linux-2.6.39: drop files which don't belong here

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
author: Martin Jansa <Martin.Jansa@gmail.com> 2011-09-01 14:03:38 +0200
committer: Paul Eggleton <paul.eggleton@linux.intel.com> 2011-09-04 14:47:10 +0100
commit: 51b58b6dd8f7dfff18d6c006ee6ae911ed24411c (patch)
tree: dfe4640a4a6f5d86d2d88ae8b70799f5234d815c /recipes-kernel
parent: 3e013ce4211bca15dedbbdc1e714e17d85013746 (diff)
download: meta-handheld-51b58b6dd8f7dfff18d6c006ee6ae911ed24411c.tar.gz
5 files changed, 0 insertions, 49288 deletions
diff --git a/recipes-kernel/linux/linux-2.6.39/om-gta01/defconfig b/recipes-kernel/linux/linux-2.6.39/om-gta01/defconfig
deleted file mode 100644
index 619104e..0000000
--- a/recipes-kernel/linux/linux-2.6.39/om-gta01/defconfig
+++ /dev/null
@@ -1,481 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_KERNEL_LZMA=y
-CONFIG_SYSVIPC=y
-CONFIG_IKCONFIG=m
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_RD_BZIP2=y
-CONFIG_RD_LZMA=y
-CONFIG_RD_LZO=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EXPERT=y
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-# CONFIG_LBDAF is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_S3C2410=y
-CONFIG_S3C_LOWLEVEL_UART_PORT=2
-CONFIG_SAMSUNG_GPIO_EXTRA=64
-CONFIG_S3C24XX_PWM=y
-CONFIG_AEABI=y
-# CONFIG_OABI_COMPAT is not set
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="unused -- bootloader passes ATAG list quiet"
-CONFIG_CPU_IDLE=y
-# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-CONFIG_PM_RUNTIME=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_XFRM_USER=m
-CONFIG_NET_KEY=m
-CONFIG_NET_KEY_MIGRATE=y
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_PNP=y
-CONFIG_NET_IPIP=m
-CONFIG_IP_MROUTE=y
-CONFIG_SYN_COOKIES=y
-CONFIG_INET_AH=m
-CONFIG_INET_ESP=m
-CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
-# CONFIG_INET_LRO is not set
-CONFIG_INET_DIAG=m
-CONFIG_TCP_CONG_ADVANCED=y
-# CONFIG_TCP_CONG_BIC is not set
-# CONFIG_TCP_CONG_CUBIC is not set
-CONFIG_TCP_CONG_WESTWOOD=y
-# CONFIG_TCP_CONG_HTCP is not set
-CONFIG_TCP_MD5SIG=y
-CONFIG_INET6_AH=m
-CONFIG_INET6_ESP=m
-CONFIG_INET6_IPCOMP=m
-CONFIG_IPV6_TUNNEL=m
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
-CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
-CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NF_CT_NETLINK=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SCTP=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_TARGET_LOG=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_AMONG=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_MARK=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_MARK_T=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_ULOG=m
-CONFIG_BRIDGE=m
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=m
-CONFIG_NET_SCH_HTB=m
-CONFIG_NET_SCH_HFSC=m
-CONFIG_NET_SCH_PRIO=m
-CONFIG_NET_SCH_RED=m
-CONFIG_NET_SCH_SFQ=m
-CONFIG_NET_SCH_TEQL=m
-CONFIG_NET_SCH_TBF=m
-CONFIG_NET_SCH_GRED=m
-CONFIG_NET_SCH_DSMARK=m
-CONFIG_NET_SCH_NETEM=m
-CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_TCINDEX=m
-CONFIG_NET_CLS_ROUTE4=m
-CONFIG_NET_CLS_FW=m
-CONFIG_NET_CLS_U32=m
-CONFIG_CLS_U32_PERF=y
-CONFIG_CLS_U32_MARK=y
-CONFIG_NET_CLS_RSVP=m
-CONFIG_NET_CLS_RSVP6=m
-CONFIG_BT=m
-CONFIG_BT_HCIBTUSB=m
-CONFIG_RFKILL=y
-CONFIG_RFKILL_INPUT=y
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
-# CONFIG_FIRMWARE_IN_KERNEL is not set
-CONFIG_CONNECTOR=m
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_ROM=y
-CONFIG_MTD_ABSENT=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_VERIFY_WRITE=y
-CONFIG_MTD_NAND_S3C2410=y
-CONFIG_MTD_NAND_S3C2410_HWECC=y
-CONFIG_MTD_UBI=y
-CONFIG_MTD_UBI_GLUEBI=y
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_UB=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_MISC_DEVICES=y
-CONFIG_SCSI=m
-CONFIG_BLK_DEV_SD=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_CHR_DEV_SG=m
-CONFIG_SCSI_MULTI_LUN=y
-CONFIG_SCSI_SCAN_ASYNC=y
-CONFIG_NETDEVICES=y
-CONFIG_TUN=m
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-CONFIG_USB_CATC=m
-CONFIG_USB_KAWETH=m
-CONFIG_USB_PEGASUS=m
-CONFIG_USB_RTL8150=m
-CONFIG_USB_USBNET=m
-# CONFIG_USB_NET_AX8817X is not set
-CONFIG_PPP=m
-CONFIG_PPP_MULTILINK=y
-CONFIG_PPP_FILTER=y
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_MPPE=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-CONFIG_INPUT_MOUSEDEV_SCREEN_X=480
-CONFIG_INPUT_MOUSEDEV_SCREEN_Y=640
-CONFIG_INPUT_JOYDEV=m
-CONFIG_INPUT_EVDEV=y
-# CONFIG_KEYBOARD_ATKBD is not set
-CONFIG_KEYBOARD_GPIO=y
-CONFIG_KEYBOARD_STOWAWAY=m
-# CONFIG_INPUT_MOUSE is not set
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_S3C2410=y
-CONFIG_INPUT_MISC=y
-CONFIG_INPUT_UINPUT=m
-# CONFIG_SERIO_SERPORT is not set
-CONFIG_VT_HW_CONSOLE_BINDING=y
-# CONFIG_LEGACY_PTYS is not set
-CONFIG_N_GSM=m
-# CONFIG_DEVKMEM is not set
-CONFIG_SERIAL_SAMSUNG=y
-CONFIG_SERIAL_SAMSUNG_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=y
-# CONFIG_I2C_HELPER_AUTO is not set
-CONFIG_I2C_ALGOBIT=y
-CONFIG_I2C_S3C2410=y
-CONFIG_SPI=y
-CONFIG_SPI_GPIO=y
-CONFIG_SPI_S3C24XX=y
-CONFIG_GPIO_SYSFS=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_S3C2410_WATCHDOG=y
-CONFIG_REGULATOR=y
-CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_FB=y
-CONFIG_FB_S3C2410=y
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-CONFIG_LCD_CLASS_DEVICE=y
-CONFIG_LCD_JBT6K74=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_GENERIC is not set
-CONFIG_BACKLIGHT_PWM=y
-CONFIG_FRAMEBUFFER_CONSOLE=y
-CONFIG_SOUND=m
-CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
-CONFIG_SND_MIXER_OSS=m
-CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
-# CONFIG_SND_SUPPORT_OLD_API is not set
-# CONFIG_SND_VERBOSE_PROCFS is not set
-# CONFIG_SND_DRIVERS is not set
-# CONFIG_SND_ARM is not set
-# CONFIG_SND_SPI is not set
-# CONFIG_SND_USB is not set
-CONFIG_SND_SOC=m
-CONFIG_HID_A4TECH=m
-CONFIG_HID_APPLE=m
-CONFIG_HID_BELKIN=m
-CONFIG_HID_CHERRY=m
-CONFIG_HID_CHICONY=m
-CONFIG_HID_CYPRESS=m
-CONFIG_HID_DRAGONRISE=m
-CONFIG_HID_EZKEY=m
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_HID_KENSINGTON=m
-CONFIG_HID_LOGITECH=m
-CONFIG_HID_MICROSOFT=m
-CONFIG_HID_MONTEREY=m
-CONFIG_HID_NTRIG=m
-CONFIG_HID_ORTEK=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SONY=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_HID_ZEROPLUS=m
-CONFIG_USB=m
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
-# CONFIG_USB_DEVICE_CLASS is not set
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_TMC=m
-CONFIG_USB_STORAGE=m
-CONFIG_USB_STORAGE_DATAFAB=m
-CONFIG_USB_STORAGE_FREECOM=m
-CONFIG_USB_STORAGE_USBAT=m
-CONFIG_USB_STORAGE_SDDR09=m
-CONFIG_USB_STORAGE_SDDR55=m
-CONFIG_USB_STORAGE_JUMPSHOT=m
-CONFIG_USB_STORAGE_ALAUDA=m
-CONFIG_USB_STORAGE_KARMA=m
-CONFIG_USB_SERIAL=m
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_AIRCABLE=m
-CONFIG_USB_SERIAL_ARK3116=m
-CONFIG_USB_SERIAL_BELKIN=m
-CONFIG_USB_SERIAL_WHITEHEAT=m
-CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
-CONFIG_USB_SERIAL_CYPRESS_M8=m
-CONFIG_USB_SERIAL_EMPEG=m
-CONFIG_USB_SERIAL_FTDI_SIO=m
-CONFIG_USB_SERIAL_FUNSOFT=m
-CONFIG_USB_SERIAL_VISOR=m
-CONFIG_USB_SERIAL_IPAQ=m
-CONFIG_USB_SERIAL_IR=m
-CONFIG_USB_SERIAL_EDGEPORT=m
-CONFIG_USB_SERIAL_EDGEPORT_TI=m
-CONFIG_USB_SERIAL_GARMIN=m
-CONFIG_USB_SERIAL_IPW=m
-CONFIG_USB_SERIAL_KEYSPAN_PDA=m
-CONFIG_USB_SERIAL_KEYSPAN=m
-CONFIG_USB_SERIAL_KLSI=m
-CONFIG_USB_SERIAL_KOBIL_SCT=m
-CONFIG_USB_SERIAL_MCT_U232=m
-CONFIG_USB_SERIAL_MOS7720=m
-CONFIG_USB_SERIAL_MOS7840=m
-CONFIG_USB_SERIAL_NAVMAN=m
-CONFIG_USB_SERIAL_PL2303=m
-CONFIG_USB_SERIAL_HP4X=m
-CONFIG_USB_SERIAL_SAFE=m
-CONFIG_USB_SERIAL_SAFE_PADDED=y
-CONFIG_USB_SERIAL_SIERRAWIRELESS=m
-CONFIG_USB_SERIAL_TI=m
-CONFIG_USB_SERIAL_CYBERJACK=m
-CONFIG_USB_SERIAL_XIRCOM=m
-CONFIG_USB_SERIAL_OPTION=m
-CONFIG_USB_SERIAL_OMNINET=m
-CONFIG_USB_TRANCEVIBRATOR=m
-CONFIG_USB_IOWARRIOR=m
-CONFIG_USB_GADGET=m
-CONFIG_USB_GADGET_VBUS_DRAW=500
-CONFIG_USB_GADGET_S3C2410=y
-CONFIG_USB_ETH=m
-CONFIG_USB_GADGETFS=m
-CONFIG_USB_FILE_STORAGE=m
-CONFIG_USB_MASS_STORAGE=m
-CONFIG_USB_G_SERIAL=m
-CONFIG_USB_CDC_COMPOSITE=m
-CONFIG_MMC=y
-CONFIG_MMC_UNSAFE_RESUME=y
-CONFIG_MMC_S3C=y
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_S3C24XX=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_PWM=y
-CONFIG_LEDS_REGULATOR=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_TIMER=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_LEDS_TRIGGER_BACKLIGHT=y
-CONFIG_LEDS_TRIGGER_GPIO=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_S3C=y
-# CONFIG_AR6000_WLAN is not set
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
-CONFIG_REISERFS_FS=y
-CONFIG_XFS_FS=m
-CONFIG_BTRFS_FS=m
-# CONFIG_DNOTIFY is not set
-CONFIG_AUTOFS4_FS=m
-CONFIG_FUSE_FS=m
-CONFIG_CUSE=m
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_UDF_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_TMPFS=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_CONFIGFS_FS=m
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_SUMMARY=y
-CONFIG_JFFS2_COMPRESSION_OPTIONS=y
-CONFIG_UBIFS_FS=y
-CONFIG_UBIFS_FS_XATTR=y
-CONFIG_UBIFS_FS_ADVANCED_COMPR=y
-CONFIG_SQUASHFS=m
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V3_ACL=y
-CONFIG_NFSD_V4=y
-CONFIG_CIFS=m
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_EFI_PARTITION=y
-CONFIG_NLS=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_CODEPAGE_866=m
-CONFIG_NLS_CODEPAGE_936=m
-CONFIG_NLS_CODEPAGE_950=m
-CONFIG_NLS_CODEPAGE_1250=m
-CONFIG_NLS_CODEPAGE_1251=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_1=m
-CONFIG_NLS_ISO8859_2=m
-CONFIG_NLS_UTF8=m
-CONFIG_PRINTK_TIME=y
-# CONFIG_ENABLE_WARN_DEPRECATED is not set
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_STRIP_ASM_SYMS=y
-CONFIG_DEBUG_S3C_UART=2
-CONFIG_CRYPTO_NULL=m
-CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_SHA256=m
-CONFIG_CRYPTO_SHA512=m
-CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_WP512=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_BLOWFISH=m
-CONFIG_CRYPTO_CAMELLIA=m
-CONFIG_CRYPTO_CAST5=m
-CONFIG_CRYPTO_CAST6=m
-CONFIG_CRYPTO_FCRYPT=m
-CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_TEA=m
-CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=y
-# CONFIG_CRYPTO_ANSI_CPRNG is not set
-# CONFIG_CRYPTO_HW is not set
-CONFIG_CRC_CCITT=y
-CONFIG_CRC_T10DIF=y
-CONFIG_CRC_ITU_T=y
-CONFIG_CRC7=y
-CONFIG_LIBCRC32C=y
diff --git a/recipes-kernel/linux/linux-2.6.39/om-gta02/defconfig b/recipes-kernel/linux/linux-2.6.39/om-gta02/defconfig
deleted file mode 100644
index 94e3b40..0000000
--- a/recipes-kernel/linux/linux-2.6.39/om-gta02/defconfig
+++ /dev/null
@@ -1,490 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-# CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_KERNEL_LZMA=y
-CONFIG_SYSVIPC=y
-CONFIG_IKCONFIG=m
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_RD_BZIP2=y
-CONFIG_RD_LZMA=y
-CONFIG_RD_LZO=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
-CONFIG_EXPERT=y
-CONFIG_SLAB=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-# CONFIG_LBDAF is not set
-# CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARCH_S3C2410=y
-CONFIG_S3C_LOWLEVEL_UART_PORT=2
-CONFIG_SAMSUNG_GPIO_EXTRA=64
-CONFIG_S3C24XX_PWM=y
-CONFIG_MACH_NEO1973_GTA02=y
-CONFIG_AEABI=y
-# CONFIG_OABI_COMPAT is not set
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="unused -- bootloader passes ATAG list quiet"
-CONFIG_CPU_IDLE=y
-# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-CONFIG_PM_RUNTIME=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_XFRM_USER=m
-CONFIG_NET_KEY=m
-CONFIG_NET_KEY_MIGRATE=y
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_PNP=y
-CONFIG_NET_IPIP=m
-CONFIG_IP_MROUTE=y
-CONFIG_SYN_COOKIES=y
-CONFIG_INET_AH=m
-CONFIG_INET_ESP=m
-CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
-# CONFIG_INET_LRO is not set
-CONFIG_INET_DIAG=m
-CONFIG_TCP_CONG_ADVANCED=y
-# CONFIG_TCP_CONG_BIC is not set
-# CONFIG_TCP_CONG_CUBIC is not set
-CONFIG_TCP_CONG_WESTWOOD=y
-# CONFIG_TCP_CONG_HTCP is not set
-CONFIG_TCP_MD5SIG=y
-CONFIG_INET6_AH=m
-CONFIG_INET6_ESP=m
-CONFIG_INET6_IPCOMP=m
-CONFIG_IPV6_TUNNEL=m
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
-CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
-CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NF_CT_NETLINK=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_SCTP=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_TARGET_LOG=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_AMONG=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_MARK=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_MARK_T=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_ULOG=m
-CONFIG_BRIDGE=m
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=m
-CONFIG_NET_SCH_HTB=m
-CONFIG_NET_SCH_HFSC=m
-CONFIG_NET_SCH_PRIO=m
-CONFIG_NET_SCH_RED=m
-CONFIG_NET_SCH_SFQ=m
-CONFIG_NET_SCH_TEQL=m
-CONFIG_NET_SCH_TBF=m
-CONFIG_NET_SCH_GRED=m
-CONFIG_NET_SCH_DSMARK=m
-CONFIG_NET_SCH_NETEM=m
-CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_TCINDEX=m
-CONFIG_NET_CLS_ROUTE4=m
-CONFIG_NET_CLS_FW=m
-CONFIG_NET_CLS_U32=m
-CONFIG_CLS_U32_PERF=y
-CONFIG_CLS_U32_MARK=y
-CONFIG_NET_CLS_RSVP=m
-CONFIG_NET_CLS_RSVP6=m
-CONFIG_BT=m
-CONFIG_BT_HCIBTUSB=m
-CONFIG_RFKILL=y
-CONFIG_RFKILL_INPUT=y
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
-# CONFIG_FIRMWARE_IN_KERNEL is not set
-CONFIG_CONNECTOR=m
-CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_CMDLINE_PARTS=y
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-CONFIG_MTD_CFI=y
-CONFIG_MTD_CFI_INTELEXT=y
-CONFIG_MTD_ROM=y
-CONFIG_MTD_ABSENT=y
-CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_NAND=y
-CONFIG_MTD_NAND_VERIFY_WRITE=y
-CONFIG_MTD_NAND_S3C2410=y
-CONFIG_MTD_NAND_S3C2410_HWECC=y
-CONFIG_MTD_UBI=y
-CONFIG_MTD_UBI_GLUEBI=y
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_UB=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_MISC_DEVICES=y
-CONFIG_SCSI=m
-CONFIG_BLK_DEV_SD=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_CHR_DEV_SG=m
-CONFIG_SCSI_MULTI_LUN=y
-CONFIG_SCSI_SCAN_ASYNC=y
-CONFIG_NETDEVICES=y
-CONFIG_TUN=m
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
-CONFIG_USB_CATC=m
-CONFIG_USB_KAWETH=m
-CONFIG_USB_PEGASUS=m
-CONFIG_USB_RTL8150=m
-CONFIG_USB_USBNET=m
-# CONFIG_USB_NET_AX8817X is not set
-CONFIG_PPP=m
-CONFIG_PPP_MULTILINK=y
-CONFIG_PPP_FILTER=y
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_MPPE=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
-CONFIG_INPUT_MOUSEDEV_SCREEN_X=480
-CONFIG_INPUT_MOUSEDEV_SCREEN_Y=640
-CONFIG_INPUT_JOYDEV=m
-CONFIG_INPUT_EVDEV=y
-# CONFIG_KEYBOARD_ATKBD is not set
-CONFIG_KEYBOARD_GPIO=y
-CONFIG_KEYBOARD_STOWAWAY=m
-# CONFIG_INPUT_MOUSE is not set
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_S3C2410=y
-CONFIG_INPUT_MISC=y
-CONFIG_INPUT_UINPUT=m
-CONFIG_INPUT_PCF50633_PMU=y
-# CONFIG_SERIO_SERPORT is not set
-CONFIG_VT_HW_CONSOLE_BINDING=y
-# CONFIG_LEGACY_PTYS is not set
-CONFIG_N_GSM=m
-# CONFIG_DEVKMEM is not set
-CONFIG_SERIAL_SAMSUNG=y
-CONFIG_SERIAL_SAMSUNG_CONSOLE=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_I2C_CHARDEV=y
-# CONFIG_I2C_HELPER_AUTO is not set
-CONFIG_I2C_ALGOBIT=y
-CONFIG_I2C_S3C2410=y
-CONFIG_SPI=y
-CONFIG_SPI_GPIO=y
-CONFIG_SPI_S3C24XX=y
-CONFIG_GPIO_SYSFS=y
-CONFIG_GPIO_GLAMO=y
-CONFIG_BATTERY_PLATFORM=y
-CONFIG_CHARGER_PCF50633=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_S3C2410_WATCHDOG=y
-CONFIG_PCF50633_ADC=y
-CONFIG_MFD_GLAMO=y
-CONFIG_REGULATOR=y
-CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_REGULATOR_PCF50633=y
-CONFIG_FB=y
-CONFIG_FB_S3C2410=y
-CONFIG_FB_GLAMO=y
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-CONFIG_LCD_CLASS_DEVICE=y
-CONFIG_LCD_JBT6K74=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_GENERIC is not set
-CONFIG_BACKLIGHT_PWM=y
-CONFIG_BACKLIGHT_PCF50633=y
-CONFIG_FRAMEBUFFER_CONSOLE=y
-CONFIG_SOUND=m
-CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
-CONFIG_SND_MIXER_OSS=m
-CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
-# CONFIG_SND_SUPPORT_OLD_API is not set
-# CONFIG_SND_VERBOSE_PROCFS is not set
-# CONFIG_SND_DRIVERS is not set
-# CONFIG_SND_ARM is not set
-# CONFIG_SND_SPI is not set
-# CONFIG_SND_USB is not set
-CONFIG_SND_SOC=m
-CONFIG_HID_A4TECH=m
-CONFIG_HID_APPLE=m
-CONFIG_HID_BELKIN=m
-CONFIG_HID_CHERRY=m
-CONFIG_HID_CHICONY=m
-CONFIG_HID_CYPRESS=m
-CONFIG_HID_DRAGONRISE=m
-CONFIG_HID_EZKEY=m
-CONFIG_HID_KYE=m
-CONFIG_HID_GYRATION=m
-CONFIG_HID_TWINHAN=m
-CONFIG_HID_KENSINGTON=m
-CONFIG_HID_LOGITECH=m
-CONFIG_HID_MICROSOFT=m
-CONFIG_HID_MONTEREY=m
-CONFIG_HID_NTRIG=m
-CONFIG_HID_ORTEK=m
-CONFIG_HID_PANTHERLORD=m
-CONFIG_HID_PETALYNX=m
-CONFIG_HID_SAMSUNG=m
-CONFIG_HID_SONY=m
-CONFIG_HID_SUNPLUS=m
-CONFIG_HID_GREENASIA=m
-CONFIG_HID_SMARTJOYPLUS=m
-CONFIG_HID_TOPSEED=m
-CONFIG_HID_THRUSTMASTER=m
-CONFIG_HID_ZEROPLUS=m
-CONFIG_USB=m
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
-# CONFIG_USB_DEVICE_CLASS is not set
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_ACM=m
-CONFIG_USB_PRINTER=m
-CONFIG_USB_TMC=m
-CONFIG_USB_STORAGE=m
-CONFIG_USB_STORAGE_DATAFAB=m
-CONFIG_USB_STORAGE_FREECOM=m
-CONFIG_USB_STORAGE_USBAT=m
-CONFIG_USB_STORAGE_SDDR09=m
-CONFIG_USB_STORAGE_SDDR55=m
-CONFIG_USB_STORAGE_JUMPSHOT=m
-CONFIG_USB_STORAGE_ALAUDA=m
-CONFIG_USB_STORAGE_KARMA=m
-CONFIG_USB_SERIAL=m
-CONFIG_USB_SERIAL_GENERIC=y
-CONFIG_USB_SERIAL_AIRCABLE=m
-CONFIG_USB_SERIAL_ARK3116=m
-CONFIG_USB_SERIAL_BELKIN=m
-CONFIG_USB_SERIAL_WHITEHEAT=m
-CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
-CONFIG_USB_SERIAL_CYPRESS_M8=m
-CONFIG_USB_SERIAL_EMPEG=m
-CONFIG_USB_SERIAL_FTDI_SIO=m
-CONFIG_USB_SERIAL_FUNSOFT=m
-CONFIG_USB_SERIAL_VISOR=m
-CONFIG_USB_SERIAL_IPAQ=m
-CONFIG_USB_SERIAL_IR=m
-CONFIG_USB_SERIAL_EDGEPORT=m
-CONFIG_USB_SERIAL_EDGEPORT_TI=m
-CONFIG_USB_SERIAL_GARMIN=m
-CONFIG_USB_SERIAL_IPW=m
-CONFIG_USB_SERIAL_KEYSPAN_PDA=m
-CONFIG_USB_SERIAL_KEYSPAN=m
-CONFIG_USB_SERIAL_KLSI=m
-CONFIG_USB_SERIAL_KOBIL_SCT=m
-CONFIG_USB_SERIAL_MCT_U232=m
-CONFIG_USB_SERIAL_MOS7720=m
-CONFIG_USB_SERIAL_MOS7840=m
-CONFIG_USB_SERIAL_NAVMAN=m
-CONFIG_USB_SERIAL_PL2303=m
-CONFIG_USB_SERIAL_HP4X=m
-CONFIG_USB_SERIAL_SAFE=m
-CONFIG_USB_SERIAL_SAFE_PADDED=y
-CONFIG_USB_SERIAL_SIERRAWIRELESS=m
-CONFIG_USB_SERIAL_TI=m
-CONFIG_USB_SERIAL_CYBERJACK=m
-CONFIG_USB_SERIAL_XIRCOM=m
-CONFIG_USB_SERIAL_OPTION=m
-CONFIG_USB_SERIAL_OMNINET=m
-CONFIG_USB_TRANCEVIBRATOR=m
-CONFIG_USB_IOWARRIOR=m
-CONFIG_USB_GADGET=m
-CONFIG_USB_GADGET_VBUS_DRAW=500
-CONFIG_USB_GADGET_S3C2410=y
-CONFIG_USB_ETH=m
-CONFIG_USB_GADGETFS=m
-CONFIG_USB_FILE_STORAGE=m
-CONFIG_USB_MASS_STORAGE=m
-CONFIG_USB_G_SERIAL=m
-CONFIG_USB_CDC_COMPOSITE=m
-CONFIG_MMC=y
-CONFIG_MMC_UNSAFE_RESUME=y
-CONFIG_MMC_S3C=y
-CONFIG_MMC_GLAMO=y
-CONFIG_NEW_LEDS=y
-CONFIG_LEDS_CLASS=y
-CONFIG_LEDS_S3C24XX=y
-CONFIG_LEDS_GPIO=y
-CONFIG_LEDS_PWM=y
-CONFIG_LEDS_REGULATOR=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_TIMER=y
-CONFIG_LEDS_TRIGGER_HEARTBEAT=y
-CONFIG_LEDS_TRIGGER_BACKLIGHT=y
-CONFIG_LEDS_TRIGGER_GPIO=y
-CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_PCF50633=y
-CONFIG_RTC_DRV_S3C=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
-CONFIG_REISERFS_FS=y
-CONFIG_XFS_FS=m
-CONFIG_BTRFS_FS=m
-# CONFIG_DNOTIFY is not set
-CONFIG_AUTOFS4_FS=m
-CONFIG_FUSE_FS=m
-CONFIG_CUSE=m
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_UDF_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_TMPFS=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_CONFIGFS_FS=m
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_SUMMARY=y
-CONFIG_JFFS2_COMPRESSION_OPTIONS=y
-CONFIG_UBIFS_FS=y
-CONFIG_UBIFS_FS_XATTR=y
-CONFIG_UBIFS_FS_ADVANCED_COMPR=y
-CONFIG_SQUASHFS=m
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V3_ACL=y
-CONFIG_NFSD_V4=y
-CONFIG_CIFS=m
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_EFI_PARTITION=y
-CONFIG_NLS=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_CODEPAGE_866=m
-CONFIG_NLS_CODEPAGE_936=m
-CONFIG_NLS_CODEPAGE_950=m
-CONFIG_NLS_CODEPAGE_1250=m
-CONFIG_NLS_CODEPAGE_1251=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_1=m
-CONFIG_NLS_ISO8859_2=m
-CONFIG_NLS_UTF8=m
-CONFIG_PRINTK_TIME=y
-# CONFIG_ENABLE_WARN_DEPRECATED is not set
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_STRIP_ASM_SYMS=y
-CONFIG_DEBUG_S3C_UART=2
-CONFIG_CRYPTO_NULL=m
-CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_SHA256=m
-CONFIG_CRYPTO_SHA512=m
-CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_WP512=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_BLOWFISH=m
-CONFIG_CRYPTO_CAMELLIA=m
-CONFIG_CRYPTO_CAST5=m
-CONFIG_CRYPTO_CAST6=m
-CONFIG_CRYPTO_FCRYPT=m
-CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_TEA=m
-CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=y
-# CONFIG_CRYPTO_ANSI_CPRNG is not set
-# CONFIG_CRYPTO_HW is not set
-CONFIG_CRC_CCITT=y
-CONFIG_CRC_T10DIF=y
-CONFIG_CRC_ITU_T=y
-CONFIG_LIBCRC32C=y
diff --git a/recipes-kernel/linux/linux-2.6.39/openmoko.patch b/recipes-kernel/linux/linux-2.6.39/openmoko.patch
deleted file mode 100644
index 5c4af4f..0000000
--- a/recipes-kernel/linux/linux-2.6.39/openmoko.patch
+++ /dev/null
@@ -1,46285 +0,0 @@
-All patches from openmoko repository
-
-http://git.openmoko.org/?p=kernel.git;a=commit;h=164905f9f5843aa94b04eef724238c77dc47af0f
-
-diff --git a/arch/arm/include/asm/fiq.h b/arch/arm/include/asm/fiq.h
-index 2242ce2..7ade2b8 100644
---- a/arch/arm/include/asm/fiq.h
-+++ b/arch/arm/include/asm/fiq.h
-@@ -29,8 +29,9 @@ struct fiq_handler {
- extern int claim_fiq(struct fiq_handler *f);
- extern void release_fiq(struct fiq_handler *f);
- extern void set_fiq_handler(void *start, unsigned int length);
--extern void set_fiq_regs(struct pt_regs *regs);
--extern void get_fiq_regs(struct pt_regs *regs);
-+extern void set_fiq_c_handler(void (*handler)(void));
-+extern void __attribute__((naked)) set_fiq_regs(struct pt_regs *regs);
-+extern void __attribute__((naked)) get_fiq_regs(struct pt_regs *regs);
- extern void enable_fiq(int fiq);
- extern void disable_fiq(int fiq);
- 
-diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
-index e72dc34..0dd0fc0 100644
---- a/arch/arm/kernel/fiq.c
-+++ b/arch/arm/kernel/fiq.c
-@@ -8,6 +8,8 @@
-  *
-  *  FIQ support re-written by Russell King to be more generic
-  *
-+ *  FIQ handler in C supoprt written by Andy Green <andy@openmoko.com>
-+ *
-  * We now properly support a method by which the FIQ handlers can
-  * be stacked onto the vector.  We still do not support sharing
-  * the FIQ vector itself.
-@@ -130,6 +132,83 @@ void __naked get_fiq_regs(struct pt_regs *regs)
- 	: "r" (&regs->ARM_r8), "I" (PSR_I_BIT | PSR_F_BIT | FIQ_MODE));
- }
- 
-+/* -------- FIQ handler in C ---------
-+ *
-+ * Major Caveats for using this
-+ *  ---------------------------
-+ *  *
-+ *  * 1) it CANNOT touch any vmalloc()'d memory, only memory
-+ *    that was kmalloc()'d.  Static allocations in the monolithic kernel
-+ *    are kmalloc()'d so they are okay.  You can touch memory-mapped IO, but
-+ *    the pointer for it has to have been stored in kmalloc'd memory.  The
-+ *    reason for this is simple: every now and then Linux turns off interrupts
-+ *    and reorders the paging tables.  If a FIQ happens during this time, the
-+ *    virtual memory space can be partly or entirely disordered or missing.
-+ *
-+ * 2) Because vmalloc() is used when a module is inserted, THIS FIQ
-+ *    ISR HAS TO BE IN THE MONOLITHIC KERNEL, not a module.  But the way
-+ *    it is set up, you can all to enable and disable it from your module
-+ *    and intercommunicate with it through struct fiq_ipc
-+ *    fiq_ipc which you can define in
-+ *    asm/archfiq_ipc_type.h.  The reason is the same as above, a
-+ *    FIQ could happen while even the ISR is not present in virtual memory
-+ *    space due to pagetables being changed at the time.
-+ *
-+ * 3) You can't call any Linux API code except simple macros
-+ *    - understand that FIQ can come in at any time, no matter what
-+ *      state of undress the kernel may privately be in, thinking it
-+ *      locked the door by turning off interrupts... FIQ is an
-+ *      unstoppable monster force (which is its value)
-+ *    - they are not vmalloc()'d memory safe
-+ *    - they might do crazy stuff like sleep: FIQ pisses fire and
-+ *      is not interested in 'sleep' that the weak seem to need
-+ *    - calling APIs from FIQ can re-enter un-renterable things
-+ *    - summary: you cannot interoperate with linux APIs directly in the FIQ ISR
-+ *
-+ * If you follow these rules, it is fantastic, an extremely powerful, solid,
-+ * genuine hard realtime feature.
-+ */
-+
-+static void (*current_fiq_c_isr)(void);
-+#define FIQ_C_ISR_STACK_SIZE 	256
-+
-+static void __attribute__((naked)) __jump_to_isr(void)
-+{
-+	asm __volatile__ ("mov pc, r8");
-+}
-+
-+
-+static void __attribute__((naked)) __actual_isr(void)
-+{
-+	asm __volatile__ (
-+		"stmdb	sp!, {r0-r12, lr};"
-+		"mov     fp, sp;"
-+	);
-+
-+	current_fiq_c_isr();
-+
-+	asm __volatile__ (
-+		"ldmia	sp!, {r0-r12, lr};"
-+		"subs	pc, lr, #4;"
-+	);
-+}
-+
-+void set_fiq_c_handler(void (*isr)(void))
-+{
-+	struct pt_regs regs;
-+
-+	memset(&regs, 0, sizeof(regs));
-+	regs.ARM_r8 = (unsigned long) __actual_isr;
-+	regs.ARM_sp = 0xffff001c + FIQ_C_ISR_STACK_SIZE;
-+
-+	set_fiq_handler(__jump_to_isr, 4);
-+
-+	current_fiq_c_isr = isr;
-+
-+	set_fiq_regs(&regs);
-+}
-+/* -------- FIQ handler in C ---------*/
-+
- int claim_fiq(struct fiq_handler *f)
- {
- 	int ret = 0;
-diff --git a/arch/arm/mach-s3c2410/include/mach/gpio.h b/arch/arm/mach-s3c2410/include/mach/gpio.h
-index f7f6b07..f9ddfa9 100644
---- a/arch/arm/mach-s3c2410/include/mach/gpio.h
-+++ b/arch/arm/mach-s3c2410/include/mach/gpio.h
-@@ -16,26 +16,20 @@
- #define gpio_cansleep	__gpio_cansleep
- #define gpio_to_irq	__gpio_to_irq
- 
--/* some boards require extra gpio capacity to support external
-- * devices that need GPIO.
-- */
-+#include <mach/gpio-fns.h>
-+#include <mach/gpio-nrs.h>
- 
--#ifdef CONFIG_CPU_S3C244X
--#define ARCH_NR_GPIOS	(32 * 9 + CONFIG_S3C24XX_GPIO_EXTRA)
--#elif defined(CONFIG_CPU_S3C2443) || defined(CONFIG_CPU_S3C2416)
--#define ARCH_NR_GPIOS	(32 * 12 + CONFIG_S3C24XX_GPIO_EXTRA)
-+#if defined(CPU_S3C2416) || defined(CPU_S3C2443)
-+#define S3C_GPIO_END	S3C2410_GPM(S3C2410_GPIO_M_NR)
-+#elif defined(CONFIG_CPU_S3C244X)
-+#define S3C_GPIO_END	S3C2410_GPJ(S3C2410_GPIO_J_NR)
- #else
--#define ARCH_NR_GPIOS	(256 + CONFIG_S3C24XX_GPIO_EXTRA)
-+#define S3C_GPIO_END	S3C2410_GPH(S3C2410_GPIO_H_NR)
- #endif
- 
--#include <asm-generic/gpio.h>
--#include <mach/gpio-nrs.h>
--#include <mach/gpio-fns.h>
-+/* some boards require extra gpio capacity to support external
-+ * devices that need GPIO.
-+ */
-+#define ARCH_NR_GPIOS (S3C_GPIO_END + CONFIG_S3C24XX_GPIO_EXTRA)
- 
--#ifdef CONFIG_CPU_S3C244X
--#define S3C_GPIO_END	(S3C2410_GPJ(0) + 32)
--#elif defined(CONFIG_CPU_S3C2443) || defined(CONFIG_CPU_S3C2416)
--#define S3C_GPIO_END	(S3C2410_GPM(0) + 32)
--#else
--#define S3C_GPIO_END	(S3C2410_GPH(0) + 32)
--#endif
-+#include <asm-generic/gpio.h>
-diff --git a/arch/arm/mach-s3c2440/Kconfig b/arch/arm/mach-s3c2440/Kconfig
-index 50825a3..5122b3e 100644
---- a/arch/arm/mach-s3c2440/Kconfig
-+++ b/arch/arm/mach-s3c2440/Kconfig
-@@ -93,13 +93,16 @@ config MACH_ANUBIS
- config MACH_NEO1973_GTA02
- 	bool "Openmoko GTA02 / Freerunner phone"
- 	select CPU_S3C2442
-+	select S3C24XX_GPIO_EXTRA64
- 	select MFD_PCF50633
--	select PCF50633_GPIO
-+	select GPIO_PCF50633
- 	select I2C
- 	select POWER_SUPPLY
- 	select MACH_NEO1973
- 	select S3C2410_PWM
- 	select S3C_DEV_USB_HOST
-+	select SPARSE_IRQ
-+	select FIQ
- 	help
- 	   Say Y here if you are using the Openmoko GTA02 / Freerunner GSM Phone
- 
-diff --git a/arch/arm/mach-s3c2440/Makefile b/arch/arm/mach-s3c2440/Makefile
-index d5440fa..035d116 100644
---- a/arch/arm/mach-s3c2440/Makefile
-+++ b/arch/arm/mach-s3c2440/Makefile
-@@ -33,8 +33,14 @@ obj-$(CONFIG_ARCH_S3C2440)	+= mach-smdk2440.o
- obj-$(CONFIG_MACH_NEXCODER_2440) += mach-nexcoder.o
- obj-$(CONFIG_MACH_AT2440EVB) += mach-at2440evb.o
- obj-$(CONFIG_MACH_MINI2440) += mach-mini2440.o
--obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o
- obj-$(CONFIG_MACH_RX1950) += mach-rx1950.o
-+obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o \
-+	gta02-pm-bt.o \
-+	gta02-pm-gps.o \
-+	gta02-pm-gsm.o \
-+	gta02-pm-wlan.o \
-+	gta02-fiq.o \
-+	gta02-hdq.o \
- 
- # extra machine support
- 
-diff --git a/arch/arm/mach-s3c2440/gta02-fiq.c b/arch/arm/mach-s3c2440/gta02-fiq.c
-new file mode 100644
-index 0000000..6a9061d
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-fiq.c
-@@ -0,0 +1,133 @@
-+#include <linux/kernel.h>
-+
-+#include <asm/fiq.h>
-+#include <mach/regs-irq.h>
-+#include <plat/regs-timer.h>
-+#include <mach/irqs.h>
-+#include <linux/io.h>
-+#include <linux/pwm.h>
-+#include <linux/err.h>
-+#include <mach/gta02-hdq.h>
-+
-+/*
-+ * GTA02 FIQ related
-+ *
-+ * Calls into vibrator and hdq and based on the return values
-+ * determines if we the FIQ source be kept alive
-+ */
-+
-+#define DIVISOR_FROM_US(x) ((x) << 3)
-+
-+#define FIQ_DIVISOR_HDQ DIVISOR_FROM_US(HDQ_SAMPLE_PERIOD_US)
-+extern int hdq_fiq_handler(void);
-+
-+/* Global data related to our fiq source */
-+static uint32_t gta02_fiq_ack_mask;
-+static const int gta02_gta02_fiq_timer_id = 2;
-+
-+struct pwm_device *gta02_fiq_timer;
-+
-+void gta02_fiq_handler(void)
-+{
-+	unsigned long intmask;
-+	int keep_running = 0;
-+	/* disable further timer interrupts if nobody has any work
-+	 * or adjust rate according to who still has work
-+	 *
-+	 * CAUTION: it means forground code must disable FIQ around
-+	 * its own non-atomic S3C2410_INTMSK changes... not common
-+	 * thankfully and taken care of by the fiq-basis patch
-+	 */
-+
-+	keep_running = hdq_fiq_handler();
-+	if (!keep_running) {
-+		/* Disable irq */
-+		intmask = __raw_readl(S3C2410_INTMSK);
-+		intmask |= (gta02_fiq_ack_mask);
-+		__raw_writel(intmask, S3C2410_INTMSK);
-+	}
-+
-+	__raw_writel(gta02_fiq_ack_mask, S3C2410_SRCPND);
-+}
-+
-+void gta02_fiq_kick(void)
-+{
-+	unsigned long flags;
-+	unsigned long intmask;
-+	/* we have to take care about FIQ because this modification is
-+	 * non-atomic, FIQ could come in after the read and before the
-+	 * writeback and its changes to the register would be lost
-+	 * (platform INTMSK mod code is taken care of already)
-+	 */
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+
-+	/* allow FIQs to resume */
-+	intmask = __raw_readl(S3C2410_INTMSK);
-+	intmask &= ~(gta02_fiq_ack_mask);
-+	__raw_writel(intmask, S3C2410_INTMSK);
-+
-+	local_irq_restore(flags);
-+
-+}
-+
-+int gta02_fiq_enable(void)
-+{
-+	int ret = 0;
-+
-+	local_fiq_disable();
-+
-+	gta02_fiq_timer = pwm_request(gta02_gta02_fiq_timer_id, "fiq timer");
-+
-+	if (IS_ERR(gta02_fiq_timer)) {
-+		ret = PTR_ERR(gta02_fiq_timer);
-+		printk(KERN_ERR "GTA02 FIQ: Could not request fiq timer: %d\n",
-+			ret);
-+		return ret;
-+	}
-+
-+	gta02_fiq_ack_mask = 1 << (IRQ_TIMER0 + gta02_gta02_fiq_timer_id
-+					- S3C2410_CPUIRQ_OFFSET);
-+
-+
-+	ret = pwm_config(gta02_fiq_timer, HDQ_SAMPLE_PERIOD_US * 1000,
-+					HDQ_SAMPLE_PERIOD_US * 1000);
-+	if (ret) {
-+		printk(KERN_ERR "GTA02 FIQ: Could not configure fiq timer: %d\n",
-+			ret);
-+		goto err;
-+	}
-+
-+	set_fiq_c_handler(gta02_fiq_handler);
-+
-+	__raw_writel(gta02_fiq_ack_mask, S3C2410_INTMOD);
-+
-+	pwm_enable(gta02_fiq_timer);
-+
-+	local_fiq_enable();
-+
-+	return 0;
-+
-+err:
-+	pwm_free(gta02_fiq_timer);
-+
-+	return ret;
-+}
-+
-+void gta02_fiq_disable(void)
-+{
-+	local_fiq_disable();
-+
-+	if (!gta02_fiq_timer)
-+		return;
-+
-+	__raw_writel(0, S3C2410_INTMOD);
-+	set_fiq_c_handler(NULL);
-+
-+	pwm_disable(gta02_fiq_timer);
-+
-+	pwm_free(gta02_fiq_timer);
-+
-+	gta02_fiq_timer = NULL;
-+}
-+/* -------------------- /GTA02 FIQ Handler ------------------------------------- */
-diff --git a/arch/arm/mach-s3c2440/gta02-hdq.c b/arch/arm/mach-s3c2440/gta02-hdq.c
-new file mode 100644
-index 0000000..a1dadc2
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-hdq.c
-@@ -0,0 +1,414 @@
-+/*
-+ * HDQ generic GPIO bitbang driver using FIQ
-+ *
-+ * (C) 2006-2007 by Openmoko, Inc.
-+ * Author: Andy Green <andy@openmoko.com>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ *
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/init.h>
-+#include <linux/delay.h>
-+#include <linux/platform_device.h>
-+#include <mach/gta02-hdq.h>
-+
-+#define HDQ_READ 0
-+
-+enum hdq_bitbang_states {
-+	HDQB_IDLE = 0,
-+	HDQB_TX_BREAK,
-+	HDQB_TX_BREAK_RECOVERY,
-+	HDQB_ADS_CALC,
-+	HDQB_ADS_LOW,
-+	HDQB_ADS_HIGH,
-+	HDQB_WAIT_RX,
-+	HDQB_DATA_RX_LOW,
-+	HDQB_DATA_RX_HIGH,
-+	HDQB_WAIT_TX,
-+};
-+
-+static struct hdq_priv {
-+	struct mutex lock; /* if you want to use hdq, you have to take lock */
-+	u8 hdq_probed; /* nonzero after HDQ driver probed */
-+	u8 hdq_ads; /* b7..b6 = register address, b0 = r/w */
-+	u8 hdq_tx_data; /* data to tx for write action */
-+	u8 hdq_rx_data; /* data received in read action */
-+	u8 hdq_request_ctr; /* incremented by "user" to request a transfer */
-+	u8 hdq_transaction_ctr; /* incremented after each transfer */
-+	u8 hdq_error; /* 0 = no error */
-+	u8 hdq_ctr;
-+	u8 hdq_ctr2;
-+	u8 hdq_bit;
-+	u8 hdq_shifter;
-+	u8 hdq_tx_data_done;
-+	enum hdq_bitbang_states hdq_state;
-+	int reported_error;
-+
-+	struct hdq_platform_data *pdata;
-+} hdq_priv;
-+
-+
-+static void hdq_bad(void)
-+{
-+	if (!hdq_priv.reported_error)
-+		printk(KERN_ERR "HDQ error: %d\n", hdq_priv.hdq_error);
-+	hdq_priv.reported_error = 1;
-+}
-+
-+static void hdq_good(void)
-+{
-+	if (hdq_priv.reported_error)
-+		printk(KERN_INFO "HDQ responds again\n");
-+	hdq_priv.reported_error = 0;
-+}
-+
-+int hdq_fiq_handler(void)
-+{
-+	if (!hdq_priv.hdq_probed)
-+		return 0;
-+
-+	switch (hdq_priv.hdq_state) {
-+	case HDQB_IDLE:
-+		if (hdq_priv.hdq_request_ctr == hdq_priv.hdq_transaction_ctr)
-+			break;
-+		hdq_priv.hdq_ctr = 250 / HDQ_SAMPLE_PERIOD_US;
-+		hdq_priv.pdata->gpio_set(0);
-+		hdq_priv.pdata->gpio_dir_out();
-+		hdq_priv.hdq_tx_data_done = 0;
-+		hdq_priv.hdq_state = HDQB_TX_BREAK;
-+		break;
-+
-+	case HDQB_TX_BREAK: /* issue low for > 190us */
-+		if (--hdq_priv.hdq_ctr == 0) {
-+			hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
-+			hdq_priv.hdq_state = HDQB_TX_BREAK_RECOVERY;
-+			hdq_priv.pdata->gpio_set(1);
-+		}
-+		break;
-+
-+	case HDQB_TX_BREAK_RECOVERY: /* issue low for > 40us */
-+		if (--hdq_priv.hdq_ctr)
-+			break;
-+		hdq_priv.hdq_shifter = hdq_priv.hdq_ads;
-+		hdq_priv.hdq_bit = 8; /* 8 bits of ads / rw */
-+		hdq_priv.hdq_tx_data_done = 0; /* doing ads */
-+		/* fallthru on last one */
-+	case HDQB_ADS_CALC:
-+		if (hdq_priv.hdq_shifter & 1)
-+			hdq_priv.hdq_ctr = 50 / HDQ_SAMPLE_PERIOD_US;
-+		else
-+			hdq_priv.hdq_ctr = 120 / HDQ_SAMPLE_PERIOD_US;
-+		/* carefully precompute the other phase length */
-+		hdq_priv.hdq_ctr2 = (210 - (hdq_priv.hdq_ctr *
-+				HDQ_SAMPLE_PERIOD_US)) / HDQ_SAMPLE_PERIOD_US;
-+		hdq_priv.hdq_state = HDQB_ADS_LOW;
-+		hdq_priv.hdq_shifter >>= 1;
-+		hdq_priv.hdq_bit--;
-+		hdq_priv.pdata->gpio_set(0);
-+		break;
-+
-+	case HDQB_ADS_LOW:
-+		if (--hdq_priv.hdq_ctr)
-+			break;
-+		hdq_priv.pdata->gpio_set(1);
-+		hdq_priv.hdq_state = HDQB_ADS_HIGH;
-+		break;
-+
-+	case HDQB_ADS_HIGH:
-+		if (--hdq_priv.hdq_ctr2 > 1) /* account for HDQB_ADS_CALC */
-+			break;
-+		if (hdq_priv.hdq_bit) { /* more bits to do */
-+			hdq_priv.hdq_state = HDQB_ADS_CALC;
-+			break;
-+		}
-+		/* no more bits, wait until hdq_priv.hdq_ctr2 exhausted */
-+		if (hdq_priv.hdq_ctr2)
-+			break;
-+		/* ok no more bits and very last state */
-+		hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
-+		/* FIXME 0 = read */
-+		if (hdq_priv.hdq_ads & 0x80) { /* write the byte out */
-+			 /* set delay before payload */
-+			hdq_priv.hdq_ctr = 300 / HDQ_SAMPLE_PERIOD_US;
-+			/* already high, no need to write */
-+			hdq_priv.hdq_state = HDQB_WAIT_TX;
-+			break;
-+		}
-+		/* read the next byte */
-+		hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+		hdq_priv.hdq_ctr = 2500 / HDQ_SAMPLE_PERIOD_US;
-+		hdq_priv.hdq_state = HDQB_WAIT_RX;
-+		hdq_priv.pdata->gpio_dir_in();
-+		break;
-+
-+	case HDQB_WAIT_TX: /* issue low for > 40us */
-+		if (--hdq_priv.hdq_ctr)
-+			break;
-+		if (!hdq_priv.hdq_tx_data_done) { /* was that the data sent? */
-+			hdq_priv.hdq_tx_data_done++;
-+			hdq_priv.hdq_shifter = hdq_priv.hdq_tx_data;
-+			hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+			hdq_priv.hdq_state = HDQB_ADS_CALC; /* start sending */
-+			break;
-+		}
-+		hdq_priv.hdq_error = 0;
-+		hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+		hdq_priv.hdq_state = HDQB_IDLE; /* all tx is done */
-+		/* idle in input mode, it's pulled up by 10K */
-+		hdq_priv.pdata->gpio_dir_in();
-+		break;
-+
-+	case HDQB_WAIT_RX: /* wait for battery to talk to us */
-+		if (hdq_priv.pdata->gpio_get() == 0) {
-+			/* it talks to us! */
-+			hdq_priv.hdq_ctr2 = 1;
-+			hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+			/* timeout */
-+			hdq_priv.hdq_ctr = 500 / HDQ_SAMPLE_PERIOD_US;
-+			hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
-+			break;
-+		}
-+		if (--hdq_priv.hdq_ctr == 0) { /* timed out, error */
-+			hdq_priv.hdq_error = 1;
-+			hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+			hdq_priv.hdq_state = HDQB_IDLE; /* abort */
-+		}
-+		break;
-+
-+	/*
-+	 * HDQ basically works by measuring the low time of the bit cell
-+	 * 32-50us --> '1', 80 - 145us --> '0'
-+	 */
-+
-+	case HDQB_DATA_RX_LOW:
-+		if (hdq_priv.pdata->gpio_get()) {
-+			hdq_priv.hdq_rx_data >>= 1;
-+			if (hdq_priv.hdq_ctr2 <= (65 / HDQ_SAMPLE_PERIOD_US))
-+				hdq_priv.hdq_rx_data |= 0x80;
-+
-+			if (--hdq_priv.hdq_bit == 0) {
-+				hdq_priv.hdq_error = 0;
-+				hdq_priv.hdq_transaction_ctr =
-+						hdq_priv.hdq_request_ctr;
-+
-+				hdq_priv.hdq_state = HDQB_IDLE;
-+			} else
-+				hdq_priv.hdq_state = HDQB_DATA_RX_HIGH;
-+			/* timeout */
-+			hdq_priv.hdq_ctr = 1000 / HDQ_SAMPLE_PERIOD_US;
-+			hdq_priv.hdq_ctr2 = 1;
-+			break;
-+		}
-+		hdq_priv.hdq_ctr2++;
-+		if (--hdq_priv.hdq_ctr)
-+			break;
-+		 /* timed out, error */
-+		hdq_priv.hdq_error = 2;
-+		hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+		hdq_priv.hdq_state = HDQB_IDLE; /* abort */
-+		break;
-+
-+	case HDQB_DATA_RX_HIGH:
-+		if (!hdq_priv.pdata->gpio_get()) {
-+			/* it talks to us! */
-+			hdq_priv.hdq_ctr2 = 1;
-+			/* timeout */
-+			hdq_priv.hdq_ctr = 400 / HDQ_SAMPLE_PERIOD_US;
-+			hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
-+			break;
-+		}
-+		if (--hdq_priv.hdq_ctr)
-+			break;
-+		/* timed out, error */
-+		hdq_priv.hdq_error = 3;
-+		hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+
-+		/* we're in input mode already */
-+		hdq_priv.hdq_state = HDQB_IDLE; /* abort */
-+		break;
-+	}
-+
-+	/* Are we interested in keeping the FIQ source alive ? */
-+	if (hdq_priv.hdq_state != HDQB_IDLE)
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+static int fiq_busy(void)
-+{
-+	int request;
-+	int transact;
-+
-+	request = (volatile u8)hdq_priv.hdq_request_ctr;
-+	transact = (volatile u8)hdq_priv.hdq_transaction_ctr;
-+	return (request != transact);
-+}
-+
-+int hdq_read(struct device *dev, unsigned int address)
-+{
-+	int count_sleeps = 5;
-+	int ret = -ETIME;
-+
-+	if (!hdq_priv.hdq_probed)
-+		return -EINVAL;
-+
-+	mutex_lock(&hdq_priv.lock);
-+
-+	hdq_priv.hdq_error = 0;
-+	hdq_priv.hdq_ads = address | HDQ_READ;
-+	hdq_priv.hdq_request_ctr++;
-+	hdq_priv.pdata->kick_fiq();
-+	/*
-+	 * FIQ takes care of it while we block our calling process
-+	 * But we're not spinning -- other processes run normally while
-+	 * we wait for the result
-+	 */
-+	while (count_sleeps--) {
-+		msleep(10); /* valid transaction always completes in < 10ms */
-+
-+		if (fiq_busy())
-+			continue;
-+
-+		if (hdq_priv.hdq_error) {
-+			hdq_bad();
-+			goto done; /* didn't see a response in good time */
-+		}
-+		hdq_good();
-+
-+		ret = hdq_priv.hdq_rx_data;
-+		goto done;
-+	}
-+
-+done:
-+	mutex_unlock(&hdq_priv.lock);
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(hdq_read);
-+
-+/* sysfs */
-+
-+static ssize_t hdq_sysfs_dump(struct device *dev, struct device_attribute *attr,
-+			 char *buf)
-+{
-+	int n;
-+	int v;
-+	u8 u8a[128]; /* whole address space for HDQ */
-+	char *end = buf;
-+
-+	if (!hdq_priv.hdq_probed)
-+		return -EINVAL;
-+
-+	/* the dump does not take care about 16 bit regs, because at this
-+	 * bus level we don't know about the chip details
-+	 */
-+	for (n = 0; n < sizeof(u8a); n++) {
-+		v = hdq_read(NULL, n);
-+		if (v < 0)
-+			goto bail;
-+		u8a[n] = v;
-+	}
-+
-+	for (n = 0; n < sizeof(u8a); n += 16) {
-+		hex_dump_to_buffer(u8a + n, sizeof(u8a), 16, 1, end, 4096, 0);
-+		end += strlen(end);
-+		*end++ = '\n';
-+		*end = '\0';
-+	}
-+	return end - buf;
-+
-+bail:
-+	return sprintf(buf, "ERROR %d\n", v);
-+}
-+
-+
-+static DEVICE_ATTR(dump, 0400, hdq_sysfs_dump, NULL);
-+
-+#ifdef CONFIG_PM
-+static int hdq_suspend(struct platform_device *pdev, pm_message_t state)
-+{
-+	/* after 18s of this, the battery monitor will also go to sleep */
-+	hdq_priv.pdata->gpio_dir_in();
-+	hdq_priv.pdata->disable_fiq();
-+	return 0;
-+}
-+
-+static int hdq_resume(struct platform_device *pdev)
-+{
-+	hdq_priv.pdata->gpio_set(1);
-+	hdq_priv.pdata->gpio_dir_out();
-+	hdq_priv.pdata->enable_fiq();
-+	return 0;
-+}
-+#endif
-+
-+static int __devinit hdq_probe(struct platform_device *pdev)
-+{
-+	struct hdq_platform_data *pdata = pdev->dev.platform_data;
-+	int ret;
-+
-+	if (!pdata)
-+		return -ENXIO;
-+
-+	mutex_init(&hdq_priv.lock);
-+
-+	/* set our HDQ comms pin from the platform data */
-+	hdq_priv.pdata = pdata;
-+
-+	hdq_priv.pdata->gpio_set(1);
-+	hdq_priv.pdata->gpio_dir_out();
-+
-+	/* Initialize FIQ */
-+	if (hdq_priv.pdata->enable_fiq() < 0) {
-+		dev_err(&pdev->dev, "Could not enable FIQ source\n");
-+		return -EINVAL;
-+	}
-+
-+	ret = device_create_file(&pdev->dev, &dev_attr_dump);
-+	if (ret)
-+		return ret;
-+
-+	hdq_priv.hdq_probed = 1; /* we are ready to do stuff now */
-+
-+	hdq_priv.pdata = pdata;
-+
-+	return 0;
-+}
-+
-+static int __devexit hdq_remove(struct platform_device *pdev)
-+{
-+	device_remove_file(&pdev->dev, &dev_attr_dump);
-+	return 0;
-+}
-+
-+static struct platform_driver hdq_driver = {
-+	.probe		= hdq_probe,
-+	.remove		= hdq_remove,
-+#ifdef CONFIG_PM
-+	.suspend	= hdq_suspend,
-+	.resume		= hdq_resume,
-+#endif
-+	.driver		= {
-+		.name		= "hdq",
-+	},
-+};
-+
-+static int __init hdq_init(void)
-+{
-+	return platform_driver_register(&hdq_driver);
-+}
-+module_init(hdq_init);
-+
-+static void __exit hdq_exit(void)
-+{
-+	platform_driver_unregister(&hdq_driver);
-+}
-+module_exit(hdq_exit);
-+
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_DESCRIPTION("HDQ driver");
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-bt.c b/arch/arm/mach-s3c2440/gta02-pm-bt.c
-new file mode 100644
-index 0000000..28aaa3c
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-bt.c
-@@ -0,0 +1,264 @@
-+/*
-+ * Bluetooth PM code for the Openmoko Freerunner GSM Phone
-+ *
-+ * (C) 2007 by Openmoko Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
-+
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
-+#include <linux/rfkill.h>
-+#include <linux/slab.h>
-+#include <linux/gpio.h>
-+
-+#include <linux/err.h>
-+
-+#include <mach/gpio-fns.h>
-+
-+#include <mach/hardware.h>
-+#include <asm/mach-types.h>
-+
-+#include <mach/gta02.h>
-+
-+#include <linux/regulator/consumer.h>
-+
-+#define DRVMSG "Openmoko Freerunner Bluetooth Power Management"
-+
-+struct gta02_pm_bt_data {
-+	struct regulator *regulator;
-+	struct rfkill *rfkill;
-+	int pre_resume_state;
-+};
-+
-+static ssize_t bt_read(struct device *dev, struct device_attribute *attr,
-+			char *buf)
-+{
-+	int ret = 0;
-+	if (!strcmp(attr->attr.name, "power_on")) {
-+		if (gpio_get_value(GTA02_GPIO_BT_EN))
-+			ret = 1;
-+	} else if (!strcmp(attr->attr.name, "reset")) {
-+		if (gpio_get_value(GTA02_GPIO_BT_EN) == 0)
-+			ret = 1;
-+	}
-+
-+	if (!ret)
-+		return strlcpy(buf, "0\n", 3);
-+	else
-+		return strlcpy(buf, "1\n", 3);
-+}
-+
-+static void __gta02_pm_bt_toggle_radio(struct device *dev, unsigned int on)
-+{
-+	struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
-+
-+	dev_info(dev, "__gta02_pm_bt_toggle_radio %d\n", on);
-+
-+	bt_data = dev_get_drvdata(dev);
-+
-+	gpio_set_value(GTA02_GPIO_BT_EN, !on);
-+
-+	if (on) {
-+		if (!regulator_is_enabled(bt_data->regulator))
-+			regulator_enable(bt_data->regulator);
-+	} else {
-+		if (regulator_is_enabled(bt_data->regulator))
-+			regulator_disable(bt_data->regulator);
-+	}
-+
-+	gpio_set_value(GTA02_GPIO_BT_EN, on);
-+}
-+
-+
-+static int bt_rfkill_set_block(void *data, bool blocked)
-+{
-+	struct device *dev = data;
-+
-+	__gta02_pm_bt_toggle_radio(dev, !blocked);
-+
-+	return 0;
-+}
-+
-+static const struct rfkill_ops gta02_bt_rfkill_ops = {
-+	.set_block = bt_rfkill_set_block,
-+};
-+
-+
-+static ssize_t bt_write(struct device *dev, struct device_attribute *attr,
-+			const char *buf, size_t count)
-+{
-+	int ret;
-+	unsigned long on;
-+	struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
-+
-+	ret = strict_strtoul(buf, 10, &on);
-+	if (ret)
-+		return ret;
-+
-+	if (!strcmp(attr->attr.name, "power_on")) {
-+		rfkill_set_sw_state(bt_data->rfkill, on ? 1 : 0);
-+
-+		__gta02_pm_bt_toggle_radio(dev, on);
-+	} else if (!strcmp(attr->attr.name, "reset")) {
-+		/* reset is low-active, so we need to invert */
-+		gpio_set_value(GTA02_GPIO_BT_EN, on ? 0 : 1);
-+	}
-+
-+	return count;
-+}
-+
-+static DEVICE_ATTR(power_on, 0644, bt_read, bt_write);
-+static DEVICE_ATTR(reset, 0644, bt_read, bt_write);
-+
-+#ifdef CONFIG_PM
-+static int gta02_bt_suspend(struct platform_device *pdev, pm_message_t state)
-+{
-+	struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
-+
-+	dev_dbg(&pdev->dev, DRVMSG ": suspending\n");
-+
-+	bt_data->pre_resume_state = gpio_get_value(GTA02_GPIO_BT_EN);
-+	__gta02_pm_bt_toggle_radio(&pdev->dev, 0);
-+
-+	return 0;
-+}
-+
-+static int gta02_bt_resume(struct platform_device *pdev)
-+{
-+	struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
-+	dev_dbg(&pdev->dev, DRVMSG ": resuming\n");
-+
-+	__gta02_pm_bt_toggle_radio(&pdev->dev, bt_data->pre_resume_state);
-+	return 0;
-+}
-+#else
-+#define gta02_bt_suspend	NULL
-+#define gta02_bt_resume		NULL
-+#endif
-+
-+static struct attribute *gta02_bt_sysfs_entries[] = {
-+	&dev_attr_power_on.attr,
-+	&dev_attr_reset.attr,
-+	NULL
-+};
-+
-+static struct attribute_group gta02_bt_attr_group = {
-+	.name	= NULL,
-+	.attrs	= gta02_bt_sysfs_entries,
-+};
-+
-+static int __devinit gta02_bt_probe(struct platform_device *pdev)
-+{
-+	struct rfkill *rfkill;
-+	struct regulator *regulator;
-+	struct gta02_pm_bt_data *bt_data;
-+	int ret;
-+
-+	dev_info(&pdev->dev, DRVMSG ": starting\n");
-+
-+	bt_data = kzalloc(sizeof(*bt_data), GFP_KERNEL);
-+	dev_set_drvdata(&pdev->dev, bt_data);
-+
-+	regulator = regulator_get(&pdev->dev, "BT_3V2");
-+	if (IS_ERR(regulator))
-+		return -ENODEV;
-+
-+	bt_data->regulator = regulator;
-+
-+	/* this tests the true physical state of the regulator... */
-+	if (regulator_is_enabled(regulator)) {
-+		/*
-+		 * but these only operate on the logical state of the
-+		 * regulator... so we need to logicaly "adopt" it on
-+		 * to turn it off
-+		 */
-+		regulator_enable(regulator);
-+		regulator_disable(regulator);
-+	}
-+
-+	/* we pull reset to low to make sure that the chip doesn't
-+	 * drain power through the reset line */
-+	gpio_request(GTA02_GPIO_BT_EN, "Bluetooth enable");
-+	gpio_direction_output(GTA02_GPIO_BT_EN, 0);
-+
-+	rfkill = rfkill_alloc(pdev->name, &pdev->dev, RFKILL_TYPE_BLUETOOTH,
-+				&gta02_bt_rfkill_ops, &pdev->dev);
-+
-+	if (!rfkill) {
-+		dev_err(&pdev->dev, "Failed to allocate rfkill\n");
-+		return -ENOMEM;
-+	}
-+
-+	rfkill_init_sw_state(rfkill, 0);
-+
-+	ret = rfkill_register(rfkill);
-+	if (ret) {
-+		rfkill_destroy(rfkill);
-+		dev_err(&pdev->dev, "Failed to register rfkill\n");
-+		return ret;
-+	}
-+
-+	bt_data->rfkill = rfkill;
-+
-+	return sysfs_create_group(&pdev->dev.kobj, &gta02_bt_attr_group);
-+}
-+
-+static int __devexit gta02_bt_remove(struct platform_device *pdev)
-+{
-+	struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
-+	struct regulator *regulator;
-+
-+	sysfs_remove_group(&pdev->dev.kobj, &gta02_bt_attr_group);
-+
-+	if (bt_data->rfkill)
-+		rfkill_destroy(bt_data->rfkill);
-+
-+	if (!bt_data || !bt_data->regulator)
-+		return 0;
-+
-+	regulator = bt_data->regulator;
-+
-+	/* Make sure regulator is disabled before calling regulator_put */
-+	if (regulator_is_enabled(regulator))
-+		regulator_disable(regulator);
-+
-+	regulator_put(regulator);
-+
-+	kfree(bt_data);
-+
-+	return 0;
-+}
-+
-+static struct platform_driver gta02_bt_driver = {
-+	.probe		= gta02_bt_probe,
-+	.remove		= __devexit_p(gta02_bt_remove),
-+	.suspend	= gta02_bt_suspend,
-+	.resume		= gta02_bt_resume,
-+	.driver		= {
-+		.name		= "gta02-pm-bt",
-+	},
-+};
-+
-+static int __init gta02_bt_init(void)
-+{
-+	return platform_driver_register(&gta02_bt_driver);
-+}
-+module_init(gta02_bt_init);
-+
-+static void __exit gta02_bt_exit(void)
-+{
-+	platform_driver_unregister(&gta02_bt_driver);
-+}
-+module_exit(gta02_bt_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_DESCRIPTION(DRVMSG);
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-gps.c b/arch/arm/mach-s3c2440/gta02-pm-gps.c
-new file mode 100644
-index 0000000..4ca3ac6
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-gps.c
-@@ -0,0 +1,229 @@
-+/*
-+ * GPS Power Management code for the Openmoko Freerunner GSM Phone
-+ *
-+ * (C) 2007-2009 by Openmoko Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
-+
-+#include <mach/hardware.h>
-+#include <mach/gpio-fns.h>
-+#include <linux/gpio.h>
-+
-+#include <mach/gta02.h>
-+
-+#include <linux/regulator/consumer.h>
-+#include <linux/err.h>
-+
-+struct gta02_pm_gps_data {
-+#ifdef CONFIG_PM
-+	int keep_on_in_suspend;
-+#endif
-+	int power_was_on;
-+	struct regulator *regulator;
-+};
-+
-+static struct gta02_pm_gps_data gta02_gps;
-+
-+int gta02_pm_gps_is_on(void)
-+{
-+	return gta02_gps.power_was_on;
-+}
-+EXPORT_SYMBOL_GPL(gta02_pm_gps_is_on);
-+
-+/* This is the POWERON pin */
-+static void gps_pwron_set(int on)
-+{
-+	if (on) {
-+		/* return UART pins to being UART pins */
-+		s3c_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPH4_TXD1);
-+		/* remove pulldown now it won't be floating any more */
-+		s3c_gpio_setpull(S3C2410_GPH(5), S3C_GPIO_PULL_NONE);
-+
-+		if (!gta02_gps.power_was_on)
-+			regulator_enable(gta02_gps.regulator);
-+	} else {
-+		/*
-+		 * take care not to power unpowered GPS from UART TX
-+		 * return them to GPIO and force low
-+		 */
-+		s3c_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPIO_OUTPUT);
-+		gpio_set_value(S3C2410_GPH(4), 0);
-+		/* don't let RX from unpowered GPS float */
-+		s3c_gpio_setpull(S3C2410_GPH(5), S3C_GPIO_PULL_DOWN);
-+		if (gta02_gps.power_was_on)
-+			regulator_disable(gta02_gps.regulator);
-+	}
-+}
-+
-+static int gps_pwron_get(void)
-+{
-+	return regulator_is_enabled(gta02_gps.regulator);
-+}
-+
-+#ifdef CONFIG_PM
-+/* This is the flag for keeping gps ON during suspend */
-+static void gps_keep_on_in_suspend_set(int on)
-+{
-+	gta02_gps.keep_on_in_suspend = on;
-+}
-+
-+static int gps_keep_on_in_suspend_get(void)
-+{
-+	return gta02_gps.keep_on_in_suspend;
-+}
-+#endif
-+
-+static ssize_t power_gps_read(struct device *dev,
-+			      struct device_attribute *attr, char *buf)
-+{
-+	int ret = 0;
-+
-+	if (!strcmp(attr->attr.name, "power_on"))
-+		ret = gps_pwron_get();
-+#ifdef CONFIG_PM
-+	else if (!strcmp(attr->attr.name, "keep_on_in_suspend"))
-+		ret = gps_keep_on_in_suspend_get();
-+#endif
-+	if (ret)
-+		return strlcpy(buf, "1\n", 3);
-+	else
-+		return strlcpy(buf, "0\n", 3);
-+}
-+
-+static ssize_t power_gps_write(struct device *dev,
-+			       struct device_attribute *attr, const char *buf,
-+			       size_t count)
-+{
-+	int ret;
-+	unsigned long on;
-+
-+	ret = strict_strtoul(buf, 10, &on);
-+	if (ret)
-+		return ret;
-+
-+	if (!strcmp(attr->attr.name, "power_on")) {
-+		gps_pwron_set(on);
-+		gta02_gps.power_was_on = !!on;
-+#ifdef CONFIG_PM
-+	} else if (!strcmp(attr->attr.name, "keep_on_in_suspend")) {
-+		gps_keep_on_in_suspend_set(on);
-+#endif
-+	}
-+	return count;
-+}
-+
-+#ifdef CONFIG_PM
-+static int gta02_pm_gps_suspend(struct device *dev)
-+{
-+	if (!gta02_gps.keep_on_in_suspend ||
-+		!gta02_gps.power_was_on)
-+		gps_pwron_set(0);
-+	else
-+		dev_warn(dev, "GTA02: keeping gps ON "
-+			 "during suspend\n");
-+	return 0;
-+}
-+
-+static int gta02_pm_gps_resume(struct device *dev)
-+{
-+	if (!gta02_gps.keep_on_in_suspend && gta02_gps.power_was_on)
-+		gps_pwron_set(1);
-+
-+	return 0;
-+}
-+
-+static DEVICE_ATTR(keep_on_in_suspend, 0644, power_gps_read, power_gps_write);
-+
-+static const struct dev_pm_ops gta02_gps_pm_ops = {
-+	.suspend	= gta02_pm_gps_suspend,
-+	.resume		= gta02_pm_gps_resume,
-+};
-+
-+#define GTA02_GPS_PM_OPS (&gta02_gps_pm_ops)
-+
-+#else
-+#define GTA02_GPS_PM_OPS NULL
-+#endif
-+
-+static DEVICE_ATTR(power_on, 0644, power_gps_read, power_gps_write);
-+
-+static struct attribute *gta02_gps_sysfs_entries[] = {
-+	&dev_attr_power_on.attr,
-+#ifdef CONFIG_PM
-+	&dev_attr_keep_on_in_suspend.attr,
-+#endif
-+	NULL
-+};
-+
-+static struct attribute_group gta02_gps_attr_group = {
-+	.name	= NULL,
-+	.attrs	= gta02_gps_sysfs_entries,
-+};
-+
-+static int __devinit gta02_pm_gps_probe(struct platform_device *pdev)
-+{
-+	gta02_gps.regulator = regulator_get(&pdev->dev, "RF_3V");
-+	if (IS_ERR(gta02_gps.regulator)) {
-+		dev_err(&pdev->dev, "probe failed %ld\n",
-+			PTR_ERR(gta02_gps.regulator));
-+
-+		return PTR_ERR(gta02_gps.regulator);
-+	}
-+
-+	dev_info(&pdev->dev, "starting\n");
-+
-+
-+	/*
-+	 * take care not to power unpowered GPS from UART TX
-+	 * return them to GPIO and force low
-+	 */
-+	gpio_request(S3C2410_GPH(4), "gps tx");
-+	gpio_direction_output(S3C2410_GPH(4), 0);
-+	/* don't let RX from unpowered GPS float */
-+	s3c_gpio_setpull(S3C2410_GPH(5), S3C_GPIO_PULL_UP);
-+
-+	return sysfs_create_group(&pdev->dev.kobj,
-+				  &gta02_gps_attr_group);
-+}
-+
-+static int __devexit gta02_pm_gps_remove(struct platform_device *pdev)
-+{
-+	regulator_put(gta02_gps.regulator);
-+	sysfs_remove_group(&pdev->dev.kobj, &gta02_gps_attr_group);
-+	return 0;
-+}
-+
-+static struct platform_driver gta02_pm_gps_driver = {
-+	.probe		= gta02_pm_gps_probe,
-+	.remove		= __devexit_p(gta02_pm_gps_remove),
-+	.driver		= {
-+		.name		= "gta02-pm-gps",
-+		.pm			= GTA02_GPS_PM_OPS,
-+	},
-+};
-+
-+static int __init gta02_pm_gps_init(void)
-+{
-+	return platform_driver_register(&gta02_pm_gps_driver);
-+}
-+module_init(gta02_pm_gps_init);
-+
-+static void __exit gta02_pm_gps_exit(void)
-+{
-+	platform_driver_unregister(&gta02_pm_gps_driver);
-+}
-+module_exit(gta02_pm_gps_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-gsm.c b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
-new file mode 100644
-index 0000000..a2b4e91
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
-@@ -0,0 +1,368 @@
-+/*
-+ * GSM Management code for the Openmoko Freerunner GSM Phone
-+ *
-+ * (C) 2007 by Openmoko Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
-+#include <linux/console.h>
-+#include <linux/errno.h>
-+#include <linux/interrupt.h>
-+#include <linux/delay.h>
-+#include <linux/err.h>
-+#include <linux/regulator/consumer.h>
-+
-+#include <linux/gpio.h>
-+#include <mach/gpio.h>
-+#include <asm/mach-types.h>
-+
-+#include <mach/hardware.h>
-+
-+#include <mach/gta02.h>
-+#include <mach/regs-gpio.h>
-+#include <mach/regs-gpioj.h>
-+
-+static int gta02_gsm_interrupts;
-+
-+extern void s3c24xx_serial_console_set_silence(int);
-+
-+struct gta02pm_priv {
-+	int gpio_ndl_gsm;
-+	struct console *con;
-+	struct regulator *regulator;
-+};
-+
-+static struct gta02pm_priv gta02_gsm;
-+
-+static struct console *find_s3c24xx_console(void)
-+{
-+	struct console *con;
-+
-+	console_lock();
-+
-+	for (con = console_drivers; con; con = con->next) {
-+		if (!strcmp(con->name, "ttySAC"))
-+			break;
-+	}
-+
-+	console_unlock();
-+
-+	return con;
-+}
-+
-+static ssize_t gsm_read(struct device *dev, struct device_attribute *attr,
-+			char *buf)
-+{
-+	if (!strcmp(attr->attr.name, "power_on")) {
-+		if (regulator_is_enabled(gta02_gsm.regulator))
-+			goto out_1;
-+	} else if (!strcmp(attr->attr.name, "download")) {
-+		if (!gpio_get_value(GTA02_GPIO_nDL_GSM))
-+			goto out_1;
-+	} else if (!strcmp(attr->attr.name, "flowcontrolled")) {
-+		if (s3c_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT)
-+			goto out_1;
-+	}
-+
-+	return strlcpy(buf, "0\n", 3);
-+out_1:
-+	return strlcpy(buf, "1\n", 3);
-+}
-+
-+static void gsm_on_off(struct device *dev, bool on)
-+{
-+	if (on == regulator_is_enabled(gta02_gsm.regulator))
-+		return;
-+
-+	if (!on) {
-+		s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_INPUT);
-+		s3c_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPIO_INPUT);
-+
-+		regulator_disable(gta02_gsm.regulator);
-+
-+		if (gta02_gsm.con) {
-+			s3c24xx_serial_console_set_silence(0);
-+			console_start(gta02_gsm.con);
-+
-+			dev_dbg(dev, "powered down gta02 GSM, enabling "
-+					"serial console\n");
-+		}
-+
-+		return;
-+	}
-+
-+	if (gta02_gsm.con) {
-+		dev_dbg(dev, "powering up GSM, thus "
-+				"disconnecting serial console\n");
-+
-+		console_stop(gta02_gsm.con);
-+		s3c24xx_serial_console_set_silence(1);
-+	}
-+
-+	/* allow UART to talk to GSM side now we will power it */
-+	s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
-+	s3c_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPH2_TXD0);
-+
-+	regulator_enable(gta02_gsm.regulator);
-+
-+	msleep(100);
-+
-+	gpio_set_value(GTA02_GPIO_MODEM_ON, 1);
-+	msleep(500);
-+	gpio_set_value(GTA02_GPIO_MODEM_ON, 0);
-+
-+	/*
-+	 * workaround for calypso firmware moko10 and earlier,
-+	 * without this it will leave IRQ line high after
-+	 * booting
-+	 */
-+	s3c2410_gpio_setpin(S3C2410_GPH(1), 1);
-+	s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
-+	msleep(1000);
-+	s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
-+
-+}
-+
-+static ssize_t gsm_write(struct device *dev, struct device_attribute *attr,
-+			 const char *buf, size_t count)
-+{
-+	int ret;
-+	unsigned long on;
-+
-+	ret = strict_strtoul(buf, 10, &on);
-+	if (ret)
-+		return ret;
-+
-+	if (!strcmp(attr->attr.name, "power_on")) {
-+		gsm_on_off(dev, on);
-+
-+		return count;
-+	}
-+
-+	if (!strcmp(attr->attr.name, "download")) {
-+		/*
-+		 * the keyboard / buttons driver requests and enables
-+		 * the JACK_INSERT IRQ.  We have to take care about
-+		 * not enabling and disabling the IRQ when it was
-+		 * already in that state or we get "unblanaced IRQ"
-+		 * kernel warnings and stack dumps.  So we use the
-+		 * copy of the ndl_gsm state to figure out if we should
-+		 * enable or disable the jack interrupt
-+		 */
-+		if (on) {
-+			if (gta02_gsm.gpio_ndl_gsm)
-+				disable_irq(gpio_to_irq(
-+						   GTA02_GPIO_JACK_INSERT));
-+		} else {
-+			if (!gta02_gsm.gpio_ndl_gsm)
-+				enable_irq(gpio_to_irq(
-+						   GTA02_GPIO_JACK_INSERT));
-+		}
-+
-+		gta02_gsm.gpio_ndl_gsm = !on;
-+		gpio_set_value(GTA02_GPIO_nDL_GSM, !on);
-+
-+		return count;
-+	}
-+
-+	if (!strcmp(attr->attr.name, "flowcontrolled")) {
-+		if (on) {
-+			gta02_gsm_interrupts = 0;
-+			gpio_set_value(S3C2410_GPH(1), 1);
-+			s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
-+		} else
-+			s3c_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
-+	}
-+
-+	return count;
-+}
-+
-+static DEVICE_ATTR(power_on, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(reset, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(download, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(flowcontrolled, 0644, gsm_read, gsm_write);
-+
-+#ifdef CONFIG_PM
-+
-+static int gta02_gsm_suspend(struct device *dev)
-+{
-+	/* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
-+	 * don't need to do much here. */
-+
-+
-+	/* If flowcontrol asserted, abort if GSM already interrupted */
-+	if (s3c_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
-+		if (gta02_gsm_interrupts)
-+			goto busy;
-+	}
-+
-+	/* disable DL GSM to prevent jack_insert becoming 'floating' */
-+	gpio_set_value(GTA02_GPIO_nDL_GSM, 1);
-+
-+	if (device_may_wakeup(dev))
-+		enable_irq_wake(GTA02_IRQ_MODEM);
-+
-+	return 0;
-+
-+busy:
-+	return -EBUSY;
-+}
-+
-+static int gta02_gsm_suspend_late(struct device *dev)
-+{
-+	/* Last chance: abort if GSM already interrupted */
-+	if (s3c_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
-+		if (gta02_gsm_interrupts)
-+			return -EBUSY;
-+	}
-+	return 0;
-+}
-+
-+static int gta02_gsm_resume(struct device *dev)
-+{
-+	if (device_may_wakeup(dev))
-+		disable_irq_wake(GTA02_IRQ_MODEM);
-+
-+	/* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
-+	 * don't need to do much here. */
-+
-+	/* Make sure that the kernel console on the serial port is still
-+	 * disabled. FIXME: resume ordering race with serial driver! */
-+	if (gta02_gsm.con && gpio_get_value(GTA02_GPIO_MODEM_ON))
-+		console_stop(gta02_gsm.con);
-+
-+	gpio_set_value(GTA02_GPIO_nDL_GSM, gta02_gsm.gpio_ndl_gsm);
-+
-+	return 0;
-+}
-+
-+static const struct dev_pm_ops gta02_gsm_pm_ops = {
-+	.suspend	= gta02_gsm_suspend,
-+	.suspend_noirq	= gta02_gsm_suspend_late,
-+	.resume		= gta02_gsm_resume,
-+};
-+
-+#define GTA02_GSM_PM_OPS (&gta02_gsm_pm_ops)
-+
-+#else
-+#define GTA02_GSM_PM_OPS NULL
-+#endif /* CONFIG_PM */
-+
-+static struct attribute *gta02_gsm_sysfs_entries[] = {
-+	&dev_attr_power_on.attr,
-+	&dev_attr_reset.attr,
-+	&dev_attr_download.attr,
-+	&dev_attr_flowcontrolled.attr,
-+	NULL
-+};
-+
-+static struct attribute_group gta02_gsm_attr_group = {
-+	.name	= NULL,
-+	.attrs	= gta02_gsm_sysfs_entries,
-+};
-+
-+static irqreturn_t gta02_gsm_irq(int irq, void *devid)
-+{
-+	gta02_gsm_interrupts++;
-+	return IRQ_HANDLED;
-+}
-+
-+static int __devinit gta02_gsm_probe(struct platform_device *pdev)
-+{
-+	int ret;
-+
-+	gta02_gsm.con = find_s3c24xx_console();
-+	if (!gta02_gsm.con)
-+		dev_warn(&pdev->dev,
-+			 "cannot find S3C24xx console driver\n");
-+
-+	gta02_gsm.regulator = regulator_get_exclusive(&pdev->dev, "GSM");
-+
-+	if (IS_ERR(gta02_gsm.regulator)) {
-+		ret = PTR_ERR(gta02_gsm.regulator);
-+		dev_err(&pdev->dev, "Failed to get regulator: %d\n", ret);
-+		return ret;
-+	}
-+
-+	ret = request_irq(GTA02_IRQ_MODEM, gta02_gsm_irq,
-+			IRQF_DISABLED | IRQF_TRIGGER_RISING, "modem", NULL);
-+
-+	if (ret) {
-+		regulator_put(gta02_gsm.regulator);
-+		dev_err(&pdev->dev, "Failed to get modem irq: %d\n", ret);
-+		goto err_regulator_put;
-+	}
-+
-+	ret = sysfs_create_group(&pdev->dev.kobj, &gta02_gsm_attr_group);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to create sysfs entries: %d\n",
-+			ret);
-+		goto err_free_irq;
-+	}
-+
-+	device_init_wakeup(&pdev->dev, 1);
-+
-+	/* note that download initially disabled, and enforce that */
-+	gta02_gsm.gpio_ndl_gsm = 1;
-+	gpio_request(GTA02_GPIO_nDL_GSM, "GSM nDL");
-+	gpio_direction_output(GTA02_GPIO_nDL_GSM, 1);
-+	gpio_request(GTA02_GPIO_MODEM_ON, "GSM modem enable");
-+	gpio_direction_output(GTA02_GPIO_MODEM_ON, 0);
-+
-+	/* GSM is to be initially off (at boot, or if this module inserted) */
-+	gsm_on_off(&pdev->dev, 0);
-+
-+	return 0;
-+err_free_irq:
-+	free_irq(GTA02_IRQ_MODEM, NULL);
-+err_regulator_put:
-+	regulator_put(gta02_gsm.regulator);
-+
-+	return ret;
-+}
-+
-+static int __devexit gta02_gsm_remove(struct platform_device *pdev)
-+{
-+	gsm_on_off(&pdev->dev, 0);
-+
-+	sysfs_remove_group(&pdev->dev.kobj, &gta02_gsm_attr_group);
-+	free_irq(GTA02_IRQ_MODEM, NULL);
-+	regulator_put(gta02_gsm.regulator);
-+
-+	return 0;
-+}
-+
-+static struct platform_driver gta02_gsm_driver = {
-+	.probe		= gta02_gsm_probe,
-+	.remove		= __devexit_p(gta02_gsm_remove),
-+	.driver		= {
-+		.name	= "gta02-pm-gsm",
-+		.pm	= GTA02_GSM_PM_OPS,
-+	},
-+};
-+
-+static int __init gta02_gsm_init(void)
-+{
-+	return platform_driver_register(&gta02_gsm_driver);
-+}
-+module_init(gta02_gsm_init);
-+
-+static void __exit gta02_gsm_exit(void)
-+{
-+	platform_driver_unregister(&gta02_gsm_driver);
-+}
-+module_exit(gta02_gsm_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_DESCRIPTION("Openmoko Freerunner GSM Power Management");
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-wlan.c b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
-new file mode 100644
-index 0000000..1c8da2c
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
-@@ -0,0 +1,198 @@
-+/*
-+ * GTA02 WLAN power management
-+ *
-+ * (C) 2008, 2009 by Openmoko Inc.
-+ * Author: Andy Green <andy@openmoko.com>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/mutex.h>
-+#include <linux/platform_device.h>
-+
-+#include <mach/hardware.h>
-+#include <asm/mach-types.h>
-+
-+#include <mach/gta02.h>
-+#include <mach/gta02-pm-wlan.h>
-+#include <mach/regs-gpio.h>
-+#include <mach/gpio-fns.h>
-+#include <linux/gpio.h>
-+
-+#include <linux/delay.h>
-+#include <linux/rfkill.h>
-+
-+
-+/* ----- Module hardware reset ("power") ----------------------------------- */
-+
-+
-+void gta02_wlan_reset()
-+{
-+	gpio_set_value(GTA02_GPIO_nWLAN_RESET, 0);
-+	msleep(200); /* probably excessive but we don't have specs */
-+	gpio_set_value(GTA02_GPIO_nWLAN_RESET, 1);
-+}
-+
-+/* ----- rfkill ------------------------------------------------------------ */
-+
-+/*
-+ * S3C MCI handles suspend/resume through device removal/insertion. In order to
-+ * preserve rfkill state, as required in clause 7 of section 3.1 in rfkill.txt,
-+ * we therefore need to maintain rfkill state outside the driver.
-+ *
-+ * This platform driver is as good a place as any other.
-+ */
-+
-+static int (*gta02_wlan_rfkill_cb)(void *user, int on);
-+static void *gta02_wlan_rfkill_user;
-+static DEFINE_MUTEX(gta02_wlan_rfkill_lock);
-+static int gta02_wlan_rfkill_on;
-+
-+/*
-+ * gta02_wlan_query_rfkill_lock is used to obtain the rfkill state before the
-+ * driver is ready to process rfkill callbacks. To prevent the state from
-+ * changing until the driver has completed its initialization, we grab and hold
-+ * the rfkill lock.
-+ *
-+ * A call to gta02_wlan_query_rfkill_lock must be followed by either
-+ * - a call to gta02_wlan_set_rfkill_cb, to complete the setup, or
-+ * - a call to gta02_wlan_query_rfkill_unlock to abort the setup process.
-+ */
-+
-+int gta02_wlan_query_rfkill_lock(void)
-+{
-+	mutex_lock(&gta02_wlan_rfkill_lock);
-+	return gta02_wlan_rfkill_on;
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_lock);
-+
-+void gta02_wlan_query_rfkill_unlock(void)
-+{
-+	mutex_unlock(&gta02_wlan_rfkill_lock);
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_unlock);
-+
-+void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user)
-+{
-+	BUG_ON(!mutex_is_locked(&gta02_wlan_rfkill_lock));
-+	BUG_ON(gta02_wlan_rfkill_cb);
-+	gta02_wlan_rfkill_cb = cb;
-+	gta02_wlan_rfkill_user = user;
-+	mutex_unlock(&gta02_wlan_rfkill_lock);
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_set_rfkill_cb);
-+
-+void gta02_wlan_clear_rfkill_cb(void)
-+{
-+	mutex_lock(&gta02_wlan_rfkill_lock);
-+	BUG_ON(!gta02_wlan_rfkill_cb);
-+	gta02_wlan_rfkill_cb = NULL;
-+	mutex_unlock(&gta02_wlan_rfkill_lock);
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_clear_rfkill_cb);
-+
-+static int gta02_wlan_set_radio_block(void *data, bool blocked)
-+{
-+	struct device *dev = data;
-+	int res = 0;
-+
-+	dev_dbg(dev, "gta02_wlan_toggle_radio: blocked %d (%p)\n",
-+		blocked, gta02_wlan_rfkill_cb);
-+	mutex_lock(&gta02_wlan_rfkill_lock);
-+	if (gta02_wlan_rfkill_cb)
-+		res = gta02_wlan_rfkill_cb(gta02_wlan_rfkill_user, !blocked);
-+	if (!res)
-+		gta02_wlan_rfkill_on = !blocked;
-+	mutex_unlock(&gta02_wlan_rfkill_lock);
-+	return res;
-+}
-+
-+static const struct rfkill_ops gta02_wlan_rfkill_ops = {
-+	.set_block = gta02_wlan_set_radio_block,
-+};
-+
-+/* ----- Initialization/removal -------------------------------------------- */
-+
-+
-+static int __devinit gta02_wlan_probe(struct platform_device *pdev)
-+{
-+	/* default-on for now */
-+	const int default_state = 1;
-+	struct rfkill *rfkill;
-+	int ret;
-+
-+	dev_info(&pdev->dev, "starting\n");
-+
-+	gpio_request(GTA02_GPIO_nWLAN_RESET, "wlan reset");
-+	gpio_direction_output(GTA02_GPIO_nWLAN_RESET, 0);
-+	gta02_wlan_reset();
-+
-+	rfkill = rfkill_alloc("ar6000", &pdev->dev, RFKILL_TYPE_WLAN,
-+				&gta02_wlan_rfkill_ops, &pdev->dev);
-+
-+
-+	if (!rfkill) {
-+		dev_err(&pdev->dev, "Failed to allocate rfkill\n");
-+		return -ENOMEM;
-+	}
-+
-+	rfkill_init_sw_state(rfkill, default_state);
-+	/*
-+	 * If the WLAN driver somehow managed to get activated before we're
-+	 * ready, the driver is now in an unknown state, which isn't something
-+	 * we're prepared to handle. This can't happen, so just fail hard.
-+	 */
-+	BUG_ON(gta02_wlan_rfkill_cb);
-+	gta02_wlan_rfkill_on = default_state;
-+
-+	ret = rfkill_register(rfkill);
-+	if (ret) {
-+		rfkill_destroy(rfkill);
-+		dev_err(&pdev->dev, "Failed to register rfkill\n");
-+		return ret;
-+	}
-+
-+	dev_set_drvdata(&pdev->dev, rfkill);
-+
-+	return 0;
-+}
-+
-+static int __devexit gta02_wlan_remove(struct platform_device *pdev)
-+{
-+	struct rfkill *rfkill = dev_get_drvdata(&pdev->dev);
-+
-+	rfkill_destroy(rfkill);
-+
-+	return 0;
-+}
-+
-+static struct platform_driver gta02_wlan_driver = {
-+	.probe		= gta02_wlan_probe,
-+	.remove		= __devexit_p(gta02_wlan_remove),
-+	.driver		= {
-+		.name		= "gta02-pm-wlan",
-+	},
-+};
-+
-+static int __init gta02_wlan_init(void)
-+{
-+	return platform_driver_register(&gta02_wlan_driver);
-+}
-+module_init(gta02_wlan_init);
-+
-+static void __exit gta02_wlan_exit(void)
-+{
-+	platform_driver_unregister(&gta02_wlan_driver);
-+}
-+module_exit(gta02_wlan_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_DESCRIPTION("Openmoko GTA02 WLAN power management");
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
-new file mode 100644
-index 0000000..90de353
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
-@@ -0,0 +1,9 @@
-+#ifndef __GTA02_FIQ_H
-+#define __GTA02_FIQ_H
-+
-+extern void gta02_fiq_handler(void);
-+extern void gta02_fiq_kick(void);
-+extern int gta02_fiq_enable(void);
-+extern void gta02_fiq_disable(void);
-+
-+#endif
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-hdq.h b/arch/arm/mach-s3c2440/include/mach/gta02-hdq.h
-new file mode 100644
-index 0000000..ba98f8f
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-hdq.h
-@@ -0,0 +1,23 @@
-+#ifndef __LINUX_HDQ_H__
-+#define __LINUX_HDQ_H__
-+
-+#include <linux/device.h>
-+
-+#define HDQ_SAMPLE_PERIOD_US	10
-+
-+/* platform data */
-+
-+struct hdq_platform_data {
-+	void (*gpio_dir_out)(void);
-+	void (*gpio_dir_in)(void);
-+	void (*gpio_set)(int);
-+	int (*gpio_get)(void);
-+
-+	int (*enable_fiq)(void);
-+	void (*disable_fiq)(void);
-+	void (*kick_fiq)(void);
-+};
-+
-+int hdq_read(struct device *dev, unsigned int address);
-+
-+#endif
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
-new file mode 100644
-index 0000000..f15180a
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
-@@ -0,0 +1 @@
-+extern int gta02_pm_gps_is_on(void);
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
-new file mode 100644
-index 0000000..0c96db4
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
-@@ -0,0 +1,10 @@
-+#ifndef __MACH_GTA02_PM_WLAN_H
-+#define __MACH_GTA02_PM_WLAN_H
-+
-+void gta02_wlan_reset(void);
-+int gta02_wlan_query_rfkill_lock(void);
-+void gta02_wlan_query_rfkill_unlock(void);
-+void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user);
-+void gta02_wlan_clear_rfkill_cb(void);
-+
-+#endif /* __MACH_GTA02_PM_WLAN_H */
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02.h b/arch/arm/mach-s3c2440/include/mach/gta02.h
-index 3a56a22..2e84b5a 100644
---- a/arch/arm/mach-s3c2440/include/mach/gta02.h
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02.h
-@@ -79,6 +79,11 @@
- #define GTA02_PCB_ID2_0		S3C2410_GPD(3)
- #define GTA02_PCB_ID2_1		S3C2410_GPD(4)
- 
-+#define GTA02_GPIO_GLAMO_BASE S3C_GPIO_END
-+#define GTA02_GPIO_GLAMO(x) (GTA02_GPIO_GLAMO_BASE + (x))
-+#define GTA02_GPIO_PCF_BASE (GTA02_GPIO_GLAMO_BASE + 32)
-+#define GTA02_GPIO_PCF(x) (GTA02_GPIO_PCF_BASE + (x))
-+
- int gta02_get_pcb_revision(void);
- 
- #endif /* _GTA02_H */
-diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
-index 7166620..aa31b8d 100644
---- a/arch/arm/mach-s3c2440/mach-gta02.c
-+++ b/arch/arm/mach-s3c2440/mach-gta02.c
-@@ -38,6 +38,7 @@
- #include <linux/platform_device.h>
- #include <linux/serial_core.h>
- #include <linux/spi/spi.h>
-+#include <linux/spi/spi_gpio.h>
- 
- #include <linux/mmc/host.h>
- 
-@@ -50,6 +51,7 @@
- 
- #include <linux/i2c.h>
- #include <linux/regulator/machine.h>
-+#include <linux/regulator/fixed.h>
- 
- #include <linux/mfd/pcf50633/core.h>
- #include <linux/mfd/pcf50633/mbc.h>
-@@ -61,6 +63,9 @@
- #include <linux/input.h>
- #include <linux/gpio_keys.h>
- 
-+#include <linux/leds.h>
-+#include <linux/leds_pwm.h>
-+
- #include <asm/mach/arch.h>
- #include <asm/mach/map.h>
- #include <asm/mach/irq.h>
-@@ -92,6 +97,19 @@
- #include <plat/ts.h>
- 
- 
-+#include <mach/gta02-pm-gps.h>
-+#include <mach/gta02-pm-wlan.h>
-+
-+#include <mach/gta02-fiq.h>
-+
-+#include <mach/gta02-hdq.h>
-+#include <linux/power/bq27x00_battery.h>
-+#include <linux/platform_battery.h>
-+
-+#include <linux/jbt6k74.h>
-+#include <linux/glamofb.h>
-+#include <linux/mfd/glamo.h>
-+
- static struct pcf50633 *gta02_pcf;
- 
- /*
-@@ -147,6 +165,183 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
- 	},
- };
- 
-+static struct platform_device gta02_pm_bt_dev = {
-+	.name = "gta02-pm-bt",
-+};
-+
-+static struct platform_device gta02_pm_gps_dev = {
-+	.name = "gta02-pm-gps",
-+};
-+
-+static struct platform_device gta02_pm_gsm_dev = {
-+	.name = "gta02-pm-gsm",
-+};
-+
-+static struct platform_device gta02_pm_wlan_dev = {
-+	.name = "gta02-pm-wlan",
-+};
-+
-+static struct regulator_consumer_supply gsm_supply_consumer = {
-+	.dev = &gta02_pm_gsm_dev.dev,
-+	.supply = "GSM",
-+};
-+
-+static struct regulator_init_data gsm_supply_init_data = {
-+	.constraints = {
-+		.min_uV = 3700000,
-+		.max_uV = 3700000,
-+		.valid_modes_mask = REGULATOR_MODE_NORMAL,
-+		.valid_ops_mask = REGULATOR_CHANGE_STATUS,
-+	},
-+	.num_consumer_supplies = 1,
-+	.consumer_supplies = &gsm_supply_consumer,
-+};
-+
-+static struct fixed_voltage_config gsm_supply_config = {
-+	.supply_name = "GSM",
-+	.microvolts = 3700000,
-+	.gpio = GTA02_GPIO_PCF(PCF50633_GPIO2),
-+	.enable_high = 1,
-+	.init_data = &gsm_supply_init_data,
-+};
-+
-+static struct platform_device gta02_gsm_supply_device = {
-+	.name = "reg-fixed-voltage",
-+	.id = 1,
-+	.dev = {
-+		.platform_data = &gsm_supply_config,
-+	},
-+};
-+
-+/*
-+ * we crank down SD Card clock dynamically when GPS is powered
-+ */
-+
-+static int gta02_glamo_mci_use_slow(void)
-+{
-+	return gta02_pm_gps_is_on();
-+}
-+
-+static void gta02_glamo_external_reset(int level)
-+{
-+	s3c2410_gpio_setpin(GTA02_GPIO_3D_RESET, level);
-+	s3c2410_gpio_cfgpin(GTA02_GPIO_3D_RESET, S3C2410_GPIO_OUTPUT);
-+}
-+
-+struct spi_gpio_platform_data spigpio_platform_data = {
-+	.sck = GTA02_GPIO_GLAMO(10),
-+	.mosi = GTA02_GPIO_GLAMO(11),
-+	.miso = GTA02_GPIO_GLAMO(5),
-+	.num_chipselect = 1,
-+};
-+
-+static struct platform_device spigpio_device = {
-+	.name = "spi_gpio",
-+	.id   = 2,
-+	.dev = {
-+		.platform_data = &spigpio_platform_data,
-+	},
-+};
-+
-+static struct fb_videomode gta02_glamo_modes[] = {
-+	{
-+		.name = "480x640",
-+		.xres = 480,
-+		.yres = 640,
-+		.pixclock	= 40816,
-+		.left_margin	= 8,
-+		.right_margin	= 16,
-+		.upper_margin	= 2,
-+		.lower_margin	= 16,
-+		.hsync_len	= 8,
-+		.vsync_len	= 2,
-+		.vmode = FB_VMODE_NONINTERLACED,
-+	}, {
-+		.name = "240x320",
-+		.xres = 240,
-+		.yres = 320,
-+		.pixclock	= 40816,
-+		.left_margin	= 8,
-+		.right_margin	= 16,
-+		.upper_margin	= 2,
-+		.lower_margin	= 16,
-+		.hsync_len	= 8,
-+		.vsync_len	= 2,
-+		.vmode = FB_VMODE_NONINTERLACED,
-+	}
-+};
-+
-+static struct glamo_fb_platform_data gta02_glamo_fb_pdata = {
-+	.width  = 43,
-+	.height = 58,
-+
-+	.num_modes = ARRAY_SIZE(gta02_glamo_modes),
-+	.modes = gta02_glamo_modes,
-+};
-+
-+static struct glamo_mmc_platform_data gta02_glamo_mmc_pdata = {
-+	.glamo_mmc_use_slow = gta02_glamo_mci_use_slow,
-+};
-+
-+static struct glamo_gpio_platform_data gta02_glamo_gpio_pdata = {
-+	.base = GTA02_GPIO_GLAMO_BASE,
-+};
-+
-+static struct glamo_platform_data gta02_glamo_pdata = {
-+	.fb_data    = &gta02_glamo_fb_pdata,
-+	.mmc_data   = &gta02_glamo_mmc_pdata,
-+	.gpio_data  = &gta02_glamo_gpio_pdata,
-+
-+	.osci_clock_rate = 32768,
-+
-+	.glamo_external_reset = gta02_glamo_external_reset,
-+};
-+
-+/* JBT6k74 display controller */
-+static void gta02_jbt6k74_probe_completed(struct device *dev)
-+{
-+	pcf50633_bl_set_brightness_limit(gta02_pcf, 0x3f);
-+}
-+
-+const static struct jbt6k74_platform_data jbt6k74_pdata = {
-+	.gpio_reset = GTA02_GPIO_GLAMO(4),
-+};
-+
-+static struct spi_board_info gta02_spi_board_info[] = {
-+	{
-+		.modalias	= "jbt6k74",
-+		.platform_data	= &jbt6k74_pdata,
-+		.controller_data = (void *)GTA02_GPIO_GLAMO(12),
-+		/* irq */
-+		.max_speed_hz	= 100 * 1000,
-+		.bus_num	= 2,
-+		.chip_select	= 0
-+	},
-+};
-+
-+static struct resource gta02_glamo_resources[] = {
-+	[0] = {
-+		.start	= S3C2410_CS1,
-+		.end	= S3C2410_CS1 + 0x1000000 - 1,
-+		.flags	= IORESOURCE_MEM,
-+	},
-+	[1] = {
-+		.start	= GTA02_IRQ_3D,
-+		.end	= GTA02_IRQ_3D,
-+		.flags	= IORESOURCE_IRQ,
-+	},
-+};
-+
-+static struct platform_device gta02_glamo_dev = {
-+	.name		= "glamo3362",
-+	.num_resources	= ARRAY_SIZE(gta02_glamo_resources),
-+	.resource	= gta02_glamo_resources,
-+	.dev		= {
-+		.platform_data	= &gta02_glamo_pdata,
-+	},
-+};
-+
-+
- #ifdef CONFIG_CHARGER_PCF50633
- /*
-  * On GTA02 the 1A charger features a 48K resistor to 0V on the ID pin.
-@@ -159,22 +354,28 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
- #define ADC_NOM_CHG_DETECT_1A 6
- #define ADC_NOM_CHG_DETECT_USB 43
- 
--static void
--gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
-+static int gta02_get_charger_online_status(void)
- {
--	int  ma;
-+	struct pcf50633 *pcf = gta02_pcf;
- 
--	/* Interpret charger type */
--	if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2)) {
-+	return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ONLINE;
-+}
- 
--		/*
--		 * Sanity - stop GPO driving out now that we have a 1A charger
--		 * GPO controls USB Host power generation on GTA02
--		 */
--		pcf50633_gpio_set(pcf, PCF50633_GPO, 0);
-+static int gta02_get_charger_active_status(void)
-+{
-+	struct pcf50633 *pcf = gta02_pcf;
-+
-+	return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ACTIVE;
-+}
-+
-+static void
-+gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
-+{
-+	int ma;
- 
-+	if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2))
- 		ma = 1000;
--	} else
-+	else
- 		ma = 100;
- 
- 	pcf50633_mbc_usb_curlim_set(pcf, ma);
-@@ -235,6 +436,8 @@ static void gta02_udc_vbus_draw(unsigned int ma)
- #else /* !CONFIG_CHARGER_PCF50633 */
- #define gta02_pmu_event_callback	NULL
- #define gta02_udc_vbus_draw		NULL
-+#define gta02_get_charger_online_status	NULL
-+#define gta02_get_charger_active_status	NULL
- #endif
- 
- /*
-@@ -258,6 +461,32 @@ static struct pcf50633_bl_platform_data gta02_backlight_data = {
- 	.ramp_time = 5,
- };
- 
-+static struct regulator_consumer_supply ldo4_consumers[] = {
-+	{
-+		.dev = &gta02_pm_bt_dev.dev,
-+		.supply = "BT_3V2",
-+	},
-+};
-+
-+static struct regulator_consumer_supply ldo5_consumers[] = {
-+	{
-+		.dev = &gta02_pm_gps_dev.dev,
-+		.supply = "RF_3V",
-+	},
-+};
-+
-+static struct regulator_consumer_supply ldo6_consumers[] = {
-+	REGULATOR_SUPPLY("VDC", "spi2.0"),
-+	REGULATOR_SUPPLY("VDDIO", "spi2.0"),
-+};
-+
-+static struct regulator_consumer_supply hcldo_consumers[] = {
-+	{
-+		.dev = &gta02_glamo_dev.dev,
-+		.supply = "SD_3V3",
-+	},
-+};
-+
- struct pcf50633_platform_data gta02_pcf_pdata = {
- 	.resumers = {
- 		[0] =	PCF50633_INT1_USBINS |
-@@ -276,6 +505,7 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- 	.charger_reference_current_ma = 1000,
- 
- 	.backlight_data = &gta02_backlight_data,
-+	.gpio_base = GTA02_GPIO_PCF_BASE,
- 
- 	.reg_init_data = {
- 		[PCF50633_REGULATOR_AUTO] = {
-@@ -313,6 +543,8 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- 				.valid_ops_mask = REGULATOR_CHANGE_VOLTAGE |
- 						REGULATOR_CHANGE_STATUS,
- 			},
-+			.num_consumer_supplies = ARRAY_SIZE(hcldo_consumers),
-+			.consumer_supplies = hcldo_consumers,
- 		},
- 		[PCF50633_REGULATOR_LDO1] = {
- 			.constraints = {
-@@ -347,6 +579,8 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- 				.valid_ops_mask = REGULATOR_CHANGE_STATUS,
- 				.apply_uV = 1,
- 			},
-+			.num_consumer_supplies = ARRAY_SIZE(ldo4_consumers),
-+			.consumer_supplies = ldo4_consumers,
- 		},
- 		[PCF50633_REGULATOR_LDO5] = {
- 			.constraints = {
-@@ -356,13 +590,18 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- 				.valid_ops_mask = REGULATOR_CHANGE_STATUS,
- 				.apply_uV = 1,
- 			},
-+			.num_consumer_supplies = ARRAY_SIZE(ldo5_consumers),
-+			.consumer_supplies = ldo5_consumers,
- 		},
- 		[PCF50633_REGULATOR_LDO6] = {
- 			.constraints = {
- 				.min_uV = 3000000,
- 				.max_uV = 3000000,
- 				.valid_modes_mask = REGULATOR_MODE_NORMAL,
-+				.valid_ops_mask = REGULATOR_CHANGE_STATUS,
- 			},
-+			.num_consumer_supplies = ARRAY_SIZE(ldo6_consumers),
-+			.consumer_supplies = ldo6_consumers,
- 		},
- 		[PCF50633_REGULATOR_MEMLDO] = {
- 			.constraints = {
-@@ -403,7 +642,6 @@ static struct platform_device gta02_nor_flash = {
- 	.num_resources	= 1,
- };
- 
--
- struct platform_device s3c24xx_pwm_device = {
- 	.name		= "s3c24xx_pwm",
- 	.num_resources	= 0,
-@@ -449,6 +687,7 @@ static struct s3c2410_platform_nand __initdata gta02_nand_info = {
- 	.twrph1		= 15,
- 	.nr_sets	= ARRAY_SIZE(gta02_nand_sets),
- 	.sets		= gta02_nand_sets,
-+	.software_ecc	= 1,
- };
- 
- 
-@@ -506,6 +745,273 @@ static struct platform_device gta02_buttons_device = {
- 	},
- };
- 
-+/* LEDs */
-+static struct gpio_led gta02_gpio_leds[] = {
-+	{
-+		.name	= "gta02:red:aux",
-+		.gpio	= GTA02_GPIO_AUX_LED,
-+	},
-+};
-+
-+static struct gpio_led_platform_data gta02_gpio_leds_pdata = {
-+	.leds = gta02_gpio_leds,
-+	.num_leds = ARRAY_SIZE(gta02_gpio_leds),
-+};
-+
-+static struct platform_device gta02_leds_device = {
-+	.name = "leds-gpio",
-+	.id   = -1,
-+	.dev = {
-+		.platform_data = &gta02_gpio_leds_pdata,
-+	},
-+};
-+
-+static inline int gta02_pwm_to_gpio(int pwm_id)
-+{
-+	return S3C2410_GPB(pwm_id);
-+}
-+
-+static int gta02_pwm_led_init(struct device *dev, struct led_pwm *led)
-+{
-+	int ret;
-+	int gpio = gta02_pwm_to_gpio(led->pwm_id);
-+
-+	ret = gpio_request(gpio, dev_name(dev));
-+	if (ret)
-+		return ret;
-+
-+	gpio_direction_output(gpio, 0);
-+
-+	return 0;
-+}
-+
-+static enum led_brightness gta02_pwm_led_notify(struct device *dev,
-+	struct led_pwm *led, enum led_brightness brightness)
-+{
-+	int gpio = gta02_pwm_to_gpio(led->pwm_id);
-+
-+	if (brightness == led->max_brightness || brightness == 0) {
-+		s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
-+		gpio_set_value(gpio, brightness ? 1 : 0);
-+
-+		brightness = 0;
-+	} else {
-+		s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_SFN2);
-+	}
-+
-+	return brightness;
-+}
-+
-+static void gta02_pwm_led_exit(struct device *dev, struct led_pwm *led)
-+{
-+	gpio_free(gta02_pwm_to_gpio(led->pwm_id));
-+}
-+
-+static struct led_pwm gta02_pwm_leds[] = {
-+	{
-+		.name = "gta02:orange:power",
-+		.max_brightness = 0xff,
-+		.pwm_period_ns = 1000000,
-+		.pwm_id = 0,
-+	},
-+	{
-+		.name = "gta02:blue:power",
-+		.max_brightness = 0xff,
-+		.pwm_period_ns = 1000000,
-+		.pwm_id = 1,
-+	},
-+	{
-+		.name = "gta02::vibrator",
-+		.max_brightness = 0x3f,
-+		.pwm_period_ns = 60000000,
-+		.pwm_id = 3,
-+	}
-+};
-+
-+static struct led_pwm_platform_data gta02_pwm_leds_pdata = {
-+	.num_leds = ARRAY_SIZE(gta02_pwm_leds),
-+	.leds = gta02_pwm_leds,
-+
-+	.init = gta02_pwm_led_init,
-+	.notify = gta02_pwm_led_notify,
-+	.exit = gta02_pwm_led_exit,
-+};
-+
-+static struct platform_device gta02_pwm_leds_device = {
-+	.name	= "leds_pwm",
-+	.id	= -1,
-+	.dev = {
-+		.platform_data = &gta02_pwm_leds_pdata,
-+	}
-+};
-+
-+/* BQ27000 Battery */
-+
-+static struct bq27000_platform_data bq27000_pdata = {
-+	.read = hdq_read,
-+	.name = "battery",
-+};
-+
-+static struct platform_device bq27000_battery_device = {
-+	.name = "bq27000-battery",
-+	.dev = {
-+		.platform_data = &bq27000_pdata,
-+	},
-+};
-+
-+/* Platform battery */
-+
-+/* Capacity of a typical BL-5C dumb battery */
-+#define GTA02_BAT_CHARGE_FULL	850000
-+
-+static int gta02_bat_voltscale(int volt)
-+{
-+	/* This table is suggested by SpeedEvil based on analysis of
-+	 * experimental data */
-+	static const int lut[][2] = {
-+		{ 4120, 100 },
-+		{ 3900, 60 },
-+		{ 3740, 25 },
-+		{ 3600, 5 },
-+		{ 3000, 0 } };
-+	int i, res = 0;
-+
-+	if (volt > lut[0][0])
-+		res = lut[0][1];
-+	else
-+		for (i = 0; lut[i][1]; i++) {
-+			if (volt <= lut[i][0] && volt >= lut[i+1][0]) {
-+				res = lut[i][1] - (lut[i][0]-volt)*
-+					(lut[i][1]-lut[i+1][1])/
-+					(lut[i][0]-lut[i+1][0]);
-+				break;
-+			}
-+		}
-+	return res;
-+}
-+
-+static int gta02_bat_get_voltage(void)
-+{
-+	struct pcf50633 *pcf = gta02_pcf;
-+	u16 adc, mv = 0;
-+	adc = pcf50633_adc_sync_read(pcf,
-+		PCF50633_ADCC1_MUX_BATSNS_RES,
-+		PCF50633_ADCC1_AVERAGE_16);
-+	/* The formula from DS is for divide-by-two mode, current driver uses
-+	divide-by-three */
-+	mv = (adc * 6000) / 1023;
-+	return mv * 1000;
-+}
-+
-+static int gta02_bat_get_present(void)
-+{
-+	/* There is no reliable way to tell if it is present or not */
-+	return 1;
-+}
-+
-+static int gta02_bat_get_status(void)
-+{
-+#ifdef CONFIG_CHARGER_PCF50633
-+	if (gta02_get_charger_active_status())
-+		return POWER_SUPPLY_STATUS_CHARGING;
-+	else
-+		return POWER_SUPPLY_STATUS_DISCHARGING;
-+#else
-+	return POWER_SUPPLY_STATUS_UNKNOWN;
-+#endif
-+}
-+
-+static int gta02_bat_get_capacity(void)
-+{
-+	return gta02_bat_voltscale(gta02_bat_get_voltage()/1000);
-+}
-+
-+static int gta02_bat_get_charge_full(void)
-+{
-+	return GTA02_BAT_CHARGE_FULL;
-+}
-+
-+static int gta02_bat_get_charge_now(void)
-+{
-+	return gta02_bat_get_capacity() * gta02_bat_get_charge_full() / 100;
-+}
-+
-+static enum power_supply_property gta02_platform_bat_properties[] = {
-+	POWER_SUPPLY_PROP_PRESENT,
-+	POWER_SUPPLY_PROP_STATUS,
-+	POWER_SUPPLY_PROP_VOLTAGE_NOW,
-+	POWER_SUPPLY_PROP_CAPACITY,
-+	POWER_SUPPLY_PROP_CHARGE_FULL,
-+	POWER_SUPPLY_PROP_CHARGE_NOW,
-+};
-+
-+int (*gta02_platform_bat_get_property[])(void) = {
-+	gta02_bat_get_present,
-+	gta02_bat_get_status,
-+	gta02_bat_get_voltage,
-+	gta02_bat_get_capacity,
-+	gta02_bat_get_charge_full,
-+	gta02_bat_get_charge_now,
-+};
-+
-+static struct platform_bat_platform_data gta02_platform_bat_pdata = {
-+	.name = "battery",
-+	.properties = gta02_platform_bat_properties,
-+	.num_properties = ARRAY_SIZE(gta02_platform_bat_properties),
-+	.get_property = gta02_platform_bat_get_property,
-+	.is_present = gta02_bat_get_present,
-+};
-+
-+struct platform_device gta02_platform_bat = {
-+	.name = "platform_battery",
-+	.id = -1,
-+	.dev = {
-+		.platform_data = &gta02_platform_bat_pdata,
-+	}
-+};
-+
-+/* HDQ */
-+
-+static void gta02_hdq_gpio_direction_out(void)
-+{
-+	s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_OUTPUT);
-+}
-+
-+static void gta02_hdq_gpio_direction_in(void)
-+{
-+	s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_INPUT);
-+}
-+
-+static void gta02_hdq_gpio_set_value(int val)
-+{
-+	s3c2410_gpio_setpin(GTA02v5_GPIO_HDQ, val);
-+}
-+
-+static int gta02_hdq_gpio_get_value(void)
-+{
-+	return s3c2410_gpio_getpin(GTA02v5_GPIO_HDQ);
-+}
-+
-+struct hdq_platform_data gta02_hdq_platform_data = {
-+	.gpio_dir_out = gta02_hdq_gpio_direction_out,
-+	.gpio_dir_in = gta02_hdq_gpio_direction_in,
-+	.gpio_set = gta02_hdq_gpio_set_value,
-+	.gpio_get = gta02_hdq_gpio_get_value,
-+
-+	.enable_fiq = gta02_fiq_enable,
-+	.disable_fiq = gta02_fiq_disable,
-+	.kick_fiq = gta02_fiq_kick,
-+};
-+
-+struct platform_device gta02_hdq_device = {
-+	.name		= "hdq",
-+	.id		= -1,
-+	.dev		= {
-+		.platform_data = &gta02_hdq_platform_data,
-+		.parent = &s3c_device_timer[2].dev,
-+	},
-+};
-+
- static void __init gta02_map_io(void)
- {
- 	s3c24xx_init_io(gta02_iodesc, ARRAY_SIZE(gta02_iodesc));
-@@ -523,19 +1029,30 @@ static struct platform_device *gta02_devices[] __initdata = {
- 	&s3c_device_usbgadget,
- 	&s3c_device_nand,
- 	&gta02_nor_flash,
--	&s3c24xx_pwm_device,
-+	&s3c_device_timer[0],
-+	&s3c_device_timer[1],
-+	&s3c_device_timer[2],
-+	&s3c_device_timer[3],
- 	&s3c_device_iis,
- 	&samsung_asoc_dma,
- 	&s3c_device_i2c0,
- 	&gta02_dfbmcs320_device,
- 	&gta02_buttons_device,
-+	&gta02_leds_device,
-+	&gta02_pwm_leds_device,
- 	&s3c_device_adc,
- 	&s3c_device_ts,
-+	&gta02_pm_bt_dev,
-+	&gta02_pm_gps_dev,
-+	&gta02_pm_wlan_dev,
-+	&gta02_glamo_dev,
- };
- 
- /* These guys DO need to be children of PMU. */
- 
- static struct platform_device *gta02_devices_pmu_children[] = {
-+	&gta02_hdq_device,
-+	&gta02_platform_bat,
- };
- 
- 
-@@ -568,11 +1085,118 @@ static void gta02_poweroff(void)
- 	pcf50633_reg_set_bit_mask(gta02_pcf, PCF50633_REG_OOCSHDWN, 1, 1);
- }
- 
-+struct gta02_device_children {
-+	const char *dev_name;
-+	size_t num_children;
-+	struct platform_device **children;
-+	void (*probed_callback)(struct device *dev);
-+};
-+
-+static struct platform_device *gta02_glamo_gpio_children[] = {
-+	&spigpio_device,
-+};
-+
-+static struct platform_device *gta02_pcf50633_gpio_children[] = {
-+	&gta02_gsm_supply_device,
-+};
-+
-+static struct platform_device *gta02_gsm_supply_children[] = {
-+	&gta02_pm_gsm_dev,
-+};
-+
-+static struct platform_device *gta02_hdq_children[] = {
-+	&bq27000_battery_device,
-+};
-+
-+
-+static struct gta02_device_children gta02_device_children[] = {
-+ 	{
-+		.dev_name = "glamo-gpio.0",
-+		.num_children = ARRAY_SIZE(gta02_glamo_gpio_children),
-+		.children = gta02_glamo_gpio_children,
-+	},
-+	{
-+		.dev_name = "pcf50633-gpio",
-+		.num_children = 1,
-+		.children = gta02_pcf50633_gpio_children,
-+	},
-+	{
-+		.dev_name = "reg-fixed-voltage.1",
-+		.num_children = 1,
-+		.children = gta02_gsm_supply_children,
-+	},
-+	{
-+		.dev_name = "spi2.0",
-+		.probed_callback = gta02_jbt6k74_probe_completed,
-+	},
-+	{
-+		.dev_name = "hdq",
-+		.num_children = 1,
-+		.children = gta02_hdq_children,
-+	},
-+};
-+
-+static int gta02_add_child_devices(struct device *parent,
-+		struct platform_device **children, size_t num_children)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < num_children; ++i)
-+		children[i]->dev.parent = parent;
-+
-+	return platform_add_devices(children, num_children);
-+}
-+
-+static int gta02_device_registered(struct notifier_block *block,
-+		unsigned long action, void *data)
-+{
-+	struct device *dev = data;
-+	const char *devname = dev_name(dev);
-+	size_t i;
-+
-+	if (action != BUS_NOTIFY_BOUND_DRIVER)
-+		return 0;
-+
-+	for (i = 0; i < ARRAY_SIZE(gta02_device_children); ++i) {
-+		if (strcmp(devname, gta02_device_children[i].dev_name) == 0) {
-+			gta02_add_child_devices(dev, gta02_device_children[i].children,
-+			gta02_device_children[i].num_children);
-+
-+			if (gta02_device_children[i].probed_callback)
-+				gta02_device_children[i].probed_callback(dev);
-+			break;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static struct notifier_block gta02_device_register_notifier = {
-+	.notifier_call = gta02_device_registered,
-+	.priority = INT_MAX,
-+};
-+
-+
-+/*
-+ * Allow the bootloader to enable hw ecc
-+ * hardware_ecc=1|0
-+ */
-+static int __init hardware_ecc_setup(char *str)
-+{
-+	if (str && str[0] == '1')
-+		gta02_nand_info.software_ecc = 0;
-+	return 1;
-+}
-+__setup("hardware_ecc=", hardware_ecc_setup);
-+
- static void __init gta02_machine_init(void)
- {
- 	/* Set the panic callback to turn AUX LED on or off. */
- 	panic_blink = gta02_panic_blink;
- 
-+	bus_register_notifier(&platform_bus_type, &gta02_device_register_notifier);
-+	bus_register_notifier(&spi_bus_type, &gta02_device_register_notifier);
-+
- 	s3c_pm_init();
- 
- #ifdef CONFIG_CHARGER_PCF50633
-@@ -584,10 +1208,13 @@ static void __init gta02_machine_init(void)
- 	s3c_ohci_set_platdata(&gta02_usb_info);
- 	s3c_nand_set_platdata(&gta02_nand_info);
- 	s3c_i2c0_set_platdata(NULL);
-+	spi_register_board_info(gta02_spi_board_info,
-+				ARRAY_SIZE(gta02_spi_board_info));
- 
- 	i2c_register_board_info(0, gta02_i2c_devs, ARRAY_SIZE(gta02_i2c_devs));
- 
- 	platform_add_devices(gta02_devices, ARRAY_SIZE(gta02_devices));
-+
- 	pm_power_off = gta02_poweroff;
- 
- 	regulator_has_full_constraints();
-diff --git a/arch/arm/plat-s3c24xx/gpiolib.c b/arch/arm/plat-s3c24xx/gpiolib.c
-index 243b641..72fa584 100644
---- a/arch/arm/plat-s3c24xx/gpiolib.c
-+++ b/arch/arm/plat-s3c24xx/gpiolib.c
-@@ -217,6 +217,8 @@ static __init int s3c24xx_gpiolib_init(void)
- 	int gpn;
- 
- 	for (gpn = 0; gpn < ARRAY_SIZE(s3c24xx_gpios); gpn++, chip++) {
-+		if (chip->chip.base >= S3C_GPIO_END)
-+			break;
- 		if (!chip->config)
- 			chip->config = &s3c24xx_gpiocfg_default;
- 
-diff --git a/arch/arm/plat-s3c24xx/include/plat/irq.h b/arch/arm/plat-s3c24xx/include/plat/irq.h
-index ec087d6..3256861 100644
---- a/arch/arm/plat-s3c24xx/include/plat/irq.h
-+++ b/arch/arm/plat-s3c24xx/include/plat/irq.h
-@@ -12,6 +12,7 @@
- 
- #include <linux/io.h>
- 
-+#include <mach/irqs.h>
- #include <mach/hardware.h>
- #include <mach/regs-irq.h>
- #include <mach/regs-gpio.h>
-@@ -31,8 +32,15 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
- {
- 	unsigned long mask;
- 	unsigned long submask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	unsigned long flags;
-+#endif
- 
- 	submask = __raw_readl(S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+#endif
- 	mask = __raw_readl(S3C2410_INTMSK);
- 
- 	submask |= (1UL << (irqno - IRQ_S3CUART_RX0));
-@@ -45,6 +53,9 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
- 
- 	/* write back masks */
- 	__raw_writel(submask, S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_irq_restore(flags);
-+#endif
- 
- }
- 
-@@ -53,8 +64,15 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
- {
- 	unsigned long mask;
- 	unsigned long submask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	unsigned long flags;
-+#endif
- 
- 	submask = __raw_readl(S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+#endif
- 	mask = __raw_readl(S3C2410_INTMSK);
- 
- 	submask &= ~(1UL << (irqno - IRQ_S3CUART_RX0));
-@@ -63,6 +81,9 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
- 	/* write back masks */
- 	__raw_writel(submask, S3C2410_INTSUBMSK);
- 	__raw_writel(mask, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_irq_restore(flags);
-+#endif
- }
- 
- 
-diff --git a/arch/arm/plat-s3c24xx/irq.c b/arch/arm/plat-s3c24xx/irq.c
-index 9aee7e1..1317f04 100644
---- a/arch/arm/plat-s3c24xx/irq.c
-+++ b/arch/arm/plat-s3c24xx/irq.c
-@@ -28,6 +28,8 @@
- #include <asm/mach/irq.h>
- 
- #include <plat/regs-irqtype.h>
-+#include <mach/regs-irq.h>
-+#include <mach/regs-gpio.h>
- 
- #include <plat/cpu.h>
- #include <plat/pm.h>
-@@ -39,9 +41,20 @@ s3c_irq_mask(struct irq_data *data)
- 	unsigned int irqno = data->irq - IRQ_EINT0;
- 	unsigned long mask;
- 
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	unsigned long flags;
-+
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+#endif
-+
- 	mask = __raw_readl(S3C2410_INTMSK);
- 	mask |= 1UL << irqno;
- 	__raw_writel(mask, S3C2410_INTMSK);
-+
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_irq_restore(flags);
-+#endif
- }
- 
- static inline void
-@@ -58,9 +71,19 @@ s3c_irq_maskack(struct irq_data *data)
- {
- 	unsigned long bitval = 1UL << (data->irq - IRQ_EINT0);
- 	unsigned long mask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	unsigned long flags;
-+#endif
- 
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+#endif
- 	mask = __raw_readl(S3C2410_INTMSK);
- 	__raw_writel(mask|bitval, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_irq_restore(flags);
-+#endif
- 
- 	__raw_writel(bitval, S3C2410_SRCPND);
- 	__raw_writel(bitval, S3C2410_INTPND);
-@@ -72,15 +95,25 @@ s3c_irq_unmask(struct irq_data *data)
- {
- 	unsigned int irqno = data->irq;
- 	unsigned long mask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	unsigned long flags;
-+#endif
- 
- 	if (irqno != IRQ_TIMER4 && irqno != IRQ_EINT8t23)
- 		irqdbf2("s3c_irq_unmask %d\n", irqno);
- 
- 	irqno -= IRQ_EINT0;
- 
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_save_flags(flags);
-+	local_fiq_disable();
-+#endif
- 	mask = __raw_readl(S3C2410_INTMSK);
- 	mask &= ~(1UL << irqno);
- 	__raw_writel(mask, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+	local_irq_restore(flags);
-+#endif
- }
- 
- struct irq_chip s3c_irq_level_chip = {
-@@ -553,26 +586,26 @@ void __init s3c24xx_init_irq(void)
- 
- 	last = 0;
- 	for (i = 0; i < 4; i++) {
--		pend = __raw_readl(S3C2410_INTPND);
-+		pend = __raw_readl(S3C2410_SUBSRCPND);
- 
- 		if (pend == 0 || pend == last)
- 			break;
- 
--		__raw_writel(pend, S3C2410_SRCPND);
--		__raw_writel(pend, S3C2410_INTPND);
--		printk("irq: clearing pending status %08x\n", (int)pend);
-+		printk("irq: clearing subpending status %08x\n", (int)pend);
-+		__raw_writel(pend, S3C2410_SUBSRCPND);
- 		last = pend;
- 	}
- 
- 	last = 0;
- 	for (i = 0; i < 4; i++) {
--		pend = __raw_readl(S3C2410_SUBSRCPND);
-+		pend = __raw_readl(S3C2410_INTPND);
- 
- 		if (pend == 0 || pend == last)
- 			break;
- 
--		printk("irq: clearing subpending status %08x\n", (int)pend);
--		__raw_writel(pend, S3C2410_SUBSRCPND);
-+		__raw_writel(pend, S3C2410_SRCPND);
-+		__raw_writel(pend, S3C2410_INTPND);
-+		printk("irq: clearing pending status %08x\n", (int)pend);
- 		last = pend;
- 	}
- 
-@@ -624,14 +657,14 @@ void __init s3c24xx_init_irq(void)
- 	for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
- 		irqdbf("registering irq %d (ext int)\n", irqno);
- 		irq_set_chip_and_handler(irqno, &s3c_irq_eint0t4,
--					 handle_edge_irq);
-+					 handle_level_irq);
- 		set_irq_flags(irqno, IRQF_VALID);
- 	}
- 
- 	for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
- 		irqdbf("registering irq %d (extended s3c irq)\n", irqno);
- 		irq_set_chip_and_handler(irqno, &s3c_irqext_chip,
--					 handle_edge_irq);
-+					 handle_level_irq);
- 		set_irq_flags(irqno, IRQF_VALID);
- 	}
- 
-diff --git a/arch/arm/plat-samsung/include/plat/nand.h b/arch/arm/plat-samsung/include/plat/nand.h
-index b64115f..cbdc8f0 100644
---- a/arch/arm/plat-samsung/include/plat/nand.h
-+++ b/arch/arm/plat-samsung/include/plat/nand.h
-@@ -49,6 +49,7 @@ struct s3c2410_platform_nand {
- 	int	twrph1;	/* time for release CLE/ALE from nWE/nOE inactive */
- 
- 	unsigned int	ignore_unset_ecc:1;
-+	unsigned int	software_ecc:1; /* force software ecc at runtime */
- 
- 	int			nr_sets;
- 	struct s3c2410_nand_set *sets;
-diff --git a/drivers/Kconfig b/drivers/Kconfig
-index 177c7d1..14e9dd6 100644
---- a/drivers/Kconfig
-+++ b/drivers/Kconfig
-@@ -116,6 +116,8 @@ source "drivers/staging/Kconfig"
- 
- source "drivers/platform/Kconfig"
- 
-+source "drivers/ar6000/Kconfig"
-+
- source "drivers/clk/Kconfig"
- 
- source "drivers/hwspinlock/Kconfig"
-diff --git a/drivers/Makefile b/drivers/Makefile
-index 3f135b6..1077025 100644
---- a/drivers/Makefile
-+++ b/drivers/Makefile
-@@ -95,6 +95,7 @@ obj-$(CONFIG_CPU_IDLE)		+= cpuidle/
- obj-$(CONFIG_DMA_ENGINE)	+= dma/
- obj-$(CONFIG_MMC)		+= mmc/
- obj-$(CONFIG_MEMSTICK)		+= memstick/
-+obj-$(CONFIG_AR6000_WLAN)	+= ar6000/
- obj-$(CONFIG_NEW_LEDS)		+= leds/
- obj-$(CONFIG_INFINIBAND)	+= infiniband/
- obj-$(CONFIG_SGI_SN)		+= sn/
-diff --git a/drivers/ar6000/Kconfig b/drivers/ar6000/Kconfig
-new file mode 100644
-index 0000000..29b28b8
---- /dev/null
-+++ b/drivers/ar6000/Kconfig
-@@ -0,0 +1,32 @@
-+config AR6000_WLAN
-+	tristate "AR6000 wireless networking over SDIO"
-+	depends on MMC
-+	select WIRELESS_EXT
-+	select WEXT_PRIV
-+	default m
-+	help
-+	  good luck.
-+
-+config AR6000_WLAN_DEBUG
-+	bool "Enable retrieval of firmware debugging information"
-+	depends on AR6000_WLAN
-+	default n
-+	help
-+	  The AR6k firmware maintains a log of debugging events that
-+	  gets flushed to the host on various occasions. Retrieval of
-+	  this data is very slow, taking several seconds.
-+
-+	  If in doubt, say N.
-+
-+config AR6000_WLAN_RESET
-+	bool "Soft-reset when shutting down"
-+	depends on AR6000_WLAN
-+	default n
-+	help
-+	  The AR6k module can be explicitly reset when shutting down
-+	  the device. This adds a delay of about two seconds to suspend,
-+	  module removal, and so on. Since the WLAN SDIO function is
-+	  generally disabled soon thereafter anyway, this reset seems
-+	  superfluous.
-+
-+	  If in doubt, say N.
-diff --git a/drivers/ar6000/Makefile b/drivers/ar6000/Makefile
-new file mode 100644
-index 0000000..f8f4431
---- /dev/null
-+++ b/drivers/ar6000/Makefile
-@@ -0,0 +1,38 @@
-+REV ?= 2
-+
-+PWD := $(shell pwd)
-+
-+EXTRA_CFLAGS += -I$(src)/include
-+
-+EXTRA_CFLAGS += -DLINUX -D__KERNEL__ -DHTC_RAW_INTERFACE\
-+                -DTCMD -DUSER_KEYS \
-+                -DNO_SYNC_FLUSH #\
-+                -DMULTIPLE_FRAMES_PER_INTERRUPT -DAR6000REV$(REV) \
-+                -DBLOCK_TX_PATH_FLAG \
-+		-DSDIO \
-+
-+EXTRA_CFLAGS += -DKERNEL_2_6
-+
-+obj-$(CONFIG_AR6000_WLAN) += ar6000.o
-+
-+ar6000-objs += htc/ar6k.o      		   \
-+	       htc/ar6k_events.o 	   \
-+               htc/htc_send.o       	   \
-+               htc/htc_recv.o       	   \
-+               htc/htc_services.o          \
-+               htc/htc.o     		   \
-+               hif/hif2.o     		   \
-+               bmi/bmi.o                   \
-+               ar6000/ar6000_drv.o         \
-+               ar6000/ar6000_raw_if.o	   \
-+               ar6000/netbuf.o		   \
-+               ar6000/wireless_ext.o	   \
-+               ar6000/ioctl.o		   \
-+               miscdrv/common_drv.o	   \
-+               miscdrv/credit_dist.o	   \
-+               wmi/wmi.o                   \
-+               wlan/wlan_node.o            \
-+               wlan/wlan_recv_beacon.o     \
-+               wlan/wlan_utils.o
-+
-+
-diff --git a/drivers/ar6000/ar6000/ar6000_drv.c b/drivers/ar6000/ar6000/ar6000_drv.c
-new file mode 100644
-index 0000000..90533ab
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_drv.c
-@@ -0,0 +1,3129 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+/*
-+ * This driver is a pseudo ethernet driver to access the Atheros AR6000
-+ * WLAN Device
-+ */
-+static const char athId[] __attribute__ ((unused)) = "$Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/ar6000_drv.c#2 $";
-+
-+#include "ar6000_drv.h"
-+#include "htc.h"
-+
-+MODULE_LICENSE("GPL and additional rights");
-+
-+#ifndef REORG_APTC_HEURISTICS
-+#undef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+#endif /* REORG_APTC_HEURISTICS */
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+#define APTC_TRAFFIC_SAMPLING_INTERVAL     100  /* msec */
-+#define APTC_UPPER_THROUGHPUT_THRESHOLD    3000 /* Kbps */
-+#define APTC_LOWER_THROUGHPUT_THRESHOLD    2000 /* Kbps */
-+
-+typedef struct aptc_traffic_record {
-+    A_BOOL timerScheduled;
-+    struct timeval samplingTS;
-+    unsigned long bytesReceived;
-+    unsigned long bytesTransmitted;
-+} APTC_TRAFFIC_RECORD;
-+
-+A_TIMER aptcTimer;
-+APTC_TRAFFIC_RECORD aptcTR;
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+unsigned int bypasswmi = 0;
-+unsigned int debuglevel = 0;
-+int tspecCompliance = 1;
-+unsigned int busspeedlow = 0;
-+unsigned int onebitmode = 0;
-+unsigned int skipflash = 0;
-+unsigned int wmitimeout = 2;
-+unsigned int wlanNodeCaching = 1;
-+unsigned int enableuartprint = 0;
-+unsigned int logWmiRawMsgs = 0;
-+unsigned int enabletimerwar = 0;
-+unsigned int mbox_yield_limit = 99;
-+int reduce_credit_dribble = 1 + HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF;
-+int allow_trace_signal = 0;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+unsigned int testmode =0;
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(bypasswmi, int, 0644);
-+module_param(debuglevel, int, 0644);
-+module_param(tspecCompliance, int, 0644);
-+module_param(onebitmode, int, 0644);
-+module_param(busspeedlow, int, 0644);
-+module_param(skipflash, int, 0644);
-+module_param(wmitimeout, int, 0644);
-+module_param(wlanNodeCaching, int, 0644);
-+module_param(logWmiRawMsgs, int, 0644);
-+module_param(enableuartprint, int, 0644);
-+module_param(enabletimerwar, int, 0644);
-+module_param(mbox_yield_limit, int, 0644);
-+module_param(reduce_credit_dribble, int, 0644);
-+module_param(allow_trace_signal, int, 0644);
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+module_param(testmode, int, 0644);
-+#endif
-+#else
-+
-+#define __user
-+/* for linux 2.4 and lower */
-+MODULE_PARM(bypasswmi,"i");
-+MODULE_PARM(debuglevel, "i");
-+MODULE_PARM(onebitmode,"i");
-+MODULE_PARM(busspeedlow, "i");
-+MODULE_PARM(skipflash, "i");
-+MODULE_PARM(wmitimeout, "i");
-+MODULE_PARM(wlanNodeCaching, "i");
-+MODULE_PARM(enableuartprint,"i");
-+MODULE_PARM(logWmiRawMsgs, "i");
-+MODULE_PARM(enabletimerwar,"i");
-+MODULE_PARM(mbox_yield_limit,"i");
-+MODULE_PARM(reduce_credit_dribble,"i");
-+MODULE_PARM(allow_trace_signal,"i");
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+MODULE_PARM(testmode, "i");
-+#endif
-+#endif
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
-+/* in 2.6.10 and later this is now a pointer to a uint */
-+unsigned int _mboxnum = HTC_MAILBOX_NUM_MAX;
-+#define mboxnum &_mboxnum
-+#else
-+unsigned int mboxnum = HTC_MAILBOX_NUM_MAX;
-+#endif
-+
-+#ifdef CONFIG_AR6000_WLAN_RESET
-+unsigned int resetok = 1;
-+#else
-+unsigned int resetok = 0;
-+#endif
-+
-+#ifdef DEBUG
-+A_UINT32 g_dbg_flags = DBG_DEFAULTS;
-+unsigned int debugflags = 0;
-+int debugdriver = 1;
-+unsigned int debughtc = 128;
-+unsigned int debugbmi = 1;
-+unsigned int debughif = 2;
-+unsigned int txcreditsavailable[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditsconsumed[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditintrenable[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditintrenableaggregate[HTC_MAILBOX_NUM_MAX] = {0};
-+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(debugflags, int, 0644);
-+module_param(debugdriver, int, 0644);
-+module_param(debughtc, int, 0644);
-+module_param(debugbmi, int, 0644);
-+module_param(debughif, int, 0644);
-+module_param(resetok, int, 0644);
-+module_param_array(txcreditsavailable, int, mboxnum, 0644);
-+module_param_array(txcreditsconsumed, int, mboxnum, 0644);
-+module_param_array(txcreditintrenable, int, mboxnum, 0644);
-+module_param_array(txcreditintrenableaggregate, int, mboxnum, 0644);
-+#else
-+/* linux 2.4 and lower */
-+MODULE_PARM(debugflags,"i");
-+MODULE_PARM(debugdriver, "i");
-+MODULE_PARM(debughtc, "i");
-+MODULE_PARM(debugbmi, "i");
-+MODULE_PARM(debughif, "i");
-+MODULE_PARM(resetok, "i");
-+MODULE_PARM(txcreditsavailable, "0-3i");
-+MODULE_PARM(txcreditsconsumed, "0-3i");
-+MODULE_PARM(txcreditintrenable, "0-3i");
-+MODULE_PARM(txcreditintrenableaggregate, "0-3i");
-+#endif
-+
-+#endif /* DEBUG */
-+
-+unsigned int tx_attempt[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int tx_post[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int tx_complete[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int hifBusRequestNumMax = 40;
-+unsigned int war23838_disabled = 0;
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+unsigned int enableAPTCHeuristics = 1;
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param_array(tx_attempt, int, mboxnum, 0644);
-+module_param_array(tx_post, int, mboxnum, 0644);
-+module_param_array(tx_complete, int, mboxnum, 0644);
-+module_param(hifBusRequestNumMax, int, 0644);
-+module_param(war23838_disabled, int, 0644);
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+module_param(enableAPTCHeuristics, int, 0644);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#else
-+MODULE_PARM(tx_attempt, "0-3i");
-+MODULE_PARM(tx_post, "0-3i");
-+MODULE_PARM(tx_complete, "0-3i");
-+MODULE_PARM(hifBusRequestNumMax, "i");
-+MODULE_PARM(war23838_disabled, "i");
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+MODULE_PARM(enableAPTCHeuristics, "i");
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#endif
-+
-+#ifdef BLOCK_TX_PATH_FLAG
-+int blocktx = 0;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(blocktx, int, 0644);
-+#else
-+MODULE_PARM(blocktx, "i");
-+#endif
-+#endif /* BLOCK_TX_PATH_FLAG */
-+
-+// TODO move to arsoft_c
-+USER_RSSI_THOLD rssi_map[12];
-+
-+int reconnect_flag = 0;
-+
-+DECLARE_WAIT_QUEUE_HEAD(ar6000_scan_queue);
-+
-+/* Function declarations */
-+static int ar6000_init_module(void);
-+static void ar6000_cleanup_module(void);
-+
-+int ar6000_init(struct net_device *dev);
-+static int ar6000_open(struct net_device *dev);
-+static int ar6000_close(struct net_device *dev);
-+static int ar6000_cleanup(struct net_device *dev);
-+static void ar6000_init_control_info(AR_SOFTC_T *ar);
-+static int ar6000_data_tx(struct sk_buff *skb, struct net_device *dev);
-+
-+static void ar6000_destroy(struct net_device *dev, unsigned int unregister);
-+static void ar6000_detect_error(unsigned long ptr);
-+static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
-+static struct iw_statistics *ar6000_get_iwstats(struct net_device * dev);
-+
-+/*
-+ * HTC service connection handlers
-+ */
-+static void ar6000_avail_ev(HTC_HANDLE HTCHandle);
-+
-+static void ar6000_unavail_ev(void *Instance);
-+
-+static void ar6000_target_failure(void *Instance, A_STATUS Status);
-+
-+static void ar6000_rx(void *Context, HTC_PACKET *pPacket);
-+
-+static void ar6000_rx_refill(void *Context,HTC_ENDPOINT_ID Endpoint);
-+
-+static void ar6000_tx_complete(void *Context, HTC_PACKET *pPacket);
-+
-+static void ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint);
-+
-+static void ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint);
-+
-+/*
-+ * Static variables
-+ */
-+
-+static struct net_device *ar6000_devices[MAX_AR6000];
-+extern struct iw_handler_def ath_iw_handler_def;
-+DECLARE_WAIT_QUEUE_HEAD(arEvent);
-+static void ar6000_cookie_init(AR_SOFTC_T *ar);
-+static void ar6000_cookie_cleanup(AR_SOFTC_T *ar);
-+static void ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie);
-+static struct ar_cookie *ar6000_alloc_cookie(AR_SOFTC_T *ar);
-+static void ar6000_TxDataCleanup(AR_SOFTC_T *ar);
-+
-+#ifdef USER_KEYS
-+static A_STATUS ar6000_reinstall_keys(AR_SOFTC_T *ar,A_UINT8 key_op_ctrl);
-+#endif
-+
-+
-+static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
-+
-+#define HOST_INTEREST_ITEM_ADDRESS(ar, item)    \
-+((ar->arTargetType == TARGET_TYPE_AR6001) ?     \
-+   AR6001_HOST_INTEREST_ITEM_ADDRESS(item) :    \
-+   AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
-+
-+
-+/* Debug log support */
-+
-+/*
-+ * Flag to govern whether the debug logs should be parsed in the kernel
-+ * or reported to the application.
-+ */
-+#ifdef DEBUG
-+#define REPORT_DEBUG_LOGS_TO_APP
-+#endif
-+
-+A_STATUS
-+ar6000_set_host_app_area(AR_SOFTC_T *ar)
-+{
-+    A_UINT32 address, data;
-+    struct host_app_area_s host_app_area;
-+
-+    /* Fetch the address of the host_app_area_s instance in the host interest area */
-+    address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_app_host_interest);
-+    if (ar6000_ReadRegDiag(ar->arHifDevice, &address, &data) != A_OK) {
-+        return A_ERROR;
-+    }
-+    address = data;
-+    host_app_area.wmi_protocol_ver = WMI_PROTOCOL_VERSION;
-+    if (ar6000_WriteDataDiag(ar->arHifDevice, address,
-+                             (A_UCHAR *)&host_app_area,
-+                             sizeof(struct host_app_area_s)) != A_OK)
-+    {
-+        return A_ERROR;
-+    }
-+
-+    return A_OK;
-+}
-+
-+A_UINT32
-+dbglog_get_debug_hdr_ptr(AR_SOFTC_T *ar)
-+{
-+    A_UINT32 param;
-+    A_UINT32 address;
-+    A_STATUS status;
-+
-+    address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_dbglog_hdr);
-+    if ((status = ar6000_ReadDataDiag(ar->arHifDevice, address,
-+                                      (A_UCHAR *)&param, 4)) != A_OK)
-+    {
-+        param = 0;
-+    }
-+
-+    return param;
-+}
-+
-+/*
-+ * The dbglog module has been initialized. Its ok to access the relevant
-+ * data stuctures over the diagnostic window.
-+ */
-+void
-+ar6000_dbglog_init_done(AR_SOFTC_T *ar)
-+{
-+    ar->dbglog_init_done = TRUE;
-+}
-+
-+A_UINT32
-+dbglog_get_debug_fragment(A_INT8 *datap, A_UINT32 len, A_UINT32 limit)
-+{
-+    A_INT32 *buffer;
-+    A_UINT32 count;
-+    A_UINT32 numargs;
-+    A_UINT32 length;
-+    A_UINT32 fraglen;
-+
-+    count = fraglen = 0;
-+    buffer = (A_INT32 *)datap;
-+    length = (limit >> 2);
-+
-+    if (len <= limit) {
-+        fraglen = len;
-+    } else {
-+        while (count < length) {
-+            numargs = DBGLOG_GET_NUMARGS(buffer[count]);
-+            fraglen = (count << 2);
-+            count += numargs + 1;
-+        }
-+    }
-+
-+    return fraglen;
-+}
-+
-+void
-+dbglog_parse_debug_logs(A_INT8 *datap, A_UINT32 len)
-+{
-+    A_INT32 *buffer;
-+    A_UINT32 count;
-+    A_UINT32 timestamp;
-+    A_UINT32 debugid;
-+    A_UINT32 moduleid;
-+    A_UINT32 numargs;
-+    A_UINT32 length;
-+
-+    count = 0;
-+    buffer = (A_INT32 *)datap;
-+    length = (len >> 2);
-+    while (count < length) {
-+        debugid = DBGLOG_GET_DBGID(buffer[count]);
-+        moduleid = DBGLOG_GET_MODULEID(buffer[count]);
-+        numargs = DBGLOG_GET_NUMARGS(buffer[count]);
-+        timestamp = DBGLOG_GET_TIMESTAMP(buffer[count]);
-+        switch (numargs) {
-+            case 0:
-+            AR_DEBUG_PRINTF("%d %d (%d)\n", moduleid, debugid, timestamp);
-+            break;
-+
-+            case 1:
-+            AR_DEBUG_PRINTF("%d %d (%d): 0x%x\n", moduleid, debugid,
-+                            timestamp, buffer[count+1]);
-+            break;
-+
-+            case 2:
-+            AR_DEBUG_PRINTF("%d %d (%d): 0x%x, 0x%x\n", moduleid, debugid,
-+                            timestamp, buffer[count+1], buffer[count+2]);
-+            break;
-+
-+            default:
-+            AR_DEBUG_PRINTF("Invalid args: %d\n", numargs);
-+        }
-+        count += numargs + 1;
-+    }
-+}
-+
-+int
-+ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar)
-+{
-+    struct dbglog_hdr_s debug_hdr;
-+    struct dbglog_buf_s debug_buf;
-+    A_UINT32 address;
-+    A_UINT32 length;
-+    A_UINT32 dropped;
-+    A_UINT32 firstbuf;
-+    A_UINT32 debug_hdr_ptr;
-+
-+    if (!ar->dbglog_init_done) return A_ERROR;
-+
-+#ifndef CONFIG_AR6000_WLAN_DEBUG
-+    return 0;
-+#endif
-+
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    if (ar->dbgLogFetchInProgress) {
-+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+        return A_EBUSY;
-+    }
-+
-+        /* block out others */
-+    ar->dbgLogFetchInProgress = TRUE;
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    debug_hdr_ptr = dbglog_get_debug_hdr_ptr(ar);
-+    printk("debug_hdr_ptr: 0x%x\n", debug_hdr_ptr);
-+
-+    /* Get the contents of the ring buffer */
-+    if (debug_hdr_ptr) {
-+        address = debug_hdr_ptr;
-+        length = sizeof(struct dbglog_hdr_s);
-+        ar6000_ReadDataDiag(ar->arHifDevice, address,
-+                            (A_UCHAR *)&debug_hdr, length);
-+        address = (A_UINT32)debug_hdr.dbuf;
-+        firstbuf = address;
-+        dropped = debug_hdr.dropped;
-+        length = sizeof(struct dbglog_buf_s);
-+        ar6000_ReadDataDiag(ar->arHifDevice, address,
-+                            (A_UCHAR *)&debug_buf, length);
-+
-+        do {
-+            address = (A_UINT32)debug_buf.buffer;
-+            length = debug_buf.length;
-+            if ((length) && (debug_buf.length <= debug_buf.bufsize)) {
-+                /* Rewind the index if it is about to overrun the buffer */
-+                if (ar->log_cnt > (DBGLOG_HOST_LOG_BUFFER_SIZE - length)) {
-+                    ar->log_cnt = 0;
-+                }
-+                if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
-+                                    (A_UCHAR *)&ar->log_buffer[ar->log_cnt], length))
-+                {
-+                    break;
-+                }
-+                ar6000_dbglog_event(ar, dropped, &ar->log_buffer[ar->log_cnt], length);
-+                ar->log_cnt += length;
-+            } else {
-+                AR_DEBUG_PRINTF("Length: %d (Total size: %d)\n",
-+                                debug_buf.length, debug_buf.bufsize);
-+            }
-+
-+            address = (A_UINT32)debug_buf.next;
-+            length = sizeof(struct dbglog_buf_s);
-+            if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
-+                                (A_UCHAR *)&debug_buf, length))
-+            {
-+                break;
-+            }
-+
-+        } while (address != firstbuf);
-+    }
-+
-+    ar->dbgLogFetchInProgress = FALSE;
-+
-+    return A_OK;
-+}
-+
-+void
-+ar6000_dbglog_event(AR_SOFTC_T *ar, A_UINT32 dropped,
-+                    A_INT8 *buffer, A_UINT32 length)
-+{
-+#ifdef REPORT_DEBUG_LOGS_TO_APP
-+    #define MAX_WIRELESS_EVENT_SIZE 252
-+    /*
-+     * Break it up into chunks of MAX_WIRELESS_EVENT_SIZE bytes of messages.
-+     * There seems to be a limitation on the length of message that could be
-+     * transmitted to the user app via this mechanism.
-+     */
-+    A_UINT32 send, sent;
-+
-+    sent = 0;
-+    send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
-+                                     MAX_WIRELESS_EVENT_SIZE);
-+    while (send) {
-+        ar6000_send_event_to_app(ar, WMIX_DBGLOG_EVENTID, &buffer[sent], send);
-+        sent += send;
-+        send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
-+                                         MAX_WIRELESS_EVENT_SIZE);
-+    }
-+#else
-+    AR_DEBUG_PRINTF("Dropped logs: 0x%x\nDebug info length: %d\n",
-+                    dropped, length);
-+
-+    /* Interpret the debug logs */
-+    dbglog_parse_debug_logs(buffer, length);
-+#endif /* REPORT_DEBUG_LOGS_TO_APP */
-+}
-+
-+
-+
-+static int __init
-+ar6000_init_module(void)
-+{
-+    static int probed = 0;
-+    A_STATUS status;
-+    HTC_INIT_INFO initInfo;
-+
-+    A_MEMZERO(&initInfo,sizeof(initInfo));
-+    initInfo.AddInstance = ar6000_avail_ev;
-+    initInfo.DeleteInstance = ar6000_unavail_ev;
-+    initInfo.TargetFailure = ar6000_target_failure;
-+
-+
-+#ifdef DEBUG
-+    /* Set the debug flags if specified at load time */
-+    if(debugflags != 0)
-+    {
-+        g_dbg_flags = debugflags;
-+    }
-+#endif
-+
-+    if (probed) {
-+        return -ENODEV;
-+    }
-+    probed++;
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+    memset(&aptcTR, 0, sizeof(APTC_TRAFFIC_RECORD));
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+    ar6000_gpio_init();
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+    status = HTCInit(&initInfo);
-+    if(status != A_OK)
-+        return -ENODEV;
-+
-+    return 0;
-+}
-+
-+static void __exit
-+ar6000_cleanup_module(void)
-+{
-+    int i = 0;
-+    struct net_device *ar6000_netdev;
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+    /* Delete the Adaptive Power Control timer */
-+    if (timer_pending(&aptcTimer)) {
-+        del_timer_sync(&aptcTimer);
-+    }
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+    for (i=0; i < MAX_AR6000; i++) {
-+        if (ar6000_devices[i] != NULL) {
-+            ar6000_netdev = ar6000_devices[i];
-+            ar6000_devices[i] = NULL;
-+            ar6000_destroy(ar6000_netdev, 1);
-+        }
-+    }
-+
-+        /* shutting down HTC will cause the HIF layer to detach from the
-+         * underlying bus driver which will cause the subsequent deletion of
-+         * all HIF and HTC instances */
-+    HTCShutDown();
-+
-+    AR_DEBUG_PRINTF("ar6000_cleanup: success\n");
-+}
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+void
-+aptcTimerHandler(unsigned long arg)
-+{
-+    A_UINT32 numbytes;
-+    A_UINT32 throughput;
-+    AR_SOFTC_T *ar;
-+    A_STATUS status;
-+
-+    ar = (AR_SOFTC_T *)arg;
-+    A_ASSERT(ar != NULL);
-+    A_ASSERT(!timer_pending(&aptcTimer));
-+
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    /* Get the number of bytes transferred */
-+    numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
-+    aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
-+
-+    /* Calculate and decide based on throughput thresholds */
-+    throughput = ((numbytes * 8)/APTC_TRAFFIC_SAMPLING_INTERVAL); /* Kbps */
-+    if (throughput < APTC_LOWER_THROUGHPUT_THRESHOLD) {
-+        /* Enable Sleep and delete the timer */
-+        A_ASSERT(ar->arWmiReady == TRUE);
-+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+        status = wmi_powermode_cmd(ar->arWmi, REC_POWER);
-+        AR6000_SPIN_LOCK(&ar->arLock, 0);
-+        A_ASSERT(status == A_OK);
-+        aptcTR.timerScheduled = FALSE;
-+    } else {
-+        A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+}
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+
-+
-+/* set HTC block size, assume BMI is already initialized */
-+A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar)
-+{
-+    A_STATUS status;
-+    A_UINT32 blocksizes[HTC_MAILBOX_NUM_MAX];
-+
-+    do {
-+            /* get the block sizes */
-+        status = HIFConfigureDevice(ar->arHifDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+                                    blocksizes, sizeof(blocksizes));
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF("Failed to get block size info from HIF layer...\n");
-+            break;
-+        }
-+            /* note: we actually get the block size for mailbox 1, for SDIO the block
-+             * size on mailbox 0 is artificially set to 1 */
-+            /* must be a power of 2 */
-+        A_ASSERT((blocksizes[1] & (blocksizes[1] - 1)) == 0);
-+
-+            /* set the host interest area for the block size */
-+        status = BMIWriteMemory(ar->arHifDevice,
-+                                HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz),
-+                                (A_UCHAR *)&blocksizes[1],
-+                                4);
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF("BMIWriteMemory for IO block size failed \n");
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF("Block Size Set: %d (target address:0x%X)\n",
-+                blocksizes[1], HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz));
-+
-+            /* set the host interest area for the mbox ISR yield limit */
-+        status = BMIWriteMemory(ar->arHifDevice,
-+                                HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_isr_yield_limit),
-+                                (A_UCHAR *)&mbox_yield_limit,
-+                                4);
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF("BMIWriteMemory for yield limit failed \n");
-+            break;
-+        }
-+
-+    } while (FALSE);
-+
-+    return status;
-+}
-+
-+static void free_raw_buffers(AR_SOFTC_T *ar)
-+{
-+    int i, j;
-+
-+    for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
-+	for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++)
-+	    kfree(ar->raw_htc_read_buffer[i][j]);
-+	for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++)
-+	    kfree(ar->raw_htc_write_buffer[i][j]);
-+    }
-+}
-+
-+static int alloc_raw_buffers(AR_SOFTC_T *ar)
-+{
-+    int i, j;
-+    raw_htc_buffer *b;
-+
-+    for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
-+	for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++) {
-+	    b = kzalloc(sizeof(*b), GFP_KERNEL);
-+	    if (!b)
-+		return -ENOMEM;
-+	    ar->raw_htc_read_buffer[i][j] = b;
-+	}
-+	for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++) {
-+	    b = kzalloc(sizeof(*b), GFP_KERNEL);
-+	    if (!b)
-+		return -ENOMEM;
-+	    ar->raw_htc_write_buffer[i][j] = b;
-+	}
-+    }
-+    return 0;
-+}
-+
-+static const struct net_device_ops ar6000_netdev_ops = {
-+    .ndo_init = &ar6000_init,
-+    .ndo_open = &ar6000_open,
-+    .ndo_stop = &ar6000_close,
-+    .ndo_start_xmit = &ar6000_data_tx,
-+    .ndo_get_stats = &ar6000_get_stats,
-+    .ndo_do_ioctl = &ar6000_ioctl,
-+};
-+/*
-+ * HTC Event handlers
-+ */
-+static void
-+ar6000_avail_ev(HTC_HANDLE HTCHandle)
-+{
-+    int i;
-+    struct net_device *dev;
-+    AR_SOFTC_T *ar;
-+    int device_index = 0;
-+
-+    AR_DEBUG_PRINTF("ar6000_available\n");
-+
-+    for (i=0; i < MAX_AR6000; i++) {
-+        if (ar6000_devices[i] == NULL) {
-+            break;
-+        }
-+    }
-+
-+    if (i == MAX_AR6000) {
-+        AR_DEBUG_PRINTF("ar6000_available: max devices reached\n");
-+        return;
-+    }
-+
-+    /* Save this. It gives a bit better readability especially since */
-+    /* we use another local "i" variable below.                      */
-+    device_index = i;
-+
-+    A_ASSERT(HTCHandle != NULL);
-+
-+    dev = alloc_etherdev(sizeof(AR_SOFTC_T));
-+    if (dev == NULL) {
-+        AR_DEBUG_PRINTF("ar6000_available: can't alloc etherdev\n");
-+        return;
-+    }
-+
-+    ether_setup(dev);
-+
-+    if (netdev_priv(dev) == NULL) {
-+        printk(KERN_CRIT "ar6000_available: Could not allocate memory\n");
-+        return;
-+    }
-+
-+    A_MEMZERO(netdev_priv(dev), sizeof(AR_SOFTC_T));
-+
-+    ar                       = (AR_SOFTC_T *)netdev_priv(dev);
-+    ar->arNetDev             = dev;
-+    ar->arHtcTarget          = HTCHandle;
-+    ar->arHifDevice          = HTCGetHifDevice(HTCHandle);
-+    ar->arWlanState          = WLAN_ENABLED;
-+    ar->arRadioSwitch        = WLAN_ENABLED;
-+    ar->arDeviceIndex        = device_index;
-+
-+    A_INIT_TIMER(&ar->arHBChallengeResp.timer, ar6000_detect_error, dev);
-+    ar->arHBChallengeResp.seqNum = 0;
-+    ar->arHBChallengeResp.outstanding = FALSE;
-+    ar->arHBChallengeResp.missCnt = 0;
-+    ar->arHBChallengeResp.frequency = AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT;
-+    ar->arHBChallengeResp.missThres = AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT;
-+
-+    ar6000_init_control_info(ar);
-+    init_waitqueue_head(&arEvent);
-+    sema_init(&ar->arSem, 1);
-+
-+    if (alloc_raw_buffers(ar)) {
-+	free_raw_buffers(ar);
-+	/*
-+	 * @@@ Clean up our own mess, but for anything else, cheerfully mimick
-+	 * the beautiful error non-handling of the rest of this function.
