Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6
Linus Torvalds [Wed, 16 Mar 2011 23:29:25 +0000 (16:29 -0700)]
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1480 commits)
  bonding: enable netpoll without checking link status
  xfrm: Refcount destination entry on xfrm_lookup
  net: introduce rx_handler results and logic around that
  bonding: get rid of IFF_SLAVE_INACTIVE netdev->priv_flag
  bonding: wrap slave state work
  net: get rid of multiple bond-related netdevice->priv_flags
  bonding: register slave pointer for rx_handler
  be2net: Bump up the version number
  be2net: Copyright notice change. Update to Emulex instead of ServerEngines
  e1000e: fix kconfig for crc32 dependency
  netfilter ebtables: fix xt_AUDIT to work with ebtables
  xen network backend driver
  bonding: Improve syslog message at device creation time
  bonding: Call netif_carrier_off after register_netdevice
  bonding: Incorrect TX queue offset
  net_sched: fix ip_tos2prio
  xfrm: fix __xfrm_route_forward()
  be2net: Fix UDP packet detected status in RX compl
  Phonet: fix aligned-mode pipe socket buffer header reserve
  netxen: support for GbE port settings
  ...

Fix up conflicts in drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
with the staging updates.

19 files changed:
1  2 
Documentation/feature-removal-schedule.txt
MAINTAINERS
drivers/infiniband/hw/cxgb4/cm.c
drivers/net/e1000e/netdev.c
drivers/net/wireless/ipw2x00/ipw2100.c
drivers/net/wireless/ipw2x00/ipw2200.h
drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
drivers/staging/brcm80211/brcmsmac/wlc_main.c
drivers/staging/pohmelfs/config.c
drivers/xen/events.c
include/linux/security.h
include/xen/events.h
net/unix/af_unix.c
security/capability.c
security/commoncap.c
security/security.c
security/selinux/hooks.c
security/selinux/xfrm.c

@@@ -619,3 -637,12 +637,11 @@@ Why:     The original implementation of mem
  Who:  Michal Hocko <mhocko@suse.cz>
  
  ----------------------------
+ What: ipt_addrtype match include file
+ When: 2012
+ Why:  superseded by xt_addrtype
+ Who:  Florian Westphal <fw@strlen.de>
+ Files:        include/linux/netfilter_ipv4/ipt_addrtype.h
 ->>>>>>> 2f5dc63123905a89d4260ab8ee08d19ec104db04
+ ----------------------------
diff --cc MAINTAINERS
Simple merge
Simple merge
Simple merge
index 66708d8,0000000..774b4e9
mode 100644,000000..100644
--- /dev/null
@@@ -1,1979 -1,0 +1,1954 @@@
 +/*
 + * Copyright (c) 2010 Broadcom Corporation
 + *
 + * Permission to use, copy, modify, and/or distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
 + * copyright notice and this permission notice appear in all copies.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 + */
 +
 +#define __UNDEF_NO_VERSION__
 +
 +#include <linux/kernel.h>
 +#include <linux/etherdevice.h>
 +#include <linux/types.h>
 +#include <linux/pci_ids.h>
 +#include <linux/module.h>
 +#include <linux/pci.h>
 +#include <linux/sched.h>
 +#include <linux/firmware.h>
 +#include <net/mac80211.h>
 +
 +#include <proto/802.11.h>
 +#include <bcmdefs.h>
 +#include <bcmwifi.h>
 +#include <bcmutils.h>
 +#include <pcicfg.h>
 +#include <wlioctl.h>
 +#include <sbhnddma.h>
 +
 +#include "phy/wlc_phy_int.h"
 +#include "d11.h"
 +#include "wlc_types.h"
 +#include "wlc_cfg.h"
 +#include "phy/phy_version.h"
 +#include "wlc_key.h"
 +#include "wlc_channel.h"
 +#include "wlc_scb.h"
 +#include "wlc_pub.h"
 +#include "wl_dbg.h"
 +#include "wl_export.h"
 +#include "wl_ucode.h"
 +#include "wl_mac80211.h"
 +
 +static void wl_timer(unsigned long data);
 +static void _wl_timer(struct wl_timer *t);
 +
 +
 +static int ieee_hw_init(struct ieee80211_hw *hw);
 +static int ieee_hw_rate_init(struct ieee80211_hw *hw);
 +
 +static int wl_linux_watchdog(void *ctx);
 +
 +/* Flags we support */
 +#define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
 +      FIF_ALLMULTI | \
 +      FIF_FCSFAIL | \
 +      FIF_PLCPFAIL | \
 +      FIF_CONTROL | \
 +      FIF_OTHER_BSS | \
 +      FIF_BCN_PRBRESP_PROMISC)
 +
 +static int wl_found;
 +
 +#define WL_DEV_IF(dev)                ((struct wl_if *)netdev_priv(dev))
 +#define       WL_INFO(dev)            ((struct wl_info *)(WL_DEV_IF(dev)->wl))
 +static int wl_request_fw(struct wl_info *wl, struct pci_dev *pdev);
 +static void wl_release_fw(struct wl_info *wl);
 +
 +/* local prototypes */
- static int wl_start(struct sk_buff *skb, struct wl_info *wl);
- static int wl_start_int(struct wl_info *wl, struct ieee80211_hw *hw,
-                       struct sk_buff *skb);
 +static void wl_dpc(unsigned long data);
 +static irqreturn_t wl_isr(int irq, void *dev_id);
 +
 +static int __devinit wl_pci_probe(struct pci_dev *pdev,
 +                                const struct pci_device_id *ent);
 +static void wl_remove(struct pci_dev *pdev);
 +static void wl_free(struct wl_info *wl);
 +
 +MODULE_AUTHOR("Broadcom Corporation");
 +MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN driver.");
 +MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN cards");
 +MODULE_LICENSE("Dual BSD/GPL");
 +
 +/* recognized PCI IDs */
 +static struct pci_device_id wl_id_table[] = {
 +      {PCI_VENDOR_ID_BROADCOM, 0x4357, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},      /* 43225 2G */
 +      {PCI_VENDOR_ID_BROADCOM, 0x4353, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},      /* 43224 DUAL */
 +      {PCI_VENDOR_ID_BROADCOM, 0x4727, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},      /* 4313 DUAL */
 +      {0}
 +};
 +
 +MODULE_DEVICE_TABLE(pci, wl_id_table);
 +
 +#ifdef BCMDBG
 +static int msglevel = 0xdeadbeef;
 +module_param(msglevel, int, 0);
 +static int phymsglevel = 0xdeadbeef;
 +module_param(phymsglevel, int, 0);
 +#endif                                /* BCMDBG */
 +
 +#define HW_TO_WL(hw)   (hw->priv)
 +#define WL_TO_HW(wl)    (wl->pub->ieee_hw)
 +
 +/* MAC80211 callback functions */
- static int wl_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 +static int wl_ops_start(struct ieee80211_hw *hw);
 +static void wl_ops_stop(struct ieee80211_hw *hw);
 +static int wl_ops_add_interface(struct ieee80211_hw *hw,
 +                              struct ieee80211_vif *vif);
 +static void wl_ops_remove_interface(struct ieee80211_hw *hw,
 +                                  struct ieee80211_vif *vif);
 +static int wl_ops_config(struct ieee80211_hw *hw, u32 changed);
 +static void wl_ops_bss_info_changed(struct ieee80211_hw *hw,
 +                                  struct ieee80211_vif *vif,
 +                                  struct ieee80211_bss_conf *info,
 +                                  u32 changed);
 +static void wl_ops_configure_filter(struct ieee80211_hw *hw,
 +                                  unsigned int changed_flags,
 +                                  unsigned int *total_flags, u64 multicast);
 +static int wl_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
 +                        bool set);
 +static void wl_ops_sw_scan_start(struct ieee80211_hw *hw);
 +static void wl_ops_sw_scan_complete(struct ieee80211_hw *hw);
 +static void wl_ops_set_tsf(struct ieee80211_hw *hw, u64 tsf);
 +static int wl_ops_get_stats(struct ieee80211_hw *hw,
 +                          struct ieee80211_low_level_stats *stats);
 +static int wl_ops_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
 +static void wl_ops_sta_notify(struct ieee80211_hw *hw,
 +                            struct ieee80211_vif *vif,
 +                            enum sta_notify_cmd cmd,
 +                            struct ieee80211_sta *sta);
 +static int wl_ops_conf_tx(struct ieee80211_hw *hw, u16 queue,
 +                        const struct ieee80211_tx_queue_params *params);
 +static u64 wl_ops_get_tsf(struct ieee80211_hw *hw);
 +static int wl_ops_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +                    struct ieee80211_sta *sta);
 +static int wl_ops_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +                       struct ieee80211_sta *sta);
 +static int wl_ops_ampdu_action(struct ieee80211_hw *hw,
 +                             struct ieee80211_vif *vif,
 +                             enum ieee80211_ampdu_mlme_action action,
 +                             struct ieee80211_sta *sta, u16 tid, u16 *ssn,
 +                             u8 buf_size);
 +static void wl_ops_rfkill_poll(struct ieee80211_hw *hw);
 +
- static int wl_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
++static void wl_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 +{
-       int status;
 +      struct wl_info *wl = hw->priv;
 +
 +      WL_LOCK(wl);
 +      if (!wl->pub->up) {
 +              WL_ERROR("ops->tx called while down\n");
-               status = -ENETDOWN;
++              kfree_skb(skb);
 +              goto done;
 +      }
-       status = wl_start(skb, wl);
++      wlc_sendpkt_mac80211(wl->wlc, skb, hw);
 + done:
 +      WL_UNLOCK(wl);
-       return status;
 +}
 +
 +static int wl_ops_start(struct ieee80211_hw *hw)
 +{
 +      struct wl_info *wl = hw->priv;
 +      bool blocked;
 +      /*
 +        struct ieee80211_channel *curchan = hw->conf.channel;
 +        WL_NONE("%s : Initial channel: %d\n", __func__, curchan->hw_value);
 +      */
 +
 +      ieee80211_wake_queues(hw);
 +      WL_LOCK(wl);
 +      blocked = wl_rfkill_set_hw_state(wl);
 +      WL_UNLOCK(wl);
 +      if (!blocked)
 +              wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
 +
 +      return 0;
 +}
 +
 +static void wl_ops_stop(struct ieee80211_hw *hw)
 +{
 +#ifdef BRCMDBG
 +      struct wl_info *wl = hw->priv;
 +      ASSERT(wl);
 +#endif /*BRCMDBG*/
 +      ieee80211_stop_queues(hw);
 +}
 +
 +static int
 +wl_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 +{
 +      struct wl_info *wl;
 +      int err;
 +
 +      /* Just STA for now */
 +      if (vif->type != NL80211_IFTYPE_AP &&
 +          vif->type != NL80211_IFTYPE_MESH_POINT &&
 +          vif->type != NL80211_IFTYPE_STATION &&
 +          vif->type != NL80211_IFTYPE_WDS &&
 +          vif->type != NL80211_IFTYPE_ADHOC) {
 +              WL_ERROR("%s: Attempt to add type %d, only STA for now\n",
 +                       __func__, vif->type);
 +              return -EOPNOTSUPP;
 +      }
 +
 +      wl = HW_TO_WL(hw);
 +      WL_LOCK(wl);
 +      err = wl_up(wl);
 +      WL_UNLOCK(wl);
 +
 +      if (err != 0) {
 +              WL_ERROR("%s: wl_up() returned %d\n", __func__, err);
 +      }
 +      return err;
 +}
 +
 +static void
 +wl_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 +{
 +      struct wl_info *wl;
 +
 +      wl = HW_TO_WL(hw);
 +
 +      /* put driver in down state */
 +      WL_LOCK(wl);
 +      wl_down(wl);
 +      WL_UNLOCK(wl);
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +static int
 +ieee_set_channel(struct ieee80211_hw *hw, struct ieee80211_channel *chan,
 +               enum nl80211_channel_type type)
 +{
 +      struct wl_info *wl = HW_TO_WL(hw);
 +      int err = 0;
 +
 +      switch (type) {
 +      case NL80211_CHAN_HT20:
 +      case NL80211_CHAN_NO_HT:
 +              err = wlc_set(wl->wlc, WLC_SET_CHANNEL, chan->hw_value);
 +              break;
 +      case NL80211_CHAN_HT40MINUS:
 +      case NL80211_CHAN_HT40PLUS:
 +              WL_ERROR("%s: Need to implement 40 Mhz Channels!\n", __func__);
 +              err = 1;
 +              break;
 +      }
 +
 +      if (err)
 +              return -EIO;
 +      return err;
 +}
 +
 +static int wl_ops_config(struct ieee80211_hw *hw, u32 changed)
 +{
 +      struct ieee80211_conf *conf = &hw->conf;
 +      struct wl_info *wl = HW_TO_WL(hw);
 +      int err = 0;
 +      int new_int;
 +
 +      WL_LOCK(wl);
 +      if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
 +              if (wlc_iovar_setint
 +                  (wl->wlc, "bcn_li_bcn", conf->listen_interval)) {
 +                      WL_ERROR("%s: Error setting listen_interval\n",
 +                               __func__);
 +                      err = -EIO;
 +                      goto config_out;
 +              }
 +              wlc_iovar_getint(wl->wlc, "bcn_li_bcn", &new_int);
 +              ASSERT(new_int == conf->listen_interval);
 +      }
 +      if (changed & IEEE80211_CONF_CHANGE_MONITOR)
 +              WL_ERROR("%s: change monitor mode: %s (implement)\n", __func__,
 +                       conf->flags & IEEE80211_CONF_MONITOR ?
 +                              "true" : "false");
 +      if (changed & IEEE80211_CONF_CHANGE_PS)
 +              WL_ERROR("%s: change power-save mode: %s (implement)\n",
 +                       __func__, conf->flags & IEEE80211_CONF_PS ?
 +                              "true" : "false");
 +
 +      if (changed & IEEE80211_CONF_CHANGE_POWER) {
 +              if (wlc_iovar_setint
 +                  (wl->wlc, "qtxpower", conf->power_level * 4)) {
 +                      WL_ERROR("%s: Error setting power_level\n", __func__);
 +                      err = -EIO;
 +                      goto config_out;
 +              }
 +              wlc_iovar_getint(wl->wlc, "qtxpower", &new_int);
 +              if (new_int != (conf->power_level * 4))
 +                      WL_ERROR("%s: Power level req != actual, %d %d\n",
 +                               __func__, conf->power_level * 4, new_int);
 +      }
 +      if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
 +              err = ieee_set_channel(hw, conf->channel, conf->channel_type);
 +      }
 +      if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
 +              if (wlc_set
 +                  (wl->wlc, WLC_SET_SRL,
 +                   conf->short_frame_max_tx_count) < 0) {
 +                      WL_ERROR("%s: Error setting srl\n", __func__);
 +                      err = -EIO;
 +                      goto config_out;
 +              }
 +              if (wlc_set(wl->wlc, WLC_SET_LRL, conf->long_frame_max_tx_count)
 +                  < 0) {
 +                      WL_ERROR("%s: Error setting lrl\n", __func__);
 +                      err = -EIO;
 +                      goto config_out;
 +              }
 +      }
 +
 + config_out:
 +      WL_UNLOCK(wl);
 +      return err;
 +}
 +
 +static void
 +wl_ops_bss_info_changed(struct ieee80211_hw *hw,
 +                      struct ieee80211_vif *vif,
 +                      struct ieee80211_bss_conf *info, u32 changed)
 +{
 +      struct wl_info *wl = HW_TO_WL(hw);
 +      int val;
 +
 +      if (changed & BSS_CHANGED_ASSOC) {
 +              /* association status changed (associated/disassociated)
 +               * also implies a change in the AID.
 +               */
 +              WL_ERROR("%s: %s: %sassociated\n", KBUILD_MODNAME, __func__,
 +                       info->assoc ? "" : "dis");
 +              wlc_associate_upd(wl->wlc, info->assoc);
 +      }
 +      if (changed & BSS_CHANGED_ERP_CTS_PROT) {
 +              /* CTS protection changed */
 +              WL_ERROR("%s: use_cts_prot: %s (implement)\n", __func__,
 +                      info->use_cts_prot ? "true" : "false");
 +      }
 +      if (changed & BSS_CHANGED_ERP_PREAMBLE) {
 +              /* preamble changed */
 +              WL_ERROR("%s: short preamble: %s (implement)\n", __func__,
 +                      info->use_short_preamble ? "true" : "false");
 +      }
 +      if (changed & BSS_CHANGED_ERP_SLOT) {
 +              /* slot timing changed */
 +              if (info->use_short_slot)
 +                      val = 1;
 +              else
 +                      val = 0;
 +              WL_LOCK(wl);
 +              wlc_set(wl->wlc, WLC_SET_SHORTSLOT_OVERRIDE, val);
 +              WL_UNLOCK(wl);
 +      }
 +
 +      if (changed & BSS_CHANGED_HT) {
 +              /* 802.11n parameters changed */
 +              u16 mode = info->ht_operation_mode;
 +              WL_NONE("%s: HT mode: 0x%04X\n", __func__, mode);
 +              wlc_protection_upd(wl->wlc, WLC_PROT_N_CFG,
 +                      mode & IEEE80211_HT_OP_MODE_PROTECTION);
 +              wlc_protection_upd(wl->wlc, WLC_PROT_N_NONGF,
 +                      mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
 +              wlc_protection_upd(wl->wlc, WLC_PROT_N_OBSS,
 +                      mode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT);
 +      }
 +      if (changed & BSS_CHANGED_BASIC_RATES) {
 +              /* Basic rateset changed */
 +              WL_ERROR("%s: Need to change Basic Rates: 0x%x (implement)\n",
 +                       __func__, (u32) info->basic_rates);
 +      }
 +      if (changed & BSS_CHANGED_BEACON_INT) {
 +              /* Beacon interval changed */
 +              WL_NONE("%s: Beacon Interval: %d\n",
 +                      __func__, info->beacon_int);
 +              wlc_set(wl->wlc, WLC_SET_BCNPRD, info->beacon_int);
 +      }
 +      if (changed & BSS_CHANGED_BSSID) {
 +              /* BSSID changed, for whatever reason (IBSS and managed mode) */
 +              WL_NONE("%s: new BSSID: aid %d  bss:%pM\n", __func__,
 +                      info->aid, info->bssid);
 +              WL_LOCK(wl);
 +              wlc_set_addrmatch(wl->wlc, RCM_BSSID_OFFSET,
 +                                info->bssid);
 +              WL_UNLOCK(wl);
 +      }
 +      if (changed & BSS_CHANGED_BEACON) {
 +              /* Beacon data changed, retrieve new beacon (beaconing modes) */
 +              WL_ERROR("%s: beacon changed\n", __func__);
 +      }
 +      if (changed & BSS_CHANGED_BEACON_ENABLED) {
 +              /* Beaconing should be enabled/disabled (beaconing modes) */
 +              WL_ERROR("%s: Beacon enabled: %s\n", __func__,
 +                       info->enable_beacon ? "true" : "false");
 +      }
 +      if (changed & BSS_CHANGED_CQM) {
 +              /* Connection quality monitor config changed */
 +              WL_ERROR("%s: cqm change: threshold %d, hys %d (implement)\n",
 +                      __func__, info->cqm_rssi_thold, info->cqm_rssi_hyst);
 +      }
 +      if (changed & BSS_CHANGED_IBSS) {
 +              /* IBSS join status changed */
 +              WL_ERROR("%s: IBSS joined: %s (implement)\n", __func__,
 +                      info->ibss_joined ? "true" : "false");
 +      }
 +      if (changed & BSS_CHANGED_ARP_FILTER) {
 +              /* Hardware ARP filter address list or state changed */
 +              WL_ERROR("%s: arp filtering: enabled %s, count %d (implement)\n",
 +                      __func__, info->arp_filter_enabled ? "true" : "false",
 +                      info->arp_addr_cnt);
 +      }
 +      if (changed & BSS_CHANGED_QOS) {
 +              /*
 +               * QoS for this association was enabled/disabled.
 +               * Note that it is only ever disabled for station mode.
 +               */
 +              WL_ERROR("%s: qos enabled: %s (implement)\n", __func__,
 +                      info->qos ? "true" : "false");
 +      }
 +      if (changed & BSS_CHANGED_IDLE) {
 +              /* Idle changed for this BSS/interface */
 +              WL_ERROR("%s: BSS idle: %s (implement)\n", __func__,
 +                      info->idle ? "true" : "false");
 +      }
 +      return;
 +}
 +
 +static void
 +wl_ops_configure_filter(struct ieee80211_hw *hw,
 +                      unsigned int changed_flags,
 +                      unsigned int *total_flags, u64 multicast)
 +{
 +      struct wl_info *wl = hw->priv;
 +
 +      changed_flags &= MAC_FILTERS;
 +      *total_flags &= MAC_FILTERS;
 +      if (changed_flags & FIF_PROMISC_IN_BSS)
 +              WL_ERROR("FIF_PROMISC_IN_BSS\n");
 +      if (changed_flags & FIF_ALLMULTI)
 +              WL_ERROR("FIF_ALLMULTI\n");
 +      if (changed_flags & FIF_FCSFAIL)
 +              WL_ERROR("FIF_FCSFAIL\n");
 +      if (changed_flags & FIF_PLCPFAIL)
 +              WL_ERROR("FIF_PLCPFAIL\n");
 +      if (changed_flags & FIF_CONTROL)
 +              WL_ERROR("FIF_CONTROL\n");
 +      if (changed_flags & FIF_OTHER_BSS)
 +              WL_ERROR("FIF_OTHER_BSS\n");
 +      if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
 +              WL_NONE("FIF_BCN_PRBRESP_PROMISC\n");
 +              WL_LOCK(wl);
 +              if (*total_flags & FIF_BCN_PRBRESP_PROMISC) {
 +                      wl->pub->mac80211_state |= MAC80211_PROMISC_BCNS;
 +                      wlc_mac_bcn_promisc_change(wl->wlc, 1);
 +              } else {
 +                      wlc_mac_bcn_promisc_change(wl->wlc, 0);
 +                      wl->pub->mac80211_state &= ~MAC80211_PROMISC_BCNS;
 +              }
 +              WL_UNLOCK(wl);
 +      }
 +      return;
 +}
 +
 +static int
 +wl_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta, bool set)
 +{
 +      WL_NONE("%s: Enter\n", __func__);
 +      return 0;
 +}
 +
 +static void wl_ops_sw_scan_start(struct ieee80211_hw *hw)
 +{
 +      struct wl_info *wl = hw->priv;
 +      WL_NONE("Scan Start\n");
 +      WL_LOCK(wl);
 +      wlc_scan_start(wl->wlc);
 +      WL_UNLOCK(wl);
 +      return;
 +}
 +
 +static void wl_ops_sw_scan_complete(struct ieee80211_hw *hw)
 +{
 +      struct wl_info *wl = hw->priv;
 +      WL_NONE("Scan Complete\n");
 +      WL_LOCK(wl);
 +      wlc_scan_stop(wl->wlc);
 +      WL_UNLOCK(wl);
 +      return;
 +}
 +
 +static void wl_ops_set_tsf(struct ieee80211_hw *hw, u64 tsf)
 +{
 +      WL_ERROR("%s: Enter\n", __func__);
 +      return;
 +}
 +
 +static int
 +wl_ops_get_stats(struct ieee80211_hw *hw,
 +               struct ieee80211_low_level_stats *stats)
 +{
 +      struct wl_info *wl = hw->priv;
 +      struct wl_cnt *cnt;
 +
 +      WL_LOCK(wl);
 +      cnt = wl->pub->_cnt;
 +      stats->dot11ACKFailureCount = cnt->txnoack;
 +      stats->dot11RTSFailureCount = cnt->txnocts;
 +      stats->dot11FCSErrorCount = cnt->rxcrc;
 +      stats->dot11RTSSuccessCount = cnt->txrts;
 +      WL_UNLOCK(wl);
 +      return 0;
 +}
 +
 +static int wl_ops_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
 +{
 +      struct wl_info *wl = hw->priv;
 +
 +      WL_LOCK(wl);
 +      wlc_iovar_setint(wl->wlc, "rtsthresh", value & 0xFFFF);
 +      WL_UNLOCK(wl);
 +      return 0;
 +}
 +
 +static void
 +wl_ops_sta_notify(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +                enum sta_notify_cmd cmd, struct ieee80211_sta *sta)
 +{
 +      WL_NONE("%s: Enter\n", __func__);
 +      switch (cmd) {
 +      default:
 +              WL_ERROR("%s: Unknown cmd = %d\n", __func__, cmd);
 +              break;
 +      }
 +      return;
 +}
 +
 +static int
 +wl_ops_conf_tx(struct ieee80211_hw *hw, u16 queue,
 +             const struct ieee80211_tx_queue_params *params)
 +{
 +      struct wl_info *wl = hw->priv;
 +
 +      WL_NONE("%s: Enter (WME config)\n", __func__);
 +      WL_NONE("queue %d, txop %d, cwmin %d, cwmax %d, aifs %d\n", queue,
 +               params->txop, params->cw_min, params->cw_max, params->aifs);
 +
 +      WL_LOCK(wl);
 +      wlc_wme_setparams(wl->wlc, queue, (void *)params, true);
 +      WL_UNLOCK(wl);
 +
 +      return 0;
 +}
 +
 +static u64 wl_ops_get_tsf(struct ieee80211_hw *hw)
 +{
 +      WL_ERROR("%s: Enter\n", __func__);
 +      return 0;
 +}
 +
 +static int
 +wl_ops_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +             struct ieee80211_sta *sta)
 +{
 +      struct scb *scb;
 +
 +      int i;
 +      struct wl_info *wl = hw->priv;
 +
 +      /* Init the scb */
 +      scb = (struct scb *)sta->drv_priv;
 +      memset(scb, 0, sizeof(struct scb));
 +      for (i = 0; i < NUMPRIO; i++)
 +              scb->seqctl[i] = 0xFFFF;
 +      scb->seqctl_nonqos = 0xFFFF;
 +      scb->magic = SCB_MAGIC;
 +
 +      wl->pub->global_scb = scb;
 +      wl->pub->global_ampdu = &(scb->scb_ampdu);
 +      wl->pub->global_ampdu->scb = scb;
 +      wl->pub->global_ampdu->max_pdu = 16;
 +      pktq_init(&scb->scb_ampdu.txq, AMPDU_MAX_SCB_TID,
 +                AMPDU_MAX_SCB_TID * PKTQ_LEN_DEFAULT);
 +
 +      sta->ht_cap.ht_supported = true;
 +      sta->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
 +      sta->ht_cap.ampdu_density = AMPDU_DEF_MPDU_DENSITY;
 +      sta->ht_cap.cap = IEEE80211_HT_CAP_GRN_FLD |
 +          IEEE80211_HT_CAP_SGI_20 |
 +          IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_40MHZ_INTOLERANT;
 +
 +      /* minstrel_ht initiates addBA on our behalf by calling ieee80211_start_tx_ba_session() */
 +      return 0;
 +}
 +
 +static int
 +wl_ops_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 +                struct ieee80211_sta *sta)
 +{
 +      WL_NONE("%s: Enter\n", __func__);
 +      return 0;
 +}
 +
 +static int
 +wl_ops_ampdu_action(struct ieee80211_hw *hw,
 +                  struct ieee80211_vif *vif,
 +                  enum ieee80211_ampdu_mlme_action action,
 +                  struct ieee80211_sta *sta, u16 tid, u16 *ssn,
 +                  u8 buf_size)
 +{
 +#if defined(BCMDBG)
 +      struct scb *scb = (struct scb *)sta->drv_priv;
 +#endif
 +      struct wl_info *wl = hw->priv;
 +      int status;
 +
 +      ASSERT(scb->magic == SCB_MAGIC);
 +      switch (action) {
 +      case IEEE80211_AMPDU_RX_START:
 +              WL_NONE("%s: action = IEEE80211_AMPDU_RX_START\n", __func__);
 +              break;
 +      case IEEE80211_AMPDU_RX_STOP:
 +              WL_NONE("%s: action = IEEE80211_AMPDU_RX_STOP\n", __func__);
 +              break;
 +      case IEEE80211_AMPDU_TX_START:
 +              WL_LOCK(wl);
 +              status = wlc_aggregatable(wl->wlc, tid);
 +              WL_UNLOCK(wl);
 +              if (!status) {
 +                      /* WL_ERROR("START: tid %d is not agg' able, return FAILURE to stack\n", tid); */
 +                      return -1;
 +              }
 +              /* XXX: Use the starting sequence number provided ... */
 +              *ssn = 0;
 +              ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
 +              break;
 +
 +      case IEEE80211_AMPDU_TX_STOP:
 +              WL_LOCK(wl);
 +              wlc_ampdu_flush(wl->wlc, sta, tid);
 +              WL_UNLOCK(wl);
 +              ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
 +              break;
 +      case IEEE80211_AMPDU_TX_OPERATIONAL:
 +              /* Not sure what to do here */
 +              /* Power save wakeup */
 +              WL_NONE("%s: action = IEEE80211_AMPDU_TX_OPERATIONAL\n",
 +                      __func__);
 +              break;
 +      default:
 +              WL_ERROR("%s: Invalid command, ignoring\n", __func__);
 +      }
 +
 +      return 0;
 +}
 +
 +static void wl_ops_rfkill_poll(struct ieee80211_hw *hw)
 +{
 +      struct wl_info *wl = HW_TO_WL(hw);
 +      bool blocked;
 +
 +      WL_LOCK(wl);
 +      blocked = wlc_check_radio_disabled(wl->wlc);
 +      WL_UNLOCK(wl);
 +
 +      WL_NONE("wl: rfkill_poll: %d\n", blocked);
 +      wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 +}
 +
 +static const struct ieee80211_ops wl_ops = {
 +      .tx = wl_ops_tx,
 +      .start = wl_ops_start,
 +      .stop = wl_ops_stop,
 +      .add_interface = wl_ops_add_interface,
 +      .remove_interface = wl_ops_remove_interface,
 +      .config = wl_ops_config,
 +      .bss_info_changed = wl_ops_bss_info_changed,
 +      .configure_filter = wl_ops_configure_filter,
 +      .set_tim = wl_ops_set_tim,
 +      .sw_scan_start = wl_ops_sw_scan_start,
 +      .sw_scan_complete = wl_ops_sw_scan_complete,
 +      .set_tsf = wl_ops_set_tsf,
 +      .get_stats = wl_ops_get_stats,
 +      .set_rts_threshold = wl_ops_set_rts_threshold,
 +      .sta_notify = wl_ops_sta_notify,
 +      .conf_tx = wl_ops_conf_tx,
 +      .get_tsf = wl_ops_get_tsf,
 +      .sta_add = wl_ops_sta_add,
 +      .sta_remove = wl_ops_sta_remove,
 +      .ampdu_action = wl_ops_ampdu_action,
 +      .rfkill_poll = wl_ops_rfkill_poll,
 +};
 +
 +/*
 + * is called in wl_pci_probe() context, therefore no locking required.
 + */
 +static int wl_set_hint(struct wl_info *wl, char *abbrev)
 +{
 +      WL_NONE("%s: Sending country code %c%c to MAC80211\n",
 +               __func__, abbrev[0], abbrev[1]);
 +      return regulatory_hint(wl->pub->ieee_hw->wiphy, abbrev);
 +}
 +
 +/**
 + * attach to the WL device.
 + *
 + * Attach to the WL device identified by vendor and device parameters.
 + * regs is a host accessible memory address pointing to WL device registers.
 + *
 + * wl_attach is not defined as static because in the case where no bus
 + * is defined, wl_attach will never be called, and thus, gcc will issue
 + * a warning that this function is defined but not used if we declare
 + * it as static.
 + *
 + *
 + * is called in wl_pci_probe() context, therefore no locking required.
 + */
 +static struct wl_info *wl_attach(u16 vendor, u16 device, unsigned long regs,
 +                          uint bustype, void *btparam, uint irq)
 +{
 +      struct wl_info *wl;
 +      int unit, err;
 +
 +      unsigned long base_addr;
 +      struct ieee80211_hw *hw;
 +      u8 perm[ETH_ALEN];
 +
 +      unit = wl_found;
 +      err = 0;
 +
 +      if (unit < 0) {
 +              WL_ERROR("wl%d: unit number overflow, exiting\n", unit);
 +              return NULL;
 +      }
 +
 +      /* allocate private info */
 +      hw = pci_get_drvdata(btparam);  /* btparam == pdev */
 +      wl = hw->priv;
 +      ASSERT(wl);
 +
 +      atomic_set(&wl->callbacks, 0);
 +
 +      /* setup the bottom half handler */
 +      tasklet_init(&wl->tasklet, wl_dpc, (unsigned long) wl);
 +
 +
 +
 +      base_addr = regs;
 +
 +      if (bustype == PCI_BUS) {
 +              wl->piomode = false;
 +      } else if (bustype == RPC_BUS) {
 +              /* Do nothing */
 +      } else {
 +              bustype = PCI_BUS;
 +              WL_TRACE("force to PCI\n");
 +      }
 +      wl->bcm_bustype = bustype;
 +
 +      wl->regsva = ioremap_nocache(base_addr, PCI_BAR0_WINSZ);
 +      if (wl->regsva == NULL) {
 +              WL_ERROR("wl%d: ioremap() failed\n", unit);
 +              goto fail;
 +      }
 +      spin_lock_init(&wl->lock);
 +      spin_lock_init(&wl->isr_lock);
 +
 +      /* prepare ucode */
 +      if (wl_request_fw(wl, (struct pci_dev *)btparam) < 0) {
 +              WL_ERROR("%s: Failed to find firmware usually in %s\n",
 +                       KBUILD_MODNAME, "/lib/firmware/brcm");
 +              wl_release_fw(wl);
 +              wl_remove((struct pci_dev *)btparam);
 +              goto fail1;
 +      }
 +
 +      /* common load-time initialization */
 +      wl->wlc = wlc_attach((void *)wl, vendor, device, unit, wl->piomode,
 +                           wl->regsva, wl->bcm_bustype, btparam, &err);
 +      wl_release_fw(wl);
 +      if (!wl->wlc) {
 +              WL_ERROR("%s: wlc_attach() failed with code %d\n",
 +                       KBUILD_MODNAME, err);
 +              goto fail;
 +      }
 +      wl->pub = wlc_pub(wl->wlc);
 +
 +      wl->pub->ieee_hw = hw;
 +      ASSERT(wl->pub->ieee_hw);
 +      ASSERT(wl->pub->ieee_hw->priv == wl);
 +
 +
 +      if (wlc_iovar_setint(wl->wlc, "mpc", 0)) {
 +              WL_ERROR("wl%d: Error setting MPC variable to 0\n", unit);
 +      }
 +
 +      /* register our interrupt handler */
 +      if (request_irq(irq, wl_isr, IRQF_SHARED, KBUILD_MODNAME, wl)) {
 +              WL_ERROR("wl%d: request_irq() failed\n", unit);
 +              goto fail;
 +      }
 +      wl->irq = irq;
 +
 +      /* register module */
 +      wlc_module_register(wl->pub, NULL, "linux", wl, NULL, wl_linux_watchdog,
 +                          NULL);
 +
 +      if (ieee_hw_init(hw)) {
 +              WL_ERROR("wl%d: %s: ieee_hw_init failed!\n", unit, __func__);
 +              goto fail;
 +      }
 +
 +      memcpy(perm, &wl->pub->cur_etheraddr, ETH_ALEN);
 +      ASSERT(is_valid_ether_addr(perm));
 +      SET_IEEE80211_PERM_ADDR(hw, perm);
 +
 +      err = ieee80211_register_hw(hw);
 +      if (err) {
 +              WL_ERROR("%s: ieee80211_register_hw failed, status %d\n",
 +                       __func__, err);
 +      }
 +
 +      if (wl->pub->srom_ccode[0])
 +              err = wl_set_hint(wl, wl->pub->srom_ccode);
 +      else
 +              err = wl_set_hint(wl, "US");
 +      if (err) {
 +              WL_ERROR("%s: regulatory_hint failed, status %d\n",
 +                       __func__, err);
 +      }
 +
 +      wl_found++;
 +      return wl;
 +
 +fail:
 +      wl_free(wl);
 +fail1:
 +      return NULL;
 +}
 +
 +
 +
 +#define CHAN2GHZ(channel, freqency, chflags)  { \
 +      .band = IEEE80211_BAND_2GHZ, \
 +      .center_freq = (freqency), \
 +      .hw_value = (channel), \
 +      .flags = chflags, \
 +      .max_antenna_gain = 0, \
 +      .max_power = 19, \
 +}
 +
 +static struct ieee80211_channel wl_2ghz_chantable[] = {
 +      CHAN2GHZ(1, 2412, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN2GHZ(2, 2417, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN2GHZ(3, 2422, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN2GHZ(4, 2427, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN2GHZ(5, 2432, 0),
 +      CHAN2GHZ(6, 2437, 0),
 +      CHAN2GHZ(7, 2442, 0),
 +      CHAN2GHZ(8, 2447, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(9, 2452, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(10, 2457, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(11, 2462, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(12, 2467,
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(13, 2472,
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN2GHZ(14, 2484,
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
 +};
 +
 +#define CHAN5GHZ(channel, chflags)  { \
 +      .band = IEEE80211_BAND_5GHZ, \
 +      .center_freq = 5000 + 5*(channel), \
 +      .hw_value = (channel), \
 +      .flags = chflags, \
 +      .max_antenna_gain = 0, \
 +      .max_power = 21, \
 +}
 +
 +static struct ieee80211_channel wl_5ghz_nphy_chantable[] = {
 +      /* UNII-1 */
 +      CHAN5GHZ(36, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(40, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(44, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(48, IEEE80211_CHAN_NO_HT40PLUS),
 +      /* UNII-2 */
 +      CHAN5GHZ(52,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(56,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(60,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(64,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      /* MID */
 +      CHAN5GHZ(100,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(104,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(108,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(112,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(116,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(120,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(124,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(128,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(132,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(136,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(140,
 +               IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
 +               IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS |
 +               IEEE80211_CHAN_NO_HT40MINUS),
 +      /* UNII-3 */
 +      CHAN5GHZ(149, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(153, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(157, IEEE80211_CHAN_NO_HT40MINUS),
 +      CHAN5GHZ(161, IEEE80211_CHAN_NO_HT40PLUS),
 +      CHAN5GHZ(165, IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
 +};
 +
 +#define RATE(rate100m, _flags) { \
 +      .bitrate = (rate100m), \
 +      .flags = (_flags), \
 +      .hw_value = (rate100m / 5), \
 +}
 +
 +static struct ieee80211_rate wl_legacy_ratetable[] = {
 +      RATE(10, 0),
 +      RATE(20, IEEE80211_RATE_SHORT_PREAMBLE),
 +      RATE(55, IEEE80211_RATE_SHORT_PREAMBLE),
 +      RATE(110, IEEE80211_RATE_SHORT_PREAMBLE),
 +      RATE(60, 0),
 +      RATE(90, 0),
 +      RATE(120, 0),
 +      RATE(180, 0),
 +      RATE(240, 0),
 +      RATE(360, 0),
 +      RATE(480, 0),
 +      RATE(540, 0),
 +};
 +
 +static struct ieee80211_supported_band wl_band_2GHz_nphy = {
 +      .band = IEEE80211_BAND_2GHZ,
 +      .channels = wl_2ghz_chantable,
 +      .n_channels = ARRAY_SIZE(wl_2ghz_chantable),
 +      .bitrates = wl_legacy_ratetable,
 +      .n_bitrates = ARRAY_SIZE(wl_legacy_ratetable),
 +      .ht_cap = {
 +                 /* from include/linux/ieee80211.h */
 +                 .cap = IEEE80211_HT_CAP_GRN_FLD |
 +                 IEEE80211_HT_CAP_SGI_20 |
 +                 IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_40MHZ_INTOLERANT,
 +                 .ht_supported = true,
 +                 .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
 +                 .ampdu_density = AMPDU_DEF_MPDU_DENSITY,
 +                 .mcs = {
 +                         /* placeholders for now */
 +                         .rx_mask = {0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0},
 +                         .rx_highest = 500,
 +                         .tx_params = IEEE80211_HT_MCS_TX_DEFINED}
 +                 }
 +};
 +
 +static struct ieee80211_supported_band wl_band_5GHz_nphy = {
 +      .band = IEEE80211_BAND_5GHZ,
 +      .channels = wl_5ghz_nphy_chantable,
 +      .n_channels = ARRAY_SIZE(wl_5ghz_nphy_chantable),
 +      .bitrates = wl_legacy_ratetable + 4,
 +      .n_bitrates = ARRAY_SIZE(wl_legacy_ratetable) - 4,
 +      .ht_cap = {
 +                 /* use IEEE80211_HT_CAP_* from include/linux/ieee80211.h */
 +                 .cap = IEEE80211_HT_CAP_GRN_FLD | IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_40MHZ_INTOLERANT,     /* No 40 mhz yet */
 +                 .ht_supported = true,
 +                 .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
 +                 .ampdu_density = AMPDU_DEF_MPDU_DENSITY,
 +                 .mcs = {
 +                         /* placeholders for now */
 +                         .rx_mask = {0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0},
 +                         .rx_highest = 500,
 +                         .tx_params = IEEE80211_HT_MCS_TX_DEFINED}
 +                 }
 +};
 +
 +/*
 + * is called in wl_pci_probe() context, therefore no locking required.