-+	 */
-+	return;
-+    }
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+    A_INIT_TIMER(&aptcTimer, aptcTimerHandler, ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+    /*
-+     * If requested, perform some magic which requires no cooperation from
-+     * the Target.  It causes the Target to ignore flash and execute to the
-+     * OS from ROM.
-+     *
-+     * This is intended to support recovery from a corrupted flash on Targets
-+     * that support flash.
-+     */
-+    if (skipflash)
-+    {
-+        ar6000_reset_device_skipflash(ar->arHifDevice);
-+            }
-+
-+    BMIInit();
-+    {
-+        struct bmi_target_info targ_info;
-+
-+        if (BMIGetTargetInfo(ar->arHifDevice, &targ_info) != A_OK) {
-+            return;
-+        }
-+
-+        ar->arVersion.target_ver = targ_info.target_ver;
-+        ar->arTargetType = targ_info.target_type;
-+    }
-+
-+    if (enableuartprint) {
-+        A_UINT32 param;
-+        param = 1;
-+        if (BMIWriteMemory(ar->arHifDevice,
-+                           HOST_INTEREST_ITEM_ADDRESS(ar, hi_serial_enable),
-+                           (A_UCHAR *)&param,
-+                           4)!= A_OK)
-+        {
-+             AR_DEBUG_PRINTF("BMIWriteMemory for enableuartprint failed \n");
-+             return ;
-+        }
-+        AR_DEBUG_PRINTF("Serial console prints enabled\n");
-+    }
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+    if(testmode) {
-+        ar->arTargetMode = AR6000_TCMD_MODE;
-+    }else {
-+        ar->arTargetMode = AR6000_WLAN_MODE;
-+    }
-+#endif
-+    if (enabletimerwar) {
-+        A_UINT32 param;
-+
-+        if (BMIReadMemory(ar->arHifDevice,
-+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
-+            (A_UCHAR *)&param,
-+            4)!= A_OK)
-+        {
-+            AR_DEBUG_PRINTF("BMIReadMemory for enabletimerwar failed \n");
-+            return;
-+        }
-+
-+        param |= HI_OPTION_TIMER_WAR;
-+
-+        if (BMIWriteMemory(ar->arHifDevice,
-+            HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
-+            (A_UCHAR *)&param,
-+            4) != A_OK)
-+        {
-+            AR_DEBUG_PRINTF("BMIWriteMemory for enabletimerwar failed \n");
-+            return;
-+        }
-+        AR_DEBUG_PRINTF("Timer WAR enabled\n");
-+    }
-+
-+
-+        /* since BMIInit is called in the driver layer, we have to set the block
-+         * size here for the target */
-+
-+    if (A_FAILED(ar6000_SetHTCBlockSize(ar))) {
-+        return;
-+    }
-+
-+    spin_lock_init(&ar->arLock);
-+
-+    dev->netdev_ops = &ar6000_netdev_ops;
-+    dev->watchdog_timeo = AR6000_TX_TIMEOUT;
-+    ar6000_ioctl_iwsetup(&ath_iw_handler_def);
-+    dev->wireless_handlers = &ath_iw_handler_def;
-+    ath_iw_handler_def.get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
-+
-+    /*
-+     * We need the OS to provide us with more headroom in order to
-+     * perform dix to 802.3, WMI header encap, and the HTC header
-+     */
-+    dev->hard_header_len = ETH_HLEN + sizeof(ATH_LLC_SNAP_HDR) +
-+        sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN;
-+
-+    /* This runs the init function */
-+    SET_NETDEV_DEV(dev, HIFGetOSDevice(ar->arHifDevice));
-+    if (register_netdev(dev)) {
-+        AR_DEBUG_PRINTF("ar6000_avail: register_netdev failed\n");
-+        ar6000_destroy(dev, 0);
-+        return;
-+    }
-+
-+    HTCSetInstance(ar->arHtcTarget, ar);
-+
-+    /* We only register the device in the global list if we succeed. */
-+    /* If the device is in the global list, it will be destroyed     */
-+    /* when the module is unloaded.                                  */
-+    ar6000_devices[device_index] = dev;
-+
-+    AR_DEBUG_PRINTF("ar6000_avail: name=%s htcTarget=0x%x, dev=0x%x (%d), ar=0x%x\n",
-+                    dev->name, (A_UINT32)HTCHandle, (A_UINT32)dev, device_index,
-+                    (A_UINT32)ar);
-+}
-+
-+static void ar6000_target_failure(void *Instance, A_STATUS Status)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
-+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
-+    static A_BOOL sip = FALSE;
-+
-+    if (Status != A_OK) {
-+        if (timer_pending(&ar->arHBChallengeResp.timer)) {
-+            A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
-+        }
-+
-+        /* try dumping target assertion information (if any) */
-+        ar6000_dump_target_assert_info(ar->arHifDevice,ar->arTargetType);
-+
-+        /*
-+         * Fetch the logs from the target via the diagnostic
-+         * window.
-+         */
-+        ar6000_dbglog_get_debug_logs(ar);
-+
-+        /* Report the error only once */
-+        if (!sip) {
-+            sip = TRUE;
-+            errEvent.errorVal = WMI_TARGET_COM_ERR |
-+                                WMI_TARGET_FATAL_ERR;
-+#ifdef SEND_EVENT_TO_APP
-+            ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-+                                     (A_UINT8 *)&errEvent,
-+                                     sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
-+#endif
-+        }
-+    }
-+}
-+
-+static void
-+ar6000_unavail_ev(void *Instance)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
-+        /* NULL out it's entry in the global list */
-+    ar6000_devices[ar->arDeviceIndex] = NULL;
-+    ar6000_destroy(ar->arNetDev, 1);
-+}
-+
-+/*
-+ * We need to differentiate between the surprise and planned removal of the
-+ * device because of the following consideration:
-+ * - In case of surprise removal, the hcd already frees up the pending
-+ *   for the device and hence there is no need to unregister the function
-+ *   driver inorder to get these requests. For planned removal, the function
-+ *   driver has to explictly unregister itself to have the hcd return all the
-+ *   pending requests before the data structures for the devices are freed up.
-+ *   Note that as per the current implementation, the function driver will
-+ *   end up releasing all the devices since there is no API to selectively
-+ *   release a particular device.
-+ * - Certain commands issued to the target can be skipped for surprise
-+ *   removal since they will anyway not go through.
-+ */
-+static void
-+ar6000_destroy(struct net_device *dev, unsigned int unregister)
-+{
-+    AR_SOFTC_T *ar;
-+
-+    AR_DEBUG_PRINTF("+ar6000_destroy \n");
-+
-+    if((dev == NULL) || ((ar = netdev_priv(dev)) == NULL))
-+    {
-+        AR_DEBUG_PRINTF("%s(): Failed to get device structure.\n", __func__);
-+        return;
-+    }
-+
-+    /* Clear the tx counters */
-+    memset(tx_attempt, 0, sizeof(tx_attempt));
-+    memset(tx_post, 0, sizeof(tx_post));
-+    memset(tx_complete, 0, sizeof(tx_complete));
-+
-+    /* Free up the device data structure */
-+    if (unregister) {
-+	unregister_netdev(dev);
-+    } else {
-+	ar6000_close(dev);
-+    ar6000_cleanup(dev);
-+    }
-+
-+    free_raw_buffers(ar);
-+
-+#ifndef free_netdev
-+    kfree(dev);
-+#else
-+    free_netdev(dev);
-+#endif
-+
-+    AR_DEBUG_PRINTF("-ar6000_destroy \n");
-+}
-+
-+static void ar6000_detect_error(unsigned long ptr)
-+{
-+    struct net_device *dev = (struct net_device *)ptr;
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
-+
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    if (ar->arHBChallengeResp.outstanding) {
-+        ar->arHBChallengeResp.missCnt++;
-+    } else {
-+        ar->arHBChallengeResp.missCnt = 0;
-+    }
-+
-+    if (ar->arHBChallengeResp.missCnt > ar->arHBChallengeResp.missThres) {
-+        /* Send Error Detect event to the application layer and do not reschedule the error detection module timer */
-+        ar->arHBChallengeResp.missCnt = 0;
-+        ar->arHBChallengeResp.seqNum = 0;
-+        errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
-+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+#ifdef SEND_EVENT_TO_APP
-+        ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-+                                 (A_UINT8 *)&errEvent,
-+                                 sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
-+#endif
-+        return;
-+    }
-+
-+    /* Generate the sequence number for the next challenge */
-+    ar->arHBChallengeResp.seqNum++;
-+    ar->arHBChallengeResp.outstanding = TRUE;
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    /* Send the challenge on the control channel */
-+    if (wmi_get_challenge_resp_cmd(ar->arWmi, ar->arHBChallengeResp.seqNum, DRV_HB_CHALLENGE) != A_OK) {
-+        AR_DEBUG_PRINTF("Unable to send heart beat challenge\n");
-+    }
-+
-+
-+    /* Reschedule the timer for the next challenge */
-+    A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
-+}
-+
-+void ar6000_init_profile_info(AR_SOFTC_T *ar)
-+{
-+    ar->arSsidLen            = 0;
-+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+    ar->arNetworkType        = INFRA_NETWORK;
-+    ar->arDot11AuthMode      = OPEN_AUTH;
-+    ar->arAuthMode           = NONE_AUTH;
-+    ar->arPairwiseCrypto     = NONE_CRYPT;
-+    ar->arPairwiseCryptoLen  = 0;
-+    ar->arGroupCrypto        = NONE_CRYPT;
-+    ar->arGroupCryptoLen     = 0;
-+    A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
-+    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+    A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-+    ar->arBssChannel = 0;
-+}
-+
-+static void
-+ar6000_init_control_info(AR_SOFTC_T *ar)
-+{
-+    ar->arWmiEnabled         = FALSE;
-+    ar6000_init_profile_info(ar);
-+    ar->arDefTxKeyIndex      = 0;
-+    A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
-+    ar->arChannelHint        = 0;
-+    ar->arListenInterval     = MAX_LISTEN_INTERVAL;
-+    ar->arVersion.host_ver   = AR6K_SW_VERSION;
-+    ar->arRssi               = 0;
-+    ar->arTxPwr              = 0;
-+    ar->arTxPwrSet           = FALSE;
-+    ar->arSkipScan           = 0;
-+    ar->arBeaconInterval     = 0;
-+    ar->arBitRate            = 0;
-+    ar->arMaxRetries         = 0;
-+    ar->arWmmEnabled         = TRUE;
-+}
-+
-+static int
-+ar6000_open(struct net_device *dev)
-+{
-+    /* Wake up the queues */
-+    netif_start_queue(dev);
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_close(struct net_device *dev)
-+{
-+    /* Stop the transmit queues */ 
-+    netif_stop_queue(dev); 
-+    return 0; 
-+}
-+
-+static int 
-+ar6000_cleanup(struct net_device *dev)
-+{
-+    AR_SOFTC_T *ar = netdev_priv(dev);
-+
-+    /* Stop the transmit queues */
-+    netif_stop_queue(dev);
-+
-+    /* Disable the target and the interrupts associated with it */
-+    if (ar->arWmiReady == TRUE)
-+    {
-+        if (!bypasswmi)
-+        {
-+            if (ar->arConnected == TRUE || ar->arConnectPending == TRUE)
-+            {
-+                AR_DEBUG_PRINTF("%s(): Disconnect\n", __func__);
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                ar6000_init_profile_info(ar);
-+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+                wmi_disconnect_cmd(ar->arWmi);
-+            }
-+
-+            ar6000_dbglog_get_debug_logs(ar);
-+            ar->arWmiReady  = FALSE;
-+            ar->arConnected = FALSE;
-+            ar->arConnectPending = FALSE;
-+            wmi_shutdown(ar->arWmi);
-+            ar->arWmiEnabled = FALSE;
-+            ar->arWmi = NULL;
-+            ar->arWlanState = WLAN_ENABLED;
-+#ifdef USER_KEYS
-+            ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+            ar->user_key_ctrl      = 0;
-+#endif
-+        }
-+
-+         AR_DEBUG_PRINTF("%s(): WMI stopped\n", __func__);
-+    }
-+    else
-+    {
-+        AR_DEBUG_PRINTF("%s(): WMI not ready 0x%08x 0x%08x\n",
-+            __func__, (unsigned int) ar, (unsigned int) ar->arWmi);
-+
-+        /* Shut down WMI if we have started it */
-+        if(ar->arWmiEnabled == TRUE)
-+        {
-+            AR_DEBUG_PRINTF("%s(): Shut down WMI\n", __func__);
-+            wmi_shutdown(ar->arWmi);
-+            ar->arWmiEnabled = FALSE;
-+            ar->arWmi = NULL;
-+        }
-+    }
-+
-+    /* stop HTC */
-+    HTCStop(ar->arHtcTarget);
-+
-+    /* set the instance to NULL so we do not get called back on remove incase we
-+     * we're explicity destroyed by module unload */
-+    HTCSetInstance(ar->arHtcTarget, NULL);
-+
-+    if (resetok) {
-+        /* try to reset the device if we can
-+         * The driver may have been configure NOT to reset the target during
-+         * a debug session */
-+        AR_DEBUG_PRINTF(" Attempting to reset target on instance destroy.... \n");
-+        ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
-+    } else {
-+        AR_DEBUG_PRINTF(" Host does not want target reset. \n");
-+    }
-+
-+       /* Done with cookies */
-+    ar6000_cookie_cleanup(ar);
-+
-+    /* Cleanup BMI */
-+    BMIInit();
-+
-+    return 0;
-+}
-+
-+/* connect to a service */
-+static A_STATUS ar6000_connectservice(AR_SOFTC_T               *ar,
-+                                      HTC_SERVICE_CONNECT_REQ  *pConnect,
-+                                      WMI_PRI_STREAM_ID        WmiStreamID,
-+                                      char                     *pDesc)
-+{
-+    A_STATUS                 status;
-+    HTC_SERVICE_CONNECT_RESP response;
-+
-+    do {
-+
-+        A_MEMZERO(&response,sizeof(response));
-+
-+        status = HTCConnectService(ar->arHtcTarget,
-+                                   pConnect,
-+                                   &response);
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(" Failed to connect to %s service status:%d \n", pDesc, status);
-+            break;
-+        }
-+
-+        if (WmiStreamID == WMI_NOT_MAPPED) {
-+                /* done */
-+            break;
-+        }
-+
-+            /* set endpoint mapping for the WMI stream in the driver layer */
-+        arSetWMIStream2EndpointIDMap(ar,WmiStreamID,response.Endpoint);
-+
-+    } while (FALSE);
-+
-+    return status;
-+}
-+
-+static void ar6000_TxDataCleanup(AR_SOFTC_T *ar)
-+{
-+        /* flush all the data (non-control) streams
-+         * we only flush packets that are tagged as data, we leave any control packets that
-+         * were in the TX queues alone */
-+    HTCFlushEndpoint(ar->arHtcTarget,
-+                     arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI),
-+                     AR6K_DATA_PKT_TAG);
-+    HTCFlushEndpoint(ar->arHtcTarget,
-+                     arWMIStream2EndpointID(ar,WMI_LOW_PRI),
-+                     AR6K_DATA_PKT_TAG);
-+    HTCFlushEndpoint(ar->arHtcTarget,
-+                     arWMIStream2EndpointID(ar,WMI_HIGH_PRI),
-+                     AR6K_DATA_PKT_TAG);
-+    HTCFlushEndpoint(ar->arHtcTarget,
-+                     arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI),
-+                     AR6K_DATA_PKT_TAG);
-+}
-+
-+/* This function does one time initialization for the lifetime of the device */
-+int ar6000_init(struct net_device *dev)
-+{
-+    AR_SOFTC_T *ar;
-+    A_STATUS    status;
-+    A_INT32     timeleft;
-+
-+    if((ar = netdev_priv(dev)) == NULL)
-+    {
-+        return(-EIO);
-+    }
-+
-+    /* Do we need to finish the BMI phase */
-+    if(BMIDone(ar->arHifDevice) != A_OK)
-+    {
-+        return -EIO;
-+    }
-+
-+    if (!bypasswmi)
-+    {
-+#if 0 /* TBDXXX */
-+        if (ar->arVersion.host_ver != ar->arVersion.target_ver) {
-+            A_PRINTF("WARNING: Host version 0x%x does not match Target "
-+                    " version 0x%x!\n",
-+                    ar->arVersion.host_ver, ar->arVersion.target_ver);
-+        }
-+#endif
-+
-+        /* Indicate that WMI is enabled (although not ready yet) */
-+        ar->arWmiEnabled = TRUE;
-+        if ((ar->arWmi = wmi_init((void *) ar)) == NULL)
-+        {
-+            AR_DEBUG_PRINTF("%s() Failed to initialize WMI.\n", __func__);
-+            return(-EIO);
-+        }
-+
-+        AR_DEBUG_PRINTF("%s() Got WMI @ 0x%08x.\n", __func__,
-+            (unsigned int) ar->arWmi);
-+    }
-+
-+    do {
-+        HTC_SERVICE_CONNECT_REQ connect;
-+
-+            /* the reason we have to wait for the target here is that the driver layer
-+             * has to init BMI in order to set the host block size,
-+             */
-+        status = HTCWaitTarget(ar->arHtcTarget);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        A_MEMZERO(&connect,sizeof(connect));
-+            /* meta data is unused for now */
-+        connect.pMetaData = NULL;
-+        connect.MetaDataLength = 0;
-+            /* these fields are the same for all service endpoints */
-+        connect.EpCallbacks.pContext = ar;
-+        connect.EpCallbacks.EpTxComplete = ar6000_tx_complete;
-+        connect.EpCallbacks.EpRecv = ar6000_rx;
-+        connect.EpCallbacks.EpRecvRefill = ar6000_rx_refill;
-+        connect.EpCallbacks.EpSendFull = ar6000_tx_queue_full;
-+        connect.EpCallbacks.EpSendAvail = ar6000_tx_queue_avail;
-+            /* set the max queue depth so that our ar6000_tx_queue_full handler gets called.
-+             * Linux has the peculiarity of not providing flow control between the
-+             * NIC and the network stack. There is no API to indicate that a TX packet
-+             * was sent which could provide some back pressure to the network stack.
-+             * Under linux you would have to wait till the network stack consumed all sk_buffs
-+             * before any back-flow kicked in. Which isn't very friendly.
-+             * So we have to manage this ourselves */
-+        connect.MaxSendQueueDepth = 32;
-+
-+            /* connect to control service */
-+        connect.ServiceID = WMI_CONTROL_SVC;
-+        status = ar6000_connectservice(ar,
-+                                       &connect,
-+                                       WMI_CONTROL_PRI,
-+                                       "WMI CONTROL");
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* for the remaining data services set the connection flag to reduce dribbling,
-+             * if configured to do so */
-+        if (reduce_credit_dribble) {
-+            connect.ConnectionFlags |= HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE;
-+            /* the credit dribble trigger threshold is (reduce_credit_dribble - 1) for a value
-+             * of 0-3 */
-+            connect.ConnectionFlags &= ~HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
-+            connect.ConnectionFlags |=
-+                        ((A_UINT16)reduce_credit_dribble - 1) & HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
-+        }
-+            /* connect to best-effort service */
-+        connect.ServiceID = WMI_DATA_BE_SVC;
-+
-+        status = ar6000_connectservice(ar,
-+                                       &connect,
-+                                       WMI_BEST_EFFORT_PRI,
-+                                       "WMI DATA BE");
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* connect to back-ground
-+             * map this to WMI LOW_PRI */
-+        connect.ServiceID = WMI_DATA_BK_SVC;
-+        status = ar6000_connectservice(ar,
-+                                       &connect,
-+                                       WMI_LOW_PRI,
-+                                       "WMI DATA BK");
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* connect to Video service, map this to
-+             * to HI PRI */
-+        connect.ServiceID = WMI_DATA_VI_SVC;
-+        status = ar6000_connectservice(ar,
-+                                       &connect,
-+                                       WMI_HIGH_PRI,
-+                                       "WMI DATA VI");
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* connect to VO service, this is currently not
-+             * mapped to a WMI priority stream due to historical reasons.
-+             * WMI originally defined 3 priorities over 3 mailboxes
-+             * We can change this when WMI is reworked so that priorities are not
-+             * dependent on mailboxes */
-+        connect.ServiceID = WMI_DATA_VO_SVC;
-+        status = ar6000_connectservice(ar,
-+                                       &connect,
-+                                       WMI_HIGHEST_PRI,
-+                                       "WMI DATA VO");
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        A_ASSERT(arWMIStream2EndpointID(ar,WMI_CONTROL_PRI) != 0);
-+        A_ASSERT(arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI) != 0);
-+        A_ASSERT(arWMIStream2EndpointID(ar,WMI_LOW_PRI) != 0);
-+        A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGH_PRI) != 0);
-+        A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI) != 0);
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+        return (-EIO);
-+    }
-+
-+    /*
-+     * give our connected endpoints some buffers
-+     */
-+    ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_CONTROL_PRI));
-+
-+    ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI));
-+
-+    /*
-+     * We will post the receive buffers only for SPE testing and so we are
-+     * making it conditional on the 'bypasswmi' flag.
-+     */
-+    if (bypasswmi) {
-+        ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_LOW_PRI));
-+        ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_HIGH_PRI));
-+    }
-+
-+        /* setup credit distribution */
-+    ar6000_setup_credit_dist(ar->arHtcTarget, &ar->arCreditStateInfo);
-+
-+    /* Since cookies are used for HTC transports, they should be */
-+    /* initialized prior to enabling HTC.                        */
-+    ar6000_cookie_init(ar);
-+
-+    /* start HTC */
-+    status = HTCStart(ar->arHtcTarget);
-+
-+    if (status != A_OK) {
-+        if (ar->arWmiEnabled == TRUE) {
-+            wmi_shutdown(ar->arWmi);
-+            ar->arWmiEnabled = FALSE;
-+            ar->arWmi = NULL;
-+        }
-+        ar6000_cookie_cleanup(ar);
-+        return -EIO;
-+    }
-+
-+    if (!bypasswmi) {
-+        /* Wait for Wmi event to be ready */
-+        timeleft = wait_event_interruptible_timeout(arEvent,
-+            (ar->arWmiReady == TRUE), wmitimeout * HZ);
-+
-+        if(!timeleft || signal_pending(current))
-+        {
-+            AR_DEBUG_PRINTF("WMI is not ready or wait was interrupted\n");
-+#if defined(DWSIM) /* TBDXXX */
-+            AR_DEBUG_PRINTF(".....but proceed anyway.\n");
-+#else
-+            return -EIO;
-+#endif
-+        }
-+
-+        AR_DEBUG_PRINTF("%s() WMI is ready\n", __func__);
-+
-+        /* Communicate the wmi protocol verision to the target */
-+        if ((ar6000_set_host_app_area(ar)) != A_OK) {
-+            AR_DEBUG_PRINTF("Unable to set the host app area\n");
-+        }
-+    }
-+
-+    ar->arNumDataEndPts = 1;
-+
-+    return(0);
-+}
-+
-+
-+void
-+ar6000_bitrate_rx(void *devt, A_INT32 rateKbps)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+    ar->arBitRate = rateKbps;
-+    wake_up(&arEvent);
-+}
-+
-+void
-+ar6000_ratemask_rx(void *devt, A_UINT16 ratemask)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+    ar->arRateMask = ratemask;
-+    wake_up(&arEvent);
-+}
-+
-+void
-+ar6000_txPwr_rx(void *devt, A_UINT8 txPwr)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+    ar->arTxPwr = txPwr;
-+    wake_up(&arEvent);
-+}
-+
-+
-+void
-+ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+    A_MEMCPY(ar->arChannelList, chanList, numChan * sizeof (A_UINT16));
-+    ar->arNumChannels = numChan;
-+
-+    wake_up(&arEvent);
-+}
-+
-+A_UINT8
-+ar6000_ibss_map_epid(struct sk_buff *skb, struct net_device *dev, A_UINT32 * mapNo)
-+{
-+    AR_SOFTC_T      *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_UINT8         *datap;
-+    ATH_MAC_HDR     *macHdr;
-+    A_UINT32         i, eptMap;
-+
-+    (*mapNo) = 0;
-+    datap = A_NETBUF_DATA(skb);
-+    macHdr = (ATH_MAC_HDR *)(datap + sizeof(WMI_DATA_HDR));
-+    if (IEEE80211_IS_MULTICAST(macHdr->dstMac)) {
-+        return ENDPOINT_2;
-+    }
-+
-+    eptMap = -1;
-+    for (i = 0; i < ar->arNodeNum; i ++) {
-+        if (IEEE80211_ADDR_EQ(macHdr->dstMac, ar->arNodeMap[i].macAddress)) {
-+            (*mapNo) = i + 1;
-+            ar->arNodeMap[i].txPending ++;
-+            return ar->arNodeMap[i].epId;
-+        }
-+
-+        if ((eptMap == -1) && !ar->arNodeMap[i].txPending) {
-+            eptMap = i;
-+        }
-+    }
-+
-+    if (eptMap == -1) {
-+        eptMap = ar->arNodeNum;
-+        ar->arNodeNum ++;
-+        A_ASSERT(ar->arNodeNum <= MAX_NODE_NUM);
-+    }
-+
-+    A_MEMCPY(ar->arNodeMap[eptMap].macAddress, macHdr->dstMac, IEEE80211_ADDR_LEN);
-+
-+    for (i = ENDPOINT_2; i <= ENDPOINT_5; i ++) {
-+        if (!ar->arTxPending[i]) {
-+            ar->arNodeMap[eptMap].epId = i;
-+            break;
-+        }
-+        // No free endpoint is available, start redistribution on the inuse endpoints.
-+        if (i == ENDPOINT_5) {
-+            ar->arNodeMap[eptMap].epId = ar->arNexEpId;
-+            ar->arNexEpId ++;
-+            if (ar->arNexEpId > ENDPOINT_5) {
-+                ar->arNexEpId = ENDPOINT_2;
-+            }
-+        }
-+    }
-+
-+    (*mapNo) = eptMap + 1;
-+    ar->arNodeMap[eptMap].txPending ++;
-+
-+    return ar->arNodeMap[eptMap].epId;
-+}
-+
-+#ifdef DEBUG
-+static void ar6000_dump_skb(struct sk_buff *skb)
-+{
-+   u_char *ch;
-+   for (ch = A_NETBUF_DATA(skb);
-+        (A_UINT32)ch < ((A_UINT32)A_NETBUF_DATA(skb) +
-+        A_NETBUF_LEN(skb)); ch++)
-+    {
-+         AR_DEBUG_PRINTF("%2.2x ", *ch);
-+    }
-+    AR_DEBUG_PRINTF("\n");
-+}
-+#endif
-+
-+static int
-+ar6000_data_tx(struct sk_buff *skb, struct net_device *dev)
-+{
-+    AR_SOFTC_T        *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_PRI_STREAM_ID streamID = WMI_NOT_MAPPED;
-+    A_UINT32          mapNo = 0;
-+    int               len;
-+    struct ar_cookie *cookie;
-+    A_BOOL            checkAdHocPsMapping = FALSE;
-+
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,13)
-+    skb->list = NULL;
-+#endif
-+
-+    AR_DEBUG2_PRINTF("ar6000_data_tx start - skb=0x%x, data=0x%x, len=0x%x\n",
-+                     (A_UINT32)skb, (A_UINT32)A_NETBUF_DATA(skb),
-+                     A_NETBUF_LEN(skb));
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+     /* TCMD doesnt support any data, free the buf and return */
-+    if(ar->arTargetMode == AR6000_TCMD_MODE) {
-+        A_NETBUF_FREE(skb);
-+        return 0;
-+    }
-+#endif
-+    do {
-+
-+        if (ar->arWmiReady == FALSE && bypasswmi == 0) {
-+            break;
-+        }
-+
-+#ifdef BLOCK_TX_PATH_FLAG
-+        if (blocktx) {
-+            break;
-+        }
-+#endif /* BLOCK_TX_PATH_FLAG */
-+
-+        if (ar->arWmiEnabled) {
-+            if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len) {
-+                struct sk_buff  *newbuf;
-+                /*
-+                 * We really should have gotten enough headroom but sometimes
-+                 * we still get packets with not enough headroom.  Copy the packet.
-+                 */
-+                len = A_NETBUF_LEN(skb);
-+                newbuf = A_NETBUF_ALLOC(len);
-+                if (newbuf == NULL) {
-+                    break;
-+                }
-+                A_NETBUF_PUT(newbuf, len);
-+                A_MEMCPY(A_NETBUF_DATA(newbuf), A_NETBUF_DATA(skb), len);
-+                A_NETBUF_FREE(skb);
-+                skb = newbuf;
-+                /* fall through and assemble header */
-+            }
-+
-+            if (wmi_dix_2_dot3(ar->arWmi, skb) != A_OK) {
-+                AR_DEBUG_PRINTF("ar6000_data_tx - wmi_dix_2_dot3 failed\n");
-+                break;
-+            }
-+
-+            if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE) != A_OK) {
-+                AR_DEBUG_PRINTF("ar6000_data_tx - wmi_data_hdr_add failed\n");
-+                break;
-+            }
-+
-+            if ((ar->arNetworkType == ADHOC_NETWORK) &&
-+                ar->arIbssPsEnable && ar->arConnected) {
-+                    /* flag to check adhoc mapping once we take the lock below: */
-+                checkAdHocPsMapping = TRUE;
-+
-+            } else {
-+                    /* get the stream mapping */
-+                if (ar->arWmmEnabled) {
-+                    streamID = wmi_get_stream_id(ar->arWmi,
-+                                    wmi_implicit_create_pstream(ar->arWmi, skb, UPLINK_TRAFFIC, UNDEFINED_PRI));
-+                } else {
-+                    streamID = WMI_BEST_EFFORT_PRI;
-+                }
-+            }
-+
-+        } else {
-+            struct iphdr    *ipHdr;
-+            /*
-+             * the endpoint is directly based on the TOS field in the IP
-+             * header **** only for testing ******
-+             */
-+            ipHdr = A_NETBUF_DATA(skb) + sizeof(ATH_MAC_HDR);
-+                /* here we map the TOS field to an endpoint number, this is for
-+                 * the endpointping test application */
-+            streamID = IP_TOS_TO_WMI_PRI(ipHdr->tos);
-+        }
-+
-+    } while (FALSE);
-+
-+        /* did we succeed ? */
-+    if ((streamID == WMI_NOT_MAPPED) && !checkAdHocPsMapping) {
-+            /* cleanup and exit */
-+        A_NETBUF_FREE(skb);
-+        AR6000_STAT_INC(ar, tx_dropped);
-+        AR6000_STAT_INC(ar, tx_aborted_errors);
-+        return 0;
-+    }
-+
-+    cookie = NULL;
-+
-+        /* take the lock to protect driver data */
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    do {
-+
-+        if (checkAdHocPsMapping) {
-+            streamID = ar6000_ibss_map_epid(skb, dev, &mapNo);
-+        }
-+
-+        A_ASSERT(streamID != WMI_NOT_MAPPED);
-+
-+            /* validate that the endpoint is connected */
-+        if (arWMIStream2EndpointID(ar,streamID) == 0) {
-+            AR_DEBUG_PRINTF("Stream %d is NOT mapped!\n",streamID);
-+            break;
-+        }
-+            /* allocate resource for this packet */
-+        cookie = ar6000_alloc_cookie(ar);
-+
-+        if (cookie != NULL) {
-+                /* update counts while the lock is held */
-+            ar->arTxPending[streamID]++;
-+            ar->arTotalTxDataPending++;
-+        }
-+
-+    } while (FALSE);
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    if (cookie != NULL) {
-+        cookie->arc_bp[0] = (A_UINT32)skb;
-+        cookie->arc_bp[1] = mapNo;
-+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
-+                               cookie,
-+                               A_NETBUF_DATA(skb),
-+                               A_NETBUF_LEN(skb),
-+                               arWMIStream2EndpointID(ar,streamID),
-+                               AR6K_DATA_PKT_TAG);
-+
-+#ifdef DEBUG
-+        if (debugdriver >= 3) {
-+            ar6000_dump_skb(skb);
-+        }
-+#endif
-+            /* HTC interface is asynchronous, if this fails, cleanup will happen in
-+             * the ar6000_tx_complete callback */
-+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
-+    } else {
-+            /* no packet to send, cleanup */
-+        A_NETBUF_FREE(skb);
-+        AR6000_STAT_INC(ar, tx_dropped);
-+        AR6000_STAT_INC(ar, tx_aborted_errors);
-+    }
-+
-+    return 0;
-+}
-+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+static void
-+tvsub(register struct timeval *out, register struct timeval *in)
-+{
-+    if((out->tv_usec -= in->tv_usec) < 0) {
-+        out->tv_sec--;
-+        out->tv_usec += 1000000;
-+    }
-+    out->tv_sec -= in->tv_sec;
-+}
-+
-+void
-+applyAPTCHeuristics(AR_SOFTC_T *ar)
-+{
-+    A_UINT32 duration;
-+    A_UINT32 numbytes;
-+    A_UINT32 throughput;
-+    struct timeval ts;
-+    A_STATUS status;
-+
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    if ((enableAPTCHeuristics) && (!aptcTR.timerScheduled)) {
-+        do_gettimeofday(&ts);
-+        tvsub(&ts, &aptcTR.samplingTS);
-+        duration = ts.tv_sec * 1000 + ts.tv_usec / 1000; /* ms */
-+        numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
-+
-+        if (duration > APTC_TRAFFIC_SAMPLING_INTERVAL) {
-+            /* Initialize the time stamp and byte count */
-+            aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
-+            do_gettimeofday(&aptcTR.samplingTS);
-+
-+            /* Calculate and decide based on throughput thresholds */
-+            throughput = ((numbytes * 8) / duration);
-+            if (throughput > APTC_UPPER_THROUGHPUT_THRESHOLD) {
-+                /* Disable Sleep and schedule a timer */
-+                A_ASSERT(ar->arWmiReady == TRUE);
-+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+                status = wmi_powermode_cmd(ar->arWmi, MAX_PERF_POWER);
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
-+                aptcTR.timerScheduled = TRUE;
-+            }
-+        }
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+}
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+static void
-+ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *) Context;
-+
-+    if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
-+        if (!bypasswmi) {
-+                /* under normal WMI if this is getting full, then something is running rampant
-+                 * the host should not be exhausting the WMI queue with too many commands
-+                 * the only exception to this is during testing using endpointping */
-+
-+            AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                /* set flag to handle subsequent messages */
-+            ar->arWMIControlEpFull = TRUE;
-+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+            AR_DEBUG_PRINTF("WMI Control Endpoint is FULL!!! \n");
-+        }
-+    } else {
-+        /* one of the data endpoints queues is getting full..need to stop network stack
-+         * the queue will resume after credits received */
-+        netif_stop_queue(ar->arNetDev);
-+    }
-+}
-+
-+static void
-+ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+
-+    if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
-+        /* FIXME: what do for it?  */
-+    } else {
-+        /* Wake up interface, rescheduling prevented.  */
-+        if (ar->arConnected == TRUE || bypasswmi)
-+            netif_wake_queue(ar->arNetDev);
-+    }
-+}
-+
-+static void
-+ar6000_tx_complete(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR_SOFTC_T     *ar = (AR_SOFTC_T *)Context;
-+    void           *cookie = (void *)pPacket->pPktContext;
-+    struct sk_buff *skb = NULL;
-+    A_UINT32        mapNo = 0;
-+    A_STATUS        status;
-+    struct ar_cookie * ar_cookie;
-+    WMI_PRI_STREAM_ID streamID;
-+    A_BOOL          wakeEvent = FALSE;
-+
-+    status = pPacket->Status;
-+    ar_cookie = (struct ar_cookie *)cookie;
-+    skb = (struct sk_buff *)ar_cookie->arc_bp[0];
-+    streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
-+    mapNo = ar_cookie->arc_bp[1];
-+
-+    A_ASSERT(skb);
-+    A_ASSERT(pPacket->pBuffer == A_NETBUF_DATA(skb));
-+
-+    if (A_SUCCESS(status)) {
-+        A_ASSERT(pPacket->ActualLength == A_NETBUF_LEN(skb));
-+    }
-+
-+    AR_DEBUG2_PRINTF("ar6000_tx_complete skb=0x%x data=0x%x len=0x%x sid=%d ",
-+                     (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
-+                     pPacket->ActualLength,
-+                     streamID);
-+
-+        /* lock the driver as we update internal state */
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    ar->arTxPending[streamID]--;
-+
-+    if ((streamID != WMI_CONTROL_PRI) || bypasswmi) {
-+        ar->arTotalTxDataPending--;
-+    }
-+
-+    if (streamID == WMI_CONTROL_PRI)
-+    {
-+        if (ar->arWMIControlEpFull) {
-+                /* since this packet completed, the WMI EP is no longer full */
-+            ar->arWMIControlEpFull = FALSE;
-+        }
-+
-+        if (ar->arTxPending[streamID] == 0) {
-+            wakeEvent = TRUE;
-+        }
-+    }
-+
-+    if (A_FAILED(status)) {
-+        AR_DEBUG_PRINTF("%s() -TX ERROR, status: 0x%x\n", __func__,
-+                        status);
-+        AR6000_STAT_INC(ar, tx_errors);
-+    } else {
-+        AR_DEBUG2_PRINTF("OK\n");
-+        AR6000_STAT_INC(ar, tx_packets);
-+        ar->arNetStats.tx_bytes += A_NETBUF_LEN(skb);
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+        aptcTR.bytesTransmitted += a_netbuf_to_len(skb);
-+        applyAPTCHeuristics(ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+    }
-+
-+    // TODO this needs to be looked at
-+    if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable
-+        && (streamID != WMI_CONTROL_PRI) && mapNo)
-+    {
-+        mapNo --;
-+        ar->arNodeMap[mapNo].txPending --;
-+
-+        if (!ar->arNodeMap[mapNo].txPending && (mapNo == (ar->arNodeNum - 1))) {
-+            A_UINT32 i;
-+            for (i = ar->arNodeNum; i > 0; i --) {
-+                if (!ar->arNodeMap[i - 1].txPending) {
-+                    A_MEMZERO(&ar->arNodeMap[i - 1], sizeof(struct ar_node_mapping));
-+                    ar->arNodeNum --;
-+                } else {
-+                    break;
-+                }
-+            }
-+        }
-+    }
-+
-+    /* Freeing a cookie should not be contingent on either of */
-+    /* these flags, just if we have a cookie or not.           */
-+    /* Can we even get here without a cookie? Fix later.       */
-+    if (ar->arWmiReady == TRUE || (bypasswmi))
-+    {
-+        ar6000_free_cookie(ar, cookie);
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    /* lock is released, we can freely call other kernel APIs */
-+
-+        /* this indirectly frees the HTC_PACKET */
-+    A_NETBUF_FREE(skb);
-+
-+    if (wakeEvent) {
-+        wake_up(&arEvent);
-+    }
-+}
-+
-+/*
-+ * Receive event handler.  This is called by HTC when a packet is received
-+ */
-+int pktcount;
-+static void
-+ar6000_rx(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+    struct sk_buff *skb = (struct sk_buff *)pPacket->pPktContext;
-+    int minHdrLen;
-+    A_STATUS        status = pPacket->Status;
-+    WMI_PRI_STREAM_ID streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
-+    HTC_ENDPOINT_ID   ept = pPacket->Endpoint;
-+
-+    A_ASSERT((status != A_OK) || (pPacket->pBuffer == (A_NETBUF_DATA(skb) + HTC_HEADER_LEN)));
-+
-+    AR_DEBUG2_PRINTF("ar6000_rx ar=0x%x sid=%d, skb=0x%x, data=0x%x, len=0x%x ",
-+                    (A_UINT32)ar, streamID, (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
-+                    pPacket->ActualLength);
-+    if (status != A_OK) {
-+        AR_DEBUG2_PRINTF("ERR\n");
-+    } else {
-+        AR_DEBUG2_PRINTF("OK\n");
-+    }
-+
-+        /* take lock to protect buffer counts
-+         * and adaptive power throughput state */
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    ar->arRxBuffers[streamID]--;
-+
-+    if (A_SUCCESS(status)) {
-+        AR6000_STAT_INC(ar, rx_packets);
-+        ar->arNetStats.rx_bytes += pPacket->ActualLength;
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+        aptcTR.bytesReceived += a_netbuf_to_len(skb);
-+        applyAPTCHeuristics(ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+
-+        A_NETBUF_PUT(skb, pPacket->ActualLength +  HTC_HEADER_LEN);
-+        A_NETBUF_PULL(skb, HTC_HEADER_LEN);
-+
-+#ifdef DEBUG
-+        if (debugdriver >= 2) {
-+            ar6000_dump_skb(skb);
-+        }
-+#endif /* DEBUG */
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    if (status != A_OK) {
-+        AR6000_STAT_INC(ar, rx_errors);
-+        A_NETBUF_FREE(skb);
-+    } else if (ar->arWmiEnabled == TRUE) {
-+        if (streamID == WMI_CONTROL_PRI) {
-+           /*
-+            * this is a wmi control msg
-+            */
-+            wmi_control_rx(ar->arWmi, skb);
-+        } else {
-+            WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
-+            if (WMI_DATA_HDR_IS_MSG_TYPE(dhdr, CNTL_MSGTYPE)) {
-+                /*
-+                 * this is a wmi control msg
-+                 */
-+                /* strip off WMI hdr */
-+                wmi_data_hdr_remove(ar->arWmi, skb);
-+                wmi_control_rx(ar->arWmi, skb);
-+            } else {
-+                /*
-+                 * this is a wmi data packet
-+                 */
-+                minHdrLen = sizeof (WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) +
-+                            sizeof(ATH_LLC_SNAP_HDR);
-+
-+                if ((pPacket->ActualLength < minHdrLen) ||
-+                    (pPacket->ActualLength > AR6000_BUFFER_SIZE))
-+                {
-+                    /*
-+                     * packet is too short or too long
-+                     */
-+                    AR_DEBUG_PRINTF("TOO SHORT or TOO LONG\n");
-+                    AR6000_STAT_INC(ar, rx_errors);
-+                    AR6000_STAT_INC(ar, rx_length_errors);
-+                    A_NETBUF_FREE(skb);
-+                } else {
-+                    if (ar->arWmmEnabled) {
-+                        wmi_implicit_create_pstream(ar->arWmi, skb,
-+                            DNLINK_TRAFFIC, UNDEFINED_PRI);
-+                    }
-+#if 0
-+                    /* Access RSSI values here */
-+                    AR_DEBUG_PRINTF("RSSI %d\n",
-+                        ((WMI_DATA_HDR *) A_NETBUF_DATA(skb))->rssi);
-+#endif
-+                    wmi_data_hdr_remove(ar->arWmi, skb);
-+                    wmi_dot3_2_dix(ar->arWmi, skb);
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
-+                    /*
-+                     * extra push and memcpy, for eth_type_trans() of 2.4 kernel
-+                     * will pull out hard_header_len bytes of the skb.
-+                     */
-+                    A_NETBUF_PUSH(skb, sizeof(WMI_DATA_HDR) + sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN);
-+                    A_MEMCPY(A_NETBUF_DATA(skb), A_NETBUF_DATA(skb) + sizeof(WMI_DATA_HDR) +
-+                             sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN, sizeof(ATH_MAC_HDR));
-+#endif
-+                    if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
-+                    {
-+                        skb->dev = ar->arNetDev;
-+                        skb->protocol = eth_type_trans(skb, ar->arNetDev);
-+                        netif_rx(skb);
-+                    }
-+                    else
-+                    {
-+                        A_NETBUF_FREE(skb);
-+                    }
-+                }
-+            }
-+        }
-+    } else {
-+        if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
-+        {
-+            skb->dev = ar->arNetDev;
-+            skb->protocol = eth_type_trans(skb, ar->arNetDev);
-+            netif_rx(skb);
-+        }
-+        else
-+        {
-+            A_NETBUF_FREE(skb);
-+        }
-+    }
-+
-+    if (status != A_ECANCELED) {
-+        /*
-+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+         * (probably due to a shutdown)
-+         */
-+        ar6000_rx_refill(Context, ept);
-+    }
-+
-+
-+}
-+
-+static void
-+ar6000_rx_refill(void *Context, HTC_ENDPOINT_ID Endpoint)
-+{
-+    AR_SOFTC_T  *ar = (AR_SOFTC_T *)Context;
-+    void        *osBuf;
-+    int         RxBuffers;
-+    int         buffersToRefill;
-+    HTC_PACKET  *pPacket;
-+    WMI_PRI_STREAM_ID streamId = arEndpoint2WMIStreamID(ar,Endpoint);
-+
-+    buffersToRefill = (int)AR6000_MAX_RX_BUFFERS -
-+                                    (int)ar->arRxBuffers[streamId];
-+
-+    if (buffersToRefill <= 0) {
-+            /* fast return, nothing to fill */
-+        return;
-+    }
-+
-+    AR_DEBUG2_PRINTF("ar6000_rx_refill: providing htc with %d buffers at eid=%d\n",
-+                    buffersToRefill, Endpoint);
-+
-+    for (RxBuffers = 0; RxBuffers < buffersToRefill; RxBuffers++) {
-+        osBuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE);
-+        if (NULL == osBuf) {
-+            break;
-+        }
-+            /* the HTC packet wrapper is at the head of the reserved area
-+             * in the skb */
-+        pPacket = (HTC_PACKET *)(A_NETBUF_HEAD(osBuf));
-+            /* set re-fill info */
-+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_BUFFER_SIZE,Endpoint);
-+            /* add this packet */
-+        HTCAddReceivePkt(ar->arHtcTarget, pPacket);
-+    }
-+
-+        /* update count */
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+    ar->arRxBuffers[streamId] += RxBuffers;
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+}
-+
-+static struct net_device_stats *
-+ar6000_get_stats(struct net_device *dev)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    return &ar->arNetStats;
-+}
-+
-+static struct iw_statistics *
-+ar6000_get_iwstats(struct net_device * dev)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    TARGET_STATS *pStats = &ar->arTargetStats;
-+    struct iw_statistics * pIwStats = &ar->arIwStats;
-+
-+    if ((ar->arWmiReady == FALSE)
-+    /*
-+     * The in_atomic function is used to determine if the scheduling is
-+     * allowed in the current context or not. This was introduced in 2.6
-+     * From what I have read on the differences between 2.4 and 2.6, the
-+     * 2.4 kernel did not support preemption and so this check might not
-+     * be required for 2.4 kernels.
-+     */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+        || (in_atomic())
-+#endif
-+       )
-+    {
-+        pIwStats->status = 0;
-+        pIwStats->qual.qual = 0;
-+        pIwStats->qual.level =0;
-+        pIwStats->qual.noise = 0;
-+        pIwStats->discard.code =0;
-+        pIwStats->discard.retries=0;
-+        pIwStats->miss.beacon =0;
-+        return pIwStats;
-+    }
-+    if (down_interruptible(&ar->arSem)) {
-+        pIwStats->status = 0;
-+        return pIwStats;
-+    }
-+
-+
-+    ar->statsUpdatePending = TRUE;
-+
-+    if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
-+        up(&ar->arSem);
-+        pIwStats->status = 0;
-+        return pIwStats;
-+    }
-+
-+    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
-+
-+    if (signal_pending(current)) {
-+        AR_DEBUG_PRINTF("ar6000 : WMI get stats timeout \n");
-+        up(&ar->arSem);
-+        pIwStats->status = 0;
-+        return pIwStats;
-+    }
-+    pIwStats->status = 1 ;
-+    pIwStats->qual.qual = pStats->cs_aveBeacon_rssi;
-+    pIwStats->qual.level =pStats->cs_aveBeacon_rssi + 161;  /* noise is -95 dBm */
-+    pIwStats->qual.noise = pStats->noise_floor_calibation;
-+    pIwStats->discard.code = pStats->rx_decrypt_err;
-+    pIwStats->discard.retries = pStats->tx_retry_cnt;
-+    pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
-+    up(&ar->arSem);
-+    return pIwStats;
-+}
-+
-+void
-+ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+    struct net_device *dev = ar->arNetDev;
-+
-+    ar->arWmiReady = TRUE;
-+    wake_up(&arEvent);
-+    A_MEMCPY(dev->dev_addr, datap, AR6000_ETH_ADDR_LEN);
-+    AR_DEBUG_PRINTF("mac address = %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-+        dev->dev_addr[0], dev->dev_addr[1],
-+        dev->dev_addr[2], dev->dev_addr[3],
-+        dev->dev_addr[4], dev->dev_addr[5]);
-+
-+    ar->arPhyCapability = phyCap;
-+}
-+
-+A_UINT8
-+ar6000_iptos_to_userPriority(A_UINT8 *pkt)
-+{
-+    struct iphdr *ipHdr = (struct iphdr *)pkt;
-+    A_UINT8 userPriority;
-+
-+    /*
-+     * IP Tos format :
-+     *      (Refer Pg 57 WMM-test-plan-v1.2)
-+     * IP-TOS - 8bits
-+     *          : DSCP(6-bits) ECN(2-bits)
-+     *          : DSCP - P2 P1 P0 X X X
-+     *              where (P2 P1 P0) form 802.1D
-+     */
-+    userPriority = ipHdr->tos >> 5;
-+    return (userPriority & 0x7);
-+}
-+
-+void
-+ar6000_connect_event(AR_SOFTC_T *ar, A_UINT16 channel, A_UINT8 *bssid,
-+                     A_UINT16 listenInterval, A_UINT16 beaconInterval,
-+                     NETWORK_TYPE networkType, A_UINT8 beaconIeLen,
-+                     A_UINT8 assocReqLen, A_UINT8 assocRespLen,
-+                     A_UINT8 *assocInfo)
-+{
-+    union iwreq_data wrqu;
-+    int i, beacon_ie_pos, assoc_resp_ie_pos, assoc_req_ie_pos;
-+    static const char *tag1 = "ASSOCINFO(ReqIEs=";
-+    static const char *tag2 = "ASSOCRESPIE=";
-+    static const char *beaconIetag = "BEACONIE=";
-+    char buf[WMI_CONTROL_MSG_MAX_LEN * 2 + sizeof(tag1)];
-+    char *pos;
-+    A_UINT8 key_op_ctrl;
-+
-+    A_MEMCPY(ar->arBssid, bssid, sizeof(ar->arBssid));
-+    ar->arBssChannel = channel;
-+
-+    A_PRINTF("AR6000 connected event on freq %d ", channel);
-+    A_PRINTF("with bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
-+            " listenInterval=%d, beaconInterval = %d, beaconIeLen = %d assocReqLen=%d"
-+            " assocRespLen =%d\n",
-+             bssid[0], bssid[1], bssid[2],
-+             bssid[3], bssid[4], bssid[5],
-+             listenInterval, beaconInterval,
-+             beaconIeLen, assocReqLen, assocRespLen);
-+    if (networkType & ADHOC_NETWORK) {
-+        if (networkType & ADHOC_CREATOR) {
-+            A_PRINTF("Network: Adhoc (Creator)\n");
-+        } else {
-+            A_PRINTF("Network: Adhoc (Joiner)\n");
-+        }
-+    } else {
-+        A_PRINTF("Network: Infrastructure\n");
-+    }
-+
-+    if (beaconIeLen && (sizeof(buf) > (9 + beaconIeLen * 2))) {
-+        AR_DEBUG_PRINTF("\nBeaconIEs= ");
-+
-+        beacon_ie_pos = 0;
-+        A_MEMZERO(buf, sizeof(buf));
-+        sprintf(buf, "%s", beaconIetag);
-+        pos = buf + 9;
-+        for (i = beacon_ie_pos; i < beacon_ie_pos + beaconIeLen; i++) {
-+            AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+            sprintf(pos, "%2.2x", assocInfo[i]);
-+            pos += 2;
-+        }
-+        AR_DEBUG_PRINTF("\n");
-+
-+        A_MEMZERO(&wrqu, sizeof(wrqu));
-+        wrqu.data.length = strlen(buf);
-+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+    }
-+
-+    if (assocRespLen && (sizeof(buf) > (12 + (assocRespLen * 2))))
-+    {
-+        assoc_resp_ie_pos = beaconIeLen + assocReqLen +
-+                            sizeof(A_UINT16)  +  /* capinfo*/
-+                            sizeof(A_UINT16)  +  /* status Code */
-+                            sizeof(A_UINT16)  ;  /* associd */
-+        A_MEMZERO(buf, sizeof(buf));
-+        sprintf(buf, "%s", tag2);
-+        pos = buf + 12;
-+        AR_DEBUG_PRINTF("\nAssocRespIEs= ");
-+        /*
-+         * The Association Response Frame w.o. the WLAN header is delivered to
-+         * the host, so skip over to the IEs
-+         */
-+        for (i = assoc_resp_ie_pos; i < assoc_resp_ie_pos + assocRespLen - 6; i++)
-+        {
-+            AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+            sprintf(pos, "%2.2x", assocInfo[i]);
-+            pos += 2;
-+        }
-+        AR_DEBUG_PRINTF("\n");
-+
-+        A_MEMZERO(&wrqu, sizeof(wrqu));
-+        wrqu.data.length = strlen(buf);
-+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+    }
-+
-+    if (assocReqLen && (sizeof(buf) > (17 + (assocReqLen * 2)))) {
-+        /*
-+         * assoc Request includes capability and listen interval. Skip these.
-+         */
-+        assoc_req_ie_pos =  beaconIeLen +
-+                            sizeof(A_UINT16)  +  /* capinfo*/
-+                            sizeof(A_UINT16);    /* listen interval */
-+
-+        A_MEMZERO(buf, sizeof(buf));
-+        sprintf(buf, "%s", tag1);
-+        pos = buf + 17;
-+        AR_DEBUG_PRINTF("AssocReqIEs= ");
-+        for (i = assoc_req_ie_pos; i < assoc_req_ie_pos + assocReqLen - 4; i++) {
-+            AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+            sprintf(pos, "%2.2x", assocInfo[i]);
-+            pos += 2;;
-+        }
-+        AR_DEBUG_PRINTF("\n");
-+
-+        A_MEMZERO(&wrqu, sizeof(wrqu));
-+        wrqu.data.length = strlen(buf);
-+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+    }
-+
-+#ifdef USER_KEYS
-+    if (ar->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
-+        ar->user_saved_keys.keyOk == TRUE)
-+    {
-+
-+        key_op_ctrl = KEY_OP_VALID_MASK & ~KEY_OP_INIT_TSC;
-+        if (ar->user_key_ctrl & AR6000_USER_SETKEYS_RSC_UNCHANGED) {
-+            key_op_ctrl &= ~KEY_OP_INIT_RSC;
-+        } else {
-+            key_op_ctrl |= KEY_OP_INIT_RSC;
-+        }
-+        ar6000_reinstall_keys(ar, key_op_ctrl);
-+    }
-+#endif /* USER_KEYS */
-+
-+        /* flush data queues */
-+    ar6000_TxDataCleanup(ar);
-+
-+    netif_start_queue(ar->arNetDev);
-+
-+    if ((OPEN_AUTH == ar->arDot11AuthMode) &&
-+        (NONE_AUTH == ar->arAuthMode)      &&
-+        (WEP_CRYPT == ar->arPairwiseCrypto))
-+    {
-+        if (!ar->arConnected) {
-+            ar6000_install_static_wep_keys(ar);
-+        }
-+    }
-+
-+    ar->arConnected  = TRUE;
-+    ar->arConnectPending = FALSE;
-+
-+    reconnect_flag = 0;
-+
-+    A_MEMZERO(&wrqu, sizeof(wrqu));
-+    A_MEMCPY(wrqu.addr.sa_data, bssid, IEEE80211_ADDR_LEN);
-+    wrqu.addr.sa_family = ARPHRD_ETHER;
-+    wireless_send_event(ar->arNetDev, SIOCGIWAP, &wrqu, NULL);
-+    if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable) {
-+        A_MEMZERO(ar->arNodeMap, sizeof(ar->arNodeMap));
-+        ar->arNodeNum = 0;
-+        ar->arNexEpId = ENDPOINT_2;
-+    }
-+
-+}
-+
-+void ar6000_set_numdataendpts(AR_SOFTC_T *ar, A_UINT32 num)
-+{
-+    A_ASSERT(num <= (HTC_MAILBOX_NUM_MAX - 1));
-+    ar->arNumDataEndPts = num;
-+}
-+
-+void
-+ar6000_disconnect_event(AR_SOFTC_T *ar, A_UINT8 reason, A_UINT8 *bssid,
-+                        A_UINT8 assocRespLen, A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus)
-+{
-+    A_UINT8 i;
-+
-+    A_PRINTF("AR6000 disconnected");
-+    if (bssid[0] || bssid[1] || bssid[2] || bssid[3] || bssid[4] || bssid[5]) {
-+        A_PRINTF(" from %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
-+                 bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
-+    }
-+    A_PRINTF("\n");
-+
-+    AR_DEBUG_PRINTF("\nDisconnect Reason is %d", reason);
-+    AR_DEBUG_PRINTF("\nProtocol Reason/Status Code is %d", protocolReasonStatus);
-+    AR_DEBUG_PRINTF("\nAssocResp Frame = %s",
-+                    assocRespLen ? " " : "NULL");
-+    for (i = 0; i < assocRespLen; i++) {
-+        if (!(i % 0x10)) {
-+            AR_DEBUG_PRINTF("\n");
-+        }
-+        AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+    }
-+    AR_DEBUG_PRINTF("\n");
-+    /*
-+     * If the event is due to disconnect cmd from the host, only they the target
-+     * would stop trying to connect. Under any other condition, target would
-+     * keep trying to connect.
-+     *
-+     */
-+    if( reason == DISCONNECT_CMD)
-+    {
-+        ar->arConnectPending = FALSE;
-+    } else {
-+        ar->arConnectPending = TRUE;
-+        if (((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x11)) ||
-+            ((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x0) && (reconnect_flag == 1))) {
-+            ar->arConnected = TRUE;
-+            return;
-+        }
-+    }
-+    ar->arConnected = FALSE;
-+
-+    if( (reason != CSERV_DISCONNECT) || (reconnect_flag != 1) ) {
-+        reconnect_flag = 0;
-+    }
-+
-+#ifdef USER_KEYS
-+    if (reason != CSERV_DISCONNECT)
-+    {
-+        ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+        ar->user_key_ctrl      = 0;
-+    }
-+#endif /* USER_KEYS */
-+
-+    netif_stop_queue(ar->arNetDev);
-+    A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-+    ar->arBssChannel = 0;
-+    ar->arBeaconInterval = 0;
-+
-+    ar6000_TxDataCleanup(ar);
-+}
-+
-+void
-+ar6000_regDomain_event(AR_SOFTC_T *ar, A_UINT32 regCode)
-+{
-+    A_PRINTF("AR6000 Reg Code = 0x%x\n", regCode);
-+    ar->arRegCode = regCode;
-+}
-+
-+void
-+ar6000_neighborReport_event(AR_SOFTC_T *ar, int numAps, WMI_NEIGHBOR_INFO *info)
-+{
-+    static const char *tag = "PRE-AUTH";
-+    char buf[128];
-+    union iwreq_data wrqu;
-+    int i;
-+
-+    AR_DEBUG_PRINTF("AR6000 Neighbor Report Event\n");
-+    for (i=0; i < numAps; info++, i++) {
-+        AR_DEBUG_PRINTF("bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
-+            info->bssid[0], info->bssid[1], info->bssid[2],
-+            info->bssid[3], info->bssid[4], info->bssid[5]);
-+        if (info->bssFlags & WMI_PREAUTH_CAPABLE_BSS) {
-+            AR_DEBUG_PRINTF("preauth-cap");
-+        }
-+        if (info->bssFlags & WMI_PMKID_VALID_BSS) {
-+            AR_DEBUG_PRINTF(" pmkid-valid\n");
-+            continue;           /* we skip bss if the pmkid is already valid */
-+        }
-+        AR_DEBUG_PRINTF("\n");
-+        snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
-+                 tag,
-+                 info->bssid[0], info->bssid[1], info->bssid[2],
-+                 info->bssid[3], info->bssid[4], info->bssid[5],
-+                 i, info->bssFlags);
-+        A_MEMZERO(&wrqu, sizeof(wrqu));
-+        wrqu.data.length = strlen(buf);
-+        wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+    }
-+}
-+
-+void
-+ar6000_tkip_micerr_event(AR_SOFTC_T *ar, A_UINT8 keyid, A_BOOL ismcast)
-+{
-+    static const char *tag = "MLME-MICHAELMICFAILURE.indication";
-+    char buf[128];
-+    union iwreq_data wrqu;
-+
-+    A_PRINTF("AR6000 TKIP MIC error received for keyid %d %scast\n",
-+             keyid, ismcast ? "multi": "uni");
-+    snprintf(buf, sizeof(buf), "%s(keyid=%d %scat)", tag, keyid,
-+             ismcast ? "multi" : "uni");
-+    memset(&wrqu, 0, sizeof(wrqu));
-+    wrqu.data.length = strlen(buf);
-+    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+}
-+
-+void
-+ar6000_scanComplete_event(AR_SOFTC_T *ar, A_STATUS status)
-+{
-+	AR_DEBUG_PRINTF("AR6000 scan complete: %d\n", status);
-+
-+	ar->scan_complete = 1;
-+	wake_up_interruptible(&ar6000_scan_queue);
-+}
-+
-+void
-+ar6000_targetStats_event(AR_SOFTC_T *ar,  WMI_TARGET_STATS *pTarget)
-+{
-+    TARGET_STATS *pStats = &ar->arTargetStats;
-+    A_UINT8 ac;
-+
-+    /*A_PRINTF("AR6000 updating target stats\n");*/
-+    pStats->tx_packets          += pTarget->txrxStats.tx_stats.tx_packets;
-+    pStats->tx_bytes            += pTarget->txrxStats.tx_stats.tx_bytes;
-+    pStats->tx_unicast_pkts     += pTarget->txrxStats.tx_stats.tx_unicast_pkts;
-+    pStats->tx_unicast_bytes    += pTarget->txrxStats.tx_stats.tx_unicast_bytes;
-+    pStats->tx_multicast_pkts   += pTarget->txrxStats.tx_stats.tx_multicast_pkts;
-+    pStats->tx_multicast_bytes  += pTarget->txrxStats.tx_stats.tx_multicast_bytes;
-+    pStats->tx_broadcast_pkts   += pTarget->txrxStats.tx_stats.tx_broadcast_pkts;
-+    pStats->tx_broadcast_bytes  += pTarget->txrxStats.tx_stats.tx_broadcast_bytes;
-+    pStats->tx_rts_success_cnt  += pTarget->txrxStats.tx_stats.tx_rts_success_cnt;
-+    for(ac = 0; ac < WMM_NUM_AC; ac++)
-+        pStats->tx_packet_per_ac[ac] += pTarget->txrxStats.tx_stats.tx_packet_per_ac[ac];
-+    pStats->tx_errors           += pTarget->txrxStats.tx_stats.tx_errors;
-+    pStats->tx_failed_cnt       += pTarget->txrxStats.tx_stats.tx_failed_cnt;
-+    pStats->tx_retry_cnt        += pTarget->txrxStats.tx_stats.tx_retry_cnt;
-+    pStats->tx_rts_fail_cnt     += pTarget->txrxStats.tx_stats.tx_rts_fail_cnt;
-+    pStats->tx_unicast_rate      = wmi_get_rate(pTarget->txrxStats.tx_stats.tx_unicast_rate);
-+
-+    pStats->rx_packets          += pTarget->txrxStats.rx_stats.rx_packets;
-+    pStats->rx_bytes            += pTarget->txrxStats.rx_stats.rx_bytes;
-+    pStats->rx_unicast_pkts     += pTarget->txrxStats.rx_stats.rx_unicast_pkts;
-+    pStats->rx_unicast_bytes    += pTarget->txrxStats.rx_stats.rx_unicast_bytes;
-+    pStats->rx_multicast_pkts   += pTarget->txrxStats.rx_stats.rx_multicast_pkts;
-+    pStats->rx_multicast_bytes  += pTarget->txrxStats.rx_stats.rx_multicast_bytes;
-+    pStats->rx_broadcast_pkts   += pTarget->txrxStats.rx_stats.rx_broadcast_pkts;
-+    pStats->rx_broadcast_bytes  += pTarget->txrxStats.rx_stats.rx_broadcast_bytes;
-+    pStats->rx_fragment_pkt     += pTarget->txrxStats.rx_stats.rx_fragment_pkt;
-+    pStats->rx_errors           += pTarget->txrxStats.rx_stats.rx_errors;
-+    pStats->rx_crcerr           += pTarget->txrxStats.rx_stats.rx_crcerr;
-+    pStats->rx_key_cache_miss   += pTarget->txrxStats.rx_stats.rx_key_cache_miss;
-+    pStats->rx_decrypt_err      += pTarget->txrxStats.rx_stats.rx_decrypt_err;
-+    pStats->rx_duplicate_frames += pTarget->txrxStats.rx_stats.rx_duplicate_frames;
-+    pStats->rx_unicast_rate      = wmi_get_rate(pTarget->txrxStats.rx_stats.rx_unicast_rate);
-+
-+
-+    pStats->tkip_local_mic_failure
-+                                += pTarget->txrxStats.tkipCcmpStats.tkip_local_mic_failure;
-+    pStats->tkip_counter_measures_invoked
-+                                += pTarget->txrxStats.tkipCcmpStats.tkip_counter_measures_invoked;
-+    pStats->tkip_replays        += pTarget->txrxStats.tkipCcmpStats.tkip_replays;
-+    pStats->tkip_format_errors  += pTarget->txrxStats.tkipCcmpStats.tkip_format_errors;
-+    pStats->ccmp_format_errors  += pTarget->txrxStats.tkipCcmpStats.ccmp_format_errors;
-+    pStats->ccmp_replays        += pTarget->txrxStats.tkipCcmpStats.ccmp_replays;
-+
-+
-+    pStats->power_save_failure_cnt += pTarget->pmStats.power_save_failure_cnt;
-+    pStats->noise_floor_calibation = pTarget->noise_floor_calibation;
-+
-+    pStats->cs_bmiss_cnt        += pTarget->cservStats.cs_bmiss_cnt;
-+    pStats->cs_lowRssi_cnt      += pTarget->cservStats.cs_lowRssi_cnt;
-+    pStats->cs_connect_cnt      += pTarget->cservStats.cs_connect_cnt;
-+    pStats->cs_disconnect_cnt   += pTarget->cservStats.cs_disconnect_cnt;
-+    pStats->cs_aveBeacon_snr    = pTarget->cservStats.cs_aveBeacon_snr;
-+    pStats->cs_aveBeacon_rssi   = pTarget->cservStats.cs_aveBeacon_rssi;
-+    pStats->cs_lastRoam_msec    = pTarget->cservStats.cs_lastRoam_msec;
-+    pStats->cs_snr              = pTarget->cservStats.cs_snr;
-+    pStats->cs_rssi             = pTarget->cservStats.cs_rssi;
-+
-+    pStats->lq_val              = pTarget->lqVal;
-+
-+    pStats->wow_num_pkts_dropped += pTarget->wowStats.wow_num_pkts_dropped;
-+    pStats->wow_num_host_pkt_wakeups += pTarget->wowStats.wow_num_host_pkt_wakeups;
-+    pStats->wow_num_host_event_wakeups += pTarget->wowStats.wow_num_host_event_wakeups;
-+    pStats->wow_num_events_discarded += pTarget->wowStats.wow_num_events_discarded;
-+
-+    ar->statsUpdatePending = FALSE;
-+    wake_up(&arEvent);
-+}
-+
-+void
-+ar6000_rssiThreshold_event(AR_SOFTC_T *ar,  WMI_RSSI_THRESHOLD_VAL newThreshold, A_INT16 rssi)
-+{
-+    USER_RSSI_THOLD userRssiThold;
-+
-+    userRssiThold.tag = rssi_map[newThreshold].tag;
-+    userRssiThold.rssi = rssi;
-+    AR_DEBUG2_PRINTF("rssi Threshold range = %d tag = %d  rssi = %d\n", newThreshold, userRssiThold.tag, rssi);
-+#ifdef SEND_EVENT_TO_APP
-+    ar6000_send_event_to_app(ar, WMI_RSSI_THRESHOLD_EVENTID,(A_UINT8 *)&userRssiThold, sizeof(USER_RSSI_THOLD));
-+#endif
-+}
-+
-+
-+void
-+ar6000_hbChallengeResp_event(AR_SOFTC_T *ar, A_UINT32 cookie, A_UINT32 source)
-+{
-+    if (source == APP_HB_CHALLENGE) {
-+        /* Report it to the app in case it wants a positive acknowledgement */
-+#ifdef SEND_EVENT_TO_APP
-+        ar6000_send_event_to_app(ar, WMIX_HB_CHALLENGE_RESP_EVENTID,
-+                                 (A_UINT8 *)&cookie, sizeof(cookie));
-+#endif
-+    } else {
-+        /* This would ignore the replys that come in after their due time */
-+        if (cookie == ar->arHBChallengeResp.seqNum) {
-+            ar->arHBChallengeResp.outstanding = FALSE;
-+        }
-+    }
-+}
-+
-+
-+void
-+ar6000_reportError_event(AR_SOFTC_T *ar, WMI_TARGET_ERROR_VAL errorVal)
-+{
-+    char    *errString[] = {
-+                [WMI_TARGET_PM_ERR_FAIL]    "WMI_TARGET_PM_ERR_FAIL",
-+                [WMI_TARGET_KEY_NOT_FOUND]  "WMI_TARGET_KEY_NOT_FOUND",
-+                [WMI_TARGET_DECRYPTION_ERR] "WMI_TARGET_DECRYPTION_ERR",
-+                [WMI_TARGET_BMISS]          "WMI_TARGET_BMISS",
-+                [WMI_PSDISABLE_NODE_JOIN]   "WMI_PSDISABLE_NODE_JOIN"
-+                };
-+
-+    A_PRINTF("AR6000 Error on Target. Error = 0x%x\n", errorVal);
-+
-+    /* One error is reported at a time, and errorval is a bitmask */
-+    if(errorVal & (errorVal - 1))
-+       return;
-+
-+    A_PRINTF("AR6000 Error type = ");
-+    switch(errorVal)
-+    {
-+        case WMI_TARGET_PM_ERR_FAIL:
-+        case WMI_TARGET_KEY_NOT_FOUND:
-+        case WMI_TARGET_DECRYPTION_ERR:
-+        case WMI_TARGET_BMISS:
-+        case WMI_PSDISABLE_NODE_JOIN:
-+            A_PRINTF("%s\n", errString[errorVal]);
-+            break;
-+        default:
-+            A_PRINTF("INVALID\n");
-+            break;
-+    }
-+
-+}
-+
-+
-+void
-+ar6000_cac_event(AR_SOFTC_T *ar, A_UINT8 ac, A_UINT8 cacIndication,
-+                 A_UINT8 statusCode, A_UINT8 *tspecSuggestion)
-+{
-+    WMM_TSPEC_IE    *tspecIe;
-+
-+    /*
-+     * This is the TSPEC IE suggestion from AP.
-+     * Suggestion provided by AP under some error
-+     * cases, could be helpful for the host app.
-+     * Check documentation.
-+     */
-+    tspecIe = (WMM_TSPEC_IE *)tspecSuggestion;
-+
-+    /*
-+     * What do we do, if we get TSPEC rejection? One thought
-+     * that comes to mind is implictly delete the pstream...
-+     */
-+    A_PRINTF("AR6000 CAC notification. "
-+                "AC = %d, cacIndication = 0x%x, statusCode = 0x%x\n",
-+                 ac, cacIndication, statusCode);
-+}
-+
-+#define AR6000_PRINT_BSSID(_pBss)  do {     \
-+        A_PRINTF("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",\
-+                 (_pBss)[0],(_pBss)[1],(_pBss)[2],(_pBss)[3],\
-+                 (_pBss)[4],(_pBss)[5]);  \
-+} while(0)
-+
-+void
-+ar6000_roam_tbl_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_TBL *pTbl)
-+{
-+    A_UINT8 i;
-+
-+    A_PRINTF("ROAM TABLE NO OF ENTRIES is %d ROAM MODE is %d\n",
-+              pTbl->numEntries, pTbl->roamMode);
-+    for (i= 0; i < pTbl->numEntries; i++) {
-+        A_PRINTF("[%d]bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ", i,
-+            pTbl->bssRoamInfo[i].bssid[0], pTbl->bssRoamInfo[i].bssid[1],
-+            pTbl->bssRoamInfo[i].bssid[2],
-+            pTbl->bssRoamInfo[i].bssid[3],
-+            pTbl->bssRoamInfo[i].bssid[4],
-+            pTbl->bssRoamInfo[i].bssid[5]);
-+        A_PRINTF("RSSI %d RSSIDT %d LAST RSSI %d UTIL %d ROAM_UTIL %d"
-+                 " BIAS %d\n",
-+            pTbl->bssRoamInfo[i].rssi,
-+            pTbl->bssRoamInfo[i].rssidt,
-+            pTbl->bssRoamInfo[i].last_rssi,
-+            pTbl->bssRoamInfo[i].util,
-+            pTbl->bssRoamInfo[i].roam_util,
-+            pTbl->bssRoamInfo[i].bias);
-+    }
-+}
-+
-+void
-+ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters, WMI_GET_WOW_LIST_REPLY *wow_reply)
-+{
-+    A_UINT8 i,j;
-+
-+    /*Each event now contains exactly one filter, see bug 26613*/
-+    A_PRINTF("WOW pattern %d of %d patterns\n", wow_reply->this_filter_num,                 wow_reply->num_filters);
-+    A_PRINTF("wow mode = %s host mode = %s\n",
-+            (wow_reply->wow_mode == 0? "disabled":"enabled"),
-+            (wow_reply->host_mode == 1 ? "awake":"asleep"));
-+
-+
-+    /*If there are no patterns, the reply will only contain generic
-+      WoW information. Pattern information will exist only if there are
-+      patterns present. Bug 26716*/
-+
-+   /* If this event contains pattern information, display it*/
-+    if (wow_reply->this_filter_num) {
-+        i=0;
-+        A_PRINTF("id=%d size=%d offset=%d\n",
-+                    wow_reply->wow_filters[i].wow_filter_id,
-+                    wow_reply->wow_filters[i].wow_filter_size,
-+                    wow_reply->wow_filters[i].wow_filter_offset);
-+       A_PRINTF("wow pattern = ");
-+       for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
-+             A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_pattern[j]);
-+        }
-+
-+        A_PRINTF("\nwow mask = ");
-+        for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
-+            A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_mask[j]);
-+        }
-+        A_PRINTF("\n");
-+    }
-+}
-+
-+/*
-+ * Report the Roaming related data collected on the target
-+ */
-+void
-+ar6000_display_roam_time(WMI_TARGET_ROAM_TIME *p)
-+{
-+    A_PRINTF("Disconnect Data : BSSID: ");
-+    AR6000_PRINT_BSSID(p->disassoc_bssid);
-+    A_PRINTF(" RSSI %d DISASSOC Time %d NO_TXRX_TIME %d\n",
-+             p->disassoc_bss_rssi,p->disassoc_time,
-+             p->no_txrx_time);
-+    A_PRINTF("Connect Data: BSSID: ");
-+    AR6000_PRINT_BSSID(p->assoc_bssid);
-+    A_PRINTF(" RSSI %d ASSOC Time %d TXRX_TIME %d\n",
-+             p->assoc_bss_rssi,p->assoc_time,
-+             p->allow_txrx_time);
-+    A_PRINTF("Last Data Tx Time (b4 Disassoc) %d "\
-+             "First Data Tx Time (after Assoc) %d\n",
-+             p->last_data_txrx_time, p->first_data_txrx_time);
-+}
-+
-+void
-+ar6000_roam_data_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_DATA *p)
-+{
-+    switch (p->roamDataType) {
-+        case ROAM_DATA_TIME:
-+            ar6000_display_roam_time(&p->u.roamTime);
-+            break;
-+        default:
-+            break;
-+    }
-+}
-+
-+void
-+ar6000_bssInfo_event_rx(AR_SOFTC_T *ar, A_UINT8 *datap, int len)
-+{
-+    struct sk_buff *skb;
-+    WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
-+
-+
-+    if (!ar->arMgmtFilter) {
-+        return;
-+    }
-+    if (((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_BEACON) &&
-+        (bih->frameType != BEACON_FTYPE))  ||
-+        ((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_PROBE_RESP) &&
-+        (bih->frameType != PROBERESP_FTYPE)))
-+    {
-+        return;
-+    }
-+
-+    if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
-+
-+        A_NETBUF_PUT(skb, len);
-+        A_MEMCPY(A_NETBUF_DATA(skb), datap, len);
-+        skb->dev = ar->arNetDev;
-+	printk("MAC RAW...\n");
-+//        skb->mac.raw = A_NETBUF_DATA(skb);
-+        skb->ip_summed = CHECKSUM_NONE;
-+        skb->pkt_type = PACKET_OTHERHOST;
-+        skb->protocol = __constant_htons(0x0019);
-+        netif_rx(skb);
-+    }
-+}
-+
-+A_UINT32 wmiSendCmdNum;
-+
-+A_STATUS
-+ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID)
-+{
-+    AR_SOFTC_T       *ar = (AR_SOFTC_T *)devt;
-+    A_STATUS         status = A_OK;
-+    struct ar_cookie *cookie = NULL;
-+    int i;
-+
-+        /* take lock to protect ar6000_alloc_cookie() */
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    do {
-+
-+        AR_DEBUG2_PRINTF("ar_contrstatus = ol_tx: skb=0x%x, len=0x%x, sid=%d\n",
-+                         (A_UINT32)osbuf, A_NETBUF_LEN(osbuf), streamID);
-+
-+        if ((streamID == WMI_CONTROL_PRI) && (ar->arWMIControlEpFull)) {
-+                /* control endpoint is full, don't allocate resources, we
-+                 * are just going to drop this packet */
-+            cookie = NULL;
-+            AR_DEBUG_PRINTF(" WMI Control EP full, dropping packet : 0x%X, len:%d \n",
-+                    (A_UINT32)osbuf, A_NETBUF_LEN(osbuf));
-+        } else {
-+            cookie = ar6000_alloc_cookie(ar);
-+        }
-+
-+        if (cookie == NULL) {
-+            status = A_NO_MEMORY;
-+            break;
-+        }
-+
-+        if(logWmiRawMsgs) {
-+            A_PRINTF("WMI cmd send, msgNo %d :", wmiSendCmdNum);
-+            for(i = 0; i < a_netbuf_to_len(osbuf); i++)
-+                A_PRINTF("%x ", ((A_UINT8 *)a_netbuf_to_data(osbuf))[i]);
-+            A_PRINTF("\n");
-+        }
-+
-+        wmiSendCmdNum++;
-+
-+    } while (FALSE);
-+
-+    if (cookie != NULL) {
-+            /* got a structure to send it out on */
-+        ar->arTxPending[streamID]++;
-+
-+        if (streamID != WMI_CONTROL_PRI) {
-+            ar->arTotalTxDataPending++;
-+        }
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    if (cookie != NULL) {
-+        cookie->arc_bp[0] = (A_UINT32)osbuf;
-+        cookie->arc_bp[1] = 0;
-+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
-+                               cookie,
-+                               A_NETBUF_DATA(osbuf),
-+                               A_NETBUF_LEN(osbuf),
-+                               arWMIStream2EndpointID(ar,streamID),
-+                               AR6K_CONTROL_PKT_TAG);
-+            /* this interface is asynchronous, if there is an error, cleanup will happen in the
-+             * TX completion callback */
-+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
-+        status = A_OK;
-+    }
-+
-+    return status;
-+}
-+
-+/* indicate tx activity or inactivity on a WMI stream */
-+void ar6000_indicate_tx_activity(void *devt, A_UINT8 TrafficClass, A_BOOL Active)
-+{
-+    AR_SOFTC_T  *ar = (AR_SOFTC_T *)devt;
-+    WMI_PRI_STREAM_ID streamid;
-+
-+    if (ar->arWmiEnabled) {
-+        streamid = wmi_get_stream_id(ar->arWmi, TrafficClass);
-+    } else {
-+            /* for mbox ping testing, the traffic class is mapped directly as a stream ID,
-+             * see handling of AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE in ioctl.c */
-+        streamid = (WMI_PRI_STREAM_ID)TrafficClass;
-+    }
-+
-+        /* notify HTC, this may cause credit distribution changes */
-+
-+    HTCIndicateActivityChange(ar->arHtcTarget,
-+                              arWMIStream2EndpointID(ar,streamid),
-+                              Active);
-+
-+}
-+
-+module_init(ar6000_init_module);
-+module_exit(ar6000_cleanup_module);
-+
-+/* Init cookie queue */
-+static void
-+ar6000_cookie_init(AR_SOFTC_T *ar)
-+{
-+    A_UINT32    i;
-+
-+    ar->arCookieList = NULL;
-+    A_MEMZERO(s_ar_cookie_mem, sizeof(s_ar_cookie_mem));
-+
-+    for (i = 0; i < MAX_COOKIE_NUM; i++) {
-+        ar6000_free_cookie(ar, &s_ar_cookie_mem[i]);
-+    }
-+}
-+
-+/* cleanup cookie queue */
-+static void
-+ar6000_cookie_cleanup(AR_SOFTC_T *ar)
-+{
-+    /* It is gone .... */
-+    ar->arCookieList = NULL;
-+}
-+
-+/* Init cookie queue */
-+static void
-+ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie)
-+{
-+    /* Insert first */
-+    A_ASSERT(ar != NULL);
-+    A_ASSERT(cookie != NULL);
-+    cookie->arc_list_next = ar->arCookieList;
-+    ar->arCookieList = cookie;
-+}
-+
-+/* cleanup cookie queue */
-+static struct ar_cookie *
-+ar6000_alloc_cookie(AR_SOFTC_T  *ar)
-+{
-+    struct ar_cookie   *cookie;
-+
-+    cookie = ar->arCookieList;
-+    if(cookie != NULL)
-+    {
-+        ar->arCookieList = cookie->arc_list_next;
-+    }
-+
-+    return cookie;
-+}
-+
-+#ifdef SEND_EVENT_TO_APP
-+/*
-+ * This function is used to send event which come from taget to
-+ * the application. The buf which send to application is include
-+ * the event ID and event content.
-+ */
-+#define EVENT_ID_LEN   2
-+void ar6000_send_event_to_app(AR_SOFTC_T *ar, A_UINT16 eventId,
-+                              A_UINT8 *datap, int len)
-+{
-+
-+#if (WIRELESS_EXT >= 15)
-+
-+/* note: IWEVCUSTOM only exists in wireless extensions after version 15 */
-+
-+    char *buf;
-+    A_UINT16 size;
-+    union iwreq_data wrqu;
-+
-+    size = len + EVENT_ID_LEN;
-+
-+    if (size > IW_CUSTOM_MAX) {
-+        AR_DEBUG_PRINTF("WMI event ID : 0x%4.4X, len = %d too big for IWEVCUSTOM (max=%d) \n",
-+                eventId, size, IW_CUSTOM_MAX);
-+        return;
-+    }
-+
-+    buf = A_MALLOC_NOWAIT(size);
-+    A_MEMZERO(buf, size);
-+    A_MEMCPY(buf, &eventId, EVENT_ID_LEN);
-+    A_MEMCPY(buf+EVENT_ID_LEN, datap, len);
-+
-+    //AR_DEBUG_PRINTF("event ID = %d,len = %d\n",*(A_UINT16*)buf, size);
-+    A_MEMZERO(&wrqu, sizeof(wrqu));
-+    wrqu.data.length = size;
-+    wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+
-+    A_FREE(buf);
-+#endif
-+
-+
-+}
-+#endif
-+
-+
-+void
-+ar6000_tx_retry_err_event(void *devt)
-+{
-+    AR_DEBUG2_PRINTF("Tx retries reach maximum!\n");
-+}
-+
-+void
-+ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, A_UINT8 snr)
-+{
-+    AR_DEBUG2_PRINTF("snr threshold range %d, snr %d\n", newThreshold, snr);
-+}
-+
-+void
-+ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL newThreshold, A_UINT8 lq)
-+{
-+    AR_DEBUG2_PRINTF("lq threshold range %d, lq %d\n", newThreshold, lq);
-+}
-+
-+
-+
-+A_UINT32
-+a_copy_to_user(void *to, const void *from, A_UINT32 n)
-+{
-+    return(copy_to_user(to, from, n));
-+}
-+
-+A_UINT32
-+a_copy_from_user(void *to, const void *from, A_UINT32 n)
-+{
-+    return(copy_from_user(to, from, n));
-+}
-+
-+
-+A_STATUS
-+ar6000_get_driver_cfg(struct net_device *dev,
-+                        A_UINT16 cfgParam,
-+                        void *result)
-+{
-+
-+    A_STATUS    ret = 0;
-+
-+    switch(cfgParam)
-+    {
-+        case AR6000_DRIVER_CFG_GET_WLANNODECACHING:
-+           *((A_UINT32 *)result) = wlanNodeCaching;
-+           break;
-+        case AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS:
-+           *((A_UINT32 *)result) = logWmiRawMsgs;
-+            break;
-+        default:
-+           ret = EINVAL;
-+           break;
-+    }
-+
-+    return ret;
-+}
-+
-+void
-+ar6000_keepalive_rx(void *devt, A_UINT8 configured)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+    ar->arKeepaliveConfigured = configured;
-+    wake_up(&arEvent);
-+}
-+
-+void
-+ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID, WMI_PMKID *pmkidList)
-+{
-+    A_UINT8 i, j;
-+
-+    A_PRINTF("Number of Cached PMKIDs is %d\n", numPMKID);
-+
-+    for (i = 0; i < numPMKID; i++) {
-+        A_PRINTF("\nPMKID %d ", i);
-+            for (j = 0; j < WMI_PMKID_LEN; j++) {
-+                A_PRINTF("%2.2x", pmkidList->pmkid[j]);
-+            }
-+        pmkidList++;
-+    }
-+}
-+
-+#ifdef USER_KEYS
-+static A_STATUS
-+
-+ar6000_reinstall_keys(AR_SOFTC_T *ar, A_UINT8 key_op_ctrl)
-+{
-+    A_STATUS status = A_OK;
-+    struct ieee80211req_key *uik = &ar->user_saved_keys.ucast_ik;
-+    struct ieee80211req_key *bik = &ar->user_saved_keys.bcast_ik;
-+    CRYPTO_TYPE  keyType = ar->user_saved_keys.keyType;
-+
-+    if (IEEE80211_CIPHER_CCKM_KRK != uik->ik_type) {
-+        if (NONE_CRYPT == keyType) {
-+            goto _reinstall_keys_out;
-+        }
-+
-+        if (uik->ik_keylen) {
-+            status = wmi_addKey_cmd(ar->arWmi, uik->ik_keyix,
-+                    ar->user_saved_keys.keyType, PAIRWISE_USAGE,
-+                    uik->ik_keylen, (A_UINT8 *)&uik->ik_keyrsc,
-+                    uik->ik_keydata, key_op_ctrl, SYNC_BEFORE_WMIFLAG);
-+        }
-+
-+    } else {
-+        status = wmi_add_krk_cmd(ar->arWmi, uik->ik_keydata);
-+    }
-+
-+    if (IEEE80211_CIPHER_CCKM_KRK != bik->ik_type) {
-+        if (NONE_CRYPT == keyType) {
-+            goto _reinstall_keys_out;
-+        }
-+
-+        if (bik->ik_keylen) {
-+            status = wmi_addKey_cmd(ar->arWmi, bik->ik_keyix,
-+                    ar->user_saved_keys.keyType, GROUP_USAGE,
-+                    bik->ik_keylen, (A_UINT8 *)&bik->ik_keyrsc,
-+                    bik->ik_keydata, key_op_ctrl, NO_SYNC_WMIFLAG);
-+        }
-+    } else {
-+        status = wmi_add_krk_cmd(ar->arWmi, bik->ik_keydata);
-+    }
-+
-+_reinstall_keys_out:
-+    ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+    ar->user_key_ctrl      = 0;
-+
-+    return status;
-+}
-+#endif /* USER_KEYS */
-+
-+
-+void
-+ar6000_dset_open_req(
-+    void *context,
-+    A_UINT32 id,
-+    A_UINT32 targHandle,
-+    A_UINT32 targReplyFn,
-+    A_UINT32 targReplyArg)
-+{
-+}
-+
-+void
-+ar6000_dset_close(
-+    void *context,
-+    A_UINT32 access_cookie)
-+{
-+    return;
-+}
-+
-+void
-+ar6000_dset_data_req(
-+   void *context,
-+   A_UINT32 accessCookie,
-+   A_UINT32 offset,
-+   A_UINT32 length,
-+   A_UINT32 targBuf,
-+   A_UINT32 targReplyFn,
-+   A_UINT32 targReplyArg)
-+{
-+}
-diff --git a/drivers/ar6000/ar6000/ar6000_drv.h b/drivers/ar6000/ar6000/ar6000_drv.h
-new file mode 100644
-index 0000000..3230d32
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_drv.h
-@@ -0,0 +1,361 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _AR6000_H_
-+#define _AR6000_H_
-+
-+#include <linux/version.h>
-+
-+
-+#include <generated/autoconf.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/spinlock.h>
-+#include <linux/skbuff.h>
-+#include <linux/if_ether.h>
-+#include <linux/netdevice.h>
-+#include <linux/etherdevice.h>
-+#include <net/iw_handler.h>
-+#include <linux/if_arp.h>
-+#include <linux/ip.h>
-+#include <linux/semaphore.h>
-+#include <linux/wireless.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <asm/io.h>
-+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "htc_api.h"
-+#include "wmi.h"
-+#include "a_drv.h"
-+#include "bmi.h"
-+#include <ieee80211.h>
-+#include <ieee80211_ioctl.h>
-+#include <wlan_api.h>
-+#include <wmi_api.h>
-+#include "gpio_api.h"
-+#include "gpio.h"
-+#include <host_version.h>
-+#include <linux/rtnetlink.h>
-+#include <linux/init.h>
-+#include <linux/moduleparam.h>
-+#include "AR6Khwreg.h"
-+#include "ar6000_api.h"
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+#include <testcmd.h>
-+#endif
-+
-+#include "targaddrs.h"
-+#include "dbglog_api.h"
-+#include "ar6000_diag.h"
-+#include "common_drv.h"
-+
-+#ifndef  __dev_put
-+#define  __dev_put(dev) dev_put(dev)
-+#endif
-+
-+#ifdef USER_KEYS
-+
-+#define USER_SAVEDKEYS_STAT_INIT     0
-+#define USER_SAVEDKEYS_STAT_RUN      1
-+
-+// TODO this needs to move into the AR_SOFTC struct
-+struct USER_SAVEDKEYS {
-+    struct ieee80211req_key   ucast_ik;
-+    struct ieee80211req_key   bcast_ik;
-+    CRYPTO_TYPE               keyType;
-+    A_BOOL                    keyOk;
-+};
-+#endif
-+
-+#define DBG_INFO		0x00000001
-+#define DBG_ERROR		0x00000002
-+#define DBG_WARNING		0x00000004
-+#define DBG_SDIO		0x00000008
-+#define DBG_HIF			0x00000010
-+#define DBG_HTC			0x00000020
-+#define DBG_WMI			0x00000040
-+#define DBG_WMI2		0x00000080
-+#define DBG_DRIVER		0x00000100
-+
-+#define DBG_DEFAULTS	(DBG_ERROR|DBG_WARNING)
-+
-+
-+#ifdef DEBUG
-+#define AR_DEBUG_PRINTF(args...)        if (debugdriver) A_PRINTF(args);
-+#define AR_DEBUG2_PRINTF(args...)        if (debugdriver >= 2) A_PRINTF(args);
-+extern int debugdriver;
-+#else
-+#define AR_DEBUG_PRINTF(args...)
-+#define AR_DEBUG2_PRINTF(args...)
-+#endif
-+
-+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#define	MAX_AR6000                        1
-+#define AR6000_MAX_RX_BUFFERS             16
-+#define AR6000_BUFFER_SIZE                1664
-+#define AR6000_TX_TIMEOUT                 10
-+#define	AR6000_ETH_ADDR_LEN               6
-+#define	AR6000_MAX_ENDPOINTS              4
-+#define MAX_NODE_NUM                      15
-+#define MAX_COOKIE_NUM                    150
-+#define AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT        1
-+#define AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT  1
-+
-+enum {
-+    DRV_HB_CHALLENGE = 0,
-+    APP_HB_CHALLENGE
-+};
-+
-+/* HTC RAW streams */
-+typedef enum _HTC_RAW_STREAM_ID {
-+    HTC_RAW_STREAM_NOT_MAPPED = -1,
-+    HTC_RAW_STREAM_0 = 0,
-+    HTC_RAW_STREAM_1 = 1,
-+    HTC_RAW_STREAM_2 = 2,
-+    HTC_RAW_STREAM_3 = 3,
-+    HTC_RAW_STREAM_NUM_MAX
-+} HTC_RAW_STREAM_ID;
-+
-+#define RAW_HTC_READ_BUFFERS_NUM    4
-+#define RAW_HTC_WRITE_BUFFERS_NUM   4
-+
-+typedef struct {
-+    int currPtr;
-+    int length;
-+    unsigned char data[AR6000_BUFFER_SIZE];
-+    HTC_PACKET    HTCPacket;
-+} raw_htc_buffer;
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/*
-+ *  add TCMD_MODE besides wmi and bypasswmi
-+ *  in TCMD_MODE, only few TCMD releated wmi commands
-+ *  counld be hanlder
-+ */
-+enum {
-+    AR6000_WMI_MODE = 0,
-+    AR6000_BYPASS_MODE,
-+    AR6000_TCMD_MODE,
-+    AR6000_WLAN_MODE
-+};
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
-+
-+struct ar_wep_key {
-+    A_UINT8                 arKeyIndex;
-+    A_UINT8                 arKeyLen;
-+    A_UINT8                 arKey[64];
-+} ;
-+
-+struct ar_node_mapping {
-+    A_UINT8                 macAddress[6];
-+    A_UINT8                 epId;
-+    A_UINT8                 txPending;
-+};
-+
-+struct ar_cookie {
-+    A_UINT32               arc_bp[2];    /* Must be first field */
-+    HTC_PACKET             HtcPkt;       /* HTC packet wrapper */
-+    struct ar_cookie *arc_list_next;
-+};
-+
-+struct ar_hb_chlng_resp {
-+    A_TIMER                 timer;
-+    A_UINT32                frequency;
-+    A_UINT32                seqNum;
-+    A_BOOL                  outstanding;
-+    A_UINT8                 missCnt;
-+    A_UINT8                 missThres;
-+};
-+
-+typedef struct ar6_softc {
-+    struct net_device       *arNetDev;    /* net_device pointer */
-+    void                    *arWmi;
-+    int                     arTxPending[WMI_PRI_MAX_COUNT];
-+    int                     arTotalTxDataPending;
-+    A_UINT8                 arNumDataEndPts;
-+    A_BOOL                  arWmiEnabled;
-+    A_BOOL                  arWmiReady;
-+    A_BOOL                  arConnected;
-+    A_BOOL                  arRadioSwitch;
-+    HTC_HANDLE              arHtcTarget;
-+    void                    *arHifDevice;
-+    spinlock_t              arLock;
-+    struct semaphore        arSem;
-+    int                     arRxBuffers[WMI_PRI_MAX_COUNT];
-+    int                     arSsidLen;
-+    u_char                  arSsid[32];
-+    A_UINT8                 arNetworkType;
-+    A_UINT8                 arDot11AuthMode;
-+    A_UINT8                 arAuthMode;
-+    A_UINT8                 arPairwiseCrypto;
-+    A_UINT8                 arPairwiseCryptoLen;
-+    A_UINT8                 arGroupCrypto;
-+    A_UINT8                 arGroupCryptoLen;
-+    A_UINT8                 arDefTxKeyIndex;
-+    struct ar_wep_key       arWepKeyList[WMI_MAX_KEY_INDEX + 1];
-+    A_UINT8                 arBssid[6];
-+    A_UINT8                 arReqBssid[6];
-+    A_UINT16                arChannelHint;
-+    A_UINT16                arBssChannel;
-+    A_UINT16                arListenInterval;
-+    struct ar6000_version   arVersion;
-+    A_UINT32                arTargetType;
-+    A_INT8                  arRssi;
-+    A_UINT8                 arTxPwr;
-+    A_BOOL                  arTxPwrSet;
-+    A_INT32                 arBitRate;
-+    struct net_device_stats arNetStats;
-+    struct iw_statistics 	arIwStats;
-+    A_INT8                  arNumChannels;
-+    A_UINT16                arChannelList[32];
-+    A_UINT32                arRegCode;
-+    A_BOOL                  statsUpdatePending;
-+    TARGET_STATS            arTargetStats;
-+    A_INT8                  arMaxRetries;
-+    A_UINT8                 arPhyCapability;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+    A_UINT8                 tcmdRxReport;
-+    A_UINT32                tcmdRxTotalPkt;
-+    A_INT32                 tcmdRxRssi;
-+    A_UINT32                tcmdPm;
-+   A_UINT32                 arTargetMode;
-+#endif
-+    AR6000_WLAN_STATE       arWlanState;
-+    struct ar_node_mapping  arNodeMap[MAX_NODE_NUM];
-+    A_UINT8                 arIbssPsEnable;
-+    A_UINT8                 arNodeNum;
-+    A_UINT8                 arNexEpId;
-+    struct ar_cookie        *arCookieList;
-+    A_UINT16                arRateMask;
-+    A_UINT8                 arSkipScan;
-+    A_UINT16                arBeaconInterval;
-+    A_BOOL                  arConnectPending;
-+    A_BOOL                  arWmmEnabled;
-+    struct ar_hb_chlng_resp arHBChallengeResp;
-+    A_UINT8                 arKeepaliveConfigured;
-+    A_UINT32                arMgmtFilter;
-+    HTC_ENDPOINT_ID         arWmi2EpMapping[WMI_PRI_MAX_COUNT];
-+    WMI_PRI_STREAM_ID       arEp2WmiMapping[ENDPOINT_MAX];
-+#ifdef HTC_RAW_INTERFACE
-+    HTC_ENDPOINT_ID         arRaw2EpMapping[HTC_RAW_STREAM_NUM_MAX];
-+    HTC_RAW_STREAM_ID       arEp2RawMapping[ENDPOINT_MAX];
-+    struct semaphore        raw_htc_read_sem[HTC_RAW_STREAM_NUM_MAX];
-+    struct semaphore        raw_htc_write_sem[HTC_RAW_STREAM_NUM_MAX];
-+    wait_queue_head_t       raw_htc_read_queue[HTC_RAW_STREAM_NUM_MAX];
-+    wait_queue_head_t       raw_htc_write_queue[HTC_RAW_STREAM_NUM_MAX];
-+    raw_htc_buffer          *raw_htc_read_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_READ_BUFFERS_NUM];
-+    raw_htc_buffer          *raw_htc_write_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_WRITE_BUFFERS_NUM];
-+    A_BOOL                  write_buffer_available[HTC_RAW_STREAM_NUM_MAX];
-+    A_BOOL                  read_buffer_available[HTC_RAW_STREAM_NUM_MAX];
-+#endif
-+    A_BOOL                  arRawIfInit;
-+    int                     arDeviceIndex;
-+    COMMON_CREDIT_STATE_INFO arCreditStateInfo;
-+    A_BOOL                  arWMIControlEpFull;
-+    A_BOOL                  dbgLogFetchInProgress;
-+    A_UCHAR                 log_buffer[DBGLOG_HOST_LOG_BUFFER_SIZE];
-+    A_UINT32                log_cnt;
-+    A_UINT32                dbglog_init_done;
-+    A_UINT32                arConnectCtrlFlags;
-+	A_UINT32                scan_complete;
-+#ifdef USER_KEYS
-+    A_INT32                 user_savedkeys_stat;
-+    A_UINT32                user_key_ctrl;
-+    struct USER_SAVEDKEYS   user_saved_keys;
-+#endif
-+} AR_SOFTC_T;
-+
-+
-+#define arWMIStream2EndpointID(ar,wmi)          (ar)->arWmi2EpMapping[(wmi)]
-+#define arSetWMIStream2EndpointIDMap(ar,wmi,ep)  \
-+{  (ar)->arWmi2EpMapping[(wmi)] = (ep); \
-+   (ar)->arEp2WmiMapping[(ep)] = (wmi); }
-+#define arEndpoint2WMIStreamID(ar,ep)           (ar)->arEp2WmiMapping[(ep)]
-+
-+#define arRawIfEnabled(ar) (ar)->arRawIfInit
-+#define arRawStream2EndpointID(ar,raw)          (ar)->arRaw2EpMapping[(raw)]
-+#define arSetRawStream2EndpointIDMap(ar,raw,ep)  \
-+{  (ar)->arRaw2EpMapping[(raw)] = (ep); \
-+   (ar)->arEp2RawMapping[(ep)] = (raw); }
-+#define arEndpoint2RawStreamID(ar,ep)           (ar)->arEp2RawMapping[(ep)]
-+
-+struct ar_giwscan_param {
-+    char    *current_ev;
-+    char    *end_buf;
-+    A_BOOL  firstPass;
-+};
-+
-+#define AR6000_STAT_INC(ar, stat)       (ar->arNetStats.stat++)
-+
-+#define AR6000_SPIN_LOCK(lock, param)   do {                            \
-+    if (irqs_disabled()) {                                              \
-+        AR_DEBUG_PRINTF("IRQs disabled:AR6000_LOCK\n");                 \
-+    }                                                                   \
-+    spin_lock_bh(lock);                                                 \
-+} while (0)
-+
-+#define AR6000_SPIN_UNLOCK(lock, param) do {                            \
-+    if (irqs_disabled()) {                                              \
-+        AR_DEBUG_PRINTF("IRQs disabled: AR6000_UNLOCK\n");              \
-+    }                                                                   \
-+    spin_unlock_bh(lock);                                               \
-+} while (0)
-+
-+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-+int ar6000_ioctl_dispatcher(struct net_device *dev, struct ifreq *rq, int cmd);
-+void ar6000_ioctl_iwsetup(struct iw_handler_def *def);
-+void ar6000_gpio_init(void);
-+void ar6000_init_profile_info(AR_SOFTC_T *ar);
-+void ar6000_install_static_wep_keys(AR_SOFTC_T *ar);
-+int ar6000_init(struct net_device *dev);
-+int ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar);
-+A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar);
-+
-+#ifdef HTC_RAW_INTERFACE
-+
-+#ifndef __user
-+#define __user
-+#endif
-+
-+int ar6000_htc_raw_open(AR_SOFTC_T *ar);
-+int ar6000_htc_raw_close(AR_SOFTC_T *ar);
-+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar,
-+                            HTC_RAW_STREAM_ID StreamID,
-+                            char __user *buffer, size_t count);
-+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar,
-+                             HTC_RAW_STREAM_ID StreamID,
-+                             char __user *buffer, size_t count);
-+
-+#endif /* HTC_RAW_INTERFACE */
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _AR6000_H_ */
-diff --git a/drivers/ar6000/ar6000/ar6000_raw_if.c b/drivers/ar6000/ar6000/ar6000_raw_if.c
-new file mode 100644
-index 0000000..c0d9f8e
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_raw_if.c
-@@ -0,0 +1,440 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "ar6000_drv.h"
-+
-+#ifdef HTC_RAW_INTERFACE
-+
-+static void
-+ar6000_htc_raw_read_cb(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR_SOFTC_T        *ar = (AR_SOFTC_T *)Context;
-+    raw_htc_buffer    *busy;
-+    HTC_RAW_STREAM_ID streamID;
-+
-+    busy = (raw_htc_buffer *)pPacket->pPktContext;
-+    A_ASSERT(busy != NULL);
-+
-+    if (pPacket->Status == A_ECANCELED) {
-+        /*
-+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+         * (probably due to a shutdown)
-+         */
-+        return;
-+    }
-+
-+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
-+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
-+
-+#ifdef CF
-+   if (down_trylock(&ar->raw_htc_read_sem[streamID])) {
-+#else
-+    if (down_interruptible(&ar->raw_htc_read_sem[streamID])) {
-+#endif /* CF */
-+        AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
-+    }
-+
-+    A_ASSERT((pPacket->Status != A_OK) ||
-+             (pPacket->pBuffer == (busy->data + HTC_HEADER_LEN)));
-+
-+    busy->length = pPacket->ActualLength + HTC_HEADER_LEN;
-+    busy->currPtr = HTC_HEADER_LEN;
-+    ar->read_buffer_available[streamID] = TRUE;
-+    //AR_DEBUG_PRINTF("raw read cb:  0x%X 0x%X \n", busy->currPtr,busy->length);
-+    up(&ar->raw_htc_read_sem[streamID]);
-+
-+    /* Signal the waiting process */
-+    AR_DEBUG2_PRINTF("Waking up the StreamID(%d) read process\n", streamID);
-+    wake_up_interruptible(&ar->raw_htc_read_queue[streamID]);
-+}
-+
-+static void
-+ar6000_htc_raw_write_cb(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR_SOFTC_T          *ar = (AR_SOFTC_T  *)Context;
-+    raw_htc_buffer      *free;
-+    HTC_RAW_STREAM_ID   streamID;
-+
-+    free = (raw_htc_buffer *)pPacket->pPktContext;
-+    A_ASSERT(free != NULL);
-+
-+    if (pPacket->Status == A_ECANCELED) {
-+        /*
-+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+         * (probably due to a shutdown)
-+         */
-+        return;
-+    }
-+
-+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
-+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
-+
-+#ifdef CF
-+    if (down_trylock(&ar->raw_htc_write_sem[streamID])) {
-+#else
-+    if (down_interruptible(&ar->raw_htc_write_sem[streamID])) {
-+#endif
-+        AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
-+    }
-+
-+    A_ASSERT(pPacket->pBuffer == (free->data + HTC_HEADER_LEN));
-+
-+    free->length = 0;
-+    ar->write_buffer_available[streamID] = TRUE;
-+    up(&ar->raw_htc_write_sem[streamID]);
-+
-+    /* Signal the waiting process */
-+    AR_DEBUG2_PRINTF("Waking up the StreamID(%d) write process\n", streamID);
-+    wake_up_interruptible(&ar->raw_htc_write_queue[streamID]);
-+}
-+
-+/* connect to a service */
-+static A_STATUS ar6000_connect_raw_service(AR_SOFTC_T        *ar,
-+                                           HTC_RAW_STREAM_ID StreamID)
-+{
-+    A_STATUS                 status;
-+    HTC_SERVICE_CONNECT_RESP response;
-+    A_UINT8                  streamNo;
-+    HTC_SERVICE_CONNECT_REQ  connect;
-+
-+    do {
-+
-+        A_MEMZERO(&connect,sizeof(connect));
-+            /* pass the stream ID as meta data to the RAW streams service */
-+        streamNo = (A_UINT8)StreamID;
-+        connect.pMetaData = &streamNo;
-+        connect.MetaDataLength = sizeof(A_UINT8);
-+            /* these fields are the same for all endpoints */
-+        connect.EpCallbacks.pContext = ar;
-+        connect.EpCallbacks.EpTxComplete = ar6000_htc_raw_write_cb;
-+        connect.EpCallbacks.EpRecv = ar6000_htc_raw_read_cb;
-+            /* simple interface, we don't need these optional callbacks */
-+        connect.EpCallbacks.EpRecvRefill = NULL;
-+        connect.EpCallbacks.EpSendFull = NULL;
-+        connect.EpCallbacks.EpSendAvail = NULL;
-+        connect.MaxSendQueueDepth = RAW_HTC_WRITE_BUFFERS_NUM;
-+
-+            /* connect to the raw streams service, we may be able to get 1 or more
-+             * connections, depending on WHAT is running on the target */
-+        connect.ServiceID = HTC_RAW_STREAMS_SVC;
-+
-+        A_MEMZERO(&response,sizeof(response));
-+
-+            /* try to connect to the raw stream, it is okay if this fails with
-+             * status HTC_SERVICE_NO_MORE_EP */
-+        status = HTCConnectService(ar->arHtcTarget,
-+                                   &connect,
-+                                   &response);
-+
-+        if (A_FAILED(status)) {
-+            if (response.ConnectRespCode == HTC_SERVICE_NO_MORE_EP) {
-+                AR_DEBUG_PRINTF("HTC RAW , No more streams allowed \n");
-+                status = A_OK;
-+            }
-+            break;
-+        }
-+
-+            /* set endpoint mapping for the RAW HTC streams */
-+        arSetRawStream2EndpointIDMap(ar,StreamID,response.Endpoint);
-+
-+        AR_DEBUG_PRINTF("HTC RAW : stream ID: %d, endpoint: %d\n",
-+                        StreamID, arRawStream2EndpointID(ar,StreamID));
-+
-+    } while (FALSE);
-+
-+    return status;
-+}
-+
-+int ar6000_htc_raw_open(AR_SOFTC_T *ar)
-+{
-+    A_STATUS status;
-+    int streamID, endPt, count2;
-+    raw_htc_buffer *buffer;
-+    HTC_SERVICE_ID servicepriority;
-+
-+    A_ASSERT(ar->arHtcTarget != NULL);
-+
-+        /* wait for target */
-+    status = HTCWaitTarget(ar->arHtcTarget);
-+
-+    if (A_FAILED(status)) {
-+        AR_DEBUG_PRINTF("HTCWaitTarget failed (%d)\n", status);
-+        return -ENODEV;
-+    }
-+
-+    for (endPt = 0; endPt < ENDPOINT_MAX; endPt++) {
-+        ar->arEp2RawMapping[endPt] = HTC_RAW_STREAM_NOT_MAPPED;
-+    }
-+
-+    for (streamID = HTC_RAW_STREAM_0; streamID < HTC_RAW_STREAM_NUM_MAX; streamID++) {
-+        /* Initialize the data structures */
-+        sema_init(&ar->raw_htc_read_sem[streamID], 1);
-+        sema_init(&ar->raw_htc_write_sem[streamID], 1);
-+        init_waitqueue_head(&ar->raw_htc_read_queue[streamID]);
-+        init_waitqueue_head(&ar->raw_htc_write_queue[streamID]);
-+
-+            /* try to connect to the raw service */
-+        status = ar6000_connect_raw_service(ar,streamID);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        if (arRawStream2EndpointID(ar,streamID) == 0) {
-+            break;
-+        }
-+
-+        for (count2 = 0; count2 < RAW_HTC_READ_BUFFERS_NUM; count2 ++) {
-+            /* Initialize the receive buffers */
-+            buffer = ar->raw_htc_write_buffer[streamID][count2];
-+            memset(buffer, 0, sizeof(raw_htc_buffer));
-+            buffer = ar->raw_htc_read_buffer[streamID][count2];
-+            memset(buffer, 0, sizeof(raw_htc_buffer));
-+
-+            SET_HTC_PACKET_INFO_RX_REFILL(&buffer->HTCPacket,
-+                                          buffer,
-+                                          buffer->data,
-+                                          AR6000_BUFFER_SIZE,
-+                                          arRawStream2EndpointID(ar,streamID));
-+
-+            /* Queue buffers to HTC for receive */
-+            if ((status = HTCAddReceivePkt(ar->arHtcTarget, &buffer->HTCPacket)) != A_OK)
-+            {
-+                BMIInit();
-+                return -EIO;
-+            }
-+        }
-+
-+        for (count2 = 0; count2 < RAW_HTC_WRITE_BUFFERS_NUM; count2 ++) {
-+            /* Initialize the receive buffers */
-+            buffer = ar->raw_htc_write_buffer[streamID][count2];
-+            memset(buffer, 0, sizeof(raw_htc_buffer));
-+        }
-+
-+        ar->read_buffer_available[streamID] = FALSE;
-+        ar->write_buffer_available[streamID] = TRUE;
-+    }
-+
-+    if (A_FAILED(status)) {
-+        return -EIO;
-+    }
-+
-+    AR_DEBUG_PRINTF("HTC RAW, number of streams the target supports: %d \n", streamID);
-+
-+    servicepriority = HTC_RAW_STREAMS_SVC;  /* only 1 */
-+
-+        /* set callbacks and priority list */
-+    HTCSetCreditDistribution(ar->arHtcTarget,
-+                             ar,
-+                             NULL,  /* use default */
-+                             NULL,  /* use default */
-+                             &servicepriority,
-+                             1);
-+
-+    /* Start the HTC component */
-+    if ((status = HTCStart(ar->arHtcTarget)) != A_OK) {
-+        BMIInit();
-+        return -EIO;
-+    }
-+
-+    (ar)->arRawIfInit = TRUE;
-+
-+    return 0;
-+}
-+
-+int ar6000_htc_raw_close(AR_SOFTC_T *ar)
-+{
-+    A_PRINTF("ar6000_htc_raw_close called \n");
-+    HTCStop(ar->arHtcTarget);
-+
-+        /* reset the device */
-+    ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
-+    /* Initialize the BMI component */
-+    BMIInit();
-+
-+    return 0;
-+}
-+
-+raw_htc_buffer *
-+get_filled_buffer(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID)
-+{
-+    int count;
-+    raw_htc_buffer *busy;
-+
-+    /* Check for data */
-+    for (count = 0; count < RAW_HTC_READ_BUFFERS_NUM; count ++) {
-+        busy = ar->raw_htc_read_buffer[StreamID][count];
-+        if (busy->length) {
-+            break;
-+        }
-+    }
-+    if (busy->length) {
-+        ar->read_buffer_available[StreamID] = TRUE;
-+    } else {
-+        ar->read_buffer_available[StreamID] = FALSE;
-+    }
-+
-+    return busy;
-+}
-+
-+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
-+                            char __user *buffer, size_t length)
-+{
-+    int readPtr;
-+    raw_htc_buffer *busy;
-+
-+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
-+        AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
-+        return -EFAULT;
-+    }
-+
-+    if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
-+        return -ERESTARTSYS;
-+    }
-+
-+    busy = get_filled_buffer(ar,StreamID);
-+    while (!ar->read_buffer_available[StreamID]) {
-+        up(&ar->raw_htc_read_sem[StreamID]);
-+
-+        /* Wait for the data */
-+        AR_DEBUG2_PRINTF("Sleeping StreamID(%d) read process\n", StreamID);
-+        if (wait_event_interruptible(ar->raw_htc_read_queue[StreamID],
-+                                     ar->read_buffer_available[StreamID]))
-+        {
-+            return -EINTR;
-+        }
-+        if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
-+            return -ERESTARTSYS;
-+        }
-+        busy = get_filled_buffer(ar,StreamID);
-+    }
-+
-+    /* Read the data */
-+    readPtr = busy->currPtr;
-+    if (length > busy->length - HTC_HEADER_LEN) {
-+        length = busy->length - HTC_HEADER_LEN;
-+    }
-+    if (copy_to_user(buffer, &busy->data[readPtr], length)) {
-+        up(&ar->raw_htc_read_sem[StreamID]);
-+        return -EFAULT;
-+    }
-+
-+    busy->currPtr += length;
-+
-+    //AR_DEBUG_PRINTF("raw read ioctl:  currPTR : 0x%X 0x%X \n", busy->currPtr,busy->length);
-+
-+    if (busy->currPtr == busy->length)
-+    {
-+        busy->currPtr = 0;
-+        busy->length = 0;
-+        HTC_PACKET_RESET_RX(&busy->HTCPacket);
-+        //AR_DEBUG_PRINTF("raw read ioctl:  ep for packet:%d \n", busy->HTCPacket.Endpoint);
-+        HTCAddReceivePkt(ar->arHtcTarget, &busy->HTCPacket);
-+    }
-+    ar->read_buffer_available[StreamID] = FALSE;
-+    up(&ar->raw_htc_read_sem[StreamID]);
-+
-+    return length;
-+}
-+
-+static raw_htc_buffer *
-+get_free_buffer(AR_SOFTC_T *ar, HTC_ENDPOINT_ID StreamID)
-+{
-+    int count;
-+    raw_htc_buffer *free;
-+
-+    free = NULL;
-+    for (count = 0; count < RAW_HTC_WRITE_BUFFERS_NUM; count ++) {
-+        free = ar->raw_htc_write_buffer[StreamID][count];
-+        if (free->length == 0) {
-+            break;
-+        }
-+    }
-+    if (!free->length) {
-+        ar->write_buffer_available[StreamID] = TRUE;
-+    } else {
-+        ar->write_buffer_available[StreamID] = FALSE;
-+    }
-+
-+    return free;
-+}
-+
-+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
-+                     char __user *buffer, size_t length)
-+{
-+    int writePtr;
-+    raw_htc_buffer *free;
-+
-+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
-+        AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
-+        return -EFAULT;
-+    }
-+
-+    if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
-+        return -ERESTARTSYS;
-+    }
-+
-+    /* Search for a free buffer */
-+    free = get_free_buffer(ar,StreamID);
-+
-+    /* Check if there is space to write else wait */
-+    while (!ar->write_buffer_available[StreamID]) {
-+        up(&ar->raw_htc_write_sem[StreamID]);
-+
-+        /* Wait for buffer to become free */
-+        AR_DEBUG2_PRINTF("Sleeping StreamID(%d) write process\n", StreamID);
-+        if (wait_event_interruptible(ar->raw_htc_write_queue[StreamID],
-+                                     ar->write_buffer_available[StreamID]))
-+        {
-+            return -EINTR;
-+        }
-+        if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
-+            return -ERESTARTSYS;
-+        }
-+        free = get_free_buffer(ar,StreamID);
-+    }
-+
-+    /* Send the data */
-+    writePtr = HTC_HEADER_LEN;
-+    if (length > (AR6000_BUFFER_SIZE - HTC_HEADER_LEN)) {
-+        length = AR6000_BUFFER_SIZE - HTC_HEADER_LEN;
-+    }
-+
-+    if (copy_from_user(&free->data[writePtr], buffer, length)) {
-+        up(&ar->raw_htc_read_sem[StreamID]);
-+        return -EFAULT;
-+    }
-+
-+    free->length = length;
-+
-+    SET_HTC_PACKET_INFO_TX(&free->HTCPacket,
-+                           free,
-+                           &free->data[writePtr],
-+                           length,
-+                           arRawStream2EndpointID(ar,StreamID),
-+                           AR6K_DATA_PKT_TAG);
-+
-+    HTCSendPkt(ar->arHtcTarget,&free->HTCPacket);
-+
-+    ar->write_buffer_available[StreamID] = FALSE;
-+    up(&ar->raw_htc_write_sem[StreamID]);
-+
-+    return length;
-+}
-+#endif /* HTC_RAW_INTERFACE */
-diff --git a/drivers/ar6000/ar6000/ar6xapi_linux.h b/drivers/ar6000/ar6000/ar6xapi_linux.h
-new file mode 100644
-index 0000000..b8e6e09
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6xapi_linux.h
-@@ -0,0 +1,128 @@
-+#ifndef _AR6XAPI_LINUX_H
-+#define _AR6XAPI_LINUX_H
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+struct ar6_softc;
-+
-+void ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap);
-+A_UINT8 ar6000_iptos_to_userPriority(A_UINT8 *pkt);
-+A_STATUS ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID);
-+void ar6000_connect_event(struct ar6_softc *ar, A_UINT16 channel,
-+                          A_UINT8 *bssid, A_UINT16 listenInterval,
-+                          A_UINT16 beaconInterval, NETWORK_TYPE networkType,
-+                          A_UINT8 beaconIeLen, A_UINT8 assocReqLen,
-+                          A_UINT8 assocRespLen,A_UINT8 *assocInfo);
-+void ar6000_disconnect_event(struct ar6_softc *ar, A_UINT8 reason,
-+                             A_UINT8 *bssid, A_UINT8 assocRespLen,
-+                             A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus);
-+void ar6000_tkip_micerr_event(struct ar6_softc *ar, A_UINT8 keyid,
-+                              A_BOOL ismcast);
-+void ar6000_bitrate_rx(void *devt, A_INT32 rateKbps);
-+void ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList);
-+void ar6000_regDomain_event(struct ar6_softc *ar, A_UINT32 regCode);
-+void ar6000_txPwr_rx(void *devt, A_UINT8 txPwr);
-+void ar6000_keepalive_rx(void *devt, A_UINT8 configured);
-+void ar6000_neighborReport_event(struct ar6_softc *ar, int numAps,
-+                                 WMI_NEIGHBOR_INFO *info);
-+void ar6000_set_numdataendpts(struct ar6_softc *ar, A_UINT32 num);
-+void ar6000_scanComplete_event(struct ar6_softc *ar, A_STATUS status);
-+void ar6000_targetStats_event(struct ar6_softc *ar,  WMI_TARGET_STATS *pStats);
-+void ar6000_rssiThreshold_event(struct ar6_softc *ar,
-+                                WMI_RSSI_THRESHOLD_VAL newThreshold,
-+                                A_INT16 rssi);
-+void ar6000_reportError_event(struct ar6_softc *, WMI_TARGET_ERROR_VAL errorVal);
-+void ar6000_cac_event(struct ar6_softc *ar, A_UINT8 ac, A_UINT8 cac_indication,
-+                                A_UINT8 statusCode, A_UINT8 *tspecSuggestion);
-+void ar6000_hbChallengeResp_event(struct ar6_softc *, A_UINT32 cookie, A_UINT32 source);
-+void
-+ar6000_roam_tbl_event(struct ar6_softc *ar, WMI_TARGET_ROAM_TBL *pTbl);
-+
-+void
-+ar6000_roam_data_event(struct ar6_softc *ar, WMI_TARGET_ROAM_DATA *p);
-+
-+void
-+ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters,
-+                      WMI_GET_WOW_LIST_REPLY *wow_reply);
-+
-+void ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID,
-+                             WMI_PMKID *pmkidList);
-+
-+void ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values);
-+void ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value);
-+void ar6000_gpio_ack_rx(void);
-+
-+void ar6000_dbglog_init_done(struct ar6_softc *ar);
-+
-+#ifdef SEND_EVENT_TO_APP
-+void ar6000_send_event_to_app(struct ar6_softc *ar, A_UINT16 eventId, A_UINT8 *datap, int len);
-+#endif
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+void ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len);
-+#endif
-+
-+void ar6000_tx_retry_err_event(void *devt);
-+
-+void ar6000_snrThresholdEvent_rx(void *devt,
-+                                 WMI_SNR_THRESHOLD_VAL newThreshold,
-+                                 A_UINT8 snr);
-+
-+void ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL range, A_UINT8 lqVal);
-+
-+
-+void ar6000_ratemask_rx(void *devt, A_UINT16 ratemask);
-+
-+A_STATUS ar6000_get_driver_cfg(struct net_device *dev,
-+                                A_UINT16 cfgParam,
-+                                void *result);
-+void ar6000_bssInfo_event_rx(struct ar6_softc *ar, A_UINT8 *data, int len);
-+
-+void ar6000_dbglog_event(struct ar6_softc *ar, A_UINT32 dropped,
-+                         A_INT8 *buffer, A_UINT32 length);
-+
-+int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
-+
-+void ar6000_indicate_tx_activity(void *devt, A_UINT8 trafficClass, A_BOOL Active);
-+
-+void ar6000_dset_open_req(void *devt,
-+                          A_UINT32 id,
-+                          A_UINT32 targ_handle,
-+                          A_UINT32 targ_reply_fn,
-+                          A_UINT32 targ_reply_arg);
-+void ar6000_dset_close(void *devt, A_UINT32 access_cookie);
-+void ar6000_dset_data_req(void *devt,
-+                          A_UINT32 access_cookie,
-+                          A_UINT32 offset,
-+                          A_UINT32 length,
-+                          A_UINT32 targ_buf,
-+                          A_UINT32 targ_reply_fn,
-+                          A_UINT32 targ_reply_arg);
-+
-+
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif
-diff --git a/drivers/ar6000/ar6000/athdrv_linux.h b/drivers/ar6000/ar6000/athdrv_linux.h
-new file mode 100644
-index 0000000..9c3e449
---- /dev/null
-+++ b/drivers/ar6000/ar6000/athdrv_linux.h
-@@ -0,0 +1,993 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _ATHDRV_LINUX_H
-+#define _ATHDRV_LINUX_H
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+
-+/*
-+ * There are two types of ioctl's here: Standard ioctls and
-+ * eXtended ioctls.  All extended ioctls (XIOCTL) are multiplexed
-+ * off of the single ioctl command, AR6000_IOCTL_EXTENDED.  The
-+ * arguments for every XIOCTL starts with a 32-bit command word
-+ * that is used to select which extended ioctl is in use.  After
-+ * the command word are command-specific arguments.
-+ */
-+
-+/* Linux standard Wireless Extensions, private ioctl interfaces */
-+#define IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)
-+#define IEEE80211_IOCTL_GETPARAM             (SIOCIWFIRSTPRIV+1)
-+#define IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+2)
-+#define IEEE80211_IOCTL_SETWMMPARAMS         (SIOCIWFIRSTPRIV+3)
-+#define IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+4)
-+#define IEEE80211_IOCTL_GETWMMPARAMS         (SIOCIWFIRSTPRIV+5)
-+#define IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+6)
-+#define IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+7)
-+//#define IEEE80211_IOCTL_GETOPTIE             (SIOCIWFIRSTPRIV+7)
-+#define IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+8)
-+//#define IEEE80211_IOCTL_SETAUTHALG           (SIOCIWFIRSTPRIV+10)
-+#define IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+9)
-+
-+
-+
-+/*                      ====WMI Ioctls====                                    */
-+/*
-+ *
-+ * Many ioctls simply provide WMI services to application code:
-+ * an application makes such an ioctl call with a set of arguments
-+ * that are packaged into the corresponding WMI message, and sent
-+ * to the Target.
-+ */
-+
-+#define AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+10)
-+/*
-+ * arguments:
-+ *   ar6000_version *revision
-+ */
-+
-+#define AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+11)
-+/*
-+ * arguments:
-+ *   WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
-+ * uses: WMI_SET_POWER_MODE_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+12)
-+/*
-+ * arguments:
-+ *   WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
-+ * uses: WMI_SET_SCAN_PARAMS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+13)
-+/*
-+ * arguments:
-+ *   UINT32 listenInterval
-+ * uses: WMI_SET_LISTEN_INT_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+14)
-+/*
-+ * arguments:
-+ *   WMI_BSS_FILTER filter (see include/wmi.h)
-+ * uses: WMI_SET_BSS_FILTER_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)
-+/*
-+ * arguments:
-+ *   WMI_CHANNEL_PARAMS_CMD chParams
-+ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)
-+/*
-+ * arguments:
-+ *   WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
-+ * uses: WMI_SETPROBED_SSID_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)
-+/*
-+ * arguments:
-+ *   WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
-+ * uses: WMI_SET_POWER_PARAMS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)
-+/*
-+ * arguments:
-+ *   WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
-+ * uses: WMI_ADD_BAD_AP_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)
-+/*
-+ * arguments:
-+ *   ar6000_queuereq queueRequest (see below)
-+ */
-+
-+#define AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)
-+/*
-+ * arguments:
-+ *   WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
-+ * uses: WMI_CREATE_PSTREAM_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)
-+/*
-+ * arguments:
-+ *   WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
-+ * uses: WMI_DELETE_PSTREAM_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD   (SIOCIWFIRSTPRIV+23)
-+/*
-+ * arguments:
-+ *   WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
-+/*
-+ * arguments:
-+ *   WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
-+ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)
-+/*
-+ * arguments:
-+ *   TARGET_STATS *targetStats (see below)
-+ * uses: WMI_GET_STATISTICS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)
-+/*
-+ * arguments:
-+ *   WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
-+ * uses: WMI_SET_ASSOC_INFO_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)
-+/*
-+ * arguments:
-+ *   WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
-+ * uses: WMI_SET_ACCESS_PARAMS_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)
-+/*
-+ * arguments:
-+ *   UINT32 beaconMissTime
-+ * uses: WMI_SET_BMISS_TIME_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)
-+/*
-+ * arguments:
-+ *   WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
-+ * uses: WMI_SET_DISC_TIMEOUT_CMDID
-+ */
-+
-+#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)
-+/*
-+ * arguments:
-+ *   WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
-+ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
-+ */
-+
-+/*
-+ * There is a very small space available for driver-private
-+ * wireless ioctls.  In order to circumvent this limitation,
-+ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
-+ * single AR6000_IOCTL_EXTENDED ioctl.
-+ */
-+#define AR6000_IOCTL_EXTENDED                (SIOCIWFIRSTPRIV+31)
-+
-+
-+/*                         ====BMI Extended Ioctls====                        */
-+
-+#define AR6000_XIOCTL_BMI_DONE                                  1
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
-+ * uses: BMI_DONE
-+ */
-+
-+#define AR6000_XIOCTL_BMI_READ_MEMORY                           2
-+/*
-+ * arguments:
-+ *   union {
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
-+ *       UINT32 address
-+ *       UINT32 length
-+ *     }
-+ *     char results[length]
-+ *   }
-+ * uses: BMI_READ_MEMORY
-+ */
-+
-+#define AR6000_XIOCTL_BMI_WRITE_MEMORY                          3
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
-+ *   UINT32 address
-+ *   UINT32 length
-+ *   char data[length]
-+ * uses: BMI_WRITE_MEMORY
-+ */
-+
-+#define AR6000_XIOCTL_BMI_EXECUTE                               4
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
-+ *   UINT32 TargetAddress
-+ *   UINT32 parameter
-+ * uses: BMI_EXECUTE
-+ */
-+
-+#define AR6000_XIOCTL_BMI_SET_APP_START                         5
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
-+ *   UINT32 TargetAddress
-+ * uses: BMI_SET_APP_START
-+ */
-+
-+#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER                     6
-+/*
-+ * arguments:
-+ *   union {
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
-+ *       UINT32 TargetAddress, 32-bit aligned
-+ *     }
-+ *     UINT32 result
-+ *   }
-+ * uses: BMI_READ_SOC_REGISTER
-+ */
-+
-+#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER                    7
-+/*
-+ * arguments:
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
-+ *       UINT32 TargetAddress, 32-bit aligned
-+ *       UINT32 newValue
-+ *     }
-+ * uses: BMI_WRITE_SOC_REGISTER
-+ */
-+
-+#define AR6000_XIOCTL_BMI_TEST                                  8
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
-+ *   UINT32 address
-+ *   UINT32 length
-+ *   UINT32 count
-+ */
-+
-+
-+
-+/* Historical Host-side DataSet support */
-+#define AR6000_XIOCTL_UNUSED9                                   9
-+#define AR6000_XIOCTL_UNUSED10                                  10
-+#define AR6000_XIOCTL_UNUSED11                                  11
-+
-+/*                      ====Misc Extended Ioctls====                          */
-+
-+#define AR6000_XIOCTL_FORCE_TARGET_RESET                        12
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
-+ */
-+
-+
-+#ifdef HTC_RAW_INTERFACE
-+/* HTC Raw Interface Ioctls */
-+#define AR6000_XIOCTL_HTC_RAW_OPEN                              13
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
-+ */
-+
-+#define AR6000_XIOCTL_HTC_RAW_CLOSE                             14
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
-+ */
-+
-+#define AR6000_XIOCTL_HTC_RAW_READ                              15
-+/*
-+ * arguments:
-+ *   union {
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
-+ *       UINT32 mailboxID
-+ *       UINT32 length
-+ *     }
-+ *     results[length]
-+ *   }
-+ */
-+
-+#define AR6000_XIOCTL_HTC_RAW_WRITE                             16
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
-+ *   UINT32 mailboxID
-+ *   UINT32 length
-+ *   char buffer[length]
-+ */
-+#endif /* HTC_RAW_INTERFACE */
-+
-+#define AR6000_XIOCTL_CHECK_TARGET_READY                        17
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
-+ */
-+
-+
-+
-+/*                ====GPIO (General Purpose I/O) Extended Ioctls====          */
-+
-+#define AR6000_XIOCTL_GPIO_OUTPUT_SET                           18
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
-+ *   ar6000_gpio_output_set_cmd_s (see below)
-+ * uses: WMIX_GPIO_OUTPUT_SET_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_GPIO_INPUT_GET                            19
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
-+ * uses: WMIX_GPIO_INPUT_GET_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_GPIO_REGISTER_SET                         20
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
-+ *   ar6000_gpio_register_cmd_s (see below)
-+ * uses: WMIX_GPIO_REGISTER_SET_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_GPIO_REGISTER_GET                         21
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
-+ *   ar6000_gpio_register_cmd_s (see below)
-+ * uses: WMIX_GPIO_REGISTER_GET_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_GPIO_INTR_ACK                             22
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
-+ *   ar6000_cpio_intr_ack_cmd_s (see below)
-+ * uses: WMIX_GPIO_INTR_ACK_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_GPIO_INTR_WAIT                            23
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
-+ */
-+
-+
-+
-+/*                    ====more wireless commands====                          */
-+
-+#define AR6000_XIOCTL_SET_ADHOC_BSSID                           24
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
-+ *   WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
-+ */
-+
-+#define AR6000_XIOCTL_SET_OPT_MODE                              25
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
-+ *   WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
-+ * uses: WMI_SET_OPT_MODE_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_OPT_SEND_FRAME                            26
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
-+ *   WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
-+ * uses: WMI_OPT_TX_FRAME_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL                   27
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL)
-+ *   WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
-+ * uses: WMI_SET_BEACON_INT_CMDID
-+ */
-+
-+
-+#define IEEE80211_IOCTL_SETAUTHALG                              28
-+
-+
-+#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE                        29
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
-+ *   WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
-+ * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
-+ */
-+
-+
-+#define AR6000_XIOCTL_SET_MAX_SP                                30
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
-+ *   WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
-+ * uses: WMI_SET_MAX_SP_LEN_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_GET_ROAM_TBL                          31
-+
-+#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL                         32
-+
-+#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS                 33
-+
-+
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
-+ *   WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
-+ *   WMI_SET_POWERSAVE_TIMERS_CMDID
-+ */
-+
-+#define AR6000_XIOCTRL_WMI_GET_POWER_MODE                        34
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
-+ */
-+
-+#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE                       35
-+typedef enum {
-+    WLAN_DISABLED,
-+    WLAN_ENABLED
-+} AR6000_WLAN_STATE;
-+/*
-+ * arguments:
-+ * enable/disable
-+ */
-+
-+#define AR6000_XIOCTL_WMI_GET_ROAM_DATA                         36
-+
-+#define AR6000_XIOCTL_WMI_SETRETRYLIMITS                37
-+/*
-+ * arguments:
-+ *   WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
-+ * uses: WMI_SET_RETRY_LIMITS_CMDID
-+ */
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/*       ====extended commands for radio test ====                          */
-+
-+#define AR6000_XIOCTL_TCMD_CONT_TX                      38
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
-+ *   WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_CONT_TX_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_TCMD_CONT_RX                      39
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
-+ *   WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_CONT_RX_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_TCMD_PM                           40
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
-+ *   WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_PM_CMDID
-+ */
-+
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
-+
-+#define AR6000_XIOCTL_WMI_STARTSCAN                     41
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
-+ *   UINT8  scanType
-+ *   UINT8  scanConnected
-+ *   A_BOOL forceFgScan
-+ * uses: WMI_START_SCAN_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SETFIXRATES                   42
-+
-+#define AR6000_XIOCTL_WMI_GETFIXRATES                   43
-+
-+
-+#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44
-+/*
-+ * arguments:
-+ *   WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_CLR_RSSISNR                   45
-+/*
-+ * arguments:
-+ *   WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_CLR_RSSISNR_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46
-+/*
-+ * arguments:
-+ *   WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_RTS                        47
-+/*
-+ * arguments:
-+ *   WMI_SET_RTS_MODE_CMD (see include/wmi.h)
-+ * uses: WMI_SET_RTS_MODE_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48
-+
-+#define AR6000_XIOCTL_WMI_SET_AUTHMODE                  49
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
-+ *   UINT8  mode
-+ * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_REASSOCMODE               50
-+
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
-+ *   UINT8  mode
-+ * uses: WMI_SET_WMM_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_WMM                       51
-+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
-+ * UINT32 frequency
-+ * UINT8  threshold
-+ */
-+#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52
-+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
-+ * UINT32 cookie
-+ */
-+#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53
-+
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
-+ *   UINT32 regDomain
-+ */
-+#define AR6000_XIOCTL_WMI_GET_RD                        54
-+
-+#define AR6000_XIOCTL_DIAG_READ                         55
-+
-+#define AR6000_XIOCTL_DIAG_WRITE                        56
-+
-+/*
-+ * arguments cmd (AR6000_XIOCTL_SET_TXOP)
-+ * WMI_TXOP_CFG  txopEnable
-+ */
-+#define AR6000_XIOCTL_WMI_SET_TXOP                      57
-+
-+#ifdef USER_KEYS
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
-+ * UINT32 keyOpCtrl
-+ * uses AR6000_USER_SETKEYS_INFO
-+ */
-+#define AR6000_XIOCTL_USER_SETKEYS                      58
-+#endif /* USER_KEYS */
-+
-+#define AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59
-+/*
-+ * arguments:
-+ *   UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
-+ *   UINT8 keepaliveInterval
-+ * uses: WMI_SET_KEEPALIVE_CMDID
-+ */
-+
-+#define AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60
-+/*
-+ * arguments:
-+ *   UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
-+ *   UINT8 keepaliveInterval
-+ *   A_BOOL configured
-+ * uses: WMI_GET_KEEPALIVE_CMDID
-+ */
-+
-+/*               ====ROM Patching Extended Ioctls====                       */
-+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61
-+/*
-+ * arguments:
-+ *     union {
-+ *       struct {
-+ *         UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
-+ *         UINT32 ROM Address
-+ *         UINT32 RAM Address
-+ *         UINT32 number of bytes
-+ *         UINT32 activate? (0 or 1)
-+ *       }
-+ *       A_UINT32 resulting rompatch ID
-+ *     }
-+ * uses: BMI_ROMPATCH_INSTALL
-+ */
-+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62
-+/*
-+ * arguments:
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
-+ *       UINT32 rompatch ID
-+ *     }
-+ * uses: BMI_ROMPATCH_UNINSTALL
-+ */
-+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63
-+/*
-+ * arguments:
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
-+ *       UINT32 rompatch count
-+ *       UINT32 rompatch IDs[rompatch count]
-+ *     }
-+ * uses: BMI_ROMPATCH_ACTIVATE
-+ */
-+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64
-+/*
-+ * arguments:
-+ *     struct {
-+ *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
-+ *       UINT32 rompatch count
-+ *       UINT32 rompatch IDs[rompatch count]
-+ *     }
-+ * uses: BMI_ROMPATCH_DEACTIVATE
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_APPIE             65
-+/*
-+ * arguments:
-+ *      struct {
-+ *          UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
-+ *          UINT32  app_frmtype;
-+ *          UINT32  app_buflen;
-+ *          UINT8   app_buf[];
-+ *      }
-+ */
-+#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER    66
-+/*
-+ * arguments:
-+ *      A_UINT32 filter_type;
-+ */
-+
-+#define AR6000_XIOCTL_DBGLOG_CFG_MODULE             67
-+
-+#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS         68
-+
-+#define AR6000_XIOCTL_WMI_SET_WSC_STATUS    		70
-+/*
-+ * arguments:
-+ *      A_UINT32 wsc_status;
-+ *            (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
-+ */
-+
-+/*
-+ * arguments:
-+ *      struct {
-+ *          A_UINT8 streamType;
-+ *          A_UINT8 status;
-+ *      }
-+ * uses: WMI_SET_BT_STATUS_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_BT_STATUS             71
-+
-+/*
-+ * arguments:
-+ *      struct {
-+ *           A_UINT8 paramType;
-+ *           union {
-+ *               A_UINT8 noSCOPkts;
-+ *               BT_PARAMS_A2DP a2dpParams;
-+ *               BT_COEX_REGS regs;
-+ *           };
-+ *      }
-+ * uses: WMI_SET_BT_PARAM_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_BT_PARAMS             72
-+
-+#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE       73
-+#define AR6000_XIOCTL_WMI_SET_WOW_MODE              74
-+#define AR6000_XIOCTL_WMI_GET_WOW_LIST              75
-+#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN           76
-+#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN           77
-+
-+
-+
-+#define AR6000_XIOCTL_TARGET_INFO                   78
-+/*
-+ * arguments:
-+ *   UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
-+ *   A_UINT32 TargetVersion (returned)
-+ *   A_UINT32 TargetType    (returned)
-+ * (See also bmi_msg.h target_ver and target_type)
-+ */
-+
-+#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE         79
-+/*
-+ * arguments:
-+ *      none
-+ */
-+
-+#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE       80
-+/*
-+ * This ioctl is used to emulate traffic activity
-+ * timeouts.  Activity/inactivity will trigger the driver
-+ * to re-balance credits.
-+ *
-+ * arguments:
-+ *      ar6000_traffic_activity_change
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS    81
-+/*
-+ * This ioctl is used to set the connect control flags
-+ *
-+ * arguments:
-+ *      A_UINT32 connectCtrlFlags
-+ */
-+
-+#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS              82
-+/*
-+ * This IOCTL sets any Authentication,Key Management and Protection
-+ * related parameters. This is used along with the information set in
-+ * Connect Command.
-+ * Currently this enables Multiple PMKIDs to an AP.
-+ *
-+ * arguments:
-+ *      struct {
-+ *          A_UINT32    akmpInfo;
-+ *      }
-+ * uses: WMI_SET_AKMP_PARAMS_CMD
-+ */
-+
-+#define AR6000_XIOCTL_WMI_GET_PMKID_LIST            83
-+
-+#define AR6000_XIOCTL_WMI_SET_PMKID_LIST            84
-+/*
-+ * This IOCTL is used to set a list of PMKIDs. This list of
-+ * PMKIDs is used in the [Re]AssocReq Frame. This list is used
-+ * only if the MultiPMKID option is enabled via the
-+ * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS  IOCTL.
-+ *
-+ * arguments:
-+ *      struct {
-+ *          A_UINT32    numPMKID;
-+ *          WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
-+ *      }
-+ * uses: WMI_SET_PMKIDLIST_CMD
-+ */
-+
-+/* Historical DSETPATCH support for INI patches */
-+#define AR6000_XIOCTL_UNUSED90                      90
-+
-+
-+
-+/* used by AR6000_IOCTL_WMI_GETREV */
-+struct ar6000_version {
-+    A_UINT32        host_ver;
-+    A_UINT32        target_ver;
-+};
-+
-+/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
-+struct ar6000_queuereq {
-+    A_UINT8         trafficClass;
-+    A_UINT16        activeTsids;
-+};
-+
-+/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
-+typedef struct targetStats_t {
-+    A_UINT64    tx_packets;
-+    A_UINT64    tx_bytes;
-+    A_UINT64    tx_unicast_pkts;
-+    A_UINT64    tx_unicast_bytes;
-+    A_UINT64    tx_multicast_pkts;
-+    A_UINT64    tx_multicast_bytes;
-+    A_UINT64    tx_broadcast_pkts;
-+    A_UINT64    tx_broadcast_bytes;
-+    A_UINT64    tx_rts_success_cnt;
-+    A_UINT64    tx_packet_per_ac[4];
-+
-+    A_UINT64    tx_errors;
-+    A_UINT64    tx_failed_cnt;
-+    A_UINT64    tx_retry_cnt;
-+    A_UINT64    tx_rts_fail_cnt;
-+    A_INT32     tx_unicast_rate;
-+    A_UINT64    rx_packets;
-+    A_UINT64    rx_bytes;
-+    A_UINT64    rx_unicast_pkts;
-+    A_UINT64    rx_unicast_bytes;
-+    A_UINT64    rx_multicast_pkts;
-+    A_UINT64    rx_multicast_bytes;
-+    A_UINT64    rx_broadcast_pkts;
-+    A_UINT64    rx_broadcast_bytes;
-+    A_UINT64    rx_fragment_pkt;
-+
-+    A_UINT64    rx_errors;
-+    A_UINT64    rx_crcerr;
-+    A_UINT64    rx_key_cache_miss;
-+    A_UINT64    rx_decrypt_err;
-+    A_UINT64    rx_duplicate_frames;
-+    A_INT32     rx_unicast_rate;
-+
-+    A_UINT64    tkip_local_mic_failure;
-+    A_UINT64    tkip_counter_measures_invoked;
-+    A_UINT64    tkip_replays;
-+    A_UINT64    tkip_format_errors;
-+    A_UINT64    ccmp_format_errors;
-+    A_UINT64    ccmp_replays;
-+
-+    A_UINT64    power_save_failure_cnt;
-+    A_INT16     noise_floor_calibation;
-+
-+    A_UINT64    cs_bmiss_cnt;
-+    A_UINT64    cs_lowRssi_cnt;
-+    A_UINT64    cs_connect_cnt;
-+    A_UINT64    cs_disconnect_cnt;
-+    A_UINT8     cs_aveBeacon_snr;
-+    A_INT16     cs_aveBeacon_rssi;
-+    A_UINT8     cs_lastRoam_msec;
-+    A_UINT8     cs_snr;
-+    A_INT16     cs_rssi;
-+
-+    A_UINT32    lq_val;
-+
-+    A_UINT32    wow_num_pkts_dropped;
-+    A_UINT8     wow_num_host_pkt_wakeups;
-+    A_UINT8     wow_num_host_event_wakeups;
-+    A_UINT16    wow_num_events_discarded;
-+
-+}TARGET_STATS;
-+
-+typedef struct targetStats_cmd_t {
-+    TARGET_STATS targetStats;
-+    int clearStats;
-+} TARGET_STATS_CMD;
-+
-+/* used by AR6000_XIOCTL_USER_SETKEYS */
-+
-+/*
-+ * Setting this bit to 1 doesnot initialize the RSC on the firmware
-+ */
-+#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL    1
-+#define AR6000_USER_SETKEYS_RSC_UNCHANGED     0x00000002
-+
-+typedef struct {
-+    A_UINT32  keyOpCtrl;  /* Bit Map of Key Mgmt Ctrl Flags */
-+} AR6000_USER_SETKEYS_INFO;
-+
-+
-+/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
-+struct ar6000_gpio_output_set_cmd_s {
-+    A_UINT32 set_mask;
-+    A_UINT32 clear_mask;
-+    A_UINT32 enable_mask;
-+    A_UINT32 disable_mask;
-+};
-+
-+/*
-+ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
-+ */
-+struct ar6000_gpio_register_cmd_s {
-+    A_UINT32 gpioreg_id;
-+    A_UINT32 value;
-+};
-+
-+/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
-+struct ar6000_gpio_intr_ack_cmd_s {
-+    A_UINT32 ack_mask;
-+};
-+
-+/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
-+struct ar6000_gpio_intr_wait_cmd_s {
-+    A_UINT32 intr_mask;
-+    A_UINT32 input_values;
-+};
-+
-+/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
-+typedef struct ar6000_dbglog_module_config_s {
-+    A_UINT32 valid;
-+    A_UINT16 mmask;
-+    A_UINT16 tsr;
-+    A_BOOL   rep;
-+    A_UINT16 size;
-+} DBGLOG_MODULE_CONFIG;
-+
-+typedef struct user_rssi_thold_t {
-+    A_INT16     tag;
-+    A_INT16     rssi;
-+} USER_RSSI_THOLD;
-+
-+typedef struct user_rssi_params_t {
-+    A_UINT8            weight;
-+    A_UINT32           pollTime;
-+    USER_RSSI_THOLD    tholds[12];
-+} USER_RSSI_PARAMS;
-+
-+/*
-+ * Host driver may have some config parameters. Typically, these
-+ * config params are one time config parameters. These could
-+ * correspond to any of the underlying modules. Host driver exposes
-+ * an api for the underlying modules to get this config.
-+ */
-+#define AR6000_DRIVER_CFG_BASE                  0x8000
-+
-+/* Should driver perform wlan node caching? */
-+#define AR6000_DRIVER_CFG_GET_WLANNODECACHING   0x8001
-+/*Should we log raw WMI msgs */
-+#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS      0x8002
-+
-+/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
-+struct ar6000_diag_window_cmd_s {
-+    unsigned int addr;
-+    unsigned int value;
-+};
-+
-+
-+struct ar6000_traffic_activity_change {
-+    A_UINT32    StreamID;   /* stream ID to indicate activity change */
-+    A_UINT32    Active;     /* active (1) or inactive (0) */
-+};
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+#endif
-diff --git a/drivers/ar6000/ar6000/athtypes_linux.h b/drivers/ar6000/ar6000/athtypes_linux.h
-new file mode 100644
-index 0000000..3e91de3
---- /dev/null
-+++ b/drivers/ar6000/ar6000/athtypes_linux.h
-@@ -0,0 +1,47 @@
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/athtypes_linux.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _ATHTYPES_LINUX_H_
-+#define _ATHTYPES_LINUX_H_
-+
-+#ifdef __KERNEL__
-+#include <linux/types.h>
-+#endif
-+
-+typedef int8_t      A_INT8;
-+typedef int16_t     A_INT16;
-+typedef int32_t     A_INT32;
-+typedef int64_t     A_INT64;
-+
-+typedef u_int8_t     A_UINT8;
-+typedef u_int16_t    A_UINT16;
-+typedef u_int32_t    A_UINT32;
-+typedef u_int64_t    A_UINT64;
-+
-+typedef int             A_BOOL;
-+typedef char            A_CHAR;
-+typedef unsigned char   A_UCHAR;
-+typedef unsigned long   A_ATH_TIMER;
-+
-+
-+#endif /* _ATHTYPES_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/config_linux.h b/drivers/ar6000/ar6000/config_linux.h
-new file mode 100644
-index 0000000..11a691d
---- /dev/null
-+++ b/drivers/ar6000/ar6000/config_linux.h
-@@ -0,0 +1,44 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _CONFIG_LINUX_H_
-+#define _CONFIG_LINUX_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/*
-+ * Host-side GPIO support is optional.
-+ * If run-time access to GPIO pins is not required, then
-+ * this should be changed to #undef.
-+ */
-+#define CONFIG_HOST_GPIO_SUPPORT
-+
-+/*
-+ * Host side Test Command support
-+ */
-+#define CONFIG_HOST_TCMD_SUPPORT
-+
-+#define USE_4BYTE_REGISTER_ACCESS
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif
-diff --git a/drivers/ar6000/ar6000/debug_linux.h b/drivers/ar6000/ar6000/debug_linux.h
-new file mode 100644
-index 0000000..c74e1df
---- /dev/null
-+++ b/drivers/ar6000/ar6000/debug_linux.h
-@@ -0,0 +1,86 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _DEBUG_LINUX_H_
-+#define _DEBUG_LINUX_H_
-+
-+#define DBG_DEFAULTS	(DBG_ERROR|DBG_WARNING)
-+
-+extern A_UINT32 g_dbg_flags;
-+
-+#define DBGFMT  "%s() : "
-+#define DBGARG  __func__
-+#define DBGFN	A_PRINTF
-+
-+/* ------- Debug related stuff ------- */
-+enum {
-+    ATH_DEBUG_SEND = 0x0001,
-+    ATH_DEBUG_RECV = 0x0002,
-+    ATH_DEBUG_SYNC = 0x0004,
-+    ATH_DEBUG_DUMP = 0x0008,
-+    ATH_DEBUG_IRQ  = 0x0010,
-+    ATH_DEBUG_TRC  = 0x0020,
-+    ATH_DEBUG_WARN = 0x0040,
-+    ATH_DEBUG_ERR  = 0x0080,
-+    ATH_LOG_INF	   = 0x0100,
-+    ATH_DEBUG_BMI  = 0x0110,
-+    ATH_DEBUG_WMI  = 0x0120,
-+    ATH_DEBUG_HIF  = 0x0140,
-+    ATH_DEBUG_HTC  = 0x0180,
-+    ATH_DEBUG_WLAN = 0x1000,
-+    ATH_LOG_ERR	   = 0x1010,
-+    ATH_DEBUG_ANY  = 0xFFFF,
-+};
-+
-+#ifdef DEBUG
-+
-+#define A_DPRINTF(f, a) \
-+	if(g_dbg_flags & (f)) \
-+	{	\
-+		DBGFN a ; \
-+	}
-+
-+
-+// TODO FIX usage of A_PRINTF!
-+#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc) do {   \
-+    if (debughtc & ATH_DEBUG_DUMP) {             \
-+        DebugDumpBytes(buffer, length,desc);               \
-+    }                                            \
-+} while(0)
-+#define PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(flags, args) do {        \
-+    if (debughtc & (flags)) {                    \
-+        A_PRINTF(KERN_ALERT PRINTX_ARG args);    \
-+    }                                            \
-+} while (0)
-+#define AR_DEBUG_ASSERT(test) do {               \
-+    if (!(test)) {                               \
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test));         \
-+    }                                            \
-+} while(0)
-+extern int debughtc;
-+#else
-+#define AR_DEBUG_PRINTF(flags, args)
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
-+#define AR_DEBUG_ASSERT(test)
-+#define AR_DEBUG_LVL_CHECK(lvl) 0
-+#define A_DPRINTF(f, a)
-+#endif
-+
-+#endif /* _DEBUG_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/ioctl.c b/drivers/ar6000/ar6000/ioctl.c
-new file mode 100644
-index 0000000..04aa911
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ioctl.c
-@@ -0,0 +1,2532 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "ar6000_drv.h"
-+
-+static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-+static A_UINT8 null_mac[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
-+extern USER_RSSI_THOLD rssi_map[12];
-+extern unsigned int wmitimeout;
-+extern A_WAITQUEUE_HEAD arEvent;
-+extern int tspecCompliance;
-+extern int bypasswmi;
-+
-+static int
-+ar6000_ioctl_get_roam_tbl(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if(wmi_get_roam_tbl_cmd(ar->arWmi) != A_OK) {
-+        return -EIO;
-+    }
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_ioctl_get_roam_data(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+
-+    /* currently assume only roam times are required */
-+    if(wmi_get_roam_data_cmd(ar->arWmi, ROAM_DATA_TIME) != A_OK) {
-+        return -EIO;
-+    }
-+
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_ioctl_set_roam_ctrl(struct net_device *dev, char *userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_ROAM_CTRL_CMD cmd;
-+    A_UINT8 size = sizeof(cmd);
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+
-+    if (copy_from_user(&cmd, userdata, size)) {
-+        return -EFAULT;
-+    }
-+
-+    if (cmd.roamCtrlType == WMI_SET_HOST_BIAS) {
-+        if (cmd.info.bssBiasInfo.numBss > 1) {
-+            size += (cmd.info.bssBiasInfo.numBss - 1) * sizeof(WMI_BSS_BIAS);
-+        }
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, size)) {
-+        return -EFAULT;
-+    }
-+
-+    if(wmi_set_roam_ctrl_cmd(ar->arWmi, &cmd, size) != A_OK) {
-+        return -EIO;
-+    }
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_ioctl_set_powersave_timers(struct net_device *dev, char *userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_POWERSAVE_TIMERS_POLICY_CMD cmd;
-+    A_UINT8 size = sizeof(cmd);
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, size)) {
-+        return -EFAULT;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, size)) {
-+        return -EFAULT;
-+    }
-+
-+    if(wmi_set_powersave_timers_cmd(ar->arWmi, &cmd, size) != A_OK) {
-+        return -EIO;
-+    }
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_ioctl_set_wmm(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_WMM_CMD cmd;
-+    A_STATUS ret;
-+
-+    if ((dev->flags & IFF_UP) != IFF_UP) {
-+        return -EIO;
-+    }
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-+                                sizeof(cmd)))
-+    {
-+        return -EFAULT;
-+    }
-+
-+    if (cmd.status == WMI_WMM_ENABLED) {
-+        ar->arWmmEnabled = TRUE;
-+    } else {
-+        ar->arWmmEnabled = FALSE;
-+    }
-+
-+    ret = wmi_set_wmm_cmd(ar->arWmi, cmd.status);
-+
-+    switch (ret) {
-+        case A_OK:
-+            return 0;
-+        case A_EBUSY :
-+            return -EBUSY;
-+        case A_NO_MEMORY:
-+            return -ENOMEM;
-+        case A_EINVAL:
-+        default:
-+            return -EFAULT;
-+    }
-+}
-+
-+static int
-+ar6000_ioctl_set_txop(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_WMM_TXOP_CMD cmd;
-+    A_STATUS ret;
-+
-+    if ((dev->flags & IFF_UP) != IFF_UP) {
-+        return -EIO;
-+    }
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-+                                sizeof(cmd)))
-+    {
-+        return -EFAULT;
-+    }
-+
-+    ret = wmi_set_wmm_txop(ar->arWmi, cmd.txopEnable);
-+
-+    switch (ret) {
-+        case A_OK:
-+            return 0;
-+        case A_EBUSY :
-+            return -EBUSY;
-+        case A_NO_MEMORY:
-+            return -ENOMEM;
-+        case A_EINVAL:
-+        default:
-+            return -EFAULT;
-+    }
-+}
-+
-+static int
-+ar6000_ioctl_get_rd(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_STATUS ret = 0;
-+
-+    if ((dev->flags & IFF_UP) != IFF_UP || ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if(copy_to_user((char *)((unsigned int*)rq->ifr_data + 1),
-+                            &ar->arRegCode, sizeof(ar->arRegCode)))
-+        ret = -EFAULT;
-+
-+    return ret;
-+}
-+
-+
-+/* Get power mode command */
-+static int
-+ar6000_ioctl_get_power_mode(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_POWER_MODE_CMD power_mode;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    power_mode.powerMode = wmi_get_power_mode_cmd(ar->arWmi);
-+    if (copy_to_user(rq->ifr_data, &power_mode, sizeof(WMI_POWER_MODE_CMD))) {
-+        ret = -EFAULT;
-+    }
-+
-+    return ret;
-+}
-+
-+
-+static int
-+ar6000_ioctl_set_channelParams(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_CHANNEL_PARAMS_CMD cmd, *cmdp;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (cmd.numChannels > 1) {
-+        cmdp = A_MALLOC(130);
-+        if (copy_from_user(cmdp, rq->ifr_data,
-+                           sizeof (*cmdp) +
-+                           ((cmd.numChannels - 1) * sizeof(A_UINT16))))
-+        {
-+            kfree(cmdp);
-+            return -EFAULT;
-+        }
-+    } else {
-+        cmdp = &cmd;
-+    }
-+
-+    if ((ar->arPhyCapability == WMI_11G_CAPABILITY) &&
-+        ((cmdp->phyMode == WMI_11A_MODE) || (cmdp->phyMode == WMI_11AG_MODE)))
-+    {
-+        ret = -EINVAL;
-+    }
-+
-+    if (!ret &&
-+        (wmi_set_channelParams_cmd(ar->arWmi, cmdp->scanParam, cmdp->phyMode,
-+                                   cmdp->numChannels, cmdp->channelList)
-+         != A_OK))
-+    {
-+        ret = -EIO;
-+    }
-+
-+    if (cmd.numChannels > 1) {
-+        kfree(cmdp);
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_set_snr_threshold(struct net_device *dev, struct ifreq *rq)
-+{
-+
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if( wmi_set_snr_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+        ret = -EIO;
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_set_rssi_threshold(struct net_device *dev, struct ifreq *rq)
-+{
-+#define SWAP_THOLD(thold1, thold2) do { \
-+    USER_RSSI_THOLD tmpThold;           \
-+    tmpThold.tag = thold1.tag;          \
-+    tmpThold.rssi = thold1.rssi;        \
-+    thold1.tag = thold2.tag;            \
-+    thold1.rssi = thold2.rssi;          \
-+    thold2.tag = tmpThold.tag;          \
-+    thold2.rssi = tmpThold.rssi;        \
-+} while (0)
-+
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
-+    USER_RSSI_PARAMS rssiParams;
-+    A_INT32 i, j;
-+
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user((char *)&rssiParams, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(USER_RSSI_PARAMS))) {
-+        return -EFAULT;
-+    }
-+    cmd.weight = rssiParams.weight;
-+    cmd.pollTime = rssiParams.pollTime;
-+
-+    A_MEMCPY(rssi_map, &rssiParams.tholds, sizeof(rssi_map));
-+    /*
-+     *  only 6 elements, so use bubble sorting, in ascending order
-+     */
-+    for (i = 5; i > 0; i--) {
-+        for (j = 0; j < i; j++) { /* above tholds */
-+            if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
-+                SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
-+            } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
-+                return EFAULT;
-+            }
-+        }
-+    }
-+    for (i = 11; i > 6; i--) {
-+        for (j = 6; j < i; j++) { /* below tholds */
-+            if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
-+                SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
-+            } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
-+                return EFAULT;
-+            }
-+        }
-+    }
-+
-+#ifdef DEBUG
-+    for (i = 0; i < 12; i++) {
-+        AR_DEBUG2_PRINTF("thold[%d].tag: %d, thold[%d].rssi: %d \n",
-+                i, rssi_map[i].tag, i, rssi_map[i].rssi);
-+    }
-+#endif
-+    cmd.thresholdAbove1_Val = rssi_map[0].rssi;
-+    cmd.thresholdAbove2_Val = rssi_map[1].rssi;
-+    cmd.thresholdAbove3_Val = rssi_map[2].rssi;
-+    cmd.thresholdAbove4_Val = rssi_map[3].rssi;
-+    cmd.thresholdAbove5_Val = rssi_map[4].rssi;
-+    cmd.thresholdAbove6_Val = rssi_map[5].rssi;
-+    cmd.thresholdBelow1_Val = rssi_map[6].rssi;
-+    cmd.thresholdBelow2_Val = rssi_map[7].rssi;
-+    cmd.thresholdBelow3_Val = rssi_map[8].rssi;
-+    cmd.thresholdBelow4_Val = rssi_map[9].rssi;
-+    cmd.thresholdBelow5_Val = rssi_map[10].rssi;
-+    cmd.thresholdBelow6_Val = rssi_map[11].rssi;
-+
-+    if( wmi_set_rssi_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+        ret = -EIO;
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_set_lq_threshold(struct net_device *dev, struct ifreq *rq)
-+{
-+
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_LQ_THRESHOLD_PARAMS_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if( wmi_set_lq_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+        ret = -EIO;
-+    }
-+
-+    return ret;
-+}
-+
-+
-+static int
-+ar6000_ioctl_set_probedSsid(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_PROBED_SSID_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_probedSsid_cmd(ar->arWmi, cmd.entryIndex, cmd.flag, cmd.ssidLength,
-+                                  cmd.ssid) != A_OK)
-+    {
-+        ret = -EIO;
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_set_badAp(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_ADD_BAD_AP_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (cmd.badApIndex > WMI_MAX_BAD_AP_INDEX) {
-+        return -EIO;
-+    }
-+
-+    if (A_MEMCMP(cmd.bssid, null_mac, AR6000_ETH_ADDR_LEN) == 0) {
-+        /*
-+         * This is a delete badAP.
-+         */
-+        if (wmi_deleteBadAp_cmd(ar->arWmi, cmd.badApIndex) != A_OK) {
-+            ret = -EIO;
-+        }
-+    } else {
-+        if (wmi_addBadAp_cmd(ar->arWmi, cmd.badApIndex, cmd.bssid) != A_OK) {
-+            ret = -EIO;
-+        }
-+    }
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_create_qos(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_CREATE_PSTREAM_CMD cmd;
-+    A_STATUS ret;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    ret = wmi_verify_tspec_params(&cmd, tspecCompliance);
-+    if (ret == A_OK)
-+        ret = wmi_create_pstream_cmd(ar->arWmi, &cmd);
-+
-+    switch (ret) {
-+        case A_OK:
-+            return 0;
-+        case A_EBUSY :
-+            return -EBUSY;
-+        case A_NO_MEMORY:
-+            return -ENOMEM;
-+        case A_EINVAL:
-+        default:
-+            return -EFAULT;
-+    }
-+}
-+
-+static int
-+ar6000_ioctl_delete_qos(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_DELETE_PSTREAM_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    ret = wmi_delete_pstream_cmd(ar->arWmi, cmd.trafficClass, cmd.tsid);
-+
-+    switch (ret) {
-+        case A_OK:
-+            return 0;
-+        case A_EBUSY :
-+            return -EBUSY;
-+        case A_NO_MEMORY:
-+            return -ENOMEM;
-+        case A_EINVAL:
-+        default:
-+            return -EFAULT;
-+    }
-+}
-+
-+static int
-+ar6000_ioctl_get_qos_queue(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ar6000_queuereq qreq;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if( copy_from_user(&qreq, rq->ifr_data,
-+                  sizeof(struct ar6000_queuereq)))
-+        return -EFAULT;
-+
-+    qreq.activeTsids = wmi_get_mapped_qos_queue(ar->arWmi, qreq.trafficClass);
-+
-+    if (copy_to_user(rq->ifr_data, &qreq,
-+                 sizeof(struct ar6000_queuereq)))
-+    {
-+        ret = -EFAULT;
-+    }
-+
-+    return ret;
-+}
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+static A_STATUS
-+ar6000_ioctl_tcmd_get_rx_report(struct net_device *dev,
-+                                 struct ifreq *rq, A_UINT8 *data, A_UINT32 len)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_UINT32    buf[2];
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+    ar->tcmdRxReport = 0;
-+    if (wmi_test_cmd(ar->arWmi, data, len) != A_OK) {
-+        up(&ar->arSem);
-+        return -EIO;
-+    }
-+
-+    wait_event_interruptible_timeout(arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
-+
-+    if (signal_pending(current)) {
-+        ret = -EINTR;
-+    }
-+
-+    buf[0] = ar->tcmdRxTotalPkt;
-+    buf[1] = ar->tcmdRxRssi;
-+    if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
-+        ret = -EFAULT;
-+    }
-+
-+    up(&ar->arSem);
-+
-+    return ret;
-+}
-+
-+void
-+ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+    TCMD_CONT_RX * rx_rep = (TCMD_CONT_RX *)results;
-+
-+    ar->tcmdRxTotalPkt = rx_rep->u.report.totalPkt;
-+    ar->tcmdRxRssi = rx_rep->u.report.rssiInDBm;
-+    ar->tcmdRxReport = 1;
-+
-+    wake_up(&arEvent);
-+}
-+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
-+
-+static int
-+ar6000_ioctl_set_error_report_bitmask(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_TARGET_ERROR_REPORT_BITMASK cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    ret = wmi_set_error_report_bitmask(ar->arWmi, cmd.bitmask);
-+
-+    return  (ret==0 ? ret : -EINVAL);
-+}
-+
-+static int
-+ar6000_clear_target_stats(struct net_device *dev)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    TARGET_STATS *pStats = &ar->arTargetStats;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+       return -EIO;
-+    }
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+    A_MEMZERO(pStats, sizeof(TARGET_STATS));
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_get_target_stats(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    TARGET_STATS_CMD cmd;
-+    TARGET_STATS *pStats = &ar->arTargetStats;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+
-+    ar->statsUpdatePending = TRUE;
-+
-+    if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
-+        up(&ar->arSem);
-+        return -EIO;
-+    }
-+
-+    wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
-+
-+    if (signal_pending(current)) {
-+        ret = -EINTR;
-+    }
-+
-+    if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
-+        ret = -EFAULT;
-+    }
-+
-+    if (cmd.clearStats == 1) {
-+        ret = ar6000_clear_target_stats(dev);
-+    }
-+
-+    up(&ar->arSem);
-+
-+    return ret;
-+}
-+
-+static int
-+ar6000_ioctl_set_access_params(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_ACCESS_PARAMS_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_set_access_params_cmd(ar->arWmi, cmd.txop, cmd.eCWmin, cmd.eCWmax,
-+                                  cmd.aifsn) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+    return (ret);
-+}
-+
-+static int
-+ar6000_ioctl_set_disconnect_timeout(struct net_device *dev, struct ifreq *rq)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_DISC_TIMEOUT_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_disctimeout_cmd(ar->arWmi, cmd.disconnectTimeout) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+    return (ret);
-+}
-+
-+static int
-+ar6000_xioctl_set_voice_pkt_size(struct net_device *dev, char * userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_VOICE_PKT_SIZE_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_set_voice_pkt_size_cmd(ar->arWmi, cmd.voicePktSize) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+
-+    return (ret);
-+}
-+
-+static int
-+ar6000_xioctl_set_max_sp_len(struct net_device *dev, char * userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_MAX_SP_LEN_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_set_max_sp_len_cmd(ar->arWmi, cmd.maxSPLen) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+    return (ret);
-+}
-+
-+
-+static int
-+ar6000_xioctl_set_bt_status_cmd(struct net_device *dev, char * userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_BT_STATUS_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_set_bt_status_cmd(ar->arWmi, cmd.streamType, cmd.status) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+    return (ret);
-+}
-+
-+static int
-+ar6000_xioctl_set_bt_params_cmd(struct net_device *dev, char * userdata)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    WMI_SET_BT_PARAMS_CMD cmd;
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+        return -EFAULT;
-+    }
-+
-+    if (wmi_set_bt_params_cmd(ar->arWmi, &cmd) == A_OK)
-+    {
-+        ret = 0;
-+    } else {
-+        ret = -EINVAL;
-+    }
-+
-+    return (ret);
-+}
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+struct ar6000_gpio_intr_wait_cmd_s  gpio_intr_results;
-+/* gpio_reg_results and gpio_data_available are protected by arSem */
-+static struct ar6000_gpio_register_cmd_s gpio_reg_results;
-+static A_BOOL gpio_data_available; /* Requested GPIO data available */
-+static A_BOOL gpio_intr_available; /* GPIO interrupt info available */
-+static A_BOOL gpio_ack_received;   /* GPIO ack was received */
-+
-+/* Host-side initialization for General Purpose I/O support */
-+void ar6000_gpio_init(void)
-+{
-+    gpio_intr_available = FALSE;
-+    gpio_data_available = FALSE;
-+    gpio_ack_received   = FALSE;
-+}
-+
-+/*
-+ * Called when a GPIO interrupt is received from the Target.
-+ * intr_values shows which GPIO pins have interrupted.
-+ * input_values shows a recent value of GPIO pins.
-+ */
-+void
-+ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values)
-+{
-+    gpio_intr_results.intr_mask = intr_mask;
-+    gpio_intr_results.input_values = input_values;
-+    *((volatile A_BOOL *)&gpio_intr_available) = TRUE;
-+    wake_up(&arEvent);
-+}
-+
-+/*
-+ * This is called when a response is received from the Target
-+ * for a previous or ar6000_gpio_input_get or ar6000_gpio_register_get
-+ * call.
-+ */
-+void
-+ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value)
-+{
-+    gpio_reg_results.gpioreg_id = reg_id;
-+    gpio_reg_results.value = value;
-+    *((volatile A_BOOL *)&gpio_data_available) = TRUE;
-+    wake_up(&arEvent);
-+}
-+
-+/*
-+ * This is called when an acknowledgement is received from the Target
-+ * for a previous or ar6000_gpio_output_set or ar6000_gpio_register_set
-+ * call.
-+ */
-+void
-+ar6000_gpio_ack_rx(void)
-+{
-+    gpio_ack_received = TRUE;
-+    wake_up(&arEvent);
-+}
-+
-+A_STATUS
-+ar6000_gpio_output_set(struct net_device *dev,
-+                       A_UINT32 set_mask,
-+                       A_UINT32 clear_mask,
-+                       A_UINT32 enable_mask,
-+                       A_UINT32 disable_mask)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    gpio_ack_received = FALSE;
-+    return wmi_gpio_output_set(ar->arWmi,
-+                set_mask, clear_mask, enable_mask, disable_mask);
-+}
-+
-+static A_STATUS
-+ar6000_gpio_input_get(struct net_device *dev)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    *((volatile A_BOOL *)&gpio_data_available) = FALSE;
-+    return wmi_gpio_input_get(ar->arWmi);
-+}
-+
-+static A_STATUS
-+ar6000_gpio_register_set(struct net_device *dev,
-+                         A_UINT32 gpioreg_id,
-+                         A_UINT32 value)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    gpio_ack_received = FALSE;
-+    return wmi_gpio_register_set(ar->arWmi, gpioreg_id, value);
-+}
-+
-+static A_STATUS
-+ar6000_gpio_register_get(struct net_device *dev,
-+                         A_UINT32 gpioreg_id)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    *((volatile A_BOOL *)&gpio_data_available) = FALSE;
-+    return wmi_gpio_register_get(ar->arWmi, gpioreg_id);
-+}
-+
-+static A_STATUS
-+ar6000_gpio_intr_ack(struct net_device *dev,
-+                     A_UINT32 ack_mask)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    gpio_intr_available = FALSE;
-+    return wmi_gpio_intr_ack(ar->arWmi, ack_mask);
-+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    HIF_DEVICE *hifDevice = ar->arHifDevice;
-+    int ret, param, param2;
-+    unsigned int address = 0;
-+    unsigned int length = 0;
-+    unsigned char *buffer;
-+    char *userdata;
-+    A_UINT32 connectCtrlFlags;
-+
-+
-+    static WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
-+                                           WMI_SHORTSCANRATIO_DEFAULT,
-+                                           DEFAULT_SCAN_CTRL_FLAGS,
-+                                           0};
-+    WMI_SET_AKMP_PARAMS_CMD  akmpParams;
-+    WMI_SET_PMKID_LIST_CMD   pmkidInfo;
-+
-+    if (cmd == AR6000_IOCTL_EXTENDED)
-+    {
-+        /*
-+         * This allows for many more wireless ioctls than would otherwise
-+         * be available.  Applications embed the actual ioctl command in
-+         * the first word of the parameter block, and use the command
-+         * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
-+         */
-+        get_user(cmd, (int *)rq->ifr_data);
-+        userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
-+    }
-+    else
-+    {
-+        userdata = (char *)rq->ifr_data;
-+    }
-+
-+    if ((ar->arWlanState == WLAN_DISABLED) &&
-+        ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
-+         (cmd != AR6000_XIOCTL_DIAG_READ) &&
-+         (cmd != AR6000_XIOCTL_DIAG_WRITE)))
-+    {
-+        return -EIO;
-+    }
-+
-+    ret = 0;
-+    switch(cmd)
-+    {
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+        case AR6000_XIOCTL_TCMD_CONT_TX:
-+            {
-+                TCMD_CONT_TX txCmd;
-+
-+                if (ar->tcmdPm == TCMD_PM_SLEEP) {
-+                    A_PRINTF("Can NOT send tx tcmd when target is asleep! \n");
-+                    return -EFAULT;
-+                }
-+
-+                if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX)))
-+                    return -EFAULT;
-+                wmi_test_cmd(ar->arWmi,(A_UINT8 *)&txCmd, sizeof(TCMD_CONT_TX));
-+            }
-+            break;
-+        case AR6000_XIOCTL_TCMD_CONT_RX:
-+            {
-+                TCMD_CONT_RX rxCmd;
-+
-+                if (ar->tcmdPm == TCMD_PM_SLEEP) {
-+                    A_PRINTF("Can NOT send rx tcmd when target is asleep! \n");
-+                    return -EFAULT;
-+                }
-+                if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX)))
-+                    return -EFAULT;
-+                switch(rxCmd.act)
-+                {
-+                    case TCMD_CONT_RX_PROMIS:
-+                    case TCMD_CONT_RX_FILTER:
-+                    case TCMD_CONT_RX_SETMAC:
-+                         wmi_test_cmd(ar->arWmi,(A_UINT8 *)&rxCmd,
-+                                                sizeof(TCMD_CONT_RX));
-+                         break;
-+                    case TCMD_CONT_RX_REPORT:
-+                         ar6000_ioctl_tcmd_get_rx_report(dev, rq,
-+                         (A_UINT8 *)&rxCmd, sizeof(TCMD_CONT_RX));
-+                         break;
-+                    default:
-+                         A_PRINTF("Unknown Cont Rx mode: %d\n",rxCmd.act);
-+                         return -EINVAL;
-+                }
-+            }
-+            break;
-+        case AR6000_XIOCTL_TCMD_PM:
-+            {
-+                TCMD_PM pmCmd;
-+
-+                if(copy_from_user(&pmCmd, userdata, sizeof(TCMD_PM)))
-+                    return -EFAULT;
-+                ar->tcmdPm = pmCmd.mode;
-+                wmi_test_cmd(ar->arWmi, (A_UINT8*)&pmCmd, sizeof(TCMD_PM));
-+            }
-+            break;
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
-+
-+        case AR6000_XIOCTL_BMI_DONE:
-+            ret = BMIDone(hifDevice);
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_READ_MEMORY:
-+            get_user(address, (unsigned int *)userdata);
-+            get_user(length, (unsigned int *)userdata + 1);
-+            AR_DEBUG_PRINTF("Read Memory (address: 0x%x, length: %d)\n",
-+                             address, length);
-+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+                A_MEMZERO(buffer, length);
-+                ret = BMIReadMemory(hifDevice, address, buffer, length);
-+                if (copy_to_user(rq->ifr_data, buffer, length)) {
-+                    ret = -EFAULT;
-+                }
-+                A_FREE(buffer);
-+            } else {
-+                ret = -ENOMEM;
-+            }
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_WRITE_MEMORY:
-+            get_user(address, (unsigned int *)userdata);
-+            get_user(length, (unsigned int *)userdata + 1);
-+            AR_DEBUG_PRINTF("Write Memory (address: 0x%x, length: %d)\n",
-+                             address, length);
-+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+                A_MEMZERO(buffer, length);
-+                if (copy_from_user(buffer, &userdata[sizeof(address) +
-+                                   sizeof(length)], length))
-+                {
-+                    ret = -EFAULT;
-+                } else {
-+                    ret = BMIWriteMemory(hifDevice, address, buffer, length);
-+                }
-+                A_FREE(buffer);
-+            } else {
-+                ret = -ENOMEM;
-+            }
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_TEST:
-+           AR_DEBUG_PRINTF("No longer supported\n");
-+           ret = -EOPNOTSUPP;
-+           break;
-+
-+        case AR6000_XIOCTL_BMI_EXECUTE:
-+            get_user(address, (unsigned int *)userdata);
-+            get_user(param, (unsigned int *)userdata + 1);
-+            AR_DEBUG_PRINTF("Execute (address: 0x%x, param: %d)\n",
-+                             address, param);
-+            ret = BMIExecute(hifDevice, address, &param);
-+            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_SET_APP_START:
-+            get_user(address, (unsigned int *)userdata);
-+            AR_DEBUG_PRINTF("Set App Start (address: 0x%x)\n", address);
-+            ret = BMISetAppStart(hifDevice, address);
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
-+            get_user(address, (unsigned int *)userdata);
-+            ret = BMIReadSOCRegister(hifDevice, address, &param);
-+            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
-+            break;
-+
-+        case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
-+            get_user(address, (unsigned int *)userdata);
-+            get_user(param, (unsigned int *)userdata + 1);
-+            ret = BMIWriteSOCRegister(hifDevice, address, param);
-+            break;
-+
-+#ifdef HTC_RAW_INTERFACE
-+        case AR6000_XIOCTL_HTC_RAW_OPEN:
-+            ret = A_OK;
-+            if (!arRawIfEnabled(ar)) {
-+                /* make sure block size is set in case the target was reset since last
-+                  * BMI phase (i.e. flashup downloads) */
-+                ret = ar6000_SetHTCBlockSize(ar);
-+                if (A_FAILED(ret)) {
-+                    break;
-+                }
-+                /* Terminate the BMI phase */
-+                ret = BMIDone(hifDevice);
-+                if (ret == A_OK) {
-+                    ret = ar6000_htc_raw_open(ar);
-+                }
-+            }
-+            break;
-+
-+        case AR6000_XIOCTL_HTC_RAW_CLOSE:
-+            if (arRawIfEnabled(ar)) {
-+                ret = ar6000_htc_raw_close(ar);
-+                arRawIfEnabled(ar) = FALSE;
-+            } else {
-+                ret = A_ERROR;
-+            }
-+            break;
-+
-+        case AR6000_XIOCTL_HTC_RAW_READ:
-+            if (arRawIfEnabled(ar)) {
-+                unsigned int streamID;
-+                get_user(streamID, (unsigned int *)userdata);
-+                get_user(length, (unsigned int *)userdata + 1);
-+                buffer = rq->ifr_data + sizeof(length);
-+                ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
-+                                          buffer, length);
-+                put_user(ret, (unsigned int *)rq->ifr_data);
-+            } else {
-+                ret = A_ERROR;
-+            }
-+            break;
-+
-+        case AR6000_XIOCTL_HTC_RAW_WRITE:
-+            if (arRawIfEnabled(ar)) {
-+                unsigned int streamID;
-+                get_user(streamID, (unsigned int *)userdata);
-+                get_user(length, (unsigned int *)userdata + 1);
-+                buffer = userdata + sizeof(streamID) + sizeof(length);
-+                ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
-+                                           buffer, length);
-+                put_user(ret, (unsigned int *)rq->ifr_data);
-+            } else {
-+                ret = A_ERROR;
-+            }
-+            break;
-+#endif /* HTC_RAW_INTERFACE */
-+
-+        case AR6000_IOCTL_WMI_GETREV:
-+        {
-+            if (copy_to_user(rq->ifr_data, &ar->arVersion,
-+                             sizeof(ar->arVersion)))
-+            {
-+                ret = -EFAULT;
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SETPWR:
-+        {
-+            WMI_POWER_MODE_CMD pwrModeCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&pwrModeCmd, userdata,
-+                                   sizeof(pwrModeCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_powermode_cmd(ar->arWmi, pwrModeCmd.powerMode)
-+                       != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS:
-+        {
-+            WMI_IBSS_PM_CAPS_CMD ibssPmCaps;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&ibssPmCaps, userdata,
-+                                   sizeof(ibssPmCaps)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_ibsspmcaps_cmd(ar->arWmi, ibssPmCaps.power_saving, ibssPmCaps.ttl,
-+                    ibssPmCaps.atim_windows, ibssPmCaps.timeout_value) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                ar->arIbssPsEnable = ibssPmCaps.power_saving;
-+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_PMPARAMS:
-+        {
-+            WMI_POWER_PARAMS_CMD pmParams;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&pmParams, userdata,
-+                                      sizeof(pmParams)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_pmparams_cmd(ar->arWmi, pmParams.idle_period,
-+                                     pmParams.pspoll_number,
-+                                     pmParams.dtim_policy) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SETSCAN:
-+        {
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&scParams, userdata,
-+                                      sizeof(scParams)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (CAN_SCAN_IN_CONNECT(scParams.scanCtrlFlags)) {
-+                    ar->arSkipScan = FALSE;
-+                } else {
-+                    ar->arSkipScan = TRUE;
-+                }
-+
-+                if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
-+                                       scParams.fg_end_period,
-+                                       scParams.bg_period,
-+                                       scParams.minact_chdwell_time,
-+                                       scParams.maxact_chdwell_time,
-+                                       scParams.pas_chdwell_time,
-+                                       scParams.shortScanRatio,
-+                                       scParams.scanCtrlFlags,
-+                                       scParams.max_dfsch_act_time) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SETLISTENINT:
-+        {
-+            WMI_LISTEN_INT_CMD listenCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&listenCmd, userdata,
-+                                      sizeof(listenCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                    if (wmi_listeninterval_cmd(ar->arWmi, listenCmd.listenInterval, listenCmd.numBeacons) != A_OK) {
-+                        ret = -EIO;
-+                    } else {
-+                        AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                        ar->arListenInterval = param;
-+                        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+                    }
-+
-+                }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_BMISS_TIME:
-+        {
-+            WMI_BMISS_TIME_CMD bmissCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&bmissCmd, userdata,
-+                                      sizeof(bmissCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_bmisstime_cmd(ar->arWmi, bmissCmd.bmissTime, bmissCmd.numBeacons) != A_OK) {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SETBSSFILTER:
-+        {
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else {
-+
-+                get_user(param, (unsigned char *)userdata);
-+                get_user(param2, (unsigned int *)(userdata + 1));
-+		printk("SETBSSFILTER: filter 0x%x, mask: 0x%x\n", param, param2);
-+                if (wmi_bssfilter_cmd(ar->arWmi, param, param2) != A_OK) {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
-+        {
-+            ret = ar6000_ioctl_set_snr_threshold(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
-+        {
-+            ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_CLR_RSSISNR:
-+        {
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            }
-+            ret = wmi_clr_rssi_snr(ar->arWmi);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_LQTHRESHOLD:
-+        {
-+            ret = ar6000_ioctl_set_lq_threshold(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_LPREAMBLE:
-+        {
-+            WMI_SET_LPREAMBLE_CMD setLpreambleCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setLpreambleCmd, userdata,
-+                                   sizeof(setLpreambleCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_lpreamble_cmd(ar->arWmi, setLpreambleCmd.status)
-+                       != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_RTS:
-+        {
-+            WMI_SET_RTS_CMD rtsCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&rtsCmd, userdata,
-+                                   sizeof(rtsCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_rts_cmd(ar->arWmi, rtsCmd.threshold)
-+                       != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_WMM:
-+        {
-+            ret = ar6000_ioctl_set_wmm(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_TXOP:
-+        {
-+            ret = ar6000_ioctl_set_txop(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_GET_RD:
-+        {
-+            ret = ar6000_ioctl_get_rd(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_CHANNELPARAMS:
-+        {
-+            ret = ar6000_ioctl_set_channelParams(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_PROBEDSSID:
-+        {
-+            ret = ar6000_ioctl_set_probedSsid(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_BADAP:
-+        {
-+            ret = ar6000_ioctl_set_badAp(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_CREATE_QOS:
-+        {
-+            ret = ar6000_ioctl_create_qos(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_DELETE_QOS:
-+        {
-+            ret = ar6000_ioctl_delete_qos(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_GET_QOS_QUEUE:
-+        {
-+            ret = ar6000_ioctl_get_qos_queue(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_GET_TARGET_STATS:
-+        {
-+            ret = ar6000_ioctl_get_target_stats(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK:
-+        {
-+            ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
-+        {
-+            WMI_SET_ASSOC_INFO_CMD cmd;
-+            A_UINT8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else {
-+                get_user(cmd.ieType, userdata);
-+                if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
-+                    ret = -EIO;
-+                } else {
-+                    get_user(cmd.bufferSize, userdata + 1);
-+                    if (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) {
-+                        ret = -EFAULT;
-+                        break;
-+                    }
-+                    if (copy_from_user(assocInfo, userdata + 2,
-+                                       cmd.bufferSize))
-+                    {
-+                        ret = -EFAULT;
-+                    } else {
-+                        if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
-+                                                 cmd.bufferSize,
-+                                                 assocInfo) != A_OK)
-+                        {
-+                            ret = -EIO;
-+                        }
-+                    }
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
-+        {
-+            ret = ar6000_ioctl_set_access_params(dev, rq);
-+            break;
-+        }
-+        case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
-+        {
-+            ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
-+            break;
-+        }
-+        case AR6000_XIOCTL_FORCE_TARGET_RESET:
-+        {
-+            if (ar->arHtcTarget)
-+            {
-+//                HTCForceReset(htcTarget);
-+            }
-+            else
-+            {
-+                AR_DEBUG_PRINTF("ar6000_ioctl cannot attempt reset.\n");
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_TARGET_INFO:
-+        case AR6000_XIOCTL_CHECK_TARGET_READY: /* backwards compatibility */
-+        {
-+            /* If we made it to here, then the Target exists and is ready. */
-+
-+            if (cmd == AR6000_XIOCTL_TARGET_INFO) {
-+                if (copy_to_user((A_UINT32 *)rq->ifr_data, &ar->arVersion.target_ver,
-+                                 sizeof(ar->arVersion.target_ver)))
-+                {
-+                    ret = -EFAULT;
-+                }
-+                if (copy_to_user(((A_UINT32 *)rq->ifr_data)+1, &ar->arTargetType,
-+                                 sizeof(ar->arTargetType)))
-+                {
-+                    ret = -EFAULT;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS:
-+        {
-+            WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD hbparam;
-+
-+            if (copy_from_user(&hbparam, userdata, sizeof(hbparam)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                /* Start a cyclic timer with the parameters provided. */
-+                if (hbparam.frequency) {
-+                    ar->arHBChallengeResp.frequency = hbparam.frequency;
-+                }
-+                if (hbparam.threshold) {
-+                    ar->arHBChallengeResp.missThres = hbparam.threshold;
-+                }
-+
-+                /* Delete the pending timer and start a new one */
-+                if (timer_pending(&ar->arHBChallengeResp.timer)) {
-+                    A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
-+                }
-+                A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
-+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP:
-+        {
-+            A_UINT32 cookie;
-+
-+            if (copy_from_user(&cookie, userdata, sizeof(cookie))) {
-+                return -EFAULT;
-+            }
-+
-+            /* Send the challenge on the control channel */
-+            if (wmi_get_challenge_resp_cmd(ar->arWmi, cookie, APP_HB_CHALLENGE) != A_OK) {
-+                return -EIO;
-+            }
-+            break;
-+        }
-+#ifdef USER_KEYS
-+        case AR6000_XIOCTL_USER_SETKEYS:
-+        {
-+
-+            ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_RUN;
-+
-+            if (copy_from_user(&ar->user_key_ctrl, userdata,
-+                               sizeof(ar->user_key_ctrl)))
-+            {
-+                return -EFAULT;
-+            }
-+
-+            A_PRINTF("ar6000 USER set key %x\n", ar->user_key_ctrl);
-+            break;
-+        }
-+#endif /* USER_KEYS */
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+        case AR6000_XIOCTL_GPIO_OUTPUT_SET:
-+        {
-+            struct ar6000_gpio_output_set_cmd_s gpio_output_set_cmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+
-+            if (copy_from_user(&gpio_output_set_cmd, userdata,
-+                                sizeof(gpio_output_set_cmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ret = ar6000_gpio_output_set(dev,
-+                                             gpio_output_set_cmd.set_mask,
-+                                             gpio_output_set_cmd.clear_mask,
-+                                             gpio_output_set_cmd.enable_mask,
-+                                             gpio_output_set_cmd.disable_mask);
-+                if (ret != A_OK) {
-+                    ret = EIO;
-+                }
-+            }
-+            up(&ar->arSem);
-+            break;
-+        }
-+        case AR6000_XIOCTL_GPIO_INPUT_GET:
-+        {
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+
-+            ret = ar6000_gpio_input_get(dev);
-+            if (ret != A_OK) {
-+                up(&ar->arSem);
-+                return -EIO;
-+            }
-+
-+            /* Wait for Target to respond. */
-+            wait_event_interruptible(arEvent, gpio_data_available);
-+            if (signal_pending(current)) {
-+                ret = -EINTR;
-+            } else {
-+                A_ASSERT(gpio_reg_results.gpioreg_id == GPIO_ID_NONE);
-+
-+                if (copy_to_user(userdata, &gpio_reg_results.value,
-+                                 sizeof(gpio_reg_results.value)))
-+                {
-+                    ret = -EFAULT;
-+                }
-+            }
-+            up(&ar->arSem);
-+            break;
-+        }
-+        case AR6000_XIOCTL_GPIO_REGISTER_SET:
-+        {
-+            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+
-+            if (copy_from_user(&gpio_register_cmd, userdata,
-+                                sizeof(gpio_register_cmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ret = ar6000_gpio_register_set(dev,
-+                                               gpio_register_cmd.gpioreg_id,
-+                                               gpio_register_cmd.value);
-+                if (ret != A_OK) {
-+                    ret = EIO;
-+                }
-+
-+                /* Wait for acknowledgement from Target */
-+                wait_event_interruptible(arEvent, gpio_ack_received);
-+                if (signal_pending(current)) {
-+                    ret = -EINTR;
-+                }
-+            }
-+            up(&ar->arSem);
-+            break;
-+        }
-+        case AR6000_XIOCTL_GPIO_REGISTER_GET:
-+        {
-+            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+
-+            if (copy_from_user(&gpio_register_cmd, userdata,
-+                                sizeof(gpio_register_cmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ret = ar6000_gpio_register_get(dev, gpio_register_cmd.gpioreg_id);
-+                if (ret != A_OK) {
-+                    up(&ar->arSem);
-+                    return -EIO;
-+                }
-+
-+                /* Wait for Target to respond. */
-+                wait_event_interruptible(arEvent, gpio_data_available);
-+                if (signal_pending(current)) {
-+                    ret = -EINTR;
-+                } else {
-+                    A_ASSERT(gpio_register_cmd.gpioreg_id == gpio_reg_results.gpioreg_id);
-+                    if (copy_to_user(userdata, &gpio_reg_results,
-+                                     sizeof(gpio_reg_results)))
-+                    {
-+                        ret = -EFAULT;
-+                    }
-+                }
-+            }
-+            up(&ar->arSem);
-+            break;
-+        }
-+        case AR6000_XIOCTL_GPIO_INTR_ACK:
-+        {
-+            struct ar6000_gpio_intr_ack_cmd_s gpio_intr_ack_cmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+
-+            if (copy_from_user(&gpio_intr_ack_cmd, userdata,
-+                                sizeof(gpio_intr_ack_cmd)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ret = ar6000_gpio_intr_ack(dev, gpio_intr_ack_cmd.ack_mask);
-+                if (ret != A_OK) {
-+                    ret = EIO;
-+                }
-+            }
-+            up(&ar->arSem);
-+            break;
-+        }
-+        case AR6000_XIOCTL_GPIO_INTR_WAIT:
-+        {
-+            /* Wait for Target to report an interrupt. */
-+            dev_hold(dev);
-+            rtnl_unlock();
-+            wait_event_interruptible(arEvent, gpio_intr_available);
-+            rtnl_lock();
-+            __dev_put(dev);
-+
-+            if (signal_pending(current)) {
-+                ret = -EINTR;
-+            } else {
-+                if (copy_to_user(userdata, &gpio_intr_results,
-+                                 sizeof(gpio_intr_results)))
-+                {
-+                    ret = -EFAULT;
-+                }
-+            }
-+            break;
-+        }
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+        case AR6000_XIOCTL_DBGLOG_CFG_MODULE:
-+        {
-+            struct ar6000_dbglog_module_config_s config;
-+
-+            if (copy_from_user(&config, userdata, sizeof(config))) {
-+                return -EFAULT;
-+            }
-+
-+            /* Send the challenge on the control channel */
-+            if (wmi_config_debug_module_cmd(ar->arWmi, config.mmask,
-+                                            config.tsr, config.rep,
-+                                            config.size, config.valid) != A_OK)
-+            {
-+                return -EIO;
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS:
-+        {
-+            /* Send the challenge on the control channel */
-+            if (ar6000_dbglog_get_debug_logs(ar) != A_OK)
-+            {
-+                return -EIO;
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_SET_ADHOC_BSSID:
-+        {
-+            WMI_SET_ADHOC_BSSID_CMD adhocBssid;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&adhocBssid, userdata,
-+                                      sizeof(adhocBssid)))
-+            {
-+                ret = -EFAULT;
-+            } else if (A_MEMCMP(adhocBssid.bssid, bcast_mac,
-+                                AR6000_ETH_ADDR_LEN) == 0)
-+            {
-+                ret = -EFAULT;
-+            } else {
-+
-+                A_MEMCPY(ar->arReqBssid, adhocBssid.bssid, sizeof(ar->arReqBssid));
-+        }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_SET_OPT_MODE:
-+        {
-+        WMI_SET_OPT_MODE_CMD optModeCmd;
-+            AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&optModeCmd, userdata,
-+                                      sizeof(optModeCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else if (ar->arConnected && optModeCmd.optMode == SPECIAL_ON) {
-+                ret = -EFAULT;
-+
-+            } else if (wmi_set_opt_mode_cmd(ar->arWmi, optModeCmd.optMode)
-+                       != A_OK)
-+            {
-+                ret = -EIO;
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_OPT_SEND_FRAME:
-+        {
-+        WMI_OPT_TX_FRAME_CMD optTxFrmCmd;
-+            A_UINT8 data[MAX_OPT_DATA_LEN];
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&optTxFrmCmd, userdata,
-+                                      sizeof(optTxFrmCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else if (copy_from_user(data,
-+                                      userdata+sizeof(WMI_OPT_TX_FRAME_CMD)-1,
-+                                      optTxFrmCmd.optIEDataLen))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ret = wmi_opt_tx_frame_cmd(ar->arWmi,
-+                                           optTxFrmCmd.frmType,
-+                                           optTxFrmCmd.dstAddr,
-+                                           optTxFrmCmd.bssid,
-+                                           optTxFrmCmd.optIEDataLen,
-+                                           data);
-+            }
-+
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SETRETRYLIMITS:
-+        {
-+            WMI_SET_RETRY_LIMITS_CMD setRetryParams;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setRetryParams, userdata,
-+                                      sizeof(setRetryParams)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_retry_limits_cmd(ar->arWmi, setRetryParams.frameType,
-+                                          setRetryParams.trafficClass,
-+                                          setRetryParams.maxRetries,
-+                                          setRetryParams.enableNotify) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                ar->arMaxRetries = setRetryParams.maxRetries;
-+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL:
-+        {
-+            WMI_BEACON_INT_CMD bIntvlCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&bIntvlCmd, userdata,
-+                       sizeof(bIntvlCmd)))
-+            {
-+                ret = -EFAULT;
-+            } else if (wmi_set_adhoc_bconIntvl_cmd(ar->arWmi, bIntvlCmd.beaconInterval)
-+                        != A_OK)
-+            {
-+                ret = -EIO;
-+            }
-+            break;
-+        }
-+        case IEEE80211_IOCTL_SETAUTHALG:
-+        {
-+            AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+            struct ieee80211req_authalg req;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&req, userdata,
-+                       sizeof(struct ieee80211req_authalg)))
-+            {
-+                ret = -EFAULT;
-+            } else if (req.auth_alg == AUTH_ALG_OPEN_SYSTEM) {
-+                ar->arDot11AuthMode  = OPEN_AUTH;
-+                ar->arPairwiseCrypto  = NONE_CRYPT;
-+                ar->arGroupCrypto     = NONE_CRYPT;
-+            } else if (req.auth_alg == AUTH_ALG_LEAP) {
-+                ar->arDot11AuthMode   = LEAP_AUTH;
-+            } else {
-+                ret = -EIO;
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_SET_VOICE_PKT_SIZE:
-+            ret = ar6000_xioctl_set_voice_pkt_size(dev, userdata);
-+            break;
-+
-+        case AR6000_XIOCTL_SET_MAX_SP:
-+            ret = ar6000_xioctl_set_max_sp_len(dev, userdata);
-+            break;
-+
-+        case AR6000_XIOCTL_WMI_GET_ROAM_TBL:
-+            ret = ar6000_ioctl_get_roam_tbl(dev, rq);
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_ROAM_CTRL:
-+            ret = ar6000_ioctl_set_roam_ctrl(dev, userdata);
-+            break;
-+        case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
-+            ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
-+            break;
-+        case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
-+            ret = ar6000_ioctl_get_power_mode(dev, rq);
-+            break;
-+        case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
-+            get_user(ar->arWlanState, (unsigned int *)userdata);
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+                break;
-+            }
-+
-+            if (ar->arWlanState == WLAN_ENABLED) {
-+                /* Enable foreground scanning */
-+                if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
-+                                       scParams.fg_end_period,
-+                                       scParams.bg_period,
-+                                       scParams.minact_chdwell_time,
-+                                       scParams.maxact_chdwell_time,
-+                                       scParams.pas_chdwell_time,
-+                                       scParams.shortScanRatio,
-+                                       scParams.scanCtrlFlags,
-+                                       scParams.max_dfsch_act_time) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+                if (ar->arSsidLen) {
-+                    ar->arConnectPending = TRUE;
-+                    if (wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
-+                                        ar->arDot11AuthMode, ar->arAuthMode,
-+                                        ar->arPairwiseCrypto,
-+                                        ar->arPairwiseCryptoLen,
-+                                        ar->arGroupCrypto, ar->arGroupCryptoLen,
-+                                        ar->arSsidLen, ar->arSsid,
-+                                        ar->arReqBssid, ar->arChannelHint,
-+                                        ar->arConnectCtrlFlags) != A_OK)
-+                    {
-+                        ret = -EIO;
-+                        ar->arConnectPending = FALSE;
-+                    }
-+                }
-+            } else {
-+                /* Disconnect from the AP and disable foreground scanning */
-+                AR6000_SPIN_LOCK(&ar->arLock, 0);
-+                if (ar->arConnected == TRUE || ar->arConnectPending == TRUE) {
-+                    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+                    wmi_disconnect_cmd(ar->arWmi);
-+                } else {
-+                    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+                }
-+
-+                if (wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0, 0, 0, 0, 0, 0, 0xFF, 0) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
-+            ret = ar6000_ioctl_get_roam_data(dev, rq);
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_BT_STATUS:
-+            ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_BT_PARAMS:
-+            ret = ar6000_xioctl_set_bt_params_cmd(dev, userdata);
-+            break;
-+        case AR6000_XIOCTL_WMI_STARTSCAN:
-+        {
-+            WMI_START_SCAN_CMD setStartScanCmd;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                    ret = -EIO;
-+                } else if (copy_from_user(&setStartScanCmd, userdata,
-+                                          sizeof(setStartScanCmd)))
-+                {
-+                    ret = -EFAULT;
-+                } else {
-+                    if (wmi_startscan_cmd(ar->arWmi, setStartScanCmd.scanType,
-+                                    setStartScanCmd.forceFgScan,
-+                                    setStartScanCmd.isLegacy,
-+                                    setStartScanCmd.homeDwellTime,
-+                                    setStartScanCmd.forceScanInterval) != A_OK)
-+                    {
-+                        ret = -EIO;
-+                    }
-+                }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SETFIXRATES:
-+        {
-+            WMI_FIX_RATES_CMD setFixRatesCmd;
-+            A_STATUS returnStatus;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                    ret = -EIO;
-+                } else if (copy_from_user(&setFixRatesCmd, userdata,
-+                                          sizeof(setFixRatesCmd)))
-+                {
-+                    ret = -EFAULT;
-+                } else {
-+                    returnStatus = wmi_set_fixrates_cmd(ar->arWmi, setFixRatesCmd.fixRateMask);
-+                    if (returnStatus == A_EINVAL)
-+                    {
-+                        ret = -EINVAL;
-+                    }
-+                    else if(returnStatus != A_OK) {
-+                        ret = -EIO;
-+                    }
-+                }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_WMI_GETFIXRATES:
-+        {
-+            WMI_FIX_RATES_CMD getFixRatesCmd;
-+            AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+            int ret = 0;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+            /* Used copy_from_user/copy_to_user to access user space data */
-+            if (copy_from_user(&getFixRatesCmd, userdata, sizeof(getFixRatesCmd))) {
-+                ret = -EFAULT;
-+            } else {
-+                ar->arRateMask = 0xFFFF;
-+
-+                if (wmi_get_ratemask_cmd(ar->arWmi) != A_OK) {
-+                    up(&ar->arSem);
-+                    return -EIO;
-+                }
-+
-+                wait_event_interruptible_timeout(arEvent, ar->arRateMask != 0xFFFF, wmitimeout * HZ);
-+
-+                if (signal_pending(current)) {
-+                    ret = -EINTR;
-+                }
-+
-+                if (!ret) {
-+                    getFixRatesCmd.fixRateMask = ar->arRateMask;
-+                }
-+
-+                if(copy_to_user(userdata, &getFixRatesCmd, sizeof(getFixRatesCmd))) {
-+                   ret = -EFAULT;
-+                }
-+
-+                up(&ar->arSem);
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_AUTHMODE:
-+        {
-+            WMI_SET_AUTH_MODE_CMD setAuthMode;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setAuthMode, userdata,
-+                                      sizeof(setAuthMode)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_authmode_cmd(ar->arWmi, setAuthMode.mode) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_REASSOCMODE:
-+        {
-+            WMI_SET_REASSOC_MODE_CMD setReassocMode;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setReassocMode, userdata,
-+                                      sizeof(setReassocMode)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_reassocmode_cmd(ar->arWmi, setReassocMode.mode) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_DIAG_READ:
-+        {
-+            A_UINT32 addr, data;
-+            get_user(addr, (unsigned int *)userdata);
-+            if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
-+                ret = -EIO;
-+            }
-+            put_user(data, (unsigned int *)userdata + 1);
-+            break;
-+        }
-+        case AR6000_XIOCTL_DIAG_WRITE:
-+        {
-+            A_UINT32 addr, data;
-+            get_user(addr, (unsigned int *)userdata);
-+            get_user(data, (unsigned int *)userdata + 1);
-+            if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
-+                ret = -EIO;
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
-+        {
-+             WMI_SET_KEEPALIVE_CMD setKeepAlive;
-+             if (ar->arWmiReady == FALSE) {
-+                 return -EIO;
-+             } else if (copy_from_user(&setKeepAlive, userdata,
-+                        sizeof(setKeepAlive))){
-+                 ret = -EFAULT;
-+             } else {
-+                 if (wmi_set_keepalive_cmd(ar->arWmi, setKeepAlive.keepaliveInterval) != A_OK) {
-+                     ret = -EIO;
-+               }
-+             }
-+             break;
-+        }
-+        case AR6000_XIOCTL_WMI_GET_KEEPALIVE:
-+        {
-+            AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+            WMI_GET_KEEPALIVE_CMD getKeepAlive;
-+            int ret = 0;
-+            if (ar->arWmiReady == FALSE) {
-+               return -EIO;
-+            }
-+            if (down_interruptible(&ar->arSem)) {
-+                return -ERESTARTSYS;
-+            }
-+            if (copy_from_user(&getKeepAlive, userdata,sizeof(getKeepAlive))) {
-+               ret = -EFAULT;
-+            } else {
-+            getKeepAlive.keepaliveInterval = wmi_get_keepalive_cmd(ar->arWmi);
-+            ar->arKeepaliveConfigured = 0xFF;
-+            if (wmi_get_keepalive_configured(ar->arWmi) != A_OK){
-+                up(&ar->arSem);
-+                return -EIO;
-+            }
-+            wait_event_interruptible_timeout(arEvent, ar->arKeepaliveConfigured != 0xFF, wmitimeout * HZ);
-+            if (signal_pending(current)) {
-+                ret = -EINTR;
-+            }
-+
-+            if (!ret) {
-+                getKeepAlive.configured = ar->arKeepaliveConfigured;
-+            }
-+            if (copy_to_user(userdata, &getKeepAlive, sizeof(getKeepAlive))) {
-+               ret = -EFAULT;
-+            }
-+            up(&ar->arSem);
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_APPIE:
-+        {
-+            WMI_SET_APPIE_CMD appIEcmd;
-+            A_UINT8           appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
-+            A_UINT32            fType,ieLen;
-+
-+	    if (ar->arWmiReady == FALSE) {
-+		    return -EIO;
-+	    }
-+	    get_user(fType, (A_UINT32 *)userdata);
-+	    appIEcmd.mgmtFrmType = fType;
-+	    if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
-+		    ret = -EIO;
-+	    } else {
-+		    get_user(ieLen, (A_UINT32 *)(userdata + 4));
-+		    appIEcmd.ieLen = ieLen;
-+		    if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
-+			    ret = -EIO;
-+			    break;
-+		    }
-+		    if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
-+			    ret = -EFAULT;
-+		    } else {
-+			    if (wmi_set_appie_cmd(ar->arWmi, appIEcmd.mgmtFrmType,
-+						  appIEcmd.ieLen,  appIeInfo) != A_OK)
-+			    {
-+				    ret = -EIO;
-+			    }
-+		    }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER:
-+        {
-+            WMI_BSS_FILTER_CMD cmd;
-+            A_UINT32    filterType;
-+
-+            if (copy_from_user(&filterType, userdata, sizeof(A_UINT32)))
-+            {
-+                return -EFAULT;
-+            }
-+            if (filterType & (IEEE80211_FILTER_TYPE_BEACON |
-+                                    IEEE80211_FILTER_TYPE_PROBE_RESP))
-+            {
-+                cmd.bssFilter = ALL_BSS_FILTER;
-+            } else {
-+                cmd.bssFilter = NONE_BSS_FILTER;
-+            }
-+            if (wmi_bssfilter_cmd(ar->arWmi, cmd.bssFilter, 0) != A_OK) {
-+                ret = -EIO;
-+            }
-+
-+            AR6000_SPIN_LOCK(&ar->arLock, 0);
-+            ar->arMgmtFilter = filterType;
-+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_WSC_STATUS:
-+        {
-+            A_UINT32    wsc_status;
-+
-+            if (copy_from_user(&wsc_status, userdata, sizeof(A_UINT32)))
-+            {
-+                return -EFAULT;
-+            }
-+            if (wmi_set_wsc_status_cmd(ar->arWmi, wsc_status) != A_OK) {
-+                ret = -EIO;
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
-+        {
-+            A_UINT32 ROM_addr;
-+            A_UINT32 RAM_addr;
-+            A_UINT32 nbytes;
-+            A_UINT32 do_activate;
-+            A_UINT32 rompatch_id;
-+
-+            get_user(ROM_addr, (A_UINT32 *)userdata);
-+            get_user(RAM_addr, (A_UINT32 *)userdata + 1);
-+            get_user(nbytes, (A_UINT32 *)userdata + 2);
-+            get_user(do_activate, (A_UINT32 *)userdata + 3);
-+            AR_DEBUG_PRINTF("Install rompatch from ROM: 0x%x to RAM: 0x%x  length: %d\n",
-+                             ROM_addr, RAM_addr, nbytes);
-+            ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
-+                                        nbytes, do_activate, &rompatch_id);
-+            if (ret == A_OK) {
-+                put_user(rompatch_id, (unsigned int *)rq->ifr_data); /* return value */
-+            }
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
-+        {
-+            A_UINT32 rompatch_id;
-+
-+            get_user(rompatch_id, (A_UINT32 *)userdata);
-+            AR_DEBUG_PRINTF("UNinstall rompatch_id %d\n", rompatch_id);
-+            ret = BMIrompatchUninstall(hifDevice, rompatch_id);
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
-+        case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
-+        {
-+            A_UINT32 rompatch_count;
-+
-+            get_user(rompatch_count, (A_UINT32 *)userdata);
-+            AR_DEBUG_PRINTF("Change rompatch activation count=%d\n", rompatch_count);
-+            length = sizeof(A_UINT32) * rompatch_count;
-+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+                A_MEMZERO(buffer, length);
-+                if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
-+                {
-+                    ret = -EFAULT;
-+                } else {
-+                    if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
-+                        ret = BMIrompatchActivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
-+                    } else {
-+                        ret = BMIrompatchDeactivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
-+                    }
-+                }
-+                A_FREE(buffer);
-+            } else {
-+                ret = -ENOMEM;
-+            }
-+
-+            break;
-+        }
-+
-+        case AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE:
-+        {
-+            WMI_SET_HOST_SLEEP_MODE_CMD setHostSleepMode;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setHostSleepMode, userdata,
-+                                      sizeof(setHostSleepMode)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_host_sleep_mode_cmd(ar->arWmi,
-+                                &setHostSleepMode) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_SET_WOW_MODE:
-+        {
-+            WMI_SET_WOW_MODE_CMD setWowMode;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&setWowMode, userdata,
-+                                      sizeof(setWowMode)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_wow_mode_cmd(ar->arWmi,
-+                                &setWowMode) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_GET_WOW_LIST:
-+        {
-+            WMI_GET_WOW_LIST_CMD getWowList;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&getWowList, userdata,
-+                                      sizeof(getWowList)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_get_wow_list_cmd(ar->arWmi,
-+                                &getWowList) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_ADD_WOW_PATTERN:
-+        {
-+#define WOW_PATTERN_SIZE 64
-+#define WOW_MASK_SIZE 64
-+
-+            WMI_ADD_WOW_PATTERN_CMD cmd;
-+            A_UINT8 mask_data[WOW_PATTERN_SIZE]={0};
-+            A_UINT8 pattern_data[WOW_PATTERN_SIZE]={0};
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else {
-+
-+                if(copy_from_user(&cmd, userdata,
-+                            sizeof(WMI_ADD_WOW_PATTERN_CMD)))
-+                      return -EFAULT;
-+                if (copy_from_user(pattern_data,
-+                                      userdata + 3,
-+                                      cmd.filter_size)){
-+                        ret = -EFAULT;
-+                        break;
-+                }
-+                if (copy_from_user(mask_data,
-+                                      (userdata + 3 + cmd.filter_size),
-+                                      cmd.filter_size)){
-+                        ret = -EFAULT;
-+                        break;
-+                } else {
-+                    if (wmi_add_wow_pattern_cmd(ar->arWmi,
-+                                &cmd, pattern_data, mask_data, cmd.filter_size) != A_OK){
-+                        ret = -EIO;
-+                    }
-+                }
-+            }
-+#undef WOW_PATTERN_SIZE
-+#undef WOW_MASK_SIZE
-+            break;
-+        }
-+        case AR6000_XIOCTL_WMI_DEL_WOW_PATTERN:
-+        {
-+            WMI_DEL_WOW_PATTERN_CMD delWowPattern;
-+
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&delWowPattern, userdata,
-+                                      sizeof(delWowPattern)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_del_wow_pattern_cmd(ar->arWmi,
-+                                &delWowPattern) != A_OK)
-+                {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        }
-+        case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
-+            if (ar->arHtcTarget != NULL) {
-+                HTCDumpCreditStates(ar->arHtcTarget);
-+            }
-+            break;
-+        case AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE:
-+            if (ar->arHtcTarget != NULL) {
-+                struct ar6000_traffic_activity_change data;
-+
-+                if (copy_from_user(&data, userdata, sizeof(data)))
-+                {
-+                    return -EFAULT;
-+                }
-+                    /* note, this is used for testing (mbox ping testing), indicate activity
-+                     * change using the stream ID as the traffic class */
-+                ar6000_indicate_tx_activity(ar,
-+                                            (A_UINT8)data.StreamID,
-+                                            data.Active ? TRUE : FALSE);
-+            }
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS:
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&connectCtrlFlags, userdata,
-+                                      sizeof(connectCtrlFlags)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                ar->arConnectCtrlFlags = connectCtrlFlags;
-+            }
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_AKMP_PARAMS:
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else if (copy_from_user(&akmpParams, userdata,
-+                                      sizeof(WMI_SET_AKMP_PARAMS_CMD)))
-+            {
-+                ret = -EFAULT;
-+            } else {
-+                if (wmi_set_akmp_params_cmd(ar->arWmi, &akmpParams) != A_OK) {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        case AR6000_XIOCTL_WMI_SET_PMKID_LIST:
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else {
-+                if (copy_from_user(&pmkidInfo.numPMKID, userdata,
-+                                      sizeof(pmkidInfo.numPMKID)))
-+                {
-+                    ret = -EFAULT;
-+                    break;
-+                }
-+                if (copy_from_user(&pmkidInfo.pmkidList,
-+                                   userdata + sizeof(pmkidInfo.numPMKID),
-+                                   pmkidInfo.numPMKID * sizeof(WMI_PMKID)))
-+                {
-+                    ret = -EFAULT;
-+                    break;
-+                }
-+                if (wmi_set_pmkid_list_cmd(ar->arWmi, &pmkidInfo) != A_OK) {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        case AR6000_XIOCTL_WMI_GET_PMKID_LIST:
-+            if (ar->arWmiReady == FALSE) {
-+                ret = -EIO;
-+            } else  {
-+                if (wmi_get_pmkid_list_cmd(ar->arWmi) != A_OK) {
-+                    ret = -EIO;
-+                }
-+            }
-+            break;
-+        default:
-+            ret = -EOPNOTSUPP;
-+    }
-+    return ret;
-+}
-+
-diff --git a/drivers/ar6000/ar6000/netbuf.c b/drivers/ar6000/ar6000/netbuf.c
-new file mode 100644
-index 0000000..97b273b
---- /dev/null
-+++ b/drivers/ar6000/ar6000/netbuf.c
-@@ -0,0 +1,225 @@
-+
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#include <linux/kernel.h>
-+#include <linux/skbuff.h>
-+#include <a_config.h>
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "htc_packet.h"
-+
-+#define AR6000_DATA_OFFSET    64
-+
-+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt)
-+{
-+    skb_queue_tail((struct sk_buff_head *) q, (struct sk_buff *) pkt);
-+}
-+
-+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt)
-+{
-+    skb_queue_head((struct sk_buff_head *) q, (struct sk_buff *) pkt);
-+}
-+
-+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q)
-+{
-+    return((void *) skb_dequeue((struct sk_buff_head *) q));
-+}
-+
-+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q)
-+{
-+    return(skb_queue_len((struct sk_buff_head *) q));
-+}
-+
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q)
-+{
-+    return(skb_queue_empty((struct sk_buff_head *) q));
-+}
-+
-+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q)
-+{
-+    skb_queue_head_init((struct sk_buff_head *) q);
-+}
-+
-+void *
-+a_netbuf_alloc(int size)
-+{
-+    struct sk_buff *skb;
-+    skb = dev_alloc_skb(AR6000_DATA_OFFSET + sizeof(HTC_PACKET) + size);
-+    skb_reserve(skb, AR6000_DATA_OFFSET + sizeof(HTC_PACKET));
-+    return ((void *)skb);
-+}
-+
-+/*
-+ * Allocate an SKB w.o. any encapsulation requirement.
-+ */
-+void *
-+a_netbuf_alloc_raw(int size)
-+{
-+    struct sk_buff *skb;
-+
-+    skb = dev_alloc_skb(size);
-+
-+    return ((void *)skb);
-+}
-+
-+void
-+a_netbuf_free(void *bufPtr)
-+{
-+    struct sk_buff *skb = (struct sk_buff *)bufPtr;
-+
-+    dev_kfree_skb(skb);
-+}
-+
-+A_UINT32
-+a_netbuf_to_len(void *bufPtr)
-+{
-+    return (((struct sk_buff *)bufPtr)->len);
-+}
-+
-+void *
-+a_netbuf_to_data(void *bufPtr)
-+{
-+    return (((struct sk_buff *)bufPtr)->data);
-+}
-+
-+/*
-+ * Add len # of bytes to the beginning of the network buffer
-+ * pointed to by bufPtr
-+ */
-+A_STATUS
-+a_netbuf_push(void *bufPtr, A_INT32 len)
-+{
-+    skb_push((struct sk_buff *)bufPtr, len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Add len # of bytes to the beginning of the network buffer
-+ * pointed to by bufPtr and also fill with data
-+ */
-+A_STATUS
-+a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len)
-+{
-+    skb_push((struct sk_buff *) bufPtr, len);
-+    A_MEMCPY(((struct sk_buff *)bufPtr)->data, srcPtr, len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Add len # of bytes to the end of the network buffer
-+ * pointed to by bufPtr
-+ */
-+A_STATUS
-+a_netbuf_put(void *bufPtr, A_INT32 len)
-+{
-+    skb_put((struct sk_buff *)bufPtr, len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Add len # of bytes to the end of the network buffer
-+ * pointed to by bufPtr and also fill with data
-+ */
-+A_STATUS
-+a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len)
-+{
-+    char *start = ((struct sk_buff *)bufPtr)->data +
-+        ((struct sk_buff *)bufPtr)->len;
-+    skb_put((struct sk_buff *)bufPtr, len);
-+    A_MEMCPY(start, srcPtr, len);
-+
-+    return A_OK;
-+}
-+
-+
-+/*
-+ * Trim the network buffer pointed to by bufPtr to len # of bytes
-+ */
-+A_STATUS
-+a_netbuf_setlen(void *bufPtr, A_INT32 len)
-+{
-+    skb_trim((struct sk_buff *)bufPtr, len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Chop of len # of bytes from the end of the buffer.
-+ */
-+A_STATUS
-+a_netbuf_trim(void *bufPtr, A_INT32 len)
-+{
-+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Chop of len # of bytes from the end of the buffer and return the data.
-+ */
-+A_STATUS
-+a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len)
-+{
-+    char *start = ((struct sk_buff *)bufPtr)->data +
-+        (((struct sk_buff *)bufPtr)->len - len);
-+
-+    A_MEMCPY(dstPtr, start, len);
-+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
-+
-+    return A_OK;
-+}
-+
-+
-+/*
-+ * Returns the number of bytes available to a a_netbuf_push()
-+ */
-+A_INT32
-+a_netbuf_headroom(void *bufPtr)
-+{
-+    return (skb_headroom((struct sk_buff *)bufPtr));
-+}
-+
-+/*
-+ * Removes specified number of bytes from the beginning of the buffer
-+ */
-+A_STATUS
-+a_netbuf_pull(void *bufPtr, A_INT32 len)
-+{
-+    skb_pull((struct sk_buff *)bufPtr, len);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Removes specified number of bytes from the beginning of the buffer
-+ * and return the data
-+ */
-+A_STATUS
-+a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len)
-+{
-+    A_MEMCPY(dstPtr, ((struct sk_buff *)bufPtr)->data, len);
-+    skb_pull((struct sk_buff *)bufPtr, len);
-+
-+    return A_OK;
-+}
-+
-diff --git a/drivers/ar6000/ar6000/osapi_linux.h b/drivers/ar6000/ar6000/osapi_linux.h
-new file mode 100644
-index 0000000..5b64212
---- /dev/null
-+++ b/drivers/ar6000/ar6000/osapi_linux.h
-@@ -0,0 +1,319 @@
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/osapi_linux.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _OSAPI_LINUX_H_
-+#define _OSAPI_LINUX_H_
-+
-+#ifdef __KERNEL__
-+
-+#include <linux/version.h>
-+#include <linux/types.h>
-+#include <linux/kernel.h>
-+#include <linux/string.h>
-+#include <linux/skbuff.h>
-+#include <linux/netdevice.h>
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+#include <linux/jiffies.h>
-+#endif
-+#include <linux/timer.h>
-+#include <linux/delay.h>
-+#include <linux/wait.h>
-+#ifdef KERNEL_2_4
-+#include <asm/arch/irq.h>
-+#include <asm/irq.h>
-+#endif
-+
-+#ifdef __GNUC__
-+#define __ATTRIB_PACK           __attribute__ ((packed))
-+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
-+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
-+#ifndef INLINE
-+#define INLINE                  __inline__
-+#endif
-+#else /* Not GCC */
-+#define __ATTRIB_PACK
-+#define __ATTRIB_PRINTF
-+#define __ATTRIB_NORETURN
-+#ifndef INLINE
-+#define INLINE                  __inline
-+#endif
-+#endif /* End __GNUC__ */
-+
-+#define PREPACK
-+#define POSTPACK                __ATTRIB_PACK
-+
-+/*
-+ * Endianes macros
-+ */
-+#define A_BE2CPU8(x)       ntohb(x)
-+#define A_BE2CPU16(x)      ntohs(x)
-+#define A_BE2CPU32(x)      ntohl(x)
-+
-+#define A_LE2CPU8(x)       (x)
-+#define A_LE2CPU16(x)      (x)
-+#define A_LE2CPU32(x)      (x)
-+
-+#define A_CPU2BE8(x)       htonb(x)
-+#define A_CPU2BE16(x)      htons(x)
-+#define A_CPU2BE32(x)      htonl(x)
-+
-+#define A_MEMCPY(dst, src, len)         memcpy((A_UINT8 *)(dst), (src), (len))
-+#define A_MEMZERO(addr, len)            memset(addr, 0, len)
-+#define A_MEMCMP(addr1, addr2, len)     memcmp((addr1), (addr2), (len))
-+#define A_MALLOC(size)                  kmalloc((size), GFP_KERNEL)
-+#define A_MALLOC_NOWAIT(size)           kmalloc((size), GFP_ATOMIC)
-+#define A_FREE(addr)                    kfree(addr)
-+#define A_PRINTF(args...)               printk(args)
-+
-+/* Mutual Exclusion */
-+typedef spinlock_t                      A_MUTEX_T;
-+#define A_MUTEX_INIT(mutex)             spin_lock_init(mutex)
-+#define A_MUTEX_LOCK(mutex)             spin_lock_bh(mutex)
-+#define A_MUTEX_UNLOCK(mutex)           spin_unlock_bh(mutex)
-+#define A_IS_MUTEX_VALID(mutex)         TRUE  /* okay to return true, since A_MUTEX_DELETE does nothing */
-+#define A_MUTEX_DELETE(mutex)           /* spin locks are not kernel resources so nothing to free.. */
-+
-+/* Get current time in ms adding a constant offset (in ms) */
-+#define A_GET_MS(offset)    \
-+	(jiffies + ((offset) / 1000) * HZ)
-+
-+/*
-+ * Timer Functions
-+ */
-+#define A_MDELAY(msecs)                 mdelay(msecs)
-+typedef struct timer_list               A_TIMER;
-+
-+#define A_INIT_TIMER(pTimer, pFunction, pArg) do {              \
-+    init_timer(pTimer);                                         \
-+    (pTimer)->function = (pFunction);                           \
-+    (pTimer)->data   = (unsigned long)(pArg);                   \
-+} while (0)
-+
-+/*
-+ * Start a Timer that elapses after 'periodMSec' milli-seconds
-+ * Support is provided for a one-shot timer. The 'repeatFlag' is
-+ * ignored.
-+ */
-+#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do {                   \
-+    if (repeatFlag) {                                                       \
-+        printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__);     \
-+        panic("Timer Repeat");                                              \
-+    }                                                                       \
-+    mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000);                \
-+} while (0)
-+
-+/*
-+ * Cancel the Timer.
-+ */
-+#define A_UNTIMEOUT(pTimer) do {                                \
-+    del_timer((pTimer));                                        \
-+} while (0)
-+
-+#define A_DELETE_TIMER(pTimer) do {                             \
-+} while (0)
-+
-+/*
-+ * Wait Queue related functions
-+ */
-+typedef wait_queue_head_t               A_WAITQUEUE_HEAD;
-+#define A_INIT_WAITQUEUE_HEAD(head)     init_waitqueue_head(head)
-+#ifndef wait_event_interruptible_timeout
-+#define __wait_event_interruptible_timeout(wq, condition, ret)          \
-+do {                                                                    \
-+        wait_queue_t __wait;                                            \
-+        init_waitqueue_entry(&__wait, current);                         \
-+                                                                        \
-+        add_wait_queue(&wq, &__wait);                                   \
-+        for (;;) {                                                      \
-+                set_current_state(TASK_INTERRUPTIBLE);                  \
-+                if (condition)                                          \
-+                        break;                                          \
-+                if (!signal_pending(current)) {                         \
-+                        ret = schedule_timeout(ret);                    \
-+                        if (!ret)                                       \
-+                                break;                                  \
-+                        continue;                                       \
-+                }                                                       \
-+                ret = -ERESTARTSYS;                                     \
-+                break;                                                  \
-+        }                                                               \
-+        current->state = TASK_RUNNING;                                  \
-+        remove_wait_queue(&wq, &__wait);                                \
-+} while (0)
-+
-+#define wait_event_interruptible_timeout(wq, condition, timeout)        \
-+({                                                                      \
-+        long __ret = timeout;                                           \
-+        if (!(condition))                                               \
-+                __wait_event_interruptible_timeout(wq, condition, __ret); \
-+        __ret;                                                          \
-+})
-+#endif /* wait_event_interruptible_timeout */
-+
-+#define A_WAIT_EVENT_INTERRUPTIBLE_TIMEOUT(head, condition, timeout) do { \
-+    wait_event_interruptible_timeout(head, condition, timeout); \
-+} while (0)
-+
-+#define A_WAKE_UP(head)                 wake_up(head)
-+
-+#ifdef DEBUG
-+#define A_ASSERT(expr)  \
-+    if (!(expr)) {   \
-+        printk(KERN_ALERT "\n" __FILE__ ":%d: Assertion " #expr " failed!\n",__LINE__); \
-+        panic(#expr); \
-+    }
-+
-+#else
-+#define A_ASSERT(expr)
-+#endif /* DEBUG */
-+
-+/*
-+ * Initialization of the network buffer subsystem
-+ */
-+#define A_NETBUF_INIT()
-+
-+/*
-+ * Network buffer queue support
-+ */
-+typedef struct sk_buff_head A_NETBUF_QUEUE_T;
-+
-+#define A_NETBUF_QUEUE_INIT(q)  \
-+    a_netbuf_queue_init(q)
-+
-+#define A_NETBUF_ENQUEUE(q, pkt) \
-+    a_netbuf_enqueue((q), (pkt))
-+#define A_NETBUF_PREQUEUE(q, pkt) \
-+    a_netbuf_prequeue((q), (pkt))
-+#define A_NETBUF_DEQUEUE(q) \
-+    (a_netbuf_dequeue(q))
-+#define A_NETBUF_QUEUE_SIZE(q)  \
-+    a_netbuf_queue_size(q)
-+#define A_NETBUF_QUEUE_EMPTY(q) \
-+    a_netbuf_queue_empty(q)
-+
-+/*
-+ * Network buffer support
-+ */
-+#define A_NETBUF_ALLOC(size) \
-+    a_netbuf_alloc(size)
-+#define A_NETBUF_ALLOC_RAW(size) \
-+    a_netbuf_alloc_raw(size)
-+#define A_NETBUF_FREE(bufPtr) \
-+    a_netbuf_free(bufPtr)
-+#define A_NETBUF_DATA(bufPtr) \
-+    a_netbuf_to_data(bufPtr)
-+#define A_NETBUF_LEN(bufPtr) \
-+    a_netbuf_to_len(bufPtr)
-+#define A_NETBUF_PUSH(bufPtr, len) \
-+    a_netbuf_push(bufPtr, len)
-+#define A_NETBUF_PUT(bufPtr, len) \
-+    a_netbuf_put(bufPtr, len)
-+#define A_NETBUF_TRIM(bufPtr,len) \
-+    a_netbuf_trim(bufPtr, len)
-+#define A_NETBUF_PULL(bufPtr, len) \
-+    a_netbuf_pull(bufPtr, len)
-+#define A_NETBUF_HEADROOM(bufPtr)\
-+    a_netbuf_headroom(bufPtr)
-+#define A_NETBUF_SETLEN(bufPtr,len) \
-+    a_netbuf_setlen(bufPtr, len)
-+
-+/* Add data to end of a buffer  */
-+#define A_NETBUF_PUT_DATA(bufPtr, srcPtr,  len) \
-+    a_netbuf_put_data(bufPtr, srcPtr, len)
-+
-+/* Add data to start of the  buffer */
-+#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr,  len) \
-+    a_netbuf_push_data(bufPtr, srcPtr, len)
-+
-+/* Remove data at start of the buffer */
-+#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
-+    a_netbuf_pull_data(bufPtr, dstPtr, len)
-+
-+/* Remove data from the end of the buffer */
-+#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
-+    a_netbuf_trim_data(bufPtr, dstPtr, len)
-+
-+/* View data as "size" contiguous bytes of type "t" */
-+#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
-+    (t )( ((struct skbuf *)(bufPtr))->data)
-+
-+/* return the beginning of the headroom for the buffer */
-+#define A_NETBUF_HEAD(bufPtr) \
-+        ((((struct sk_buff *)(bufPtr))->head))
-+
-+/*
-+ * OS specific network buffer access routines
-+ */
-+void *a_netbuf_alloc(int size);
-+void *a_netbuf_alloc_raw(int size);
-+void a_netbuf_free(void *bufPtr);
-+void *a_netbuf_to_data(void *bufPtr);
-+A_UINT32 a_netbuf_to_len(void *bufPtr);
-+A_STATUS a_netbuf_push(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len);
-+A_STATUS a_netbuf_put(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len);
-+A_STATUS a_netbuf_pull(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len);
-+A_STATUS a_netbuf_trim(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len);
-+A_STATUS a_netbuf_setlen(void *bufPtr, A_INT32 len);
-+A_INT32 a_netbuf_headroom(void *bufPtr);
-+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
-+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
-+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
-+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
-+
-+/*
-+ * Kernel v.s User space functions
-+ */
-+A_UINT32 a_copy_to_user(void *to, const void *from, A_UINT32 n);
-+A_UINT32 a_copy_from_user(void *to, const void *from, A_UINT32 n);
-+
-+#else /* __KERNEL__ */
-+
-+#ifdef __GNUC__
-+#define __ATTRIB_PACK           __attribute__ ((packed))
-+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
-+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
-+#ifndef INLINE
-+#define INLINE                  __inline__
-+#endif
-+#else /* Not GCC */
-+#define __ATTRIB_PACK
-+#define __ATTRIB_PRINTF
-+#define __ATTRIB_NORETURN
-+#ifndef INLINE
-+#define INLINE                  __inline
-+#endif
-+#endif /* End __GNUC__ */
-+
-+#define PREPACK
-+#define POSTPACK                __ATTRIB_PACK
-+
-+#endif /* __KERNEL__ */
-+
-+#endif /* _OSAPI_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/wireless_ext.c b/drivers/ar6000/ar6000/wireless_ext.c
-new file mode 100644
-index 0000000..af78ae0
---- /dev/null
-+++ b/drivers/ar6000/ar6000/wireless_ext.c
-@@ -0,0 +1,1979 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "ar6000_drv.h"
-+
-+static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-+static void ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi);
-+extern unsigned int wmitimeout;
-+extern A_WAITQUEUE_HEAD arEvent;
-+extern wait_queue_head_t ar6000_scan_queue;
-+
-+/*
-+ * Encode a WPA or RSN information element as a custom
-+ * element using the hostap format.
-+ */
-+static u_int
-+encode_ie(void *buf, size_t bufsize,
-+    const u_int8_t *ie, size_t ielen,
-+    const char *leader, size_t leader_len)
-+{
-+    u_int8_t *p;
-+    int i;
-+
-+    if (bufsize < leader_len)
-+        return 0;
-+    p = buf;
-+    memcpy(p, leader, leader_len);
-+    bufsize -= leader_len;
-+    p += leader_len;
-+    for (i = 0; i < ielen && bufsize > 2; i++)
-+        p += sprintf(p, "%02x", ie[i]);
-+    return (i == ielen ? p - (u_int8_t *)buf : 0);
-+}
-+
-+void
-+ar6000_scan_node(void *arg, bss_t *ni)
-+{
-+    struct iw_event iwe;
-+#if WIRELESS_EXT > 14
-+    char buf[64*2 + 30];
-+#endif
-+    struct ar_giwscan_param *param;
-+    A_CHAR *current_ev;
-+    A_CHAR *end_buf;
-+    struct ieee80211_common_ie  *cie;
-+	struct iw_request_info info;
-+
-+	info.cmd = 0;
-+	info.flags = 0;
-+
-+    param = (struct ar_giwscan_param *)arg;
-+
-+    if (param->current_ev >= param->end_buf) {
-+        return;
-+    }
-+    if ((param->firstPass == TRUE) &&
-+        ((ni->ni_cie.ie_wpa == NULL) && (ni->ni_cie.ie_rsn == NULL))) {
-+        /*
-+         * Only forward wpa bss's in first pass
-+         */
-+        return;
-+    }
-+
-+     if ((param->firstPass == FALSE) &&
-+        ((ni->ni_cie.ie_wpa != NULL) || (ni->ni_cie.ie_rsn != NULL))) {
-+        /*
-+         * Only forward non-wpa bss's in 2nd pass
-+         */
-+        return;
-+    }
-+
-+    current_ev = param->current_ev;
-+    end_buf = param->end_buf;
-+
-+    cie = &ni->ni_cie;
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = SIOCGIWAP;
-+    iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-+    A_MEMCPY(iwe.u.ap_addr.sa_data, ni->ni_macaddr, 6);
-+    current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+                                      IW_EV_ADDR_LEN);
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = SIOCGIWESSID;
-+    iwe.u.data.flags = 1;
-+    iwe.u.data.length = cie->ie_ssid[1];
-+    current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+                                      &cie->ie_ssid[2]);
-+
-+    if (cie->ie_capInfo & (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) {
-+        A_MEMZERO(&iwe, sizeof(iwe));
-+        iwe.cmd = SIOCGIWMODE;
-+        iwe.u.mode = cie->ie_capInfo & IEEE80211_CAPINFO_ESS ?
-+                IW_MODE_MASTER : IW_MODE_ADHOC;
-+        current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+                                          IW_EV_UINT_LEN);
-+    }
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = SIOCGIWFREQ;
-+    iwe.u.freq.m = cie->ie_chan * 100000;
-+    iwe.u.freq.e = 1;
-+    current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+                                      IW_EV_FREQ_LEN);
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = IWEVQUAL;
-+    ar6000_set_quality(&iwe.u.qual, ni->ni_snr);
-+    current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+                                      IW_EV_QUAL_LEN);
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = SIOCGIWENCODE;
-+    if (cie->ie_capInfo & IEEE80211_CAPINFO_PRIVACY) {
-+        iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-+    } else {
-+        iwe.u.data.flags = IW_ENCODE_DISABLED;
-+    }
-+    iwe.u.data.length = 0;
-+    current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, "");
-+
-+    A_MEMZERO(&iwe, sizeof(iwe));
-+    iwe.cmd = IWEVCUSTOM;
-+    snprintf(buf, sizeof(buf), "bcn_int=%d", cie->ie_beaconInt);
-+    iwe.u.data.length = strlen(buf);
-+    current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, buf);
-+
-+    if (cie->ie_wpa != NULL) {
-+        static const char wpa_leader[] = "wpa_ie=";
-+
-+        A_MEMZERO(&iwe, sizeof(iwe));
-+        iwe.cmd = IWEVCUSTOM;
-+        iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wpa,
-+                                      cie->ie_wpa[1]+2,
-+                                      wpa_leader, sizeof(wpa_leader)-1);
-+
-+        if (iwe.u.data.length != 0) {
-+            current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+									   buf);
-+        }
-+    }
-+
-+    if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
-+        static const char rsn_leader[] = "rsn_ie=";
-+
-+        A_MEMZERO(&iwe, sizeof(iwe));
-+        iwe.cmd = IWEVCUSTOM;
-+        iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_rsn,
-+                                      cie->ie_rsn[1]+2,
-+                                      rsn_leader, sizeof(rsn_leader)-1);
-+
-+        if (iwe.u.data.length != 0) {
-+            current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+									   buf);
-+        }
-+    }
-+
-+    if (cie->ie_wmm != NULL) {
-+        static const char wmm_leader[] = "wmm_ie=";
-+
-+        A_MEMZERO(&iwe, sizeof(iwe));
-+        iwe.cmd = IWEVCUSTOM;
-+        iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wmm,
-+                                      cie->ie_wmm[1]+2,
-+                                      wmm_leader, sizeof(wmm_leader)-1);
-+        if (iwe.u.data.length != 0) {
-+            current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+									   buf);
-+        }
-+    }
-+
-+    if (cie->ie_ath != NULL) {
-+        static const char ath_leader[] = "ath_ie=";
-+
-+        A_MEMZERO(&iwe, sizeof(iwe));
-+        iwe.cmd = IWEVCUSTOM;
-+        iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_ath,
-+                                      cie->ie_ath[1]+2,
-+                                      ath_leader, sizeof(ath_leader)-1);
-+        if (iwe.u.data.length != 0) {
-+            current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+									   buf);
-+        }
-+    }
-+
-+    param->current_ev = current_ev;
-+}
-+
-+int
-+ar6000_ioctl_giwscan(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_point *data, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ar_giwscan_param param;
-+    int i;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    param.current_ev = extra;
-+    param.end_buf = extra + IW_SCAN_MAX_DATA;
-+    param.firstPass = TRUE;
-+
-+    /*
-+     * Do two passes to insure WPA scan candidates
-+     * are sorted to the front.  This is a hack to deal with
-+     * the wireless extensions capping scan results at
-+     * IW_SCAN_MAX_DATA bytes.  In densely populated environments
-+     * it's easy to overflow this buffer (especially with WPA/RSN
-+     * information elements).  Note this sorting hack does not
-+     * guarantee we won't overflow anyway.
-+     */
-+    for (i = 0; i < 2; i++) {
-+        /*
-+         * Translate data to WE format.
-+         */
-+        wmi_iterate_nodes(ar->arWmi, ar6000_scan_node, &param);
-+        param.firstPass = FALSE;
-+        if (param.current_ev >= param.end_buf) {
-+            data->length = param.current_ev - extra;
-+            return -E2BIG;
-+        }
-+    }
-+
-+    data->length = param.current_ev - extra;
-+    return 0;
-+}
-+
-+extern int reconnect_flag;
-+/* SIOCSIWESSID */
-+static int
-+ar6000_ioctl_siwessid(struct net_device *dev,
-+                     struct iw_request_info *info,
-+                     struct iw_point *data, char *ssid)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_STATUS status;
-+    A_UINT8     arNetworkType;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    /*
-+     * iwconfig passes a string with length excluding any trailing NUL.
-+     * FIXME: we should be able to set an ESSID of 32 bytes, yet things fall
-+     * over badly if we do. So we limit the ESSID to 31 bytes.
-+     */
-+    if (data->flags && (!data->length || data->length >= sizeof(ar->arSsid))) {
-+        /*
-+         * ssid is invalid
-+         */
-+        return -EINVAL;
-+    }
-+    /* Added for bug 25178, return an IOCTL error instead of target returning
-+       Illegal parameter error when either the BSSID or channel is missing
-+       and we cannot scan during connect.
-+     */
-+    if (data->flags) {
-+        if (ar->arSkipScan == TRUE &&
-+            (ar->arChannelHint == 0 ||
-+             (!ar->arReqBssid[0] && !ar->arReqBssid[1] && !ar->arReqBssid[2] &&
-+              !ar->arReqBssid[3] && !ar->arReqBssid[4] && !ar->arReqBssid[5])))
-+        {
-+            return -EINVAL;
-+        }
-+    }
-+
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+
-+    if (ar->arTxPending[WMI_CONTROL_PRI]) {
-+        /*
-+         * sleep until the command queue drains
-+         */
-+        wait_event_interruptible_timeout(arEvent,
-+            ar->arTxPending[WMI_CONTROL_PRI] == 0, wmitimeout * HZ);
-+        if (signal_pending(current)) {
-+            return -EINTR;
-+        }
-+    }
-+
-+    if (!data->flags) {
-+        arNetworkType = ar->arNetworkType;
-+        ar6000_init_profile_info(ar);
-+        ar->arNetworkType = arNetworkType;
-+    }
-+
-+    /*
-+     * The original logic here prevented a disconnect if issuing an "essid off"
-+     * if no ESSID was set, presumably to prevent sending multiple disconnects
-+     * to the WMI.
-+     *
-+     * Unfortunately, this also meant that no disconnect was sent when we were
-+     * already connected, but the profile has been changed since (which also
-+     * clears the ESSID as a reminder that the WMI needs updating.)
-+     *
-+     * The "1 ||" makes sure we always disconnect or reconnect. The WMI doesn't
-+     * seem to mind being sent multiple disconnects.
-+     */
-+    if (1 || (ar->arSsidLen) || (!data->flags))
-+    {
-+        if ((!data->flags) ||
-+            (A_MEMCMP(ar->arSsid, ssid, ar->arSsidLen) != 0) ||
-+            (ar->arSsidLen != (data->length)))
-+        {
-+            /*
-+             * SSID set previously or essid off has been issued.
-+             *
-+             * Disconnect Command is issued in two cases after wmi is ready
-+             * (1) ssid is different from the previous setting
-+             * (2) essid off has been issued
-+             *
-+             */
-+            if (ar->arWmiReady == TRUE) {
-+                reconnect_flag = 0;
-+                status = wmi_disconnect_cmd(ar->arWmi);
-+                A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+                ar->arSsidLen = 0;
-+                if (ar->arSkipScan == FALSE) {
-+                    A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+                }
-+                if (!data->flags) {
-+                    up(&ar->arSem);
-+                    return 0;
-+                }
-+            } else {
-+                 up(&ar->arSem);
-+            }
-+        }
-+        else
-+        {
-+            /*
-+             * SSID is same, so we assume profile hasn't changed.
-+             * If the interface is up and wmi is ready, we issue
-+             * a reconnect cmd. Issue a reconnect only we are already
-+             * connected.
-+             */
-+            if((ar->arConnected == TRUE) && (ar->arWmiReady == TRUE))
-+            {
-+                reconnect_flag = TRUE;
-+                status = wmi_reconnect_cmd(ar->arWmi,ar->arReqBssid,
-+                                           ar->arChannelHint);
-+                up(&ar->arSem);
-+                if (status != A_OK) {
-+                    return -EIO;
-+                }
-+                return 0;
-+            }
-+            else{
-+                /*
-+                 * Dont return if connect is pending.
-+                 */
-+                if(!(ar->arConnectPending)) {
-+                    up(&ar->arSem);
-+                    return 0;
-+                }
-+            }
-+        }
-+    }
-+
-+    ar->arSsidLen = data->length;
-+    A_MEMCPY(ar->arSsid, ssid, ar->arSsidLen);
-+
-+    /* The ssid length check prevents second "essid off" from the user,
-+       to be treated as a connect cmd. The second "essid off" is ignored.
-+    */
-+    if((ar->arWmiReady == TRUE) && (ar->arSsidLen > 0) )
-+    {
-+        AR6000_SPIN_LOCK(&ar->arLock, 0);
-+        if (SHARED_AUTH == ar->arDot11AuthMode) {
-+            ar6000_install_static_wep_keys(ar);
-+        }
-+        AR_DEBUG_PRINTF("Connect called with authmode %d dot11 auth %d"\
-+                        " PW crypto %d PW crypto Len %d GRP crypto %d"\
-+                        " GRP crypto Len %d\n",
-+                        ar->arAuthMode, ar->arDot11AuthMode,
-+                        ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
-+                        ar->arGroupCrypto, ar->arGroupCryptoLen);
-+        reconnect_flag = 0;
-+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+        status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
-+                                 ar->arDot11AuthMode, ar->arAuthMode,
-+                                 ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
-+                                 ar->arGroupCrypto,ar->arGroupCryptoLen,
-+                                 ar->arSsidLen, ar->arSsid,
-+                                 ar->arReqBssid, ar->arChannelHint,
-+                                 ar->arConnectCtrlFlags);
-+
-+
-+        up(&ar->arSem);
-+
-+        if (status != A_OK) {
-+            return -EIO;
-+        }
-+        ar->arConnectPending = TRUE;
-+    }else{
-+      up(&ar->arSem);
-+    }
-+    return 0;
-+}
-+
-+/* SIOCGIWESSID */
-+static int
-+ar6000_ioctl_giwessid(struct net_device *dev,
-+                     struct iw_request_info *info,
-+                     struct iw_point *data, char *essid)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    data->flags = 1;
-+    data->length = ar->arSsidLen;
-+    A_MEMCPY(essid, ar->arSsid, ar->arSsidLen);
-+
-+    return 0;
-+}
-+
-+
-+void ar6000_install_static_wep_keys(AR_SOFTC_T *ar)
-+{
-+    A_UINT8 index;
-+    A_UINT8 keyUsage;
-+
-+    for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
-+        if (ar->arWepKeyList[index].arKeyLen) {
-+            keyUsage = GROUP_USAGE;
-+            if (index == ar->arDefTxKeyIndex) {
-+                keyUsage |= TX_USAGE;
-+            }
-+            wmi_addKey_cmd(ar->arWmi,
-+                           index,
-+                           WEP_CRYPT,
-+                           keyUsage,
-+                           ar->arWepKeyList[index].arKeyLen,
-+                           NULL,
-+                           ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL,
-+                           NO_SYNC_WMIFLAG);
-+        }
-+    }
-+}
-+
-+int
-+ar6000_ioctl_delkey(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    return 0;
-+}
-+
-+int
-+ar6000_ioctl_setmlme(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ieee80211req_mlme *mlme = (struct ieee80211req_mlme *)extra;
-+
-+    if ((ar->arWmiReady == FALSE) || (ar->arConnected != TRUE))
-+		return -EIO;
-+
-+    switch (mlme->im_op) {
-+        case IEEE80211_MLME_DISASSOC:
-+        case IEEE80211_MLME_DEAUTH:
-+            /* Not Supported */
-+            break;
-+        default:
-+            break;
-+    }
-+    return 0;
-+}
-+
-+
-+int
-+ar6000_ioctl_setwmmparams(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    return -EIO;            /* for now */
-+}
-+
-+int
-+ar6000_ioctl_getwmmparams(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    return -EIO;            /* for now */
-+}
-+
-+int ar6000_ioctl_setoptie(struct net_device *dev, struct iw_request_info *info,
-+			  struct iw_point *data, char *extra)
-+{
-+	/* The target generates the WPA/RSN IE */
-+	return 0;
-+}
-+
-+int
-+ar6000_ioctl_setauthalg(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ieee80211req_authalg *req = (struct ieee80211req_authalg *)extra;
-+    int ret = 0;
-+
-+
-+    AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+    if (req->auth_alg == AUTH_ALG_OPEN_SYSTEM) {
-+        ar->arDot11AuthMode  = OPEN_AUTH;
-+    } else if (req->auth_alg == AUTH_ALG_LEAP) {
-+        ar->arDot11AuthMode   = LEAP_AUTH;
-+        ar->arPairwiseCrypto  = WEP_CRYPT;
-+        ar->arGroupCrypto     = WEP_CRYPT;
-+    } else {
-+        ret = -EIO;
-+    }
-+
-+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+    return ret;
-+}
-+static int
-+ar6000_ioctl_addpmkid(struct net_device *dev, struct iw_request_info *info,
-+             void *w, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ieee80211req_addpmkid  *req = (struct ieee80211req_addpmkid *)extra;
-+    A_STATUS status;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    AR_DEBUG_PRINTF("Add pmkid for %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x en=%d\n",
-+                    req->pi_bssid[0], req->pi_bssid[1], req->pi_bssid[2],
-+                    req->pi_bssid[3], req->pi_bssid[4], req->pi_bssid[5],
-+                    req->pi_enable);
-+
-+    status = wmi_setPmkid_cmd(ar->arWmi, req->pi_bssid, req->pi_pmkid,
-+                              req->pi_enable);
-+
-+    if (status != A_OK) {
-+        return -EIO;
-+    }
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCSIWRATE
-+ */
-+int
-+ar6000_ioctl_siwrate(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_UINT32  kbps;
-+
-+    if (rrq->fixed) {
-+        kbps = rrq->value / 1000;           /* rrq->value is in bps */
-+    } else {
-+        kbps = -1;                          /* -1 indicates auto rate */
-+    }
-+    if(kbps != -1 && wmi_validate_bitrate(ar->arWmi, kbps) == A_EINVAL)
-+    {
-+        AR_DEBUG_PRINTF("BitRate is not Valid %d\n", kbps);
-+        return -EINVAL;
-+    }
-+    ar->arBitRate = kbps;
-+    if(ar->arWmiReady == TRUE)
-+    {
-+        if (wmi_set_bitrate_cmd(ar->arWmi, kbps) != A_OK) {
-+            return -EINVAL;
-+        }
-+    }
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWRATE
-+ */
-+int
-+ar6000_ioctl_giwrate(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    int ret = 0;
-+
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+    if(ar->arWmiReady == TRUE)
-+    {
-+        ar->arBitRate = 0xFFFF;
-+        if (wmi_get_bitrate_cmd(ar->arWmi) != A_OK) {
-+            up(&ar->arSem);
-+            return -EIO;
-+        }
-+        wait_event_interruptible_timeout(arEvent, ar->arBitRate != 0xFFFF, wmitimeout * HZ);
-+        if (signal_pending(current)) {
-+            ret = -EINTR;
-+        }
-+    }
-+    /* If the interface is down or wmi is not ready or the target is not
-+       connected - return the value stored in the device structure */
-+    if (!ret) {
-+        if (ar->arBitRate == -1) {
-+            rrq->fixed = TRUE;
-+            rrq->value = 0;
-+        } else {
-+            rrq->value = ar->arBitRate * 1000;
-+        }
-+    }
-+
-+    up(&ar->arSem);
-+
-+    return ret;
-+}
-+
-+/*
-+ * SIOCSIWTXPOW
-+ */
-+static int
-+ar6000_ioctl_siwtxpow(struct net_device *dev,
-+             struct iw_request_info *info,
-+             struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_UINT8 dbM;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arRadioSwitch == WLAN_ENABLED
-+	&& rrq->disabled) {
-+	    if (wmi_switch_radio(ar->arWmi, WLAN_DISABLED) < 0)
-+		    return -EIO;
-+	    ar->arRadioSwitch = WLAN_DISABLED;
-+    } else if (ar->arRadioSwitch == WLAN_DISABLED
-+	       && !rrq->disabled) {
-+	    if (wmi_switch_radio(ar->arWmi, WLAN_ENABLED) < 0)
-+		    return -EIO;
-+	    ar->arRadioSwitch = WLAN_ENABLED;
-+    }
-+
-+    if (rrq->fixed) {
-+        if (rrq->flags != IW_TXPOW_DBM) {
-+            return -EOPNOTSUPP;
-+        }
-+        ar->arTxPwr= dbM = rrq->value;
-+        ar->arTxPwrSet = TRUE;
-+    } else {
-+        ar->arTxPwr = dbM = 0;
-+        ar->arTxPwrSet = FALSE;
-+    }
-+    if(ar->arWmiReady == TRUE)
-+    {
-+        AR_DEBUG_PRINTF("Set tx pwr cmd %d dbM\n", dbM);
-+        wmi_set_txPwr_cmd(ar->arWmi, dbM);
-+    }
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWTXPOW
-+ */
-+int
-+ar6000_ioctl_giwtxpow(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    int ret = 0;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arRadioSwitch == WLAN_DISABLED) {
-+	    rrq->disabled = 1;
-+	    return 0;
-+    }
-+
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+    if((ar->arWmiReady == TRUE) && (ar->arConnected == TRUE))
-+    {
-+        ar->arTxPwr = 0;
-+
-+        if (wmi_get_txPwr_cmd(ar->arWmi) != A_OK) {
-+            up(&ar->arSem);
-+            return -EIO;
-+        }
-+
-+        wait_event_interruptible_timeout(arEvent, ar->arTxPwr != 0, wmitimeout * HZ);
-+
-+        if (signal_pending(current)) {
-+            ret = -EINTR;
-+         }
-+    }
-+   /* If the interace is down or wmi is not ready or target is not connected
-+      then return value stored in the device structure */
-+
-+    if (!ret) {
-+         if (ar->arTxPwrSet == TRUE) {
-+            rrq->fixed = TRUE;
-+        }
-+        rrq->value = ar->arTxPwr;
-+        rrq->flags = IW_TXPOW_DBM;
-+    }
-+
-+    up(&ar->arSem);
-+
-+    return ret;
-+}
-+
-+/*
-+ * SIOCSIWRETRY
-+ * since iwconfig only provides us with one max retry value, we use it
-+ * to apply to data frames of the BE traffic class.
-+ */
-+static int
-+ar6000_ioctl_siwretry(struct net_device *dev,
-+             struct iw_request_info *info,
-+             struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (rrq->disabled) {
-+        return -EOPNOTSUPP;
-+    }
-+
-+    if ((rrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT) {
-+        return -EOPNOTSUPP;
-+    }
-+
-+    if ( !(rrq->value >= WMI_MIN_RETRIES) || !(rrq->value <= WMI_MAX_RETRIES)) {
-+            return - EINVAL;
-+    }
-+    if(ar->arWmiReady == TRUE)
-+    {
-+        if (wmi_set_retry_limits_cmd(ar->arWmi, DATA_FRAMETYPE, WMM_AC_BE,
-+                                     rrq->value, 0) != A_OK){
-+            return -EINVAL;
-+        }
-+    }
-+    ar->arMaxRetries = rrq->value;
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWRETRY
-+ */
-+static int
-+ar6000_ioctl_giwretry(struct net_device *dev,
-+             struct iw_request_info *info,
-+             struct iw_param *rrq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    rrq->disabled = 0;
-+    switch (rrq->flags & IW_RETRY_TYPE) {
-+    case IW_RETRY_LIFETIME:
-+        return -EOPNOTSUPP;
-+        break;
-+    case IW_RETRY_LIMIT:
-+        rrq->flags = IW_RETRY_LIMIT;
-+        switch (rrq->flags & IW_RETRY_MODIFIER) {
-+        case IW_RETRY_MIN:
-+            rrq->flags |= IW_RETRY_MIN;
-+            rrq->value = WMI_MIN_RETRIES;
-+            break;
-+        case IW_RETRY_MAX:
-+            rrq->flags |= IW_RETRY_MAX;
-+            rrq->value = ar->arMaxRetries;
-+            break;
-+        }
-+        break;
-+    }
-+    return 0;
-+}
-+
-+/*
-+ * SIOCSIWENCODE
-+ */
-+static int
-+ar6000_ioctl_siwencode(struct net_device *dev,
-+              struct iw_request_info *info,
-+              struct iw_point *erq, char *keybuf)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    int index;
-+    A_INT32 auth = ar->arDot11AuthMode;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    index = erq->flags & IW_ENCODE_INDEX;
-+
-+    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
-+                  ((index - 1) > WMI_MAX_KEY_INDEX)))
-+    {
-+        return -EIO;
-+    }
-+
-+    if (erq->flags & IW_ENCODE_DISABLED) {
-+        /*
-+         * Encryption disabled
-+         */
-+        if (index) {
-+            /*
-+             * If key index was specified then clear the specified key
-+             */
-+            index--;
-+            A_MEMZERO(ar->arWepKeyList[index].arKey,
-+                      sizeof(ar->arWepKeyList[index].arKey));
-+            ar->arWepKeyList[index].arKeyLen = 0;
-+        }
-+        ar->arDot11AuthMode       = OPEN_AUTH;
-+        ar->arPairwiseCrypto      = NONE_CRYPT;
-+        ar->arGroupCrypto         = NONE_CRYPT;
-+        ar->arAuthMode            = NONE_AUTH;
-+    } else {
-+        /*
-+         * Enabling WEP encryption
-+         */
-+        if (index) {
-+            index--;                /* keyindex is off base 1 in iwconfig */
-+        }
-+
-+        if (erq->flags & IW_ENCODE_OPEN) {
-+            auth = OPEN_AUTH;
-+        } else if (erq->flags & IW_ENCODE_RESTRICTED) {
-+            auth = SHARED_AUTH;
-+        }
-+
-+        if (erq->length) {
-+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(erq->length)) {
-+                return -EIO;
-+            }
-+
-+            A_MEMZERO(ar->arWepKeyList[index].arKey,
-+                      sizeof(ar->arWepKeyList[index].arKey));
-+            A_MEMCPY(ar->arWepKeyList[index].arKey, keybuf, erq->length);
-+            ar->arWepKeyList[index].arKeyLen = erq->length;
-+        } else {
-+            if (ar->arWepKeyList[index].arKeyLen == 0) {
-+                return -EIO;
-+            }
-+            ar->arDefTxKeyIndex = index;
-+        }
-+
-+        ar->arPairwiseCrypto      = WEP_CRYPT;
-+        ar->arGroupCrypto         = WEP_CRYPT;
-+        ar->arDot11AuthMode       = auth;
-+        ar->arAuthMode            = NONE_AUTH;
-+    }
-+
-+    /*
-+     * profile has changed.  Erase ssid to signal change
-+     */
-+    A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+    ar->arSsidLen = 0;
-+
-+    return 0;
-+}
-+
-+static int
-+ar6000_ioctl_giwencode(struct net_device *dev,
-+              struct iw_request_info *info,
-+              struct iw_point *erq, char *key)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    A_UINT8 keyIndex;
-+    struct ar_wep_key *wk;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arPairwiseCrypto == NONE_CRYPT) {
-+        erq->length = 0;
-+        erq->flags = IW_ENCODE_DISABLED;
-+    } else {
-+        /* get the keyIndex */
-+        keyIndex = erq->flags & IW_ENCODE_INDEX;
-+        if (0 == keyIndex) {
-+            keyIndex = ar->arDefTxKeyIndex;
-+        } else if ((keyIndex - 1 < WMI_MIN_KEY_INDEX) ||
-+                   (keyIndex - 1 > WMI_MAX_KEY_INDEX))
-+        {
-+            keyIndex = WMI_MIN_KEY_INDEX;
-+        } else {
-+            keyIndex--;
-+        }
-+        erq->flags = keyIndex + 1;
-+        erq->flags |= IW_ENCODE_ENABLED;
-+        wk = &ar->arWepKeyList[keyIndex];
-+        if (erq->length > wk->arKeyLen) {
-+            erq->length = wk->arKeyLen;
-+        }
-+        if (wk->arKeyLen) {
-+            A_MEMCPY(key, wk->arKey, erq->length);
-+        }
-+        if (ar->arDot11AuthMode == OPEN_AUTH) {
-+            erq->flags |= IW_ENCODE_OPEN;
-+        } else if (ar->arDot11AuthMode == SHARED_AUTH) {
-+            erq->flags |= IW_ENCODE_RESTRICTED;
-+        }
-+    }
-+
-+    return 0;
-+}
-+
-+static int ar6000_ioctl_siwpower(struct net_device *dev,
-+				 struct iw_request_info *info,
-+				 union iwreq_data *wrqu, char *extra)
-+{
-+	AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+	WMI_POWER_MODE power_mode;
-+
-+	if (wrqu->power.disabled)
-+		power_mode = MAX_PERF_POWER;
-+	else
-+		power_mode = REC_POWER;
-+
-+	if (wmi_powermode_cmd(ar->arWmi, power_mode) < 0)
-+		return -EIO;
-+
-+	return 0;
-+}
-+
-+static int ar6000_ioctl_giwpower(struct net_device *dev,
-+				 struct iw_request_info *info,
-+				 union iwreq_data *wrqu, char *extra)
-+{
-+	AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+	/*
-+	 * FIXME:
-+	 * https://docs.openmoko.org/trac/ticket/2267
-+	 * When starting wpa_supplicant the kernel oopses.
-+	 * The following condition avoids the oops.
-+	 * Remove this comment to bless this solution.
-+	 */
-+	if (ar->arWlanState == WLAN_DISABLED || ar->arWmiReady == FALSE)
-+		return -EIO;
-+
-+	return wmi_get_power_mode_cmd(ar->arWmi);
-+}
-+
-+static int ar6000_ioctl_siwgenie(struct net_device *dev,
-+				 struct iw_request_info *info,
-+				 struct iw_point *dwrq,
-+				 char *extra)
-+{
-+	/* The target does that for us */
-+	return 0;
-+}
-+
-+static int ar6000_ioctl_giwgenie(struct net_device *dev,
-+				 struct iw_request_info *info,
-+				 struct iw_point *dwrq,
-+				 char *extra)
-+{
-+	return 0;
-+}
-+
-+static int ar6000_ioctl_siwauth(struct net_device *dev,
-+				struct iw_request_info *info,
-+				struct iw_param *param,
-+				char *extra)
-+{
-+	AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+	int reset = 0;
-+
-+	switch (param->flags & IW_AUTH_INDEX) {
-+	case IW_AUTH_WPA_VERSION:
-+		if (param->value & IW_AUTH_WPA_VERSION_DISABLED) {
-+			ar->arAuthMode = NONE_AUTH;
-+		}
-+		if (param->value & IW_AUTH_WPA_VERSION_WPA) {
-+			ar->arAuthMode = WPA_AUTH;
-+		}
-+		if (param->value & IW_AUTH_WPA_VERSION_WPA2) {
-+			ar->arAuthMode = WPA2_AUTH;
-+		}
-+
-+		reset = 1;
-+		break;
-+	case IW_AUTH_CIPHER_PAIRWISE:
-+		if (param->value & IW_AUTH_CIPHER_NONE) {
-+			ar->arPairwiseCrypto = NONE_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_WEP40) {
-+			ar->arPairwiseCrypto = WEP_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_TKIP) {
-+			ar->arPairwiseCrypto = TKIP_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_CCMP) {
-+			ar->arPairwiseCrypto = AES_CRYPT;
-+		}
-+
-+		reset = 1;
-+		break;
-+	case IW_AUTH_CIPHER_GROUP:
-+		if (param->value & IW_AUTH_CIPHER_NONE) {
-+			ar->arGroupCrypto = NONE_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_WEP40) {
-+			ar->arGroupCrypto = WEP_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_TKIP) {
-+			ar->arGroupCrypto = TKIP_CRYPT;
-+		}
-+		if (param->value & IW_AUTH_CIPHER_CCMP) {
-+			ar->arGroupCrypto = AES_CRYPT;
-+		}
-+
-+		reset = 1;
-+		break;
-+	case IW_AUTH_KEY_MGMT:
-+		if (param->value & IW_AUTH_KEY_MGMT_PSK) {
-+			if (ar->arAuthMode == WPA_AUTH) {
-+				ar->arAuthMode = WPA_PSK_AUTH;
-+			} else if (ar->arAuthMode == WPA2_AUTH) {
-+				ar->arAuthMode = WPA2_PSK_AUTH;
-+			}
-+
-+			reset = 1;
-+		}
-+		break;
-+
-+	case IW_AUTH_TKIP_COUNTERMEASURES:
-+		if (ar->arWmiReady == FALSE) {
-+			return -EIO;
-+		}
-+		wmi_set_tkip_countermeasures_cmd(ar->arWmi, param->value);
-+		break;
-+
-+	case IW_AUTH_DROP_UNENCRYPTED:
-+		break;
-+
-+	case IW_AUTH_80211_AUTH_ALG:
-+		if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
-+			ar->arDot11AuthMode  = OPEN_AUTH;
-+		}
-+		if (param->value & IW_AUTH_ALG_SHARED_KEY) {
-+			ar->arDot11AuthMode  = SHARED_AUTH;
-+		}
-+		if (param->value & IW_AUTH_ALG_LEAP) {
-+			ar->arDot11AuthMode   = LEAP_AUTH;
-+			ar->arPairwiseCrypto  = WEP_CRYPT;
-+			ar->arGroupCrypto     = WEP_CRYPT;
-+		}
-+
-+		reset = 1;
-+		break;
-+
-+	case IW_AUTH_WPA_ENABLED:
-+		reset = 1;
-+		break;
-+
-+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-+		break;
-+
-+	case IW_AUTH_PRIVACY_INVOKED:
-+		break;
-+
-+	default:
-+		printk("%s(): Unknown flag 0x%x\n", __FUNCTION__, param->flags);
-+		return -EOPNOTSUPP;
-+	}
-+
-+	if (reset) {
-+		A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+		ar->arSsidLen = 0;
-+	}
-+
-+	return 0;
-+}
-+
-+static int ar6000_ioctl_giwauth(struct net_device *dev,
-+				struct iw_request_info *info,
-+				struct iw_param *dwrq,
-+				char *extra)
-+{
-+	return 0;
-+}
-+
-+static int ar6000_ioctl_siwencodeext(struct net_device *dev,
-+				     struct iw_request_info *info,
-+				     union iwreq_data *wrqu,
-+				     char *extra)
-+{
-+	AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+	struct iw_point *encoding = &wrqu->encoding;
-+	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-+	int alg = ext->alg, idx;
-+
-+	if (ar->arWlanState == WLAN_DISABLED) {
-+		return -EIO;
-+	}
-+
-+	/* Determine and validate the key index */
-+	idx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-+	if (idx) {
-+		if (idx < 0 || idx > 3)
-+			return -EINVAL;
-+	}
-+
-+	if ((alg == IW_ENCODE_ALG_TKIP) || (alg == IW_ENCODE_ALG_CCMP)) {
-+		struct ieee80211req_key ik;
-+		KEY_USAGE key_usage;
-+		CRYPTO_TYPE key_type = NONE_CRYPT;
-+		int status;
-+
-+		ar->user_saved_keys.keyOk = FALSE;
-+
-+		if (alg == IW_ENCODE_ALG_TKIP) {
-+			key_type = TKIP_CRYPT;
-+			ik.ik_type = IEEE80211_CIPHER_TKIP;
-+		} else {
-+			key_type = AES_CRYPT;
-+			ik.ik_type = IEEE80211_CIPHER_AES_CCM;
-+		}
-+
-+		ik.ik_keyix = idx;
-+		ik.ik_keylen = ext->key_len;
-+		ik.ik_flags = IEEE80211_KEY_RECV;
-+		if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
-+			ik.ik_flags |= IEEE80211_KEY_XMIT
-+				| IEEE80211_KEY_DEFAULT;
-+		}
-+
-+		if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-+			memcpy(&ik.ik_keyrsc, ext->rx_seq, 8);
-+		}
-+
-+		memcpy(ik.ik_keydata, ext->key, ext->key_len);
-+
-+		ar->user_saved_keys.keyType = key_type;
-+		if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-+			key_usage = GROUP_USAGE;
-+			memset(ik.ik_macaddr, 0, ETH_ALEN);
-+			memcpy(&ar->user_saved_keys.bcast_ik, &ik,
-+			       sizeof(struct ieee80211req_key));
-+		} else {
-+			key_usage = PAIRWISE_USAGE;
-+			memcpy(ik.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
-+			memcpy(&ar->user_saved_keys.ucast_ik, &ik,
-+			       sizeof(struct ieee80211req_key));
-+		}
-+
-+		status = wmi_addKey_cmd(ar->arWmi, ik.ik_keyix, key_type,
-+					key_usage, ik.ik_keylen,
-+					(A_UINT8 *)&ik.ik_keyrsc,
-+					ik.ik_keydata,
-+					KEY_OP_INIT_VAL, SYNC_BEFORE_WMIFLAG);
-+
-+		if (status < 0)
-+			return -EIO;
-+
-+		ar->user_saved_keys.keyOk = TRUE;
-+
-+		return 0;
-+
-+	} else {
-+		/* WEP falls back to SIWENCODE */
-+		return -EOPNOTSUPP;
-+	}
-+
-+	return 0;
-+}
-+
-+
-+static int ar6000_ioctl_giwencodeext(struct net_device *dev,
-+				     struct iw_request_info *info,
-+				     struct iw_point *dwrq,
-+				     char *extra)
-+{
-+	return 0;
-+}
-+
-+
-+static int
-+ar6000_ioctl_setparam(struct net_device *dev,
-+                      struct iw_request_info *info,
-+                      void *erq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    int *i = (int *)extra;
-+    int param = i[0];
-+    int value = i[1];
-+    int ret = 0;
-+    A_BOOL profChanged = FALSE;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    switch (param) {
-+        case IEEE80211_PARAM_WPA:
-+            switch (value) {
-+                case WPA_MODE_WPA1:
-+                    ar->arAuthMode = WPA_AUTH;
-+                    profChanged    = TRUE;
-+                    break;
-+                case WPA_MODE_WPA2:
-+                    ar->arAuthMode = WPA2_AUTH;
-+                    profChanged    = TRUE;
-+                    break;
-+                case WPA_MODE_NONE:
-+                    ar->arAuthMode = NONE_AUTH;
-+                    profChanged    = TRUE;
-+                    break;
-+	    default:
-+		    printk("IEEE80211_PARAM_WPA: Unknown value %d\n", value);
-+            }
-+            break;
-+        case IEEE80211_PARAM_AUTHMODE:
-+            switch(value) {
-+                case IEEE80211_AUTH_WPA_PSK:
-+                    if (WPA_AUTH == ar->arAuthMode) {
-+                        ar->arAuthMode = WPA_PSK_AUTH;
-+                        profChanged    = TRUE;
-+                    } else if (WPA2_AUTH == ar->arAuthMode) {
-+                        ar->arAuthMode = WPA2_PSK_AUTH;
-+                        profChanged    = TRUE;
-+                    } else {
-+                        AR_DEBUG_PRINTF("Error -  Setting PSK mode when WPA "\
-+                                        "param was set to %d\n",
-+                                        ar->arAuthMode);
-+                        ret = -1;
-+                    }
-+                    break;
-+                case IEEE80211_AUTH_WPA_CCKM:
-+                    if (WPA2_AUTH == ar->arAuthMode) {
-+                        ar->arAuthMode = WPA2_AUTH_CCKM;
-+                    } else {
-+                        ar->arAuthMode = WPA_AUTH_CCKM;
-+                    }
-+                    break;
-+                default:
-+                    break;
-+            }
-+            break;
-+        case IEEE80211_PARAM_UCASTCIPHER:
-+            switch (value) {
-+                case IEEE80211_CIPHER_AES_CCM:
-+                    ar->arPairwiseCrypto = AES_CRYPT;
-+                    profChanged          = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_TKIP:
-+                    ar->arPairwiseCrypto = TKIP_CRYPT;
-+                    profChanged          = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_WEP:
-+                    ar->arPairwiseCrypto = WEP_CRYPT;
-+                    profChanged          = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_NONE:
-+                    ar->arPairwiseCrypto = NONE_CRYPT;
-+                    profChanged          = TRUE;
-+                    break;
-+            }
-+            break;
-+        case IEEE80211_PARAM_UCASTKEYLEN:
-+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
-+                ret = -EIO;
-+            } else {
-+                ar->arPairwiseCryptoLen = value;
-+            }
-+            break;
-+        case IEEE80211_PARAM_MCASTCIPHER:
-+            switch (value) {
-+                case IEEE80211_CIPHER_AES_CCM:
-+                    ar->arGroupCrypto = AES_CRYPT;
-+                    profChanged       = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_TKIP:
-+                    ar->arGroupCrypto = TKIP_CRYPT;
-+                    profChanged       = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_WEP:
-+                    ar->arGroupCrypto = WEP_CRYPT;
-+                    profChanged       = TRUE;
-+                    break;
-+                case IEEE80211_CIPHER_NONE:
-+                    ar->arGroupCrypto = NONE_CRYPT;
-+                    profChanged       = TRUE;
-+                    break;
-+            }
-+            break;
-+        case IEEE80211_PARAM_MCASTKEYLEN:
-+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
-+                ret = -EIO;
-+            } else {
-+                ar->arGroupCryptoLen = value;
-+            }
-+            break;
-+        case IEEE80211_PARAM_COUNTERMEASURES:
-+            if (ar->arWmiReady == FALSE) {
-+                return -EIO;
-+            }
-+            wmi_set_tkip_countermeasures_cmd(ar->arWmi, value);
-+            break;
-+        default:
-+            break;
-+    }
-+
-+    if (profChanged == TRUE) {
-+        /*
-+         * profile has changed.  Erase ssid to signal change
-+         */
-+	A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+	ar->arSsidLen = 0;
-+    }
-+
-+    return ret;
-+}
-+
-+int
-+ar6000_ioctl_getparam(struct net_device *dev, struct iw_request_info *info,
-+            void *w, char *extra)
-+{
-+    return -EIO;            /* for now */
-+}
-+
-+int
-+ar6000_ioctl_setkey(struct net_device *dev, struct iw_request_info *info,
-+		    void *w, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct ieee80211req_key *ik = (struct ieee80211req_key *)extra;
-+    KEY_USAGE keyUsage;
-+    A_STATUS status;
-+    CRYPTO_TYPE keyType = NONE_CRYPT;
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    ar->user_saved_keys.keyOk = FALSE;
-+
-+    if ( 0 == memcmp(ik->ik_macaddr, "\x00\x00\x00\x00\x00\x00",
-+                     IEEE80211_ADDR_LEN)) {
-+        keyUsage = GROUP_USAGE;
-+        A_MEMCPY(&ar->user_saved_keys.bcast_ik, ik,
-+                 sizeof(struct ieee80211req_key));
-+    } else {
-+        keyUsage = PAIRWISE_USAGE;
-+        A_MEMCPY(&ar->user_saved_keys.ucast_ik, ik,
-+                 sizeof(struct ieee80211req_key));
-+    }
-+
-+    switch (ik->ik_type) {
-+        case IEEE80211_CIPHER_WEP:
-+            keyType = WEP_CRYPT;
-+            break;
-+        case IEEE80211_CIPHER_TKIP:
-+            keyType = TKIP_CRYPT;
-+            break;
-+        case IEEE80211_CIPHER_AES_CCM:
-+            keyType = AES_CRYPT;
-+            break;
-+        default:
-+            break;
-+    }
-+    ar->user_saved_keys.keyType = keyType;
-+
-+    if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
-+        if (NONE_CRYPT == keyType) {
-+            return -EIO;
-+        }
-+
-+        status = wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, keyType, keyUsage,
-+                                ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
-+                                ik->ik_keydata, KEY_OP_INIT_VAL,
-+                                SYNC_BEFORE_WMIFLAG);
-+
-+        if (status != A_OK) {
-+            return -EIO;
-+        }
-+    } else {
-+        status = wmi_add_krk_cmd(ar->arWmi, ik->ik_keydata);
-+    }
-+
-+    ar->user_saved_keys.keyOk = TRUE;
-+
-+    return 0;
-+}
-+
-+
-+/*
-+ * SIOCGIWNAME
-+ */
-+int
-+ar6000_ioctl_giwname(struct net_device *dev,
-+           struct iw_request_info *info,
-+           char *name, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    switch (ar->arPhyCapability) {
-+    case (WMI_11A_CAPABILITY):
-+        strncpy(name, "AR6000 802.11a", IFNAMSIZ);
-+        break;
-+    case (WMI_11G_CAPABILITY):
-+        strncpy(name, "AR6000 802.11g", IFNAMSIZ);
-+        break;
-+    case (WMI_11AG_CAPABILITY):
-+        strncpy(name, "AR6000 802.11ag", IFNAMSIZ);
-+        break;
-+    default:
-+        strncpy(name, "AR6000 802.11", IFNAMSIZ);
-+        break;
-+    }
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCSIWFREQ
-+ */
-+int
-+ar6000_ioctl_siwfreq(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_freq *freq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    /*
-+     * We support limiting the channels via wmiconfig.
-+     *
-+     * We use this command to configure the channel hint for the connect cmd
-+     * so it is possible the target will end up connecting to a different
-+     * channel.
-+     */
-+    if (freq->e > 1) {
-+        return -EINVAL;
-+    } else if (freq->e == 1) {
-+        ar->arChannelHint = freq->m / 100000;
-+    } else {
-+        ar->arChannelHint = wlan_ieee2freq(freq->m);
-+    }
-+
-+    A_PRINTF("channel hint set to %d\n", ar->arChannelHint);
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWFREQ
-+ */
-+int
-+ar6000_ioctl_giwfreq(struct net_device *dev,
-+                struct iw_request_info *info,
-+                struct iw_freq *freq, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arConnected != TRUE) {
-+        return -EINVAL;
-+    }
-+
-+    freq->m = ar->arBssChannel * 100000;
-+    freq->e = 1;
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCSIWMODE
-+ */
-+int
-+ar6000_ioctl_siwmode(struct net_device *dev,
-+            struct iw_request_info *info,
-+            __u32 *mode, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    switch (*mode) {
-+    case IW_MODE_INFRA:
-+        ar->arNetworkType = INFRA_NETWORK;
-+        break;
-+    case IW_MODE_ADHOC:
-+        ar->arNetworkType = ADHOC_NETWORK;
-+        break;
-+    default:
-+        return -EINVAL;
-+    }
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWMODE
-+ */
-+int
-+ar6000_ioctl_giwmode(struct net_device *dev,
-+            struct iw_request_info *info,
-+            __u32 *mode, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    switch (ar->arNetworkType) {
-+    case INFRA_NETWORK:
-+        *mode = IW_MODE_INFRA;
-+        break;
-+    case ADHOC_NETWORK:
-+        *mode = IW_MODE_ADHOC;
-+        break;
-+    default:
-+        return -EIO;
-+    }
-+    return 0;
-+}
-+
-+/*
-+ * SIOCSIWSENS
-+ */
-+int
-+ar6000_ioctl_siwsens(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_param *sens, char *extra)
-+{
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWSENS
-+ */
-+int
-+ar6000_ioctl_giwsens(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_param *sens, char *extra)
-+{
-+    sens->value = 0;
-+    sens->fixed = 1;
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWRANGE
-+ */
-+int
-+ar6000_ioctl_giwrange(struct net_device *dev,
-+             struct iw_request_info *info,
-+             struct iw_point *data, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    struct iw_range *range = (struct iw_range *) extra;
-+    int i, ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (down_interruptible(&ar->arSem)) {
-+        return -ERESTARTSYS;
-+    }
-+    ar->arNumChannels = -1;
-+    A_MEMZERO(ar->arChannelList, sizeof (ar->arChannelList));
-+
-+    if (wmi_get_channelList_cmd(ar->arWmi) != A_OK) {
-+        up(&ar->arSem);
-+        return -EIO;
-+    }
-+
-+    wait_event_interruptible_timeout(arEvent, ar->arNumChannels != -1, wmitimeout * HZ);
-+
-+    if (signal_pending(current)) {
-+        up(&ar->arSem);
-+        return -EINTR;
-+    }
-+
-+    data->length = sizeof(struct iw_range);
-+    A_MEMZERO(range, sizeof(struct iw_range));
-+
-+    range->txpower_capa = IW_TXPOW_DBM;
-+
-+    range->min_pmp = 1 * 1024;
-+    range->max_pmp = 65535 * 1024;
-+    range->min_pmt = 1 * 1024;
-+    range->max_pmt = 1000 * 1024;
-+    range->pmp_flags = IW_POWER_PERIOD;
-+    range->pmt_flags = IW_POWER_TIMEOUT;
-+    range->pm_capa = 0;
-+
-+    range->we_version_compiled = WIRELESS_EXT;
-+    range->we_version_source = 13;
-+
-+    range->retry_capa = IW_RETRY_LIMIT;
-+    range->retry_flags = IW_RETRY_LIMIT;
-+    range->min_retry = 0;
-+    range->max_retry = 255;
-+
-+    range->num_frequency = range->num_channels = ar->arNumChannels;
-+    for (i = 0; i < ar->arNumChannels; i++) {
-+        range->freq[i].i = wlan_freq2ieee(ar->arChannelList[i]);
-+        range->freq[i].m = ar->arChannelList[i] * 100000;
-+        range->freq[i].e = 1;
-+         /*
-+         * Linux supports max of 32 channels, bail out once you
-+         * reach the max.
-+         */
-+        if (i == IW_MAX_FREQUENCIES) {
-+            break;
-+        }
-+    }
-+
-+    /* Max quality is max field value minus noise floor */
-+    range->max_qual.qual  = 0xff - 161;
-+
-+    /*
-+     * In order to use dBm measurements, 'level' must be lower
-+     * than any possible measurement (see iw_print_stats() in
-+     * wireless tools).  It's unclear how this is meant to be
-+     * done, but setting zero in these values forces dBm and
-+     * the actual numbers are not used.
-+     */
-+    range->max_qual.level = 0;
-+    range->max_qual.noise = 0;
-+
-+    range->sensitivity = 3;
-+
-+    range->max_encoding_tokens = 4;
-+    /* XXX query driver to find out supported key sizes */
-+    range->num_encoding_sizes = 3;
-+    range->encoding_size[0] = 5;        /* 40-bit */
-+    range->encoding_size[1] = 13;       /* 104-bit */
-+    range->encoding_size[2] = 16;       /* 128-bit */
-+
-+    range->num_bitrates = 0;
-+
-+    /* estimated maximum TCP throughput values (bps) */
-+    range->throughput = 22000000;
-+
-+    range->min_rts = 0;
-+    range->max_rts = 2347;
-+    range->min_frag = 256;
-+    range->max_frag = 2346;
-+
-+    up(&ar->arSem);
-+
-+    return ret;
-+}
-+
-+
-+/*
-+ * SIOCSIWAP
-+ * This ioctl is used to set the desired bssid for the connect command.
-+ */
-+int
-+ar6000_ioctl_siwap(struct net_device *dev,
-+              struct iw_request_info *info,
-+              struct sockaddr *ap_addr, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ap_addr->sa_family != ARPHRD_ETHER) {
-+        return -EIO;
-+    }
-+
-+    if (A_MEMCMP(&ap_addr->sa_data, bcast_mac, AR6000_ETH_ADDR_LEN) == 0) {
-+        A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+    } else {
-+        A_MEMCPY(ar->arReqBssid, &ap_addr->sa_data,  sizeof(ar->arReqBssid));
-+    }
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWAP
-+ */
-+int
-+ar6000_ioctl_giwap(struct net_device *dev,
-+              struct iw_request_info *info,
-+              struct sockaddr *ap_addr, char *extra)
-+{
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arConnected != TRUE) {
-+        return -EINVAL;
-+    }
-+
-+    A_MEMCPY(&ap_addr->sa_data, ar->arBssid, sizeof(ar->arBssid));
-+    ap_addr->sa_family = ARPHRD_ETHER;
-+
-+    return 0;
-+}
-+
-+/*
-+ * SIOCGIWAPLIST
-+ */
-+int
-+ar6000_ioctl_iwaplist(struct net_device *dev,
-+            struct iw_request_info *info,
-+            struct iw_point *data, char *extra)
-+{
-+    return -EIO;            /* for now */
-+}
-+
-+/*
-+ * SIOCSIWSCAN
-+ */
-+int
-+ar6000_ioctl_siwscan(struct net_device *dev,
-+                     struct iw_request_info *info,
-+                     struct iw_point *data, char *extra)
-+{
-+#define ACT_DWELLTIME_DEFAULT   105
-+#define HOME_TXDRAIN_TIME       100
-+#define SCAN_INT                HOME_TXDRAIN_TIME + ACT_DWELLTIME_DEFAULT
-+    AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+    int ret = 0;
-+
-+    if (ar->arWmiReady == FALSE) {
-+        return -EIO;
-+    }
-+
-+    if (ar->arWlanState == WLAN_DISABLED) {
-+        return -EIO;
-+    }
-+
-+    /* We ask for everything from the target */
-+    if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
-+	    printk("Couldn't set filtering\n");
-+	    ret = -EIO;
-+    }
-+
-+    if (wmi_startscan_cmd(ar->arWmi, WMI_LONG_SCAN, FALSE, FALSE, \
-+                          HOME_TXDRAIN_TIME, SCAN_INT) != A_OK) {
-+        ret = -EIO;
-+    }
-+
-+    ar->scan_complete = 0;
-+    wait_event_interruptible_timeout(ar6000_scan_queue, ar->scan_complete,
-+				     5 * HZ);
-+
-+    if (wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0) != A_OK) {
-+	    printk("Couldn't set filtering\n");
-+	    ret = -EIO;
-+    }
-+
-+    return ret;
-+#undef  ACT_DWELLTIME_DEFAULT
-+#undef HOME_TXDRAIN_TIME
-+#undef SCAN_INT
-+}
-+
-+
-+/*
-+ * Units are in db above the noise floor. That means the
-+ * rssi values reported in the tx/rx descriptors in the
-+ * driver are the SNR expressed in db.
-+ *
-+ * If you assume that the noise floor is -95, which is an
-+ * excellent assumption 99.5 % of the time, then you can
-+ * derive the absolute signal level (i.e. -95 + rssi).
-+ * There are some other slight factors to take into account
-+ * depending on whether the rssi measurement is from 11b,
-+ * 11g, or 11a.   These differences are at most 2db and
-+ * can be documented.
-+ *
-+ * NB: various calculations are based on the orinoco/wavelan
-+ *     drivers for compatibility
-+ */
-+static void
-+ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi)
-+{
-+    if (rssi < 0) {
-+        iq->qual = 0;
-+    } else {
-+        iq->qual = rssi;
-+    }
-+
-+    /* NB: max is 94 because noise is hardcoded to 161 */
-+    if (iq->qual > 94)
-+        iq->qual = 94;
-+
-+    iq->noise = 161;        /* -95dBm */
-+    iq->level = iq->noise + iq->qual;
-+    iq->updated = 7;
-+}
-+
-+
-+/* Structures to export the Wireless Handlers */
-+static const iw_handler ath_handlers[] = {
-+    (iw_handler) NULL,                          /* SIOCSIWCOMMIT */
-+    (iw_handler) ar6000_ioctl_giwname,          /* SIOCGIWNAME */
-+    (iw_handler) NULL,                          /* SIOCSIWNWID */
-+    (iw_handler) NULL,                          /* SIOCGIWNWID */
-+    (iw_handler) ar6000_ioctl_siwfreq,          /* SIOCSIWFREQ */
-+    (iw_handler) ar6000_ioctl_giwfreq,          /* SIOCGIWFREQ */
-+    (iw_handler) ar6000_ioctl_siwmode,          /* SIOCSIWMODE */
-+    (iw_handler) ar6000_ioctl_giwmode,          /* SIOCGIWMODE */
-+    (iw_handler) ar6000_ioctl_siwsens,          /* SIOCSIWSENS */
-+    (iw_handler) ar6000_ioctl_giwsens,          /* SIOCGIWSENS */
-+    (iw_handler) NULL /* not _used */,          /* SIOCSIWRANGE */
-+    (iw_handler) ar6000_ioctl_giwrange,         /* SIOCGIWRANGE */
-+    (iw_handler) NULL /* not used */,           /* SIOCSIWPRIV */
-+    (iw_handler) NULL /* kernel code */,        /* SIOCGIWPRIV */
-+    (iw_handler) NULL /* not used */,           /* SIOCSIWSTATS */
-+    (iw_handler) NULL /* kernel code */,        /* SIOCGIWSTATS */
-+    (iw_handler) NULL,                          /* SIOCSIWSPY */
-+    (iw_handler) NULL,                          /* SIOCGIWSPY */
-+    (iw_handler) NULL,                          /* SIOCSIWTHRSPY */
-+    (iw_handler) NULL,                          /* SIOCGIWTHRSPY */
-+    (iw_handler) ar6000_ioctl_siwap,            /* SIOCSIWAP */
-+    (iw_handler) ar6000_ioctl_giwap,            /* SIOCGIWAP */
-+    (iw_handler) NULL,                          /* -- hole -- */
-+    (iw_handler) ar6000_ioctl_iwaplist,         /* SIOCGIWAPLIST */
-+    (iw_handler) ar6000_ioctl_siwscan,          /* SIOCSIWSCAN */
-+    (iw_handler) ar6000_ioctl_giwscan,          /* SIOCGIWSCAN */
-+    (iw_handler) ar6000_ioctl_siwessid,         /* SIOCSIWESSID */
-+    (iw_handler) ar6000_ioctl_giwessid,         /* SIOCGIWESSID */
-+    (iw_handler) NULL,                          /* SIOCSIWNICKN */
-+    (iw_handler) NULL,                          /* SIOCGIWNICKN */
-+    (iw_handler) NULL,                          /* -- hole -- */
-+    (iw_handler) NULL,                          /* -- hole -- */
-+    (iw_handler) ar6000_ioctl_siwrate,          /* SIOCSIWRATE */
-+    (iw_handler) ar6000_ioctl_giwrate,          /* SIOCGIWRATE */
-+    (iw_handler) NULL,           /* SIOCSIWRTS */
-+    (iw_handler) NULL,           /* SIOCGIWRTS */
-+    (iw_handler) NULL,          /* SIOCSIWFRAG */
-+    (iw_handler) NULL,          /* SIOCGIWFRAG */
-+    (iw_handler) ar6000_ioctl_siwtxpow,         /* SIOCSIWTXPOW */
-+    (iw_handler) ar6000_ioctl_giwtxpow,         /* SIOCGIWTXPOW */
-+    (iw_handler) ar6000_ioctl_siwretry,         /* SIOCSIWRETRY */
-+    (iw_handler) ar6000_ioctl_giwretry,         /* SIOCGIWRETRY */
-+    (iw_handler) ar6000_ioctl_siwencode,        /* SIOCSIWENCODE */
-+    (iw_handler) ar6000_ioctl_giwencode,        /* SIOCGIWENCODE */
-+    (iw_handler) ar6000_ioctl_siwpower,         /* SIOCSIWPOWER */
-+    (iw_handler) ar6000_ioctl_giwpower,         /* SIOCGIWPOWER */
-+    (iw_handler) NULL,	/* -- hole -- */
-+    (iw_handler) NULL,	/* -- hole -- */
-+    (iw_handler) ar6000_ioctl_siwgenie,	/* SIOCSIWGENIE */
-+    (iw_handler) ar6000_ioctl_giwgenie,	/* SIOCGIWGENIE */
-+    (iw_handler) ar6000_ioctl_siwauth,	/* SIOCSIWAUTH */
-+    (iw_handler) ar6000_ioctl_giwauth,	/* SIOCGIWAUTH */
-+    (iw_handler) ar6000_ioctl_siwencodeext,/* SIOCSIWENCODEEXT */
-+    (iw_handler) ar6000_ioctl_giwencodeext,/* SIOCGIWENCODEEXT */
-+    (iw_handler) NULL,		/* SIOCSIWPMKSA */
-+};
-+
-+static const iw_handler ath_priv_handlers[] = {
-+    (iw_handler) ar6000_ioctl_setparam,         /* SIOCWFIRSTPRIV+0 */
-+    (iw_handler) ar6000_ioctl_getparam,         /* SIOCWFIRSTPRIV+1 */
-+    (iw_handler) ar6000_ioctl_setkey,           /* SIOCWFIRSTPRIV+2 */
-+    (iw_handler) ar6000_ioctl_setwmmparams,     /* SIOCWFIRSTPRIV+3 */
-+    (iw_handler) ar6000_ioctl_delkey,           /* SIOCWFIRSTPRIV+4 */
-+    (iw_handler) ar6000_ioctl_getwmmparams,     /* SIOCWFIRSTPRIV+5 */
-+    (iw_handler) ar6000_ioctl_setoptie,         /* SIOCWFIRSTPRIV+6 */
-+    (iw_handler) ar6000_ioctl_setmlme,          /* SIOCWFIRSTPRIV+7 */
-+    (iw_handler) ar6000_ioctl_addpmkid,         /* SIOCWFIRSTPRIV+8 */
-+};
-+
-+#define IW_PRIV_TYPE_KEY \
-+    (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_key))
-+#define IW_PRIV_TYPE_DELKEY \
-+    (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_del_key))
-+#define IW_PRIV_TYPE_MLME \
-+    (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_mlme))
-+#define IW_PRIV_TYPE_ADDPMKID \
-+    (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_addpmkid))
-+
-+static const struct iw_priv_args ar6000_priv_args[] = {
-+    { IEEE80211_IOCTL_SETKEY,
-+      IW_PRIV_TYPE_KEY | IW_PRIV_SIZE_FIXED, 0,       "setkey"},
-+    { IEEE80211_IOCTL_DELKEY,
-+      IW_PRIV_TYPE_DELKEY | IW_PRIV_SIZE_FIXED, 0,    "delkey"},
-+    { IEEE80211_IOCTL_SETPARAM,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0,   "setparam"},
-+    { IEEE80211_IOCTL_GETPARAM,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,      "getparam"},
-+    { IEEE80211_IOCTL_SETWMMPARAMS,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, 0,   "setwmmparams"},
-+    { IEEE80211_IOCTL_GETWMMPARAMS,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3,
-+      IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,      "getwmmparams"},
-+    { IEEE80211_IOCTL_SETOPTIE,
-+      IW_PRIV_TYPE_BYTE, 0,       "setie"},
-+    { IEEE80211_IOCTL_SETMLME,
-+      IW_PRIV_TYPE_MLME, 0,       "setmlme"},
-+    { IEEE80211_IOCTL_ADDPMKID,
-+      IW_PRIV_TYPE_ADDPMKID | IW_PRIV_SIZE_FIXED, 0,  "addpmkid"},
-+};
-+
-+void ar6000_ioctl_iwsetup(struct iw_handler_def *def)
-+{
-+    def->private_args = (struct iw_priv_args *)ar6000_priv_args;
-+    def->num_private_args = ARRAY_SIZE(ar6000_priv_args);
-+}
-+
-+struct iw_handler_def ath_iw_handler_def = {
-+    .standard         = (iw_handler *)ath_handlers,
-+    .num_standard     = ARRAY_SIZE(ath_handlers),
-+    .private          = (iw_handler *)ath_priv_handlers,
-+    .num_private      = ARRAY_SIZE(ath_priv_handlers),
-+};
-+
-+
-diff --git a/drivers/ar6000/bmi/bmi.c b/drivers/ar6000/bmi/bmi.c
-new file mode 100644
-index 0000000..d7b610c
---- /dev/null
-+++ b/drivers/ar6000/bmi/bmi.c
-@@ -0,0 +1,657 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "hif.h"
-+#include "bmi.h"
-+#include "htc_api.h"
-+#include "bmi_internal.h"
-+
-+/*
-+Although we had envisioned BMI to run on top of HTC, this is not what the
-+final implementation boiled down to on dragon. Its a part of BSP and does
-+not use the HTC protocol either. On the host side, however, we were still
-+living with the original idea. I think the time has come to accept the truth
-+and separate it from HTC which has been carrying BMI's burden all this while.
-+It shall make HTC state machine relatively simpler
-+*/
-+
-+/* APIs visible to the driver */
-+void
-+BMIInit(void)
-+{
-+    bmiDone = FALSE;
-+}
-+
-+A_STATUS
-+BMIDone(HIF_DEVICE *device)
-+{
-+    A_STATUS status;
-+    A_UINT32 cid;
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF (ATH_DEBUG_BMI, ("BMIDone skipped\n"));
-+        return A_OK;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%p)\n", device));
-+    bmiDone = TRUE;
-+    cid = BMI_DONE;
-+
-+    status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Exit\n"));
-+
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info)
-+{
-+    A_STATUS status;
-+    A_UINT32 cid;
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%p)\n", device));
-+    cid = BMI_GET_TARGET_INFO;
-+
-+    status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_ver,
-+                                                sizeof(targ_info->target_ver));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Version from the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    if (targ_info->target_ver == TARGET_VERSION_SENTINAL) {
-+        /* Determine how many bytes are in the Target's targ_info */
-+        status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_info_byte_count,
-+                                            sizeof(targ_info->target_info_byte_count));
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info Byte Count from the device\n"));
-+            return A_ERROR;
-+        }
-+
-+        /*
-+         * The Target's targ_info doesn't match the Host's targ_info.
-+         * We need to do some backwards compatibility work to make this OK.
-+         */
-+        A_ASSERT(targ_info->target_info_byte_count == sizeof(*targ_info));
-+
-+        /* Read the remainder of the targ_info */
-+        status = bmiBufferReceive(device,
-+                        ((A_UCHAR *)targ_info)+sizeof(targ_info->target_info_byte_count),
-+                        sizeof(*targ_info)-sizeof(targ_info->target_info_byte_count));
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info (%d bytes) from the device\n",
-+                        					targ_info->target_info_byte_count));
-+            return A_ERROR;
-+        }
-+    } else {
-+        /*
-+         * Target must be an AR6001 whose firmware does not
-+         * support BMI_GET_TARGET_INFO.  Construct the data
-+         * that it would have sent.
-+         */
-+        targ_info->target_info_byte_count = sizeof(targ_info);
-+        targ_info->target_type = TARGET_TYPE_AR6001;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
-+        							targ_info->target_ver, targ_info->target_type));
-+    printk("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
-+	   targ_info->target_ver, targ_info->target_type);
-+
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIReadMemory(HIF_DEVICE *device,
-+              A_UINT32 address,
-+              A_UCHAR *buffer,
-+              A_UINT32 length)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    A_UINT32 remaining, rxlen;
-+    static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
-+    memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+       			("BMI Read Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
-+        			device, address, length));
-+
-+    cid = BMI_READ_MEMORY;
-+
-+    remaining = length;
-+
-+    while (remaining)
-+    {
-+        rxlen = (remaining < BMI_DATASZ_MAX) ? remaining : BMI_DATASZ_MAX;
-+        offset = 0;
-+        A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+        offset += sizeof(cid);
-+        A_MEMCPY(&data[offset], &address, sizeof(address));
-+        offset += sizeof(address);
-+        A_MEMCPY(&data[offset], &rxlen, sizeof(rxlen));
-+        offset += sizeof(length);
-+
-+        status = bmiBufferSend(device, data, offset);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+            return A_ERROR;
-+        }
-+        status = bmiBufferReceive(device, data, rxlen);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+            return A_ERROR;
-+        }
-+        A_MEMCPY(&buffer[length - remaining], data, rxlen);
-+        remaining -= rxlen; address += rxlen;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read Memory: Exit\n"));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIWriteMemory(HIF_DEVICE *device,
-+               A_UINT32 address,
-+               A_UCHAR *buffer,
-+               A_UINT32 length)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    A_UINT32 remaining, txlen;
-+    const A_UINT32 header = sizeof(cid) + sizeof(address) + sizeof(length);
-+    static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
-+	memset (&data, 0, header);
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+         ("BMI Write Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
-+         device, address, length));
-+
-+    cid = BMI_WRITE_MEMORY;
-+
-+    remaining = length;
-+    while (remaining)
-+    {
-+        txlen = (remaining < (BMI_DATASZ_MAX - header)) ?
-+                                       remaining : (BMI_DATASZ_MAX - header);
-+        offset = 0;
-+        A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+        offset += sizeof(cid);
-+        A_MEMCPY(&data[offset], &address, sizeof(address));
-+        offset += sizeof(address);
-+        A_MEMCPY(&data[offset], &txlen, sizeof(txlen));
-+        offset += sizeof(txlen);
-+        A_MEMCPY(&data[offset], &buffer[length - remaining], txlen);
-+        offset += txlen;
-+        status = bmiBufferSend(device, data, offset);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+            return A_ERROR;
-+        }
-+        remaining -= txlen; address += txlen;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Write Memory: Exit\n"));
-+
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIExecute(HIF_DEVICE *device,
-+           A_UINT32 address,
-+           A_UINT32 *param)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(*param)];
-+    memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(*param));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+       ("BMI Execute: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
-+        device, address, *param));
-+
-+    cid = BMI_EXECUTE;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &address, sizeof(address));
-+    offset += sizeof(address);
-+    A_MEMCPY(&data[offset], param, sizeof(*param));
-+    offset += sizeof(*param);
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    status = bmiBufferReceive(device, data, sizeof(*param));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    A_MEMCPY(param, data, sizeof(*param));
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Execute: Exit (param: %d)\n", *param));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMISetAppStart(HIF_DEVICE *device,
-+               A_UINT32 address)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(address)];
-+    memset (&data, 0, sizeof(cid) + sizeof(address));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+       ("BMI Set App Start: Enter (device: 0x%p, address: 0x%x)\n",
-+        device, address));
-+
-+    cid = BMI_SET_APP_START;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &address, sizeof(address));
-+    offset += sizeof(address);
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Set App Start: Exit\n"));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIReadSOCRegister(HIF_DEVICE *device,
-+                   A_UINT32 address,
-+                   A_UINT32 *param)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(address)];
-+    memset (&data, 0, sizeof(cid) + sizeof(address));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+       ("BMI Read SOC Register: Enter (device: 0x%p, address: 0x%x)\n",
-+       device, address));
-+
-+    cid = BMI_READ_SOC_REGISTER;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &address, sizeof(address));
-+    offset += sizeof(address);
-+
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    status = bmiBufferReceive(device, data, sizeof(*param));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+        return A_ERROR;
-+    }
-+    A_MEMCPY(param, data, sizeof(*param));
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit (value: %d)\n", *param));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIWriteSOCRegister(HIF_DEVICE *device,
-+                    A_UINT32 address,
-+                    A_UINT32 param)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(param)];
-+
-+    memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(param));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+     ("BMI Write SOC Register: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
-+     device, address, param));
-+
-+    cid = BMI_WRITE_SOC_REGISTER;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &address, sizeof(address));
-+    offset += sizeof(address);
-+    A_MEMCPY(&data[offset], &param, sizeof(param));
-+    offset += sizeof(param);
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit\n"));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIrompatchInstall(HIF_DEVICE *device,
-+                   A_UINT32 ROM_addr,
-+                   A_UINT32 RAM_addr,
-+                   A_UINT32 nbytes,
-+                   A_UINT32 do_activate,
-+                   A_UINT32 *rompatch_id)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
-+                                sizeof(nbytes) + sizeof(do_activate)];
-+
-+	memset (&data, 0, sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
-+                      sizeof(nbytes) + sizeof(do_activate));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+         ("BMI rompatch Install: Enter (device: 0x%p, ROMaddr: 0x%x, RAMaddr: 0x%x length: %d activate: %d)\n",
-+         device, ROM_addr, RAM_addr, nbytes, do_activate));
-+
-+    cid = BMI_ROMPATCH_INSTALL;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &ROM_addr, sizeof(ROM_addr));
-+    offset += sizeof(ROM_addr);
-+    A_MEMCPY(&data[offset], &RAM_addr, sizeof(RAM_addr));
-+    offset += sizeof(RAM_addr);
-+    A_MEMCPY(&data[offset], &nbytes, sizeof(nbytes));
-+    offset += sizeof(nbytes);
-+    A_MEMCPY(&data[offset], &do_activate, sizeof(do_activate));
-+    offset += sizeof(do_activate);
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    status = bmiBufferReceive(device, (A_UCHAR *)rompatch_id, sizeof(*rompatch_id));
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch Install: (rompatch_id=%d)\n", *rompatch_id));
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIrompatchUninstall(HIF_DEVICE *device,
-+                     A_UINT32 rompatch_id)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[sizeof(cid) + sizeof(rompatch_id)];
-+    memset (&data, 0, sizeof(cid) + sizeof(rompatch_id));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+         ("BMI rompatch Uninstall: Enter (device: 0x%p, rompatch_id: %d)\n",
-+         								 device, rompatch_id));
-+
-+    cid = BMI_ROMPATCH_UNINSTALL;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &rompatch_id, sizeof(rompatch_id));
-+    offset += sizeof(rompatch_id);
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch UNinstall: (rompatch_id=0x%x)\n", rompatch_id));
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+_BMIrompatchChangeActivation(HIF_DEVICE *device,
-+                             A_UINT32 rompatch_count,
-+                             A_UINT32 *rompatch_list,
-+                             A_UINT32 do_activate)
-+{
-+    A_UINT32 cid;
-+    A_STATUS status;
-+    A_UINT32 offset;
-+    static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count)];
-+    A_UINT32 length;
-+
-+	memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count));
-+
-+    if (bmiDone) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+         ("BMI Change rompatch Activation: Enter (device: 0x%p, count: %d)\n",
-+           device, rompatch_count));
-+
-+    cid = do_activate ? BMI_ROMPATCH_ACTIVATE : BMI_ROMPATCH_DEACTIVATE;
-+
-+    offset = 0;
-+    A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+    offset += sizeof(cid);
-+    A_MEMCPY(&data[offset], &rompatch_count, sizeof(rompatch_count));
-+    offset += sizeof(rompatch_count);
-+    length = rompatch_count * sizeof(*rompatch_list);
-+    A_MEMCPY(&data[offset], rompatch_list, length);
-+    offset += length;
-+    status = bmiBufferSend(device, data, offset);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+        return A_ERROR;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Change rompatch Activation: Exit\n"));
-+
-+    return A_OK;
-+}
-+
-+A_STATUS
-+BMIrompatchActivate(HIF_DEVICE *device,
-+                    A_UINT32 rompatch_count,
-+                    A_UINT32 *rompatch_list)
-+{
-+    return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 1);
-+}
-+
-+A_STATUS
-+BMIrompatchDeactivate(HIF_DEVICE *device,
-+                      A_UINT32 rompatch_count,
-+                      A_UINT32 *rompatch_list)
-+{
-+    return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 0);
-+}
-+
-+/* BMI Access routines */
-+A_STATUS
-+bmiBufferSend(HIF_DEVICE *device,
-+              A_UCHAR *buffer,
-+              A_UINT32 length)
-+{
-+    A_STATUS status;
-+    A_UINT32 timeout;
-+    A_UINT32 address;
-+    static A_UINT32 cmdCredits;
-+    A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
-+
-+    HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
-+                       &mboxAddress, sizeof(mboxAddress));
-+
-+    cmdCredits = 0;
-+    timeout = BMI_COMMUNICATION_TIMEOUT;
-+
-+    while(timeout-- && !cmdCredits) {
-+        /* Read the counter register to get the command credits */
-+        address = COUNT_DEC_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 4;
-+        /* hit the credit counter with a 4-byte access, the first byte read will hit the counter and cause
-+         * a decrement, while the remaining 3 bytes has no effect.  The rationale behind this is to
-+         * make all HIF accesses 4-byte aligned */
-+        status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, 4,
-+            HIF_RD_SYNC_BYTE_INC, NULL);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to decrement the command credit count register\n"));
-+            return A_ERROR;
-+        }
-+        /* the counter is only 8=bits, ignore anything in the upper 3 bytes */
-+        cmdCredits &= 0xFF;
-+    }
-+
-+    if (cmdCredits) {
-+        address = mboxAddress[ENDPOINT1];
-+        status = HIFReadWrite(device, address, buffer, length,
-+            HIF_WR_SYNC_BYTE_INC, NULL);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to send the BMI data to the device\n"));
-+            return A_ERROR;
-+        }
-+    } else {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout\n"));
-+        return A_ERROR;
-+    }
-+
-+    return status;
-+}
-+
-+A_STATUS
-+bmiBufferReceive(HIF_DEVICE *device,
-+                 A_UCHAR *buffer,
-+                 A_UINT32 length)
-+{
-+    A_STATUS status;
-+    A_UINT32 address;
-+    A_UINT32 timeout;
-+    static A_UINT32 cmdCredits;
-+    A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
-+
-+    HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
-+                       &mboxAddress, sizeof(mboxAddress));
-+
-+    cmdCredits = 0;
-+    timeout = BMI_COMMUNICATION_TIMEOUT;
-+    while(timeout-- && !cmdCredits) {
-+        /* Read the counter register to get the command credits */
-+        address = COUNT_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 1;
-+        /* read the counter using a 4-byte read.  Since the counter is NOT auto-decrementing,
-+         * we can read this counter multiple times using a non-incrementing address mode.
-+         * The rationale here is to make all HIF accesses a multiple of 4 bytes */
-+        status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, sizeof(cmdCredits),
-+            HIF_RD_SYNC_BYTE_FIX, NULL);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the command credit count register\n"));
-+            return A_ERROR;
-+        }
-+            /* we did a 4-byte read to the same count register so mask off upper bytes */
-+        cmdCredits &= 0xFF;
-+        status = A_ERROR;
-+    }
-+
-+    if (cmdCredits) {
-+        address = mboxAddress[ENDPOINT1];
-+        status = HIFReadWrite(device, address, buffer, length,
-+            HIF_RD_SYNC_BYTE_INC, NULL);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the BMI data from the device\n"));
-+            return A_ERROR;
-+        }
-+    } else {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Communication timeout\n"));
-+        return A_ERROR;
-+    }
-+
-+    return status;
-+}
-diff --git a/drivers/ar6000/bmi/bmi_internal.h b/drivers/ar6000/bmi/bmi_internal.h
-new file mode 100644
-index 0000000..1e21354
---- /dev/null
-+++ b/drivers/ar6000/bmi/bmi_internal.h
-@@ -0,0 +1,45 @@
-+#ifndef BMI_INTERNAL_H
-+#define BMI_INTERNAL_H
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "AR6Khwreg.h"
-+#include "bmi_msg.h"
-+
-+#define BMI_COMMUNICATION_TIMEOUT       100000
-+
-+/* ------ Global Variable Declarations ------- */
-+A_BOOL bmiDone;
-+
-+A_STATUS
-+bmiBufferSend(HIF_DEVICE *device,
-+              A_UCHAR *buffer,
-+              A_UINT32 length);
-+
-+A_STATUS
-+bmiBufferReceive(HIF_DEVICE *device,
-+                 A_UCHAR *buffer,
-+                 A_UINT32 length);
-+
-+#endif
-diff --git a/drivers/ar6000/hif/hif.c b/drivers/ar6000/hif/hif.c
-new file mode 100644
-index 0000000..d04486c
---- /dev/null
-+++ b/drivers/ar6000/hif/hif.c
-@@ -0,0 +1,824 @@
-+/*
-+ * @file: hif.c
-+ *
-+ * @abstract: HIF layer reference implementation for Atheros SDIO stack
-+ *
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "hif_internal.h"
-+
-+/* ------ Static Variables ------ */
-+
-+/* ------ Global Variable Declarations ------- */
-+SD_PNP_INFO Ids[] = {
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xB,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xA,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x9,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x8,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x0,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+        .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x1,
-+        .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+        .SDIO_FunctionClass = FUNCTION_CLASS,
-+        .SDIO_FunctionNo = 1
-+    },
-+    {
-+    }                      //list is null termintaed
-+};
-+
-+TARGET_FUNCTION_CONTEXT FunctionContext = {
-+    .function.Version    = CT_SDIO_STACK_VERSION_CODE,
-+    .function.pName      = "sdio_wlan",
-+    .function.MaxDevices = 1,
-+    .function.NumDevices = 0,
-+    .function.pIds       = Ids,
-+    .function.pProbe     = hifDeviceInserted,
-+    .function.pRemove    = hifDeviceRemoved,
-+    .function.pSuspend   = NULL,
-+    .function.pResume    = NULL,
-+    .function.pWake      = NULL,
-+    .function.pContext   = &FunctionContext,
-+};
-+
-+HIF_DEVICE hifDevice[HIF_MAX_DEVICES];
-+HTC_CALLBACKS htcCallbacks;
-+BUS_REQUEST busRequest[BUS_REQUEST_MAX_NUM];
-+static BUS_REQUEST *s_busRequestFreeQueue = NULL;
-+OS_CRITICALSECTION lock;
-+extern A_UINT32 onebitmode;
-+extern A_UINT32 busspeedlow;
-+
-+#ifdef DEBUG
-+extern A_UINT32 debughif;
-+#define ATH_DEBUG_ERROR 1
-+#define ATH_DEBUG_WARN  2
-+#define ATH_DEBUG_TRACE 3
-+#define _AR_DEBUG_PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(lvl, args)\
-+    {if (lvl <= debughif)\
-+        A_PRINTF(KERN_ALERT _AR_DEBUG_PRINTX_ARG args);\
-+    }
-+#else
-+#define AR_DEBUG_PRINTF(lvl, args)
-+#endif
-+
-+static BUS_REQUEST *hifAllocateBusRequest(void);
-+static void hifFreeBusRequest(BUS_REQUEST *busrequest);
-+static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper);
-+static void ResetAllCards(void);
-+
-+/* ------ Functions ------ */
-+int HIFInit(HTC_CALLBACKS *callbacks)
-+{
-+    SDIO_STATUS status;
-+    DBG_ASSERT(callbacks != NULL);
-+
-+    /* Store the callback and event handlers */
-+    htcCallbacks.deviceInsertedHandler = callbacks->deviceInsertedHandler;
-+    htcCallbacks.deviceRemovedHandler = callbacks->deviceRemovedHandler;
-+    htcCallbacks.deviceSuspendHandler = callbacks->deviceSuspendHandler;
-+    htcCallbacks.deviceResumeHandler = callbacks->deviceResumeHandler;
-+    htcCallbacks.deviceWakeupHandler = callbacks->deviceWakeupHandler;
-+    htcCallbacks.rwCompletionHandler = callbacks->rwCompletionHandler;
-+    htcCallbacks.dsrHandler = callbacks->dsrHandler;
-+
-+    CriticalSectionInit(&lock);
-+
-+    /* Register with bus driver core */
-+    status = SDIO_RegisterFunction(&FunctionContext.function);
-+    DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+    return(0);
-+}
-+
-+A_STATUS
-+HIFReadWrite(HIF_DEVICE *device,
-+             A_UINT32 address,
-+             A_UCHAR *buffer,
-+             A_UINT32 length,
-+             A_UINT32 request,
-+             void *context)
-+{
-+    A_UINT8 rw;
-+    A_UINT8 mode;
-+    A_UINT8 funcNo;
-+    A_UINT8 opcode;
-+    A_UINT16 count;
-+    SDREQUEST *sdrequest;
-+    SDIO_STATUS sdiostatus;
-+    BUS_REQUEST *busrequest;
-+    A_STATUS    status = A_OK;
-+
-+    DBG_ASSERT(device != NULL);
-+    DBG_ASSERT(device->handle != NULL);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
-+
-+    do {
-+        busrequest = hifAllocateBusRequest();
-+        if (busrequest == NULL) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF Unable to allocate bus request\n"));
-+            status = A_NO_RESOURCE;
-+            break;
-+        }
-+
-+        sdrequest = busrequest->request;
-+        busrequest->context = context;
-+
-+        sdrequest->pDataBuffer = buffer;
-+        if (request & HIF_SYNCHRONOUS) {
-+            sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS;
-+            sdrequest->pCompleteContext = NULL;
-+            sdrequest->pCompletion = NULL;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Synchronous\n"));
-+        } else if (request & HIF_ASYNCHRONOUS) {
-+            sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS |
-+                               SDREQ_FLAGS_TRANS_ASYNC;
-+            sdrequest->pCompleteContext = busrequest;
-+            sdrequest->pCompletion = hifRWCompletionHandler;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Asynchronous\n"));
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Invalid execution mode: 0x%08x\n", request));
-+            status = A_EINVAL;
-+            break;
-+        }
-+
-+        if (request & HIF_EXTENDED_IO) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Command type: CMD53\n"));
-+            sdrequest->Command = CMD53;
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Invalid command type: 0x%08x\n", request));
-+            status = A_EINVAL;
-+            break;
-+        }
-+
-+        if (request & HIF_BLOCK_BASIS) {
-+            mode = CMD53_BLOCK_BASIS;
-+            sdrequest->BlockLen = HIF_MBOX_BLOCK_SIZE;
-+            sdrequest->BlockCount = length / HIF_MBOX_BLOCK_SIZE;
-+            count = sdrequest->BlockCount;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                            ("Block mode (BlockLen: %d, BlockCount: %d)\n",
-+                            sdrequest->BlockLen, sdrequest->BlockCount));
-+        } else if (request & HIF_BYTE_BASIS) {
-+            mode = CMD53_BYTE_BASIS;
-+            sdrequest->BlockLen = length;
-+            sdrequest->BlockCount = 1;
-+            count = sdrequest->BlockLen;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                            ("Byte mode (BlockLen: %d, BlockCount: %d)\n",
-+                            sdrequest->BlockLen, sdrequest->BlockCount));
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Invalid data mode: 0x%08x\n", request));
-+            status = A_EINVAL;
-+            break;
-+        }
-+
-+#if 0
-+        /* useful for checking register accesses */
-+        if (length & 0x3) {
-+            A_PRINTF(KERN_ALERT"HIF (%s) is not a multiple of 4 bytes, addr:0x%X, len:%d\n",
-+                                request & HIF_WRITE ? "write":"read", address, length);
-+        }
-+#endif
-+
-+        if ((address >= HIF_MBOX_START_ADDR(0)) &&
-+            (address <= HIF_MBOX_END_ADDR(3)))
-+        {
-+
-+            DBG_ASSERT(length <= HIF_MBOX_WIDTH);
-+
-+            /*
-+             * Mailbox write. Adjust the address so that the last byte
-+             * falls on the EOM address.