 + */
 +static int ieee_hw_rate_init(struct ieee80211_hw *hw)
 +{
 +      struct wl_info *wl = HW_TO_WL(hw);
 +      int has_5g;
 +      char phy_list[4];
 +
 +      has_5g = 0;
 +
 +      hw->wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
 +      hw->wiphy->bands[IEEE80211_BAND_5GHZ] = NULL;
 +
 +      if (wlc_get(wl->wlc, WLC_GET_PHYLIST, (int *)&phy_list) < 0) {
 +              WL_ERROR("Phy list failed\n");
 +      }
 +      WL_NONE("%s: phylist = %c\n", __func__, phy_list[0]);
 +
 +      if (phy_list[0] == 'n' || phy_list[0] == 'c') {
 +              if (phy_list[0] == 'c') {
 +                      /* Single stream */
 +                      wl_band_2GHz_nphy.ht_cap.mcs.rx_mask[1] = 0;
 +                      wl_band_2GHz_nphy.ht_cap.mcs.rx_highest = 72;
 +              }
 +              hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl_band_2GHz_nphy;
 +      } else {
 +              BUG();
 +              return -1;
 +      }
 +
 +      /* Assume all bands use the same phy.  True for 11n devices. */
 +      if (NBANDS_PUB(wl->pub) > 1) {
 +              has_5g++;
 +              if (phy_list[0] == 'n' || phy_list[0] == 'c') {
 +                      hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
 +                          &wl_band_5GHz_nphy;
 +              } else {
 +                      return -1;
 +              }
 +      }
 +
 +      WL_NONE("%s: 2ghz = %d, 5ghz = %d\n", __func__, 1, has_5g);
 +
 +      return 0;
 +}
 +
 +/*
 + * is called in wl_pci_probe() context, therefore no locking required.
 + */
 +static int ieee_hw_init(struct ieee80211_hw *hw)
 +{
 +      hw->flags = IEEE80211_HW_SIGNAL_DBM
 +          /* | IEEE80211_HW_CONNECTION_MONITOR  What is this? */
 +          | IEEE80211_HW_REPORTS_TX_ACK_STATUS
 +          | IEEE80211_HW_AMPDU_AGGREGATION;
 +
 +      hw->extra_tx_headroom = wlc_get_header_len();
 +      /* FIXME: should get this from wlc->machwcap */
 +      hw->queues = 4;
 +      /* FIXME: this doesn't seem to be used properly in minstrel_ht.
 +       * mac80211/status.c:ieee80211_tx_status() checks this value,
 +       * but mac80211/rc80211_minstrel_ht.c:minstrel_ht_get_rate()
 +       * appears to always set 3 rates
 +       */
 +      hw->max_rates = 2;      /* Primary rate and 1 fallback rate */
 +
 +      hw->channel_change_time = 7 * 1000;     /* channel change time is dependant on chip and band  */
 +      hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 +
 +      hw->rate_control_algorithm = "minstrel_ht";
 +
 +      hw->sta_data_size = sizeof(struct scb);
 +      return ieee_hw_rate_init(hw);
 +}
 +
 +/**
 + * determines if a device is a WL device, and if so, attaches it.
 + *
 + * This function determines if a device pointed to by pdev is a WL device,
 + * and if so, performs a wl_attach() on it.
 + *
 + * Perimeter lock is initialized in the course of this function.
 + */
 +static int __devinit
 +wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 +{
 +      int rc;
 +      struct wl_info *wl;
 +      struct ieee80211_hw *hw;
 +      u32 val;
 +
 +      ASSERT(pdev);
 +
 +      WL_TRACE("%s: bus %d slot %d func %d irq %d\n",
 +               __func__, pdev->bus->number, PCI_SLOT(pdev->devfn),
 +               PCI_FUNC(pdev->devfn), pdev->irq);
 +
 +      if ((pdev->vendor != PCI_VENDOR_ID_BROADCOM) ||
 +          (((pdev->device & 0xff00) != 0x4300) &&
 +           ((pdev->device & 0xff00) != 0x4700) &&
 +           ((pdev->device < 43000) || (pdev->device > 43999))))
 +              return -ENODEV;
 +
 +      rc = pci_enable_device(pdev);
 +      if (rc) {
 +              WL_ERROR("%s: Cannot enable device %d-%d_%d\n",
 +                       __func__, pdev->bus->number, PCI_SLOT(pdev->devfn),
 +                       PCI_FUNC(pdev->devfn));
 +              return -ENODEV;
 +      }
 +      pci_set_master(pdev);
 +
 +      pci_read_config_dword(pdev, 0x40, &val);
 +      if ((val & 0x0000ff00) != 0)
 +              pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 +
 +      hw = ieee80211_alloc_hw(sizeof(struct wl_info), &wl_ops);
 +      if (!hw) {
 +              WL_ERROR("%s: ieee80211_alloc_hw failed\n", __func__);
 +              rc = -ENOMEM;
 +              goto err_1;
 +      }
 +
 +      SET_IEEE80211_DEV(hw, &pdev->dev);
 +
 +      pci_set_drvdata(pdev, hw);
 +
 +      memset(hw->priv, 0, sizeof(*wl));
 +
 +      wl = wl_attach(pdev->vendor, pdev->device, pci_resource_start(pdev, 0),
 +                     PCI_BUS, pdev, pdev->irq);
 +
 +      if (!wl) {
 +              WL_ERROR("%s: %s: wl_attach failed!\n",
 +                       KBUILD_MODNAME, __func__);
 +              return -ENODEV;
 +      }
 +      return 0;
 + err_1:
 +      WL_ERROR("%s: err_1: Major hoarkage\n", __func__);
 +      return 0;
 +}
 +
 +static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
 +{
 +      struct wl_info *wl;
 +      struct ieee80211_hw *hw;
 +
 +      WL_TRACE("wl: wl_suspend\n");
 +
 +      hw = pci_get_drvdata(pdev);
 +      wl = HW_TO_WL(hw);
 +      if (!wl) {
 +              WL_ERROR("wl: wl_suspend: pci_get_drvdata failed\n");
 +              return -ENODEV;
 +      }
 +
 +      /* only need to flag hw is down for proper resume */
 +      WL_LOCK(wl);
 +      wl->pub->hw_up = false;
 +      WL_UNLOCK(wl);
 +
 +      pci_save_state(pdev);
 +      pci_disable_device(pdev);
 +      return pci_set_power_state(pdev, PCI_D3hot);
 +}
 +
 +static int wl_resume(struct pci_dev *pdev)
 +{
 +      struct wl_info *wl;
 +      struct ieee80211_hw *hw;
 +      int err = 0;
 +      u32 val;
 +
 +      WL_TRACE("wl: wl_resume\n");
 +      hw = pci_get_drvdata(pdev);
 +      wl = HW_TO_WL(hw);
 +      if (!wl) {
 +              WL_ERROR("wl: wl_resume: pci_get_drvdata failed\n");
 +              return -ENODEV;
 +      }
 +
 +      err = pci_set_power_state(pdev, PCI_D0);
 +      if (err)
 +              return err;
 +
 +      pci_restore_state(pdev);
 +
 +      err = pci_enable_device(pdev);
 +      if (err)
 +              return err;
 +
 +      pci_set_master(pdev);
 +
 +      pci_read_config_dword(pdev, 0x40, &val);
 +      if ((val & 0x0000ff00) != 0)
 +              pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 +
 +      /*
 +      *  done. driver will be put in up state
 +      *  in wl_ops_add_interface() call.
 +      */
 +      return err;
 +}
 +
 +/*
 +* called from both kernel as from wl_*()
 +* precondition: perimeter lock is not acquired.
 +*/
 +static void wl_remove(struct pci_dev *pdev)
 +{
 +      struct wl_info *wl;
 +      struct ieee80211_hw *hw;
 +      int status;
 +
 +      hw = pci_get_drvdata(pdev);
 +      wl = HW_TO_WL(hw);
 +      if (!wl) {
 +              WL_ERROR("wl: wl_remove: pci_get_drvdata failed\n");
 +              return;
 +      }
 +
 +      WL_LOCK(wl);
 +      status = wlc_chipmatch(pdev->vendor, pdev->device);
 +      WL_UNLOCK(wl);
 +      if (!status) {
 +              WL_ERROR("wl: wl_remove: wlc_chipmatch failed\n");
 +              return;
 +      }
 +      if (wl->wlc) {
 +              wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
 +              wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
 +              ieee80211_unregister_hw(hw);
 +              WL_LOCK(wl);
 +              wl_down(wl);
 +              WL_UNLOCK(wl);
 +              WL_NONE("%s: Down\n", __func__);
 +      }
 +      pci_disable_device(pdev);
 +
 +      wl_free(wl);
 +
 +      pci_set_drvdata(pdev, NULL);
 +      ieee80211_free_hw(hw);
 +}
 +
 +static struct pci_driver wl_pci_driver = {
 +      .name     = KBUILD_MODNAME,
 +      .probe    = wl_pci_probe,
 +      .suspend  = wl_suspend,
 +      .resume   = wl_resume,
 +      .remove   = __devexit_p(wl_remove),
 +      .id_table = wl_id_table,
 +};
 +
 +/**
 + * This is the main entry point for the WL driver.
 + *
 + * This function determines if a device pointed to by pdev is a WL device,
 + * and if so, performs a wl_attach() on it.
 + *
 + */
 +static int __init wl_module_init(void)
 +{
 +      int error = -ENODEV;
 +
 +#ifdef BCMDBG
 +      if (msglevel != 0xdeadbeef)
 +              wl_msg_level = msglevel;
 +      else {
 +              char *var = getvar(NULL, "wl_msglevel");
 +              if (var) {
 +                      unsigned long value;
 +
 +                      (void)strict_strtoul(var, 0, &value);
 +                      wl_msg_level = value;
 +              }
 +      }
 +      if (phymsglevel != 0xdeadbeef)
 +              phyhal_msg_level = phymsglevel;
 +      else {
 +              char *var = getvar(NULL, "phy_msglevel");
 +              if (var) {
 +                      unsigned long value;
 +
 +                      (void)strict_strtoul(var, 0, &value);
 +                      phyhal_msg_level = value;
 +              }
 +      }
 +#endif                                /* BCMDBG */
 +
 +      error = pci_register_driver(&wl_pci_driver);
 +      if (!error)
 +              return 0;
 +
 +
 +
 +      return error;
 +}
 +
 +/**
 + * This function unloads the WL driver from the system.
 + *
 + * This function unconditionally unloads the WL driver module from the
 + * system.
 + *
 + */
 +static void __exit wl_module_exit(void)
 +{
 +      pci_unregister_driver(&wl_pci_driver);
 +
 +}
 +
 +module_init(wl_module_init);
 +module_exit(wl_module_exit);
 +
 +/**
 + * This function frees the WL per-device resources.
 + *
 + * This function frees resources owned by the WL device pointed to
 + * by the wl parameter.
 + *
 + * precondition: can both be called locked and unlocked
 + *
 + */
 +static void wl_free(struct wl_info *wl)
 +{
 +      struct wl_timer *t, *next;
 +
 +      ASSERT(wl);
 +      /* free ucode data */
 +      if (wl->fw.fw_cnt)
 +              wl_ucode_data_free();
 +      if (wl->irq)
 +              free_irq(wl->irq, wl);
 +
 +      /* kill dpc */
 +      tasklet_kill(&wl->tasklet);
 +
 +      if (wl->pub) {
 +              wlc_module_unregister(wl->pub, "linux", wl);
 +      }
 +
 +      /* free common resources */
 +      if (wl->wlc) {
 +              wlc_detach(wl->wlc);
 +              wl->wlc = NULL;
 +              wl->pub = NULL;
 +      }
 +
 +      /* virtual interface deletion is deferred so we cannot spinwait */
 +
 +      /* wait for all pending callbacks to complete */
 +      while (atomic_read(&wl->callbacks) > 0)
 +              schedule();
 +
 +      /* free timers */
 +      for (t = wl->timers; t; t = next) {
 +              next = t->next;
 +#ifdef BCMDBG
 +              kfree(t->name);
 +#endif
 +              kfree(t);
 +      }
 +
 +      /*
 +       * unregister_netdev() calls get_stats() which may read chip registers
 +       * so we cannot unmap the chip registers until after calling unregister_netdev() .
 +       */
 +      if (wl->regsva && wl->bcm_bustype != SDIO_BUS &&
 +          wl->bcm_bustype != JTAG_BUS) {
 +              iounmap((void *)wl->regsva);
 +      }
 +      wl->regsva = NULL;
 +}
 +
 +/*
-  * transmit a packet
-  * precondition: perimeter lock has been acquired
-  */
- static int BCMFASTPATH wl_start(struct sk_buff *skb, struct wl_info *wl)
- {
-       if (!wl)
-               return -ENETDOWN;
-       return wl_start_int(wl, WL_TO_HW(wl), skb);
- }
- static int BCMFASTPATH
- wl_start_int(struct wl_info *wl, struct ieee80211_hw *hw, struct sk_buff *skb)
- {
-       wlc_sendpkt_mac80211(wl->wlc, skb, hw);
-       return NETDEV_TX_OK;
- }
- /*
 + * precondition: perimeter lock has been acquired
 + */
 +void wl_txflowcontrol(struct wl_info *wl, struct wl_if *wlif, bool state,
 +                    int prio)
 +{
 +      WL_ERROR("Shouldn't be here %s\n", __func__);
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +void wl_init(struct wl_info *wl)
 +{
 +      WL_TRACE("wl%d: wl_init\n", wl->pub->unit);
 +
 +      wl_reset(wl);
 +
 +      wlc_init(wl->wlc);
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +uint wl_reset(struct wl_info *wl)
 +{
 +      WL_TRACE("wl%d: wl_reset\n", wl->pub->unit);
 +
 +      wlc_reset(wl->wlc);
 +
 +      /* dpc will not be rescheduled */
 +      wl->resched = 0;
 +
 +      return 0;
 +}
 +
 +/*
 + * These are interrupt on/off entry points. Disable interrupts
 + * during interrupt state transition.
 + */
 +void BCMFASTPATH wl_intrson(struct wl_info *wl)
 +{
 +      unsigned long flags;
 +
 +      INT_LOCK(wl, flags);
 +      wlc_intrson(wl->wlc);
 +      INT_UNLOCK(wl, flags);
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +bool wl_alloc_dma_resources(struct wl_info *wl, uint addrwidth)
 +{
 +      return true;
 +}
 +
 +u32 BCMFASTPATH wl_intrsoff(struct wl_info *wl)
 +{
 +      unsigned long flags;
 +      u32 status;
 +
 +      INT_LOCK(wl, flags);
 +      status = wlc_intrsoff(wl->wlc);
 +      INT_UNLOCK(wl, flags);
 +      return status;
 +}
 +
 +void wl_intrsrestore(struct wl_info *wl, u32 macintmask)
 +{
 +      unsigned long flags;
 +
 +      INT_LOCK(wl, flags);
 +      wlc_intrsrestore(wl->wlc, macintmask);
 +      INT_UNLOCK(wl, flags);
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +int wl_up(struct wl_info *wl)
 +{
 +      int error = 0;
 +
 +      if (wl->pub->up)
 +              return 0;
 +
 +      error = wlc_up(wl->wlc);
 +
 +      return error;
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +void wl_down(struct wl_info *wl)
 +{
 +      uint callbacks, ret_val = 0;
 +
 +      /* call common down function */
 +      ret_val = wlc_down(wl->wlc);
 +      callbacks = atomic_read(&wl->callbacks) - ret_val;
 +
 +      /* wait for down callbacks to complete */
 +      WL_UNLOCK(wl);
 +
 +      /* For HIGH_only driver, it's important to actually schedule other work,
 +       * not just spin wait since everything runs at schedule level
 +       */
 +      SPINWAIT((atomic_read(&wl->callbacks) > callbacks), 100 * 1000);
 +
 +      WL_LOCK(wl);
 +}
 +
 +static irqreturn_t BCMFASTPATH wl_isr(int irq, void *dev_id)
 +{
 +      struct wl_info *wl;
 +      bool ours, wantdpc;
 +      unsigned long flags;
 +
 +      wl = (struct wl_info *) dev_id;
 +
 +      WL_ISRLOCK(wl, flags);
 +
 +      /* call common first level interrupt handler */
 +      ours = wlc_isr(wl->wlc, &wantdpc);
 +      if (ours) {
 +              /* if more to do... */
 +              if (wantdpc) {
 +
 +                      /* ...and call the second level interrupt handler */
 +                      /* schedule dpc */
 +                      ASSERT(wl->resched == false);
 +                      tasklet_schedule(&wl->tasklet);
 +              }
 +      }
 +
 +      WL_ISRUNLOCK(wl, flags);
 +
 +      return IRQ_RETVAL(ours);
 +}
 +
 +static void BCMFASTPATH wl_dpc(unsigned long data)
 +{
 +      struct wl_info *wl;
 +
 +      wl = (struct wl_info *) data;
 +
 +      WL_LOCK(wl);
 +
 +      /* call the common second level interrupt handler */
 +      if (wl->pub->up) {
 +              if (wl->resched) {
 +                      unsigned long flags;
 +
 +                      INT_LOCK(wl, flags);
 +                      wlc_intrsupd(wl->wlc);
 +                      INT_UNLOCK(wl, flags);
 +              }
 +
 +              wl->resched = wlc_dpc(wl->wlc, true);
 +      }
 +
 +      /* wlc_dpc() may bring the driver down */
 +      if (!wl->pub->up)
 +              goto done;
 +
 +      /* re-schedule dpc */
 +      if (wl->resched)
 +              tasklet_schedule(&wl->tasklet);
 +      else {
 +              /* re-enable interrupts */
 +              wl_intrson(wl);
 +      }
 +
 + done:
 +      WL_UNLOCK(wl);
 +}
 +
 +/*
 + * is called by the kernel from software irq context
 + */
 +static void wl_timer(unsigned long data)
 +{
 +      _wl_timer((struct wl_timer *) data);
 +}
 +
 +/*
 +* precondition: perimeter lock is not acquired
 + */
 +static void _wl_timer(struct wl_timer *t)
 +{
 +      WL_LOCK(t->wl);
 +
 +      if (t->set) {
 +              if (t->periodic) {
 +                      t->timer.expires = jiffies + t->ms * HZ / 1000;
 +                      atomic_inc(&t->wl->callbacks);
 +                      add_timer(&t->timer);
 +                      t->set = true;
 +              } else
 +                      t->set = false;
 +
 +              t->fn(t->arg);
 +      }
 +
 +      atomic_dec(&t->wl->callbacks);
 +
 +      WL_UNLOCK(t->wl);
 +}
 +
 +/*
 + * Adds a timer to the list. Caller supplies a timer function.
 + * Is called from wlc.
 + *
 + * precondition: perimeter lock has been acquired
 + */
 +struct wl_timer *wl_init_timer(struct wl_info *wl, void (*fn) (void *arg),
 +                             void *arg, const char *name)
 +{
 +      struct wl_timer *t;
 +
 +      t = kzalloc(sizeof(struct wl_timer), GFP_ATOMIC);
 +      if (!t) {
 +              WL_ERROR("wl%d: wl_init_timer: out of memory\n", wl->pub->unit);
 +              return 0;
 +      }
 +
 +      init_timer(&t->timer);
 +      t->timer.data = (unsigned long) t;
 +      t->timer.function = wl_timer;
 +      t->wl = wl;
 +      t->fn = fn;
 +      t->arg = arg;
 +      t->next = wl->timers;
 +      wl->timers = t;
 +
 +#ifdef BCMDBG
 +      t->name = kmalloc(strlen(name) + 1, GFP_ATOMIC);
 +      if (t->name)
 +              strcpy(t->name, name);
 +#endif
 +
 +      return t;
 +}
 +
 +/* BMAC_NOTE: Add timer adds only the kernel timer since it's going to be more accurate
 + * as well as it's easier to make it periodic
 + *
 + * precondition: perimeter lock has been acquired
 + */
 +void wl_add_timer(struct wl_info *wl, struct wl_timer *t, uint ms, int periodic)
 +{
 +#ifdef BCMDBG
 +      if (t->set) {
 +              WL_ERROR("%s: Already set. Name: %s, per %d\n",
 +                       __func__, t->name, periodic);
 +      }
 +#endif
 +      ASSERT(!t->set);
 +
 +      t->ms = ms;
 +      t->periodic = (bool) periodic;
 +      t->set = true;
 +      t->timer.expires = jiffies + ms * HZ / 1000;
 +
 +      atomic_inc(&wl->callbacks);
 +      add_timer(&t->timer);
 +}
 +
 +/*
 + * return true if timer successfully deleted, false if still pending
 + *
 + * precondition: perimeter lock has been acquired
 + */
 +bool wl_del_timer(struct wl_info *wl, struct wl_timer *t)
 +{
 +      if (t->set) {
 +              t->set = false;
 +              if (!del_timer(&t->timer)) {
 +                      return false;
 +              }
 +              atomic_dec(&wl->callbacks);
 +      }
 +
 +      return true;
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +void wl_free_timer(struct wl_info *wl, struct wl_timer *t)
 +{
 +      struct wl_timer *tmp;
 +
 +      /* delete the timer in case it is active */
 +      wl_del_timer(wl, t);
 +
 +      if (wl->timers == t) {
 +              wl->timers = wl->timers->next;
 +#ifdef BCMDBG
 +              kfree(t->name);
 +#endif
 +              kfree(t);
 +              return;
 +
 +      }
 +
 +      tmp = wl->timers;
 +      while (tmp) {
 +              if (tmp->next == t) {
 +                      tmp->next = t->next;
 +#ifdef BCMDBG
 +                      kfree(t->name);
 +#endif
 +                      kfree(t);
 +                      return;
 +              }
 +              tmp = tmp->next;
 +      }
 +
 +}
 +
 +/*
 + * runs in software irq context
 + *
 + * precondition: perimeter lock is not acquired
 + */
 +static int wl_linux_watchdog(void *ctx)
 +{
 +      struct wl_info *wl = (struct wl_info *) ctx;
 +      struct wl_cnt *cnt;
 +      struct net_device_stats *stats = NULL;
 +      uint id;
 +      /* refresh stats */
 +      if (wl->pub->up) {
 +              ASSERT(wl->stats_id < 2);
 +
 +              cnt = wl->pub->_cnt;
 +              id = 1 - wl->stats_id;
 +              stats = &wl->stats_watchdog[id];
 +              stats->rx_packets = cnt->rxframe;
 +              stats->tx_packets = cnt->txframe;
 +              stats->rx_bytes = cnt->rxbyte;
 +              stats->tx_bytes = cnt->txbyte;
 +              stats->rx_errors = cnt->rxerror;
 +              stats->tx_errors = cnt->txerror;
 +              stats->collisions = 0;
 +
 +              stats->rx_length_errors = 0;
 +              stats->rx_over_errors = cnt->rxoflo;
 +              stats->rx_crc_errors = cnt->rxcrc;
 +              stats->rx_frame_errors = 0;
 +              stats->rx_fifo_errors = cnt->rxoflo;
 +              stats->rx_missed_errors = 0;
 +
 +              stats->tx_fifo_errors = cnt->txuflo;
 +
 +              wl->stats_id = id;
 +      }
 +
 +      return 0;
 +}
 +
 +struct wl_fw_hdr {
 +      u32 offset;
 +      u32 len;
 +      u32 idx;
 +};
 +
 +char *wl_firmwares[WL_MAX_FW] = {
 +      "brcm/bcm43xx",
 +      NULL
 +};
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +int wl_ucode_init_buf(struct wl_info *wl, void **pbuf, u32 idx)
 +{
 +      int i, entry;
 +      const u8 *pdata;
 +      struct wl_fw_hdr *hdr;
 +      for (i = 0; i < wl->fw.fw_cnt; i++) {
 +              hdr = (struct wl_fw_hdr *)wl->fw.fw_hdr[i]->data;
 +              for (entry = 0; entry < wl->fw.hdr_num_entries[i];
 +                   entry++, hdr++) {
 +                      if (hdr->idx == idx) {
 +                              pdata = wl->fw.fw_bin[i]->data + hdr->offset;
 +                              *pbuf = kmalloc(hdr->len, GFP_ATOMIC);
 +                              if (*pbuf == NULL) {
 +                                      WL_ERROR("fail to alloc %d bytes\n",
 +                                               hdr->len);
 +                                      goto fail;
 +                              }
 +                              memcpy(*pbuf, pdata, hdr->len);
 +                              return 0;
 +                      }
 +              }
 +      }
 +      WL_ERROR("ERROR: ucode buf tag:%d can not be found!\n", idx);
 +      *pbuf = NULL;
 +fail:
 +      return BCME_NOTFOUND;
 +}
 +
 +/*
 + * Precondition: Since this function is called in wl_pci_probe() context,
 + * no locking is required.
 + */
 +int wl_ucode_init_uint(struct wl_info *wl, u32 *data, u32 idx)
 +{
 +      int i, entry;
 +      const u8 *pdata;
 +      struct wl_fw_hdr *hdr;
 +      for (i = 0; i < wl->fw.fw_cnt; i++) {
 +              hdr = (struct wl_fw_hdr *)wl->fw.fw_hdr[i]->data;
 +              for (entry = 0; entry < wl->fw.hdr_num_entries[i];
 +                   entry++, hdr++) {
 +                      if (hdr->idx == idx) {
 +                              pdata = wl->fw.fw_bin[i]->data + hdr->offset;
 +                              ASSERT(hdr->len == 4);
 +                              *data = *((u32 *) pdata);
 +                              return 0;
 +                      }
 +              }
 +      }
 +      WL_ERROR("ERROR: ucode tag:%d can not be found!\n", idx);
 +      return -1;
 +}
 +
 +/*
 + * Precondition: Since this function is called in wl_pci_probe() context,
 + * no locking is required.
 + */
 +static int wl_request_fw(struct wl_info *wl, struct pci_dev *pdev)
 +{
 +      int status;
 +      struct device *device = &pdev->dev;
 +      char fw_name[100];
 +      int i;
 +
 +      memset((void *)&wl->fw, 0, sizeof(struct wl_firmware));
 +      for (i = 0; i < WL_MAX_FW; i++) {
 +              if (wl_firmwares[i] == NULL)
 +                      break;
 +              sprintf(fw_name, "%s-%d.fw", wl_firmwares[i],
 +                      UCODE_LOADER_API_VER);
 +              WL_NONE("request fw %s\n", fw_name);
 +              status = request_firmware(&wl->fw.fw_bin[i], fw_name, device);
 +              if (status) {
 +                      WL_ERROR("%s: fail to load firmware %s\n",
 +                               KBUILD_MODNAME, fw_name);
 +                      return status;
 +              }
 +              WL_NONE("request fw %s\n", fw_name);
 +              sprintf(fw_name, "%s_hdr-%d.fw", wl_firmwares[i],
 +                      UCODE_LOADER_API_VER);
 +              status = request_firmware(&wl->fw.fw_hdr[i], fw_name, device);
 +              if (status) {
 +                      WL_ERROR("%s: fail to load firmware %s\n",
 +                               KBUILD_MODNAME, fw_name);
 +                      return status;
 +              }
 +              wl->fw.hdr_num_entries[i] =
 +                  wl->fw.fw_hdr[i]->size / (sizeof(struct wl_fw_hdr));
 +              WL_NONE("request fw %s find: %d entries\n",
 +                      fw_name, wl->fw.hdr_num_entries[i]);
 +      }
 +      wl->fw.fw_cnt = i;
 +      return wl_ucode_data_init(wl);
 +}
 +
 +/*
 + * precondition: can both be called locked and unlocked
 + */
 +void wl_ucode_free_buf(void *p)
 +{
 +      kfree(p);
 +}
 +
 +/*
 + * Precondition: Since this function is called in wl_pci_probe() context,
 + * no locking is required.
 + */
 +static void wl_release_fw(struct wl_info *wl)
 +{
 +      int i;
 +      for (i = 0; i < WL_MAX_FW; i++) {
 +              release_firmware(wl->fw.fw_bin[i]);
 +              release_firmware(wl->fw.fw_hdr[i]);
 +      }
 +}
 +
 +
 +/*
 + * checks validity of all firmware images loaded from user space
 + *
 + * Precondition: Since this function is called in wl_pci_probe() context,
 + * no locking is required.
 + */
 +int wl_check_firmwares(struct wl_info *wl)
 +{
 +      int i;
 +      int entry;
 +      int rc = 0;
 +      const struct firmware *fw;
 +      const struct firmware *fw_hdr;
 +      struct wl_fw_hdr *ucode_hdr;
 +      for (i = 0; i < WL_MAX_FW && rc == 0; i++) {
 +              fw =  wl->fw.fw_bin[i];
 +              fw_hdr = wl->fw.fw_hdr[i];
 +              if (fw == NULL && fw_hdr == NULL) {
 +                      break;
 +              } else if (fw == NULL || fw_hdr == NULL) {
 +                      WL_ERROR("%s: invalid bin/hdr fw\n", __func__);
 +                      rc = -EBADF;
 +              } else if (fw_hdr->size % sizeof(struct wl_fw_hdr)) {
 +                      WL_ERROR("%s: non integral fw hdr file size %zu/%zu\n",
 +                               __func__, fw_hdr->size,
 +                               sizeof(struct wl_fw_hdr));
 +                      rc = -EBADF;
 +              } else if (fw->size < MIN_FW_SIZE || fw->size > MAX_FW_SIZE) {
 +                      WL_ERROR("%s: out of bounds fw file size %zu\n",
 +                               __func__, fw->size);
 +                      rc = -EBADF;
 +              } else {
 +                      /* check if ucode section overruns firmware image */
 +                      ucode_hdr = (struct wl_fw_hdr *)fw_hdr->data;
 +                      for (entry = 0; entry < wl->fw.hdr_num_entries[i] &&
 +                           !rc; entry++, ucode_hdr++) {
 +                              if (ucode_hdr->offset + ucode_hdr->len >
 +                                  fw->size) {
 +                                      WL_ERROR("%s: conflicting bin/hdr\n",
 +                                               __func__);
 +                                      rc = -EBADF;
 +                              }
 +                      }
 +              }
 +      }
 +      if (rc == 0 && wl->fw.fw_cnt != i) {
 +              WL_ERROR("%s: invalid fw_cnt=%d\n", __func__, wl->fw.fw_cnt);
 +              rc = -EBADF;
 +      }
 +      return rc;
 +}
 +
 +/*
 + * precondition: perimeter lock has been acquired
 + */
 +bool wl_rfkill_set_hw_state(struct wl_info *wl)
 +{
 +      bool blocked = wlc_check_radio_disabled(wl->wlc);
 +
 +      WL_NONE("%s: update hw state: blocked=%s\n", __func__,
 +              blocked ? "true" : "false");
 +      WL_UNLOCK(wl);
 +      wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 +      if (blocked)
 +              wiphy_rfkill_start_polling(wl->pub->ieee_hw->wiphy);
 +      WL_LOCK(wl);
 +      return blocked;
 +}
index 0870dc9,0000000..639b5d7
mode 100644,000000..100644
--- /dev/null
@@@ -1,8496 -1,0 +1,8499 @@@
 +/*
 + * Copyright (c) 2010 Broadcom Corporation
 + *
 + * Permission to use, copy, modify, and/or distribute this software for any
 + * purpose with or without fee is hereby granted, provided that the above
 + * copyright notice and this permission notice appear in all copies.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 + */
 +#include <linux/kernel.h>
 +#include <linux/ctype.h>
 +#include <linux/etherdevice.h>
 +#include <net/mac80211.h>
 +
 +#include <bcmdefs.h>
 +#include <bcmdevs.h>
 +#include <bcmutils.h>
 +#include <bcmwifi.h>
 +#include <siutils.h>
 +#include <pcicfg.h>
 +#include <bcmsrom.h>
 +#include <wlioctl.h>
 +#include <sbhnddma.h>
 +#include <hnddma.h>
 +#include <hndpmu.h>
 +
 +#include "d11.h"
 +#include "wlc_types.h"
 +#include "wlc_cfg.h"
 +#include "wlc_rate.h"
 +#include "wlc_scb.h"
 +#include "wlc_pub.h"
 +#include "wlc_key.h"
 +#include "wlc_bsscfg.h"
 +#include "phy/wlc_phy_hal.h"
 +#include "wlc_channel.h"
 +#include "wlc_main.h"
 +#include "wlc_bmac.h"
 +#include "wlc_phy_hal.h"
 +#include "wlc_phy_shim.h"
 +#include "wlc_antsel.h"
 +#include "wlc_stf.h"
 +#include "wlc_ampdu.h"
 +#include "wl_export.h"
 +#include "wlc_alloc.h"
 +#include "wl_dbg.h"
 +
 +/*
 + *    Disable statistics counting for WME
 + */
 +#define WLCNTSET(a, b)
 +#define WLCNTINCR(a)
 +#define WLCNTADD(a, b)
 +
 +/*
 + * WPA(2) definitions
 + */
 +#define RSN_CAP_4_REPLAY_CNTRS                2
 +#define RSN_CAP_16_REPLAY_CNTRS               3
 +
 +#define WPA_CAP_4_REPLAY_CNTRS                RSN_CAP_4_REPLAY_CNTRS
 +#define WPA_CAP_16_REPLAY_CNTRS               RSN_CAP_16_REPLAY_CNTRS
 +
 +/*
 + * Indication for txflowcontrol that all priority bits in
 + * TXQ_STOP_FOR_PRIOFC_MASK are to be considered.
 + */
 +#define ALLPRIO               -1
 +
 +/*
 + * buffer length needed for wlc_format_ssid
 + * 32 SSID chars, max of 4 chars for each SSID char "\xFF", plus NULL.
 + */
 +#define SSID_FMT_BUF_LEN      ((4 * IEEE80211_MAX_SSID_LEN) + 1)
 +
 +#define       TIMER_INTERVAL_WATCHDOG 1000    /* watchdog timer, in unit of ms */
 +#define       TIMER_INTERVAL_RADIOCHK 800     /* radio monitor timer, in unit of ms */
 +
 +#ifndef WLC_MPC_MAX_DELAYCNT
 +#define       WLC_MPC_MAX_DELAYCNT    10      /* Max MPC timeout, in unit of watchdog */
 +#endif
 +#define       WLC_MPC_MIN_DELAYCNT    1       /* Min MPC timeout, in unit of watchdog */
 +#define       WLC_MPC_THRESHOLD       3       /* MPC count threshold level */
 +
 +#define       BEACON_INTERVAL_DEFAULT 100     /* beacon interval, in unit of 1024TU */
 +#define       DTIM_INTERVAL_DEFAULT   3       /* DTIM interval, in unit of beacon interval */
 +
 +/* Scale down delays to accommodate QT slow speed */
 +#define       BEACON_INTERVAL_DEF_QT  20      /* beacon interval, in unit of 1024TU */
 +#define       DTIM_INTERVAL_DEF_QT    1       /* DTIM interval, in unit of beacon interval */
 +
 +#define       TBTT_ALIGN_LEEWAY_US    100     /* min leeway before first TBTT in us */
 +
 +/*
 + * driver maintains internal 'tick'(wlc->pub->now) which increments in 1s OS timer(soft
 + * watchdog) it is not a wall clock and won't increment when driver is in "down" state
 + * this low resolution driver tick can be used for maintenance tasks such as phy
 + * calibration and scb update
 + */
 +
 +/* watchdog trigger mode: OSL timer or TBTT */
 +#define WLC_WATCHDOG_TBTT(wlc) \
 +      (wlc->stas_associated > 0 && wlc->PM != PM_OFF && wlc->pub->align_wd_tbtt)
 +
 +/* To inform the ucode of the last mcast frame posted so that it can clear moredata bit */
 +#define BCMCFID(wlc, fid) wlc_bmac_write_shm((wlc)->hw, M_BCMC_FID, (fid))
 +
 +#define WLC_WAR16165(wlc) (wlc->pub->sih->bustype == PCI_BUS && \
 +                              (!AP_ENAB(wlc->pub)) && (wlc->war16165))
 +
 +/* debug/trace */
 +uint wl_msg_level =
 +#if defined(BCMDBG)
 +    WL_ERROR_VAL;
 +#else
 +    0;
 +#endif                                /* BCMDBG */
 +
 +/* Find basic rate for a given rate */
 +#define WLC_BASIC_RATE(wlc, rspec)    (IS_MCS(rspec) ? \
 +                      (wlc)->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK].leg_ofdm] : \
 +                      (wlc)->band->basic_rate[rspec & RSPEC_RATE_MASK])
 +
 +#define FRAMETYPE(r, mimoframe)       (IS_MCS(r) ? mimoframe  : (IS_CCK(r) ? FT_CCK : FT_OFDM))
 +
 +#define RFDISABLE_DEFAULT     10000000        /* rfdisable delay timer 500 ms, runs of ALP clock */
 +
 +#define WLC_TEMPSENSE_PERIOD          10      /* 10 second timeout */
 +
 +#define SCAN_IN_PROGRESS(x)   0
 +
 +#define EPI_VERSION_NUM               0x054b0b00
 +
 +#ifdef BCMDBG
 +/* pointer to most recently allocated wl/wlc */
 +static struct wlc_info *wlc_info_dbg = (struct wlc_info *) (NULL);
 +#endif
 +
 +/* IOVar table */
 +
 +/* Parameter IDs, for use only internally to wlc -- in the wlc_iovars
 + * table and by the wlc_doiovar() function.  No ordering is imposed:
 + * the table is keyed by name, and the function uses a switch.
 + */
 +enum {
 +      IOV_MPC = 1,
 +      IOV_RTSTHRESH,
 +      IOV_QTXPOWER,
 +      IOV_BCN_LI_BCN,         /* Beacon listen interval in # of beacons */
 +      IOV_LAST                /* In case of a need to check max ID number */
 +};
 +
 +const bcm_iovar_t wlc_iovars[] = {
 +      {"mpc", IOV_MPC, (0), IOVT_BOOL, 0},
 +      {"rtsthresh", IOV_RTSTHRESH, (IOVF_WHL), IOVT_UINT16, 0},
 +      {"qtxpower", IOV_QTXPOWER, (IOVF_WHL), IOVT_UINT32, 0},
 +      {"bcn_li_bcn", IOV_BCN_LI_BCN, (0), IOVT_UINT8, 0},
 +      {NULL, 0, 0, 0, 0}
 +};
 +
 +const u8 prio2fifo[NUMPRIO] = {
 +      TX_AC_BE_FIFO,          /* 0    BE      AC_BE   Best Effort */
 +      TX_AC_BK_FIFO,          /* 1    BK      AC_BK   Background */
 +      TX_AC_BK_FIFO,          /* 2    --      AC_BK   Background */
 +      TX_AC_BE_FIFO,          /* 3    EE      AC_BE   Best Effort */
 +      TX_AC_VI_FIFO,          /* 4    CL      AC_VI   Video */
 +      TX_AC_VI_FIFO,          /* 5    VI      AC_VI   Video */
 +      TX_AC_VO_FIFO,          /* 6    VO      AC_VO   Voice */
 +      TX_AC_VO_FIFO           /* 7    NC      AC_VO   Voice */
 +};
 +
 +/* precedences numbers for wlc queues. These are twice as may levels as
 + * 802.1D priorities.
 + * Odd numbers are used for HI priority traffic at same precedence levels
 + * These constants are used ONLY by wlc_prio2prec_map.  Do not use them elsewhere.
 + */
 +#define       _WLC_PREC_NONE          0       /* None = - */
 +#define       _WLC_PREC_BK            2       /* BK - Background */
 +#define       _WLC_PREC_BE            4       /* BE - Best-effort */
 +#define       _WLC_PREC_EE            6       /* EE - Excellent-effort */
 +#define       _WLC_PREC_CL            8       /* CL - Controlled Load */
 +#define       _WLC_PREC_VI            10      /* Vi - Video */
 +#define       _WLC_PREC_VO            12      /* Vo - Voice */
 +#define       _WLC_PREC_NC            14      /* NC - Network Control */
 +
 +/* 802.1D Priority to precedence queue mapping */
 +const u8 wlc_prio2prec_map[] = {
 +      _WLC_PREC_BE,           /* 0 BE - Best-effort */
 +      _WLC_PREC_BK,           /* 1 BK - Background */
 +      _WLC_PREC_NONE,         /* 2 None = - */
 +      _WLC_PREC_EE,           /* 3 EE - Excellent-effort */
 +      _WLC_PREC_CL,           /* 4 CL - Controlled Load */
 +      _WLC_PREC_VI,           /* 5 Vi - Video */
 +      _WLC_PREC_VO,           /* 6 Vo - Voice */
 +      _WLC_PREC_NC,           /* 7 NC - Network Control */
 +};
 +
 +/* Sanity check for tx_prec_map and fifo synchup
 + * Either there are some packets pending for the fifo, else if fifo is empty then
 + * all the corresponding precmap bits should be set
 + */
 +#define WLC_TX_FIFO_CHECK(wlc, fifo) (TXPKTPENDGET((wlc), (fifo)) ||  \
 +      (TXPKTPENDGET((wlc), (fifo)) == 0 && \
 +      ((wlc)->tx_prec_map & (wlc)->fifo2prec_map[(fifo)]) == \
 +      (wlc)->fifo2prec_map[(fifo)]))
 +
 +/* TX FIFO number to WME/802.1E Access Category */
 +const u8 wme_fifo2ac[] = { AC_BK, AC_BE, AC_VI, AC_VO, AC_BE, AC_BE };
 +
 +/* WME/802.1E Access Category to TX FIFO number */
 +static const u8 wme_ac2fifo[] = { 1, 0, 2, 3 };
 +
 +static bool in_send_q = false;
 +
 +/* Shared memory location index for various AC params */
 +#define wme_shmemacindex(ac)  wme_ac2fifo[ac]
 +
 +#ifdef BCMDBG
 +static const char *fifo_names[] = {
 +      "AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
 +#else
 +static const char fifo_names[6][0];
 +#endif
 +
 +static const u8 acbitmap2maxprio[] = {
 +      PRIO_8021D_BE, PRIO_8021D_BE, PRIO_8021D_BK, PRIO_8021D_BK,
 +      PRIO_8021D_VI, PRIO_8021D_VI, PRIO_8021D_VI, PRIO_8021D_VI,
 +      PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO,
 +      PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO, PRIO_8021D_VO
 +};
 +
 +/* currently the best mechanism for determining SIFS is the band in use */
 +#define SIFS(band) ((band)->bandtype == WLC_BAND_5G ? APHY_SIFS_TIME : BPHY_SIFS_TIME);
 +
 +/* value for # replay counters currently supported */
 +#define WLC_REPLAY_CNTRS_VALUE        WPA_CAP_16_REPLAY_CNTRS
 +
 +/* local prototypes */
 +static u16 BCMFASTPATH wlc_d11hdrs_mac80211(struct wlc_info *wlc,
 +                                             struct ieee80211_hw *hw,
 +                                             struct sk_buff *p,
 +                                             struct scb *scb, uint frag,
 +                                             uint nfrags, uint queue,
 +                                             uint next_frag_len,
 +                                             wsec_key_t *key,
 +                                             ratespec_t rspec_override);
 +
 +static void wlc_ctrupd_cache(u16 cur_stat, u16 *macstat_snapshot, u32 *macstat);
 +static void wlc_bss_default_init(struct wlc_info *wlc);
 +static void wlc_ucode_mac_upd(struct wlc_info *wlc);
 +static ratespec_t mac80211_wlc_set_nrate(struct wlc_info *wlc,
 +                                       struct wlcband *cur_band, u32 int_val);
 +static void wlc_tx_prec_map_init(struct wlc_info *wlc);
 +static void wlc_watchdog(void *arg);
 +static void wlc_watchdog_by_timer(void *arg);
 +static u16 wlc_rate_shm_offset(struct wlc_info *wlc, u8 rate);
 +static int wlc_set_rateset(struct wlc_info *wlc, wlc_rateset_t *rs_arg);
 +static int wlc_iovar_rangecheck(struct wlc_info *wlc, u32 val,
 +                              const bcm_iovar_t *vi);
 +static u8 wlc_local_constraint_qdbm(struct wlc_info *wlc);
 +
 +/* send and receive */
 +static struct wlc_txq_info *wlc_txq_alloc(struct wlc_info *wlc);
 +static void wlc_txq_free(struct wlc_info *wlc,
 +                       struct wlc_txq_info *qi);
 +static void wlc_txflowcontrol_signal(struct wlc_info *wlc,
 +                                   struct wlc_txq_info *qi,
 +                                   bool on, int prio);
 +static void wlc_txflowcontrol_reset(struct wlc_info *wlc);
 +static u16 wlc_compute_airtime(struct wlc_info *wlc, ratespec_t rspec,
 +                                uint length);
 +static void wlc_compute_cck_plcp(ratespec_t rate, uint length, u8 *plcp);
 +static void wlc_compute_ofdm_plcp(ratespec_t rate, uint length, u8 *plcp);
 +static void wlc_compute_mimo_plcp(ratespec_t rate, uint length, u8 *plcp);
 +static u16 wlc_compute_frame_dur(struct wlc_info *wlc, ratespec_t rate,
 +                                  u8 preamble_type, uint next_frag_len);
 +static void wlc_recvctl(struct wlc_info *wlc,
 +                      d11rxhdr_t *rxh, struct sk_buff *p);
 +static uint wlc_calc_frame_len(struct wlc_info *wlc, ratespec_t rate,
 +                             u8 preamble_type, uint dur);
 +static uint wlc_calc_ack_time(struct wlc_info *wlc, ratespec_t rate,
 +                            u8 preamble_type);
 +static uint wlc_calc_cts_time(struct wlc_info *wlc, ratespec_t rate,
 +                            u8 preamble_type);
 +/* interrupt, up/down, band */
 +static void wlc_setband(struct wlc_info *wlc, uint bandunit);
 +static chanspec_t wlc_init_chanspec(struct wlc_info *wlc);
 +static void wlc_bandinit_ordered(struct wlc_info *wlc, chanspec_t chanspec);
 +static void wlc_bsinit(struct wlc_info *wlc);
 +static int wlc_duty_cycle_set(struct wlc_info *wlc, int duty_cycle, bool isOFDM,
 +                            bool writeToShm);
 +static void wlc_radio_hwdisable_upd(struct wlc_info *wlc);
 +static bool wlc_radio_monitor_start(struct wlc_info *wlc);
 +static void wlc_radio_timer(void *arg);
 +static void wlc_radio_enable(struct wlc_info *wlc);
 +static void wlc_radio_upd(struct wlc_info *wlc);
 +
 +/* scan, association, BSS */
 +static uint wlc_calc_ba_time(struct wlc_info *wlc, ratespec_t rate,
 +                           u8 preamble_type);
 +static void wlc_update_mimo_band_bwcap(struct wlc_info *wlc, u8 bwcap);
 +static void wlc_ht_update_sgi_rx(struct wlc_info *wlc, int val);
 +static void wlc_ht_update_ldpc(struct wlc_info *wlc, s8 val);
 +static void wlc_war16165(struct wlc_info *wlc, bool tx);
 +
 +static void wlc_wme_retries_write(struct wlc_info *wlc);
 +static bool wlc_attach_stf_ant_init(struct wlc_info *wlc);
 +static uint wlc_attach_module(struct wlc_info *wlc);
 +static void wlc_detach_module(struct wlc_info *wlc);
 +static void wlc_timers_deinit(struct wlc_info *wlc);
 +static void wlc_down_led_upd(struct wlc_info *wlc);
 +static uint wlc_down_del_timer(struct wlc_info *wlc);
 +static void wlc_ofdm_rateset_war(struct wlc_info *wlc);
 +static int _wlc_ioctl(struct wlc_info *wlc, int cmd, void *arg, int len,
 +                    struct wlc_if *wlcif);
 +
 +#if defined(BCMDBG)
 +void wlc_get_rcmta(struct wlc_info *wlc, int idx, u8 *addr)
 +{
 +      d11regs_t *regs = wlc->regs;
 +      u32 v32;
 +
 +      WL_TRACE("wl%d: %s\n", WLCWLUNIT(wlc), __func__);
 +
 +      W_REG(&regs->objaddr, (OBJADDR_RCMTA_SEL | (idx * 2)));
 +      (void)R_REG(&regs->objaddr);
 +      v32 = R_REG(&regs->objdata);
 +      addr[0] = (u8) v32;
 +      addr[1] = (u8) (v32 >> 8);
 +      addr[2] = (u8) (v32 >> 16);
 +      addr[3] = (u8) (v32 >> 24);
 +      W_REG(&regs->objaddr, (OBJADDR_RCMTA_SEL | ((idx * 2) + 1)));
 +      (void)R_REG(&regs->objaddr);
 +      v32 = R_REG(&regs->objdata);
 +      addr[4] = (u8) v32;
 +      addr[5] = (u8) (v32 >> 8);
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +/* keep the chip awake if needed */
 +bool wlc_stay_awake(struct wlc_info *wlc)
 +{
 +      return true;
 +}
 +
 +/* conditions under which the PM bit should be set in outgoing frames and STAY_AWAKE is meaningful
 + */
 +bool wlc_ps_allowed(struct wlc_info *wlc)
 +{
 +      int idx;
 +      struct wlc_bsscfg *cfg;
 +
 +      /* disallow PS when one of the following global conditions meets */
 +      if (!wlc->pub->associated || !wlc->PMenabled || wlc->PM_override)
 +              return false;
 +
 +      /* disallow PS when one of these meets when not scanning */
 +      if (!wlc->PMblocked) {
 +              if (AP_ACTIVE(wlc) || wlc->monitor)
 +                      return false;
 +      }
 +
 +      FOREACH_AS_STA(wlc, idx, cfg) {
 +              /* disallow PS when one of the following bsscfg specific conditions meets */
 +              if (!cfg->BSS || !WLC_PORTOPEN(cfg))
 +                      return false;
 +
 +              if (!cfg->dtim_programmed)
 +                      return false;
 +      }
 +
 +      return true;
 +}
 +
 +void wlc_reset(struct wlc_info *wlc)
 +{
 +      WL_TRACE("wl%d: wlc_reset\n", wlc->pub->unit);
 +
 +      wlc->check_for_unaligned_tbtt = false;
 +
 +      /* slurp up hw mac counters before core reset */
 +      wlc_statsupd(wlc);
 +
 +      /* reset our snapshot of macstat counters */
 +      memset((char *)wlc->core->macstat_snapshot, 0,
 +              sizeof(macstat_t));
 +
 +      wlc_bmac_reset(wlc->hw);
 +      wlc_ampdu_reset(wlc->ampdu);
 +      wlc->txretried = 0;
 +
 +}
 +
 +void wlc_fatal_error(struct wlc_info *wlc)
 +{
 +      WL_ERROR("wl%d: fatal error, reinitializing\n", wlc->pub->unit);
 +      wl_init(wlc->wl);
 +}
 +
 +/* Return the channel the driver should initialize during wlc_init.
 + * the channel may have to be changed from the currently configured channel
 + * if other configurations are in conflict (bandlocked, 11n mode disabled,
 + * invalid channel for current country, etc.)
 + */
 +static chanspec_t wlc_init_chanspec(struct wlc_info *wlc)
 +{
 +      chanspec_t chanspec =
 +          1 | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE |
 +          WL_CHANSPEC_BAND_2G;
 +
 +      /* make sure the channel is on the supported band if we are band-restricted */
 +      if (wlc->bandlocked || NBANDS(wlc) == 1) {
 +              ASSERT(CHSPEC_WLCBANDUNIT(chanspec) == wlc->band->bandunit);
 +      }
 +      ASSERT(wlc_valid_chanspec_db(wlc->cmi, chanspec));
 +      return chanspec;
 +}
 +
 +struct scb global_scb;
 +
 +static void wlc_init_scb(struct wlc_info *wlc, struct scb *scb)
 +{
 +      int i;
 +      scb->flags = SCB_WMECAP | SCB_HTCAP;
 +      for (i = 0; i < NUMPRIO; i++)
 +              scb->seqnum[i] = 0;
 +}
 +
 +void wlc_init(struct wlc_info *wlc)
 +{
 +      d11regs_t *regs;
 +      chanspec_t chanspec;
 +      int i;
 +      struct wlc_bsscfg *bsscfg;
 +      bool mute = false;
 +
 +      WL_TRACE("wl%d: wlc_init\n", wlc->pub->unit);
 +
 +      regs = wlc->regs;
 +
 +      /* This will happen if a big-hammer was executed. In that case, we want to go back
 +       * to the channel that we were on and not new channel
 +       */
 +      if (wlc->pub->associated)
 +              chanspec = wlc->home_chanspec;
 +      else
 +              chanspec = wlc_init_chanspec(wlc);
 +
 +      wlc_bmac_init(wlc->hw, chanspec, mute);
 +
 +      wlc->seckeys = wlc_bmac_read_shm(wlc->hw, M_SECRXKEYS_PTR) * 2;
 +      if (wlc->machwcap & MCAP_TKIPMIC)
 +              wlc->tkmickeys =
 +                  wlc_bmac_read_shm(wlc->hw, M_TKMICKEYS_PTR) * 2;
 +
 +      /* update beacon listen interval */
 +      wlc_bcn_li_upd(wlc);
 +      wlc->bcn_wait_prd =
 +          (u8) (wlc_bmac_read_shm(wlc->hw, M_NOSLPZNATDTIM) >> 10);
 +      ASSERT(wlc->bcn_wait_prd > 0);
 +
 +      /* the world is new again, so is our reported rate */
 +      wlc_reprate_init(wlc);
 +
 +      /* write ethernet address to core */
 +      FOREACH_BSS(wlc, i, bsscfg) {
 +              wlc_set_mac(bsscfg);
 +              wlc_set_bssid(bsscfg);
 +      }
 +
 +      /* Update tsf_cfprep if associated and up */
 +      if (wlc->pub->associated) {
 +              FOREACH_BSS(wlc, i, bsscfg) {
 +                      if (bsscfg->up) {
 +                              u32 bi;
 +
 +                              /* get beacon period and convert to uS */
 +                              bi = bsscfg->current_bss->beacon_period << 10;
 +                              /*
 +                               * update since init path would reset
 +                               * to default value
 +                               */
 +                              W_REG(&regs->tsf_cfprep,
 +                                    (bi << CFPREP_CBI_SHIFT));
 +
 +                              /* Update maccontrol PM related bits */
 +                              wlc_set_ps_ctrl(wlc);
 +
 +                              break;
 +                      }
 +              }
 +      }
 +
 +      wlc_key_hw_init_all(wlc);
 +
 +      wlc_bandinit_ordered(wlc, chanspec);
 +
 +      wlc_init_scb(wlc, &global_scb);
 +
 +      /* init probe response timeout */
 +      wlc_write_shm(wlc, M_PRS_MAXTIME, wlc->prb_resp_timeout);
 +
 +      /* init max burst txop (framebursting) */
 +      wlc_write_shm(wlc, M_MBURST_TXOP,
 +                    (wlc->
 +                     _rifs ? (EDCF_AC_VO_TXOP_AP << 5) : MAXFRAMEBURST_TXOP));
 +
 +      /* initialize maximum allowed duty cycle */
 +      wlc_duty_cycle_set(wlc, wlc->tx_duty_cycle_ofdm, true, true);
 +      wlc_duty_cycle_set(wlc, wlc->tx_duty_cycle_cck, false, true);
 +
 +      /* Update some shared memory locations related to max AMPDU size allowed to received */
 +      wlc_ampdu_shm_upd(wlc->ampdu);
 +
 +      /* band-specific inits */
 +      wlc_bsinit(wlc);
 +
 +      /* Enable EDCF mode (while the MAC is suspended) */
 +      if (EDCF_ENAB(wlc->pub)) {
 +              OR_REG(&regs->ifs_ctl, IFS_USEEDCF);
 +              wlc_edcf_setparams(wlc->cfg, false);
 +      }
 +
 +      /* Init precedence maps for empty FIFOs */
 +      wlc_tx_prec_map_init(wlc);
 +
 +      /* read the ucode version if we have not yet done so */
 +      if (wlc->ucode_rev == 0) {
 +              wlc->ucode_rev =
 +                  wlc_read_shm(wlc, M_BOM_REV_MAJOR) << NBITS(u16);
 +              wlc->ucode_rev |= wlc_read_shm(wlc, M_BOM_REV_MINOR);
 +      }
 +
 +      /* ..now really unleash hell (allow the MAC out of suspend) */
 +      wlc_enable_mac(wlc);
 +
 +      /* clear tx flow control */
 +      wlc_txflowcontrol_reset(wlc);
 +
 +      /* clear tx data fifo suspends */
 +      wlc->tx_suspended = false;
 +
 +      /* enable the RF Disable Delay timer */
 +      W_REG(&wlc->regs->rfdisabledly, RFDISABLE_DEFAULT);
 +
 +      /* initialize mpc delay */
 +      wlc->mpc_delay_off = wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
 +
 +      /*
 +       * Initialize WME parameters; if they haven't been set by some other
 +       * mechanism (IOVar, etc) then read them from the hardware.
 +       */
 +      if (WLC_WME_RETRY_SHORT_GET(wlc, 0) == 0) {     /* Uninitialized; read from HW */
 +              int ac;
 +
 +              ASSERT(wlc->clk);
 +              for (ac = 0; ac < AC_COUNT; ac++) {
 +                      wlc->wme_retries[ac] =
 +                          wlc_read_shm(wlc, M_AC_TXLMT_ADDR(ac));
 +              }
 +      }
 +}
 +
 +void wlc_mac_bcn_promisc_change(struct wlc_info *wlc, bool promisc)
 +{
 +      wlc->bcnmisc_monitor = promisc;
 +      wlc_mac_bcn_promisc(wlc);
 +}
 +
 +void wlc_mac_bcn_promisc(struct wlc_info *wlc)
 +{
 +      if ((AP_ENAB(wlc->pub) && (N_ENAB(wlc->pub) || wlc->band->gmode)) ||
 +          wlc->bcnmisc_ibss || wlc->bcnmisc_scan || wlc->bcnmisc_monitor)
 +              wlc_mctrl(wlc, MCTL_BCNS_PROMISC, MCTL_BCNS_PROMISC);
 +      else
 +              wlc_mctrl(wlc, MCTL_BCNS_PROMISC, 0);
 +}
 +
 +/* set or clear maccontrol bits MCTL_PROMISC and MCTL_KEEPCONTROL */
 +void wlc_mac_promisc(struct wlc_info *wlc)
 +{
 +      u32 promisc_bits = 0;
 +
 +      /* promiscuous mode just sets MCTL_PROMISC
 +       * Note: APs get all BSS traffic without the need to set the MCTL_PROMISC bit
 +       * since all BSS data traffic is directed at the AP
 +       */
 +      if (PROMISC_ENAB(wlc->pub) && !AP_ENAB(wlc->pub) && !wlc->wet)
 +              promisc_bits |= MCTL_PROMISC;
 +
 +      /* monitor mode needs both MCTL_PROMISC and MCTL_KEEPCONTROL
 +       * Note: monitor mode also needs MCTL_BCNS_PROMISC, but that is
 +       * handled in wlc_mac_bcn_promisc()
 +       */
 +      if (MONITOR_ENAB(wlc))
 +              promisc_bits |= MCTL_PROMISC | MCTL_KEEPCONTROL;
 +
 +      wlc_mctrl(wlc, MCTL_PROMISC | MCTL_KEEPCONTROL, promisc_bits);
 +}
 +
 +/* check if hps and wake states of sw and hw are in sync */
 +bool wlc_ps_check(struct wlc_info *wlc)
 +{
 +      bool res = true;
 +      bool hps, wake;
 +      bool wake_ok;
 +
 +      if (!AP_ACTIVE(wlc)) {
 +              u32 tmp;
 +              tmp = R_REG(&wlc->regs->maccontrol);
 +
 +              /*
 +               * If deviceremoved is detected, then don't take any action as
 +               * this can be called in any context. Assume that caller will
 +               * take care of the condition. This is just to avoid assert
 +               */
 +              if (tmp == 0xffffffff) {
 +                      WL_ERROR("wl%d: %s: dead chip\n",
 +                               wlc->pub->unit, __func__);
 +                      return DEVICEREMOVED(wlc);
 +              }
 +
 +              hps = PS_ALLOWED(wlc);
 +
 +              if (hps != ((tmp & MCTL_HPS) != 0)) {
 +                      int idx;
 +                      struct wlc_bsscfg *cfg;
 +                      WL_ERROR("wl%d: hps not sync, sw %d, maccontrol 0x%x\n",
 +                               wlc->pub->unit, hps, tmp);
 +                      FOREACH_BSS(wlc, idx, cfg) {
 +                              if (!BSSCFG_STA(cfg))
 +                                      continue;
 +                      }
 +
 +                      res = false;
 +              }
 +              /* For a monolithic build the wake check can be exact since it looks at wake
 +               * override bits. The MCTL_WAKE bit should match the 'wake' value.
 +               */
 +              wake = STAY_AWAKE(wlc) || wlc->hw->wake_override;
 +              wake_ok = (wake == ((tmp & MCTL_WAKE) != 0));
 +              if (hps && !wake_ok) {
 +                      WL_ERROR("wl%d: wake not sync, sw %d maccontrol 0x%x\n",
 +                               wlc->pub->unit, wake, tmp);
 +                      res = false;
 +              }
 +      }
 +      ASSERT(res);
 +      return res;
 +}
 +
 +/* push sw hps and wake state through hardware */
 +void wlc_set_ps_ctrl(struct wlc_info *wlc)
 +{
 +      u32 v1, v2;
 +      bool hps, wake;
 +      bool awake_before;
 +
 +      hps = PS_ALLOWED(wlc);
 +      wake = hps ? (STAY_AWAKE(wlc)) : true;
 +
 +      WL_TRACE("wl%d: wlc_set_ps_ctrl: hps %d wake %d\n",
 +               wlc->pub->unit, hps, wake);
 +
 +      v1 = R_REG(&wlc->regs->maccontrol);
 +      v2 = 0;
 +      if (hps)
 +              v2 |= MCTL_HPS;
 +      if (wake)
 +              v2 |= MCTL_WAKE;
 +
 +      wlc_mctrl(wlc, MCTL_WAKE | MCTL_HPS, v2);
 +
 +      awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
 +
 +      if (wake && !awake_before)
 +              wlc_bmac_wait_for_wake(wlc->hw);
 +
 +}
 +
 +/*
 + * Write this BSS config's MAC address to core.
 + * Updates RXE match engine.
 + */
 +int wlc_set_mac(struct wlc_bsscfg *cfg)
 +{
 +      int err = 0;
 +      struct wlc_info *wlc = cfg->wlc;
 +
 +      if (cfg == wlc->cfg) {
 +              /* enter the MAC addr into the RXE match registers */
 +              wlc_set_addrmatch(wlc, RCM_MAC_OFFSET, cfg->cur_etheraddr);
 +      }
 +
 +      wlc_ampdu_macaddr_upd(wlc);
 +
 +      return err;
 +}
 +
 +/* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
 + * Updates RXE match engine.
 + */
 +void wlc_set_bssid(struct wlc_bsscfg *cfg)
 +{
 +      struct wlc_info *wlc = cfg->wlc;
 +
 +      /* if primary config, we need to update BSSID in RXE match registers */
 +      if (cfg == wlc->cfg) {
 +              wlc_set_addrmatch(wlc, RCM_BSSID_OFFSET, cfg->BSSID);
 +      }
 +#ifdef SUPPORT_HWKEYS
 +      else if (BSSCFG_STA(cfg) && cfg->BSS) {
 +              wlc_rcmta_add_bssid(wlc, cfg);
 +      }
 +#endif
 +}
 +
 +/*
 + * Suspend the the MAC and update the slot timing
 + * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
 + */
 +void wlc_switch_shortslot(struct wlc_info *wlc, bool shortslot)
 +{
 +      int idx;
 +      struct wlc_bsscfg *cfg;
 +
 +      ASSERT(wlc->band->gmode);
 +
 +      /* use the override if it is set */
 +      if (wlc->shortslot_override != WLC_SHORTSLOT_AUTO)
 +              shortslot = (wlc->shortslot_override == WLC_SHORTSLOT_ON);
 +
 +      if (wlc->shortslot == shortslot)
 +              return;
 +
 +      wlc->shortslot = shortslot;
 +
 +      /* update the capability based on current shortslot mode */
 +      FOREACH_BSS(wlc, idx, cfg) {
 +              if (!cfg->associated)
 +                      continue;
 +              cfg->current_bss->capability &=
 +                                      ~WLAN_CAPABILITY_SHORT_SLOT_TIME;
 +              if (wlc->shortslot)
 +                      cfg->current_bss->capability |=
 +                                      WLAN_CAPABILITY_SHORT_SLOT_TIME;
 +      }
 +
 +      wlc_bmac_set_shortslot(wlc->hw, shortslot);
 +}
 +
 +static u8 wlc_local_constraint_qdbm(struct wlc_info *wlc)
 +{
 +      u8 local;
 +      s16 local_max;
 +
 +      local = WLC_TXPWR_MAX;
 +      if (wlc->pub->associated &&
 +          (wf_chspec_ctlchan(wlc->chanspec) ==
 +           wf_chspec_ctlchan(wlc->home_chanspec))) {
 +
 +              /* get the local power constraint if we are on the AP's
 +               * channel [802.11h, 7.3.2.13]
 +               */
 +              /* Clamp the value between 0 and WLC_TXPWR_MAX w/o overflowing the target */
 +              local_max =
 +                  (wlc->txpwr_local_max -
 +                   wlc->txpwr_local_constraint) * WLC_TXPWR_DB_FACTOR;
 +              if (local_max > 0 && local_max < WLC_TXPWR_MAX)
 +                      return (u8) local_max;
 +              if (local_max < 0)
 +                      return 0;
 +      }
 +
 +      return local;
 +}
 +
 +/* propagate home chanspec to all bsscfgs in case bsscfg->current_bss->chanspec is referenced */
 +void wlc_set_home_chanspec(struct wlc_info *wlc, chanspec_t chanspec)
 +{
 +      if (wlc->home_chanspec != chanspec) {
 +              int idx;
 +              struct wlc_bsscfg *cfg;
 +
 +              wlc->home_chanspec = chanspec;
 +
 +              FOREACH_BSS(wlc, idx, cfg) {
 +                      if (!cfg->associated)
 +                              continue;
 +
 +                      cfg->current_bss->chanspec = chanspec;
 +              }
 +
 +      }
 +}
 +
 +static void wlc_set_phy_chanspec(struct wlc_info *wlc, chanspec_t chanspec)
 +{
 +      /* Save our copy of the chanspec */
 +      wlc->chanspec = chanspec;
 +
 +      /* Set the chanspec and power limits for this locale after computing
 +       * any 11h local tx power constraints.
 +       */
 +      wlc_channel_set_chanspec(wlc->cmi, chanspec,
 +                               wlc_local_constraint_qdbm(wlc));
 +
 +      if (wlc->stf->ss_algosel_auto)
 +              wlc_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
 +                                          chanspec);
 +
 +      wlc_stf_ss_update(wlc, wlc->band);
 +
 +}
 +
 +void wlc_set_chanspec(struct wlc_info *wlc, chanspec_t chanspec)
 +{
 +      uint bandunit;
 +      bool switchband = false;
 +      chanspec_t old_chanspec = wlc->chanspec;
 +
 +      if (!wlc_valid_chanspec_db(wlc->cmi, chanspec)) {
 +              WL_ERROR("wl%d: %s: Bad channel %d\n",
 +                       wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
 +              ASSERT(wlc_valid_chanspec_db(wlc->cmi, chanspec));
 +              return;
 +      }
 +
 +      /* Switch bands if necessary */
 +      if (NBANDS(wlc) > 1) {
 +              bandunit = CHSPEC_WLCBANDUNIT(chanspec);
 +              if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
 +                      switchband = true;
 +                      if (wlc->bandlocked) {
 +                              WL_ERROR("wl%d: %s: chspec %d band is locked!\n",
 +                                       wlc->pub->unit, __func__,
 +                                       CHSPEC_CHANNEL(chanspec));
 +                              return;
 +                      }
 +                      /* BMAC_NOTE: should the setband call come after the wlc_bmac_chanspec() ?
 +                       * if the setband updates (wlc_bsinit) use low level calls to inspect and
 +                       * set state, the state inspected may be from the wrong band, or the
 +                       * following wlc_bmac_set_chanspec() may undo the work.
 +                       */
 +                      wlc_setband(wlc, bandunit);
 +              }
 +      }
 +
 +      ASSERT(N_ENAB(wlc->pub) || !CHSPEC_IS40(chanspec));
 +
 +      /* sync up phy/radio chanspec */
 +      wlc_set_phy_chanspec(wlc, chanspec);
 +
 +      /* init antenna selection */
 +      if (CHSPEC_WLC_BW(old_chanspec) != CHSPEC_WLC_BW(chanspec)) {
 +              wlc_antsel_init(wlc->asi);
 +
 +              /* Fix the hardware rateset based on bw.
 +               * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
 +               */
 +              wlc_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
 +                                        wlc->band->
 +                                        mimo_cap_40 ? CHSPEC_WLC_BW(chanspec)
 +                                        : 0);
 +      }
 +
 +      /* update some mac configuration since chanspec changed */
 +      wlc_ucode_mac_upd(wlc);
 +}
 +
 +#if defined(BCMDBG)
 +static int wlc_get_current_txpwr(struct wlc_info *wlc, void *pwr, uint len)
 +{
 +      txpwr_limits_t txpwr;
 +      tx_power_t power;
 +      tx_power_legacy_t *old_power = NULL;
 +      int r, c;
 +      uint qdbm;
 +      bool override;
 +
 +      if (len == sizeof(tx_power_legacy_t))
 +              old_power = (tx_power_legacy_t *) pwr;
 +      else if (len < sizeof(tx_power_t))
 +              return BCME_BUFTOOSHORT;
 +
 +      memset(&power, 0, sizeof(tx_power_t));
 +
 +      power.chanspec = WLC_BAND_PI_RADIO_CHANSPEC;
 +      if (wlc->pub->associated)
 +              power.local_chanspec = wlc->home_chanspec;
 +
 +      /* Return the user target tx power limits for the various rates.  Note  wlc_phy.c's
 +       * public interface only implements getting and setting a single value for all of
 +       * rates, so we need to fill the array ourselves.
 +       */
 +      wlc_phy_txpower_get(wlc->band->pi, &qdbm, &override);
 +      for (r = 0; r < WL_TX_POWER_RATES; r++) {
 +              power.user_limit[r] = (u8) qdbm;
 +      }
 +
 +      power.local_max = wlc->txpwr_local_max * WLC_TXPWR_DB_FACTOR;
 +      power.local_constraint =
 +          wlc->txpwr_local_constraint * WLC_TXPWR_DB_FACTOR;
 +
 +      power.antgain[0] = wlc->bandstate[BAND_2G_INDEX]->antgain;
 +      power.antgain[1] = wlc->bandstate[BAND_5G_INDEX]->antgain;
 +
 +      wlc_channel_reg_limits(wlc->cmi, power.chanspec, &txpwr);
 +
 +#if WL_TX_POWER_CCK_NUM != WLC_NUM_RATES_CCK
 +#error "WL_TX_POWER_CCK_NUM != WLC_NUM_RATES_CCK"
 +#endif
 +
 +      /* CCK tx power limits */
 +      for (c = 0, r = WL_TX_POWER_CCK_FIRST; c < WL_TX_POWER_CCK_NUM;
 +           c++, r++)
 +              power.reg_limit[r] = txpwr.cck[c];
 +
 +#if WL_TX_POWER_OFDM_NUM != WLC_NUM_RATES_OFDM
 +#error "WL_TX_POWER_OFDM_NUM != WLC_NUM_RATES_OFDM"
 +#endif
 +
 +      /* 20 MHz OFDM SISO tx power limits */
 +      for (c = 0, r = WL_TX_POWER_OFDM_FIRST; c < WL_TX_POWER_OFDM_NUM;
 +           c++, r++)
 +              power.reg_limit[r] = txpwr.ofdm[c];
 +
 +      if (WLC_PHY_11N_CAP(wlc->band)) {
 +
 +              /* 20 MHz OFDM CDD tx power limits */
 +              for (c = 0, r = WL_TX_POWER_OFDM20_CDD_FIRST;
 +                   c < WL_TX_POWER_OFDM_NUM; c++, r++)
 +                      power.reg_limit[r] = txpwr.ofdm_cdd[c];
 +
 +              /* 40 MHz OFDM SISO tx power limits */
 +              for (c = 0, r = WL_TX_POWER_OFDM40_SISO_FIRST;
 +                   c < WL_TX_POWER_OFDM_NUM; c++, r++)
 +                      power.reg_limit[r] = txpwr.ofdm_40_siso[c];
 +
 +              /* 40 MHz OFDM CDD tx power limits */
 +              for (c = 0, r = WL_TX_POWER_OFDM40_CDD_FIRST;
 +                   c < WL_TX_POWER_OFDM_NUM; c++, r++)
 +                      power.reg_limit[r] = txpwr.ofdm_40_cdd[c];
 +
 +#if WL_TX_POWER_MCS_1_STREAM_NUM != WLC_NUM_RATES_MCS_1_STREAM
 +#error "WL_TX_POWER_MCS_1_STREAM_NUM != WLC_NUM_RATES_MCS_1_STREAM"
 +#endif
 +
 +              /* 20MHz MCS0-7 SISO tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS20_SISO_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_20_siso[c];
 +
 +              /* 20MHz MCS0-7 CDD tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS20_CDD_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_20_cdd[c];
 +
 +              /* 20MHz MCS0-7 STBC tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS20_STBC_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_20_stbc[c];
 +
 +              /* 40MHz MCS0-7 SISO tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS40_SISO_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_40_siso[c];
 +
 +              /* 40MHz MCS0-7 CDD tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS40_CDD_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_40_cdd[c];
 +
 +              /* 40MHz MCS0-7 STBC tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS40_STBC_FIRST;
 +                   c < WLC_NUM_RATES_MCS_1_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_40_stbc[c];
 +
 +#if WL_TX_POWER_MCS_2_STREAM_NUM != WLC_NUM_RATES_MCS_2_STREAM
 +#error "WL_TX_POWER_MCS_2_STREAM_NUM != WLC_NUM_RATES_MCS_2_STREAM"
 +#endif
 +
 +              /* 20MHz MCS8-15 SDM tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS20_SDM_FIRST;
 +                   c < WLC_NUM_RATES_MCS_2_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_20_mimo[c];
 +
 +              /* 40MHz MCS8-15 SDM tx power limits */
 +              for (c = 0, r = WL_TX_POWER_MCS40_SDM_FIRST;
 +                   c < WLC_NUM_RATES_MCS_2_STREAM; c++, r++)
 +                      power.reg_limit[r] = txpwr.mcs_40_mimo[c];
 +
 +              /* MCS 32 */
 +              power.reg_limit[WL_TX_POWER_MCS_32] = txpwr.mcs32;
 +      }
 +
 +      wlc_phy_txpower_get_current(wlc->band->pi, &power,
 +                                  CHSPEC_CHANNEL(power.chanspec));
 +
 +      /* copy the tx_power_t struct to the return buffer,
 +       * or convert to a tx_power_legacy_t struct
 +       */
 +      if (!old_power) {
 +              memcpy(pwr, &power, sizeof(tx_power_t));
 +      } else {
 +              int band_idx = CHSPEC_IS2G(power.chanspec) ? 0 : 1;
 +
 +              memset(old_power, 0, sizeof(tx_power_legacy_t));
 +
 +              old_power->txpwr_local_max = power.local_max;
 +              old_power->txpwr_local_constraint = power.local_constraint;
 +              if (CHSPEC_IS2G(power.chanspec)) {
 +                      old_power->txpwr_chan_reg_max = txpwr.cck[0];
 +                      old_power->txpwr_est_Pout[band_idx] =
 +                          power.est_Pout_cck;
 +                      old_power->txpwr_est_Pout_gofdm = power.est_Pout[0];
 +              } else {
 +                      old_power->txpwr_chan_reg_max = txpwr.ofdm[0];
 +                      old_power->txpwr_est_Pout[band_idx] = power.est_Pout[0];
 +              }
 +              old_power->txpwr_antgain[0] = power.antgain[0];
 +              old_power->txpwr_antgain[1] = power.antgain[1];
 +
 +              for (r = 0; r < NUM_PWRCTRL_RATES; r++) {
 +                      old_power->txpwr_band_max[r] = power.user_limit[r];
 +                      old_power->txpwr_limit[r] = power.reg_limit[r];
 +                      old_power->txpwr_target[band_idx][r] = power.target[r];
 +                      if (CHSPEC_IS2G(power.chanspec))
 +                              old_power->txpwr_bphy_cck_max[r] =
 +                                  power.board_limit[r];
 +                      else
 +                              old_power->txpwr_aphy_max[r] =
 +                                  power.board_limit[r];
 +              }
 +      }
 +
 +      return 0;
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +static u32 wlc_watchdog_backup_bi(struct wlc_info *wlc)
 +{
 +      u32 bi;
 +      bi = 2 * wlc->cfg->current_bss->dtim_period *
 +          wlc->cfg->current_bss->beacon_period;
 +      if (wlc->bcn_li_dtim)
 +              bi *= wlc->bcn_li_dtim;
 +      else if (wlc->bcn_li_bcn)
 +              /* recalculate bi based on bcn_li_bcn */
 +              bi = 2 * wlc->bcn_li_bcn * wlc->cfg->current_bss->beacon_period;
 +
 +      if (bi < 2 * TIMER_INTERVAL_WATCHDOG)
 +              bi = 2 * TIMER_INTERVAL_WATCHDOG;
 +      return bi;
 +}
 +
 +/* Change to run the watchdog either from a periodic timer or from tbtt handler.