-+             */
-+            address += (HIF_MBOX_WIDTH - length);
-+        }
-+
-+
-+
-+        if (request & HIF_WRITE) {
-+            rw = CMD53_WRITE;
-+            sdrequest->Flags |= SDREQ_FLAGS_DATA_WRITE;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Write\n"));
-+        } else if (request & HIF_READ) {
-+            rw = CMD53_READ;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Read\n"));
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Invalid direction: 0x%08x\n", request));
-+            status = A_EINVAL;
-+            break;
-+        }
-+
-+        if (request & HIF_FIXED_ADDRESS) {
-+            opcode = CMD53_FIXED_ADDRESS;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Fixed\n"));
-+        } else if (request & HIF_INCREMENTAL_ADDRESS) {
-+            opcode = CMD53_INCR_ADDRESS;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Incremental\n"));
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Invalid address mode: 0x%08x\n", request));
-+            status = A_EINVAL;
-+            break;
-+        }
-+
-+        funcNo = SDDEVICE_GET_SDIO_FUNCNO(device->handle);
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Function number: %d\n", funcNo));
-+        SDIO_SET_CMD53_ARG(sdrequest->Argument, rw, funcNo,
-+                           mode, opcode, address, count);
-+
-+        /* Send the command out */
-+        sdiostatus = SDDEVICE_CALL_REQUEST_FUNC(device->handle, sdrequest);
-+
-+        if (!SDIO_SUCCESS(sdiostatus)) {
-+            status = A_ERROR;
-+        }
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status) || (request & HIF_SYNCHRONOUS)) {
-+        if (busrequest != NULL) {
-+            hifFreeBusRequest(busrequest);
-+        }
-+    }
-+
-+    if (A_FAILED(status) && (request & HIF_ASYNCHRONOUS)) {
-+            /* call back async handler on failure */
-+        htcCallbacks.rwCompletionHandler(context, status);
-+    }
-+
-+    return status;
-+}
-+
-+A_STATUS
-+HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
-+                   void *config, A_UINT32 configLen)
-+{
-+    A_UINT32 count;
-+
-+    switch(opcode) {
-+        case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
-+            ((A_UINT32 *)config)[0] = HIF_MBOX0_BLOCK_SIZE;
-+            ((A_UINT32 *)config)[1] = HIF_MBOX1_BLOCK_SIZE;
-+            ((A_UINT32 *)config)[2] = HIF_MBOX2_BLOCK_SIZE;
-+            ((A_UINT32 *)config)[3] = HIF_MBOX3_BLOCK_SIZE;
-+            break;
-+
-+        case HIF_DEVICE_GET_MBOX_ADDR:
-+            for (count = 0; count < 4; count ++) {
-+                ((A_UINT32 *)config)[count] = HIF_MBOX_START_ADDR(count);
-+            }
-+            break;
-+        case HIF_DEVICE_GET_IRQ_PROC_MODE:
-+                /* the SDIO stack allows the interrupts to be processed either way, ASYNC or SYNC */
-+            *((HIF_DEVICE_IRQ_PROCESSING_MODE *)config) = HIF_DEVICE_IRQ_ASYNC_SYNC;
-+            break;
-+        default:
-+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
-+                            ("Unsupported configuration opcode: %d\n", opcode));
-+            return A_ERROR;
-+    }
-+
-+    return A_OK;
-+}
-+
-+void
-+HIFShutDownDevice(HIF_DEVICE *device)
-+{
-+    A_UINT8 data;
-+    A_UINT32 count;
-+    SDIO_STATUS status;
-+    SDCONFIG_BUS_MODE_DATA busSettings;
-+    SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
-+
-+    if (device != NULL) {
-+        DBG_ASSERT(device->handle != NULL);
-+
-+        /* Remove the allocated current if any */
-+        status = SDLIB_IssueConfig(device->handle,
-+                                   SDCONFIG_FUNC_FREE_SLOT_CURRENT, NULL, 0);
-+        DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+        /* Disable the card */
-+        fData.EnableFlags = SDCONFIG_DISABLE_FUNC;
-+        fData.TimeOut = 1;
-+        status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ENABLE_DISABLE,
-+                                   &fData, sizeof(fData));
-+        DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+        /* Perform a soft I/O reset */
-+        data = SDIO_IO_RESET;
-+        status = SDLIB_IssueCMD52(device->handle, 0, SDIO_IO_ABORT_REG,
-+                                  &data, 1, 1);
-+        DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+        /*
-+         * WAR - Codetelligence driver does not seem to shutdown correctly in 1
-+         * bit mode. By default it configures the HC in the 4 bit. Its later in
-+         * our driver that we switch to 1 bit mode. If we try to shutdown, the
-+         * driver hangs so we revert to 4 bit mode, to be transparent to the
-+         * underlying bus driver.
-+         */
-+        if (onebitmode) {
-+            ZERO_OBJECT(busSettings);
-+            busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(device->handle);
-+            SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
-+                                   SDCONFIG_BUS_WIDTH_4_BIT);
-+
-+            /* Issue config request to change the bus width to 4 bit */
-+            status = SDLIB_IssueConfig(device->handle, SDCONFIG_BUS_MODE_CTRL,
-+                                       &busSettings,
-+                                       sizeof(SDCONFIG_BUS_MODE_DATA));
-+            DBG_ASSERT(SDIO_SUCCESS(status));
-+        }
-+
-+        /* Free the bus requests */
-+        for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-+            SDDeviceFreeRequest(device->handle, busRequest[count].request);
-+        }
-+        /* Clean up the queue */
-+        s_busRequestFreeQueue = NULL;
-+    } else {
-+            /* since we are unloading the driver anyways, reset all cards in case the SDIO card
-+             * is externally powered and we are unloading the SDIO stack.  This avoids the problem when
-+             * the SDIO stack is reloaded and attempts are made to re-enumerate a card that is already
-+             * enumerated */
-+        ResetAllCards();
-+        /* Unregister with bus driver core */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                        ("Unregistering with the bus driver\n"));
-+        status = SDIO_UnregisterFunction(&FunctionContext.function);
-+        DBG_ASSERT(SDIO_SUCCESS(status));
-+    }
-+}
-+
-+void
-+hifRWCompletionHandler(SDREQUEST *request)
-+{
-+    A_STATUS status;
-+    void *context;
-+    BUS_REQUEST *busrequest;
-+
-+    if (SDIO_SUCCESS(request->Status)) {
-+        status = A_OK;
-+    } else {
-+        status = A_ERROR;
-+    }
-+
-+    DBG_ASSERT(status == A_OK);
-+    busrequest = (BUS_REQUEST *) request->pCompleteContext;
-+    context = (void *) busrequest->context;
-+        /* free the request before calling the callback, in case the
-+         * callback submits another request, this guarantees that
-+         * there is at least 1 free request available everytime the callback
-+         * is invoked */
-+    hifFreeBusRequest(busrequest);
-+    htcCallbacks.rwCompletionHandler(context, status);
-+}
-+
-+void
-+hifIRQHandler(void *context)
-+{
-+    A_STATUS status;
-+    HIF_DEVICE *device;
-+
-+    device = (HIF_DEVICE *)context;
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
-+    status = htcCallbacks.dsrHandler(device->htc_handle);
-+    DBG_ASSERT(status == A_OK);
-+}
-+
-+BOOL
-+hifDeviceInserted(SDFUNCTION *function, SDDEVICE *handle)
-+{
-+    BOOL enabled;
-+    A_UINT8 data;
-+    A_UINT32 count;
-+    HIF_DEVICE *device;
-+    SDIO_STATUS status;
-+    A_UINT16 maxBlocks;
-+    A_UINT16 maxBlockSize;
-+    SDCONFIG_BUS_MODE_DATA busSettings;
-+    SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
-+    TARGET_FUNCTION_CONTEXT *functionContext;
-+    SDCONFIG_FUNC_SLOT_CURRENT_DATA slotCurrent;
-+    SD_BUSCLOCK_RATE                currentBusClock;
-+
-+    DBG_ASSERT(function != NULL);
-+    DBG_ASSERT(handle != NULL);
-+
-+    device = addHifDevice(handle);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
-+    functionContext =  (TARGET_FUNCTION_CONTEXT *)function->pContext;
-+
-+    /*
-+     * Issue commands to get the manufacturer ID and stuff and compare it
-+     * against the rev Id derived from the ID registered during the
-+     * initialization process. Report the device only in the case there
-+     * is a match. In the case od SDIO, the bus driver has already queried
-+     * these details so we just need to use their data structures to get the
-+     * relevant values. Infact, the driver has already matched it against
-+     * the Ids that we registered with it so we dont need to the step here.
-+     */
-+
-+    /* Configure the SDIO Bus Width */
-+    if (onebitmode) {
-+        data = SDIO_BUS_WIDTH_1_BIT;
-+        status = SDLIB_IssueCMD52(handle, 0, SDIO_BUS_IF_REG, &data, 1, 1);
-+        if (!SDIO_SUCCESS(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Unable to set the bus width to 1 bit\n"));
-+            return FALSE;
-+        }
-+    }
-+
-+    /* Get current bus flags */
-+    ZERO_OBJECT(busSettings);
-+
-+    busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(handle);
-+    if (onebitmode) {
-+        SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
-+                               SDCONFIG_BUS_WIDTH_1_BIT);
-+    }
-+
-+        /* get the current operating clock, the bus driver sets us up based
-+         * on what our CIS reports and what the host controller can handle
-+         * we can use this to determine whether we want to drop our clock rate
-+         * down */
-+    currentBusClock = SDDEVICE_GET_OPER_CLOCK(handle);
-+    busSettings.ClockRate = currentBusClock;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                        ("HIF currently running at: %d \n",currentBusClock));
-+
-+        /* see if HIF wants to run at a lower clock speed, we may already be
-+         * at that lower clock speed */
-+    if (currentBusClock > (SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow)) {
-+        busSettings.ClockRate = SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow;
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
-+                        ("HIF overriding clock to %d \n",busSettings.ClockRate));
-+    }
-+
-+    /* Issue config request to override clock rate */
-+    status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_CHANGE_BUS_MODE, &busSettings,
-+                               sizeof(SDCONFIG_BUS_MODE_DATA));
-+    if (!SDIO_SUCCESS(status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                        ("Unable to configure the host clock\n"));
-+        return FALSE;
-+    } else {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                        ("Configured clock: %d, Maximum clock: %d\n",
-+                        busSettings.ActualClockRate,
-+                        SDDEVICE_GET_MAX_CLOCK(handle)));
-+    }
-+
-+    /*
-+     * Check if the target supports block mode. This result of this check
-+     * can be used to implement the HIFReadWrite API.
-+     */
-+    if (SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle)) {
-+        /* Limit block size to operational block limit or card function
-+           capability */
-+        maxBlockSize = min(SDDEVICE_GET_OPER_BLOCK_LEN(handle),
-+                           SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle));
-+
-+        /* check if the card support multi-block transfers */
-+        if (!(SDDEVICE_GET_SDIOCARD_CAPS(handle) & SDIO_CAPS_MULTI_BLOCK)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Byte basis only\n"));
-+
-+            /* Limit block size to max byte basis */
-+            maxBlockSize =  min(maxBlockSize,
-+                                (A_UINT16)SDIO_MAX_LENGTH_BYTE_BASIS);
-+            maxBlocks = 1;
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Multi-block capable\n"));
-+            maxBlocks = SDDEVICE_GET_OPER_BLOCKS(handle);
-+            status = SDLIB_SetFunctionBlockSize(handle, HIF_MBOX_BLOCK_SIZE);
-+            if (!SDIO_SUCCESS(status)) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                                ("Failed to set block size. Err:%d\n", status));
-+                return FALSE;
-+            }
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                        ("Bytes Per Block: %d bytes, Block Count:%d \n",
-+                        maxBlockSize, maxBlocks));
-+    } else {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                        ("Function does not support Block Mode!\n"));
-+        return FALSE;
-+    }
-+
-+    /* Allocate the slot current */
-+    status = SDLIB_GetDefaultOpCurrent(handle, &slotCurrent.SlotCurrent);
-+    if (SDIO_SUCCESS(status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Allocating Slot current: %d mA\n",
-+                                slotCurrent.SlotCurrent));
-+        status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ALLOC_SLOT_CURRENT,
-+                                   &slotCurrent, sizeof(slotCurrent));
-+        if (!SDIO_SUCCESS(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                            ("Failed to allocate slot current %d\n", status));
-+            return FALSE;
-+        }
-+    }
-+
-+    /* Enable the dragon function */
-+    count = 0;
-+    enabled = FALSE;
-+    fData.TimeOut = 1;
-+    fData.EnableFlags = SDCONFIG_ENABLE_FUNC;
-+    while ((count++ < SDWLAN_ENABLE_DISABLE_TIMEOUT) && !enabled)
-+    {
-+        /* Enable dragon */
-+        status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ENABLE_DISABLE,
-+                                   &fData, sizeof(fData));
-+        if (!SDIO_SUCCESS(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                            ("Attempting to enable the card again\n"));
-+            continue;
-+        }
-+
-+        /* Mark the status as enabled */
-+        enabled = TRUE;
-+    }
-+
-+    /* Check if we were succesful in enabling the target */
-+    if (!enabled) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+                        ("Failed to communicate with the target\n"));
-+        return FALSE;
-+    }
-+
-+    /* Allocate the bus requests to be used later */
-+    A_MEMZERO(busRequest, sizeof(busRequest));
-+    for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-+        if ((busRequest[count].request = SDDeviceAllocRequest(handle)) == NULL){
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Unable to allocate memory\n"));
-+            /* TODO: Free the memory that has already been allocated */
-+            return FALSE;
-+        }
-+        hifFreeBusRequest(&busRequest[count]);
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                ("0x%08x = busRequest[%d].request = 0x%08x\n",
-+				(unsigned int) &busRequest[count], count,
-+				(unsigned int) busRequest[count].request));
-+    }
-+
-+        /* Schedule a worker to handle device inserted, this is a temporary workaround
-+         * to fix a deadlock if the device fails to intialize in the insertion handler
-+         * The failure causes the instance to shutdown the HIF layer and unregister the
-+         * function driver within the busdriver probe context which can deadlock
-+         *
-+         * NOTE: we cannot use the default work queue because that would block
-+         * SD bus request processing for all synchronous I/O. We must use a kernel
-+         * thread that is creating using the helper library.
-+         * */
-+
-+    if (SDIO_SUCCESS(SDLIB_OSCreateHelper(&device->insert_helper,
-+                         insert_helper_func,
-+                         device))) {
-+        device->helper_started = TRUE;
-+    }
-+
-+    return TRUE;
-+}
-+
-+static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper)
-+{
-+
-+    /*
-+     * Adding a wait of around a second before we issue the very first
-+     * command to dragon. During the process of loading/unloading the
-+     * driver repeatedly it was observed that we get a data timeout
-+     * while accessing function 1 registers in the chip. The theory at
-+     * this point is that some initialization delay in dragon is
-+     * causing the SDIO state in dragon core to be not ready even after
-+     * the ready bit indicates that function 1 is ready. Accomodating
-+     * for this behavior by adding some delay in the driver before it
-+     * issues the first command after switching on dragon. Need to
-+     * investigate this a bit more - TODO
-+     */
-+
-+    A_MDELAY(1000);
-+        /* Inform HTC */
-+    if ((htcCallbacks.deviceInsertedHandler(SD_GET_OS_HELPER_CONTEXT(pHelper))) != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device rejected\n"));
-+    }
-+
-+    return 0;
-+}
-+
-+void
-+HIFAckInterrupt(HIF_DEVICE *device)
-+{
-+    SDIO_STATUS status;
-+    DBG_ASSERT(device != NULL);
-+    DBG_ASSERT(device->handle != NULL);
-+
-+    /* Acknowledge our function IRQ */
-+    status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ACK_IRQ,
-+                               NULL, 0);
-+    DBG_ASSERT(SDIO_SUCCESS(status));
-+}
-+
-+void
-+HIFUnMaskInterrupt(HIF_DEVICE *device)
-+{
-+    SDIO_STATUS status;
-+
-+    DBG_ASSERT(device != NULL);
-+    DBG_ASSERT(device->handle != NULL);
-+
-+    /* Register the IRQ Handler */
-+    SDDEVICE_SET_IRQ_HANDLER(device->handle, hifIRQHandler, device);
-+
-+    /* Unmask our function IRQ */
-+    status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_UNMASK_IRQ,
-+                               NULL, 0);
-+    DBG_ASSERT(SDIO_SUCCESS(status));
-+}
-+
-+void HIFMaskInterrupt(HIF_DEVICE *device)
-+{
-+    SDIO_STATUS status;
-+    DBG_ASSERT(device != NULL);
-+    DBG_ASSERT(device->handle != NULL);
-+
-+    /* Mask our function IRQ */
-+    status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_MASK_IRQ,
-+                               NULL, 0);
-+    DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+    /* Unregister the IRQ Handler */
-+    SDDEVICE_SET_IRQ_HANDLER(device->handle, NULL, NULL);
-+}
-+
-+static BUS_REQUEST *hifAllocateBusRequest(void)
-+{
-+    BUS_REQUEST *busrequest;
-+
-+    /* Acquire lock */
-+    CriticalSectionAcquire(&lock);
-+
-+    /* Remove first in list */
-+    if((busrequest = s_busRequestFreeQueue) != NULL)
-+    {
-+        s_busRequestFreeQueue = busrequest->next;
-+    }
-+
-+    /* Release lock */
-+    CriticalSectionRelease(&lock);
-+
-+    return busrequest;
-+}
-+
-+static void
-+hifFreeBusRequest(BUS_REQUEST *busrequest)
-+{
-+    DBG_ASSERT(busrequest != NULL);
-+
-+    /* Acquire lock */
-+    CriticalSectionAcquire(&lock);
-+
-+    /* Insert first in list */
-+    busrequest->next = s_busRequestFreeQueue;
-+    s_busRequestFreeQueue = busrequest;
-+
-+    /* Release lock */
-+    CriticalSectionRelease(&lock);
-+}
-+
-+void
-+hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *handle)
-+{
-+    A_STATUS status;
-+    HIF_DEVICE *device;
-+    DBG_ASSERT(function != NULL);
-+    DBG_ASSERT(handle != NULL);
-+
-+    device = getHifDevice(handle);
-+    status = htcCallbacks.deviceRemovedHandler(device->htc_handle, A_OK);
-+
-+        /* cleanup the helper thread */
-+    if (device->helper_started) {
-+        SDLIB_OSDeleteHelper(&device->insert_helper);
-+        device->helper_started = FALSE;
-+    }
-+
-+    delHifDevice(handle);
-+    DBG_ASSERT(status == A_OK);
-+}
-+
-+HIF_DEVICE *
-+addHifDevice(SDDEVICE *handle)
-+{
-+    DBG_ASSERT(handle != NULL);
-+    hifDevice[0].handle = handle;
-+    return &hifDevice[0];
-+}
-+
-+HIF_DEVICE *
-+getHifDevice(SDDEVICE *handle)
-+{
-+    DBG_ASSERT(handle != NULL);
-+    return &hifDevice[0];
-+}
-+
-+void
-+delHifDevice(SDDEVICE *handle)
-+{
-+    DBG_ASSERT(handle != NULL);
-+    hifDevice[0].handle = NULL;
-+}
-+
-+struct device*
-+HIFGetOSDevice(HIF_DEVICE *device)
-+{
-+    return &device->handle->Device->dev;
-+}
-+
-+static void ResetAllCards(void)
-+{
-+    UINT8       data;
-+    SDIO_STATUS status;
-+    int         i;
-+
-+    data = SDIO_IO_RESET;
-+
-+    /* set the I/O CARD reset bit:
-+     * NOTE: we are exploiting a "feature" of the SDIO core that resets the core when you
-+     * set the RES bit in the SDIO_IO_ABORT register.  This bit however "normally" resets the
-+     * I/O functions leaving the SDIO core in the same state (as per SDIO spec).
-+     * In this design, this reset can be used to reset the SDIO core itself */
-+    for (i = 0; i < HIF_MAX_DEVICES; i++) {
-+        if (hifDevice[i].handle != NULL) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+                        ("Issuing I/O Card reset for instance: %d \n",i));
-+                /* set the I/O Card reset bit */
-+            status = SDLIB_IssueCMD52(hifDevice[i].handle,
-+                                      0,                    /* function 0 space */
-+                                      SDIO_IO_ABORT_REG,
-+                                      &data,
-+                                      1,                    /* 1 byte */
-+                                      TRUE);                /* write */
-+        }
-+    }
-+
-+}
-+
-+void HIFSetHandle(void *hif_handle, void *handle)
-+{
-+    HIF_DEVICE *device = (HIF_DEVICE *) hif_handle;
-+
-+    device->htc_handle = handle;
-+
-+    return;
-+}
-diff --git a/drivers/ar6000/hif/hif2.c b/drivers/ar6000/hif/hif2.c
-new file mode 100644
-index 0000000..386d96e
---- /dev/null
-+++ b/drivers/ar6000/hif/hif2.c
-@@ -0,0 +1,768 @@
-+/*
-+ * hif2.c - HIF layer re-implementation for the Linux SDIO stack
-+ *
-+ * Copyright (C) 2008, 2009 by OpenMoko, Inc.
-+ * Written by Werner Almesberger <werner@openmoko.org>
-+ * All Rights Reserved
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Based on:
-+ *
-+ * @abstract: HIF layer reference implementation for Atheros SDIO stack
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
-+ */
-+
-+
-+#include <linux/kernel.h>
-+#include <linux/kthread.h>
-+#include <linux/list.h>
-+#include <linux/wait.h>
-+#include <linux/spinlock.h>
-+#include <linux/mutex.h>
-+#include <linux/sched.h>
-+#include <linux/mmc/sdio_func.h>
-+#include <linux/mmc/sdio.h>
-+#include <linux/mmc/sdio_ids.h>
-+
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "hif.h"
-+
-+
-+/* @@@ Hack - this wants cleaning up */
-+
-+#ifdef CONFIG_MACH_NEO1973_GTA02
-+
-+#include <mach/gta02-pm-wlan.h>
-+
-+#else /* CONFIG_MACH_NEO1973_GTA02 */
-+
-+#define	gta02_wlan_query_rfkill_lock()  1
-+#define	gta02_wlan_set_rfkill_cb(cb, hif) ((void) cb)
-+#define	gta02_wlan_query_rfkill_unlock()
-+#define	gta02_wlan_clear_rfkill_cb()
-+
-+#endif /* !CONFIG_MACH_NEO1973_GTA02 */
-+
-+
-+/*
-+ * KNOWN BUGS:
-+ *
-+ * - HIF_DEVICE_IRQ_ASYNC_SYNC doesn't work yet (gets MMC errors)
-+ * - latency can reach hundreds of ms, probably because of scheduling delays
-+ * - packets go through about three queues before finally hitting the network
-+ */
-+
-+/*
-+ * Differences from Atheros' HIFs:
-+ *
-+ * - synchronous and asynchronous requests may get reordered with respect to
-+ *   each other, e.g., if HIFReadWrite returns for an asynchronous request and
-+ *   then HIFReadWrite is called for a synchronous request, the synchronous
-+ *   request may be executed before the asynchronous request.
-+ *
-+ * - request queue locking seems unnecessarily complex in the Atheros HIFs.
-+ *
-+ * - Atheros mask interrupts by calling sdio_claim_irq/sdio_release_irq, which
-+ *   can cause quite a bit of overhead. This HIF has its own light-weight
-+ *   interrupt masking.
-+ *
-+ * - Atheros call deviceInsertedHandler from a thread spawned off the probe or
-+ *   device insertion function. The original explanation for the Atheros SDIO
-+ *   stack said that this is done because a delay is needed to let the chip
-+ *   complete initialization. There is indeed a one second delay in the thread.
-+ *
-+ *   The Atheros Linux SDIO HIF removes the delay and only retains the thread.
-+ *   Experimentally removing the thread didn't show any conflicts, so let's get
-+ *   rid of it for good.
-+ *
-+ * - The Atheros SDIO stack with Samuel's driver sets SDIO_CCCR_POWER in
-+ *   SDIO_POWER_EMPC. Atheros' Linux SDIO code apparently doesn't. We don't
-+ *   either, and this seems to work fine.
-+ *   @@@ Need to check this with Atheros.
-+ */
-+
-+
-+#define MBOXES			4
-+
-+#define HIF_MBOX_BLOCK_SIZE	128
-+#define	HIF_MBOX_BASE_ADDR	0x800
-+#define	HIF_MBOX_WIDTH		0x800
-+#define	HIF_MBOX_START_ADDR(mbox) \
-+    (HIF_MBOX_BASE_ADDR+(mbox)*HIF_MBOX_WIDTH)
-+
-+
-+struct hif_device {
-+	void *htc_handle;
-+	struct sdio_func *func;
-+
-+	/*
-+	 * @@@ our sweet little bit of bogosity - the mechanism that lets us
-+	 * use the SDIO stack from softirqs. This really wants to use skbs.
-+	 */
-+	struct list_head queue;
-+	spinlock_t queue_lock;
-+	struct task_struct *io_task;
-+	wait_queue_head_t wait;
-+
-+	/*
-+	 * activate_lock protects "active" and the activation/deactivation
-+	 * process itself.
-+	 *
-+	 * Relation to other locks: The SDIO function can be claimed while
-+	 * activate_lock is being held, but trying to acquire activate_lock
-+	 * while having ownership of the SDIO function could cause a deadlock.
-+	 */
-+	int active;
-+	struct mutex activate_lock;
-+};
-+
-+struct hif_request {
-+	struct list_head list;
-+	struct sdio_func *func;
-+	int (*read)(struct sdio_func *func,
-+	    void *dst, unsigned int addr, int count);
-+	int (*write)(struct sdio_func *func,
-+	    unsigned int addr, void *src, int count);
-+	void *buf;
-+	unsigned long addr;
-+	int len;
-+	A_STATUS (*completion)(void *context, A_STATUS status);
-+	void *context;
-+};
-+
-+
-+static HTC_CALLBACKS htcCallbacks;
-+
-+/*
-+ * shutdown_lock prevents recursion through HIFShutDownDevice
-+ */
-+static DEFINE_MUTEX(shutdown_lock);
-+
-+
-+/* ----- Request processing ------------------------------------------------ */
-+
-+
-+static A_STATUS process_request(struct hif_request *req)
-+{
-+	int ret;
-+	A_STATUS status;
-+
-+	dev_dbg(&req->func->dev, "process_request(req %p)\n", req);
-+	sdio_claim_host(req->func);
-+	if (req->read) {
-+		ret = req->read(req->func, req->buf, req->addr, req->len);
-+	} else {
-+		ret = req->write(req->func, req->addr, req->buf, req->len);
-+	}
-+	sdio_release_host(req->func);
-+	status = ret ? A_ERROR : A_OK;
-+	if (req->completion)
-+		req->completion(req->context, status);
-+	kfree(req);
-+	return status;
-+}
-+
-+
-+static void enqueue_request(struct hif_device *hif, struct hif_request *req)
-+{
-+	unsigned long flags;
-+
-+	dev_dbg(&req->func->dev, "enqueue_request(req %p)\n", req);
-+	spin_lock_irqsave(&hif->queue_lock, flags);
-+	list_add_tail(&req->list, &hif->queue);
-+	spin_unlock_irqrestore(&hif->queue_lock, flags);
-+	wake_up(&hif->wait);
-+}
-+
-+
-+static struct hif_request *dequeue_request(struct hif_device *hif)
-+{
-+	struct hif_request *req;
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&hif->queue_lock, flags);
-+	if (list_empty(&hif->queue))
-+		req = NULL;
-+	else {
-+		req = list_first_entry(&hif->queue,
-+		    struct hif_request, list);
-+		list_del(&req->list);
-+	}
-+	spin_unlock_irqrestore(&hif->queue_lock, flags);
-+	return req;
-+}
-+
-+
-+static void wait_queue_empty(struct hif_device *hif)
-+{
-+	unsigned long flags;
-+	int empty;
-+
-+	while (1) {
-+		spin_lock_irqsave(&hif->queue_lock, flags);
-+		empty = list_empty(&hif->queue);
-+		spin_unlock_irqrestore(&hif->queue_lock, flags);
-+		if (empty)
-+			break;
-+		else
-+			yield();
-+	}
-+}
-+
-+
-+static int io(void *data)
-+{
-+	struct hif_device *hif = data;
-+	struct sched_param param = { .sched_priority = 2 };
-+		/* one priority level slower than ksdioirqd (which is at 1) */
-+	DEFINE_WAIT(wait);
-+	struct hif_request *req;
-+
-+	sched_setscheduler(current, SCHED_FIFO, &param);
-+
-+	while (1) {
-+		while (1) {
-+			/*
-+			 * Since we never use signals here, one might think
-+			 * that this ought to be TASK_UNINTERRUPTIBLE. However,
-+			 * such a task would increase the load average and,
-+			 * worse, it would trigger the softlockup check.
-+			 */
-+			prepare_to_wait(&hif->wait, &wait, TASK_INTERRUPTIBLE);
-+			if (kthread_should_stop()) {
-+				finish_wait(&hif->wait, &wait);
-+				return 0;
-+			}
-+			req = dequeue_request(hif);
-+			if (req)
-+				break;
-+			schedule();
-+		}
-+		finish_wait(&hif->wait, &wait);
-+
-+		(void) process_request(req);
-+	}
-+	return 0;
-+}
-+
-+
-+A_STATUS HIFReadWrite(HIF_DEVICE *hif, A_UINT32 address, A_UCHAR *buffer,
-+    A_UINT32 length, A_UINT32 request, void *context)
-+{
-+	struct device *dev = HIFGetOSDevice(hif);
-+	struct hif_request *req;
-+
-+	dev_dbg(dev, "HIFReadWrite(device %p, address 0x%x, buffer %p, "
-+	    "length %d, request 0x%x, context %p)\n",
-+	    hif, address, buffer, length, request, context);
-+
-+	BUG_ON(!(request & (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)));
-+	BUG_ON(!(request & (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)));
-+	BUG_ON(!(request & (HIF_READ | HIF_WRITE)));
-+	BUG_ON(!(request & HIF_EXTENDED_IO));
-+
-+	if (address >= HIF_MBOX_START_ADDR(0) &&
-+	    address < HIF_MBOX_START_ADDR(MBOXES+1)) {
-+		BUG_ON(length > HIF_MBOX_WIDTH);
-+		/* Adjust the address so that the last byte falls on the EOM
-+		   address. */
-+		address += HIF_MBOX_WIDTH-length;
-+	}
-+
-+	req = kzalloc(sizeof(*req), GFP_ATOMIC);
-+	if (!req) {
-+		if (request & HIF_ASYNCHRONOUS)
-+			htcCallbacks.rwCompletionHandler(context, A_ERROR);
-+		return A_ERROR;
-+	}
-+
-+	req->func = hif->func;
-+	req->addr = address;
-+	req->buf = buffer;
-+	req->len = length;
-+
-+	if (request & HIF_READ) {
-+		if (request & HIF_FIXED_ADDRESS)
-+			req->read = sdio_readsb;
-+		else
-+			req->read = sdio_memcpy_fromio;
-+	} else {
-+		if (request & HIF_FIXED_ADDRESS)
-+			req->write = sdio_writesb;
-+		else
-+			req->write = sdio_memcpy_toio;
-+	}
-+
-+	if (!(request & HIF_ASYNCHRONOUS))
-+		return process_request(req);
-+
-+	req->completion = htcCallbacks.rwCompletionHandler;
-+	req->context = context;
-+	enqueue_request(hif, req);
-+
-+	return A_OK;
-+}
-+
-+
-+/* ----- Interrupt handling ------------------------------------------------ */
-+
-+/*
-+ * Volatile ought to be good enough to make gcc do the right thing on S3C24xx.
-+ * No need to use atomic or put barriers, keeping the code more readable.
-+ *
-+ * Warning: this story changes if going SMP/SMT.
-+ */
-+
-+static volatile int masked = 1;
-+static volatile int pending;
-+static volatile int in_interrupt;
-+
-+
-+static void ar6000_do_irq(struct sdio_func *func)
-+{
-+	HIF_DEVICE *hif = sdio_get_drvdata(func);
-+	struct device *dev = HIFGetOSDevice(hif);
-+	A_STATUS status;
-+
-+	dev_dbg(dev, "ar6000_do_irq -> %p\n", htcCallbacks.dsrHandler);
-+
-+	status = htcCallbacks.dsrHandler(hif->htc_handle);
-+	BUG_ON(status != A_OK);
-+}
-+
-+
-+static void sdio_ar6000_irq(struct sdio_func *func)
-+{
-+	HIF_DEVICE *hif = sdio_get_drvdata(func);
-+	struct device *dev = HIFGetOSDevice(hif);
-+
-+	dev_dbg(dev, "sdio_ar6000_irq\n");
-+
-+	in_interrupt = 1;
-+	if (masked) {
-+		in_interrupt = 0;
-+		pending++;
-+		return;
-+	}
-+	/*
-+	 * @@@ This is ugly. If we don't drop the lock, we'll deadlock when
-+	 * the handler tries to do SDIO. So there are four choices:
-+	 *
-+	 * 1) Break the call chain by calling the callback from a workqueue.
-+	 *    Ugh.
-+	 * 2) Make process_request aware that we already have the lock.
-+	 * 3) Drop the lock. Which is ugly but should be safe as long as we're
-+	 *    making sure the device doesn't go away.
-+	 * 4) Change the AR6k driver such that it only issues asynchronous
-+	 *    quests when called from an interrupt.
-+	 *
-+	 * Solution 2) is probably the best for now. Will try it later.
-+	 */
-+	sdio_release_host(func);
-+	ar6000_do_irq(func);
-+	sdio_claim_host(func);
-+	in_interrupt = 0;
-+}
-+
-+
-+void HIFAckInterrupt(HIF_DEVICE *hif)
-+{
-+	struct device *dev = HIFGetOSDevice(hif);
-+
-+	dev_dbg(dev, "HIFAckInterrupt\n");
-+	/* do nothing */
-+}
-+
-+
-+void HIFUnMaskInterrupt(HIF_DEVICE *hif)
-+{
-+	struct device *dev = HIFGetOSDevice(hif);
-+
-+	dev_dbg(dev, "HIFUnMaskInterrupt\n");
-+	do {
-+		masked = 1;
-+		if (pending) {
-+			pending = 0;
-+			ar6000_do_irq(hif->func);
-+			/* We may take an interrupt before unmasking and thus
-+			   get it pending. In this case, we just loop back. */
-+		}
-+		masked = 0;
-+	}
-+	while (pending);
-+}
-+
-+
-+void HIFMaskInterrupt(HIF_DEVICE *hif)
-+{
-+	struct device *dev = HIFGetOSDevice(hif);
-+
-+	dev_dbg(dev, "HIFMaskInterrupt\n");
-+	/*
-+	 * Since sdio_ar6000_irq can also be called from a process context, we
-+	 * may conceivably end up racing with it. Thus, we need to wait until
-+	 * we can be sure that no concurrent interrupt processing is going on
-+	 * before we return.
-+	 *
-+	 * Note: this may be a bit on the paranoid side - the callers may
-+	 * actually be nice enough to disable scheduling. Check later.
-+	 */
-+	masked = 1;
-+	while (in_interrupt)
-+		yield();
-+}
-+
-+
-+/* ----- HIF API glue functions -------------------------------------------- */
-+
-+
-+struct device *HIFGetOSDevice(HIF_DEVICE *hif)
-+{
-+	return &hif->func->dev;
-+}
-+
-+
-+void HIFSetHandle(void *hif_handle, void *handle)
-+{
-+	HIF_DEVICE *hif = (HIF_DEVICE *) hif_handle;
-+
-+	hif->htc_handle = handle;
-+}
-+
-+
-+/* ----- Device configuration (HIF side) ----------------------------------- */
-+
-+
-+A_STATUS HIFConfigureDevice(HIF_DEVICE *hif,
-+    HIF_DEVICE_CONFIG_OPCODE opcode, void *config, A_UINT32 configLen)
-+{
-+	struct device *dev = HIFGetOSDevice(hif);
-+	HIF_DEVICE_IRQ_PROCESSING_MODE *ipm_cfg = config;
-+	A_UINT32 *mbs_cfg = config;
-+	int i;
-+
-+	dev_dbg(dev, "HIFConfigureDevice\n");
-+
-+	switch (opcode) {
-+	case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
-+		for (i = 0; i != MBOXES; i++)
-+			mbs_cfg[i] = HIF_MBOX_BLOCK_SIZE;
-+		break;
-+	case HIF_DEVICE_GET_MBOX_ADDR:
-+		for (i = 0; i != MBOXES; i++)
-+			mbs_cfg[i] = HIF_MBOX_START_ADDR(i);
-+		break;
-+	case HIF_DEVICE_GET_IRQ_PROC_MODE:
-+		*ipm_cfg = HIF_DEVICE_IRQ_SYNC_ONLY;
-+//		*ipm_cfg = HIF_DEVICE_IRQ_ASYNC_SYNC;
-+		break;
-+	default:
-+		return A_ERROR;
-+	}
-+	return A_OK;
-+}
-+
-+
-+/* ----- Device probe and removal (Linux side) ----------------------------- */
-+
-+
-+static int ar6000_do_activate(struct hif_device *hif)
-+{
-+	struct sdio_func *func = hif->func;
-+	struct device *dev = &func->dev;
-+	int ret;
-+
-+	dev_dbg(dev, "ar6000_do_activate\n");
-+
-+	sdio_claim_host(func);
-+	sdio_enable_func(func);
-+
-+	INIT_LIST_HEAD(&hif->queue);
-+	init_waitqueue_head(&hif->wait);
-+	spin_lock_init(&hif->queue_lock);
-+
-+	ret = sdio_set_block_size(func, HIF_MBOX_BLOCK_SIZE);
-+	if (ret < 0) {
-+		dev_err(dev, "sdio_set_block_size returns %d\n", ret);
-+		goto out_enabled;
-+	}
-+	ret = sdio_claim_irq(func, sdio_ar6000_irq);
-+	if (ret) {
-+		dev_err(dev, "sdio_claim_irq returns %d\n", ret);
-+		goto out_enabled;
-+	}
-+	/* Set SDIO_BUS_CD_DISABLE in SDIO_CCCR_IF ? */
-+#if 0
-+	sdio_f0_writeb(func, SDIO_CCCR_CAP_E4MI, SDIO_CCCR_CAPS, &ret);
-+	if (ret) {
-+		dev_err(dev, "sdio_f0_writeb(SDIO_CCCR_CAPS) returns %d\n",
-+		    ret);
-+		goto out_got_irq;
-+	}
-+#else
-+	if (0) /* avoid warning */
-+		goto out_got_irq;
-+#endif
-+
-+	sdio_release_host(func);
-+
-+	hif->io_task = kthread_run(io, hif, "ar6000_io");
-+	ret = IS_ERR(hif->io_task);
-+	if (ret) {
-+		dev_err(dev, "kthread_run(ar6000_io): %d\n", ret);
-+		goto out_func_ready;
-+	}
-+
-+	ret = htcCallbacks.deviceInsertedHandler(hif);
-+	if (ret == A_OK)
-+		return 0;
-+
-+	dev_err(dev, "deviceInsertedHandler: %d\n", ret);
-+
-+	ret = kthread_stop(hif->io_task);
-+	if (ret)
-+		dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
-+
-+out_func_ready:
-+	sdio_claim_host(func);
-+
-+out_got_irq:
-+	sdio_release_irq(func);
-+
-+out_enabled:
-+	sdio_disable_func(func);
-+	sdio_release_host(func);
-+
-+	return ret;
-+}
-+
-+
-+static void ar6000_do_deactivate(struct hif_device *hif)
-+{
-+	struct sdio_func *func = hif->func;
-+	struct device *dev = &func->dev;
-+	int ret;
-+
-+	dev_dbg(dev, "ar6000_do_deactivate\n");
-+	if (!hif->active)
-+		return;
-+
-+	if (mutex_trylock(&shutdown_lock)) {
-+		/*
-+		 * Funny, Atheros' HIF does this call, but this just puts us in
-+		 * a recursion through HTCShutDown/HIFShutDown if unloading the
-+		 * module.
-+		 *
-+		 * However, we need it for suspend/resume. See the comment at
-+		 * HIFShutDown, below.
-+		 */
-+		ret = htcCallbacks.deviceRemovedHandler(hif->htc_handle, A_OK);
-+		if (ret != A_OK)
-+			dev_err(dev, "deviceRemovedHandler: %d\n", ret);
-+		mutex_unlock(&shutdown_lock);
-+	}
-+	wait_queue_empty(hif);
-+	ret = kthread_stop(hif->io_task);
-+	if (ret)
-+		dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
-+	sdio_claim_host(func);
-+	sdio_release_irq(func);
-+	sdio_disable_func(func);
-+	sdio_release_host(func);
-+}
-+
-+
-+static int ar6000_activate(struct hif_device *hif)
-+{
-+	int ret = 0;
-+
-+	dev_dbg(&hif->func->dev, "ar6000_activate\n");
-+	mutex_lock(&hif->activate_lock);
-+	if (!hif->active) {
-+		ret = ar6000_do_activate(hif);
-+		if (ret) {
-+			printk(KERN_ERR "%s: Failed to activate %d\n",
-+				__func__, ret);
-+			goto out;
-+		}
-+		hif->active = 1;
-+	}
-+out:
-+	mutex_unlock(&hif->activate_lock);
-+	return ret;
-+}
-+
-+
-+static void ar6000_deactivate(struct hif_device *hif)
-+{
-+	dev_dbg(&hif->func->dev, "ar6000_deactivate\n");
-+	mutex_lock(&hif->activate_lock);
-+	if (hif->active) {
-+		ar6000_do_deactivate(hif);
-+		hif->active = 0;
-+	}
-+	mutex_unlock(&hif->activate_lock);
-+}
-+
-+
-+static int ar6000_rfkill_cb(void *data, int on)
-+{
-+	struct hif_device *hif = data;
-+	struct sdio_func *func = hif->func;
-+	struct device *dev = &func->dev;
-+
-+	dev_dbg(dev, "ar6000_rfkill_cb: on %d\n", on);
-+	if (on)
-+		return ar6000_activate(hif);
-+	ar6000_deactivate(hif);
-+	return 0;
-+}
-+
-+
-+static int sdio_ar6000_probe(struct sdio_func *func,
-+    const struct sdio_device_id *id)
-+{
-+	struct device *dev = &func->dev;
-+	struct hif_device *hif;
-+	int ret = 0;
-+
-+	dev_dbg(dev, "sdio_ar6000_probe\n");
-+	BUG_ON(!htcCallbacks.deviceInsertedHandler);
-+
-+	hif = kzalloc(sizeof(*hif), GFP_KERNEL);
-+	if (!hif)
-+		return -ENOMEM;
-+
-+	sdio_set_drvdata(func, hif);
-+	hif->func = func;
-+	mutex_init(&hif->activate_lock);
-+	hif->active = 0;
-+
-+	if (gta02_wlan_query_rfkill_lock())
-+		ret = ar6000_activate(hif);
-+	if (!ret) {
-+		gta02_wlan_set_rfkill_cb(ar6000_rfkill_cb, hif);
-+		return 0;
-+	}
-+	gta02_wlan_query_rfkill_unlock();
-+	sdio_set_drvdata(func, NULL);
-+	kfree(hif);
-+	return ret;
-+}
-+
-+
-+static void sdio_ar6000_remove(struct sdio_func *func)
-+{
-+	struct device *dev = &func->dev;
-+	HIF_DEVICE *hif = sdio_get_drvdata(func);
-+
-+	dev_dbg(dev, "sdio_ar6000_remove\n");
-+	gta02_wlan_clear_rfkill_cb();
-+	ar6000_deactivate(hif);
-+	sdio_set_drvdata(func, NULL);
-+	kfree(hif);
-+}
-+
-+
-+/* ----- Device registration/unregistration (called by HIF) ---------------- */
-+
-+
-+#define ATHEROS_SDIO_DEVICE(id, offset) \
-+    SDIO_DEVICE(SDIO_VENDOR_ID_ATHEROS, SDIO_DEVICE_ID_ATHEROS_##id | (offset))
-+
-+static const struct sdio_device_id sdio_ar6000_ids[] = {
-+	{ ATHEROS_SDIO_DEVICE(AR6002, 0)	},
-+	{ ATHEROS_SDIO_DEVICE(AR6002, 0x1)	},
-+	{ ATHEROS_SDIO_DEVICE(AR6001, 0x8)	},
-+	{ ATHEROS_SDIO_DEVICE(AR6001, 0x9)	},
-+	{ ATHEROS_SDIO_DEVICE(AR6001, 0xa)	},
-+	{ ATHEROS_SDIO_DEVICE(AR6001, 0xb)	},
-+	{ /* end: all zeroes */			},
-+};
-+
-+MODULE_DEVICE_TABLE(sdio, sdio_ar6000_ids);
-+
-+
-+static struct sdio_driver sdio_ar6000_driver = {
-+	.probe		= sdio_ar6000_probe,
-+	.remove		= sdio_ar6000_remove,
-+	.name		= "sdio_ar6000",
-+	.id_table	= sdio_ar6000_ids,
-+};
-+
-+
-+int HIFInit(HTC_CALLBACKS *callbacks)
-+{
-+	int ret;
-+
-+	BUG_ON(!callbacks);
-+
-+	printk(KERN_DEBUG "HIFInit\n");
-+	htcCallbacks = *callbacks;
-+
-+	ret = sdio_register_driver(&sdio_ar6000_driver);
-+	if (ret) {
-+		printk(KERN_ERR
-+		    "sdio_register_driver(sdio_ar6000_driver): %d\n", ret);
-+		return A_ERROR;
-+	}
-+
-+	return 0;
-+}
-+
-+
-+/*
-+ * We have four possible call chains here:
-+ *
-+ * System shutdown/reboot:
-+ *
-+ *   kernel_restart_prepare ...> device_shutdown ... > s3cmci_shutdown ->
-+ *     mmc_remove_host ..> sdio_bus_remove -> sdio_ar6000_remove ->
-+ *     ar6000_deactivate -> ar6000_do_deactivate ->
-+ *     deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ *   This is roughly the same sequence as suspend, described below.
-+ *
-+ * Module removal:
-+ *
-+ *   sys_delete_module -> ar6000_cleanup_module -> HTCShutDown ->
-+ *     HIFShutDownDevice -> sdio_unregister_driver ...> sdio_bus_remove ->
-+ *     sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate
-+ *
-+ *   In this case, HIFShutDownDevice must call sdio_unregister_driver to
-+ *   notify the driver about its removal. ar6000_do_deactivate must not call
-+ *   deviceRemovedHandler, because that would loop back into HIFShutDownDevice.
-+ *
-+ * Suspend:
-+ *
-+ *   device_suspend ...> s3cmci_suspend ...> sdio_bus_remove ->
-+ *     sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate ->
-+ *     deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ *   We must call deviceRemovedHandler to inform the ar6k stack that the device
-+ *   has been removed. Since HTCTargetRemovedHandler calls back into
-+ *   HIFShutDownDevice, we must also prevent the call to
-+ *   sdio_unregister_driver, or we'd end up recursing into the SDIO stack,
-+ *   eventually deadlocking somewhere.
-+ *
-+ * rfkill:
-+ *
-+ *   rfkill_state_store -> rfkill_toggle_radio -> gta02_wlan_toggle_radio ->
-+ *   ar6000_rfkill_cb -> ar6000_deactivate -> ar6000_do_deactivate ->
-+ *     deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ *   This is similar to suspend - only the entry point changes.
-+ */
-+
-+void HIFShutDownDevice(HIF_DEVICE *hif)
-+{
-+	/* Beware, HTCShutDown calls us with hif == NULL ! */
-+	if (mutex_trylock(&shutdown_lock)) {
-+		sdio_unregister_driver(&sdio_ar6000_driver);
-+		mutex_unlock(&shutdown_lock);
-+	}
-+}
-diff --git a/drivers/ar6000/hif/hif_internal.h b/drivers/ar6000/hif/hif_internal.h
-new file mode 100644
-index 0000000..d8fc101
---- /dev/null
-+++ b/drivers/ar6000/hif/hif_internal.h
-@@ -0,0 +1,102 @@
-+/*
-+ * @file: hif_internal.h
-+ *
-+ * @abstract: internal header file for hif layer
-+ *
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include <linux/sdio/ctsystem.h>
-+#include <linux/sdio/sdio_busdriver.h>
-+#include <linux/sdio/_sdio_defs.h>
-+#include <linux/sdio/sdio_lib.h>
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "hif.h"
-+
-+#define MANUFACTURER_ID_AR6001_BASE        0x100
-+#define MANUFACTURER_ID_AR6002_BASE        0x200
-+#define FUNCTION_CLASS                     0x0
-+#define MANUFACTURER_CODE                  0x271
-+
-+#define BUS_REQUEST_MAX_NUM                64
-+
-+#define SDIO_CLOCK_FREQUENCY_DEFAULT       25000000
-+#define SDWLAN_ENABLE_DISABLE_TIMEOUT      20
-+#define FLAGS_CARD_ENAB                    0x02
-+#define FLAGS_CARD_IRQ_UNMSK               0x04
-+
-+#define HIF_MBOX_BLOCK_SIZE                128
-+#define HIF_MBOX_BASE_ADDR                 0x800
-+#define HIF_MBOX_WIDTH                     0x800
-+#define HIF_MBOX0_BLOCK_SIZE               1
-+#define HIF_MBOX1_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
-+#define HIF_MBOX2_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
-+#define HIF_MBOX3_BLOCK_SIZE               HIF_MBOX_BLOCK_SIZE
-+
-+#define HIF_MBOX_START_ADDR(mbox)                        \
-+    HIF_MBOX_BASE_ADDR + mbox * HIF_MBOX_WIDTH
-+
-+#define HIF_MBOX_END_ADDR(mbox)	                         \
-+    HIF_MBOX_START_ADDR(mbox) + HIF_MBOX_WIDTH - 1
-+
-+struct hif_device {
-+    SDDEVICE *handle;
-+    void *htc_handle;
-+    OSKERNEL_HELPER insert_helper;
-+    BOOL  helper_started;
-+};
-+
-+typedef struct target_function_context {
-+    SDFUNCTION           function; /* function description of the bus driver */
-+    OS_SEMAPHORE         instanceSem; /* instance lock. Unused */
-+    SDLIST               instanceList; /* list of instances. Unused */
-+} TARGET_FUNCTION_CONTEXT;
-+
-+typedef struct bus_request {
-+    struct bus_request *next;
-+    SDREQUEST *request;
-+    void *context;
-+} BUS_REQUEST;
-+
-+BOOL
-+hifDeviceInserted(SDFUNCTION *function, SDDEVICE *device);
-+
-+void
-+hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *device);
-+
-+SDREQUEST *
-+hifAllocateDeviceRequest(SDDEVICE *device);
-+
-+void
-+hifFreeDeviceRequest(SDREQUEST *request);
-+
-+void
-+hifRWCompletionHandler(SDREQUEST *request);
-+
-+void
-+hifIRQHandler(void *context);
-+
-+HIF_DEVICE *
-+addHifDevice(SDDEVICE *handle);
-+
-+HIF_DEVICE *
-+getHifDevice(SDDEVICE *handle);
-+
-+void
-+delHifDevice(SDDEVICE *handle);
-diff --git a/drivers/ar6000/htc/ar6k.c b/drivers/ar6000/htc/ar6k.c
-new file mode 100644
-index 0000000..72472ab
---- /dev/null
-+++ b/drivers/ar6000/htc/ar6k.c
-@@ -0,0 +1,991 @@
-+/*
-+ * AR6K device layer that handles register level I/O
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "hif.h"
-+#include "htc_packet.h"
-+#include "ar6k.h"
-+
-+#define MAILBOX_FOR_BLOCK_SIZE 1
-+
-+extern A_UINT32 resetok;
-+
-+static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev);
-+static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev);
-+
-+#define LOCK_AR6K(p)      A_MUTEX_LOCK(&(p)->Lock);
-+#define UNLOCK_AR6K(p)    A_MUTEX_UNLOCK(&(p)->Lock);
-+
-+void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket)
-+{
-+    LOCK_AR6K(pDev);
-+    HTC_PACKET_ENQUEUE(&pDev->RegisterIOList,pPacket);
-+    UNLOCK_AR6K(pDev);
-+}
-+
-+HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev)
-+{
-+    HTC_PACKET *pPacket;
-+
-+    LOCK_AR6K(pDev);
-+    pPacket = HTC_PACKET_DEQUEUE(&pDev->RegisterIOList);
-+    UNLOCK_AR6K(pDev);
-+
-+    return pPacket;
-+}
-+
-+A_STATUS DevSetup(AR6K_DEVICE *pDev)
-+{
-+    A_UINT32 mailboxaddrs[AR6K_MAILBOXES];
-+    A_UINT32 blocksizes[AR6K_MAILBOXES];
-+    A_STATUS status = A_OK;
-+    int      i;
-+
-+    AR_DEBUG_ASSERT(AR6K_IRQ_PROC_REGS_SIZE == 16);
-+    AR_DEBUG_ASSERT(AR6K_IRQ_ENABLE_REGS_SIZE == 4);
-+
-+    do {
-+            /* give a handle to HIF for this target */
-+        HIFSetHandle(pDev->HIFDevice, (void *)pDev);
-+            /* initialize our free list of IO packets */
-+        INIT_HTC_PACKET_QUEUE(&pDev->RegisterIOList);
-+        A_MUTEX_INIT(&pDev->Lock);
-+
-+            /* get the addresses for all 4 mailboxes */
-+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
-+                                    mailboxaddrs, sizeof(mailboxaddrs));
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* carve up register I/O packets (these are for ASYNC register I/O ) */
-+        for (i = 0; i < AR6K_MAX_REG_IO_BUFFERS; i++) {
-+            HTC_PACKET *pIOPacket;
-+            pIOPacket = &pDev->RegIOBuffers[i].HtcPacket;
-+            SET_HTC_PACKET_INFO_RX_REFILL(pIOPacket,
-+                                          pDev,
-+                                          pDev->RegIOBuffers[i].Buffer,
-+                                          AR6K_REG_IO_BUFFER_SIZE,
-+                                          0); /* don't care */
-+            AR6KFreeIOPacket(pDev,pIOPacket);
-+        }
-+
-+            /* get the address of the mailbox we are using */
-+        pDev->MailboxAddress = mailboxaddrs[HTC_MAILBOX];
-+
-+            /* get the block sizes */
-+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+                                    blocksizes, sizeof(blocksizes));
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* note: we actually get the block size of a mailbox other than 0, for SDIO the block
-+             * size on mailbox 0 is artificially set to 1.  So we use the block size that is set
-+             * for the other 3 mailboxes */
-+        pDev->BlockSize = blocksizes[MAILBOX_FOR_BLOCK_SIZE];
-+            /* must be a power of 2 */
-+        AR_DEBUG_ASSERT((pDev->BlockSize & (pDev->BlockSize - 1)) == 0);
-+
-+            /* assemble mask, used for padding to a block */
-+        pDev->BlockMask = pDev->BlockSize - 1;
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("BlockSize: %d, MailboxAddress:0x%X \n",
-+                    pDev->BlockSize, pDev->MailboxAddress));
-+
-+        pDev->GetPendingEventsFunc = NULL;
-+            /* see if the HIF layer implements the get pending events function  */
-+        HIFConfigureDevice(pDev->HIFDevice,
-+                           HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
-+                           &pDev->GetPendingEventsFunc,
-+                           sizeof(pDev->GetPendingEventsFunc));
-+
-+            /* assume we can process HIF interrupt events asynchronously */
-+        pDev->HifIRQProcessingMode = HIF_DEVICE_IRQ_ASYNC_SYNC;
-+
-+            /* see if the HIF layer overrides this assumption */
-+        HIFConfigureDevice(pDev->HIFDevice,
-+                           HIF_DEVICE_GET_IRQ_PROC_MODE,
-+                           &pDev->HifIRQProcessingMode,
-+                           sizeof(pDev->HifIRQProcessingMode));
-+
-+        switch (pDev->HifIRQProcessingMode) {
-+            case HIF_DEVICE_IRQ_SYNC_ONLY:
-+                AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is SYNC ONLY\n"));
-+                break;
-+            case HIF_DEVICE_IRQ_ASYNC_SYNC:
-+                AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is ASYNC and SYNC\n"));
-+                break;
-+            default:
-+                AR_DEBUG_ASSERT(FALSE);
-+        }
-+
-+        pDev->HifMaskUmaskRecvEvent = NULL;
-+
-+            /* see if the HIF layer implements the mask/unmask recv events function  */
-+        HIFConfigureDevice(pDev->HIFDevice,
-+                           HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
-+                           &pDev->HifMaskUmaskRecvEvent,
-+                           sizeof(pDev->HifMaskUmaskRecvEvent));
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF special overrides : 0x%X , 0x%X\n",
-+                 (A_UINT32)pDev->GetPendingEventsFunc, (A_UINT32)pDev->HifMaskUmaskRecvEvent));
-+
-+        status = DevDisableInterrupts(pDev);
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+            /* make sure handle is cleared */
-+        HIFSetHandle(pDev->HIFDevice, NULL);
-+    }
-+
-+    return status;
-+
-+}
-+
-+static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev)
-+{
-+    A_STATUS                  status;
-+    AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+    LOCK_AR6K(pDev);
-+
-+        /* Enable all the interrupts except for the dragon interrupt */
-+    pDev->IrqEnableRegisters.int_status_enable = INT_STATUS_ENABLE_ERROR_SET(0x01) |
-+                                      INT_STATUS_ENABLE_CPU_SET(0x01) |
-+                                      INT_STATUS_ENABLE_COUNTER_SET(0x01);
-+
-+    if (NULL == pDev->GetPendingEventsFunc) {
-+        pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+    } else {
-+        /* The HIF layer provided us with a pending events function which means that
-+         * the detection of pending mbox messages is handled in the HIF layer.
-+         * This is the case for the SPI2 interface.
-+         * In the normal case we enable MBOX interrupts, for the case
-+         * with HIFs that offer this mechanism, we keep these interrupts
-+         * masked */
-+        pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+    }
-+
-+
-+    /* Set up the CPU Interrupt Status Register */
-+    pDev->IrqEnableRegisters.cpu_int_status_enable = CPU_INT_STATUS_ENABLE_BIT_SET(0x00);
-+
-+    /* Set up the Error Interrupt Status Register */
-+    pDev->IrqEnableRegisters.error_status_enable =
-+                                  ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(0x01) |
-+                                  ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(0x01);
-+
-+    /* Set up the Counter Interrupt Status Register (only for debug interrupt to catch fatal errors) */
-+    pDev->IrqEnableRegisters.counter_int_status_enable =
-+        COUNTER_INT_STATUS_ENABLE_BIT_SET(AR6K_TARGET_DEBUG_INTR_MASK);
-+
-+        /* copy into our temp area */
-+    A_MEMCPY(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
-+
-+    UNLOCK_AR6K(pDev);
-+
-+        /* always synchronous */
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          INT_STATUS_ENABLE_ADDRESS,
-+                          &regs.int_status_enable,
-+                          AR6K_IRQ_ENABLE_REGS_SIZE,
-+                          HIF_WR_SYNC_BYTE_INC,
-+                          NULL);
-+
-+    if (status != A_OK) {
-+        /* Can't write it for some reason */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                        ("Failed to update interrupt control registers err: %d\n", status));
-+
-+    }
-+
-+    return status;
-+}
-+
-+static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev)
-+{
-+    AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+    LOCK_AR6K(pDev);
-+        /* Disable all interrupts */
-+    pDev->IrqEnableRegisters.int_status_enable = 0;
-+    pDev->IrqEnableRegisters.cpu_int_status_enable = 0;
-+    pDev->IrqEnableRegisters.error_status_enable = 0;
-+    pDev->IrqEnableRegisters.counter_int_status_enable = 0;
-+        /* copy into our temp area */
-+    A_MEMCPY(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
-+
-+    UNLOCK_AR6K(pDev);
-+
-+        /* always synchronous */
-+    return HIFReadWrite(pDev->HIFDevice,
-+                        INT_STATUS_ENABLE_ADDRESS,
-+                        &regs.int_status_enable,
-+                        AR6K_IRQ_ENABLE_REGS_SIZE,
-+                        HIF_WR_SYNC_BYTE_INC,
-+                        NULL);
-+}
-+
-+/* enable device interrupts */
-+A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev)
-+{
-+        /* Unmask the host controller interrupts */
-+    HIFUnMaskInterrupt(pDev->HIFDevice);
-+
-+    return DevEnableInterrupts(pDev);
-+}
-+
-+/* disable all device interrupts */
-+A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev)
-+{
-+    A_STATUS status;
-+
-+    status = DevDisableInterrupts(pDev);
-+
-+    if (A_SUCCESS(status)) {
-+            /* Disable the interrupt at the HIF layer */
-+        HIFMaskInterrupt(pDev->HIFDevice);
-+    }
-+
-+    return status;
-+}
-+
-+/* callback when our fetch to enable/disable completes */
-+static void DevDoEnableDisableRecvAsyncHandler(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDoEnableDisableRecvAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
-+
-+    if (A_FAILED(pPacket->Status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                (" Failed to disable receiver, status:%d \n", pPacket->Status));
-+    }
-+        /* free this IO packet */
-+    AR6KFreeIOPacket(pDev,pPacket);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDoEnableDisableRecvAsyncHandler \n"));
-+}
-+
-+/* disable packet reception (used in case the host runs out of buffers)
-+ * this is the "override" method when the HIF reports another methods to
-+ * disable recv events */
-+static A_STATUS DevDoEnableDisableRecvOverride(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
-+{
-+    A_STATUS                  status = A_OK;
-+    HTC_PACKET                *pIOPacket = NULL;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("DevDoEnableDisableRecvOverride: Enable:%d Mode:%d\n",
-+            EnableRecv,AsyncMode));
-+
-+    do {
-+
-+        if (AsyncMode) {
-+
-+            pIOPacket = AR6KAllocIOPacket(pDev);
-+
-+            if (NULL == pIOPacket) {
-+                status = A_NO_MEMORY;
-+                AR_DEBUG_ASSERT(FALSE);
-+                break;
-+            }
-+
-+                /* stick in our completion routine when the I/O operation completes */
-+            pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
-+            pIOPacket->pContext = pDev;
-+
-+                /* call the HIF layer override and do this asynchronously */
-+            status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
-+                                                 EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
-+                                                 pIOPacket);
-+            break;
-+        }
-+
-+            /* if we get here we are doing it synchronously */
-+        status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
-+                                             EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
-+                                             NULL);
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status) && (pIOPacket != NULL)) {
-+        AR6KFreeIOPacket(pDev,pIOPacket);
-+    }
-+
-+    return status;
-+}
-+
-+/* disable packet reception (used in case the host runs out of buffers)
-+ * this is the "normal" method using the interrupt enable registers through
-+ * the host I/F */
-+static A_STATUS DevDoEnableDisableRecvNormal(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
-+{
-+    A_STATUS                  status = A_OK;
-+    HTC_PACKET                *pIOPacket = NULL;
-+    AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+        /* take the lock to protect interrupt enable shadows */
-+    LOCK_AR6K(pDev);
-+
-+    if (EnableRecv) {
-+        pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+    } else {
-+        pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+    }
-+
-+        /* copy into our temp area */
-+    A_MEMCPY(&regs,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
-+    UNLOCK_AR6K(pDev);
-+
-+    do {
-+
-+        if (AsyncMode) {
-+
-+            pIOPacket = AR6KAllocIOPacket(pDev);
-+
-+            if (NULL == pIOPacket) {
-+                status = A_NO_MEMORY;
-+                AR_DEBUG_ASSERT(FALSE);
-+                break;
-+            }
-+
-+                /* copy values to write to our async I/O buffer */
-+            A_MEMCPY(pIOPacket->pBuffer,&regs,AR6K_IRQ_ENABLE_REGS_SIZE);
-+
-+                /* stick in our completion routine when the I/O operation completes */
-+            pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
-+            pIOPacket->pContext = pDev;
-+
-+                /* write it out asynchronously */
-+            HIFReadWrite(pDev->HIFDevice,
-+                         INT_STATUS_ENABLE_ADDRESS,
-+                         pIOPacket->pBuffer,
-+                         AR6K_IRQ_ENABLE_REGS_SIZE,
-+                         HIF_WR_ASYNC_BYTE_INC,
-+                         pIOPacket);
-+            break;
-+        }
-+
-+        /* if we get here we are doing it synchronously */
-+
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              INT_STATUS_ENABLE_ADDRESS,
-+                              &regs.int_status_enable,
-+                              AR6K_IRQ_ENABLE_REGS_SIZE,
-+                              HIF_WR_SYNC_BYTE_INC,
-+                              NULL);
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status) && (pIOPacket != NULL)) {
-+        AR6KFreeIOPacket(pDev,pIOPacket);
-+    }
-+
-+    return status;
-+}
-+
-+
-+A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
-+{
-+    if (NULL == pDev->HifMaskUmaskRecvEvent) {
-+        return DevDoEnableDisableRecvNormal(pDev,FALSE,AsyncMode);
-+    } else {
-+        return DevDoEnableDisableRecvOverride(pDev,FALSE,AsyncMode);
-+    }
-+}
-+
-+A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
-+{
-+    if (NULL == pDev->HifMaskUmaskRecvEvent) {
-+        return DevDoEnableDisableRecvNormal(pDev,TRUE,AsyncMode);
-+    } else {
-+        return DevDoEnableDisableRecvOverride(pDev,TRUE,AsyncMode);
-+    }
-+}
-+
-+void DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS   *pIrqProcRegs,
-+                      AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs)
-+{
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("\n<------- Register Table -------->\n"));
-+
-+    if (pIrqProcRegs != NULL) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Int Status:               0x%x\n",pIrqProcRegs->host_int_status));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("CPU Int Status:            0x%x\n",pIrqProcRegs->cpu_int_status));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Error Int Status:          0x%x\n",pIrqProcRegs->error_int_status));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Counter Int Status:        0x%x\n",pIrqProcRegs->counter_int_status));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Mbox Frame:                0x%x\n",pIrqProcRegs->mbox_frame));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Rx Lookahead Valid:        0x%x\n",pIrqProcRegs->rx_lookahead_valid));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Rx Lookahead 0:            0x%x\n",pIrqProcRegs->rx_lookahead[0]));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Rx Lookahead 1:            0x%x\n",pIrqProcRegs->rx_lookahead[1]));
-+    }
-+
-+    if (pIrqEnableRegs != NULL) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Int Status Enable:         0x%x\n",pIrqEnableRegs->int_status_enable));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+            ("Counter Int Status Enable: 0x%x\n",pIrqEnableRegs->counter_int_status_enable));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("<------------------------------->\n"));
-+    }
-+}
-+
-+
-+#ifdef MBOXHW_UNIT_TEST
-+
-+
-+/* This is a mailbox hardware unit test that must be called in a schedulable context
-+ * This test is very simple, it will send a list of buffers with a counting pattern
-+ * and the target will invert the data and send the message back
-+ *
-+ * the unit test has the following constraints:
-+ *
-+ * The target has at least 8 buffers of 256 bytes each. The host will send
-+ * the following pattern of buffers in rapid succession :
-+ *
-+ * 1 buffer - 128 bytes
-+ * 1 buffer - 256 bytes
-+ * 1 buffer - 512 bytes
-+ * 1 buffer - 1024 bytes
-+ *
-+ * The host will send the buffers to one mailbox and wait for buffers to be reflected
-+ * back from the same mailbox. The target sends the buffers FIFO order.
-+ * Once the final buffer has been received for a mailbox, the next mailbox is tested.
-+ *
-+ *
-+ * Note:  To simplifythe test , we assume that the chosen buffer sizes
-+ *        will fall on a nice block pad
-+ *
-+ * It is expected that higher-order tests will be written to stress the mailboxes using
-+ * a message-based protocol (with some performance timming) that can create more
-+ * randomness in the packets sent over mailboxes.
-+ *
-+ * */
-+
-+#define A_ROUND_UP_PWR2(x, align)    (((int) (x) + ((align)-1)) & ~((align)-1))
-+
-+#define BUFFER_BLOCK_PAD 128
-+
-+#if 0
-+#define BUFFER1 128
-+#define BUFFER2 256
-+#define BUFFER3 512
-+#define BUFFER4 1024
-+#endif
-+
-+#if 1
-+#define BUFFER1 80
-+#define BUFFER2 200
-+#define BUFFER3 444
-+#define BUFFER4 800
-+#endif
-+
-+#define TOTAL_BYTES (A_ROUND_UP_PWR2(BUFFER1,BUFFER_BLOCK_PAD) + \
-+                     A_ROUND_UP_PWR2(BUFFER2,BUFFER_BLOCK_PAD) + \
-+                     A_ROUND_UP_PWR2(BUFFER3,BUFFER_BLOCK_PAD) + \
-+                     A_ROUND_UP_PWR2(BUFFER4,BUFFER_BLOCK_PAD) )
-+
-+#define TEST_BYTES (BUFFER1 +  BUFFER2 + BUFFER3 + BUFFER4)
-+
-+#define TEST_CREDITS_RECV_TIMEOUT 100
-+
-+static A_UINT8  g_Buffer[TOTAL_BYTES];
-+static A_UINT32 g_MailboxAddrs[AR6K_MAILBOXES];
-+static A_UINT32 g_BlockSizes[AR6K_MAILBOXES];
-+
-+#define BUFFER_PROC_LIST_DEPTH 4
-+
-+typedef struct _BUFFER_PROC_LIST{
-+    A_UINT8  *pBuffer;
-+    A_UINT32 length;
-+}BUFFER_PROC_LIST;
-+
-+
-+#define PUSH_BUFF_PROC_ENTRY(pList,len,pCurrpos) \
-+{                                                   \
-+    (pList)->pBuffer = (pCurrpos);                  \
-+    (pList)->length = (len);                        \
-+    (pCurrpos) += (len);                            \
-+    (pList)++;                                      \
-+}
-+
-+/* a simple and crude way to send different "message" sizes */
-+static void AssembleBufferList(BUFFER_PROC_LIST *pList)
-+{
-+    A_UINT8 *pBuffer = g_Buffer;
-+
-+#if BUFFER_PROC_LIST_DEPTH < 4
-+#error "Buffer processing list depth is not deep enough!!"
-+#endif
-+
-+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER1,pBuffer);
-+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER2,pBuffer);
-+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER3,pBuffer);
-+    PUSH_BUFF_PROC_ENTRY(pList,BUFFER4,pBuffer);
-+
-+}
-+
-+#define FILL_ZERO     TRUE
-+#define FILL_COUNTING FALSE
-+static void InitBuffers(A_BOOL Zero)
-+{
-+    A_UINT16 *pBuffer16 = (A_UINT16 *)g_Buffer;
-+    int      i;
-+
-+        /* fill buffer with 16 bit counting pattern or zeros */
-+    for (i = 0; i <  (TOTAL_BYTES / 2) ; i++) {
-+        if (!Zero) {
-+            pBuffer16[i] = (A_UINT16)i;
-+        } else {
-+            pBuffer16[i] = 0;
-+        }
-+    }
-+}
-+
-+
-+static A_BOOL CheckOneBuffer(A_UINT16 *pBuffer16, int Length)
-+{
-+    int      i;
-+    A_UINT16 startCount;
-+    A_BOOL   success = TRUE;
-+
-+        /* get the starting count */
-+    startCount = pBuffer16[0];
-+        /* invert it, this is the expected value */
-+    startCount = ~startCount;
-+        /* scan the buffer and verify */
-+    for (i = 0; i < (Length / 2) ; i++,startCount++) {
-+            /* target will invert all the data */
-+        if ((A_UINT16)pBuffer16[i] != (A_UINT16)~startCount) {
-+            success = FALSE;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Data Got:0x%X, Expecting:0x%X (offset:%d, total:%d) \n",
-+                        pBuffer16[i], ((A_UINT16)~startCount), i, Length));
-+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("0x%X 0x%X 0x%X 0x%X \n",
-+                        pBuffer16[i], pBuffer16[i + 1], pBuffer16[i + 2],pBuffer16[i+3]));
-+            break;
-+        }
-+    }
-+
-+    return success;
-+}
-+
-+static A_BOOL CheckBuffers(void)
-+{
-+    int      i;
-+    A_BOOL   success = TRUE;
-+    BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
-+
-+        /* assemble the list */
-+    AssembleBufferList(checkList);
-+
-+        /* scan the buffers and verify */
-+    for (i = 0; i < BUFFER_PROC_LIST_DEPTH ; i++) {
-+        success = CheckOneBuffer((A_UINT16 *)checkList[i].pBuffer, checkList[i].length);
-+        if (!success) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer : 0x%X, Length:%d failed verify \n",
-+                        (A_UINT32)checkList[i].pBuffer, checkList[i].length));
-+            break;
-+        }
-+    }
-+
-+    return success;
-+}
-+
-+    /* find the end marker for the last buffer we will be sending */
-+static A_UINT16 GetEndMarker(void)
-+{
-+    A_UINT8  *pBuffer;
-+    BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
-+
-+        /* fill up buffers with the normal counting pattern */
-+    InitBuffers(FILL_COUNTING);
-+
-+        /* assemble the list we will be sending down */
-+    AssembleBufferList(checkList);
-+        /* point to the last 2 bytes of the last buffer */
-+    pBuffer = &(checkList[BUFFER_PROC_LIST_DEPTH - 1].pBuffer[(checkList[BUFFER_PROC_LIST_DEPTH - 1].length) - 2]);
-+
-+        /* the last count in the last buffer is the marker */
-+    return (A_UINT16)pBuffer[0] | ((A_UINT16)pBuffer[1] << 8);
-+}
-+
-+#define ATH_PRINT_OUT_ZONE ATH_DEBUG_ERR
-+
-+/* send the ordered buffers to the target */
-+static A_STATUS SendBuffers(AR6K_DEVICE *pDev, int mbox)
-+{
-+    A_STATUS         status = A_OK;
-+    A_UINT32         request = HIF_WR_SYNC_BLOCK_INC;
-+    BUFFER_PROC_LIST sendList[BUFFER_PROC_LIST_DEPTH];
-+    int              i;
-+    int              totalBytes = 0;
-+    int              paddedLength;
-+    int              totalwPadding = 0;
-+
-+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sending buffers on mailbox : %d \n",mbox));
-+
-+        /* fill buffer with counting pattern */
-+    InitBuffers(FILL_COUNTING);
-+
-+        /* assemble the order in which we send */
-+    AssembleBufferList(sendList);
-+
-+    for (i = 0; i < BUFFER_PROC_LIST_DEPTH; i++) {
-+
-+            /* we are doing block transfers, so we need to pad everything to a block size */
-+        paddedLength = (sendList[i].length + (g_BlockSizes[mbox] - 1)) &
-+                       (~(g_BlockSizes[mbox] - 1));
-+
-+            /* send each buffer synchronously */
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              g_MailboxAddrs[mbox],
-+                              sendList[i].pBuffer,
-+                              paddedLength,
-+                              request,
-+                              NULL);
-+        if (status != A_OK) {
-+            break;
-+        }
-+        totalBytes += sendList[i].length;
-+        totalwPadding += paddedLength;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sent %d bytes (%d padded bytes) to mailbox : %d \n",totalBytes,totalwPadding,mbox));
-+
-+    return status;
-+}
-+
-+/* poll the mailbox credit counter until we get a credit or timeout */
-+static A_STATUS GetCredits(AR6K_DEVICE *pDev, int mbox, int *pCredits)
-+{
-+    A_STATUS status = A_OK;
-+    int      timeout = TEST_CREDITS_RECV_TIMEOUT;
-+    A_UINT8  credits = 0;
-+    A_UINT32 address;
-+
-+    while (TRUE) {
-+
-+            /* Read the counter register to get credits, this auto-decrements  */
-+        address = COUNT_DEC_ADDRESS + (AR6K_MAILBOXES + mbox) * 4;
-+        status = HIFReadWrite(pDev->HIFDevice, address, &credits, sizeof(credits),
-+                              HIF_RD_SYNC_BYTE_FIX, NULL);
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                ("Unable to decrement the command credit count register (mbox=%d)\n",mbox));
-+            status = A_ERROR;
-+            break;
-+        }
-+
-+        if (credits) {
-+            break;
-+        }
-+
-+        timeout--;
-+
-+        if (timeout <= 0) {
-+              AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                (" Timeout reading credit registers (mbox=%d, address:0x%X) \n",mbox,address));
-+            status = A_ERROR;
-+            break;
-+        }
-+
-+         /* delay a little, target may not be ready */
-+         msleep(1000);
-+
-+    }
-+
-+    if (status == A_OK) {
-+        *pCredits = credits;
-+    }
-+
-+    return status;
-+}
-+
-+
-+/* wait for the buffers to come back */
-+static A_STATUS RecvBuffers(AR6K_DEVICE *pDev, int mbox)
-+{
-+    A_STATUS         status = A_OK;
-+    A_UINT32         request = HIF_RD_SYNC_BLOCK_INC;
-+    BUFFER_PROC_LIST recvList[BUFFER_PROC_LIST_DEPTH];
-+    int              curBuffer;
-+    int              credits;
-+    int              i;
-+    int              totalBytes = 0;
-+    int              paddedLength;
-+    int              totalwPadding = 0;
-+
-+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for buffers on mailbox : %d \n",mbox));
-+
-+        /* zero the buffers */
-+    InitBuffers(FILL_ZERO);
-+
-+        /* assemble the order in which we should receive */
-+    AssembleBufferList(recvList);
-+
-+    curBuffer = 0;
-+
-+    while (curBuffer < BUFFER_PROC_LIST_DEPTH) {
-+
-+            /* get number of buffers that have been completed, this blocks
-+             * until we get at least 1 credit or it times out */
-+        status = GetCredits(pDev, mbox, &credits);
-+
-+        if (status != A_OK) {
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got %d messages on mailbox : %d \n",credits, mbox));
-+
-+            /* get all the buffers that are sitting on the queue */
-+        for (i = 0; i < credits; i++) {
-+            AR_DEBUG_ASSERT(curBuffer < BUFFER_PROC_LIST_DEPTH);
-+                /* recv the current buffer synchronously, the buffers should come back in
-+                 * order... with padding applied by the target */
-+            paddedLength = (recvList[curBuffer].length + (g_BlockSizes[mbox] - 1)) &
-+                       (~(g_BlockSizes[mbox] - 1));
-+
-+            status = HIFReadWrite(pDev->HIFDevice,
-+                                  g_MailboxAddrs[mbox],
-+                                  recvList[curBuffer].pBuffer,
-+                                  paddedLength,
-+                                  request,
-+                                  NULL);
-+            if (status != A_OK) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to read %d bytes on mailbox:%d : address:0x%X \n",
-+                        recvList[curBuffer].length, mbox, g_MailboxAddrs[mbox]));
-+                break;
-+            }
-+
-+            totalwPadding += paddedLength;
-+            totalBytes += recvList[curBuffer].length;
-+            curBuffer++;
-+        }
-+
-+        if (status != A_OK) {
-+            break;
-+        }
-+            /* go back and get some more */
-+        credits = 0;
-+    }
-+
-+    if (totalBytes != TEST_BYTES) {
-+        AR_DEBUG_ASSERT(FALSE);
-+    }  else {
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got all buffers on mbox:%d total recv :%d (w/Padding : %d) \n",
-+            mbox, totalBytes, totalwPadding));
-+    }
-+
-+    return status;
-+
-+
-+}
-+
-+static A_STATUS DoOneMboxHWTest(AR6K_DEVICE *pDev, int mbox)
-+{
-+    A_STATUS status;
-+
-+    do {
-+            /* send out buffers */
-+        status = SendBuffers(pDev,mbox);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Sending buffers Failed : %d mbox:%d\n",status,mbox));
-+            break;
-+        }
-+
-+            /* go get them, this will block */
-+        status =  RecvBuffers(pDev, mbox);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Recv buffers Failed : %d mbox:%d\n",status,mbox));
-+            break;
-+        }
-+
-+            /* check the returned data patterns */
-+        if (!CheckBuffers()) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer Verify Failed : mbox:%d\n",mbox));
-+            status = A_ERROR;
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" Send/Recv success! mailbox : %d \n",mbox));
-+
-+    }  while (FALSE);
-+
-+    return status;
-+}
-+
-+/* here is where the test starts */
-+A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev)
-+{
-+    int      i;
-+    A_STATUS status;
-+    int      credits = 0;
-+    A_UINT8  params[4];
-+    int      numBufs;
-+    int      bufferSize;
-+    A_UINT16 temp;
-+
-+
-+    AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest START -  \n"));
-+
-+    do {
-+            /* get the addresses for all 4 mailboxes */
-+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
-+                                    g_MailboxAddrs, sizeof(g_MailboxAddrs));
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* get the block sizes */
-+        status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+                                    g_BlockSizes, sizeof(g_BlockSizes));
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* note, the HIF layer usually reports mbox 0 to have a block size of
-+             * 1, but our test wants to run in block-mode for all mailboxes, so we treat all mailboxes
-+             * the same. */
-+        g_BlockSizes[0] = g_BlockSizes[1];
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Block Size to use: %d \n",g_BlockSizes[0]));
-+
-+        if (g_BlockSizes[1] > BUFFER_BLOCK_PAD) {
-+            AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("%d Block size is too large for buffer pad %d\n",
-+                g_BlockSizes[1], BUFFER_BLOCK_PAD));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for target.... \n"));
-+
-+            /* the target lets us know it is ready by giving us 1 credit on
-+             * mailbox 0 */
-+        status = GetCredits(pDev, 0, &credits);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait for target ready \n"));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Target is ready ...\n"));
-+
-+            /* read the first 4 scratch registers */
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              SCRATCH_ADDRESS,
-+                              params,
-+                              4,
-+                              HIF_RD_SYNC_BYTE_INC,
-+                              NULL);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait get parameters \n"));
-+            break;
-+        }
-+
-+        numBufs = params[0];
-+        bufferSize = (int)(((A_UINT16)params[2] << 8) | (A_UINT16)params[1]);
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE,
-+            ("Target parameters: bufs per mailbox:%d, buffer size:%d bytes (total space: %d, minimum required space (w/padding): %d) \n",
-+            numBufs, bufferSize, (numBufs * bufferSize), TOTAL_BYTES));
-+
-+        if ((numBufs * bufferSize) < TOTAL_BYTES) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Not Enough buffer space to run test! need:%d, got:%d \n",
-+                TOTAL_BYTES, (numBufs*bufferSize)));
-+            status = A_ERROR;
-+            break;
-+        }
-+
-+        temp = GetEndMarker();
-+
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              SCRATCH_ADDRESS + 4,
-+                              (A_UINT8 *)&temp,
-+                              2,
-+                              HIF_WR_SYNC_BYTE_INC,
-+                              NULL);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write end marker \n"));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("End Marker: 0x%X \n",temp));
-+
-+        temp = (A_UINT16)g_BlockSizes[1];
-+            /* convert to a mask */
-+        temp = temp - 1;
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              SCRATCH_ADDRESS + 6,
-+                              (A_UINT8 *)&temp,
-+                              2,
-+                              HIF_WR_SYNC_BYTE_INC,
-+                              NULL);
-+
-+        if (status != A_OK) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write block mask \n"));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Set Block Mask: 0x%X \n",temp));
-+
-+            /* execute the test on each mailbox */
-+        for (i = 0; i < AR6K_MAILBOXES; i++) {
-+            status = DoOneMboxHWTest(pDev, i);
-+            if (status != A_OK) {
-+                break;
-+            }
-+        }
-+
-+    } while (FALSE);
-+
-+    if (status == A_OK) {
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - SUCCESS! -  \n"));
-+    } else {
-+        AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - FAILED! -  \n"));
-+    }
-+        /* don't let HTC_Start continue, the target is actually not running any HTC code */
-+    return A_ERROR;
-+}
-+#endif
-+
-+
-+
-diff --git a/drivers/ar6000/htc/ar6k.h b/drivers/ar6000/htc/ar6k.h
-new file mode 100644
-index 0000000..301ab34
---- /dev/null
-+++ b/drivers/ar6000/htc/ar6k.h
-@@ -0,0 +1,191 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef AR6K_H_
-+#define AR6K_H_
-+
-+#define AR6K_MAILBOXES 4
-+
-+/* HTC runs over mailbox 0 */
-+#define HTC_MAILBOX          0
-+
-+#define AR6K_TARGET_DEBUG_INTR_MASK     0x01
-+
-+#define OTHER_INTS_ENABLED (INT_STATUS_ENABLE_ERROR_MASK |   \
-+                            INT_STATUS_ENABLE_CPU_MASK   |   \
-+                            INT_STATUS_ENABLE_COUNTER_MASK)
-+
-+//#define MBOXHW_UNIT_TEST 1
-+
-+#include "athstartpack.h"
-+typedef PREPACK struct _AR6K_IRQ_PROC_REGISTERS {
-+    A_UINT8                      host_int_status;
-+    A_UINT8                      cpu_int_status;
-+    A_UINT8                      error_int_status;
-+    A_UINT8                      counter_int_status;
-+    A_UINT8                      mbox_frame;
-+    A_UINT8                      rx_lookahead_valid;
-+    A_UINT8                      hole[2];
-+    A_UINT32                     rx_lookahead[2];
-+} POSTPACK AR6K_IRQ_PROC_REGISTERS;
-+
-+#define AR6K_IRQ_PROC_REGS_SIZE sizeof(AR6K_IRQ_PROC_REGISTERS)
-+
-+
-+
-+typedef PREPACK struct _AR6K_IRQ_ENABLE_REGISTERS {
-+    A_UINT8                      int_status_enable;
-+    A_UINT8                      cpu_int_status_enable;
-+    A_UINT8                      error_status_enable;
-+    A_UINT8                      counter_int_status_enable;
-+} POSTPACK AR6K_IRQ_ENABLE_REGISTERS;
-+
-+#include "athendpack.h"
-+
-+#define AR6K_IRQ_ENABLE_REGS_SIZE sizeof(AR6K_IRQ_ENABLE_REGISTERS)
-+
-+#define AR6K_REG_IO_BUFFER_SIZE     32
-+#define AR6K_MAX_REG_IO_BUFFERS     8
-+
-+/* buffers for ASYNC I/O */
-+typedef struct AR6K_ASYNC_REG_IO_BUFFER {
-+    HTC_PACKET    HtcPacket;   /* we use an HTC packet as a wrapper for our async register-based I/O */
-+    A_UINT8       Buffer[AR6K_REG_IO_BUFFER_SIZE];
-+} AR6K_ASYNC_REG_IO_BUFFER;
-+
-+typedef struct _AR6K_DEVICE {
-+    A_MUTEX_T                   Lock;
-+    AR6K_IRQ_PROC_REGISTERS     IrqProcRegisters;
-+    AR6K_IRQ_ENABLE_REGISTERS   IrqEnableRegisters;
-+    void                        *HIFDevice;
-+    A_UINT32                    BlockSize;
-+    A_UINT32                    BlockMask;
-+    A_UINT32                    MailboxAddress;
-+    HIF_PENDING_EVENTS_FUNC     GetPendingEventsFunc;
-+    void                        *HTCContext;
-+    HTC_PACKET_QUEUE            RegisterIOList;
-+    AR6K_ASYNC_REG_IO_BUFFER    RegIOBuffers[AR6K_MAX_REG_IO_BUFFERS];
-+    void                        (*TargetFailureCallback)(void *Context);
-+    A_STATUS                    (*MessagePendingCallback)(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
-+    HIF_DEVICE_IRQ_PROCESSING_MODE  HifIRQProcessingMode;
-+    HIF_MASK_UNMASK_RECV_EVENT      HifMaskUmaskRecvEvent;
-+} AR6K_DEVICE;
-+
-+#define IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(pDev) ((pDev)->HifIRQProcessingMode != HIF_DEVICE_IRQ_SYNC_ONLY)
-+
-+A_STATUS DevSetup(AR6K_DEVICE *pDev);
-+A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev);
-+A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev);
-+A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
-+                            A_UINT32    *pLookAhead,
-+                            int          TimeoutMS);
-+A_STATUS DevRWCompletionHandler(void *context, A_STATUS status);
-+A_STATUS DevDsrHandler(void *context);
-+A_STATUS DevCheckPendingRecvMsgsAsync(void *context);
-+void     DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS   *pIrqProcRegs,
-+                          AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs);
-+
-+#define DEV_STOP_RECV_ASYNC TRUE
-+#define DEV_STOP_RECV_SYNC  FALSE
-+#define DEV_ENABLE_RECV_ASYNC TRUE
-+#define DEV_ENABLE_RECV_SYNC  FALSE
-+A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
-+A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
-+
-+static INLINE A_STATUS DevSendPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 SendLength) {
-+    A_UINT32 paddedLength;
-+    A_BOOL   sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
-+    A_STATUS status;
-+
-+       /* adjust the length to be a multiple of block size if appropriate */
-+    paddedLength = (SendLength + (pDev->BlockMask)) &
-+                    (~(pDev->BlockMask));
-+#if 0 // BufferLength may not be set in , fix this...
-+    if (paddedLength > pPacket->BufferLength) {
-+        AR_DEBUG_ASSERT(FALSE);
-+        if (pPacket->Completion != NULL) {
-+            COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
-+        }
-+        return A_EINVAL;
-+    }
-+#endif
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+                ("DevSendPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
-+                paddedLength,
-+                pDev->MailboxAddress,
-+                sync ? "SYNC" : "ASYNC"));
-+
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          pDev->MailboxAddress,
-+                          pPacket->pBuffer,
-+                          paddedLength,     /* the padded length */
-+                          sync ? HIF_WR_SYNC_BLOCK_INC : HIF_WR_ASYNC_BLOCK_INC,
-+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
-+
-+    if (sync) {
-+        pPacket->Status = status;
-+    }
-+
-+    return status;
-+}
-+
-+static INLINE A_STATUS DevRecvPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 RecvLength) {
-+    A_UINT32 paddedLength;
-+    A_STATUS status;
-+    A_BOOL   sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
-+
-+        /* adjust the length to be a multiple of block size if appropriate */
-+    paddedLength = (RecvLength + (pDev->BlockMask)) &
-+                    (~(pDev->BlockMask));
-+    if (paddedLength > pPacket->BufferLength) {
-+        AR_DEBUG_ASSERT(FALSE);
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                ("DevRecvPacket, Not enough space for padlen:%d recvlen:%d bufferlen:%d \n",
-+                    paddedLength,RecvLength,pPacket->BufferLength));
-+        if (pPacket->Completion != NULL) {
-+            COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
-+        }
-+        return A_EINVAL;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+                ("DevRecvPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
-+                paddedLength,
-+                pDev->MailboxAddress,
-+                sync ? "SYNC" : "ASYNC"));
-+
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          pDev->MailboxAddress,
-+                          pPacket->pBuffer,
-+                          paddedLength,
-+                          sync ? HIF_RD_SYNC_BLOCK_INC : HIF_RD_ASYNC_BLOCK_INC,
-+                          sync ? NULL : pPacket);  /* pass the packet as the context to the HIF request */
-+
-+    if (sync) {
-+        pPacket->Status = status;
-+    }
-+
-+    return status;
-+}
-+
-+#ifdef MBOXHW_UNIT_TEST
-+A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev);
-+#endif
-+
-+#endif /*AR6K_H_*/
-diff --git a/drivers/ar6000/htc/ar6k_events.c b/drivers/ar6000/htc/ar6k_events.c
-new file mode 100644
-index 0000000..91b29af
---- /dev/null
-+++ b/drivers/ar6000/htc/ar6k_events.c
-@@ -0,0 +1,638 @@
-+/*
-+ * AR6K Driver layer event handling (i.e. interrupts, message polling)
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "hif.h"
-+#include "htc_packet.h"
-+#include "ar6k.h"
-+
-+extern void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket);
-+extern HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev);
-+
-+static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev);
-+
-+#define DELAY_PER_INTERVAL_MS 10  /* 10 MS delay per polling interval */
-+
-+/* completion routine for ALL HIF layer async I/O */
-+A_STATUS DevRWCompletionHandler(void *context, A_STATUS status)
-+{
-+    HTC_PACKET *pPacket = (HTC_PACKET *)context;
-+
-+    COMPLETE_HTC_PACKET(pPacket,status);
-+
-+    return A_OK;
-+}
-+
-+/* mailbox recv message polling */
-+A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
-+                            A_UINT32    *pLookAhead,
-+                            int          TimeoutMS)
-+{
-+    A_STATUS status = A_OK;
-+    int      timeout = TimeoutMS/DELAY_PER_INTERVAL_MS;
-+
-+    AR_DEBUG_ASSERT(timeout > 0);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+DevPollMboxMsgRecv \n"));
-+
-+    while (TRUE) {
-+
-+        if (pDev->GetPendingEventsFunc != NULL)
-+		{
-+
-+            HIF_PENDING_EVENTS_INFO events;
-+
-+            /* the HIF layer uses a special mechanism to get events, do this
-+             * synchronously */
-+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+                                            &events,
-+                                            NULL);
-+            if (A_FAILED(status))
-+			{
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to get pending events \n"));
-+				break;
-+            }
-+
-+            if (events.Events & HIF_RECV_MSG_AVAIL)
-+			{
-+                    /*  there is a message available, the lookahead should be valid now */
-+                *pLookAhead = events.LookAhead;
-+
-+                break;
-+            }
-+        }
-+		else
-+		{
-+
-+                /* this is the standard HIF way.... */
-+                /* load the register table */
-+            status = HIFReadWrite(pDev->HIFDevice,
-+                                  HOST_INT_STATUS_ADDRESS,
-+                                  (A_UINT8 *)&pDev->IrqProcRegisters,
-+                                  AR6K_IRQ_PROC_REGS_SIZE,
-+                                  HIF_RD_SYNC_BYTE_INC,
-+                                  NULL);
-+
-+            if (A_FAILED(status))
-+			{
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to read register table \n"));
-+                break;
-+            }
-+
-+                /* check for MBOX data and valid lookahead */
-+            if (pDev->IrqProcRegisters.host_int_status & (1 << HTC_MAILBOX))
-+			{
-+                if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX))
-+				{
-+                    /* mailbox has a message and the look ahead is valid */
-+                    *pLookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
-+                    break;
-+                }
-+            }
-+
-+        }
-+
-+        timeout--;
-+
-+        if (timeout <= 0)
-+		{
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Timeout waiting for recv message \n"));
-+            status = A_ERROR;
-+
-+                /* check if the target asserted */
-+            if ( pDev->IrqProcRegisters.counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
-+                    /* target signaled an assert, process this pending interrupt
-+                     * this will call the target failure handler */
-+                DevServiceDebugInterrupt(pDev);
-+            }
-+
-+            break;
-+        }
-+
-+            /* delay a little  */
-+         msleep(DELAY_PER_INTERVAL_MS);
-+         AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("  Retry Mbox Poll : %d \n",timeout));
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-DevPollMboxMsgRecv \n"));
-+
-+    return status;
-+}
-+
-+static A_STATUS DevServiceCPUInterrupt(AR6K_DEVICE *pDev)
-+{
-+    A_STATUS status;
-+    A_UINT8  cpu_int_status;
-+    A_UINT8  regBuffer[4];
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("CPU Interrupt\n"));
-+    cpu_int_status = pDev->IrqProcRegisters.cpu_int_status &
-+                     pDev->IrqEnableRegisters.cpu_int_status_enable;
-+    AR_DEBUG_ASSERT(cpu_int_status);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                    ("Valid interrupt source(s) in CPU_INT_STATUS: 0x%x\n",
-+                    cpu_int_status));
-+
-+        /* Clear the interrupt */
-+    pDev->IrqProcRegisters.cpu_int_status &= ~cpu_int_status; /* W1C */
-+
-+        /* set up the register transfer buffer to hit the register 4 times , this is done
-+         * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
-+         * restrict bus transfer lengths to be a multiple of 4-bytes */
-+
-+        /* set W1C value to clear the interrupt, this hits the register first */
-+    regBuffer[0] = cpu_int_status;
-+        /* the remaining 4 values are set to zero which have no-effect  */
-+    regBuffer[1] = 0;
-+    regBuffer[2] = 0;
-+    regBuffer[3] = 0;
-+
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          CPU_INT_STATUS_ADDRESS,
-+                          regBuffer,
-+                          4,
-+                          HIF_WR_SYNC_BYTE_FIX,
-+                          NULL);
-+
-+    AR_DEBUG_ASSERT(status == A_OK);
-+    return status;
-+}
-+
-+
-+static A_STATUS DevServiceErrorInterrupt(AR6K_DEVICE *pDev)
-+{
-+    A_STATUS status;
-+    A_UINT8  error_int_status;
-+    A_UINT8  regBuffer[4];
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error Interrupt\n"));
-+    error_int_status = pDev->IrqProcRegisters.error_int_status & 0x0F;
-+    AR_DEBUG_ASSERT(error_int_status);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                    ("Valid interrupt source(s) in ERROR_INT_STATUS: 0x%x\n",
-+                    error_int_status));
-+
-+    if (ERROR_INT_STATUS_WAKEUP_GET(error_int_status)) {
-+        /* Wakeup */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error : Wakeup\n"));
-+    }
-+
-+    if (ERROR_INT_STATUS_RX_UNDERFLOW_GET(error_int_status)) {
-+        /* Rx Underflow */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Rx Underflow\n"));
-+    }
-+
-+    if (ERROR_INT_STATUS_TX_OVERFLOW_GET(error_int_status)) {
-+        /* Tx Overflow */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Tx Overflow\n"));
-+    }
-+
-+        /* Clear the interrupt */
-+    pDev->IrqProcRegisters.error_int_status &= ~error_int_status; /* W1C */
-+
-+        /* set up the register transfer buffer to hit the register 4 times , this is done
-+         * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
-+         * restrict bus transfer lengths to be a multiple of 4-bytes */
-+
-+        /* set W1C value to clear the interrupt, this hits the register first */
-+    regBuffer[0] = error_int_status;
-+        /* the remaining 4 values are set to zero which have no-effect  */
-+    regBuffer[1] = 0;
-+    regBuffer[2] = 0;
-+    regBuffer[3] = 0;
-+
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          ERROR_INT_STATUS_ADDRESS,
-+                          regBuffer,
-+                          4,
-+                          HIF_WR_SYNC_BYTE_FIX,
-+                          NULL);
-+
-+    AR_DEBUG_ASSERT(status == A_OK);
-+    return status;
-+}
-+
-+static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev)
-+{
-+    A_UINT32 dummy;
-+    A_STATUS status;
-+
-+    /* Send a target failure event to the application */
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Target debug interrupt\n"));
-+
-+    if (pDev->TargetFailureCallback != NULL) {
-+        pDev->TargetFailureCallback(pDev->HTCContext);
-+    }
-+
-+    /* clear the interrupt , the debug error interrupt is
-+     * counter 0 */
-+        /* read counter to clear interrupt */
-+    status = HIFReadWrite(pDev->HIFDevice,
-+                          COUNT_DEC_ADDRESS,
-+                          (A_UINT8 *)&dummy,
-+                          4,
-+                          HIF_RD_SYNC_BYTE_INC,
-+                          NULL);
-+
-+    AR_DEBUG_ASSERT(status == A_OK);
-+    return status;
-+}
-+
-+static A_STATUS DevServiceCounterInterrupt(AR6K_DEVICE *pDev)
-+{
-+    A_UINT8 counter_int_status;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Counter Interrupt\n"));
-+
-+    counter_int_status = pDev->IrqProcRegisters.counter_int_status &
-+                         pDev->IrqEnableRegisters.counter_int_status_enable;
-+
-+    AR_DEBUG_ASSERT(counter_int_status);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                    ("Valid interrupt source(s) in COUNTER_INT_STATUS: 0x%x\n",
-+                    counter_int_status));
-+
-+    /* Check if the debug interrupt is pending */
-+    if (counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
-+        return DevServiceDebugInterrupt(pDev);
-+    }
-+
-+    return A_OK;
-+}
-+
-+/* callback when our fetch to get interrupt status registers completes */
-+static void DevGetEventAsyncHandler(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
-+    A_UINT32    lookAhead = 0;
-+    A_BOOL      otherInts = FALSE;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGetEventAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
-+
-+    do {
-+
-+        if (A_FAILED(pPacket->Status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    (" GetEvents I/O request failed, status:%d \n", pPacket->Status));
-+            /* bail out, don't unmask HIF interrupt */
-+            break;
-+        }
-+
-+        if (pDev->GetPendingEventsFunc != NULL) {
-+                /* the HIF layer collected the information for us */
-+            HIF_PENDING_EVENTS_INFO *pEvents = (HIF_PENDING_EVENTS_INFO *)pPacket->pBuffer;
-+            if (pEvents->Events & HIF_RECV_MSG_AVAIL) {
-+                lookAhead = pEvents->LookAhead;
-+                if (0 == lookAhead) {
-+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler1, lookAhead is zero! \n"));
-+                }
-+            }
-+            if (pEvents->Events & HIF_OTHER_EVENTS) {
-+                otherInts = TRUE;
-+            }
-+        } else {
-+                /* standard interrupt table handling.... */
-+            AR6K_IRQ_PROC_REGISTERS *pReg = (AR6K_IRQ_PROC_REGISTERS *)pPacket->pBuffer;
-+            A_UINT8                 host_int_status;
-+
-+            host_int_status = pReg->host_int_status & pDev->IrqEnableRegisters.int_status_enable;
-+
-+            if (host_int_status & (1 << HTC_MAILBOX)) {
-+                host_int_status &= ~(1 << HTC_MAILBOX);
-+                if (pReg->rx_lookahead_valid & (1 << HTC_MAILBOX)) {
-+                        /* mailbox has a message and the look ahead is valid */
-+                    lookAhead = pReg->rx_lookahead[HTC_MAILBOX];
-+                    if (0 == lookAhead) {
-+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler2, lookAhead is zero! \n"));
-+                    }
-+                }
-+            }
-+
-+            if (host_int_status) {
-+                    /* there are other interrupts to handle */
-+                otherInts = TRUE;
-+            }
-+        }
-+
-+        if (otherInts || (lookAhead == 0)) {
-+            /* if there are other interrupts to process, we cannot do this in the async handler so
-+             * ack the interrupt which will cause our sync handler to run again
-+             * if however there are no more messages, we can now ack the interrupt  */
-+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                (" Acking interrupt from DevGetEventAsyncHandler (otherints:%d, lookahead:0x%X)\n",
-+                otherInts, lookAhead));
-+            HIFAckInterrupt(pDev->HIFDevice);
-+        } else {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                    (" DevGetEventAsyncHandler : detected another message, lookahead :0x%X \n",
-+                    lookAhead));
-+                /* lookahead is non-zero and there are no other interrupts to service,
-+                 * go get the next message */
-+            pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, NULL);
-+        }
-+
-+    } while (FALSE);
-+
-+        /* free this IO packet */
-+    AR6KFreeIOPacket(pDev,pPacket);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGetEventAsyncHandler \n"));
-+}
-+
-+/* called by the HTC layer when it wants us to check if the device has any more pending
-+ * recv messages, this starts off a series of async requests to read interrupt registers  */
-+A_STATUS DevCheckPendingRecvMsgsAsync(void *context)
-+{
-+    AR6K_DEVICE  *pDev = (AR6K_DEVICE *)context;
-+    A_STATUS      status = A_OK;
-+    HTC_PACKET   *pIOPacket;
-+
-+    /* this is called in an ASYNC only context, we may NOT block, sleep or call any apis that can
-+     * cause us to switch contexts */
-+
-+   AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevCheckPendingRecvMsgsAsync: (dev: 0x%X)\n", (A_UINT32)pDev));
-+
-+   do {
-+
-+        if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
-+                /* break the async processing chain right here, no need to continue.
-+                 * The DevDsrHandler() will handle things in a loop when things are driven
-+                 * synchronously  */
-+            break;
-+        }
-+            /* first allocate one of our HTC packets we created for async I/O
-+             * we reuse HTC packet definitions so that we can use the completion mechanism
-+             * in DevRWCompletionHandler() */
-+        pIOPacket = AR6KAllocIOPacket(pDev);
-+
-+        if (NULL == pIOPacket) {
-+                /* there should be only 1 asynchronous request out at a time to read these registers
-+                 * so this should actually never happen */
-+            status = A_NO_MEMORY;
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* stick in our completion routine when the I/O operation completes */
-+        pIOPacket->Completion = DevGetEventAsyncHandler;
-+        pIOPacket->pContext = pDev;
-+
-+        if (pDev->GetPendingEventsFunc) {
-+                /* HIF layer has it's own mechanism, pass the IO to it.. */
-+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+                                                (HIF_PENDING_EVENTS_INFO *)pIOPacket->pBuffer,
-+                                                pIOPacket);
-+
-+        } else {
-+                /* standard way, read the interrupt register table asynchronously again */
-+            status = HIFReadWrite(pDev->HIFDevice,
-+                                  HOST_INT_STATUS_ADDRESS,
-+                                  pIOPacket->pBuffer,
-+                                  AR6K_IRQ_PROC_REGS_SIZE,
-+                                  HIF_RD_ASYNC_BYTE_INC,
-+                                  pIOPacket);
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Async IO issued to get interrupt status...\n"));
-+   } while (FALSE);
-+
-+   AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevCheckPendingRecvMsgsAsync \n"));
-+
-+   return status;
-+}
-+
-+/* process pending interrupts synchronously */
-+static A_STATUS ProcessPendingIRQs(AR6K_DEVICE *pDev, A_BOOL *pDone, A_BOOL *pASyncProcessing)
-+{
-+    A_STATUS    status = A_OK;
-+    A_UINT8     host_int_status = 0;
-+    A_UINT32    lookAhead = 0;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+ProcessPendingIRQs: (dev: 0x%X)\n", (A_UINT32)pDev));
-+
-+    /*** NOTE: the HIF implementation guarantees that the context of this call allows
-+     *         us to perform SYNCHRONOUS I/O, that is we can block, sleep or call any API that
-+     *         can block or switch thread/task ontexts.
-+     *         This is a fully schedulable context.
-+     * */
-+    do {
-+
-+        if (pDev->GetPendingEventsFunc != NULL) {
-+            HIF_PENDING_EVENTS_INFO events;
-+
-+                /* the HIF layer uses a special mechanism to get events
-+                 * get this synchronously  */
-+            status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+                                                &events,
-+                                                NULL);
-+
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+
-+            if (events.Events & HIF_RECV_MSG_AVAIL) {
-+                lookAhead = events.LookAhead;
-+                if (0 == lookAhead) {
-+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs1 lookAhead is zero! \n"));
-+                }
-+            }
-+
-+            if (!(events.Events & HIF_OTHER_EVENTS) ||
-+                !(pDev->IrqEnableRegisters.int_status_enable & OTHER_INTS_ENABLED)) {
-+                    /* no need to read the register table, no other interesting interrupts.
-+                     * Some interfaces (like SPI) can shadow interrupt sources without
-+                     * requiring the host to do a full table read */
-+                break;
-+            }
-+
-+            /* otherwise fall through and read the register table */
-+        }
-+
-+        /*
-+         * Read the first 28 bytes of the HTC register table. This will yield us
-+         * the value of different int status registers and the lookahead
-+         * registers.
-+         *    length = sizeof(int_status) + sizeof(cpu_int_status) +
-+         *             sizeof(error_int_status) + sizeof(counter_int_status) +
-+         *             sizeof(mbox_frame) + sizeof(rx_lookahead_valid) +
-+         *             sizeof(hole) +  sizeof(rx_lookahead) +
-+         *             sizeof(int_status_enable) + sizeof(cpu_int_status_enable) +
-+         *             sizeof(error_status_enable) +
-+         *             sizeof(counter_int_status_enable);
-+         *
-+        */
-+        status = HIFReadWrite(pDev->HIFDevice,
-+                              HOST_INT_STATUS_ADDRESS,
-+                              (A_UINT8 *)&pDev->IrqProcRegisters,
-+                              AR6K_IRQ_PROC_REGS_SIZE,
-+                              HIF_RD_SYNC_BYTE_INC,
-+                              NULL);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_IRQ)) {
-+            DevDumpRegisters(&pDev->IrqProcRegisters,
-+                             &pDev->IrqEnableRegisters);
-+        }
-+
-+            /* Update only those registers that are enabled */
-+        host_int_status = pDev->IrqProcRegisters.host_int_status &
-+                          pDev->IrqEnableRegisters.int_status_enable;
-+
-+        if (NULL == pDev->GetPendingEventsFunc) {
-+                /* only look at mailbox status if the HIF layer did not provide this function,
-+                 * on some HIF interfaces reading the RX lookahead is not valid to do */
-+            if (host_int_status & (1 << HTC_MAILBOX)) {
-+                    /* mask out pending mailbox value, we use "lookAhead" as the real flag for
-+                     * mailbox processing below */
-+                host_int_status &= ~(1 << HTC_MAILBOX);
-+                if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX)) {
-+                        /* mailbox has a message and the look ahead is valid */
-+                    lookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
-+                    if (0 == lookAhead) {
-+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs2, lookAhead is zero! \n"));
-+                    }
-+                }
-+            }
-+        } else {
-+                /* not valid to check if the HIF has another mechanism for reading mailbox pending status*/
-+            host_int_status &= ~(1 << HTC_MAILBOX);
-+        }
-+
-+    } while (FALSE);
-+
-+
-+    do {
-+
-+            /* did the interrupt status fetches succeed? */
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        if ((0 == host_int_status) && (0 == lookAhead)) {
-+                /* nothing to process, the caller can use this to break out of a loop */
-+            *pDone = TRUE;
-+            break;
-+        }
-+
-+        if (lookAhead != 0) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Pending mailbox message, LookAhead: 0x%X\n",lookAhead));
-+                /* Mailbox Interrupt, the HTC layer may issue async requests to empty the
-+                 * mailbox...
-+                 * When emptying the recv mailbox we use the async handler above called from the
-+                 * completion routine of the callers read request. This can improve performance
-+                 * by reducing context switching when we rapidly pull packets */
-+            status = pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, pASyncProcessing);
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+        }
-+
-+            /* now handle the rest of them */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+                            (" Valid interrupt source(s) for OTHER interrupts: 0x%x\n",
-+                            host_int_status));
-+
-+        if (HOST_INT_STATUS_CPU_GET(host_int_status)) {
-+                /* CPU Interrupt */
-+            status = DevServiceCPUInterrupt(pDev);
-+            if (A_FAILED(status)){
-+                break;
-+            }
-+        }
-+
-+        if (HOST_INT_STATUS_ERROR_GET(host_int_status)) {
-+                /* Error Interrupt */
-+            status = DevServiceErrorInterrupt(pDev);
-+            if (A_FAILED(status)){
-+                break;
-+            }
-+        }
-+
-+        if (HOST_INT_STATUS_COUNTER_GET(host_int_status)) {
-+                /* Counter Interrupt */
-+            status = DevServiceCounterInterrupt(pDev);
-+            if (A_FAILED(status)){
-+                break;
-+            }
-+        }
-+
-+    } while (FALSE);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-ProcessPendingIRQs: (done:%d, async:%d) status=%d \n",
-+                *pDone, *pASyncProcessing, status));
-+
-+    return status;
-+}
-+
-+
-+/* Synchronousinterrupt handler, this handler kicks off all interrupt processing.*/
-+A_STATUS DevDsrHandler(void *context)
-+{
-+    AR6K_DEVICE *pDev = (AR6K_DEVICE *)context;
-+    A_STATUS    status = A_OK;
-+    A_BOOL      done = FALSE;
-+    A_BOOL      asyncProc = FALSE;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDsrHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
-+
-+
-+    while (!done) {
-+        status = ProcessPendingIRQs(pDev, &done, &asyncProc);
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
-+            /* the HIF layer does not allow async IRQ processing, override the asyncProc flag */
-+            asyncProc = FALSE;
-+            /* this will cause us to re-enter ProcessPendingIRQ() and re-read interrupt status registers.
-+             * this has a nice side effect of blocking us until all async read requests are completed.
-+             * This behavior is required on some HIF implementations that do not allow ASYNC
-+             * processing in interrupt handlers (like Windows CE) */
-+        }
-+
-+        if (asyncProc) {
-+                /* the function performed some async I/O for performance, we
-+                   need to exit the ISR immediately, the check below will prevent the interrupt from being
-+                   Ack'd while we handle it asynchronously */
-+            break;
-+        }
-+
-+    }
-+
-+    if (A_SUCCESS(status) && !asyncProc) {
-+            /* Ack the interrupt only if :
-+             *  1. we did not get any errors in processing interrupts
-+             *  2. there are no outstanding async processing requests */
-+        AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Acking interrupt from DevDsrHandler \n"));
-+        HIFAckInterrupt(pDev->HIFDevice);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDsrHandler \n"));
-+    return A_OK;
-+}
-+
-+
-diff --git a/drivers/ar6000/htc/htc.c b/drivers/ar6000/htc/htc.c
-new file mode 100644
-index 0000000..d52ed94
---- /dev/null
-+++ b/drivers/ar6000/htc/htc.c
-@@ -0,0 +1,508 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "htc_internal.h"
-+
-+
-+static HTC_INIT_INFO  HTCInitInfo = {NULL,NULL,NULL};
-+static A_BOOL         HTCInitialized = FALSE;
-+
-+static A_STATUS HTCTargetInsertedHandler(void *hif_handle);
-+static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status);
-+static void HTCReportFailure(void *Context);
-+
-+/* Initializes the HTC layer */
-+A_STATUS HTCInit(HTC_INIT_INFO *pInitInfo)
-+{
-+    HTC_CALLBACKS htcCallbacks;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Enter\n"));
-+    if (HTCInitialized) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
-+        return A_OK;
-+    }
-+
-+    A_MEMCPY(&HTCInitInfo,pInitInfo,sizeof(HTC_INIT_INFO));
-+
-+    A_MEMZERO(&htcCallbacks, sizeof(HTC_CALLBACKS));
-+
-+        /* setup HIF layer callbacks */
-+    htcCallbacks.deviceInsertedHandler = HTCTargetInsertedHandler;
-+    htcCallbacks.deviceRemovedHandler = HTCTargetRemovedHandler;
-+        /* the device layer handles these */
-+    htcCallbacks.rwCompletionHandler = DevRWCompletionHandler;
-+    htcCallbacks.dsrHandler = DevDsrHandler;
-+    HIFInit(&htcCallbacks);
-+    HTCInitialized = TRUE;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
-+    return A_OK;
-+}
-+
-+void HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList)
-+{
-+    LOCK_HTC(target);
-+    HTC_PACKET_ENQUEUE(pList,pPacket);
-+    UNLOCK_HTC(target);
-+}
-+
-+HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target,  HTC_PACKET_QUEUE *pList)
-+{
-+    HTC_PACKET *pPacket;
-+
-+    LOCK_HTC(target);
-+    pPacket = HTC_PACKET_DEQUEUE(pList);
-+    UNLOCK_HTC(target);
-+
-+    return pPacket;
-+}
-+
-+/* cleanup the HTC instance */
-+static void HTCCleanup(HTC_TARGET *target)
-+{
-+    if (A_IS_MUTEX_VALID(&target->HTCLock)) {
-+        A_MUTEX_DELETE(&target->HTCLock);
-+    }
-+
-+    if (A_IS_MUTEX_VALID(&target->HTCRxLock)) {
-+        A_MUTEX_DELETE(&target->HTCRxLock);
-+    }
-+
-+    if (A_IS_MUTEX_VALID(&target->HTCTxLock)) {
-+        A_MUTEX_DELETE(&target->HTCTxLock);
-+    }
-+        /* free our instance */
-+    A_FREE(target);
-+}
-+
-+/* registered target arrival callback from the HIF layer */
-+static A_STATUS HTCTargetInsertedHandler(void *hif_handle)
-+{
-+    HTC_TARGET              *target = NULL;
-+    A_STATUS                 status;
-+    int                      i;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Enter\n"));
-+
-+    do {
-+
-+            /* allocate target memory */
-+        if ((target = (HTC_TARGET *)A_MALLOC(sizeof(HTC_TARGET))) == NULL) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to allocate memory\n"));
-+            status = A_ERROR;
-+            break;
-+        }
-+
-+        A_MEMZERO(target, sizeof(HTC_TARGET));
-+        A_MUTEX_INIT(&target->HTCLock);
-+        A_MUTEX_INIT(&target->HTCRxLock);
-+        A_MUTEX_INIT(&target->HTCTxLock);
-+        INIT_HTC_PACKET_QUEUE(&target->ControlBufferTXFreeList);
-+        INIT_HTC_PACKET_QUEUE(&target->ControlBufferRXFreeList);
-+
-+            /* give device layer the hif device handle */
-+        target->Device.HIFDevice = hif_handle;
-+            /* give the device layer our context (for event processing)
-+             * the device layer will register it's own context with HIF
-+             * so we need to set this so we can fetch it in the target remove handler */
-+        target->Device.HTCContext = target;
-+            /* set device layer target failure callback */
-+        target->Device.TargetFailureCallback = HTCReportFailure;
-+            /* set device layer recv message pending callback */
-+        target->Device.MessagePendingCallback = HTCRecvMessagePendingHandler;
-+        target->EpWaitingForBuffers = ENDPOINT_MAX;
-+
-+            /* setup device layer */
-+        status = DevSetup(&target->Device);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* carve up buffers/packets for control messages */
-+        for (i = 0; i < NUM_CONTROL_RX_BUFFERS; i++) {
-+            HTC_PACKET *pControlPacket;
-+            pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
-+            SET_HTC_PACKET_INFO_RX_REFILL(pControlPacket,
-+                                          target,
-+                                          target->HTCControlBuffers[i].Buffer,
-+                                          HTC_CONTROL_BUFFER_SIZE,
-+                                          ENDPOINT_0);
-+            HTC_FREE_CONTROL_RX(target,pControlPacket);
-+        }
-+
-+        for (;i < NUM_CONTROL_BUFFERS;i++) {
-+             HTC_PACKET *pControlPacket;
-+             pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
-+             INIT_HTC_PACKET_INFO(pControlPacket,
-+                                  target->HTCControlBuffers[i].Buffer,
-+                                  HTC_CONTROL_BUFFER_SIZE);
-+             HTC_FREE_CONTROL_TX(target,pControlPacket);
-+        }
-+
-+    } while (FALSE);
-+
-+    if (A_SUCCESS(status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" calling AddInstance callback \n"));
-+            /* announce ourselves */
-+        HTCInitInfo.AddInstance((HTC_HANDLE)target);
-+    } else {
-+        if (target != NULL) {
-+            HTCCleanup(target);
-+        }
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Exit\n"));
-+
-+    return status;
-+}
-+
-+/* registered removal callback from the HIF layer */
-+static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status)
-+{
-+    HTC_TARGET *target;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCTargetRemovedHandler handle:0x%X \n",(A_UINT32)handle));
-+
-+    if (NULL == handle) {
-+            /* this could be NULL in the event that target initialization failed */
-+        return A_OK;
-+    }
-+
-+    target = ((AR6K_DEVICE *)handle)->HTCContext;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("   removing target:0x%X instance:0x%X ... \n",
-+            (A_UINT32)target, (A_UINT32)target->pInstanceContext));
-+
-+    if (target->pInstanceContext != NULL) {
-+            /* let upper layer know, it needs to call HTCStop() */
-+        HTCInitInfo.DeleteInstance(target->pInstanceContext);
-+    }
-+
-+    HIFShutDownDevice(target->Device.HIFDevice);
-+
-+    HTCCleanup(target);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCTargetRemovedHandler \n"));
-+    return A_OK;
-+}
-+
-+/* get the low level HIF device for the caller , the caller may wish to do low level
-+ * HIF requests */
-+void *HTCGetHifDevice(HTC_HANDLE HTCHandle)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    return target->Device.HIFDevice;
-+}
-+
-+/* set the instance block for this HTC handle, so that on removal, the blob can be
-+ * returned to the caller */
-+void HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance)
-+{
-+    HTC_TARGET  *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+
-+    target->pInstanceContext = Instance;
-+}
-+
-+/* wait for the target to arrive (sends HTC Ready message)
-+ * this operation is fully synchronous and the message is polled for */
-+A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
-+{
-+    HTC_TARGET              *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    A_STATUS                 status;
-+    HTC_PACKET              *pPacket = NULL;
-+    HTC_READY_MSG           *pRdyMsg;
-+    HTC_SERVICE_CONNECT_REQ  connect;
-+    HTC_SERVICE_CONNECT_RESP resp;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%X) \n", (A_UINT32)target));
-+
-+    do {
-+
-+#ifdef MBOXHW_UNIT_TEST
-+
-+        status = DoMboxHWTest(&target->Device);
-+
-+        if (status != A_OK) {
-+            break;
-+        }
-+
-+#endif
-+
-+            /* we should be getting 1 control message that the target is ready */
-+        status = HTCWaitforControlMessage(target, &pPacket);
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Target Not Available!!\n"));
-+            break;
-+        }
-+
-+            /* we controlled the buffer creation so it has to be properly aligned */
-+        pRdyMsg = (HTC_READY_MSG *)pPacket->pBuffer;
-+
-+        if ((pRdyMsg->MessageID != HTC_MSG_READY_ID) ||
-+            (pPacket->ActualLength < sizeof(HTC_READY_MSG))) {
-+                /* this message is not valid */
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        if (pRdyMsg->CreditCount == 0 || pRdyMsg->CreditSize == 0) {
-+              /* this message is not valid */
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        target->TargetCredits = pRdyMsg->CreditCount;
-+        target->TargetCreditSize = pRdyMsg->CreditSize;
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" Target Ready: credits: %d credit size: %d\n",
-+                target->TargetCredits, target->TargetCreditSize));
-+
-+            /* setup our pseudo HTC control endpoint connection */
-+        A_MEMZERO(&connect,sizeof(connect));
-+        A_MEMZERO(&resp,sizeof(resp));
-+        connect.EpCallbacks.pContext = target;
-+        connect.EpCallbacks.EpTxComplete = HTCControlTxComplete;
-+        connect.EpCallbacks.EpRecv = HTCControlRecv;
-+        connect.EpCallbacks.EpRecvRefill = NULL;  /* not needed */
-+        connect.EpCallbacks.EpSendFull = NULL;    /* not needed */
-+        connect.EpCallbacks.EpSendAvail = NULL;   /* not needed */
-+        connect.MaxSendQueueDepth = NUM_CONTROL_BUFFERS;
-+        connect.ServiceID = HTC_CTRL_RSVD_SVC;
-+
-+            /* connect fake service */
-+        status = HTCConnectService((HTC_HANDLE)target,
-+                                   &connect,
-+                                   &resp);
-+
-+        if (!A_FAILED(status)) {
-+            break;
-+        }
-+
-+    } while (FALSE);
-+
-+    if (pPacket != NULL) {
-+        HTC_FREE_CONTROL_RX(target,pPacket);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Exit\n"));
-+
-+    return status;
-+}
-+
-+
-+
-+/* Start HTC, enable interrupts and let the target know host has finished setup */
-+A_STATUS HTCStart(HTC_HANDLE HTCHandle)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    HTC_PACKET *pPacket;
-+    A_STATUS   status;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Enter\n"));
-+
-+        /* now that we are starting, push control receive buffers into the
-+         * HTC control endpoint */
-+
-+    while (1) {
-+        pPacket = HTC_ALLOC_CONTROL_RX(target);
-+        if (NULL == pPacket) {
-+            break;
-+        }
-+        HTCAddReceivePkt((HTC_HANDLE)target,pPacket);
-+    }
-+
-+    do {
-+
-+        AR_DEBUG_ASSERT(target->InitCredits != NULL);
-+        AR_DEBUG_ASSERT(target->EpCreditDistributionListHead != NULL);
-+        AR_DEBUG_ASSERT(target->EpCreditDistributionListHead->pNext != NULL);
-+
-+            /* call init credits callback to do the distribution ,
-+             * NOTE: the first entry in the distribution list is ENDPOINT_0, so
-+             * we pass the start of the list after this one. */
-+        target->InitCredits(target->pCredDistContext,
-+                            target->EpCreditDistributionListHead->pNext,
-+                            target->TargetCredits);
-+
-+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_TRC)) {
-+            DumpCreditDistStates(target);
-+        }
-+
-+            /* the caller is done connecting to services, so we can indicate to the
-+            * target that the setup phase is complete */
-+        status = HTCSendSetupComplete(target);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* unmask interrupts */
-+        status = DevUnmaskInterrupts(&target->Device);
-+
-+        if (A_FAILED(status)) {
-+            HTCStop(target);
-+        }
-+
-+    } while (FALSE);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Exit\n"));
-+    return status;
-+}
-+
-+
-+/* stop HTC communications, i.e. stop interrupt reception, and flush all queued buffers */
-+void HTCStop(HTC_HANDLE HTCHandle)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCStop \n"));
-+
-+        /* mark that we are shutting down .. */
-+    target->HTCStateFlags |= HTC_STATE_STOPPING;
-+
-+        /* Masking interrupts is a synchronous operation, when this function returns
-+         * all pending HIF I/O has completed, we can safely flush the queues */
-+    DevMaskInterrupts(&target->Device);
-+
-+        /* flush all send packets */
-+    HTCFlushSendPkts(target);
-+        /* flush all recv buffers */
-+    HTCFlushRecvBuffers(target);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCStop \n"));
-+}
-+
-+/* undo what was done in HTCInit() */
-+void HTCShutDown(void)
-+{
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCShutDown: \n"));
-+    HTCInitialized = FALSE;
-+        /* undo HTCInit */
-+    HIFShutDownDevice(NULL);
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCShutDown: \n"));
-+}
-+
-+void HTCDumpCreditStates(HTC_HANDLE HTCHandle)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+
-+    LOCK_HTC_TX(target);
-+
-+    DumpCreditDistStates(target);
-+
-+    UNLOCK_HTC_TX(target);
-+}
-+
-+/* report a target failure from the device, this is a callback from the device layer
-+ * which uses a mechanism to report errors from the target (i.e. special interrupts) */
-+static void HTCReportFailure(void *Context)
-+{
-+    HTC_TARGET *target = (HTC_TARGET *)Context;
-+
-+    target->TargetFailure = TRUE;
-+
-+    if ((target->pInstanceContext != NULL) && (HTCInitInfo.TargetFailure != NULL)) {
-+            /* let upper layer know, it needs to call HTCStop() */
-+        HTCInitInfo.TargetFailure(target->pInstanceContext, A_ERROR);
-+    }
-+}
-+
-+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription)
-+{
-+    A_CHAR stream[60];
-+    A_UINT32 i;
-+    A_UINT16 offset, count;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<---------Dumping %d Bytes : %s ------>\n", length, pDescription));
-+
-+    count = 0;
-+    offset = 0;
-+    for(i = 0; i < length; i++) {
-+        sprintf(stream + offset, "%2.2X ", buffer[i]);
-+        count ++;
-+        offset += 3;
-+
-+        if(count == 16) {
-+            count = 0;
-+            offset = 0;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
-+            A_MEMZERO(stream, 60);
-+        }
-+    }
-+
-+    if(offset != 0) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<------------------------------------------------->\n"));
-+}
-+
-+A_BOOL HTCGetEndpointStatistics(HTC_HANDLE               HTCHandle,
-+                                HTC_ENDPOINT_ID          Endpoint,
-+                                HTC_ENDPOINT_STAT_ACTION Action,
-+                                HTC_ENDPOINT_STATS       *pStats)
-+{
-+
-+#ifdef HTC_EP_STAT_PROFILING
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    A_BOOL     clearStats = FALSE;
-+    A_BOOL     sample = FALSE;
-+
-+    switch (Action) {
-+        case HTC_EP_STAT_SAMPLE :
-+            sample = TRUE;
-+            break;
-+        case HTC_EP_STAT_SAMPLE_AND_CLEAR :
-+            sample = TRUE;
-+            clearStats = TRUE;
-+            break;
-+        case HTC_EP_STAT_CLEAR :
-+            clearStats = TRUE;
-+            break;
-+        default:
-+            break;
-+    }
-+
-+    A_ASSERT(Endpoint < ENDPOINT_MAX);
-+
-+        /* lock out TX and RX while we sample and/or clear */
-+    LOCK_HTC_TX(target);
-+    LOCK_HTC_RX(target);
-+
-+    if (sample) {
-+        A_ASSERT(pStats != NULL);
-+            /* return the stats to the caller */
-+        A_MEMCPY(pStats, &target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
-+    }
-+
-+    if (clearStats) {
-+            /* reset stats */
-+        A_MEMZERO(&target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
-+    }
-+
-+    UNLOCK_HTC_RX(target);
-+    UNLOCK_HTC_TX(target);
-+
-+    return TRUE;
-+#else
-+    return FALSE;
-+#endif
-+}
-diff --git a/drivers/ar6000/htc/htc_debug.h b/drivers/ar6000/htc/htc_debug.h
-new file mode 100644
-index 0000000..08080be
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_debug.h
-@@ -0,0 +1,65 @@
-+#ifndef HTC_DEBUG_H_
-+#define HTC_DEBUG_H_
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+/* ------- Debug related stuff ------- */
-+enum {
-+    ATH_DEBUG_SEND = 0x0001,
-+    ATH_DEBUG_RECV = 0x0002,
-+    ATH_DEBUG_SYNC = 0x0004,
-+    ATH_DEBUG_DUMP = 0x0008,
-+    ATH_DEBUG_IRQ  = 0x0010,
-+    ATH_DEBUG_TRC  = 0x0020,
-+    ATH_DEBUG_WARN = 0x0040,
-+    ATH_DEBUG_ERR  = 0x0080,
-+    ATH_DEBUG_ANY  = 0xFFFF,
-+};
-+
-+#ifdef DEBUG
-+
-+// TODO FIX usage of A_PRINTF!
-+#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc) do {   \
-+    if (debughtc & ATH_DEBUG_DUMP) {             \
-+        DebugDumpBytes(buffer, length,desc);               \
-+    }                                            \
-+} while(0)
-+#define PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(flags, args) do {        \
-+    if (debughtc & (flags)) {                    \
-+        A_PRINTF(KERN_ALERT PRINTX_ARG args);    \
-+    }                                            \
-+} while (0)
-+#define AR_DEBUG_ASSERT(test) do {               \
-+    if (!(test)) {                               \
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test));         \
-+    }                                            \
-+} while(0)
-+extern int debughtc;
-+#else
-+#define AR_DEBUG_PRINTF(flags, args)
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
-+#define AR_DEBUG_ASSERT(test)
-+#define AR_DEBUG_LVL_CHECK(lvl) 0
-+#endif
-+
-+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
-+
-+#endif /*HTC_DEBUG_H_*/
-diff --git a/drivers/ar6000/htc/htc_internal.h b/drivers/ar6000/htc/htc_internal.h
-new file mode 100644
-index 0000000..ebb8ac1
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_internal.h
-@@ -0,0 +1,168 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _HTC_INTERNAL_H_
-+#define _HTC_INTERNAL_H_
-+
-+/* for debugging, uncomment this to capture the last frame header, on frame header
-+ * processing errors, the last frame header is dump for comparison */
-+//#define HTC_CAPTURE_LAST_FRAME
-+
-+//#define HTC_EP_STAT_PROFILING
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/* Header files */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "htc.h"
-+#include "htc_api.h"
-+#include "bmi_msg.h"
-+#include "hif.h"
-+#include "ar6k.h"
-+
-+/* HTC operational parameters */
-+#define HTC_TARGET_RESPONSE_TIMEOUT        2000 /* in ms */
-+#define HTC_TARGET_DEBUG_INTR_MASK         0x01
-+#define HTC_TARGET_CREDIT_INTR_MASK        0xF0
-+
-+typedef struct _HTC_ENDPOINT {
-+    HTC_SERVICE_ID              ServiceID;      /* service ID this endpoint is bound to
-+                                                   non-zero value means this endpoint is in use */
-+    HTC_PACKET_QUEUE            TxQueue;        /* HTC frame buffer TX queue */
-+    HTC_PACKET_QUEUE            RxBuffers;      /* HTC frame buffer RX list */
-+    HTC_ENDPOINT_CREDIT_DIST    CreditDist;     /* credit distribution structure (exposed to driver layer) */
-+    HTC_EP_CALLBACKS            EpCallBacks;    /* callbacks associated with this endpoint */
-+    int                         MaxTxQueueDepth;   /* max depth of the TX queue before we need to
-+                                                      call driver's full handler */
-+    int                         CurrentTxQueueDepth; /* current TX queue depth */
-+    int                         MaxMsgLength;        /* max length of endpoint message */
-+#ifdef HTC_EP_STAT_PROFILING
-+    HTC_ENDPOINT_STATS          EndPointStats;  /* endpoint statistics */
-+#endif
-+} HTC_ENDPOINT;
-+
-+#ifdef HTC_EP_STAT_PROFILING
-+#define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
-+#else
-+#define INC_HTC_EP_STAT(p,stat,count)
-+#endif
-+
-+#define HTC_SERVICE_TX_PACKET_TAG  HTC_TX_PACKET_TAG_INTERNAL
-+
-+#define NUM_CONTROL_BUFFERS     8
-+#define NUM_CONTROL_TX_BUFFERS  2
-+#define NUM_CONTROL_RX_BUFFERS  (NUM_CONTROL_BUFFERS - NUM_CONTROL_TX_BUFFERS)
-+
-+#define HTC_CONTROL_BUFFER_SIZE (HTC_MAX_CONTROL_MESSAGE_LENGTH + HTC_HDR_LENGTH)
-+
-+typedef struct HTC_CONTROL_BUFFER {
-+    HTC_PACKET    HtcPacket;
-+    A_UINT8       Buffer[HTC_CONTROL_BUFFER_SIZE];
-+} HTC_CONTROL_BUFFER;
-+
-+/* our HTC target state */
-+typedef struct _HTC_TARGET {
-+    HTC_ENDPOINT                EndPoint[ENDPOINT_MAX];
-+    HTC_CONTROL_BUFFER          HTCControlBuffers[NUM_CONTROL_BUFFERS];
-+    HTC_ENDPOINT_CREDIT_DIST   *EpCreditDistributionListHead;
-+    HTC_PACKET_QUEUE            ControlBufferTXFreeList;
-+    HTC_PACKET_QUEUE            ControlBufferRXFreeList;
-+    HTC_CREDIT_DIST_CALLBACK    DistributeCredits;
-+    HTC_CREDIT_INIT_CALLBACK    InitCredits;
-+    void                       *pCredDistContext;
-+    int                         TargetCredits;
-+    int                         TargetCreditSize;
-+    A_MUTEX_T                   HTCLock;
-+    A_MUTEX_T                   HTCRxLock;
-+    A_MUTEX_T                   HTCTxLock;
-+    AR6K_DEVICE                 Device;         /* AR6K - specific state */
-+    A_UINT32                    HTCStateFlags;
-+    HTC_ENDPOINT_ID             EpWaitingForBuffers;
-+    A_BOOL                      TargetFailure;
-+    void                       *pInstanceContext;
-+#define HTC_STATE_WAIT_BUFFERS  (1 << 0)
-+#define HTC_STATE_STOPPING      (1 << 1)
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+    HTC_FRAME_HDR               LastFrameHdr;  /* useful for debugging */
-+    A_UINT8                     LastTrailer[256];
-+    A_UINT8                     LastTrailerLength;
-+#endif
-+} HTC_TARGET;
-+
-+#define HTC_STOPPING(t) ((t)->HTCStateFlags & HTC_STATE_STOPPING)
-+#define LOCK_HTC(t)      A_MUTEX_LOCK(&(t)->HTCLock);
-+#define UNLOCK_HTC(t)    A_MUTEX_UNLOCK(&(t)->HTCLock);
-+#define LOCK_HTC_RX(t)   A_MUTEX_LOCK(&(t)->HTCRxLock);
-+#define UNLOCK_HTC_RX(t) A_MUTEX_UNLOCK(&(t)->HTCRxLock);
-+#define LOCK_HTC_TX(t)   A_MUTEX_LOCK(&(t)->HTCTxLock);
-+#define UNLOCK_HTC_TX(t) A_MUTEX_UNLOCK(&(t)->HTCTxLock);
-+
-+#define GET_HTC_TARGET_FROM_HANDLE(hnd) ((HTC_TARGET *)(hnd))
-+#define HTC_RECYCLE_RX_PKT(target,p)                \
-+{                                                   \
-+    HTC_PACKET_RESET_RX(pPacket);                   \
-+    HTCAddReceivePkt((HTC_HANDLE)(target),(p));     \
-+}
-+
-+/* internal HTC functions */
-+void        HTCControlTxComplete(void *Context, HTC_PACKET *pPacket);
-+void        HTCControlRecv(void *Context, HTC_PACKET *pPacket);
-+A_STATUS    HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket);
-+HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target, HTC_PACKET_QUEUE *pList);
-+void        HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList);
-+A_STATUS    HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 Flags);
-+A_STATUS    HTCIssueRecv(HTC_TARGET *target, HTC_PACKET *pPacket);
-+void        HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket);
-+A_STATUS    HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
-+void        HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint);
-+A_STATUS    HTCSendSetupComplete(HTC_TARGET *target);
-+void        HTCFlushRecvBuffers(HTC_TARGET *target);
-+void        HTCFlushSendPkts(HTC_TARGET *target);
-+void        DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist);
-+void        DumpCreditDistStates(HTC_TARGET *target);
-+void 		DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
-+
-+static INLINE HTC_PACKET *HTC_ALLOC_CONTROL_TX(HTC_TARGET *target) {
-+    HTC_PACKET *pPacket = HTCAllocControlBuffer(target,&target->ControlBufferTXFreeList);
-+    if (pPacket != NULL) {
-+            /* set payload pointer area with some headroom */
-+        pPacket->pBuffer = pPacket->pBufferStart + HTC_HDR_LENGTH;
-+    }
-+    return pPacket;
-+}
-+
-+#define HTC_FREE_CONTROL_TX(t,p) HTCFreeControlBuffer((t),(p),&(t)->ControlBufferTXFreeList)
-+#define HTC_ALLOC_CONTROL_RX(t)  HTCAllocControlBuffer((t),&(t)->ControlBufferRXFreeList)
-+#define HTC_FREE_CONTROL_RX(t,p) \
-+{                                                                \
-+    HTC_PACKET_RESET_RX(p);                                      \
-+    HTCFreeControlBuffer((t),(p),&(t)->ControlBufferRXFreeList); \
-+}
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _HTC_INTERNAL_H_ */
-diff --git a/drivers/ar6000/htc/htc_recv.c b/drivers/ar6000/htc/htc_recv.c
-new file mode 100644
-index 0000000..4be2b08
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_recv.c
-@@ -0,0 +1,703 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "htc_internal.h"
-+
-+#define HTCIssueRecv(t, p) \
-+    DevRecvPacket(&(t)->Device,  \
-+                  (p),          \
-+                  (p)->ActualLength)
-+
-+#define DO_RCV_COMPLETION(t,p,e)            \
-+{                                           \
-+    if ((p)->ActualLength > 0) {            \
-+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" completing packet 0x%X (%d bytes) on ep : %d \n", \
-+            (A_UINT32)(p), (p)->ActualLength, (p)->Endpoint));  \
-+        (e)->EpCallBacks.EpRecv((e)->EpCallBacks.pContext,      \
-+                                (p));                           \
-+    } else {                                                    \
-+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" recycling empty packet \n"));  \
-+        HTC_RECYCLE_RX_PKT((t), (p));                           \
-+    }                                                           \
-+}
-+
-+#ifdef HTC_EP_STAT_PROFILING
-+#define HTC_RX_STAT_PROFILE(t,ep,lookAhead)            \
-+{                                                      \
-+    LOCK_HTC_RX((t));                                  \
-+    INC_HTC_EP_STAT((ep), RxReceived, 1);              \
-+    if ((lookAhead) != 0) {                            \
-+        INC_HTC_EP_STAT((ep), RxLookAheads, 1);        \
-+    }                                                  \
-+    UNLOCK_HTC_RX((t));                                \
-+}
-+#else
-+#define HTC_RX_STAT_PROFILE(t,ep,lookAhead)
-+#endif
-+
-+static INLINE A_STATUS HTCProcessTrailer(HTC_TARGET *target,
-+                                         A_UINT8    *pBuffer,
-+                                         int         Length,
-+                                         A_UINT32   *pNextLookAhead,
-+                                         HTC_ENDPOINT_ID FromEndpoint)
-+{
-+    HTC_RECORD_HDR          *pRecord;
-+    A_UINT8                 *pRecordBuf;
-+    HTC_LOOKAHEAD_REPORT    *pLookAhead;
-+    A_UINT8                 *pOrigBuffer;
-+    int                     origLength;
-+    A_STATUS                status;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessTrailer (length:%d) \n", Length));
-+
-+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+        AR_DEBUG_PRINTBUF(pBuffer,Length,"Recv Trailer");
-+    }
-+
-+    pOrigBuffer = pBuffer;
-+    origLength = Length;
-+    status = A_OK;
-+
-+    while (Length > 0) {
-+
-+        if (Length < sizeof(HTC_RECORD_HDR)) {
-+            status = A_EPROTO;
-+            break;
-+        }
-+            /* these are byte aligned structs */
-+        pRecord = (HTC_RECORD_HDR *)pBuffer;
-+        Length -= sizeof(HTC_RECORD_HDR);
-+        pBuffer += sizeof(HTC_RECORD_HDR);
-+
-+        if (pRecord->Length > Length) {
-+                /* no room left in buffer for record */
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                (" invalid record length: %d (id:%d) buffer has: %d bytes left \n",
-+                        pRecord->Length, pRecord->RecordID, Length));
-+            status = A_EPROTO;
-+            break;
-+        }
-+            /* start of record follows the header */
-+        pRecordBuf = pBuffer;
-+
-+        switch (pRecord->RecordID) {
-+            case HTC_RECORD_CREDITS:
-+                AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_CREDIT_REPORT));
-+                HTCProcessCreditRpt(target,
-+                                    (HTC_CREDIT_REPORT *)pRecordBuf,
-+                                    pRecord->Length / (sizeof(HTC_CREDIT_REPORT)),
-+                                    FromEndpoint);
-+                break;
-+            case HTC_RECORD_LOOKAHEAD:
-+                AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_LOOKAHEAD_REPORT));
-+                pLookAhead = (HTC_LOOKAHEAD_REPORT *)pRecordBuf;
-+                if ((pLookAhead->PreValid == ((~pLookAhead->PostValid) & 0xFF)) &&
-+                    (pNextLookAhead != NULL)) {
-+
-+                    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+                                (" LookAhead Report Found (pre valid:0x%X, post valid:0x%X) \n",
-+                                pLookAhead->PreValid,
-+                                pLookAhead->PostValid));
-+
-+                        /* look ahead bytes are valid, copy them over */
-+                    ((A_UINT8 *)pNextLookAhead)[0] = pLookAhead->LookAhead[0];
-+                    ((A_UINT8 *)pNextLookAhead)[1] = pLookAhead->LookAhead[1];
-+                    ((A_UINT8 *)pNextLookAhead)[2] = pLookAhead->LookAhead[2];
-+                    ((A_UINT8 *)pNextLookAhead)[3] = pLookAhead->LookAhead[3];
-+
-+                    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+                        DebugDumpBytes((A_UINT8 *)pNextLookAhead,4,"Next Look Ahead");
-+                    }
-+                }
-+                break;
-+            default:
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" unhandled record: id:%d length:%d \n",
-+                        pRecord->RecordID, pRecord->Length));
-+                break;
-+        }
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* advance buffer past this record for next time around */
-+        pBuffer += pRecord->Length;
-+        Length -= pRecord->Length;
-+    }
-+
-+    if (A_FAILED(status)) {
-+        DebugDumpBytes(pOrigBuffer,origLength,"BAD Recv Trailer");
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessTrailer \n"));
-+    return status;
-+
-+}
-+
-+/* process a received message (i.e. strip off header, process any trailer data)
-+ * note : locks must be released when this function is called */
-+static A_STATUS HTCProcessRecvHeader(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT32 *pNextLookAhead)
-+{
-+    A_UINT8   temp;
-+    A_UINT8   *pBuf;
-+    A_STATUS  status = A_OK;
-+    A_UINT16  payloadLen;
-+    A_UINT32  lookAhead;
-+
-+    pBuf = pPacket->pBuffer;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessRecvHeader \n"));
-+
-+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+        AR_DEBUG_PRINTBUF(pBuf,pPacket->ActualLength,"HTC Recv PKT");
-+    }
-+
-+    do {
-+        /* note, we cannot assume the alignment of pBuffer, so we use the safe macros to
-+         * retrieve 16 bit fields */
-+        payloadLen = A_GET_UINT16_FIELD(pBuf, HTC_FRAME_HDR, PayloadLen);
-+
-+        ((A_UINT8 *)&lookAhead)[0] = pBuf[0];
-+        ((A_UINT8 *)&lookAhead)[1] = pBuf[1];
-+        ((A_UINT8 *)&lookAhead)[2] = pBuf[2];
-+        ((A_UINT8 *)&lookAhead)[3] = pBuf[3];
-+
-+        if (lookAhead != pPacket->HTCReserved) {
-+            /* somehow the lookahead that gave us the full read length did not
-+             * reflect the actual header in the pending message */
-+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    ("HTCProcessRecvHeader, lookahead mismatch! \n"));
-+             DebugDumpBytes((A_UINT8 *)&pPacket->HTCReserved,4,"Expected Message LookAhead");
-+             DebugDumpBytes(pBuf,sizeof(HTC_FRAME_HDR),"Current Frame Header");
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+            DebugDumpBytes((A_UINT8 *)&target->LastFrameHdr,sizeof(HTC_FRAME_HDR),"Last Frame Header");
-+            if (target->LastTrailerLength != 0) {
-+                DebugDumpBytes(target->LastTrailer,
-+                               target->LastTrailerLength,
-+                               "Last trailer");
-+            }
-+#endif
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+            /* get flags */
-+        temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, Flags);
-+
-+        if (temp & HTC_FLAGS_RECV_TRAILER) {
-+            /* this packet has a trailer */
-+
-+                /* extract the trailer length in control byte 0 */
-+            temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, ControlBytes[0]);
-+
-+            if ((temp < sizeof(HTC_RECORD_HDR)) || (temp > payloadLen)) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    ("HTCProcessRecvHeader, invalid header (payloadlength should be :%d, CB[0] is:%d) \n",
-+                        payloadLen, temp));
-+                status = A_EPROTO;
-+                break;
-+            }
-+
-+                /* process trailer data that follows HDR + application payload */
-+            status = HTCProcessTrailer(target,
-+                                       (pBuf + HTC_HDR_LENGTH + payloadLen - temp),
-+                                       temp,
-+                                       pNextLookAhead,
-+                                       pPacket->Endpoint);
-+
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+            A_MEMCPY(target->LastTrailer, (pBuf + HTC_HDR_LENGTH + payloadLen - temp), temp);
-+            target->LastTrailerLength = temp;
-+#endif
-+                /* trim length by trailer bytes */
-+            pPacket->ActualLength -= temp;
-+        }
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+         else {
-+            target->LastTrailerLength = 0;
-+        }
-+#endif
-+
-+            /* if we get to this point, the packet is good */
-+            /* remove header and adjust length */
-+        pPacket->pBuffer += HTC_HDR_LENGTH;
-+        pPacket->ActualLength -= HTC_HDR_LENGTH;
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+            /* dump the whole packet */
-+        DebugDumpBytes(pBuf,pPacket->ActualLength,"BAD HTC Recv PKT");
-+    } else {
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+        A_MEMCPY(&target->LastFrameHdr,pBuf,sizeof(HTC_FRAME_HDR));
-+#endif
-+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+            if (pPacket->ActualLength > 0) {
-+                AR_DEBUG_PRINTBUF(pPacket->pBuffer,pPacket->ActualLength,"HTC - Application Msg");
-+            }
-+        }
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessRecvHeader \n"));
-+    return status;
-+}
-+
-+/* asynchronous completion handler for recv packet fetching, when the device layer
-+ * completes a read request, it will call this completion handler */
-+void HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket)
-+{
-+    HTC_TARGET      *target = (HTC_TARGET *)Context;
-+    HTC_ENDPOINT    *pEndpoint;
-+    A_UINT32        nextLookAhead = 0;
-+    A_STATUS        status;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCRecvCompleteHandler (status:%d, ep:%d) \n",
-+                pPacket->Status, pPacket->Endpoint));
-+
-+    AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
-+    pEndpoint = &target->EndPoint[pPacket->Endpoint];
-+    pPacket->Completion = NULL;
-+
-+        /* get completion status */
-+    status = pPacket->Status;
-+
-+    do {
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTCRecvCompleteHandler: request failed (status:%d, ep:%d) \n",
-+                pPacket->Status, pPacket->Endpoint));
-+            break;
-+        }
-+            /* process the header for any trailer data */
-+        status = HTCProcessRecvHeader(target,pPacket,&nextLookAhead);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+            /* was there a lookahead for the next packet? */
-+        if (nextLookAhead != 0) {
-+            A_STATUS nextStatus;
-+            AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+                            ("HTCRecvCompleteHandler - next look ahead was non-zero : 0x%X \n",
-+                             nextLookAhead));
-+                /* we have another packet, get the next packet fetch started (pipelined) before
-+                 * we call into the endpoint's callback, this will start another async request */
-+            nextStatus = HTCRecvMessagePendingHandler(target,nextLookAhead,NULL);
-+            if (A_EPROTO == nextStatus) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                            ("Next look ahead from recv header was INVALID\n"));
-+                DebugDumpBytes((A_UINT8 *)&nextLookAhead,
-+                                4,
-+                                "BAD lookahead from lookahead report");
-+            }
-+        } else {
-+             AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+            ("HTCRecvCompleteHandler - rechecking for more messages...\n"));
-+            /* if we did not get anything on the look-ahead,
-+             * call device layer to asynchronously re-check for messages. If we can keep the async
-+             * processing going we get better performance.  If there is a pending message we will keep processing
-+             * messages asynchronously which should pipeline things nicely */
-+            DevCheckPendingRecvMsgsAsync(&target->Device);
-+        }
-+
-+        HTC_RX_STAT_PROFILE(target,pEndpoint,nextLookAhead);
-+        DO_RCV_COMPLETION(target,pPacket,pEndpoint);
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                         ("HTCRecvCompleteHandler , message fetch failed (status = %d) \n",
-+                         status));
-+            /* recyle this packet */
-+         HTC_RECYCLE_RX_PKT(target, pPacket);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCRecvCompleteHandler\n"));
-+}
-+
-+/* synchronously wait for a control message from the target,
-+ * This function is used at initialization time ONLY.  At init messages
-+ * on ENDPOINT 0 are expected. */
-+A_STATUS HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket)
-+{
-+    A_STATUS        status;
-+    A_UINT32        lookAhead;
-+    HTC_PACKET      *pPacket = NULL;
-+    HTC_FRAME_HDR   *pHdr;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCWaitforControlMessage \n"));
-+
-+    do  {
-+
-+        *ppControlPacket = NULL;
-+
-+            /* call the polling function to see if we have a message */
-+        status = DevPollMboxMsgRecv(&target->Device,
-+                                    &lookAhead,
-+                                    HTC_TARGET_RESPONSE_TIMEOUT);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+                ("HTCWaitforControlMessage : lookAhead : 0x%X \n", lookAhead));
-+
-+            /* check the lookahead */
-+        pHdr = (HTC_FRAME_HDR *)&lookAhead;
-+
-+        if (pHdr->EndpointID != ENDPOINT_0) {
-+                /* unexpected endpoint number, should be zero */
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        if (A_FAILED(status)) {
-+                /* bad message */
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        pPacket = HTC_ALLOC_CONTROL_RX(target);
-+
-+        if (pPacket == NULL) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_NO_MEMORY;
-+            break;
-+        }
-+
-+        pPacket->HTCReserved = lookAhead;
-+        pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
-+
-+        if (pPacket->ActualLength > pPacket->BufferLength) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+            /* we want synchronous operation */
-+        pPacket->Completion = NULL;
-+
-+            /* get the message from the device, this will block */
-+        status = HTCIssueRecv(target, pPacket);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+            /* process receive header */
-+        status = HTCProcessRecvHeader(target,pPacket,NULL);
-+
-+        pPacket->Status = status;
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    ("HTCWaitforControlMessage, HTCProcessRecvHeader failed (status = %d) \n",
-+                     status));
-+            break;
-+        }
-+
-+            /* give the caller this control message packet, they are responsible to free */
-+        *ppControlPacket = pPacket;
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+        if (pPacket != NULL) {
-+                /* cleanup buffer on error */
-+            HTC_FREE_CONTROL_RX(target,pPacket);
-+        }
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCWaitforControlMessage \n"));
-+
-+    return status;
-+}
-+
-+/* callback when device layer or lookahead report parsing detects a pending message */
-+A_STATUS HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc)
-+{
-+    HTC_TARGET      *target = (HTC_TARGET *)Context;
-+    A_STATUS         status = A_OK;
-+    HTC_PACKET      *pPacket = NULL;
-+    HTC_FRAME_HDR   *pHdr;
-+    HTC_ENDPOINT    *pEndpoint;
-+    A_BOOL          asyncProc = FALSE;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCRecvMessagePendingHandler LookAhead:0x%X \n",LookAhead));
-+
-+    if (IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(&target->Device)) {
-+            /* We use async mode to get the packets if the device layer supports it.