 + * Call watchdog from tbtt handler if tbtt is true, watchdog timer otherwise.
 + */
 +void wlc_watchdog_upd(struct wlc_info *wlc, bool tbtt)
 +{
 +      /* make sure changing watchdog driver is allowed */
 +      if (!wlc->pub->up || !wlc->pub->align_wd_tbtt)
 +              return;
 +      if (!tbtt && wlc->WDarmed) {
 +              wl_del_timer(wlc->wl, wlc->wdtimer);
 +              wlc->WDarmed = false;
 +      }
 +
 +      /* stop watchdog timer and use tbtt interrupt to drive watchdog */
 +      if (tbtt && wlc->WDarmed) {
 +              wl_del_timer(wlc->wl, wlc->wdtimer);
 +              wlc->WDarmed = false;
 +              wlc->WDlast = OSL_SYSUPTIME();
 +      }
 +      /* arm watchdog timer and drive the watchdog there */
 +      else if (!tbtt && !wlc->WDarmed) {
 +              wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG,
 +                           true);
 +              wlc->WDarmed = true;
 +      }
 +      if (tbtt && !wlc->WDarmed) {
 +              wl_add_timer(wlc->wl, wlc->wdtimer, wlc_watchdog_backup_bi(wlc),
 +                           true);
 +              wlc->WDarmed = true;
 +      }
 +}
 +
 +ratespec_t wlc_lowest_basic_rspec(struct wlc_info *wlc, wlc_rateset_t *rs)
 +{
 +      ratespec_t lowest_basic_rspec;
 +      uint i;
 +
 +      /* Use the lowest basic rate */
 +      lowest_basic_rspec = rs->rates[0] & RATE_MASK;
 +      for (i = 0; i < rs->count; i++) {
 +              if (rs->rates[i] & WLC_RATE_FLAG) {
 +                      lowest_basic_rspec = rs->rates[i] & RATE_MASK;
 +                      break;
 +              }
 +      }
 +#if NCONF
 +      /* pick siso/cdd as default for OFDM (note no basic rate MCSs are supported yet) */
 +      if (IS_OFDM(lowest_basic_rspec)) {
 +              lowest_basic_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
 +      }
 +#endif
 +
 +      return lowest_basic_rspec;
 +}
 +
 +/* This function changes the phytxctl for beacon based on current beacon ratespec AND txant
 + * setting as per this table:
 + *  ratespec     CCK          ant = wlc->stf->txant
 + *            OFDM            ant = 3
 + */
 +void wlc_beacon_phytxctl_txant_upd(struct wlc_info *wlc, ratespec_t bcn_rspec)
 +{
 +      u16 phyctl;
 +      u16 phytxant = wlc->stf->phytxant;
 +      u16 mask = PHY_TXC_ANT_MASK;
 +
 +      /* for non-siso rates or default setting, use the available chains */
 +      if (WLC_PHY_11N_CAP(wlc->band)) {
 +              phytxant = wlc_stf_phytxchain_sel(wlc, bcn_rspec);
 +      }
 +
 +      phyctl = wlc_read_shm(wlc, M_BCN_PCTLWD);
 +      phyctl = (phyctl & ~mask) | phytxant;
 +      wlc_write_shm(wlc, M_BCN_PCTLWD, phyctl);
 +}
 +
 +/* centralized protection config change function to simplify debugging, no consistency checking
 + * this should be called only on changes to avoid overhead in periodic function
 +*/
 +void wlc_protection_upd(struct wlc_info *wlc, uint idx, int val)
 +{
 +      WL_TRACE("wlc_protection_upd: idx %d, val %d\n", idx, val);
 +
 +      switch (idx) {
 +      case WLC_PROT_G_SPEC:
 +              wlc->protection->_g = (bool) val;
 +              break;
 +      case WLC_PROT_G_OVR:
 +              wlc->protection->g_override = (s8) val;
 +              break;
 +      case WLC_PROT_G_USER:
 +              wlc->protection->gmode_user = (u8) val;
 +              break;
 +      case WLC_PROT_OVERLAP:
 +              wlc->protection->overlap = (s8) val;
 +              break;
 +      case WLC_PROT_N_USER:
 +              wlc->protection->nmode_user = (s8) val;
 +              break;
 +      case WLC_PROT_N_CFG:
 +              wlc->protection->n_cfg = (s8) val;
 +              break;
 +      case WLC_PROT_N_CFG_OVR:
 +              wlc->protection->n_cfg_override = (s8) val;
 +              break;
 +      case WLC_PROT_N_NONGF:
 +              wlc->protection->nongf = (bool) val;
 +              break;
 +      case WLC_PROT_N_NONGF_OVR:
 +              wlc->protection->nongf_override = (s8) val;
 +              break;
 +      case WLC_PROT_N_PAM_OVR:
 +              wlc->protection->n_pam_override = (s8) val;
 +              break;
 +      case WLC_PROT_N_OBSS:
 +              wlc->protection->n_obss = (bool) val;
 +              break;
 +
 +      default:
 +              ASSERT(0);
 +              break;
 +      }
 +
 +}
 +
 +static void wlc_ht_update_sgi_rx(struct wlc_info *wlc, int val)
 +{
 +      wlc->ht_cap.cap_info &= ~(IEEE80211_HT_CAP_SGI_20 |
 +                                      IEEE80211_HT_CAP_SGI_40);
 +      wlc->ht_cap.cap_info |= (val & WLC_N_SGI_20) ?
 +                                      IEEE80211_HT_CAP_SGI_20 : 0;
 +      wlc->ht_cap.cap_info |= (val & WLC_N_SGI_40) ?
 +                                      IEEE80211_HT_CAP_SGI_40 : 0;
 +
 +      if (wlc->pub->up) {
 +              wlc_update_beacon(wlc);
 +              wlc_update_probe_resp(wlc, true);
 +      }
 +}
 +
 +static void wlc_ht_update_ldpc(struct wlc_info *wlc, s8 val)
 +{
 +      wlc->stf->ldpc = val;
 +
 +      wlc->ht_cap.cap_info &= ~IEEE80211_HT_CAP_LDPC_CODING;
 +      if (wlc->stf->ldpc != OFF)
 +              wlc->ht_cap.cap_info |= IEEE80211_HT_CAP_LDPC_CODING;
 +
 +      if (wlc->pub->up) {
 +              wlc_update_beacon(wlc);
 +              wlc_update_probe_resp(wlc, true);
 +              wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
 +      }
 +}
 +
 +/*
 + * ucode, hwmac update
 + *    Channel dependent updates for ucode and hw
 + */
 +static void wlc_ucode_mac_upd(struct wlc_info *wlc)
 +{
 +      /* enable or disable any active IBSSs depending on whether or not
 +       * we are on the home channel
 +       */
 +      if (wlc->home_chanspec == WLC_BAND_PI_RADIO_CHANSPEC) {
 +              if (wlc->pub->associated) {
 +                      /* BMAC_NOTE: This is something that should be fixed in ucode inits.
 +                       * I think that the ucode inits set up the bcn templates and shm values
 +                       * with a bogus beacon. This should not be done in the inits. If ucode needs
 +                       * to set up a beacon for testing, the test routines should write it down,
 +                       * not expect the inits to populate a bogus beacon.
 +                       */
 +                      if (WLC_PHY_11N_CAP(wlc->band)) {
 +                              wlc_write_shm(wlc, M_BCN_TXTSF_OFFSET,
 +                                            wlc->band->bcntsfoff);
 +                      }
 +              }
 +      } else {
 +              /* disable an active IBSS if we are not on the home channel */
 +      }
 +
 +      /* update the various promisc bits */
 +      wlc_mac_bcn_promisc(wlc);
 +      wlc_mac_promisc(wlc);
 +}
 +
 +static void wlc_bandinit_ordered(struct wlc_info *wlc, chanspec_t chanspec)
 +{
 +      wlc_rateset_t default_rateset;
 +      uint parkband;
 +      uint i, band_order[2];
 +
 +      WL_TRACE("wl%d: wlc_bandinit_ordered\n", wlc->pub->unit);
 +      /*
 +       * We might have been bandlocked during down and the chip power-cycled (hibernate).
 +       * figure out the right band to park on
 +       */
 +      if (wlc->bandlocked || NBANDS(wlc) == 1) {
 +              ASSERT(CHSPEC_WLCBANDUNIT(chanspec) == wlc->band->bandunit);
 +
 +              parkband = wlc->band->bandunit; /* updated in wlc_bandlock() */
 +              band_order[0] = band_order[1] = parkband;
 +      } else {
 +              /* park on the band of the specified chanspec */
 +              parkband = CHSPEC_WLCBANDUNIT(chanspec);
 +
 +              /* order so that parkband initialize last */
 +              band_order[0] = parkband ^ 1;
 +              band_order[1] = parkband;
 +      }
 +
 +      /* make each band operational, software state init */
 +      for (i = 0; i < NBANDS(wlc); i++) {
 +              uint j = band_order[i];
 +
 +              wlc->band = wlc->bandstate[j];
 +
 +              wlc_default_rateset(wlc, &default_rateset);
 +
 +              /* fill in hw_rate */
 +              wlc_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
 +                                 false, WLC_RATES_CCK_OFDM, RATE_MASK,
 +                                 (bool) N_ENAB(wlc->pub));
 +
 +              /* init basic rate lookup */
 +              wlc_rate_lookup_init(wlc, &default_rateset);
 +      }
 +
 +      /* sync up phy/radio chanspec */
 +      wlc_set_phy_chanspec(wlc, chanspec);
 +}
 +
 +/* band-specific init */
 +static void WLBANDINITFN(wlc_bsinit) (struct wlc_info *wlc)
 +{
 +      WL_TRACE("wl%d: wlc_bsinit: bandunit %d\n",
 +               wlc->pub->unit, wlc->band->bandunit);
 +
 +      /* write ucode ACK/CTS rate table */
 +      wlc_set_ratetable(wlc);
 +
 +      /* update some band specific mac configuration */
 +      wlc_ucode_mac_upd(wlc);
 +
 +      /* init antenna selection */
 +      wlc_antsel_init(wlc->asi);
 +
 +}
 +
 +/* switch to and initialize new band */
 +static void WLBANDINITFN(wlc_setband) (struct wlc_info *wlc, uint bandunit)
 +{
 +      int idx;
 +      struct wlc_bsscfg *cfg;
 +
 +      ASSERT(NBANDS(wlc) > 1);
 +      ASSERT(!wlc->bandlocked);
 +      ASSERT(bandunit != wlc->band->bandunit || wlc->bandinit_pending);
 +
 +      wlc->band = wlc->bandstate[bandunit];
 +
 +      if (!wlc->pub->up)
 +              return;
 +
 +      /* wait for at least one beacon before entering sleeping state */
 +      wlc->PMawakebcn = true;
 +      FOREACH_AS_STA(wlc, idx, cfg)
 +          cfg->PMawakebcn = true;
 +      wlc_set_ps_ctrl(wlc);
 +
 +      /* band-specific initializations */
 +      wlc_bsinit(wlc);
 +}
 +
 +/* Initialize a WME Parameter Info Element with default STA parameters from WMM Spec, Table 12 */
 +void wlc_wme_initparams_sta(struct wlc_info *wlc, wme_param_ie_t *pe)
 +{
 +      static const wme_param_ie_t stadef = {
 +              WME_OUI,
 +              WME_TYPE,
 +              WME_SUBTYPE_PARAM_IE,
 +              WME_VER,
 +              0,
 +              0,
 +              {
 +               {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA,
 +                cpu_to_le16(EDCF_AC_BE_TXOP_STA)},
 +               {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA,
 +                cpu_to_le16(EDCF_AC_BK_TXOP_STA)},
 +               {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA,
 +                cpu_to_le16(EDCF_AC_VI_TXOP_STA)},
 +               {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA,
 +                cpu_to_le16(EDCF_AC_VO_TXOP_STA)}
 +               }
 +      };
 +
 +      ASSERT(sizeof(*pe) == WME_PARAM_IE_LEN);
 +      memcpy(pe, &stadef, sizeof(*pe));
 +}
 +
 +void wlc_wme_setparams(struct wlc_info *wlc, u16 aci, void *arg, bool suspend)
 +{
 +      int i;
 +      shm_acparams_t acp_shm;
 +      u16 *shm_entry;
 +      struct ieee80211_tx_queue_params *params = arg;
 +
 +      ASSERT(wlc);
 +
 +      /* Only apply params if the core is out of reset and has clocks */
 +      if (!wlc->clk) {
 +              WL_ERROR("wl%d: %s : no-clock\n", wlc->pub->unit, __func__);
 +              return;
 +      }
 +
 +      /*
 +       * AP uses AC params from wme_param_ie_ap.
 +       * AP advertises AC params from wme_param_ie.
 +       * STA uses AC params from wme_param_ie.
 +       */
 +
 +      wlc->wme_admctl = 0;
 +
 +      do {
 +              memset((char *)&acp_shm, 0, sizeof(shm_acparams_t));
 +              /* find out which ac this set of params applies to */
 +              ASSERT(aci < AC_COUNT);
 +              /* set the admission control policy for this AC */
 +              /* wlc->wme_admctl |= 1 << aci; *//* should be set ??  seems like off by default */
 +
 +              /* fill in shm ac params struct */
 +              acp_shm.txop = le16_to_cpu(params->txop);
 +              /* convert from units of 32us to us for ucode */
 +              wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
 +                  EDCF_TXOP2USEC(acp_shm.txop);
 +              acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
 +
 +              if (aci == AC_VI && acp_shm.txop == 0
 +                  && acp_shm.aifs < EDCF_AIFSN_MAX)
 +                      acp_shm.aifs++;
 +
 +              if (acp_shm.aifs < EDCF_AIFSN_MIN
 +                  || acp_shm.aifs > EDCF_AIFSN_MAX) {
 +                      WL_ERROR("wl%d: wlc_edcf_setparams: bad aifs %d\n",
 +                               wlc->pub->unit, acp_shm.aifs);
 +                      continue;
 +              }
 +
 +              acp_shm.cwmin = params->cw_min;
 +              acp_shm.cwmax = params->cw_max;
 +              acp_shm.cwcur = acp_shm.cwmin;
 +              acp_shm.bslots =
 +                  R_REG(&wlc->regs->tsf_random) & acp_shm.cwcur;
 +              acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
 +              /* Indicate the new params to the ucode */
 +              acp_shm.status = wlc_read_shm(wlc, (M_EDCF_QINFO +
 +                                                  wme_shmemacindex(aci) *
 +                                                  M_EDCF_QLEN +
 +                                                  M_EDCF_STATUS_OFF));
 +              acp_shm.status |= WME_STATUS_NEWAC;
 +
 +              /* Fill in shm acparam table */
 +              shm_entry = (u16 *) &acp_shm;
 +              for (i = 0; i < (int)sizeof(shm_acparams_t); i += 2)
 +                      wlc_write_shm(wlc,
 +                                    M_EDCF_QINFO +
 +                                    wme_shmemacindex(aci) * M_EDCF_QLEN + i,
 +                                    *shm_entry++);
 +
 +      } while (0);
 +
 +      if (suspend)
 +              wlc_suspend_mac_and_wait(wlc);
 +
 +      if (suspend)
 +              wlc_enable_mac(wlc);
 +
 +}
 +
 +void wlc_edcf_setparams(struct wlc_bsscfg *cfg, bool suspend)
 +{
 +      struct wlc_info *wlc = cfg->wlc;
 +      uint aci, i, j;
 +      edcf_acparam_t *edcf_acp;
 +      shm_acparams_t acp_shm;
 +      u16 *shm_entry;
 +
 +      ASSERT(cfg);
 +      ASSERT(wlc);
 +
 +      /* Only apply params if the core is out of reset and has clocks */
 +      if (!wlc->clk)
 +              return;
 +
 +      /*
 +       * AP uses AC params from wme_param_ie_ap.
 +       * AP advertises AC params from wme_param_ie.
 +       * STA uses AC params from wme_param_ie.
 +       */
 +
 +      edcf_acp = (edcf_acparam_t *) &wlc->wme_param_ie.acparam[0];
 +
 +      wlc->wme_admctl = 0;
 +
 +      for (i = 0; i < AC_COUNT; i++, edcf_acp++) {
 +              memset((char *)&acp_shm, 0, sizeof(shm_acparams_t));
 +              /* find out which ac this set of params applies to */
 +              aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
 +              ASSERT(aci < AC_COUNT);
 +              /* set the admission control policy for this AC */
 +              if (edcf_acp->ACI & EDCF_ACM_MASK) {
 +                      wlc->wme_admctl |= 1 << aci;
 +              }
 +
 +              /* fill in shm ac params struct */
 +              acp_shm.txop = le16_to_cpu(edcf_acp->TXOP);
 +              /* convert from units of 32us to us for ucode */
 +              wlc->edcf_txop[aci] = acp_shm.txop =
 +                  EDCF_TXOP2USEC(acp_shm.txop);
 +              acp_shm.aifs = (edcf_acp->ACI & EDCF_AIFSN_MASK);
 +
 +              if (aci == AC_VI && acp_shm.txop == 0
 +                  && acp_shm.aifs < EDCF_AIFSN_MAX)
 +                      acp_shm.aifs++;
 +
 +              if (acp_shm.aifs < EDCF_AIFSN_MIN
 +                  || acp_shm.aifs > EDCF_AIFSN_MAX) {
 +                      WL_ERROR("wl%d: wlc_edcf_setparams: bad aifs %d\n",
 +                               wlc->pub->unit, acp_shm.aifs);
 +                      continue;
 +              }
 +
 +              /* CWmin = 2^(ECWmin) - 1 */
 +              acp_shm.cwmin = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
 +              /* CWmax = 2^(ECWmax) - 1 */
 +              acp_shm.cwmax = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
 +                                          >> EDCF_ECWMAX_SHIFT);
 +              acp_shm.cwcur = acp_shm.cwmin;
 +              acp_shm.bslots =
 +                  R_REG(&wlc->regs->tsf_random) & acp_shm.cwcur;
 +              acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
 +              /* Indicate the new params to the ucode */
 +              acp_shm.status = wlc_read_shm(wlc, (M_EDCF_QINFO +
 +                                                  wme_shmemacindex(aci) *
 +                                                  M_EDCF_QLEN +
 +                                                  M_EDCF_STATUS_OFF));
 +              acp_shm.status |= WME_STATUS_NEWAC;
 +
 +              /* Fill in shm acparam table */
 +              shm_entry = (u16 *) &acp_shm;
 +              for (j = 0; j < (int)sizeof(shm_acparams_t); j += 2)
 +                      wlc_write_shm(wlc,
 +                                    M_EDCF_QINFO +
 +                                    wme_shmemacindex(aci) * M_EDCF_QLEN + j,
 +                                    *shm_entry++);
 +      }
 +
 +      if (suspend)
 +              wlc_suspend_mac_and_wait(wlc);
 +
 +      if (AP_ENAB(wlc->pub) && WME_ENAB(wlc->pub)) {
 +              wlc_update_beacon(wlc);
 +              wlc_update_probe_resp(wlc, false);
 +      }
 +
 +      if (suspend)
 +              wlc_enable_mac(wlc);
 +
 +}
 +
 +bool wlc_timers_init(struct wlc_info *wlc, int unit)
 +{
 +      wlc->wdtimer = wl_init_timer(wlc->wl, wlc_watchdog_by_timer,
 +              wlc, "watchdog");
 +      if (!wlc->wdtimer) {
 +              WL_ERROR("wl%d:  wl_init_timer for wdtimer failed\n", unit);
 +              goto fail;
 +      }
 +
 +      wlc->radio_timer = wl_init_timer(wlc->wl, wlc_radio_timer,
 +              wlc, "radio");
 +      if (!wlc->radio_timer) {
 +              WL_ERROR("wl%d:  wl_init_timer for radio_timer failed\n", unit);
 +              goto fail;
 +      }
 +
 +      return true;
 +
 + fail:
 +      return false;
 +}
 +
 +/*
 + * Initialize wlc_info default values ...
 + * may get overrides later in this function
 + */
 +void wlc_info_init(struct wlc_info *wlc, int unit)
 +{
 +      int i;
 +      /* Assume the device is there until proven otherwise */
 +      wlc->device_present = true;
 +
 +      /* set default power output percentage to 100 percent */
 +      wlc->txpwr_percent = 100;
 +
 +      /* Save our copy of the chanspec */
 +      wlc->chanspec = CH20MHZ_CHSPEC(1);
 +
 +      /* initialize CCK preamble mode to unassociated state */
 +      wlc->shortpreamble = false;
 +
 +      wlc->legacy_probe = true;
 +
 +      /* various 802.11g modes */
 +      wlc->shortslot = false;
 +      wlc->shortslot_override = WLC_SHORTSLOT_AUTO;
 +
 +      wlc->barker_overlap_control = true;
 +      wlc->barker_preamble = WLC_BARKER_SHORT_ALLOWED;
 +      wlc->txburst_limit_override = AUTO;
 +
 +      wlc_protection_upd(wlc, WLC_PROT_G_OVR, WLC_PROTECTION_AUTO);
 +      wlc_protection_upd(wlc, WLC_PROT_G_SPEC, false);
 +
 +      wlc_protection_upd(wlc, WLC_PROT_N_CFG_OVR, WLC_PROTECTION_AUTO);
 +      wlc_protection_upd(wlc, WLC_PROT_N_CFG, WLC_N_PROTECTION_OFF);
 +      wlc_protection_upd(wlc, WLC_PROT_N_NONGF_OVR, WLC_PROTECTION_AUTO);
 +      wlc_protection_upd(wlc, WLC_PROT_N_NONGF, false);
 +      wlc_protection_upd(wlc, WLC_PROT_N_PAM_OVR, AUTO);
 +
 +      wlc_protection_upd(wlc, WLC_PROT_OVERLAP, WLC_PROTECTION_CTL_OVERLAP);
 +
 +      /* 802.11g draft 4.0 NonERP elt advertisement */
 +      wlc->include_legacy_erp = true;
 +
 +      wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
 +      wlc->stf->txant = ANT_TX_DEF;
 +
 +      wlc->prb_resp_timeout = WLC_PRB_RESP_TIMEOUT;
 +
 +      wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
 +      for (i = 0; i < NFIFO; i++)
 +              wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
 +      wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
 +
 +      /* default rate fallback retry limits */
 +      wlc->SFBL = RETRY_SHORT_FB;
 +      wlc->LFBL = RETRY_LONG_FB;
 +
 +      /* default mac retry limits */
 +      wlc->SRL = RETRY_SHORT_DEF;
 +      wlc->LRL = RETRY_LONG_DEF;
 +
 +      /* init PM state */
 +      wlc->PM = PM_OFF;       /* User's setting of PM mode through IOCTL */
 +      wlc->PM_override = false;       /* Prevents from going to PM if our AP is 'ill' */
 +      wlc->PMenabled = false; /* Current PM state */
 +      wlc->PMpending = false; /* Tracks whether STA indicated PM in the last attempt */
 +      wlc->PMblocked = false; /* To allow blocking going into PM during RM and scans */
 +
 +      /* In WMM Auto mode, PM is allowed if association is a UAPSD association */
 +      wlc->WME_PM_blocked = false;
 +
 +      /* Init wme queuing method */
 +      wlc->wme_prec_queuing = false;
 +
 +      /* Overrides for the core to stay awake under zillion conditions Look for STAY_AWAKE */
 +      wlc->wake = false;
 +      /* Are we waiting for a response to PS-Poll that we sent */
 +      wlc->PSpoll = false;
 +
 +      /* APSD defaults */
 +      wlc->wme_apsd = true;
 +      wlc->apsd_sta_usp = false;
 +      wlc->apsd_trigger_timeout = 0;  /* disable the trigger timer */
 +      wlc->apsd_trigger_ac = AC_BITMAP_ALL;
 +
 +      /* Set flag to indicate that hw keys should be used when available. */
 +      wlc->wsec_swkeys = false;
 +
 +      /* init the 4 static WEP default keys */
 +      for (i = 0; i < WSEC_MAX_DEFAULT_KEYS; i++) {
 +              wlc->wsec_keys[i] = wlc->wsec_def_keys[i];
 +              wlc->wsec_keys[i]->idx = (u8) i;
 +      }
 +
 +      wlc->_regulatory_domain = false;        /* 802.11d */
 +
 +      /* WME QoS mode is Auto by default */
 +      wlc->pub->_wme = AUTO;
 +
 +#ifdef BCMSDIODEV_ENABLED
 +      wlc->pub->_priofc = true;       /* enable priority flow control for sdio dongle */
 +#endif
 +
 +      wlc->pub->_ampdu = AMPDU_AGG_HOST;
 +      wlc->pub->bcmerror = 0;
 +      wlc->ibss_allowed = true;
 +      wlc->ibss_coalesce_allowed = true;
 +      wlc->pub->_coex = ON;
 +
 +      /* initialize mpc delay */
 +      wlc->mpc_delay_off = wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
 +
 +      wlc->pr80838_war = true;
 +}
 +
 +static bool wlc_state_bmac_sync(struct wlc_info *wlc)
 +{
 +      wlc_bmac_state_t state_bmac;
 +
 +      if (wlc_bmac_state_get(wlc->hw, &state_bmac) != 0)
 +              return false;
 +
 +      wlc->machwcap = state_bmac.machwcap;
 +      wlc_protection_upd(wlc, WLC_PROT_N_PAM_OVR,
 +                         (s8) state_bmac.preamble_ovr);
 +
 +      return true;
 +}
 +
 +static uint wlc_attach_module(struct wlc_info *wlc)
 +{
 +      uint err = 0;
 +      uint unit;
 +      unit = wlc->pub->unit;
 +
 +      wlc->asi = wlc_antsel_attach(wlc);
 +      if (wlc->asi == NULL) {
 +              WL_ERROR("wl%d: wlc_attach: wlc_antsel_attach failed\n", unit);
 +              err = 44;
 +              goto fail;
 +      }
 +
 +      wlc->ampdu = wlc_ampdu_attach(wlc);
 +      if (wlc->ampdu == NULL) {
 +              WL_ERROR("wl%d: wlc_attach: wlc_ampdu_attach failed\n", unit);
 +              err = 50;
 +              goto fail;
 +      }
 +
 +      if ((wlc_stf_attach(wlc) != 0)) {
 +              WL_ERROR("wl%d: wlc_attach: wlc_stf_attach failed\n", unit);
 +              err = 68;
 +              goto fail;
 +      }
 + fail:
 +      return err;
 +}
 +
 +struct wlc_pub *wlc_pub(void *wlc)
 +{
 +      return ((struct wlc_info *) wlc)->pub;
 +}
 +
 +#define CHIP_SUPPORTS_11N(wlc)        1
 +
 +/*
 + * The common driver entry routine. Error codes should be unique
 + */
 +void *wlc_attach(void *wl, u16 vendor, u16 device, uint unit, bool piomode,
 +               void *regsva, uint bustype, void *btparam, uint *perr)
 +{
 +      struct wlc_info *wlc;
 +      uint err = 0;
 +      uint j;
 +      struct wlc_pub *pub;
 +      struct wlc_txq_info *qi;
 +      uint n_disabled;
 +
 +      WL_NONE("wl%d: %s: vendor 0x%x device 0x%x\n",
 +              unit, __func__, vendor, device);
 +
 +      ASSERT(WSEC_MAX_RCMTA_KEYS <= WSEC_MAX_KEYS);
 +      ASSERT(WSEC_MAX_DEFAULT_KEYS == WLC_DEFAULT_KEYS);
 +
 +      /* some code depends on packed structures */
 +      ASSERT(sizeof(struct ethhdr) == ETH_HLEN);
 +      ASSERT(sizeof(d11regs_t) == SI_CORE_SIZE);
 +      ASSERT(sizeof(ofdm_phy_hdr_t) == D11_PHY_HDR_LEN);
 +      ASSERT(sizeof(cck_phy_hdr_t) == D11_PHY_HDR_LEN);
 +      ASSERT(sizeof(d11txh_t) == D11_TXH_LEN);
 +      ASSERT(sizeof(d11rxhdr_t) == RXHDR_LEN);
 +      ASSERT(sizeof(struct ieee80211_hdr) == DOT11_A4_HDR_LEN);
 +      ASSERT(sizeof(struct ieee80211_rts) == DOT11_RTS_LEN);
 +      ASSERT(sizeof(tx_status_t) == TXSTATUS_LEN);
 +      ASSERT(sizeof(struct ieee80211_ht_cap) == HT_CAP_IE_LEN);
 +#ifdef BRCM_FULLMAC
 +      ASSERT(offsetof(wl_scan_params_t, channel_list) ==
 +             WL_SCAN_PARAMS_FIXED_SIZE);
 +#endif
 +      ASSERT(IS_ALIGNED(offsetof(wsec_key_t, data), sizeof(u32)));
 +      ASSERT(ISPOWEROF2(MA_WINDOW_SZ));
 +
 +      ASSERT(sizeof(wlc_d11rxhdr_t) <= WL_HWRXOFF);
 +
 +      /*
 +       * Number of replay counters value used in WPA IE must match # rxivs
 +       * supported in wsec_key_t struct. See 802.11i/D3.0 sect. 7.3.2.17
 +       * 'RSN Information Element' figure 8 for this mapping.
 +       */
 +      ASSERT((WPA_CAP_16_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
 +              && 16 == WLC_NUMRXIVS)
 +             || (WPA_CAP_4_REPLAY_CNTRS == WLC_REPLAY_CNTRS_VALUE
 +                 && 4 == WLC_NUMRXIVS));
 +
 +      /* allocate struct wlc_info state and its substructures */
 +      wlc = (struct wlc_info *) wlc_attach_malloc(unit, &err, device);
 +      if (wlc == NULL)
 +              goto fail;
 +      pub = wlc->pub;
 +
 +#if defined(BCMDBG)
 +      wlc_info_dbg = wlc;
 +#endif
 +
 +      wlc->band = wlc->bandstate[0];
 +      wlc->core = wlc->corestate;
 +      wlc->wl = wl;
 +      pub->unit = unit;
 +      wlc->btparam = btparam;
 +      pub->_piomode = piomode;
 +      wlc->bandinit_pending = false;
 +      /* By default restrict TKIP associations from 11n STA's */
 +      wlc->ht_wsec_restriction = WLC_HT_TKIP_RESTRICT;
 +
 +      /* populate struct wlc_info with default values  */
 +      wlc_info_init(wlc, unit);
 +
 +      /* update sta/ap related parameters */
 +      wlc_ap_upd(wlc);
 +
 +      /* 11n_disable nvram */
 +      n_disabled = getintvar(pub->vars, "11n_disable");
 +
 +      /* register a module (to handle iovars) */
 +      wlc_module_register(wlc->pub, wlc_iovars, "wlc_iovars", wlc,
 +                          wlc_doiovar, NULL, NULL);
 +
 +      /*
 +       * low level attach steps(all hw accesses go
 +       * inside, no more in rest of the attach)
 +       */
 +      err = wlc_bmac_attach(wlc, vendor, device, unit, piomode, regsva,
 +                            bustype, btparam);
 +      if (err)
 +              goto fail;
 +
 +      /* for some states, due to different info pointer(e,g, wlc, wlc_hw) or master/slave split,
 +       * HIGH driver(both monolithic and HIGH_ONLY) needs to sync states FROM BMAC portion driver
 +       */
 +      if (!wlc_state_bmac_sync(wlc)) {
 +              err = 20;
 +              goto fail;
 +      }
 +
 +      pub->phy_11ncapable = WLC_PHY_11N_CAP(wlc->band);
 +
 +      /* propagate *vars* from BMAC driver to high driver */
 +      wlc_bmac_copyfrom_vars(wlc->hw, &pub->vars, &wlc->vars_size);
 +
 +
 +      /* set maximum allowed duty cycle */
 +      wlc->tx_duty_cycle_ofdm =
 +          (u16) getintvar(pub->vars, "tx_duty_cycle_ofdm");
 +      wlc->tx_duty_cycle_cck =
 +          (u16) getintvar(pub->vars, "tx_duty_cycle_cck");
 +
 +      wlc_stf_phy_chain_calc(wlc);
 +
 +      /* txchain 1: txant 0, txchain 2: txant 1 */
 +      if (WLCISNPHY(wlc->band) && (wlc->stf->txstreams == 1))
 +              wlc->stf->txant = wlc->stf->hw_txchain - 1;
 +
 +      /* push to BMAC driver */
 +      wlc_phy_stf_chain_init(wlc->band->pi, wlc->stf->hw_txchain,
 +                             wlc->stf->hw_rxchain);
 +
 +      /* pull up some info resulting from the low attach */
 +      {
 +              int i;
 +              for (i = 0; i < NFIFO; i++)
 +                      wlc->core->txavail[i] = wlc->hw->txavail[i];
 +      }
 +
 +      wlc_bmac_hw_etheraddr(wlc->hw, wlc->perm_etheraddr);
 +
 +      memcpy(&pub->cur_etheraddr, &wlc->perm_etheraddr, ETH_ALEN);
 +
 +      for (j = 0; j < NBANDS(wlc); j++) {
 +              /* Use band 1 for single band 11a */
 +              if (IS_SINGLEBAND_5G(wlc->deviceid))
 +                      j = BAND_5G_INDEX;
 +
 +              wlc->band = wlc->bandstate[j];
 +
 +              if (!wlc_attach_stf_ant_init(wlc)) {
 +                      err = 24;
 +                      goto fail;
 +              }
 +
 +              /* default contention windows size limits */
 +              wlc->band->CWmin = APHY_CWMIN;
 +              wlc->band->CWmax = PHY_CWMAX;
 +
 +              /* init gmode value */
 +              if (BAND_2G(wlc->band->bandtype)) {
 +                      wlc->band->gmode = GMODE_AUTO;
 +                      wlc_protection_upd(wlc, WLC_PROT_G_USER,
 +                                         wlc->band->gmode);
 +              }
 +
 +              /* init _n_enab supported mode */
 +              if (WLC_PHY_11N_CAP(wlc->band) && CHIP_SUPPORTS_11N(wlc)) {
 +                      if (n_disabled & WLFEATURE_DISABLE_11N) {
 +                              pub->_n_enab = OFF;
 +                              wlc_protection_upd(wlc, WLC_PROT_N_USER, OFF);
 +                      } else {
 +                              pub->_n_enab = SUPPORT_11N;
 +                              wlc_protection_upd(wlc, WLC_PROT_N_USER,
 +                                                 ((pub->_n_enab ==
 +                                                   SUPPORT_11N) ? WL_11N_2x2 :
 +                                                  WL_11N_3x3));
 +                      }
 +              }
 +
 +              /* init per-band default rateset, depend on band->gmode */
 +              wlc_default_rateset(wlc, &wlc->band->defrateset);
 +
 +              /* fill in hw_rateset (used early by WLC_SET_RATESET) */
 +              wlc_rateset_filter(&wlc->band->defrateset,
 +                                 &wlc->band->hw_rateset, false,
 +                                 WLC_RATES_CCK_OFDM, RATE_MASK,
 +                                 (bool) N_ENAB(wlc->pub));
 +      }
 +
 +      /* update antenna config due to wlc->stf->txant/txchain/ant_rx_ovr change */
 +      wlc_stf_phy_txant_upd(wlc);
 +
 +      /* attach each modules */
 +      err = wlc_attach_module(wlc);
 +      if (err != 0)
 +              goto fail;
 +
 +      if (!wlc_timers_init(wlc, unit)) {
 +              WL_ERROR("wl%d: %s: wlc_init_timer failed\n", unit, __func__);
 +              err = 32;
 +              goto fail;
 +      }
 +
 +      /* depend on rateset, gmode */
 +      wlc->cmi = wlc_channel_mgr_attach(wlc);
 +      if (!wlc->cmi) {
 +              WL_ERROR("wl%d: %s: wlc_channel_mgr_attach failed\n",
 +                       unit, __func__);
 +              err = 33;
 +              goto fail;
 +      }
 +
 +      /* init default when all parameters are ready, i.e. ->rateset */
 +      wlc_bss_default_init(wlc);
 +
 +      /*
 +       * Complete the wlc default state initializations..
 +       */
 +
 +      /* allocate our initial queue */
 +      qi = wlc_txq_alloc(wlc);
 +      if (qi == NULL) {
 +              WL_ERROR("wl%d: %s: failed to malloc tx queue\n",
 +                       unit, __func__);
 +              err = 100;
 +              goto fail;
 +      }
 +      wlc->active_queue = qi;
 +
 +      wlc->bsscfg[0] = wlc->cfg;
 +      wlc->cfg->_idx = 0;
 +      wlc->cfg->wlc = wlc;
 +      pub->txmaxpkts = MAXTXPKTS;
 +
 +      pub->_cnt->version = WL_CNT_T_VERSION;
 +      pub->_cnt->length = sizeof(struct wl_cnt);
 +
 +      WLCNTSET(pub->_wme_cnt->version, WL_WME_CNT_VERSION);
 +      WLCNTSET(pub->_wme_cnt->length, sizeof(wl_wme_cnt_t));
 +
 +      wlc_wme_initparams_sta(wlc, &wlc->wme_param_ie);
 +
 +      wlc->mimoft = FT_HT;
 +      wlc->ht_cap.cap_info = HT_CAP;
 +      if (HT_ENAB(wlc->pub))
 +              wlc->stf->ldpc = AUTO;
 +
 +      wlc->mimo_40txbw = AUTO;
 +      wlc->ofdm_40txbw = AUTO;
 +      wlc->cck_40txbw = AUTO;
 +      wlc_update_mimo_band_bwcap(wlc, WLC_N_BW_20IN2G_40IN5G);
 +
 +      /* Enable setting the RIFS Mode bit by default in HT Info IE */
 +      wlc->rifs_advert = AUTO;
 +
 +      /* Set default values of SGI */
 +      if (WLC_SGI_CAP_PHY(wlc)) {
 +              wlc_ht_update_sgi_rx(wlc, (WLC_N_SGI_20 | WLC_N_SGI_40));
 +              wlc->sgi_tx = AUTO;
 +      } else if (WLCISSSLPNPHY(wlc->band)) {
 +              wlc_ht_update_sgi_rx(wlc, (WLC_N_SGI_20 | WLC_N_SGI_40));
 +              wlc->sgi_tx = AUTO;
 +      } else {
 +              wlc_ht_update_sgi_rx(wlc, 0);
 +              wlc->sgi_tx = OFF;
 +      }
 +
 +      /* *******nvram 11n config overrides Start ********* */
 +
 +      /* apply the sgi override from nvram conf */
 +      if (n_disabled & WLFEATURE_DISABLE_11N_SGI_TX)
 +              wlc->sgi_tx = OFF;
 +
 +      if (n_disabled & WLFEATURE_DISABLE_11N_SGI_RX)
 +              wlc_ht_update_sgi_rx(wlc, 0);
 +
 +      /* apply the stbc override from nvram conf */
 +      if (n_disabled & WLFEATURE_DISABLE_11N_STBC_TX) {
 +              wlc->bandstate[BAND_2G_INDEX]->band_stf_stbc_tx = OFF;
 +              wlc->bandstate[BAND_5G_INDEX]->band_stf_stbc_tx = OFF;
 +              wlc->ht_cap.cap_info &= ~IEEE80211_HT_CAP_TX_STBC;
 +      }
 +      if (n_disabled & WLFEATURE_DISABLE_11N_STBC_RX)
 +              wlc_stf_stbc_rx_set(wlc, HT_CAP_RX_STBC_NO);
 +
 +      /* apply the GF override from nvram conf */
 +      if (n_disabled & WLFEATURE_DISABLE_11N_GF)
 +              wlc->ht_cap.cap_info &= ~IEEE80211_HT_CAP_GRN_FLD;
 +
 +      /* initialize radio_mpc_disable according to wlc->mpc */
 +      wlc_radio_mpc_upd(wlc);
 +
 +      if ((wlc->pub->sih->chip) == BCM43235_CHIP_ID) {
 +              if ((getintvar(wlc->pub->vars, "aa2g") == 7) ||
 +                  (getintvar(wlc->pub->vars, "aa5g") == 7)) {
 +                      wlc_bmac_antsel_set(wlc->hw, 1);
 +              }
 +      } else {
 +              wlc_bmac_antsel_set(wlc->hw, wlc->asi->antsel_avail);
 +      }
 +
 +      if (perr)
 +              *perr = 0;
 +
 +      return (void *)wlc;
 +
 + fail:
 +      WL_ERROR("wl%d: %s: failed with err %d\n", unit, __func__, err);
 +      if (wlc)
 +              wlc_detach(wlc);
 +
 +      if (perr)
 +              *perr = err;
 +      return NULL;
 +}
 +
 +static void wlc_attach_antgain_init(struct wlc_info *wlc)
 +{
 +      uint unit;
 +      unit = wlc->pub->unit;
 +
 +      if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
 +              /* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
 +              wlc->band->antgain = 8;
 +      } else if (wlc->band->antgain == -1) {
 +              WL_ERROR("wl%d: %s: Invalid antennas available in srom, using 2dB\n",
 +                       unit, __func__);
 +              wlc->band->antgain = 8;
 +      } else {
 +              s8 gain, fract;
 +              /* Older sroms specified gain in whole dbm only.  In order
 +               * be able to specify qdbm granularity and remain backward compatible
 +               * the whole dbms are now encoded in only low 6 bits and remaining qdbms
 +               * are encoded in the hi 2 bits. 6 bit signed number ranges from
 +               * -32 - 31. Examples: 0x1 = 1 db,
 +               * 0xc1 = 1.75 db (1 + 3 quarters),
 +               * 0x3f = -1 (-1 + 0 quarters),
 +               * 0x7f = -.75 (-1 in low 6 bits + 1 quarters in hi 2 bits) = -3 qdbm.
 +               * 0xbf = -.50 (-1 in low 6 bits + 2 quarters in hi 2 bits) = -2 qdbm.
 +               */
 +              gain = wlc->band->antgain & 0x3f;
 +              gain <<= 2;     /* Sign extend */
 +              gain >>= 2;
 +              fract = (wlc->band->antgain & 0xc0) >> 6;
 +              wlc->band->antgain = 4 * gain + fract;
 +      }
 +}
 +
 +static bool wlc_attach_stf_ant_init(struct wlc_info *wlc)
 +{
 +      int aa;
 +      uint unit;
 +      char *vars;
 +      int bandtype;
 +
 +      unit = wlc->pub->unit;
 +      vars = wlc->pub->vars;
 +      bandtype = wlc->band->bandtype;
 +
 +      /* get antennas available */
 +      aa = (s8) getintvar(vars, (BAND_5G(bandtype) ? "aa5g" : "aa2g"));
 +      if (aa == 0)
 +              aa = (s8) getintvar(vars,
 +                                    (BAND_5G(bandtype) ? "aa1" : "aa0"));
 +      if ((aa < 1) || (aa > 15)) {
 +              WL_ERROR("wl%d: %s: Invalid antennas available in srom (0x%x), using 3\n",
 +                       unit, __func__, aa);
 +              aa = 3;
 +      }
 +
 +      /* reset the defaults if we have a single antenna */
 +      if (aa == 1) {
 +              wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
 +              wlc->stf->txant = ANT_TX_FORCE_0;
 +      } else if (aa == 2) {
 +              wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
 +              wlc->stf->txant = ANT_TX_FORCE_1;
 +      } else {
 +      }
 +
 +      /* Compute Antenna Gain */
 +      wlc->band->antgain =
 +          (s8) getintvar(vars, (BAND_5G(bandtype) ? "ag1" : "ag0"));
 +      wlc_attach_antgain_init(wlc);
 +
 +      return true;
 +}
 +
 +
 +static void wlc_timers_deinit(struct wlc_info *wlc)
 +{
 +      /* free timer state */
 +      if (wlc->wdtimer) {
 +              wl_free_timer(wlc->wl, wlc->wdtimer);
 +              wlc->wdtimer = NULL;
 +      }
 +      if (wlc->radio_timer) {
 +              wl_free_timer(wlc->wl, wlc->radio_timer);
 +              wlc->radio_timer = NULL;
 +      }
 +}
 +
 +static void wlc_detach_module(struct wlc_info *wlc)
 +{
 +      if (wlc->asi) {
 +              wlc_antsel_detach(wlc->asi);
 +              wlc->asi = NULL;
 +      }
 +
 +      if (wlc->ampdu) {
 +              wlc_ampdu_detach(wlc->ampdu);
 +              wlc->ampdu = NULL;
 +      }
 +
 +      wlc_stf_detach(wlc);
 +}
 +
 +/*
 + * Return a count of the number of driver callbacks still pending.
 + *
 + * General policy is that wlc_detach can only dealloc/free software states. It can NOT
 + *  touch hardware registers since the d11core may be in reset and clock may not be available.
 + *    One exception is sb register access, which is possible if crystal is turned on
 + * After "down" state, driver should avoid software timer with the exception of radio_monitor.
 + */
 +uint wlc_detach(struct wlc_info *wlc)
 +{
 +      uint i;
 +      uint callbacks = 0;
 +
 +      if (wlc == NULL)
 +              return 0;
 +
 +      WL_TRACE("wl%d: %s\n", wlc->pub->unit, __func__);
 +
 +      ASSERT(!wlc->pub->up);
 +
 +      callbacks += wlc_bmac_detach(wlc);
 +
 +      /* delete software timers */
 +      if (!wlc_radio_monitor_stop(wlc))
 +              callbacks++;
 +
 +      wlc_channel_mgr_detach(wlc->cmi);
 +
 +      wlc_timers_deinit(wlc);
 +
 +      wlc_detach_module(wlc);
 +
 +      /* free other state */
 +
 +
 +#ifdef BCMDBG
 +      kfree(wlc->country_ie_override);
 +      wlc->country_ie_override = NULL;
 +#endif                                /* BCMDBG */
 +
 +      {
 +              /* free dumpcb list */
 +              struct dumpcb_s *prev, *ptr;
 +              prev = ptr = wlc->dumpcb_head;
 +              while (ptr) {
 +                      ptr = prev->next;
 +                      kfree(prev);
 +                      prev = ptr;
 +              }
 +              wlc->dumpcb_head = NULL;
 +      }
 +
 +      /* Detach from iovar manager */
 +      wlc_module_unregister(wlc->pub, "wlc_iovars", wlc);
 +
 +      while (wlc->tx_queues != NULL)
 +              wlc_txq_free(wlc, wlc->tx_queues);
 +
 +      /*
 +       * consistency check: wlc_module_register/wlc_module_unregister calls
 +       * should match therefore nothing should be left here.
 +       */
 +      for (i = 0; i < WLC_MAXMODULES; i++)
 +              ASSERT(wlc->modulecb[i].name[0] == '\0');
 +
 +      wlc_detach_mfree(wlc);
 +      return callbacks;
 +}
 +
 +/* update state that depends on the current value of "ap" */
 +void wlc_ap_upd(struct wlc_info *wlc)
 +{
 +      if (AP_ENAB(wlc->pub))
 +              wlc->PLCPHdr_override = WLC_PLCP_AUTO;  /* AP: short not allowed, but not enforced */
 +      else
 +              wlc->PLCPHdr_override = WLC_PLCP_SHORT; /* STA-BSS; short capable */
 +
 +      /* disable vlan_mode on AP since some legacy STAs cannot rx tagged pkts */
 +      wlc->vlan_mode = AP_ENAB(wlc->pub) ? OFF : AUTO;
 +
 +      /* fixup mpc */
 +      wlc->mpc = true;
 +}
 +
 +/* read hwdisable state and propagate to wlc flag */
 +static void wlc_radio_hwdisable_upd(struct wlc_info *wlc)
 +{
 +      if (wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO || wlc->pub->hw_off)
 +              return;
 +
 +      if (wlc_bmac_radio_read_hwdisabled(wlc->hw)) {
 +              mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
 +      } else {
 +              mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
 +      }
 +}
 +
 +/* return true if Minimum Power Consumption should be entered, false otherwise */
 +bool wlc_is_non_delay_mpc(struct wlc_info *wlc)
 +{
 +      return false;
 +}
 +
 +bool wlc_ismpc(struct wlc_info *wlc)
 +{
 +      return (wlc->mpc_delay_off == 0) && (wlc_is_non_delay_mpc(wlc));
 +}
 +
 +void wlc_radio_mpc_upd(struct wlc_info *wlc)
 +{
 +      bool mpc_radio, radio_state;
 +
 +      /*
 +       * Clear the WL_RADIO_MPC_DISABLE bit when mpc feature is disabled
 +       * in case the WL_RADIO_MPC_DISABLE bit was set. Stop the radio
 +       * monitor also when WL_RADIO_MPC_DISABLE is the only reason that
 +       * the radio is going down.
 +       */
 +      if (!wlc->mpc) {
 +              if (!wlc->pub->radio_disabled)
 +                      return;
 +              mboolclr(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE);
 +              wlc_radio_upd(wlc);
 +              if (!wlc->pub->radio_disabled)
 +                      wlc_radio_monitor_stop(wlc);
 +              return;
 +      }
 +
 +      /*
 +       * sync ismpc logic with WL_RADIO_MPC_DISABLE bit in wlc->pub->radio_disabled
 +       * to go ON, always call radio_upd synchronously
 +       * to go OFF, postpone radio_upd to later when context is safe(e.g. watchdog)
 +       */
 +      radio_state =
 +          (mboolisset(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE) ? OFF :
 +           ON);
 +      mpc_radio = (wlc_ismpc(wlc) == true) ? OFF : ON;
 +
 +      if (radio_state == ON && mpc_radio == OFF)
 +              wlc->mpc_delay_off = wlc->mpc_dlycnt;
 +      else if (radio_state == OFF && mpc_radio == ON) {
 +              mboolclr(wlc->pub->radio_disabled, WL_RADIO_MPC_DISABLE);
 +              wlc_radio_upd(wlc);
 +              if (wlc->mpc_offcnt < WLC_MPC_THRESHOLD) {
 +                      wlc->mpc_dlycnt = WLC_MPC_MAX_DELAYCNT;
 +              } else
 +                      wlc->mpc_dlycnt = WLC_MPC_MIN_DELAYCNT;
 +              wlc->mpc_dur += OSL_SYSUPTIME() - wlc->mpc_laston_ts;
 +      }
 +      /* Below logic is meant to capture the transition from mpc off to mpc on for reasons
 +       * other than wlc->mpc_delay_off keeping the mpc off. In that case reset
 +       * wlc->mpc_delay_off to wlc->mpc_dlycnt, so that we restart the countdown of mpc_delay_off
 +       */
 +      if ((wlc->prev_non_delay_mpc == false) &&
 +          (wlc_is_non_delay_mpc(wlc) == true) && wlc->mpc_delay_off) {
 +              wlc->mpc_delay_off = wlc->mpc_dlycnt;
 +      }
 +      wlc->prev_non_delay_mpc = wlc_is_non_delay_mpc(wlc);
 +}
 +
 +/*
 + * centralized radio disable/enable function,
 + * invoke radio enable/disable after updating hwradio status
 + */
 +static void wlc_radio_upd(struct wlc_info *wlc)
 +{
 +      if (wlc->pub->radio_disabled) {
 +              wlc_radio_disable(wlc);
 +      } else {
 +              wlc_radio_enable(wlc);
 +      }
 +}
 +
 +/* maintain LED behavior in down state */
 +static void wlc_down_led_upd(struct wlc_info *wlc)
 +{
 +      ASSERT(!wlc->pub->up);
 +
 +      /* maintain LEDs while in down state, turn on sbclk if not available yet */
 +      /* turn on sbclk if necessary */
 +      if (!AP_ENAB(wlc->pub)) {
 +              wlc_pllreq(wlc, true, WLC_PLLREQ_FLIP);
 +
 +              wlc_pllreq(wlc, false, WLC_PLLREQ_FLIP);
 +      }
 +}
 +
 +/* update hwradio status and return it */
 +bool wlc_check_radio_disabled(struct wlc_info *wlc)
 +{
 +      wlc_radio_hwdisable_upd(wlc);
 +
 +      return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ? true : false;
 +}
 +
 +void wlc_radio_disable(struct wlc_info *wlc)
 +{
 +      if (!wlc->pub->up) {
 +              wlc_down_led_upd(wlc);
 +              return;
 +      }
 +
 +      wlc_radio_monitor_start(wlc);
 +      wl_down(wlc->wl);
 +}
 +
 +static void wlc_radio_enable(struct wlc_info *wlc)
 +{
 +      if (wlc->pub->up)
 +              return;
 +
 +      if (DEVICEREMOVED(wlc))
 +              return;
 +
 +      if (!wlc->down_override) {      /* imposed by wl down/out ioctl */
 +              wl_up(wlc->wl);
 +      }
 +}
 +
 +/* periodical query hw radio button while driver is "down" */
 +static void wlc_radio_timer(void *arg)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) arg;
 +
 +      if (DEVICEREMOVED(wlc)) {
 +              WL_ERROR("wl%d: %s: dead chip\n", wlc->pub->unit, __func__);
 +              wl_down(wlc->wl);
 +              return;
 +      }
 +
 +      /* cap mpc off count */
 +      if (wlc->mpc_offcnt < WLC_MPC_MAX_DELAYCNT)
 +              wlc->mpc_offcnt++;
 +
 +      /* validate all the reasons driver could be down and running this radio_timer */
 +      ASSERT(wlc->pub->radio_disabled || wlc->down_override);
 +      wlc_radio_hwdisable_upd(wlc);
 +      wlc_radio_upd(wlc);
 +}
 +
 +static bool wlc_radio_monitor_start(struct wlc_info *wlc)
 +{
 +      /* Don't start the timer if HWRADIO feature is disabled */
 +      if (wlc->radio_monitor || (wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO))
 +              return true;
 +
 +      wlc->radio_monitor = true;
 +      wlc_pllreq(wlc, true, WLC_PLLREQ_RADIO_MON);
 +      wl_add_timer(wlc->wl, wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
 +      return true;
 +}
 +
 +bool wlc_radio_monitor_stop(struct wlc_info *wlc)
 +{
 +      if (!wlc->radio_monitor)
 +              return true;
 +
 +      ASSERT((wlc->pub->wlfeatureflag & WL_SWFL_NOHWRADIO) !=
 +             WL_SWFL_NOHWRADIO);
 +
 +      wlc->radio_monitor = false;
 +      wlc_pllreq(wlc, false, WLC_PLLREQ_RADIO_MON);
 +      return wl_del_timer(wlc->wl, wlc->radio_timer);
 +}
 +
 +/* bring the driver down, but don't reset hardware */
 +void wlc_out(struct wlc_info *wlc)
 +{
 +      wlc_bmac_set_noreset(wlc->hw, true);
 +      wlc_radio_upd(wlc);
 +      wl_down(wlc->wl);
 +      wlc_bmac_set_noreset(wlc->hw, false);
 +
 +      /* core clk is true in BMAC driver due to noreset, need to mirror it in HIGH */
 +      wlc->clk = true;
 +
 +      /* This will make sure that when 'up' is done
 +       * after 'out' it'll restore hardware (especially gpios)
 +       */
 +      wlc->pub->hw_up = false;
 +}
 +
 +#if defined(BCMDBG)
 +/* Verify the sanity of wlc->tx_prec_map. This can be done only by making sure that
 + * if there is no packet pending for the FIFO, then the corresponding prec bits should be set
 + * in prec_map. Of course, ignore this rule when block_datafifo is set
 + */
 +static bool wlc_tx_prec_map_verify(struct wlc_info *wlc)
 +{
 +      /* For non-WME, both fifos have overlapping prec_map. So it's an error only if both
 +       * fail the check.
 +       */
 +      if (!EDCF_ENAB(wlc->pub)) {
 +              if (!(WLC_TX_FIFO_CHECK(wlc, TX_DATA_FIFO) ||
 +                    WLC_TX_FIFO_CHECK(wlc, TX_CTL_FIFO)))
 +                      return false;
 +              else
 +                      return true;
 +      }
 +
 +      return WLC_TX_FIFO_CHECK(wlc, TX_AC_BK_FIFO)
 +              && WLC_TX_FIFO_CHECK(wlc, TX_AC_BE_FIFO)
 +              && WLC_TX_FIFO_CHECK(wlc, TX_AC_VI_FIFO)
 +              && WLC_TX_FIFO_CHECK(wlc, TX_AC_VO_FIFO);
 +}
 +#endif                                /* BCMDBG */
 +
 +static void wlc_watchdog_by_timer(void *arg)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) arg;
 +      wlc_watchdog(arg);
 +      if (WLC_WATCHDOG_TBTT(wlc)) {
 +              /* set to normal osl watchdog period */
 +              wl_del_timer(wlc->wl, wlc->wdtimer);
 +              wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG,
 +                           true);
 +      }
 +}
 +
 +/* common watchdog code */
 +static void wlc_watchdog(void *arg)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) arg;
 +      int i;
 +      struct wlc_bsscfg *cfg;
 +
 +      WL_TRACE("wl%d: wlc_watchdog\n", wlc->pub->unit);
 +
 +      if (!wlc->pub->up)
 +              return;
 +
 +      if (DEVICEREMOVED(wlc)) {
 +              WL_ERROR("wl%d: %s: dead chip\n", wlc->pub->unit, __func__);
 +              wl_down(wlc->wl);
 +              return;
 +      }
 +
 +      /* increment second count */
 +      wlc->pub->now++;
 +
 +      /* delay radio disable */
 +      if (wlc->mpc_delay_off) {
 +              if (--wlc->mpc_delay_off == 0) {
 +                      mboolset(wlc->pub->radio_disabled,
 +                               WL_RADIO_MPC_DISABLE);
 +                      if (wlc->mpc && wlc_ismpc(wlc))
 +                              wlc->mpc_offcnt = 0;
 +                      wlc->mpc_laston_ts = OSL_SYSUPTIME();
 +              }
 +      }
 +
 +      /* mpc sync */
 +      wlc_radio_mpc_upd(wlc);
 +      /* radio sync: sw/hw/mpc --> radio_disable/radio_enable */
 +      wlc_radio_hwdisable_upd(wlc);
 +      wlc_radio_upd(wlc);
 +      /* if ismpc, driver should be in down state if up/down is allowed */
 +      if (wlc->mpc && wlc_ismpc(wlc))
 +              ASSERT(!wlc->pub->up);
 +      /* if radio is disable, driver may be down, quit here */
 +      if (wlc->pub->radio_disabled)
 +              return;
 +
 +      wlc_bmac_watchdog(wlc);
 +
 +      /* occasionally sample mac stat counters to detect 16-bit counter wrap */
 +      if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
 +              wlc_statsupd(wlc);
 +
 +      /* Manage TKIP countermeasures timers */
 +      FOREACH_BSS(wlc, i, cfg) {
 +              if (cfg->tk_cm_dt) {
 +                      cfg->tk_cm_dt--;
 +              }
 +              if (cfg->tk_cm_bt) {
 +                      cfg->tk_cm_bt--;
 +              }
 +      }
 +
 +      /* Call any registered watchdog handlers */
 +      for (i = 0; i < WLC_MAXMODULES; i++) {
 +              if (wlc->modulecb[i].watchdog_fn)
 +                      wlc->modulecb[i].watchdog_fn(wlc->modulecb[i].hdl);
 +      }
 +
 +      if (WLCISNPHY(wlc->band) && !wlc->pub->tempsense_disable &&
 +          ((wlc->pub->now - wlc->tempsense_lasttime) >=
 +           WLC_TEMPSENSE_PERIOD)) {
 +              wlc->tempsense_lasttime = wlc->pub->now;
 +              wlc_tempsense_upd(wlc);
 +      }
 +      /* BMAC_NOTE: for HIGH_ONLY driver, this seems being called after RPC bus failed */
 +      ASSERT(wlc_bmac_taclear(wlc->hw, true));
 +
 +      /* Verify that tx_prec_map and fifos are in sync to avoid lock ups */
 +      ASSERT(wlc_tx_prec_map_verify(wlc));
 +
 +      ASSERT(wlc_ps_check(wlc));
 +}
 +
 +/* make interface operational */
 +int wlc_up(struct wlc_info *wlc)
 +{
 +      WL_TRACE("wl%d: %s:\n", wlc->pub->unit, __func__);
 +
 +      /* HW is turned off so don't try to access it */
 +      if (wlc->pub->hw_off || DEVICEREMOVED(wlc))
 +              return BCME_RADIOOFF;
 +
 +      if (!wlc->pub->hw_up) {
 +              wlc_bmac_hw_up(wlc->hw);
 +              wlc->pub->hw_up = true;
 +      }
 +
 +      if ((wlc->pub->boardflags & BFL_FEM)
 +          && (wlc->pub->sih->chip == BCM4313_CHIP_ID)) {
 +              if (wlc->pub->boardrev >= 0x1250
 +                  && (wlc->pub->boardflags & BFL_FEM_BT)) {
 +                      wlc_mhf(wlc, MHF5, MHF5_4313_GPIOCTRL,
 +                              MHF5_4313_GPIOCTRL, WLC_BAND_ALL);
 +              } else {
 +                      wlc_mhf(wlc, MHF4, MHF4_EXTPA_ENABLE, MHF4_EXTPA_ENABLE,
 +                              WLC_BAND_ALL);
 +              }
 +      }
 +
 +      /*
 +       * Need to read the hwradio status here to cover the case where the system
 +       * is loaded with the hw radio disabled. We do not want to bring the driver up in this case.
 +       * if radio is disabled, abort up, lower power, start radio timer and return 0(for NDIS)
 +       * don't call radio_update to avoid looping wlc_up.
 +       *
 +       * wlc_bmac_up_prep() returns either 0 or BCME_RADIOOFF only
 +       */
 +      if (!wlc->pub->radio_disabled) {
 +              int status = wlc_bmac_up_prep(wlc->hw);
 +              if (status == BCME_RADIOOFF) {
 +                      if (!mboolisset
 +                          (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
 +                              int idx;
 +                              struct wlc_bsscfg *bsscfg;
 +                              mboolset(wlc->pub->radio_disabled,
 +                                       WL_RADIO_HW_DISABLE);
 +
 +                              FOREACH_BSS(wlc, idx, bsscfg) {
 +                                      if (!BSSCFG_STA(bsscfg)
 +                                          || !bsscfg->enable || !bsscfg->BSS)
 +                                              continue;
 +                                      WL_ERROR("wl%d.%d: wlc_up: rfdisable -> " "wlc_bsscfg_disable()\n",
 +                                               wlc->pub->unit, idx);
 +                              }
 +                      }
 +              } else
 +                      ASSERT(!status);
 +      }
 +
 +      if (wlc->pub->radio_disabled) {
 +              wlc_radio_monitor_start(wlc);
 +              return 0;
 +      }
 +
 +      /* wlc_bmac_up_prep has done wlc_corereset(). so clk is on, set it */
 +      wlc->clk = true;
 +
 +      wlc_radio_monitor_stop(wlc);
 +
 +      /* Set EDCF hostflags */
 +      if (EDCF_ENAB(wlc->pub)) {
 +              wlc_mhf(wlc, MHF1, MHF1_EDCF, MHF1_EDCF, WLC_BAND_ALL);
 +      } else {
 +              wlc_mhf(wlc, MHF1, MHF1_EDCF, 0, WLC_BAND_ALL);
 +      }
 +
 +      if (WLC_WAR16165(wlc))
 +              wlc_mhf(wlc, MHF2, MHF2_PCISLOWCLKWAR, MHF2_PCISLOWCLKWAR,
 +                      WLC_BAND_ALL);
 +
 +      wl_init(wlc->wl);
 +      wlc->pub->up = true;
 +
 +      if (wlc->bandinit_pending) {
 +              wlc_suspend_mac_and_wait(wlc);
 +              wlc_set_chanspec(wlc, wlc->default_bss->chanspec);
 +              wlc->bandinit_pending = false;
 +              wlc_enable_mac(wlc);
 +      }
 +
 +      wlc_bmac_up_finish(wlc->hw);
 +
 +      /* other software states up after ISR is running */
 +      /* start APs that were to be brought up but are not up  yet */
 +      /* if (AP_ENAB(wlc->pub)) wlc_restart_ap(wlc->ap); */
 +
 +      /* Program the TX wme params with the current settings */
 +      wlc_wme_retries_write(wlc);
 +
 +      /* start one second watchdog timer */
 +      ASSERT(!wlc->WDarmed);
 +      wl_add_timer(wlc->wl, wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
 +      wlc->WDarmed = true;
 +
 +      /* ensure antenna config is up to date */
 +      wlc_stf_phy_txant_upd(wlc);
 +      /* ensure LDPC config is in sync */
 +      wlc_ht_update_ldpc(wlc, wlc->stf->ldpc);
 +
 +      return 0;
 +}
 +
 +/* Initialize the base precedence map for dequeueing from txq based on WME settings */
 +static void wlc_tx_prec_map_init(struct wlc_info *wlc)
 +{
 +      wlc->tx_prec_map = WLC_PREC_BMP_ALL;
 +      memset(wlc->fifo2prec_map, 0, NFIFO * sizeof(u16));
 +
 +      /* For non-WME, both fifos have overlapping MAXPRIO. So just disable all precedences
 +       * if either is full.
 +       */
 +      if (!EDCF_ENAB(wlc->pub)) {
 +              wlc->fifo2prec_map[TX_DATA_FIFO] = WLC_PREC_BMP_ALL;
 +              wlc->fifo2prec_map[TX_CTL_FIFO] = WLC_PREC_BMP_ALL;
 +      } else {
 +              wlc->fifo2prec_map[TX_AC_BK_FIFO] = WLC_PREC_BMP_AC_BK;
 +              wlc->fifo2prec_map[TX_AC_BE_FIFO] = WLC_PREC_BMP_AC_BE;
 +              wlc->fifo2prec_map[TX_AC_VI_FIFO] = WLC_PREC_BMP_AC_VI;
 +              wlc->fifo2prec_map[TX_AC_VO_FIFO] = WLC_PREC_BMP_AC_VO;
 +      }
 +}
 +
 +static uint wlc_down_del_timer(struct wlc_info *wlc)
 +{
 +      uint callbacks = 0;
 +
 +      return callbacks;
 +}
 +
 +/*
 + * Mark the interface nonoperational, stop the software mechanisms,
 + * disable the hardware, free any transient buffer state.
 + * Return a count of the number of driver callbacks still pending.
 + */
 +uint wlc_down(struct wlc_info *wlc)
 +{
 +
 +      uint callbacks = 0;
 +      int i;
 +      bool dev_gone = false;
 +      struct wlc_txq_info *qi;
 +
 +      WL_TRACE("wl%d: %s:\n", wlc->pub->unit, __func__);
 +
 +      /* check if we are already in the going down path */
 +      if (wlc->going_down) {
 +              WL_ERROR("wl%d: %s: Driver going down so return\n",
 +                       wlc->pub->unit, __func__);
 +              return 0;
 +      }
 +      if (!wlc->pub->up)
 +              return callbacks;
 +
 +      /* in between, mpc could try to bring down again.. */
 +      wlc->going_down = true;
 +
 +      callbacks += wlc_bmac_down_prep(wlc->hw);
 +
 +      dev_gone = DEVICEREMOVED(wlc);
 +
 +      /* Call any registered down handlers */
 +      for (i = 0; i < WLC_MAXMODULES; i++) {
 +              if (wlc->modulecb[i].down_fn)
 +                      callbacks +=
 +                          wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
 +      }
 +
 +      /* cancel the watchdog timer */
 +      if (wlc->WDarmed) {
 +              if (!wl_del_timer(wlc->wl, wlc->wdtimer))
 +                      callbacks++;
 +              wlc->WDarmed = false;
 +      }
 +      /* cancel all other timers */
 +      callbacks += wlc_down_del_timer(wlc);
 +
 +      /* interrupt must have been blocked */
 +      ASSERT((wlc->macintmask == 0) || !wlc->pub->up);
 +
 +      wlc->pub->up = false;
 +
 +      wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
 +
 +      /* clear txq flow control */
 +      wlc_txflowcontrol_reset(wlc);
 +
 +      /* flush tx queues */
 +      for (qi = wlc->tx_queues; qi != NULL; qi = qi->next) {
 +              pktq_flush(&qi->q, true, NULL, 0);
 +              ASSERT(pktq_empty(&qi->q));
 +      }
 +
 +      callbacks += wlc_bmac_down_finish(wlc->hw);
 +
 +      /* wlc_bmac_down_finish has done wlc_coredisable(). so clk is off */
 +      wlc->clk = false;
 +
 +#ifdef BCMDBG
 +      /* Since all the packets should have been freed,
 +       * all callbacks should have been called
 +       */
 +      for (i = 1; i <= wlc->pub->tunables->maxpktcb; i++)
 +              ASSERT(wlc->pkt_callback[i].fn == NULL);
 +#endif
 +      wlc->going_down = false;
 +      return callbacks;
 +}
 +
 +/* Set the current gmode configuration */
 +int wlc_set_gmode(struct wlc_info *wlc, u8 gmode, bool config)
 +{
 +      int ret = 0;
 +      uint i;
 +      wlc_rateset_t rs;
 +      /* Default to 54g Auto */
 +      s8 shortslot = WLC_SHORTSLOT_AUTO;      /* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
 +      bool shortslot_restrict = false;        /* Restrict association to stations that support shortslot
 +                                               */
 +      bool ignore_bcns = true;        /* Ignore legacy beacons on the same channel */
 +      bool ofdm_basic = false;        /* Make 6, 12, and 24 basic rates */
 +      int preamble = WLC_PLCP_LONG;   /* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
 +      bool preamble_restrict = false; /* Restrict association to stations that support short
 +                                       * preambles
 +                                       */
 +      struct wlcband *band;
 +
 +      /* if N-support is enabled, allow Gmode set as long as requested
 +       * Gmode is not GMODE_LEGACY_B
 +       */
 +      if (N_ENAB(wlc->pub) && gmode == GMODE_LEGACY_B)
 +              return BCME_UNSUPPORTED;
 +
 +      /* verify that we are dealing with 2G band and grab the band pointer */
 +      if (wlc->band->bandtype == WLC_BAND_2G)
 +              band = wlc->band;
 +      else if ((NBANDS(wlc) > 1) &&
 +               (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == WLC_BAND_2G))
 +              band = wlc->bandstate[OTHERBANDUNIT(wlc)];
 +      else
 +              return BCME_BADBAND;
 +
 +      /* Legacy or bust when no OFDM is supported by regulatory */
 +      if ((wlc_channel_locale_flags_in_band(wlc->cmi, band->bandunit) &
 +           WLC_NO_OFDM) && (gmode != GMODE_LEGACY_B))
 +              return BCME_RANGE;
 +
 +      /* update configuration value */
 +      if (config == true)
 +              wlc_protection_upd(wlc, WLC_PROT_G_USER, gmode);
 +
 +      /* Clear supported rates filter */
 +      memset(&wlc->sup_rates_override, 0, sizeof(wlc_rateset_t));
 +
 +      /* Clear rateset override */
 +      memset(&rs, 0, sizeof(wlc_rateset_t));
 +
 +      switch (gmode) {
 +      case GMODE_LEGACY_B:
 +              shortslot = WLC_SHORTSLOT_OFF;
 +              wlc_rateset_copy(&gphy_legacy_rates, &rs);
 +
 +              break;
 +
 +      case GMODE_LRS:
 +              if (AP_ENAB(wlc->pub))
 +                      wlc_rateset_copy(&cck_rates, &wlc->sup_rates_override);
 +              break;
 +
 +      case GMODE_AUTO:
 +              /* Accept defaults */
 +              break;
 +
 +      case GMODE_ONLY:
 +              ofdm_basic = true;
 +              preamble = WLC_PLCP_SHORT;
 +              preamble_restrict = true;
 +              break;
 +
 +      case GMODE_PERFORMANCE:
 +              if (AP_ENAB(wlc->pub))  /* Put all rates into the Supported Rates element */
 +                      wlc_rateset_copy(&cck_ofdm_rates,
 +                                       &wlc->sup_rates_override);
 +
 +              shortslot = WLC_SHORTSLOT_ON;
 +              shortslot_restrict = true;
 +              ofdm_basic = true;
 +              preamble = WLC_PLCP_SHORT;
 +              preamble_restrict = true;
 +              break;
 +
 +      default:
 +              /* Error */
 +              WL_ERROR("wl%d: %s: invalid gmode %d\n",
 +                       wlc->pub->unit, __func__, gmode);
 +              return BCME_UNSUPPORTED;
 +      }
 +
 +      /*
 +       * If we are switching to gmode == GMODE_LEGACY_B,
 +       * clean up rate info that may refer to OFDM rates.