-+             * The device layer interfaces with HIF in which HIF may have restrictions on
-+             * how interrupts are processed */
-+        asyncProc = TRUE;
-+    }
-+
-+    if (pAsyncProc != NULL) {
-+            /* indicate to caller how we decided to process this */
-+        *pAsyncProc = asyncProc;
-+    }
-+
-+    while (TRUE) {
-+
-+        pHdr = (HTC_FRAME_HDR *)&LookAhead;
-+
-+        if (pHdr->EndpointID >= ENDPOINT_MAX) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Endpoint in look-ahead: %d \n",pHdr->EndpointID));
-+                /* invalid endpoint */
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        if (pHdr->PayloadLen > HTC_MAX_PAYLOAD_LENGTH) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Payload length %d exceeds max HTC : %d !\n",
-+                    pHdr->PayloadLen, HTC_MAX_PAYLOAD_LENGTH));
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        pEndpoint = &target->EndPoint[pHdr->EndpointID];
-+
-+        if (0 == pEndpoint->ServiceID) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Endpoint %d is not connected !\n",pHdr->EndpointID));
-+                /* endpoint isn't even connected */
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+            /* lock RX to get a buffer */
-+        LOCK_HTC_RX(target);
-+
-+            /* get a packet from the endpoint recv queue */
-+        pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
-+
-+        if (NULL == pPacket) {
-+                /* check for refill handler */
-+            if (pEndpoint->EpCallBacks.EpRecvRefill != NULL) {
-+                UNLOCK_HTC_RX(target);
-+                    /* call the re-fill handler */
-+                pEndpoint->EpCallBacks.EpRecvRefill(pEndpoint->EpCallBacks.pContext,
-+                                                    pHdr->EndpointID);
-+                LOCK_HTC_RX(target);
-+                    /* check if we have more buffers */
-+                pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
-+                    /* fall through */
-+            }
-+        }
-+
-+        if (NULL == pPacket) {
-+                /* this is not an error, we simply need to mark that we are waiting for buffers.*/
-+            target->HTCStateFlags |= HTC_STATE_WAIT_BUFFERS;
-+            target->EpWaitingForBuffers = pHdr->EndpointID;
-+            status = A_NO_MEMORY;
-+        }
-+
-+        UNLOCK_HTC_RX(target);
-+
-+        if (A_FAILED(status)) {
-+                /* no buffers */
-+            break;
-+        }
-+
-+        AR_DEBUG_ASSERT(pPacket->Endpoint == pHdr->EndpointID);
-+
-+            /* make sure this message can fit in the endpoint buffer */
-+        if ((pHdr->PayloadLen + HTC_HDR_LENGTH) > pPacket->BufferLength) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    ("Payload Length Error : header reports payload of: %d, endpoint buffer size: %d \n",
-+                    pHdr->PayloadLen, pPacket->BufferLength));
-+            status = A_EPROTO;
-+            break;
-+        }
-+
-+        pPacket->HTCReserved = LookAhead; /* set expected look ahead */
-+            /* set the amount of data to fetch */
-+        pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
-+
-+        if (asyncProc) {
-+                /* we use async mode to get the packet if the device layer supports it
-+                 * set our callback and context */
-+            pPacket->Completion = HTCRecvCompleteHandler;
-+            pPacket->pContext = target;
-+        } else {
-+                /* fully synchronous */
-+            pPacket->Completion = NULL;
-+        }
-+
-+            /* go fetch the packet */
-+        status = HTCIssueRecv(target, pPacket);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        if (asyncProc) {
-+                /* we did this asynchronously so we can get out of the loop, the asynch processing
-+                 * creates a chain of requests to continue processing pending messages in the
-+                 * context of callbacks  */
-+            break;
-+        }
-+
-+            /* in the sync case, we process the packet, check lookaheads and then repeat */
-+
-+        LookAhead = 0;
-+        status = HTCProcessRecvHeader(target,pPacket,&LookAhead);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        HTC_RX_STAT_PROFILE(target,pEndpoint,LookAhead);
-+        DO_RCV_COMPLETION(target,pPacket,pEndpoint);
-+
-+        pPacket = NULL;
-+
-+        if (0 == LookAhead) {
-+            break;
-+        }
-+
-+    }
-+
-+    if (A_NO_MEMORY == status) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                (" Endpoint :%d has no buffers, blocking receiver to prevent overrun.. \n",
-+                pHdr->EndpointID));
-+            /* try to stop receive at the device layer */
-+        DevStopRecv(&target->Device, asyncProc ? DEV_STOP_RECV_ASYNC : DEV_STOP_RECV_SYNC);
-+        status = A_OK;
-+    } else if (A_FAILED(status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                        ("Failed to get pending message : LookAhead Value: 0x%X (status = %d) \n",
-+                        LookAhead, status));
-+        if (pPacket != NULL) {
-+                /* clean up packet on error */
-+            HTC_RECYCLE_RX_PKT(target, pPacket);
-+        }
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCRecvMessagePendingHandler \n"));
-+
-+    return status;
-+}
-+
-+/* Makes a buffer available to the HTC module */
-+A_STATUS HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    HTC_ENDPOINT *pEndpoint;
-+    A_BOOL       unblockRecv = FALSE;
-+    A_STATUS     status = A_OK;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+                    ("+- HTCAddReceivePkt: endPointId: %d, buffer: 0x%X, length: %d\n",
-+                    pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->BufferLength));
-+
-+    do {
-+
-+        if (HTC_STOPPING(target)) {
-+            status = A_ECANCELED;
-+            break;
-+        }
-+
-+        AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
-+
-+        pEndpoint = &target->EndPoint[pPacket->Endpoint];
-+
-+        LOCK_HTC_RX(target);
-+
-+            /* store receive packet */
-+        HTC_PACKET_ENQUEUE(&pEndpoint->RxBuffers, pPacket);
-+
-+            /* check if we are blocked waiting for a new buffer */
-+        if (target->HTCStateFlags & HTC_STATE_WAIT_BUFFERS) {
-+            if (target->EpWaitingForBuffers == pPacket->Endpoint) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" receiver was blocked on ep:%d, unblocking.. \n",
-+                    target->EpWaitingForBuffers));
-+                target->HTCStateFlags &= ~HTC_STATE_WAIT_BUFFERS;
-+                target->EpWaitingForBuffers = ENDPOINT_MAX;
-+                unblockRecv = TRUE;
-+            }
-+        }
-+
-+        UNLOCK_HTC_RX(target);
-+
-+        if (unblockRecv && !HTC_STOPPING(target)) {
-+                /* TODO : implement a buffer threshold count? */
-+            DevEnableRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
-+        }
-+
-+    } while (FALSE);
-+
-+    return status;
-+}
-+
-+static void HTCFlushEndpointRX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint)
-+{
-+    HTC_PACKET  *pPacket;
-+
-+    LOCK_HTC_RX(target);
-+
-+    while (1) {
-+        pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
-+        if (NULL == pPacket) {
-+            break;
-+        }
-+        UNLOCK_HTC_RX(target);
-+        pPacket->Status = A_ECANCELED;
-+        pPacket->ActualLength = 0;
-+        AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("  Flushing RX packet:0x%X, length:%d, ep:%d \n",
-+                (A_UINT32)pPacket, pPacket->BufferLength, pPacket->Endpoint));
-+            /* give the packet back */
-+        pEndpoint->EpCallBacks.EpRecv(pEndpoint->EpCallBacks.pContext,
-+                                      pPacket);
-+        LOCK_HTC_RX(target);
-+    }
-+
-+    UNLOCK_HTC_RX(target);
-+
-+
-+}
-+
-+void HTCFlushRecvBuffers(HTC_TARGET *target)
-+{
-+    HTC_ENDPOINT    *pEndpoint;
-+    int             i;
-+
-+        /* NOTE: no need to flush endpoint 0, these buffers were
-+         * allocated as part of the HTC struct */
-+    for (i = ENDPOINT_1; i < ENDPOINT_MAX; i++) {
-+        pEndpoint = &target->EndPoint[i];
-+        if (pEndpoint->ServiceID == 0) {
-+                /* not in use.. */
-+            continue;
-+        }
-+        HTCFlushEndpointRX(target,pEndpoint);
-+    }
-+
-+
-+}
-+
-+
-diff --git a/drivers/ar6000/htc/htc_send.c b/drivers/ar6000/htc/htc_send.c
-new file mode 100644
-index 0000000..cf0dabe
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_send.c
-@@ -0,0 +1,538 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "htc_internal.h"
-+
-+#define DO_EP_TX_COMPLETION(ep,p)                                    \
-+{                                                                    \
-+    (p)->Completion = NULL;                                          \
-+    (ep)->EpCallBacks.EpTxComplete((ep)->EpCallBacks.pContext,(p));  \
-+}
-+
-+
-+/* call the distribute credits callback with the distribution */
-+#define DO_DISTRIBUTION(t,reason,description,pList) \
-+{                                             \
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,           \
-+        ("  calling distribute function (%s) (dfn:0x%X, ctxt:0x%X, dist:0x%X) \n", \
-+                (description),                                           \
-+                (A_UINT32)(t)->DistributeCredits,                        \
-+                (A_UINT32)(t)->pCredDistContext,                         \
-+                (A_UINT32)pList));                                       \
-+    (t)->DistributeCredits((t)->pCredDistContext,                        \
-+                           (pList),                                      \
-+                           (reason));                                    \
-+}
-+
-+/* our internal send packet completion handler when packets are submited to the AR6K device
-+ * layer */
-+static void HTCSendPktCompletionHandler(void *Context, HTC_PACKET *pPacket)
-+{
-+    HTC_TARGET      *target = (HTC_TARGET *)Context;
-+    HTC_ENDPOINT    *pEndpoint = &target->EndPoint[pPacket->Endpoint];
-+
-+
-+    if (A_FAILED(pPacket->Status)) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+            ("HTCSendPktCompletionHandler: request failed (status:%d, ep:%d) \n",
-+                pPacket->Status, pPacket->Endpoint));
-+    }
-+        /* first, fixup the head room we allocated */
-+    pPacket->pBuffer += HTC_HDR_LENGTH;
-+        /* do completion */
-+    DO_EP_TX_COMPLETION(pEndpoint,pPacket);
-+}
-+
-+A_STATUS HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 SendFlags)
-+{
-+    A_STATUS status;
-+    A_UINT8 *pHdrBuf;
-+    A_BOOL   sync = FALSE;
-+
-+        /* caller always provides headrooom */
-+    pPacket->pBuffer -= HTC_HDR_LENGTH;
-+    pHdrBuf = pPacket->pBuffer;
-+        /* setup frame header */
-+    A_SET_UINT16_FIELD(pHdrBuf,HTC_FRAME_HDR,PayloadLen,(A_UINT16)pPacket->ActualLength);
-+    A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,Flags,SendFlags);
-+    A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,EndpointID, (A_UINT8)pPacket->Endpoint);
-+
-+    if (pPacket->Completion == NULL) {
-+            /* mark that this request was synchronously issued */
-+        sync = TRUE;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+                    ("+-HTCIssueSend: transmit length : %d (%s) \n",
-+                    pPacket->ActualLength + HTC_HDR_LENGTH,
-+                    sync ? "SYNC" : "ASYNC" ));
-+
-+        /* send message to device */
-+    status = DevSendPacket(&target->Device,
-+                           pPacket,
-+                           pPacket->ActualLength + HTC_HDR_LENGTH);
-+
-+    if (sync) {
-+            /* use local sync variable.  If this was issued asynchronously, pPacket is no longer
-+             * safe to access. */
-+        pPacket->pBuffer += HTC_HDR_LENGTH;
-+    }
-+
-+    /* if this request was asynchronous, the packet completion routine will be invoked by
-+     * the device layer when the HIF layer completes the request */
-+
-+    return status;
-+}
-+
-+/* try to send the current packet or a packet at the head of the TX queue,
-+ * if there are no credits, the packet remains in the queue. */
-+static void HTCTrySend(HTC_TARGET      *target,
-+                       HTC_PACKET      *pPacketToSend,
-+                       HTC_ENDPOINT_ID ep)
-+{
-+    HTC_PACKET   *pPacket;
-+    HTC_ENDPOINT *pEndpoint;
-+    int          creditsRequired;
-+    A_UINT8      sendFlags;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (pPkt:0x%X)\n",(A_UINT32)pPacketToSend));
-+
-+    pEndpoint = &target->EndPoint[ep];
-+
-+    LOCK_HTC_TX(target);
-+
-+    if (pPacketToSend != NULL) {
-+        /* caller supplied us a packet to queue to the tail of the HTC TX queue before
-+         * we check the tx queue */
-+        HTC_PACKET_ENQUEUE(&pEndpoint->TxQueue,pPacketToSend);
-+        pEndpoint->CurrentTxQueueDepth++;
-+    }
-+
-+        /* now drain the TX queue for transmission as long as we have enough
-+         * credits */
-+
-+    while (1) {
-+
-+        if (HTC_QUEUE_EMPTY(&pEndpoint->TxQueue)) {
-+                /* nothing in the queue */
-+            break;
-+        }
-+
-+        sendFlags = 0;
-+
-+            /* get packet at head, but don't remove it */
-+        pPacket = HTC_GET_PKT_AT_HEAD(&pEndpoint->TxQueue);
-+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:0x%X , Queue Depth: %d\n",
-+                (A_UINT32)pPacket, pEndpoint->CurrentTxQueueDepth));
-+
-+            /* figure out how many credits this message requires */
-+        creditsRequired  = pPacket->ActualLength + HTC_HDR_LENGTH;
-+        creditsRequired += target->TargetCreditSize - 1;
-+        creditsRequired /= target->TargetCreditSize;
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Creds Required:%d   Got:%d\n",
-+                            creditsRequired, pEndpoint->CreditDist.TxCredits));
-+
-+        if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
-+
-+            /* not enough credits */
-+
-+            if (pPacket->Endpoint == ENDPOINT_0) {
-+                    /* leave it in the queue */
-+                break;
-+            }
-+                /* invoke the registered distribution function only if this is not
-+                 * endpoint 0, we let the driver layer provide more credits if it can.
-+                 * We pass the credit distribution list starting at the endpoint in question
-+                 * */
-+
-+                /* set how many credits we need  */
-+            pEndpoint->CreditDist.TxCreditsSeek =
-+                                    creditsRequired - pEndpoint->CreditDist.TxCredits;
-+            DO_DISTRIBUTION(target,
-+                            HTC_CREDIT_DIST_SEEK_CREDITS,
-+                            "Seek Credits",
-+                            &pEndpoint->CreditDist);
-+
-+            pEndpoint->CreditDist.TxCreditsSeek = 0;
-+
-+            if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
-+                    /* still not enough credits to send, leave packet in the queue */
-+                AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+                    (" Not enough credits for ep %d leaving packet in queue..\n",
-+                    pPacket->Endpoint));
-+                break;
-+            }
-+
-+        }
-+
-+        pEndpoint->CreditDist.TxCredits -= creditsRequired;
-+        INC_HTC_EP_STAT(pEndpoint, TxCreditsConsummed, creditsRequired);
-+
-+            /* check if we need credits */
-+        if (pEndpoint->CreditDist.TxCredits < pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
-+            sendFlags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditLowIndications, 1);
-+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Host Needs Credits  \n"));
-+        }
-+
-+            /* now we can fully dequeue */
-+        pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->TxQueue);
-+        pEndpoint->CurrentTxQueueDepth--;
-+
-+        INC_HTC_EP_STAT(pEndpoint, TxIssued, 1);
-+
-+        UNLOCK_HTC_TX(target);
-+
-+        HTCIssueSend(target, pPacket, sendFlags);
-+
-+        LOCK_HTC_TX(target);
-+
-+        /* go back and check for more messages */
-+    }
-+
-+    if (pEndpoint->CurrentTxQueueDepth >= pEndpoint->MaxTxQueueDepth) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Endpoint %d, TX queue is full, Depth:%d, Max:%d \n",
-+                        ep, pEndpoint->CurrentTxQueueDepth, pEndpoint->MaxTxQueueDepth));
-+        UNLOCK_HTC_TX(target);
-+            /* queue is now full, let caller know */
-+        if (pEndpoint->EpCallBacks.EpSendFull != NULL) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Calling driver's send full callback.... \n"));
-+            pEndpoint->EpCallBacks.EpSendFull(pEndpoint->EpCallBacks.pContext, ep);
-+        }
-+    } else {
-+        UNLOCK_HTC_TX(target);
-+            /* queue is now available for new packet, let caller know */
-+        if (pEndpoint->EpCallBacks.EpSendAvail)
-+            pEndpoint->EpCallBacks.EpSendAvail(pEndpoint->EpCallBacks.pContext, ep);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend:  \n"));
-+}
-+
-+/* HTC API - HTCSendPkt */
-+A_STATUS HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
-+{
-+    HTC_TARGET      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    HTC_ENDPOINT    *pEndpoint;
-+    HTC_ENDPOINT_ID ep;
-+    A_STATUS        status = A_OK;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+                    ("+HTCSendPkt: Enter endPointId: %d, buffer: 0x%X, length: %d \n",
-+                    pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->ActualLength));
-+
-+    ep = pPacket->Endpoint;
-+    AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
-+    pEndpoint = &target->EndPoint[ep];
-+
-+    do {
-+
-+        if (HTC_STOPPING(target)) {
-+            status = A_ECANCELED;
-+            pPacket->Status = status;
-+            DO_EP_TX_COMPLETION(pEndpoint,pPacket);
-+            break;
-+        }
-+            /* everything sent through this interface is asynchronous */
-+            /* fill in HTC completion routines */
-+        pPacket->Completion = HTCSendPktCompletionHandler;
-+        pPacket->pContext = target;
-+
-+        HTCTrySend(target, pPacket, ep);
-+
-+    } while (FALSE);
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCSendPkt \n"));
-+
-+    return status;
-+}
-+
-+
-+/* check TX queues to drain because of credit distribution update */
-+static INLINE void HTCCheckEndpointTxQueues(HTC_TARGET *target)
-+{
-+    HTC_ENDPOINT                *pEndpoint;
-+    HTC_ENDPOINT_CREDIT_DIST    *pDistItem;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCCheckEndpointTxQueues \n"));
-+    pDistItem = target->EpCreditDistributionListHead;
-+
-+        /* run through the credit distribution list to see
-+         * if there are packets queued
-+         * NOTE: no locks need to be taken since the distribution list
-+         * is not dynamic (cannot be re-ordered) and we are not modifying any state */
-+    while (pDistItem != NULL) {
-+        pEndpoint = (HTC_ENDPOINT *)pDistItem->pHTCReserved;
-+
-+        if (pEndpoint->CurrentTxQueueDepth > 0) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Ep %d has %d credits and %d Packets in TX Queue \n",
-+                    pDistItem->Endpoint, pEndpoint->CreditDist.TxCredits, pEndpoint->CurrentTxQueueDepth));
-+                /* try to start the stalled queue, this list is ordered by priority.
-+                 * Highest priority queue get's processed first, if there are credits available the
-+                 * highest priority queue will get a chance to reclaim credits from lower priority
-+                 * ones */
-+            HTCTrySend(target, NULL, pDistItem->Endpoint);
-+        }
-+
-+        pDistItem = pDistItem->pNext;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCCheckEndpointTxQueues \n"));
-+}
-+
-+/* process credit reports and call distribution function */
-+void HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint)
-+{
-+    int             i;
-+    HTC_ENDPOINT    *pEndpoint;
-+    int             totalCredits = 0;
-+    A_BOOL          doDist = FALSE;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCProcessCreditRpt, Credit Report Entries:%d \n", NumEntries));
-+
-+        /* lock out TX while we update credits */
-+    LOCK_HTC_TX(target);
-+
-+    for (i = 0; i < NumEntries; i++, pRpt++) {
-+        if (pRpt->EndpointID >= ENDPOINT_MAX) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+        pEndpoint = &target->EndPoint[pRpt->EndpointID];
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("  Endpoint %d got %d credits \n",
-+                pRpt->EndpointID, pRpt->Credits));
-+
-+
-+#ifdef HTC_EP_STAT_PROFILING
-+
-+        INC_HTC_EP_STAT(pEndpoint, TxCreditRpts, 1);
-+        INC_HTC_EP_STAT(pEndpoint, TxCreditsReturned, pRpt->Credits);
-+
-+        if (FromEndpoint == pRpt->EndpointID) {
-+                /* this credit report arrived on the same endpoint indicating it arrived in an RX
-+                 * packet */
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromRx, pRpt->Credits);
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromRx, 1);
-+        } else if (FromEndpoint == ENDPOINT_0) {
-+                /* this credit arrived on endpoint 0 as a NULL message */
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromEp0, pRpt->Credits);
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromEp0, 1);
-+        } else {
-+                /* arrived on another endpoint */
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditsFromOther, pRpt->Credits);
-+            INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromOther, 1);
-+        }
-+
-+#endif
-+
-+        if (ENDPOINT_0 == pRpt->EndpointID) {
-+                /* always give endpoint 0 credits back */
-+            pEndpoint->CreditDist.TxCredits += pRpt->Credits;
-+        } else {
-+                /* for all other endpoints, update credits to distribute, the distribution function
-+                 * will handle giving out credits back to the endpoints */
-+            pEndpoint->CreditDist.TxCreditsToDist += pRpt->Credits;
-+                /* flag that we have to do the distribution */
-+            doDist = TRUE;
-+        }
-+
-+        totalCredits += pRpt->Credits;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("  Report indicated %d credits to distribute \n", totalCredits));
-+
-+    if (doDist) {
-+            /* this was a credit return based on a completed send operations
-+             * note, this is done with the lock held */
-+        DO_DISTRIBUTION(target,
-+                        HTC_CREDIT_DIST_SEND_COMPLETE,
-+                        "Send Complete",
-+                        target->EpCreditDistributionListHead->pNext);
-+    }
-+
-+    UNLOCK_HTC_TX(target);
-+
-+    if (totalCredits) {
-+        HTCCheckEndpointTxQueues(target);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCProcessCreditRpt \n"));
-+}
-+
-+/* flush endpoint TX queue */
-+static void HTCFlushEndpointTX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint, HTC_TX_TAG Tag)
-+{
-+    HTC_PACKET          *pPacket;
-+    HTC_PACKET_QUEUE    discardQueue;
-+
-+        /* initialize the discard queue */
-+    INIT_HTC_PACKET_QUEUE(&discardQueue);
-+
-+    LOCK_HTC_TX(target);
-+
-+        /* interate from the front of the TX queue and flush out packets */
-+    ITERATE_OVER_LIST_ALLOW_REMOVE(&pEndpoint->TxQueue, pPacket, HTC_PACKET, ListLink) {
-+
-+            /* check for removal */
-+        if ((HTC_TX_PACKET_TAG_ALL == Tag) || (Tag == pPacket->PktInfo.AsTx.Tag)) {
-+                /* remove from queue */
-+            HTC_PACKET_REMOVE(pPacket);
-+                /* add it to the discard pile */
-+            HTC_PACKET_ENQUEUE(&discardQueue, pPacket);
-+            pEndpoint->CurrentTxQueueDepth--;
-+        }
-+
-+    } ITERATE_END;
-+
-+    UNLOCK_HTC_TX(target);
-+
-+        /* empty the discard queue */
-+    while (1) {
-+        pPacket = HTC_PACKET_DEQUEUE(&discardQueue);
-+        if (NULL == pPacket) {
-+            break;
-+        }
-+        pPacket->Status = A_ECANCELED;
-+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("  Flushing TX packet:0x%X, length:%d, ep:%d tag:0x%X \n",
-+                (A_UINT32)pPacket, pPacket->ActualLength, pPacket->Endpoint, pPacket->PktInfo.AsTx.Tag));
-+        DO_EP_TX_COMPLETION(pEndpoint,pPacket);
-+    }
-+
-+}
-+
-+void DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist)
-+{
-+#ifdef DEBUG
-+    HTC_ENDPOINT *pEndpoint = (HTC_ENDPOINT *)pEPDist->pHTCReserved;
-+#endif
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("--- EP : %d  ServiceID: 0x%X    --------------\n",
-+                        pEPDist->Endpoint, pEPDist->ServiceID));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" this:0x%X next:0x%X prev:0x%X\n",
-+                (A_UINT32)pEPDist, (A_UINT32)pEPDist->pNext, (A_UINT32)pEPDist->pPrev));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" DistFlags          : 0x%X \n", pEPDist->DistFlags));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsNorm      : %d \n", pEPDist->TxCreditsNorm));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsMin       : %d \n", pEPDist->TxCreditsMin));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCredits          : %d \n", pEPDist->TxCredits));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsAssigned  : %d \n", pEPDist->TxCreditsAssigned));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsSeek      : %d \n", pEPDist->TxCreditsSeek));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditSize       : %d \n", pEPDist->TxCreditSize));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsPerMaxMsg : %d \n", pEPDist->TxCreditsPerMaxMsg));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsToDist    : %d \n", pEPDist->TxCreditsToDist));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxQueueDepth       : %d \n", pEndpoint->CurrentTxQueueDepth));
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("----------------------------------------------------\n"));
-+}
-+
-+void DumpCreditDistStates(HTC_TARGET *target)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pEPList = target->EpCreditDistributionListHead;
-+
-+    while (pEPList != NULL) {
-+        DumpCreditDist(pEPList);
-+        pEPList = pEPList->pNext;
-+    }
-+
-+    if (target->DistributeCredits != NULL) {
-+        DO_DISTRIBUTION(target,
-+                        HTC_DUMP_CREDIT_STATE,
-+                        "Dump State",
-+                        NULL);
-+    }
-+}
-+
-+/* flush all send packets from all endpoint queues */
-+void HTCFlushSendPkts(HTC_TARGET *target)
-+{
-+    HTC_ENDPOINT    *pEndpoint;
-+    int             i;
-+
-+    DumpCreditDistStates(target);
-+
-+    for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
-+        pEndpoint = &target->EndPoint[i];
-+        if (pEndpoint->ServiceID == 0) {
-+                /* not in use.. */
-+            continue;
-+        }
-+        HTCFlushEndpointTX(target,pEndpoint,HTC_TX_PACKET_TAG_ALL);
-+    }
-+
-+}
-+
-+/* HTC API to flush an endpoint's TX queue*/
-+void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag)
-+{
-+    HTC_TARGET      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    HTC_ENDPOINT    *pEndpoint = &target->EndPoint[Endpoint];
-+
-+    if (pEndpoint->ServiceID == 0) {
-+        AR_DEBUG_ASSERT(FALSE);
-+        /* not in use.. */
-+        return;
-+    }
-+
-+    HTCFlushEndpointTX(target, pEndpoint, Tag);
-+}
-+
-+/* HTC API to indicate activity to the credit distribution function */
-+void HTCIndicateActivityChange(HTC_HANDLE      HTCHandle,
-+                               HTC_ENDPOINT_ID Endpoint,
-+                               A_BOOL          Active)
-+{
-+    HTC_TARGET      *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    HTC_ENDPOINT    *pEndpoint = &target->EndPoint[Endpoint];
-+    A_BOOL          doDist = FALSE;
-+
-+    if (pEndpoint->ServiceID == 0) {
-+        AR_DEBUG_ASSERT(FALSE);
-+        /* not in use.. */
-+        return;
-+    }
-+
-+    LOCK_HTC_TX(target);
-+
-+    if (Active) {
-+        if (!(pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE)) {
-+                /* mark active now */
-+            pEndpoint->CreditDist.DistFlags |= HTC_EP_ACTIVE;
-+            doDist = TRUE;
-+        }
-+    } else {
-+        if (pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE) {
-+                /* mark inactive now */
-+            pEndpoint->CreditDist.DistFlags &= ~HTC_EP_ACTIVE;
-+            doDist = TRUE;
-+        }
-+    }
-+
-+    if (doDist) {
-+        /* do distribution again based on activity change
-+         * note, this is done with the lock held */
-+        DO_DISTRIBUTION(target,
-+                        HTC_CREDIT_DIST_ACTIVITY_CHANGE,
-+                        "Activity Change",
-+                        target->EpCreditDistributionListHead->pNext);
-+    }
-+
-+    UNLOCK_HTC_TX(target);
-+
-+}
-diff --git a/drivers/ar6000/htc/htc_services.c b/drivers/ar6000/htc/htc_services.c
-new file mode 100644
-index 0000000..e5d50d1
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_services.c
-@@ -0,0 +1,403 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "htc_internal.h"
-+
-+void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket)
-+{
-+        /* not implemented
-+         * we do not send control TX frames during normal runtime, only during setup  */
-+    AR_DEBUG_ASSERT(FALSE);
-+}
-+
-+    /* callback when a control message arrives on this endpoint */
-+void HTCControlRecv(void *Context, HTC_PACKET *pPacket)
-+{
-+    AR_DEBUG_ASSERT(pPacket->Endpoint == ENDPOINT_0);
-+
-+        /* the only control messages we are expecting are NULL messages (credit resports), which should
-+         * never get here */
-+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    ("HTCControlRecv, got message with length:%d \n",
-+                    pPacket->ActualLength + HTC_HDR_LENGTH));
-+
-+        /* dump header and message */
-+    DebugDumpBytes(pPacket->pBuffer - HTC_HDR_LENGTH,
-+                   pPacket->ActualLength + HTC_HDR_LENGTH,
-+                   "Unexpected ENDPOINT 0 Message");
-+
-+    HTC_RECYCLE_RX_PKT((HTC_TARGET*)Context,pPacket);
-+}
-+
-+A_STATUS HTCSendSetupComplete(HTC_TARGET *target)
-+{
-+    HTC_PACKET             *pSendPacket = NULL;
-+    A_STATUS                status;
-+    HTC_SETUP_COMPLETE_MSG *pSetupComplete;
-+
-+    do {
-+           /* allocate a packet to send to the target */
-+        pSendPacket = HTC_ALLOC_CONTROL_TX(target);
-+
-+        if (NULL == pSendPacket) {
-+            status = A_NO_MEMORY;
-+            break;
-+        }
-+
-+            /* assemble setup complete message */
-+        pSetupComplete = (HTC_SETUP_COMPLETE_MSG *)pSendPacket->pBuffer;
-+        A_MEMZERO(pSetupComplete,sizeof(HTC_SETUP_COMPLETE_MSG));
-+        pSetupComplete->MessageID = HTC_MSG_SETUP_COMPLETE_ID;
-+
-+        SET_HTC_PACKET_INFO_TX(pSendPacket,
-+                               NULL,
-+                               (A_UINT8 *)pSetupComplete,
-+                               sizeof(HTC_SETUP_COMPLETE_MSG),
-+                               ENDPOINT_0,
-+                               HTC_SERVICE_TX_PACKET_TAG);
-+
-+            /* we want synchronous operation */
-+        pSendPacket->Completion = NULL;
-+            /* send the message */
-+        status = HTCIssueSend(target,pSendPacket,0);
-+
-+    } while (FALSE);
-+
-+    if (pSendPacket != NULL) {
-+        HTC_FREE_CONTROL_TX(target,pSendPacket);
-+    }
-+
-+    return status;
-+}
-+
-+
-+A_STATUS HTCConnectService(HTC_HANDLE               HTCHandle,
-+                           HTC_SERVICE_CONNECT_REQ  *pConnectReq,
-+                           HTC_SERVICE_CONNECT_RESP *pConnectResp)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    A_STATUS                            status = A_OK;
-+    HTC_PACKET                          *pRecvPacket = NULL;
-+    HTC_PACKET                          *pSendPacket = NULL;
-+    HTC_CONNECT_SERVICE_RESPONSE_MSG    *pResponseMsg;
-+    HTC_CONNECT_SERVICE_MSG             *pConnectMsg;
-+    HTC_ENDPOINT_ID                     assignedEndpoint = ENDPOINT_MAX;
-+    HTC_ENDPOINT                        *pEndpoint;
-+    int                                 maxMsgSize = 0;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:0x%X SvcID:0x%X \n",
-+               (A_UINT32)target, pConnectReq->ServiceID));
-+
-+    do {
-+
-+        AR_DEBUG_ASSERT(pConnectReq->ServiceID != 0);
-+
-+        if (HTC_CTRL_RSVD_SVC == pConnectReq->ServiceID) {
-+                /* special case for pseudo control service */
-+            assignedEndpoint = ENDPOINT_0;
-+            maxMsgSize = HTC_MAX_CONTROL_MESSAGE_LENGTH;
-+        } else {
-+                /* allocate a packet to send to the target */
-+            pSendPacket = HTC_ALLOC_CONTROL_TX(target);
-+
-+            if (NULL == pSendPacket) {
-+                AR_DEBUG_ASSERT(FALSE);
-+                status = A_NO_MEMORY;
-+                break;
-+            }
-+                /* assemble connect service message */
-+            pConnectMsg = (HTC_CONNECT_SERVICE_MSG *)pSendPacket->pBuffer;
-+            AR_DEBUG_ASSERT(pConnectMsg != NULL);
-+            A_MEMZERO(pConnectMsg,sizeof(HTC_CONNECT_SERVICE_MSG));
-+            pConnectMsg->MessageID = HTC_MSG_CONNECT_SERVICE_ID;
-+            pConnectMsg->ServiceID = pConnectReq->ServiceID;
-+            pConnectMsg->ConnectionFlags = pConnectReq->ConnectionFlags;
-+                /* check caller if it wants to transfer meta data */
-+            if ((pConnectReq->pMetaData != NULL) &&
-+                (pConnectReq->MetaDataLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
-+                    /* copy meta data into message buffer (after header ) */
-+                A_MEMCPY((A_UINT8 *)pConnectMsg + sizeof(HTC_CONNECT_SERVICE_MSG),
-+                         pConnectReq->pMetaData,
-+                         pConnectReq->MetaDataLength);
-+                pConnectMsg->ServiceMetaLength = pConnectReq->MetaDataLength;
-+            }
-+
-+            SET_HTC_PACKET_INFO_TX(pSendPacket,
-+                                   NULL,
-+                                   (A_UINT8 *)pConnectMsg,
-+                                   sizeof(HTC_CONNECT_SERVICE_MSG) + pConnectMsg->ServiceMetaLength,
-+                                   ENDPOINT_0,
-+                                   HTC_SERVICE_TX_PACKET_TAG);
-+
-+                /* we want synchronous operation */
-+            pSendPacket->Completion = NULL;
-+
-+            status = HTCIssueSend(target,pSendPacket,0);
-+
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+
-+                /* wait for response */
-+            status = HTCWaitforControlMessage(target, &pRecvPacket);
-+
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+                /* we controlled the buffer creation so it has to be properly aligned */
-+            pResponseMsg = (HTC_CONNECT_SERVICE_RESPONSE_MSG *)pRecvPacket->pBuffer;
-+
-+            if ((pResponseMsg->MessageID != HTC_MSG_CONNECT_SERVICE_RESPONSE_ID) ||
-+                (pRecvPacket->ActualLength < sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG))) {
-+                    /* this message is not valid */
-+                AR_DEBUG_ASSERT(FALSE);
-+                status = A_EPROTO;
-+                break;
-+            }
-+
-+            pConnectResp->ConnectRespCode = pResponseMsg->Status;
-+                /* check response status */
-+            if (pResponseMsg->Status != HTC_SERVICE_SUCCESS) {
-+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+                    (" Target failed service 0x%X connect request (status:%d)\n",
-+                                pResponseMsg->ServiceID, pResponseMsg->Status));
-+                status = A_EPROTO;
-+                break;
-+            }
-+
-+            assignedEndpoint = pResponseMsg->EndpointID;
-+            maxMsgSize = pResponseMsg->MaxMsgSize;
-+
-+            if ((pConnectResp->pMetaData != NULL) &&
-+                (pResponseMsg->ServiceMetaLength > 0) &&
-+                (pResponseMsg->ServiceMetaLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
-+                    /* caller supplied a buffer and the target responded with data */
-+                int copyLength = min((int)pConnectResp->BufferLength, (int)pResponseMsg->ServiceMetaLength);
-+                    /* copy the meta data */
-+                A_MEMCPY(pConnectResp->pMetaData,
-+                         ((A_UINT8 *)pResponseMsg) + sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG),
-+                         copyLength);
-+                pConnectResp->ActualLength = copyLength;
-+            }
-+
-+        }
-+
-+            /* the rest of these are parameter checks so set the error status */
-+        status = A_EPROTO;
-+
-+        if (assignedEndpoint >= ENDPOINT_MAX) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+        if (0 == maxMsgSize) {
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+        pEndpoint = &target->EndPoint[assignedEndpoint];
-+
-+        if (pEndpoint->ServiceID != 0) {
-+            /* endpoint already in use! */
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+
-+            /* return assigned endpoint to caller */
-+        pConnectResp->Endpoint = assignedEndpoint;
-+        pConnectResp->MaxMsgLength = maxMsgSize;
-+
-+            /* setup the endpoint */
-+        pEndpoint->ServiceID = pConnectReq->ServiceID; /* this marks the endpoint in use */
-+        pEndpoint->MaxTxQueueDepth = pConnectReq->MaxSendQueueDepth;
-+        pEndpoint->MaxMsgLength = maxMsgSize;
-+            /* copy all the callbacks */
-+        pEndpoint->EpCallBacks = pConnectReq->EpCallbacks;
-+        INIT_HTC_PACKET_QUEUE(&pEndpoint->RxBuffers);
-+        INIT_HTC_PACKET_QUEUE(&pEndpoint->TxQueue);
-+            /* set the credit distribution info for this endpoint, this information is
-+             * passed back to the credit distribution callback function */
-+        pEndpoint->CreditDist.ServiceID = pConnectReq->ServiceID;
-+        pEndpoint->CreditDist.pHTCReserved = pEndpoint;
-+        pEndpoint->CreditDist.Endpoint = assignedEndpoint;
-+        pEndpoint->CreditDist.TxCreditSize = target->TargetCreditSize;
-+        pEndpoint->CreditDist.TxCreditsPerMaxMsg = maxMsgSize / target->TargetCreditSize;
-+
-+        if (0 == pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
-+            pEndpoint->CreditDist.TxCreditsPerMaxMsg = 1;
-+        }
-+
-+        status = A_OK;
-+
-+    } while (FALSE);
-+
-+    if (pSendPacket != NULL) {
-+        HTC_FREE_CONTROL_TX(target,pSendPacket);
-+    }
-+
-+    if (pRecvPacket != NULL) {
-+        HTC_FREE_CONTROL_RX(target,pRecvPacket);
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCConnectService \n"));
-+
-+    return status;
-+}
-+
-+static void AddToEndpointDistList(HTC_TARGET *target, HTC_ENDPOINT_CREDIT_DIST *pEpDist)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEntry,*pLastEntry;
-+
-+    if (NULL == target->EpCreditDistributionListHead) {
-+        target->EpCreditDistributionListHead = pEpDist;
-+        pEpDist->pNext = NULL;
-+        pEpDist->pPrev = NULL;
-+        return;
-+    }
-+
-+        /* queue to the end of the list, this does not have to be very
-+         * fast since this list is built at startup time */
-+    pCurEntry = target->EpCreditDistributionListHead;
-+
-+    while (pCurEntry) {
-+        pLastEntry = pCurEntry;
-+        pCurEntry = pCurEntry->pNext;
-+    }
-+
-+    pLastEntry->pNext = pEpDist;
-+    pEpDist->pPrev = pLastEntry;
-+    pEpDist->pNext = NULL;
-+}
-+
-+
-+
-+/* default credit init callback */
-+static void HTCDefaultCreditInit(void                     *Context,
-+                                 HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+                                 int                      TotalCredits)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+    int                      totalEps = 0;
-+    int                      creditsPerEndpoint;
-+
-+    pCurEpDist = pEPList;
-+        /* first run through the list and figure out how many endpoints we are dealing with */
-+    while (pCurEpDist != NULL) {
-+        pCurEpDist = pCurEpDist->pNext;
-+        totalEps++;
-+    }
-+
-+        /* even distribution */
-+    creditsPerEndpoint = TotalCredits/totalEps;
-+
-+    pCurEpDist = pEPList;
-+        /* run through the list and set minimum and normal credits and
-+         * provide the endpoint with some credits to start */
-+    while (pCurEpDist != NULL) {
-+
-+        if (creditsPerEndpoint < pCurEpDist->TxCreditsPerMaxMsg) {
-+                /* too many endpoints and not enough credits */
-+            AR_DEBUG_ASSERT(FALSE);
-+            break;
-+        }
-+            /* our minimum is set for at least 1 max message */
-+        pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
-+            /* this value is ignored by our credit alg, since we do
-+             * not dynamically adjust credits, this is the policy of
-+             * the "default" credit distribution, something simple and easy */
-+        pCurEpDist->TxCreditsNorm = 0xFFFF;
-+            /* give the endpoint minimum credits */
-+        pCurEpDist->TxCredits = creditsPerEndpoint;
-+        pCurEpDist->TxCreditsAssigned = creditsPerEndpoint;
-+        pCurEpDist = pCurEpDist->pNext;
-+    }
-+
-+}
-+
-+/* default credit distribution callback, NOTE, this callback holds the TX lock */
-+void HTCDefaultCreditDist(void                     *Context,
-+                          HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
-+                          HTC_CREDIT_DIST_REASON   Reason)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+
-+    if (Reason == HTC_CREDIT_DIST_SEND_COMPLETE) {
-+        pCurEpDist = pEPDistList;
-+            /* simple distribution */
-+        while (pCurEpDist != NULL) {
-+            if (pCurEpDist->TxCreditsToDist > 0) {
-+                    /* just give the endpoint back the credits */
-+                pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
-+                pCurEpDist->TxCreditsToDist = 0;
-+            }
-+            pCurEpDist = pCurEpDist->pNext;
-+        }
-+    }
-+
-+    /* note we do not need to handle the other reason codes as this is a very
-+     * simple distribution scheme, no need to seek for more credits or handle inactivity */
-+}
-+
-+void HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
-+                              void                     *pCreditDistContext,
-+                              HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
-+                              HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
-+                              HTC_SERVICE_ID           ServicePriorityOrder[],
-+                              int                      ListLength)
-+{
-+    HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+    int i;
-+    int ep;
-+
-+    if (CreditInitFunc != NULL) {
-+            /* caller has supplied their own distribution functions */
-+        target->InitCredits = CreditInitFunc;
-+        AR_DEBUG_ASSERT(CreditDistFunc != NULL);
-+        target->DistributeCredits = CreditDistFunc;
-+        target->pCredDistContext = pCreditDistContext;
-+    } else {
-+        /* caller wants HTC to do distribution */
-+        /* if caller wants service to handle distributions then
-+         * it must set both of these to NULL! */
-+        AR_DEBUG_ASSERT(CreditDistFunc == NULL);
-+        target->InitCredits = HTCDefaultCreditInit;
-+        target->DistributeCredits = HTCDefaultCreditDist;
-+        target->pCredDistContext = target;
-+    }
-+
-+        /* always add HTC control endpoint first, we only expose the list after the
-+         * first one, this is added for TX queue checking */
-+    AddToEndpointDistList(target, &target->EndPoint[ENDPOINT_0].CreditDist);
-+
-+        /* build the list of credit distribution structures in priority order
-+         * supplied by the caller, these will follow endpoint 0 */
-+    for (i = 0; i < ListLength; i++) {
-+            /* match services with endpoints and add the endpoints to the distribution list
-+             * in FIFO order */
-+        for (ep = ENDPOINT_1; ep < ENDPOINT_MAX; ep++) {
-+            if (target->EndPoint[ep].ServiceID == ServicePriorityOrder[i]) {
-+                    /* queue this one to the list */
-+                AddToEndpointDistList(target, &target->EndPoint[ep].CreditDist);
-+                break;
-+            }
-+        }
-+        AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
-+    }
-+
-+}
-diff --git a/drivers/ar6000/include/AR6001_regdump.h b/drivers/ar6000/include/AR6001_regdump.h
-new file mode 100644
-index 0000000..c1bcade
---- /dev/null
-+++ b/drivers/ar6000/include/AR6001_regdump.h
-@@ -0,0 +1,100 @@
-+/*
-+ * Copyright (c) 2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __AR6000_REGDUMP_H__
-+#define __AR6000_REGDUMP_H__
-+
-+#if !defined(__ASSEMBLER__)
-+/*
-+ * Target CPU state at the time of failure is reflected
-+ * in a register dump, which the Host can fetch through
-+ * the diagnostic window.
-+ */
-+
-+struct MIPS_exception_frame_s {
-+    A_UINT32 pc;        /* Program Counter */
-+    A_UINT32 at;        /* MIPS General Purpose registers */
-+    A_UINT32 v0;
-+    A_UINT32 v1;
-+    A_UINT32 a0;
-+    A_UINT32 a1;
-+    A_UINT32 a2;
-+    A_UINT32 a3;
-+    A_UINT32 t0;
-+    A_UINT32 t1;
-+    A_UINT32 t2;
-+    A_UINT32 t3;
-+    A_UINT32 t4;
-+    A_UINT32 t5;
-+    A_UINT32 t6;
-+    A_UINT32 t7;
-+    A_UINT32 s0;
-+    A_UINT32 s1;
-+    A_UINT32 s2;
-+    A_UINT32 s3;
-+    A_UINT32 s4;
-+    A_UINT32 s5;
-+    A_UINT32 s6;
-+    A_UINT32 s7;
-+    A_UINT32 t8;
-+    A_UINT32 t9;
-+    A_UINT32 k0;
-+    A_UINT32 k1;
-+    A_UINT32 gp;
-+    A_UINT32 sp;
-+    A_UINT32 s8;
-+    A_UINT32 ra;
-+    A_UINT32 cause; /* Selected coprocessor regs */
-+    A_UINT32 status;
-+};
-+typedef struct MIPS_exception_frame_s CPU_exception_frame_t;
-+
-+#endif
-+
-+/*
-+ * Offsets into MIPS_exception_frame structure, for use in assembler code
-+ * MUST MATCH C STRUCTURE ABOVE
-+ */
-+#define RD_pc           0
-+#define RD_at           1
-+#define RD_v0           2
-+#define RD_v1           3
-+#define RD_a0           4
-+#define RD_a1           5
-+#define RD_a2           6
-+#define RD_a3           7
-+#define RD_t0           8
-+#define RD_t1           9
-+#define RD_t2           10
-+#define RD_t3           11
-+#define RD_t4           12
-+#define RD_t5           13
-+#define RD_t6           14
-+#define RD_t7           15
-+#define RD_s0           16
-+#define RD_s1           17
-+#define RD_s2           18
-+#define RD_s3           19
-+#define RD_s4           20
-+#define RD_s5           21
-+#define RD_s6           22
-+#define RD_s7           23
-+#define RD_t8           24
-+#define RD_t9           25
-+#define RD_k0           26
-+#define RD_k1           27
-+#define RD_gp           28
-+#define RD_sp           29
-+#define RD_s8           30
-+#define RD_ra           31
-+#define RD_cause        32
-+#define RD_status       33
-+
-+#define RD_SIZE         (34*4) /* Space for this number of words */
-+
-+#endif /* __AR6000_REGDUMP_H__ */
-diff --git a/drivers/ar6000/include/AR6K_version.h b/drivers/ar6000/include/AR6K_version.h
-new file mode 100644
-index 0000000..d5b2a20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6K_version.h
-@@ -0,0 +1,36 @@
-+#define __VER_MAJOR_ 2
-+#define __VER_MINOR_ 0
-+#define __VER_PATCH_ 0
-+
-+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * The makear6ksdk script (used for release builds) modifies the following line.
-+ */
-+#define __BUILD_NUMBER_ 18
-+
-+
-+/* Format of the version number. */
-+#define VER_MAJOR_BIT_OFFSET		28
-+#define VER_MINOR_BIT_OFFSET		24
-+#define VER_PATCH_BIT_OFFSET		16
-+#define VER_BUILD_NUM_BIT_OFFSET	0
-+
-+
-+/*
-+ * The version has the following format:
-+ * Bits 28-31: Major version
-+ * Bits 24-27: Minor version
-+ * Bits 16-23: Patch version
-+ * Bits 0-15:  Build number (automatically generated during build process )
-+ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
-+ *
-+ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
-+ */
-+#define AR6K_SW_VERSION 	( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
-+
-+
-diff --git a/drivers/ar6000/include/AR6K_version.h.NEW b/drivers/ar6000/include/AR6K_version.h.NEW
-new file mode 100644
-index 0000000..d5b2a20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6K_version.h.NEW
-@@ -0,0 +1,36 @@
-+#define __VER_MAJOR_ 2
-+#define __VER_MINOR_ 0
-+#define __VER_PATCH_ 0
-+
-+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * The makear6ksdk script (used for release builds) modifies the following line.
-+ */
-+#define __BUILD_NUMBER_ 18
-+
-+
-+/* Format of the version number. */
-+#define VER_MAJOR_BIT_OFFSET		28
-+#define VER_MINOR_BIT_OFFSET		24
-+#define VER_PATCH_BIT_OFFSET		16
-+#define VER_BUILD_NUM_BIT_OFFSET	0
-+
-+
-+/*
-+ * The version has the following format:
-+ * Bits 28-31: Major version
-+ * Bits 24-27: Minor version
-+ * Bits 16-23: Patch version
-+ * Bits 0-15:  Build number (automatically generated during build process )
-+ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
-+ *
-+ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
-+ */
-+#define AR6K_SW_VERSION 	( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
-+
-+
-diff --git a/drivers/ar6000/include/AR6Khwreg.h b/drivers/ar6000/include/AR6Khwreg.h
-new file mode 100644
-index 0000000..ecfdf20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6Khwreg.h
-@@ -0,0 +1,147 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions for AR6001 registers
-+ * that may be directly manipulated by Host software.
-+ */
-+
-+#ifndef __AR6KHWREG_H__
-+#define __AR6KHWREG_H__
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/* Host registers */
-+#define HOST_INT_STATUS_ADDRESS                  0x00000400
-+#define CPU_INT_STATUS_ADDRESS                   0x00000401
-+#define ERROR_INT_STATUS_ADDRESS                 0x00000402
-+#define INT_STATUS_ENABLE_ADDRESS                0x00000418
-+#define CPU_INT_STATUS_ENABLE_ADDRESS            0x00000419
-+#define COUNT_ADDRESS                            0x00000420
-+#define COUNT_DEC_ADDRESS                        0x00000440
-+#define WINDOW_DATA_ADDRESS                      0x00000474
-+#define WINDOW_WRITE_ADDR_ADDRESS                0x00000478
-+#define WINDOW_READ_ADDR_ADDRESS                 0x0000047c
-+
-+/* Target addresses */
-+#define RESET_CONTROL_ADDRESS                    0x0c000000
-+#define MC_REMAP_VALID_ADDRESS                   0x0c004080
-+#define MC_REMAP_SIZE_ADDRESS                    0x0c004100
-+#define MC_REMAP_COMPARE_ADDRESS                 0x0c004180
-+#define MC_REMAP_TARGET_ADDRESS                  0x0c004200
-+#define LOCAL_COUNT_ADDRESS                      0x0c014080
-+#define LOCAL_SCRATCH_ADDRESS                    0x0c0140c0
-+
-+
-+#define INT_STATUS_ENABLE_ERROR_MSB              7
-+#define INT_STATUS_ENABLE_ERROR_LSB              7
-+#define INT_STATUS_ENABLE_ERROR_MASK             0x00000080
-+#define INT_STATUS_ENABLE_ERROR_GET(x)           (((x) & INT_STATUS_ENABLE_ERROR_MASK) >> INT_STATUS_ENABLE_ERROR_LSB)
-+#define INT_STATUS_ENABLE_ERROR_SET(x)           (((x) << INT_STATUS_ENABLE_ERROR_LSB) & INT_STATUS_ENABLE_ERROR_MASK)
-+
-+#define INT_STATUS_ENABLE_CPU_MSB                6
-+#define INT_STATUS_ENABLE_CPU_LSB                6
-+#define INT_STATUS_ENABLE_CPU_MASK               0x00000040
-+#define INT_STATUS_ENABLE_CPU_GET(x)             (((x) & INT_STATUS_ENABLE_CPU_MASK) >> INT_STATUS_ENABLE_CPU_LSB)
-+#define INT_STATUS_ENABLE_CPU_SET(x)             (((x) << INT_STATUS_ENABLE_CPU_LSB) & INT_STATUS_ENABLE_CPU_MASK)
-+
-+#define INT_STATUS_ENABLE_COUNTER_MSB            4
-+#define INT_STATUS_ENABLE_COUNTER_LSB            4
-+#define INT_STATUS_ENABLE_COUNTER_MASK           0x00000010
-+#define INT_STATUS_ENABLE_COUNTER_GET(x)         (((x) & INT_STATUS_ENABLE_COUNTER_MASK) >> INT_STATUS_ENABLE_COUNTER_LSB)
-+#define INT_STATUS_ENABLE_COUNTER_SET(x)         (((x) << INT_STATUS_ENABLE_COUNTER_LSB) & INT_STATUS_ENABLE_COUNTER_MASK)
-+
-+#define INT_STATUS_ENABLE_MBOX_DATA_MSB          3
-+#define INT_STATUS_ENABLE_MBOX_DATA_LSB          0
-+#define INT_STATUS_ENABLE_MBOX_DATA_MASK         0x0000000f
-+#define INT_STATUS_ENABLE_MBOX_DATA_GET(x)       (((x) & INT_STATUS_ENABLE_MBOX_DATA_MASK) >> INT_STATUS_ENABLE_MBOX_DATA_LSB)
-+#define INT_STATUS_ENABLE_MBOX_DATA_SET(x)       (((x) << INT_STATUS_ENABLE_MBOX_DATA_LSB) & INT_STATUS_ENABLE_MBOX_DATA_MASK)
-+
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MSB     1
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB     1
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK    0x00000002
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_GET(x)  (((x) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK) >> ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB)
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(x)  (((x) << ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
-+
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MSB      0
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB      0
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK     0x00000001
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_GET(x)   (((x) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK) >> ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB)
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(x)   (((x) << ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
-+
-+
-+#define CPU_INT_STATUS_ENABLE_BIT_MSB            7
-+#define CPU_INT_STATUS_ENABLE_BIT_LSB            0
-+#define CPU_INT_STATUS_ENABLE_BIT_MASK           0x000000ff
-+#define CPU_INT_STATUS_ENABLE_BIT_GET(x)         (((x) & CPU_INT_STATUS_ENABLE_BIT_MASK) >> CPU_INT_STATUS_ENABLE_BIT_LSB)
-+#define CPU_INT_STATUS_ENABLE_BIT_SET(x)         (((x) << CPU_INT_STATUS_ENABLE_BIT_LSB) & CPU_INT_STATUS_ENABLE_BIT_MASK)
-+
-+#define COUNTER_INT_STATUS_ENABLE_BIT_MSB        7
-+#define COUNTER_INT_STATUS_ENABLE_BIT_LSB        0
-+#define COUNTER_INT_STATUS_ENABLE_BIT_MASK       0x000000ff
-+#define COUNTER_INT_STATUS_ENABLE_BIT_GET(x)     (((x) & COUNTER_INT_STATUS_ENABLE_BIT_MASK) >> COUNTER_INT_STATUS_ENABLE_BIT_LSB)
-+#define COUNTER_INT_STATUS_ENABLE_BIT_SET(x)     (((x) << COUNTER_INT_STATUS_ENABLE_BIT_LSB) & COUNTER_INT_STATUS_ENABLE_BIT_MASK)
-+
-+#define ERROR_INT_STATUS_WAKEUP_MSB              2
-+#define ERROR_INT_STATUS_WAKEUP_LSB              2
-+#define ERROR_INT_STATUS_WAKEUP_MASK             0x00000004
-+#define ERROR_INT_STATUS_WAKEUP_GET(x)           (((x) & ERROR_INT_STATUS_WAKEUP_MASK) >> ERROR_INT_STATUS_WAKEUP_LSB)
-+#define ERROR_INT_STATUS_WAKEUP_SET(x)           (((x) << ERROR_INT_STATUS_WAKEUP_LSB) & ERROR_INT_STATUS_WAKEUP_MASK)
-+
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_MSB        1
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_LSB        1
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_MASK       0x00000002
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_GET(x)     (((x) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK) >> ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_SET(x)     (((x) << ERROR_INT_STATUS_RX_UNDERFLOW_LSB) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK)
-+
-+#define ERROR_INT_STATUS_TX_OVERFLOW_MSB         0
-+#define ERROR_INT_STATUS_TX_OVERFLOW_LSB         0
-+#define ERROR_INT_STATUS_TX_OVERFLOW_MASK        0x00000001
-+#define ERROR_INT_STATUS_TX_OVERFLOW_GET(x)      (((x) & ERROR_INT_STATUS_TX_OVERFLOW_MASK) >> ERROR_INT_STATUS_TX_OVERFLOW_LSB)
-+#define ERROR_INT_STATUS_TX_OVERFLOW_SET(x)      (((x) << ERROR_INT_STATUS_TX_OVERFLOW_LSB) & ERROR_INT_STATUS_TX_OVERFLOW_MASK)
-+
-+#define HOST_INT_STATUS_ERROR_MSB                7
-+#define HOST_INT_STATUS_ERROR_LSB                7
-+#define HOST_INT_STATUS_ERROR_MASK               0x00000080
-+#define HOST_INT_STATUS_ERROR_GET(x)             (((x) & HOST_INT_STATUS_ERROR_MASK) >> HOST_INT_STATUS_ERROR_LSB)
-+#define HOST_INT_STATUS_ERROR_SET(x)             (((x) << HOST_INT_STATUS_ERROR_LSB) & HOST_INT_STATUS_ERROR_MASK)
-+
-+#define HOST_INT_STATUS_CPU_MSB                  6
-+#define HOST_INT_STATUS_CPU_LSB                  6
-+#define HOST_INT_STATUS_CPU_MASK                 0x00000040
-+#define HOST_INT_STATUS_CPU_GET(x)               (((x) & HOST_INT_STATUS_CPU_MASK) >> HOST_INT_STATUS_CPU_LSB)
-+#define HOST_INT_STATUS_CPU_SET(x)               (((x) << HOST_INT_STATUS_CPU_LSB) & HOST_INT_STATUS_CPU_MASK)
-+
-+#define HOST_INT_STATUS_COUNTER_MSB              4
-+#define HOST_INT_STATUS_COUNTER_LSB              4
-+#define HOST_INT_STATUS_COUNTER_MASK             0x00000010
-+#define HOST_INT_STATUS_COUNTER_GET(x)           (((x) & HOST_INT_STATUS_COUNTER_MASK) >> HOST_INT_STATUS_COUNTER_LSB)
-+#define HOST_INT_STATUS_COUNTER_SET(x)           (((x) << HOST_INT_STATUS_COUNTER_LSB) & HOST_INT_STATUS_COUNTER_MASK)
-+
-+#define RESET_CONTROL_WARM_RST_MSB               7
-+#define RESET_CONTROL_WARM_RST_LSB               7
-+#define RESET_CONTROL_WARM_RST_MASK              0x00000080
-+#define RESET_CONTROL_WARM_RST_GET(x)            (((x) & RESET_CONTROL_WARM_RST_MASK) >> RESET_CONTROL_WARM_RST_LSB)
-+#define RESET_CONTROL_WARM_RST_SET(x)            (((x) << RESET_CONTROL_WARM_RST_LSB) & RESET_CONTROL_WARM_RST_MASK)
-+
-+#define RESET_CONTROL_COLD_RST_MSB               8
-+#define RESET_CONTROL_COLD_RST_LSB               8
-+#define RESET_CONTROL_COLD_RST_MASK              0x00000100
-+#define RESET_CONTROL_COLD_RST_GET(x)            (((x) & RESET_CONTROL_COLD_RST_MASK) >> RESET_CONTROL_COLD_RST_LSB)
-+#define RESET_CONTROL_COLD_RST_SET(x)            (((x) << RESET_CONTROL_COLD_RST_LSB) & RESET_CONTROL_COLD_RST_MASK)
-+
-+#define RESET_CAUSE_LAST_MSB                     2
-+#define RESET_CAUSE_LAST_LSB                     0
-+#define RESET_CAUSE_LAST_MASK                    0x00000007
-+#define RESET_CAUSE_LAST_GET(x)                  (((x) & RESET_CAUSE_LAST_MASK) >> RESET_CAUSE_LAST_LSB)
-+#define RESET_CAUSE_LAST_SET(x)                  (((x) << RESET_CAUSE_LAST_LSB) & RESET_CAUSE_LAST_MASK)
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* __AR6KHWREG_H__ */
-diff --git a/drivers/ar6000/include/a_config.h b/drivers/ar6000/include/a_config.h
-new file mode 100644
-index 0000000..627b298
---- /dev/null
-+++ b/drivers/ar6000/include/a_config.h
-@@ -0,0 +1,27 @@
-+#ifndef _A_CONFIG_H_
-+#define _A_CONFIG_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+/*
-+ * This file contains software configuration options that enables
-+ * specific software "features"
-+ */
-+#include "../ar6000/config_linux.h"
-+
-+#endif
-diff --git a/drivers/ar6000/include/a_debug.h b/drivers/ar6000/include/a_debug.h
-new file mode 100644
-index 0000000..4b0b351
---- /dev/null
-+++ b/drivers/ar6000/include/a_debug.h
-@@ -0,0 +1,41 @@
-+#ifndef _A_DEBUG_H_
-+#define _A_DEBUG_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include <a_types.h>
-+#include <a_osapi.h>
-+
-+#define DBG_INFO		0x00000001
-+#define DBG_ERROR		0x00000002
-+#define DBG_WARNING		0x00000004
-+#define DBG_SDIO		0x00000008
-+#define DBG_HIF			0x00000010
-+#define DBG_HTC			0x00000020
-+#define DBG_WMI			0x00000040
-+#define DBG_WMI2		0x00000080
-+#define DBG_DRIVER		0x00000100
-+
-+#define DBG_DEFAULTS	(DBG_ERROR|DBG_WARNING)
-+
-+#include "../ar6000/debug_linux.h"
-+
-+#endif
-diff --git a/drivers/ar6000/include/a_drv.h b/drivers/ar6000/include/a_drv.h
-new file mode 100644
-index 0000000..07e52d1
---- /dev/null
-+++ b/drivers/ar6000/include/a_drv.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_DRV_H_
-+#define _A_DRV_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_drv.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "../ar6000/athdrv_linux.h"
-+
-+#endif /* _ADRV_H_ */
-diff --git a/drivers/ar6000/include/a_drv_api.h b/drivers/ar6000/include/a_drv_api.h
-new file mode 100644
-index 0000000..7531726
---- /dev/null
-+++ b/drivers/ar6000/include/a_drv_api.h
-@@ -0,0 +1,185 @@
-+#ifndef _A_DRV_API_H_
-+#define _A_DRV_API_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/****************************************************************************/
-+/****************************************************************************/
-+/**                                                                        **/
-+/** WMI related hooks                                                      **/
-+/**                                                                        **/
-+/****************************************************************************/
-+/****************************************************************************/
-+
-+#include <ar6000_api.h>
-+
-+#define A_WMI_CHANNELLIST_RX(devt, numChan, chanList)	\
-+	ar6000_channelList_rx((devt), (numChan), (chanList))
-+
-+#define A_WMI_SET_NUMDATAENDPTS(devt, num)	\
-+	ar6000_set_numdataendpts((devt), (num))
-+
-+#define A_WMI_CONTROL_TX(devt, osbuf, streamID)	\
-+	ar6000_control_tx((devt), (osbuf), (streamID))
-+
-+#define A_WMI_TARGETSTATS_EVENT(devt, pStats)	\
-+	ar6000_targetStats_event((devt), (pStats))
-+
-+#define A_WMI_SCANCOMPLETE_EVENT(devt, status)	\
-+	ar6000_scanComplete_event((devt), (status))
-+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+
-+#define A_WMI_DSET_DATA_REQ(devt, access_cookie, offset, length, targ_buf, targ_reply_fn, targ_reply_arg)	\
-+	ar6000_dset_data_req((devt), (access_cookie), (offset), (length), (targ_buf), (targ_reply_fn), (targ_reply_arg))
-+
-+#define A_WMI_DSET_CLOSE(devt, access_cookie)	\
-+	ar6000_dset_close((devt), (access_cookie))
-+
-+#endif
-+
-+#define A_WMI_DSET_OPEN_REQ(devt, id, targ_handle, targ_reply_fn, targ_reply_arg) \
-+	ar6000_dset_open_req((devt), (id), (targ_handle), (targ_reply_fn), (targ_reply_arg))
-+
-+#define A_WMI_CONNECT_EVENT(devt, channel, bssid, listenInterval, beaconInterval, networkType, beaconIeLen, assocReqLen, assocRespLen, assocInfo) \
-+	ar6000_connect_event((devt), (channel), (bssid), (listenInterval), (beaconInterval), (networkType), (beaconIeLen), (assocReqLen), (assocRespLen), (assocInfo))
-+
-+#define A_WMI_REGDOMAIN_EVENT(devt, regCode)	\
-+	ar6000_regDomain_event((devt), (regCode))
-+
-+#define A_WMI_NEIGHBORREPORT_EVENT(devt, numAps, info)	\
-+	ar6000_neighborReport_event((devt), (numAps), (info))
-+
-+#define A_WMI_DISCONNECT_EVENT(devt, reason, bssid, assocRespLen, assocInfo, protocolReasonStatus)	\
-+	ar6000_disconnect_event((devt), (reason), (bssid), (assocRespLen), (assocInfo), (protocolReasonStatus))
-+
-+#define A_WMI_TKIP_MICERR_EVENT(devt, keyid, ismcast)	\
-+	ar6000_tkip_micerr_event((devt), (keyid), (ismcast))
-+
-+#define A_WMI_BITRATE_RX(devt, rateKbps)	\
-+	ar6000_bitrate_rx((devt), (rateKbps))
-+
-+#define A_WMI_TXPWR_RX(devt, txPwr)	\
-+	ar6000_txPwr_rx((devt), (txPwr))
-+
-+#define A_WMI_READY_EVENT(devt, datap, phyCap)	\
-+	ar6000_ready_event((devt), (datap), (phyCap))
-+
-+#define A_WMI_DBGLOG_INIT_DONE(ar) \
-+        ar6000_dbglog_init_done(ar);
-+
-+#define A_WMI_RSSI_THRESHOLD_EVENT(devt, newThreshold, rssi)	\
-+	ar6000_rssiThreshold_event((devt), (newThreshold), (rssi))
-+
-+#define A_WMI_REPORT_ERROR_EVENT(devt, errorVal)	\
-+	ar6000_reportError_event((devt), (errorVal))
-+
-+#define A_WMI_ROAM_TABLE_EVENT(devt, pTbl) \
-+	ar6000_roam_tbl_event((devt), (pTbl))
-+
-+#define A_WMI_ROAM_DATA_EVENT(devt, p) \
-+	ar6000_roam_data_event((devt), (p))
-+
-+#define A_WMI_WOW_LIST_EVENT(devt, num_filters, wow_filters)	\
-+	ar6000_wow_list_event((devt), (num_filters), (wow_filters))
-+
-+#define A_WMI_CAC_EVENT(devt, ac, cac_indication, statusCode, tspecSuggestion)  \
-+	ar6000_cac_event((devt), (ac), (cac_indication), (statusCode), (tspecSuggestion))
-+
-+#define A_WMI_IPTOS_TO_USERPRIORITY(pkt)    \
-+	ar6000_iptos_to_userPriority((pkt))
-+
-+#define A_WMI_PMKID_LIST_EVENT(devt, num_pmkid, pmkid_list)	\
-+	ar6000_pmkid_list_event((devt), (num_pmkid), (pmkid_list))
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+
-+#define A_WMI_GPIO_INTR_RX(intr_mask, input_values) \
-+	ar6000_gpio_intr_rx((intr_mask), (input_values))
-+
-+#define A_WMI_GPIO_DATA_RX(reg_id, value) \
-+	ar6000_gpio_data_rx((reg_id), (value))
-+
-+#define A_WMI_GPIO_ACK_RX() \
-+	ar6000_gpio_ack_rx()
-+
-+#endif
-+
-+#ifdef SEND_EVENT_TO_APP
-+
-+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len) \
-+	ar6000_send_event_to_app((ar), (eventId), (datap), (len))
-+
-+#else
-+
-+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len)
-+
-+#endif
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+#define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
-+	ar6000_tcmd_rx_report_event((devt), (results), (len))
-+#endif
-+
-+#define A_WMI_HBCHALLENGERESP_EVENT(devt, cookie, source)    \
-+    ar6000_hbChallengeResp_event((devt), (cookie), (source))
-+
-+#define A_WMI_TX_RETRY_ERR_EVENT(devt) \
-+	ar6000_tx_retry_err_event((devt))
-+
-+#define A_WMI_SNR_THRESHOLD_EVENT_RX(devt, newThreshold, snr) \
-+	ar6000_snrThresholdEvent_rx((devt), (newThreshold), (snr))
-+
-+#define A_WMI_LQ_THRESHOLD_EVENT_RX(devt, range, lqVal) \
-+	ar6000_lqThresholdEvent_rx((devt), (range), (lqVal))
-+
-+#define A_WMI_RATEMASK_RX(devt, ratemask) \
-+	ar6000_ratemask_rx((devt), (ratemask))
-+
-+#define A_WMI_KEEPALIVE_RX(devt, configured)    \
-+        ar6000_keepalive_rx((devt), (configured))
-+
-+#define A_WMI_BSSINFO_EVENT_RX(ar, datp, len)   \
-+        ar6000_bssInfo_event_rx((ar), (datap), (len))
-+
-+#define A_WMI_DBGLOG_EVENT(ar, dropped, buffer, length) \
-+        ar6000_dbglog_event((ar), (dropped), (buffer), (length));
-+
-+#define A_WMI_STREAM_TX_ACTIVE(devt,trafficClass) \
-+    ar6000_indicate_tx_activity((devt),(trafficClass), TRUE)
-+
-+#define A_WMI_STREAM_TX_INACTIVE(devt,trafficClass) \
-+    ar6000_indicate_tx_activity((devt),(trafficClass), FALSE)
-+
-+/****************************************************************************/
-+/****************************************************************************/
-+/**                                                                        **/
-+/** HTC related hooks                                                      **/
-+/**                                                                        **/
-+/****************************************************************************/
-+/****************************************************************************/
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif
-diff --git a/drivers/ar6000/include/a_osapi.h b/drivers/ar6000/include/a_osapi.h
-new file mode 100644
-index 0000000..7d60867
---- /dev/null
-+++ b/drivers/ar6000/include/a_osapi.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_OSAPI_H_
-+#define _A_OSAPI_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_osapi.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "../ar6000/osapi_linux.h"
-+
-+#endif /* _OSAPI_H_ */
-diff --git a/drivers/ar6000/include/a_types.h b/drivers/ar6000/include/a_types.h
-new file mode 100644
-index 0000000..e2ed090
---- /dev/null
-+++ b/drivers/ar6000/include/a_types.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_TYPES_H_
-+#define _A_TYPES_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_types.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "../ar6000/athtypes_linux.h"
-+
-+#endif /* _ATHTYPES_H_ */
-diff --git a/drivers/ar6000/include/ar6000_api.h b/drivers/ar6000/include/ar6000_api.h
-new file mode 100644
-index 0000000..abe5de7
---- /dev/null
-+++ b/drivers/ar6000/include/ar6000_api.h
-@@ -0,0 +1,29 @@
-+#ifndef _AR6000_API_H_
-+#define _AR6000_API_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains the API to access the OS dependent atheros host driver
-+ * by the WMI or WLAN generic modules.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/ar6000_api.h#1 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "../ar6000/ar6xapi_linux.h"
-+
-+#endif /* _AR6000_API_H */
-+
-diff --git a/drivers/ar6000/include/ar6000_diag.h b/drivers/ar6000/include/ar6000_diag.h
-new file mode 100644
-index 0000000..2df131d
---- /dev/null
-+++ b/drivers/ar6000/include/ar6000_diag.h
-@@ -0,0 +1,38 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef AR6000_DIAG_H_
-+#define AR6000_DIAG_H_
-+
-+
-+A_STATUS
-+ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+
-+A_STATUS
-+ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+
-+A_STATUS
-+ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+                    A_UCHAR *data, A_UINT32 length);
-+
-+A_STATUS
-+ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+                     A_UCHAR *data, A_UINT32 length);
-+
-+#endif /*AR6000_DIAG_H_*/
-diff --git a/drivers/ar6000/include/athdefs.h b/drivers/ar6000/include/athdefs.h
-new file mode 100644
-index 0000000..c28c871
---- /dev/null
-+++ b/drivers/ar6000/include/athdefs.h
-@@ -0,0 +1,85 @@
-+#ifndef __ATHDEFS_H__
-+#define __ATHDEFS_H__
-+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains definitions that may be used across both
-+ * Host and Target software.  Nothing here is module-dependent
-+ * or platform-dependent.
-+ */
-+
-+/*
-+ * Generic error codes that can be used by hw, sta, ap, sim, dk
-+ * and any other environments. Since these are enums, feel free to
-+ * add any more codes that you need.
-+ */
-+
-+typedef enum {
-+    A_ERROR = -1,               /* Generic error return */
-+    A_OK = 0,                   /* success */
-+                                /* Following values start at 1 */
-+    A_DEVICE_NOT_FOUND,         /* not able to find PCI device */
-+    A_NO_MEMORY,                /* not able to allocate memory, not available */
-+    A_MEMORY_NOT_AVAIL,         /* memory region is not free for mapping */
-+    A_NO_FREE_DESC,             /* no free descriptors available */
-+    A_BAD_ADDRESS,              /* address does not match descriptor */
-+    A_WIN_DRIVER_ERROR,         /* used in NT_HW version, if problem at init */
-+    A_REGS_NOT_MAPPED,          /* registers not correctly mapped */
-+    A_EPERM,                    /* Not superuser */
-+    A_EACCES,                   /* Access denied */
-+    A_ENOENT,                   /* No such entry, search failed, etc. */
-+    A_EEXIST,                   /* The object already exists (can't create) */
-+    A_EFAULT,                   /* Bad address fault */
-+    A_EBUSY,                    /* Object is busy */
-+    A_EINVAL,                   /* Invalid parameter */
-+    A_EMSGSIZE,                 /* Inappropriate message buffer length */
-+    A_ECANCELED,                /* Operation canceled */
-+    A_ENOTSUP,                  /* Operation not supported */
-+    A_ECOMM,                    /* Communication error on send */
-+    A_EPROTO,                   /* Protocol error */
-+    A_ENODEV,                   /* No such device */
-+    A_EDEVNOTUP,                /* device is not UP */
-+    A_NO_RESOURCE,              /* No resources for requested operation */
-+    A_HARDWARE,                 /* Hardware failure */
-+    A_PENDING,                  /* Asynchronous routine; will send up results la
-+ter (typically in callback) */
-+    A_EBADCHANNEL,              /* The channel cannot be used */
-+    A_DECRYPT_ERROR,            /* Decryption error */
-+    A_PHY_ERROR,                /* RX PHY error */
-+    A_CONSUMED                  /* Object was consumed */
-+} A_STATUS;
-+
-+#define A_SUCCESS(x)        (x == A_OK)
-+#define A_FAILED(x)         (!A_SUCCESS(x))
-+
-+#ifndef TRUE
-+#define TRUE 1
-+#endif
-+
-+#ifndef FALSE
-+#define FALSE 0
-+#endif
-+
-+/*
-+ * The following definition is WLAN specific definition
-+ */
-+typedef enum {
-+    MODE_11A = 0,   /* 11a Mode */
-+    MODE_11G = 1,   /* 11g + 11b Mode */
-+    MODE_11B = 2,   /* 11b Mode */
-+    MODE_11GONLY = 3, /* 11g only Mode */
-+    MODE_UNKNOWN = 4,
-+    MODE_MAX = 4
-+} WLAN_PHY_MODE;
-+
-+typedef enum {
-+    WLAN_11A_CAPABILITY   = 1,
-+    WLAN_11G_CAPABILITY   = 2,
-+    WLAN_11AG_CAPABILITY  = 3,
-+}WLAN_CAPABILITY;
-+
-+#endif /* __ATHDEFS_H__ */
-diff --git a/drivers/ar6000/include/athdrv.h b/drivers/ar6000/include/athdrv.h
-new file mode 100644
-index 0000000..19da97e
---- /dev/null
-+++ b/drivers/ar6000/include/athdrv.h
-@@ -0,0 +1,32 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _ATHDRV_H_
-+#define _ATHDRV_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _ATHDRV_H_ */
-diff --git a/drivers/ar6000/include/athendpack.h b/drivers/ar6000/include/athendpack.h
-new file mode 100644
-index 0000000..42921ae
---- /dev/null
-+++ b/drivers/ar6000/include/athendpack.h
-@@ -0,0 +1,41 @@
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ * @file: athendpack.h
-+ *
-+ * @abstract: end compiler-specific structure packing
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#ifdef VXWORKS
-+#endif /* VXWORKS */
-+
-+#ifdef LINUX
-+#endif /* LINUX */
-+
-+#ifdef QNX
-+#endif /* QNX */
-+
-+#ifdef INTEGRITY
-+#include "integrity/athendpack_integrity.h"
-+#endif /* INTEGRITY */
-+
-+#ifdef NUCLEUS
-+#endif /* NUCLEUS */
-+
-+#ifdef UNDER_CE
-+#include "../os/wince/include/athendpack_wince.h"
-+#endif /* WINCE */
-+
-diff --git a/drivers/ar6000/include/athstartpack.h b/drivers/ar6000/include/athstartpack.h
-new file mode 100644
-index 0000000..6632cc2
---- /dev/null
-+++ b/drivers/ar6000/include/athstartpack.h
-@@ -0,0 +1,42 @@
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ * @file: athstartpack.h
-+ *
-+ * @abstract: start compiler-specific structure packing
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef VXWORKS
-+#endif /* VXWORKS */
-+
-+#ifdef LINUX
-+#endif /* LINUX */
-+
-+#ifdef QNX
-+#endif /* QNX */
-+
-+#ifdef INTEGRITY
-+#include "integrity/athstartpack_integrity.h"
-+#endif /* INTEGRITY */
-+
-+#ifdef NUCLEUS
-+#endif /* NUCLEUS */
-+
-+#ifdef UNDER_CE
-+#include "../os/wince/include/athstartpack_wince.h"
-+#endif /* WINCE */
-+
-diff --git a/drivers/ar6000/include/bmi.h b/drivers/ar6000/include/bmi.h
-new file mode 100644
-index 0000000..2eb7134
---- /dev/null
-+++ b/drivers/ar6000/include/bmi.h
-@@ -0,0 +1,100 @@
-+#ifndef _BMI_H_
-+#define _BMI_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * BMI declarations and prototypes
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/* Header files */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "hif.h"
-+#include "a_osapi.h"
-+#include "bmi_msg.h"
-+
-+void
-+BMIInit(void);
-+
-+A_STATUS
-+BMIDone(HIF_DEVICE *device);
-+
-+A_STATUS
-+BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info);
-+
-+A_STATUS
-+BMIReadMemory(HIF_DEVICE *device,
-+              A_UINT32 address,
-+              A_UCHAR *buffer,
-+              A_UINT32 length);
-+
-+A_STATUS
-+BMIWriteMemory(HIF_DEVICE *device,
-+               A_UINT32 address,
-+               A_UCHAR *buffer,
-+               A_UINT32 length);
-+
-+A_STATUS
-+BMIExecute(HIF_DEVICE *device,
-+           A_UINT32 address,
-+           A_UINT32 *param);
-+
-+A_STATUS
-+BMISetAppStart(HIF_DEVICE *device,
-+               A_UINT32 address);
-+
-+A_STATUS
-+BMIReadSOCRegister(HIF_DEVICE *device,
-+                   A_UINT32 address,
-+                   A_UINT32 *param);
-+
-+A_STATUS
-+BMIWriteSOCRegister(HIF_DEVICE *device,
-+                    A_UINT32 address,
-+                    A_UINT32 param);
-+
-+A_STATUS
-+BMIrompatchInstall(HIF_DEVICE *device,
-+                   A_UINT32 ROM_addr,
-+                   A_UINT32 RAM_addr,
-+                   A_UINT32 nbytes,
-+                   A_UINT32 do_activate,
-+                   A_UINT32 *patch_id);
-+
-+A_STATUS
-+BMIrompatchUninstall(HIF_DEVICE *device,
-+                     A_UINT32 rompatch_id);
-+
-+A_STATUS
-+BMIrompatchActivate(HIF_DEVICE *device,
-+                    A_UINT32 rompatch_count,
-+                    A_UINT32 *rompatch_list);
-+
-+A_STATUS
-+BMIrompatchDeactivate(HIF_DEVICE *device,
-+                      A_UINT32 rompatch_count,
-+                      A_UINT32 *rompatch_list);
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _BMI_H_ */
-diff --git a/drivers/ar6000/include/bmi_msg.h b/drivers/ar6000/include/bmi_msg.h
-new file mode 100644
-index 0000000..7c91ef4
---- /dev/null
-+++ b/drivers/ar6000/include/bmi_msg.h
-@@ -0,0 +1,199 @@
-+#ifndef __BMI_MSG_H__
-+#define __BMI_MSG_H__
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+/*
-+ * Bootloader Messaging Interface (BMI)
-+ *
-+ * BMI is a very simple messaging interface used during initialization
-+ * to read memory, write memory, execute code, and to define an
-+ * application entry PC.
-+ *
-+ * It is used to download an application to AR6K, to provide
-+ * patches to code that is already resident on AR6K, and generally
-+ * to examine and modify state.  The Host has an opportunity to use
-+ * BMI only once during bootup.  Once the Host issues a BMI_DONE
-+ * command, this opportunity ends.
-+ *
-+ * The Host writes BMI requests to mailbox0, and reads BMI responses
-+ * from mailbox0.   BMI requests all begin with a command
-+ * (see below for specific commands), and are followed by
-+ * command-specific data.
-+ *
-+ * Flow control:
-+ * The Host can only issue a command once the Target gives it a
-+ * "BMI Command Credit", using AR6K Counter #4.  As soon as the
-+ * Target has completed a command, it issues another BMI Command
-+ * Credit (so the Host can issue the next command).
-+ *
-+ * BMI handles all required Target-side cache flushing.
-+ */
-+
-+
-+/* Maximum data size used for BMI transfers */
-+#define BMI_DATASZ_MAX                     32
-+
-+/* BMI Commands */
-+
-+#define BMI_NO_COMMAND                      0
-+
-+#define BMI_DONE                            1
-+        /*
-+         * Semantics: Host is done using BMI
-+         * Request format:
-+         *    A_UINT32      command (BMI_DONE)
-+         * Response format: none
-+         */
-+
-+#define BMI_READ_MEMORY                     2
-+        /*
-+         * Semantics: Host reads AR6K memory
-+         * Request format:
-+         *    A_UINT32      command (BMI_READ_MEMORY)
-+         *    A_UINT32      address
-+         *    A_UINT32      length, at most BMI_DATASZ_MAX
-+         * Response format:
-+         *    A_UINT8       data[length]
-+         */
-+
-+#define BMI_WRITE_MEMORY                    3
-+        /*
-+         * Semantics: Host writes AR6K memory
-+         * Request format:
-+         *    A_UINT32       command (BMI_WRITE_MEMORY)
-+         *    A_UINT32      address
-+         *    A_UINT32      length, at most BMI_DATASZ_MAX
-+         *    A_UINT8       data[length]
-+         * Response format: none
-+         */
-+
-+#define BMI_EXECUTE                         4
-+        /*
-+         * Semantics: Causes AR6K to execute code
-+         * Request format:
-+         *    A_UINT32      command (BMI_EXECUTE)
-+         *    A_UINT32      address
-+         *    A_UINT32      parameter
-+         * Response format:
-+         *    A_UINT32      return value
-+         */
-+
-+#define BMI_SET_APP_START                   5
-+        /*
-+         * Semantics: Set Target application starting address
-+         * Request format:
-+         *    A_UINT32      command (BMI_SET_APP_START)
-+         *    A_UINT32      address
-+         * Response format: none
-+         */
-+
-+#define BMI_READ_SOC_REGISTER               6
-+        /*
-+         * Semantics: Read a 32-bit Target SOC register.
-+         * Request format:
-+         *    A_UINT32      command (BMI_READ_REGISTER)
-+         *    A_UINT32      address
-+         * Response format:
-+         *    A_UINT32      value
-+         */
-+
-+#define BMI_WRITE_SOC_REGISTER              7
-+        /*
-+         * Semantics: Write a 32-bit Target SOC register.
-+         * Request format:
-+         *    A_UINT32      command (BMI_WRITE_REGISTER)
-+         *    A_UINT32      address
-+         *    A_UINT32      value
-+         *
-+         * Response format: none
-+         */
-+
-+#define BMI_GET_TARGET_ID                  8
-+#define BMI_GET_TARGET_INFO                8
-+        /*
-+         * Semantics: Fetch the 4-byte Target information
-+         * Request format:
-+         *    A_UINT32      command (BMI_GET_TARGET_ID/INFO)
-+         * Response format1 (old firmware):
-+         *    A_UINT32      TargetVersionID
-+         * Response format2 (newer firmware):
-+         *    A_UINT32      TARGET_VERSION_SENTINAL
-+         *    struct bmi_target_info;
-+         */
-+
-+struct bmi_target_info {
-+    A_UINT32 target_info_byte_count; /* size of this structure */
-+    A_UINT32 target_ver;             /* Target Version ID */
-+    A_UINT32 target_type;            /* Target type */
-+};
-+#define TARGET_VERSION_SENTINAL 0xffffffff
-+#define TARGET_TYPE_AR6001 1
-+#define TARGET_TYPE_AR6002 2
-+
-+
-+#define BMI_ROMPATCH_INSTALL               9
-+        /*
-+         * Semantics: Install a ROM Patch.
-+         * Request format:
-+         *    A_UINT32      command (BMI_ROMPATCH_INSTALL)
-+         *    A_UINT32      Target ROM Address
-+         *    A_UINT32      Target RAM Address
-+         *    A_UINT32      Size, in bytes
-+         *    A_UINT32      Activate? 1-->activate;
-+         *                            0-->install but do not activate
-+         * Response format:
-+         *    A_UINT32      PatchID
-+         */
-+
-+#define BMI_ROMPATCH_UNINSTALL             10
-+        /*
-+         * Semantics: Uninstall a previously-installed ROM Patch,
-+         * automatically deactivating, if necessary.
-+         * Request format:
-+         *    A_UINT32      command (BMI_ROMPATCH_UNINSTALL)
-+         *    A_UINT32      PatchID
-+         *
-+         * Response format: none
-+         */
-+
-+#define BMI_ROMPATCH_ACTIVATE              11
-+        /*
-+         * Semantics: Activate a list of previously-installed ROM Patches.
-+         * Request format:
-+         *    A_UINT32      command (BMI_ROMPATCH_ACTIVATE)
-+         *    A_UINT32      rompatch_count
-+         *    A_UINT32      PatchID[rompatch_count]
-+         *
-+         * Response format: none
-+         */
-+
-+#define BMI_ROMPATCH_DEACTIVATE            12
-+        /*
-+         * Semantics: Deactivate a list of active ROM Patches.
-+         * Request format:
-+         *    A_UINT32      command (BMI_ROMPATCH_DEACTIVATE)
-+         *    A_UINT32      rompatch_count
-+         *    A_UINT32      PatchID[rompatch_count]
-+         *
-+         * Response format: none
-+         */
-+
-+
-+#endif /* __BMI_MSG_H__ */
-diff --git a/drivers/ar6000/include/common_drv.h b/drivers/ar6000/include/common_drv.h
-new file mode 100644
-index 0000000..1bdc3da
---- /dev/null
-+++ b/drivers/ar6000/include/common_drv.h
-@@ -0,0 +1,61 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+
-+#ifndef COMMON_DRV_H_
-+#define COMMON_DRV_H_
-+
-+#include "hif.h"
-+#include "htc_packet.h"
-+
-+
-+
-+/* structure that is the state information for the default credit distribution callback
-+ * drivers should instantiate (zero-init as well) this structure in their driver instance
-+ * and pass it as a context to the HTC credit distribution functions */
-+typedef struct _COMMON_CREDIT_STATE_INFO {
-+    int TotalAvailableCredits;      /* total credits in the system at startup */
-+    int CurrentFreeCredits;         /* credits available in the pool that have not been
-+                                       given out to endpoints */
-+    HTC_ENDPOINT_CREDIT_DIST *pLowestPriEpDist;  /* pointer to the lowest priority endpoint dist struct */
-+} COMMON_CREDIT_STATE_INFO;
-+
-+
-+/* HTC TX packet tagging definitions */
-+#define AR6K_CONTROL_PKT_TAG    HTC_TX_PACKET_TAG_USER_DEFINED
-+#define AR6K_DATA_PKT_TAG       (AR6K_CONTROL_PKT_TAG + 1)
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/* OS-independent APIs */
-+A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo);
-+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,  A_UCHAR *data, A_UINT32 length);
-+A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
-+void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
-+A_STATUS ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice);
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /*COMMON_DRV_H_*/
-diff --git a/drivers/ar6000/include/dbglog.h b/drivers/ar6000/include/dbglog.h
-new file mode 100644
-index 0000000..3d1e528
---- /dev/null
-+++ b/drivers/ar6000/include/dbglog.h
-@@ -0,0 +1,107 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions and data structures associated with
-+ * the log based debug mechanism.
-+ *
-+ */
-+
-+#ifndef _DBGLOG_H_
-+#define _DBGLOG_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#define DBGLOG_TIMESTAMP_OFFSET          0
-+#define DBGLOG_TIMESTAMP_MASK            0x0000FFFF /* Bit 0-15. Contains bit
-+                                                       8-23 of the LF0 timer */
-+#define DBGLOG_DBGID_OFFSET              16
-+#define DBGLOG_DBGID_MASK                0x03FF0000 /* Bit 16-25 */
-+#define DBGLOG_DBGID_NUM_MAX             256 /* Upper limit is width of mask */
-+
-+#define DBGLOG_MODULEID_OFFSET           26
-+#define DBGLOG_MODULEID_MASK             0x3C000000 /* Bit 26-29 */
-+#define DBGLOG_MODULEID_NUM_MAX          16 /* Upper limit is width of mask */
-+
-+/*
-+ * Please ensure that the definition of any new module intrduced is captured
-+ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The
-+ * structure is required for the parser to correctly pick up the values for
-+ * different modules.
-+ */
-+#define DBGLOG_MODULEID_START
-+#define DBGLOG_MODULEID_INF                   0
-+#define DBGLOG_MODULEID_WMI                   1
-+#define DBGLOG_MODULEID_CSERV                 2
-+#define DBGLOG_MODULEID_PM                    3
-+#define DBGLOG_MODULEID_TXRX_MGMTBUF          4
-+#define DBGLOG_MODULEID_TXRX_TXBUF            5
-+#define DBGLOG_MODULEID_TXRX_RXBUF            6
-+#define DBGLOG_MODULEID_WOW                   7
-+#define DBGLOG_MODULEID_WHAL                  8
-+#define DBGLOG_MODULEID_END
-+
-+#define DBGLOG_NUM_ARGS_OFFSET             30
-+#define DBGLOG_NUM_ARGS_MASK               0xC0000000 /* Bit 30-31 */
-+#define DBGLOG_NUM_ARGS_MAX                2 /* Upper limit is width of mask */
-+
-+#define DBGLOG_MODULE_LOG_ENABLE_OFFSET    0
-+#define DBGLOG_MODULE_LOG_ENABLE_MASK      0x0000FFFF
-+
-+#define DBGLOG_REPORTING_ENABLED_OFFSET    16
-+#define DBGLOG_REPORTING_ENABLED_MASK      0x00010000
-+
-+#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
-+#define DBGLOG_TIMESTAMP_RESOLUTION_MASK   0x000E0000
-+
-+#define DBGLOG_REPORT_SIZE_OFFSET          20
-+#define DBGLOG_REPORT_SIZE_MASK            0x3FF00000
-+
-+#define DBGLOG_LOG_BUFFER_SIZE             1500
-+#define DBGLOG_DBGID_DEFINITION_LEN_MAX    64
-+
-+struct dbglog_buf_s {
-+    struct dbglog_buf_s *next;
-+    A_INT8              *buffer;
-+    A_UINT32             bufsize;
-+    A_UINT32             length;
-+    A_UINT32             count;
-+    A_UINT32             free;
-+};
-+
-+struct dbglog_hdr_s {
-+    struct dbglog_buf_s *dbuf;
-+    A_UINT32             dropped;
-+};
-+
-+struct dbglog_config_s {
-+    A_UINT32                    cfgvalid; /* Mask with valid config bits */
-+    union {
-+        /* TODO: Take care of endianness */
-+        struct {
-+            A_UINT32            mmask:16; /* Mask of modules with logging on */
-+            A_UINT32            rep:1; /* Reporting enabled or not */
-+            A_UINT32            tsr:3; /* Time stamp resolution. Def: 1 ms */
-+            A_UINT32            size:10; /* Report size in number of messages */
-+            A_UINT32            reserved:2;
-+        } dbglog_config;
-+
-+        A_UINT32                value;
-+    } u;
-+};
-+
-+#define cfgmmask                   u.dbglog_config.mmask
-+#define cfgrep                     u.dbglog_config.rep
-+#define cfgtsr                     u.dbglog_config.tsr
-+#define cfgsize                    u.dbglog_config.size
-+#define cfgvalue                   u.value
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _DBGLOG_H_ */
-diff --git a/drivers/ar6000/include/dbglog_api.h b/drivers/ar6000/include/dbglog_api.h
-new file mode 100644
-index 0000000..06c8102
---- /dev/null
-+++ b/drivers/ar6000/include/dbglog_api.h
-@@ -0,0 +1,46 @@
-+#ifndef _DBGLOG_API_H_
-+#define _DBGLOG_API_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * This file contains host side debug primitives.
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include "dbglog.h"
-+
-+#define DBGLOG_HOST_LOG_BUFFER_SIZE            DBGLOG_LOG_BUFFER_SIZE
-+
-+#define DBGLOG_GET_DBGID(arg) \
-+    ((arg & DBGLOG_DBGID_MASK) >> DBGLOG_DBGID_OFFSET)
-+
-+#define DBGLOG_GET_MODULEID(arg) \
-+    ((arg & DBGLOG_MODULEID_MASK) >> DBGLOG_MODULEID_OFFSET)
-+
-+#define DBGLOG_GET_NUMARGS(arg) \
-+    ((arg & DBGLOG_NUM_ARGS_MASK) >> DBGLOG_NUM_ARGS_OFFSET)
-+
-+#define DBGLOG_GET_TIMESTAMP(arg) \
-+    ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _DBGLOG_API_H_ */
-diff --git a/drivers/ar6000/include/dbglog_id.h b/drivers/ar6000/include/dbglog_id.h
-new file mode 100644
-index 0000000..ce22b16
---- /dev/null
-+++ b/drivers/ar6000/include/dbglog_id.h
-@@ -0,0 +1,307 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions of the debug identifiers for different
-+ * modules.
-+ *
-+ */
-+
-+#ifndef _DBGLOG_ID_H_
-+#define _DBGLOG_ID_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/*
-+ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
-+ * Please ensure that the definition of any new debugid introduced is captured
-+ * between the <MODULE>_DBGID_DEFINITION_START and
-+ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the
-+ * parser to correctly pick up the values for different debug identifiers.
-+ */
-+
-+/* INF debug identifier definitions */
-+#define INF_DBGID_DEFINITION_START
-+#define INF_ASSERTION_FAILED                          1
-+#define INF_TARGET_ID                                 2
-+#define INF_DBGID_DEFINITION_END
-+
-+/* WMI debug identifier definitions */
-+#define WMI_DBGID_DEFINITION_START
-+#define WMI_CMD_RX_XTND_PKT_TOO_SHORT                 1
-+#define WMI_EXTENDED_CMD_NOT_HANDLED                  2
-+#define WMI_CMD_RX_PKT_TOO_SHORT                      3
-+#define WMI_CALLING_WMI_EXTENSION_FN                  4
-+#define WMI_CMD_NOT_HANDLED                           5
-+#define WMI_IN_SYNC                                   6
-+#define WMI_TARGET_WMI_SYNC_CMD                       7
-+#define WMI_SET_SNR_THRESHOLD_PARAMS                  8
-+#define WMI_SET_RSSI_THRESHOLD_PARAMS                 9
-+#define WMI_SET_LQ_TRESHOLD_PARAMS                   10
-+#define WMI_TARGET_CREATE_PSTREAM_CMD                11
-+#define WMI_WI_DTM_INUSE                             12
-+#define WMI_TARGET_DELETE_PSTREAM_CMD                13
-+#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD       14
-+#define WMI_TARGET_GET_BIT_RATE_CMD                  15
-+#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS       16
-+#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD        17
-+#define WMI_TARGET_GET_TX_PWR_CMD                    18
-+#define WMI_FREE_EVBUF_WMIBUF                        19
-+#define WMI_FREE_EVBUF_DATABUF                       20
-+#define WMI_FREE_EVBUF_BADFLAG                       21
-+#define WMI_HTC_RX_ERROR_DATA_PACKET                 22
-+#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX             23
-+#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT      24
-+#define WMI_SENDING_READY_EVENT                      25
-+#define WMI_SETPOWER_MDOE_TO_MAXPERF                 26
-+#define WMI_SETPOWER_MDOE_TO_REC                     27
-+#define WMI_BSSINFO_EVENT_FROM                       28
-+#define WMI_TARGET_GET_STATS_CMD                     29
-+#define WMI_SENDING_SCAN_COMPLETE_EVENT              30
-+#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT        31
-+#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT       32
-+#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT     33
-+#define WMI_SENDING_ERROR_REPORT_EVENT               34
-+#define WMI_SENDING_CAC_EVENT                        35
-+#define WMI_TARGET_GET_ROAM_TABLE_CMD                36
-+#define WMI_TARGET_GET_ROAM_DATA_CMD                 37
-+#define WMI_SENDING_GPIO_INTR_EVENT                  38
-+#define WMI_SENDING_GPIO_ACK_EVENT                   39
-+#define WMI_SENDING_GPIO_DATA_EVENT                  40
-+#define WMI_CMD_RX                                   41
-+#define WMI_CMD_RX_XTND                              42
-+#define WMI_EVENT_SEND                               43
-+#define WMI_EVENT_SEND_XTND                          44
-+#define WMI_DBGID_DEFINITION_END
-+
-+/* CSERV debug identifier definitions */
-+#define CSERV_DBGID_DEFINITION_START
-+#define CSERV_BEGIN_SCAN1                             1
-+#define CSERV_BEGIN_SCAN2                             2
-+#define CSERV_END_SCAN1                               3
-+#define CSERV_END_SCAN2                               4
-+#define CSERV_CHAN_SCAN_START                         5
-+#define CSERV_CHAN_SCAN_STOP                          6
-+#define CSERV_CHANNEL_OPPPORTUNITY                    7
-+#define CSERV_NC_TIMEOUT                              8
-+#define CSERV_BACK_HOME                              10
-+#define CSERV_CHMGR_CH_CALLBACK1                     11
-+#define CSERV_CHMGR_CH_CALLBACK2                     12
-+#define CSERV_CHMGR_CH_CALLBACK3                     13
-+#define CSERV_SET_SCAN_PARAMS1                       14
-+#define CSERV_SET_SCAN_PARAMS2                       15
-+#define CSERV_SET_SCAN_PARAMS3                       16
-+#define CSERV_SET_SCAN_PARAMS4                       17
-+#define CSERV_ABORT_SCAN                             18
-+#define CSERV_NEWSTATE                               19
-+#define CSERV_MINCHMGR_OP_END                        20
-+#define CSERV_CHMGR_OP_END                           21
-+#define CSERV_DISCONNECT_TIMEOUT                     22
-+#define CSERV_ROAM_TIMEOUT                           23
-+#define CSERV_FORCE_SCAN1                            24
-+#define CSERV_FORCE_SCAN2                            25
-+#define CSERV_FORCE_SCAN3                            26
-+#define CSERV_UTIL_TIMEOUT                           27
-+#define CSERV_RSSIPOLLER                             28
-+#define CSERV_RETRY_CONNECT_TIMEOUT                  29
-+#define CSERV_RSSIINDBMPOLLER                        30
-+#define CSERV_BGSCAN_ENABLE                          31
-+#define CSERV_BGSCAN_DISABLE                         32
-+#define CSERV_WLAN_START_SCAN_CMD1                   33
-+#define CSERV_WLAN_START_SCAN_CMD2                   34
-+#define CSERV_WLAN_START_SCAN_CMD3                   35
-+#define CSERV_START_SCAN_CMD                         36
-+#define CSERV_START_FORCE_SCAN                       37
-+#define CSERV_NEXT_CHAN                              38
-+#define CSERV_SET_REGCODE                            39
-+#define CSERV_START_ADHOC                            40
-+#define CSERV_ADHOC_AT_HOME                          41
-+#define CSERV_OPT_AT_HOME                            42
-+#define CSERV_WLAN_CONNECT_CMD                       43
-+#define CSERV_WLAN_RECONNECT_CMD                     44
-+#define CSERV_WLAN_DISCONNECT_CMD                    45
-+#define CSERV_BSS_CHANGE_CHANNEL                     46
-+#define CSERV_BEACON_RX                              47
-+#define CSERV_KEEPALIVE_CHECK                        48
-+#define CSERV_RC_BEGIN_SCAN                          49
-+#define CSERV_RC_SCAN_START                          50
-+#define CSERV_RC_SCAN_STOP                           51
-+#define CSERV_RC_NEXT                                52
-+#define CSERV_RC_SCAN_END                            53
-+#define CSERV_PROBE_CALLBACK                         54
-+#define CSERV_ROAM1                                  55
-+#define CSERV_ROAM2                                  56
-+#define CSERV_ROAM3                                  57
-+#define CSERV_CONNECT_EVENT                          58
-+#define CSERV_DISCONNECT_EVENT                       59
-+#define CSERV_BMISS_HANDLER1                         60
-+#define CSERV_BMISS_HANDLER2                         61
-+#define CSERV_BMISS_HANDLER3                         62
-+#define CSERV_LOWRSSI_HANDLER                        63
-+#define CSERV_WLAN_SET_PMKID_CMD                     64
-+#define CSERV_RECONNECT_REQUEST                      65
-+#define CSERV_KEYSPLUMBED_EVENT                      66
-+#define CSERV_NEW_REG                                67
-+#define CSERV_SET_RSSI_THOLD                         68
-+#define CSERV_RSSITHRESHOLDCHECK                     69
-+#define CSERV_RSSIINDBMTHRESHOLDCHECK                70
-+#define CSERV_WLAN_SET_OPT_CMD1                      71
-+#define CSERV_WLAN_SET_OPT_CMD2                      72
-+#define CSERV_WLAN_SET_OPT_CMD3                      73
-+#define CSERV_WLAN_SET_OPT_CMD4                      74
-+#define CSERV_SCAN_CONNECT_STOP                      75
-+#define CSERV_BMISS_HANDLER4                         76
-+#define CSERV_INITIALIZE_TIMER                       77
-+#define CSERV_ARM_TIMER                              78
-+#define CSERV_DISARM_TIMER                           79
-+#define CSERV_UNINITIALIZE_TIMER                     80
-+#define CSERV_DISCONNECT_EVENT2                      81
-+#define CSERV_SCAN_CONNECT_START                     82
-+#define CSERV_BSSINFO_MEMORY_ALLOC_FAILED            83
-+#define CSERV_SET_SCAN_PARAMS5                       84
-+#define CSERV_DBGID_DEFINITION_END
-+
-+/* TXRX debug identifier definitions */
-+#define TXRX_TXBUF_DBGID_DEFINITION_START
-+#define TXRX_TXBUF_ALLOCATE_BUF                      1
-+#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX                 2
-+#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ                  3
-+#define TXRX_TXBUF_TXQ_DEPTH                         4
-+#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ                 5
-+#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ         6
-+#define TXRX_TXBUF_INITIALIZE_TIMER                  7
-+#define TXRX_TXBUF_ARM_TIMER                         8
-+#define TXRX_TXBUF_DISARM_TIMER                      9
-+#define TXRX_TXBUF_UNINITIALIZE_TIMER                10
-+#define TXRX_TXBUF_DBGID_DEFINITION_END
-+
-+#define TXRX_RXBUF_DBGID_DEFINITION_START
-+#define TXRX_RXBUF_ALLOCATE_BUF                      1
-+#define TXRX_RXBUF_QUEUE_TO_HOST                     2
-+#define TXRX_RXBUF_QUEUE_TO_WLAN                     3
-+#define TXRX_RXBUF_ZERO_LEN_BUF                      4
-+#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN  5
-+#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF        6
-+#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN         7
-+#define TXRX_RXBUF_SEND_TO_RECV_MGMT                 8
-+#define TXRX_RXBUF_SEND_TO_IEEE_LAYER                9
-+#define TXRX_RXBUF_DBGID_DEFINITION_END
-+
-+#define TXRX_MGMTBUF_DBGID_DEFINITION_START
-+#define TXRX_MGMTBUF_ALLOCATE_BUF                    1
-+#define TXRX_MGMTBUF_ALLOCATE_SM_BUF                 2
-+#define TXRX_MGMTBUF_ALLOCATE_RMBUF                  3
-+#define TXRX_MGMTBUF_GET_BUF                         4
-+#define TXRX_MGMTBUF_GET_SM_BUF                      5
-+#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ                6
-+#define TXRX_MGMTBUF_REAPED_BUF                      7
-+#define TXRX_MGMTBUF_REAPED_SM_BUF                   8
-+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN              9
-+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN          10
-+#define TXRX_MGMTBUF_ENQUEUE_INTO_SFQ                11
-+#define TXRX_MGMTBUF_DEQUEUE_FROM_SFQ                12
-+#define TXRX_MGMTBUF_PAUSE_TXQ                       13
-+#define TXRX_MGMTBUF_RESUME_TXQ                      14
-+#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT       15
-+#define TXRX_MGMTBUF_DRAINQ                          16
-+#define TXRX_MGMTBUF_INDICATE_Q_DRAINED              17
-+#define TXRX_MGMTBUF_DBGID_DEFINITION_END
-+
-+/* PM (Power Module) debug identifier definitions */
-+#define PM_DBGID_DEFINITION_START
-+#define PM_INIT                                      1
-+#define PM_ENABLE                                    2
-+#define PM_SET_STATE                                 3
-+#define PM_SET_POWERMODE                             4
-+#define PM_CONN_NOTIFY                               5
-+#define PM_REF_COUNT_NEGATIVE                        6
-+#define PM_APSD_ENABLE                               7
-+#define PM_UPDATE_APSD_STATE                         8
-+#define PM_CHAN_OP_REQ                               9
-+#define PM_SET_MY_BEACON_POLICY                      10
-+#define PM_SET_ALL_BEACON_POLICY                     11
-+#define PM_SET_PM_PARAMS1                            12
-+#define PM_SET_PM_PARAMS2                            13
-+#define PM_ADHOC_SET_PM_CAPS_FAIL                    14
-+#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID              15
-+#define PM_DBGID_DEFINITION_END
-+
-+/* Wake on Wireless debug identifier definitions */
-+#define WOW_DBGID_DEFINITION_START
-+#define WOW_INIT                                        1
-+#define WOW_GET_CONFIG_DSET                             2
-+#define WOW_NO_CONFIG_DSET                              3
-+#define WOW_INVALID_CONFIG_DSET                         4
-+#define WOW_USE_DEFAULT_CONFIG                          5
-+#define WOW_SETUP_GPIO                                  6
-+#define WOW_INIT_DONE                                   7
-+#define WOW_SET_GPIO_PIN                                8
-+#define WOW_CLEAR_GPIO_PIN                              9
-+#define WOW_SET_WOW_MODE_CMD                            10
-+#define WOW_SET_HOST_MODE_CMD                           11
-+#define WOW_ADD_WOW_PATTERN_CMD                         12
-+#define WOW_NEW_WOW_PATTERN_AT_INDEX                    13
-+#define WOW_DEL_WOW_PATTERN_CMD                         14
-+#define WOW_LIST_CONTAINS_PATTERNS                      15
-+#define WOW_GET_WOW_LIST_CMD                            16
-+#define WOW_INVALID_FILTER_ID                           17
-+#define WOW_INVALID_FILTER_LISTID                       18
-+#define WOW_NO_VALID_FILTER_AT_ID                       19
-+#define WOW_NO_VALID_LIST_AT_ID                         20
-+#define WOW_NUM_PATTERNS_EXCEEDED                       21
-+#define WOW_NUM_LISTS_EXCEEDED                          22
-+#define WOW_GET_WOW_STATS                               23
-+#define WOW_CLEAR_WOW_STATS                             24
-+#define WOW_WAKEUP_HOST                                 25
-+#define WOW_EVENT_WAKEUP_HOST                           26
-+#define WOW_EVENT_DISCARD                               27
-+#define WOW_PATTERN_MATCH                               28
-+#define WOW_PATTERN_NOT_MATCH                           29
-+#define WOW_PATTERN_NOT_MATCH_OFFSET                    30
-+#define WOW_DISABLED_HOST_ASLEEP                        31
-+#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS             32
-+#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND          33
-+#define WOW_DBGID_DEFINITION_END
-+
-+/* WHAL debug identifier definitions */
-+#define WHAL_DBGID_DEFINITION_START
-+#define WHAL_ERROR_ANI_CONTROL                      1
-+#define WHAL_ERROR_CHIP_TEST1                       2
-+#define WHAL_ERROR_CHIP_TEST2                       3
-+#define WHAL_ERROR_EEPROM_CHECKSUM                  4
-+#define WHAL_ERROR_EEPROM_MACADDR                   5
-+#define WHAL_ERROR_INTERRUPT_HIU                    6
-+#define WHAL_ERROR_KEYCACHE_RESET                   7
-+#define WHAL_ERROR_KEYCACHE_SET                     8
-+#define WHAL_ERROR_KEYCACHE_TYPE                    9
-+#define WHAL_ERROR_KEYCACHE_TKIPENTRY              10
-+#define WHAL_ERROR_KEYCACHE_WEPLENGTH              11
-+#define WHAL_ERROR_PHY_INVALID_CHANNEL             12
-+#define WHAL_ERROR_POWER_AWAKE                     13
-+#define WHAL_ERROR_POWER_SET                       14
-+#define WHAL_ERROR_RECV_STOPDMA                    15
-+#define WHAL_ERROR_RECV_STOPPCU                    16
-+#define WHAL_ERROR_RESET_CHANNF1                   17
-+#define WHAL_ERROR_RESET_CHANNF2                   18
-+#define WHAL_ERROR_RESET_PM                        19
-+#define WHAL_ERROR_RESET_OFFSETCAL                 20
-+#define WHAL_ERROR_RESET_RFGRANT                   21
-+#define WHAL_ERROR_RESET_RXFRAME                   22
-+#define WHAL_ERROR_RESET_STOPDMA                   23
-+#define WHAL_ERROR_RESET_RECOVER                   24
-+#define WHAL_ERROR_XMIT_COMPUTE                    25
-+#define WHAL_ERROR_XMIT_NOQUEUE                    26
-+#define WHAL_ERROR_XMIT_ACTIVEQUEUE                27
-+#define WHAL_ERROR_XMIT_BADTYPE                    28
-+#define WHAL_DBGID_DEFINITION_END
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _DBGLOG_ID_H_ */
-diff --git a/drivers/ar6000/include/dl_list.h b/drivers/ar6000/include/dl_list.h
-new file mode 100644
-index 0000000..4b9c581
---- /dev/null
-+++ b/drivers/ar6000/include/dl_list.h
-@@ -0,0 +1,114 @@
-+/*
-+ *
-+ * Double-link list definitions (adapted from Atheros SDIO stack)
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#ifndef __DL_LIST_H___
-+#define __DL_LIST_H___
-+
-+#define A_CONTAINING_STRUCT(address, struct_type, field_name)\
-+            ((struct_type *)((A_UINT32)(address) - (A_UINT32)(&((struct_type *)0)->field_name)))
-+
-+/* list functions */
-+/* pointers for the list */
-+typedef struct _DL_LIST {
-+    struct _DL_LIST *pPrev;
-+    struct _DL_LIST *pNext;
-+}DL_LIST, *PDL_LIST;
-+/*
-+ * DL_LIST_INIT , initialize doubly linked list
-+*/
-+#define DL_LIST_INIT(pList)\
-+    {(pList)->pPrev = pList; (pList)->pNext = pList;}
-+
-+#define DL_LIST_IS_EMPTY(pList) (((pList)->pPrev == (pList)) && ((pList)->pNext == (pList)))
-+#define DL_LIST_GET_ITEM_AT_HEAD(pList) (pList)->pNext
-+#define DL_LIST_GET_ITEM_AT_TAIL(pList) (pList)->pPrev
-+/*
-+ * ITERATE_OVER_LIST pStart is the list, pTemp is a temp list member
-+ * NOT: do not use this function if the items in the list are deleted inside the
-+ * iteration loop
-+*/
-+#define ITERATE_OVER_LIST(pStart, pTemp) \
-+    for((pTemp) =(pStart)->pNext; pTemp != (pStart); (pTemp) = (pTemp)->pNext)
-+
-+
-+/* safe iterate macro that allows the item to be removed from the list
-+ * the iteration continues to the next item in the list
-+ */
-+#define ITERATE_OVER_LIST_ALLOW_REMOVE(pStart,pItem,st,offset)  \
-+{                                                       \
-+    PDL_LIST  pTemp;                                     \
-+    pTemp = (pStart)->pNext;                            \
-+    while (pTemp != (pStart)) {                         \
-+        (pItem) = A_CONTAINING_STRUCT(pTemp,st,offset);   \
-+         pTemp = pTemp->pNext;                          \
-+
-+#define ITERATE_END }}
-+
-+/*
-+ * DL_ListInsertTail - insert pAdd to the end of the list
-+*/
-+static INLINE PDL_LIST DL_ListInsertTail(PDL_LIST pList, PDL_LIST pAdd) {
-+        /* insert at tail */
-+    pAdd->pPrev = pList->pPrev;
-+    pAdd->pNext = pList;
-+    pList->pPrev->pNext = pAdd;
-+    pList->pPrev = pAdd;
-+    return pAdd;
-+}
-+
-+/*
-+ * DL_ListInsertHead - insert pAdd into the head of the list
-+*/
-+static INLINE PDL_LIST DL_ListInsertHead(PDL_LIST pList, PDL_LIST pAdd) {
-+        /* insert at head */
-+    pAdd->pPrev = pList;
-+    pAdd->pNext = pList->pNext;
-+    pList->pNext->pPrev = pAdd;
-+    pList->pNext = pAdd;
-+    return pAdd;
-+}
-+
-+#define DL_ListAdd(pList,pItem) DL_ListInsertHead((pList),(pItem))
-+/*
-+ * DL_ListRemove - remove pDel from list
-+*/
-+static INLINE PDL_LIST DL_ListRemove(PDL_LIST pDel) {
-+    pDel->pNext->pPrev = pDel->pPrev;
-+    pDel->pPrev->pNext = pDel->pNext;
-+        /* point back to itself just to be safe, incase remove is called again */
-+    pDel->pNext = pDel;
-+    pDel->pPrev = pDel;
-+    return pDel;
-+}
-+
-+/*
-+ * DL_ListRemoveItemFromHead - get a list item from the head
-+*/
-+static INLINE PDL_LIST DL_ListRemoveItemFromHead(PDL_LIST pList) {
-+    PDL_LIST pItem = NULL;
-+    if (pList->pNext != pList) {
-+        pItem = pList->pNext;
-+            /* remove the first item from head */
-+        DL_ListRemove(pItem);
-+    }
-+    return pItem;
-+}
-+
-+#endif /* __DL_LIST_H___ */
-diff --git a/drivers/ar6000/include/dset_api.h b/drivers/ar6000/include/dset_api.h
-new file mode 100644
-index 0000000..de5cc6a
---- /dev/null
-+++ b/drivers/ar6000/include/dset_api.h
-@@ -0,0 +1,63 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/dset_api.h#1 $
-+ *
-+ * Host-side DataSet API.
-+ *
-+ */
-+
-+#ifndef _DSET_API_H_
-+#define _DSET_API_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/*
-+ * Host-side DataSet support is optional, and is not
-+ * currently required for correct operation.  To disable
-+ * Host-side DataSet support, set this to 0.
-+ */
-+#ifndef CONFIG_HOST_DSET_SUPPORT
-+#define CONFIG_HOST_DSET_SUPPORT 1
-+#endif
-+
-+/* Called to send a DataSet Open Reply back to the Target. */
-+A_STATUS wmi_dset_open_reply(struct wmi_t *wmip,
-+                             A_UINT32 status,
-+                             A_UINT32 access_cookie,
-+                             A_UINT32 size,
-+                             A_UINT32 version,
-+                             A_UINT32 targ_handle,
-+                             A_UINT32 targ_reply_fn,
-+                             A_UINT32 targ_reply_arg);
-+
-+/* Called to send a DataSet Data Reply back to the Target. */
-+A_STATUS wmi_dset_data_reply(struct wmi_t *wmip,
-+                             A_UINT32 status,
-+                             A_UINT8 *host_buf,
-+                             A_UINT32 length,
-+                             A_UINT32 targ_buf,
-+                             A_UINT32 targ_reply_fn,
-+                             A_UINT32 targ_reply_arg);
-+
-+#ifdef __cplusplus
-+}
-+#endif /* __cplusplus */
-+
-+
-+#endif /* _DSET_API_H_ */
-diff --git a/drivers/ar6000/include/dset_internal.h b/drivers/ar6000/include/dset_internal.h
-new file mode 100644
-index 0000000..f0be380
---- /dev/null
-+++ b/drivers/ar6000/include/dset_internal.h
-@@ -0,0 +1,39 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __DSET_INTERNAL_H__
-+#define __DSET_INTERNAL_H__
-+
-+/*
-+ * Internal dset definitions, common for DataSet layer.
-+ */
-+
-+#define DSET_TYPE_STANDARD      0
-+#define DSET_TYPE_BPATCHED      1
-+#define DSET_TYPE_COMPRESSED    2
-+
-+/* Dataset descriptor */
-+
-+typedef struct dset_descriptor_s {
-+  struct dset_descriptor_s  *next;         /* List link. NULL only at the last
-+                                              descriptor */
-+  A_UINT16                   id;           /* Dset ID */
-+  A_UINT16                   size;         /* Dset size. */
-+  void                      *DataPtr;      /* Pointer to raw data for standard
-+                                              DataSet or pointer to original
-+                                              dset_descriptor for patched
-+                                              DataSet */
-+  A_UINT32                   data_type;    /* DSET_TYPE_*, above */
-+
-+  void                      *AuxPtr;       /* Additional data that might
-+                                              needed for data_type. For
-+                                              example, pointer to patch
-+                                              Dataset descriptor for BPatch. */
-+} dset_descriptor_t;
-+
-+#endif /* __DSET_INTERNAL_H__ */
-diff --git a/drivers/ar6000/include/dsetid.h b/drivers/ar6000/include/dsetid.h
-new file mode 100644
-index 0000000..85729f8
---- /dev/null
-+++ b/drivers/ar6000/include/dsetid.h
-@@ -0,0 +1,110 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __DSETID_H__
-+#define __DSETID_H__
-+
-+/* Well-known DataSet IDs */
-+#define DSETID_UNUSED                     0x00000000
-+#define DSETID_BOARD_DATA                 0x00000001 /* Cal and board data */
-+#define DSETID_REGDB                      0x00000002 /* Regulatory Database */
-+#define DSETID_POWER_CONTROL              0x00000003 /* TX Pwr Lim & Ant Gain */
-+#define DSETID_USER_CONFIG                0x00000004 /* User Configuration */
-+
-+#define DSETID_ANALOG_CONTROL_DATA_START  0x00000005
-+#define DSETID_ANALOG_CONTROL_DATA_END    0x00000025
-+/*
-+ * Get DSETID for various reference clock speeds.
-+ * For each speed there are three DataSets that correspond
-+ * to the three columns of bank6 data (addr, 11a, 11b/g).
-+ * This macro returns the dsetid of the first of those
-+ * three DataSets.
-+ */
-+#define ANALOG_CONTROL_DATA_DSETID(refclk) \
-+        (DSETID_ANALOG_CONTROL_DATA_START + 3*refclk)
-+
-+/*
-+ * There are TWO STARTUP_PATCH DataSets.
-+ * DSETID_STARTUP_PATCH is historical, and was applied before BMI on
-+ * earlier systems.  On AR6002, it is applied after BMI, just like
-+ * DSETID_STARTUP_PATCH2.
-+ */
-+#define DSETID_STARTUP_PATCH              0x00000026
-+#define DSETID_GPIO_CONFIG_PATCH          0x00000027
-+#define DSETID_WLANREGS                   0x00000028 /* override wlan regs */
-+#define DSETID_STARTUP_PATCH2             0x00000029
-+
-+#define DSETID_WOW_CONFIG                 0x00000090 /* WoW Configuration */
-+
-+/* Add WHAL_INI_DATA_ID to DSETID_INI_DATA for a specific WHAL INI table. */
-+#define DSETID_INI_DATA                   0x00000100
-+/* Reserved for WHAL INI Tables: 0x100..0x11f */
-+#define DSETID_INI_DATA_END               0x0000011f
-+
-+#define DSETID_VENDOR_START               0x00010000 /* Vendor-defined DataSets */
-+
-+#define DSETID_INDEX_END                  0xfffffffe /* Reserved to indicate the
-+                                                        end of a memory-based
-+                                                        DataSet Index */
-+#define DSETID_INDEX_FREE                 0xffffffff /* An unused index entry */
-+
-+/*
-+ * PATCH DataSet format:
-+ * A list of patches, terminated by a patch with
-+ * address=PATCH_END.
-+ *
-+ * This allows for patches to be stored in flash.
-+ */
-+struct patch_s {
-+    A_UINT32 *address;
-+    A_UINT32  data;
-+};
-+
-+/*
-+ * Skip some patches.  Can be used to erase a single patch in a
-+ * patch DataSet without having to re-write the DataSet.  May
-+ * also be used to embed information for use by subsequent
-+ * patch code.  The "data" in a PATCH_SKIP tells how many
-+ * bytes of length "patch_s" to skip.
-+ */
-+#define PATCH_SKIP      ((A_UINT32 *)0x00000000)
-+
-+/*
-+ * Execute code at the address specified by "data".
-+ * The address of the patch structure is passed as
-+ * the one parameter.
-+ */
-+#define PATCH_CODE_ABS  ((A_UINT32 *)0x00000001)
-+
-+/*
-+ * Same as PATCH_CODE_ABS, but treat "data" as an
-+ * offset from the start of the patch word.
-+ */
-+#define PATCH_CODE_REL  ((A_UINT32 *)0x00000002)
-+
-+/* Mark the end of this patch DataSet. */
-+#define PATCH_END       ((A_UINT32 *)0xffffffff)
-+
-+/*
-+ * A DataSet which contains a Binary Patch to some other DataSet
-+ * uses the original dsetid with the DSETID_BPATCH_FLAG bit set.
-+ * Such a BPatch DataSet consists of BPatch metadata followed by
-+ * the bdiff bytes.  BPatch metadata consists of a single 32-bit
-+ * word that contains the size of the BPatched final image.
-+ *
-+ * To create a suitable bdiff DataSet, use bdiff in host/tools/bdiff
-+ * to create "diffs":
-+ *  bdiff -q -O -nooldmd5 -nonewmd5 -d ORIGfile NEWfile diffs
-+ * Then add BPatch metadata to the start of "diffs".
-+ *
-+ * NB: There are some implementation-induced restrictions
-+ * on which DataSets can be BPatched.
-+ */
-+#define DSETID_BPATCH_FLAG                0x80000000
-+
-+#endif /* __DSETID_H__ */
-diff --git a/drivers/ar6000/include/gpio.h b/drivers/ar6000/include/gpio.h
-new file mode 100644
-index 0000000..2203c7e
---- /dev/null
-+++ b/drivers/ar6000/include/gpio.h
-@@ -0,0 +1,34 @@
-+/*
-+ * Copyright (c) 2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#if defined(AR6001)
-+#define GPIO_PIN_COUNT 18
-+#else
-+#define GPIO_PIN_COUNT 18
-+#endif
-+
-+/*
-+ * Possible values for WMIX_GPIO_SET_REGISTER_CMDID.
-+ * NB: These match hardware order, so that addresses can
-+ * easily be computed.
-+ */
-+#define GPIO_ID_OUT             0x00000000
-+#define GPIO_ID_OUT_W1TS        0x00000001
-+#define GPIO_ID_OUT_W1TC        0x00000002
-+#define GPIO_ID_ENABLE          0x00000003
-+#define GPIO_ID_ENABLE_W1TS     0x00000004
-+#define GPIO_ID_ENABLE_W1TC     0x00000005
-+#define GPIO_ID_IN              0x00000006
-+#define GPIO_ID_STATUS          0x00000007
-+#define GPIO_ID_STATUS_W1TS     0x00000008
-+#define GPIO_ID_STATUS_W1TC     0x00000009
-+#define GPIO_ID_PIN0            0x0000000a
-+#define GPIO_ID_PIN(n)          (GPIO_ID_PIN0+(n))
-+
-+#define GPIO_LAST_REGISTER_ID   GPIO_ID_PIN(17)
-+#define GPIO_ID_NONE            0xffffffff
-diff --git a/drivers/ar6000/include/gpio_api.h b/drivers/ar6000/include/gpio_api.h
-new file mode 100644
-index 0000000..8078aa5
---- /dev/null
-+++ b/drivers/ar6000/include/gpio_api.h
-@@ -0,0 +1,57 @@
-+#ifndef _GPIO_API_H_
-+#define _GPIO_API_H_
-+/*
-+ * Copyright 2005 Atheros Communications, Inc.,  All Rights Reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+/*
-+ * Host-side General Purpose I/O API.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/gpio_api.h#1 $
-+ */
-+
-+/*
-+ * Send a command to the Target in order to change output on GPIO pins.
-+ */
-+A_STATUS wmi_gpio_output_set(struct wmi_t *wmip,
-+                             A_UINT32 set_mask,
-+                             A_UINT32 clear_mask,
-+                             A_UINT32 enable_mask,
-+                             A_UINT32 disable_mask);
-+
-+/*
-+ * Send a command to the Target requesting input state of GPIO pins.
-+ */
-+A_STATUS wmi_gpio_input_get(struct wmi_t *wmip);
-+
-+/*
-+ * Send a command to the Target to change the value of a GPIO register.
-+ */
-+A_STATUS wmi_gpio_register_set(struct wmi_t *wmip,
-+                               A_UINT32 gpioreg_id,
-+                               A_UINT32 value);
-+
-+/*
-+ * Send a command to the Target to fetch the value of a GPIO register.
-+ */
-+A_STATUS wmi_gpio_register_get(struct wmi_t *wmip, A_UINT32 gpioreg_id);
-+
-+/*
-+ * Send a command to the Target, acknowledging some GPIO interrupts.
-+ */
-+A_STATUS wmi_gpio_intr_ack(struct wmi_t *wmip, A_UINT32 ack_mask);
-+
-+#endif /* _GPIO_API_H_ */
-diff --git a/drivers/ar6000/include/hif.h b/drivers/ar6000/include/hif.h
-new file mode 100644
-index 0000000..846a69f
---- /dev/null
-+++ b/drivers/ar6000/include/hif.h
-@@ -0,0 +1,296 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * HIF specific declarations and prototypes
-+ */
-+
-+#ifndef _HIF_H_
-+#define _HIF_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/* Header files */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+
-+typedef struct htc_callbacks HTC_CALLBACKS;
-+typedef struct hif_device HIF_DEVICE;
-+
-+/*
-+ * direction - Direction of transfer (HIF_READ/HIF_WRITE).
-+ */
-+#define HIF_READ                    0x00000001
-+#define HIF_WRITE                   0x00000002
-+#define HIF_DIR_MASK                (HIF_READ | HIF_WRITE)
-+
-+/*
-+ *     type - An interface may support different kind of read/write commands.
-+ *            The command type is divided into a basic and an extended command
-+ *            and can be specified using HIF_BASIC_IO/HIF_EXTENDED_IO.
-+ */
-+#define HIF_BASIC_IO                0x00000004
-+#define HIF_EXTENDED_IO             0x00000008
-+#define HIF_TYPE_MASK               (HIF_BASIC_IO | HIF_EXTENDED_IO)
-+
-+/*
-+ *     emode - This indicates the whether the command is to be executed in a
-+ *             blocking or non-blocking fashion (HIF_SYNCHRONOUS/
-+ *             HIF_ASYNCHRONOUS). The read/write data paths in HTC have been
-+ *             implemented using the asynchronous mode allowing the the bus
-+ *             driver to indicate the completion of operation through the
-+ *             registered callback routine. The requirement primarily comes
-+ *             from the contexts these operations get called from (a driver's
-+ *             transmit context or the ISR context in case of receive).
-+ *             Support for both of these modes is essential.
-+ */
-+#define HIF_SYNCHRONOUS             0x00000010
-+#define HIF_ASYNCHRONOUS            0x00000020
-+#define HIF_EMODE_MASK              (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)
-+
-+/*
-+ *     dmode - An interface may support different kinds of commands based on
-+ *             the tradeoff between the amount of data it can carry and the
-+ *             setup time. Byte and Block modes are supported (HIF_BYTE_BASIS/
-+ *             HIF_BLOCK_BASIS). In case of latter, the data is rounded off
-+ *             to the nearest block size by padding. The size of the block is
-+ *             configurable at compile time using the HIF_BLOCK_SIZE and is
-+ *             negotiated with the target during initialization after the
-+ *             dragon interrupts are enabled.
-+ */
-+#define HIF_BYTE_BASIS              0x00000040
-+#define HIF_BLOCK_BASIS             0x00000080
-+#define HIF_DMODE_MASK              (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)
-+
-+/*
-+ *     amode - This indicates if the address has to be incremented on dragon
-+ *             after every read/write operation (HIF?FIXED_ADDRESS/
-+ *             HIF_INCREMENTAL_ADDRESS).
-+ */
-+#define HIF_FIXED_ADDRESS           0x00000100
-+#define HIF_INCREMENTAL_ADDRESS     0x00000200
-+#define HIF_AMODE_MASK              (HIF_FIXED_ADDRESS | HIF_INCREMENTAL_ADDRESS)
-+
-+#define HIF_WR_ASYNC_BYTE_FIX   \
-+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_WR_ASYNC_BYTE_INC   \
-+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_ASYNC_BLOCK_INC  \
-+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_SYNC_BYTE_FIX    \
-+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_WR_SYNC_BYTE_INC    \
-+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_SYNC_BLOCK_INC  \
-+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BYTE_INC    \
-+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BYTE_FIX    \
-+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BYTE_FIX   \
-+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BLOCK_FIX  \
-+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BYTE_INC   \
-+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_ASYNC_BLOCK_INC  \
-+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BLOCK_INC  \
-+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+
-+
-+typedef enum {
-+    HIF_DEVICE_POWER_STATE = 0,
-+    HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+    HIF_DEVICE_GET_MBOX_ADDR,
-+    HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
-+    HIF_DEVICE_GET_IRQ_PROC_MODE,
-+    HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
-+} HIF_DEVICE_CONFIG_OPCODE;
-+
-+/*
-+ * HIF CONFIGURE definitions:
-+ *
-+ *   HIF_DEVICE_GET_MBOX_BLOCK_SIZE
-+ *   input : none
-+ *   output : array of 4 A_UINT32s
-+ *   notes: block size is returned for each mailbox (4)
-+ *
-+ *   HIF_DEVICE_GET_MBOX_ADDR
-+ *   input : none
-+ *   output : array of 4 A_UINT32
-+ *   notes: address is returned for each mailbox (4) in the array
-+ *
-+ *   HIF_DEVICE_GET_PENDING_EVENTS_FUNC
-+ *   input : none
-+ *   output: HIF_PENDING_EVENTS_FUNC function pointer
-+ *   notes: this is optional for the HIF layer, if the request is
-+ *          not handled then it indicates that the upper layer can use
-+ *          the standard device methods to get pending events (IRQs, mailbox messages etc..)
-+ *          otherwise it can call the function pointer to check pending events.
-+ *
-+ *   HIF_DEVICE_GET_IRQ_PROC_MODE
-+ *   input : none
-+ *   output : HIF_DEVICE_IRQ_PROCESSING_MODE (interrupt processing mode)
-+ *   note: the hif layer interfaces with the underlying OS-specific bus driver. The HIF
-+ *         layer can report whether IRQ processing is requires synchronous behavior or
-+ *         can be processed using asynchronous bus requests (typically faster).
-+ *
-+ *   HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC
-+ *   input :
-+ *   output : HIF_MASK_UNMASK_RECV_EVENT function pointer
-+ *   notes: this is optional for the HIF layer.  The HIF layer may require a special mechanism
-+ *          to mask receive message events.  The upper layer can call this pointer when it needs
-+ *          to mask/unmask receive events (in case it runs out of buffers).
-+ *
-+ *
-+ */
-+
-+typedef enum {
-+    HIF_DEVICE_IRQ_SYNC_ONLY,   /* for HIF implementations that require the DSR to process all
-+                                   interrupts before returning */
-+    HIF_DEVICE_IRQ_ASYNC_SYNC,  /* for HIF implementations that allow DSR to process interrupts
-+                                   using ASYNC I/O (that is HIFAckInterrupt can be called at a
-+                                   later time */
-+} HIF_DEVICE_IRQ_PROCESSING_MODE;
-+
-+#define HIF_MAX_DEVICES                 1
-+
-+struct htc_callbacks {
-+    A_UCHAR *name;
-+    A_UINT32 id;
-+    A_STATUS (* deviceInsertedHandler)(void *hif_handle);
-+    A_STATUS (* deviceRemovedHandler)(void *htc_handle, A_STATUS status);
-+    A_STATUS (* deviceSuspendHandler)(void *htc_handle);
-+    A_STATUS (* deviceResumeHandler)(void *htc_handle);
-+    A_STATUS (* deviceWakeupHandler)(void *htc_handle);
-+    A_STATUS (* rwCompletionHandler)(void *context, A_STATUS status);
-+    A_STATUS (* dsrHandler)(void *htc_handle);
-+};
-+
-+
-+#define HIF_OTHER_EVENTS     (1 << 0)   /* other interrupts (non-Recv) are pending, host
-+                                           needs to read the register table to figure out what */
-+#define HIF_RECV_MSG_AVAIL   (1 << 1)   /* pending recv packet */
-+
-+typedef struct _HIF_PENDING_EVENTS_INFO {
-+    A_UINT32 Events;
-+    A_UINT32 LookAhead;
-+} HIF_PENDING_EVENTS_INFO;
-+
-+    /* function to get pending events , some HIF modules use special mechanisms
-+     * to detect packet available and other interrupts */
-+typedef A_STATUS ( *HIF_PENDING_EVENTS_FUNC)(HIF_DEVICE              *device,
-+                                             HIF_PENDING_EVENTS_INFO *pEvents,
-+                                             void                    *AsyncContext);
-+
-+#define HIF_MASK_RECV    TRUE
-+#define HIF_UNMASK_RECV  FALSE
-+    /* function to mask recv events */
-+typedef A_STATUS ( *HIF_MASK_UNMASK_RECV_EVENT)(HIF_DEVICE  *device,
-+                                                A_BOOL      Mask,
-+                                                void        *AsyncContext);
-+
-+
-+/*
-+ * This API is used by the HTC layer to initialize the HIF layer and to
-+ * register different callback routines. Support for following events has
-+ * been captured - DSR, Read/Write completion, Device insertion/removal,
-+ * Device suspension/resumption/wakeup. In addition to this, the API is
-+ * also used to register the name and the revision of the chip. The latter
-+ * can be used to verify the revision of the chip read from the device
-+ * before reporting it to HTC.
-+ */
-+int HIFInit(HTC_CALLBACKS *callbacks);
-+
-+/*
-+ * This API is used to provide the read/write interface over the specific bus
-+ * interface.
-+ * address - Starting address in the dragon's address space. For mailbox
-+ *           writes, it refers to the start of the mbox boundary. It should
-+ *           be ensured that the last byte falls on the mailbox's EOM. For
-+ *           mailbox reads, it refers to the end of the mbox boundary.
-+ * buffer - Pointer to the buffer containg the data to be transmitted or
-+ *          received.
-+ * length - Amount of data to be transmitted or received.
-+ * request - Characterizes the attributes of the command.
-+ */
-+A_STATUS
-+HIFReadWrite(HIF_DEVICE    *device,
-+             A_UINT32       address,
-+             A_UCHAR       *buffer,
-+             A_UINT32       length,
-+             A_UINT32       request,
-+             void          *context);
-+
-+/*
-+ * This can be initiated from the unload driver context ie when the HTCShutdown
-+ * routine is called.
-+ */
-+void HIFShutDownDevice(HIF_DEVICE *device);
-+
-+/*
-+ * This should translate to an acknowledgment to the bus driver indicating that
-+ * the previous interrupt request has been serviced and the all the relevant
-+ * sources have been cleared. HTC is ready to process more interrupts.
-+ * This should prevent the bus driver from raising an interrupt unless the
-+ * previous one has been serviced and acknowledged using the previous API.
-+ */
-+void HIFAckInterrupt(HIF_DEVICE *device);
-+
-+void HIFMaskInterrupt(HIF_DEVICE *device);
-+
-+void HIFUnMaskInterrupt(HIF_DEVICE *device);
-+
-+/*
-+ * This set of functions are to be used by the bus driver to notify
-+ * the HIF module about various events.
-+ * These are not implemented if the bus driver provides an alternative
-+ * way for this notification though callbacks for instance.
-+ */
-+int HIFInsertEventNotify(void);
-+
-+int HIFRemoveEventNotify(void);
-+
-+int HIFIRQEventNotify(void);
-+
-+int HIFRWCompleteEventNotify(void);
-+
-+/*
-+ * This function associates a opaque handle with the HIF layer
-+ * to be used in communication with upper layer i.e. HTC.
-+ * This would normaly be a pointer to htc_target data structure.
-+ */
-+void HIFSetHandle(void *hif_handle, void *handle);
-+
-+A_STATUS
-+HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
-+                   void *config, A_UINT32 configLen);
-+
-+
-+struct device;
-+struct device*
-+HIFGetOSDevice(HIF_DEVICE *device);
-+
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _HIF_H_ */
-diff --git a/drivers/ar6000/include/host_version.h b/drivers/ar6000/include/host_version.h
-new file mode 100644
-index 0000000..c090115
---- /dev/null
-+++ b/drivers/ar6000/include/host_version.h
-@@ -0,0 +1,49 @@
-+#ifndef _HOST_VERSION_H_
-+#define _HOST_VERSION_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains version information for the sample host driver for the
-+ * AR6000 chip
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/host_version.h#2 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include <AR6K_version.h>
-+
-+/*
-+ * The version number is made up of major, minor, patch and build
-+ * numbers. These are 16 bit numbers.  The build and release script will
-+ * set the build number using a Perforce counter.  Here the build number is
-+ * set to 9999 so that builds done without the build-release script are easily
-+ * identifiable.
-+ */
-+
-+#define ATH_SW_VER_MAJOR      __VER_MAJOR_
-+#define ATH_SW_VER_MINOR      __VER_MINOR_
-+#define ATH_SW_VER_PATCH      __VER_PATCH_
-+#define ATH_SW_VER_BUILD 9999
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _HOST_VERSION_H_ */
-diff --git a/drivers/ar6000/include/htc.h b/drivers/ar6000/include/htc.h
-new file mode 100644
-index 0000000..152d867
---- /dev/null
-+++ b/drivers/ar6000/include/htc.h
-@@ -0,0 +1,190 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+
-+#ifndef __HTC_H__
-+#define __HTC_H__
-+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
-+
-+#define A_OFFSETOF(type,field) (int)(&(((type *)NULL)->field))
-+
-+#define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
-+        (((A_UINT16)(((A_UINT8 *)(p))[(highbyte)])) << 8 | (A_UINT16)(((A_UINT8 *)(p))[(lowbyte)]))
-+
-+/* alignment independent macros (little-endian) to fetch UINT16s or UINT8s from a
-+ * structure using only the type and field name.
-+ * Use these macros if there is the potential for unaligned buffer accesses. */
-+#define A_GET_UINT16_FIELD(p,type,field) \
-+    ASSEMBLE_UNALIGNED_UINT16(p,\
-+                              A_OFFSETOF(type,field) + 1, \
-+                              A_OFFSETOF(type,field))
-+
-+#define A_SET_UINT16_FIELD(p,type,field,value) \
-+{                                              \
-+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (A_UINT8)(value);        \
-+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field) + 1] = (A_UINT8)((value) >> 8); \
-+}
-+
-+#define A_GET_UINT8_FIELD(p,type,field) \
-+            ((A_UINT8 *)(p))[A_OFFSETOF(type,field)]
-+
-+#define A_SET_UINT8_FIELD(p,type,field,value) \
-+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (value)
-+
-+/****** DANGER DANGER ***************
-+ *
-+ *   The frame header length and message formats defined herein were
-+ *   selected to accommodate optimal alignment for target processing.  This reduces code
-+ *   size and improves performance.
-+ *
-+ *   Any changes to the header length may alter the alignment and cause exceptions
-+ *   on the target. When adding to the message structures insure that fields are
-+ *   properly aligned.
-+ *
-+ */
-+
-+/* HTC frame header */
-+typedef PREPACK struct _HTC_FRAME_HDR{
-+        /* do not remove or re-arrange these fields, these are minimally required
-+         * to take advantage of 4-byte lookaheads in some hardware implementations */
-+    A_UINT8   EndpointID;
-+    A_UINT8   Flags;
-+    A_UINT16  PayloadLen;       /* length of data (including trailer) that follows the header */
-+
-+    /***** end of 4-byte lookahead ****/
-+
-+    A_UINT8   ControlBytes[2];
-+
-+    /* message payload starts after the header */
-+
-+} POSTPACK HTC_FRAME_HDR;
-+
-+/* frame header flags */
-+#define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
-+#define HTC_FLAGS_RECV_TRAILER       (1 << 1)
-+
-+
-+#define HTC_HDR_LENGTH  (sizeof(HTC_FRAME_HDR))
-+#define HTC_MAX_TRAILER_LENGTH   255
-+#define HTC_MAX_PAYLOAD_LENGTH   (2048 - sizeof(HTC_FRAME_HDR))
-+
-+/* HTC control message IDs */
-+typedef enum {
-+    HTC_MSG_READY_ID = 1,
-+    HTC_MSG_CONNECT_SERVICE_ID = 2,
-+    HTC_MSG_CONNECT_SERVICE_RESPONSE_ID = 3,
-+    HTC_MSG_SETUP_COMPLETE_ID = 4,
-+} HTC_MSG_IDS;
-+
-+#define HTC_MAX_CONTROL_MESSAGE_LENGTH  256
-+
-+/* base message ID header */
-+typedef PREPACK struct {
-+    A_UINT16 MessageID;
-+} POSTPACK HTC_UNKNOWN_MSG;
-+
-+/* HTC ready message
-+ * direction : target-to-host  */
-+typedef PREPACK struct {
-+    A_UINT16  MessageID;    /* ID */
-+    A_UINT16  CreditCount;  /* number of credits the target can offer */
-+    A_UINT16  CreditSize;   /* size of each credit */
-+    A_UINT8   MaxEndpoints; /* maximum number of endpoints the target has resources for */
-+    A_UINT8   _Pad1;
-+} POSTPACK HTC_READY_MSG;
-+
-+#define HTC_SERVICE_META_DATA_MAX_LENGTH 128
-+
-+/* connect service
-+ * direction : host-to-target */
-+typedef PREPACK struct {
-+    A_UINT16  MessageID;
-+    A_UINT16  ServiceID;           /* service ID of the service to connect to */
-+    A_UINT16  ConnectionFlags;     /* connection flags */
-+
-+#define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2)  /* reduce credit dribbling when
-+                                                             the host needs credits */
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK             (0x3)
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_FOURTH        0x0
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF          0x1
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_THREE_FOURTHS     0x2
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_UNITY             0x3
-+
-+    A_UINT8   ServiceMetaLength;   /* length of meta data that follows */
-+    A_UINT8   _Pad1;
-+
-+    /* service-specific meta data starts after the header */
-+
-+} POSTPACK HTC_CONNECT_SERVICE_MSG;
-+
-+/* connect response
-+ * direction : target-to-host */
-+typedef PREPACK struct {
-+    A_UINT16  MessageID;
-+    A_UINT16  ServiceID;            /* service ID that the connection request was made */
-+    A_UINT8   Status;               /* service connection status */
-+    A_UINT8   EndpointID;           /* assigned endpoint ID */
-+    A_UINT16  MaxMsgSize;           /* maximum expected message size on this endpoint */
-+    A_UINT8   ServiceMetaLength;    /* length of meta data that follows */
-+    A_UINT8   _Pad1;
-+
-+    /* service-specific meta data starts after the header */
-+
-+} POSTPACK HTC_CONNECT_SERVICE_RESPONSE_MSG;
-+
-+typedef PREPACK struct {
-+    A_UINT16  MessageID;
-+    /* currently, no other fields */
-+} POSTPACK HTC_SETUP_COMPLETE_MSG;
-+
-+
-+/* connect response status codes */
-+#define HTC_SERVICE_SUCCESS      0  /* success */
-+#define HTC_SERVICE_NOT_FOUND    1  /* service could not be found */
-+#define HTC_SERVICE_FAILED       2  /* specific service failed the connect */
-+#define HTC_SERVICE_NO_RESOURCES 3  /* no resources (i.e. no more endpoints) */
-+#define HTC_SERVICE_NO_MORE_EP   4  /* specific service is not allowing any more
-+                                       endpoints */
-+
-+/* report record IDs */
-+typedef enum {
-+    HTC_RECORD_NULL  = 0,
-+    HTC_RECORD_CREDITS   = 1,
-+    HTC_RECORD_LOOKAHEAD = 2,
-+} HTC_RPT_IDS;
-+
-+typedef PREPACK struct {
-+    A_UINT8 RecordID;     /* Record ID */
-+    A_UINT8 Length;       /* Length of record */
-+} POSTPACK HTC_RECORD_HDR;
-+
-+typedef PREPACK struct {
-+    A_UINT8 EndpointID;     /* Endpoint that owns these credits */
-+    A_UINT8 Credits;        /* credits to report since last report */
-+} POSTPACK HTC_CREDIT_REPORT;
-+
-+typedef PREPACK struct {
-+    A_UINT8 PreValid;         /* pre valid guard */
-+    A_UINT8 LookAhead[4];     /* 4 byte lookahead */
-+    A_UINT8 PostValid;        /* post valid guard */
-+
-+   /* NOTE: the LookAhead array is guarded by a PreValid and Post Valid guard bytes.
-+    * The PreValid bytes must equal the inverse of the PostValid byte */
-+
-+} POSTPACK HTC_LOOKAHEAD_REPORT;
-+
-+#ifndef ATH_TARGET
-+#include "athendpack.h"
-+#endif
-+
-+
-+#endif /* __HTC_H__ */
-+
-diff --git a/drivers/ar6000/include/htc_api.h b/drivers/ar6000/include/htc_api.h
-new file mode 100644
-index 0000000..e75692d
---- /dev/null
-+++ b/drivers/ar6000/include/htc_api.h
-@@ -0,0 +1,439 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _HTC_API_H_
-+#define _HTC_API_H_
-+
-+#include <htc.h>
-+#include <htc_services.h>
-+#include "htc_packet.h"
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/* TODO.. for BMI */
-+#define ENDPOINT1 0
-+// TODO -remove me, but we have to fix BMI first
-+#define HTC_MAILBOX_NUM_MAX    4
-+
-+
-+/* ------ Endpoint IDS ------ */
-+typedef enum
-+{
-+    ENDPOINT_UNUSED = -1,
-+    ENDPOINT_0 = 0,
-+    ENDPOINT_1 = 1,
-+    ENDPOINT_2 = 2,
-+    ENDPOINT_3,
-+    ENDPOINT_4,
-+    ENDPOINT_5,
-+    ENDPOINT_6,
-+    ENDPOINT_7,
-+    ENDPOINT_8,
-+    ENDPOINT_MAX,
-+} HTC_ENDPOINT_ID;
-+
-+/* this is the amount of header room required by users of HTC */
-+#define HTC_HEADER_LEN         HTC_HDR_LENGTH
-+
-+typedef void *HTC_HANDLE;
-+
-+typedef A_UINT16 HTC_SERVICE_ID;
-+
-+typedef struct _HTC_INIT_INFO {
-+    void   (*AddInstance)(HTC_HANDLE);
-+    void   (*DeleteInstance)(void *Instance);
-+    void   (*TargetFailure)(void *Instance, A_STATUS Status);
-+} HTC_INIT_INFO;
-+
-+/* per service connection send completion */
-+typedef void   (*HTC_EP_SEND_PKT_COMPLETE)(void *,HTC_PACKET *);
-+/* per service connection pkt received */
-+typedef void   (*HTC_EP_RECV_PKT)(void *,HTC_PACKET *);
-+
-+/* Optional per service connection receive buffer re-fill callback,
-+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
-+ * to the network stack.  The driver never gets the packets back from the OS.  For these OSes
-+ * a refill callback can be used to allocate and re-queue buffers into HTC.
-+ *
-+ * On other OSes, the network stack can call into the driver's OS-specifc "return_packet" handler and
-+ * the driver can re-queue these buffers into HTC. In this regard a refill callback is
-+ * unnecessary */
-+typedef void   (*HTC_EP_RECV_REFILL)(void *, HTC_ENDPOINT_ID Endpoint);
-+
-+/* Optional per service connection callback when a send queue is full. This can occur if the
-+ * host continues queueing up TX packets faster than credits can arrive
-+ * To prevent the host (on some Oses like Linux) from continuously queueing packets
-+ * and consuming resources, this callback is provided so that that the host
-+ * can disable TX in the subsystem (i.e. network stack)
-+ * Other OSes require a "per-packet" indication_RAW_STREAM_NUM_MAX for each completed TX packet, this
-+ * closed loop mechanism will prevent the network stack from overunning the NIC */
-+typedef void (*HTC_EP_SEND_QUEUE_FULL)(void *, HTC_ENDPOINT_ID Endpoint);
-+/* Optional per service connection callback when a send queue is available for receive new packet. */
-+typedef void (*HTC_EP_SEND_QUEUE_AVAIL)(void *, HTC_ENDPOINT_ID Endpoint);
-+
-+typedef struct _HTC_EP_CALLBACKS {
-+    void                     *pContext;     /* context for each callback */
-+    HTC_EP_SEND_PKT_COMPLETE EpTxComplete;  /* tx completion callback for connected endpoint */
-+    HTC_EP_RECV_PKT          EpRecv;        /* receive callback for connected endpoint */
-+    HTC_EP_RECV_REFILL       EpRecvRefill;  /* OPTIONAL receive re-fill callback for connected endpoint */
-+    HTC_EP_SEND_QUEUE_FULL   EpSendFull;    /* OPTIONAL send full callback */
-+    HTC_EP_SEND_QUEUE_AVAIL  EpSendAvail;    /* OPTIONAL send available callback */
-+} HTC_EP_CALLBACKS;
-+
-+/* service connection information */
-+typedef struct _HTC_SERVICE_CONNECT_REQ {
-+    HTC_SERVICE_ID   ServiceID;                 /* service ID to connect to */
-+    A_UINT16         ConnectionFlags;           /* connection flags, see htc protocol definition */
-+    A_UINT8         *pMetaData;                 /* ptr to optional service-specific meta-data */
-+    A_UINT8          MetaDataLength;            /* optional meta data length */
-+    HTC_EP_CALLBACKS EpCallbacks;               /* endpoint callbacks */
-+    int              MaxSendQueueDepth;         /* maximum depth of any send queue */
-+} HTC_SERVICE_CONNECT_REQ;
-+
-+/* service connection response information */
-+typedef struct _HTC_SERVICE_CONNECT_RESP {
-+    A_UINT8     *pMetaData;             /* caller supplied buffer to optional meta-data */
-+    A_UINT8     BufferLength;           /* length of caller supplied buffer */
-+    A_UINT8     ActualLength;           /* actual length of meta data */
-+    HTC_ENDPOINT_ID Endpoint;           /* endpoint to communicate over */
-+    int         MaxMsgLength;           /* max length of all messages over this endpoint */
-+    A_UINT8     ConnectRespCode;        /* connect response code from target */
-+} HTC_SERVICE_CONNECT_RESP;
-+
-+/* endpoint distribution structure */
-+typedef struct _HTC_ENDPOINT_CREDIT_DIST {
-+    struct _HTC_ENDPOINT_CREDIT_DIST *pNext;
-+    struct _HTC_ENDPOINT_CREDIT_DIST *pPrev;
-+    HTC_SERVICE_ID      ServiceID;          /* Service ID (set by HTC) */
-+    HTC_ENDPOINT_ID     Endpoint;           /* endpoint for this distribution struct (set by HTC) */
-+    A_UINT32            DistFlags;          /* distribution flags, distribution function can
-+                                               set default activity using SET_EP_ACTIVE() macro */
-+    int                 TxCreditsNorm;      /* credits for normal operation, anything above this
-+                                               indicates the endpoint is over-subscribed, this field
-+                                               is only relevant to the credit distribution function */
-+    int                 TxCreditsMin;       /* floor for credit distribution, this field is
-+                                               only relevant to the credit distribution function */
-+    int                 TxCreditsAssigned;  /* number of credits assigned to this EP, this field
-+                                               is only relevant to the credit dist function */
-+    int                 TxCredits;          /* current credits available, this field is used by
-+                                               HTC to determine whether a message can be sent or
-+                                               must be queued */
-+    int                 TxCreditsToDist;    /* pending credits to distribute on this endpoint, this
-+                                               is set by HTC when credit reports arrive.
-+                                               The credit distribution functions sets this to zero
-+                                               when it distributes the credits */
-+    int                 TxCreditsSeek;      /* this is the number of credits that the current pending TX
-+                                               packet needs to transmit.  This is set by HTC when
-+                                               and endpoint needs credits in order to transmit */
-+    int                 TxCreditSize;       /* size in bytes of each credit (set by HTC) */
-+    int                 TxCreditsPerMaxMsg; /* credits required for a maximum sized messages (set by HTC) */
-+    void                *pHTCReserved;      /* reserved for HTC use */
-+} HTC_ENDPOINT_CREDIT_DIST;
-+
-+#define HTC_EP_ACTIVE                            (1 << 31)
-+
-+/* macro to check if an endpoint has gone active, useful for credit
-+ * distributions */
-+#define IS_EP_ACTIVE(epDist)  ((epDist)->DistFlags & HTC_EP_ACTIVE)
-+#define SET_EP_ACTIVE(epDist) (epDist)->DistFlags |= HTC_EP_ACTIVE
-+
-+    /* credit distibution code that is passed into the distrbution function,
-+     * there are mandatory and optional codes that must be handled */
-+typedef enum _HTC_CREDIT_DIST_REASON {
-+    HTC_CREDIT_DIST_SEND_COMPLETE = 0,     /* credits available as a result of completed
-+                                              send operations (MANDATORY) resulting in credit reports */
-+    HTC_CREDIT_DIST_ACTIVITY_CHANGE = 1,   /* a change in endpoint activity occured (OPTIONAL) */
-+    HTC_CREDIT_DIST_SEEK_CREDITS,          /* an endpoint needs to "seek" credits (OPTIONAL) */
-+    HTC_DUMP_CREDIT_STATE                  /* for debugging, dump any state information that is kept by
-+                                              the distribution function */
-+} HTC_CREDIT_DIST_REASON;
-+
-+typedef void (*HTC_CREDIT_DIST_CALLBACK)(void                     *Context,
-+                                         HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+                                         HTC_CREDIT_DIST_REASON   Reason);
-+
-+typedef void (*HTC_CREDIT_INIT_CALLBACK)(void *Context,
-+                                         HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+                                         int                      TotalCredits);
-+
-+    /* endpoint statistics action */
-+typedef enum _HTC_ENDPOINT_STAT_ACTION {
-+    HTC_EP_STAT_SAMPLE = 0,                /* only read statistics */
-+    HTC_EP_STAT_SAMPLE_AND_CLEAR = 1,      /* sample and immediately clear statistics */
-+    HTC_EP_STAT_CLEAR                      /* clear only */
-+} HTC_ENDPOINT_STAT_ACTION;
-+
-+    /* endpoint statistics */
-+typedef struct _HTC_ENDPOINT_STATS {
-+    A_UINT32  TxCreditLowIndications;  /* number of times the host set the credit-low flag in a send message on
-+                                        this endpoint */
-+    A_UINT32  TxIssued;               /* running count of TX packets issued */
-+    A_UINT32  TxCreditRpts;           /* running count of total credit reports received for this endpoint */
-+    A_UINT32  TxCreditRptsFromRx;
-+    A_UINT32  TxCreditRptsFromOther;
-+    A_UINT32  TxCreditRptsFromEp0;
-+    A_UINT32  TxCreditsFromRx;        /* count of credits received via Rx packets on this endpoint */
-+    A_UINT32  TxCreditsFromOther;     /* count of credits received via another endpoint */
-+    A_UINT32  TxCreditsFromEp0;       /* count of credits received via another endpoint */
-+    A_UINT32  TxCreditsConsummed;     /* count of consummed credits */
-+    A_UINT32  TxCreditsReturned;      /* count of credits returned */
-+    A_UINT32  RxReceived;             /* count of RX packets received */
-+    A_UINT32  RxLookAheads;           /* count of lookahead records
-+                                         found in messages received on this endpoint */
-+} HTC_ENDPOINT_STATS;
-+
-+/* ------ Function Prototypes ------ */
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Initialize HTC
-+  @function name: HTCInit
-+  @input:  pInfo - initialization information
-+  @output:
-+  @return: A_OK on success
-+  @notes: The caller initializes global HTC state and registers various instance
-+          notification callbacks (see HTC_INIT_INFO).
-+
-+  @example:
-+  @see also: HTCShutdown
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCInit(HTC_INIT_INFO *pInfo);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Get the underlying HIF device handle
-+  @function name: HTCGetHifDevice
-+  @input:  HTCHandle - handle passed into the AddInstance callback
-+  @output:
-+  @return: opaque HIF device handle usable in HIF API calls.
-+  @notes:
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void       *HTCGetHifDevice(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Set the associated instance for the HTC handle
-+  @function name: HTCSetInstance
-+  @input:  HTCHandle - handle passed into the AddInstance callback
-+           Instance - caller supplied instance object
-+  @output:
-+  @return:
-+  @notes:  Caller must set the instance information for the HTC handle in order to receive
-+           notifications for instance deletion (DeleteInstance callback is called) and for target
-+           failure notification.
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Set credit distribution parameters
-+  @function name: HTCSetCreditDistribution
-+  @input:  HTCHandle - HTC handle
-+           pCreditDistCont - caller supplied context to pass into distribution functions
-+           CreditDistFunc - Distribution function callback
-+           CreditDistInit - Credit Distribution initialization callback
-+           ServicePriorityOrder - Array containing list of service IDs, lowest index is highest
-+                                  priority
-+           ListLength - number of elements in ServicePriorityOrder
-+  @output:
-+  @return:
-+  @notes:  The user can set a custom credit distribution function to handle special requirements
-+           for each endpoint.  A default credit distribution routine can be used by setting
-+           CreditInitFunc to NULL.  The default credit distribution is only provided for simple
-+           "fair" credit distribution without regard to any prioritization.
-+
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
-+                                     void                     *pCreditDistContext,
-+                                     HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
-+                                     HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
-+                                     HTC_SERVICE_ID           ServicePriorityOrder[],
-+                                     int                      ListLength);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Wait for the target to indicate the HTC layer is ready
-+  @function name: HTCWaitTarget
-+  @input:  HTCHandle - HTC handle
-+  @output:
-+  @return:
-+  @notes:  This API blocks until the target responds with an HTC ready message.
-+           The caller should not connect services until the target has indicated it is
-+           ready.
-+  @example:
-+  @see also: HTCConnectService
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCWaitTarget(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Start target service communications
-+  @function name: HTCStart
-+  @input:  HTCHandle - HTC handle
-+  @output:
-+  @return:
-+  @notes: This API indicates to the target that the service connection phase is complete
-+          and the target can freely start all connected services.  This API should only be
-+          called AFTER all service connections have been made.  TCStart will issue a
-+          SETUP_COMPLETE message to the target to indicate that all service connections
-+          have been made and the target can start communicating over the endpoints.
-+  @example:
-+  @see also: HTCConnectService
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCStart(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Add receive packet to HTC
-+  @function name: HTCAddReceivePkt
-+  @input:  HTCHandle - HTC handle
-+           pPacket - HTC receive packet to add
-+  @output:
-+  @return: A_OK on success
-+  @notes:  user must supply HTC packets for capturing incomming HTC frames.  The caller
-+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
-+           macro.
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Connect to an HTC service
-+  @function name: HTCConnectService
-+  @input:  HTCHandle - HTC handle
-+           pReq - connection details
-+  @output: pResp - connection response
-+  @return:
-+  @notes:  Service connections must be performed before HTCStart.  User provides callback handlers
-+           for various endpoint events.
-+  @example:
-+  @see also: HTCStart
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCConnectService(HTC_HANDLE HTCHandle,
-+                              HTC_SERVICE_CONNECT_REQ  *pReq,
-+                              HTC_SERVICE_CONNECT_RESP *pResp);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Send an HTC packet
-+  @function name: HTCSendPkt
-+  @input:  HTCHandle - HTC handle
-+           pPacket - packet to send
-+  @output:
-+  @return: A_OK
-+  @notes:  Caller must initialize packet using SET_HTC_PACKET_INFO_TX() macro.
-+           This interface is fully asynchronous.  On error, HTC SendPkt will
-+           call the registered Endpoint callback to cleanup the packet.
-+  @example:
-+  @see also: HTCFlushEndpoint
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS    HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Stop HTC service communications
-+  @function name: HTCStop
-+  @input:  HTCHandle - HTC handle
-+  @output:
-+  @return:
-+  @notes: HTC communications is halted.  All receive and pending TX packets will
-+          be flushed.
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCStop(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Shutdown HTC
-+  @function name: HTCShutdown
-+  @input:
-+  @output:
-+  @return:
-+  @notes:  This cleans up all resources allocated by HTCInit().
-+  @example:
-+  @see also: HTCInit
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCShutDown(void);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Flush pending TX packets
-+  @function name: HTCFlushEndpoint
-+  @input:  HTCHandle - HTC handle
-+           Endpoint - Endpoint to flush
-+           Tag - flush tag
-+  @output:
-+  @return:
-+  @notes:  The Tag parameter is used to selectively flush packets with matching tags.
-+           The value of 0 forces all packets to be flush regardless of tag.
-+  @example:
-+  @see also: HTCSendPkt
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Dump credit distribution state
-+  @function name: HTCDumpCreditStates
-+  @input:  HTCHandle - HTC handle
-+  @output:
-+  @return:
-+  @notes:  This dumps all credit distribution information to the debugger
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCDumpCreditStates(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Indicate a traffic activity change on an endpoint
-+  @function name: HTCIndicateActivityChange
-+  @input:  HTCHandle - HTC handle
-+           Endpoint - endpoint in which activity has changed
-+           Active - TRUE if active, FALSE if it has become inactive
-+  @output:
-+  @return:
-+  @notes:  This triggers the registered credit distribution function to
-+           re-adjust credits for active/inactive endpoints.
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void        HTCIndicateActivityChange(HTC_HANDLE      HTCHandle,
-+                                      HTC_ENDPOINT_ID Endpoint,
-+                                      A_BOOL          Active);
-+
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+  @desc: Get endpoint statistics
-+  @function name: HTCGetEndpointStatistics
-+  @input:  HTCHandle - HTC handle
-+           Endpoint - Endpoint identifier
-+           Action - action to take with statistics
-+  @output:
-+           pStats - statistics that were sampled (can be NULL if Action is HTC_EP_STAT_CLEAR)
-+
-+  @return: TRUE if statistics profiling is enabled, otherwise FALSE.
-+
-+  @notes:  Statistics is a compile-time option and this function may return FALSE
-+           if HTC is not compiled with profiling.
-+
-+           The caller can specify the statistic "action" to take when sampling
-+           the statistics.  This includes:
-+
-+           HTC_EP_STAT_SAMPLE: The pStats structure is filled with the current values.
-+           HTC_EP_STAT_SAMPLE_AND_CLEAR: The structure is filled and the current statistics
-+                             are cleared.