 +       */
 +      if ((gmode == GMODE_LEGACY_B) && (band->gmode != GMODE_LEGACY_B)) {
 +              band->gmode = gmode;
 +              if (band->rspec_override && !IS_CCK(band->rspec_override)) {
 +                      band->rspec_override = 0;
 +                      wlc_reprate_init(wlc);
 +              }
 +              if (band->mrspec_override && !IS_CCK(band->mrspec_override)) {
 +                      band->mrspec_override = 0;
 +              }
 +      }
 +
 +      band->gmode = gmode;
 +
 +      wlc->ignore_bcns = ignore_bcns;
 +
 +      wlc->shortslot_override = shortslot;
 +
 +      if (AP_ENAB(wlc->pub)) {
 +              /* wlc->ap->shortslot_restrict = shortslot_restrict; */
 +              wlc->PLCPHdr_override =
 +                  (preamble !=
 +                   WLC_PLCP_LONG) ? WLC_PLCP_SHORT : WLC_PLCP_AUTO;
 +      }
 +
 +      if ((AP_ENAB(wlc->pub) && preamble != WLC_PLCP_LONG)
 +          || preamble == WLC_PLCP_SHORT)
 +              wlc->default_bss->capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 +      else
 +              wlc->default_bss->capability &= ~WLAN_CAPABILITY_SHORT_PREAMBLE;
 +
 +      /* Update shortslot capability bit for AP and IBSS */
 +      if ((AP_ENAB(wlc->pub) && shortslot == WLC_SHORTSLOT_AUTO) ||
 +          shortslot == WLC_SHORTSLOT_ON)
 +              wlc->default_bss->capability |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 +      else
 +              wlc->default_bss->capability &=
 +                                      ~WLAN_CAPABILITY_SHORT_SLOT_TIME;
 +
 +      /* Use the default 11g rateset */
 +      if (!rs.count)
 +              wlc_rateset_copy(&cck_ofdm_rates, &rs);
 +
 +      if (ofdm_basic) {
 +              for (i = 0; i < rs.count; i++) {
 +                      if (rs.rates[i] == WLC_RATE_6M
 +                          || rs.rates[i] == WLC_RATE_12M
 +                          || rs.rates[i] == WLC_RATE_24M)
 +                              rs.rates[i] |= WLC_RATE_FLAG;
 +              }
 +      }
 +
 +      /* Set default bss rateset */
 +      wlc->default_bss->rateset.count = rs.count;
 +      memcpy(wlc->default_bss->rateset.rates, rs.rates, 
 +             sizeof(wlc->default_bss->rateset.rates));
 +
 +      return ret;
 +}
 +
 +static int wlc_nmode_validate(struct wlc_info *wlc, s32 nmode)
 +{
 +      int err = 0;
 +
 +      switch (nmode) {
 +
 +      case OFF:
 +              break;
 +
 +      case AUTO:
 +      case WL_11N_2x2:
 +      case WL_11N_3x3:
 +              if (!(WLC_PHY_11N_CAP(wlc->band)))
 +                      err = BCME_BADBAND;
 +              break;
 +
 +      default:
 +              err = BCME_RANGE;
 +              break;
 +      }
 +
 +      return err;
 +}
 +
 +int wlc_set_nmode(struct wlc_info *wlc, s32 nmode)
 +{
 +      uint i;
 +      int err;
 +
 +      err = wlc_nmode_validate(wlc, nmode);
 +      ASSERT(err == 0);
 +      if (err)
 +              return err;
 +
 +      switch (nmode) {
 +      case OFF:
 +              wlc->pub->_n_enab = OFF;
 +              wlc->default_bss->flags &= ~WLC_BSS_HT;
 +              /* delete the mcs rates from the default and hw ratesets */
 +              wlc_rateset_mcs_clear(&wlc->default_bss->rateset);
 +              for (i = 0; i < NBANDS(wlc); i++) {
 +                      memset(wlc->bandstate[i]->hw_rateset.mcs, 0,
 +                             MCSSET_LEN);
 +                      if (IS_MCS(wlc->band->rspec_override)) {
 +                              wlc->bandstate[i]->rspec_override = 0;
 +                              wlc_reprate_init(wlc);
 +                      }
 +                      if (IS_MCS(wlc->band->mrspec_override))
 +                              wlc->bandstate[i]->mrspec_override = 0;
 +              }
 +              break;
 +
 +      case AUTO:
 +              if (wlc->stf->txstreams == WL_11N_3x3)
 +                      nmode = WL_11N_3x3;
 +              else
 +                      nmode = WL_11N_2x2;
 +      case WL_11N_2x2:
 +      case WL_11N_3x3:
 +              ASSERT(WLC_PHY_11N_CAP(wlc->band));
 +              /* force GMODE_AUTO if NMODE is ON */
 +              wlc_set_gmode(wlc, GMODE_AUTO, true);
 +              if (nmode == WL_11N_3x3)
 +                      wlc->pub->_n_enab = SUPPORT_HT;
 +              else
 +                      wlc->pub->_n_enab = SUPPORT_11N;
 +              wlc->default_bss->flags |= WLC_BSS_HT;
 +              /* add the mcs rates to the default and hw ratesets */
 +              wlc_rateset_mcs_build(&wlc->default_bss->rateset,
 +                                    wlc->stf->txstreams);
 +              for (i = 0; i < NBANDS(wlc); i++)
 +                      memcpy(wlc->bandstate[i]->hw_rateset.mcs,
 +                             wlc->default_bss->rateset.mcs, MCSSET_LEN);
 +              break;
 +
 +      default:
 +              ASSERT(0);
 +              break;
 +      }
 +
 +      return err;
 +}
 +
 +static int wlc_set_rateset(struct wlc_info *wlc, wlc_rateset_t *rs_arg)
 +{
 +      wlc_rateset_t rs, new;
 +      uint bandunit;
 +
 +      memcpy(&rs, rs_arg, sizeof(wlc_rateset_t));
 +
 +      /* check for bad count value */
 +      if ((rs.count == 0) || (rs.count > WLC_NUMRATES))
 +              return BCME_BADRATESET;
 +
 +      /* try the current band */
 +      bandunit = wlc->band->bandunit;
 +      memcpy(&new, &rs, sizeof(wlc_rateset_t));
 +      if (wlc_rate_hwrs_filter_sort_validate
 +          (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
 +           wlc->stf->txstreams))
 +              goto good;
 +
 +      /* try the other band */
 +      if (IS_MBAND_UNLOCKED(wlc)) {
 +              bandunit = OTHERBANDUNIT(wlc);
 +              memcpy(&new, &rs, sizeof(wlc_rateset_t));
 +              if (wlc_rate_hwrs_filter_sort_validate(&new,
 +                                                     &wlc->
 +                                                     bandstate[bandunit]->
 +                                                     hw_rateset, true,
 +                                                     wlc->stf->txstreams))
 +                      goto good;
 +      }
 +
 +      return BCME_ERROR;
 +
 + good:
 +      /* apply new rateset */
 +      memcpy(&wlc->default_bss->rateset, &new, sizeof(wlc_rateset_t));
 +      memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
 +             sizeof(wlc_rateset_t));
 +      return 0;
 +}
 +
 +/* simplified integer set interface for common ioctl handler */
 +int wlc_set(struct wlc_info *wlc, int cmd, int arg)
 +{
 +      return wlc_ioctl(wlc, cmd, (void *)&arg, sizeof(arg), NULL);
 +}
 +
 +/* simplified integer get interface for common ioctl handler */
 +int wlc_get(struct wlc_info *wlc, int cmd, int *arg)
 +{
 +      return wlc_ioctl(wlc, cmd, arg, sizeof(int), NULL);
 +}
 +
 +static void wlc_ofdm_rateset_war(struct wlc_info *wlc)
 +{
 +      u8 r;
 +      bool war = false;
 +
 +      if (wlc->cfg->associated)
 +              r = wlc->cfg->current_bss->rateset.rates[0];
 +      else
 +              r = wlc->default_bss->rateset.rates[0];
 +
 +      wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
 +
 +      return;
 +}
 +
 +int
 +wlc_ioctl(struct wlc_info *wlc, int cmd, void *arg, int len,
 +        struct wlc_if *wlcif)
 +{
 +      return _wlc_ioctl(wlc, cmd, arg, len, wlcif);
 +}
 +
 +/* common ioctl handler. return: 0=ok, -1=error, positive=particular error */
 +static int
 +_wlc_ioctl(struct wlc_info *wlc, int cmd, void *arg, int len,
 +         struct wlc_if *wlcif)
 +{
 +      int val, *pval;
 +      bool bool_val;
 +      int bcmerror;
 +      d11regs_t *regs;
 +      uint i;
 +      struct scb *nextscb;
 +      bool ta_ok;
 +      uint band;
 +      rw_reg_t *r;
 +      struct wlc_bsscfg *bsscfg;
 +      wlc_bss_info_t *current_bss;
 +
 +      /* update bsscfg pointer */
 +      bsscfg = NULL;          /* XXX: Hack bsscfg to be size one and use this globally */
 +      current_bss = NULL;
 +
 +      /* initialize the following to get rid of compiler warning */
 +      nextscb = NULL;
 +      ta_ok = false;
 +      band = 0;
 +      r = NULL;
 +
 +      /* If the device is turned off, then it's not "removed" */
 +      if (!wlc->pub->hw_off && DEVICEREMOVED(wlc)) {
 +              WL_ERROR("wl%d: %s: dead chip\n", wlc->pub->unit, __func__);
 +              wl_down(wlc->wl);
 +              return BCME_ERROR;
 +      }
 +
 +      ASSERT(!(wlc->pub->hw_off && wlc->pub->up));
 +
 +      /* default argument is generic integer */
 +      pval = arg ? (int *)arg:NULL;
 +
 +      /* This will prevent the misaligned access */
 +      if (pval && (u32) len >= sizeof(val))
 +              memcpy(&val, pval, sizeof(val));
 +      else
 +              val = 0;
 +
 +      /* bool conversion to avoid duplication below */
 +      bool_val = val != 0;
 +
 +      if (cmd != WLC_SET_CHANNEL)
 +              WL_NONE("WLC_IOCTL: cmd %d val 0x%x (%d) len %d\n",
 +                      cmd, (uint)val, val, len);
 +
 +      bcmerror = 0;
 +      regs = wlc->regs;
 +
 +      /* A few commands don't need any arguments; all the others do. */
 +      switch (cmd) {
 +      case WLC_UP:
 +      case WLC_OUT:
 +      case WLC_DOWN:
 +      case WLC_DISASSOC:
 +      case WLC_RESTART:
 +      case WLC_REBOOT:
 +      case WLC_START_CHANNEL_QA:
 +      case WLC_INIT:
 +              break;
 +
 +      default:
 +              if ((arg == NULL) || (len <= 0)) {
 +                      WL_ERROR("wl%d: %s: Command %d needs arguments\n",
 +                               wlc->pub->unit, __func__, cmd);
 +                      bcmerror = BCME_BADARG;
 +                      goto done;
 +              }
 +      }
 +
 +      switch (cmd) {
 +
 +#if defined(BCMDBG)
 +      case WLC_GET_MSGLEVEL:
 +              *pval = wl_msg_level;
 +              break;
 +
 +      case WLC_SET_MSGLEVEL:
 +              wl_msg_level = val;
 +              break;
 +#endif
 +
 +      case WLC_GET_INSTANCE:
 +              *pval = wlc->pub->unit;
 +              break;
 +
 +      case WLC_GET_CHANNEL:{
 +                      channel_info_t *ci = (channel_info_t *) arg;
 +
 +                      ASSERT(len > (int)sizeof(ci));
 +
 +                      ci->hw_channel =
 +                          CHSPEC_CHANNEL(WLC_BAND_PI_RADIO_CHANSPEC);
 +                      ci->target_channel =
 +                          CHSPEC_CHANNEL(wlc->default_bss->chanspec);
 +                      ci->scan_channel = 0;
 +
 +                      break;
 +              }
 +
 +      case WLC_SET_CHANNEL:{
 +                      chanspec_t chspec = CH20MHZ_CHSPEC(val);
 +
 +                      if (val < 0 || val > MAXCHANNEL) {
 +                              bcmerror = BCME_OUTOFRANGECHAN;
 +                              break;
 +                      }
 +
 +                      if (!wlc_valid_chanspec_db(wlc->cmi, chspec)) {
 +                              bcmerror = BCME_BADCHAN;
 +                              break;
 +                      }
 +
 +                      if (!wlc->pub->up && IS_MBAND_UNLOCKED(wlc)) {
 +                              if (wlc->band->bandunit !=
 +                                  CHSPEC_WLCBANDUNIT(chspec))
 +                                      wlc->bandinit_pending = true;
 +                              else
 +                                      wlc->bandinit_pending = false;
 +                      }
 +
 +                      wlc->default_bss->chanspec = chspec;
 +                      /* wlc_BSSinit() will sanitize the rateset before using it.. */
 +                      if (wlc->pub->up &&
 +                          (WLC_BAND_PI_RADIO_CHANSPEC != chspec)) {
 +                              wlc_set_home_chanspec(wlc, chspec);
 +                              wlc_suspend_mac_and_wait(wlc);
 +                              wlc_set_chanspec(wlc, chspec);
 +                              wlc_enable_mac(wlc);
 +                      }
 +                      break;
 +              }
 +
 +#if defined(BCMDBG)
 +      case WLC_GET_UCFLAGS:
 +              if (!wlc->pub->up) {
 +                      bcmerror = BCME_NOTUP;
 +                      break;
 +              }
 +
 +              /* optional band is stored in the second integer of incoming buffer */
 +              band =
 +                  (len <
 +                   (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              if (val >= MHFMAX) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              *pval = wlc_bmac_mhf_get(wlc->hw, (u8) val, WLC_BAND_AUTO);
 +              break;
 +
 +      case WLC_SET_UCFLAGS:
 +              if (!wlc->pub->up) {
 +                      bcmerror = BCME_NOTUP;
 +                      break;
 +              }
 +
 +              /* optional band is stored in the second integer of incoming buffer */
 +              band =
 +                  (len <
 +                   (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              i = (u16) val;
 +              if (i >= MHFMAX) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              wlc_mhf(wlc, (u8) i, 0xffff, (u16) (val >> NBITS(u16)),
 +                      WLC_BAND_AUTO);
 +              break;
 +
 +      case WLC_GET_SHMEM:
 +              ta_ok = true;
 +
 +              /* optional band is stored in the second integer of incoming buffer */
 +              band =
 +                  (len <
 +                   (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              if (val & 1) {
 +                      bcmerror = BCME_BADADDR;
 +                      break;
 +              }
 +
 +              *pval = wlc_read_shm(wlc, (u16) val);
 +              break;
 +
 +      case WLC_SET_SHMEM:
 +              ta_ok = true;
 +
 +              /* optional band is stored in the second integer of incoming buffer */
 +              band =
 +                  (len <
 +                   (int)(2 * sizeof(int))) ? WLC_BAND_AUTO : ((int *)arg)[1];
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              if (val & 1) {
 +                      bcmerror = BCME_BADADDR;
 +                      break;
 +              }
 +
 +              wlc_write_shm(wlc, (u16) val,
 +                            (u16) (val >> NBITS(u16)));
 +              break;
 +
 +      case WLC_R_REG: /* MAC registers */
 +              ta_ok = true;
 +              r = (rw_reg_t *) arg;
 +              band = WLC_BAND_AUTO;
 +
 +              if (len < (int)(sizeof(rw_reg_t) - sizeof(uint))) {
 +                      bcmerror = BCME_BUFTOOSHORT;
 +                      break;
 +              }
 +
 +              if (len >= (int)sizeof(rw_reg_t))
 +                      band = r->band;
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              if ((r->byteoff + r->size) > sizeof(d11regs_t)) {
 +                      bcmerror = BCME_BADADDR;
 +                      break;
 +              }
 +              if (r->size == sizeof(u32))
 +                      r->val =
 +                          R_REG((u32 *)((unsigned char *)(unsigned long)regs +
 +                                            r->byteoff));
 +              else if (r->size == sizeof(u16))
 +                      r->val =
 +                          R_REG((u16 *)((unsigned char *)(unsigned long)regs +
 +                                            r->byteoff));
 +              else
 +                      bcmerror = BCME_BADADDR;
 +              break;
 +
 +      case WLC_W_REG:
 +              ta_ok = true;
 +              r = (rw_reg_t *) arg;
 +              band = WLC_BAND_AUTO;
 +
 +              if (len < (int)(sizeof(rw_reg_t) - sizeof(uint))) {
 +                      bcmerror = BCME_BUFTOOSHORT;
 +                      break;
 +              }
 +
 +              if (len >= (int)sizeof(rw_reg_t))
 +                      band = r->band;
 +
 +              /* bcmerror checking */
 +              bcmerror = wlc_iocregchk(wlc, band);
 +              if (bcmerror)
 +                      break;
 +
 +              if (r->byteoff + r->size > sizeof(d11regs_t)) {
 +                      bcmerror = BCME_BADADDR;
 +                      break;
 +              }
 +              if (r->size == sizeof(u32))
 +                      W_REG((u32 *)((unsigned char *)(unsigned long) regs +
 +                                        r->byteoff), r->val);
 +              else if (r->size == sizeof(u16))
 +                      W_REG((u16 *)((unsigned char *)(unsigned long) regs +
 +                                        r->byteoff), r->val);
 +              else
 +                      bcmerror = BCME_BADADDR;
 +              break;
 +#endif                                /* BCMDBG */
 +
 +      case WLC_GET_TXANT:
 +              *pval = wlc->stf->txant;
 +              break;
 +
 +      case WLC_SET_TXANT:
 +              bcmerror = wlc_stf_ant_txant_validate(wlc, (s8) val);
 +              if (bcmerror < 0)
 +                      break;
 +
 +              wlc->stf->txant = (s8) val;
 +
 +              /* if down, we are done */
 +              if (!wlc->pub->up)
 +                      break;
 +
 +              wlc_suspend_mac_and_wait(wlc);
 +
 +              wlc_stf_phy_txant_upd(wlc);
 +              wlc_beacon_phytxctl_txant_upd(wlc, wlc->bcn_rspec);
 +
 +              wlc_enable_mac(wlc);
 +
 +              break;
 +
 +      case WLC_GET_ANTDIV:{
 +                      u8 phy_antdiv;
 +
 +                      /* return configured value if core is down */
 +                      if (!wlc->pub->up) {
 +                              *pval = wlc->stf->ant_rx_ovr;
 +
 +                      } else {
 +                              if (wlc_phy_ant_rxdiv_get
 +                                  (wlc->band->pi, &phy_antdiv))
 +                                      *pval = (int)phy_antdiv;
 +                              else
 +                                      *pval = (int)wlc->stf->ant_rx_ovr;
 +                      }
 +
 +                      break;
 +              }
 +      case WLC_SET_ANTDIV:
 +              /* values are -1=driver default, 0=force0, 1=force1, 2=start1, 3=start0 */
 +              if ((val < -1) || (val > 3)) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              if (val == -1)
 +                      val = ANT_RX_DIV_DEF;
 +
 +              wlc->stf->ant_rx_ovr = (u8) val;
 +              wlc_phy_ant_rxdiv_set(wlc->band->pi, (u8) val);
 +              break;
 +
 +      case WLC_GET_RX_ANT:{   /* get latest used rx antenna */
 +                      u16 rxstatus;
 +
 +                      if (!wlc->pub->up) {
 +                              bcmerror = BCME_NOTUP;
 +                              break;
 +                      }
 +
 +                      rxstatus = R_REG(&wlc->regs->phyrxstatus0);
 +                      if (rxstatus == 0xdead || rxstatus == (u16) -1) {
 +                              bcmerror = BCME_ERROR;
 +                              break;
 +                      }
 +                      *pval = (rxstatus & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
 +                      break;
 +              }
 +
 +#if defined(BCMDBG)
 +      case WLC_GET_UCANTDIV:
 +              if (!wlc->clk) {
 +                      bcmerror = BCME_NOCLK;
 +                      break;
 +              }
 +
 +              *pval =
 +                  (wlc_bmac_mhf_get(wlc->hw, MHF1, WLC_BAND_AUTO) &
 +                   MHF1_ANTDIV);
 +              break;
 +
 +      case WLC_SET_UCANTDIV:{
 +                      if (!wlc->pub->up) {
 +                              bcmerror = BCME_NOTUP;
 +                              break;
 +                      }
 +
 +                      /* if multiband, band must be locked */
 +                      if (IS_MBAND_UNLOCKED(wlc)) {
 +                              bcmerror = BCME_NOTBANDLOCKED;
 +                              break;
 +                      }
 +
 +                      wlc_mhf(wlc, MHF1, MHF1_ANTDIV,
 +                              (val ? MHF1_ANTDIV : 0), WLC_BAND_AUTO);
 +                      break;
 +              }
 +#endif                                /* defined(BCMDBG) */
 +
 +      case WLC_GET_SRL:
 +              *pval = wlc->SRL;
 +              break;
 +
 +      case WLC_SET_SRL:
 +              if (val >= 1 && val <= RETRY_SHORT_MAX) {
 +                      int ac;
 +                      wlc->SRL = (u16) val;
 +
 +                      wlc_bmac_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
 +
 +                      for (ac = 0; ac < AC_COUNT; ac++) {
 +                              WLC_WME_RETRY_SHORT_SET(wlc, ac, wlc->SRL);
 +                      }
 +                      wlc_wme_retries_write(wlc);
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +      case WLC_GET_LRL:
 +              *pval = wlc->LRL;
 +              break;
 +
 +      case WLC_SET_LRL:
 +              if (val >= 1 && val <= 255) {
 +                      int ac;
 +                      wlc->LRL = (u16) val;
 +
 +                      wlc_bmac_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
 +
 +                      for (ac = 0; ac < AC_COUNT; ac++) {
 +                              WLC_WME_RETRY_LONG_SET(wlc, ac, wlc->LRL);
 +                      }
 +                      wlc_wme_retries_write(wlc);
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +      case WLC_GET_CWMIN:
 +              *pval = wlc->band->CWmin;
 +              break;
 +
 +      case WLC_SET_CWMIN:
 +              if (!wlc->clk) {
 +                      bcmerror = BCME_NOCLK;
 +                      break;
 +              }
 +
 +              if (val >= 1 && val <= 255) {
 +                      wlc_set_cwmin(wlc, (u16) val);
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +      case WLC_GET_CWMAX:
 +              *pval = wlc->band->CWmax;
 +              break;
 +
 +      case WLC_SET_CWMAX:
 +              if (!wlc->clk) {
 +                      bcmerror = BCME_NOCLK;
 +                      break;
 +              }
 +
 +              if (val >= 255 && val <= 2047) {
 +                      wlc_set_cwmax(wlc, (u16) val);
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +      case WLC_GET_RADIO:     /* use mask if don't want to expose some internal bits */
 +              *pval = wlc->pub->radio_disabled;
 +              break;
 +
 +      case WLC_SET_RADIO:{    /* 32 bits input, higher 16 bits are mask, lower 16 bits are value to
 +                               * set
 +                               */
 +                      u16 radiomask, radioval;
 +                      uint validbits =
 +                          WL_RADIO_SW_DISABLE | WL_RADIO_HW_DISABLE;
 +                      mbool new = 0;
 +
 +                      radiomask = (val & 0xffff0000) >> 16;
 +                      radioval = val & 0x0000ffff;
 +
 +                      if ((radiomask == 0) || (radiomask & ~validbits)
 +                          || (radioval & ~validbits)
 +                          || ((radioval & ~radiomask) != 0)) {
 +                              WL_ERROR("SET_RADIO with wrong bits 0x%x\n",
 +                                       val);
 +                              bcmerror = BCME_RANGE;
 +                              break;
 +                      }
 +
 +                      new =
 +                          (wlc->pub->radio_disabled & ~radiomask) | radioval;
 +                      wlc->pub->radio_disabled = new;
 +
 +                      wlc_radio_hwdisable_upd(wlc);
 +                      wlc_radio_upd(wlc);
 +                      break;
 +              }
 +
 +      case WLC_GET_PHYTYPE:
 +              *pval = WLC_PHYTYPE(wlc->band->phytype);
 +              break;
 +
 +#if defined(BCMDBG)
 +      case WLC_GET_KEY:
 +              if ((val >= 0) && (val < WLC_MAX_WSEC_KEYS(wlc))) {
 +                      wl_wsec_key_t key;
 +
 +                      wsec_key_t *src_key = wlc->wsec_keys[val];
 +
 +                      if (len < (int)sizeof(key)) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      memset((char *)&key, 0, sizeof(key));
 +                      if (src_key) {
 +                              key.index = src_key->id;
 +                              key.len = src_key->len;
 +                              memcpy(key.data, src_key->data, key.len);
 +                              key.algo = src_key->algo;
 +                              if (WSEC_SOFTKEY(wlc, src_key, bsscfg))
 +                                      key.flags |= WL_SOFT_KEY;
 +                              if (src_key->flags & WSEC_PRIMARY_KEY)
 +                                      key.flags |= WL_PRIMARY_KEY;
 +
 +                              memcpy(key.ea, src_key->ea, ETH_ALEN);
 +                      }
 +
 +                      memcpy(arg, &key, sizeof(key));
 +              } else
 +                      bcmerror = BCME_BADKEYIDX;
 +              break;
 +#endif                                /* defined(BCMDBG) */
 +
 +      case WLC_SET_KEY:
 +              bcmerror =
 +                  wlc_iovar_op(wlc, "wsec_key", NULL, 0, arg, len, IOV_SET,
 +                               wlcif);
 +              break;
 +
 +      case WLC_GET_KEY_SEQ:{
 +                      wsec_key_t *key;
 +
 +                      if (len < DOT11_WPA_KEY_RSC_LEN) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      /* Return the key's tx iv as an EAPOL sequence counter.
 +                       * This will be used to supply the RSC value to a supplicant.
 +                       * The format is 8 bytes, with least significant in seq[0].
 +                       */
 +
 +                      key = WSEC_KEY(wlc, val);
 +                      if ((val >= 0) && (val < WLC_MAX_WSEC_KEYS(wlc)) &&
 +                              (key != NULL)) {
 +                              u8 seq[DOT11_WPA_KEY_RSC_LEN];
 +                              u16 lo;
 +                              u32 hi;
 +                              /* group keys in WPA-NONE (IBSS only, AES and TKIP) use a global TXIV */
 +                              if ((bsscfg->WPA_auth & WPA_AUTH_NONE) &&
 +                                  is_zero_ether_addr(key->ea)) {
 +                                      lo = bsscfg->wpa_none_txiv.lo;
 +                                      hi = bsscfg->wpa_none_txiv.hi;
 +                              } else {
 +                                      lo = key->txiv.lo;
 +                                      hi = key->txiv.hi;
 +                              }
 +
 +                              /* format the buffer, low to high */
 +                              seq[0] = lo & 0xff;
 +                              seq[1] = (lo >> 8) & 0xff;
 +                              seq[2] = hi & 0xff;
 +                              seq[3] = (hi >> 8) & 0xff;
 +                              seq[4] = (hi >> 16) & 0xff;
 +                              seq[5] = (hi >> 24) & 0xff;
 +                              seq[6] = 0;
 +                              seq[7] = 0;
 +
 +                              memcpy(arg, seq, sizeof(seq));
 +                      } else {
 +                              bcmerror = BCME_BADKEYIDX;
 +                      }
 +                      break;
 +              }
 +
 +      case WLC_GET_CURR_RATESET:{
 +                      wl_rateset_t *ret_rs = (wl_rateset_t *) arg;
 +                      wlc_rateset_t *rs;
 +
 +                      if (bsscfg->associated)
 +                              rs = &current_bss->rateset;
 +                      else
 +                              rs = &wlc->default_bss->rateset;
 +
 +                      if (len < (int)(rs->count + sizeof(rs->count))) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      /* Copy only legacy rateset section */
 +                      ret_rs->count = rs->count;
 +                      memcpy(&ret_rs->rates, &rs->rates, rs->count);
 +                      break;
 +              }
 +
 +      case WLC_GET_RATESET:{
 +                      wlc_rateset_t rs;
 +                      wl_rateset_t *ret_rs = (wl_rateset_t *) arg;
 +
 +                      memset(&rs, 0, sizeof(wlc_rateset_t));
 +                      wlc_default_rateset(wlc, (wlc_rateset_t *) &rs);
 +
 +                      if (len < (int)(rs.count + sizeof(rs.count))) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      /* Copy only legacy rateset section */
 +                      ret_rs->count = rs.count;
 +                      memcpy(&ret_rs->rates, &rs.rates, rs.count);
 +                      break;
 +              }
 +
 +      case WLC_SET_RATESET:{
 +                      wlc_rateset_t rs;
 +                      wl_rateset_t *in_rs = (wl_rateset_t *) arg;
 +
 +                      if (len < (int)(in_rs->count + sizeof(in_rs->count))) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      if (in_rs->count > WLC_NUMRATES) {
 +                              bcmerror = BCME_BUFTOOLONG;
 +                              break;
 +                      }
 +
 +                      memset(&rs, 0, sizeof(wlc_rateset_t));
 +
 +                      /* Copy only legacy rateset section */
 +                      rs.count = in_rs->count;
 +                      memcpy(&rs.rates, &in_rs->rates, rs.count);
 +
 +                      /* merge rateset coming in with the current mcsset */
 +                      if (N_ENAB(wlc->pub)) {
 +                              if (bsscfg->associated)
 +                                      memcpy(rs.mcs,
 +                                             &current_bss->rateset.mcs[0],
 +                                             MCSSET_LEN);
 +                              else
 +                                      memcpy(rs.mcs,
 +                                             &wlc->default_bss->rateset.mcs[0],
 +                                             MCSSET_LEN);
 +                      }
 +
 +                      bcmerror = wlc_set_rateset(wlc, &rs);
 +
 +                      if (!bcmerror)
 +                              wlc_ofdm_rateset_war(wlc);
 +
 +                      break;
 +              }
 +
 +      case WLC_GET_BCNPRD:
 +              if (BSSCFG_STA(bsscfg) && bsscfg->BSS && bsscfg->associated)
 +                      *pval = current_bss->beacon_period;
 +              else
 +                      *pval = wlc->default_bss->beacon_period;
 +              break;
 +
 +      case WLC_SET_BCNPRD:
 +              /* range [1, 0xffff] */
 +              if (val >= DOT11_MIN_BEACON_PERIOD
 +                  && val <= DOT11_MAX_BEACON_PERIOD) {
 +                      wlc->default_bss->beacon_period = (u16) val;
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +      case WLC_GET_DTIMPRD:
 +              if (BSSCFG_STA(bsscfg) && bsscfg->BSS && bsscfg->associated)
 +                      *pval = current_bss->dtim_period;
 +              else
 +                      *pval = wlc->default_bss->dtim_period;
 +              break;
 +
 +      case WLC_SET_DTIMPRD:
 +              /* range [1, 0xff] */
 +              if (val >= DOT11_MIN_DTIM_PERIOD
 +                  && val <= DOT11_MAX_DTIM_PERIOD) {
 +                      wlc->default_bss->dtim_period = (u8) val;
 +              } else
 +                      bcmerror = BCME_RANGE;
 +              break;
 +
 +#ifdef SUPPORT_PS
 +      case WLC_GET_PM:
 +              *pval = wlc->PM;
 +              break;
 +
 +      case WLC_SET_PM:
 +              if ((val >= PM_OFF) && (val <= PM_MAX)) {
 +                      wlc->PM = (u8) val;
 +                      if (wlc->pub->up) {
 +                      }
 +                      /* Change watchdog driver to align watchdog with tbtt if possible */
 +                      wlc_watchdog_upd(wlc, PS_ALLOWED(wlc));
 +              } else
 +                      bcmerror = BCME_ERROR;
 +              break;
 +#endif                                /* SUPPORT_PS */
 +
 +#ifdef SUPPORT_PS
 +#ifdef BCMDBG
 +      case WLC_GET_WAKE:
 +              if (AP_ENAB(wlc->pub)) {
 +                      bcmerror = BCME_NOTSTA;
 +                      break;
 +              }
 +              *pval = wlc->wake;
 +              break;
 +
 +      case WLC_SET_WAKE:
 +              if (AP_ENAB(wlc->pub)) {
 +                      bcmerror = BCME_NOTSTA;
 +                      break;
 +              }
 +
 +              wlc->wake = val ? true : false;
 +
 +              /* if down, we're done */
 +              if (!wlc->pub->up)
 +                      break;
 +
 +              /* apply to the mac */
 +              wlc_set_ps_ctrl(wlc);
 +              break;
 +#endif                                /* BCMDBG */
 +#endif                                /* SUPPORT_PS */
 +
 +      case WLC_GET_REVINFO:
 +              bcmerror = wlc_get_revision_info(wlc, arg, (uint) len);
 +              break;
 +
 +      case WLC_GET_AP:
 +              *pval = (int)AP_ENAB(wlc->pub);
 +              break;
 +
 +      case WLC_GET_ATIM:
 +              if (bsscfg->associated)
 +                      *pval = (int)current_bss->atim_window;
 +              else
 +                      *pval = (int)wlc->default_bss->atim_window;
 +              break;
 +
 +      case WLC_SET_ATIM:
 +              wlc->default_bss->atim_window = (u32) val;
 +              break;
 +
 +      case WLC_GET_PKTCNTS:{
 +                      get_pktcnt_t *pktcnt = (get_pktcnt_t *) pval;
 +                      wlc_statsupd(wlc);
 +                      pktcnt->rx_good_pkt = wlc->pub->_cnt->rxframe;
 +                      pktcnt->rx_bad_pkt = wlc->pub->_cnt->rxerror;
 +                      pktcnt->tx_good_pkt =
 +                          wlc->pub->_cnt->txfrmsnt;
 +                      pktcnt->tx_bad_pkt =
 +                          wlc->pub->_cnt->txerror +
 +                          wlc->pub->_cnt->txfail;
 +                      if (len >= (int)sizeof(get_pktcnt_t)) {
 +                              /* Be backward compatible - only if buffer is large enough  */
 +                              pktcnt->rx_ocast_good_pkt =
 +                                  wlc->pub->_cnt->rxmfrmocast;
 +                      }
 +                      break;
 +              }
 +
 +#ifdef SUPPORT_HWKEY
 +      case WLC_GET_WSEC:
 +              bcmerror =
 +                  wlc_iovar_op(wlc, "wsec", NULL, 0, arg, len, IOV_GET,
 +                               wlcif);
 +              break;
 +
 +      case WLC_SET_WSEC:
 +              bcmerror =
 +                  wlc_iovar_op(wlc, "wsec", NULL, 0, arg, len, IOV_SET,
 +                               wlcif);
 +              break;
 +
 +      case WLC_GET_WPA_AUTH:
 +              *pval = (int)bsscfg->WPA_auth;
 +              break;
 +
 +      case WLC_SET_WPA_AUTH:
 +              /* change of WPA_Auth modifies the PS_ALLOWED state */
 +              if (BSSCFG_STA(bsscfg)) {
 +                      bsscfg->WPA_auth = (u16) val;
 +              } else
 +                      bsscfg->WPA_auth = (u16) val;
 +              break;
 +#endif                                /* SUPPORT_HWKEY */
 +
 +      case WLC_GET_BANDLIST:
 +              /* count of number of bands, followed by each band type */
 +              *pval++ = NBANDS(wlc);
 +              *pval++ = wlc->band->bandtype;
 +              if (NBANDS(wlc) > 1)
 +                      *pval++ = wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype;
 +              break;
 +
 +      case WLC_GET_BAND:
 +              *pval = wlc->bandlocked ? wlc->band->bandtype : WLC_BAND_AUTO;
 +              break;
 +
 +      case WLC_GET_PHYLIST:
 +              {
 +                      unsigned char *cp = arg;
 +                      if (len < 3) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +
 +                      if (WLCISNPHY(wlc->band)) {
 +                              *cp++ = 'n';
 +                      } else if (WLCISLCNPHY(wlc->band)) {
 +                              *cp++ = 'c';
 +                      } else if (WLCISSSLPNPHY(wlc->band)) {
 +                              *cp++ = 's';
 +                      }
 +                      *cp = '\0';
 +                      break;
 +              }
 +
 +      case WLC_GET_SHORTSLOT:
 +              *pval = wlc->shortslot;
 +              break;
 +
 +      case WLC_GET_SHORTSLOT_OVERRIDE:
 +              *pval = wlc->shortslot_override;
 +              break;
 +
 +      case WLC_SET_SHORTSLOT_OVERRIDE:
 +              if ((val != WLC_SHORTSLOT_AUTO) &&
 +                  (val != WLC_SHORTSLOT_OFF) && (val != WLC_SHORTSLOT_ON)) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              wlc->shortslot_override = (s8) val;
 +
 +              /* shortslot is an 11g feature, so no more work if we are
 +               * currently on the 5G band
 +               */
 +              if (BAND_5G(wlc->band->bandtype))
 +                      break;
 +
 +              if (wlc->pub->up && wlc->pub->associated) {
 +                      /* let watchdog or beacon processing update shortslot */
 +              } else if (wlc->pub->up) {
 +                      /* unassociated shortslot is off */
 +                      wlc_switch_shortslot(wlc, false);
 +              } else {
 +                      /* driver is down, so just update the wlc_info value */
 +                      if (wlc->shortslot_override == WLC_SHORTSLOT_AUTO) {
 +                              wlc->shortslot = false;
 +                      } else {
 +                              wlc->shortslot =
 +                                  (wlc->shortslot_override ==
 +                                   WLC_SHORTSLOT_ON);
 +                      }
 +              }
 +
 +              break;
 +
 +      case WLC_GET_LEGACY_ERP:
 +              *pval = wlc->include_legacy_erp;
 +              break;
 +
 +      case WLC_SET_LEGACY_ERP:
 +              if (wlc->include_legacy_erp == bool_val)
 +                      break;
 +
 +              wlc->include_legacy_erp = bool_val;
 +
 +              if (AP_ENAB(wlc->pub) && wlc->clk) {
 +                      wlc_update_beacon(wlc);
 +                      wlc_update_probe_resp(wlc, true);
 +              }
 +              break;
 +
 +      case WLC_GET_GMODE:
 +              if (wlc->band->bandtype == WLC_BAND_2G)
 +                      *pval = wlc->band->gmode;
 +              else if (NBANDS(wlc) > 1)
 +                      *pval = wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode;
 +              break;
 +
 +      case WLC_SET_GMODE:
 +              if (!wlc->pub->associated)
 +                      bcmerror = wlc_set_gmode(wlc, (u8) val, true);
 +              else {
 +                      bcmerror = BCME_ASSOCIATED;
 +                      break;
 +              }
 +              break;
 +
 +      case WLC_GET_GMODE_PROTECTION:
 +              *pval = wlc->protection->_g;
 +              break;
 +
 +      case WLC_GET_PROTECTION_CONTROL:
 +              *pval = wlc->protection->overlap;
 +              break;
 +
 +      case WLC_SET_PROTECTION_CONTROL:
 +              if ((val != WLC_PROTECTION_CTL_OFF) &&
 +                  (val != WLC_PROTECTION_CTL_LOCAL) &&
 +                  (val != WLC_PROTECTION_CTL_OVERLAP)) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              wlc_protection_upd(wlc, WLC_PROT_OVERLAP, (s8) val);
 +
 +              /* Current g_protection will sync up to the specified control alg in watchdog
 +               * if the driver is up and associated.
 +               * If the driver is down or not associated, the control setting has no effect.
 +               */
 +              break;
 +
 +      case WLC_GET_GMODE_PROTECTION_OVERRIDE:
 +              *pval = wlc->protection->g_override;
 +              break;
 +
 +      case WLC_SET_GMODE_PROTECTION_OVERRIDE:
 +              if ((val != WLC_PROTECTION_AUTO) &&
 +                  (val != WLC_PROTECTION_OFF) && (val != WLC_PROTECTION_ON)) {
 +                      bcmerror = BCME_RANGE;
 +                      break;
 +              }
 +
 +              wlc_protection_upd(wlc, WLC_PROT_G_OVR, (s8) val);
 +
 +              break;
 +
 +      case WLC_SET_SUP_RATESET_OVERRIDE:{
 +                      wlc_rateset_t rs, new;
 +
 +                      /* copyin */
 +                      if (len < (int)sizeof(wlc_rateset_t)) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +                      memcpy(&rs, arg, sizeof(wlc_rateset_t));
 +
 +                      /* check for bad count value */
 +                      if (rs.count > WLC_NUMRATES) {
 +                              bcmerror = BCME_BADRATESET;     /* invalid rateset */
 +                              break;
 +                      }
 +
 +                      /* this command is only appropriate for gmode operation */
 +                      if (!(wlc->band->gmode ||
 +                            ((NBANDS(wlc) > 1)
 +                             && wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode))) {
 +                              bcmerror = BCME_BADBAND;        /* gmode only command when not in gmode */
 +                              break;
 +                      }
 +
 +                      /* check for an empty rateset to clear the override */
 +                      if (rs.count == 0) {
 +                              memset(&wlc->sup_rates_override, 0,
 +                                    sizeof(wlc_rateset_t));
 +                              break;
 +                      }
 +
 +                      /* validate rateset by comparing pre and post sorted against 11g hw rates */
 +                      wlc_rateset_filter(&rs, &new, false, WLC_RATES_CCK_OFDM,
 +                                         RATE_MASK, BSS_N_ENAB(wlc, bsscfg));
 +                      wlc_rate_hwrs_filter_sort_validate(&new,
 +                                                         &cck_ofdm_rates,
 +                                                         false,
 +                                                         wlc->stf->txstreams);
 +                      if (rs.count != new.count) {
 +                              bcmerror = BCME_BADRATESET;     /* invalid rateset */
 +                              break;
 +                      }
 +
 +                      /* apply new rateset to the override */
 +                      memcpy(&wlc->sup_rates_override, &new,
 +                            sizeof(wlc_rateset_t));
 +
 +                      /* update bcn and probe resp if needed */
 +                      if (wlc->pub->up && AP_ENAB(wlc->pub)
 +                          && wlc->pub->associated) {
 +                              wlc_update_beacon(wlc);
 +                              wlc_update_probe_resp(wlc, true);
 +                      }
 +                      break;
 +              }
 +
 +      case WLC_GET_SUP_RATESET_OVERRIDE:
 +              /* this command is only appropriate for gmode operation */
 +              if (!(wlc->band->gmode ||
 +                    ((NBANDS(wlc) > 1)
 +                     && wlc->bandstate[OTHERBANDUNIT(wlc)]->gmode))) {
 +                      bcmerror = BCME_BADBAND;        /* gmode only command when not in gmode */
 +                      break;
 +              }
 +              if (len < (int)sizeof(wlc_rateset_t)) {
 +                      bcmerror = BCME_BUFTOOSHORT;
 +                      break;
 +              }
 +              memcpy(arg, &wlc->sup_rates_override, sizeof(wlc_rateset_t));
 +
 +              break;
 +
 +      case WLC_GET_PRB_RESP_TIMEOUT:
 +              *pval = wlc->prb_resp_timeout;
 +              break;
 +
 +      case WLC_SET_PRB_RESP_TIMEOUT:
 +              if (wlc->pub->up) {
 +                      bcmerror = BCME_NOTDOWN;
 +                      break;
 +              }
 +              if (val < 0 || val >= 0xFFFF) {
 +                      bcmerror = BCME_RANGE;  /* bad value */
 +                      break;
 +              }
 +              wlc->prb_resp_timeout = (u16) val;
 +              break;
 +
 +      case WLC_GET_KEY_PRIMARY:{
 +                      wsec_key_t *key;
 +
 +                      /* treat the 'val' parm as the key id */
 +                      key = WSEC_BSS_DEFAULT_KEY(bsscfg);
 +                      if (key != NULL) {
 +                              *pval = key->id == val ? true : false;
 +                      } else {
 +                              bcmerror = BCME_BADKEYIDX;
 +                      }
 +                      break;
 +              }
 +
 +      case WLC_SET_KEY_PRIMARY:{
 +                      wsec_key_t *key, *old_key;
 +
 +                      bcmerror = BCME_BADKEYIDX;
 +
 +                      /* treat the 'val' parm as the key id */
 +                      for (i = 0; i < WSEC_MAX_DEFAULT_KEYS; i++) {
 +                              key = bsscfg->bss_def_keys[i];
 +                              if (key != NULL && key->id == val) {
 +                                      old_key = WSEC_BSS_DEFAULT_KEY(bsscfg);
 +                                      if (old_key != NULL)
 +                                              old_key->flags &=
 +                                                  ~WSEC_PRIMARY_KEY;
 +                                      key->flags |= WSEC_PRIMARY_KEY;
 +                                      bsscfg->wsec_index = i;
 +                                      bcmerror = BCME_OK;
 +                              }
 +                      }
 +                      break;
 +              }
 +
 +#ifdef BCMDBG
 +      case WLC_INIT:
 +              wl_init(wlc->wl);
 +              break;
 +#endif
 +
 +      case WLC_SET_VAR:
 +      case WLC_GET_VAR:{
 +                      char *name;
 +                      /* validate the name value */
 +                      name = (char *)arg;
 +                      for (i = 0; i < (uint) len && *name != '\0';
 +                           i++, name++)
 +                              ;
 +
 +                      if (i == (uint) len) {
 +                              bcmerror = BCME_BUFTOOSHORT;
 +                              break;
 +                      }
 +                      i++;    /* include the null in the string length */
 +
 +                      if (cmd == WLC_GET_VAR) {
 +                              bcmerror =
 +                                  wlc_iovar_op(wlc, arg,
 +                                               (void *)((s8 *) arg + i),
 +                                               len - i, arg, len, IOV_GET,
 +                                               wlcif);
 +                      } else
 +                              bcmerror =
 +                                  wlc_iovar_op(wlc, arg, NULL, 0,
 +                                               (void *)((s8 *) arg + i),
 +                                               len - i, IOV_SET, wlcif);
 +
 +                      break;
 +              }
 +
 +      case WLC_SET_WSEC_PMK:
 +              bcmerror = BCME_UNSUPPORTED;
 +              break;
 +
 +#if defined(BCMDBG)
 +      case WLC_CURRENT_PWR:
 +              if (!wlc->pub->up)
 +                      bcmerror = BCME_NOTUP;
 +              else
 +                      bcmerror = wlc_get_current_txpwr(wlc, arg, len);
 +              break;
 +#endif
 +
 +      case WLC_LAST:
 +              WL_ERROR("%s: WLC_LAST\n", __func__);
 +      }
 + done:
 +
 +      if (bcmerror) {
 +              if (VALID_BCMERROR(bcmerror))
 +                      wlc->pub->bcmerror = bcmerror;
 +              else {
 +                      bcmerror = 0;
 +              }
 +
 +      }
 +      /* BMAC_NOTE: for HIGH_ONLY driver, this seems being called after RPC bus failed */
 +      /* In hw_off condition, IOCTLs that reach here are deemed safe but taclear would
 +       * certainly result in getting -1 for register reads. So skip ta_clear altogether
 +       */
 +      if (!(wlc->pub->hw_off))
 +              ASSERT(wlc_bmac_taclear(wlc->hw, ta_ok) || !ta_ok);
 +
 +      return bcmerror;
 +}
 +
 +#if defined(BCMDBG)
 +/* consolidated register access ioctl error checking */
 +int wlc_iocregchk(struct wlc_info *wlc, uint band)
 +{
 +      /* if band is specified, it must be the current band */
 +      if ((band != WLC_BAND_AUTO) && (band != (uint) wlc->band->bandtype))
 +              return BCME_BADBAND;
 +
 +      /* if multiband and band is not specified, band must be locked */
 +      if ((band == WLC_BAND_AUTO) && IS_MBAND_UNLOCKED(wlc))
 +              return BCME_NOTBANDLOCKED;
 +
 +      /* must have core clocks */
 +      if (!wlc->clk)
 +              return BCME_NOCLK;
 +
 +      return 0;
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +#if defined(BCMDBG)
 +/* For some ioctls, make sure that the pi pointer matches the current phy */
 +int wlc_iocpichk(struct wlc_info *wlc, uint phytype)
 +{
 +      if (wlc->band->phytype != phytype)
 +              return BCME_BADBAND;
 +      return 0;
 +}
 +#endif
 +
 +/* Look up the given var name in the given table */
 +static const bcm_iovar_t *wlc_iovar_lookup(const bcm_iovar_t *table,
 +                                         const char *name)
 +{
 +      const bcm_iovar_t *vi;
 +      const char *lookup_name;
 +
 +      /* skip any ':' delimited option prefixes */
 +      lookup_name = strrchr(name, ':');
 +      if (lookup_name != NULL)
 +              lookup_name++;
 +      else
 +              lookup_name = name;
 +
 +      ASSERT(table != NULL);
 +
 +      for (vi = table; vi->name; vi++) {
 +              if (!strcmp(vi->name, lookup_name))
 +                      return vi;
 +      }
 +      /* ran to end of table */
 +
 +      return NULL;            /* var name not found */
 +}
 +
 +/* simplified integer get interface for common WLC_GET_VAR ioctl handler */
 +int wlc_iovar_getint(struct wlc_info *wlc, const char *name, int *arg)
 +{
 +      return wlc_iovar_op(wlc, name, NULL, 0, arg, sizeof(s32), IOV_GET,
 +                          NULL);
 +}
 +
 +/* simplified integer set interface for common WLC_SET_VAR ioctl handler */
 +int wlc_iovar_setint(struct wlc_info *wlc, const char *name, int arg)
 +{
 +      return wlc_iovar_op(wlc, name, NULL, 0, (void *)&arg, sizeof(arg),
 +                          IOV_SET, NULL);
 +}
 +
 +/* simplified s8 get interface for common WLC_GET_VAR ioctl handler */
 +int wlc_iovar_gets8(struct wlc_info *wlc, const char *name, s8 *arg)
 +{
 +      int iovar_int;
 +      int err;
 +
 +      err =
 +          wlc_iovar_op(wlc, name, NULL, 0, &iovar_int, sizeof(iovar_int),
 +                       IOV_GET, NULL);
 +      if (!err)
 +              *arg = (s8) iovar_int;
 +
 +      return err;
 +}
 +
 +/*
 + * register iovar table, watchdog and down handlers.
 + * calling function must keep 'iovars' until wlc_module_unregister is called.
 + * 'iovar' must have the last entry's name field being NULL as terminator.
 + */
 +int wlc_module_register(struct wlc_pub *pub, const bcm_iovar_t *iovars,
 +                      const char *name, void *hdl, iovar_fn_t i_fn,
 +                      watchdog_fn_t w_fn, down_fn_t d_fn)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) pub->wlc;
 +      int i;
 +
 +      ASSERT(name != NULL);
 +      ASSERT(i_fn != NULL || w_fn != NULL || d_fn != NULL);
 +
 +      /* find an empty entry and just add, no duplication check! */
 +      for (i = 0; i < WLC_MAXMODULES; i++) {
 +              if (wlc->modulecb[i].name[0] == '\0') {
 +                      strncpy(wlc->modulecb[i].name, name,
 +                              sizeof(wlc->modulecb[i].name) - 1);
 +                      wlc->modulecb[i].iovars = iovars;
 +                      wlc->modulecb[i].hdl = hdl;
 +                      wlc->modulecb[i].iovar_fn = i_fn;
 +                      wlc->modulecb[i].watchdog_fn = w_fn;
 +                      wlc->modulecb[i].down_fn = d_fn;
 +                      return 0;
 +              }
 +      }
 +
 +      /* it is time to increase the capacity */
 +      ASSERT(i < WLC_MAXMODULES);
 +      return BCME_NORESOURCE;
 +}
 +
 +/* unregister module callbacks */
 +int wlc_module_unregister(struct wlc_pub *pub, const char *name, void *hdl)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) pub->wlc;
 +      int i;
 +
 +      if (wlc == NULL)
 +              return BCME_NOTFOUND;
 +
 +      ASSERT(name != NULL);
 +
 +      for (i = 0; i < WLC_MAXMODULES; i++) {
 +              if (!strcmp(wlc->modulecb[i].name, name) &&
 +                  (wlc->modulecb[i].hdl == hdl)) {
 +                      memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
 +                      return 0;
 +              }
 +      }
 +
 +      /* table not found! */
 +      return BCME_NOTFOUND;
 +}
 +
 +/* Write WME tunable parameters for retransmit/max rate from wlc struct to ucode */
 +static void wlc_wme_retries_write(struct wlc_info *wlc)
 +{
 +      int ac;
 +
 +      /* Need clock to do this */
 +      if (!wlc->clk)
 +              return;
 +
 +      for (ac = 0; ac < AC_COUNT; ac++) {
 +              wlc_write_shm(wlc, M_AC_TXLMT_ADDR(ac), wlc->wme_retries[ac]);
 +      }
 +}
 +
 +/* Get or set an iovar.  The params/p_len pair specifies any additional
 + * qualifying parameters (e.g. an "element index") for a get, while the
 + * arg/len pair is the buffer for the value to be set or retrieved.
 + * Operation (get/set) is specified by the last argument.
 + * interface context provided by wlcif
 + *
 + * All pointers may point into the same buffer.
 + */
 +int
 +wlc_iovar_op(struct wlc_info *wlc, const char *name,
 +           void *params, int p_len, void *arg, int len,
 +           bool set, struct wlc_if *wlcif)
 +{
 +      int err = 0;
 +      int val_size;
 +      const bcm_iovar_t *vi = NULL;
 +      u32 actionid;
 +      int i;
 +
 +      ASSERT(name != NULL);
 +
 +      ASSERT(len >= 0);
 +
 +      /* Get MUST have return space */
 +      ASSERT(set || (arg && len));
 +
 +      ASSERT(!(wlc->pub->hw_off && wlc->pub->up));
 +
 +      /* Set does NOT take qualifiers */
 +      ASSERT(!set || (!params && !p_len));
 +
 +      if (!set && (len == sizeof(int)) &&
 +          !(IS_ALIGNED((unsigned long)(arg), (uint) sizeof(int)))) {
 +              WL_ERROR("wl%d: %s unaligned get ptr for %s\n",
 +                       wlc->pub->unit, __func__, name);
 +              ASSERT(0);
 +      }
 +
 +      /* find the given iovar name */
 +      for (i = 0; i < WLC_MAXMODULES; i++) {
 +              if (!wlc->modulecb[i].iovars)
 +                      continue;
 +              vi = wlc_iovar_lookup(wlc->modulecb[i].iovars, name);
 +              if (vi)
 +                      break;
 +      }
 +      /* iovar name not found */
 +      if (i >= WLC_MAXMODULES) {
 +              err = BCME_UNSUPPORTED;
 +              goto exit;
 +      }
 +
 +      /* set up 'params' pointer in case this is a set command so that
 +       * the convenience int and bool code can be common to set and get
 +       */
 +      if (params == NULL) {
 +              params = arg;
 +              p_len = len;
 +      }
 +
 +      if (vi->type == IOVT_VOID)
 +              val_size = 0;
 +      else if (vi->type == IOVT_BUFFER)
 +              val_size = len;
 +      else
 +              /* all other types are integer sized */
 +              val_size = sizeof(int);
 +
 +      actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
 +
 +      /* Do the actual parameter implementation */
 +      err = wlc->modulecb[i].iovar_fn(wlc->modulecb[i].hdl, vi, actionid,
 +                                      name, params, p_len, arg, len, val_size,
 +                                      wlcif);
 +
 + exit:
 +      return err;
 +}
 +
 +int
 +wlc_iovar_check(struct wlc_pub *pub, const bcm_iovar_t *vi, void *arg, int len,
 +              bool set)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) pub->wlc;
 +      int err = 0;
 +      s32 int_val = 0;
 +
 +      /* check generic condition flags */
 +      if (set) {
 +              if (((vi->flags & IOVF_SET_DOWN) && wlc->pub->up) ||
 +                  ((vi->flags & IOVF_SET_UP) && !wlc->pub->up)) {
 +                      err = (wlc->pub->up ? BCME_NOTDOWN : BCME_NOTUP);
 +              } else if ((vi->flags & IOVF_SET_BAND)
 +                         && IS_MBAND_UNLOCKED(wlc)) {
 +                      err = BCME_NOTBANDLOCKED;
 +              } else if ((vi->flags & IOVF_SET_CLK) && !wlc->clk) {
 +                      err = BCME_NOCLK;
 +              }
 +      } else {
 +              if (((vi->flags & IOVF_GET_DOWN) && wlc->pub->up) ||
 +                  ((vi->flags & IOVF_GET_UP) && !wlc->pub->up)) {
 +                      err = (wlc->pub->up ? BCME_NOTDOWN : BCME_NOTUP);
 +              } else if ((vi->flags & IOVF_GET_BAND)
 +                         && IS_MBAND_UNLOCKED(wlc)) {
 +                      err = BCME_NOTBANDLOCKED;
 +              } else if ((vi->flags & IOVF_GET_CLK) && !wlc->clk) {
 +                      err = BCME_NOCLK;
 +              }
 +      }
 +
 +      if (err)
 +              goto exit;
 +
 +      /* length check on io buf */
 +      err = bcm_iovar_lencheck(vi, arg, len, set);
 +      if (err)
 +              goto exit;
 +
 +      /* On set, check value ranges for integer types */
 +      if (set) {
 +              switch (vi->type) {
 +              case IOVT_BOOL:
 +              case IOVT_INT8:
 +              case IOVT_INT16:
 +              case IOVT_INT32:
 +              case IOVT_UINT8:
 +              case IOVT_UINT16:
 +              case IOVT_UINT32:
 +                      memcpy(&int_val, arg, sizeof(int));
 +                      err = wlc_iovar_rangecheck(wlc, int_val, vi);
 +                      break;
 +              }
 +      }
 + exit:
 +      return err;
 +}
 +
 +/* handler for iovar table wlc_iovars */
 +/*
 + * IMPLEMENTATION NOTE: In order to avoid checking for get/set in each
 + * iovar case, the switch statement maps the iovar id into separate get
 + * and set values.  If you add a new iovar to the switch you MUST use
 + * IOV_GVAL and/or IOV_SVAL in the case labels to avoid conflict with
 + * another case.
 + * Please use params for additional qualifying parameters.
 + */
 +int
 +wlc_doiovar(void *hdl, const bcm_iovar_t *vi, u32 actionid,
 +          const char *name, void *params, uint p_len, void *arg, int len,
 +          int val_size, struct wlc_if *wlcif)
 +{
 +      struct wlc_info *wlc = hdl;
 +      struct wlc_bsscfg *bsscfg;
 +      int err = 0;
 +      s32 int_val = 0;
 +      s32 int_val2 = 0;
 +      s32 *ret_int_ptr;
 +      bool bool_val;
 +      bool bool_val2;
 +      wlc_bss_info_t *current_bss;
 +
 +      WL_TRACE("wl%d: %s\n", wlc->pub->unit, __func__);
 +
 +      bsscfg = NULL;
 +      current_bss = NULL;
 +
 +      err = wlc_iovar_check(wlc->pub, vi, arg, len, IOV_ISSET(actionid));
 +      if (err != 0)
 +              return err;
 +
 +      /* convenience int and bool vals for first 8 bytes of buffer */
 +      if (p_len >= (int)sizeof(int_val))
 +              memcpy(&int_val, params, sizeof(int_val));
 +
 +      if (p_len >= (int)sizeof(int_val) * 2)
 +              memcpy(&int_val2,
 +                     (void *)((unsigned long)params + sizeof(int_val)),
 +                     sizeof(int_val));
 +
 +      /* convenience int ptr for 4-byte gets (requires int aligned arg) */
 +      ret_int_ptr = (s32 *) arg;
 +
 +      bool_val = (int_val != 0) ? true : false;
 +      bool_val2 = (int_val2 != 0) ? true : false;
 +
 +      WL_TRACE("wl%d: %s: id %d\n",
 +               wlc->pub->unit, __func__, IOV_ID(actionid));
 +      /* Do the actual parameter implementation */
 +      switch (actionid) {
 +      case IOV_SVAL(IOV_RTSTHRESH):
 +              wlc->RTSThresh = int_val;
 +              break;
 +
 +      case IOV_GVAL(IOV_QTXPOWER):{
 +                      uint qdbm;
 +                      bool override;
 +
 +                      err = wlc_phy_txpower_get(wlc->band->pi, &qdbm,
 +                              &override);
 +                      if (err != BCME_OK)
 +                              return err;
 +
 +                      /* Return qdbm units */
 +                      *ret_int_ptr =
 +                          qdbm | (override ? WL_TXPWR_OVERRIDE : 0);
 +                      break;
 +              }
 +
 +              /* As long as override is false, this only sets the *user* targets.
 +                 User can twiddle this all he wants with no harm.
 +                 wlc_phy_txpower_set() explicitly sets override to false if
 +                 not internal or test.
 +               */
 +      case IOV_SVAL(IOV_QTXPOWER):{
 +                      u8 qdbm;
 +                      bool override;
 +
 +                      /* Remove override bit and clip to max qdbm value */
 +                      qdbm = (u8)min_t(u32, (int_val & ~WL_TXPWR_OVERRIDE), 0xff);
 +                      /* Extract override setting */
 +                      override = (int_val & WL_TXPWR_OVERRIDE) ? true : false;
 +                      err =
 +                          wlc_phy_txpower_set(wlc->band->pi, qdbm, override);
 +                      break;
 +              }
 +
 +      case IOV_GVAL(IOV_MPC):
 +              *ret_int_ptr = (s32) wlc->mpc;
 +              break;
 +
 +      case IOV_SVAL(IOV_MPC):
 +              wlc->mpc = bool_val;
 +              wlc_radio_mpc_upd(wlc);
 +
 +              break;
 +
 +      case IOV_GVAL(IOV_BCN_LI_BCN):
 +              *ret_int_ptr = wlc->bcn_li_bcn;
 +              break;
 +
 +      case IOV_SVAL(IOV_BCN_LI_BCN):
 +              wlc->bcn_li_bcn = (u8) int_val;
 +              if (wlc->pub->up)
 +                      wlc_bcn_li_upd(wlc);
 +              break;
 +
 +      default:
 +              WL_ERROR("wl%d: %s: unsupported\n", wlc->pub->unit, __func__);
 +              err = BCME_UNSUPPORTED;
 +              break;
 +      }
 +
 +      goto exit;              /* avoid unused label warning */
 +
 + exit:
 +      return err;
 +}
 +
 +static int
 +wlc_iovar_rangecheck(struct wlc_info *wlc, u32 val, const bcm_iovar_t *vi)
 +{
 +      int err = 0;
 +      u32 min_val = 0;
 +      u32 max_val = 0;
 +
 +      /* Only ranged integers are checked */
 +      switch (vi->type) {
 +      case IOVT_INT32:
 +              max_val |= 0x7fffffff;
 +              /* fall through */
 +      case IOVT_INT16:
 +              max_val |= 0x00007fff;
 +              /* fall through */
 +      case IOVT_INT8:
 +              max_val |= 0x0000007f;
 +              min_val = ~max_val;
 +              if (vi->flags & IOVF_NTRL)
 +                      min_val = 1;
 +              else if (vi->flags & IOVF_WHL)
 +                      min_val = 0;
 +              /* Signed values are checked against max_val and min_val */
 +              if ((s32) val < (s32) min_val
 +                  || (s32) val > (s32) max_val)
 +                      err = BCME_RANGE;
 +              break;
 +
 +      case IOVT_UINT32:
 +              max_val |= 0xffffffff;
 +              /* fall through */
 +      case IOVT_UINT16:
 +              max_val |= 0x0000ffff;
 +              /* fall through */
 +      case IOVT_UINT8:
 +              max_val |= 0x000000ff;
 +              if (vi->flags & IOVF_NTRL)
 +                      min_val = 1;
 +              if ((val < min_val) || (val > max_val))
 +                      err = BCME_RANGE;
 +              break;
 +      }
 +
 +      return err;
 +}
 +
 +#ifdef BCMDBG
 +static const char *supr_reason[] = {
 +      "None", "PMQ Entry", "Flush request",
 +      "Previous frag failure", "Channel mismatch",
 +      "Lifetime Expiry", "Underflow"
 +};
 +
 +static void wlc_print_txs_status(u16 s)
 +{
 +      printk(KERN_DEBUG "[15:12]  %d  frame attempts\n",
 +             (s & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT);
 +      printk(KERN_DEBUG " [11:8]  %d  rts attempts\n",
 +             (s & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT);
 +      printk(KERN_DEBUG "    [7]  %d  PM mode indicated\n",
 +             ((s & TX_STATUS_PMINDCTD) ? 1 : 0));
 +      printk(KERN_DEBUG "    [6]  %d  intermediate status\n",
 +             ((s & TX_STATUS_INTERMEDIATE) ? 1 : 0));
 +      printk(KERN_DEBUG "    [5]  %d  AMPDU\n",
 +             (s & TX_STATUS_AMPDU) ? 1 : 0);
 +      printk(KERN_DEBUG "  [4:2]  %d  Frame Suppressed Reason (%s)\n",
 +             ((s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT),
 +             supr_reason[(s & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT]);
 +      printk(KERN_DEBUG "    [1]  %d  acked\n",
 +             ((s & TX_STATUS_ACK_RCV) ? 1 : 0));
 +}
 +#endif                                /* BCMDBG */
 +
 +void wlc_print_txstatus(tx_status_t *txs)
 +{
 +#if defined(BCMDBG)
 +      u16 s = txs->status;
 +      u16 ackphyrxsh = txs->ackphyrxsh;
 +
 +      printk(KERN_DEBUG "\ntxpkt (MPDU) Complete\n");
 +
 +      printk(KERN_DEBUG "FrameID: %04x   ", txs->frameid);
 +      printk(KERN_DEBUG "TxStatus: %04x", s);
 +      printk(KERN_DEBUG "\n");
 +
 +      wlc_print_txs_status(s);
 +
 +      printk(KERN_DEBUG "LastTxTime: %04x ", txs->lasttxtime);
 +      printk(KERN_DEBUG "Seq: %04x ", txs->sequence);
 +      printk(KERN_DEBUG "PHYTxStatus: %04x ", txs->phyerr);
 +      printk(KERN_DEBUG "RxAckRSSI: %04x ",
 +             (ackphyrxsh & PRXS1_JSSI_MASK) >> PRXS1_JSSI_SHIFT);
 +      printk(KERN_DEBUG "RxAckSQ: %04x",
 +             (ackphyrxsh & PRXS1_SQ_MASK) >> PRXS1_SQ_SHIFT);
 +      printk(KERN_DEBUG "\n");
 +#endif                                /* defined(BCMDBG) */
 +}
 +
 +static void
 +wlc_ctrupd_cache(u16 cur_stat, u16 *macstat_snapshot, u32 *macstat)
 +{
 +      u16 v;
 +      u16 delta;
 +
 +      v = le16_to_cpu(cur_stat);
 +      delta = (u16)(v - *macstat_snapshot);
 +
 +      if (delta != 0) {
 +              *macstat += delta;
 +              *macstat_snapshot = v;
 +      }
 +}
 +
 +#define MACSTATUPD(name) \
 +      wlc_ctrupd_cache(macstats.name, &wlc->core->macstat_snapshot->name, &wlc->pub->_cnt->name)
 +
 +void wlc_statsupd(struct wlc_info *wlc)
 +{
 +      int i;
 +      macstat_t macstats;
 +#ifdef BCMDBG
 +      u16 delta;
 +      u16 rxf0ovfl;
 +      u16 txfunfl[NFIFO];
 +#endif                                /* BCMDBG */
 +
 +      /* if driver down, make no sense to update stats */
 +      if (!wlc->pub->up)
 +              return;
 +
 +#ifdef BCMDBG
 +      /* save last rx fifo 0 overflow count */
 +      rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
 +
 +      /* save last tx fifo  underflow count */
 +      for (i = 0; i < NFIFO; i++)
 +              txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
 +#endif                                /* BCMDBG */
 +
 +      /* Read mac stats from contiguous shared memory */
 +      wlc_bmac_copyfrom_shm(wlc->hw, M_UCODE_MACSTAT,
 +                            &macstats, sizeof(macstat_t));
 +
 +      /* update mac stats */
 +      MACSTATUPD(txallfrm);
 +      MACSTATUPD(txrtsfrm);
 +      MACSTATUPD(txctsfrm);
 +      MACSTATUPD(txackfrm);
 +      MACSTATUPD(txdnlfrm);
 +      MACSTATUPD(txbcnfrm);
 +      for (i = 0; i < NFIFO; i++)
 +              MACSTATUPD(txfunfl[i]);
 +      MACSTATUPD(txtplunfl);
 +      MACSTATUPD(txphyerr);
 +      MACSTATUPD(rxfrmtoolong);
 +      MACSTATUPD(rxfrmtooshrt);
 +      MACSTATUPD(rxinvmachdr);
 +      MACSTATUPD(rxbadfcs);
 +      MACSTATUPD(rxbadplcp);
 +      MACSTATUPD(rxcrsglitch);
 +      MACSTATUPD(rxstrt);
 +      MACSTATUPD(rxdfrmucastmbss);
 +      MACSTATUPD(rxmfrmucastmbss);
 +      MACSTATUPD(rxcfrmucast);
 +      MACSTATUPD(rxrtsucast);
 +      MACSTATUPD(rxctsucast);
 +      MACSTATUPD(rxackucast);
 +      MACSTATUPD(rxdfrmocast);
 +      MACSTATUPD(rxmfrmocast);
 +      MACSTATUPD(rxcfrmocast);
 +      MACSTATUPD(rxrtsocast);
 +      MACSTATUPD(rxctsocast);
 +      MACSTATUPD(rxdfrmmcast);
 +      MACSTATUPD(rxmfrmmcast);
 +      MACSTATUPD(rxcfrmmcast);
 +      MACSTATUPD(rxbeaconmbss);
 +      MACSTATUPD(rxdfrmucastobss);
 +      MACSTATUPD(rxbeaconobss);
 +      MACSTATUPD(rxrsptmout);
 +      MACSTATUPD(bcntxcancl);
 +      MACSTATUPD(rxf0ovfl);
 +      MACSTATUPD(rxf1ovfl);
 +      MACSTATUPD(rxf2ovfl);
 +      MACSTATUPD(txsfovfl);
 +      MACSTATUPD(pmqovfl);
 +      MACSTATUPD(rxcgprqfrm);
 +      MACSTATUPD(rxcgprsqovfl);
 +      MACSTATUPD(txcgprsfail);
 +      MACSTATUPD(txcgprssuc);
 +      MACSTATUPD(prs_timeout);
 +      MACSTATUPD(rxnack);
 +      MACSTATUPD(frmscons);
 +      MACSTATUPD(txnack);
 +      MACSTATUPD(txglitch_nack);
 +      MACSTATUPD(txburst);
 +      MACSTATUPD(phywatchdog);
 +      MACSTATUPD(pktengrxducast);
 +      MACSTATUPD(pktengrxdmcast);
 +
 +#ifdef BCMDBG
 +      /* check for rx fifo 0 overflow */
 +      delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
 +      if (delta)
 +              WL_ERROR("wl%d: %u rx fifo 0 overflows!\n",
 +                       wlc->pub->unit, delta);
 +
 +      /* check for tx fifo underflows */
 +      for (i = 0; i < NFIFO; i++) {
 +              delta =
 +                  (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
 +                            txfunfl[i]);
 +              if (delta)
 +                      WL_ERROR("wl%d: %u tx fifo %d underflows!\n",
 +                               wlc->pub->unit, delta, i);
 +      }
 +#endif                                /* BCMDBG */
 +
 +      /* dot11 counter update */
 +
 +      WLCNTSET(wlc->pub->_cnt->txrts,
 +               (wlc->pub->_cnt->rxctsucast -
 +                wlc->pub->_cnt->d11cnt_txrts_off));
 +      WLCNTSET(wlc->pub->_cnt->rxcrc,
 +               (wlc->pub->_cnt->rxbadfcs - wlc->pub->_cnt->d11cnt_rxcrc_off));
 +      WLCNTSET(wlc->pub->_cnt->txnocts,
 +               ((wlc->pub->_cnt->txrtsfrm - wlc->pub->_cnt->rxctsucast) -
 +                wlc->pub->_cnt->d11cnt_txnocts_off));
 +
 +      /* merge counters from dma module */
 +      for (i = 0; i < NFIFO; i++) {
 +              if (wlc->hw->di[i]) {
 +                      WLCNTADD(wlc->pub->_cnt->txnobuf,
 +                               (wlc->hw->di[i])->txnobuf);
 +                      WLCNTADD(wlc->pub->_cnt->rxnobuf,
 +                               (wlc->hw->di[i])->rxnobuf);
 +                      WLCNTADD(wlc->pub->_cnt->rxgiant,
 +                               (wlc->hw->di[i])->rxgiants);
 +                      dma_counterreset(wlc->hw->di[i]);
 +              }
 +      }
 +
 +      /*
 +       * Aggregate transmit and receive errors that probably resulted
 +       * in the loss of a frame are computed on the fly.
 +       */
 +      WLCNTSET(wlc->pub->_cnt->txerror,
 +               wlc->pub->_cnt->txnobuf + wlc->pub->_cnt->txnoassoc +
 +               wlc->pub->_cnt->txuflo + wlc->pub->_cnt->txrunt +
 +               wlc->pub->_cnt->dmade + wlc->pub->_cnt->dmada +
 +               wlc->pub->_cnt->dmape);
 +      WLCNTSET(wlc->pub->_cnt->rxerror,
 +               wlc->pub->_cnt->rxoflo + wlc->pub->_cnt->rxnobuf +
 +               wlc->pub->_cnt->rxfragerr + wlc->pub->_cnt->rxrunt +
 +               wlc->pub->_cnt->rxgiant + wlc->pub->_cnt->rxnoscb +
 +               wlc->pub->_cnt->rxbadsrcmac);
 +      for (i = 0; i < NFIFO; i++)
 +              wlc->pub->_cnt->rxerror += wlc->pub->_cnt->rxuflo[i];
 +}
 +
 +bool wlc_chipmatch(u16 vendor, u16 device)
 +{
 +      if (vendor != VENDOR_BROADCOM) {
 +              WL_ERROR("wlc_chipmatch: unknown vendor id %04x\n", vendor);
 +              return false;
 +      }
 +
 +      if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
 +              return true;
 +
 +      if (device == BCM4313_D11N2G_ID)
 +              return true;
 +      if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
 +              return true;
 +
 +      WL_ERROR("wlc_chipmatch: unknown device id %04x\n", device);
 +      return false;
 +}
 +
 +#if defined(BCMDBG)
 +void wlc_print_txdesc(d11txh_t *txh)
 +{
 +      u16 mtcl = le16_to_cpu(txh->MacTxControlLow);
 +      u16 mtch = le16_to_cpu(txh->MacTxControlHigh);
 +      u16 mfc = le16_to_cpu(txh->MacFrameControl);
 +      u16 tfest = le16_to_cpu(txh->TxFesTimeNormal);
 +      u16 ptcw = le16_to_cpu(txh->PhyTxControlWord);
 +      u16 ptcw_1 = le16_to_cpu(txh->PhyTxControlWord_1);
 +      u16 ptcw_1_Fbr = le16_to_cpu(txh->PhyTxControlWord_1_Fbr);
 +      u16 ptcw_1_Rts = le16_to_cpu(txh->PhyTxControlWord_1_Rts);
 +      u16 ptcw_1_FbrRts = le16_to_cpu(txh->PhyTxControlWord_1_FbrRts);
 +      u16 mainrates = le16_to_cpu(txh->MainRates);
 +      u16 xtraft = le16_to_cpu(txh->XtraFrameTypes);
 +      u8 *iv = txh->IV;
 +      u8 *ra = txh->TxFrameRA;
 +      u16 tfestfb = le16_to_cpu(txh->TxFesTimeFallback);
 +      u8 *rtspfb = txh->RTSPLCPFallback;
 +      u16 rtsdfb = le16_to_cpu(txh->RTSDurFallback);
 +      u8 *fragpfb = txh->FragPLCPFallback;
 +      u16 fragdfb = le16_to_cpu(txh->FragDurFallback);
 +      u16 mmodelen = le16_to_cpu(txh->MModeLen);
 +      u16 mmodefbrlen = le16_to_cpu(txh->MModeFbrLen);
 +      u16 tfid = le16_to_cpu(txh->TxFrameID);
 +      u16 txs = le16_to_cpu(txh->TxStatus);
 +      u16 mnmpdu = le16_to_cpu(txh->MaxNMpdus);
 +      u16 mabyte = le16_to_cpu(txh->MaxABytes_MRT);
 +      u16 mabyte_f = le16_to_cpu(txh->MaxABytes_FBR);
 +      u16 mmbyte = le16_to_cpu(txh->MinMBytes);
 +
 +      u8 *rtsph = txh->RTSPhyHeader;
 +      struct ieee80211_rts rts = txh->rts_frame;
 +      char hexbuf[256];
 +
 +      /* add plcp header along with txh descriptor */
 +      prhex("Raw TxDesc + plcp header", (unsigned char *) txh, sizeof(d11txh_t) + 48);
 +
 +      printk(KERN_DEBUG "TxCtlLow: %04x ", mtcl);
 +      printk(KERN_DEBUG "TxCtlHigh: %04x ", mtch);
 +      printk(KERN_DEBUG "FC: %04x ", mfc);
 +      printk(KERN_DEBUG "FES Time: %04x\n", tfest);
 +      printk(KERN_DEBUG "PhyCtl: %04x%s ", ptcw,
 +             (ptcw & PHY_TXC_SHORT_HDR) ? " short" : "");
 +      printk(KERN_DEBUG "PhyCtl_1: %04x ", ptcw_1);
 +      printk(KERN_DEBUG "PhyCtl_1_Fbr: %04x\n", ptcw_1_Fbr);
 +      printk(KERN_DEBUG "PhyCtl_1_Rts: %04x ", ptcw_1_Rts);
 +      printk(KERN_DEBUG "PhyCtl_1_Fbr_Rts: %04x\n", ptcw_1_FbrRts);
 +      printk(KERN_DEBUG "MainRates: %04x ", mainrates);
 +      printk(KERN_DEBUG "XtraFrameTypes: %04x ", xtraft);
 +      printk(KERN_DEBUG "\n");
 +
 +      bcm_format_hex(hexbuf, iv, sizeof(txh->IV));
 +      printk(KERN_DEBUG "SecIV:       %s\n", hexbuf);
 +      bcm_format_hex(hexbuf, ra, sizeof(txh->TxFrameRA));
 +      printk(KERN_DEBUG "RA:          %s\n", hexbuf);
 +
 +      printk(KERN_DEBUG "Fb FES Time: %04x ", tfestfb);
 +      bcm_format_hex(hexbuf, rtspfb, sizeof(txh->RTSPLCPFallback));
 +      printk(KERN_DEBUG "RTS PLCP: %s ", hexbuf);
 +      printk(KERN_DEBUG "RTS DUR: %04x ", rtsdfb);
 +      bcm_format_hex(hexbuf, fragpfb, sizeof(txh->FragPLCPFallback));
 +      printk(KERN_DEBUG "PLCP: %s ", hexbuf);
 +      printk(KERN_DEBUG "DUR: %04x", fragdfb);
 +      printk(KERN_DEBUG "\n");
 +
 +      printk(KERN_DEBUG "MModeLen: %04x ", mmodelen);
 +      printk(KERN_DEBUG "MModeFbrLen: %04x\n", mmodefbrlen);
 +
 +      printk(KERN_DEBUG "FrameID:     %04x\n", tfid);
 +      printk(KERN_DEBUG "TxStatus:    %04x\n", txs);
 +
 +      printk(KERN_DEBUG "MaxNumMpdu:  %04x\n", mnmpdu);
 +      printk(KERN_DEBUG "MaxAggbyte:  %04x\n", mabyte);
 +      printk(KERN_DEBUG "MaxAggbyte_fb:  %04x\n", mabyte_f);
 +      printk(KERN_DEBUG "MinByte:     %04x\n", mmbyte);
 +
 +      bcm_format_hex(hexbuf, rtsph, sizeof(txh->RTSPhyHeader));
 +      printk(KERN_DEBUG "RTS PLCP: %s ", hexbuf);
 +      bcm_format_hex(hexbuf, (u8 *) &rts, sizeof(txh->rts_frame));
 +      printk(KERN_DEBUG "RTS Frame: %s", hexbuf);
 +      printk(KERN_DEBUG "\n");
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +#if defined(BCMDBG)
 +void wlc_print_rxh(d11rxhdr_t *rxh)
 +{
 +      u16 len = rxh->RxFrameSize;
 +      u16 phystatus_0 = rxh->PhyRxStatus_0;
 +      u16 phystatus_1 = rxh->PhyRxStatus_1;
 +      u16 phystatus_2 = rxh->PhyRxStatus_2;
 +      u16 phystatus_3 = rxh->PhyRxStatus_3;
 +      u16 macstatus1 = rxh->RxStatus1;
 +      u16 macstatus2 = rxh->RxStatus2;
 +      char flagstr[64];
 +      char lenbuf[20];
 +      static const bcm_bit_desc_t macstat_flags[] = {
 +              {RXS_FCSERR, "FCSErr"},
 +              {RXS_RESPFRAMETX, "Reply"},
 +              {RXS_PBPRES, "PADDING"},
 +              {RXS_DECATMPT, "DeCr"},
 +              {RXS_DECERR, "DeCrErr"},
 +              {RXS_BCNSENT, "Bcn"},
 +              {0, NULL}
 +      };
 +
 +      prhex("Raw RxDesc", (unsigned char *) rxh, sizeof(d11rxhdr_t));
 +
 +      bcm_format_flags(macstat_flags, macstatus1, flagstr, 64);
 +
 +      snprintf(lenbuf, sizeof(lenbuf), "0x%x", len);
 +
 +      printk(KERN_DEBUG "RxFrameSize:     %6s (%d)%s\n", lenbuf, len,
 +             (rxh->PhyRxStatus_0 & PRXS0_SHORTH) ? " short preamble" : "");
 +      printk(KERN_DEBUG "RxPHYStatus:     %04x %04x %04x %04x\n",
 +             phystatus_0, phystatus_1, phystatus_2, phystatus_3);
 +      printk(KERN_DEBUG "RxMACStatus:     %x %s\n", macstatus1, flagstr);
 +      printk(KERN_DEBUG "RXMACaggtype:    %x\n",
 +             (macstatus2 & RXS_AGGTYPE_MASK));
 +      printk(KERN_DEBUG "RxTSFTime:       %04x\n", rxh->RxTSFTime);
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +#if defined(BCMDBG)
 +int wlc_format_ssid(char *buf, const unsigned char ssid[], uint ssid_len)
 +{
 +      uint i, c;
 +      char *p = buf;
 +      char *endp = buf + SSID_FMT_BUF_LEN;
 +
 +      if (ssid_len > IEEE80211_MAX_SSID_LEN)
 +              ssid_len = IEEE80211_MAX_SSID_LEN;
 +
 +      for (i = 0; i < ssid_len; i++) {
 +              c = (uint) ssid[i];
 +              if (c == '\\') {
 +                      *p++ = '\\';
 +                      *p++ = '\\';
 +              } else if (isprint((unsigned char) c)) {
 +                      *p++ = (char)c;
 +              } else {
 +                      p += snprintf(p, (endp - p), "\\x%02X", c);
 +              }
 +      }
 +      *p = '\0';
 +      ASSERT(p < endp);
 +
 +      return (int)(p - buf);
 +}
 +#endif                                /* defined(BCMDBG) */
 +
 +static u16 wlc_rate_shm_offset(struct wlc_info *wlc, u8 rate)
 +{
 +      return wlc_bmac_rate_shm_offset(wlc->hw, rate);
 +}
 +
 +/* Callback for device removed */
 +
 +/*
 + * Attempts to queue a packet onto a multiple-precedence queue,
 + * if necessary evicting a lower precedence packet from the queue.