-+           HTC_EP_STAT_CLEA : the statistics are cleared, the called can pass a NULL value for
-+                   pStats
-+
-+  @example:
-+  @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_BOOL       HTCGetEndpointStatistics(HTC_HANDLE               HTCHandle,
-+                                      HTC_ENDPOINT_ID          Endpoint,
-+                                      HTC_ENDPOINT_STAT_ACTION Action,
-+                                      HTC_ENDPOINT_STATS       *pStats);
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _HTC_API_H_ */
-diff --git a/drivers/ar6000/include/htc_packet.h b/drivers/ar6000/include/htc_packet.h
-new file mode 100644
-index 0000000..9ce8718
---- /dev/null
-+++ b/drivers/ar6000/include/htc_packet.h
-@@ -0,0 +1,138 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef HTC_PACKET_H_
-+#define HTC_PACKET_H_
-+
-+
-+#include "dl_list.h"
-+
-+struct _HTC_PACKET;
-+
-+typedef void (* HTC_PACKET_COMPLETION)(void *,struct _HTC_PACKET *);
-+
-+typedef A_UINT16 HTC_TX_TAG;
-+
-+typedef struct _HTC_TX_PACKET_INFO {
-+    HTC_TX_TAG    Tag;            /* tag used to selective flush packets */
-+} HTC_TX_PACKET_INFO;
-+
-+#define HTC_TX_PACKET_TAG_ALL          0    /* a tag of zero is reserved and used to flush ALL packets */
-+#define HTC_TX_PACKET_TAG_INTERNAL     1                                /* internal tags start here */
-+#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
-+
-+typedef struct _HTC_RX_PACKET_INFO {
-+    A_UINT32    Unused;          /* for future use and to make compilers happy */
-+} HTC_RX_PACKET_INFO;
-+
-+/* wrapper around endpoint-specific packets */
-+typedef struct _HTC_PACKET {
-+    DL_LIST         ListLink;       /* double link */
-+    void            *pPktContext;   /* caller's per packet specific context */
-+
-+    A_UINT8         *pBufferStart;  /* the true buffer start , the caller can
-+                                       store the real buffer start here.  In
-+                                       receive callbacks, the HTC layer sets pBuffer
-+                                       to the start of the payload past the header. This
-+                                       field allows the caller to reset pBuffer when it
-+                                       recycles receive packets back to HTC */
-+    /*
-+     * Pointer to the start of the buffer. In the transmit
-+     * direction this points to the start of the payload. In the
-+     * receive direction, however, the buffer when queued up
-+     * points to the start of the HTC header but when returned
-+     * to the caller points to the start of the payload
-+     */
-+    A_UINT8         *pBuffer;       /* payload start (RX/TX) */
-+    A_UINT32        BufferLength;   /* length of buffer */
-+    A_UINT32        ActualLength;   /* actual length of payload */
-+    int             Endpoint;       /* endpoint that this packet was sent/recv'd from */
-+    A_STATUS        Status;         /* completion status */
-+    union {
-+        HTC_TX_PACKET_INFO  AsTx;   /* Tx Packet specific info */
-+        HTC_RX_PACKET_INFO  AsRx;   /* Rx Packet specific info */
-+    } PktInfo;
-+
-+    /* the following fields are for internal HTC use */
-+    HTC_PACKET_COMPLETION Completion;   /* completion */
-+    void                  *pContext;    /* HTC private completion context */
-+    A_UINT32              HTCReserved;  /* reserved */
-+} HTC_PACKET;
-+
-+
-+
-+#define COMPLETE_HTC_PACKET(p,status)        \
-+{                                            \
-+    (p)->Status = (status);                  \
-+    (p)->Completion((p)->pContext,(p));      \
-+}
-+
-+#define INIT_HTC_PACKET_INFO(p,b,len)             \
-+{                                                 \
-+    (p)->pBufferStart = (b);                      \
-+    (p)->BufferLength = (len);                    \
-+}
-+
-+/* macro to set an initial RX packet for refilling HTC */
-+#define SET_HTC_PACKET_INFO_RX_REFILL(p,c,b,len,ep) \
-+{                                                 \
-+    (p)->pPktContext = (c);                       \
-+    (p)->pBuffer = (b);                           \
-+    (p)->pBufferStart = (b);                      \
-+    (p)->BufferLength = (len);                    \
-+    (p)->Endpoint = (ep);                         \
-+}
-+
-+/* fast macro to recycle an RX packet that will be re-queued to HTC */
-+#define HTC_PACKET_RESET_RX(p)              \
-+    (p)->pBuffer = (p)->pBufferStart
-+
-+/* macro to set packet parameters for TX */
-+#define SET_HTC_PACKET_INFO_TX(p,c,b,len,ep,tag)  \
-+{                                                 \
-+    (p)->pPktContext = (c);                       \
-+    (p)->pBuffer = (b);                           \
-+    (p)->ActualLength = (len);                    \
-+    (p)->Endpoint = (ep);                         \
-+    (p)->PktInfo.AsTx.Tag = (tag);                \
-+}
-+
-+/* HTC Packet Queueing Macros */
-+typedef DL_LIST HTC_PACKET_QUEUE;
-+/* initialize queue */
-+#define INIT_HTC_PACKET_QUEUE(pQ) DL_LIST_INIT((pQ))
-+/* enqueue HTC packet to the tail of the queue */
-+#define HTC_PACKET_ENQUEUE(pQ,p)  DL_ListInsertTail((pQ),&(p)->ListLink)
-+/* test if a queue is empty */
-+#define HTC_QUEUE_EMPTY(pQ)       DL_LIST_IS_EMPTY((pQ))
-+/* get packet at head without removing it */
-+#define HTC_GET_PKT_AT_HEAD(pQ)   A_CONTAINING_STRUCT((DL_LIST_GET_ITEM_AT_HEAD(pQ)),HTC_PACKET,ListLink);
-+/* remove a packet from the current list it is linked to */
-+#define HTC_PACKET_REMOVE(p)      DL_ListRemove(&(p)->ListLink)
-+
-+/* dequeue an HTC packet from the head of the queue */
-+static INLINE HTC_PACKET *HTC_PACKET_DEQUEUE(HTC_PACKET_QUEUE *queue) {
-+    DL_LIST    *pItem = DL_ListRemoveItemFromHead(queue);
-+    if (pItem != NULL) {
-+        return A_CONTAINING_STRUCT(pItem, HTC_PACKET, ListLink);
-+    }
-+    return NULL;
-+}
-+
-+#endif /*HTC_PACKET_H_*/
-diff --git a/drivers/ar6000/include/htc_services.h b/drivers/ar6000/include/htc_services.h
-new file mode 100644
-index 0000000..fc6fc29
---- /dev/null
-+++ b/drivers/ar6000/include/htc_services.h
-@@ -0,0 +1,37 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __HTC_SERVICES_H__
-+#define __HTC_SERVICES_H__
-+
-+/* Current service IDs */
-+
-+typedef enum {
-+    RSVD_SERVICE_GROUP  = 0,
-+    WMI_SERVICE_GROUP   = 1,
-+
-+    HTC_TEST_GROUP = 254,
-+    HTC_SERVICE_GROUP_LAST = 255
-+}HTC_SERVICE_GROUP_IDS;
-+
-+#define MAKE_SERVICE_ID(group,index) \
-+            (int)(((int)group << 8) | (int)(index))
-+
-+/* NOTE: service ID of 0x0000 is reserved and should never be used */
-+#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP,1)
-+#define WMI_CONTROL_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,0)
-+#define WMI_DATA_BE_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,1)
-+#define WMI_DATA_BK_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,2)
-+#define WMI_DATA_VI_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,3)
-+#define WMI_DATA_VO_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,4)
-+#define WMI_MAX_SERVICES  5
-+
-+/* raw stream service (i.e. flash, tcmd, calibration apps) */
-+#define HTC_RAW_STREAMS_SVC MAKE_SERVICE_ID(HTC_TEST_GROUP,0)
-+
-+#endif /*HTC_SERVICES_H_*/
-diff --git a/drivers/ar6000/include/ieee80211.h b/drivers/ar6000/include/ieee80211.h
-new file mode 100644
-index 0000000..7090040
---- /dev/null
-+++ b/drivers/ar6000/include/ieee80211.h
-@@ -0,0 +1,342 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2006 Atheros Communications, Inc.
-+ *
-+ * Wireless Network driver for Atheros AR6001
-+ * All rights reserved.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ *
-+ */
-+#ifndef _NET80211_IEEE80211_H_
-+#define _NET80211_IEEE80211_H_
-+
-+#include "athstartpack.h"
-+
-+/*
-+ * 802.11 protocol definitions.
-+ */
-+
-+#define IEEE80211_ADDR_LEN  6       /* size of 802.11 address */
-+/* is 802.11 address multicast/broadcast? */
-+#define IEEE80211_IS_MULTICAST(_a)  (*(_a) & 0x01)
-+#define IEEE80211_ADDR_EQ(addr1, addr2)     \
-+    (A_MEMCMP(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
-+
-+#define IEEE80211_KEYBUF_SIZE 16
-+#define IEEE80211_MICBUF_SIZE (8+8)  /* space for both tx and rx */
-+
-+/*
-+ * NB: these values are ordered carefully; there are lots of
-+ * of implications in any reordering.  In particular beware
-+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
-+ */
-+#define IEEE80211_CIPHER_WEP            0
-+#define IEEE80211_CIPHER_TKIP           1
-+#define IEEE80211_CIPHER_AES_OCB        2
-+#define IEEE80211_CIPHER_AES_CCM        3
-+#define IEEE80211_CIPHER_CKIP           5
-+#define IEEE80211_CIPHER_CCKM_KRK       6
-+#define IEEE80211_CIPHER_NONE           7       /* pseudo value */
-+
-+#define IEEE80211_CIPHER_MAX            (IEEE80211_CIPHER_NONE+1)
-+
-+#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
-+        (((len) == 5) || ((len) == 13) || ((len) == 16))
-+
-+
-+
-+/*
-+ * generic definitions for IEEE 802.11 frames
-+ */
-+PREPACK struct ieee80211_frame {
-+    A_UINT8    i_fc[2];
-+    A_UINT8    i_dur[2];
-+    A_UINT8    i_addr1[IEEE80211_ADDR_LEN];
-+    A_UINT8    i_addr2[IEEE80211_ADDR_LEN];
-+    A_UINT8    i_addr3[IEEE80211_ADDR_LEN];
-+    A_UINT8    i_seq[2];
-+    /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
-+    /* see below */
-+} POSTPACK;
-+
-+#define IEEE80211_FC0_VERSION_MASK          0x03
-+#define IEEE80211_FC0_VERSION_SHIFT         0
-+#define IEEE80211_FC0_VERSION_0             0x00
-+#define IEEE80211_FC0_TYPE_MASK             0x0c
-+#define IEEE80211_FC0_TYPE_SHIFT            2
-+#define IEEE80211_FC0_TYPE_MGT              0x00
-+#define IEEE80211_FC0_TYPE_CTL              0x04
-+#define IEEE80211_FC0_TYPE_DATA             0x08
-+
-+#define IEEE80211_FC0_SUBTYPE_MASK          0xf0
-+#define IEEE80211_FC0_SUBTYPE_SHIFT         4
-+/* for TYPE_MGT */
-+#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ     0x00
-+#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP    0x10
-+#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ   0x20
-+#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP  0x30
-+#define IEEE80211_FC0_SUBTYPE_PROBE_REQ     0x40
-+#define IEEE80211_FC0_SUBTYPE_PROBE_RESP    0x50
-+#define IEEE80211_FC0_SUBTYPE_BEACON        0x80
-+#define IEEE80211_FC0_SUBTYPE_ATIM          0x90
-+#define IEEE80211_FC0_SUBTYPE_DISASSOC      0xa0
-+#define IEEE80211_FC0_SUBTYPE_AUTH          0xb0
-+#define IEEE80211_FC0_SUBTYPE_DEAUTH        0xc0
-+/* for TYPE_CTL */
-+#define IEEE80211_FC0_SUBTYPE_PS_POLL       0xa0
-+#define IEEE80211_FC0_SUBTYPE_RTS           0xb0
-+#define IEEE80211_FC0_SUBTYPE_CTS           0xc0
-+#define IEEE80211_FC0_SUBTYPE_ACK           0xd0
-+#define IEEE80211_FC0_SUBTYPE_CF_END        0xe0
-+#define IEEE80211_FC0_SUBTYPE_CF_END_ACK    0xf0
-+/* for TYPE_DATA (bit combination) */
-+#define IEEE80211_FC0_SUBTYPE_DATA          0x00
-+#define IEEE80211_FC0_SUBTYPE_CF_ACK        0x10
-+#define IEEE80211_FC0_SUBTYPE_CF_POLL       0x20
-+#define IEEE80211_FC0_SUBTYPE_CF_ACPL       0x30
-+#define IEEE80211_FC0_SUBTYPE_NODATA        0x40
-+#define IEEE80211_FC0_SUBTYPE_CFACK         0x50
-+#define IEEE80211_FC0_SUBTYPE_CFPOLL        0x60
-+#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
-+#define IEEE80211_FC0_SUBTYPE_QOS           0x80
-+#define IEEE80211_FC0_SUBTYPE_QOS_NULL      0xc0
-+
-+#define IEEE80211_FC1_DIR_MASK              0x03
-+#define IEEE80211_FC1_DIR_NODS              0x00    /* STA->STA */
-+#define IEEE80211_FC1_DIR_TODS              0x01    /* STA->AP  */
-+#define IEEE80211_FC1_DIR_FROMDS            0x02    /* AP ->STA */
-+#define IEEE80211_FC1_DIR_DSTODS            0x03    /* AP ->AP  */
-+
-+#define IEEE80211_FC1_MORE_FRAG             0x04
-+#define IEEE80211_FC1_RETRY                 0x08
-+#define IEEE80211_FC1_PWR_MGT               0x10
-+#define IEEE80211_FC1_MORE_DATA             0x20
-+#define IEEE80211_FC1_WEP                   0x40
-+#define IEEE80211_FC1_ORDER                 0x80
-+
-+#define IEEE80211_SEQ_FRAG_MASK             0x000f
-+#define IEEE80211_SEQ_FRAG_SHIFT            0
-+#define IEEE80211_SEQ_SEQ_MASK              0xfff0
-+#define IEEE80211_SEQ_SEQ_SHIFT             4
-+
-+#define IEEE80211_NWID_LEN                  32
-+
-+/*
-+ * 802.11 rate set.
-+ */
-+#define IEEE80211_RATE_SIZE     8       /* 802.11 standard */
-+#define IEEE80211_RATE_MAXSIZE  15      /* max rates we'll handle */
-+
-+#define WMM_NUM_AC                  4   /* 4 AC categories */
-+
-+#define WMM_PARAM_ACI_M         0x60    /* Mask for ACI field */
-+#define WMM_PARAM_ACI_S         5   /* Shift for ACI field */
-+#define WMM_PARAM_ACM_M         0x10    /* Mask for ACM bit */
-+#define WMM_PARAM_ACM_S         4       /* Shift for ACM bit */
-+#define WMM_PARAM_AIFSN_M       0x0f    /* Mask for aifsn field */
-+#define WMM_PARAM_LOGCWMIN_M    0x0f    /* Mask for CwMin field (in log) */
-+#define WMM_PARAM_LOGCWMAX_M    0xf0    /* Mask for CwMax field (in log) */
-+#define WMM_PARAM_LOGCWMAX_S    4   /* Shift for CwMax field */
-+
-+#define WMM_AC_TO_TID(_ac) (       \
-+    ((_ac) == WMM_AC_VO) ? 6 : \
-+    ((_ac) == WMM_AC_VI) ? 5 : \
-+    ((_ac) == WMM_AC_BK) ? 1 : \
-+    0)
-+
-+#define TID_TO_WMM_AC(_tid) (      \
-+    ((_tid) < 1) ? WMM_AC_BE : \
-+    ((_tid) < 3) ? WMM_AC_BK : \
-+    ((_tid) < 6) ? WMM_AC_VI : \
-+    WMM_AC_VO)
-+/*
-+ * Management information element payloads.
-+ */
-+
-+enum {
-+    IEEE80211_ELEMID_SSID       = 0,
-+    IEEE80211_ELEMID_RATES      = 1,
-+    IEEE80211_ELEMID_FHPARMS    = 2,
-+    IEEE80211_ELEMID_DSPARMS    = 3,
-+    IEEE80211_ELEMID_CFPARMS    = 4,
-+    IEEE80211_ELEMID_TIM        = 5,
-+    IEEE80211_ELEMID_IBSSPARMS  = 6,
-+    IEEE80211_ELEMID_COUNTRY    = 7,
-+    IEEE80211_ELEMID_CHALLENGE  = 16,
-+    /* 17-31 reserved for challenge text extension */
-+    IEEE80211_ELEMID_PWRCNSTR   = 32,
-+    IEEE80211_ELEMID_PWRCAP     = 33,
-+    IEEE80211_ELEMID_TPCREQ     = 34,
-+    IEEE80211_ELEMID_TPCREP     = 35,
-+    IEEE80211_ELEMID_SUPPCHAN   = 36,
-+    IEEE80211_ELEMID_CHANSWITCH = 37,
-+    IEEE80211_ELEMID_MEASREQ    = 38,
-+    IEEE80211_ELEMID_MEASREP    = 39,
-+    IEEE80211_ELEMID_QUIET      = 40,
-+    IEEE80211_ELEMID_IBSSDFS    = 41,
-+    IEEE80211_ELEMID_ERP        = 42,
-+    IEEE80211_ELEMID_RSN        = 48,
-+    IEEE80211_ELEMID_XRATES     = 50,
-+    IEEE80211_ELEMID_TPC        = 150,
-+    IEEE80211_ELEMID_CCKM       = 156,
-+    IEEE80211_ELEMID_VENDOR     = 221,  /* vendor private */
-+};
-+
-+#define ATH_OUI             0x7f0300        /* Atheros OUI */
-+#define ATH_OUI_TYPE        0x01
-+#define ATH_OUI_SUBTYPE     0x01
-+#define ATH_OUI_VERSION     0x00
-+
-+#define WPA_OUI             0xf25000
-+#define WPA_OUI_TYPE        0x01
-+#define WPA_VERSION         1          /* current supported version */
-+
-+#define WPA_CSE_NULL        0x00
-+#define WPA_CSE_WEP40       0x01
-+#define WPA_CSE_TKIP        0x02
-+#define WPA_CSE_CCMP        0x04
-+#define WPA_CSE_WEP104      0x05
-+
-+#define WPA_ASE_NONE        0x00
-+#define WPA_ASE_8021X_UNSPEC    0x01
-+#define WPA_ASE_8021X_PSK   0x02
-+
-+#define RSN_OUI         0xac0f00
-+#define RSN_VERSION     1       /* current supported version */
-+
-+#define RSN_CSE_NULL        0x00
-+#define RSN_CSE_WEP40       0x01
-+#define RSN_CSE_TKIP        0x02
-+#define RSN_CSE_WRAP        0x03
-+#define RSN_CSE_CCMP        0x04
-+#define RSN_CSE_WEP104      0x05
-+
-+#define RSN_ASE_NONE        0x00
-+#define RSN_ASE_8021X_UNSPEC    0x01
-+#define RSN_ASE_8021X_PSK   0x02
-+
-+#define RSN_CAP_PREAUTH     0x01
-+
-+#define WMM_OUI         0xf25000
-+#define WMM_OUI_TYPE        0x02
-+#define WMM_INFO_OUI_SUBTYPE    0x00
-+#define WMM_PARAM_OUI_SUBTYPE   0x01
-+#define WMM_VERSION     1
-+
-+/* WMM stream classes */
-+#define WMM_NUM_AC  4
-+#define WMM_AC_BE   0       /* best effort */
-+#define WMM_AC_BK   1       /* background */
-+#define WMM_AC_VI   2       /* video */
-+#define WMM_AC_VO   3       /* voice */
-+
-+/* TSPEC related */
-+#define ACTION_CATEGORY_CODE_TSPEC                 17
-+#define ACTION_CODE_TSPEC_ADDTS                    0
-+#define ACTION_CODE_TSPEC_ADDTS_RESP               1
-+#define ACTION_CODE_TSPEC_DELTS                    2
-+
-+typedef enum {
-+    TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
-+    TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
-+    TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
-+    TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
-+    TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
-+    TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
-+    TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
-+    TSPEC_STATUS_CODE_DELTS_SENT    = 0x30,
-+    TSPEC_STATUS_CODE_DELTS_RECV    = 0x31,
-+} TSPEC_STATUS_CODE;
-+
-+/*
-+ * WMM/802.11e Tspec Element
-+ */
-+typedef PREPACK struct wmm_tspec_ie_t {
-+    A_UINT8     elementId;
-+    A_UINT8     len;
-+    A_UINT8     oui[3];
-+    A_UINT8     ouiType;
-+    A_UINT8     ouiSubType;
-+    A_UINT8     version;
-+    A_UINT16    tsInfo_info;
-+    A_UINT8     tsInfo_reserved;
-+    A_UINT16    nominalMSDU;
-+    A_UINT16    maxMSDU;
-+    A_UINT32    minServiceInt;
-+    A_UINT32    maxServiceInt;
-+    A_UINT32    inactivityInt;
-+    A_UINT32    suspensionInt;
-+    A_UINT32    serviceStartTime;
-+    A_UINT32    minDataRate;
-+    A_UINT32    meanDataRate;
-+    A_UINT32    peakDataRate;
-+    A_UINT32    maxBurstSize;
-+    A_UINT32    delayBound;
-+    A_UINT32    minPhyRate;
-+    A_UINT16    sba;
-+    A_UINT16    mediumTime;
-+} POSTPACK WMM_TSPEC_IE;
-+
-+
-+/*
-+ * BEACON management packets
-+ *
-+ *  octet timestamp[8]
-+ *  octet beacon interval[2]
-+ *  octet capability information[2]
-+ *  information element
-+ *      octet elemid
-+ *      octet length
-+ *      octet information[length]
-+ */
-+
-+#define IEEE80211_BEACON_INTERVAL(beacon) \
-+    ((beacon)[8] | ((beacon)[9] << 8))
-+#define IEEE80211_BEACON_CAPABILITY(beacon) \
-+    ((beacon)[10] | ((beacon)[11] << 8))
-+
-+#define IEEE80211_CAPINFO_ESS               0x0001
-+#define IEEE80211_CAPINFO_IBSS              0x0002
-+#define IEEE80211_CAPINFO_CF_POLLABLE       0x0004
-+#define IEEE80211_CAPINFO_CF_POLLREQ        0x0008
-+#define IEEE80211_CAPINFO_PRIVACY           0x0010
-+#define IEEE80211_CAPINFO_SHORT_PREAMBLE    0x0020
-+#define IEEE80211_CAPINFO_PBCC              0x0040
-+#define IEEE80211_CAPINFO_CHNL_AGILITY      0x0080
-+/* bits 8-9 are reserved */
-+#define IEEE80211_CAPINFO_SHORT_SLOTTIME    0x0400
-+#define IEEE80211_CAPINFO_APSD              0x0800
-+/* bit 12 is reserved */
-+#define IEEE80211_CAPINFO_DSSSOFDM          0x2000
-+/* bits 14-15 are reserved */
-+
-+/*
-+ * Authentication Modes
-+ */
-+
-+enum ieee80211_authmode {
-+    IEEE80211_AUTH_NONE     = 0,
-+    IEEE80211_AUTH_OPEN     = 1,
-+    IEEE80211_AUTH_SHARED   = 2,
-+    IEEE80211_AUTH_8021X    = 3,
-+    IEEE80211_AUTH_AUTO     = 4,   /* auto-select/accept */
-+    /* NB: these are used only for ioctls */
-+    IEEE80211_AUTH_WPA      = 5,  /* WPA/RSN  w/ 802.1x */
-+    IEEE80211_AUTH_WPA_PSK  = 6,  /* WPA/RSN  w/ PSK */
-+    IEEE80211_AUTH_WPA_CCKM = 7,  /* WPA/RSN IE  w/ CCKM */
-+};
-+
-+#include "athendpack.h"
-+
-+#endif /* _NET80211_IEEE80211_H_ */
-diff --git a/drivers/ar6000/include/ieee80211_ioctl.h b/drivers/ar6000/include/ieee80211_ioctl.h
-new file mode 100644
-index 0000000..dab6747
---- /dev/null
-+++ b/drivers/ar6000/include/ieee80211_ioctl.h
-@@ -0,0 +1,163 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/ieee80211_ioctl.h#1 $
-+ */
-+
-+#ifndef _IEEE80211_IOCTL_H_
-+#define _IEEE80211_IOCTL_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/*
-+ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
-+ */
-+
-+/*
-+ * WPA/RSN get/set key request.  Specify the key/cipher
-+ * type and whether the key is to be used for sending and/or
-+ * receiving.  The key index should be set only when working
-+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
-+ * Otherwise a unicast/pairwise key is specified by the bssid
-+ * (on a station) or mac address (on an ap).  They key length
-+ * must include any MIC key data; otherwise it should be no
-+ more than IEEE80211_KEYBUF_SIZE.
-+ */
-+struct ieee80211req_key {
-+	u_int8_t	ik_type;	/* key/cipher type */
-+	u_int8_t	ik_pad;
-+	u_int16_t	ik_keyix;	/* key index */
-+	u_int8_t	ik_keylen;	/* key length in bytes */
-+	u_int8_t	ik_flags;
-+#define IEEE80211_KEY_XMIT  0x01
-+#define IEEE80211_KEY_RECV  0x02
-+#define	IEEE80211_KEY_DEFAULT	0x80	/* default xmit key */
-+	u_int8_t	ik_macaddr[IEEE80211_ADDR_LEN];
-+	u_int64_t	ik_keyrsc;	/* key receive sequence counter */
-+	u_int64_t	ik_keytsc;	/* key transmit sequence counter */
-+	u_int8_t	ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
-+};
-+/*
-+ * Delete a key either by index or address.  Set the index
-+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
-+ */
-+struct ieee80211req_del_key {
-+	u_int8_t	idk_keyix;	/* key index */
-+	u_int8_t	idk_macaddr[IEEE80211_ADDR_LEN];
-+};
-+/*
-+ * MLME state manipulation request.  IEEE80211_MLME_ASSOC
-+ * only makes sense when operating as a station.  The other
-+ * requests can be used when operating as a station or an
-+ * ap (to effect a station).
-+ */
-+struct ieee80211req_mlme {
-+	u_int8_t	im_op;		/* operation to perform */
-+#define	IEEE80211_MLME_ASSOC		1	/* associate station */
-+#define	IEEE80211_MLME_DISASSOC		2	/* disassociate station */
-+#define	IEEE80211_MLME_DEAUTH		3	/* deauthenticate station */
-+#define	IEEE80211_MLME_AUTHORIZE	4	/* authorize station */
-+#define	IEEE80211_MLME_UNAUTHORIZE	5	/* unauthorize station */
-+	u_int16_t	im_reason;	/* 802.11 reason code */
-+	u_int8_t	im_macaddr[IEEE80211_ADDR_LEN];
-+};
-+
-+struct ieee80211req_addpmkid {
-+    u_int8_t    pi_bssid[IEEE80211_ADDR_LEN];
-+    u_int8_t    pi_enable;
-+    u_int8_t    pi_pmkid[16];
-+};
-+
-+#define AUTH_ALG_OPEN_SYSTEM	0x01
-+#define AUTH_ALG_SHARED_KEY	0x02
-+#define AUTH_ALG_LEAP		0x04
-+
-+struct ieee80211req_authalg {
-+   u_int8_t auth_alg;
-+};
-+
-+/*
-+ * Request to add an IE to a Management Frame
-+ */
-+enum{
-+    IEEE80211_APPIE_FRAME_BEACON     = 0,
-+    IEEE80211_APPIE_FRAME_PROBE_REQ  = 1,
-+    IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
-+    IEEE80211_APPIE_FRAME_ASSOC_REQ  = 3,
-+    IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
-+    IEEE80211_APPIE_NUM_OF_FRAME     = 5
-+};
-+
-+/*
-+ * The Maximum length of the IE that can be added to a Management frame
-+ */
-+#define IEEE80211_APPIE_FRAME_MAX_LEN  78
-+
-+struct ieee80211req_getset_appiebuf {
-+    u_int32_t app_frmtype; /* management frame type for which buffer is added */
-+    u_int32_t app_buflen;  /*application supplied buffer length */
-+    u_int8_t  app_buf[];
-+};
-+
-+/*
-+ * The following definitions are used by an application to set filter
-+ * for receiving management frames
-+ */
-+enum {
-+     IEEE80211_FILTER_TYPE_BEACON      =   0x1,
-+     IEEE80211_FILTER_TYPE_PROBE_REQ   =   0x2,
-+     IEEE80211_FILTER_TYPE_PROBE_RESP  =   0x4,
-+     IEEE80211_FILTER_TYPE_ASSOC_REQ   =   0x8,
-+     IEEE80211_FILTER_TYPE_ASSOC_RESP  =   0x10,
-+     IEEE80211_FILTER_TYPE_AUTH        =   0x20,
-+     IEEE80211_FILTER_TYPE_DEAUTH      =   0x40,
-+     IEEE80211_FILTER_TYPE_DISASSOC    =   0x80,
-+     IEEE80211_FILTER_TYPE_ALL         =   0xFF  /* used to check the valid filter bits */
-+};
-+
-+struct ieee80211req_set_filter {
-+      u_int32_t app_filterype; /* management frame filter type */
-+};
-+
-+enum {
-+    IEEE80211_PARAM_AUTHMODE = 3,   /* Authentication Mode */
-+    IEEE80211_PARAM_MCASTCIPHER = 5,
-+    IEEE80211_PARAM_MCASTKEYLEN = 6,    /* multicast key length */
-+    IEEE80211_PARAM_UCASTCIPHER = 8,
-+    IEEE80211_PARAM_UCASTKEYLEN = 9,    /* unicast key length */
-+	IEEE80211_PARAM_WPA		= 10,	/* WPA mode (0,1,2) */
-+	IEEE80211_PARAM_ROAMING		= 12,	/* roaming mode */
-+	IEEE80211_PARAM_PRIVACY		= 13,	/* privacy invoked */
-+	IEEE80211_PARAM_COUNTERMEASURES	= 14,	/* WPA/TKIP countermeasures */
-+	IEEE80211_PARAM_DROPUNENCRYPTED	= 15,	/* discard unencrypted frames */
-+};
-+
-+/*
-+ * Values for IEEE80211_PARAM_WPA
-+ */
-+#define WPA_MODE_WPA1   1
-+#define WPA_MODE_WPA2   2
-+#define WPA_MODE_AUTO   3
-+#define WPA_MODE_NONE   4
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _IEEE80211_IOCTL_H_ */
-diff --git a/drivers/ar6000/include/ieee80211_node.h b/drivers/ar6000/include/ieee80211_node.h
-new file mode 100644
-index 0000000..46b613c
---- /dev/null
-+++ b/drivers/ar6000/include/ieee80211_node.h
-@@ -0,0 +1,77 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2006 Atheros Communications, Inc.
-+ *
-+ * Wireless Network driver for Atheros AR6001
-+ * All rights reserved.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ *
-+ */
-+#ifndef _IEEE80211_NODE_H_
-+#define _IEEE80211_NODE_H_
-+
-+/*
-+ * Node locking definitions.
-+ */
-+#define IEEE80211_NODE_LOCK_INIT(_nt)   A_MUTEX_INIT(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_DESTROY(_nt)
-+#define IEEE80211_NODE_LOCK(_nt)        A_MUTEX_LOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_UNLOCK(_nt)      A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_BH(_nt)     A_MUTEX_LOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_UNLOCK_BH(_nt)   A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_ASSERT(_nt)
-+
-+/*
-+ * Node reference counting definitions.
-+ *
-+ * ieee80211_node_initref   initialize the reference count to 1
-+ * ieee80211_node_incref    add a reference
-+ * ieee80211_node_decref    remove a reference
-+ * ieee80211_node_dectestref    remove a reference and return 1 if this
-+ *              is the last reference, otherwise 0
-+ * ieee80211_node_refcnt    reference count for printing (only)
-+ */
-+#define ieee80211_node_initref(_ni)     ((_ni)->ni_refcnt = 1)
-+#define ieee80211_node_incref(_ni)      ((_ni)->ni_refcnt++)
-+#define ieee80211_node_decref(_ni)      ((_ni)->ni_refcnt--)
-+#define ieee80211_node_dectestref(_ni)  (((_ni)->ni_refcnt--) == 0)
-+#define ieee80211_node_refcnt(_ni)      ((_ni)->ni_refcnt)
-+
-+#define IEEE80211_NODE_HASHSIZE 32
-+/* simple hash is enough for variation of macaddr */
-+#define IEEE80211_NODE_HASH(addr)   \
-+    (((const A_UINT8 *)(addr))[IEEE80211_ADDR_LEN - 1] % \
-+        IEEE80211_NODE_HASHSIZE)
-+
-+/*
-+ * Table of ieee80211_node instances.  Each ieee80211com
-+ * has at least one for holding the scan candidates.
-+ * When operating as an access point or in ibss mode there
-+ * is a second table for associated stations or neighbors.
-+ */
-+struct ieee80211_node_table {
-+    void                   *nt_wmip;       /* back reference */
-+    A_MUTEX_T               nt_nodelock;    /* on node table */
-+    struct bss              *nt_node_first; /* information of all nodes */
-+    struct bss              *nt_node_last;  /* information of all nodes */
-+    struct bss              *nt_hash[IEEE80211_NODE_HASHSIZE];
-+    const char              *nt_name;   /* for debugging */
-+    A_UINT32                nt_scangen; /* gen# for timeout scan */
-+    A_TIMER                 nt_inact_timer;
-+    A_UINT8                 isTimerArmed;   /* is the node timer armed */
-+};
-+
-+#define WLAN_NODE_INACT_TIMEOUT_MSEC            10000
-+
-+#endif /* _IEEE80211_NODE_H_ */
-diff --git a/drivers/ar6000/include/ini_dset.h b/drivers/ar6000/include/ini_dset.h
-new file mode 100644
-index 0000000..410f2b52
---- /dev/null
-+++ b/drivers/ar6000/include/ini_dset.h
-@@ -0,0 +1,40 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+#ifndef _INI_DSET_H_
-+#define _INI_DSET_H_
-+
-+/*
-+ * Each of these represents a WHAL INI table, which consists
-+ * of an "address column" followed by 1 or more "value columns".
-+ *
-+ * Software uses the base WHAL_INI_DATA_ID+column to access a
-+ * DataSet that holds a particular column of data.
-+ */
-+typedef enum {
-+    WHAL_INI_DATA_ID_NULL               =0,
-+    WHAL_INI_DATA_ID_MODE_SPECIFIC      =1,  /* 2,3 */
-+    WHAL_INI_DATA_ID_COMMON             =4,  /* 5 */
-+    WHAL_INI_DATA_ID_BB_RFGAIN          =6,  /* 7,8 */
-+    WHAL_INI_DATA_ID_ANALOG_BANK1       =9,  /* 10 */
-+    WHAL_INI_DATA_ID_ANALOG_BANK2       =11, /* 12 */
-+    WHAL_INI_DATA_ID_ANALOG_BANK3       =13, /* 14, 15 */
-+    WHAL_INI_DATA_ID_ANALOG_BANK6       =16, /* 17, 18 */
-+    WHAL_INI_DATA_ID_ANALOG_BANK7       =19, /* 20 */
-+    WHAL_INI_DATA_ID_MODE_OVERRIDES     =21, /* 22,23 */
-+    WHAL_INI_DATA_ID_COMMON_OVERRIDES   =24, /* 25 */
-+
-+    WHAL_INI_DATA_ID_MAX                =25
-+} WHAL_INI_DATA_ID;
-+
-+typedef PREPACK struct {
-+    A_UINT16 freqIndex; // 1 - A mode 2 - B or G mode 0 - common
-+    A_UINT16 offset;
-+    A_UINT32 newValue;
-+} POSTPACK INI_DSET_REG_OVERRIDE;
-+
-+#endif
-diff --git a/drivers/ar6000/include/regDb.h b/drivers/ar6000/include/regDb.h
-new file mode 100644
-index 0000000..b3f665f
---- /dev/null
-+++ b/drivers/ar6000/include/regDb.h
-@@ -0,0 +1,19 @@
-+/*
-+ * Copyright (c) 2005 Atheros Communications, Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This module contains the header files for regulatory module,
-+ * which include the DB schema and DB values.
-+ * $Id:
-+ */
-+
-+#ifndef __REG_DB_H__
-+#define __REG_DB_H__
-+
-+#include "./regulatory/reg_dbschema.h"
-+#include "./regulatory/reg_dbvalues.h"
-+
-+#endif  /* __REG_DB_H__ */
-diff --git a/drivers/ar6000/include/regdump.h b/drivers/ar6000/include/regdump.h
-new file mode 100644
-index 0000000..0106825
---- /dev/null
-+++ b/drivers/ar6000/include/regdump.h
-@@ -0,0 +1,33 @@
-+#ifndef __REGDUMP_H__
-+#define __REGDUMP_H__
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+#if defined(AR6001)
-+#include "AR6001/AR6001_regdump.h"
-+#endif
-+#if defined(AR6002)
-+#include "AR6002/AR6002_regdump.h"
-+#endif
-+
-+#if !defined(__ASSEMBLER__)
-+/*
-+ * Target CPU state at the time of failure is reflected
-+ * in a register dump, which the Host can fetch through
-+ * the diagnostic window.
-+ */
-+struct register_dump_s {
-+    A_UINT32 target_id;               /* Target ID */
-+    A_UINT32 assline;                 /* Line number (if assertion failure) */
-+    A_UINT32 pc;                      /* Program Counter at time of exception */
-+    A_UINT32 badvaddr;                /* Virtual address causing exception */
-+    CPU_exception_frame_t exc_frame;  /* CPU-specific exception info */
-+
-+    /* Could copy top of stack here, too.... */
-+};
-+#endif /* __ASSEMBLER__ */
-+#endif /* __REGDUMP_H__ */
-diff --git a/drivers/ar6000/include/targaddrs.h b/drivers/ar6000/include/targaddrs.h
-new file mode 100644
-index 0000000..da2a650
---- /dev/null
-+++ b/drivers/ar6000/include/targaddrs.h
-@@ -0,0 +1,158 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __TARGADDRS_H__
-+#define __TARGADDRS_H__
-+#if defined(AR6001)
-+#include "AR6001/addrs.h"
-+#endif
-+#if defined(AR6002)
-+#include "AR6002/addrs.h"
-+#endif
-+
-+/*
-+ * AR6K option bits, to enable/disable various features.
-+ * By default, all option bits are 0.
-+ * These bits can be set in LOCAL_SCRATCH register 0.
-+ */
-+#define AR6K_OPTION_BMI_DISABLE      0x01 /* Disable BMI comm with Host */
-+#define AR6K_OPTION_SERIAL_ENABLE    0x02 /* Enable serial port msgs */
-+#define AR6K_OPTION_WDT_DISABLE      0x04 /* WatchDog Timer override */
-+#define AR6K_OPTION_SLEEP_DISABLE    0x08 /* Disable system sleep */
-+#define AR6K_OPTION_STOP_BOOT        0x10 /* Stop boot processes (for ATE) */
-+#define AR6K_OPTION_ENABLE_NOANI     0x20 /* Operate without ANI */
-+#define AR6K_OPTION_DSET_DISABLE     0x40 /* Ignore DataSets */
-+#define AR6K_OPTION_IGNORE_FLASH     0x80 /* Ignore flash during bootup */
-+
-+/*
-+ * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
-+ * host_interest structure.  It must match the address of the _host_interest
-+ * symbol (see linker script).
-+ *
-+ * Host Interest is shared between Host and Target in order to coordinate
-+ * between the two, and is intended to remain constant (with additions only
-+ * at the end) across software releases.
-+ */
-+#define AR6001_HOST_INTEREST_ADDRESS     0x80000600
-+#define AR6002_HOST_INTEREST_ADDRESS     0x00500400
-+
-+#define HOST_INTEREST_MAX_SIZE          0x100
-+
-+#if !defined(__ASSEMBLER__)
-+struct register_dump_s;
-+struct dbglog_hdr_s;
-+
-+/*
-+ * These are items that the Host may need to access
-+ * via BMI or via the Diagnostic Window. The position
-+ * of items in this structure must remain constant
-+ * across firmware revisions!
-+ *
-+ * Types for each item must be fixed size across
-+ * target and host platforms.
-+ *
-+ * More items may be added at the end.
-+ */
-+struct host_interest_s {
-+    /*
-+     * Pointer to application-defined area, if any.
-+     * Set by Target application during startup.
-+     */
-+    A_UINT32               hi_app_host_interest;                      /* 0x00 */
-+
-+    /* Pointer to register dump area, valid after Target crash. */
-+    A_UINT32               hi_failure_state;                          /* 0x04 */
-+
-+    /* Pointer to debug logging header */
-+    A_UINT32               hi_dbglog_hdr;                             /* 0x08 */
-+
-+    /* Indicates whether or not flash is present on Target.
-+     * NB: flash_is_present indicator is here not just
-+     * because it might be of interest to the Host; but
-+     * also because it's set early on by Target's startup
-+     * asm code and we need it to have a special RAM address
-+     * so that it doesn't get reinitialized with the rest
-+     * of data.
-+     */
-+    A_UINT32               hi_flash_is_present;                       /* 0x0c */
-+
-+    /*
-+     * General-purpose flag bits, similar to AR6000_OPTION_* flags.
-+     * Can be used by application rather than by OS.
-+     */
-+    A_UINT32               hi_option_flag;                            /* 0x10 */
-+
-+    /*
-+     * Boolean that determines whether or not to
-+     * display messages on the serial port.
-+     */
-+    A_UINT32               hi_serial_enable;                          /* 0x14 */
-+
-+    /* Start address of Flash DataSet index, if any */
-+    A_UINT32               hi_dset_list_head;                         /* 0x18 */
-+
-+    /* Override Target application start address */
-+    A_UINT32               hi_app_start;                              /* 0x1c */
-+
-+    /* Clock and voltage tuning */
-+    A_UINT32               hi_skip_clock_init;                        /* 0x20 */
-+    A_UINT32               hi_core_clock_setting;                     /* 0x24 */
-+    A_UINT32               hi_cpu_clock_setting;                      /* 0x28 */
-+    A_UINT32               hi_system_sleep_setting;                   /* 0x2c */
-+    A_UINT32               hi_xtal_control_setting;                   /* 0x30 */
-+    A_UINT32               hi_pll_ctrl_setting_24ghz;                 /* 0x34 */
-+    A_UINT32               hi_pll_ctrl_setting_5ghz;                  /* 0x38 */
-+    A_UINT32               hi_ref_voltage_trim_setting;               /* 0x3c */
-+    A_UINT32               hi_clock_info;                             /* 0x40 */
-+
-+    /*
-+     * Flash configuration overrides, used only
-+     * when firmware is not executing from flash.
-+     * (When using flash, modify the global variables
-+     * with equivalent names.)
-+     */
-+    A_UINT32               hi_bank0_addr_value;                       /* 0x44 */
-+    A_UINT32               hi_bank0_read_value;                       /* 0x48 */
-+    A_UINT32               hi_bank0_write_value;                      /* 0x4c */
-+    A_UINT32               hi_bank0_config_value;                     /* 0x50 */
-+
-+    /* Pointer to Board Data  */
-+    A_UINT32               hi_board_data;                             /* 0x54 */
-+    A_UINT32               hi_board_data_initialized;                 /* 0x58 */
-+
-+    A_UINT32               hi_dset_RAM_index_table;                   /* 0x5c */
-+
-+    A_UINT32               hi_desired_baud_rate;                      /* 0x60 */
-+    A_UINT32               hi_dbglog_config;                          /* 0x64 */
-+    A_UINT32               hi_end_RAM_reserve_sz;                     /* 0x68 */
-+    A_UINT32               hi_mbox_io_block_sz;                       /* 0x6c */
-+
-+    A_UINT32               hi_num_bpatch_streams;                     /* 0x70 */
-+    A_UINT32               hi_mbox_isr_yield_limit;                   /* 0x74 */
-+
-+    A_UINT32               hi_refclk_hz;                              /* 0x78 */
-+};
-+
-+/* Bits defined in hi_option_flag */
-+#define HI_OPTION_TIMER_WAR     1 /* not really used */
-+
-+/*
-+ * Intended for use by Host software, this macro returns the Target RAM
-+ * address of any item in the host_interest structure.
-+ * Example: target_addr = AR6001_HOST_INTEREST_ITEM_ADDRESS(hi_board_data);
-+ */
-+#define AR6001_HOST_INTEREST_ITEM_ADDRESS(item) \
-+    ((A_UINT32)&((((struct host_interest_s *)(AR6001_HOST_INTEREST_ADDRESS))->item)))
-+
-+#define AR6002_HOST_INTEREST_ITEM_ADDRESS(item) \
-+    ((A_UINT32)&((((struct host_interest_s *)(AR6002_HOST_INTEREST_ADDRESS))->item)))
-+
-+
-+#endif /* !__ASSEMBLER__ */
-+
-+#endif /* __TARGADDRS_H__ */
-diff --git a/drivers/ar6000/include/testcmd.h b/drivers/ar6000/include/testcmd.h
-new file mode 100644
-index 0000000..737533a
---- /dev/null
-+++ b/drivers/ar6000/include/testcmd.h
-@@ -0,0 +1,144 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef  TESTCMD_H_
-+#define  TESTCMD_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+typedef enum {
-+    ZEROES_PATTERN = 0,
-+    ONES_PATTERN,
-+    REPEATING_10,
-+    PN7_PATTERN,
-+    PN9_PATTERN,
-+    PN15_PATTERN
-+}TX_DATA_PATTERN;
-+
-+/* Continous tx
-+   mode : TCMD_CONT_TX_OFF - Disabling continous tx
-+          TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
-+          TCMD_CONT_TX_FRAME- Enable continuous modulated tx
-+   freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
-+dataRate: 0 - 1 Mbps
-+          1 - 2 Mbps
-+          2 - 5.5 Mbps
-+          3 - 11 Mbps
-+          4 - 6 Mbps
-+          5 - 9 Mbps
-+          6 - 12 Mbps
-+          7 - 18 Mbps
-+          8 - 24 Mbps
-+          9 - 36 Mbps
-+         10 - 28 Mbps
-+         11 - 54 Mbps
-+  txPwr: Tx power in dBm[5 -11] for unmod Tx, [5-14] for mod Tx
-+antenna:  1 - one antenna
-+          2 - two antenna
-+Note : Enable/disable continuous tx test cmd works only when target is awake.
-+*/
-+
-+typedef enum {
-+    TCMD_CONT_TX_OFF = 0,
-+    TCMD_CONT_TX_SINE,
-+    TCMD_CONT_TX_FRAME,
-+    TCMD_CONT_TX_TX99,
-+    TCMD_CONT_TX_TX100
-+} TCMD_CONT_TX_MODE;
-+
-+typedef PREPACK struct {
-+    A_UINT32                 testCmdId;
-+    A_UINT32                mode;
-+    A_UINT32                freq;
-+    A_UINT32                dataRate;
-+    A_INT32                 txPwr;
-+    A_UINT32                antenna;
-+    A_UINT32                enANI;
-+    A_UINT32                scramblerOff;
-+    A_UINT32                aifsn;
-+    A_UINT16                pktSz;
-+    A_UINT16                txPattern;
-+} POSTPACK TCMD_CONT_TX;
-+
-+#define TCMD_TXPATTERN_ZERONE                 0x1
-+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE    0x2
-+
-+/* Continuous Rx
-+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
-+      TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
-+                                             address equal specified
-+                                             mac address (set via act =3)
-+      TCMD_CONT_RX_REPORT  off mode  (disable cont rx mode and get the
-+                                          report from the last cont
-+                                          Rx test)
-+
-+     TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
-+                                                 target. This Overrides
-+                                                 the default MAC address.)
-+
-+*/
-+typedef enum {
-+    TCMD_CONT_RX_PROMIS =0,
-+    TCMD_CONT_RX_FILTER,
-+    TCMD_CONT_RX_REPORT,
-+    TCMD_CONT_RX_SETMAC
-+} TCMD_CONT_RX_ACT;
-+
-+typedef PREPACK struct {
-+    A_UINT32         testCmdId;
-+    A_UINT32        act;
-+    A_UINT32        enANI;
-+    PREPACK union {
-+        struct PREPACK TCMD_CONT_RX_PARA {
-+            A_UINT32    freq;
-+            A_UINT32    antenna;
-+        } POSTPACK para;
-+        struct PREPACK TCMD_CONT_RX_REPORT {
-+            A_UINT32    totalPkt;
-+            A_INT32    rssiInDBm;
-+        } POSTPACK report;
-+        struct PREPACK TCMD_CONT_RX_MAC {
-+            A_UCHAR    addr[ATH_MAC_LEN];
-+        } POSTPACK mac;
-+    } POSTPACK u;
-+} POSTPACK TCMD_CONT_RX;
-+
-+/* Force sleep/wake  test cmd
-+ mode: TCMD_PM_WAKEUP - Wakeup the target
-+       TCMD_PM_SLEEP - Force the target to sleep.
-+ */
-+typedef enum {
-+    TCMD_PM_WAKEUP = 1, /* be consistent with target */
-+    TCMD_PM_SLEEP
-+} TCMD_PM_MODE;
-+
-+typedef PREPACK struct {
-+	A_UINT32  testCmdId;
-+    A_UINT32  mode;
-+} POSTPACK TCMD_PM;
-+
-+typedef enum{
-+    TCMD_CONT_TX_ID,
-+    TCMD_CONT_RX_ID,
-+    TCMD_PM_ID
-+   } TCMD_ID;
-+
-+typedef PREPACK union {
-+          TCMD_CONT_TX contTx;
-+          TCMD_CONT_RX contRx;
-+          TCMD_PM pm ;
-+} POSTPACK TEST_CMD;
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* TESTCMD_H_ */
-diff --git a/drivers/ar6000/include/wlan_api.h b/drivers/ar6000/include/wlan_api.h
-new file mode 100644
-index 0000000..aabca4b
---- /dev/null
-+++ b/drivers/ar6000/include/wlan_api.h
-@@ -0,0 +1,101 @@
-+#ifndef _HOST_WLAN_API_H_
-+#define _HOST_WLAN_API_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains the API for the host wlan module
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wlan_api.h#1 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+struct ieee80211_node_table;
-+struct ieee80211_frame;
-+
-+struct ieee80211_common_ie {
-+    A_UINT16    ie_chan;
-+    A_UINT8     *ie_tstamp;
-+    A_UINT8     *ie_ssid;
-+    A_UINT8     *ie_rates;
-+    A_UINT8     *ie_xrates;
-+    A_UINT8     *ie_country;
-+    A_UINT8     *ie_wpa;
-+    A_UINT8     *ie_rsn;
-+    A_UINT8     *ie_wmm;
-+    A_UINT8     *ie_ath;
-+    A_UINT16    ie_capInfo;
-+    A_UINT16    ie_beaconInt;
-+    A_UINT8     *ie_tim;
-+    A_UINT8     *ie_chswitch;
-+    A_UINT8     ie_erp;
-+    A_UINT8     *ie_wsc;
-+};
-+
-+typedef struct bss {
-+    A_UINT8                      ni_macaddr[6];
-+    A_UINT8                      ni_snr;
-+    A_INT16                      ni_rssi;
-+    struct bss                   *ni_list_next;
-+    struct bss                   *ni_list_prev;
-+    struct bss                   *ni_hash_next;
-+    struct bss                   *ni_hash_prev;
-+    struct ieee80211_common_ie   ni_cie;
-+    A_UINT8                     *ni_buf;
-+    struct ieee80211_node_table *ni_table;
-+    A_UINT32                     ni_refcnt;
-+    int                          ni_scangen;
-+    A_UINT32                     ni_tstamp;
-+} bss_t;
-+
-+typedef void wlan_node_iter_func(void *arg, bss_t *);
-+
-+bss_t *wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size);
-+void wlan_node_free(bss_t *ni);
-+void wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
-+                const A_UINT8 *macaddr);
-+bss_t *wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr);
-+void wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni);
-+void wlan_free_allnodes(struct ieee80211_node_table *nt);
-+void wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
-+                        void *arg);
-+
-+void wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt);
-+void wlan_node_table_reset(struct ieee80211_node_table *nt);
-+void wlan_node_table_cleanup(struct ieee80211_node_table *nt);
-+
-+A_STATUS wlan_parse_beacon(A_UINT8 *buf, int framelen,
-+                           struct ieee80211_common_ie *cie);
-+
-+A_UINT16 wlan_ieee2freq(int chan);
-+A_UINT32 wlan_freq2ieee(A_UINT16 freq);
-+
-+
-+bss_t *
-+wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
-+					A_UINT32 ssidLength, A_BOOL bIsWPA2);
-+
-+void
-+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni);
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _HOST_WLAN_API_H_ */
-diff --git a/drivers/ar6000/include/wlan_dset.h b/drivers/ar6000/include/wlan_dset.h
-new file mode 100644
-index 0000000..8a876d6
---- /dev/null
-+++ b/drivers/ar6000/include/wlan_dset.h
-@@ -0,0 +1,20 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications, Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
-+
-+#ifndef __WLAN_DSET_H__
-+#define __WKAN_DSET_H__
-+
-+typedef PREPACK struct wow_config_dset {
-+
-+    A_UINT8 valid_dset;
-+    A_UINT8 gpio_enable;
-+    A_UINT16 gpio_pin;
-+} POSTPACK WOW_CONFIG_DSET;
-+
-+#endif
-diff --git a/drivers/ar6000/include/wmi.h b/drivers/ar6000/include/wmi.h
-new file mode 100644
-index 0000000..045acd4
---- /dev/null
-+++ b/drivers/ar6000/include/wmi.h
-@@ -0,0 +1,1743 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions of the WMI protocol specified in the
-+ * Wireless Module Interface (WMI).  It includes definitions of all the
-+ * commands and events. Commands are messages from the host to the WM.
-+ * Events and Replies are messages from the WM to the host.
-+ *
-+ * Ownership of correctness in regards to WMI commands
-+ * belongs to the host driver and the WM is not required to validate
-+ * parameters for value, proper range, or any other checking.
-+ *
-+ */
-+
-+#ifndef _WMI_H_
-+#define _WMI_H_
-+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
-+
-+#include "wmix.h"
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#define WMI_PROTOCOL_VERSION    0x0002
-+#define WMI_PROTOCOL_REVISION   0x0000
-+
-+#define ATH_MAC_LEN             6               /* length of mac in bytes */
-+#define WMI_CMD_MAX_LEN         100
-+#define WMI_CONTROL_MSG_MAX_LEN     256
-+#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
-+#define IS_ETHERTYPE(_typeOrLen)        ((_typeOrLen) >= 0x0600)
-+#define RFC1042OUI      {0x00, 0x00, 0x00}
-+
-+#define IP_ETHERTYPE 0x0800
-+
-+#define WMI_IMPLICIT_PSTREAM 0xFF
-+#define WMI_MAX_THINSTREAM 15
-+
-+struct host_app_area_s {
-+    A_UINT32 wmi_protocol_ver;
-+};
-+
-+/*
-+ * Data Path
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     dstMac[ATH_MAC_LEN];
-+    A_UINT8     srcMac[ATH_MAC_LEN];
-+    A_UINT16    typeOrLen;
-+} POSTPACK ATH_MAC_HDR;
-+
-+typedef PREPACK struct {
-+    A_UINT8     dsap;
-+    A_UINT8     ssap;
-+    A_UINT8     cntl;
-+    A_UINT8     orgCode[3];
-+    A_UINT16    etherType;
-+} POSTPACK ATH_LLC_SNAP_HDR;
-+
-+typedef enum {
-+    DATA_MSGTYPE = 0x0,
-+    CNTL_MSGTYPE,
-+    SYNC_MSGTYPE
-+} WMI_MSG_TYPE;
-+
-+
-+typedef PREPACK struct {
-+    A_INT8      rssi;
-+    A_UINT8     info;            /* WMI_MSG_TYPE in lower 2 bits - b1b0 */
-+                                 /* UP in next 3 bits - b4b3b2 */
-+#define WMI_DATA_HDR_MSG_TYPE_MASK  0x03
-+#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
-+#define WMI_DATA_HDR_UP_MASK        0x07
-+#define WMI_DATA_HDR_UP_SHIFT       2
-+#define WMI_DATA_HDR_IS_MSG_TYPE(h, t)  (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
-+} POSTPACK WMI_DATA_HDR;
-+
-+
-+#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
-+#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
-+
-+/*
-+ * Control Path
-+ */
-+typedef PREPACK struct {
-+    A_UINT16    commandId;
-+} POSTPACK WMI_CMD_HDR;        /* used for commands and events */
-+
-+/*
-+ * List of Commnands
-+ */
-+typedef enum {
-+    WMI_CONNECT_CMDID           = 0x0001,
-+    WMI_RECONNECT_CMDID,
-+    WMI_DISCONNECT_CMDID,
-+    WMI_SYNCHRONIZE_CMDID,
-+    WMI_CREATE_PSTREAM_CMDID,
-+    WMI_DELETE_PSTREAM_CMDID,
-+    WMI_START_SCAN_CMDID,
-+    WMI_SET_SCAN_PARAMS_CMDID,
-+    WMI_SET_BSS_FILTER_CMDID,
-+    WMI_SET_PROBED_SSID_CMDID,
-+    WMI_SET_LISTEN_INT_CMDID,
-+    WMI_SET_BMISS_TIME_CMDID,
-+    WMI_SET_DISC_TIMEOUT_CMDID,
-+    WMI_GET_CHANNEL_LIST_CMDID,
-+    WMI_SET_BEACON_INT_CMDID,
-+    WMI_GET_STATISTICS_CMDID,
-+    WMI_SET_CHANNEL_PARAMS_CMDID,
-+    WMI_SET_POWER_MODE_CMDID,
-+    WMI_SET_IBSS_PM_CAPS_CMDID,
-+    WMI_SET_POWER_PARAMS_CMDID,
-+    WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
-+    WMI_ADD_CIPHER_KEY_CMDID,
-+    WMI_DELETE_CIPHER_KEY_CMDID,
-+    WMI_ADD_KRK_CMDID,
-+    WMI_DELETE_KRK_CMDID,
-+    WMI_SET_PMKID_CMDID,
-+    WMI_SET_TX_PWR_CMDID,
-+    WMI_GET_TX_PWR_CMDID,
-+    WMI_SET_ASSOC_INFO_CMDID,
-+    WMI_ADD_BAD_AP_CMDID,
-+    WMI_DELETE_BAD_AP_CMDID,
-+    WMI_SET_TKIP_COUNTERMEASURES_CMDID,
-+    WMI_RSSI_THRESHOLD_PARAMS_CMDID,
-+    WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
-+    WMI_SET_ACCESS_PARAMS_CMDID,
-+    WMI_SET_RETRY_LIMITS_CMDID,
-+    WMI_SET_OPT_MODE_CMDID,
-+    WMI_OPT_TX_FRAME_CMDID,
-+    WMI_SET_VOICE_PKT_SIZE_CMDID,
-+    WMI_SET_MAX_SP_LEN_CMDID,
-+    WMI_SET_ROAM_CTRL_CMDID,
-+    WMI_GET_ROAM_TBL_CMDID,
-+    WMI_GET_ROAM_DATA_CMDID,
-+    WMI_ENABLE_RM_CMDID,
-+    WMI_SET_MAX_OFFHOME_DURATION_CMDID,
-+    WMI_EXTENSION_CMDID,                        /* Non-wireless extensions */
-+    WMI_SNR_THRESHOLD_PARAMS_CMDID,
-+    WMI_LQ_THRESHOLD_PARAMS_CMDID,
-+    WMI_SET_LPREAMBLE_CMDID,
-+    WMI_SET_RTS_CMDID,
-+    WMI_CLR_RSSI_SNR_CMDID,
-+    WMI_SET_FIXRATES_CMDID,
-+    WMI_GET_FIXRATES_CMDID,
-+    WMI_SET_AUTH_MODE_CMDID,
-+    WMI_SET_REASSOC_MODE_CMDID,
-+    WMI_SET_WMM_CMDID,
-+    WMI_SET_WMM_TXOP_CMDID,
-+    WMI_TEST_CMDID,
-+    WMI_SET_BT_STATUS_CMDID,
-+    WMI_SET_BT_PARAMS_CMDID,
-+
-+    WMI_SET_KEEPALIVE_CMDID,
-+    WMI_GET_KEEPALIVE_CMDID,
-+    WMI_SET_APPIE_CMDID,
-+    WMI_GET_APPIE_CMDID,
-+    WMI_SET_WSC_STATUS_CMDID,
-+
-+    /* Wake on Wireless */
-+    WMI_SET_HOST_SLEEP_MODE_CMDID,
-+    WMI_SET_WOW_MODE_CMDID,
-+    WMI_GET_WOW_LIST_CMDID,
-+    WMI_ADD_WOW_PATTERN_CMDID,
-+    WMI_DEL_WOW_PATTERN_CMDID,
-+    WMI_SET_MAC_ADDRESS_CMDID,
-+    WMI_SET_AKMP_PARAMS_CMDID,
-+    WMI_SET_PMKID_LIST_CMDID,
-+    WMI_GET_PMKID_LIST_CMDID,
-+
-+    /*
-+     * Developer commands starts at 0xF000
-+     */
-+    WMI_SET_BITRATE_CMDID = 0xF000,
-+    WMI_GET_BITRATE_CMDID,
-+    WMI_SET_WHALPARAM_CMDID,
-+
-+} WMI_COMMAND_ID;
-+
-+/*
-+ * Frame Types
-+ */
-+typedef enum {
-+    WMI_FRAME_BEACON        =   0,
-+    WMI_FRAME_PROBE_REQ,
-+    WMI_FRAME_PROBE_RESP,
-+    WMI_FRAME_ASSOC_REQ,
-+    WMI_FRAME_ASSOC_RESP,
-+    WMI_NUM_MGMT_FRAME
-+} WMI_MGMT_FRAME_TYPE;
-+
-+/*
-+ * Connect Command
-+ */
-+typedef enum {
-+    INFRA_NETWORK       = 0x01,
-+    ADHOC_NETWORK       = 0x02,
-+    ADHOC_CREATOR       = 0x04,
-+} NETWORK_TYPE;
-+
-+typedef enum {
-+    OPEN_AUTH           = 0x01,
-+    SHARED_AUTH         = 0x02,
-+    LEAP_AUTH           = 0x04,  /* different from IEEE_AUTH_MODE definitions */
-+} DOT11_AUTH_MODE;
-+
-+typedef enum {
-+    NONE_AUTH           = 0x01,
-+    WPA_AUTH            = 0x02,
-+    WPA_PSK_AUTH        = 0x03,
-+    WPA2_AUTH           = 0x04,
-+    WPA2_PSK_AUTH       = 0x05,
-+    WPA_AUTH_CCKM       = 0x06,
-+    WPA2_AUTH_CCKM      = 0x07,
-+} AUTH_MODE;
-+
-+typedef enum {
-+    NONE_CRYPT          = 0x01,
-+    WEP_CRYPT           = 0x02,
-+    TKIP_CRYPT          = 0x03,
-+    AES_CRYPT           = 0x04,
-+} CRYPTO_TYPE;
-+
-+#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
-+#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
-+
-+#define WMI_MIN_KEY_INDEX   0
-+#define WMI_MAX_KEY_INDEX   3
-+
-+#define WMI_MAX_KEY_LEN     32
-+
-+#define WMI_MAX_SSID_LEN    32
-+
-+typedef enum {
-+    CONNECT_ASSOC_POLICY_USER = 0x0001,
-+    CONNECT_SEND_REASSOC = 0x0002,
-+    CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
-+    CONNECT_PROFILE_MATCH_DONE = 0x0008,
-+    CONNECT_IGNORE_AAC_BEACON = 0x0010,
-+    CONNECT_CSA_FOLLOW_BSS = 0x0020,
-+} WMI_CONNECT_CTRL_FLAGS_BITS;
-+
-+#define DEFAULT_CONNECT_CTRL_FLAGS         (CONNECT_CSA_FOLLOW_BSS)
-+
-+typedef PREPACK struct {
-+    A_UINT8     networkType;
-+    A_UINT8     dot11AuthMode;
-+    A_UINT8     authMode;
-+    A_UINT8     pairwiseCryptoType;
-+    A_UINT8     pairwiseCryptoLen;
-+    A_UINT8     groupCryptoType;
-+    A_UINT8     groupCryptoLen;
-+    A_UINT8     ssidLength;
-+    A_UCHAR     ssid[WMI_MAX_SSID_LEN];
-+    A_UINT16    channel;
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT32    ctrl_flags;
-+} POSTPACK WMI_CONNECT_CMD;
-+
-+/*
-+ * WMI_RECONNECT_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT16    channel;                    /* hint */
-+    A_UINT8     bssid[ATH_MAC_LEN];         /* mandatory if set */
-+} POSTPACK WMI_RECONNECT_CMD;
-+
-+/*
-+ * WMI_ADD_CIPHER_KEY_CMDID
-+ */
-+typedef enum {
-+    PAIRWISE_USAGE      = 0x00,
-+    GROUP_USAGE         = 0x01,
-+    TX_USAGE            = 0x02,     /* default Tx Key - Static WEP only */
-+} KEY_USAGE;
-+
-+/*
-+ * Bit Flag
-+ * Bit 0 - Initialise TSC - default is Initialize
-+ */
-+#define KEY_OP_INIT_TSC       0x01
-+#define KEY_OP_INIT_RSC       0x02
-+
-+#define KEY_OP_INIT_VAL     0x03     /* Default Initialise the TSC & RSC */
-+#define KEY_OP_VALID_MASK   0x03
-+
-+typedef PREPACK struct {
-+    A_UINT8     keyIndex;
-+    A_UINT8     keyType;
-+    A_UINT8     keyUsage;           /* KEY_USAGE */
-+    A_UINT8     keyLength;
-+    A_UINT8     keyRSC[8];          /* key replay sequence counter */
-+    A_UINT8     key[WMI_MAX_KEY_LEN];
-+    A_UINT8     key_op_ctrl;       /* Additional Key Control information */
-+} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
-+
-+/*
-+ * WMI_DELETE_CIPHER_KEY_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     keyIndex;
-+} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
-+
-+#define WMI_KRK_LEN     16
-+/*
-+ * WMI_ADD_KRK_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     krk[WMI_KRK_LEN];
-+} POSTPACK WMI_ADD_KRK_CMD;
-+
-+/*
-+ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
-+ */
-+typedef enum {
-+    WMI_TKIP_CM_DISABLE = 0x0,
-+    WMI_TKIP_CM_ENABLE  = 0x1,
-+} WMI_TKIP_CM_CONTROL;
-+
-+typedef PREPACK struct {
-+    A_UINT8  cm_en;                     /* WMI_TKIP_CM_CONTROL */
-+} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
-+
-+/*
-+ * WMI_SET_PMKID_CMDID
-+ */
-+
-+#define WMI_PMKID_LEN 16
-+
-+typedef enum {
-+   PMKID_DISABLE = 0,
-+   PMKID_ENABLE  = 1,
-+} PMKID_ENABLE_FLG;
-+
-+typedef PREPACK struct {
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT8     enable;                 /* PMKID_ENABLE_FLG */
-+    A_UINT8     pmkid[WMI_PMKID_LEN];
-+} POSTPACK WMI_SET_PMKID_CMD;
-+
-+/*
-+ * WMI_START_SCAN_CMD
-+ */
-+typedef enum {
-+    WMI_LONG_SCAN  = 0,
-+    WMI_SHORT_SCAN = 1,
-+} WMI_SCAN_TYPE;
-+
-+typedef PREPACK struct {
-+    A_BOOL   forceFgScan;
-+    A_BOOL   isLegacy;        /* For Legacy Cisco AP compatibility */
-+    A_UINT32 homeDwellTime;   /* Maximum duration in the home channel(milliseconds) */
-+    A_UINT32 forceScanInterval;    /* Time interval between scans (milliseconds)*/
-+    A_UINT8  scanType;           /* WMI_SCAN_TYPE */
-+} POSTPACK WMI_START_SCAN_CMD;
-+
-+/*
-+ * WMI_SET_SCAN_PARAMS_CMDID
-+ */
-+#define WMI_SHORTSCANRATIO_DEFAULT      3
-+typedef enum {
-+    CONNECT_SCAN_CTRL_FLAGS = 0x01,    /* set if can scan in the Connect cmd */
-+    SCAN_CONNECTED_CTRL_FLAGS = 0x02,  /* set if scan for the SSID it is */
-+                                       /* already connected to */
-+    ACTIVE_SCAN_CTRL_FLAGS = 0x04,     /* set if enable active scan */
-+    ROAM_SCAN_CTRL_FLAGS = 0x08,       /* set if enable roam scan when bmiss and lowrssi */
-+    REPORT_BSSINFO_CTRL_FLAGS = 0x10,   /* set if follows customer BSSINFO reporting rule */
-+    ENABLE_AUTO_CTRL_FLAGS = 0x20,      /* if disabled, target doesn't
-+                                          scan after a disconnect event  */
-+    ENABLE_SCAN_ABORT_EVENT = 0x40      /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
-+
-+} WMI_SCAN_CTRL_FLAGS_BITS;
-+
-+#define CAN_SCAN_IN_CONNECT(flags)      (flags & CONNECT_SCAN_CTRL_FLAGS)
-+#define CAN_SCAN_CONNECTED(flags)       (flags & SCAN_CONNECTED_CTRL_FLAGS)
-+#define ENABLE_ACTIVE_SCAN(flags)       (flags & ACTIVE_SCAN_CTRL_FLAGS)
-+#define ENABLE_ROAM_SCAN(flags)         (flags & ROAM_SCAN_CTRL_FLAGS)
-+#define CONFIG_REPORT_BSSINFO(flags)     (flags & REPORT_BSSINFO_CTRL_FLAGS)
-+#define IS_AUTO_SCAN_ENABLED(flags)      (flags & ENABLE_AUTO_CTRL_FLAGS)
-+#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
-+
-+#define DEFAULT_SCAN_CTRL_FLAGS         (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
-+
-+
-+typedef PREPACK struct {
-+    A_UINT16    fg_start_period;        /* seconds */
-+    A_UINT16    fg_end_period;          /* seconds */
-+    A_UINT16    bg_period;              /* seconds */
-+    A_UINT16    maxact_chdwell_time;    /* msec */
-+    A_UINT16    pas_chdwell_time;       /* msec */
-+    A_UINT8     shortScanRatio;         /* how many shorts scan for one long */
-+    A_UINT8     scanCtrlFlags;
-+    A_UINT16    minact_chdwell_time;    /* msec */
-+    A_UINT32    max_dfsch_act_time;  /* msecs */
-+} POSTPACK WMI_SCAN_PARAMS_CMD;
-+
-+/*
-+ * WMI_SET_BSS_FILTER_CMDID
-+ */
-+typedef enum {
-+    NONE_BSS_FILTER = 0x0,              /* no beacons forwarded */
-+    ALL_BSS_FILTER,                     /* all beacons forwarded */
-+    PROFILE_FILTER,                     /* only beacons matching profile */
-+    ALL_BUT_PROFILE_FILTER,             /* all but beacons matching profile */
-+    CURRENT_BSS_FILTER,                 /* only beacons matching current BSS */
-+    ALL_BUT_BSS_FILTER,                 /* all but beacons matching BSS */
-+    PROBED_SSID_FILTER,                 /* beacons matching probed ssid */
-+    LAST_BSS_FILTER,                    /* marker only */
-+} WMI_BSS_FILTER;
-+
-+typedef PREPACK struct {
-+    A_UINT8    bssFilter;                      /* see WMI_BSS_FILTER */
-+    A_UINT32   ieMask;
-+} POSTPACK WMI_BSS_FILTER_CMD;
-+
-+/*
-+ * WMI_SET_PROBED_SSID_CMDID
-+ */
-+#define MAX_PROBED_SSID_INDEX   5
-+
-+typedef enum {
-+    DISABLE_SSID_FLAG  = 0,                  /* disables entry */
-+    SPECIFIC_SSID_FLAG = 0x01,               /* probes specified ssid */
-+    ANY_SSID_FLAG      = 0x02,               /* probes for any ssid */
-+} WMI_SSID_FLAG;
-+
-+typedef PREPACK struct {
-+    A_UINT8     entryIndex;                     /* 0 to MAX_PROBED_SSID_INDEX */
-+    A_UINT8     flag;                           /* WMI_SSID_FLG */
-+    A_UINT8     ssidLength;
-+    A_UINT8     ssid[32];
-+} POSTPACK WMI_PROBED_SSID_CMD;
-+
-+/*
-+ * WMI_SET_LISTEN_INT_CMDID
-+ * The Listen interval is between 15 and 3000 TUs
-+ */
-+#define MIN_LISTEN_INTERVAL 15
-+#define MAX_LISTEN_INTERVAL 5000
-+#define MIN_LISTEN_BEACONS 1
-+#define MAX_LISTEN_BEACONS 50
-+
-+typedef PREPACK struct {
-+    A_UINT16     listenInterval;
-+    A_UINT16     numBeacons;
-+} POSTPACK WMI_LISTEN_INT_CMD;
-+
-+/*
-+ * WMI_SET_BEACON_INT_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT16     beaconInterval;
-+} POSTPACK WMI_BEACON_INT_CMD;
-+
-+/*
-+ * WMI_SET_BMISS_TIME_CMDID
-+ * valid values are between 1000 and 5000 TUs
-+ */
-+
-+#define MIN_BMISS_TIME     1000
-+#define MAX_BMISS_TIME     5000
-+#define MIN_BMISS_BEACONS  1
-+#define MAX_BMISS_BEACONS  50
-+
-+typedef PREPACK struct {
-+    A_UINT16     bmissTime;
-+    A_UINT16     numBeacons;
-+} POSTPACK WMI_BMISS_TIME_CMD;
-+
-+/*
-+ * WMI_SET_POWER_MODE_CMDID
-+ */
-+typedef enum {
-+    REC_POWER = 0x01,
-+    MAX_PERF_POWER,
-+} WMI_POWER_MODE;
-+
-+typedef PREPACK struct {
-+    A_UINT8     powerMode;      /* WMI_POWER_MODE */
-+} POSTPACK WMI_POWER_MODE_CMD;
-+
-+/*
-+ * WMI_SET_POWER_PARAMS_CMDID
-+ */
-+typedef enum {
-+    IGNORE_DTIM = 0x01,
-+    NORMAL_DTIM = 0x02,
-+    STICK_DTIM  = 0x03,
-+} WMI_DTIM_POLICY;
-+
-+typedef PREPACK struct {
-+    A_UINT16    idle_period;             /* msec */
-+    A_UINT16    pspoll_number;
-+    A_UINT16    dtim_policy;
-+} POSTPACK WMI_POWER_PARAMS_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8    power_saving;
-+    A_UINT8    ttl; /* number of beacon periods */
-+    A_UINT16   atim_windows;          /* msec */
-+    A_UINT16   timeout_value;         /* msec */
-+} POSTPACK WMI_IBSS_PM_CAPS_CMD;
-+
-+/*
-+ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
-+ */
-+typedef enum {
-+    IGNORE_TIM_ALL_QUEUES_APSD = 0,
-+    PROCESS_TIM_ALL_QUEUES_APSD = 1,
-+    IGNORE_TIM_SIMULATED_APSD = 2,
-+    PROCESS_TIM_SIMULATED_APSD = 3,
-+} APSD_TIM_POLICY;
-+
-+typedef PREPACK struct {
-+    A_UINT16    psPollTimeout;          /* msec */
-+    A_UINT16    triggerTimeout;         /* msec */
-+    A_UINT32    apsdTimPolicy;      /* TIM behavior with  ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
-+    A_UINT32    simulatedAPSDTimPolicy;      /* TIM behavior with  simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
-+} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
-+
-+/*
-+ * WMI_SET_VOICE_PKT_SIZE_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT16    voicePktSize;
-+} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
-+
-+/*
-+ * WMI_SET_MAX_SP_LEN_CMDID
-+ */
-+typedef enum {
-+    DELIVER_ALL_PKT = 0x0,
-+    DELIVER_2_PKT = 0x1,
-+    DELIVER_4_PKT = 0x2,
-+    DELIVER_6_PKT = 0x3,
-+} APSD_SP_LEN_TYPE;
-+
-+typedef PREPACK struct {
-+    A_UINT8    maxSPLen;
-+} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
-+
-+/*
-+ * WMI_SET_DISC_TIMEOUT_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     disconnectTimeout;          /* seconds */
-+} POSTPACK WMI_DISC_TIMEOUT_CMD;
-+
-+typedef enum {
-+    UPLINK_TRAFFIC = 0,
-+    DNLINK_TRAFFIC = 1,
-+    BIDIR_TRAFFIC = 2,
-+} DIR_TYPE;
-+
-+typedef enum {
-+    DISABLE_FOR_THIS_AC = 0,
-+    ENABLE_FOR_THIS_AC  = 1,
-+    ENABLE_FOR_ALL_AC   = 2,
-+} VOICEPS_CAP_TYPE;
-+
-+typedef enum {
-+    TRAFFIC_TYPE_APERIODIC = 0,
-+    TRAFFIC_TYPE_PERIODIC = 1,
-+}TRAFFIC_TYPE;
-+
-+/*
-+ * WMI_CREATE_PSTREAM_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT32        minServiceInt;           /* in milli-sec */
-+    A_UINT32        maxServiceInt;           /* in milli-sec */
-+    A_UINT32        inactivityInt;           /* in milli-sec */
-+    A_UINT32        suspensionInt;           /* in milli-sec */
-+    A_UINT32        serviceStartTime;
-+    A_UINT32        minDataRate;             /* in bps */
-+    A_UINT32        meanDataRate;            /* in bps */
-+    A_UINT32        peakDataRate;            /* in bps */
-+    A_UINT32        maxBurstSize;
-+    A_UINT32        delayBound;
-+    A_UINT32        minPhyRate;              /* in bps */
-+    A_UINT32        sba;
-+    A_UINT32        mediumTime;
-+    A_UINT16        nominalMSDU;             /* in octects */
-+    A_UINT16        maxMSDU;                 /* in octects */
-+    A_UINT8         trafficClass;
-+    A_UINT8         trafficType;             /* TRAFFIC_TYPE */
-+    A_UINT8         trafficDirection;        /* TRAFFIC_DIR */
-+    A_UINT8         voicePSCapability;       /* VOICEPS_CAP_TYPE */
-+    A_UINT8         tsid;
-+    A_UINT8         userPriority;            /* 802.1D user priority */
-+} POSTPACK WMI_CREATE_PSTREAM_CMD;
-+
-+/*
-+ * WMI_DELETE_PSTREAM_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     trafficClass;
-+    A_UINT8     tsid;
-+} POSTPACK WMI_DELETE_PSTREAM_CMD;
-+
-+/*
-+ * WMI_SET_CHANNEL_PARAMS_CMDID
-+ */
-+typedef enum {
-+    WMI_11A_MODE  = 0x1,
-+    WMI_11G_MODE  = 0x2,
-+    WMI_11AG_MODE = 0x3,
-+    WMI_11B_MODE  = 0x4,
-+    WMI_11GONLY_MODE = 0x5,
-+} WMI_PHY_MODE;
-+
-+#define WMI_MAX_CHANNELS        32
-+
-+typedef PREPACK struct {
-+    A_UINT8     reserved1;
-+    A_UINT8     scanParam;              /* set if enable scan */
-+    A_UINT8     phyMode;                /* see WMI_PHY_MODE */
-+    A_UINT8     numChannels;            /* how many channels follow */
-+    A_UINT16    channelList[1];         /* channels in Mhz */
-+} POSTPACK WMI_CHANNEL_PARAMS_CMD;
-+
-+
-+/*
-+ *  WMI_RSSI_THRESHOLD_PARAMS_CMDID
-+ *  Setting the polltime to 0 would disable polling.
-+ *  Threshold values are in the ascending order, and should agree to:
-+ *  (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
-+ *      < highThreshold_upperVal)
-+ */
-+
-+typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
-+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
-+    A_INT16     thresholdAbove1_Val;          /* lowest of upper */
-+    A_INT16     thresholdAbove2_Val;
-+    A_INT16     thresholdAbove3_Val;
-+    A_INT16     thresholdAbove4_Val;
-+    A_INT16     thresholdAbove5_Val;
-+    A_INT16     thresholdAbove6_Val;          /* highest of upper */
-+    A_INT16     thresholdBelow1_Val;         /* lowest of bellow */
-+    A_INT16     thresholdBelow2_Val;
-+    A_INT16     thresholdBelow3_Val;
-+    A_INT16     thresholdBelow4_Val;
-+    A_INT16     thresholdBelow5_Val;
-+    A_INT16     thresholdBelow6_Val;         /* highest of bellow */
-+    A_UINT8     weight;                  /* "alpha" */
-+    A_UINT8     reserved[3];
-+} POSTPACK  WMI_RSSI_THRESHOLD_PARAMS_CMD;
-+
-+/*
-+ *  WMI_SNR_THRESHOLD_PARAMS_CMDID
-+ *  Setting the polltime to 0 would disable polling.
-+ */
-+
-+typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
-+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
-+    A_UINT8     weight;                  /* "alpha" */
-+    A_UINT8     thresholdAbove1_Val;      /* lowest of uppper*/
-+    A_UINT8     thresholdAbove2_Val;
-+    A_UINT8     thresholdAbove3_Val;
-+    A_UINT8     thresholdAbove4_Val;      /* highest of upper */
-+    A_UINT8     thresholdBelow1_Val;     /* lowest of bellow */
-+    A_UINT8     thresholdBelow2_Val;
-+    A_UINT8     thresholdBelow3_Val;
-+    A_UINT8     thresholdBelow4_Val;     /* highest of bellow */
-+    A_UINT8     reserved[3];
-+} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
-+
-+/*
-+ *  WMI_LQ_THRESHOLD_PARAMS_CMDID
-+ */
-+typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
-+    A_UINT8     enable;
-+    A_UINT8     thresholdAbove1_Val;
-+    A_UINT8     thresholdAbove2_Val;
-+    A_UINT8     thresholdAbove3_Val;
-+    A_UINT8     thresholdAbove4_Val;
-+    A_UINT8     thresholdBelow1_Val;
-+    A_UINT8     thresholdBelow2_Val;
-+    A_UINT8     thresholdBelow3_Val;
-+    A_UINT8     thresholdBelow4_Val;
-+    A_UINT8     reserved[3];
-+} POSTPACK  WMI_LQ_THRESHOLD_PARAMS_CMD;
-+
-+typedef enum {
-+    WMI_LPREAMBLE_DISABLED = 0,
-+    WMI_LPREAMBLE_ENABLED
-+} WMI_LPREAMBLE_STATUS;
-+
-+typedef PREPACK struct {
-+    A_UINT8     status;
-+}POSTPACK WMI_SET_LPREAMBLE_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT16    threshold;
-+}POSTPACK WMI_SET_RTS_CMD;
-+
-+/*
-+ *  WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
-+ *  Sets the error reporting event bitmask in target. Target clears it
-+ *  upon an error. Subsequent errors are counted, but not reported
-+ *  via event, unless the bitmask is set again.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32    bitmask;
-+} POSTPACK  WMI_TARGET_ERROR_REPORT_BITMASK;
-+
-+/*
-+ * WMI_SET_TX_PWR_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     dbM;                  /* in dbM units */
-+} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
-+
-+/*
-+ * WMI_SET_ASSOC_INFO_CMDID
-+ *
-+ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
-+ * A 3rd one, the CCX version IE can also be set from the host.
-+ */
-+#define WMI_MAX_ASSOC_INFO_TYPE    2
-+#define WMI_CCX_VER_IE             2 /* ieType to set CCX Version IE */
-+
-+#define WMI_MAX_ASSOC_INFO_LEN     240
-+
-+typedef PREPACK struct {
-+    A_UINT8     ieType;
-+    A_UINT8     bufferSize;
-+    A_UINT8     assocInfo[1];       /* up to WMI_MAX_ASSOC_INFO_LEN */
-+} POSTPACK WMI_SET_ASSOC_INFO_CMD;
-+
-+
-+/*
-+ * WMI_GET_TX_PWR_CMDID does not take any parameters
-+ */
-+
-+/*
-+ * WMI_ADD_BAD_AP_CMDID
-+ */
-+#define WMI_MAX_BAD_AP_INDEX      1
-+
-+typedef PREPACK struct {
-+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_ADD_BAD_AP_CMD;
-+
-+/*
-+ * WMI_DELETE_BAD_AP_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
-+} POSTPACK WMI_DELETE_BAD_AP_CMD;
-+
-+/*
-+ * WMI_SET_ACCESS_PARAMS_CMDID
-+ */
-+#define WMI_DEFAULT_TXOP_ACPARAM    0       /* implies one MSDU */
-+#define WMI_DEFAULT_ECWMIN_ACPARAM  4       /* corresponds to CWmin of 15 */
-+#define WMI_DEFAULT_ECWMAX_ACPARAM  10      /* corresponds to CWmax of 1023 */
-+#define WMI_MAX_CW_ACPARAM          15      /* maximum eCWmin or eCWmax */
-+#define WMI_DEFAULT_AIFSN_ACPARAM   2
-+#define WMI_MAX_AIFSN_ACPARAM       15
-+typedef PREPACK struct {
-+    A_UINT16 txop;                      /* in units of 32 usec */
-+    A_UINT8  eCWmin;
-+    A_UINT8  eCWmax;
-+    A_UINT8  aifsn;
-+} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
-+
-+
-+/*
-+ * WMI_SET_RETRY_LIMITS_CMDID
-+ *
-+ * This command is used to customize the number of retries the
-+ * wlan device will perform on a given frame.
-+ */
-+#define WMI_MIN_RETRIES 2
-+#define WMI_MAX_RETRIES 13
-+typedef enum {
-+    MGMT_FRAMETYPE    = 0,
-+    CONTROL_FRAMETYPE = 1,
-+    DATA_FRAMETYPE    = 2
-+} WMI_FRAMETYPE;
-+
-+typedef PREPACK struct {
-+    A_UINT8 frameType;                      /* WMI_FRAMETYPE */
-+    A_UINT8 trafficClass;                   /* applies only to DATA_FRAMETYPE */
-+    A_UINT8 maxRetries;
-+    A_UINT8 enableNotify;
-+} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
-+
-+/*
-+ * WMI_SET_ROAM_CTRL_CMDID
-+ *
-+ * This command is used to influence the Roaming behaviour
-+ * Set the host biases of the BSSs before setting the roam mode as bias
-+ * based.
-+ */
-+
-+/*
-+ * Different types of Roam Control
-+ */
-+
-+typedef enum {
-+        WMI_FORCE_ROAM          = 1,      /* Roam to the specified BSSID */
-+        WMI_SET_ROAM_MODE       = 2,      /* default ,progd bias, no roam */
-+        WMI_SET_HOST_BIAS       = 3,     /* Set the Host Bias */
-+        WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
-+} WMI_ROAM_CTRL_TYPE;
-+
-+#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
-+#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
-+
-+/*
-+ * ROAM MODES
-+ */
-+
-+typedef enum {
-+        WMI_DEFAULT_ROAM_MODE   = 1,  /* RSSI based ROAM */
-+        WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
-+        WMI_LOCK_BSS_MODE  = 3  /* Lock to the Current BSS - no Roam */
-+} WMI_ROAM_MODE;
-+
-+/*
-+ * BSS HOST BIAS INFO
-+ */
-+
-+typedef PREPACK struct {
-+        A_UINT8 bssid[ATH_MAC_LEN];
-+        A_INT8  bias;
-+} POSTPACK WMI_BSS_BIAS;
-+
-+typedef PREPACK struct {
-+        A_UINT8 numBss;
-+        WMI_BSS_BIAS bssBias[1];
-+} POSTPACK WMI_BSS_BIAS_INFO;
-+
-+typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
-+        A_UINT16 lowrssi_scan_period;
-+        A_INT16  lowrssi_scan_threshold;
-+        A_INT16  lowrssi_roam_threshold;
-+        A_UINT8  roam_rssi_floor;
-+        A_UINT8  reserved[1];              /* For alignment */
-+} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
-+
-+typedef PREPACK struct {
-+    PREPACK union {
-+        A_UINT8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
-+        A_UINT8 roamMode;           /* WMI_SET_ROAM_MODE  */
-+        WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
-+        WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
-+    } POSTPACK info;
-+    A_UINT8   roamCtrlType ;
-+} POSTPACK WMI_SET_ROAM_CTRL_CMD;
-+
-+/*
-+ * WMI_ENABLE_RM_CMDID
-+ */
-+typedef PREPACK struct {
-+        A_BOOL enable_radio_measurements;
-+} POSTPACK WMI_ENABLE_RM_CMD;
-+
-+/*
-+ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
-+ */
-+typedef PREPACK struct {
-+        A_UINT8 max_offhome_duration;
-+} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT32 frequency;
-+    A_UINT8  threshold;
-+} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
-+
-+typedef enum {
-+    BT_STREAM_UNDEF = 0,
-+    BT_STREAM_SCO,             /* SCO stream */
-+    BT_STREAM_A2DP,            /* A2DP stream */
-+    BT_STREAM_MAX
-+} BT_STREAM_TYPE;
-+
-+typedef enum {
-+    BT_PARAM_SCO = 1,         /* SCO stream parameters */
-+    BT_PARAM_A2DP,            /* A2DP stream parameters */
-+    BT_PARAM_MISC,            /* miscellaneous parameters */
-+    BT_PARAM_REGS,            /* co-existence register parameters */
-+    BT_PARAM_MAX
-+} BT_PARAM_TYPE;
-+
-+typedef enum {
-+    BT_STATUS_UNDEF = 0,
-+    BT_STATUS_START,
-+    BT_STATUS_STOP,
-+    BT_STATUS_RESUME,
-+    BT_STATUS_SUSPEND,
-+    BT_STATUS_MAX
-+} BT_STREAM_STATUS;
-+
-+typedef PREPACK struct {
-+    A_UINT8 streamType;
-+    A_UINT8 status;
-+} POSTPACK WMI_SET_BT_STATUS_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8 noSCOPkts;
-+    A_UINT8 pspollTimeout;
-+    A_UINT8 stompbt;
-+} POSTPACK BT_PARAMS_SCO;
-+
-+typedef PREPACK struct {
-+    A_UINT32 period;
-+    A_UINT32 dutycycle;
-+    A_UINT8  stompbt;
-+} POSTPACK BT_PARAMS_A2DP;
-+
-+typedef PREPACK struct {
-+    A_UINT32 mode;
-+    A_UINT32 scoWghts;
-+    A_UINT32 a2dpWghts;
-+    A_UINT32 genWghts;
-+    A_UINT32 mode2;
-+    A_UINT8  setVal;
-+} POSTPACK BT_COEX_REGS;
-+
-+typedef enum {
-+    WLAN_PROTECT_POLICY = 1,
-+    WLAN_COEX_CTRL_FLAGS
-+} BT_PARAMS_MISC_TYPE;
-+
-+typedef enum {
-+    WLAN_PROTECT_PER_STREAM = 0x01,   /* default */
-+    WLAN_PROTECT_ANY_TX = 0x02
-+} WLAN_PROTECT_FLAGS;
-+
-+
-+#define WLAN_DISABLE_COEX_IN_DISCONNECT   0x01 /* default */
-+#define WLAN_KEEP_COEX_IN_DISCONNECT      0x02
-+#define WLAN_STOMPBT_IN_DISCONNECT        0x04
-+
-+#define WLAN_DISABLE_COEX_IN_ROAM         0x10 /* default */
-+#define WLAN_KEEP_COEX_IN_ROAM            0x20
-+#define WLAN_STOMPBT_IN_ROAM              0x40
-+
-+#define WLAN_DISABLE_COEX_IN_SCAN        0x100 /* default */
-+#define WLAN_KEEP_COEX_IN_SCAN           0x200
-+#define WLAN_STOMPBT_IN_SCAN             0x400
-+
-+#define WLAN_DISABLE_COEX_BT_OFF        0x1000 /* default */
-+#define WLAN_KEEP_COEX_BT_OFF           0x2000
-+#define WLAN_STOMPBT_BT_OFF             0x4000
-+
-+typedef PREPACK struct {
-+    A_UINT32 period;
-+    A_UINT32 dutycycle;
-+    A_UINT8  stompbt;
-+    A_UINT8  policy;
-+} POSTPACK WLAN_PROTECT_POLICY_TYPE;
-+
-+typedef PREPACK struct {
-+    PREPACK union {
-+        WLAN_PROTECT_POLICY_TYPE protectParams;
-+        A_UINT16 wlanCtrlFlags;
-+    } POSTPACK info;
-+    A_UINT8 paramType;
-+} POSTPACK BT_PARAMS_MISC;
-+
-+typedef PREPACK struct {
-+    PREPACK union {
-+        BT_PARAMS_SCO scoParams;
-+        BT_PARAMS_A2DP a2dpParams;
-+        BT_PARAMS_MISC miscParams;
-+        BT_COEX_REGS regs;
-+    } POSTPACK info;
-+    A_UINT8 paramType;
-+} POSTPACK WMI_SET_BT_PARAMS_CMD;
-+
-+/*
-+ * Command Replies
-+ */
-+
-+/*
-+ * WMI_GET_CHANNEL_LIST_CMDID reply
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     reserved1;
-+    A_UINT8     numChannels;            /* number of channels in reply */
-+    A_UINT16    channelList[1];         /* channel in Mhz */
-+} POSTPACK WMI_CHANNEL_LIST_REPLY;
-+
-+typedef enum {
-+    A_SUCCEEDED = A_OK,
-+    A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
-+    A_SUCCEEDED_MODIFY_STREAM=251,
-+    A_FAILED_INVALID_STREAM = 252,
-+    A_FAILED_MAX_THINSTREAMS = 253,
-+    A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
-+} PSTREAM_REPLY_STATUS;
-+
-+/*
-+ * List of Events (target to host)
-+ */
-+typedef enum {
-+    WMI_READY_EVENTID           = 0x1001,
-+    WMI_CONNECT_EVENTID,
-+    WMI_DISCONNECT_EVENTID,
-+    WMI_BSSINFO_EVENTID,
-+    WMI_CMDERROR_EVENTID,
-+    WMI_REGDOMAIN_EVENTID,
-+    WMI_PSTREAM_TIMEOUT_EVENTID,
-+    WMI_NEIGHBOR_REPORT_EVENTID,
-+    WMI_TKIP_MICERR_EVENTID,
-+    WMI_SCAN_COMPLETE_EVENTID,
-+    WMI_REPORT_STATISTICS_EVENTID,
-+    WMI_RSSI_THRESHOLD_EVENTID,
-+    WMI_ERROR_REPORT_EVENTID,
-+    WMI_OPT_RX_FRAME_EVENTID,
-+    WMI_REPORT_ROAM_TBL_EVENTID,
-+    WMI_EXTENSION_EVENTID,
-+    WMI_CAC_EVENTID,
-+    WMI_SNR_THRESHOLD_EVENTID,
-+    WMI_LQ_THRESHOLD_EVENTID,
-+    WMI_TX_RETRY_ERR_EVENTID,
-+    WMI_REPORT_ROAM_DATA_EVENTID,
-+    WMI_TEST_EVENTID,
-+    WMI_APLIST_EVENTID,
-+    WMI_GET_WOW_LIST_EVENTID,
-+    WMI_GET_PMKID_LIST_EVENTID
-+} WMI_EVENT_ID;
-+
-+typedef enum {
-+    WMI_11A_CAPABILITY   = 1,
-+    WMI_11G_CAPABILITY   = 2,
-+    WMI_11AG_CAPABILITY  = 3,
-+} WMI_PHY_CAPABILITY;
-+
-+typedef PREPACK struct {
-+    A_UINT8     macaddr[ATH_MAC_LEN];
-+    A_UINT8     phyCapability;              /* WMI_PHY_CAPABILITY */
-+} POSTPACK WMI_READY_EVENT;
-+
-+/*
-+ * Connect Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT16    channel;
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT16    listenInterval;
-+    A_UINT16    beaconInterval;
-+    A_UINT32    networkType;
-+    A_UINT8     beaconIeLen;
-+    A_UINT8     assocReqLen;
-+    A_UINT8     assocRespLen;
-+    A_UINT8     assocInfo[1];
-+} POSTPACK WMI_CONNECT_EVENT;
-+
-+/*
-+ * Disconnect Event
-+ */
-+typedef enum {
-+    NO_NETWORK_AVAIL   = 0x01,
-+    LOST_LINK          = 0x02,     /* bmiss */
-+    DISCONNECT_CMD     = 0x03,
-+    BSS_DISCONNECTED   = 0x04,
-+    AUTH_FAILED        = 0x05,
-+    ASSOC_FAILED       = 0x06,
-+    NO_RESOURCES_AVAIL = 0x07,
-+    CSERV_DISCONNECT   = 0x08,
-+    INVALID_PROFILE    = 0x0a,
-+    DOT11H_CHANNEL_SWITCH = 0x0b,
-+} WMI_DISCONNECT_REASON;
-+
-+typedef PREPACK struct {
-+    A_UINT16    protocolReasonStatus;  /* reason code, see 802.11 spec. */
-+    A_UINT8     bssid[ATH_MAC_LEN];    /* set if known */
-+    A_UINT8     disconnectReason ;      /* see WMI_DISCONNECT_REASON */
-+    A_UINT8     assocRespLen;
-+    A_UINT8     assocInfo[1];
-+} POSTPACK WMI_DISCONNECT_EVENT;
-+
-+/*
-+ * BSS Info Event.
-+ * Mechanism used to inform host of the presence and characteristic of
-+ * wireless networks present.  Consists of bss info header followed by
-+ * the beacon or probe-response frame body.  The 802.11 header is not included.
-+ */
-+typedef enum {
-+    BEACON_FTYPE = 0x1,
-+    PROBERESP_FTYPE,
-+    ACTION_MGMT_FTYPE,
-+} WMI_BI_FTYPE;
-+
-+enum {
-+    BSS_ELEMID_CHANSWITCH = 0x01,
-+    BSS_ELEMID_ATHEROS = 0x02,
-+};
-+
-+typedef PREPACK struct {
-+    A_UINT16    channel;
-+    A_UINT8     frameType;          /* see WMI_BI_FTYPE */
-+    A_UINT8     snr;
-+    A_INT16     rssi;
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT32    ieMask;
-+} POSTPACK WMI_BSS_INFO_HDR;
-+
-+/*
-+ * Command Error Event
-+ */
-+typedef enum {
-+    INVALID_PARAM  = 0x01,
-+    ILLEGAL_STATE  = 0x02,
-+    INTERNAL_ERROR = 0x03,
-+} WMI_ERROR_CODE;
-+
-+typedef PREPACK struct {
-+    A_UINT16    commandId;
-+    A_UINT8     errorCode;
-+} POSTPACK WMI_CMD_ERROR_EVENT;
-+
-+/*
-+ * New Regulatory Domain Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT32    regDomain;
-+} POSTPACK WMI_REG_DOMAIN_EVENT;
-+
-+typedef PREPACK struct {
-+    A_UINT8     trafficClass;
-+} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
-+
-+/*
-+ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
-+ * the host of BSS's it has found that matches the current profile.
-+ * It can be used by the host to cache PMKs and/to initiate pre-authentication
-+ * if the BSS supports it.  The first bssid is always the current associated
-+ * BSS.
-+ * The bssid and bssFlags information repeats according to the number
-+ * or APs reported.
-+ */
-+typedef enum {
-+    WMI_DEFAULT_BSS_FLAGS   = 0x00,
-+    WMI_PREAUTH_CAPABLE_BSS = 0x01,
-+    WMI_PMKID_VALID_BSS     = 0x02,
-+} WMI_BSS_FLAGS;
-+
-+typedef PREPACK struct {
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT8     bssFlags;            /* see WMI_BSS_FLAGS */
-+} POSTPACK WMI_NEIGHBOR_INFO;
-+
-+typedef PREPACK struct {
-+    A_INT8      numberOfAps;
-+    WMI_NEIGHBOR_INFO neighbor[1];
-+} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
-+
-+/*
-+ * TKIP MIC Error Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT8 keyid;
-+    A_UINT8 ismcast;
-+} POSTPACK WMI_TKIP_MICERR_EVENT;
-+
-+/*
-+ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
-+ */
-+typedef PREPACK struct {
-+    A_STATUS status;
-+} POSTPACK WMI_SCAN_COMPLETE_EVENT;
-+
-+#define MAX_OPT_DATA_LEN 1400
-+
-+/*
-+ * WMI_SET_ADHOC_BSSID_CMDID
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
-+
-+/*
-+ * WMI_SET_OPT_MODE_CMDID
-+ */
-+typedef enum {
-+    SPECIAL_OFF,
-+    SPECIAL_ON,
-+} OPT_MODE_TYPE;
-+
-+typedef PREPACK struct {
-+    A_UINT8     optMode;
-+} POSTPACK WMI_SET_OPT_MODE_CMD;
-+
-+/*
-+ * WMI_TX_OPT_FRAME_CMDID
-+ */
-+typedef enum {
-+    OPT_PROBE_REQ   = 0x01,
-+    OPT_PROBE_RESP  = 0x02,
-+    OPT_CPPP_START  = 0x03,
-+    OPT_CPPP_STOP   = 0x04,
-+} WMI_OPT_FTYPE;
-+
-+typedef PREPACK struct {
-+    A_UINT16    optIEDataLen;
-+    A_UINT8     frmType;
-+    A_UINT8     dstAddr[ATH_MAC_LEN];
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT8     reserved;               /* For alignment */
-+    A_UINT8     optIEData[1];
-+} POSTPACK WMI_OPT_TX_FRAME_CMD;
-+
-+/*
-+ * Special frame receive Event.
-+ * Mechanism used to inform host of the receiption of the special frames.
-+ * Consists of special frame info header followed by special frame body.
-+ * The 802.11 header is not included.
-+ */
-+typedef PREPACK struct {
-+    A_UINT16    channel;
-+    A_UINT8     frameType;          /* see WMI_OPT_FTYPE */
-+    A_INT8      snr;
-+    A_UINT8     srcAddr[ATH_MAC_LEN];
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_OPT_RX_INFO_HDR;
-+
-+/*
-+ * Reporting statistics.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32   tx_packets;
-+    A_UINT32   tx_bytes;
-+    A_UINT32   tx_unicast_pkts;
-+    A_UINT32   tx_unicast_bytes;
-+    A_UINT32   tx_multicast_pkts;
-+    A_UINT32   tx_multicast_bytes;
-+    A_UINT32   tx_broadcast_pkts;
-+    A_UINT32   tx_broadcast_bytes;
-+    A_UINT32   tx_rts_success_cnt;
-+    A_UINT32   tx_packet_per_ac[4];
-+    A_UINT32   tx_errors_per_ac[4];
-+
-+    A_UINT32   tx_errors;
-+    A_UINT32   tx_failed_cnt;
-+    A_UINT32   tx_retry_cnt;
-+    A_UINT32   tx_rts_fail_cnt;
-+    A_INT32    tx_unicast_rate;
-+}POSTPACK tx_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32   rx_packets;
-+    A_UINT32   rx_bytes;
-+    A_UINT32   rx_unicast_pkts;
-+    A_UINT32   rx_unicast_bytes;
-+    A_UINT32   rx_multicast_pkts;
-+    A_UINT32   rx_multicast_bytes;
-+    A_UINT32   rx_broadcast_pkts;
-+    A_UINT32   rx_broadcast_bytes;
-+    A_UINT32   rx_fragment_pkt;
-+
-+    A_UINT32   rx_errors;
-+    A_UINT32   rx_crcerr;
-+    A_UINT32   rx_key_cache_miss;
-+    A_UINT32   rx_decrypt_err;
-+    A_UINT32   rx_duplicate_frames;
-+    A_INT32    rx_unicast_rate;
-+}POSTPACK rx_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32   tkip_local_mic_failure;
-+    A_UINT32   tkip_counter_measures_invoked;
-+    A_UINT32   tkip_replays;
-+    A_UINT32   tkip_format_errors;
-+    A_UINT32   ccmp_format_errors;
-+    A_UINT32   ccmp_replays;
-+}POSTPACK tkip_ccmp_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32   power_save_failure_cnt;
-+}POSTPACK pm_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32    cs_bmiss_cnt;
-+    A_UINT32    cs_lowRssi_cnt;
-+    A_UINT16    cs_connect_cnt;
-+    A_UINT16    cs_disconnect_cnt;
-+    A_INT16     cs_aveBeacon_rssi;
-+    A_UINT16    cs_roam_count;
-+    A_UINT16    cs_rssi;
-+    A_UINT8     cs_snr;
-+    A_UINT8     cs_aveBeacon_snr;
-+    A_UINT8     cs_lastRoam_msec;
-+} POSTPACK cserv_stats_t;
-+
-+typedef PREPACK struct {
-+    tx_stats_t          tx_stats;
-+    rx_stats_t          rx_stats;
-+    tkip_ccmp_stats_t   tkipCcmpStats;
-+}POSTPACK wlan_net_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32    wow_num_pkts_dropped;
-+    A_UINT16    wow_num_events_discarded;
-+    A_UINT8     wow_num_host_pkt_wakeups;
-+    A_UINT8     wow_num_host_event_wakeups;
-+} POSTPACK wlan_wow_stats_t;
-+
-+typedef PREPACK struct {
-+    A_UINT32            lqVal;
-+    A_INT32             noise_floor_calibation;
-+    pm_stats_t          pmStats;
-+    wlan_net_stats_t    txrxStats;
-+    wlan_wow_stats_t    wowStats;
-+    cserv_stats_t       cservStats;
-+} POSTPACK WMI_TARGET_STATS;
-+
-+/*
-+ * WMI_RSSI_THRESHOLD_EVENTID.
-+ * Indicate the RSSI events to host. Events are indicated when we breach a
-+ * thresold value.
-+ */
-+typedef enum{
-+    WMI_RSSI_THRESHOLD1_ABOVE = 0,
-+    WMI_RSSI_THRESHOLD2_ABOVE,
-+    WMI_RSSI_THRESHOLD3_ABOVE,
-+    WMI_RSSI_THRESHOLD4_ABOVE,
-+    WMI_RSSI_THRESHOLD5_ABOVE,
-+    WMI_RSSI_THRESHOLD6_ABOVE,
-+    WMI_RSSI_THRESHOLD1_BELOW,
-+    WMI_RSSI_THRESHOLD2_BELOW,
-+    WMI_RSSI_THRESHOLD3_BELOW,
-+    WMI_RSSI_THRESHOLD4_BELOW,
-+    WMI_RSSI_THRESHOLD5_BELOW,
-+    WMI_RSSI_THRESHOLD6_BELOW
-+}WMI_RSSI_THRESHOLD_VAL;
-+
-+typedef PREPACK struct {
-+    A_INT16 rssi;
-+    A_UINT8 range;
-+}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
-+
-+/*
-+ *  WMI_ERROR_REPORT_EVENTID
-+ */
-+typedef enum{
-+    WMI_TARGET_PM_ERR_FAIL      = 0x00000001,
-+    WMI_TARGET_KEY_NOT_FOUND    = 0x00000002,
-+    WMI_TARGET_DECRYPTION_ERR   = 0x00000004,
-+    WMI_TARGET_BMISS            = 0x00000008,
-+    WMI_PSDISABLE_NODE_JOIN     = 0x00000010,
-+    WMI_TARGET_COM_ERR          = 0x00000020,
-+    WMI_TARGET_FATAL_ERR        = 0x00000040
-+} WMI_TARGET_ERROR_VAL;
-+
-+typedef PREPACK struct {
-+    A_UINT32 errorVal;
-+}POSTPACK  WMI_TARGET_ERROR_REPORT_EVENT;
-+
-+typedef PREPACK struct {
-+    A_UINT8 retrys;
-+}POSTPACK  WMI_TX_RETRY_ERR_EVENT;
-+
-+typedef enum{
-+    WMI_SNR_THRESHOLD1_ABOVE = 1,
-+    WMI_SNR_THRESHOLD1_BELOW,
-+    WMI_SNR_THRESHOLD2_ABOVE,
-+    WMI_SNR_THRESHOLD2_BELOW,
-+    WMI_SNR_THRESHOLD3_ABOVE,
-+    WMI_SNR_THRESHOLD3_BELOW,
-+    WMI_SNR_THRESHOLD4_ABOVE,
-+    WMI_SNR_THRESHOLD4_BELOW
-+} WMI_SNR_THRESHOLD_VAL;
-+
-+typedef PREPACK struct {
-+    A_UINT8 range;  /* WMI_SNR_THRESHOLD_VAL */
-+    A_UINT8 snr;
-+}POSTPACK  WMI_SNR_THRESHOLD_EVENT;
-+
-+typedef enum{
-+    WMI_LQ_THRESHOLD1_ABOVE = 1,
-+    WMI_LQ_THRESHOLD1_BELOW,
-+    WMI_LQ_THRESHOLD2_ABOVE,
-+    WMI_LQ_THRESHOLD2_BELOW,
-+    WMI_LQ_THRESHOLD3_ABOVE,
-+    WMI_LQ_THRESHOLD3_BELOW,
-+    WMI_LQ_THRESHOLD4_ABOVE,
-+    WMI_LQ_THRESHOLD4_BELOW
-+} WMI_LQ_THRESHOLD_VAL;
-+
-+typedef PREPACK struct {
-+    A_INT32 lq;
-+    A_UINT8 range;  /* WMI_LQ_THRESHOLD_VAL */
-+}POSTPACK  WMI_LQ_THRESHOLD_EVENT;
-+/*
-+ * WMI_REPORT_ROAM_TBL_EVENTID
-+ */
-+#define MAX_ROAM_TBL_CAND   5
-+
-+typedef PREPACK struct {
-+    A_INT32 roam_util;
-+    A_UINT8 bssid[ATH_MAC_LEN];
-+    A_INT8  rssi;
-+    A_INT8  rssidt;
-+    A_INT8  last_rssi;
-+    A_INT8  util;
-+    A_INT8  bias;
-+    A_UINT8 reserved; /* For alignment */
-+} POSTPACK WMI_BSS_ROAM_INFO;
-+
-+
-+typedef PREPACK struct {
-+    A_UINT16  roamMode;
-+    A_UINT16  numEntries;
-+    WMI_BSS_ROAM_INFO bssRoamInfo[1];
-+} POSTPACK WMI_TARGET_ROAM_TBL;
-+
-+/*
-+ *  WMI_CAC_EVENTID
-+ */
-+typedef enum {
-+    CAC_INDICATION_ADMISSION = 0x00,
-+    CAC_INDICATION_ADMISSION_RESP = 0x01,
-+    CAC_INDICATION_DELETE = 0x02,
-+    CAC_INDICATION_NO_RESP = 0x03,
-+}CAC_INDICATION;
-+
-+#define WMM_TSPEC_IE_LEN   63
-+
-+typedef PREPACK struct {
-+    A_UINT8 ac;
-+    A_UINT8 cac_indication;
-+    A_UINT8 statusCode;
-+    A_UINT8 tspecSuggestion[WMM_TSPEC_IE_LEN];
-+}POSTPACK  WMI_CAC_EVENT;
-+
-+/*
-+ * WMI_APLIST_EVENTID
-+ */
-+
-+typedef enum {
-+    APLIST_VER1 = 1,
-+} APLIST_VER;
-+
-+typedef PREPACK struct {
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+    A_UINT16    channel;
-+} POSTPACK  WMI_AP_INFO_V1;
-+
-+typedef PREPACK union {
-+    WMI_AP_INFO_V1  apInfoV1;
-+} POSTPACK WMI_AP_INFO;
-+
-+typedef PREPACK struct {
-+    A_UINT8     apListVer;
-+    A_UINT8     numAP;
-+    WMI_AP_INFO apList[1];
-+} POSTPACK WMI_APLIST_EVENT;
-+
-+/*
-+ * developer commands
-+ */
-+
-+/*
-+ * WMI_SET_BITRATE_CMDID
-+ *
-+ * Get bit rate cmd uses same definition as set bit rate cmd
-+ */
-+typedef enum {
-+    RATE_AUTO   = -1,
-+    RATE_1Mb    = 0,
-+    RATE_2Mb    = 1,
-+    RATE_5_5Mb  = 2,
-+    RATE_11Mb   = 3,
-+    RATE_6Mb    = 4,
-+    RATE_9Mb    = 5,
-+    RATE_12Mb   = 6,
-+    RATE_18Mb   = 7,
-+    RATE_24Mb   = 8,
-+    RATE_36Mb   = 9,
-+    RATE_48Mb   = 10,
-+    RATE_54Mb   = 11,
-+} WMI_BIT_RATE;
-+
-+typedef PREPACK struct {
-+    A_INT8      rateIndex;          /* see WMI_BIT_RATE */
-+} POSTPACK WMI_BIT_RATE_CMD, WMI_BIT_RATE_REPLY;
-+
-+/*
-+ * WMI_SET_FIXRATES_CMDID
-+ *
-+ * Get fix rates cmd uses same definition as set fix rates cmd
-+ */
-+typedef enum {
-+    FIX_RATE_1Mb    = 0x1,
-+    FIX_RATE_2Mb    = 0x2,
-+    FIX_RATE_5_5Mb  = 0x4,
-+    FIX_RATE_11Mb   = 0x8,
-+    FIX_RATE_6Mb    = 0x10,
-+    FIX_RATE_9Mb    = 0x20,
-+    FIX_RATE_12Mb   = 0x40,
-+    FIX_RATE_18Mb   = 0x80,
-+    FIX_RATE_24Mb   = 0x100,
-+    FIX_RATE_36Mb   = 0x200,
-+    FIX_RATE_48Mb   = 0x400,
-+    FIX_RATE_54Mb   = 0x800,
-+} WMI_FIX_RATES_MASK;
-+
-+typedef PREPACK struct {
-+    A_UINT16      fixRateMask;          /* see WMI_BIT_RATE */
-+} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
-+
-+/*
-+ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
-+ *
-+ * Set authentication mode
-+ */
-+typedef enum {
-+    RECONN_DO_AUTH = 0x00,
-+    RECONN_NOT_AUTH = 0x01
-+} WMI_AUTH_MODE;
-+
-+typedef PREPACK struct {
-+    A_UINT8 mode;
-+} POSTPACK WMI_SET_AUTH_MODE_CMD;
-+
-+/*
-+ * WMI_SET_REASSOC_MODE_CMDID
-+ *
-+ * Set authentication mode
-+ */
-+typedef enum {
-+    REASSOC_DO_DISASSOC = 0x00,
-+    REASSOC_DONOT_DISASSOC = 0x01
-+} WMI_REASSOC_MODE;
-+
-+typedef PREPACK struct {
-+    A_UINT8 mode;
-+}POSTPACK WMI_SET_REASSOC_MODE_CMD;
-+
-+typedef enum {
-+    ROAM_DATA_TIME = 1,            /* Get The Roam Time Data */
-+} ROAM_DATA_TYPE;
-+
-+typedef PREPACK struct {
-+    A_UINT32        disassoc_time;
-+    A_UINT32        no_txrx_time;
-+    A_UINT32        assoc_time;
-+    A_UINT32        allow_txrx_time;
-+    A_UINT32        last_data_txrx_time;
-+    A_UINT32        first_data_txrx_time;
-+    A_UINT8         disassoc_bssid[ATH_MAC_LEN];
-+    A_INT8          disassoc_bss_rssi;
-+    A_UINT8         assoc_bssid[ATH_MAC_LEN];
-+    A_INT8          assoc_bss_rssi;
-+} POSTPACK WMI_TARGET_ROAM_TIME;
-+
-+typedef PREPACK struct {
-+    PREPACK union {
-+        WMI_TARGET_ROAM_TIME roamTime;
-+    } POSTPACK u;
-+    A_UINT8 roamDataType ;
-+} POSTPACK WMI_TARGET_ROAM_DATA;
-+
-+typedef enum {
-+    WMI_WMM_DISABLED = 0,
-+    WMI_WMM_ENABLED
-+} WMI_WMM_STATUS;
-+
-+typedef PREPACK struct {
-+    A_UINT8    status;
-+}POSTPACK WMI_SET_WMM_CMD;
-+
-+typedef enum {
-+    WMI_TXOP_DISABLED = 0,
-+    WMI_TXOP_ENABLED
-+} WMI_TXOP_CFG;
-+
-+typedef PREPACK struct {
-+    A_UINT8    txopEnable;
-+}POSTPACK WMI_SET_WMM_TXOP_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8 keepaliveInterval;
-+} POSTPACK WMI_SET_KEEPALIVE_CMD;
-+
-+typedef PREPACK struct {
-+    A_BOOL configured;
-+    A_UINT8 keepaliveInterval;
-+} POSTPACK WMI_GET_KEEPALIVE_CMD;
-+
-+/*
-+ * Add Application specified IE to a management frame
-+ */
-+#define WMI_MAX_IE_LEN  78
-+
-+typedef PREPACK struct {
-+    A_UINT8 mgmtFrmType;  /* one of WMI_MGMT_FRAME_TYPE */
-+    A_UINT8 ieLen;    /* Length  of the IE that should be added to the MGMT frame */
-+    A_UINT8 ieInfo[1];
-+} POSTPACK WMI_SET_APPIE_CMD;
-+
-+/*
-+ * Notify the WSC registration status to the target
-+ */
-+#define WSC_REG_ACTIVE     1
-+#define WSC_REG_INACTIVE   0
-+/* Generic Hal Interface for setting hal paramters. */
-+/* Add new Set HAL Param cmdIds here for newer params */
-+typedef enum {
-+   WHAL_SETCABTO_CMDID = 1,
-+}WHAL_CMDID;
-+
-+typedef PREPACK struct {
-+    A_UINT8 cabTimeOut;
-+} POSTPACK WHAL_SETCABTO_PARAM;
-+
-+typedef PREPACK struct {
-+    A_UINT8  whalCmdId;
-+    A_UINT8 data[1];
-+} POSTPACK WHAL_PARAMCMD;
-+
-+
-+#define WOW_MAX_FILTER_LISTS 1 /*4*/
-+#define WOW_MAX_FILTERS_PER_LIST 4
-+#define WOW_PATTERN_SIZE 64
-+#define WOW_MASK_SIZE 64
-+
-+typedef PREPACK struct {
-+    A_UINT8 wow_valid_filter;
-+    A_UINT8 wow_filter_id;
-+    A_UINT8 wow_filter_size;
-+    A_UINT8 wow_filter_offset;
-+    A_UINT8 wow_filter_mask[WOW_MASK_SIZE];
-+    A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE];
-+} POSTPACK WOW_FILTER;
-+
-+
-+typedef PREPACK struct {
-+    A_UINT8 wow_valid_list;
-+    A_UINT8 wow_list_id;
-+    A_UINT8 wow_num_filters;
-+    A_UINT8 wow_total_list_size;
-+    WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
-+} POSTPACK WOW_FILTER_LIST;
-+
-+typedef PREPACK struct {
-+    A_BOOL awake;
-+    A_BOOL asleep;
-+} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
-+
-+typedef PREPACK struct {
-+    A_BOOL enable_wow;
-+} POSTPACK WMI_SET_WOW_MODE_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8 filter_list_id;
-+} POSTPACK WMI_GET_WOW_LIST_CMD;
-+
-+/*
-+ * WMI_GET_WOW_LIST_CMD reply
-+ */
-+typedef PREPACK struct {
-+    A_UINT8     num_filters;     /* number of patterns in reply */
-+    A_UINT8     this_filter_num; /*  this is filter # x of total num_filters */
-+    A_UINT8     wow_mode;
-+    A_UINT8     host_mode;
-+    WOW_FILTER  wow_filters[1];
-+} POSTPACK WMI_GET_WOW_LIST_REPLY;
-+
-+typedef PREPACK struct {
-+    A_UINT8 filter_list_id;
-+    A_UINT8 filter_size;
-+    A_UINT8 filter_offset;
-+    A_UINT8 filter[1];
-+} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT16 filter_list_id;
-+    A_UINT16 filter_id;
-+} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8 macaddr[ATH_MAC_LEN];
-+} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
-+
-+/*
-+ * WMI_SET_AKMP_PARAMS_CMD
-+ */
-+
-+#define WMI_AKMP_MULTI_PMKID_EN   0x000001
-+
-+typedef PREPACK struct {
-+    A_UINT32    akmpInfo;
-+} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT8 pmkid[WMI_PMKID_LEN];
-+} POSTPACK WMI_PMKID;
-+
-+/*
-+ * WMI_SET_PMKID_LIST_CMD
-+ */
-+#define WMI_MAX_PMKID_CACHE   8
-+
-+typedef PREPACK struct {
-+    A_UINT32    numPMKID;
-+    WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
-+} POSTPACK WMI_SET_PMKID_LIST_CMD;
-+
-+/*
-+ * WMI_GET_PMKID_LIST_CMD  Reply
-+ * Following the Number of PMKIDs is the list of PMKIDs
-+ */
-+typedef PREPACK struct {
-+    A_UINT32    numPMKID;
-+    WMI_PMKID   pmkidList[1];
-+} POSTPACK WMI_PMKID_LIST_REPLY;
-+
-+/* index used for priority streams */
-+typedef enum {
-+    WMI_NOT_MAPPED  = -1,
-+    WMI_CONTROL_PRI = 0,
-+    WMI_BEST_EFFORT_PRI = 1,
-+    WMI_LOW_PRI = 2,
-+    WMI_HIGH_PRI = 3,
-+    WMI_HIGHEST_PRI,
-+    WMI_PRI_MAX_COUNT
-+} WMI_PRI_STREAM_ID;
-+
-+#ifndef ATH_TARGET
-+#include "athendpack.h"
-+#endif
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _WMI_H_ */
-diff --git a/drivers/ar6000/include/wmi_api.h b/drivers/ar6000/include/wmi_api.h
-new file mode 100644
-index 0000000..267edfd
---- /dev/null
-+++ b/drivers/ar6000/include/wmi_api.h
-@@ -0,0 +1,260 @@
-+#ifndef _WMI_API_H_
-+#define _WMI_API_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains the definitions for the Wireless Module Interface (WMI).
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wmi_api.h#2 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/*
-+ * IP QoS Field definitions according to 802.1p
-+ */
-+#define BEST_EFFORT_PRI         0
-+#define BACKGROUND_PRI          1
-+#define EXCELLENT_EFFORT_PRI    3
-+#define CONTROLLED_LOAD_PRI     4
-+#define VIDEO_PRI               5
-+#define VOICE_PRI               6
-+#define NETWORK_CONTROL_PRI     7
-+#define MAX_NUM_PRI             8
-+
-+#define UNDEFINED_PRI           (0xff)
-+
-+/* simple mapping of IP TOS field to a WMI priority stream
-+ * this mapping was taken from the original linux driver implementation
-+ * The operation maps the following
-+ *
-+ *  */
-+#define IP_TOS_TO_WMI_PRI(tos)  \
-+    ((WMI_PRI_STREAM_ID)(((tos) >> 1) & 0x03))
-+
-+#define WMI_IMPLICIT_PSTREAM_INACTIVITY_INT 5000 /* 5 seconds */
-+
-+
-+struct wmi_t;
-+
-+void *wmi_init(void *devt);
-+
-+void wmi_qos_state_init(struct wmi_t *wmip);
-+void wmi_shutdown(struct wmi_t *wmip);
-+A_UINT16  wmi_get_mapped_qos_queue(struct wmi_t *, A_UINT8);
-+A_STATUS wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType);
-+A_STATUS wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_syncpoint(struct wmi_t *wmip);
-+A_STATUS wmi_syncpoint_reset(struct wmi_t *wmip);
-+WMI_PRI_STREAM_ID wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass);
-+A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up);
-+
-+A_STATUS wmi_control_rx(struct wmi_t *wmip, void *osbuf);
-+void wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg);
-+void wmi_free_allnodes(struct wmi_t *wmip);
-+bss_t *wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr);
-+
-+
-+typedef enum {
-+    NO_SYNC_WMIFLAG = 0,
-+    SYNC_BEFORE_WMIFLAG,            /* transmit all queued data before cmd */
-+    SYNC_AFTER_WMIFLAG,             /* any new data waits until cmd execs */
-+    SYNC_BOTH_WMIFLAG,
-+    END_WMIFLAG                     /* end marker */
-+} WMI_SYNC_FLAG;
-+
-+A_STATUS wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+                      WMI_SYNC_FLAG flag);
-+A_STATUS wmi_connect_cmd(struct wmi_t *wmip,
-+                         NETWORK_TYPE netType,
-+                         DOT11_AUTH_MODE dot11AuthMode,
-+                         AUTH_MODE authMode,
-+                         CRYPTO_TYPE pairwiseCrypto,
-+                         A_UINT8 pairwiseCryptoLen,
-+                         CRYPTO_TYPE groupCrypto,
-+                         A_UINT8 groupCryptoLen,
-+                         int ssidLength,
-+                         A_UCHAR *ssid,
-+                         A_UINT8 *bssid,
-+                         A_UINT16 channel,
-+                         A_UINT32 ctrl_flags);
-+A_STATUS wmi_reconnect_cmd(struct wmi_t *wmip,
-+                           A_UINT8 *bssid,
-+                           A_UINT16 channel);
-+A_STATUS wmi_disconnect_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_getrev_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
-+                           A_BOOL forceFgScan, A_BOOL isLegacy,
-+                           A_UINT32 homeDwellTime, A_UINT32 forceScanInterval);
-+A_STATUS wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
-+                            A_UINT16 fg_end_sec, A_UINT16 bg_sec,
-+                            A_UINT16 minact_chdw_msec,
-+                            A_UINT16 maxact_chdw_msec, A_UINT16 pas_chdw_msec,
-+                            A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
-+                            A_UINT32 max_dfsch_act_time);
-+A_STATUS wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask);
-+A_STATUS wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
-+                            A_UINT8 ssidLength, A_UCHAR *ssid);
-+A_STATUS wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons);
-+A_STATUS wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmisstime, A_UINT16 bmissbeacons);
-+A_STATUS wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
-+                           A_UINT8 ieLen, A_UINT8 *ieInfo);
-+A_STATUS wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode);
-+A_STATUS wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
-+                            A_UINT16 atim_windows, A_UINT16 timeout_value);
-+A_STATUS wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
-+                           A_UINT16 psPollNum, A_UINT16 dtimPolicy);
-+A_STATUS wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout);
-+A_STATUS wmi_sync_cmd(struct wmi_t *wmip, A_UINT8 syncNumber);
-+A_STATUS wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *pstream);
-+A_STATUS wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 streamID);
-+A_STATUS wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate);
-+A_STATUS wmi_get_bitrate_cmd(struct wmi_t *wmip);
-+A_INT8   wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate);
-+A_STATUS wmi_get_regDomain_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_get_channelList_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
-+                                   WMI_PHY_MODE mode, A_INT8 numChan,
-+                                   A_UINT16 *channelList);
-+
-+A_STATUS wmi_set_snr_threshold_params(struct wmi_t *wmip,
-+                                       WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
-+A_STATUS wmi_set_rssi_threshold_params(struct wmi_t *wmip,
-+                                        WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
-+A_STATUS wmi_clr_rssi_snr(struct wmi_t *wmip);
-+A_STATUS wmi_set_lq_threshold_params(struct wmi_t *wmip,
-+                                      WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd);
-+A_STATUS wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold);
-+A_STATUS wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status);
-+
-+A_STATUS wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 bitmask);
-+
-+A_STATUS wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie,
-+                                    A_UINT32 source);
-+A_STATUS wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
-+                                     A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
-+                                     A_UINT32 valid);
-+A_STATUS wmi_get_stats_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex,
-+                        CRYPTO_TYPE keyType, A_UINT8 keyUsage,
-+                        A_UINT8 keyLength,A_UINT8 *keyRSC,
-+                        A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
-+                        WMI_SYNC_FLAG sync_flag);
-+A_STATUS wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk);
-+A_STATUS wmi_delete_krk_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex);
-+A_STATUS wmi_set_akmp_params_cmd(struct wmi_t *wmip,
-+                                 WMI_SET_AKMP_PARAMS_CMD *akmpParams);
-+A_STATUS wmi_get_pmkid_list_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
-+                                WMI_SET_PMKID_LIST_CMD *pmkInfo);
-+A_STATUS wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM);
-+A_STATUS wmi_get_txPwr_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on);
-+A_STATUS wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid);
-+A_STATUS wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex);
-+A_STATUS wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en);
-+A_STATUS wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
-+                          A_BOOL set);
-+A_STATUS wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop,
-+                                   A_UINT8 eCWmin, A_UINT8 eCWmax,
-+                                   A_UINT8 aifsn);
-+A_STATUS wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
-+                                  A_UINT8 trafficClass, A_UINT8 maxRetries,
-+                                  A_UINT8 enableNotify);
-+
-+void wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid);
-+
-+A_STATUS wmi_get_roam_tbl_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType);
-+A_STATUS wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
-+                               A_UINT8 size);
-+A_STATUS wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
-+                            WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
-+                            A_UINT8 size);
-+
-+A_STATUS wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode);
-+A_STATUS wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
-+                              A_UINT8 frmType,
-+                              A_UINT8 *dstMacAddr,
-+                              A_UINT8 *bssid,
-+                              A_UINT16 optIEDataLen,
-+                              A_UINT8 *optIEData);
-+
-+A_STATUS wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl);
-+A_STATUS wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize);
-+A_STATUS wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSpLen);
-+A_UINT8  convert_userPriority_to_trafficClass(A_UINT8 userPriority);
-+A_UINT8 wmi_get_power_mode_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance);
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+A_STATUS wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32  len);
-+#endif
-+
-+A_STATUS wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status);
-+A_STATUS wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd);
-+
-+
-+/*
-+ *  This function is used to configure the fix rates mask to the target.
-+ */
-+A_STATUS wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask);
-+A_STATUS wmi_get_ratemask_cmd(struct wmi_t *wmip);
-+
-+A_STATUS wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
-+
-+A_STATUS wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
-+
-+A_STATUS wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status);
-+A_STATUS wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG txEnable);
-+
-+A_STATUS wmi_get_keepalive_configured(struct wmi_t *wmip);
-+A_UINT8 wmi_get_keepalive_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval);
-+
-+A_STATUS wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType,
-+                           A_UINT8 ieLen,A_UINT8 *ieInfo);
-+
-+A_STATUS wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen);
-+A_INT32 wmi_get_rate(A_INT8 rateindex);
-+
-+/*Wake on Wireless WMI commands*/
-+A_STATUS wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip, WMI_SET_HOST_SLEEP_MODE_CMD *cmd);
-+A_STATUS wmi_set_wow_mode_cmd(struct wmi_t *wmip, WMI_SET_WOW_MODE_CMD *cmd);
-+A_STATUS wmi_get_wow_list_cmd(struct wmi_t *wmip, WMI_GET_WOW_LIST_CMD *cmd);
-+A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
-+                                 WMI_ADD_WOW_PATTERN_CMD *cmd, A_UINT8* pattern, A_UINT8* mask, A_UINT8 pattern_size);
-+A_STATUS wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
-+                                 WMI_DEL_WOW_PATTERN_CMD *cmd);
-+A_STATUS wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status);
-+
-+bss_t *
-+wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
-+				   A_UINT32 ssidLength, A_BOOL bIsWPA2);
-+
-+void
-+wmi_node_return (struct wmi_t *wmip, bss_t *bss);
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _WMI_API_H_ */
-diff --git a/drivers/ar6000/include/wmix.h b/drivers/ar6000/include/wmix.h
-new file mode 100644
-index 0000000..8f12b5e
---- /dev/null
-+++ b/drivers/ar6000/include/wmix.h
-@@ -0,0 +1,233 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains extensions of the WMI protocol specified in the
-+ * Wireless Module Interface (WMI).  It includes definitions of all
-+ * extended commands and events.  Extensions include useful commands
-+ * that are not directly related to wireless activities.  They may
-+ * be hardware-specific, and they might not be supported on all
-+ * implementations.
-+ *
-+ * Extended WMIX commands are encapsulated in a WMI message with
-+ * cmd=WMI_EXTENSION_CMD.
-+ *
-+ */
-+
-+#ifndef _WMIX_H_
-+#define _WMIX_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
-+
-+#include "dbglog.h"
-+
-+/*
-+ * Extended WMI commands are those that are needed during wireless
-+ * operation, but which are not really wireless commands.  This allows,
-+ * for instance, platform-specific commands.  Extended WMI commands are
-+ * embedded in a WMI command message with WMI_COMMAND_ID=WMI_EXTENSION_CMDID.
-+ * Extended WMI events are similarly embedded in a WMI event message with
-+ * WMI_EVENT_ID=WMI_EXTENSION_EVENTID.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32    commandId;
-+} POSTPACK WMIX_CMD_HDR;
-+
-+typedef enum {
-+    WMIX_DSETOPEN_REPLY_CMDID           = 0x2001,
-+    WMIX_DSETDATA_REPLY_CMDID,
-+    WMIX_GPIO_OUTPUT_SET_CMDID,
-+    WMIX_GPIO_INPUT_GET_CMDID,
-+    WMIX_GPIO_REGISTER_SET_CMDID,
-+    WMIX_GPIO_REGISTER_GET_CMDID,
-+    WMIX_GPIO_INTR_ACK_CMDID,
-+    WMIX_HB_CHALLENGE_RESP_CMDID,
-+    WMIX_DBGLOG_CFG_MODULE_CMDID,
-+} WMIX_COMMAND_ID;
-+
-+typedef enum {
-+    WMIX_DSETOPENREQ_EVENTID            = 0x3001,
-+    WMIX_DSETCLOSE_EVENTID,
-+    WMIX_DSETDATAREQ_EVENTID,
-+    WMIX_GPIO_INTR_EVENTID,
-+    WMIX_GPIO_DATA_EVENTID,
-+    WMIX_GPIO_ACK_EVENTID,
-+    WMIX_HB_CHALLENGE_RESP_EVENTID,
-+    WMIX_DBGLOG_EVENTID,
-+} WMIX_EVENT_ID;
-+
-+/*
-+ * =============DataSet support=================
-+ */
-+
-+/*
-+ * WMIX_DSETOPENREQ_EVENTID
-+ * DataSet Open Request Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT32 dset_id;
-+    A_UINT32 targ_dset_handle;  /* echo'ed, not used by Host, */
-+    A_UINT32 targ_reply_fn;     /* echo'ed, not used by Host, */
-+    A_UINT32 targ_reply_arg;    /* echo'ed, not used by Host, */
-+} POSTPACK WMIX_DSETOPENREQ_EVENT;
-+
-+/*
-+ * WMIX_DSETCLOSE_EVENTID
-+ * DataSet Close Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT32 access_cookie;
-+} POSTPACK WMIX_DSETCLOSE_EVENT;
-+
-+/*
-+ * WMIX_DSETDATAREQ_EVENTID
-+ * DataSet Data Request Event
-+ */
-+typedef PREPACK struct {
-+    A_UINT32 access_cookie;
-+    A_UINT32 offset;
-+    A_UINT32 length;
-+    A_UINT32 targ_buf;         /* echo'ed, not used by Host, */
-+    A_UINT32 targ_reply_fn;    /* echo'ed, not used by Host, */
-+    A_UINT32 targ_reply_arg;   /* echo'ed, not used by Host, */
-+} POSTPACK WMIX_DSETDATAREQ_EVENT;
-+
-+typedef PREPACK struct {
-+    A_UINT32              status;
-+    A_UINT32              targ_dset_handle;
-+    A_UINT32              targ_reply_fn;
-+    A_UINT32              targ_reply_arg;
-+    A_UINT32              access_cookie;
-+    A_UINT32              size;
-+    A_UINT32              version;
-+} POSTPACK WMIX_DSETOPEN_REPLY_CMD;
-+
-+typedef PREPACK struct {
-+    A_UINT32              status;
-+    A_UINT32              targ_buf;
-+    A_UINT32              targ_reply_fn;
-+    A_UINT32              targ_reply_arg;
-+    A_UINT32              length;
-+    A_UINT8               buf[1];
-+} POSTPACK WMIX_DSETDATA_REPLY_CMD;
-+
-+
-+/*
-+ * =============GPIO support=================
-+ * All masks are 18-bit masks with bit N operating on GPIO pin N.
-+ */
-+
-+#include "gpio.h"
-+
-+/*
-+ * Set GPIO pin output state.
-+ * In order for output to be driven, a pin must be enabled for output.
-+ * This can be done during initialization through the GPIO Configuration
-+ * DataSet, or during operation with the enable_mask.
-+ *
-+ * If a request is made to simultaneously set/clear or set/disable or
-+ * clear/disable or disable/enable, results are undefined.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              set_mask;             /* pins to set */
-+    A_UINT32              clear_mask;           /* pins to clear */
-+    A_UINT32              enable_mask;          /* pins to enable for output */
-+    A_UINT32              disable_mask;         /* pins to disable/tristate */
-+} POSTPACK WMIX_GPIO_OUTPUT_SET_CMD;
-+
-+/*
-+ * Set a GPIO register.  For debug/exceptional cases.
-+ * Values for gpioreg_id are GPIO_REGISTER_IDs, defined in a
-+ * platform-dependent header.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              gpioreg_id;           /* GPIO register ID */
-+    A_UINT32              value;                /* value to write */
-+} POSTPACK WMIX_GPIO_REGISTER_SET_CMD;
-+
-+/* Get a GPIO register.  For debug/exceptional cases. */
-+typedef PREPACK struct {
-+    A_UINT32              gpioreg_id;           /* GPIO register to read */
-+} POSTPACK WMIX_GPIO_REGISTER_GET_CMD;
-+
-+/*
-+ * Host acknowledges and re-arms GPIO interrupts.  A single
-+ * message should be used to acknowledge all interrupts that
-+ * were delivered in an earlier WMIX_GPIO_INTR_EVENT message.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              ack_mask;             /* interrupts to acknowledge */
-+} POSTPACK WMIX_GPIO_INTR_ACK_CMD;
-+
-+/*
-+ * Target informs Host of GPIO interrupts that have ocurred since the
-+ * last WMIX_GIPO_INTR_ACK_CMD was received.  Additional information --
-+ * the current GPIO input values is provided -- in order to support
-+ * use of a GPIO interrupt as a Data Valid signal for other GPIO pins.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              intr_mask;            /* pending GPIO interrupts */
-+    A_UINT32              input_values;         /* recent GPIO input values */
-+} POSTPACK WMIX_GPIO_INTR_EVENT;
-+
-+/*
-+ * Target responds to Host's earlier WMIX_GPIO_INPUT_GET_CMDID request
-+ * using a GPIO_DATA_EVENT with
-+ *   value set to the mask of GPIO pin inputs and
-+ *   reg_id set to GPIO_ID_NONE
-+ *
-+ *
-+ * Target responds to Hosts's earlier WMIX_GPIO_REGISTER_GET_CMDID request
-+ * using a GPIO_DATA_EVENT with
-+ *   value set to the value of the requested register and
-+ *   reg_id identifying the register (reflects the original request)
-+ * NB: reg_id supports the future possibility of unsolicited
-+ * WMIX_GPIO_DATA_EVENTs (for polling GPIO input), and it may
-+ * simplify Host GPIO support.
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              value;
-+    A_UINT32              reg_id;
-+} POSTPACK WMIX_GPIO_DATA_EVENT;
-+
-+/*
-+ * =============Error Detection support=================
-+ */
-+
-+/*
-+ * WMIX_HB_CHALLENGE_RESP_CMDID
-+ * Heartbeat Challenge Response command
-+ */
-+typedef PREPACK struct {
-+    A_UINT32              cookie;
-+    A_UINT32              source;
-+} POSTPACK WMIX_HB_CHALLENGE_RESP_CMD;
-+
-+/*
-+ * WMIX_HB_CHALLENGE_RESP_EVENTID
-+ * Heartbeat Challenge Response Event
-+ */
-+#define WMIX_HB_CHALLENGE_RESP_EVENT WMIX_HB_CHALLENGE_RESP_CMD
-+
-+typedef PREPACK struct {
-+    struct dbglog_config_s config;
-+} POSTPACK WMIX_DBGLOG_CFG_MODULE_CMD;
-+
-+#ifndef ATH_TARGET
-+#include "athendpack.h"
-+#endif
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _WMIX_H_ */
-diff --git a/drivers/ar6000/miscdrv/common_drv.c b/drivers/ar6000/miscdrv/common_drv.c
-new file mode 100644
-index 0000000..4f12734
---- /dev/null
-+++ b/drivers/ar6000/miscdrv/common_drv.c
-@@ -0,0 +1,467 @@
-+
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "targaddrs.h"
-+#include "a_osapi.h"
-+#include "hif.h"
-+#include "htc_api.h"
-+#include "bmi.h"
-+#include "bmi_msg.h"
-+#include "common_drv.h"
-+#include "a_debug.h"
-+#include "targaddrs.h"
-+
-+#define HOST_INTEREST_ITEM_ADDRESS(target, item)    \
-+(((TargetType) == TARGET_TYPE_AR6001) ?     \
-+   AR6001_HOST_INTEREST_ITEM_ADDRESS(item) :    \
-+   AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
-+
-+
-+/* Compile the 4BYTE version of the window register setup routine,
-+ * This mitigates host interconnect issues with non-4byte aligned bus requests, some
-+ * interconnects use bus adapters that impose strict limitations.
-+ * Since diag window access is not intended for performance critical operations, the 4byte mode should
-+ * be satisfactory even though it generates 4X the bus activity. */
-+
-+#ifdef USE_4BYTE_REGISTER_ACCESS
-+
-+    /* set the window address register (using 4-byte register access ). */
-+A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
-+{
-+    A_STATUS status;
-+    A_UINT8 addrValue[4];
-+    int i;
-+
-+        /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
-+         * last to initiate the access cycle */
-+
-+    for (i = 1; i <= 3; i++) {
-+            /* fill the buffer with the address byte value we want to hit 4 times*/
-+        addrValue[0] = ((A_UINT8 *)&Address)[i];
-+        addrValue[1] = addrValue[0];
-+        addrValue[2] = addrValue[0];
-+        addrValue[3] = addrValue[0];
-+
-+            /* hit each byte of the register address with a 4-byte write operation to the same address,
-+             * this is a harmless operation */
-+        status = HIFReadWrite(hifDevice,
-+                              RegisterAddr+i,
-+                              addrValue,
-+                              4,
-+                              HIF_WR_SYNC_BYTE_FIX,
-+                              NULL);
-+        if (status != A_OK) {
-+            break;
-+        }
-+    }
-+
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
-+             RegisterAddr, Address));
-+        return status;
-+    }
-+
-+        /* write the address register again, this time write the whole 4-byte value.
-+         * The effect here is that the LSB write causes the cycle to start, the extra
-+         * 3 byte write to bytes 1,2,3 has no effect since we are writing the same values again */
-+    status = HIFReadWrite(hifDevice,
-+                          RegisterAddr,
-+                          (A_UCHAR *)(&Address),
-+                          4,
-+                          HIF_WR_SYNC_BYTE_INC,
-+                          NULL);
-+
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
-+            RegisterAddr, Address));
-+        return status;
-+    }
-+
-+    return A_OK;
-+
-+
-+
-+}
-+
-+
-+#else
-+
-+    /* set the window address register */
-+A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
-+{
-+    A_STATUS status;
-+
-+        /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
-+         * last to initiate the access cycle */
-+    status = HIFReadWrite(hifDevice,
-+                          RegisterAddr+1,  /* write upper 3 bytes */
-+                          ((A_UCHAR *)(&Address))+1,
-+                          sizeof(A_UINT32)-1,
-+                          HIF_WR_SYNC_BYTE_INC,
-+                          NULL);
-+
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
-+             RegisterAddr, Address));
-+        return status;
-+    }
-+
-+        /* write the LSB of the register, this initiates the operation */
-+    status = HIFReadWrite(hifDevice,
-+                          RegisterAddr,
-+                          (A_UCHAR *)(&Address),
-+                          sizeof(A_UINT8),
-+                          HIF_WR_SYNC_BYTE_INC,
-+                          NULL);
-+
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
-+            RegisterAddr, Address));
-+        return status;
-+    }
-+
-+    return A_OK;
-+}
-+
-+#endif
-+
-+/*
-+ * Read from the AR6000 through its diagnostic window.
-+ * No cooperation from the Target is required for this.
-+ */
-+A_STATUS
-+ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
-+{
-+    A_STATUS status;
-+
-+        /* set window register to start read cycle */
-+    status = ar6000_SetAddressWindowRegister(hifDevice,
-+                                             WINDOW_READ_ADDR_ADDRESS,
-+                                             *address);
-+
-+    if (status != A_OK) {
-+        return status;
-+    }
-+
-+        /* read the data */
-+    status = HIFReadWrite(hifDevice,
-+                          WINDOW_DATA_ADDRESS,
-+                          (A_UCHAR *)data,
-+                          sizeof(A_UINT32),
-+                          HIF_RD_SYNC_BYTE_INC,
-+                          NULL);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot read from WINDOW_DATA_ADDRESS\n"));
-+        return status;
-+    }
-+
-+    return status;
-+}
-+
-+
-+/*
-+ * Write to the AR6000 through its diagnostic window.
-+ * No cooperation from the Target is required for this.
-+ */
-+A_STATUS
-+ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
-+{
-+    A_STATUS status;
-+
-+        /* set write data */
-+    status = HIFReadWrite(hifDevice,
-+                          WINDOW_DATA_ADDRESS,
-+                          (A_UCHAR *)data,
-+                          sizeof(A_UINT32),
-+                          HIF_WR_SYNC_BYTE_INC,
-+                          NULL);
-+    if (status != A_OK) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to WINDOW_DATA_ADDRESS\n", *data));
-+        return status;
-+    }
-+
-+        /* set window register, which starts the write cycle */
-+    return ar6000_SetAddressWindowRegister(hifDevice,
-+                                           WINDOW_WRITE_ADDR_ADDRESS,
-+                                           *address);
-+}
-+
-+A_STATUS
-+ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+                    A_UCHAR *data, A_UINT32 length)
-+{
-+    A_UINT32 count;
-+    A_STATUS status = A_OK;
-+
-+    for (count = 0; count < length; count += 4, address += 4) {
-+        if ((status = ar6000_ReadRegDiag(hifDevice, &address,
-+                                         (A_UINT32 *)&data[count])) != A_OK)
-+        {
-+            break;
-+        }
-+    }
-+
-+    return status;
-+}
-+
-+A_STATUS
-+ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+                     A_UCHAR *data, A_UINT32 length)
-+{
-+    A_UINT32 count;
-+    A_STATUS status = A_OK;
-+
-+    for (count = 0; count < length; count += 4, address += 4) {
-+        if ((status = ar6000_WriteRegDiag(hifDevice, &address,
-+                                          (A_UINT32 *)&data[count])) != A_OK)
-+        {
-+            break;
-+        }
-+    }
-+
-+    return status;
-+}
-+
-+A_STATUS
-+ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice)
-+{
-+    int i;
-+    struct forceROM_s {
-+        A_UINT32 addr;
-+        A_UINT32 data;
-+    };
-+    struct forceROM_s *ForceROM;
-+    int szForceROM;
-+    A_UINT32 instruction;
-+
-+    static struct forceROM_s ForceROM_REV2[] = {
-+        /* NB: This works for old REV2 ROM (old). */
-+        {0x00001ff0, 0x175b0027}, /* jump instruction at 0xa0001ff0 */
-+        {0x00001ff4, 0x00000000}, /* nop instruction at 0xa0001ff4 */
-+
-+        {MC_REMAP_TARGET_ADDRESS, 0x00001ff0}, /* remap to 0xa0001ff0 */
-+        {MC_REMAP_COMPARE_ADDRESS, 0x01000040},/* ...from 0xbfc00040 */
-+        {MC_REMAP_SIZE_ADDRESS, 0x00000000},   /* ...1 cache line */
-+        {MC_REMAP_VALID_ADDRESS, 0x00000001},  /* ...remap is valid */
-+
-+        {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
-+
-+        {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
-+    };
-+
-+    static struct forceROM_s ForceROM_NEW[] = {
-+        /* NB: This works for AR6000 ROM REV3 and beyond.  */
-+        {LOCAL_SCRATCH_ADDRESS, AR6K_OPTION_IGNORE_FLASH},
-+        {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
-+        {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
-+    };
-+
-+    /*
-+     * Examine a semi-arbitrary instruction that's different
-+     * in REV2 and other revisions.
-+     * NB: If a Host port does not require simultaneous support
-+     * for multiple revisions of Target ROM, this code can be elided.
-+     */
-+    (void)ar6000_ReadDataDiag(hifDevice, 0x01000040,
-+                              (A_UCHAR *)&instruction, 4);
-+
-+    AR_DEBUG_PRINTF(ATH_LOG_ERR, ("instruction=0x%x\n", instruction));
-+
-+    if (instruction == 0x3c1aa200) {
-+        /* It's an old ROM */
-+        ForceROM = ForceROM_REV2;
-+        szForceROM = sizeof(ForceROM_REV2)/sizeof(*ForceROM);
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using OLD method\n"));
-+    } else {
-+        ForceROM = ForceROM_NEW;
-+        szForceROM = sizeof(ForceROM_NEW)/sizeof(*ForceROM);
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using NEW method\n"));
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Force Target to execute from ROM....\n"));
-+    for (i = 0; i < szForceROM; i++)
-+    {
-+        if (ar6000_WriteRegDiag(hifDevice,
-+                                &ForceROM[i].addr,
-+                                &ForceROM[i].data) != A_OK)
-+        {
-+            AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot force Target to execute ROM!\n"));
-+            return A_ERROR;
-+        }
-+    }
-+
-+    msleep(50); /* delay to allow dragon to come to BMI phase  */
-+    return A_OK;
-+}
-+
-+/* reset device */
-+A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
-+{
-+
-+#if !defined(DWSIM)
-+    A_STATUS status = A_OK;
-+    A_UINT32 address;
-+    A_UINT32 data;
-+
-+    do {
-+
-+        // address = RESET_CONTROL_ADDRESS;
-+        data = RESET_CONTROL_COLD_RST_MASK;
-+
-+          /* Hardcode the address of RESET_CONTROL_ADDRESS based on the target type */
-+        if (TargetType == TARGET_TYPE_AR6001) {
-+            address = 0x0C000000;
-+        } else {
-+            if (TargetType == TARGET_TYPE_AR6002) {
-+                address = 0x00004000;
-+            } else {
-+                A_ASSERT(0);
-+            }
-+        }
-+
-+        status = ar6000_WriteRegDiag(hifDevice, &address, &data);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        /*
-+         * Read back the RESET CAUSE register to ensure that the cold reset
-+         * went through.
-+         */
-+        msleep(2000); /* 2 second delay to allow things to settle down */
-+
-+
-+        // address = RESET_CAUSE_ADDRESS;
-+        /* Hardcode the address of RESET_CAUSE_ADDRESS based on the target type */
-+        if (TargetType == TARGET_TYPE_AR6001) {
-+            address = 0x0C0000CC;
-+        } else {
-+            if (TargetType == TARGET_TYPE_AR6002) {
-+                address = 0x000040C0;
-+            } else {
-+                A_ASSERT(0);
-+            }
-+        }
-+
-+        data = 0;
-+        status = ar6000_ReadRegDiag(hifDevice, &address, &data);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Reset Cause readback: 0x%X \n",data));
-+        data &= RESET_CAUSE_LAST_MASK;
-+        if (data != 2) {
-+            AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Unable to cold reset the target \n"));
-+        }
-+
-+    } while (FALSE);
-+
-+    if (A_FAILED(status)) {
-+        AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Failed to reset target \n"));
-+    }
-+#endif
-+    return A_OK;
-+}
-+
-+#define REG_DUMP_COUNT_AR6001   38  /* WORDs, derived from AR6001_regdump.h */
-+#define REG_DUMP_COUNT_AR6002   32  /* WORDs, derived from AR6002_regdump.h */
-+
-+
-+#if REG_DUMP_COUNT_AR6001 <= REG_DUMP_COUNT_AR6002
-+#define REGISTER_DUMP_LEN_MAX  REG_DUMP_COUNT_AR6002
-+#else
-+#define REGISTER_DUMP_LEN_MAX  REG_DUMP_COUNT_AR6001
-+#endif
-+
-+void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
-+{
-+    A_UINT32 address;
-+    A_UINT32 regDumpArea = 0;
-+    A_STATUS status;
-+    A_UINT32 regDumpValues[REGISTER_DUMP_LEN_MAX];
-+    A_UINT32 regDumpCount = 0;
-+    A_UINT32 i;
-+
-+    do {
-+
-+            /* the reg dump pointer is copied to the host interest area */
-+        address = HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_failure_state);
-+
-+        if (TargetType == TARGET_TYPE_AR6001) {
-+                /* for AR6001, this is a fixed location because the ptr is actually stuck in cache,
-+                 * this may be fixed in later firmware versions */
-+            address = 0x18a0;
-+            regDumpCount = REG_DUMP_COUNT_AR6001;
-+
-+        } else  if (TargetType == TARGET_TYPE_AR6002) {
-+
-+            regDumpCount = REG_DUMP_COUNT_AR6002;
-+
-+        } else {
-+            A_ASSERT(0);
-+        }
-+
-+            /* read RAM location through diagnostic window */
-+        status = ar6000_ReadRegDiag(hifDevice, &address, &regDumpArea);
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get ptr to register dump area \n"));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Location of register dump data: 0x%X \n",regDumpArea));
-+
-+        if (regDumpArea == 0) {
-+                /* no reg dump */
-+            break;
-+        }
-+
-+        if (TargetType == TARGET_TYPE_AR6001) {
-+            regDumpArea &= 0x0FFFFFFF;  /* convert to physical address in target memory */
-+        }
-+
-+            /* fetch register dump data */
-+        status = ar6000_ReadDataDiag(hifDevice,
-+                                     regDumpArea,
-+                                     (A_UCHAR *)&regDumpValues[0],
-+                                     regDumpCount * (sizeof(A_UINT32)));
-+
-+        if (A_FAILED(status)) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get register dump \n"));
-+            break;
-+        }
-+
-+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Register Dump: \n"));
-+
-+        for (i = 0; i < regDumpCount; i++) {
-+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" %d :  0x%8.8X \n",i, regDumpValues[i]));
-+        }
-+
-+    } while (FALSE);
-+
-+}
-+
-diff --git a/drivers/ar6000/miscdrv/credit_dist.c b/drivers/ar6000/miscdrv/credit_dist.c
-new file mode 100644
-index 0000000..8d37d62
---- /dev/null
-+++ b/drivers/ar6000/miscdrv/credit_dist.c
-@@ -0,0 +1,346 @@
-+
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "htc_api.h"
-+#include "common_drv.h"
-+
-+/********* CREDIT DISTRIBUTION FUNCTIONS ******************************************/
-+
-+#define NO_VO_SERVICE 1 /* currently WMI only uses 3 data streams, so we leave VO service inactive */
-+
-+#ifdef NO_VO_SERVICE
-+#define DATA_SVCS_USED 3
-+#else
-+#define DATA_SVCS_USED 4
-+#endif
-+
-+static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+                                HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
-+
-+static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+                        HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
-+
-+/* reduce an ep's credits back to a set limit */
-+static INLINE void ReduceCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+                                HTC_ENDPOINT_CREDIT_DIST  *pEpDist,
-+                                int                       Limit)
-+{
-+    int credits;
-+
-+        /* set the new limit */
-+    pEpDist->TxCreditsAssigned = Limit;
-+
-+    if (pEpDist->TxCredits <= Limit) {
-+        return;
-+    }
-+
-+        /* figure out how much to take away */
-+    credits = pEpDist->TxCredits - Limit;
-+        /* take them away */
-+    pEpDist->TxCredits -= credits;
-+    pCredInfo->CurrentFreeCredits += credits;
-+}
-+
-+/* give an endpoint some credits from the free credit pool */
-+#define GiveCredits(pCredInfo,pEpDist,credits)      \
-+{                                                   \
-+    (pEpDist)->TxCredits += (credits);              \
-+    (pEpDist)->TxCreditsAssigned += (credits);      \
-+    (pCredInfo)->CurrentFreeCredits -= (credits);   \
-+}
-+
-+
-+/* default credit init callback.
-+ * This function is called in the context of HTCStart() to setup initial (application-specific)
-+ * credit distributions */
-+static void ar6000_credit_init(void                     *Context,
-+                               HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+                               int                      TotalCredits)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+    int                      count;
-+    COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
-+
-+    pCredInfo->CurrentFreeCredits = TotalCredits;
-+    pCredInfo->TotalAvailableCredits = TotalCredits;
-+
-+    pCurEpDist = pEPList;
-+
-+        /* run through the list and initialize */
-+    while (pCurEpDist != NULL) {
-+
-+            /* set minimums for each endpoint */
-+        pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
-+
-+        if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
-+                /* give control service some credits */
-+            GiveCredits(pCredInfo,pCurEpDist,pCurEpDist->TxCreditsMin);
-+                /* control service is always marked active, it never goes inactive EVER */
-+            SET_EP_ACTIVE(pCurEpDist);
-+        } else if (pCurEpDist->ServiceID == WMI_DATA_BK_SVC) {
-+                /* this is the lowest priority data endpoint, save this off for easy access */
-+            pCredInfo->pLowestPriEpDist = pCurEpDist;
-+        }
-+
-+        /* Streams have to be created (explicit | implicit)for all kinds
-+         * of traffic. BE endpoints are also inactive in the beginning.
-+         * When BE traffic starts it creates implicit streams that
-+         * redistributes credits.
-+         */
-+
-+        /* note, all other endpoints have minimums set but are initially given NO credits.
-+         * Credits will be distributed as traffic activity demands */
-+        pCurEpDist = pCurEpDist->pNext;
-+    }
-+
-+    if (pCredInfo->CurrentFreeCredits <= 0) {
-+        AR_DEBUG_PRINTF(ATH_LOG_INF, ("Not enough credits (%d) to do credit distributions \n", TotalCredits));
-+        A_ASSERT(FALSE);
-+        return;
-+    }
-+
-+        /* reset list */
-+    pCurEpDist = pEPList;
-+        /* now run through the list and set max operating credit limits for everyone */
-+    while (pCurEpDist != NULL) {
-+        if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
-+                /* control service max is just 1 max message */
-+            pCurEpDist->TxCreditsNorm = pCurEpDist->TxCreditsPerMaxMsg;
-+        } else {
-+                /* for the remaining data endpoints, we assume that each TxCreditsPerMaxMsg are
-+                 * the same.
-+                 * We use a simple calculation here, we take the remaining credits and
-+                 * determine how many max messages this can cover and then set each endpoint's
-+                 * normal value equal to half this amount.
-+                 * */
-+            count = (pCredInfo->CurrentFreeCredits/pCurEpDist->TxCreditsPerMaxMsg) * pCurEpDist->TxCreditsPerMaxMsg;
-+            count = count >> 1;
-+            count = max(count,pCurEpDist->TxCreditsPerMaxMsg);
-+                /* set normal */
-+            pCurEpDist->TxCreditsNorm = count;
-+
-+        }
-+        pCurEpDist = pCurEpDist->pNext;
-+    }
-+
-+}
-+
-+
-+/* default credit distribution callback
-+ * This callback is invoked whenever endpoints require credit distributions.
-+ * A lock is held while this function is invoked, this function shall NOT block.
-+ * The pEPDistList is a list of distribution structures in prioritized order as
-+ * defined by the call to the HTCSetCreditDistribution() api.
-+ *
-+ */
-+static void ar6000_credit_distribute(void                     *Context,
-+                                     HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
-+                                     HTC_CREDIT_DIST_REASON   Reason)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+    COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
-+
-+    switch (Reason) {
-+        case HTC_CREDIT_DIST_SEND_COMPLETE :
-+            pCurEpDist = pEPDistList;
-+                /* we are given the start of the endpoint distribution list.
-+                 * There may be one or more endpoints to service.