 + *
 + * 'prec' is the precedence number that has already been mapped
 + * from the packet priority.
 + *
 + * Returns true if packet consumed (queued), false if not.
 + */
 +bool BCMFASTPATH
 +wlc_prec_enq(struct wlc_info *wlc, struct pktq *q, void *pkt, int prec)
 +{
 +      return wlc_prec_enq_head(wlc, q, pkt, prec, false);
 +}
 +
 +bool BCMFASTPATH
 +wlc_prec_enq_head(struct wlc_info *wlc, struct pktq *q, struct sk_buff *pkt,
 +                int prec, bool head)
 +{
 +      struct sk_buff *p;
 +      int eprec = -1;         /* precedence to evict from */
 +
 +      /* Determine precedence from which to evict packet, if any */
 +      if (pktq_pfull(q, prec))
 +              eprec = prec;
 +      else if (pktq_full(q)) {
 +              p = pktq_peek_tail(q, &eprec);
 +              ASSERT(p != NULL);
 +              if (eprec > prec) {
 +                      WL_ERROR("%s: Failing: eprec %d > prec %d\n",
 +                               __func__, eprec, prec);
 +                      return false;
 +              }
 +      }
 +
 +      /* Evict if needed */
 +      if (eprec >= 0) {
 +              bool discard_oldest;
 +
 +              /* Detect queueing to unconfigured precedence */
 +              ASSERT(!pktq_pempty(q, eprec));
 +
 +              discard_oldest = AC_BITMAP_TST(wlc->wme_dp, eprec);
 +
 +              /* Refuse newer packet unless configured to discard oldest */
 +              if (eprec == prec && !discard_oldest) {
 +                      WL_ERROR("%s: No where to go, prec == %d\n",
 +                               __func__, prec);
 +                      return false;
 +              }
 +
 +              /* Evict packet according to discard policy */
 +              p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q,
 +                                                                        eprec);
 +              ASSERT(p != NULL);
 +
 +              /* Increment wme stats */
 +              if (WME_ENAB(wlc->pub)) {
 +                      WLCNTINCR(wlc->pub->_wme_cnt->
 +                                tx_failed[WME_PRIO2AC(p->priority)].packets);
 +                      WLCNTADD(wlc->pub->_wme_cnt->
 +                               tx_failed[WME_PRIO2AC(p->priority)].bytes,
 +                               pkttotlen(p));
 +              }
 +              pkt_buf_free_skb(p);
 +              wlc->pub->_cnt->txnobuf++;
 +      }
 +
 +      /* Enqueue */
 +      if (head)
 +              p = pktq_penq_head(q, prec, pkt);
 +      else
 +              p = pktq_penq(q, prec, pkt);
 +      ASSERT(p != NULL);
 +
 +      return true;
 +}
 +
 +void BCMFASTPATH wlc_txq_enq(void *ctx, struct scb *scb, struct sk_buff *sdu,
 +                           uint prec)
 +{
 +      struct wlc_info *wlc = (struct wlc_info *) ctx;
 +      struct wlc_txq_info *qi = wlc->active_queue;    /* Check me */
 +      struct pktq *q = &qi->q;
 +      int prio;
 +
 +      prio = sdu->priority;
 +
 +      ASSERT(pktq_max(q) >= wlc->pub->tunables->datahiwat);
 +
 +      if (!wlc_prec_enq(wlc, q, sdu, prec)) {
 +              if (!EDCF_ENAB(wlc->pub)
 +                  || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL))
 +                      WL_ERROR("wl%d: wlc_txq_enq: txq overflow\n",
 +                               wlc->pub->unit);
 +
 +              /*
 +               * XXX we might hit this condtion in case
 +               * packet flooding from mac80211 stack
 +               */
 +              pkt_buf_free_skb(sdu);
 +              wlc->pub->_cnt->txnobuf++;
 +      }
 +
 +      /* Check if flow control needs to be turned on after enqueuing the packet
 +       *   Don't turn on flow control if EDCF is enabled. Driver would make the decision on what
 +       *   to drop instead of relying on stack to make the right decision
 +       */
 +      if (!EDCF_ENAB(wlc->pub)
 +          || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL)) {
 +              if (pktq_len(q) >= wlc->pub->tunables->datahiwat) {
 +                      wlc_txflowcontrol(wlc, qi, ON, ALLPRIO);
 +              }
 +      } else if (wlc->pub->_priofc) {
 +              if (pktq_plen(q, wlc_prio2prec_map[prio]) >=
 +                  wlc->pub->tunables->datahiwat) {
 +                      wlc_txflowcontrol(wlc, qi, ON, prio);
 +              }
 +      }
 +}
 +
 +bool BCMFASTPATH
 +wlc_sendpkt_mac80211(struct wlc_info *wlc, struct sk_buff *sdu,
 +                   struct ieee80211_hw *hw)
 +{
 +      u8 prio;
 +      uint fifo;
 +      void *pkt;
 +      struct scb *scb = &global_scb;
 +      struct ieee80211_hdr *d11_header = (struct ieee80211_hdr *)(sdu->data);
 +
 +      ASSERT(sdu);
 +
 +      /* 802.11 standard requires management traffic to go at highest priority */
 +      prio = ieee80211_is_data(d11_header->frame_control) ? sdu->priority :
 +              MAXPRIO;
 +      fifo = prio2fifo[prio];
 +
 +      ASSERT((uint) skb_headroom(sdu) >= TXOFF);
 +      ASSERT(!(sdu->next));
 +      ASSERT(!(sdu->prev));
 +      ASSERT(fifo < NFIFO);
 +
 +      pkt = sdu;
 +      if (unlikely
 +          (wlc_d11hdrs_mac80211(wlc, hw, pkt, scb, 0, 1, fifo, 0, NULL, 0)))
 +              return -EINVAL;
 +      wlc_txq_enq(wlc, scb, pkt, WLC_PRIO_TO_PREC(prio));
 +      wlc_send_q(wlc, wlc->active_queue);
 +
 +      wlc->pub->_cnt->ieee_tx++;
 +      return 0;
 +}
 +
 +void BCMFASTPATH wlc_send_q(struct wlc_info *wlc, struct wlc_txq_info *qi)
 +{
 +      struct sk_buff *pkt[DOT11_MAXNUMFRAGS];
 +      int prec;
 +      u16 prec_map;
 +      int err = 0, i, count;
 +      uint fifo;
 +      struct pktq *q = &qi->q;
 +      struct ieee80211_tx_info *tx_info;
 +
 +      /* only do work for the active queue */
 +      if (qi != wlc->active_queue)
 +              return;
 +
 +      if (in_send_q)
 +              return;
 +      else
 +              in_send_q = true;
 +
 +      prec_map = wlc->tx_prec_map;
 +
 +      /* Send all the enq'd pkts that we can.
 +       * Dequeue packets with precedence with empty HW fifo only
 +       */
 +      while (prec_map && (pkt[0] = pktq_mdeq(q, prec_map, &prec))) {
 +              tx_info = IEEE80211_SKB_CB(pkt[0]);
 +              if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 +                      err = wlc_sendampdu(wlc->ampdu, qi, pkt, prec);
 +              } else {
 +                      count = 1;
 +                      err = wlc_prep_pdu(wlc, pkt[0], &fifo);
 +                      if (!err) {
 +                              for (i = 0; i < count; i++) {
 +                                      wlc_txfifo(wlc, fifo, pkt[i], true, 1);
 +                              }
 +                      }
 +              }
 +
 +              if (err == BCME_BUSY) {
 +                      pktq_penq_head(q, prec, pkt[0]);
 +                      /* If send failed due to any other reason than a change in
 +                       * HW FIFO condition, quit. Otherwise, read the new prec_map!
 +                       */
 +                      if (prec_map == wlc->tx_prec_map)
 +                              break;
 +                      prec_map = wlc->tx_prec_map;
 +              }
 +      }
 +
 +      /* Check if flow control needs to be turned off after sending the packet */
 +      if (!EDCF_ENAB(wlc->pub)
 +          || (wlc->pub->wlfeatureflag & WL_SWFL_FLOWCONTROL)) {
 +              if (wlc_txflowcontrol_prio_isset(wlc, qi, ALLPRIO)
 +                  && (pktq_len(q) < wlc->pub->tunables->datahiwat / 2)) {
 +                      wlc_txflowcontrol(wlc, qi, OFF, ALLPRIO);
 +              }
 +      } else if (wlc->pub->_priofc) {
 +              int prio;
 +              for (prio = MAXPRIO; prio >= 0; prio--) {
 +                      if (wlc_txflowcontrol_prio_isset(wlc, qi, prio) &&
 +                          (pktq_plen(q, wlc_prio2prec_map[prio]) <
 +                           wlc->pub->tunables->datahiwat / 2)) {
 +                              wlc_txflowcontrol(wlc, qi, OFF, prio);
 +                      }
 +              }
 +      }
 +      in_send_q = false;
 +}
 +
 +/*
 + * bcmc_fid_generate:
 + * Generate frame ID for a BCMC packet.  The frag field is not used
 + * for MC frames so is used as part of the sequence number.
 + */
 +static inline u16
 +bcmc_fid_generate(struct wlc_info *wlc, struct wlc_bsscfg *bsscfg,
 +                d11txh_t *txh)
 +{
 +      u16 frameid;
 +
 +      frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
 +                                                TXFID_QUEUE_MASK);
 +      frameid |=
 +          (((wlc->
 +             mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
 +          TX_BCMC_FIFO;
 +
 +      return frameid;
 +}
 +
 +void BCMFASTPATH
 +wlc_txfifo(struct wlc_info *wlc, uint fifo, struct sk_buff *p, bool commit,
 +         s8 txpktpend)
 +{
 +      u16 frameid = INVALIDFID;
 +      d11txh_t *txh;
 +
 +      ASSERT(fifo < NFIFO);
 +      txh = (d11txh_t *) (p->data);
 +
 +      /* When a BC/MC frame is being committed to the BCMC fifo via DMA (NOT PIO), update
 +       * ucode or BSS info as appropriate.
 +       */
 +      if (fifo == TX_BCMC_FIFO) {
 +              frameid = le16_to_cpu(txh->TxFrameID);
 +
 +      }
 +
 +      if (WLC_WAR16165(wlc))
 +              wlc_war16165(wlc, true);
 +
 +
 +      /* Bump up pending count for if not using rpc. If rpc is used, this will be handled
 +       * in wlc_bmac_txfifo()
 +       */
 +      if (commit) {
 +              TXPKTPENDINC(wlc, fifo, txpktpend);
 +              WL_TRACE("wlc_txfifo, pktpend inc %d to %d\n",
 +                       txpktpend, TXPKTPENDGET(wlc, fifo));
 +      }
 +
 +      /* Commit BCMC sequence number in the SHM frame ID location */
 +      if (frameid != INVALIDFID)
 +              BCMCFID(wlc, frameid);
 +
 +      if (dma_txfast(wlc->hw->di[fifo], p, commit) < 0) {
 +              WL_ERROR("wlc_txfifo: fatal, toss frames !!!\n");
 +      }
 +}
 +
 +static u16
 +wlc_compute_airtime(struct wlc_info *wlc, ratespec_t rspec, uint length)
 +{
 +      u16 usec = 0;
 +      uint mac_rate = RSPEC2RATE(rspec);
 +      uint nsyms;
 +
 +      if (IS_MCS(rspec)) {
 +              /* not supported yet */
 +              ASSERT(0);
 +      } else if (IS_OFDM(rspec)) {
 +              /* nsyms = Ceiling(Nbits / (Nbits/sym))
 +               *
 +               * Nbits = length * 8
 +               * Nbits/sym = Mbps * 4 = mac_rate * 2
 +               */
 +              nsyms = CEIL((length * 8), (mac_rate * 2));
 +
 +              /* usec = symbols * usec/symbol */
 +              usec = (u16) (nsyms * APHY_SYMBOL_TIME);
 +              return usec;
 +      } else {
 +              switch (mac_rate) {
 +              case WLC_RATE_1M:
 +                      usec = length << 3;
 +                      break;
 +              case WLC_RATE_2M:
 +                      usec = length << 2;
 +                      break;
 +              case WLC_RATE_5M5:
 +                      usec = (length << 4) / 11;
 +                      break;
 +              case WLC_RATE_11M:
 +                      usec = (length << 3) / 11;
 +                      break;
 +              default:
 +                      WL_ERROR("wl%d: wlc_compute_airtime: unsupported rspec 0x%x\n",
 +                               wlc->pub->unit, rspec);
 +                      ASSERT((const char *)"Bad phy_rate" == NULL);
 +                      break;
 +              }
 +      }
 +
 +      return usec;
 +}
 +
 +void BCMFASTPATH
 +wlc_compute_plcp(struct wlc_info *wlc, ratespec_t rspec, uint length, u8 *plcp)
 +{
 +      if (IS_MCS(rspec)) {
 +              wlc_compute_mimo_plcp(rspec, length, plcp);
 +      } else if (IS_OFDM(rspec)) {
 +              wlc_compute_ofdm_plcp(rspec, length, plcp);
 +      } else {
 +              wlc_compute_cck_plcp(rspec, length, plcp);
 +      }
 +      return;
 +}
 +
 +/* Rate: 802.11 rate code, length: PSDU length in octets */
 +static void wlc_compute_mimo_plcp(ratespec_t rspec, uint length, u8 *plcp)
 +{
 +      u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
 +      ASSERT(IS_MCS(rspec));
 +      plcp[0] = mcs;
 +      if (RSPEC_IS40MHZ(rspec) || (mcs == 32))
 +              plcp[0] |= MIMO_PLCP_40MHZ;
 +      WLC_SET_MIMO_PLCP_LEN(plcp, length);
 +      plcp[3] = RSPEC_MIMOPLCP3(rspec);       /* rspec already holds this byte */
 +      plcp[3] |= 0x7;         /* set smoothing, not sounding ppdu & reserved */
 +      plcp[4] = 0;            /* number of extension spatial streams bit 0 & 1 */
 +      plcp[5] = 0;
 +}
 +
 +/* Rate: 802.11 rate code, length: PSDU length in octets */
 +static void BCMFASTPATH
 +wlc_compute_ofdm_plcp(ratespec_t rspec, u32 length, u8 *plcp)
 +{
 +      u8 rate_signal;
 +      u32 tmp = 0;
 +      int rate = RSPEC2RATE(rspec);
 +
 +      ASSERT(IS_OFDM(rspec));
 +
 +      /* encode rate per 802.11a-1999 sec 17.3.4.1, with lsb transmitted first */
 +      rate_signal = rate_info[rate] & RATE_MASK;
 +      ASSERT(rate_signal != 0);
 +
 +      memset(plcp, 0, D11_PHY_HDR_LEN);
 +      D11A_PHY_HDR_SRATE((ofdm_phy_hdr_t *) plcp, rate_signal);
 +
 +      tmp = (length & 0xfff) << 5;
 +      plcp[2] |= (tmp >> 16) & 0xff;
 +      plcp[1] |= (tmp >> 8) & 0xff;
 +      plcp[0] |= tmp & 0xff;
 +
 +      return;
 +}
 +
 +/*
 + * Compute PLCP, but only requires actual rate and length of pkt.
 + * Rate is given in the driver standard multiple of 500 kbps.
 + * le is set for 11 Mbps rate if necessary.
 + * Broken out for PRQ.
 + */
 +
 +static void wlc_cck_plcp_set(int rate_500, uint length, u8 *plcp)
 +{
 +      u16 usec = 0;
 +      u8 le = 0;
 +
 +      switch (rate_500) {
 +      case WLC_RATE_1M:
 +              usec = length << 3;
 +              break;
 +      case WLC_RATE_2M:
 +              usec = length << 2;
 +              break;
 +      case WLC_RATE_5M5:
 +              usec = (length << 4) / 11;
 +              if ((length << 4) - (usec * 11) > 0)
 +                      usec++;
 +              break;
 +      case WLC_RATE_11M:
 +              usec = (length << 3) / 11;
 +              if ((length << 3) - (usec * 11) > 0) {
 +                      usec++;
 +                      if ((usec * 11) - (length << 3) >= 8)
 +                              le = D11B_PLCP_SIGNAL_LE;
 +              }
 +              break;
 +
 +      default:
 +              WL_ERROR("wlc_cck_plcp_set: unsupported rate %d\n", rate_500);
 +              rate_500 = WLC_RATE_1M;
 +              usec = length << 3;
 +              break;
 +      }
 +      /* PLCP signal byte */
 +      plcp[0] = rate_500 * 5; /* r (500kbps) * 5 == r (100kbps) */
 +      /* PLCP service byte */
 +      plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
 +      /* PLCP length u16, little endian */
 +      plcp[2] = usec & 0xff;
 +      plcp[3] = (usec >> 8) & 0xff;
 +      /* PLCP CRC16 */
 +      plcp[4] = 0;
 +      plcp[5] = 0;
 +}
 +
 +/* Rate: 802.11 rate code, length: PSDU length in octets */
 +static void wlc_compute_cck_plcp(ratespec_t rspec, uint length, u8 *plcp)
 +{
 +      int rate = RSPEC2RATE(rspec);
 +
 +      ASSERT(IS_CCK(rspec));
 +
 +      wlc_cck_plcp_set(rate, length, plcp);
 +}
 +
 +/* wlc_compute_frame_dur()
 + *
 + * Calculate the 802.11 MAC header DUR field for MPDU
 + * DUR for a single frame = 1 SIFS + 1 ACK
 + * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
 + *
 + * rate                       MPDU rate in unit of 500kbps
 + * next_frag_len      next MPDU length in bytes
 + * preamble_type      use short/GF or long/MM PLCP header
 + */
 +static u16 BCMFASTPATH
 +wlc_compute_frame_dur(struct wlc_info *wlc, ratespec_t rate, u8 preamble_type,
 +                    uint next_frag_len)
 +{
 +      u16 dur, sifs;
 +
 +      sifs = SIFS(wlc->band);
 +
 +      dur = sifs;
 +      dur += (u16) wlc_calc_ack_time(wlc, rate, preamble_type);
 +
 +      if (next_frag_len) {
 +              /* Double the current DUR to get 2 SIFS + 2 ACKs */
 +              dur *= 2;
 +              /* add another SIFS and the frag time */
 +              dur += sifs;
 +              dur +=
 +                  (u16) wlc_calc_frame_time(wlc, rate, preamble_type,
 +                                               next_frag_len);
 +      }
 +      return dur;
 +}
 +
 +/* wlc_compute_rtscts_dur()
 + *
 + * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
 + * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
 + * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
 + *
 + * cts                        cts-to-self or rts/cts
 + * rts_rate           rts or cts rate in unit of 500kbps
 + * rate                       next MPDU rate in unit of 500kbps
 + * frame_len          next MPDU frame length in bytes
 + */
 +u16 BCMFASTPATH
 +wlc_compute_rtscts_dur(struct wlc_info *wlc, bool cts_only, ratespec_t rts_rate,
 +                     ratespec_t frame_rate, u8 rts_preamble_type,
 +                     u8 frame_preamble_type, uint frame_len, bool ba)
 +{
 +      u16 dur, sifs;
 +
 +      sifs = SIFS(wlc->band);
 +
 +      if (!cts_only) {        /* RTS/CTS */
 +              dur = 3 * sifs;
 +              dur +=
 +                  (u16) wlc_calc_cts_time(wlc, rts_rate,
 +                                             rts_preamble_type);
 +      } else {                /* CTS-TO-SELF */
 +              dur = 2 * sifs;
 +      }
 +
 +      dur +=
 +          (u16) wlc_calc_frame_time(wlc, frame_rate, frame_preamble_type,
 +                                       frame_len);
 +      if (ba)
 +              dur +=
 +                  (u16) wlc_calc_ba_time(wlc, frame_rate,
 +                                            WLC_SHORT_PREAMBLE);
 +      else
 +              dur +=
 +                  (u16) wlc_calc_ack_time(wlc, frame_rate,
 +                                             frame_preamble_type);
 +      return dur;
 +}
 +
 +static bool wlc_phy_rspec_check(struct wlc_info *wlc, u16 bw, ratespec_t rspec)
 +{
 +      if (IS_MCS(rspec)) {
 +              uint mcs = rspec & RSPEC_RATE_MASK;
 +
 +              if (mcs < 8) {
 +                      ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_SDM);
 +              } else if ((mcs >= 8) && (mcs <= 23)) {
 +                      ASSERT(RSPEC_STF(rspec) == PHY_TXC1_MODE_SDM);
 +              } else if (mcs == 32) {
 +                      ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_SDM);
 +                      ASSERT(bw == PHY_TXC1_BW_40MHZ_DUP);
 +              }
 +      } else if (IS_OFDM(rspec)) {
 +              ASSERT(RSPEC_STF(rspec) < PHY_TXC1_MODE_STBC);
 +      } else {
 +              ASSERT(IS_CCK(rspec));
 +
 +              ASSERT((bw == PHY_TXC1_BW_20MHZ)
 +                     || (bw == PHY_TXC1_BW_20MHZ_UP));
 +              ASSERT(RSPEC_STF(rspec) == PHY_TXC1_MODE_SISO);
 +      }
 +
 +      return true;
 +}
 +
 +u16 BCMFASTPATH wlc_phytxctl1_calc(struct wlc_info *wlc, ratespec_t rspec)
 +{
 +      u16 phyctl1 = 0;
 +      u16 bw;
 +
 +      if (WLCISLCNPHY(wlc->band)) {
 +              bw = PHY_TXC1_BW_20MHZ;
 +      } else {
 +              bw = RSPEC_GET_BW(rspec);
 +              /* 10Mhz is not supported yet */
 +              if (bw < PHY_TXC1_BW_20MHZ) {
 +                      WL_ERROR("wlc_phytxctl1_calc: bw %d is not supported yet, set to 20L\n",
 +                               bw);
 +                      bw = PHY_TXC1_BW_20MHZ;
 +              }
 +
 +              wlc_phy_rspec_check(wlc, bw, rspec);
 +      }
 +
 +      if (IS_MCS(rspec)) {
 +              uint mcs = rspec & RSPEC_RATE_MASK;
 +
 +              /* bw, stf, coding-type is part of RSPEC_PHYTXBYTE2 returns */
 +              phyctl1 = RSPEC_PHYTXBYTE2(rspec);
 +              /* set the upper byte of phyctl1 */
 +              phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
 +      } else if (IS_CCK(rspec) && !WLCISLCNPHY(wlc->band)
 +                 && !WLCISSSLPNPHY(wlc->band)) {
 +              /* In CCK mode LPPHY overloads OFDM Modulation bits with CCK Data Rate */
 +              /* Eventually MIMOPHY would also be converted to this format */
 +              /* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
 +              phyctl1 = (bw | (RSPEC_STF(rspec) << PHY_TXC1_MODE_SHIFT));
 +      } else {                /* legacy OFDM/CCK */
 +              s16 phycfg;
 +              /* get the phyctl byte from rate phycfg table */
 +              phycfg = wlc_rate_legacy_phyctl(RSPEC2RATE(rspec));
 +              if (phycfg == -1) {
 +                      WL_ERROR("wlc_phytxctl1_calc: wrong legacy OFDM/CCK rate\n");
 +                      ASSERT(0);
 +                      phycfg = 0;
 +              }
 +              /* set the upper byte of phyctl1 */
 +              phyctl1 =
 +                  (bw | (phycfg << 8) |
 +                   (RSPEC_STF(rspec) << PHY_TXC1_MODE_SHIFT));
 +      }
 +
 +#ifdef BCMDBG
 +      /* phy clock must support 40Mhz if tx descriptor uses it */
 +      if ((phyctl1 & PHY_TXC1_BW_MASK) >= PHY_TXC1_BW_40MHZ) {
 +              ASSERT(CHSPEC_WLC_BW(wlc->chanspec) == WLC_40_MHZ);
 +              ASSERT(wlc->chanspec == wlc_phy_chanspec_get(wlc->band->pi));
 +      }
 +#endif                                /* BCMDBG */
 +      return phyctl1;
 +}
 +
 +ratespec_t BCMFASTPATH
 +wlc_rspec_to_rts_rspec(struct wlc_info *wlc, ratespec_t rspec, bool use_rspec,
 +                     u16 mimo_ctlchbw)
 +{
 +      ratespec_t rts_rspec = 0;
 +
 +      if (use_rspec) {
 +              /* use frame rate as rts rate */
 +              rts_rspec = rspec;
 +
 +      } else if (wlc->band->gmode && wlc->protection->_g && !IS_CCK(rspec)) {
 +              /* Use 11Mbps as the g protection RTS target rate and fallback.
 +               * Use the WLC_BASIC_RATE() lookup to find the best basic rate under the
 +               * target in case 11 Mbps is not Basic.
 +               * 6 and 9 Mbps are not usually selected by rate selection, but even
 +               * if the OFDM rate we are protecting is 6 or 9 Mbps, 11 is more robust.
 +               */
 +              rts_rspec = WLC_BASIC_RATE(wlc, WLC_RATE_11M);
 +      } else {
 +              /* calculate RTS rate and fallback rate based on the frame rate
 +               * RTS must be sent at a basic rate since it is a
 +               * control frame, sec 9.6 of 802.11 spec
 +               */
 +              rts_rspec = WLC_BASIC_RATE(wlc, rspec);
 +      }
 +
 +      if (WLC_PHY_11N_CAP(wlc->band)) {
 +              /* set rts txbw to correct side band */
 +              rts_rspec &= ~RSPEC_BW_MASK;
 +
 +              /* if rspec/rspec_fallback is 40MHz, then send RTS on both 20MHz channel
 +               * (DUP), otherwise send RTS on control channel
 +               */
 +              if (RSPEC_IS40MHZ(rspec) && !IS_CCK(rts_rspec))
 +                      rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
 +              else
 +                      rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
 +
 +              /* pick siso/cdd as default for ofdm */
 +              if (IS_OFDM(rts_rspec)) {
 +                      rts_rspec &= ~RSPEC_STF_MASK;
 +                      rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
 +              }
 +      }
 +      return rts_rspec;
 +}
 +
 +/*
 + * Add d11txh_t, cck_phy_hdr_t.
 + *
 + * 'p' data must start with 802.11 MAC header
 + * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
 + *
 + * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
 + *
 + */
 +static u16 BCMFASTPATH
 +wlc_d11hdrs_mac80211(struct wlc_info *wlc, struct ieee80211_hw *hw,
 +                   struct sk_buff *p, struct scb *scb, uint frag,
 +                   uint nfrags, uint queue, uint next_frag_len,
 +                   wsec_key_t *key, ratespec_t rspec_override)
 +{
 +      struct ieee80211_hdr *h;
 +      d11txh_t *txh;
 +      u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
 +      int len, phylen, rts_phylen;
 +      u16 mch, phyctl, xfts, mainrates;
 +      u16 seq = 0, mcl = 0, status = 0, frameid = 0;
 +      ratespec_t rspec[2] = { WLC_RATE_1M, WLC_RATE_1M }, rts_rspec[2] = {
 +      WLC_RATE_1M, WLC_RATE_1M};
 +      bool use_rts = false;
 +      bool use_cts = false;
 +      bool use_rifs = false;
 +      bool short_preamble[2] = { false, false };
 +      u8 preamble_type[2] = { WLC_LONG_PREAMBLE, WLC_LONG_PREAMBLE };
 +      u8 rts_preamble_type[2] = { WLC_LONG_PREAMBLE, WLC_LONG_PREAMBLE };
 +      u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
 +      struct ieee80211_rts *rts = NULL;
 +      bool qos;
 +      uint ac;
 +      u32 rate_val[2];
 +      bool hwtkmic = false;
 +      u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
 +#define ANTCFG_NONE 0xFF
 +      u8 antcfg = ANTCFG_NONE;
 +      u8 fbantcfg = ANTCFG_NONE;
 +      uint phyctl1_stf = 0;
 +      u16 durid = 0;
 +      struct ieee80211_tx_rate *txrate[2];
 +      int k;
 +      struct ieee80211_tx_info *tx_info;
 +      bool is_mcs[2];
 +      u16 mimo_txbw;
 +      u8 mimo_preamble_type;
 +
 +      ASSERT(queue < NFIFO);
 +
 +      /* locate 802.11 MAC header */
 +      h = (struct ieee80211_hdr *)(p->data);
 +      qos = ieee80211_is_data_qos(h->frame_control);
 +
 +      /* compute length of frame in bytes for use in PLCP computations */
 +      len = pkttotlen(p);
 +      phylen = len + FCS_LEN;
 +
 +      /* If WEP enabled, add room in phylen for the additional bytes of
 +       * ICV which MAC generates.  We do NOT add the additional bytes to
 +       * the packet itself, thus phylen = packet length + ICV_LEN + FCS_LEN
 +       * in this case
 +       */
 +      if (key) {
 +              phylen += key->icv_len;
 +      }
 +
 +      /* Get tx_info */
 +      tx_info = IEEE80211_SKB_CB(p);
 +      ASSERT(tx_info);
 +
 +      /* add PLCP */
 +      plcp = skb_push(p, D11_PHY_HDR_LEN);
 +
 +      /* add Broadcom tx descriptor header */
 +      txh = (d11txh_t *) skb_push(p, D11_TXH_LEN);
 +      memset(txh, 0, D11_TXH_LEN);
 +
 +      /* setup frameid */
 +      if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
 +              /* non-AP STA should never use BCMC queue */
 +              ASSERT(queue != TX_BCMC_FIFO);
 +              if (queue == TX_BCMC_FIFO) {
 +                      WL_ERROR("wl%d: %s: ASSERT queue == TX_BCMC!\n",
 +                               WLCWLUNIT(wlc), __func__);
 +                      frameid = bcmc_fid_generate(wlc, NULL, txh);
 +              } else {
 +                      /* Increment the counter for first fragment */
 +                      if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT) {
 +                              SCB_SEQNUM(scb, p->priority)++;
 +                      }
 +
 +                      /* extract fragment number from frame first */
 +                      seq = le16_to_cpu(seq) & FRAGNUM_MASK;
 +                      seq |= (SCB_SEQNUM(scb, p->priority) << SEQNUM_SHIFT);
 +                      h->seq_ctrl = cpu_to_le16(seq);
 +
 +                      frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
 +                          (queue & TXFID_QUEUE_MASK);
 +              }
 +      }
 +      frameid |= queue & TXFID_QUEUE_MASK;
 +
 +      /* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
 +      if (SCB_PS(scb) || ieee80211_is_beacon(h->frame_control))
 +              mcl |= TXC_IGNOREPMQ;
 +
 +      ASSERT(hw->max_rates <= IEEE80211_TX_MAX_RATES);
 +      ASSERT(hw->max_rates == 2);
 +
 +      txrate[0] = tx_info->control.rates;
 +      txrate[1] = txrate[0] + 1;
 +
 +      ASSERT(txrate[0]->idx >= 0);
 +      /* if rate control algorithm didn't give us a fallback rate, use the primary rate */
 +      if (txrate[1]->idx < 0) {
 +              txrate[1] = txrate[0];
 +      }
 +
 +      for (k = 0; k < hw->max_rates; k++) {
 +              is_mcs[k] =
 +                  txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
 +              if (!is_mcs[k]) {
 +                      ASSERT(!(tx_info->flags & IEEE80211_TX_CTL_AMPDU));
 +                      if ((txrate[k]->idx >= 0)
 +                          && (txrate[k]->idx <
 +                              hw->wiphy->bands[tx_info->band]->n_bitrates)) {
 +                              rate_val[k] =
 +                                  hw->wiphy->bands[tx_info->band]->
 +                                  bitrates[txrate[k]->idx].hw_value;
 +                              short_preamble[k] =
 +                                  txrate[k]->
 +                                  flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
 +                                  true : false;
 +                      } else {
 +                              ASSERT((txrate[k]->idx >= 0) &&
 +                                     (txrate[k]->idx <
 +                                      hw->wiphy->bands[tx_info->band]->
 +                                      n_bitrates));
 +                              rate_val[k] = WLC_RATE_1M;
 +                      }
 +              } else {
 +                      rate_val[k] = txrate[k]->idx;
 +              }
 +              /* Currently only support same setting for primay and fallback rates.
 +               * Unify flags for each rate into a single value for the frame
 +               */
 +              use_rts |=
 +                  txrate[k]->
 +                  flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
 +              use_cts |=
 +                  txrate[k]->
 +                  flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
 +
 +              if (is_mcs[k])
 +                      rate_val[k] |= NRATE_MCS_INUSE;
 +
 +              rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band, rate_val[k]);
 +
 +              /* (1) RATE: determine and validate primary rate and fallback rates */
 +              if (!RSPEC_ACTIVE(rspec[k])) {
 +                      ASSERT(RSPEC_ACTIVE(rspec[k]));
 +                      rspec[k] = WLC_RATE_1M;
 +              } else {
 +                      if (!is_multicast_ether_addr(h->addr1)) {
 +                              /* set tx antenna config */
 +                              wlc_antsel_antcfg_get(wlc->asi, false, false, 0,
 +                                                    0, &antcfg, &fbantcfg);
 +                      }
 +              }
 +      }
 +
 +      phyctl1_stf = wlc->stf->ss_opmode;
 +
 +      if (N_ENAB(wlc->pub)) {
 +              for (k = 0; k < hw->max_rates; k++) {
 +                      /* apply siso/cdd to single stream mcs's or ofdm if rspec is auto selected */
 +                      if (((IS_MCS(rspec[k]) &&
 +                            IS_SINGLE_STREAM(rspec[k] & RSPEC_RATE_MASK)) ||
 +                           IS_OFDM(rspec[k]))
 +                          && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
 +                              || !(rspec[k] & RSPEC_OVERRIDE))) {
 +                              rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
 +
 +                              /* For SISO MCS use STBC if possible */
 +                              if (IS_MCS(rspec[k])
 +                                  && WLC_STF_SS_STBC_TX(wlc, scb)) {
 +                                      u8 stc;
 +
 +                                      ASSERT(WLC_STBC_CAP_PHY(wlc));
 +                                      stc = 1;        /* Nss for single stream is always 1 */
 +                                      rspec[k] |=
 +                                          (PHY_TXC1_MODE_STBC <<
 +                                           RSPEC_STF_SHIFT) | (stc <<
 +                                                               RSPEC_STC_SHIFT);
 +                              } else
 +                                      rspec[k] |=
 +                                          (phyctl1_stf << RSPEC_STF_SHIFT);
 +                      }
 +
 +                      /* Is the phy configured to use 40MHZ frames? If so then pick the desired txbw */
 +                      if (CHSPEC_WLC_BW(wlc->chanspec) == WLC_40_MHZ) {
 +                              /* default txbw is 20in40 SB */
 +                              mimo_ctlchbw = mimo_txbw =
 +                                  CHSPEC_SB_UPPER(WLC_BAND_PI_RADIO_CHANSPEC)
 +                                  ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
 +
 +                              if (IS_MCS(rspec[k])) {
 +                                      /* mcs 32 must be 40b/w DUP */
 +                                      if ((rspec[k] & RSPEC_RATE_MASK) == 32) {
 +                                              mimo_txbw =
 +                                                  PHY_TXC1_BW_40MHZ_DUP;
 +                                              /* use override */
 +                                      } else if (wlc->mimo_40txbw != AUTO)
 +                                              mimo_txbw = wlc->mimo_40txbw;
 +                                      /* else check if dst is using 40 Mhz */
 +                                      else if (scb->flags & SCB_IS40)
 +                                              mimo_txbw = PHY_TXC1_BW_40MHZ;
 +                              } else if (IS_OFDM(rspec[k])) {
 +                                      if (wlc->ofdm_40txbw != AUTO)
 +                                              mimo_txbw = wlc->ofdm_40txbw;
 +                              } else {
 +                                      ASSERT(IS_CCK(rspec[k]));
 +                                      if (wlc->cck_40txbw != AUTO)
 +                                              mimo_txbw = wlc->cck_40txbw;
 +                              }
 +                      } else {
 +                              /* mcs32 is 40 b/w only.
 +                               * This is possible for probe packets on a STA during SCAN
 +                               */