-+                 * Run through the list and distribute credits */
-+            while (pCurEpDist != NULL) {
-+
-+                if (pCurEpDist->TxCreditsToDist > 0) {
-+                        /* return the credits back to the endpoint */
-+                    pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
-+                        /* always zero out when we are done */
-+                    pCurEpDist->TxCreditsToDist = 0;
-+
-+                    if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsAssigned) {
-+                            /* reduce to the assigned limit, previous credit reductions
-+                             * could have caused the limit to change */
-+                        ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsAssigned);
-+                    }
-+
-+                    if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsNorm) {
-+                            /* oversubscribed endpoints need to reduce back to normal */
-+                        ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsNorm);
-+                    }
-+                }
-+
-+                pCurEpDist = pCurEpDist->pNext;
-+            }
-+
-+            A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
-+
-+            break;
-+
-+        case HTC_CREDIT_DIST_ACTIVITY_CHANGE :
-+            RedistributeCredits(pCredInfo,pEPDistList);
-+            break;
-+        case HTC_CREDIT_DIST_SEEK_CREDITS :
-+            SeekCredits(pCredInfo,pEPDistList);
-+            break;
-+        case HTC_DUMP_CREDIT_STATE :
-+            AR_DEBUG_PRINTF(ATH_LOG_INF, ("Credit Distribution, total : %d, free : %d\n",
-+            								pCredInfo->TotalAvailableCredits, pCredInfo->CurrentFreeCredits));
-+            break;
-+        default:
-+            break;
-+
-+    }
-+
-+}
-+
-+/* redistribute credits based on activity change */
-+static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+                                HTC_ENDPOINT_CREDIT_DIST *pEPDistList)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist = pEPDistList;
-+
-+        /* walk through the list and remove credits from inactive endpoints */
-+    while (pCurEpDist != NULL) {
-+
-+        if (pCurEpDist->ServiceID != WMI_CONTROL_SVC) {
-+            if (!IS_EP_ACTIVE(pCurEpDist)) {
-+                    /* EP is inactive, reduce credits back to zero */
-+                ReduceCredits(pCredInfo, pCurEpDist, 0);
-+            }
-+        }
-+
-+        /* NOTE in the active case, we do not need to do anything further,
-+         * when an EP goes active and needs credits, HTC will call into
-+         * our distribution function using a reason code of HTC_CREDIT_DIST_SEEK_CREDITS  */
-+
-+        pCurEpDist = pCurEpDist->pNext;
-+    }
-+
-+    A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
-+
-+}
-+
-+/* HTC has an endpoint that needs credits, pEPDist is the endpoint in question */
-+static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+                        HTC_ENDPOINT_CREDIT_DIST *pEPDist)
-+{
-+    HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+    int                      credits = 0;
-+    int                      need;
-+
-+    do {
-+
-+        if (pEPDist->ServiceID == WMI_CONTROL_SVC) {
-+                /* we never oversubscribe on the control service, this is not
-+                 * a high performance path and the target never holds onto control
-+                 * credits for too long */
-+            break;
-+        }
-+
-+        /* for all other services, we follow a simple algorithm of
-+         * 1. checking the free pool for credits
-+         * 2. checking lower priority endpoints for credits to take */
-+
-+        if (pCredInfo->CurrentFreeCredits >= 2 * pEPDist->TxCreditsSeek) {
-+                /* try to give more credits than it needs */
-+            credits = 2 * pEPDist->TxCreditsSeek;
-+        } else {
-+                /* give what we can */
-+            credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
-+        }
-+
-+        if (credits >= pEPDist->TxCreditsSeek) {
-+                /* we found some to fullfill the seek request */
-+            break;
-+        }
-+
-+        /* we don't have enough in the free pool, try taking away from lower priority services
-+         *
-+         * The rule for taking away credits:
-+         *   1. Only take from lower priority endpoints
-+         *   2. Only take what is allocated above the minimum (never starve an endpoint completely)
-+         *   3. Only take what you need.
-+         *
-+         * */
-+
-+            /* starting at the lowest priority */
-+        pCurEpDist = pCredInfo->pLowestPriEpDist;
-+
-+            /* work backwards until we hit the endpoint again */
-+        while (pCurEpDist != pEPDist) {
-+                /* calculate how many we need so far */
-+            need = pEPDist->TxCreditsSeek - pCredInfo->CurrentFreeCredits;
-+
-+            if ((pCurEpDist->TxCreditsAssigned - need) > pCurEpDist->TxCreditsMin) {
-+                    /* the current one has been allocated more than it's minimum and it
-+                     * has enough credits assigned above it's minimum to fullfill our need
-+                     * try to take away just enough to fullfill our need */
-+                ReduceCredits(pCredInfo,
-+                              pCurEpDist,
-+                              pCurEpDist->TxCreditsAssigned - need);
-+
-+                if (pCredInfo->CurrentFreeCredits >= pEPDist->TxCreditsSeek) {
-+                        /* we have enough */
-+                    break;
-+                }
-+            }
-+
-+            pCurEpDist = pCurEpDist->pPrev;
-+        }
-+
-+            /* return what we can get */
-+        credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
-+
-+    } while (FALSE);
-+
-+        /* did we find some credits? */
-+    if (credits) {
-+            /* give what we can */
-+        GiveCredits(pCredInfo, pEPDist, credits);
-+    }
-+
-+}
-+
-+/* initialize and setup credit distribution */
-+A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo)
-+{
-+    HTC_SERVICE_ID servicepriority[5];
-+
-+    A_MEMZERO(pCredInfo,sizeof(COMMON_CREDIT_STATE_INFO));
-+
-+    servicepriority[0] = WMI_CONTROL_SVC;  /* highest */
-+    servicepriority[1] = WMI_DATA_VO_SVC;
-+    servicepriority[2] = WMI_DATA_VI_SVC;
-+    servicepriority[3] = WMI_DATA_BE_SVC;
-+    servicepriority[4] = WMI_DATA_BK_SVC; /* lowest */
-+
-+        /* set callbacks and priority list */
-+    HTCSetCreditDistribution(HTCHandle,
-+                             pCredInfo,
-+                             ar6000_credit_distribute,
-+                             ar6000_credit_init,
-+                             servicepriority,
-+                             5);
-+
-+    return A_OK;
-+}
-+
-diff --git a/drivers/ar6000/wlan/wlan_node.c b/drivers/ar6000/wlan/wlan_node.c
-new file mode 100644
-index 0000000..b124845
---- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_node.c
-@@ -0,0 +1,371 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2004-2005 Atheros Communications
-+ * All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote products
-+ *    derived from this software without specific prior written permission.
-+ *
-+ * Alternatively, this software may be distributed under the terms of the
-+ * GNU General Public License ("GPL") version 2 as published by the Free
-+ * Software Foundation.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_node.c#1 $
-+ */
-+/*
-+ * IEEE 802.11 node handling support.
-+ */
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
-+#include <a_debug.h>
-+#include <ieee80211.h>
-+#include <wlan_api.h>
-+#include <ieee80211_node.h>
-+#include <htc_api.h>
-+#include <wmi.h>
-+#include <wmi_api.h>
-+
-+static void wlan_node_timeout(A_ATH_TIMER arg);
-+static bss_t * _ieee80211_find_node(struct ieee80211_node_table *nt,
-+                                    const A_UINT8 *macaddr);
-+
-+bss_t *
-+wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size)
-+{
-+    bss_t *ni;
-+
-+    ni = A_MALLOC_NOWAIT(sizeof(bss_t));
-+
-+    if (ni != NULL) {
-+        ni->ni_buf = A_MALLOC_NOWAIT(wh_size);
-+        if (ni->ni_buf == NULL) {
-+            A_FREE(ni);
-+            ni = NULL;
-+            return ni;
-+        }
-+    } else {
-+        return ni;
-+    }
-+
-+    /* Make sure our lists are clean */
-+    ni->ni_list_next = NULL;
-+    ni->ni_list_prev = NULL;
-+    ni->ni_hash_next = NULL;
-+    ni->ni_hash_prev = NULL;
-+
-+    //
-+    // ni_scangen never initialized before and during suspend/resume of winmobile, customer (LG/SEMCO) identified
-+    // that some junk has been stored in this, due to this scan list didn't properly updated
-+    //
-+    ni->ni_scangen	 = 0;
-+
-+    return ni;
-+}
-+
-+void
-+wlan_node_free(bss_t *ni)
-+{
-+    if (ni->ni_buf != NULL) {
-+        A_FREE(ni->ni_buf);
-+    }
-+    A_FREE(ni);
-+}
-+
-+void
-+wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
-+                const A_UINT8 *macaddr)
-+{
-+    int hash;
-+
-+    A_MEMCPY(ni->ni_macaddr, macaddr, IEEE80211_ADDR_LEN);
-+    hash = IEEE80211_NODE_HASH(macaddr);
-+    ieee80211_node_initref(ni);     /* mark referenced */
-+
-+    ni->ni_tstamp = A_GET_MS(WLAN_NODE_INACT_TIMEOUT_MSEC);
-+    IEEE80211_NODE_LOCK_BH(nt);
-+
-+    /* Insert at the end of the node list */
-+    ni->ni_list_next = NULL;
-+    ni->ni_list_prev = nt->nt_node_last;
-+    if(nt->nt_node_last != NULL)
-+    {
-+        nt->nt_node_last->ni_list_next = ni;
-+    }
-+    nt->nt_node_last = ni;
-+    if(nt->nt_node_first == NULL)
-+    {
-+        nt->nt_node_first = ni;
-+    }
-+
-+    /* Insert into the hash list i.e. the bucket */
-+    if((ni->ni_hash_next = nt->nt_hash[hash]) != NULL)
-+    {
-+        nt->nt_hash[hash]->ni_hash_prev = ni;
-+    }
-+    ni->ni_hash_prev = NULL;
-+    nt->nt_hash[hash] = ni;
-+
-+    if (!nt->isTimerArmed) {
-+        A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
-+        nt->isTimerArmed = TRUE;
-+    }
-+
-+    IEEE80211_NODE_UNLOCK_BH(nt);
-+}
-+
-+static bss_t *
-+_ieee80211_find_node(struct ieee80211_node_table *nt,
-+    const A_UINT8 *macaddr)
-+{
-+    bss_t *ni;
-+    int hash;
-+
-+    IEEE80211_NODE_LOCK_ASSERT(nt);
-+
-+    hash = IEEE80211_NODE_HASH(macaddr);
-+    for(ni = nt->nt_hash[hash]; ni; ni = ni->ni_hash_next) {
-+        if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
-+            ieee80211_node_incref(ni);  /* mark referenced */
-+            return ni;
-+        }
-+    }
-+    return NULL;
-+}
-+
-+bss_t *
-+wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr)
-+{
-+    bss_t *ni;
-+
-+    IEEE80211_NODE_LOCK(nt);
-+    ni = _ieee80211_find_node(nt, macaddr);
-+    IEEE80211_NODE_UNLOCK(nt);
-+    return ni;
-+}
-+
-+/*
-+ * Reclaim a node.  If this is the last reference count then
-+ * do the normal free work.  Otherwise remove it from the node
-+ * table and mark it gone by clearing the back-reference.
-+ */
-+void
-+wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni)
-+{
-+    IEEE80211_NODE_LOCK(nt);
-+
-+    if(ni->ni_list_prev == NULL)
-+    {
-+        /* First in list so fix the list head */
-+        nt->nt_node_first = ni->ni_list_next;
-+    }
-+    else
-+    {
-+        ni->ni_list_prev->ni_list_next = ni->ni_list_next;
-+    }
-+
-+    if(ni->ni_list_next == NULL)
-+    {
-+        /* Last in list so fix list tail */
-+        nt->nt_node_last = ni->ni_list_prev;
-+    }
-+    else
-+    {
-+        ni->ni_list_next->ni_list_prev = ni->ni_list_prev;
-+    }
-+
-+    if(ni->ni_hash_prev == NULL)
-+    {
-+        /* First in list so fix the list head */
-+        int hash;
-+        hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
-+        nt->nt_hash[hash] = ni->ni_hash_next;
-+    }
-+    else
-+    {
-+        ni->ni_hash_prev->ni_hash_next = ni->ni_hash_next;
-+    }
-+
-+    if(ni->ni_hash_next != NULL)
-+    {
-+        ni->ni_hash_next->ni_hash_prev = ni->ni_hash_prev;
-+    }
-+    wlan_node_free(ni);
-+
-+    IEEE80211_NODE_UNLOCK(nt);
-+}
-+
-+static void
-+wlan_node_dec_free(bss_t *ni)
-+{
-+    if (ieee80211_node_dectestref(ni)) {
-+        wlan_node_free(ni);
-+    }
-+}
-+
-+void
-+wlan_free_allnodes(struct ieee80211_node_table *nt)
-+{
-+    bss_t *ni;
-+
-+    while ((ni = nt->nt_node_first) != NULL) {
-+        wlan_node_reclaim(nt, ni);
-+    }
-+}
-+
-+void
-+wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
-+                   void *arg)
-+{
-+    bss_t *ni;
-+    A_UINT32 gen;
-+
-+    gen = ++nt->nt_scangen;
-+
-+    IEEE80211_NODE_LOCK(nt);
-+    for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
-+        if (ni->ni_scangen != gen) {
-+            ni->ni_scangen = gen;
-+            (void) ieee80211_node_incref(ni);
-+            (*f)(arg, ni);
-+            wlan_node_dec_free(ni);
-+        }
-+    }
-+    IEEE80211_NODE_UNLOCK(nt);
-+}
-+
-+/*
-+ * Node table support.
-+ */
-+void
-+wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt)
-+{
-+    int i;
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN, ("node table = 0x%x\n", (A_UINT32)nt));
-+    IEEE80211_NODE_LOCK_INIT(nt);
-+
-+    nt->nt_node_first = nt->nt_node_last = NULL;
-+    for(i = 0; i < IEEE80211_NODE_HASHSIZE; i++)
-+    {
-+        nt->nt_hash[i] = NULL;
-+    }
-+    A_INIT_TIMER(&nt->nt_inact_timer, wlan_node_timeout, nt);
-+    nt->isTimerArmed = FALSE;
-+    nt->nt_wmip = wmip;
-+}
-+
-+static void
-+wlan_node_timeout(A_ATH_TIMER arg)
-+{
-+    struct ieee80211_node_table *nt = (struct ieee80211_node_table *)arg;
-+    bss_t *bss, *nextBss;
-+    A_UINT8 myBssid[IEEE80211_ADDR_LEN], reArmTimer = FALSE;
-+
-+    wmi_get_current_bssid(nt->nt_wmip, myBssid);
-+
-+    bss = nt->nt_node_first;
-+    while (bss != NULL)
-+    {
-+        nextBss = bss->ni_list_next;
-+        if (A_MEMCMP(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
-+        {
-+
-+            if (bss->ni_tstamp <= A_GET_MS(0))
-+            {
-+               /*
-+                * free up all but the current bss - if set
-+                */
-+                wlan_node_reclaim(nt, bss);
-+            }
-+            else
-+            {
-+                /*
-+                 * Re-arm timer, only when we have a bss other than
-+                 * current bss AND it is not aged-out.
-+                 */
-+                reArmTimer = TRUE;
-+            }
-+        }
-+        bss = nextBss;
-+    }
-+
-+    if(reArmTimer)
-+        A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
-+
-+    nt->isTimerArmed = reArmTimer;
-+}
-+
-+void
-+wlan_node_table_cleanup(struct ieee80211_node_table *nt)
-+{
-+    A_UNTIMEOUT(&nt->nt_inact_timer);
-+    A_DELETE_TIMER(&nt->nt_inact_timer);
-+    wlan_free_allnodes(nt);
-+    IEEE80211_NODE_LOCK_DESTROY(nt);
-+}
-+
-+bss_t *
-+wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
-+					A_UINT32 ssidLength, A_BOOL bIsWPA2)
-+{
-+    bss_t   *ni = NULL;
-+	A_UCHAR *pIESsid = NULL;
-+
-+    IEEE80211_NODE_LOCK (nt);
-+
-+    for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
-+		pIESsid = ni->ni_cie.ie_ssid;
-+		if (pIESsid[1] <= 32) {
-+
-+			// Step 1 : Check SSID
-+			if (0x00 == memcmp (pSsid, &pIESsid[2], ssidLength)) {
-+
-+				// Step 2 : if SSID matches, check WPA or WPA2
-+				if (TRUE == bIsWPA2 && NULL != ni->ni_cie.ie_rsn) {
-+					ieee80211_node_incref (ni);  /* mark referenced */
-+					IEEE80211_NODE_UNLOCK (nt);
-+					return ni;
-+				}
-+				if (FALSE == bIsWPA2 && NULL != ni->ni_cie.ie_wpa) {
-+					ieee80211_node_incref(ni);  /* mark referenced */
-+					IEEE80211_NODE_UNLOCK (nt);
-+					return ni;
-+				}
-+			}
-+		}
-+    }
-+
-+    IEEE80211_NODE_UNLOCK (nt);
-+
-+    return NULL;
-+}
-+
-+void
-+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni)
-+{
-+	IEEE80211_NODE_LOCK (nt);
-+	wlan_node_dec_free (ni);
-+	IEEE80211_NODE_UNLOCK (nt);
-+}
-diff --git a/drivers/ar6000/wlan/wlan_recv_beacon.c b/drivers/ar6000/wlan/wlan_recv_beacon.c
-new file mode 100644
-index 0000000..15beabb
---- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_recv_beacon.c
-@@ -0,0 +1,192 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote products
-+ *    derived from this software without specific prior written permission.
-+ *
-+ * Alternatively, this software may be distributed under the terms of the
-+ * GNU General Public License ("GPL") version 2 as published by the Free
-+ * Software Foundation.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+ */
-+/*
-+ * IEEE 802.11 input handling.
-+ */
-+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include <wmi.h>
-+#include <ieee80211.h>
-+#include <wlan_api.h>
-+
-+#define IEEE80211_VERIFY_LENGTH(_len, _minlen) do {         \
-+    if ((_len) < (_minlen)) {                   \
-+        return A_EINVAL;                         \
-+    }                               \
-+} while (0)
-+
-+#define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {         \
-+    if ((__elem) == NULL) {                     \
-+        return A_EINVAL;                         \
-+    }                               \
-+    if ((__elem)[1] > (__maxlen)) {                 \
-+        return A_EINVAL;                         \
-+    }                               \
-+} while (0)
-+
-+
-+/* unaligned little endian access */
-+#define LE_READ_2(p)                            \
-+    ((A_UINT16)                            \
-+     ((((A_UINT8 *)(p))[0]      ) | (((A_UINT8 *)(p))[1] <<  8)))
-+
-+#define LE_READ_4(p)                            \
-+    ((A_UINT32)                            \
-+     ((((A_UINT8 *)(p))[0]      ) | (((A_UINT8 *)(p))[1] <<  8) | \
-+      (((A_UINT8 *)(p))[2] << 16) | (((A_UINT8 *)(p))[3] << 24)))
-+
-+
-+static int __inline
-+iswpaoui(const A_UINT8 *frm)
-+{
-+    return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
-+}
-+
-+static int __inline
-+iswmmoui(const A_UINT8 *frm)
-+{
-+    return frm[1] > 3 && LE_READ_4(frm+2) == ((WMM_OUI_TYPE<<24)|WMM_OUI);
-+}
-+
-+static int __inline
-+iswmmparam(const A_UINT8 *frm)
-+{
-+    return frm[1] > 5 && frm[6] == WMM_PARAM_OUI_SUBTYPE;
-+}
-+
-+static int __inline
-+iswmminfo(const A_UINT8 *frm)
-+{
-+    return frm[1] > 5 && frm[6] == WMM_INFO_OUI_SUBTYPE;
-+}
-+
-+static int __inline
-+isatherosoui(const A_UINT8 *frm)
-+{
-+    return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
-+}
-+
-+static int __inline
-+iswscoui(const A_UINT8 *frm)
-+{
-+    return frm[1] > 3 && LE_READ_4(frm+2) == ((0x04<<24)|WPA_OUI);
-+}
-+
-+A_STATUS
-+wlan_parse_beacon(A_UINT8 *buf, int framelen, struct ieee80211_common_ie *cie)
-+{
-+    A_UINT8 *frm, *efrm;
-+
-+    frm = buf;
-+    efrm = (A_UINT8 *) (frm + framelen);
-+
-+    /*
-+     * beacon/probe response frame format
-+     *  [8] time stamp
-+     *  [2] beacon interval
-+     *  [2] capability information
-+     *  [tlv] ssid
-+     *  [tlv] supported rates
-+     *  [tlv] country information
-+     *  [tlv] parameter set (FH/DS)
-+     *  [tlv] erp information
-+     *  [tlv] extended supported rates
-+     *  [tlv] WMM
-+     *  [tlv] WPA or RSN
-+     *  [tlv] Atheros Advanced Capabilities
-+     */
-+    IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
-+    A_MEMZERO(cie, sizeof(*cie));
-+
-+    cie->ie_tstamp = frm; frm += 8;
-+    cie->ie_beaconInt = A_LE2CPU16(*(A_UINT16 *)frm);  frm += 2;
-+    cie->ie_capInfo = A_LE2CPU16(*(A_UINT16 *)frm);  frm += 2;
-+    cie->ie_chan = 0;
-+
-+    while (frm < efrm) {
-+        switch (*frm) {
-+        case IEEE80211_ELEMID_SSID:
-+            cie->ie_ssid = frm;
-+            break;
-+        case IEEE80211_ELEMID_RATES:
-+            cie->ie_rates = frm;
-+            break;
-+        case IEEE80211_ELEMID_COUNTRY:
-+            cie->ie_country = frm;
-+            break;
-+        case IEEE80211_ELEMID_FHPARMS:
-+            break;
-+        case IEEE80211_ELEMID_DSPARMS:
-+            cie->ie_chan = frm[2];
-+            break;
-+        case IEEE80211_ELEMID_TIM:
-+            cie->ie_tim = frm;
-+            break;
-+        case IEEE80211_ELEMID_IBSSPARMS:
-+            break;
-+        case IEEE80211_ELEMID_XRATES:
-+            cie->ie_xrates = frm;
-+            break;
-+        case IEEE80211_ELEMID_ERP:
-+            if (frm[1] != 1) {
-+                //A_PRINTF("Discarding ERP Element - Bad Len\n");
-+                return A_EINVAL;
-+            }
-+            cie->ie_erp = frm[2];
-+            break;
-+        case IEEE80211_ELEMID_RSN:
-+            cie->ie_rsn = frm;
-+            break;
-+        case IEEE80211_ELEMID_VENDOR:
-+            if (iswpaoui(frm)) {
-+                cie->ie_wpa = frm;
-+            } else if (iswmmoui(frm)) {
-+                cie->ie_wmm = frm;
-+            } else if (isatherosoui(frm)) {
-+                cie->ie_ath = frm;
-+            } else if(iswscoui(frm)) {
-+                cie->ie_wsc = frm;
-+            }
-+            break;
-+        default:
-+            break;
-+        }
-+        frm += frm[1] + 2;
-+    }
-+    IEEE80211_VERIFY_ELEMENT(cie->ie_rates, IEEE80211_RATE_MAXSIZE);
-+    IEEE80211_VERIFY_ELEMENT(cie->ie_ssid, IEEE80211_NWID_LEN);
-+
-+    return A_OK;
-+}
-diff --git a/drivers/ar6000/wlan/wlan_utils.c b/drivers/ar6000/wlan/wlan_utils.c
-new file mode 100644
-index 0000000..fd5aac9
---- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_utils.c
-@@ -0,0 +1,59 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This module implements frequently used wlan utilies
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_utils.c#1 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
-+
-+/*
-+ * converts ieee channel number to frequency
-+ */
-+A_UINT16
-+wlan_ieee2freq(int chan)
-+{
-+    if (chan == 14) {
-+        return 2484;
-+    }
-+    if (chan < 14) {    /* 0-13 */
-+        return (2407 + (chan*5));
-+    }
-+    if (chan < 27) {    /* 15-26 */
-+        return (2512 + ((chan-15)*20));
-+    }
-+    return (5000 + (chan*5));
-+}
-+
-+/*
-+ * Converts MHz frequency to IEEE channel number.
-+ */
-+A_UINT32
-+wlan_freq2ieee(A_UINT16 freq)
-+{
-+    if (freq == 2484)
-+        return 14;
-+    if (freq < 2484)
-+        return (freq - 2407) / 5;
-+    if (freq < 5000)
-+        return 15 + ((freq - 2512) / 20);
-+    return (freq - 5000) / 5;
-+}
-diff --git a/drivers/ar6000/wmi/wmi.c b/drivers/ar6000/wmi/wmi.c
-new file mode 100644
-index 0000000..d322cf3
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi.c
-@@ -0,0 +1,3954 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This module implements the hardware independent layer of the
-+ * Wireless Module Interface (WMI) protocol.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi.c#3 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
-+#include "htc.h"
-+#include "htc_api.h"
-+#include "wmi.h"
-+#include <ieee80211.h>
-+#include <ieee80211_node.h>
-+#include <wlan_api.h>
-+#include <wmi_api.h>
-+#include "dset_api.h"
-+#include "gpio_api.h"
-+#include "wmi_host.h"
-+#include "a_drv.h"
-+#include "a_drv_api.h"
-+#include "a_debug.h"
-+#include "dbglog_api.h"
-+
-+static A_STATUS wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_STATUS wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                        int len);
-+static A_STATUS wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                        int len);
-+static A_STATUS wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                       int len);
-+static A_STATUS wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_sync_point(struct wmi_t *wmip);
-+
-+static A_STATUS wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                         int len);
-+static A_STATUS wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                       int len);
-+static A_STATUS wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                             int len);
-+
-+static A_STATUS wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+static A_STATUS wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
-+
-+
-+static A_STATUS wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                     int len);
-+static A_STATUS wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                      int len);
-+static A_STATUS wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                      int len);
-+static A_STATUS wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+                                      int len);
-+static A_STATUS
-+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len);
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+static A_STATUS wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+static A_STATUS
-+wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+#endif
-+
-+static A_STATUS
-+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_STATUS
-+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_STATUS
-+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_BOOL
-+wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex);
-+
-+static A_STATUS
-+wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_STATUS
-+wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+static A_STATUS wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+
-+int wps_enable;
-+static const A_INT32 wmi_rateTable[] = {
-+    1000,
-+    2000,
-+    5500,
-+    11000,
-+    6000,
-+    9000,
-+    12000,
-+    18000,
-+    24000,
-+    36000,
-+    48000,
-+    54000,
-+    0};
-+
-+#define MODE_A_SUPPORT_RATE_START       4
-+#define MODE_A_SUPPORT_RATE_STOP        11
-+
-+#define MODE_GONLY_SUPPORT_RATE_START   MODE_A_SUPPORT_RATE_START
-+#define MODE_GONLY_SUPPORT_RATE_STOP    MODE_A_SUPPORT_RATE_STOP
-+
-+#define MODE_B_SUPPORT_RATE_START       0
-+#define MODE_B_SUPPORT_RATE_STOP        3
-+
-+#define MODE_G_SUPPORT_RATE_START       0
-+#define MODE_G_SUPPORT_RATE_STOP        11
-+
-+#define MAX_NUMBER_OF_SUPPORT_RATES     (MODE_G_SUPPORT_RATE_STOP + 1)
-+
-+/* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
-+const A_UINT8 up_to_ac[]= {
-+                WMM_AC_BE,
-+                WMM_AC_BK,
-+                WMM_AC_BK,
-+                WMM_AC_BE,
-+                WMM_AC_VI,
-+                WMM_AC_VI,
-+                WMM_AC_VO,
-+                WMM_AC_VO,
-+            };
-+
-+void *
-+wmi_init(void *devt)
-+{
-+    struct wmi_t *wmip;
-+
-+    wmip = A_MALLOC(sizeof(struct wmi_t));
-+    if (wmip == NULL) {
-+        return (NULL);
-+    }
-+    A_MEMZERO(wmip, sizeof(*wmip));
-+    A_MUTEX_INIT(&wmip->wmi_lock);
-+    wmip->wmi_devt = devt;
-+    wlan_node_table_init(wmip, &wmip->wmi_scan_table);
-+    wmi_qos_state_init(wmip);
-+    wmip->wmi_powerMode = REC_POWER;
-+    wmip->wmi_phyMode = WMI_11G_MODE;
-+
-+    return (wmip);
-+}
-+
-+void
-+wmi_qos_state_init(struct wmi_t *wmip)
-+{
-+    A_UINT8 i;
-+
-+    if (wmip == NULL) {
-+        return;
-+    }
-+    LOCK_WMI(wmip);
-+
-+    /* Initialize QoS States */
-+    wmip->wmi_numQoSStream = 0;
-+
-+    wmip->wmi_fatPipeExists = 0;
-+
-+    for (i=0; i < WMM_NUM_AC; i++) {
-+        wmip->wmi_streamExistsForAC[i]=0;
-+    }
-+
-+        /* Initialize the static Wmi stream Pri to WMM AC mappings Arrays */
-+    WMI_INIT_WMISTREAM_AC_MAP(wmip);
-+
-+    UNLOCK_WMI(wmip);
-+
-+    A_WMI_SET_NUMDATAENDPTS(wmip->wmi_devt, 1);
-+}
-+
-+void
-+wmi_shutdown(struct wmi_t *wmip)
-+{
-+    if (wmip != NULL) {
-+        wlan_node_table_cleanup(&wmip->wmi_scan_table);
-+        if (A_IS_MUTEX_VALID(&wmip->wmi_lock)) {
-+            A_MUTEX_DELETE(&wmip->wmi_lock);
-+        }
-+        A_FREE(wmip);
-+    }
-+}
-+
-+/*
-+ *  performs DIX to 802.3 encapsulation for transmit packets.
-+ *  uses passed in buffer.  Returns buffer or NULL if failed.
-+ *  Assumes the entire DIX header is contigous and that there is
-+ *  enough room in the buffer for a 802.3 mac header and LLC+SNAP headers.
-+ */
-+A_STATUS
-+wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf)
-+{
-+    A_UINT8          *datap;
-+    A_UINT16         typeorlen;
-+    ATH_MAC_HDR      macHdr;
-+    ATH_LLC_SNAP_HDR *llcHdr;
-+
-+    A_ASSERT(osbuf != NULL);
-+
-+    if (A_NETBUF_HEADROOM(osbuf) <
-+        (sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR)))
-+    {
-+        return A_NO_MEMORY;
-+    }
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+
-+    typeorlen = *(A_UINT16 *)(datap + ATH_MAC_LEN + ATH_MAC_LEN);
-+
-+    if (!IS_ETHERTYPE(A_BE2CPU16(typeorlen))) {
-+        /*
-+         * packet is already in 802.3 format - return success
-+         */
-+        A_DPRINTF(DBG_WMI, (DBGFMT "packet already 802.3\n", DBGARG));
-+        return (A_OK);
-+    }
-+
-+    /*
-+     * Save mac fields and length to be inserted later
-+     */
-+    A_MEMCPY(macHdr.dstMac, datap, ATH_MAC_LEN);
-+    A_MEMCPY(macHdr.srcMac, datap + ATH_MAC_LEN, ATH_MAC_LEN);
-+    macHdr.typeOrLen = A_CPU2BE16(A_NETBUF_LEN(osbuf) - sizeof(ATH_MAC_HDR) +
-+                                  sizeof(ATH_LLC_SNAP_HDR));
-+
-+    /*
-+     * Make room for LLC+SNAP headers
-+     */
-+    if (A_NETBUF_PUSH(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+
-+    A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
-+
-+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
-+    llcHdr->dsap      = 0xAA;
-+    llcHdr->ssap      = 0xAA;
-+    llcHdr->cntl      = 0x03;
-+    llcHdr->orgCode[0] = 0x0;
-+    llcHdr->orgCode[1] = 0x0;
-+    llcHdr->orgCode[2] = 0x0;
-+    llcHdr->etherType = typeorlen;
-+
-+    return (A_OK);
-+}
-+
-+/*
-+ * Adds a WMI data header
-+ * Assumes there is enough room in the buffer to add header.
-+ */
-+A_STATUS
-+wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType)
-+{
-+    WMI_DATA_HDR     *dtHdr;
-+
-+    A_ASSERT(osbuf != NULL);
-+
-+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
-+    dtHdr->info = msgType;
-+    dtHdr->rssi = 0;
-+
-+    return (A_OK);
-+}
-+
-+A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up)
-+{
-+    A_UINT8         *datap;
-+    A_UINT8         trafficClass = WMM_AC_BE, userPriority = up;
-+    ATH_LLC_SNAP_HDR *llcHdr;
-+    A_UINT16        ipType = IP_ETHERTYPE;
-+    WMI_DATA_HDR     *dtHdr;
-+    WMI_CREATE_PSTREAM_CMD  cmd;
-+    A_BOOL           streamExists = FALSE;
-+
-+    A_ASSERT(osbuf != NULL);
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+
-+    if (up == UNDEFINED_PRI) {
-+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(WMI_DATA_HDR) +
-+                                  sizeof(ATH_MAC_HDR));
-+
-+        if (llcHdr->etherType == A_CPU2BE16(ipType)) {
-+        /* Extract the endpoint info from the TOS field in the IP header */
-+        userPriority = A_WMI_IPTOS_TO_USERPRIORITY(((A_UINT8 *)llcHdr) + sizeof(ATH_LLC_SNAP_HDR));
-+        }
-+    }
-+
-+    if (userPriority < MAX_NUM_PRI) {
-+        trafficClass = convert_userPriority_to_trafficClass(userPriority);
-+    }
-+
-+    dtHdr = (WMI_DATA_HDR *)datap;
-+    if(dir==UPLINK_TRAFFIC)
-+        dtHdr->info |= (userPriority & WMI_DATA_HDR_UP_MASK) << WMI_DATA_HDR_UP_SHIFT;  /* lower 3-bits are 802.1d priority */
-+
-+    LOCK_WMI(wmip);
-+    streamExists = wmip->wmi_fatPipeExists;
-+    UNLOCK_WMI(wmip);
-+
-+    if (!(streamExists & (1 << trafficClass))) {
-+
-+        A_MEMZERO(&cmd, sizeof(cmd));
-+	    cmd.trafficClass = trafficClass;
-+	    cmd.userPriority = userPriority;
-+		cmd.inactivityInt = WMI_IMPLICIT_PSTREAM_INACTIVITY_INT;
-+            /* Implicit streams are created with TSID 0xFF */
-+        cmd.tsid = WMI_IMPLICIT_PSTREAM;
-+        wmi_create_pstream_cmd(wmip, &cmd);
-+    }
-+
-+    return trafficClass;
-+}
-+
-+WMI_PRI_STREAM_ID
-+wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass)
-+{
-+    return WMI_ACCESSCATEGORY_WMISTREAM(wmip, trafficClass);
-+}
-+
-+/*
-+ *  performs 802.3 to DIX encapsulation for received packets.
-+ *  Assumes the entire 802.3 header is contigous.
-+ */
-+A_STATUS
-+wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf)
-+{
-+    A_UINT8          *datap;
-+    ATH_MAC_HDR      macHdr;
-+    ATH_LLC_SNAP_HDR *llcHdr;
-+
-+    A_ASSERT(osbuf != NULL);
-+    datap = A_NETBUF_DATA(osbuf);
-+
-+    A_MEMCPY(&macHdr, datap, sizeof(ATH_MAC_HDR));
-+    llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
-+    macHdr.typeOrLen = llcHdr->etherType;
-+
-+    if (A_NETBUF_PULL(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+
-+    A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
-+
-+    return (A_OK);
-+}
-+
-+/*
-+ * Removes a WMI data header
-+ */
-+A_STATUS
-+wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf)
-+{
-+    A_ASSERT(osbuf != NULL);
-+
-+    return (A_NETBUF_PULL(osbuf, sizeof(WMI_DATA_HDR)));
-+}
-+
-+void
-+wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg)
-+{
-+    wlan_iterate_nodes(&wmip->wmi_scan_table, f, arg);
-+}
-+
-+/*
-+ * WMI Extended Event received from Target.
-+ */
-+A_STATUS
-+wmi_control_rx_xtnd(struct wmi_t *wmip, void *osbuf)
-+{
-+    WMIX_CMD_HDR *cmd;
-+    A_UINT16 id;
-+    A_UINT8 *datap;
-+    A_UINT32 len;
-+    A_STATUS status = A_OK;
-+
-+    if (A_NETBUF_LEN(osbuf) < sizeof(WMIX_CMD_HDR)) {
-+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
-+        wmip->wmi_stats.cmd_len_err++;
-+        A_NETBUF_FREE(osbuf);
-+        return A_ERROR;
-+    }
-+
-+    cmd = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+    id = cmd->commandId;
-+
-+    if (A_NETBUF_PULL(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
-+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
-+        wmip->wmi_stats.cmd_len_err++;
-+        A_NETBUF_FREE(osbuf);
-+        return A_ERROR;
-+    }
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+    len = A_NETBUF_LEN(osbuf);
-+
-+    switch (id) {
-+    case (WMIX_DSETOPENREQ_EVENTID):
-+        status = wmi_dset_open_req_rx(wmip, datap, len);
-+        break;
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+    case (WMIX_DSETCLOSE_EVENTID):
-+        status = wmi_dset_close_rx(wmip, datap, len);
-+        break;
-+    case (WMIX_DSETDATAREQ_EVENTID):
-+        status = wmi_dset_data_req_rx(wmip, datap, len);
-+        break;
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+    case (WMIX_GPIO_INTR_EVENTID):
-+        wmi_gpio_intr_rx(wmip, datap, len);
-+        break;
-+    case (WMIX_GPIO_DATA_EVENTID):
-+        wmi_gpio_data_rx(wmip, datap, len);
-+        break;
-+    case (WMIX_GPIO_ACK_EVENTID):
-+        wmi_gpio_ack_rx(wmip, datap, len);
-+        break;
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+    case (WMIX_HB_CHALLENGE_RESP_EVENTID):
-+        wmi_hbChallengeResp_rx(wmip, datap, len);
-+        break;
-+    case (WMIX_DBGLOG_EVENTID):
-+        wmi_dbglog_event_rx(wmip, datap, len);
-+        break;
-+    default:
-+        A_DPRINTF(DBG_WMI|DBG_ERROR,
-+            (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
-+        wmip->wmi_stats.cmd_id_err++;
-+        status = A_ERROR;
-+        break;
-+    }
-+
-+    return status;
-+}
-+
-+/*
-+ * Control Path
-+ */
-+A_UINT32 cmdRecvNum;
-+
-+A_STATUS
-+wmi_control_rx(struct wmi_t *wmip, void *osbuf)
-+{
-+    WMI_CMD_HDR *cmd;
-+    A_UINT16 id;
-+    A_UINT8 *datap;
-+    A_UINT32 len, i, loggingReq;
-+    A_STATUS status = A_OK;
-+
-+    A_ASSERT(osbuf != NULL);
-+    if (A_NETBUF_LEN(osbuf) < sizeof(WMI_CMD_HDR)) {
-+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
-+        wmip->wmi_stats.cmd_len_err++;
-+        A_NETBUF_FREE(osbuf);
-+        return A_ERROR;
-+    }
-+
-+    cmd = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+    id = cmd->commandId;
-+
-+    if (A_NETBUF_PULL(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
-+        A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
-+        wmip->wmi_stats.cmd_len_err++;
-+        A_NETBUF_FREE(osbuf);
-+        return A_ERROR;
-+    }
-+
-+    datap = A_NETBUF_DATA(osbuf);
-+    len = A_NETBUF_LEN(osbuf);
-+
-+    ar6000_get_driver_cfg(wmip->wmi_devt,
-+                    AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS,
-+                    &loggingReq);
-+
-+    if(loggingReq) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI %d \n",id));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI recv, MsgNo %d : ", cmdRecvNum));
-+        for(i = 0; i < len; i++)
-+            AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("%x ", datap[i]));
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("\n"));
-+    }
-+
-+    LOCK_WMI(wmip);
-+    cmdRecvNum++;
-+    UNLOCK_WMI(wmip);
-+
-+    switch (id) {
-+    case (WMI_GET_BITRATE_CMDID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_BITRATE_CMDID\n", DBGARG));
-+        status = wmi_bitrate_reply_rx(wmip, datap, len);
-+        break;
-+    case (WMI_GET_CHANNEL_LIST_CMDID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_CHANNEL_LIST_CMDID\n", DBGARG));
-+        status = wmi_channelList_reply_rx(wmip, datap, len);
-+        break;
-+    case (WMI_GET_TX_PWR_CMDID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_TX_PWR_CMDID\n", DBGARG));
-+        status = wmi_txPwr_reply_rx(wmip, datap, len);
-+        break;
-+    case (WMI_READY_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_READY_EVENTID\n", DBGARG));
-+        status = wmi_ready_event_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        A_WMI_DBGLOG_INIT_DONE(wmip->wmi_devt);
-+        break;
-+    case (WMI_CONNECT_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CONNECT_EVENTID\n", DBGARG));
-+        status = wmi_connect_event_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_DISCONNECT_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DISCONNECT_EVENTID\n", DBGARG));
-+        status = wmi_disconnect_event_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_TKIP_MICERR_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TKIP_MICERR_EVENTID\n", DBGARG));
-+        status = wmi_tkip_micerr_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_BSSINFO_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BSSINFO_EVENTID\n", DBGARG));
-+        status = wmi_bssInfo_event_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_REGDOMAIN_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REGDOMAIN_EVENTID\n", DBGARG));
-+        status = wmi_regDomain_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_PSTREAM_TIMEOUT_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSTREAM_TIMEOUT_EVENTID\n", DBGARG));
-+        status = wmi_pstream_timeout_event_rx(wmip, datap, len);
-+            /* pstreams are fatpipe abstractions that get implicitly created.
-+             * User apps only deal with thinstreams. creation of a thinstream
-+             * by the user or data traffic flow in an AC triggers implicit
-+             * pstream creation. Do we need to send this event to App..?
-+             * no harm in sending it.
-+             */
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_NEIGHBOR_REPORT_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_NEIGHBOR_REPORT_EVENTID\n", DBGARG));
-+        status = wmi_neighborReport_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_SCAN_COMPLETE_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SCAN_COMPLETE_EVENTID\n", DBGARG));
-+        status = wmi_scanComplete_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_CMDERROR_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CMDERROR_EVENTID\n", DBGARG));
-+        status = wmi_errorEvent_rx(wmip, datap, len);
-+        break;
-+    case (WMI_REPORT_STATISTICS_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_STATISTICS_EVENTID\n", DBGARG));
-+        status = wmi_statsEvent_rx(wmip, datap, len);
-+        break;
-+    case (WMI_RSSI_THRESHOLD_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_RSSI_THRESHOLD_EVENTID\n", DBGARG));
-+        status = wmi_rssiThresholdEvent_rx(wmip, datap, len);
-+        break;
-+    case (WMI_ERROR_REPORT_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_ERROR_REPORT_EVENTID\n", DBGARG));
-+        status = wmi_reportErrorEvent_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_OPT_RX_FRAME_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_OPT_RX_FRAME_EVENTID\n", DBGARG));
-+        status = wmi_opt_frame_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_REPORT_ROAM_TBL_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_TBL_EVENTID\n", DBGARG));
-+        status = wmi_roam_tbl_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_EXTENSION_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_EXTENSION_EVENTID\n", DBGARG));
-+        status = wmi_control_rx_xtnd(wmip, osbuf);
-+        break;
-+    case (WMI_CAC_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CAC_EVENTID\n", DBGARG));
-+        status = wmi_cac_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_REPORT_ROAM_DATA_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_DATA_EVENTID\n", DBGARG));
-+        status = wmi_roam_data_event_rx(wmip, datap, len);
-+        break;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+    case (WMI_TEST_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TEST_EVENTID\n", DBGARG));
-+        status = wmi_tcmd_test_report_rx(wmip, datap, len);
-+        break;
-+#endif
-+    case (WMI_GET_FIXRATES_CMDID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_FIXRATES_CMDID\n", DBGARG));
-+        status = wmi_ratemask_reply_rx(wmip, datap, len);
-+        break;
-+    case (WMI_TX_RETRY_ERR_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TX_RETRY_ERR_EVENTID\n", DBGARG));
-+        status = wmi_txRetryErrEvent_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_SNR_THRESHOLD_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SNR_THRESHOLD_EVENTID\n", DBGARG));
-+        status = wmi_snrThresholdEvent_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_LQ_THRESHOLD_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_LQ_THRESHOLD_EVENTID\n", DBGARG));
-+        status = wmi_lqThresholdEvent_rx(wmip, datap, len);
-+        A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+        break;
-+    case (WMI_APLIST_EVENTID):
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Received APLIST Event\n"));
-+        status = wmi_aplistEvent_rx(wmip, datap, len);
-+        break;
-+    case (WMI_GET_KEEPALIVE_CMDID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_KEEPALIVE_CMDID\n", DBGARG));
-+        status = wmi_keepalive_reply_rx(wmip, datap, len);
-+        break;
-+    case (WMI_GET_WOW_LIST_EVENTID):
-+        status = wmi_get_wow_list_event_rx(wmip, datap, len);
-+        break;
-+    case (WMI_GET_PMKID_LIST_EVENTID):
-+        A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_PMKID_LIST Event\n", DBGARG));
-+        status = wmi_get_pmkid_list_event_rx(wmip, datap, len);
-+        break;
-+    default:
-+        A_DPRINTF(DBG_WMI|DBG_ERROR,
-+            (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
-+        wmip->wmi_stats.cmd_id_err++;
-+        status = A_ERROR;
-+        break;
-+    }
-+
-+    A_NETBUF_FREE(osbuf);
-+
-+    return status;
-+}
-+
-+static A_STATUS
-+wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_READY_EVENT *ev = (WMI_READY_EVENT *)datap;
-+
-+    if (len < sizeof(WMI_READY_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+    wmip->wmi_ready = TRUE;
-+    A_WMI_READY_EVENT(wmip->wmi_devt, ev->macaddr, ev->phyCapability);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_CONNECT_EVENT *ev;
-+
-+    if (len < sizeof(WMI_CONNECT_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    ev = (WMI_CONNECT_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "freq %d bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-+        DBGARG, ev->channel,
-+        ev->bssid[0], ev->bssid[1], ev->bssid[2],
-+        ev->bssid[3], ev->bssid[4], ev->bssid[5]));
-+
-+    A_MEMCPY(wmip->wmi_bssid, ev->bssid, ATH_MAC_LEN);
-+
-+    A_WMI_CONNECT_EVENT(wmip->wmi_devt, ev->channel, ev->bssid,
-+                         ev->listenInterval, ev->beaconInterval,
-+                         ev->networkType, ev->beaconIeLen,
-+                         ev->assocReqLen, ev->assocRespLen,
-+                         ev->assocInfo);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_REG_DOMAIN_EVENT *ev;
-+
-+    if (len < sizeof(*ev)) {
-+        return A_EINVAL;
-+    }
-+    ev = (WMI_REG_DOMAIN_EVENT *)datap;
-+
-+    A_WMI_REGDOMAIN_EVENT(wmip->wmi_devt, ev->regDomain);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_NEIGHBOR_REPORT_EVENT *ev;
-+    int numAps;
-+
-+    if (len < sizeof(*ev)) {
-+        return A_EINVAL;
-+    }
-+    ev = (WMI_NEIGHBOR_REPORT_EVENT *)datap;
-+    numAps = ev->numberOfAps;
-+
-+    if (len < (int)(sizeof(*ev) + ((numAps - 1) * sizeof(WMI_NEIGHBOR_INFO)))) {
-+        return A_EINVAL;
-+    }
-+
-+    A_WMI_NEIGHBORREPORT_EVENT(wmip->wmi_devt, numAps, ev->neighbor);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_DISCONNECT_EVENT *ev;
-+
-+    if (len < sizeof(WMI_DISCONNECT_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    ev = (WMI_DISCONNECT_EVENT *)datap;
-+
-+    A_MEMZERO(wmip->wmi_bssid, sizeof(wmip->wmi_bssid));
-+
-+    A_WMI_DISCONNECT_EVENT(wmip->wmi_devt, ev->disconnectReason, ev->bssid,
-+                            ev->assocRespLen, ev->assocInfo, ev->protocolReasonStatus);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TKIP_MICERR_EVENT *ev;
-+
-+    if (len < sizeof(*ev)) {
-+        return A_EINVAL;
-+    }
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    ev = (WMI_TKIP_MICERR_EVENT *)datap;
-+    A_WMI_TKIP_MICERR_EVENT(wmip->wmi_devt, ev->keyid, ev->ismcast);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    bss_t *bss;
-+    WMI_BSS_INFO_HDR *bih;
-+    A_UINT8 *buf;
-+    A_UINT32 nodeCachingAllowed;
-+
-+    if (len <= sizeof(WMI_BSS_INFO_HDR)) {
-+        return A_EINVAL;
-+    }
-+
-+    A_WMI_BSSINFO_EVENT_RX(wmip->wmi_devt, datap, len);
-+    /* What is driver config for wlan node caching? */
-+    if(ar6000_get_driver_cfg(wmip->wmi_devt,
-+                    AR6000_DRIVER_CFG_GET_WLANNODECACHING,
-+                    &nodeCachingAllowed) != A_OK) {
-+        return A_EINVAL;
-+    }
-+
-+    if(!nodeCachingAllowed) {
-+        return A_OK;
-+    }
-+
-+
-+    bih = (WMI_BSS_INFO_HDR *)datap;
-+    buf = datap + sizeof(WMI_BSS_INFO_HDR);
-+    len -= sizeof(WMI_BSS_INFO_HDR);
-+
-+    A_DPRINTF(DBG_WMI2, (DBGFMT "bssInfo event - ch %u, rssi %02x, "
-+              "bssid \"%02x:%02x:%02x:%02x:%02x:%02x\"\n", DBGARG,
-+              bih->channel, (unsigned char) bih->rssi, bih->bssid[0],
-+              bih->bssid[1], bih->bssid[2], bih->bssid[3], bih->bssid[4],
-+              bih->bssid[5]));
-+
-+    if(wps_enable && (bih->frameType == PROBERESP_FTYPE) ) {
-+	    printk("%s() A_OK 2\n", __FUNCTION__);
-+		return A_OK;
-+    }
-+
-+    bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
-+    if (bss != NULL) {
-+        /*
-+         * Free up the node.  Not the most efficient process given
-+         * we are about to allocate a new node but it is simple and should be
-+         * adequate.
-+         */
-+        wlan_node_reclaim(&wmip->wmi_scan_table, bss);
-+    }
-+
-+    bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
-+    if (bss == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    bss->ni_snr        = bih->snr;
-+    bss->ni_rssi       = bih->rssi;
-+    A_ASSERT(bss->ni_buf != NULL);
-+    A_MEMCPY(bss->ni_buf, buf, len);
-+
-+    if (wlan_parse_beacon(bss->ni_buf, len, &bss->ni_cie) != A_OK) {
-+        wlan_node_free(bss);
-+        return A_EINVAL;
-+    }
-+
-+    /*
-+     * Update the frequency in ie_chan, overwriting of channel number
-+     * which is done in wlan_parse_beacon
-+     */
-+    bss->ni_cie.ie_chan = bih->channel;
-+    wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    bss_t *bss;
-+    WMI_OPT_RX_INFO_HDR *bih;
-+    A_UINT8 *buf;
-+
-+    if (len <= sizeof(WMI_OPT_RX_INFO_HDR)) {
-+        return A_EINVAL;
-+    }
-+
-+    bih = (WMI_OPT_RX_INFO_HDR *)datap;
-+    buf = datap + sizeof(WMI_OPT_RX_INFO_HDR);
-+    len -= sizeof(WMI_OPT_RX_INFO_HDR);
-+
-+    A_DPRINTF(DBG_WMI2, (DBGFMT "opt frame event %2.2x:%2.2x\n", DBGARG,
-+        bih->bssid[4], bih->bssid[5]));
-+
-+    bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
-+    if (bss != NULL) {
-+        /*
-+         * Free up the node.  Not the most efficient process given
-+         * we are about to allocate a new node but it is simple and should be
-+         * adequate.
-+         */
-+        wlan_node_reclaim(&wmip->wmi_scan_table, bss);
-+    }
-+
-+    bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
-+    if (bss == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    bss->ni_snr        = bih->snr;
-+    bss->ni_cie.ie_chan = bih->channel;
-+    A_ASSERT(bss->ni_buf != NULL);
-+    A_MEMCPY(bss->ni_buf, buf, len);
-+    wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
-+
-+    return A_OK;
-+}
-+
-+    /* This event indicates inactivity timeout of a fatpipe(pstream)
-+     * at the target
-+     */
-+static A_STATUS
-+wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_PSTREAM_TIMEOUT_EVENT *ev;
-+
-+    if (len < sizeof(WMI_PSTREAM_TIMEOUT_EVENT)) {
-+        return A_EINVAL;
-+    }
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "wmi_pstream_timeout_event_rx\n", DBGARG));
-+
-+    ev = (WMI_PSTREAM_TIMEOUT_EVENT *)datap;
-+
-+        /* When the pstream (fat pipe == AC) timesout, it means there were no
-+         * thinStreams within this pstream & it got implicitly created due to
-+         * data flow on this AC. We start the inactivity timer only for
-+         * implicitly created pstream. Just reset the host state.
-+         */
-+        /* Set the activeTsids for this AC to 0 */
-+    LOCK_WMI(wmip);
-+    wmip->wmi_streamExistsForAC[ev->trafficClass]=0;
-+    wmip->wmi_fatPipeExists &= ~(1 << ev->trafficClass);
-+    UNLOCK_WMI(wmip);
-+
-+        /*Indicate inactivity to driver layer for this fatpipe (pstream)*/
-+    A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, ev->trafficClass);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_BIT_RATE_CMD *reply;
-+    A_INT32 rate;
-+
-+    if (len < sizeof(WMI_BIT_RATE_CMD)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_BIT_RATE_CMD *)datap;
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - rateindex %d\n", DBGARG, reply->rateIndex));
-+
-+    if (reply->rateIndex == RATE_AUTO) {
-+        rate = RATE_AUTO;
-+    } else {
-+        rate = wmi_rateTable[(A_UINT32) reply->rateIndex];
-+    }
-+
-+    A_WMI_BITRATE_RX(wmip->wmi_devt, rate);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_FIX_RATES_CMD *reply;
-+
-+    if (len < sizeof(WMI_BIT_RATE_CMD)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_FIX_RATES_CMD *)datap;
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - fixed rate mask %x\n", DBGARG, reply->fixRateMask));
-+
-+    A_WMI_RATEMASK_RX(wmip->wmi_devt, reply->fixRateMask);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_CHANNEL_LIST_REPLY *reply;
-+
-+    if (len < sizeof(WMI_CHANNEL_LIST_REPLY)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_CHANNEL_LIST_REPLY *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_CHANNELLIST_RX(wmip->wmi_devt, reply->numChannels,
-+                          reply->channelList);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TX_PWR_REPLY *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TX_PWR_REPLY *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_TXPWR_RX(wmip->wmi_devt, reply->dbM);
-+
-+    return A_OK;
-+}
-+static A_STATUS
-+wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_GET_KEEPALIVE_CMD *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_GET_KEEPALIVE_CMD *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_KEEPALIVE_RX(wmip->wmi_devt, reply->configured);
-+
-+    return A_OK;
-+}
-+
-+
-+static A_STATUS
-+wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_DSETOPENREQ_EVENT *dsetopenreq;
-+
-+    if (len < sizeof(WMIX_DSETOPENREQ_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    dsetopenreq = (WMIX_DSETOPENREQ_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - dset_id=0x%x\n", DBGARG, dsetopenreq->dset_id));
-+    A_WMI_DSET_OPEN_REQ(wmip->wmi_devt,
-+                        dsetopenreq->dset_id,
-+                        dsetopenreq->targ_dset_handle,
-+                        dsetopenreq->targ_reply_fn,
-+                        dsetopenreq->targ_reply_arg);
-+
-+    return A_OK;
-+}
-+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+static A_STATUS
-+wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_DSETCLOSE_EVENT *dsetclose;
-+
-+    if (len < sizeof(WMIX_DSETCLOSE_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    dsetclose = (WMIX_DSETCLOSE_EVENT *)datap;
-+    A_WMI_DSET_CLOSE(wmip->wmi_devt, dsetclose->access_cookie);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_DSETDATAREQ_EVENT *dsetdatareq;
-+
-+    if (len < sizeof(WMIX_DSETDATAREQ_EVENT)) {
-+        return A_EINVAL;
-+    }
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    dsetdatareq = (WMIX_DSETDATAREQ_EVENT *)datap;
-+    A_WMI_DSET_DATA_REQ(wmip->wmi_devt,
-+                         dsetdatareq->access_cookie,
-+                         dsetdatareq->offset,
-+                         dsetdatareq->length,
-+                         dsetdatareq->targ_buf,
-+                         dsetdatareq->targ_reply_fn,
-+                         dsetdatareq->targ_reply_arg);
-+
-+    return A_OK;
-+}
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
-+
-+static A_STATUS
-+wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_SCAN_COMPLETE_EVENT *ev;
-+
-+    ev = (WMI_SCAN_COMPLETE_EVENT *)datap;
-+    A_WMI_SCANCOMPLETE_EVENT(wmip->wmi_devt, ev->status);
-+
-+    return A_OK;
-+}
-+
-+/*
-+ * Target is reporting a programming error.  This is for
-+ * developer aid only.  Target only checks a few common violations
-+ * and it is responsibility of host to do all error checking.
-+ * Behavior of target after wmi error event is undefined.
-+ * A reset is recommended.
-+ */
-+static A_STATUS
-+wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_CMD_ERROR_EVENT *ev;
-+
-+    ev = (WMI_CMD_ERROR_EVENT *)datap;
-+    AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Programming Error: cmd=%d ", ev->commandId));
-+    switch (ev->errorCode) {
-+    case (INVALID_PARAM):
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal Parameter\n"));
-+        break;
-+    case (ILLEGAL_STATE):
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal State\n"));
-+        break;
-+    case (INTERNAL_ERROR):
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Internal Error\n"));
-+        break;
-+    }
-+
-+    return A_OK;
-+}
-+
-+
-+static A_STATUS
-+wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TARGET_STATS *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TARGET_STATS *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_TARGETSTATS_EVENT(wmip->wmi_devt, reply);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_RSSI_THRESHOLD_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_RSSI_THRESHOLD_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_RSSI_THRESHOLD_EVENT(wmip->wmi_devt, reply->range, reply->rssi);
-+
-+    return A_OK;
-+}
-+
-+
-+static A_STATUS
-+wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TARGET_ERROR_REPORT_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TARGET_ERROR_REPORT_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_REPORT_ERROR_EVENT(wmip->wmi_devt, reply->errorVal);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_CAC_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_CAC_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_CAC_EVENT(wmip->wmi_devt, reply->ac,
-+                reply->cac_indication, reply->statusCode,
-+                reply->tspecSuggestion);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_HB_CHALLENGE_RESP_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMIX_HB_CHALLENGE_RESP_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "wmi: challenge response event\n", DBGARG));
-+
-+    A_WMI_HBCHALLENGERESP_EVENT(wmip->wmi_devt, reply->cookie, reply->source);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TARGET_ROAM_TBL *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TARGET_ROAM_TBL *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_ROAM_TABLE_EVENT(wmip->wmi_devt, reply);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TARGET_ROAM_DATA *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TARGET_ROAM_DATA *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_ROAM_DATA_EVENT(wmip->wmi_devt, reply);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_TX_RETRY_ERR_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_TX_RETRY_ERR_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_TX_RETRY_ERR_EVENT(wmip->wmi_devt);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_SNR_THRESHOLD_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_SNR_THRESHOLD_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_SNR_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->snr);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_LQ_THRESHOLD_EVENT *reply;
-+
-+    if (len < sizeof(*reply)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_LQ_THRESHOLD_EVENT *)datap;
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_LQ_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->lq);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    A_UINT16 ap_info_entry_size;
-+    WMI_APLIST_EVENT *ev = (WMI_APLIST_EVENT *)datap;
-+    WMI_AP_INFO_V1 *ap_info_v1;
-+    A_UINT8 i;
-+
-+    if (len < sizeof(WMI_APLIST_EVENT)) {
-+        return A_EINVAL;
-+    }
-+
-+    if (ev->apListVer == APLIST_VER1) {
-+        ap_info_entry_size = sizeof(WMI_AP_INFO_V1);
-+        ap_info_v1 = (WMI_AP_INFO_V1 *)ev->apList;
-+    } else {
-+        return A_EINVAL;
-+    }
-+
-+    AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Number of APs in APLIST Event is %d\n", ev->numAP));
-+    if (len < (int)(sizeof(WMI_APLIST_EVENT) +
-+              (ev->numAP - 1) * ap_info_entry_size))
-+    {
-+        return A_EINVAL;
-+    }
-+
-+    /*
-+     * AP List Ver1 Contents
-+     */
-+    for (i = 0; i < ev->numAP; i++) {
-+        AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("AP#%d BSSID %2.2x %2.2x %2.2x %2.2x %2.2x %2.2x "\
-+                    "Channel %d\n", i,
-+                   ap_info_v1->bssid[0], ap_info_v1->bssid[1],
-+                   ap_info_v1->bssid[2], ap_info_v1->bssid[3],
-+                   ap_info_v1->bssid[4], ap_info_v1->bssid[5],
-+                   ap_info_v1->channel));
-+        ap_info_v1++;
-+    }
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    A_UINT32 dropped;
-+
-+    dropped = *((A_UINT32 *)datap);
-+    datap += sizeof(dropped);
-+    len -= sizeof(dropped);
-+    A_WMI_DBGLOG_EVENT(wmip->wmi_devt, dropped, datap, len);
-+    return A_OK;
-+}
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+static A_STATUS
-+wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_GPIO_INTR_EVENT *gpio_intr = (WMIX_GPIO_INTR_EVENT *)datap;
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - intrmask=0x%x input=0x%x.\n", DBGARG,
-+        gpio_intr->intr_mask, gpio_intr->input_values));
-+
-+    A_WMI_GPIO_INTR_RX(gpio_intr->intr_mask, gpio_intr->input_values);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMIX_GPIO_DATA_EVENT *gpio_data = (WMIX_GPIO_DATA_EVENT *)datap;
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG,
-+        gpio_data->reg_id, gpio_data->value));
-+
-+    A_WMI_GPIO_DATA_RX(gpio_data->reg_id, gpio_data->value);
-+
-+    return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    A_WMI_GPIO_ACK_RX();
-+
-+    return A_OK;
-+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+/*
-+ * Called to send a wmi command. Command specific data is already built
-+ * on osbuf and current osbuf->data points to it.
-+ */
-+A_STATUS
-+wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+               WMI_SYNC_FLAG syncflag)
-+{
-+#define IS_LONG_CMD(cmdId) ((cmdId == WMI_OPT_TX_FRAME_CMDID) || (cmdId == WMI_ADD_WOW_PATTERN_CMDID))
-+    WMI_CMD_HDR         *cHdr;
-+    WMI_PRI_STREAM_ID   streamID = WMI_CONTROL_PRI;
-+
-+    A_ASSERT(osbuf != NULL);
-+
-+    if (syncflag >= END_WMIFLAG) {
-+        return A_EINVAL;
-+    }
-+
-+    if ((syncflag == SYNC_BEFORE_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
-+        /*
-+         * We want to make sure all data currently queued is transmitted before
-+         * the cmd execution.  Establish a new sync point.
-+         */
-+        wmi_sync_point(wmip);
-+    }
-+
-+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    cHdr = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+    cHdr->commandId = cmdId;
-+
-+    /*
-+     * Send cmd, some via control pipe, others via data pipe
-+     */
-+    if (IS_LONG_CMD(cmdId)) {
-+        wmi_data_hdr_add(wmip, osbuf, CNTL_MSGTYPE);
-+        // TODO ... these can now go through the control endpoint via HTC 2.0
-+        streamID = WMI_BEST_EFFORT_PRI;
-+    }
-+    A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID);
-+
-+    if ((syncflag == SYNC_AFTER_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
-+        /*
-+         * We want to make sure all new data queued waits for the command to
-+         * execute. Establish a new sync point.
-+         */
-+        wmi_sync_point(wmip);
-+    }
-+    return (A_OK);
-+#undef IS_LONG_CMD
-+}
-+
-+A_STATUS
-+wmi_cmd_send_xtnd(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+                  WMI_SYNC_FLAG syncflag)
-+{
-+    WMIX_CMD_HDR     *cHdr;
-+
-+    if (A_NETBUF_PUSH(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    cHdr = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+    cHdr->commandId = cmdId;
-+
-+    return wmi_cmd_send(wmip, osbuf, WMI_EXTENSION_CMDID, syncflag);
-+}
-+
-+A_STATUS
-+wmi_connect_cmd(struct wmi_t *wmip, NETWORK_TYPE netType,
-+                DOT11_AUTH_MODE dot11AuthMode, AUTH_MODE authMode,
-+                CRYPTO_TYPE pairwiseCrypto, A_UINT8 pairwiseCryptoLen,
-+                CRYPTO_TYPE groupCrypto,A_UINT8 groupCryptoLen,
-+                int ssidLength, A_UCHAR *ssid,
-+                A_UINT8 *bssid, A_UINT16 channel, A_UINT32 ctrl_flags)
-+{
-+    void *osbuf;
-+    WMI_CONNECT_CMD *cc;
-+
-+    if ((pairwiseCrypto == NONE_CRYPT) && (groupCrypto != NONE_CRYPT)) {
-+        return A_EINVAL;
-+    }
-+    if ((pairwiseCrypto != NONE_CRYPT) && (groupCrypto == NONE_CRYPT)) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_CONNECT_CMD));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(WMI_CONNECT_CMD));
-+
-+    cc = (WMI_CONNECT_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cc, sizeof(*cc));
-+
-+    A_MEMCPY(cc->ssid, ssid, ssidLength);
-+    cc->ssidLength          = ssidLength;
-+    cc->networkType         = netType;
-+    cc->dot11AuthMode       = dot11AuthMode;
-+    cc->authMode            = authMode;
-+    cc->pairwiseCryptoType  = pairwiseCrypto;
-+    cc->pairwiseCryptoLen   = pairwiseCryptoLen;
-+    cc->groupCryptoType     = groupCrypto;
-+    cc->groupCryptoLen      = groupCryptoLen;
-+    cc->channel             = channel;
-+    cc->ctrl_flags          = ctrl_flags;
-+
-+    if (bssid != NULL) {
-+        A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
-+    }
-+    if (wmi_set_keepalive_cmd(wmip, wmip->wmi_keepaliveInterval) != A_OK) {
-+        return(A_ERROR);
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_CONNECT_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_reconnect_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT16 channel)
-+{
-+    void *osbuf;
-+    WMI_RECONNECT_CMD *cc;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(WMI_RECONNECT_CMD));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(WMI_RECONNECT_CMD));
-+
-+    cc = (WMI_RECONNECT_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cc, sizeof(*cc));
-+
-+    cc->channel = channel;
-+
-+    if (bssid != NULL) {
-+        A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_RECONNECT_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_disconnect_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+    A_STATUS status;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    /* Bug fix for 24817(elevator bug) - the disconnect command does not
-+       need to do a SYNC before.*/
-+    status = (wmi_cmd_send(wmip, osbuf, WMI_DISCONNECT_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+
-+    return status;
-+}
-+
-+A_STATUS
-+wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
-+                  A_BOOL forceFgScan, A_BOOL isLegacy,
-+                  A_UINT32 homeDwellTime, A_UINT32 forceScanInterval)
-+{
-+    void *osbuf;
-+    WMI_START_SCAN_CMD *sc;
-+
-+    if ((scanType != WMI_LONG_SCAN) && (scanType != WMI_SHORT_SCAN)) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*sc));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*sc));
-+
-+    sc = (WMI_START_SCAN_CMD *)(A_NETBUF_DATA(osbuf));
-+    sc->scanType = scanType;
-+    sc->forceFgScan = forceFgScan;
-+    sc->isLegacy = isLegacy;
-+    sc->homeDwellTime = homeDwellTime;
-+    sc->forceScanInterval = forceScanInterval;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_START_SCAN_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
-+                   A_UINT16 fg_end_sec, A_UINT16 bg_sec,
-+                   A_UINT16 minact_chdw_msec, A_UINT16 maxact_chdw_msec,
-+                   A_UINT16 pas_chdw_msec,
-+                   A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
-+                   A_UINT32 max_dfsch_act_time)
-+{
-+    void *osbuf;
-+    WMI_SCAN_PARAMS_CMD *sc;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*sc));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*sc));
-+
-+    sc = (WMI_SCAN_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(sc, sizeof(*sc));
-+    sc->fg_start_period  = fg_start_sec;
-+    sc->fg_end_period    = fg_end_sec;
-+    sc->bg_period        = bg_sec;
-+    sc->minact_chdwell_time = minact_chdw_msec;
-+    sc->maxact_chdwell_time = maxact_chdw_msec;
-+    sc->pas_chdwell_time = pas_chdw_msec;
-+    sc->shortScanRatio   = shScanRatio;
-+    sc->scanCtrlFlags    = scanCtrlFlags;
-+    sc->max_dfsch_act_time = max_dfsch_act_time;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_SCAN_PARAMS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask)
-+{
-+    void *osbuf;
-+    WMI_BSS_FILTER_CMD *cmd;
-+
-+    if (filter >= LAST_BSS_FILTER) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_BSS_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->bssFilter = filter;
-+    cmd->ieMask = ieMask;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BSS_FILTER_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
-+                   A_UINT8 ssidLength, A_UCHAR *ssid)
-+{
-+    void *osbuf;
-+    WMI_PROBED_SSID_CMD *cmd;
-+
-+    if (index > MAX_PROBED_SSID_INDEX) {
-+        return A_EINVAL;
-+    }
-+    if (ssidLength > sizeof(cmd->ssid)) {
-+        return A_EINVAL;
-+    }
-+    if ((flag & (DISABLE_SSID_FLAG | ANY_SSID_FLAG)) && (ssidLength > 0)) {
-+        return A_EINVAL;
-+    }
-+    if ((flag & SPECIFIC_SSID_FLAG) && !ssidLength) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_PROBED_SSID_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->entryIndex = index;
-+    cmd->flag       = flag;
-+    cmd->ssidLength = ssidLength;
-+    A_MEMCPY(cmd->ssid, ssid, ssidLength);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PROBED_SSID_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons)
-+{
-+    void *osbuf;
-+    WMI_LISTEN_INT_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_LISTEN_INT_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->listenInterval = listenInterval;
-+    cmd->numBeacons = listenBeacons;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_LISTEN_INT_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmissTime, A_UINT16 bmissBeacons)
-+{
-+    void *osbuf;
-+    WMI_BMISS_TIME_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_BMISS_TIME_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->bmissTime = bmissTime;
-+    cmd->numBeacons =  bmissBeacons;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BMISS_TIME_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
-+                     A_UINT8 ieLen, A_UINT8 *ieInfo)
-+{
-+    void *osbuf;
-+    WMI_SET_ASSOC_INFO_CMD *cmd;
-+    A_UINT16 cmdLen;
-+
-+    cmdLen = sizeof(*cmd) + ieLen - 1;
-+    osbuf = A_NETBUF_ALLOC(cmdLen);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, cmdLen);
-+
-+    cmd = (WMI_SET_ASSOC_INFO_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, cmdLen);
-+    cmd->ieType = ieType;
-+    cmd->bufferSize = ieLen;
-+    A_MEMCPY(cmd->assocInfo, ieInfo, ieLen);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ASSOC_INFO_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode)
-+{
-+    void *osbuf;
-+    WMI_POWER_MODE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_POWER_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->powerMode = powerMode;
-+    wmip->wmi_powerMode = powerMode;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_MODE_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
-+                   A_UINT16 atim_windows, A_UINT16 timeout_value)
-+{
-+    void *osbuf;
-+    WMI_IBSS_PM_CAPS_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_IBSS_PM_CAPS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->power_saving = pmEnable;
-+    cmd->ttl = ttl;
-+    cmd->atim_windows = atim_windows;
-+    cmd->timeout_value = timeout_value;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_IBSS_PM_CAPS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
-+                 A_UINT16 psPollNum, A_UINT16 dtimPolicy)
-+{
-+    void *osbuf;
-+    WMI_POWER_PARAMS_CMD *pm;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*pm));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*pm));
-+
-+    pm = (WMI_POWER_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(pm, sizeof(*pm));
-+    pm->idle_period   = idlePeriod;
-+    pm->pspoll_number = psPollNum;
-+    pm->dtim_policy   = dtimPolicy;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_PARAMS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout)
-+{
-+    void *osbuf;
-+    WMI_DISC_TIMEOUT_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_DISC_TIMEOUT_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->disconnectTimeout = timeout;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_DISC_TIMEOUT_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex, CRYPTO_TYPE keyType,
-+               A_UINT8 keyUsage, A_UINT8 keyLength, A_UINT8 *keyRSC,
-+               A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
-+               WMI_SYNC_FLAG sync_flag)
-+{
-+    void *osbuf;
-+    WMI_ADD_CIPHER_KEY_CMD *cmd;
-+
-+    if ((keyIndex > WMI_MAX_KEY_INDEX) || (keyLength > WMI_MAX_KEY_LEN) ||
-+        (keyMaterial == NULL))
-+    {
-+        return A_EINVAL;
-+    }
-+
-+    if ((WEP_CRYPT != keyType) && (NULL == keyRSC)) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_ADD_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->keyIndex = keyIndex;
-+    cmd->keyType  = keyType;
-+    cmd->keyUsage = keyUsage;
-+    cmd->keyLength = keyLength;
-+    A_MEMCPY(cmd->key, keyMaterial, keyLength);
-+    if (NULL != keyRSC) {
-+        A_MEMCPY(cmd->keyRSC, keyRSC, sizeof(cmd->keyRSC));
-+    }
-+    cmd->key_op_ctrl = key_op_ctrl;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_CIPHER_KEY_CMDID, sync_flag));
-+}
-+
-+A_STATUS
-+wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk)
-+{
-+    void *osbuf;
-+    WMI_ADD_KRK_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_ADD_KRK_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    A_MEMCPY(cmd->krk, krk, WMI_KRK_LEN);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_KRK_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_delete_krk_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);
-+
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_KRK_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex)
-+{
-+    void *osbuf;
-+    WMI_DELETE_CIPHER_KEY_CMD *cmd;
-+
-+    if (keyIndex > WMI_MAX_KEY_INDEX) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_DELETE_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->keyIndex = keyIndex;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_CIPHER_KEY_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
-+                 A_BOOL set)
-+{
-+    void *osbuf;
-+    WMI_SET_PMKID_CMD *cmd;
-+
-+    if (bssid == NULL) {
-+        return A_EINVAL;
-+    }
-+
-+    if ((set == TRUE) && (pmkId == NULL)) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_PMKID_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+    if (set == TRUE) {
-+        A_MEMCPY(cmd->pmkid, pmkId, sizeof(cmd->pmkid));
-+        cmd->enable = PMKID_ENABLE;
-+    } else {
-+        A_MEMZERO(cmd->pmkid, sizeof(cmd->pmkid));
-+        cmd->enable = PMKID_DISABLE;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en)
-+{
-+    void *osbuf;
-+    WMI_SET_TKIP_COUNTERMEASURES_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_TKIP_COUNTERMEASURES_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->cm_en = (en == TRUE)? WMI_TKIP_CM_ENABLE : WMI_TKIP_CM_DISABLE;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TKIP_COUNTERMEASURES_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_akmp_params_cmd(struct wmi_t *wmip,
-+                        WMI_SET_AKMP_PARAMS_CMD *akmpParams)
-+{
-+    void *osbuf;
-+    WMI_SET_AKMP_PARAMS_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+    cmd = (WMI_SET_AKMP_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->akmpInfo = akmpParams->akmpInfo;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_AKMP_PARAMS_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
-+                       WMI_SET_PMKID_LIST_CMD *pmkInfo)
-+{
-+    void *osbuf;
-+    WMI_SET_PMKID_LIST_CMD *cmd;
-+    A_UINT16 cmdLen;
-+    A_UINT8 i;
-+
-+    cmdLen = sizeof(pmkInfo->numPMKID) +
-+             pmkInfo->numPMKID * sizeof(WMI_PMKID);
-+
-+    osbuf = A_NETBUF_ALLOC(cmdLen);
-+
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, cmdLen);
-+    cmd = (WMI_SET_PMKID_LIST_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->numPMKID = pmkInfo->numPMKID;
-+
-+    for (i = 0; i < cmd->numPMKID; i++) {
-+        A_MEMCPY(&cmd->pmkidList[i], &pmkInfo->pmkidList[i],
-+                 WMI_PMKID_LEN);
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_LIST_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_pmkid_list_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_PMKID_LIST_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_dataSync_send(struct wmi_t *wmip, void *osbuf, WMI_PRI_STREAM_ID streamID)
-+{
-+    WMI_DATA_HDR     *dtHdr;
-+
-+    A_ASSERT(streamID != WMI_CONTROL_PRI);
-+    A_ASSERT(osbuf != NULL);
-+
-+    if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
-+    dtHdr->info =
-+      (SYNC_MSGTYPE & WMI_DATA_HDR_MSG_TYPE_MASK) << WMI_DATA_HDR_MSG_TYPE_SHIFT;
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - streamID %d\n", DBGARG, streamID));
-+
-+    return (A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID));
-+}
-+
-+typedef struct _WMI_DATA_SYNC_BUFS {
-+    A_UINT8            trafficClass;
-+    void               *osbuf;
-+}WMI_DATA_SYNC_BUFS;
-+
-+static A_STATUS
-+wmi_sync_point(struct wmi_t *wmip)
-+{
-+	void *cmd_osbuf;
-+    WMI_DATA_SYNC_BUFS dataSyncBufs[WMM_NUM_AC];
-+	A_UINT8 i,numPriStreams=0;
-+	A_STATUS status;
-+
-+	A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    memset(dataSyncBufs,0,sizeof(dataSyncBufs));
-+
-+    /* lock out while we walk through the priority list and assemble our local array */
-+    LOCK_WMI(wmip);
-+
-+    for (i=0; i < WMM_NUM_AC ; i++) {
-+		if (wmip->wmi_fatPipeExists & (1 << i)) {
-+            numPriStreams++;
-+            dataSyncBufs[numPriStreams-1].trafficClass = i;
-+        }
-+    }
-+
-+    UNLOCK_WMI(wmip);
-+
-+    /* dataSyncBufs is now filled with entries (starting at index 0) containing valid streamIDs */
-+
-+    do {
-+	    /*
-+	     * We allocate all network buffers needed so we will be able to
-+	     * send all required frames.
-+	     */
-+	    cmd_osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+	    if (cmd_osbuf == NULL) {
-+		    status = A_NO_MEMORY;
-+            break;
-+	    }
-+
-+	    for (i=0; i < numPriStreams ; i++) {
-+	        dataSyncBufs[i].osbuf = A_NETBUF_ALLOC(0);
-+            if (dataSyncBufs[i].osbuf == NULL) {
-+                status = A_NO_MEMORY;
-+                break;
-+            }
-+	    } //end for
-+
-+	    /*
-+	     * Send sync cmd followed by sync data messages on all endpoints being
-+	     * used
-+	     */
-+	    status = wmi_cmd_send(wmip, cmd_osbuf, WMI_SYNCHRONIZE_CMDID,
-+						  NO_SYNC_WMIFLAG);
-+
-+        if (A_FAILED(status)) {
-+            break;
-+        }
-+            /* cmd buffer sent, we no longer own it */
-+        cmd_osbuf = NULL;
-+
-+		for(i=0; i < numPriStreams; i++) {
-+            A_ASSERT(dataSyncBufs[i].osbuf != NULL);
-+
-+            status = wmi_dataSync_send(wmip, dataSyncBufs[i].osbuf,
-+                        WMI_ACCESSCATEGORY_WMISTREAM(wmip,dataSyncBufs[i].trafficClass));
-+
-+            if (A_FAILED(status)) {
-+                break;
-+            }
-+            /* we don't own this buffer anymore, NULL it out of the array so it
-+             * won't get cleaned up */
-+            dataSyncBufs[i].osbuf = NULL;
-+		} //end for
-+
-+    } while(FALSE);
-+
-+    /* free up any resources left over (possibly due to an error) */
-+
-+    if (cmd_osbuf != NULL) {
-+        A_NETBUF_FREE(cmd_osbuf);
-+    }
-+
-+    for (i = 0; i < numPriStreams; i++) {
-+        if (dataSyncBufs[i].osbuf != NULL) {
-+            A_NETBUF_FREE(dataSyncBufs[i].osbuf);
-+        }
-+    }
-+
-+	return (status);
-+}
-+
-+A_STATUS
-+wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *params)
-+{
-+    void *osbuf;
-+    WMI_CREATE_PSTREAM_CMD *cmd;
-+	A_UINT16 activeTsids=0;
-+    A_UINT8 fatPipeExistsForAC=0;
-+
-+    /* Validate all the parameters. */
-+    if( !((params->userPriority < 8) &&
-+         (params->userPriority <= 0x7) &&
-+         (convert_userPriority_to_trafficClass(params->userPriority) == params->trafficClass)  &&
-+         (params->trafficDirection == UPLINK_TRAFFIC ||
-+            params->trafficDirection == DNLINK_TRAFFIC ||
-+            params->trafficDirection == BIDIR_TRAFFIC) &&
-+         (params->trafficType == TRAFFIC_TYPE_APERIODIC ||
-+            params->trafficType == TRAFFIC_TYPE_PERIODIC ) &&
-+         (params->voicePSCapability == DISABLE_FOR_THIS_AC  ||
-+            params->voicePSCapability == ENABLE_FOR_THIS_AC ||
-+            params->voicePSCapability == ENABLE_FOR_ALL_AC) &&
-+         (params->tsid == WMI_IMPLICIT_PSTREAM || params->tsid <= WMI_MAX_THINSTREAM)) )
-+    {
-+        return  A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Sending create_pstream_cmd: ac=%d    tsid:%d\n", DBGARG,
-+        params->trafficClass, params->tsid));
-+
-+    cmd = (WMI_CREATE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    A_MEMCPY(cmd, params, sizeof(*cmd));
-+
-+        /* this is an implicitly created Fat pipe */
-+    if (params->tsid == WMI_IMPLICIT_PSTREAM) {
-+        LOCK_WMI(wmip);
-+        fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
-+        wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
-+        UNLOCK_WMI(wmip);
-+    } else {
-+            /* this is an explicitly created thin stream within a fat pipe */
-+        LOCK_WMI(wmip);
-+        fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
-+        activeTsids = wmip->wmi_streamExistsForAC[params->trafficClass];
-+        wmip->wmi_streamExistsForAC[params->trafficClass] |= (1<<params->tsid);
-+            /* if a thinstream becomes active, the fat pipe automatically
-+            * becomes active
-+            */
-+        wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
-+        UNLOCK_WMI(wmip);
-+    }
-+
-+        /* Indicate activty change to driver layer only if this is the
-+         * first TSID to get created in this AC explicitly or an implicit
-+         * fat pipe is getting created.
-+         */
-+    if (!fatPipeExistsForAC) {
-+        A_WMI_STREAM_TX_ACTIVE(wmip->wmi_devt, params->trafficClass);
-+    }
-+
-+    /* mike: should be SYNC_BEFORE_WMIFLAG */
-+    return (wmi_cmd_send(wmip, osbuf, WMI_CREATE_PSTREAM_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 tsid)
-+{
-+    void *osbuf;
-+    WMI_DELETE_PSTREAM_CMD *cmd;
-+    A_STATUS status;
-+	A_UINT16 activeTsids=0;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_DELETE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+
-+    cmd->trafficClass = trafficClass;
-+    cmd->tsid = tsid;
-+
-+    LOCK_WMI(wmip);
-+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
-+    UNLOCK_WMI(wmip);
-+
-+        /* Check if the tsid was created & exists */
-+    if (!(activeTsids & (1<<tsid))) {
-+
-+        A_DPRINTF(DBG_WMI,
-+        (DBGFMT "TSID %d does'nt exist for trafficClass: %d\n", DBGARG, tsid, trafficClass));
-+            /* TODO: return a more appropriate err code */
-+        return A_ERROR;
-+    }
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Sending delete_pstream_cmd: trafficClass: %d tsid=%d\n", DBGARG, trafficClass, tsid));
-+
-+    status = (wmi_cmd_send(wmip, osbuf, WMI_DELETE_PSTREAM_CMDID,
-+                         SYNC_BEFORE_WMIFLAG));
-+
-+    LOCK_WMI(wmip);
-+    wmip->wmi_streamExistsForAC[trafficClass] &= ~(1<<tsid);
-+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
-+    UNLOCK_WMI(wmip);
-+
-+
-+        /* Indicate stream inactivity to driver layer only if all tsids
-+         * within this AC are deleted.
-+         */
-+    if(!activeTsids) {
-+        A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, trafficClass);
-+        wmip->wmi_fatPipeExists &= ~(1<<trafficClass);
-+    }
-+
-+    return status;
-+}
-+
-+/*
-+ * used to set the bit rate.  rate is in Kbps.  If rate == -1
-+ * then auto selection is used.
-+ */
-+A_STATUS
-+wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate)
-+{
-+    void *osbuf;
-+    WMI_BIT_RATE_CMD *cmd;
-+    A_INT8 index;
-+
-+    if (rate != -1) {
-+        index = wmi_validate_bitrate(wmip, rate);
-+        if(index == A_EINVAL){
-+            return A_EINVAL;
-+        }
-+    } else {
-+        index = -1;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_BIT_RATE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+
-+    cmd->rateIndex = index;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_bitrate_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+/*
-+ * Returns TRUE iff the given rate index is legal in the current PHY mode.
-+ */
-+A_BOOL
-+wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex)
-+{
-+    WMI_PHY_MODE phyMode = wmip->wmi_phyMode;
-+    A_BOOL isValid = TRUE;
-+    switch(phyMode) {
-+        case WMI_11A_MODE:
-+            if ((rateIndex < MODE_A_SUPPORT_RATE_START) || (rateIndex > MODE_A_SUPPORT_RATE_STOP)) {
-+                isValid = FALSE;
-+            }
-+            break;
-+
-+        case WMI_11B_MODE:
-+            if ((rateIndex < MODE_B_SUPPORT_RATE_START) || (rateIndex > MODE_B_SUPPORT_RATE_STOP)) {
-+                isValid = FALSE;
-+            }
-+            break;
-+
-+        case WMI_11GONLY_MODE:
-+            if ((rateIndex < MODE_GONLY_SUPPORT_RATE_START) || (rateIndex > MODE_GONLY_SUPPORT_RATE_STOP)) {
-+                isValid = FALSE;
-+            }
-+            break;
-+
-+        case WMI_11G_MODE:
-+        case WMI_11AG_MODE:
-+            if ((rateIndex < MODE_G_SUPPORT_RATE_START) || (rateIndex > MODE_G_SUPPORT_RATE_STOP)) {
-+                isValid = FALSE;
-+            }
-+            break;
-+
-+        default:
-+            A_ASSERT(FALSE);
-+            break;
-+    }
-+
-+    return isValid;
-+}
-+
-+A_INT8
-+wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate)
-+{
-+    A_INT8 i;
-+    if (rate != -1)
-+    {
-+        for (i=0;;i++)
-+        {
-+            if (wmi_rateTable[(A_UINT32) i] == 0) {
-+                return A_EINVAL;
-+            }
-+            if (wmi_rateTable[(A_UINT32) i] == rate) {
-+                break;
-+            }
-+        }
-+    }
-+    else{
-+     i = -1;
-+    }
-+
-+    if(wmi_is_bitrate_index_valid(wmip, i) != TRUE) {
-+        return A_EINVAL;
-+    }
-+
-+    return i;
-+}
-+
-+A_STATUS
-+wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask)
-+{
-+    void *osbuf;
-+    WMI_FIX_RATES_CMD *cmd;
-+    A_UINT32 rateIndex;
-+
-+    /* Make sure all rates in the mask are valid in the current PHY mode */
-+    for(rateIndex = 0; rateIndex < MAX_NUMBER_OF_SUPPORT_RATES; rateIndex++) {
-+       if((1 << rateIndex) & (A_UINT32)fixRatesMask) {
-+            if(wmi_is_bitrate_index_valid(wmip, rateIndex) != TRUE) {
-+                A_DPRINTF(DBG_WMI, (DBGFMT "Set Fix Rates command failed: Given rate is illegal in current PHY mode\n", DBGARG));
-+                return A_EINVAL;
-+            }
-+       }
-+    }
-+
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_FIX_RATES_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+
-+    cmd->fixRateMask = fixRatesMask;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_ratemask_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_channelList_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_CHANNEL_LIST_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+/*
-+ * used to generate a wmi sey channel Parameters cmd.
-+ * mode should always be specified and corresponds to the phy mode of the
-+ * wlan.
-+ * numChan should alway sbe specified. If zero indicates that all available
-+ * channels should be used.
-+ * channelList is an array of channel frequencies (in Mhz) which the radio
-+ * should limit its operation to.  It should be NULL if numChan == 0.  Size of
-+ * array should correspond to numChan entries.
-+ */
-+A_STATUS
-+wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
-+                          WMI_PHY_MODE mode, A_INT8 numChan,
-+                          A_UINT16 *channelList)
-+{
-+    void *osbuf;
-+    WMI_CHANNEL_PARAMS_CMD *cmd;
-+    A_INT8 size;
-+
-+    size = sizeof (*cmd);
-+
-+    if (numChan) {
-+        if (numChan > WMI_MAX_CHANNELS) {
-+            return A_EINVAL;
-+        }
-+        size += sizeof(A_UINT16) * (numChan - 1);
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_CHANNEL_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+
-+    wmip->wmi_phyMode = mode;
-+    cmd->scanParam   = scanParam;
-+    cmd->phyMode     = mode;
-+    cmd->numChannels = numChan;
-+    A_MEMCPY(cmd->channelList, channelList, numChan * sizeof(A_UINT16));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_CHANNEL_PARAMS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_rssi_threshold_params(struct wmi_t *wmip,
-+                              WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_RSSI_THRESHOLD_PARAMS_CMD *cmd;
-+    /* These values are in ascending order */
-+    if( rssiCmd->thresholdAbove6_Val <= rssiCmd->thresholdAbove5_Val ||
-+        rssiCmd->thresholdAbove5_Val <= rssiCmd->thresholdAbove4_Val ||
-+        rssiCmd->thresholdAbove4_Val <= rssiCmd->thresholdAbove3_Val ||
-+        rssiCmd->thresholdAbove3_Val <= rssiCmd->thresholdAbove2_Val ||
-+        rssiCmd->thresholdAbove2_Val <= rssiCmd->thresholdAbove1_Val ||
-+        rssiCmd->thresholdBelow6_Val <= rssiCmd->thresholdBelow5_Val ||
-+        rssiCmd->thresholdBelow5_Val <= rssiCmd->thresholdBelow4_Val ||
-+        rssiCmd->thresholdBelow4_Val <= rssiCmd->thresholdBelow3_Val ||
-+        rssiCmd->thresholdBelow3_Val <= rssiCmd->thresholdBelow2_Val ||
-+        rssiCmd->thresholdBelow2_Val <= rssiCmd->thresholdBelow1_Val) {
-+
-+        return A_EINVAL;
-+    }
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_RSSI_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, rssiCmd, sizeof(WMI_RSSI_THRESHOLD_PARAMS_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_RSSI_THRESHOLD_PARAMS_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip,
-+                              WMI_SET_HOST_SLEEP_MODE_CMD *hostModeCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_SET_HOST_SLEEP_MODE_CMD *cmd;
-+
-+    if( hostModeCmd->awake == hostModeCmd->asleep) {
-+        return A_EINVAL;
-+    }
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_SET_HOST_SLEEP_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, hostModeCmd, sizeof(WMI_SET_HOST_SLEEP_MODE_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_HOST_SLEEP_MODE_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_wow_mode_cmd(struct wmi_t *wmip,
-+                              WMI_SET_WOW_MODE_CMD *wowModeCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_SET_WOW_MODE_CMD *cmd;
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_SET_WOW_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, wowModeCmd, sizeof(WMI_SET_WOW_MODE_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WOW_MODE_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+
-+}
-+
-+A_STATUS
-+wmi_get_wow_list_cmd(struct wmi_t *wmip,
-+                              WMI_GET_WOW_LIST_CMD *wowListCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_GET_WOW_LIST_CMD *cmd;
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_GET_WOW_LIST_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, wowListCmd, sizeof(WMI_GET_WOW_LIST_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_WOW_LIST_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+
-+}
-+
-+static A_STATUS
-+wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+    WMI_GET_WOW_LIST_REPLY *reply;
-+
-+    if (len < sizeof(WMI_GET_WOW_LIST_REPLY)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_GET_WOW_LIST_REPLY *)datap;
-+
-+    A_WMI_WOW_LIST_EVENT(wmip->wmi_devt, reply->num_filters,
-+                          reply);
-+
-+    return A_OK;
-+}
-+
-+A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
-+                                 WMI_ADD_WOW_PATTERN_CMD *addWowCmd,
-+                                 A_UINT8* pattern, A_UINT8* mask,
-+                                 A_UINT8 pattern_size)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_ADD_WOW_PATTERN_CMD *cmd;
-+    A_UINT8 *filter_mask = NULL;
-+
-+    size = sizeof (*cmd);
-+
-+    size += ((2 * addWowCmd->filter_size)* sizeof(A_UINT8));
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_ADD_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->filter_list_id = addWowCmd->filter_list_id;
-+    cmd->filter_offset = addWowCmd->filter_offset;
-+    cmd->filter_size = addWowCmd->filter_size;
-+
-+    A_MEMCPY(cmd->filter, pattern, addWowCmd->filter_size);
-+
-+    filter_mask = (A_UINT8*)(cmd->filter + cmd->filter_size);
-+    A_MEMCPY(filter_mask, mask, addWowCmd->filter_size);
-+
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_WOW_PATTERN_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
-+                              WMI_DEL_WOW_PATTERN_CMD *delWowCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_DEL_WOW_PATTERN_CMD *cmd;
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_DEL_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, delWowCmd, sizeof(WMI_DEL_WOW_PATTERN_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_DEL_WOW_PATTERN_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+
-+}
-+
-+A_STATUS
-+wmi_set_snr_threshold_params(struct wmi_t *wmip,
-+                             WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_SNR_THRESHOLD_PARAMS_CMD *cmd;
-+    /* These values are in ascending order */
-+    if( snrCmd->thresholdAbove4_Val <= snrCmd->thresholdAbove3_Val ||
-+        snrCmd->thresholdAbove3_Val <= snrCmd->thresholdAbove2_Val ||
-+        snrCmd->thresholdAbove2_Val <= snrCmd->thresholdAbove1_Val ||
-+        snrCmd->thresholdBelow4_Val <= snrCmd->thresholdBelow3_Val ||
-+        snrCmd->thresholdBelow3_Val <= snrCmd->thresholdBelow2_Val ||
-+        snrCmd->thresholdBelow2_Val <= snrCmd->thresholdBelow1_Val) {
-+
-+        return A_EINVAL;
-+    }
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_SNR_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, snrCmd, sizeof(WMI_SNR_THRESHOLD_PARAMS_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SNR_THRESHOLD_PARAMS_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_clr_rssi_snr(struct wmi_t *wmip)
-+{
-+    void    *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(int));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_CLR_RSSI_SNR_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_lq_threshold_params(struct wmi_t *wmip,
-+                             WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_LQ_THRESHOLD_PARAMS_CMD *cmd;
-+    /* These values are in ascending order */
-+    if( lqCmd->thresholdAbove4_Val <= lqCmd->thresholdAbove3_Val ||
-+        lqCmd->thresholdAbove3_Val <= lqCmd->thresholdAbove2_Val ||
-+        lqCmd->thresholdAbove2_Val <= lqCmd->thresholdAbove1_Val ||
-+        lqCmd->thresholdBelow4_Val <= lqCmd->thresholdBelow3_Val ||
-+        lqCmd->thresholdBelow3_Val <= lqCmd->thresholdBelow2_Val ||
-+        lqCmd->thresholdBelow2_Val <= lqCmd->thresholdBelow1_Val ) {
-+
-+        return A_EINVAL;
-+    }
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_LQ_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+    A_MEMCPY(cmd, lqCmd, sizeof(WMI_LQ_THRESHOLD_PARAMS_CMD));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_LQ_THRESHOLD_PARAMS_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 mask)
-+{
-+    void    *osbuf;
-+    A_INT8  size;
-+    WMI_TARGET_ERROR_REPORT_BITMASK *cmd;
-+
-+    size = sizeof (*cmd);
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_TARGET_ERROR_REPORT_BITMASK *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+
-+    cmd->bitmask = mask;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
-+                            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie, A_UINT32 source)
-+{
-+    void *osbuf;
-+    WMIX_HB_CHALLENGE_RESP_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMIX_HB_CHALLENGE_RESP_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->cookie = cookie;
-+    cmd->source = source;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_HB_CHALLENGE_RESP_CMDID,
-+                              NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
-+                            A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
-+                            A_UINT32 valid)
-+{
-+    void *osbuf;
-+    WMIX_DBGLOG_CFG_MODULE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMIX_DBGLOG_CFG_MODULE_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->config.cfgmmask = mmask;
-+    cmd->config.cfgtsr = tsr;
-+    cmd->config.cfgrep = rep;
-+    cmd->config.cfgsize = size;
-+    cmd->config.cfgvalid = valid;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DBGLOG_CFG_MODULE_CMDID,
-+                              NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_stats_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_STATISTICS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid)
-+{
-+    void *osbuf;
-+    WMI_ADD_BAD_AP_CMD *cmd;
-+
-+    if ((bssid == NULL) || (apIndex > WMI_MAX_BAD_AP_INDEX)) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_ADD_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->badApIndex = apIndex;
-+    A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_ADD_BAD_AP_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex)
-+{
-+    void *osbuf;
-+    WMI_DELETE_BAD_AP_CMD *cmd;
-+
-+    if (apIndex > WMI_MAX_BAD_AP_INDEX) {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_DELETE_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->badApIndex = apIndex;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_BAD_AP_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM)
-+{
-+    void *osbuf;
-+    WMI_SET_TX_PWR_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_TX_PWR_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->dbM = dbM;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_txPwr_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on)
-+{
-+	WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
-+					WMI_SHORTSCANRATIO_DEFAULT,
-+					DEFAULT_SCAN_CTRL_FLAGS,
-+					0};
-+
-+	if (on) {
-+		/* Enable foreground scanning */
-+                if (wmi_scanparams_cmd(wmip, scParams.fg_start_period,
-+                                       scParams.fg_end_period,
-+                                       scParams.bg_period,
-+                                       scParams.minact_chdwell_time,
-+                                       scParams.maxact_chdwell_time,
-+                                       scParams.pas_chdwell_time,
-+                                       scParams.shortScanRatio,
-+                                       scParams.scanCtrlFlags,
-+                                       scParams.max_dfsch_act_time) != A_OK) {
-+			return -EIO;
-+		}
-+	} else {
-+		wmi_disconnect_cmd(wmip);
-+		if (wmi_scanparams_cmd(wmip, 0xFFFF, 0, 0, 0,
-+				       0, 0, 0, 0xFF, 0) != A_OK) {
-+			return -EIO;
-+		}
-+	}
-+
-+	return A_OK;
-+}
-+
-+
-+A_UINT16
-+wmi_get_mapped_qos_queue(struct wmi_t *wmip, A_UINT8 trafficClass)
-+{
-+	A_UINT16 activeTsids=0;
-+
-+    LOCK_WMI(wmip);
-+    activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
-+    UNLOCK_WMI(wmip);
-+
-+    return activeTsids;
-+}
-+
-+A_STATUS
-+wmi_get_roam_tbl_cmd(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    osbuf = A_NETBUF_ALLOC(0);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_TBL_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType)
-+{
-+    void *osbuf;
-+    A_UINT32 size = sizeof(A_UINT8);
-+    WMI_TARGET_ROAM_DATA *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(size);      /* no payload */
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_TARGET_ROAM_DATA *)(A_NETBUF_DATA(osbuf));
-+    cmd->roamDataType = roamDataType;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_DATA_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
-+                      A_UINT8 size)
-+{
-+    void *osbuf;
-+    WMI_SET_ROAM_CTRL_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_SET_ROAM_CTRL_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+
-+    A_MEMCPY(cmd, p, size);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ROAM_CTRL_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
-+                            WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
-+                            A_UINT8 size)
-+{
-+    void *osbuf;
-+    WMI_POWERSAVE_TIMERS_POLICY_CMD *cmd;
-+
-+    /* These timers can't be zero */
-+    if(!pCmd->psPollTimeout || !pCmd->triggerTimeout ||
-+       !(pCmd->apsdTimPolicy == IGNORE_TIM_ALL_QUEUES_APSD ||
-+         pCmd->apsdTimPolicy == PROCESS_TIM_ALL_QUEUES_APSD) ||
-+       !(pCmd->simulatedAPSDTimPolicy == IGNORE_TIM_SIMULATED_APSD ||
-+         pCmd->simulatedAPSDTimPolicy == PROCESS_TIM_SIMULATED_APSD))
-+        return A_EINVAL;
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, size);
-+
-+    cmd = (WMI_POWERSAVE_TIMERS_POLICY_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, size);
-+
-+    A_MEMCPY(cmd, pCmd, size);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+/* Send a command to Target to change GPIO output pins. */
-+A_STATUS
-+wmi_gpio_output_set(struct wmi_t *wmip,
-+                    A_UINT32 set_mask,
-+                    A_UINT32 clear_mask,
-+                    A_UINT32 enable_mask,
-+                    A_UINT32 disable_mask)
-+{
-+    void *osbuf;
-+    WMIX_GPIO_OUTPUT_SET_CMD *output_set;
-+    int size;
-+
-+    size = sizeof(*output_set);
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - set=0x%x clear=0x%x enb=0x%x dis=0x%x\n", DBGARG,
-+        set_mask, clear_mask, enable_mask, disable_mask));
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, size);
-+    output_set = (WMIX_GPIO_OUTPUT_SET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    output_set->set_mask                   = set_mask;
-+    output_set->clear_mask                 = clear_mask;
-+    output_set->enable_mask                = enable_mask;
-+    output_set->disable_mask               = disable_mask;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_OUTPUT_SET_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target requesting state of the GPIO input pins */
-+A_STATUS
-+wmi_gpio_input_get(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    osbuf = A_NETBUF_ALLOC(0);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INPUT_GET_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target that changes the value of a GPIO register. */
-+A_STATUS
-+wmi_gpio_register_set(struct wmi_t *wmip,
-+                      A_UINT32 gpioreg_id,
-+                      A_UINT32 value)
-+{
-+    void *osbuf;
-+    WMIX_GPIO_REGISTER_SET_CMD *register_set;
-+    int size;
-+
-+    size = sizeof(*register_set);
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG, gpioreg_id, value));
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, size);
-+    register_set = (WMIX_GPIO_REGISTER_SET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    register_set->gpioreg_id               = gpioreg_id;
-+    register_set->value                    = value;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_SET_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target to fetch the value of a GPIO register. */
-+A_STATUS
-+wmi_gpio_register_get(struct wmi_t *wmip,
-+                      A_UINT32 gpioreg_id)
-+{
-+    void *osbuf;
-+    WMIX_GPIO_REGISTER_GET_CMD *register_get;
-+    int size;
-+
-+    size = sizeof(*register_get);
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - reg=%d\n", DBGARG, gpioreg_id));
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, size);
-+    register_get = (WMIX_GPIO_REGISTER_GET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    register_get->gpioreg_id               = gpioreg_id;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_GET_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target acknowledging some GPIO interrupts. */
-+A_STATUS
-+wmi_gpio_intr_ack(struct wmi_t *wmip,
-+                  A_UINT32 ack_mask)
-+{
-+    void *osbuf;
-+    WMIX_GPIO_INTR_ACK_CMD *intr_ack;
-+    int size;
-+
-+    size = sizeof(*intr_ack);
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter ack_mask=0x%x\n", DBGARG, ack_mask));
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, size);
-+    intr_ack = (WMIX_GPIO_INTR_ACK_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    intr_ack->ack_mask               = ack_mask;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INTR_ACK_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+
-+A_STATUS
-+wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop, A_UINT8 eCWmin,
-+                          A_UINT8 eCWmax, A_UINT8 aifsn)
-+{
-+    void *osbuf;
-+    WMI_SET_ACCESS_PARAMS_CMD *cmd;
-+
-+    if ((eCWmin > WMI_MAX_CW_ACPARAM) || (eCWmax > WMI_MAX_CW_ACPARAM) ||
-+        (aifsn > WMI_MAX_AIFSN_ACPARAM))
-+    {
-+        return A_EINVAL;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_ACCESS_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->txop   = txop;
-+    cmd->eCWmin = eCWmin;
-+    cmd->eCWmax = eCWmax;
-+    cmd->aifsn  = aifsn;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_ACCESS_PARAMS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
-+                         A_UINT8 trafficClass, A_UINT8 maxRetries,
-+                         A_UINT8 enableNotify)
-+{
-+    void *osbuf;
-+    WMI_SET_RETRY_LIMITS_CMD *cmd;
-+
-+    if ((frameType != MGMT_FRAMETYPE) && (frameType != CONTROL_FRAMETYPE) &&
-+        (frameType != DATA_FRAMETYPE))
-+    {
-+        return A_EINVAL;
-+    }
-+
-+    if (maxRetries > WMI_MAX_RETRIES) {
-+        return A_EINVAL;
-+    }
-+
-+    if (frameType != DATA_FRAMETYPE) {
-+        trafficClass = 0;
-+    }
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_RETRY_LIMITS_CMD *)(A_NETBUF_DATA(osbuf));
-+    cmd->frameType    = frameType;
-+    cmd->trafficClass = trafficClass;
-+    cmd->maxRetries   = maxRetries;
-+    cmd->enableNotify = enableNotify;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_RETRY_LIMITS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+void
-+wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid)
-+{
-+    if (bssid != NULL) {
-+        A_MEMCPY(bssid, wmip->wmi_bssid, ATH_MAC_LEN);
-+    }
-+}
-+
-+A_STATUS
-+wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode)
-+{
-+    void *osbuf;
-+    WMI_SET_OPT_MODE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_OPT_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->optMode = optMode;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_OPT_MODE_CMDID,
-+                         SYNC_BOTH_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
-+                      A_UINT8 frmType,
-+                      A_UINT8 *dstMacAddr,
-+                      A_UINT8 *bssid,
-+                      A_UINT16 optIEDataLen,
-+                      A_UINT8 *optIEData)
-+{
-+    void *osbuf;
-+    WMI_OPT_TX_FRAME_CMD *cmd;
-+    osbuf = A_NETBUF_ALLOC(optIEDataLen + sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, (optIEDataLen + sizeof(*cmd)));
-+
-+    cmd = (WMI_OPT_TX_FRAME_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, (optIEDataLen + sizeof(*cmd)-1));
-+
-+    cmd->frmType    = frmType;
-+    cmd->optIEDataLen   = optIEDataLen;
-+    //cmd->optIEData     = (A_UINT8 *)((int)cmd + sizeof(*cmd));
-+    A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+    A_MEMCPY(cmd->dstAddr, dstMacAddr, sizeof(cmd->dstAddr));
-+    A_MEMCPY(&cmd->optIEData[0], optIEData, optIEDataLen);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_OPT_TX_FRAME_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl)
-+{
-+    void *osbuf;
-+    WMI_BEACON_INT_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_BEACON_INT_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->beaconInterval = intvl;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BEACON_INT_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+
-+A_STATUS
-+wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize)
-+{
-+    void *osbuf;
-+    WMI_SET_VOICE_PKT_SIZE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_VOICE_PKT_SIZE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->voicePktSize = voicePktSize;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_VOICE_PKT_SIZE_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+
-+A_STATUS
-+wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSPLen)
-+{
-+    void *osbuf;
-+    WMI_SET_MAX_SP_LEN_CMD *cmd;
-+
-+    /* maxSPLen is a two-bit value. If user trys to set anything
-+     * other than this, then its invalid
-+     */
-+    if(maxSPLen & ~0x03)
-+        return  A_EINVAL;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_MAX_SP_LEN_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->maxSPLen = maxSPLen;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_MAX_SP_LEN_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_UINT8
-+convert_userPriority_to_trafficClass(A_UINT8 userPriority)
-+{
-+        return  (up_to_ac[userPriority & 0x7]);
-+}
-+
-+A_UINT8
-+wmi_get_power_mode_cmd(struct wmi_t *wmip)
-+{
-+    return wmip->wmi_powerMode;
-+}
-+
-+A_STATUS
-+wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance)
-+{
-+    return A_OK;
-+}
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+static A_STATUS
-+wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+
-+   A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+   A_WMI_TCMD_RX_REPORT_EVENT(wmip->wmi_devt, datap, len);
-+
-+   return A_OK;
-+}
-+
-+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
-+
-+A_STATUS
-+wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
-+{
-+    void *osbuf;
-+    WMI_SET_AUTH_MODE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_AUTH_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->mode = mode;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_AUTH_MODE_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
-+{
-+    void *osbuf;
-+    WMI_SET_REASSOC_MODE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_REASSOC_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->mode = mode;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_REASSOC_MODE_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status)
-+{
-+    void *osbuf;
-+    WMI_SET_LPREAMBLE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_LPREAMBLE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->status = status;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_LPREAMBLE_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold)
-+{
-+    void *osbuf;
-+    WMI_SET_RTS_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_RTS_CMD*)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->threshold = threshold;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_RTS_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status)
-+{
-+    void *osbuf;
-+    WMI_SET_WMM_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_WMM_CMD*)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->status = status;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_CMDID,
-+            NO_SYNC_WMIFLAG));
-+
-+}
-+
-+A_STATUS
-+wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG cfg)
-+{
-+    void *osbuf;
-+    WMI_SET_WMM_TXOP_CMD *cmd;
-+
-+    if( !((cfg == WMI_TXOP_DISABLED) || (cfg == WMI_TXOP_ENABLED)) )
-+        return A_EINVAL;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_WMM_TXOP_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->txopEnable = cfg;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_TXOP_CMDID,
-+            NO_SYNC_WMIFLAG));
-+
-+}
-+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/* WMI  layer doesn't need to know the data type of the test cmd.
-+   This would be beneficial for customers like Qualcomm, who might
-+   have different test command requirements from differnt manufacturers
-+ */
-+A_STATUS
-+wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32  len)
-+{
-+    void *osbuf;
-+    char *data;
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+    osbuf= A_NETBUF_ALLOC(len);
-+    if(osbuf == NULL)
-+    {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, len);
-+    data = A_NETBUF_DATA(osbuf);
-+    A_MEMCPY(data, buf, len);
-+
-+    return(wmi_cmd_send(wmip, osbuf, WMI_TEST_CMDID,
-+         NO_SYNC_WMIFLAG));
-+}
-+
-+#endif
-+
-+A_STATUS
-+wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status)
-+{
-+    void *osbuf;
-+    WMI_SET_BT_STATUS_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_BT_STATUS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->streamType = streamType;
-+    cmd->status = status;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_STATUS_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd)
-+{
-+    void *osbuf;
-+    WMI_SET_BT_PARAMS_CMD* alloc_cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    alloc_cmd = (WMI_SET_BT_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(alloc_cmd, sizeof(*cmd));
-+    A_MEMCPY(alloc_cmd, cmd, sizeof(*cmd));
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_PARAMS_CMDID,
-+            NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_keepalive_configured(struct wmi_t *wmip)
-+{
-+    void *osbuf;
-+    WMI_GET_KEEPALIVE_CMD *cmd;
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+    cmd = (WMI_GET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    return (wmi_cmd_send(wmip, osbuf, WMI_GET_KEEPALIVE_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_UINT8
-+wmi_get_keepalive_cmd(struct wmi_t *wmip)
-+{
-+    return wmip->wmi_keepaliveInterval;
-+}
-+
-+A_STATUS
-+wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval)
-+{
-+    void *osbuf;
-+    WMI_SET_KEEPALIVE_CMD *cmd;
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+    cmd = (WMI_SET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd->keepaliveInterval = keepaliveInterval;
-+    wmip->wmi_keepaliveInterval = keepaliveInterval;
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_KEEPALIVE_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType, A_UINT8 ieLen,
-+                  A_UINT8 *ieInfo)
-+{
-+    void *osbuf;
-+    WMI_SET_APPIE_CMD *cmd;
-+    A_UINT16 cmdLen;
-+
-+    if (ieLen > WMI_MAX_IE_LEN) {
-+        return A_ERROR;
-+    }
-+    cmdLen = sizeof(*cmd) + ieLen - 1;
-+    osbuf = A_NETBUF_ALLOC(cmdLen);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, cmdLen);
-+
-+    cmd = (WMI_SET_APPIE_CMD *)(A_NETBUF_DATA(osbuf));
-+    A_MEMZERO(cmd, cmdLen);
-+
-+    cmd->mgmtFrmType = mgmtFrmType;
-+    cmd->ieLen = ieLen;
-+    A_MEMCPY(cmd->ieInfo, ieInfo, ieLen);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_APPIE_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen)
-+{
-+    void *osbuf;
-+    A_UINT8 *data;
-+
-+    osbuf = A_NETBUF_ALLOC(dataLen);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, dataLen);
-+
-+    data = A_NETBUF_DATA(osbuf);
-+
-+    A_MEMCPY(data, cmd, dataLen);
-+
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WHALPARAM_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_INT32
-+wmi_get_rate(A_INT8 rateindex)
-+{
-+    if (rateindex == RATE_AUTO) {
-+        return 0;
-+    } else {
-+        return(wmi_rateTable[(A_UINT32) rateindex]);
-+    }
-+}
-+
-+void
-+wmi_node_return (struct wmi_t *wmip, bss_t *bss)
-+{
-+	if (NULL != bss)
-+	{
-+		wlan_node_return (&wmip->wmi_scan_table, bss);
-+	}
-+}
-+
-+bss_t *
-+wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
-+				   A_UINT32 ssidLength, A_BOOL bIsWPA2)
-+{
-+	bss_t *node = NULL;
-+    node = wlan_find_Ssidnode (&wmip->wmi_scan_table, pSsid,
-+							   ssidLength, bIsWPA2);
-+	return node;
-+}
-+
-+void
-+wmi_free_allnodes(struct wmi_t *wmip)
-+{
-+	wlan_free_allnodes(&wmip->wmi_scan_table);
-+}
-+
-+bss_t *
-+wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr)
-+{
-+	bss_t *ni=NULL;
-+	ni=wlan_find_node(&wmip->wmi_scan_table,macaddr);
-+	return ni;
-+}
-+
-+A_STATUS
-+wmi_dset_open_reply(struct wmi_t *wmip,
-+                    A_UINT32 status,
-+                    A_UINT32 access_cookie,
-+                    A_UINT32 dset_size,
-+                    A_UINT32 dset_version,
-+                    A_UINT32 targ_handle,
-+                    A_UINT32 targ_reply_fn,
-+                    A_UINT32 targ_reply_arg)
-+{
-+    void *osbuf;
-+    WMIX_DSETOPEN_REPLY_CMD *open_reply;
-+
-+    A_DPRINTF(DBG_WMI, (DBGFMT "Enter - wmip=0x%x\n", DBGARG, (int)wmip));
-+
-+    osbuf = A_NETBUF_ALLOC(sizeof(*open_reply));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    A_NETBUF_PUT(osbuf, sizeof(*open_reply));
-+    open_reply = (WMIX_DSETOPEN_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    open_reply->status                   = status;
-+    open_reply->targ_dset_handle         = targ_handle;
-+    open_reply->targ_reply_fn            = targ_reply_fn;
-+    open_reply->targ_reply_arg           = targ_reply_arg;
-+    open_reply->access_cookie            = access_cookie;
-+    open_reply->size                     = dset_size;
-+    open_reply->version                  = dset_version;
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETOPEN_REPLY_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+
-+static A_STATUS
-+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len)
-+{
-+    WMI_PMKID_LIST_REPLY *reply;
-+    A_UINT32 expected_len;
-+
-+    if (len < sizeof(WMI_PMKID_LIST_REPLY)) {
-+        return A_EINVAL;
-+    }
-+    reply = (WMI_PMKID_LIST_REPLY *)datap;
-+    expected_len = sizeof(reply->numPMKID) + reply->numPMKID * WMI_PMKID_LEN;
-+
-+    if (len < expected_len) {
-+        return A_EINVAL;
-+    }
-+
-+    A_WMI_PMKID_LIST_EVENT(wmip->wmi_devt, reply->numPMKID,
-+                           reply->pmkidList);
-+
-+    return A_OK;
-+}
-+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+A_STATUS
-+wmi_dset_data_reply(struct wmi_t *wmip,
-+                    A_UINT32 status,
-+                    A_UINT8 *user_buf,
-+                    A_UINT32 length,
-+                    A_UINT32 targ_buf,
-+                    A_UINT32 targ_reply_fn,
-+                    A_UINT32 targ_reply_arg)
-+{
-+    void *osbuf;
-+    WMIX_DSETDATA_REPLY_CMD *data_reply;
-+    int size;
-+
-+    size = sizeof(*data_reply) + length;
-+
-+    A_DPRINTF(DBG_WMI,
-+        (DBGFMT "Enter - length=%d status=%d\n", DBGARG, length, status));
-+
-+    osbuf = A_NETBUF_ALLOC(size);
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+    A_NETBUF_PUT(osbuf, size);
-+    data_reply = (WMIX_DSETDATA_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+    data_reply->status                     = status;
-+    data_reply->targ_buf                   = targ_buf;
-+    data_reply->targ_reply_fn              = targ_reply_fn;
-+    data_reply->targ_reply_arg             = targ_reply_arg;
-+    data_reply->length                     = length;
-+
-+    if (status == A_OK) {
-+        if (a_copy_from_user(data_reply->buf, user_buf, length)) {
-+            return A_ERROR;
-+        }
-+    }
-+
-+    return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETDATA_REPLY_CMDID,
-+                             NO_SYNC_WMIFLAG));
-+}
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
-+
-+A_STATUS
-+wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status)
-+{
-+    void *osbuf;
-+    char *cmd;
-+
-+	wps_enable = status;
-+
-+    osbuf = a_netbuf_alloc(sizeof(1));
-+    if (osbuf == NULL) {
-+        return A_NO_MEMORY;
-+    }
-+
-+    a_netbuf_put(osbuf, sizeof(1));
-+
-+    cmd = (char *)(a_netbuf_to_data(osbuf));
-+
-+    A_MEMZERO(cmd, sizeof(*cmd));
-+    cmd[0] = (status?1:0);
-+    return (wmi_cmd_send(wmip, osbuf, WMI_SET_WSC_STATUS_CMDID,
-+                         NO_SYNC_WMIFLAG));
-+}
-+
-diff --git a/drivers/ar6000/wmi/wmi_doc.h b/drivers/ar6000/wmi/wmi_doc.h
-new file mode 100644
-index 0000000..19cd938
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi_doc.h
-@@ -0,0 +1,4421 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+
-+#if 0
-+Wireless Module Interface (WMI) Documentaion
-+
-+   This section describes the format and the usage model for WMI control and
-+   data messages between the host and the AR6000-based targets. The header
-+   file include/wmi.h contains all command and event manifest constants as
-+   well as structure typedefs for each set of command and reply parameters.
-+
-+Data Frames
-+
-+   The data payload transmitted and received by the target follows RFC-1042
-+   encapsulation and thus starts with an 802.2-style LLC-SNAP header. The
-+   WLAN module completes 802.11 encapsulation of the payload, including the
-+   MAC header, FCS, and WLAN security related fields. At the interface to the
-+   message transport (HTC), a data frame is encapsulated in a WMI message.
-+
-+WMI Message Structure
-+
-+   The WMI protocol leverages an 802.3-style Ethernet header in communicating
-+   the source and destination information between the host and the AR6000
-+   modules using a 14-byte 802.3 header ahead of the 802.2-style payload. In
-+   addition, the WMI protocol adds a header to all data messages:
-+
-+    {
-+    INT8    rssi
-+                  The RSSI of the received packet and its units are shown in db above the
-+                      noise floor, and the noise floor is shown in dbm.
-+    UINT8   info
-+                      Contains information on message type and user priority. Message type
-+                      differentiates between a data packet and a synchronization message.
-+    } WMI_DATA_HDR
-+
-+   User priority contains the 802.1d user priority info from host to target. Host
-+   software translates the host Ethernet format to 802.3 format prior to Tx and
-+   802.3 format to host format in the Rx direction. The host does not transmit the
-+   FCS that follows the data. MsgType differentiates between a regular data
-+   packet (msgType=0) and a synchronization message (msgType=1).
-+
-+Data Endpoints
-+
-+   The AR6000 chipset provides several data endpoints to support quality of
-+   service (QoS) and maintains separate queues and separate DMA engines for
-+   each data endpoint. A data endpoint can be bi-directional.
-+
-+   Best effort (BE) class traffic uses the default data endpoint (2). The host can
-+   establish up to two additional data endpoints for other traffic classes. Once
-+   such a data endpoint is established, it sends and receives corresponding QoS
-+   traffic in a manner similar to the default data endpoint.
-+
-+   If QoS is desired over the interconnect, host software must classify each data
-+   packet and place it on the appropriate data endpoint. The information
-+   required to classify data is generally available in-band as an 802.1p/q style
-+   tag or as the ToS field in the IP header. The information may also be available
-+   out-of-band depending on the host DDI.
-+
-+Connection States
-+
-+   Table B-1 describes the AR6000 WLAN connection states:
-+
-+   Table B-1.  AR6000 Connection States
-+
-+Connection State
-+    Description
-+
-+   DISCONNECTED
-+    In this state, the AR6000 device is not connected to a wireless
-+   network. The device is in this state after reset when it sends the
-+   WIRELESS MODULE �READY� EVENT, after it processes a
-+   DISCONNECT command, and when it loses its link with the
-+   access point (AP) that it was connected to. The device signals a
-+   transition to the DISCONNECTED state with a �DISCONNECT�
-+   event.
-+
-+CONNECTED
-+    In this state, the AR6000 device is connected to wireless networks.
-+   The device enters this state after successfully processing a
-+   CONNECT, which establishes a connection with a wireless
-+   network. The device signals a transition to the CONNECTED state
-+   with a �CONNECT� event.
-+
-+
-+Message Types
-+
-+   WMI uses commands, replies, and events for the control and configuration of
-+   the AR6000 device. The control protocol is asynchronous. Table B-2 describes
-+   AR6000 message types:
-+
-+Table B-2.  AR6000 Message Types
-+
-+Message Type
-+    Description
-+
-+Commands
-+    Control messages that flow from the host to the device
-+
-+Replies/Events
-+    Control messages that flow from the device to the host.
-+
-+   The device issues a reply to some WMI commands, but not to others.
-+   The payload in a reply is command-specific, and some commands do
-+   not trigger a reply message at all. Events are control messages issued
-+   by the device to signal the occurrence of an asynchronous event.
-+
-+
-+WMI Message Format
-+
-+   All WMI control commands, replies and events use the header format:
-+
-+   WMI_CMD_HDR Header Format
-+   {
-+        UINT16 id
-+                 This 16-bit constant identifies which WMI command the host is issuing,
-+                 which command the target is replying to, or which event has occurred.
-+        WMI_CMD_HDR
-+   }
-+
-+
-+   A variable-size command-, reply-, or event-specific payload follows the
-+   header. Over the interconnect, all fields in control messages (including
-+   WMI_CMD_HDR and the command specific payload) use 32-bit little Endian
-+   byte ordering and fields are packed. The AR6000 device always executes
-+   commands in order, and the host may send multiple commands without
-+   waiting for previous commands to complete. A majority of commands are
-+   processed to completion once received. Other commands trigger a longer
-+   duration activity whose completion is signaled to the host through an event.
-+
-+Command Restrictions
-+
-+   Some commands may only be issued when the AR6000 device is in a certain
-+   state. The host is required to wait for an event signaling a state transition
-+   before such a command can be issued. For example, if a command requires
-+   the device to be in the CONNECTED state, then the host is required to wait
-+   for a �CONNECT� event before it issues that command.
-+
-+   The device ignores any commands inappropriate for its current state. If the
-+   command triggers a reply, the device generates an error reply. Otherwise, the
-+   device silently ignores the inappropriate command.
-+
-+Command and Data Synchronization
-+
-+   WMI provides a mechanism for a host to advise the device of necessary
-+   synchronization between commands and data. The device implements
-+   synchronization; no implicit synchronization exists between endpoints.
-+
-+   The host controls synchronization using the �SYNCHRONIZE� command
-+   over the control channel and synchronization messages over data channels.
-+   The device stops each data channel upon receiving a synchronization message
-+   on that channel, processing all data packets received prior to that message.
-+   After the device receives synchronization messages for each data endpoint
-+   and the �SYNCHRONIZE� command, it resumes all channels.
-+
-+   When the host must guarantee a command executes before processing new
-+   data packets, it first issues the command, then issues the �SYNCHRONIZE�
-+   command and sends synchronization messages on data channels. When the
-+   host must guarantee the device has processed all old data packets before a
-+   processing a new command, it issues a �SYNCHRONIZE� command and
-+   synchronization messages on all data channels, then issues the desired
-+   command.
-+
-+
-+
-+WMI Commands
-+
-+   ADD_BAD_AP
-+    Cause the AR6000 device to avoid a particular AP
-+   ADD_CIPHER_KEY
-+    Add or replace any of the four AR6000 encryption keys
-+   ADD_WOW_PATTERN
-+    Used to add a pattern to the WoW pattern list
-+   CLR_RSSI_SNR
-+    Clear the current calculated RSSI and SNR value
-+   CONNECT_CMD
-+    Request that the AR6000 device establish a wireless connection
-+        with the specified SSID
-+   CREATE_PSTREAM
-+    Create prioritized data endpoint between the host and device
-+   DELETE_BAD_AP
-+    Clear an entry in the bad AP table
-+   DELETE_CIPHER_KEY
-+    Delete a previously added cipher key
-+   DELETE_PSTREAM
-+    Delete a prioritized data endpoint
-+   DELETE_WOW_PATTERN
-+    Remove a pre-specified pattern from the WoW pattern list
-+   EXTENSION
-+    WMI message interface command
-+   GET_BIT_RATE
-+    Retrieve rate most recently used by the AR6000
-+   GET_CHANNEL_LIST
-+    Retrieve list of channels used by the AR6000
-+   GET_FIXRATES
-+    Retrieves the rate-mask set via the SET_FIXRATES command.
-+   GET_PMKID_LIST_CMD
-+    Retrieve the firmware list of PMKIDs
-+   GET_ROAM_DATA
-+    Internal use for data collection; available in special build only
-+   GET_ROAM_TBL
-+    Retrieve the roaming table maintained on the target
-+   GET_TARGET_STATS
-+    Request that the target send the statistics it maintains
-+   GET_TX_PWR
-+    Retrieve the current AR6000 device Tx power levels
-+   GET_WOW_LIST
-+    Retrieve the current list of WoW patterns
-+   LQ_THRESHOLD_PARAMS
-+    Set the link quality thresholds
-+   OPT_TX_FRAME
-+    Send a special frame (special feature)
-+   RECONNECT
-+    Request a reconnection to a BSS
-+   RSSI_THRESHOLD_PARAMS
-+    Configure how the AR6000 device monitors and reports signal
-+       strength (RSSI) of the connected BSS
-+   SCAN_PARAMS
-+    Determine dwell time and changes scanned channels
-+   SET_ACCESS_PARAMS
-+    Set access parameters for the wireless network
-+   SET_ADHOC_BSSID
-+    Set the BSSID for an ad hoc network
-+   SET_AKMP_PARAMS
-+    Set multiPMKID mode
-+   SET_APPIE
-+    Add application-specified IE to a management frame
-+   SET_ASSOC_INFO
-+    Specify the IEs the device should add to association or
-+        reassociation requests
-+   SET_AUTH_MODE
-+    Set 802.11 authentication mode of reconnection
-+   SET_BEACON_INT
-+    Set the beacon interval for an ad hoc network
-+   SET_BIT_RATE
-+    Set the AR6000 to a specific fixed bit rate
-+   SET_BMISS_TIME
-+    Set the beacon miss time
-+   SET_BSS_FILTER
-+    Inform the AR6000 of network types about which it wants to
-+        receive information using a �BSSINFO� event
-+   SET_BT_PARAMS
-+    Set the status of a Bluetooth stream (SCO or A2DP) or set
-+        Bluetooth coexistence register parameters
-+   SET_BT_STATUS
-+    Set the status of a Bluetooth stream (SCO or A2DP)
-+   SET_CHANNEL_PARAMETERS
-+    Configure WLAN channel parameters
-+   SET_DISC_TIMEOUT
-+    Set the amount of time the AR6000 spends attempting to
-+        reestablish a connection
-+   SET_FIXRATES
-+    Set the device to a specific fixed PHY rate (supported subset)
-+   SET_HALPARAM
-+    Internal AR6000 command to set certain hardware parameters
-+   SET_HOST_SLEEP_MODE
-+    Set the host mode to asleep or awake
-+   SET_IBSS_PM_CAPS
-+    Support a non-standard power management scheme for an
-+        ad hoc network
-+   SET_LISTEN_INT
-+    Request a listen interval
-+   SET_LPREAMBLE
-+    Override the short preamble capability of the AR6000 device
-+   SET_MAX_SP_LEN
-+    Set the maximum service period
-+   SET_OPT_MODE
-+    Set the special mode on/off (special feature)
-+   SET_PMKID
-+    Set the pairwise master key ID (PMKID)
-+   SET_PMKID_LIST_CMD
-+    Configure the firmware list of PMKIDs
-+   SET_POWER_MODE
-+    Set guidelines on trade-off between power utilization
-+   SET_POWER_PARAMS
-+    Configure power parameters
-+   SET_POWERSAVE_PARAMS
-+    Set the two AR6000 power save timers
-+   SET_PROBED_SSID
-+    Provide list of SSIDs the device should seek
-+   SET_REASSOC_MODE
-+    Specify whether the disassociated frame should be sent upon
-+        reassociation
-+   SET_RETRY_LIMITS
-+    Limit how many times the device tries to send a frame
-+   SET_ROAM_CTRL
-+    Control roaming behavior
-+   SET_RTS
-+    Determine when RTS should be sent
-+   SET_SCAN_PARAMS
-+    Set the AR6000 scan parameters
-+   SET_TKIP_COUNTERMEASURES
-+    Enable/disable reports of TKIP MIC errors
-+   SET_TX_PWR
-+    Specify the AR6000 device Tx power levels
-+   SET_VOICE_PKT_SIZE
-+    Set voice packet size
-+   SET_WMM
-+    Override the AR6000 WMM capability
-+   SET_WMM_TXOP
-+    Configure TxOP bursting when sending traffic to a WMM-
-+    capable AP
-+   SET_WOW_MODE
-+    Enable/disable WoW mode
-+   SET_WSC_STATUS
-+    Enable/disable profile check in cserv when the WPS protocol
-+    is in progress
-+   SNR_THRESHOLD_PARAMS
-+    Configure how the device monitors and reports SNR of BSS
-+   START_SCAN
-+    Start a long or short channel scan
-+   SYNCHRONIZE
-+    Force a synchronization point between command and data
-+    paths
-+   TARGET_REPORT_ERROR_BITMASK
-+    Control �ERROR_REPORT� events from the AR6000
-+
-+
-+
-+
-+Name
-+    ADD_BAD_AP
-+
-+Synopsis
-+    The host uses this command to cause the AR6000 to avoid a particular AP. The
-+    AR6000 maintain a table with up to two APs to avoid. An ADD_BAD_AP command
-+    adds or replaces the specified entry in this bad AP table.
-+
-+    If the AR6000 are currently connected to the AP specified in this command, they
-+    disassociate.
-+
-+Command
-+    wmiconfig eth1 --badap <bssid> <badApIndex>
-+
-+Command Parameters
-+    UINT8 badApIndex    Index [0...1] that identifies which entry in the
-+                        bad AP table to use
-+
-+
-+    UINT8 bssid[6]  MAC address of the AP to avoid
-+
-+Command Values
-+    badApIndex = 0, 1    Entry in the bad AP table to use
-+
-+Reset Value
-+    The bad AP table is cleared
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �DELETE_BAD_AP� on page B-13
-+
-+=====================================================================
-+Name
-+    ADD_CIPHER_KEY
-+
-+Synopsis
-+    The host uses this command to add/replace any of four encryption keys on the
-+    AR6000. The ADD_CIPHER_KEY command is issued after the CONNECT event
-+    has been received by the host for all dot11Auth modes except for SHARED_AUTH.
-+    When the dot11AuthMode is SHARED_AUTH, then the ADD_CIPHER_KEY
-+    command should be issued before the �CONNECT� command.
-+
-+Command
-+    wmiconfig eth1 --cipherkey <keyIndex> <keyType> <keyUsage>
-+                            <keyLength> <keyopctrl> <keyRSC> <key>
-+
-+Command Parameters
-+    UINT8 keyIndex      Index (0...3) of the key to add/replace;
-+                        uniquely identifies the key
-+    UINT8 keyType    CRYPTO_TYPE
-+    UINT8 keyUsage   Specifies usage parameters of the key when
-+                     keyType = WEP_CRYPT
-+    UINT8 keyLength  Length of the key in bytes
-+    UINT8 keyOpCtrl  bit[0] = Initialize TSC (default),
-+                     bit[1] = Initialize RSC
-+    UINT8 keyRSC[8]  Key replay sequence counter (RSC) initial
-+                     value the device should use
-+    UINT8 key[32]    Key material used for this connection
-+    Command Values
-+    {
-+        NONE_CRYPT = 1
-+        WEP_CRYPT  = 2
-+        TKIP_CRYPT = 3
-+        AES_CRYPT  = 4
-+        KEY_OP_INIT_TSC   0x01
-+        KEY_OP_INIT_RSC   0x02
-+        KEY_OP_INIT_VAL   0x03
-+                Default is to Initialize the TSC
-+        KEY_OP_VALID_MASK 0x04
-+                Two operations defined
-+    } CRYPTO_TYPE
-+
-+    {
-+        PAIRWISE_USAGE  = 0  Set if the key is used for unicast traffic only
-+        GROUP_USAGE     = 1  Set if the key is used to receive multicast
-+                              traffic (also set for static WEP keys)
-+        TX_USAGE        = 2  Set for the GROUP key used to transmit frames
-+                All others are reserved
-+    } KEY_USAGE
-+
-+Reset Value
-+    The four available keys are disabled.
-+
-+Restrictions
-+    The cipher should correspond to the encryption mode specified in the �CONNECT�
-+    command.
-+
-+See Also
-+    �DELETE_CIPHER_KEY�
-+
-+=====================================================================
-+
-+
-+Name
-+    ADD_WOW_PATTERN
-+
-+Synopsis
-+    The host uses this command to add a pattern to the WoW pattern list; used for
-+    pattern-matching for host wakeups by the WoW module. If the host mode is asleep
-+    and WoW is enabled, all packets are matched against the existing WoW patterns. If a
-+    packet matches any of the patterns specified, the target will wake up the host. All
-+    non-matching packets are discarded by the target without being sent up to the host.
-+
-+Command
-+    wmiconfig �addwowpattern <list-id> <filter-size> <filter-offset>
-+    <pattern> <mask>
-+
-+Command Parameters
-+    A_UINT8  filter_list_id    ID of the list that is to include the new pattern
-+    A_UINT8  filter_size       Size of the new pattern
-+    A_UINT8  filter_offset     Offset at which the pattern matching for this
-+                                new pattern should begin at
-+    A_UINT8  filter[1]         Byte stream that contains both the pattern and
-+                                the mask of the new WoW wake-up pattern
-+
-+Reply Parameters
-+    None
-+
-+Reset Value
-+    None defined (default host mode is awake)
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �DELETE_WOW_PATTERN�
-+
-+=====================================================================
-+
-+
-+Name
-+    CLR_RSSI_SNR
-+
-+Synopsis
-+    Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
-+    running-average value. This command will clear the history and have a fresh start
-+    for the running-average mechanism.
-+
-+Command
-+    wmiconfig eth1 --cleanRssiSnr
-+
-+Command Parameters
-+    None
-+
-+Reply Parameters
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+Name
-+    CONNECT_CMD
-+
-+Synopsis
-+    New connect control information (connectCtrl) is added, with 32 possible modifiers.
-+
-+    CONNECT_SEND_REASSOC
-+        Valid only for a host-controlled connection to a
-+        particular AP. If this bit is set, a reassociation frame is
-+        sent. If this bit is clear, an association request frame is
-+        sent to the AP.
-+
-+    CONNECT_IGNORE_WPAx_GROUP_CIPHER
-+        No group key is issued in the CONNECT command,
-+        so use the group key advertised by the AP. In a target-
-+        initiated roaming situation this allows a STA to roam
-+        between APs that support different multicast ciphers.
-+
-+    CONNECT_PROFILE_MATCH_DONE
-+        In a host-controlled connection case, it is possible that
-+        during connect, firmware may not have the
-+        information for a profile match (e.g, when the AP
-+        supports hidden SSIDs and the device may not
-+        transmit probe requests during connect). By setting
-+        this bit in the connection control information, the
-+        firmware waits for a beacon from the AP with the
-+        BSSID supplied in the CONNECT command. No
-+        additional profile checks are done.
-+
-+    CONNECT_IGNORE_AAC_BEACON
-+        Ignore the Admission Capacity information in the
-+        beacon of the AP
-+
-+    CONNECT_ASSOC_POLICY_USER
-+        When set, the CONNECT_SEND_REASSOC setting
-+        determines if an Assoc or Reassoc is sent to an AP
-+
-+Command
-+    wmiconfig --setconnectctrl <ctrl flags bitmask>
-+
-+Command Parameters
-+    typedef struct{
-+    A_UINT8 networktype;
-+    A_UINT8 dot11authmode;
-+    A_UINT8 authmode;
-+    A_UINT8 pairwiseCryptoType; /*CRYPTO_TYPE*/
-+    A_UINT8 pairwiseCryptoLen;
-+    A_UINT8 groupCryptoType; /*CRYPTO_TYPE*/
-+    A_UINT8 groupCryptoLen;
-+    A_UINT8 ssidLength;
-+    A_UCHAR ssid[WMI_MAX_SSID_LEN];
-+    A_UINT16 channel;
-+    A_UINT8 bssid[AUTH_MAC_LEN];
-+    A_UINT8 ctrl_flags; /*WMI_CONNECT_CTRL_FLAGS_BITS*/
-+    } WMI_CONNECT_CMD;
-+
-+    ctrl flags bitmask
-+        = 0x0001 CONNECT_ASSOC_POLICY_USER
-+            Assoc frames are sent using the policy specified by
-+            the flag
-+        = 0x0002 CONNECT_SEND_REASSOC
-+            Send Reassoc frame while connecting, otherwise send
-+            assoc frames
-+        = 0x0004 CONNECT_IGNORE_WPAx_GROUP_CIPHER
-+            Ignore WPAx group cipher for WPA/WPA2
-+        = 0x0008 CONNECT_PROFILE_MATCH_DONE
-+            Ignore any profile check
-+        = 0x0010 CONNECT_IGNORE_AAC_BEACON
-+            Ignore the admission control information in the
-+            beacon
-+        ... CONNECT_CMD, continued
-+        Command Values
-+        typedef enum {
-+            INFRA_NETWORK       = 0x01,
-+            ADHOC_NETWORK       = 0x02,
-+            ADHOC_CREATOR       = 0x04,
-+        } NETWORK_TYPE;
-+
-+        typedef enum {
-+            OPEN_AUTH           = 0x01,
-+            SHARED_AUTH         = 0x02,
-+            LEAP_AUTH           = 0x04,
-+        } DOT11_AUTH_MODE;
-+        typedef enum {
-+            NONE_AUTH           = 0x01,
-+            WPA_AUTH            = 0x02,
-+            WPA_PSK_AUTH        = 0x03,
-+            WPA2_AUTH           = 0x04,
-+            WPA2_PSK_AUTH       = 0x05,
-+            WPA_AUTH_CCKM       = 0x06,
-+            WPA2_AUTH_CCKM      = 0x07,
-+        } AUTH_MODE;
-+        typedef enum {
-+            NONE_CRYPT          = 0x01,
-+            WEP_CRYPT           = 0x02,
-+            TKIP_CRYPT          = 0x03,
-+            AES_CRYPT           = 0x04,
-+        } CRYPTO_TYPE;
-+        typedef enum {
-+            CONNECT_ASSOC_POLICY_USER = 0x0001,
-+            CONNECT_SEND_REASSOC = 0x0002,
-+            CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
-+            CONNECT_PROFILE_MATCH_DONE = 0x0008,
-+            CONNECT_IGNORE_AAC_BEACON = 0x0010,
-+        } WMI_CONNECT_CTRL_FLAGS_BITS;
-+
-+    pairwiseCryptoLen and groupCryptoLen are valid when the respective
-+    CryptoTypesis WEP_CRYPT, otherwise this value should be 0. This is the length in
-+    bytes.
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    CREATE_PSTREAM
-+
-+Synopsis
-+    The host uses this command to create a new prioritized data endpoint between the
-+    host and the AR6000 device that carries a prioritized stream of data. If the AP that the
-+    device connects to requires TSPEC stream establishment, the device requests the
-+    corresponding TSPEC with the AP. The maximum and minimum service interval
-+    ranges from 0 � 0x7FFFFFFF (ms), where 0 = disabled. The device does not send a
-+    reply event for this command, as it is always assumed the command has succeeded.
-+    An AP admission control response comes to the host via a WMI_CAC_INDICATION
-+    event, once the response for the ADDTS frame comes.
-+
-+    Examples of cases where reassociation is generated (when WMM) and cases where
-+    ADDTS is generated (when WMM and enabling ACM) are when:
-+        Changing UAPSD flags in WMM mode, reassociation is generated
-+        Changing the interval of sending auto QoS Null frame in WMM mode;
-+            reassociation is not generated
-+        Issuing a command with same previous parameters in WMM mode and enabling
-+            ACM, an ADDTS request is generated
-+        Changing the interval of a QoS null frame sending in WMM mode and enabling
-+            ACM, an ADDTS request is generated
-+        Issuing the command in disconnected state, reassociation or ADDTS is not
-+            generated but the parameters are available after (re)association
-+
-+Command
-+    --createqos <user priority> <direction> <traffic class>
-+<trafficType> <voice PS capability> <min service interval> <max
-+service interval> <inactivity interval> <suspension interval>
-+<service start time> <tsid> <nominal MSDU> <max MSDU> <min data
-+rate> <mean data rate> <peak data rate> <max burst size> <delay
-+bound> <min phy rate> <sba> <medium time> where:
-+
-+    <user priority>
-+    802.1D user priority range (0�7)
-+    <direction>
-+        = 0    Tx (uplink) traffic
-+        = 1    Rx (downlink) traffic
-+        = 2    Bi-directional traffic
-+    <traffic class>
-+        = 1    BK
-+        = 2    VI
-+        = 3    VO
-+    <trafficType>
-+        = 0    Aperiodic
-+        = 1    Periodic
-+    <voice PS capability>
-+        Specifies whether the voice power save mechanism
-+    (APSD if AP supports it or legacy/simulated APSD
-+    [using PS-Poll]) should be used
-+        = 0    Disable voice power save for traffic class
-+        = 1    Enable APSD voice power save for traffic class
-+        = 2    Enable voice power save for all traffic classes
-+    <min service interval>
-+        (In ms)
-+    <max service interval>
-+        Inactivity interval (in ms) (0 = Infinite)
-+    <suspension interval>
-+        (In ms)
-+    <service start time>
-+        Service start time
-+    <tsid>
-+        TSID range (0�15)
-+    <nominal MSDU>
-+        Nominal MAC SDU size
-+    <max MSDU>
-+        Maximum MAC SDU size
-+    <min data rate>
-+        Minimum data rate (in bps)
-+    <mean data rate>
-+        Mean data rate (in bps)
-+    <peak data rate>
-+        Peak data rate (in bps)
-+    <max burst size>
-+        Maximum burst size (in bps)
-+    <delay bound>
-+        Delay bound
-+    <min phy rate>
-+        Minimum PHY rate (in bps)
-+    <sba>
-+        Surplus bandwidth allowance
-+    <medium time>
-+        Medium time in TU of 32-ms periods per sec
-+    ... CREATE_PSTREAM (continued)
-+
-+Command Parameters
-+    UINT8 trafficClass    TRAFFIC_CLASS value
-+    UINT8 traffic
-+    Direction
-+    DIR_TYPE value
-+    UINT8    rxQueueNum
-+        AR6000 device mailbox index (2 or 3)
-+        corresponding to the endpoint the host
-+        wishes to use to receive packets for the
-+        prioritized stream
-+    UINT8 trafficType  TRAFFIC_TYPE value
-+    UINT8 voicePS
-+Capability
-+    VOICEPS_CAP_TYPE value
-+    UINT8 tsid          Traffic stream ID
-+    UINT8 userPriority  802.1D user priority
-+    UINT16 nominalMSDU  Nominal MSDU in octets
-+    UINT16 maxMSDU      Maximum MSDU in octets
-+    UINT32 minServiceInt Minimum service interval: the min.
-+                            period of traffic specified (in ms)
-+    UINT32 maxServiceInt  Maximum service interval: the max.
-+                        period of traffic specified (in ms)
-+    UINT32 inactivityInt Indicates how many ms an established
-+                        stream is inactive before the prioritized
-+                        data endpoint is taken down and the
-+                        corresponding T-SPEC deleted
-+    UINT32 suspensionInt  Suspension interval (in ms)
-+    UINT32 service       StartTime Service start time
-+    UINT32 minDataRate  Minimum data rate (in bps)
-+    UINT32 meanDataRate Mean data rate (in bps)
-+    UINT32 peakDataRate Peak data rate (in bps)
-+    UINT32 maxBurstSize
-+    UINT32 delayBound
-+    UINT32 minPhyRate   Minimum PHY rate for TSPEC (in bps)
-+    UINT32 sba          Surplus bandwidth allowance
-+    UINT32 mediumTime   Medium TSPEC time (in units of 32 ms)
-+Command Values
-+    {
-+        WMM_AC_BE = 0   Best Effort
-+        WMM_AC_BK = 1   Background
-+        WMM_AC_VI = 2   Video
-+        WMM_AC_VO = 3   Voice
-+        All other values reserved
-+    } TRAFFIC_CLASS
-+    {
-+        UPLINK_TRAFFIC   = 0  From the AR6000 device to the AP
-+        DOWNLINK_TRAFFIC = 1  From the AP to the AR6000 device
-+        BIDIR_TRAFFIC    = 2  Bi-directional traffic
-+        All other values reserved
-+    } DIR_TYPE
-+    {
-+        DISABLE_FOR_THIS_AC = 0
-+        ENABLE_FOR_THIS_AC  = 1
-+        ENABLE_FOR_ALL_AC   = 2
-+        All other values reserved
-+    } VOICEPS_CAP_TYPE
-+
-+    ... CREATE_PSTREAM (continued)
-+
-+
-+        VI  BE   BK    Supported, Y/N?
-+   0    0    0    0    Y
-+   0    0    0    1    Y
-+   0    0    1    0    N
-+   0    0    1    1    N
-+   0    1    0    0    Y
-+   0    1    0    1    Y
-+   0    1    1    0    N
-+   0    1    1    1    N
-+   1    0    0    0    Y
-+   1    0    0    1    Y
-+   1    0    1    0    N
-+   1    1    0    0    N
-+   1    1    0    1    Y
-+   1    1    0    0    N
-+   1    1    1    0    N
-+   1    1    1    1    Y
-+
-+Reset Value
-+    No pstream is present after reset; each of the BE, BK, VI,VO pstreams must be created
-+    (either implicitly by data flow or explicitly by user)
-+
-+Restrictions
-+    This command can only be issued when the device is in the CONNECTED state. If
-+    the device receives the command while in DISCONNECTED state, it replies with a
-+    failure indication. At most four prioritized data endpoints can be created, one for
-+    each AC.
-+
-+See Also
-+    �DELETE_PSTREAM�
-+=====================================================================
-+
-+Name
-+    DELETE_BAD_AP
-+
-+Synopsis
-+    The host uses this command to clear a particular entry in the bad AP table
-+
-+Command
-+    wmiconfig eth1 --rmAP [--num=<index>] // used to clear a badAP
-+    entry. num is index from 0-3
-+
-+Command Parameters
-+    UINT8  badApIndex   Index [0...n] that identifies the entry in the bad
-+                        AP table to delete
-+
-+Command Values
-+    badApIndex   = 0, 1, 2, 3
-+            Entry in the bad AP table
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �ADD_BAD_AP�
-+
-+=====================================================================
-+
-+
-+Name
-+    DELETE_CIPHER_KEY
-+
-+Synopsis
-+    The host uses this command to delete a key that was previously added with the
-+    �ADD_CIPHER_KEY� command.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    UINT8   keyIndex    Index (0...3) of the key to be deleted
-+
-+Command Values
-+    keyIndex    = 0, 1,2, 3    Key to delete
-+
-+Reset Value
-+    None
-+
-+Restrictions
-+    The host should not delete a key that is currently in use by the AR6000.
-+
-+See Also
-+    �ADD_CIPHER_KEY�
-+
-+=====================================================================
-+
-+Name
-+    DELETE_PSTREAM
-+
-+Synopsis
-+    The host uses this command to delete a prioritized data endpoint created by a
-+    previous �CREATE_PSTREAM� command
-+
-+Command
-+    --deleteqos <trafficClass> <tsid>, where:
-+
-+    <traffic class>
-+        = 0    BE
-+        = 1    BK
-+        = 2    VI
-+        = 3    VO
-+    <tsid>
-+        The TSpec ID; use the -qosqueue option
-+        to get the active TSpec IDs for each traffic class
-+
-+Command Parameters
-+    A_UINT8    trafficClass    Indicate the traffic class of the stream
-+                            being deleted
-+
-+Command Values
-+    {
-+        WMM_AC_BE = 0    Best effort
-+        WMM_AC_BK = 1    Background
-+        WMM_AC_VI = 2    Video
-+        WMM_AC_VO = 3    Voice
-+    } TRAFFIC CLASS
-+
-+    0-15 for TSID
-+
-+Reply Values
-+    N/A
-+
-+Restrictions
-+    This command should only be issued after a �CREATE_PSTREAM� command has
-+    successfully created a prioritized stream
-+
-+See Also
-+    �CREATE_PSTREAM�
-+
-+=====================================================================
-+
-+
-+Name
-+    DELETE_WOW_PATTERN
-+
-+Synopsis
-+    The host uses this command to remove a pre-specified pattern from the
-+    WoW pattern list.
-+
-+Command
-+    wmiconfig �delwowpattern <list-id> <pattern-id>
-+
-+Command Parameters
-+    A_UINT8    filter_list_id    ID of the list that contains the WoW filter
-+                                 pattern to delete
-+    A_UINT8    filter_id    ID of the WoW filter pattern to delete
-+
-+Reply Parameters
-+    None
-+
-+
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �ADD_WOW_PATTERN�
-+
-+=====================================================================
-+
-+
-+Name
-+    EXTENSION
-+
-+Synopsis
-+    The WMI message interface is used mostly for wireless control messages to a wireless
-+    module applicable to wireless module management regardless of the target platform
-+    implementation. However, some commands only peripherally related to wireless
-+    management are desired during operation. These wireless extension commands may
-+    be platform-specific or implementation-dependent.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    Command-specific
-+
-+Command Values
-+    Command-specific
-+
-+Reply Parameters
-+    Command-specific
-+
-+Reset Values
-+    None defined
-+
-+Restrictions
-+    None defined
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_BIT_RATE
-+
-+Synopsis
-+    Used by the host to obtain the rate most recently used by the AR6000 device
-+
-+Command
-+    wmiconfig eth1 --getfixrates
-+
-+Command Parameters
-+    None
-+
-+
-+
-+Reply Parameters
-+    INT8
-+    rateIndex
-+    See the �SET_BIT_RATE� command
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    This command should only be used during development/debug; it is not intended
-+for use in production. It is only valid when the device is in the CONNECTED state
-+
-+See Also
-+    �SET_BIT_RATE�
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_CHANNEL_LIST
-+
-+Synopsis
-+    Used by the host uses to retrieve the list of channels that can be used by the device
-+    while in the current wireless mode and in the current regulatory domain.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    None
-+
-+Reply Parameters
-+    UINT8    reserved    Reserved
-+    UINT8    numberOfChannels    Number of channels the reply contains
-+    UINT16    channelList[numberOfChannels]  Array of channel frequencies (in MHz)
-+
-+Reset Values
-+    None defined
-+
-+Restrictions
-+    The maximum number of channels that can be reported are 32
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_FIXRATES
-+
-+Synopsis
-+    Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
-+    running-average value. This command will clear the history and have a fresh start for
-+    the running-average mechanism.
-+
-+Synopsis
-+    This returns rate-mask set via WMI_SET_FIXRATES to retrieve the current fixed rate
-+    that the AR6001 or AR6001 is using. See �SET_FIXRATES�.
-+
-+Command
-+    wmiconfig eth1 --getfixrates
-+
-+Command Parameters
-+    A_UINT16    fixRateMask;    Note: if this command is used prior to
-+                using WMI_SET_FIXRATES, AR6000
-+                returns 0xffff as fixRateMask, indicating
-+                all the rates are enabled
-+
-+Reply Parameters
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �SET_FIXRATES�
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    GET_PMKID_LIST_CMD
-+
-+Synopsis
-+    Retrieves the list of PMKIDs on the firmware. The
-+    WMI_GET_PMKID_LIST_EVENT is generated by the firmware.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    None
-+
-+See Also
-+    SET_PMKID_LIST_CMD GET_PMKID_LIST_EVENT
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_ROAM_TBL
-+
-+Synopsis
-+    Retrieve the roaming table maintained on the target. The response is reported
-+    asynchronously through the ROAM_TBL_EVENT.
-+
-+Command
-+    wmiconfig --getroamtable <roamctrl> <info>
-+
-+Command Parameters
-+    A_UINT8    roamCtrlType;
-+    A_UINT16   roamMode
-+    A_UINT16   numEntries
-+    WMI_BSS_ROAM_INFO bssRoamInfo[1]
-+
-+Reply Value
-+    Reported asynchronously through the ROAM_TBL_EVENT
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    SET_KEEPALIVE
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_TARGET_STATS
-+
-+Synopsis
-+    The host uses this command to request that the target send the statistics that it
-+    maintains. The statistics obtained from the target are accrued in the host every time
-+    the GET_TARGET_STATS command is issued. The --clearStats option is added to
-+    clear the target statistics maintained in the host.
-+
-+Command
-+    wmiconfig --getTargetStats --clearStats
-+
-+Command Parameters
-+    TARGET_STATS    targetStats
-+    WMI_TARGET_STATS
-+    UINT8   clearStats
-+
-+
-+Reply Value
-+    RSSI return value (0�100)
-+
-+Reset Values
-+    All statistics are cleared (zeroed)
-+
-+Restrictions
-+    The --getTargetStats option must be used; the --clearStats option is also available also
-+
-+
-+=====================================================================
-+
-+Name
-+    GET_TX_PWR
-+
-+Synopsis
-+    The host uses this command to retrieve the current Tx power level
-+
-+Command
-+    wmiconfig -i eth1 --getpower
-+
-+Command Parameters
-+    None
-+
-+Reply Parameters
-+    UINT16 dbM    The current Tx power level specified in dbM
-+
-+Reset Values
-+    The maximum permitted by the regulatory domain
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �SET_TX_PWR�
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_WOW_LIST
-+
-+Synopsis
-+    The host uses this command to retrieve the current list of WoW patterns.
-+
-+Command
-+    wmiconfig �getwowlist <list-id>
-+
-+Command Parameters
-+    A_UINT8 filter_list_id    ID of the list of WoW patterns to retrieve
-+
-+Reply Value(s)
-+    A_UINT16  num_filters    Number of WoW patterns contained in the list
-+    A_UINT8   wow_mode    Current mode of WoW (enabled or disabled)
-+    A_UINT8    host_mode    Current host mode (asleep or awake)
-+    WOW_FILTER    wow_filters[1]
-+        Contents of the WoW filter pattern list
-+        (contains mask, pattern, offset and size
-+    information for each of the patterns)
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �SET_WSC_STATUS�
-+
-+=====================================================================
-+
-+
-+Name
-+    LQ_THRESHOLD_PARAMS
-+
-+Synopsis
-+    Sets Link Quality thresholds, the sampling will happen at every unicast data frame
-+    Tx if a certain threshold is met, and the corresponding event will be sent to the host.
-+
-+Command
-+    --lqThreshold <enable> <upper_threshold_1> ...
-+    <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
-+
-+Command Parameters
-+    <enable>    = 0    Disable link quality sampling
-+                = 1    Enable link quality sampling
-+    <upper_threshold_x>  Above thresholds (value in [0,100]), in
-+                    ascending order
-+    <lower_threshold_x> Below thresholds (value in [0,100]), in
-+                    ascending order
-+
-+Command Values
-+    See command parameters
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    OPT_TX_FRAME
-+
-+Synopsis
-+    Special feature, sends a special frame.
-+
-+Command
-+    wmiconfig --sendframe <frmType> <dstaddr> <bssid> <optIEDatalen>
-+    <optIEData>
-+
-+Command Parameters
-+    {
-+        A_UINT16    optIEDataLen;
-+        A_UINT8    frmType;
-+        A_UINT8    dstAddr[ATH_MAC_LEN];
-+        A_UINT8    bssid[ATH_MAC_LEN];
-+        A_UINT8    optIEData[1];
-+    } WMI_OPT_TX_FRAME_CMD;
-+
-+Command Values
-+    <frmtype>   = 1    Probe request frame
-+                = 2    Probe response frame
-+                = 3    CPPP start
-+                = 4    CPPP stop
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    Send a special frame only when special mode is on.
-+
-+=====================================================================
-+
-+
-+Name
-+    RECONNECT
-+
-+Synopsis
-+    This command requests a reconnection to a BSS to which the AR6000 device was
-+    formerly connected
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    UINT16    channel    Provides a hint as to which channel was
-+                        used for a previous connection
-+    UINT8    bssid[6]    If set, indicates which BSSID to connect to
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �CONNECT_CMD�
-+
-+=====================================================================
-+
-+
-+Name
-+    RSSI_THRESHOLD_PARAMS
-+
-+Synopsis
-+    Configures how the AR6000 device monitors and reports signal strength (RSSI) of the
-+    connected BSS, which is used as a link quality metric. The four RSSI threshold sets (in
-+    dbM) of the host specification divide the signal strength range into six segments.
-+    When signal strength increases or decreases across one of the boundaries, an
-+    RSSI_THRESHOLD event is signaled to the host. The host may then choose to take
-+    action (such as influencing roaming).
-+
-+Command
-+    wmiconfig eth1 --rssiThreshold <weight> <pollTime>
-+        <above_threshold_val_1> ... <above_threshold_tag_6>
-+        <above_threshold_val_6>
-+        <below_threshold_tag_1> <below_threshold_val_1> ...
-+        <below_threshold_tag_6> <below_threshold_val_6>
-+
-+Command Parameters
-+    UINT8    weight    Range in [1, 16] used to calculate average RSSI
-+    UINT32   pollTime   RSSI (signal strength) sampling frequency in
-+                seconds (if pollTime = 0, single strength
-+        sampling is disabled)
-+    USER_RSS__THOLD tholds[12]  Thresholds (6 x 2)
-+
-+Command Values
-+    None defined
-+
-+Reset Values
-+    pollTime is 0, and sampling is disabled
-+
-+Restrictions
-+    Can only be issued if the AR6000 device is connected
-+
-+
-+=====================================================================
-+
-+Name
-+    SCAN_PARAMS
-+
-+Synopsis
-+    The minact parameter determines the minimum active channel dwell time, within
-+    which if the STA receives any beacon, it remains on that channel until the maxact
-+    channel dwell time. If the STA does not receive a beacon within the minact dwell
-+    time, it switches to scan the next channel.
-+
-+Command
-+    wmiconfig -scan -minact=<ms> --maxact=<ms>
-+
-+Command Parameters
-+    UINT16    maxact    Channel dwell time (in ms), default = 0
-+    UINT16    minact    Channel dwell time (in ms), default = 105
-+
-+Command Values
-+    See channel parameters
-+
-+Reset Values
-+    None defined
-+
-+Restrictions
-+    The minact value should be greater than 0; maxact should be between 5�65535 ms
-+    and greater than minact
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_ACCESS_PARAMS
-+
-+Synopsis
-+    Allows the host to set access parameters for the wireless network. A thorough
-+    understanding of IEEE 802.11 is required to properly manipulate these parameters.
-+
-+Command
-+    wmiconfig eth1 --acparams --txop <limit> --cwmin <0-15>
-+    --cwmax <0-15> --aifsn<0-15>
-+
-+Command Parameters
-+    UINT16    txop    The maximum time (expressed in units of
-+                        32 ms) the device can spend transmitting
-+                        after acquiring the right to transmit
-+    UINT8    eCWmin    Minimum contention window
-+    UINT8    eCWmax    Maximum contention window
-+    UINT8    aifsn    The arbitration inter-frame space number
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    Reasonable defaults that vary, between endpoints (prioritized streams)
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_ADHOC_BSSID
-+
-+Synopsis
-+    Allows the host to set the BSSID for an ad hoc network. If a network with this BSSID
-+    is not found, the target creates an ad hoc network with this BSSID after the connect
-+    WMI command is triggered (e.g., by the SIOCSIWESSID IOCTL).
-+
-+Command
-+    wmiconfig eth1 --adhocbssid <bssid>
-+
-+Command Parameters
-+    A_UINT8     bssid[ATH_MAC_LEN]    BSSID is specified in xx:xx:xx:xx:xx:xx format
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_AKMP_PARAMS
-+
-+Synopsis
-+    Enables or disables multi PMKID mode.
-+
-+Command
-+    wmiconfig eth1 --setakmp --multipmkid=<on/off>
-+
-+Command Parameters
-+    typedef struct {
-+      A_UINT32    akmpInfo;
-+    } WMI_SET_AKMP_PARAMS_CMD;
-+
-+Command Values
-+    akmpInfo;
-+    bit[0] = 0
-+        MultiPMKID mode is disabled and PMKIDs that
-+        were set using the WMI_SET_PMKID_CMD are
-+        used in the [Re]AssocRequest frame.
-+     bit[0] = 1
-+        MultiPMKID mode is enabled and PMKIDs issued
-+        by the WMI_SET_PMKID_LIST_CMD are used in
-+        the next [Re]AssocRequest sent to the AP.
-+
-+Reset Values
-+    MultiPMKID mode is disabled
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_APPIE
-+
-+Synopsis
-+    Add an application-specified IE to a management frame. The maximum length is
-+    76 bytes. Including the length and the element ID, this translates to 78 bytes.
-+
-+Command
-+    wmiconfig --setappie <frame> <IE>, where:
-+
-+    frame
-+        One of beacon, probe, respon, assoc
-+
-+    IE
-+        A hex string beginning with DD (if = 0, no
-+        IE is sent in the management frame)
-+
-+Command Parameters
-+    mgmtFrmType;
-+        A WMI_MGMT_FRAME_TYPE
-+
-+    ieLen;
-+        Length of the IE to add to the GMT frame
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    Supported only for the probe request and association request management frame
-+types. Also, only one IE can be added per management frame type.
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_ASSOC_INFO
-+
-+Synopsis
-+    The host uses this command to specify any information elements (IEs) it wishes the
-+    AR6000 device to add to all future association and reassociation requests. IEs must be
-+    correct and are used as is by the device. IEs specified through this command are
-+    cleared with a DISCONNECT.
-+
-+Command
-+    wmiconfig eth1 --setAssocIe <IE>
-+
-+Command Parameters
-+    UINT8    ieType    Used directly in 802.11 frames
-+    UINT8    bufferSize    Size of assocInfo (in bytes) ranging from
-+                        0�240. If = 0, previously set IEs are cleared.
-+    UINT8    assocInfo[bufferSize]    Used directly in 802.11 frames
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    IEs are cleared
-+
-+Restrictions
-+    This command can only be issued in the DISCONNECTED state
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_AUTHMODE
-+
-+Synopsis
-+    Sets the 802.11 authentication mode of reconnection
-+
-+Command
-+    wmiconfig eth1 --setauthmode <mode>
-+
-+Command Parameters
-+    UINT8    mode
-+
-+Command Values
-+    mode    = 0x00    Proceed with authentication during reconnect
-+            = 0x01    Do not proceed with authentication during reconnect
-+
-+Reset Values
-+    Authentication
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BEACON_INT
-+
-+Synopsis
-+    Sets the beacon interval for an ad hoc network. Beacon interval selection may have an
-+    impact on power savings. To some degree, a longer interval reduces power
-+    consumption but also decreases throughput. A thorough understanding of IEEE
-+    802.11 ad hoc networks is required to use this command effectively.
-+
-+Command
-+    wmiconfig eth1 --ibssconintv
-+
-+Command Parameters
-+    UINT16    beaconInterval    Specifies the beacon interval in TU units (1024 ms)
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    The default beacon interval is 100 TUs (102.4 ms)
-+
-+Restrictions
-+    This command can only be issued before the AR6000 device starts an ad hoc network
-+
-+See Also
-+    �SET_IBSS_PM_CAPS�
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BIT_RATE
-+
-+Synopsis
-+    The host uses this command to set the AR6000 device to a specific fixed rate.
-+
-+Command
-+    wmiconfig eth1 --setfixrates <rate_0> ... <rate_n>
-+
-+Command Parameters
-+    INT8    rateIndex
-+    A WMI_BIT_RATE value
-+    {
-+        RATE_AUTO    = -1
-+        RATE_1Mb     = 0
-+        RATE_2Mb     = 1
-+        RATE_5_5M    = 2
-+        RATE_11Mb    = 3
-+        RATE_6Mb     = 4
-+        RATE_9Mb     = 5
-+        RATE_12Mb    = 6
-+        RATE_18Mb    = 7
-+        RATE_24Mb    = 8
-+        RATE_36Mb    = 9
-+        RATE_48Mb    = 10
-+        RATE_54Mb    = 11
-+      } WMI_BIT_RATE
-+
-+
-+Command Values
-+    See command parameters
-+
-+Reset Values
-+    The dynamic rate is determined by the AR6000 device
-+
-+Restrictions
-+    This command is intended for use only during development/debug; it is not
-+intended for use in production
-+
-+See Also
-+    �GET_BIT_RATE�
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BMISS_TIME
-+
-+Synopsis
-+    This command sets the beacon miss (BMISS) time, which the AR6000 hardware use
-+    to recognize missed beacons. When an excessive number (15) of consecutive beacons
-+    are missed, the AR6000 consider switching to a different BSS. The time can be
-+    specified in number of beacons or in TUs.
-+
-+Command(s)
-+    wmiconfig eth1 --setbmissbeacons=<val>
-+    wmiconfig eth1 --setbmisstime=<val>
-+
-+Command Parameters
-+    UINT16    bmissTime    Specifies the beacon miss time
-+                            [1000...5000] in TUs (1024 ms)
-+    UINT16    bmissbeacons  Specifies the number of beacons [5...50]
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    bmissTime is 1500 TUs (1536 ms)
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BSS_FILTER
-+
-+Synopsis
-+    The host uses this to inform the AR6000 device of the types of networks about which
-+    it wants to receive information from the �BSSINFO� event. As the device performs
-+    either foreground or background scans, it applies the filter and sends �BSSINFO�
-+    events only for the networks that pass the filter. If any of the  bssFilter or the ieMask
-+    filter matches, a BSS Info is sent to the host. The ieMask currently is used as a match
-+    for the IEs in the beacons, probe reponses and channel switch action management
-+    frame. See also �Scan and Roam� on page C-1.
-+
-+    The BSS filter command has been enhanced to support IE based filtering. The IEs can
-+    be specified as a bitmask through this command using this enum.
-+
-+Command
-+    wmiconfig eth1 �filter = <filter> --ieMask 0x<mask>
-+
-+Command Parameters
-+    UINT8    BssFilter
-+
-+ Command Values
-+    typedef struct {
-+        A_UINT8    bssFilter;    See WMI_BSS_FILTER
-+        A_UINT32    ieMask;
-+    } __ATTRIB_PACK WMI_BSS_FILTER_CMD;
-+
-+    The ieMask can take this combination of values:
-+
-+    enum {
-+        BSS_ELEMID_CHANSWITCH   = 0x01
-+        BSS_ELEMID_ATHEROS      = 0x02,
-+    }
-+
-+Reply Value
-+    None
-+
-+Reset Value
-+    BssFilter = NONE_BSS_FILTER (0)
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �CONNECT_CMD�
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BT_PARAMS
-+
-+Synopsis
-+    This command is used to set the status of a Bluetooth stream or set Bluetooth
-+    coexistence register parameters. The stream may be an SCO or an A2DP stream and
-+    its status can be started/stopped/suspended/resumed.
-+
-+Command
-+    wmiconfig �setBTparams <paramType> <params>
-+
-+Command Parameters
-+    struct {
-+       union {
-+            BT_PARAMS_SCO    scoParams;
-+            BT_PARAMS_A2DP   a2dpParams;
-+            BT_PARAMS_MISC   miscParams;
-+            BT_COEX_REGS     regs;
-+        } info;
-+         A_UINT8 paramType;
-+        struct {
-+            A_UINT8 noSCOPkts;    Number of SCO packets between consecutive PS-POLLs
-+            A_UINT8 pspollTimeout;
-+            A_UINT8 stompbt;
-+        } BT_PARAMS_SCO;
-+        struct {
-+            A2DP BT stream parameters
-+            A_UINT32   period;
-+            A_UINT32   dutycycle;
-+            A_UINT8    stompbt;
-+        } BT_PARAMS_A2DP;
-+        struct {
-+            union {
-+               WLAN_PROTECT_POLICY_TYPE   protectParams;
-+               A_UINT16    wlanCtrlFlags;
-+            }info;
-+        A_UINT8 paramType;
-+        } BT_PARAMS_MISC;
-+        struct {
-+            BT coexistence registers values
-+            A_UINT32    mode;     Coexistence mode
-+            A_UINT32    scoWghts; WLAN and BT weights
-+            A_UINT32    a2dpWghts;
-+            A_UINT32    genWghts;
-+            A_UINT32    mode2;    Coexistence mode2
-+            A_UINT8    setVal;
-+        } BT_COEX_REGS;
-+
-+Command Values
-+    None defined
-+
-+Reset Value
-+    None
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_BT_STATUS
-+
-+Synopsis
-+    Sets the status of a Bluetooth stream. The stream may be a SCO or an A2DP stream
-+    and its status can be started/stopped/suspended/resumed.
-+
-+Command
-+    wmiconfig �setBTstatus <streamType> <status>
-+
-+Command Parameters
-+    {
-+        A_UINT8        streamType;    Stream type
-+        A_UINT8        status;    Stream status
-+    }WMI_SET_BT_STATUS_CMD;
-+
-+Command Values
-+    {
-+        BT_STREAM_UNDEF    = 0
-+        BT_STREAM_SCO
-+        SCO stream
-+        BT_STREAM_A2DP
-+        A2DP stream
-+        BT_STREAM_MAX
-+    } BT_STREAM_TYPE;
-+
-+    {
-+        BT_STATUS_UNDEF    = 0
-+        BT_STATUS_START
-+        BT_STATUS_STOP
-+        BT_STATUS_RESUME
-+        BT_STATUS_SUSPEND
-+        BT_STATUS_MAX
-+    } BT_STREAM_STATUS;
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_CHANNEL_PARAMETERS
-+
-+Synopsis
-+    Configures various WLAN parameters related to channels, sets the wireless mode,
-+    and can restrict the AR6000 device to a subset of available channels. The list of
-+    available channels varies depending on the wireless mode and the regulatory
-+    domain. The device never operates on a channel outside of its regulatory domain. The
-+    device starts to scan the list of channels right after this command.
-+
-+Command
-+    wmiconfig eth1 --wmode <mode> <list>
-+
-+Command Parameters
-+    UINT8    phyMode    See Values below.
-+    UINT8    numberOfChannels
-+        Number of channels in the channel array that
-+        follows. If = 0, then the device uses all of the
-+        channels permitted by the regulatory domain
-+        and by the specified phyMode.
-+    UINT16    channel[numberOfChannels]
-+        Array listing the subset of channels (expressed
-+        as frequencies in MHz) the host wants the
-+        device to use. Any channel not permitted by
-+        the specified phyMode or by the specified
-+        regulatory domain is ignored by the device.
-+
-+Command Values
-+    phyMode = {
-+        Wireless mode
-+        11a    = 0x01
-+        11g    = 0x02
-+        11ag   = 0x03
-+        11b    = 0x04
-+        11g only    = 0x05
-+        }
-+
-+Reset Values
-+    phyMode
-+    11ag
-+    802.11a/g modules
-+        11g
-+    802.11g module
-+    channels
-+        Defaults to all channels permitted by the
-+        current regulatory domain.
-+
-+Restrictions
-+    This command, if issued, should be issued soon after reset and prior to the first
-+    connection. This command should only be issued in the DISCONNECTED state.
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_DISC_TIMEOUT
-+
-+Synopsis
-+    The host uses this command to configure the amount of time that the AR6000 should
-+    spend when it attempts to reestablish a connection after losing link with its current
-+    BSS. If this time limit is exceeded, the AR6000 send a �DISCONNECT� event. After
-+    sending the �DISCONNECT� event the AR6000 continues to attempt to reestablish a
-+    connection, but they do so at the interval corresponding to a foreground scan as
-+    established by the �SET_SCAN_PARAMS� command.
-+
-+    A timeout value of 0 indicates that the AR6000 will disable all autonomous roaming,
-+    so that the AR6000 will not perform any scans after sending a �DISCONNECT�
-+    event to the host. The state is maintained until a shutdown or host sets different
-+    timeout value from 0.
-+
-+Command
-+    wmiconfig eth1 --disc=<timeout in seconds>
-+
-+Command Parameters
-+    UINT8    disconnectTimeout
-+        Specifies the time limit (in seconds) after
-+        which a failure to reestablish a connection
-+        results in a �DISCONNECT� event
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    disconnectTimeout is 10 seconds
-+
-+Restrictions
-+    This command can only be issued while in a DISCONNECTED state
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_FIXRATES
-+
-+Synopsis
-+    By default, the AR6000 device uses all PHY rates based on mode of operation. If the
-+    host application requires the device to use subset of supported rates, it can set those
-+    rates with this command. In 802.11g mode, the AR6000 device takes the entire
-+    802.11g basic rate set and the rates specified with this command and uses it as the
-+    supported rate set.
-+
-+    This rate set is advertised in the probe request and the assoc/re-assoc request as
-+    supported rates. Upon successful association, the device modifies the rate set pool
-+    using the: intersection of AP-supported rates with the union of the 802.11g basic rate
-+    set and rates set using this command. The device picks transmission rates from this
-+    pool based on a rate control algorithm.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    A_UINT16    fixRateMask;
-+        The individual bit is an index for rate table,
-+        and setting the that index to 1 would set that
-+        corresponding rate. E.g., fixRateMask = 9
-+        (1001) sets 1 Mbps and 11 Mbps.
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �GET_FIXRATES�
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_WHAL_PARAM
-+
-+Synopsis
-+    An internal AR6000 command that is used to set certain hardware parameters. The
-+    description of this command is in $WORKAREA/include/halapi.h.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    ATH_HAL_SETCABTO_CMDID
-+        Sets the timeout waiting for the multicast
-+        traffic after a DTIM beacon (in TUs).
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    Default = 10 TUs
-+
-+Restrictions
-+    This command should be executed before issuing a connect command.
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_HOST_SLEEP_MODE
-+
-+Synopsis
-+    The host uses this command to set the host mode to asleep or awake. All packets are
-+    delivered to the host when the host mode is awake. When host mode is asleep, only if
-+    WoW is enabled and the incoming packet matches one of the specified WoW
-+    patterns, will the packet be delivered to the host. The host will also be woken up by
-+    the target for pattern-matching packets and important events.
-+
-+Command
-+    wmiconfig �sethostmode=<asleep/awake>
-+
-+Command Parameters
-+    A_BOOL    awake    Set the host mode to awake
-+    A_BOOL    asleep   Set the host mode to asleep
-+
-+Command Values
-+    1 = awake, 0 = asleep
-+
-+Reset Value
-+    None defined (default host mode is awake)
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_IBSS_PM_CAPS
-+
-+Synopsis
-+    Used to support a non-standard power management scheme for an ad hoc wireless
-+    network consisting of up to eight stations (STAs) that support this form of power
-+    saving (e.g., Atheros-based STAs). A thorough understanding of IEEE 802.11 ad hoc
-+    networks is required to use this command effectively.
-+
-+Command
-+    wmiconfig eth1 --ibsspmcaps --ps=<enable/disable>
-+        --aw=<ATIM Windows in ms>
-+        --ttl=<Time to live in number of beacon periods>
-+        --to=<timeout in ms>
-+
-+Command Parameters
-+    UINT8    power_saving
-+        = 0
-+        The non-standard power saving scheme is
-+        disabled and maximum throughput (with no
-+        power saving) is obtained.
-+
-+        = 1
-+        Ad hoc power saving scheme is enabled (but
-+        throughput may be decreased)
-+
-+    UINT16    atim_windows
-+        Specifies the length (in ms) of the ad hoc traffic
-+        indication message (ATIM) windows used in an ad
-+        hoc network. All Atheros-based STAs that join the
-+        network use this duration ATIM window.
-+
-+    The duration is communicated between wireless
-+    STAs through an IE in beacons and probe responses.
-+
-+    The host sets atim_windows to control trade-offs
-+    between power use and throughput. The value
-+    chosen should be based on the beacon interval (see
-+    the �SET_BEACON_INT� command) on the
-+    expected number of STAs in the IBSS, and on the
-+    amount of traffic and traffic patterns between STAs.
-+
-+    UINT16    timeout_value
-+        Specifies the timeout (in ms). The value is the same
-+        for all ad hoc connections, but tracks separately for
-+        each.
-+
-+        Applicable only for a beacon period and used to
-+        derive actual timeout values on the Tx and Rx sides.
-+        On the Tx side, the value defines a window during
-+        which the STA accepts the frame(s) from the host for a
-+        particular connection. Until closed, the window
-+        restarts with every frame received from the host. On
-+        the Rx side, indicates the time until which the STA
-+        continues accepting frames from a particular
-+        connection. The value resets with every frame
-+        received. The value can be used to determine the
-+        trade off between throughput and power.
-+        Default = 10 ms
-+
-+    UINT8    ttl
-+        Specifies the value in number of beacon periods. The
-+        value is used to set a limit on the time until which a
-+        frame is kept alive in the AR6001 before being
-+        discarded. Default = 5
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    By default, power_saving is enabled with atim_window = 20 ms
-+
-+Restrictions
-+    Can only be issued before the AR6000 starts an ad hoc network
-+
-+See Also
-+    �SET_BEACON_INT�
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    SET_LISTEN_INT
-+
-+Synopsis
-+    The host uses this command to request a listen interval, which determines how often
-+    the AR6000 device should wake up and listen for traffic. The listen interval can be set
-+    by the TUs or by the number of beacons. The device may not be able to comply with
-+    the request (e.g., if the beacon interval is greater than the requested listen interval, the
-+    device sets the listen interval to the beacon interval). The actual listen interval used
-+    by the device is available in the �CONNECT� event.
-+
-+Command
-+    wmiconfig eth1 --listen=<#of TUs, can range from 15 to 3000>
-+
-+    --listenbeacons=<#of beacons, can range from 1 to 50>
-+
-+Command Parameters
-+    UINT16    listenInterval
-+        Specifies the listen interval in Kms
-+        (1024 ms), ranging from 100 to 1000
-+
-+    UINT16    listenbeacons
-+        Specifies the listen interval in beacons,
-+        ranging from 1 to 50
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    The device sets the listen interval equal to the beacon interval of the AP it associates
-+    to.
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_LPREAMBLE
-+
-+Synopsis
-+    Overrides the short preamble capability of the AR6000 device
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    WMI_LPREAMBLE_DISABLED
-+        The device is short-preamble capable
-+
-+    WMI_LPREAMBLE_ENABLED
-+        The device supports only the long-
-+    preamble mode
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_MAX_SP_LEN
-+
-+Synopsis
-+    Set the maximum service period; indicates the number of packets the AR6001 can
-+    receive from the AP when triggered
-+
-+Command
-+    wmiconfig eth1 --setMaxSPLength <maxSPLen>
-+
-+Command Parameters
-+    UINT8    maxSPLen
-+        An APSD_SP_LEN_TYPE value
-+
-+Command Values
-+    {
-+        DELIVER_ALL_PKT  = 0x0
-+        DELIVER_2_PKT    = 0x1
-+        DELIVER_4_PKT    = 0x2
-+        DELIVER_6_PKT    = 0x3
-+    }APSD_SP_LEN_TYPE
-+
-+
-+Reset Values
-+    maxSPLen is DELIVER_ALL_PKT
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_OPT_MODE
-+
-+Synopsis
-+    Special feature, sets the special mode on/off
-+
-+Command
-+    wmiconfig eth1 --mode <mode>
-+    Set the optional mode, where mode is special or off
-+
-+Command Parameters
-+    enum {
-+        SPECIAL_OFF
-+        SPECIAL_ON
-+    } OPT_MODE_TYPE;
-+
-+Command Values
-+
-+Reset Value
-+    Mode = Off
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_PMKID
-+
-+Synopsis
-+    The host uses this command to enable or disable a pairwise master key ID (PMKID)
-+    in the AR6000 PMKID cache. The AR6000 clears its PMKID cache on receipt of a
-+    DISCONNECT command from the host. Individual entries in the cache might be
-+    deleted as the AR6000 detect new APs and decides to remove old ones.
-+
-+Command
-+    wmiconfig eth1 --setbsspmkid --bssid=<aabbccddeeff>
-+    --bsspmkid=<pmkid>
-+
-+Command Parameters
-+    UINT8    bssid[6]
-+        The MAC address of the AP that the
-+        PMKID corresponds to (6 bytes in hex
-+        format)
-+
-+    UINT8    enable
-+        Either PMKID_DISABLE (0) to disable
-+        the PMKID or PMKID_ENABLE (1) to
-+        enable it (16 bytes in hex format)
-+
-+    UINT8    pmkid[16]
-+        Meaningful only if enable is
-+        PMKID_ENABLE, when it is the PMKID
-+        that the AR6000 should use on the next
-+        reassociation with the specified AP
-+
-+Command Values
-+    enable
-+    = 0 (disable), 1 (enable)
-+    PKMID enabled/disabled
-+
-+Reset Values
-+    None defined
-+
-+Restrictions
-+    Only supported in infrastructure networks
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_PMKID_LIST_CMD
-+
-+Synopsis
-+    Configures the list of PMKIDs on the firmware.
-+
-+Command
-+    wmiconfig --setpmkidlist --numpmkid=<n> --pmkid=<pmkid_1>
-+    ... --pmkid=<pmkid_n>
-+
-+    Where n is the number of pmkids (maximum = 8) and pmkid_i is the ith pmkid (16
-+    bytes in hex format)
-+
-+Command Parameters
-+    {
-+        A_UINT8 pmkid[WMI_PMKID_LEN];
-+    } __ATTRIB_PACK WMI_PMKID;
-+
-+    {
-+        A_UINT32 numPMKID;
-+        WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
-+    } __ATTRIB_PACK WMI_SET_PMKID_LIST_CMD;
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    Supported only in infrastructure modes
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_POWER_MODE
-+
-+Synopsis
-+    The host uses this command to provide the AR6000 device with guidelines on the
-+    desired trade-off between power utilization and performance.
-+
-+        In normal power mode, the device enters a sleep state if they have nothing to do,
-+        which conserves power but may cost performance as it can take up to 2 ms to
-+        resume operation after leaving sleep state.
-+
-+        In maximum performance mode, the device never enters sleep state, thus no time
-+        is spent waking up, resulting in higher power consumption and better
-+        performance.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    UINT8    powerMode
-+        WMI_POWER_MODE value
-+    {
-+        REC_POWER   = 1
-+            (Recommended setting) Tries to conserve
-+            power without sacrificing performance
-+        MAX_PERF_POWER    = 2
-+            Setting that maximizes performance at
-+            the expense of power
-+
-+            All other values are reserved
-+    } WMI_POWER_MODE
-+
-+Command Values
-+    See command parameters
-+
-+Reset Values
-+    powerMode is REC_POWER
-+
-+Restrictions
-+    This command should only be issued in the DISCONNECTED state for the
-+    infrastructure network.
-+
-+            For a PM-disabled ad hoc network, the power mode should remain in
-+            MAX_PERF_POWER.
-+
-+            For a PM-enabled ad hoc network, the device can have REC_POWER or
-+            MAX_PERF_POWER set, but either way it must follow the power save ad hoc
-+            protocol. The host can change power modes in the CONNECTED state.
-+
-+    Host changes to the PS setting when the STA is off the home channel take no effect
-+    and cause a TARGET_PM_FAIL event.
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_POWER_PARAMS
-+
-+Synopsis
-+    The host uses this command to configure power parameters
-+
-+Command
-+    wmiconfig eth1 --pmparams --it=<ms> --np=<number of PS POLL>
-+    --dp=<DTIM policy: ignore/normal/stick>
-+
-+Command Parameters
-+    UINT16    idle_period
-+        Length of time (in ms) the AR6000 device
-+        remains awake after frame Rx/Tx before going
-+        to SLEEP state
-+
-+    UINT16    pspoll_number
-+            The number of PowerSavePoll (PS-poll)
-+            messages the device should send before
-+            notifying the AP it is awake
-+
-+    UINT16    dtim_policy
-+            A WMI_POWER_PARAMS_CMD value
-+
-+    {
-+        IGNORE_DTIM    =1
-+            The device does not listen to any content after
-+            beacon (CAB) traffic
-+        NORMAL_DTIM    = 2
-+            DTIM period follows the listen interval (e.g., if
-+            the listen interval is 4 and the DTIM period is 2,
-+            the device wakes up every fourth beacon)
-+        STICK_DTIM    = 3
-+            Device attempt to receive all CAB traffic (e.g., if
-+            the DTIM period is 2 and the listen interval is 4,
-+            the device wakes up every second beacon)
-+    } WMI_POWER_PARAMS_CMD
-+
-+Command Parameters
-+    See command parameters
-+
-+Reset Values
-+    idle_period
-+        200 ms
-+
-+    pspoll_number
-+    = 1
-+
-+    dtim_policy
-+    = NORMAL_DTIM
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_POWERSAVE_PARAMS
-+
-+Synopsis
-+    Set the two AR6000 power save timers (PS-POLL timer and APSD trigger timer) and
-+    the two ASPD TIM policies
-+
-+Command
-+    wmiconfig eth1--psparams --psPollTimer=<psPollTimeout in ms>
-+    --triggerTimer=<triggerTimeout in ms> --apsdTimPolicy=<ignore/
-+    adhere> --simulatedAPSDTimPolicy=<ignore/adhere>
-+
-+Command Parameters
-+    typedef struct {
-+        A_UINT16    psPollTimeout;
-+            Timeout (in ms) after sending PS-POLL; the
-+            AR6000 device sleeps if it does not receive a
-+            data packet from the AP
-+
-+        A_UINT16    triggerTimeout;
-+            Timeout (in ms) after sending a trigger; the
-+            device sleeps if it does not receive any data
-+            or null frame from the AP
-+
-+        APSD_TIM_POLICY    apsdTimPolicy;
-+            TIM behavior with queue APSD enabled
-+
-+        APSD_TIM_POLICY    simulatedAPSD
-+
-+        TimPolicy;
-+            TIM behavior with simulated APSD
-+            enabled
-+
-+    typedef enum {
-+        IGNORE_TIM_ALL_QUEUES_APSD = 0,
-+        PROCESS_TIM_ALL_QUEUES_APSD = 1,
-+        IGNORE_TIM_SIMULATED_APSD = 2,
-+        POWERSAVE_TIMERS_POLICY = 3,
-+    } APSD_TIM_POLICY;
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    psPollTimeout is 50 ms; triggerTimeout is 10 ms;
-+    apsdTimPolicy = IGNORE_TIM_ALL_QUEUES_APSD;
-+    simulatedAPSDTimPolicy = POWERSAVE_TIMERS_POLICY
-+
-+Restrictions
-+    When this command is used, all parameters must be set; this command does not
-+    allow setting only one parameter.
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_PROBED_SSID
-+
-+Synopsis
-+    The host uses this command to provide a list of up to MAX_PROBED_SSID_INDEX
-+    (six) SSIDs that the AR6000 device should actively look for. It lists the active SSID
-+    table. By default, the device actively looks for only the SSID specified in the
-+    �CONNECT_CMD� command, and only when the regulatory domain allows active
-+    probing. With this command, specified SSIDs are probed for, even if they are hidden.
-+
-+Command
-+    wmiconfig eth1 --ssid=<ssid> [--num=<index>]
-+
-+Command Parameters
-+    {
-+        A_UINT8    numSsids
-+            A number from 0 to
-+            MAX_PROBED_SSID_INDEX indicating
-+            the active SSID table entry index for this
-+            command (if the specified entry index
-+            already has an SSID, the SSID specified in
-+            this command replaces it)
-+
-+        WMI_PROBED_SSID_INFO    probedSSID[1]
-+    } WMI_PROBED_SSID_CMD
-+
-+    {
-+        A_UINT8    flag
-+            WMI_SSID_FLAG indicates the current
-+            entry in the active SSID table
-+        A_UINT8    ssidLength
-+            Length of the specified SSID in bytes.
-+            If = 0, the entry corresponding to the
-+            index is erased
-+        A_UINT8    ssid[32]
-+            SSID string actively probed for when
-+            permitted by the regulatory domain
-+    } WMI_PROBED_SSID_INFO
-+
-+Command Values
-+    WMI_SSID_FLAG
-+    {
-+         DISABLE_SSID_FLAG    = 0
-+            Disables entry
-+        SPECIFIC_SSID_FLAG    = 1
-+            Probes specified SSID
-+        ANY_SSID_FLAG    = 2
-+            Probes for any SSID
-+    } WMI_SSID_FLAG
-+
-+Reset Value
-+    The entries are unused.
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_REASSOC_MODE
-+
-+Synopsis
-+    Specify whether the disassociated frame should be sent or not upon reassociation.
-+
-+Command
-+    wmiconfig eth1 --setreassocmode <mode>
-+
-+Command Parameters
-+    UINT8    mode
-+
-+Command Values
-+    mode
-+        = 0x00
-+        Send disassoc to a previously connected AP
-+        upon reassociation
-+        = 0x01
-+        Do not send disassoc to previously connected
-+        AP upon reassociation
-+
-+Reset Values
-+    None defined
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_RETRY_LIMITS
-+
-+Synopsis
-+    Allows the host to influence the number of times that the AR6000 device should
-+    attempt to send a frame before they give up.
-+
-+Command
-+    wmiconfig --setretrylimits <frameType> <trafficClass> <maxRetries>
-+    <enableNotify>
-+
-+Command Parameters
-+    {
-+        UINT8    frameType
-+            A WMI_FRAMETYPE specifying
-+            which type of frame is of interest.
-+        UINT8    trafficClass
-+            Specifies a traffic class (see
-+            �CREATE_PSTREAM�). This
-+            parameter is only significant when
-+            frameType = DATA_FRAMETYPE.
-+        UINT8    maxRetries
-+            Maximum number of times the
-+            device attempts to retry a frame Tx,
-+            ranging from WMI_MIN_RETRIES
-+            (2) to WMI_MAX_RETRIES (15). If
-+            the special value 0 is used,
-+            maxRetries is set to 15.
-+        A_UINT8    enableNotify
-+            Notify when enabled
-+    } WMI_RETRY_LIMIT_INFO
-+
-+    {
-+        A_UINT8    numEntries
-+        WMI_RETRY_LIMIT_INFO  retryLimitInfo[1]
-+    } WMI_SET_RETRY_LIMITS_CMD
-+
-+Command Values
-+    {
-+        MGMT_FRAMETYPE    = 0    Management frame
-+        CONTROL_FRAMETYPE = 1    Control frame
-+        DATA_FRAMETYPE    = 2    Data frame
-+    } WMI_FRAMETYPE
-+
-+Reset Values
-+    Retries are set to 15
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_ROAM_CTRL
-+
-+Synopsis
-+    Affects how the AR6000 device selects a BSS. The host uses this command to set and
-+    enable low RSSI scan parameters. The time period of low RSSI background scan is
-+    mentioned in scan period. Low RSSI scan is triggered when the current RSSI
-+    threshold (75% of current RSSI) is equal to or less than scan threshold.
-+
-+    Low RSSI roam is triggered when the current RSSI threshold falls below the roam
-+    threshold and roams to a better AP by the end of the scan cycle. During Low RSSI
-+    roam, if the STA finds a new AP with an RSSI greater than roam RSSI to floor, during
-+    scan, it roams immediately to it instead of waiting for the end of the scan cycle. See
-+    also �Scan and Roam� on page C-1.
-+
-+Command
-+    wmiconfig --roam <roamctrl> <info>, where info is <scan period>
-+    <scan threshold> <roam threshold> <roam rssi floor>
-+
-+Command Parameters
-+    A_UINT8    roamCtrlType;
-+
-+Command Values
-+    WMI_FORCE_ROAM     = 1
-+    Roam to the specified BSSID
-+
-+    WMI_SET_ROAM_MODE  = 2
-+    Default, progd bias, no roam
-+
-+    WMI_SET_HOST_BIAS  = 3
-+    Set the host bias
-+
-+    WMI_SET_LOWRSSI_SCAN_PARAMS  = 4
-+    Info parameters
-+
-+    A_UINT8    bssid[ATH_MAC_LEN];
-+    WMI_FORCE_ROAM
-+
-+    A_UINT8    roamMode;
-+    WMI_SET_ROAM_MODE
-+
-+    A_UINT8    bssBiasInfo;
-+    WMI_SET_HOST_BIAS
-+
-+    A_UINT16    lowrssi_scan_period;
-+    WMI_SET_LOWRSSI_SCAN_PARAMS
-+
-+    A_INT16
-+    lowrssi_scan_threshold;
-+    WMI_SET_LOWRSSI_SCAN_PARAMS
-+
-+    A_INT16    lowrssi_roam_threshold;
-+    WMI_SET_LOWRSSI_SCAN_PARAMS
-+
-+    A_UINT8    roam_rssi_floor;
-+    WMI_SET_LOWRSSI_SCAN_PARAMS
-+
-+Reset Value
-+    None defined (default lowrssi scan is disabled. Enabled only when scan period is set.)
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_RTS
-+
-+Synopsis
-+    Decides when RTS should be sent.
-+
-+Command
-+    wmiconfig eth1 --setRTS <pkt length threshold>
-+
-+Command Parameters
-+    A_UINT16
-+    threshold;
-+    Command parameter threshold in bytes. An RTS is
-+    sent if the data length is more than this threshold.
-+    The default is to NOT send RTS.
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    Not to send RTS.
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_SCAN_PARAMS
-+
-+Synopsis
-+    The host uses this command to set the AR6000 scan parameters, including the duty
-+    cycle for both foreground and background scanning. Foreground scanning takes
-+    place when the AR6000 device is not connected, and discovers all available wireless
-+    networks to find the best BSS to join. Background scanning takes place when the
-+    device is already connected to a network and scans for potential roaming candidates
-+    and maintains them in order of best to worst. A second priority of background
-+    scanning is to find new wireless networks.
-+
-+    The device initiates a scan when necessary. For example, a foreground scan is always
-+    started on receipt of a �CONNECT_CMD� command or when the device cannot find
-+    a BSS to connect to. Foreground scanning is disabled by default until receipt of a
-+    CONNECT command. Background scanning is enabled by default and occurs every
-+    60 seconds after the device is connected.
-+
-+    The device implements a binary backoff interval for foreground scanning when it
-+    enters the DISCONNECTED state after losing connectivity with an AP or when a
-+    CONNECT command is received. The first interval is ForegroundScanStartPeriod,
-+    which doubles after each scan until the interval reaches ForegroundScanEndPeriod.
-+    If the host terminates a connection with DISCONNECT, the foreground scan period
-+    is ForegroundScanEndPeriod. All scan intervals are measured from the time a full
-+    scan ends to the time the next full scan starts. The host starts a scan by issuing a
-+    �START_SCAN� command. See also �Scan and Roam� on page C-1.
-+
-+Command
-+    wmiconfig eth1 --scan --fgstart=<sec> --fgend=<sec> --bg=<sec> --
-+    act=<msec> --pas=<msec> --sr=<short scan ratio> --scanctrlflags
-+    <connScan> <scanConnected> <activeScan> <reportBSSINFO>
-+
-+Command Parameters
-+    UINT16    fgStartPeriod
-+        First interval used by the device when it
-+        disconnects from an AP or receives a
-+        CONNECT command, specified in seconds (0�
-+        65535). If = 0, the device uses the reset value.
-+        If = 65535, the device disables foreground
-+        scanning.
-+
-+    UINT16    fgEndPeriod
-+        The maximum interval the device waits between
-+        foreground scans specified in seconds (from
-+        ForegroundScanStartPeriod to 65535). If = 0, the
-+        device uses the reset value.
-+
-+    UINT16    bgScanPeriod
-+        The period of background scan specified in
-+        seconds (0�65535). By default, it is set to the reset
-+        value of 60 seconds. If 0 or 65535 is specified, the
-+        device disables background scanning.
-+
-+    UINT16    maxactChDwellTime
-+        The period of time the device stays on a
-+        particular channel while active scanning. It is
-+        specified in ms (10�65535). If the special value of
-+        0 is specified, the device uses the reset value.
-+
-+    UINT16    PasChDwellTime
-+        The period of time the device remains on a
-+        particular channel while passive scanning. It is
-+        specified in ms (10�65535). If the special value of
-+        0 is specified, the device uses the reset value.
-+
-+    UINT8    shortScanRatio
-+        Number of short scans to perform for each
-+        long scan.
-+
-+    UINT8    scanCtrlFlasgs
-+
-+    UINT16    minactChDwellTime
-+        Specified in ms
-+
-+    UINT32    maxDFSchActTime
-+        The maximum time a DFS channel can stay
-+        active before being marked passive, specified in
-+        ms.
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    ForegroundScanStart
-+Period
-+        1 sec
-+
-+    ForegroundScanEndPeriod
-+        60 sec
-+
-+    BackgroundScanPeriod
-+        60 sec
-+
-+    ActiveChannelDwellTime
-+        105 ms
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_TKIP_COUNTERMEASURES
-+
-+Synopsis
-+    The host issues this command to tell the target whether to enable or disable TKIP
-+    countermeasures.
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    UINT8    WMI_TKIP_CM_ENABLE
-+        Enables the countermeasures
-+
-+
-+    UINT8    TKIP_CM_DISABLE
-+        Disables the countermeasures
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    By default, TKIP MIC reporting is disabled
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_TX_PWR
-+
-+Synopsis
-+    The host uses this command to specify the Tx power level of the AR6000. Cannot be
-+    used to exceed the power limit permitted by the regulatory domain. The maximum
-+    output power is limited in the chip to 31.5 dBm; the range is 0 � 31.5 dbm.
-+
-+Command
-+    wmiconfig --power <dbM>
-+
-+Command Parameters
-+    UINT8    dbM
-+        The desired Tx power specified in dbM.
-+        If = 0, the device chooses the maximum
-+        permitted by the regulatory domain.
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    The maximum permitted by the regulatory domain
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �GET_TX_PWR�
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_VOICE_PKT_SIZE
-+
-+Synopsis
-+    If an AP does not support WMM, it has no way to differentiate voice from data.
-+    Because the voice packet is typically small, packet in size less than voicePktSize are
-+    assumed to be voice, otherwise it is treated as data.
-+
-+Command
-+    wmiconfig eth1 --setVoicePktSize <size-in-bytes>
-+
-+Command Parameters
-+    UINT16    voicePktSize
-+        Packet size in octets
-+
-+Command Values
-+    None
-+
-+Reset Values
-+    voicePktSize default is 400 bytes
-+
-+Restrictions
-+    No effect if WMM is unavailable
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_WMM
-+
-+Synopsis
-+    Overrides the AR6000 device WMM capability
-+
-+Command
-+    wmiconfig eth1 --setwmm <enable>
-+
-+Command Parameters
-+    WMI_WMM_ENABLED
-+        Enables WMM
-+
-+    WMI_WMM_DISABLED
-+        Disables WMM support
-+
-+Command Values
-+    0 = disabled
-+    1 = enabled
-+
-+Reset Value
-+    WMM Disabled
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_WMM_TXOP
-+
-+Synopsis
-+    Configures TxOP Bursting when sending traffic to a WMM capable AP
-+
-+Command
-+    wmiconfig eth1 --txopbursting <burstEnable>
-+
-+    <burstEnable>
-+        = 0
-+    Disallow TxOp bursting
-+
-+        = 1
-+    Allow TxOp bursting
-+
-+Command Parameters
-+    txopEnable
-+        = WMI_TXOP_DISABLED
-+        Disabled
-+
-+        = WMI_TXOP_ENABLED
-+        Enabled
-+
-+Command Values
-+    txopEnable
-+        = 0    Disabled
-+
-+        = 1    Enabled
-+
-+Reset Value
-+    Bursting is off by default
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_WOW_MODE
-+
-+Synopsis
-+    The host uses this command to enable or disable the WoW mode. When WoW mode
-+    is enabled and the host is asleep, pattern matching takes place at the target level.
-+    Only packets that match any of the pre-specified WoW filter patterns, will be passed
-+    up to the host. The host will also be woken up by the target. Packets which do not
-+    match any of the WoW patterns are discarded.
-+
-+Command
-+    wmiconfig �setwowmode <enable/disable>
-+
-+Command Parameters
-+    A_BOOL    enable_wow
-+        Enable or disable WoW:
-+
-+Command Values
-+        = 0
-+    Disable WoW
-+
-+        = 1
-+    Enable WoW
-+
-+Reset Value
-+    None defined (default WoW mode is disabled).
-+
-+Restrictions
-+    None
-+
-+See Also
-+    �GET_WOW_LIST�
-+
-+
-+=====================================================================
-+
-+Name
-+    SET_WSC_STATUS
-+
-+Synopsis
-+    The supplicant uses this command to inform the target about the status of the WSC
-+    registration protocol. During the WSC registration protocol, a flag is set so the target
-+    bypasses some of the checks in the CSERV module. At the end of the registration, this
-+    flag is reset.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    A_BOOL status
-+        = 1    WSC registration in progress
-+        = 0    WSC protocol not running
-+
-+Reply Parameters
-+    None
-+
-+Reset Value
-+    None defined (default = 0)
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    SNR_THRESHOLD_PARAMS
-+
-+Synopsis
-+    Configures how the AR6000 device monitors and reports SNR of the connected BSS,
-+    used as a link quality metric.
-+
-+Command
-+    --snrThreshold <weight> <upper_threshold_1> ...
-+    <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
-+    <pollTimer>
-+
-+Command Parameters
-+    <weight>
-+        Share with rssiThreshold. Range in [1, 16], used
-+        in the formula to calculate average RSSI
-+
-+    <upper_threshold_x>
-+        Above thresholds expressed in db, in ascending
-+        order
-+
-+    <lower_threshold_x>
-+        Below thresholds expressed in db, in ascending
-+        order
-+
-+    <pollTimer>
-+        The signal strength sampling frequency in
-+        seconds. If polltime = 0, signal strength
-+        sampling is disabled
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    None defined
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    START_SCAN
-+
-+Synopsis
-+    The host uses this command to start a long or short channel scan. All future scans are
-+    relative to the time the AR6000 device processes this command. The device performs
-+    a channel scan on receipt of this command, even if a scan was already in progress.
-+    The host uses this command when it wishes to refresh its cached database of wireless
-+    networks. The isLegacy field will be removed (0 for now) because it is achieved by
-+    setting CONNECT_PROFILE_MATCH_DONE in the CONNECT command. See also
-+    �Scan and Roam�
-+
-+Command
-+    wmiconfig eth1 --startscan <scan type> <forcefgscan> 0
-+    <homeDwellTime> <forceScanInterval>
-+
-+Command Parameters
-+    UINT8    scanType
-+        WMI_SCAN_TYPE
-+
-+Command Values
-+    {
-+        WMI_LONG_SCAN    =0x0
-+            Requests a full scan
-+        WMI_SHORT_SCAN   =0x1
-+            Requests a short scan
-+    } WMI_SCAN_TYPE
-+
-+    A_BOOL    forceFgScan
-+        forceFgScan
-+        = 0
-+        Disable the foreground scan
-+
-+        forceFgScan
-+        = 1
-+        Forces a foreground scan
-+
-+    A_UINT32    homeDwellTime
-+        Maximum duration in the home
-+        channel (in ms)
-+
-+    A_UINT32     forceScanInterval
-+        Time interval between scans (in ms)
-+
-+    A_UINT32     scanType
-+        WMI_SCAN_TYPE
-+
-+Reset Value
-+    Disable forcing foreground scan
-+
-+Restrictions
-+    isLegacy field will no longer be supported (pass as 0 for now)
-+
-+
-+=====================================================================
-+
-+Name
-+    SYNCHRONIZE
-+
-+Synopsis
-+    The host uses this command to force a synchronization point between the command
-+    and data paths
-+
-+Command
-+    TBD
-+
-+Command Parameters
-+    None
-+
-+
-+
-+Command Values
-+    None
-+
-+
-+
-+Reset Values
-+    None
-+
-+
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    TARGET_ERROR_REPORT_BITMASK
-+
-+Synopsis
-+    Allows the host to control �ERROR_REPORT� events from the AR6000 device.
-+
-+        If error reporting is disabled for an error type, a count of errors of that type is
-+        maintained by the device.
-+
-+        If error reporting is enabled for an error type, an �ERROR_REPORT� event is
-+        sent when an error occurs and the error report bit is cleared.
-+
-+    Error counts for each error type are available through the �GET_TARGET_STATS�
-+    command.
-+
-+Command
-+    wmiconfig eth1 --setErrorReportingBitmask
-+
-+Command Parameters
-+    UINT32    bitmask
-+        Represents the set of
-+        WMI_TARGET_ERROR_VAL error types
-+        enabled for reporting
-+
-+Command Values
-+    {
-+        WMI_TARGET_PM_ERR_FAIL    = 0x00000001
-+            Power save fails (only two cases):
-+               Retry out of null function/QoS null
-+               function to associated AP for PS
-+               indication'
-+               Host changes the PS setting when
-+               STA is off home channel
-+
-+        WMI_TARGET_KEY_NOT_FOUND    = 0x00000002
-+            No cipher key
-+        WMI_TARGET_DECRYPTION_ERR   = 0x00000004
-+            Decryption error
-+        WMI_TARGET_BMISS            = 0x00000008
-+            Beacon miss
-+        WMI_PSDISABLE_NODE_JOIN     = 0x00000010
-+            A non-PS-enabled STA joined the
-+            PS-enabled network
-+        WMI_TARGET_COM_ERR          = 0x00000020
-+            Host/target communication error
-+        WMI_TARGET_FATAL_ERR        = 0x00000040
-+            Fatal error
-+    } WMI_TARGET_ERROR_VAL
-+
-+Reset Values
-+    Bitmask is 0, and all error reporting is disabled
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+WMI Events
-+
-+Event
-+    Description
-+    Page
-+
-+
-+BSSINFO
-+    Contains information describing BSSs collected during a scan
-+
-+CAC_EVENTID
-+    Indicates signalling events in admission control
-+
-+CMDERROR
-+    The AR6000 device encounters an error while attempting to process
-+    a command
-+
-+CONNECT
-+    The device has connected to a wireless network
-+
-+DISCONNECT
-+    The device lost connectivity with a wireless network
-+
-+ERROR_REPORT
-+    An error has occurred for which the host previously requested
-+    notification with the command
-+    �TARGET_ERROR_REPORT_BITMASK�
-+
-+EXTENSION
-+    WMI extension event
-+
-+GET_PMKID_LIST_EVENT
-+    Created in response to a �GET_PMKID_LIST_CMD� command
-+
-+GET_WOW_LIST_EVENT
-+    Response to the wmiconfig �GET_WOW_LIST� command to
-+    retrieve the configured WoW patterns
-+
-+NEIGHBOR_REPORT
-+    Neighbor APs that match the current profile were detected
-+
-+OPT_RX_FRAME_EVENT
-+    (Special feature) informs the host of the reception of a special frame
-+
-+PSTREAM_TIMEOUT
-+    A prioritized stream has been idle for a specified interval
-+
-+READY
-+    The AR6000 device is ready to accept commands
-+
-+REGDOMAIN
-+    The regulatory domain has changed
-+
-+REPORT_ROAM_DATA_EVENT
-+    Reports the roam time calculations made by the device
-+    (generated with a special build)
-+    �
-+
-+REPORT_STATISTICS
-+    Reply to a �GET_TARGET_STATS� command
-+
-+ROAM_TBL_EVENT
-+    Reports the roam table
-+
-+RSSI_THRESHOLD
-+    Signal strength from the connected AP has crossed the threshold
-+    defined in the �RSSI_THRESHOLD_PARAMS� command
-+
-+SCAN_COMPLETE_EVENT
-+    A scan has completed (added status SCAN_ABORTED in release 2.0)
-+
-+TEST_EVENT
-+    Event generated by the TCMD
-+
-+TKIP_MICERROR
-+    TKIP MIC errors were detected
-+
-+=====================================================================
-+
-+Name
-+    BSSINFO
-+
-+Synopsis
-+    Contains information describing one or more BSSs as collected during a scan.
-+    Information includes the BSSID, SSID, RSSI, network type, channel, supported rates,
-+    and IEs. BSSINFO events are sent only after the device receives a beacon or probe-
-+    response frame that pass the filter specified in the �SET_BSS_FILTER� command.
-+    BSSINFO events consist of a small header followed by a copy of the beacon or probe
-+    response frame. The 802.11 header is not present. For formats of beacon and probe-
-+    response frames please consult the IEEE 802.11 specification.
-+
-+    The beacons or probe responses containing the IE specified by the
-+    WMI_BSS_FILTER_CMD are passed to the host through the
-+    WMI_BSSINFO_EVENT. The event carries a 32-bit bitmask that indicates the IEs that
-+    were detected in the management frame. The frame type field has been extended to
-+    indicate action management frames. This would be helpful to route these frames
-+    through the same event mechanism as used by the beacon processing function.
-+
-+    If the bssFilter in the SET_BSS_FILTER matches, then the ieMask is not relevant
-+    because the BSSINFO event is sent to the host. If the bssFilter doesnot match in the
-+    beacons/probe respones, then the ieMask match dictates whether the BSSINFO
-+    event is sent to the host. In the case of action management frames, the ieMask is the
-+    filter that is applied.
-+
-+Event ID
-+    0x1004
-+
-+Event Parameters
-+    typedef struct {
-+        A_UINT16    channel;
-+            Specifies the frequency (in MHz) where the
-+            frame was received
-+        A_UINT8    frameType;
-+            A WMI_BI_FTYPE value
-+        A_UINT8    snr;
-+        A_INT16    rssi;
-+            Indicates signal strength
-+        A_UINT8    bssid[ATH_MAC_LEN];
-+        A_UINT32    ieMask;
-+    } _ATTRIB_PACK_WMI_BSS_INFO_HDR;
-+
-+    Beacon or Probe Response Frame
-+
-+Event Values
-+    {
-+        BEACON_FTYPE    = 0x1
-+            Indicates a beacon frame
-+        PROBERESP_FTYPE
-+            Indicates a probe response frame
-+        ACTION_MGMT_FTYPE
-+     } WMI_BI_FTYPE
-+
-+=====================================================================
-+
-+Name
-+    CAC_EVENTID
-+
-+Synopsis
-+    Indicates signalling events in admission control. Events are generated when
-+    admission is accepted, rejected, or deleted by either the host or the AP. If the AP does
-+    not respond to an admission request within a timeout of 500 ms, an event is
-+    generated to the host.
-+
-+Event ID
-+    0x1011
-+
-+Event Parameters
-+    UINT8
-+    ac
-+    Access class pertaining to the
-+signalling
-+
-+    UINT8    cac_indication
-+        Type of indication; indications are
-+        listed in WMI_CAC_INDICATION
-+
-+    UINT8    statusCode
-+        AP response status code for a
-+        request
-+
-+    UINT8    tspecSuggestion[63]
-+        Suggested TSPEC from AP
-+
-+Event Values
-+    {
-+        CAC_INDICATION_ADMISSION = 0x00
-+        CAC_INDICATION_ADMISSION_RESP    = 0x01
-+        CAC_INDICATION_DELETE    = 0x02
-+        CAC_INDICATION_NO_RESP   = 0x03
-+    } WMI_CAC_INDICATION
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    CMDERROR
-+
-+Synopsis
-+    Indicates that the AR6000 device encountered an error while attempting to process a
-+    command. This error is fatal and indicates that the device requires a reset.
-+
-+Event ID
-+    0x1005
-+
-+Event Parameters
-+    UINT16    commandId
-+        Corresponds to the command which generated
-+        the error
-+    UINT8    errorCode
-+        A WMI_ERROR_CODE value
-+
-+Event Values
-+    {
-+        INVALID_PARAM    = 1
-+            Invalid parameter
-+        ILLEGAL_STATE    = 2
-+            Illegal state
-+        INTERNAL_ERROR   = 3
-+            Internal Error
-+        All other values reserved
-+    } WMI_ERROR_CODE
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    CONNECT
-+
-+Synopsis
-+    Signals that the AR6000 connected to a wireless network. Connection occurs due to a
-+    �CONNECT� command or roaming to a new AP. For infrastructure networks, shows
-+    that the AR6000 successfully performed 802.11 authentication and AP association.
-+
-+Event ID
-+    0x1002
-+
-+Event Parameters
-+    UINT16    channel
-+        Channel frequency (in MHz) of the network the
-+        AR6000 are connected to
-+
-+    UINT8    bssid[6]
-+        MAC address of the AP the AR6000 are
-+        connected to or the BSSID of the ad hoc
-+        network
-+
-+    UINT16    listenInterval
-+        Listen interval (in Kms) that the AR6000 are
-+        using
-+
-+    UINT 8    beaconIeLen
-+        Length (in bytes) of the beacon IEs
-+
-+    UINT8    assocInfo
-+        Pointer to an array containing beacon IEs,
-+        followed first by association request IEs then by
-+        association response IEs
-+
-+    UINT8    assocReqLen
-+        Length (in bytes) of the assocReqIEs array
-+
-+    UINT8    assocRespLen
-+        Length (in bytes) of the assocRespIEs array
-+
-+Event Values
-+    None defined
-+
-+=====================================================================
-+
-+
-+Name
-+    DISCONNECT
-+
-+Synopsis
-+    Signals that the AR6000 device lost connectivity with the wireless network.
-+    DISCONENCT is generated when the device fails to complete a �CONNECT�
-+    command or as a result of a transition from a connected state to disconnected state.
-+
-+    After sending the �DISCONNECT� event the device continually tries to re-establish
-+    a connection. A LOST_LINK occurs when STA cannot receive beacons within the
-+    specified time for the SET_BMISS_TIME command.
-+
-+Event ID
-+    0x1003
-+
-+Event Parameters
-+    UINT8    disconnect
-+        Reason
-+        A WMI_DISCONNECT_REASON value
-+
-+    UINT8    bssid[6]
-+        Indicates which BSS the device was connected to
-+
-+    UINT8    assocRespLen
-+        Length of the 802.11 association response frame
-+        that triggered this event, or 0 if not applicable
-+
-+    UINT8    assocInfo[assocRespLen]
-+        Copy of the 802.11 association response frame
-+
-+Event Values
-+    {
-+        NO_NETWORK_AVAIL    =0x01
-+            Indicates that the device was unable to
-+            establish or find the desired network
-+        LOST_LINK    =0x02
-+            Indicates the devices is no longer receiving
-+            beacons from the BSS it was previously
-+            connected to
-+
-+        DISCONNECT_CMD  =0x03
-+            Indicates a �DISCONNECT� command was
-+            processed
-+        BSS_DISCONNECTED =0x04
-+            Indicates the BSS explicitly disconnected the
-+            device. Possible mechanisms include the AP
-+            sending 802.11 management frames
-+            (e.g., disassociate or deauthentication
-+            messages).
-+        AUTH_FAILED    =0x05
-+            Indicates that the device failed 802.11
-+            authentication with the BSS
-+        ASSOC_FAILED    =0x06
-+            Indicates that the device failed 802.11
-+            association with the BSS
-+        NO_RESOURCES_AVAIL    =0x07
-+            Indicates that a connection failed because the
-+            AP had insufficient resources to complete the
-+            connection
-+        CSERV_DISCONNECT    =0x08
-+            Indicates that the device�s connection services
-+            module decided to disconnect from a BSS,
-+            which can happen for a variety of reasons (e.g.,
-+            the host marks the current connected AP as a
-+            bad AP).
-+        INVALID_PROFILE    =0x0A
-+            Indicates that an attempt was made to
-+            reconnect to a BSS that no longer matches the
-+            current profile
-+        All other values are reserved
-+    } WMI_DISCONNECT_REASON
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    ERROR_REPORT
-+
-+Synopsis
-+    Signals that a type of error has occurred for which the host previously requested
-+    notification through the �TARGET_ERROR_REPORT_BITMASK� command.
-+
-+Event ID
-+    0x100D
-+
-+Event Parameters
-+    UINT32    errorVal
-+            WMI_TARGET_ERROR_VAL value. See
-+            �TARGET_ERROR_REPORT_BITMASK�.
-+
-+Event Values
-+    errorVal
-+    = 0x00000001
-+    Power save fails
-+
-+        = 0x00000002
-+    No cipher key
-+
-+        = 0x00000004
-+    Decryption error
-+
-+        = 0x00000008
-+    Beacon miss
-+
-+        = 0x00000010
-+    A non-power save disabled node has joined
-+    the PS-enabled network
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    EXTENSION
-+
-+Synopsis
-+    The WMI is used mostly for wireless control messages to a wireless module that
-+    apply to wireless module management regardless of the target platform
-+    implementation. However, some events peripherally related to wireless management
-+    are desired during operation. These wireless extension events may be platform-
-+    specific or implementation-dependent. See �WMI Extension Commands�
-+
-+
-+Event ID
-+    0x1010
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_PMKID_LIST_EVENT
-+
-+Synopsis
-+    Generated by firmware in response to a �GET_PMKID_LIST_CMD� command.
-+
-+Event Parameters
-+    typedef struct {
-+        A_UINT32    numPMKID;
-+            Contains the number of PMKIDs in the reply
-+        WMI_PMKID   pmkidList[1];
-+    } __ATTRIB_PACK WMI_PMKID_LIST_REPLY;
-+
-+Event Values
-+    None
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    GET_WOW_LIST_EVENT
-+
-+Synopsis
-+    Response to the wmiconfig �getwowlist command to retrieve the configured Wake on
-+    Wireless patterns
-+
-+Event ID
-+    0x10018
-+
-+Event Parameters
-+    {
-+
-+    A_UINT8    num_filters
-+        Total number of patterns in the list
-+    A_UINT8    this_filter_num
-+        The filter number
-+    A_UINT8    wow_mode
-+        Shows whether WoW is enabled or disabled
-+    A_UINT8    host_mode
-+        Shows whether the host is asleep or awake
-+    WOW_FILTER    wow_filters[1]
-+        List of WoW filters (pattern and mask data bytes)
-+    } WMI_GET_WOW_LIST_REPLY;
-+
-+    {
-+        Each wow_filter_list element shows:
-+    A_UINT8    wow_valid_filter
-+        Whether the filter is valid
-+    A_UINT8    wow_filter_list_id
-+        Filter List ID (23 = default)
-+    A_UINT8    wow_filter_size
-+        Size in bytes of the filter
-+    A_UINT8    wow_filter_offset
-+        Offset of the pattern to search in the data packet
-+    A_UINT8    wow_filter_mask[MASK_SIZE]
-+        The mask to be applied to the pattern
-+    A_UINT8    wow_filter_pattern[WOW_PATTERN_SIZE]
-+        The pattern that to match to wake up the host
-+    } WOW_FILTER
-+
-+Event Values
-+    None
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    NEIGHBOR_REPORT
-+
-+Synopsis
-+    Indicates the existence of neighbor APs that match the current profile. The host uses
-+    this event to populate the PMKID cache on the AR6000 and/or to perform
-+    preauthentication. This event is only generated in infrastructure mode.
-+
-+    A total of numberOfAps pairs of bssid/bssFlags exist, one pair for each AP.
-+
-+Event ID
-+    0x1008
-+
-+Event Parameters
-+    UINT8    numberOfAps
-+        The number of APs reported about in
-+        this event
-+    {
-+        UINT8    bssid[6]
-+            MAC address of a neighbor AP
-+        UINT8    bssFlags
-+            A WMI_BSS_FLAGS value
-+    }[numberOfAps]
-+
-+
-+Event Values
-+    {
-+        WMI_DEFAULT_BSS_FLAGS    = 0
-+            Logical OR of 1 or more
-+        WMI_BSS_FLAGS
-+        WMI_PREAUTH_CAPABLE_BSS
-+            = 1
-+            Indicates that this AP is capable of
-+            preauthentication
-+        WMI_PMKID_VALID_BSS
-+            = 2
-+            Indicates that the AR6000 have a
-+            valid pairwise master key for this AP
-+    } WMI_BSS_FLAGS
-+
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    OPT_RX_FRAME_EVENT
-+
-+Synopsis
-+    Special feature, informs host of the reception of a special frame.
-+
-+Event ID
-+    0x100E
-+
-+Event Parameters
-+    {
-+        A_UINT16    channel;
-+        A_UINT8    frameType;
-+        A_INT8    snr;
-+        A_UINT8    srcAddr[ATH_MAC_LEN];
-+        A_UINT8    bssid[ATH_MAC_LEN];
-+        }WMI_OPT_RX_INFO_HDR
-+
-+Event Values
-+    None
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    PSTREAM_TIMEOUT
-+
-+Synopsis
-+    Indicates that a priority stream that got created as a result of priority-marked data
-+    flow (priority marked in IP TOS) being idle for the default inactivity interval period
-+    (specified in the �CREATE_PSTREAM� command) used for priority streams created
-+    implicitly by the driver. This event is not indicated for user-created priority streams.
-+    User-created priority streams exist until the users delete them explicitly. They do not
-+    timeout due to data inactivity.
-+
-+Event ID
-+    0x1007
-+
-+Event Parameters
-+    A_UINT8
-+    trafficClass
-+    Indicated the traffic class of priority
-+    stream that timed out
-+
-+Event Values
-+    {
-+        WMM_AC_BE    = 0
-+            Best effort
-+        WMM_AC_BK    = 1
-+            Background
-+        WMM_AC_VI    = 2
-+            Video
-+        WMM_AC_VO     = 3
-+            Voice
-+    } TRAFFIC CLASS
-+
-+
-+=====================================================================
-+
-+Name
-+    READY
-+
-+Synopsis
-+    Indicates that the AR6000 device is prepared to accept commands. It is sent once after
-+    power on or reset. It also indicates the MAC address of the device.
-+
-+Event ID
-+    0x1001
-+
-+Event Parameters
-+    UINT8    macAddr[6]
-+        Device MAC address
-+    UINT8    phyCapability
-+        A WMI_PHY_CAPABILITY value. Indicates the
-+        capabilities of the device wireless module�s radio
-+
-+Event Values
-+    {
-+        WMI_11A_CAPABILITY       = 1
-+        WMI_11G_CAPABILITY       = 2
-+        WMI_11AG_CAPABILITY      = 3
-+    } WMI_PHY_CAPABILITY
-+
-+
-+=====================================================================
-+
-+Name
-+    REGDOMAIN
-+
-+Synopsis
-+    Indicates that the regulatory domain has changed. It initially occurs when the
-+    AR6000 device reads the board data information. The regulatory domain can also
-+    change when the device is a world-mode SKU. In this case, the regulatory domain is
-+    based on the country advertised by APs per the IEEE 802.11d specification. A
-+    potential side effect of a regulatory domain change is a change in the list of available
-+    channels. Any channel restrictions that exist as a result of a previous
-+    �SET_CHANNEL_PARAMETERS� command are lifted.
-+
-+Event ID
-+    0x1006
-+
-+Event Parameters
-+    UINT32    regDomain
-+        The range of 0x0000 � 0x00FF
-+        corresponds to an ISO country code.
-+
-+    Other regCodes are reserved for world
-+    mode settings and specific regulatory
-+    domains.
-+
-+Event Values
-+    None
-+
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    REPORT_STATISTICS
-+
-+Synopsis
-+    A reply to a �GET_TARGET_STATS� command.
-+
-+Event ID
-+    0x100B
-+
-+Event Parameters
-+    When the statistics are sent to the host, the AR6001 clear them so that a new set of
-+    statistics are collected for the next report.
-+
-+    UINT32    tx_packets
-+    UINT32    tx_bytes
-+    UINT32    tx_unicast_pkts
-+    UINT32    tx_unicast_bytes
-+    UINT32    tx_multicast_pkts
-+    UINT32    tx_multicast_bytes
-+    UINT32    tx_broadcast_pkts
-+    UINT32    tx_broadcast_bytes
-+    UINT32    tx_rts_success_cnt
-+    UINT32    tx_packet_per_ac[4]
-+        Tx packets per AC: [0] = BE, [1] = BK,
-+        [2] = VI, [3] = VO
-+    UINT32    tx_errors
-+        Number of packets which failed Tx, due
-+        to all failures
-+    ... REPORT_STATISTICS, continued
-+    UINT32    tx_failed_cnt
-+        Number of data packets that failed Tx
-+    UINT32    tx_retry_cnt
-+        Number of Tx retries for all packets
-+    UINT32    tx_rts_fail_cnt
-+        Number of RTS Tx failed count
-+    UINT32    rx_packets
-+    UINT32    rx_bytes
-+    UINT32    rx_unicast_pkts
-+    UINT32    rx_unicast_bytes
-+    UINT32    rx_multicast_pkts
-+    UINT32    rx_multicast_bytes
-+    UINT32    rx_broadcast_pkts
-+    UINT32    rx_broadcast_bytes
-+    UINT32    rx_fragment_pkt
-+        Number of fragmented packets received
-+    UINT32    rx_errors
-+        Number of Rx errors due to all failures
-+    UINT32    rx_crcerr
-+        Number of Rx errors due to CRC errors
-+    UINT32    rx_key_cache_miss
-+        Number of Rx errors due to a key not
-+        being plumbed
-+    UINT32    rx_decrypt_err
-+        Number of Rx errors due to decryption
-+        failure
-+    UINT32    rx_duplicate_frames
-+        Number of duplicate frames received
-+    UINT32    tkip_local_mic_failure
-+        Number of TKIP MIC errors detected
-+    UINT32    tkip_counter_measures_invoked
-+        Number of times TKIP countermeasures
-+        were invoked
-+    UINT32    tkip_replays
-+        Number of frames that replayed a TKIP
-+        encrypted frame received earlier
-+    UINT32    tkip_format_errors
-+        Number of frames that did not conform
-+        to the TKIP frame format
-+    UINT32    ccmp_format_errors
-+        Number of frames that did not conform
-+        to the CCMP frame format
-+    UINT32    ccmp_replays
-+        Number of frames that replayed a CCMP
-+        encrypted frame received earlier
-+    UINT32    power_save_failure_cnt
-+        Number of failures that occurred when
-+        the AR6001 could not go to sleep
-+    UINT32    cs_bmiss_cnt
-+        Number of BMISS interrupts since
-+    connection
-+    UINT32    cs_lowRssi_cnt
-+        Number of the times the RSSI went below
-+        the low RSSI threshold
-+    UINT16    cs_connect_cnt
-+        Number of connection times
-+    UINT16    cs_disconnect_cnt
-+        Number of disconnection times
-+    UINT8    cs_aveBeacon_rssi
-+        The current averaged value of the RSSI
-+        from the beacons of the connected BSS
-+    UINT8    cs_lastRoam_msec
-+        Time that the last roaming took, in ms.
-+        This time is the difference between
-+        roaming start and actual connection.
-+
-+Event Values
-+    None defined
-+
-+
-+=====================================================================
-+
-+Name
-+    ROAM_TBL_EVENT
-+
-+Synopsis
-+    Reports the roam table, which contains the current roam mode and this information
-+    for every BSS:
-+
-+Event ID
-+    0x100F
-+
-+Event Parameters
-+    A_UINT8     bssid[ATH_MAC_LEN];
-+        BSSID
-+    A_UINT8     rssi
-+        Averaged RSSI
-+    A_UINT8     rssidt
-+        Change in RSSI
-+    A_UINT8     last_rssi
-+        Last recorded RSSI
-+    A_UINT8     roam_util
-+        Utility value used in roaming decision
-+    A_UINT8     util
-+        Base utility with the BSS
-+    A_UINT8     bias
-+        Host configured for this BSS
-+
-+Event Values
-+    roamMode
-+        Current roam mode
-+
-+        = 1
-+    RSSI based roam
-+
-+        = 2
-+    Host bias-based roam
-+
-+        = 3
-+    Lock to the current BSS
-+
-+        = 4
-+    Autonomous roaming disabled
-+
-+
-+=====================================================================
-+
-+Name
-+    RSSI_THRESHOLD
-+
-+Synopsis
-+    Alerts the host that the signal strength from the connected AP has crossed a
-+    interesting threshold as defined in a previous �RSSI_THRESHOLD_PARAMS�
-+    command.
-+
-+Event ID
-+    0x100C
-+
-+Event Parameters
-+    UINT8    range
-+        A WMI_RSSI_THRESHOLD_VAL
-+        value, which indicates the range of
-+        the average signal strength
-+
-+Event Values
-+    {
-+        WMI_RSSI_LOWTHRESHOLD_BELOW_LOWERVAL  = 1
-+        WMI_RSSI_LOWTHRESHOLD_LOWERVAL        = 2
-+        WMI_RSSI_LOWTHRESHOLD_UPPERVAL        = 3
-+        WMI_RSSI_HIGHTHRESHOLD_LOWERVAL       = 4
-+        WMI_RSSI_HIGHTHRESHOLD_HIGHERVAL      = 5
-+    } WMI_RSSI_THRESHOLD_VAL
-+
-+
-+=====================================================================
-+
-+Name
-+    SCAN_COMPLETE_EVENT
-+
-+Synopsis
-+    Indicates the scan status. if the Scan was not completed, this event is generated with
-+    the status A_ECANCELED.
-+
-+Event ID
-+    0x100A
-+
-+Event Parameters
-+    A_UINT8    scanStatus
-+
-+Event Values
-+    {
-+        #define     SCAN_ABORTED 16
-+        #define     SCAN_COMPLETED 0
-+        A_UINT8     scanStatus
-+            A_OK or A_ECANCELED
-+    } WMI_SCAN_COMPLETE_EVENT;
-+
-+
-+=====================================================================
-+
-+Name
-+    TEST_EVENT
-+
-+Synopsis
-+    The TCMD application uses a single WMI event (WMI_TEST_EVENTID) to
-+    communicate events from target to host. The events are parsed by the TCMD
-+    application and WMI layer is oblivious of it.
-+
-+Event ID
-+    0x1016
-+
-+Event Parameters
-+    WMI_TEST_EVENTID
-+
-+
-+Event Values
-+    None
-+
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    TKIP_MICERR
-+
-+Synopsis
-+    Indicates that TKIP MIC errors were detected.
-+
-+Event ID
-+    0x1009
-+
-+Event Parameters
-+    UINT8    keyid
-+        Indicates the TKIP key ID
-+
-+    UINT8    ismcast
-+        0 = Unicast
-+        1 = Multicast
-+
-+Event Values
-+    See event parameters
-+
-+=====================================================================
-+
-+WMI Extension Commands
-+
-+The WMI EXTENSION command is used to multiplex a collection of
-+commands that:
-+
-+        Are not generic wireless commands
-+        May be implementation-specific
-+        May be target platform-specific
-+        May be optional for a host implementation
-+
-+    An extension command is sent to the AR6000 targets like any other WMI
-+command message and uses the WMI_EXTENSION. The first field of the
-+payload for this EXTENSION command is another commandId, sometimes
-+called the subcommandId, which indicates which extension command is
-+being used. A subcommandId-specific payload follows the subcommandId.
-+
-+All extensions (subcommandIds) are listed in the header file include/wmix.h.
-+See also �WMI Extension Events� on page B-58.
-+
-+
-+WMI Extension Commands
-+
-+
-+GPIO_INPUT_GET
-+    Read GPIO pins configured for input
-+
-+GPIO_INTR_ACK
-+    Acknowledge and re-arm GPIO interrupts reported earlier
-+
-+GPIO_OUTPUT_SET
-+    Manage output on GPIO pins configured for output
-+
-+GPIO_REGISTER_GET
-+    Read an arbitrary GPIO register
-+
-+GPIO_REGISTER_SET
-+    Dynamically change GPIO configuration
-+
-+SET_LQTHRESHOLD
-+    Set link quality thresholds; the sampling happens at every unicast
-+    data frame Tx, if certain thresholds are met, and corresponding
-+    events are sent to the host
-+
-+
-+=====================================================================
-+
-+Name
-+    GPIO_INPUT_GET
-+
-+Synopsis
-+    Allows the host to read GPIO pins that are configured for input. The values read are
-+    returned through a �GPIO_DATA� extension event.
-+
-+NOTE: Support for GPIO is optional.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    None
-+
-+
-+
-+Reply Parameters
-+    None
-+
-+
-+Reset Value
-+    None
-+
-+
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    GPIO_INTR_ACK
-+
-+Synopsis
-+    The host uses this command to acknowledge and to re-arm GPIO interrupts reported
-+    through an earlier �GPIO_INTR� extension event. A single �GPIO_INTR_ACK�
-+    command should be used to acknowledge all GPIO interrupts that the host knows to
-+    be outstanding (if pending interrupts are not acknowledged through
-+    �GPIO_INTR_ACK�, another �GPIO_INTR� extension event is raised).
-+
-+NOTE: Support for GPIO is optional.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    UINT32    ack_mask
-+        A mask of interrupting GPIO pins (e.g., ack_mask
-+        bit [3] acknowledges an interrupt from the pin GPIO3).
-+
-+Command Values
-+    None
-+
-+Reset Value
-+    None
-+
-+Restrictions
-+    The host should acknowledge only interrupts about which it was notified.
-+
-+
-+=====================================================================
-+
-+Name
-+    GPIO_OUTPUT_SET
-+
-+Synopsis
-+    Manages output on GPIO pins configured for output.
-+
-+    Conflicts between set_mask and clear_mask or enable_mask and disable_mask result
-+    in undefined behavior.
-+
-+NOTE: Support for GPIO is optional.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    UINT32    set_mask
-+        Specifies which pins should drive a 1 out
-+    UINT32    clear_mask
-+        Specifies which pins should drive a 0 out
-+    UINT32    enable_mask
-+        Specifies which pins should be enabled for output
-+    UINT32    disable_mask
-+        Specifies which pins should be disabled for output
-+
-+Command Values
-+    None
-+
-+
-+Reset Value
-+    None
-+
-+
-+Restrictions
-+    None
-+
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    GPIO_REGISTER_GET
-+
-+Synopsis
-+    Allows the host to read an arbitrary GPIO register. It is intended for use during
-+    bringup/debug. The target responds to this command with a �GPIO_DATA� event.
-+
-+NOTE: Support for GPIO is optional.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    UINT32
-+    gpioreg_id
-+    Specifies a GPIO register identifier, as defined
-+in include/AR6000/AR6000_gpio.h
-+
-+Reply Parameters
-+    None
-+
-+Reset Value
-+    N/A
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+Name
-+    GPIO_REGISTER_SET
-+
-+Synopsis
-+    Allows the host to dynamically change GPIO configuration (usually handled
-+    statically through the GPIO configuration DataSet).
-+
-+NOTE: Support for GPIO is optional.
-+
-+Command
-+    N/A
-+
-+Command Parameters
-+    UINT32    gpioreg_id
-+        Specifies a GPIO register identifier, as defined in
-+        include/AR6000/AR6000_gpio.h
-+    UINT32    value
-+        Specifies a value to write to the specified
-+        GPIO register
-+
-+Command Values
-+    None
-+
-+
-+Reset Value
-+    Initial hardware configuration is as defined in the AR6001 or AR6002 ROCmTM
-+    Single-Chip MAC/BB/Radio for 2.4/5 GHz Embedded WLAN Applications data sheet. This
-+    configuration is modified by the GPIO Configuration DataSet, if one exists.
-+
-+Restrictions
-+    None
-+
-+
-+=====================================================================
-+
-+
-+Name
-+    SET_LQTHRESHOLD
-+
-+Synopsis
-+    Set link quality thresholds, the sampling happens at every unicast data frame Tx, if
-+    certain threshold is met, corresponding event will be sent to host.
-+
-+Command
-+    wmiconfig eth1 --lqThreshold <enable> <upper_threshold_1>...
-+    <upper_threshold_4> <lower_threshold_1>... <lower_threshold_4>
-+
-+Command Parameters
-+    A_UINT8   enable;
-+    A_UINT8   thresholdAbove1_Val;
-+    A_UINT8   thresholdAbove2_Val;
-+    A_UINT8   thresholdAbove3_Val;
-+    A_UINT8   thresholdAbove4_Val;
-+    A_UINT8   thresholdBelow1_Val;
-+    A_UINT8   thresholdBelow2_Val;
-+    A_UINT8   thresholdBelow3_Val;
-+    A_UINT8   thresholdBelow4_Val;
-+
-+Command Values
-+    enable
-+    = 0
-+    Disable link quality sampling
-+
-+        = 1
-+    Enable link quality sampling
-+
-+
-+    thresholdAbove_Val
-+    [1...4]
-+    Above thresholds (value in [0,100]), in ascending
-+    order threshold
-+
-+    Below_Val [1...4] = below thresholds (value
-+    in [0,100]), in ascending order
-+
-+Reset Values
-+    None
-+
-+Restrictions
-+    None
-+
-+=====================================================================
-+WMI Extension Events
-+
-+The WMI EXTENSION event is used for a collection of events that:
-+
-+    Are not generic wireless events
-+    May be implementation-specific
-+    May be target platform-specific
-+    May be optional for a host implementation
-+
-+    An extension event is sent from the AR6000 device targets to the host just like
-+any other WMI event message, using the WMI_EXTENSION_EVENTID. The
-+first field of the payload for this �EXTENSION� event is another commandId
-+(sometimes called the subcommandId) that indicates which �EXTENSION�
-+event is being used. A subcommandId-specific payload follows the
-+subcommandId.
-+
-+All extensions (subcommandIds) are listed in the header file include/wmix.h.
-+See also �WMI Extension Commands� on page B-55.
-+
-+
-+WMI Extension Events
-+
-+
-+GPIO_ACK
-+    Acknowledges a host set command has been processed by the device
-+
-+GPIO_DATA
-+    Response to a host�s request for data
-+
-+GPIO_INTR
-+    Signals that GPIO interrupts are pending
-+
-+
-+=====================================================================
-+
-+Name
-+    GPIO_ACK
-+
-+Synopsis
-+    Acknowledges that a host set command (either �GPIO_OUTPUT_SET� or
-+    �GPIO_REGISTER_SET�) has been processed by the AR6000 device.
-+
-+NOTE: Support for GPIO is optional.
-+
-+Event ID
-+    N/A
-+
-+Event Parameters
-+    None
-+
-+
-+Event Values
-+    None
-+
-+=====================================================================
-+
-+
-+Name
-+    GPIO_DATA
-+
-+Synopsis
-+    The AR6000 device uses this event to respond to the host�s earlier request for data
-+    (through either a �GPIO_REGISTER_GET� or a �GPIO_INPUT_GET� command).
-+
-+NOTE: Support for GPIO is optional.
-+
-+Event ID
-+    N/A
-+
-+Event Parameters
-+    UINT32    value
-+        Holds the data of interest, which is either a register value
-+        (in the case of �GPIO_REGISTER_GET�) or a mask of
-+        pin inputs (in the case of �GPIO_INPUT_GET�).
-+    UINT32    reg_id
-+        Indicates which register was read (in the case of
-+        �GPIO_REGISTER_GET�) or is GPIO_ID_NONE (in the
-+        case of �GPIO_INPUT_GET�)
-+
-+Event Values
-+    None
-+
-+
-+=====================================================================
-+
-+
-+
-+Name
-+    GPIO_INTR
-+
-+Synopsis
-+    The AR6000 device raises this event to signal that GPIO interrupts are pending.
-+    These GPIOs may be interrupts that occurred after the last �GPIO_INTR_ACK�
-+    command was issued, or may be GPIO interrupts that the host failed to acknowledge
-+    in the last �GPIO_INTR_ACK�. The AR6000 will not raise another GPIO_INTR
-+    event until this event is acknowledged through a �GPIO_INTR_ACK� command.
-+
-+NOTE: Support for GPIO is optional.
-+
-+Event ID
-+    N/A
-+
-+Event Parameters
-+    UINT32    intr_mask
-+        Indicates which GPIO interrupts are currently pending
-+
-+    UINT32    input_values
-+        A recent copy of the GPIO input values, taken at the
-+        time the most recent GPIO interrupt was processed
-+
-+Event Values
-+    None
-+
-+
-+
-+=====================================================================
-+#endif
-diff --git a/drivers/ar6000/wmi/wmi_host.h b/drivers/ar6000/wmi/wmi_host.h
-new file mode 100644
-index 0000000..57844bc
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi_host.h
-@@ -0,0 +1,71 @@
-+#ifndef _WMI_HOST_H_
-+#define _WMI_HOST_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains local definitios for the wmi host module.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi_host.h#1 $
-+ *
-+ *
-+ *  This program is free software; you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License version 2 as
-+ *  published by the Free Software Foundation;
-+ *
-+ *  Software distributed under the License is distributed on an "AS
-+ *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ *  implied. See the License for the specific language governing
-+ *  rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+struct wmi_stats {
-+    A_UINT32    cmd_len_err;
-+    A_UINT32    cmd_id_err;
-+};
-+
-+struct wmi_t {
-+    A_BOOL                          wmi_ready;
-+    A_BOOL                          wmi_numQoSStream;
-+    A_UINT8                         wmi_wmiStream2AcMapping[WMI_PRI_MAX_COUNT];
-+    WMI_PRI_STREAM_ID               wmi_ac2WmiStreamMapping[WMM_NUM_AC];
-+    A_UINT16                        wmi_streamExistsForAC[WMM_NUM_AC];
-+    A_UINT8                         wmi_fatPipeExists;
-+    void                           *wmi_devt;
-+    struct wmi_stats                wmi_stats;
-+    struct ieee80211_node_table     wmi_scan_table;
-+    A_UINT8                         wmi_bssid[ATH_MAC_LEN];
-+    A_UINT8                         wmi_powerMode;
-+    A_UINT8                         wmi_phyMode;
-+    A_UINT8                         wmi_keepaliveInterval;
-+    A_MUTEX_T                       wmi_lock;
-+};
-+
-+#define WMI_INIT_WMISTREAM_AC_MAP(w) \
-+{  (w)->wmi_wmiStream2AcMapping[WMI_BEST_EFFORT_PRI] = WMM_AC_BE; \
-+   (w)->wmi_wmiStream2AcMapping[WMI_LOW_PRI] = WMM_AC_BK; \
-+   (w)->wmi_wmiStream2AcMapping[WMI_HIGH_PRI] = WMM_AC_VI; \
-+   (w)->wmi_wmiStream2AcMapping[WMI_HIGHEST_PRI] = WMM_AC_VO; \
-+   (w)->wmi_ac2WmiStreamMapping[WMM_AC_BE] = WMI_BEST_EFFORT_PRI; \
-+   (w)->wmi_ac2WmiStreamMapping[WMM_AC_BK] = WMI_LOW_PRI; \
-+   (w)->wmi_ac2WmiStreamMapping[WMM_AC_VI] = WMI_HIGH_PRI; \
-+   (w)->wmi_ac2WmiStreamMapping[WMM_AC_VO] = WMI_HIGHEST_PRI; }
-+
-+#define WMI_WMISTREAM_ACCESSCATEGORY(w,s)      (w)->wmi_wmiStream2AcMapping[s]
-+#define WMI_ACCESSCATEGORY_WMISTREAM(w,ac)       (w)->wmi_ac2WmiStreamMapping[ac]
-+
-+#define LOCK_WMI(w)     A_MUTEX_LOCK(&(w)->wmi_lock);
-+#define UNLOCK_WMI(w)   A_MUTEX_UNLOCK(&(w)->wmi_lock);
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
-+#endif /* _WMI_HOST_H_ */
-diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
-index d3b2953..fea341e 100644
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -75,6 +75,12 @@ config GPIO_BASIC_MMIO
- 	help
- 	  Say yes here to support basic memory-mapped GPIO controllers.
- 
-+config GPIO_GLAMO
-+	tristate "Glamo GPIO support"
-+	depends on MFD_GLAMO
-+	help
-+	  Say yes here to support GPIO functionality of the Smedia Glamo.
-+
- config GPIO_IT8761E
- 	tristate "IT8761E GPIO support"
- 	depends on GPIOLIB
-@@ -294,6 +300,13 @@ config GPIO_ADP5588_IRQ
- 	  Say yes here to enable the adp5588 to be used as an interrupt
- 	  controller. It requires the driver to be built in the kernel.
- 
-+config GPIO_PCF50633
-+	tristate "GPIO support for NXP PCF50633"
-+	depends on MFD_PCF50633
-+	help
-+	 Say yes here if you want to include support GPIO for pins on
-+	 the PCF50633 chip.
-+
- comment "PCI GPIO expanders:"
- 
- config GPIO_CS5535
-diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
-index becef59..d5f3c31 100644
---- a/drivers/gpio/Makefile
-+++ b/drivers/gpio/Makefile
-@@ -11,6 +11,7 @@ obj-$(CONFIG_GPIOLIB)		+= gpiolib.o
- obj-$(CONFIG_GPIO_ADP5520)	+= adp5520-gpio.o
- obj-$(CONFIG_GPIO_ADP5588)	+= adp5588-gpio.o
- obj-$(CONFIG_GPIO_BASIC_MMIO)	+= basic_mmio_gpio.o
-+obj-$(CONFIG_GPIO_GLAMO)	+= glamo-gpio.o
- obj-$(CONFIG_GPIO_LANGWELL)	+= langwell_gpio.o
- obj-$(CONFIG_GPIO_MAX730X)	+= max730x.o
- obj-$(CONFIG_GPIO_MAX7300)	+= max7300.o
-@@ -43,3 +44,4 @@ obj-$(CONFIG_GPIO_SX150X)	+= sx150x.o
- obj-$(CONFIG_GPIO_VX855)	+= vx855_gpio.o
- obj-$(CONFIG_GPIO_ML_IOH)	+= ml_ioh_gpio.o
- obj-$(CONFIG_AB8500_GPIO)       += ab8500-gpio.o
-+obj-$(CONFIG_GPIO_PCF50633)	+= pcf50633-gpio.o
-diff --git a/drivers/gpio/glamo-gpio.c b/drivers/gpio/glamo-gpio.c
-new file mode 100644
-index 0000000..1e9986b
---- /dev/null
-+++ b/drivers/gpio/glamo-gpio.c
-@@ -0,0 +1,250 @@
-+/* Smedia Glamo 336x/337x gpio driver
-+ *
-+ * (C) 2009,2011 Lars-Peter Clausen <lars@metafoo.de>
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
-+
-+#include <linux/io.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/platform_device.h>
-+#include <linux/slab.h>
-+#include <linux/spinlock.h>
-+
-+#include <linux/gpio.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/mfd/glamo-regs.h>
-+
-+#define GLAMO_NR_GPIO 21
-+#define GLAMO_NR_GPIO_REGS DIV_ROUND_UP(GLAMO_NR_GPIO, 4)
-+
-+#define GLAMO_GPIO_REG(x) (((x) * 2) + GLAMO_REG_GPIO_GEN1)
-+
-+struct glamo_gpio {
-+	struct glamo_core *glamo;
-+	struct gpio_chip chip;
-+	uint16_t saved_regs[GLAMO_NR_GPIO_REGS];
-+};
-+
-+#define GLAMO_GPIO_REG_GPIO(gpio)	GLAMO_GPIO_REG((gpio) >> 2)
-+#define GLAMO_GPIO_BIT(gpio, offset)	BIT(((gpio) & 0x3) + (offset))
-+#define GLAMO_GPIO_DIRECTION_BIT(gpio)	GLAMO_GPIO_BIT((gpio), 0)
-+#define GLAMO_GPIO_OUTPUT_BIT(gpio)	GLAMO_GPIO_BIT((gpio), 4)
-+#define GLAMO_GPIO_INPUT_BIT(gpio)	GLAMO_GPIO_BIT((gpio), 8)
-+#define GLAMO_GPIO_FUNC_BIT(gpio)	GLAMO_GPIO_BIT((gpio), 12)
-+
-+
-+static inline struct glamo_core *chip_to_glamo(struct gpio_chip *chip)
-+{
-+	return container_of(chip, struct glamo_gpio, chip)->glamo;
-+}
-+
-+static void glamo_gpio_modify_reg(struct gpio_chip *chip, unsigned offset,
-+    uint16_t set, uint16_t clear)
-+{
-+	struct glamo_core *glamo = chip_to_glamo(chip);
-+	void __iomem *reg = glamo->base + GLAMO_GPIO_REG_GPIO(offset);
-+	uint16_t tmp;
-+
-+	spin_lock(&glamo->lock);
-+	tmp = readw(reg);
-+	tmp |= set;
-+	tmp &= ~clear;
-+	writew(tmp, reg);
-+	spin_unlock(&glamo->lock);
-+}
-+
-+static void glamo_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-+{
-+	uint16_t mask = GLAMO_GPIO_OUTPUT_BIT(offset);
-+	glamo_gpio_modify_reg(chip, offset, value ? mask : 0, value ? 0 : mask);
-+}
-+
-+static int glamo_gpio_get(struct gpio_chip *chip, unsigned offset)
-+{
-+	struct glamo_core *glamo = chip_to_glamo(chip);
-+	void __iomem *reg = glamo->base + GLAMO_GPIO_REG_GPIO(offset);
-+
-+	return !!(readw(reg) & GLAMO_GPIO_INPUT_BIT(offset));
-+}
-+
-+static int glamo_gpio_request(struct gpio_chip *chip, unsigned offset)
-+{
-+	glamo_gpio_modify_reg(chip, offset, GLAMO_GPIO_FUNC_BIT(offset), 0);
-+
-+	return 0;
-+}
-+
-+static void glamo_gpio_free(struct gpio_chip *chip, unsigned offset)
-+{
-+	glamo_gpio_modify_reg(chip, offset, 0, GLAMO_GPIO_FUNC_BIT(offset));
-+}
-+
-+static int glamo_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
-+				       int value)
-+{
-+	uint16_t output_mask = GLAMO_GPIO_OUTPUT_BIT(offset);
-+	uint16_t set, clear;
-+
-+	clear = GLAMO_GPIO_DIRECTION_BIT(offset);
-+
-+	if (value) {
-+		set = output_mask;
-+	} else {
-+		set = 0;
-+		clear |= output_mask;
-+	}
-+
-+	glamo_gpio_modify_reg(chip, offset, set, clear);
-+
-+	return 0;
-+}
-+
-+static int glamo_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
-+{
-+	glamo_gpio_modify_reg(chip, offset, GLAMO_GPIO_DIRECTION_BIT(offset), 0);
-+
-+	return 0;
-+}
-+
-+static const struct __devinit gpio_chip glamo_gpio_chip = {
-+	.label			= "glamo",
-+	.request		= glamo_gpio_request,
-+	.free			= glamo_gpio_free,
-+	.direction_input	= glamo_gpio_direction_input,
-+	.direction_output	= glamo_gpio_direction_output,
-+	.get			= glamo_gpio_get,
-+	.set			= glamo_gpio_set,
-+	.base			= -1,
-+	.ngpio			= GLAMO_NR_GPIO,
-+	.owner			= THIS_MODULE,
-+};
-+
-+static int __devinit glamo_gpio_probe(struct platform_device *pdev)
-+{
-+	struct glamo_platform_data *pdata = pdev->dev.parent->platform_data;
-+	struct glamo_gpio *glamo_gpio;
-+	int ret;
-+
-+	glamo_gpio = kzalloc(sizeof(*glamo_gpio), GFP_KERNEL);
-+	if (!glamo_gpio)
-+		return -ENOMEM;
-+
-+	glamo_gpio->glamo = dev_get_drvdata(pdev->dev.parent);
-+	glamo_gpio->chip = glamo_gpio_chip;
-+	glamo_gpio->chip.dev = &pdev->dev;
-+	if (pdata && pdata->gpio_data)
-+		glamo_gpio->chip.base = pdata->gpio_data->base;
-+
-+	ret = gpiochip_add(&glamo_gpio->chip);
-+
-+	if (ret) {
-+		dev_err(&pdev->dev, "Could not register gpio chip: %d\n", ret);
-+		goto err;
-+	}
-+
-+	platform_set_drvdata(pdev, glamo_gpio);
-+
-+	return 0;
-+err:
-+	kfree(glamo_gpio);
-+	return ret;
-+}
-+
-+static int __devexit glamo_gpio_remove(struct platform_device *pdev)
-+{
-+	struct glamo_gpio *glamo_gpio = platform_get_drvdata(pdev);
-+	int ret;
-+
-+	ret = gpiochip_remove(&glamo_gpio->chip);
-+	if (!ret)
-+		goto done;
-+
-+	platform_set_drvdata(pdev, NULL);
-+	kfree(glamo_gpio);
-+
-+done:
-+	return ret;
-+}
-+
-+#ifdef CONFIG_PM_SLEEP
-+
-+static int glamo_gpio_suspend(struct device *dev)
-+{
-+	struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
-+	struct glamo_core *glamo = glamo_gpio->glamo;
-+	uint16_t *saved_regs = glamo_gpio->saved_regs;
-+	int i;
-+
-+	spin_lock(&glamo->lock);
-+	for (i = 0; i < GLAMO_NR_GPIO_REGS; ++i)
-+		saved_regs[i] = readw(glamo->base + GLAMO_GPIO_REG(i));
-+	spin_unlock(&glamo->lock);
-+
-+	return 0;
-+}
-+
-+static int glamo_gpio_resume(struct device *dev)
-+{
-+	struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
-+	struct glamo_core *glamo = glamo_gpio->glamo;
-+	uint16_t *saved_regs = glamo_gpio->saved_regs;
-+	int i;
-+
-+	spin_lock(&glamo->lock);
-+	for (i = 0; i < GLAMO_NR_GPIO_REGS; ++i)
-+		writew(saved_regs[i], glamo->base + GLAMO_GPIO_REG(i));
-+	spin_unlock(&glamo->lock);
-+	return 0;
-+}
-+
-+static SIMPLE_DEV_PM_OPS(glamo_pm_ops, glamo_gpio_suspend, glamo_gpio_resume);
-+
-+#define GLAMO_GPIO_PM_OPS (&glamo_pm_ops)
-+
-+#else
-+#define GLAMO_GPIO_PM_OPS NULL
-+#endif
-+
-+static struct platform_driver glamo_gpio_driver = {
-+	.probe = glamo_gpio_probe,
-+	.remove = __devexit_p(glamo_gpio_remove),
-+	.driver = {
-+		.name  = "glamo-gpio",
-+		.owner = THIS_MODULE,
-+		.pm    = GLAMO_GPIO_PM_OPS,
-+	},
-+};
-+
-+static int __init glamo_gpio_init(void)
-+{
-+	return platform_driver_register(&glamo_gpio_driver);
-+}
-+module_init(glamo_gpio_init);
-+
-+static void __exit glamo_gpio_exit(void)
-+{
-+	platform_driver_unregister(&glamo_gpio_driver);
-+}
-+module_exit(glamo_gpio_exit);
-+
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("GPIO interface for the Glamo multimedia device");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("platform:glamo-gpio");
-diff --git a/drivers/gpio/pcf50633-gpio.c b/drivers/gpio/pcf50633-gpio.c
-new file mode 100644
-index 0000000..eb044e8
---- /dev/null
-+++ b/drivers/gpio/pcf50633-gpio.c
-@@ -0,0 +1,228 @@
-+/* NXP PCF50633 GPIO Driver
-+ *
-+ * (C) 2006-2008 by Openmoko, Inc.
-+ * Author: Balaji Rao <balajirrao@openmoko.org>
-+ * Copyright 2010, Lars-Peter Clausen <lars@metafoo.de>
-+ * All rights reserved.
-+ *
-+ * Broken down from monstrous PCF50633 driver mainly by
-+ * Harald Welte, Andy Green and Werner Almesberger
-+ *
-+ *  This program is free software; you can redistribute  it and/or modify it
-+ *  under  the terms of  the GNU General  Public License as published by the
-+ *  Free Software Foundation;  either version 2 of the  License, or (at your
-+ *  option) any later version.
-+ *
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/slab.h>
-+#include <linux/platform_device.h>
-+
-+#include <linux/mfd/pcf50633/core.h>
-+#include <linux/mfd/pcf50633/gpio.h>
-+#include <linux/gpio.h>
-+
-+#define PCF50633_REG_GPIOCTL	0x13
-+#define PCF50633_REG_GPIOCFG(x) (0x14 + (x))
-+
-+enum pcf50633_regulator_id {
-+	PCF50633_REGULATOR_AUTO,
-+	PCF50633_REGULATOR_DOWN1,
-+	PCF50633_REGULATOR_DOWN2,
-+	PCF50633_REGULATOR_LDO1,
-+	PCF50633_REGULATOR_LDO2,
-+	PCF50633_REGULATOR_LDO3,
-+	PCF50633_REGULATOR_LDO4,
-+	PCF50633_REGULATOR_LDO5,
-+	PCF50633_REGULATOR_LDO6,
-+	PCF50633_REGULATOR_HCLDO,
-+	PCF50633_REGULATOR_MEMLDO,
-+};
-+
-+#define PCF50633_REG_AUTOOUT	0x1a
-+#define PCF50633_REG_DOWN1OUT	0x1e
-+#define PCF50633_REG_DOWN2OUT	0x22
-+#define PCF50633_REG_MEMLDOOUT	0x26
-+#define PCF50633_REG_LDO1OUT	0x2d
-+#define PCF50633_REG_LDO2OUT	0x2f
-+#define PCF50633_REG_LDO3OUT	0x31
-+#define PCF50633_REG_LDO4OUT	0x33
-+#define PCF50633_REG_LDO5OUT	0x35
-+#define PCF50633_REG_LDO6OUT	0x37
-+#define PCF50633_REG_HCLDOOUT	0x39
-+
-+static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
-+	[PCF50633_REGULATOR_AUTO]	= PCF50633_REG_AUTOOUT,
-+	[PCF50633_REGULATOR_DOWN1]	= PCF50633_REG_DOWN1OUT,
-+	[PCF50633_REGULATOR_DOWN2]	= PCF50633_REG_DOWN2OUT,
-+	[PCF50633_REGULATOR_MEMLDO]	= PCF50633_REG_MEMLDOOUT,
-+	[PCF50633_REGULATOR_LDO1]	= PCF50633_REG_LDO1OUT,
-+	[PCF50633_REGULATOR_LDO2]	= PCF50633_REG_LDO2OUT,
-+	[PCF50633_REGULATOR_LDO3]	= PCF50633_REG_LDO3OUT,
-+	[PCF50633_REGULATOR_LDO4]	= PCF50633_REG_LDO4OUT,
-+	[PCF50633_REGULATOR_LDO5]	= PCF50633_REG_LDO5OUT,
-+	[PCF50633_REGULATOR_LDO6]	= PCF50633_REG_LDO6OUT,
-+	[PCF50633_REGULATOR_HCLDO]	= PCF50633_REG_HCLDOOUT,
-+};
-+
-+struct pcf50633_gpio {
-+	struct pcf50633 *pcf;
-+	struct gpio_chip chip;
-+};
-+
-+static inline struct pcf50633 *gpio_chip_to_pcf50633(struct gpio_chip *chip)
-+{
-+	struct pcf50633 *pcf = dev_to_pcf50633(chip->dev->parent);
-+	return pcf;
-+}
-+
-+static void pcf50633_gpio_set_value(struct gpio_chip *chip, unsigned gpio, int value)
-+{
-+	struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+	u8 reg;
-+
-+	reg = PCF50633_REG_GPIOCFG(gpio);
-+
-+	pcf50633_reg_set_bit_mask(pcf, reg, 0x07, value ? 0x7 : 0x0);
-+}
-+
-+static int pcf50633_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
-+{
-+	struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+	return pcf50633_reg_read(pcf, PCF50633_REG_GPIOCFG(gpio)) >> 3;
-+}
-+
-+
-+static int pcf50633_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
-+                                          int value)
-+{
-+	struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+	int ret;
-+
-+	ret = pcf50633_gpio_set_config(pcf, pcf->pdata->gpio_base + gpio,
-+	                               PCF50633_GPIO_CONFIG_OUTPUT);
-+	if (!ret)
-+	    pcf50633_gpio_set_value(chip, gpio, value);
-+
-+	return ret;
-+}
-+
-+static int pcf50633_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
-+{
-+	return -ENOSYS;
-+}
-+
-+int pcf50633_gpio_set_config(struct pcf50633 *pcf, unsigned gpio,
-+                              enum pcf50633_gpio_config config)
-+{
-+	u8 reg;
-+	u8 direction;
-+	int ret;
-+
-+	gpio -= pcf->pdata->gpio_base;
-+
-+	if (gpio < 3) {
-+	    direction = (config == PCF50633_GPIO_CONFIG_INPUT) ? (1 << gpio) : 0;
-+	    ret = pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_GPIOCTL, (1 << gpio),
-+					    direction);
-+	    if (ret) {
-+			return ret;
-+		}
-+	} else if (gpio > 3 || config == PCF50633_GPIO_CONFIG_INPUT) {
-+	    return -EINVAL;
-+	}
-+
-+	if (config != PCF50633_GPIO_CONFIG_INPUT) {
-+	    reg = PCF50633_REG_GPIOCFG(gpio);
-+	    ret = pcf50633_reg_set_bit_mask(pcf, reg, 0x0f, config);
-+	}
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_gpio_set_config);
-+
-+int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
-+					int gpio, int regulator, int on)
-+{
-+	u8 reg, val, mask;
-+
-+	gpio -= pcf->pdata->gpio_base;
-+
-+	/* the *ENA register is always one after the *OUT register */
-+	reg = pcf50633_regulator_registers[regulator] + 1;
-+
-+	val = !!on << (gpio - PCF50633_GPIO1);
-+	mask = 1 << (gpio - PCF50633_GPIO1);
-+
-+	return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
-+
-+
-+static int __devinit pcf50633_gpio_probe(struct platform_device *pdev)
-+{
-+	struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
-+	struct pcf50633_gpio *pcf_gpio;
-+
-+	pcf_gpio = kzalloc(sizeof(*pcf_gpio), GFP_KERNEL);
-+
-+	if (!pcf_gpio)
-+		return -ENOMEM;
-+
-+	pcf_gpio->pcf = pcf;
-+
-+	pcf_gpio->chip.direction_input = pcf50633_gpio_direction_input;
-+	pcf_gpio->chip.direction_output = pcf50633_gpio_direction_output;
-+	pcf_gpio->chip.get = pcf50633_gpio_get_value;
-+	pcf_gpio->chip.set = pcf50633_gpio_set_value;
-+
-+	pcf_gpio->chip.base = pcf->pdata->gpio_base;
-+	pcf_gpio->chip.ngpio = 4;
-+	pcf_gpio->chip.label = dev_name(pcf->dev);
-+	pcf_gpio->chip.can_sleep = 1;
-+	pcf_gpio->chip.owner = THIS_MODULE;
-+	pcf_gpio->chip.dev = &pdev->dev;
-+
-+	platform_set_drvdata(pdev, pcf_gpio);
-+
-+	return gpiochip_add(&pcf_gpio->chip);
-+}
-+
-+static int __devexit pcf50633_gpio_remove(struct platform_device *pdev)
-+{
-+	struct pcf50633_gpio *pcf_gpio = platform_get_drvdata(pdev);
-+
-+	gpiochip_remove(&pcf_gpio->chip);
-+
-+	platform_set_drvdata(pdev, NULL);
-+	kfree(pcf_gpio);
-+
-+	return 0;
-+}
-+
-+static struct platform_driver pcf50633_gpio_driver = {
-+	.probe = pcf50633_gpio_probe,
-+	.remove = __devexit_p(pcf50633_gpio_remove),
-+	.driver = {
-+		.name = "pcf50633-gpio",
-+		.owner = THIS_MODULE,
-+	},
-+};
-+
-+int __init pcf50633_gpio_init(void)
-+{
-+	return platform_driver_register(&pcf50633_gpio_driver);
-+}
-+module_init(pcf50633_gpio_init);
-+
-+void __exit pcf50633_gpio_exit(void)
-+{
-+	platform_driver_unregister(&pcf50633_gpio_driver);
-+}
-+module_exit(pcf50633_gpio_exit);
-+
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("GPIO driver for the PCF50633");
-+MODULE_LICENSE("GPL");
-diff --git a/drivers/input/misc/pcf50633-input.c b/drivers/input/misc/pcf50633-input.c
-index 9556273..983d5c8 100644
---- a/drivers/input/misc/pcf50633-input.c
-+++ b/drivers/input/misc/pcf50633-input.c
-@@ -20,6 +20,7 @@
- #include <linux/device.h>
- #include <linux/platform_device.h>
- #include <linux/input.h>
-+#include <linux/interrupt.h>
- #include <linux/slab.h>
- 
- #include <linux/mfd/pcf50633/core.h>
-@@ -31,26 +32,27 @@
- struct pcf50633_input {
- 	struct pcf50633 *pcf;
- 	struct input_dev *input_dev;
-+	int irq_pressed;
-+	int irq_released;
- };
- 
--static void
--pcf50633_input_irq(int irq, void *data)
-+static irqreturn_t pcf50633_input_irq(int irq, void *data)
- {
--	struct pcf50633_input *input;
-+	struct pcf50633_input *input = data;
- 	int onkey_released;
- 
--	input = data;
--
- 	/* We report only one event depending on the key press status */
- 	onkey_released = pcf50633_reg_read(input->pcf, PCF50633_REG_OOCSTAT)
- 						& PCF50633_OOCSTAT_ONKEY;
- 
--	if (irq == PCF50633_IRQ_ONKEYF && !onkey_released)
-+	if (irq == input->irq_pressed && !onkey_released)
- 		input_report_key(input->input_dev, KEY_POWER, 1);
--	else if (irq == PCF50633_IRQ_ONKEYR && onkey_released)
-+	else if (irq == input->irq_released && onkey_released)
- 		input_report_key(input->input_dev, KEY_POWER, 0);
- 
- 	input_sync(input->input_dev);
-+
-+	return IRQ_HANDLED;
- }
- 
- static int __devinit pcf50633_input_probe(struct platform_device *pdev)
-@@ -58,7 +60,22 @@ static int __devinit pcf50633_input_probe(struct platform_device *pdev)
- 	struct pcf50633_input *input;
- 	struct input_dev *input_dev;
- 	int ret;
-+	int irq_released;
-+	int irq_pressed;
-+
-+	irq_released = platform_get_irq_byname(pdev, "ONKEYR");
-+	if (irq_released <= 0) {
-+		dev_err(&pdev->dev, "Failed to get released irq: %d\n",
-+			irq_released);
-+		return irq_released ?: -EINVAL;
-+	}
- 
-+	irq_pressed = platform_get_irq_byname(pdev, "ONKEYF");
-+	if (irq_pressed <= 0) {
-+		dev_err(&pdev->dev, "Failed to get pressed irq: %d\n",
-+			irq_pressed);
-+		return irq_pressed ?: -EINVAL;
-+	}
- 
- 	input = kzalloc(sizeof(*input), GFP_KERNEL);
- 	if (!input)
-@@ -85,20 +102,41 @@ static int __devinit pcf50633_input_probe(struct platform_device *pdev)
- 		kfree(input);
- 		return ret;
- 	}
--	pcf50633_register_irq(input->pcf, PCF50633_IRQ_ONKEYR,
--				pcf50633_input_irq, input);
--	pcf50633_register_irq(input->pcf, PCF50633_IRQ_ONKEYF,
--				pcf50633_input_irq, input);
-+
-+	ret = request_threaded_irq(irq_released, NULL, pcf50633_input_irq, 0,
-+			"onkey released", input);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to request released irq: %d\n", ret);
-+		goto err_input_unregister;
-+	}
-+	ret = request_threaded_irq(irq_pressed, NULL, pcf50633_input_irq, 0,
-+			"onkey pressed", input);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to request pressed irq: %d\n", ret);
-+		goto err_free_irq;
-+	}
-+
-+	input->irq_released = irq_released;
-+	input->irq_pressed = irq_pressed;
-+
- 
- 	return 0;
-+
-+err_free_irq:
-+	free_irq(irq_pressed, input);
-+err_input_unregister:
-+	input_unregister_device(input->input_dev);
-+	kfree(input);
-+
-+	return ret;
- }
- 
- static int __devexit pcf50633_input_remove(struct platform_device *pdev)
- {
- 	struct pcf50633_input *input  = platform_get_drvdata(pdev);
- 
--	pcf50633_free_irq(input->pcf, PCF50633_IRQ_ONKEYR);
--	pcf50633_free_irq(input->pcf, PCF50633_IRQ_ONKEYF);
-+	free_irq(input->irq_released, input);
-+	free_irq(input->irq_pressed, input);
- 
- 	input_unregister_device(input->input_dev);
- 	kfree(input);
-diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
-index 666daf7..46fac25 100644
---- a/drivers/leds/leds-pwm.c
-+++ b/drivers/leds/leds-pwm.c
-@@ -26,8 +26,8 @@
- struct led_pwm_data {
- 	struct led_classdev	cdev;
- 	struct pwm_device	*pwm;
--	unsigned int 		active_low;
--	unsigned int		period;
-+	struct led_pwm		*led;
-+	struct device		*parent;
- };
- 
- static void led_pwm_set(struct led_classdev *led_cdev,
-@@ -35,8 +35,13 @@ static void led_pwm_set(struct led_classdev *led_cdev,
- {
- 	struct led_pwm_data *led_dat =
- 		container_of(led_cdev, struct led_pwm_data, cdev);
-+	struct device *parent = led_dat->parent;
-+	struct led_pwm_platform_data *pdata = parent->platform_data;
- 	unsigned int max = led_dat->cdev.max_brightness;
--	unsigned int period =  led_dat->period;
-+	unsigned int period =  led_dat->led->pwm_period_ns;
-+
-+	if (pdata->notify)
-+	    brightness = pdata->notify(parent, led_dat->led, brightness);
- 
- 	if (brightness == 0) {
- 		pwm_config(led_dat->pwm, 0, period);
-@@ -77,18 +82,28 @@ static int led_pwm_probe(struct platform_device *pdev)
- 
- 		led_dat->cdev.name = cur_led->name;
- 		led_dat->cdev.default_trigger = cur_led->default_trigger;
--		led_dat->active_low = cur_led->active_low;
--		led_dat->period = cur_led->pwm_period_ns;
- 		led_dat->cdev.brightness_set = led_pwm_set;
- 		led_dat->cdev.brightness = LED_OFF;
- 		led_dat->cdev.max_brightness = cur_led->max_brightness;
- 		led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
- 
-+		led_dat->led = cur_led;
-+		led_dat->parent = &pdev->dev;
-+
- 		ret = led_classdev_register(&pdev->dev, &led_dat->cdev);
- 		if (ret < 0) {
- 			pwm_free(led_dat->pwm);
- 			goto err;
- 		}
-+
-+		if (pdata->init) {
-+			ret = pdata->init(&pdev->dev, cur_led);
-+			if (ret < 0) {
-+				led_classdev_unregister(&led_dat->cdev);
-+				pwm_free(led_dat->pwm);
-+				goto err;
-+			}
-+		}
- 	}
- 
- 	platform_set_drvdata(pdev, leds_data);
-@@ -98,6 +113,8 @@ static int led_pwm_probe(struct platform_device *pdev)
- err:
- 	if (i > 0) {
- 		for (i = i - 1; i >= 0; i--) {
-+			if (pdata->exit)
-+				pdata->exit(&pdev->dev, &pdata->leds[i]);
- 			led_classdev_unregister(&leds_data[i].cdev);
- 			pwm_free(leds_data[i].pwm);
- 		}
-@@ -117,6 +134,8 @@ static int __devexit led_pwm_remove(struct platform_device *pdev)
- 	leds_data = platform_get_drvdata(pdev);
- 
- 	for (i = 0; i < pdata->num_leds; i++) {
-+		if (pdata->exit)
-+			pdata->exit(&pdev->dev, &pdata->leds[i]);
- 		led_classdev_unregister(&leds_data[i].cdev);
- 		pwm_free(leds_data[i].pwm);
- 	}
-diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
-index 3ed3ff0..9b2b1bb 100644
---- a/drivers/mfd/Kconfig
-+++ b/drivers/mfd/Kconfig
-@@ -448,6 +448,7 @@ config MFD_WM8994
- 
- config MFD_PCF50633
- 	tristate "Support for NXP PCF50633"
-+	select MFD_CORE
- 	depends on I2C
- 	help
- 	  Say yes here if you have NXP PCF50633 chip on your board.
-@@ -477,13 +478,6 @@ config PCF50633_ADC
- 	 Say yes here if you want to include support for ADC in the
- 	 NXP PCF50633 chip.
- 
--config PCF50633_GPIO
--	tristate "Support for NXP PCF50633 GPIO"
--	depends on MFD_PCF50633
--	help
--	 Say yes here if you want to include support GPIO for pins on
--	 the PCF50633 chip.
--
- config ABX500_CORE
- 	bool "ST-Ericsson ABX500 Mixed Signal Circuit register functions"
- 	default y if ARCH_U300 || ARCH_U8500
-@@ -602,6 +596,14 @@ config LPC_SCH
- 	  LPC bridge function of the Intel SCH provides support for
- 	  System Management Bus and General Purpose I/O.
- 
-+config MFD_GLAMO
-+	bool "Smedia Glamo 336x/337x support"
-+	select MFD_CORE
-+	help
-+	  This enables the core driver for the Smedia Glamo 336x/337x
-+	  multi-function device.  It includes irq_chip demultiplex as
-+	  well as clock / power management and GPIO support.
-+
- config MFD_RDC321X
- 	tristate "Support for RDC-R321x southbridge"
- 	select MFD_CORE
-diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
-index 419caa9..fb5f307 100644
---- a/drivers/mfd/Makefile
-+++ b/drivers/mfd/Makefile
-@@ -6,6 +6,8 @@
- obj-$(CONFIG_MFD_88PM860X)	+= 88pm860x.o
- obj-$(CONFIG_MFD_SM501)		+= sm501.o
- obj-$(CONFIG_MFD_ASIC3)		+= asic3.o tmio_core.o
-+obj-$(CONFIG_MFD_SH_MOBILE_SDHI)		+= sh_mobile_sdhi.o
-+obj-$(CONFIG_MFD_GLAMO)		+= glamo-core.o
- 
- obj-$(CONFIG_HTC_EGPIO)		+= htc-egpio.o
- obj-$(CONFIG_HTC_PASIC3)	+= htc-pasic3.o
-@@ -68,7 +70,6 @@ obj-$(CONFIG_MFD_MAX8998)	+= max8998.o max8998-irq.o
- pcf50633-objs			:= pcf50633-core.o pcf50633-irq.o
- obj-$(CONFIG_MFD_PCF50633)	+= pcf50633.o
- obj-$(CONFIG_PCF50633_ADC)	+= pcf50633-adc.o
--obj-$(CONFIG_PCF50633_GPIO)	+= pcf50633-gpio.o
- obj-$(CONFIG_ABX500_CORE)	+= abx500-core.o
- obj-$(CONFIG_AB3100_CORE)	+= ab3100-core.o
- obj-$(CONFIG_AB3100_OTP)	+= ab3100-otp.o
-diff --git a/drivers/mfd/glamo-core.c b/drivers/mfd/glamo-core.c
-new file mode 100644
-index 0000000..c9b2ae5
---- /dev/null
-+++ b/drivers/mfd/glamo-core.c
-@@ -0,0 +1,1274 @@
-+/* Smedia Glamo 3362 driver
-+ *
-+ * (C) 2007 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/errno.h>
-+#include <linux/string.h>
-+#include <linux/mm.h>
-+#include <linux/delay.h>
-+#include <linux/init.h>
-+#include <linux/irq.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/platform_device.h>
-+#include <linux/kernel_stat.h>
-+#include <linux/spinlock.h>
-+#include <linux/mfd/core.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-regs.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/io.h>
-+#include <linux/slab.h>
-+#include <linux/debugfs.h>
-+#include <linux/seq_file.h>
-+#include <linux/uaccess.h>
-+
-+#include <linux/pm.h>
-+
-+#define GLAMO_MEM_REFRESH_COUNT 0x100
-+
-+#define GLAMO_NR_IRQS 9
-+
-+#define GLAMO_IRQ_HOSTBUS	0
-+#define GLAMO_IRQ_JPEG		1
-+#define GLAMO_IRQ_MPEG		2
-+#define GLAMO_IRQ_MPROC1	3
-+#define GLAMO_IRQ_MPROC0	4
-+#define GLAMO_IRQ_CMDQUEUE	5
-+#define GLAMO_IRQ_2D		6
-+#define GLAMO_IRQ_MMC		7
-+#define GLAMO_IRQ_RISC		8
-+
-+/*
-+ * Glamo internal settings
-+ *
-+ * We run the memory interface from the faster PLLB on 2.6.28 kernels and
-+ * above.  Couple of GTA02 users report trouble with memory bus when they
-+ * upgraded from 2.6.24.  So this parameter allows reversion to 2.6.24
-+ * scheme if their Glamo chip needs it.
-+ *
-+ * you can override the faster default on kernel commandline using
-+ *
-+ *   glamo3362.slow_memory=1
-+ *
-+ * for example
-+ */
-+
-+static int slow_memory;
-+module_param(slow_memory, int, 0644);
-+
-+struct reg_range {
-+	int start;
-+	int count;
-+	char *name;
-+	unsigned dump:1;
-+};
-+
-+static const struct reg_range reg_range[] = {
-+	{ 0x0000, 0x76,		"General",	1 },
-+	{ 0x0200, 0x18,		"Host Bus",	1 },
-+	{ 0x0300, 0x38,		"Memory",	1 },
-+/*	{ 0x0400, 0x100,	"Sensor",	0 }, */
-+/*	{ 0x0500, 0x300,	"ISP",		0 }, */
-+/*	{ 0x0800, 0x400,	"JPEG",		0 }, */
-+/*	{ 0x0c00, 0xcc,		"MPEG",		0 }, */
-+	{ 0x1100, 0xb2,		"LCD 1",	0 },
-+	{ 0x1200, 0x64,		"LCD 2",	0 },
-+	{ 0x1400, 0x42,		"MMC",		0 },
-+/*	{ 0x1500, 0x080,	"MPU 0",	0 },
-+	{ 0x1580, 0x080,	"MPU 1",	0 },
-+	{ 0x1600, 0x080,	"Cmd Queue",	0 },
-+	{ 0x1680, 0x080,	"RISC CPU",	0 },*/
-+	{ 0x1700, 0x400,	"2D Unit",	0 },
-+/*	{ 0x1b00, 0x900,	"3D Unit",	0 }, */
-+};
-+
-+static inline void __reg_write(struct glamo_core *glamo,
-+				uint16_t reg, uint16_t val)
-+{
-+	writew(val, glamo->base + reg);
-+}
-+
-+void glamo_reg_write(struct glamo_core *glamo,
-+				uint16_t reg, uint16_t val)
-+{
-+	spin_lock(&glamo->lock);
-+	__reg_write(glamo, reg, val);
-+	spin_unlock(&glamo->lock);
-+}
-+EXPORT_SYMBOL_GPL(glamo_reg_write);
-+
-+
-+static inline uint16_t __reg_read(struct glamo_core *glamo,
-+					uint16_t reg)
-+{
-+	return readw(glamo->base + reg);
-+}
-+
-+uint16_t glamo_reg_read(struct glamo_core *glamo, uint16_t reg)
-+{
-+	uint16_t val;
-+	spin_lock(&glamo->lock);
-+	val = __reg_read(glamo, reg);
-+	spin_unlock(&glamo->lock);
-+
-+	return val;
-+}
-+EXPORT_SYMBOL_GPL(glamo_reg_read);
-+
-+static void __reg_set_bit_mask(struct glamo_core *glamo,
-+				uint16_t reg, uint16_t mask,
-+				uint16_t val)
-+{
-+	uint16_t tmp;
-+
-+	val &= mask;
-+
-+	tmp = __reg_read(glamo, reg);
-+	tmp &= ~mask;
-+	tmp |= val;
-+	__reg_write(glamo, reg, tmp);
-+}
-+
-+static void reg_set_bit_mask(struct glamo_core *glamo,
-+				uint16_t reg, uint16_t mask,
-+				uint16_t val)
-+{
-+	spin_lock(&glamo->lock);
-+	__reg_set_bit_mask(glamo, reg, mask, val);
-+	spin_unlock(&glamo->lock);
-+}
-+
-+static inline void __reg_set_bit(struct glamo_core *glamo,
-+				 uint16_t reg, uint16_t bit)
-+{
-+	uint16_t tmp;
-+	tmp = __reg_read(glamo, reg);
-+	tmp |= bit;
-+	__reg_write(glamo, reg, tmp);
-+}
-+
-+static inline void __reg_clear_bit(struct glamo_core *glamo,
-+					uint16_t reg, uint16_t bit)
-+{
-+	uint16_t tmp;
-+	tmp = __reg_read(glamo, reg);
-+	tmp &= ~bit;
-+	__reg_write(glamo, reg, tmp);
-+}
-+
-+/***********************************************************************
-+ * resources of sibling devices
-+ ***********************************************************************/
-+
-+static struct resource glamo_fb_resources[] = {
-+	{
-+		.name	= "glamo-fb-regs",
-+		.start	= GLAMO_REGOFS_LCD,
-+		.end	= GLAMO_REGOFS_MMC - 1,
-+		.flags	= IORESOURCE_MEM,
-+	}, {
-+		.name	= "glamo-fb-mem",
-+		.start	= GLAMO_OFFSET_FB,
-+		.end	= GLAMO_OFFSET_FB + GLAMO_FB_SIZE - 1,
-+		.flags	= IORESOURCE_MEM,
-+	},
-+};
-+
-+static struct resource glamo_mmc_resources[] = {
-+	{
-+		.name	= "glamo-mmc-regs",
-+		.start	= GLAMO_REGOFS_MMC,
-+		.end	= GLAMO_REGOFS_MPROC0 - 1,
-+		.flags	= IORESOURCE_MEM
-+	}, {
-+		.name	= "glamo-mmc-mem",
-+		.start	= GLAMO_OFFSET_FB + GLAMO_FB_SIZE,
-+		.end	= GLAMO_OFFSET_FB + GLAMO_FB_SIZE +
-+				  GLAMO_MMC_BUFFER_SIZE - 1,
-+		.flags	= IORESOURCE_MEM
-+	}, {
-+		.start	= GLAMO_IRQ_MMC,
-+		.end	= GLAMO_IRQ_MMC,
-+		.flags	= IORESOURCE_IRQ,
-+	},
-+};
-+
-+enum glamo_cells {
-+	GLAMO_CELL_FB,
-+	GLAMO_CELL_MMC,
-+	GLAMO_CELL_GPIO,
-+};
-+
-+static const struct mfd_cell glamo_cells[] = {
-+	[GLAMO_CELL_FB] = {
-+		.name = "glamo-fb",
-+		.num_resources = ARRAY_SIZE(glamo_fb_resources),
-+		.resources = glamo_fb_resources,
-+	},
-+	[GLAMO_CELL_MMC] = {
-+		.name = "glamo-mci",
-+		.num_resources = ARRAY_SIZE(glamo_mmc_resources),
-+		.resources = glamo_mmc_resources,
-+	},
-+	[GLAMO_CELL_GPIO] = {
-+		.name = "glamo-gpio",
-+	},
-+};
-+
-+/***********************************************************************
-+ * IRQ demultiplexer
-+ ***********************************************************************/
-+static inline unsigned int glamo_irq_bit(struct glamo_core *glamo,
-+	struct irq_data *data)
-+{
-+	return BIT(data->irq - glamo->irq_base);
-+}
-+
-+static void glamo_ack_irq(struct irq_data *data)
-+{
-+	struct glamo_core *glamo = irq_data_get_irq_chip_data(data);
-+	/* clear interrupt source */
-+	__reg_write(glamo, GLAMO_REG_IRQ_CLEAR, glamo_irq_bit(glamo, data));
-+}
-+
-+static void glamo_mask_irq(struct irq_data *data)
-+{
-+	struct glamo_core *glamo = irq_data_get_irq_chip_data(data);
-+
-+	/* clear bit in enable register */
-+	__reg_clear_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, data));
-+}
-+
-+static void glamo_unmask_irq(struct irq_data *data)
-+{
-+	struct glamo_core *glamo = irq_data_get_irq_chip_data(data);
-+
-+	/* set bit in enable register */
-+	__reg_set_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, data));
-+}
-+
-+static struct irq_chip glamo_irq_chip = {
-+	.name		= "glamo",
-+	.irq_ack	= glamo_ack_irq,
-+	.irq_mask	= glamo_mask_irq,
-+	.irq_unmask	= glamo_unmask_irq,
-+};
-+
-+static irqreturn_t glamo_irq_handler(int irq, void *devid)
-+{
-+	struct glamo_core *glamo = devid;
-+	uint16_t irqstatus;
-+	int i;
-+
-+	irqstatus = __reg_read(glamo, GLAMO_REG_IRQ_STATUS);
-+	for (i = 0; i < 9; ++i) {
-+		if (irqstatus & BIT(i))
-+			generic_handle_irq(glamo->irq_base + i);
-+	}
-+
-+	return IRQ_HANDLED;
-+}
-+
-+struct glamo_engine_reg_set {
-+	uint16_t reg;
-+	uint16_t mask_suspended;
-+	uint16_t mask_enabled;
-+};
-+
-+/*
-+debugfs
-+*/
-+
-+#ifdef CONFIG_DEBUG_FS
-+static ssize_t debugfs_regs_write(struct file *file,
-+				  const char __user *user_buf,
-+				  size_t count, loff_t *ppos)
-+{
-+	struct glamo_core *glamo = ((struct seq_file *)file->private_data)->private;
-+	char buf[14];
-+	unsigned int reg;
-+	unsigned int val;
-+	int buf_size;
-+
-+	buf_size = min(count, sizeof(buf) - 1);
-+	if (copy_from_user(buf, user_buf, buf_size))
-+		return -EFAULT;
-+	if (sscanf(buf, "%x %x", &reg, &val) != 2)
-+		return -EFAULT;
-+
-+	dev_info(&glamo->pdev->dev, "reg %#02x <-- %#04x\n", reg, val);
-+
-+	glamo_reg_write(glamo, reg, val);
-+
-+	return count;
-+}
-+
-+static int glamo_show_regs(struct seq_file *s, void *pos)
-+{
-+	struct glamo_core *glamo = s->private;
-+	const struct reg_range *rr = reg_range;
-+	int i, n;
-+
-+	spin_lock(&glamo->lock);
-+	for (i = 0; i < ARRAY_SIZE(reg_range); ++i, ++rr) {
-+		if (!rr->dump)
-+			continue;
-+		seq_printf(s, "\n%s\n", rr->name);
-+		for (n = rr->start; n < rr->start + rr->count; n += 2) {
-+			if ((n & 15) == 0)
-+				seq_printf(s, "\n%04X:  ", n);
-+			seq_printf(s, "%04x ", __reg_read(glamo, n));
-+		}
-+		seq_printf(s, "\n");
-+	}
-+	spin_unlock(&glamo->lock);
-+
-+	return 0;
-+}
-+
-+static int debugfs_open_file(struct inode *inode, struct file *file)
-+{
-+	return single_open(file, glamo_show_regs, inode->i_private);
-+}
-+
-+static const struct file_operations debugfs_regs_ops = {
-+	.open		= debugfs_open_file,
-+	.read		= seq_read,
-+	.llseek		= seq_lseek,
-+	.write		= debugfs_regs_write,
-+	.release	= single_release,
-+};
-+
-+static void glamo_init_debugfs(struct glamo_core *glamo)
-+{
-+	glamo->debugfs_dir = debugfs_create_dir("glamo3362", NULL);
-+	if (glamo->debugfs_dir)
-+		debugfs_create_file("regs", S_IRUGO | S_IWUSR,
-+				    glamo->debugfs_dir,
-+				    glamo, &debugfs_regs_ops);
-+	else
-+		dev_warn(&glamo->pdev->dev, "Failed to set up debugfs.\n");
-+}
-+
-+static void glamo_exit_debugfs(struct glamo_core *glamo)
-+{
-+	if (glamo->debugfs_dir)
-+		debugfs_remove_recursive(glamo->debugfs_dir);
-+}
-+#else
-+static void glamo_init_debugfs(struct glamo_core *glamo)
-+{
-+}
-+
-+static void glamo_exit_debugfs(struct glamo_core *glamo)
-+{
-+}
-+#endif
-+
-+struct glamo_engine_desc {
-+	const char *name;
-+	uint16_t hostbus;
-+	const struct glamo_engine_reg_set *regs;
-+	size_t num_regs;
-+};
-+
-+static const struct glamo_engine_reg_set glamo_lcd_regs[] = {
-+	{ GLAMO_REG_CLOCK_LCD,
-+	GLAMO_CLOCK_LCD_EN_M5CLK |
-+	GLAMO_CLOCK_LCD_DG_M5CLK |
-+	GLAMO_CLOCK_LCD_EN_DMCLK,
-+
-+	GLAMO_CLOCK_LCD_EN_DHCLK |
-+	GLAMO_CLOCK_LCD_EN_DCLK
-+	},
-+	{ GLAMO_REG_CLOCK_GEN5_1,
-+	GLAMO_CLOCK_GEN51_EN_DIV_DMCLK,
-+
-+	GLAMO_CLOCK_GEN51_EN_DIV_DHCLK |
-+	GLAMO_CLOCK_GEN51_EN_DIV_DCLK
-+	}
-+};
-+
-+static const struct glamo_engine_reg_set glamo_mmc_regs[] = {
-+	{ GLAMO_REG_CLOCK_MMC,
-+	GLAMO_CLOCK_MMC_EN_M9CLK |
-+	GLAMO_CLOCK_MMC_DG_M9CLK,
-+
-+	GLAMO_CLOCK_MMC_EN_TCLK |
-+	GLAMO_CLOCK_MMC_DG_TCLK
-+	},
-+	{ GLAMO_REG_CLOCK_GEN5_1,
-+	0,
-+	GLAMO_CLOCK_GEN51_EN_DIV_TCLK
-+	}
-+};
-+
-+static const struct glamo_engine_reg_set glamo_2d_regs[] = {
-+	{ GLAMO_REG_CLOCK_2D,
-+	GLAMO_CLOCK_2D_EN_M7CLK |
-+	GLAMO_CLOCK_2D_DG_M7CLK,
-+
-+	GLAMO_CLOCK_2D_EN_GCLK |
-+	GLAMO_CLOCK_2D_DG_GCLK
-+	},
-+	{ GLAMO_REG_CLOCK_GEN5_1,
-+	0,
-+	GLAMO_CLOCK_GEN51_EN_DIV_GCLK,
-+	}
-+};
-+
-+static const struct glamo_engine_reg_set glamo_cmdq_regs[] = {
-+	{ GLAMO_REG_CLOCK_2D,
-+	GLAMO_CLOCK_2D_EN_M6CLK,
-+	0
-+	},
-+};
-+
-+#define GLAMO_ENGINE(xname, xhostbus, xregs) { \
-+	.name = xname, \
-+	.hostbus = xhostbus, \
-+	.num_regs = ARRAY_SIZE(xregs), \
-+	.regs = xregs, \
-+}
-+
-+static const struct glamo_engine_desc glamo_engines[] = {
-+	[GLAMO_ENGINE_LCD] = GLAMO_ENGINE("LCD", GLAMO_HOSTBUS2_MMIO_EN_LCD,
-+					glamo_lcd_regs),
-+	[GLAMO_ENGINE_MMC] = GLAMO_ENGINE("MMC", GLAMO_HOSTBUS2_MMIO_EN_MMC,
-+					glamo_mmc_regs),
-+	[GLAMO_ENGINE_2D] = GLAMO_ENGINE("2D", GLAMO_HOSTBUS2_MMIO_EN_2D,
-+					glamo_2d_regs),
-+	[GLAMO_ENGINE_CMDQ] = GLAMO_ENGINE("CMDQ", GLAMO_HOSTBUS2_MMIO_EN_CQ,
-+					glamo_cmdq_regs),
-+};
-+
-+static inline const char *glamo_engine_name(enum glamo_engine engine)
-+{
-+	return glamo_engines[engine].name;
-+}
-+
-+/***********************************************************************
-+ * 'engine' support
-+ ***********************************************************************/
-+
-+int __glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int i;
-+	const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+	const struct glamo_engine_reg_set *reg;
-+
-+	switch (engine) {
-+	case GLAMO_ENGINE_LCD:
-+	case GLAMO_ENGINE_MMC:
-+	case GLAMO_ENGINE_2D:
-+	case GLAMO_ENGINE_CMDQ:
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	reg = engine_desc->regs;
-+
-+	__reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+			engine_desc->hostbus);
-+	for (i = engine_desc->num_regs; i; --i, ++reg)
-+		__reg_set_bit(glamo, reg->reg,
-+				reg->mask_suspended | reg->mask_enabled);
-+
-+	return 0;
-+}
-+
-+int glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int ret = 0;
-+
-+	spin_lock(&glamo->lock);
-+
-+	if (glamo->engine_state[engine] != GLAMO_ENGINE_ENABLED) {
-+		ret = __glamo_engine_enable(glamo, engine);
-+		if (!ret)
-+			glamo->engine_state[engine] = GLAMO_ENGINE_ENABLED;
-+	}
-+
-+	spin_unlock(&glamo->lock);
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_enable);
-+
-+int __glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int i;
-+	const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+	const struct glamo_engine_reg_set *reg;
-+
-+	switch (engine) {
-+	case GLAMO_ENGINE_LCD:
-+	case GLAMO_ENGINE_MMC:
-+	case GLAMO_ENGINE_2D:
-+	case GLAMO_ENGINE_CMDQ:
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	reg = engine_desc->regs;
-+
-+	__reg_clear_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+			engine_desc->hostbus);
-+	for (i = engine_desc->num_regs; i; --i, ++reg)
-+		__reg_clear_bit(glamo, reg->reg,
-+				reg->mask_suspended | reg->mask_enabled);
-+
-+	return 0;
-+}
-+int glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int ret = 0;
-+
-+	spin_lock(&glamo->lock);
-+
-+	if (glamo->engine_state[engine] != GLAMO_ENGINE_DISABLED) {
-+		ret = __glamo_engine_disable(glamo, engine);
-+		if (!ret)
-+			glamo->engine_state[engine] = GLAMO_ENGINE_DISABLED;
-+	}
-+
-+	spin_unlock(&glamo->lock);
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_disable);
-+
-+int __glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int i;
-+	const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+	const struct glamo_engine_reg_set *reg;
-+
-+	switch (engine) {
-+	case GLAMO_ENGINE_LCD:
-+	case GLAMO_ENGINE_MMC:
-+	case GLAMO_ENGINE_2D:
-+	case GLAMO_ENGINE_CMDQ:
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	reg = engine_desc->regs;
-+
-+	__reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+			engine_desc->hostbus);
-+	for (i = engine_desc->num_regs; i; --i, ++reg) {
-+		__reg_set_bit(glamo, reg->reg, reg->mask_suspended);
-+		__reg_clear_bit(glamo, reg->reg, reg->mask_enabled);
-+	}
-+
-+	return 0;
-+}
-+
-+int glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	int ret = 0;
-+
-+	spin_lock(&glamo->lock);
-+
-+	if (glamo->engine_state[engine] != GLAMO_ENGINE_SUSPENDED) {
-+		ret = __glamo_engine_suspend(glamo, engine);
-+		if (!ret)
-+			glamo->engine_state[engine] = GLAMO_ENGINE_SUSPENDED;
-+	}
-+
-+	spin_unlock(&glamo->lock);
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_suspend);
-+
-+static const struct glamo_script reset_regs[] = {
-+	[GLAMO_ENGINE_LCD] = {
-+		GLAMO_REG_CLOCK_LCD, GLAMO_CLOCK_LCD_RESET
-+	},
-+	[GLAMO_ENGINE_MMC] = {
-+		GLAMO_REG_CLOCK_MMC, GLAMO_CLOCK_MMC_RESET
-+	},
-+	[GLAMO_ENGINE_CMDQ] = {
-+		GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_CQ_RESET
-+	},
-+	[GLAMO_ENGINE_2D] = {
-+		GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_RESET
-+	},
-+	[GLAMO_ENGINE_JPEG] = {
-+		GLAMO_REG_CLOCK_JPEG, GLAMO_CLOCK_JPEG_RESET
-+	},
-+};
-+
-+void glamo_engine_reset(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+	uint16_t reg = reset_regs[engine].reg;
-+	uint16_t val = reset_regs[engine].val;
-+
-+	if (engine >= ARRAY_SIZE(reset_regs)) {
-+		dev_warn(&glamo->pdev->dev, "unknown engine %u ", engine);
-+		return;
-+	}
-+
-+	spin_lock(&glamo->lock);
-+	__reg_set_bit(glamo, reg, val);
-+	__reg_clear_bit(glamo, reg, val);
-+	spin_unlock(&glamo->lock);
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_reset);
-+
-+int glamo_pll_rate(struct glamo_core *glamo,
-+			  enum glamo_pll pll)
-+{
-+	uint16_t reg;
-+	unsigned int osci = glamo->pdata->osci_clock_rate;
-+
-+	switch (pll) {
-+	case GLAMO_PLL1:
-+		reg = __reg_read(glamo, GLAMO_REG_PLL_GEN1);
-+		break;
-+	case GLAMO_PLL2:
-+		reg = __reg_read(glamo, GLAMO_REG_PLL_GEN3);
-+		break;
-+	default:
-+		return -EINVAL;
-+	}
-+
-+	return (int)osci * (int)reg;
-+}
-+EXPORT_SYMBOL_GPL(glamo_pll_rate);
-+
-+int glamo_engine_reclock(struct glamo_core *glamo,
-+			 enum glamo_engine engine,
-+			 int hz)
-+{
-+	int pll;
-+	uint16_t reg, mask, div;
-+
-+	if (!hz)
-+		return -EINVAL;
-+
-+	switch (engine) {
-+	case GLAMO_ENGINE_LCD:
-+		pll = GLAMO_PLL1;
-+		reg = GLAMO_REG_CLOCK_GEN7;
-+		mask = 0xff;
-+		break;
-+	case GLAMO_ENGINE_MMC:
-+		pll = GLAMO_PLL1;
-+		reg = GLAMO_REG_CLOCK_GEN8;
-+		mask = 0xff;
-+		break;
-+	default:
-+		dev_warn(&glamo->pdev->dev,
-+			 "reclock of engine 0x%x not supported\n", engine);
-+		return -EINVAL;
-+		break;
-+	}
-+
-+	pll = glamo_pll_rate(glamo, pll);
-+
-+	div = pll / hz;
-+
-+	if (div != 0 && pll / div <= hz)
-+		--div;
-+
-+	if (div > mask)
-+		div = mask;
-+
-+	dev_dbg(&glamo->pdev->dev,
-+			"PLL %d, kHZ %d, div %d\n", pll, hz / 1000, div);
-+
-+	reg_set_bit_mask(glamo, reg, mask, div);
-+	mdelay(5); /* wait some time to stabilize */
-+
-+	return pll / (div + 1);
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_reclock);
-+
-+/***********************************************************************
-+ * script support
-+ ***********************************************************************/
-+
-+#define GLAMO_SCRIPT_END	0xffff
-+#define GLAMO_SCRIPT_WAIT	0xfffe
-+#define GLAMO_SCRIPT_LOCK_PLL	0xfffd
-+
-+/*
-+ * couple of people reported artefacts with 2.6.28 changes, this
-+ * allows reversion to 2.6.24 settings
-+*/
-+static const uint16_t reg_0x200[] = {
-+	0xe03, /* 0 waits on Async BB R & W, Use PLL 2 for mem bus */
-+	0xef0, /* 3 waits on Async BB R & W, Use PLL 1 for mem bus */
-+	0xea0, /* 2 waits on Async BB R & W, Use PLL 1 for mem bus */
-+	0xe50, /* 1 waits on Async BB R & W, Use PLL 1 for mem bus */
-+	0xe00, /* 0 waits on Async BB R & W, Use PLL 1 for mem bus */
-+	0xef3, /* 3 waits on Async BB R & W, Use PLL 2 for mem bus */
-+	0xea3, /* 2 waits on Async BB R & W, Use PLL 2 for mem bus */
-+	0xe53, /* 1 waits on Async BB R & W, Use PLL 2 for mem bus */
-+};
-+
-+static int glamo_run_script(struct glamo_core *glamo,
-+				const struct glamo_script *script, int len,
-+				int may_sleep)
-+{
-+	int i;
-+	uint16_t status;
-+	const struct glamo_script *line = script;
-+
-+	for (i = 0; i < len; ++i, ++line) {
-+		switch (line->reg) {
-+		case GLAMO_SCRIPT_END:
-+			return 0;
-+		case GLAMO_SCRIPT_WAIT:
-+			if (may_sleep)
-+				msleep(line->val);
-+			else
-+				mdelay(line->val * 4);
-+			break;
-+		case GLAMO_SCRIPT_LOCK_PLL:
-+			/* spin until PLLs lock */
-+			do {
-+				status = __reg_read(glamo, GLAMO_REG_PLL_GEN5);
-+			} while ((status & 3) != 3);
-+			break;
-+		case 0x200:
-+			__reg_write(glamo, line->reg,
-+					reg_0x200[slow_memory & 0x7]);
-+			break;
-+		default:
-+			__reg_write(glamo, line->reg, line->val);
-+			break;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static const struct glamo_script glamo_init_script[] = {
-+	{ GLAMO_REG_CLOCK_HOST,		0x1000 },
-+	{ GLAMO_SCRIPT_WAIT,		     2 },
-+	{ GLAMO_REG_CLOCK_MEMORY,	0x1000 },
-+	{ GLAMO_REG_CLOCK_MEMORY,	0x2000 },
-+	{ GLAMO_REG_CLOCK_LCD,		0x1000 },
-+	{ GLAMO_REG_CLOCK_MMC,		0x1000 },
-+	{ GLAMO_REG_CLOCK_ISP,		0x1000 },
-+	{ GLAMO_REG_CLOCK_ISP,		0x3000 },
-+	{ GLAMO_REG_CLOCK_JPEG,		0x1000 },
-+	{ GLAMO_REG_CLOCK_3D,		0x1000 },
-+	{ GLAMO_REG_CLOCK_3D,		0x3000 },
-+	{ GLAMO_REG_CLOCK_2D,		0x1000 },
-+	{ GLAMO_REG_CLOCK_2D,		0x3000 },
-+	{ GLAMO_REG_CLOCK_RISC1,	0x1000 },
-+	{ GLAMO_REG_CLOCK_MPEG,		0x1000 },
-+	{ GLAMO_REG_CLOCK_MPEG,		0x3000 },
-+	{ GLAMO_REG_CLOCK_MPROC,	0x1000 /*0x100f*/ },
-+	{ GLAMO_SCRIPT_WAIT,		     2 },
-+	{ GLAMO_REG_CLOCK_HOST,		0x0000 },
-+	{ GLAMO_REG_CLOCK_MEMORY,	0x0000 },
-+	{ GLAMO_REG_CLOCK_LCD,		0x0000 },
-+	{ GLAMO_REG_CLOCK_MMC,		0x0000 },
-+	{ GLAMO_REG_PLL_GEN1,		0x05db },	/* 48MHz */
-+	{ GLAMO_REG_PLL_GEN3,		0x0aba },	/* 90MHz */
-+	{ GLAMO_SCRIPT_LOCK_PLL, 0 },
-+	/*
-+	 * b9 of this register MUST be zero to get any interrupts on INT#
-+	 * the other set bits enable all the engine interrupt sources
-+	 */
-+	{ GLAMO_REG_IRQ_ENABLE,		0x0100 },
-+	{ GLAMO_REG_CLOCK_GEN6,		0x2000 },
-+	{ GLAMO_REG_CLOCK_GEN7,		0x0101 },
-+	{ GLAMO_REG_CLOCK_GEN8,		0x0100 },
-+	{ GLAMO_REG_CLOCK_HOST,		0x000d },
-+	/*
-+	 * b7..b4 = 0 = no wait states on read or write
-+	 * b0 = 1 select PLL2 for Host interface, b1 = enable it
-+	 */
-+	{ GLAMO_REG_HOSTBUS(1),		0x0e03 /* this is replaced by script parser */ },
-+	{ GLAMO_REG_HOSTBUS(2),		0x07ff }, /* TODO: Disable all */
-+	{ GLAMO_REG_HOSTBUS(10),	0x0000 },
-+	{ GLAMO_REG_HOSTBUS(11),	0x4000 },
-+	{ GLAMO_REG_HOSTBUS(12),	0xf00e },
-+
-+	/* S-Media recommended "set tiling mode to 512 mode for memory access
-+	 * more efficiency when 640x480" */
-+	{ GLAMO_REG_MEM_TYPE,		0x0c74 }, /* 8MB, 16 word pg wr+rd */
-+	{ GLAMO_REG_MEM_GEN,		0xafaf }, /* 63 grants min + max */
-+
-+	{ GLAMO_REG_MEM_TIMING1,	0x0108 },
-+	{ GLAMO_REG_MEM_TIMING2,	0x0010 }, /* Taa = 3 MCLK */
-+	{ GLAMO_REG_MEM_TIMING3,	0x0000 },
-+	{ GLAMO_REG_MEM_TIMING4,	0x0000 }, /* CE1# delay fall/rise */
-+	{ GLAMO_REG_MEM_TIMING5,	0x0000 }, /* UB# LB# */
-+	{ GLAMO_REG_MEM_TIMING6,	0x0000 }, /* OE# */
-+	{ GLAMO_REG_MEM_TIMING7,	0x0000 }, /* WE# */
-+	{ GLAMO_REG_MEM_TIMING8,	0x1002 }, /* MCLK delay, was 0x1000 */
-+	{ GLAMO_REG_MEM_TIMING9,	0x6006 },
-+	{ GLAMO_REG_MEM_TIMING10,	0x00ff },
-+	{ GLAMO_REG_MEM_TIMING11,	0x0001 },
-+	{ GLAMO_REG_MEM_POWER1,		0x0020 },
-+	{ GLAMO_REG_MEM_POWER2,		0x0000 },
-+	{ GLAMO_REG_MEM_DRAM1,		0x0000 },
-+	{ GLAMO_SCRIPT_WAIT,		     1 },
-+	{ GLAMO_REG_MEM_DRAM1,		0xc100 },
-+	{ GLAMO_SCRIPT_WAIT,		     1 },
-+	{ GLAMO_REG_MEM_DRAM1,		0xe100 },
-+	{ GLAMO_REG_MEM_DRAM2,		0x01d6 },
-+	{ GLAMO_REG_CLOCK_MEMORY,	0x000b },
-+};
-+
-+/* Find out if we can support this version of the Glamo chip */
-+static int __devinit glamo_supported(struct glamo_core *glamo)
-+{
-+	uint16_t dev_id, rev_id;
-+
-+	dev_id = __reg_read(glamo, GLAMO_REG_DEVICE_ID);
-+	rev_id = __reg_read(glamo, GLAMO_REG_REVISION_ID);
-+
-+	switch (dev_id) {
-+	case 0x3650:
-+		switch (rev_id) {
-+		case GLAMO_CORE_REV_A2:
-+			break;
-+		case GLAMO_CORE_REV_A0:
-+		case GLAMO_CORE_REV_A1:
-+		case GLAMO_CORE_REV_A3:
-+			dev_warn(&glamo->pdev->dev, "untested core revision "
-+				 "%04x, your mileage may vary\n", rev_id);
-+			break;
-+		default:
-+			dev_warn(&glamo->pdev->dev, "unknown glamo revision "
-+				 "%04x, your mileage may vary\n", rev_id);
-+		}
-+		break;
-+	default:
-+		dev_err(&glamo->pdev->dev, "unsupported Glamo device %04x\n",
-+			dev_id);
-+		return 0;
-+	}
-+
-+	dev_dbg(&glamo->pdev->dev, "Detected Glamo core %04x Revision %04x "
-+		 "(%uHz CPU / %uHz Memory)\n", dev_id, rev_id,
-+		 glamo_pll_rate(glamo, GLAMO_PLL1),
-+		 glamo_pll_rate(glamo, GLAMO_PLL2));
-+
-+	return 1;
-+}
-+
-+static int __devinit glamo_probe(struct platform_device *pdev)
-+{
-+	int ret = 0, n, irq, irq_base;
-+	struct glamo_core *glamo;
-+	struct resource *mem;
-+
-+	glamo = kmalloc(GFP_KERNEL, sizeof(*glamo));
-+	if (!glamo)
-+		return -ENOMEM;
-+
-+	for (n = 0; n < __NUM_GLAMO_ENGINES; n++)
-+		glamo->engine_state[n] = GLAMO_ENGINE_DISABLED;
-+
-+	spin_lock_init(&glamo->lock);
-+
-+	glamo->pdev = pdev;
-+	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-+	glamo->irq = platform_get_irq(pdev, 0);
-+	glamo->pdata = pdev->dev.platform_data;
-+
-+	if (glamo->irq < 0) {
-+		ret = glamo->irq;
-+		dev_err(&pdev->dev, "Failed to get platform irq: %d\n", ret);
-+		goto err_free;
-+	}
-+
-+	if (!mem) {
-+		dev_err(&pdev->dev, "Failed to get platform memory\n");
-+		ret = -ENOENT;
-+		goto err_free;
-+	}
-+
-+	if (!glamo->pdata) {
-+		dev_err(&pdev->dev, "Missing platform data\n");
-+		ret = -ENOENT;
-+		goto err_free;
-+	}
-+
-+	irq_base = irq_alloc_descs(-1, 0, GLAMO_NR_IRQS, 0);
-+	if (irq_base < 0) {
-+		dev_err(&pdev->dev, "Failed to allocate irqs: %d\n", irq_base);
-+		goto err_free;
-+	}
-+	glamo->irq_base = irq_base;
-+
-+
-+	/* only request the generic, hostbus and memory controller registers */
-+	glamo->mem = request_mem_region(mem->start, GLAMO_REGOFS_VIDCAP,
-+					pdev->name);
-+
-+	if (!glamo->mem) {
-+		dev_err(&pdev->dev, "Failed to request io memory region\n");
-+		ret = -ENOENT;
-+		goto err_irq_free_descs;
-+	}
-+
-+	glamo->base = ioremap(glamo->mem->start, resource_size(glamo->mem));
-+	if (!glamo->base) {
-+		dev_err(&pdev->dev, "Failed to ioremap() memory region\n");
-+		goto err_release_mem_region;
-+	}
-+
-+	/* confirm it isn't insane version */
-+	if (!glamo_supported(glamo)) {
-+		dev_err(&pdev->dev,
-+			"This version of the Glamo is not supported\n");
-+		goto err_iounmap;
-+	}
-+
-+	platform_set_drvdata(pdev, glamo);
-+
-+	/* debugfs */
-+	glamo_init_debugfs(glamo);
-+
-+	/* init the chip with canned register set */
-+	glamo_run_script(glamo, glamo_init_script,
-+			 ARRAY_SIZE(glamo_init_script), 1);
-+
-+	/*
-+	 * finally set the mfd interrupts up
-+	 */
-+	for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+#ifdef CONFIG_ARM
-+		set_irq_flags(irq, IRQF_VALID);
-+#else
-+		irq_set_noprobe(irq);
-+#endif
-+		irq_set_chip_data(irq, glamo);
-+		irq_set_chip_and_handler(irq, &glamo_irq_chip,
-+					handle_level_irq);
-+	}
-+
-+	ret = request_any_context_irq(glamo->irq, glamo_irq_handler,
-+				IRQF_TRIGGER_FALLING, "glamo irq demux", glamo);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to request irq: %d\n", ret);
-+		goto err_free_irqs;
-+	}
-+
-+	ret = mfd_add_devices(&pdev->dev, pdev->id, glamo_cells,
-+				ARRAY_SIZE(glamo_cells), mem, glamo->irq_base);
-+
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to add child devices: %d\n", ret);
-+		goto err_free_irq;
-+	}
-+
-+	dev_info(&glamo->pdev->dev, "Glamo core PLL1: %uHz, PLL2: %uHz\n",
-+		 glamo_pll_rate(glamo, GLAMO_PLL1),
-+		 glamo_pll_rate(glamo, GLAMO_PLL2));
-+
-+	return 0;
-+
-+err_free_irq:
-+	free_irq(glamo->irq, glamo);
-+err_free_irqs:
-+	for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+		irq_set_chip(irq, NULL);
-+#ifdef CONFIG_ARM
-+		set_irq_flags(irq, 0);
-+#else
-+		irq_set_probe(irq);
-+#endif
-+		irq_set_chip_data(irq, NULL);
-+	}
-+err_iounmap:
-+	iounmap(glamo->base);
-+err_release_mem_region:
-+	release_mem_region(glamo->mem->start, resource_size(glamo->mem));
-+err_irq_free_descs:
-+	irq_free_descs(irq_base, GLAMO_NR_IRQS);
-+err_free:
-+	platform_set_drvdata(pdev, NULL);
-+	kfree(glamo);
-+
-+	return ret;
-+}
-+
-+static int __devexit glamo_remove(struct platform_device *pdev)
-+{
-+	struct glamo_core *glamo = platform_get_drvdata(pdev);
-+	int irq;
-+	int irq_base = glamo->irq_base;
-+
-+	glamo_exit_debugfs(glamo);
-+
-+	mfd_remove_devices(&pdev->dev);
-+
-+	free_irq(glamo->irq, glamo);
-+
-+	for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+#ifdef CONFIG_ARM
-+		set_irq_flags(irq, 0);
-+#else
-+		irq_set_noprobe();
-+#endif
-+		irq_set_chip(irq, NULL);
-+		irq_set_chip_data(irq, NULL);
-+	}
-+
-+	platform_set_drvdata(pdev, NULL);
-+	iounmap(glamo->base);
-+	release_mem_region(glamo->mem->start, resource_size(glamo->mem));
-+	irq_free_descs(irq_base, GLAMO_NR_IRQS);
-+	kfree(glamo);
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_PM
-+#if 0
-+static struct glamo_script glamo_resume_script[] = {
-+
-+	{ GLAMO_REG_PLL_GEN1,		0x05db },	/* 48MHz */
-+	{ GLAMO_REG_PLL_GEN3,		0x0aba },	/* 90MHz */
-+	{ GLAMO_REG_DFT_GEN6, 1 },
-+		{ 0xfffe, 100 },
-+		{ 0xfffd, 0 },
-+	{ 0x200,	0x0e03 },
-+
-+	/*
-+	 * b9 of this register MUST be zero to get any interrupts on INT#
-+	 * the other set bits enable all the engine interrupt sources
-+	 */
-+	{ GLAMO_REG_IRQ_ENABLE,		0x01ff },
-+	{ GLAMO_REG_CLOCK_HOST,		0x0018 },
-+	{ GLAMO_REG_CLOCK_GEN5_1, 0x18b1 },
-+
-+	{ GLAMO_REG_MEM_DRAM1,		0x0000 },
-+		{ 0xfffe, 1 },
-+	{ GLAMO_REG_MEM_DRAM1,		0xc100 },
-+		{ 0xfffe, 1 },
-+	{ GLAMO_REG_MEM_DRAM1,		0xe100 },
-+	{ GLAMO_REG_MEM_DRAM2,		0x01d6 },
-+	{ GLAMO_REG_CLOCK_MEMORY,	0x000b },
-+};
-+#endif
-+
-+#if 0
-+static void glamo_power(struct glamo_core *glamo)
-+{
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&glamo->lock, flags);
-+
-+	/*
-+Power management
-+static const REG_VALUE_MASK_TYPE reg_powerOn[] =
-+{
-+	{ REG_GEN_DFT6,	    REG_BIT_ALL,    REG_DATA(1u << 0)		},
-+	{ REG_GEN_PLL3,	    0u,		    REG_DATA(1u << 13)		},
-+	{ REG_GEN_MEM_CLK,  REG_BIT_ALL,    REG_BIT_EN_MOCACLK		},
-+	{ REG_MEM_DRAM2,    0u,		    REG_BIT_EN_DEEP_POWER_DOWN	},
-+	{ REG_MEM_DRAM1,    0u,		    REG_BIT_SELF_REFRESH	}
-+};
-+
-+static const REG_VALUE_MASK_TYPE reg_powerStandby[] =
-+{
-+	{ REG_MEM_DRAM1,    REG_BIT_ALL,    REG_BIT_SELF_REFRESH    },
-+	{ REG_GEN_MEM_CLK,  0u,		    REG_BIT_EN_MOCACLK	    },
-+	{ REG_GEN_PLL3,	    REG_BIT_ALL,    REG_DATA(1u << 13)	    },
-+	{ REG_GEN_DFT5,	    REG_BIT_ALL,    REG_DATA(1u << 0)	    }
-+};
-+
-+static const REG_VALUE_MASK_TYPE reg_powerSuspend[] =
-+{
-+	{ REG_MEM_DRAM2,    REG_BIT_ALL,    REG_BIT_EN_DEEP_POWER_DOWN  },
-+	{ REG_GEN_MEM_CLK,  0u,		    REG_BIT_EN_MOCACLK		},
-+	{ REG_GEN_PLL3,	    REG_BIT_ALL,    REG_DATA(1u << 13)		},
-+	{ REG_GEN_DFT5,	    REG_BIT_ALL,    REG_DATA(1u << 0)		}
-+};
-+*/
-+	switch (new_state) {
-+	case GLAMO_POWER_ON:
-+
-+		/*
-+		 * glamo state on resume is nondeterministic in some
-+		 * fundamental way, it has also been observed that the
-+		 * Glamo reset pin can get asserted by, eg, touching it with
-+		 * a scope probe.  So the only answer is to roll with it and
-+		 * force an external reset on the Glamo during resume.
-+		 */
-+
-+
-+		break;
-+
-+	case GLAMO_POWER_SUSPEND:
-+
-+		break;
-+	}
-+	spin_unlock_irqrestore(&glamo->lock, flags);
-+}
-+#endif
-+
-+static int glamo_suspend(struct device *dev)
-+{
-+	struct glamo_core *glamo = dev_get_drvdata(dev);
-+	int n;
-+
-+	spin_lock(&glamo->lock);
-+
-+	glamo->saved_irq_mask = __reg_read(glamo, GLAMO_REG_IRQ_ENABLE);
-+
-+	/* nuke interrupts */
-+	__reg_write(glamo, GLAMO_REG_IRQ_ENABLE, 0x200);
-+
-+	/* take down each engine before we kill mem and pll */
-+	for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
-+		if (glamo->engine_state[n] != GLAMO_ENGINE_DISABLED)
-+			__glamo_engine_disable(glamo, n);
-+	}
-+
-+	/* enable self-refresh */
-+
-+	__reg_write(glamo, GLAMO_REG_MEM_DRAM1,
-+				GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
-+				GLAMO_MEM_DRAM1_EN_GATE_CKE |
-+				GLAMO_MEM_DRAM1_SELF_REFRESH |
-+				GLAMO_MEM_REFRESH_COUNT);
-+	__reg_write(glamo, GLAMO_REG_MEM_DRAM1,
-+				GLAMO_MEM_DRAM1_EN_MODEREG_SET |
-+				GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
-+				GLAMO_MEM_DRAM1_EN_GATE_CKE |
-+				GLAMO_MEM_DRAM1_SELF_REFRESH |
-+				GLAMO_MEM_REFRESH_COUNT);
-+
-+	/* force RAM into deep powerdown */
-+	__reg_write(glamo, GLAMO_REG_MEM_DRAM2,
-+				GLAMO_MEM_DRAM2_DEEP_PWRDOWN |
-+				(7 << 6) | /* tRC */
-+				(1 << 4) | /* tRP */
-+				(1 << 2) | /* tRCD */
-+				2); /* CAS latency */
-+
-+	/* disable clocks to memory */
-+	__reg_write(glamo, GLAMO_REG_CLOCK_MEMORY, 0);
-+
-+	/* all dividers from OSCI */
-+	__reg_set_bit_mask(glamo, GLAMO_REG_CLOCK_GEN5_1, 0x400, 0x400);
-+
-+	/* PLL2 into bypass */
-+	__reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 12, 1 << 12);
-+
-+	__reg_write(glamo, GLAMO_BASIC_MMC_EN_TCLK_DLYA1, 0x0e00);
-+
-+	/* kill PLLS 1 then 2 */
-+	__reg_write(glamo, GLAMO_REG_DFT_GEN5, 0x0001);
-+	__reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 13, 1 << 13);
-+
-+	spin_unlock(&glamo->lock);
-+
-+	return 0;
-+}
-+
-+static int glamo_resume(struct device *dev)
-+{
-+	struct glamo_core *glamo = dev_get_drvdata(dev);
-+	int n;
-+
-+	(glamo->pdata->glamo_external_reset)(0);
-+	udelay(10);
-+	(glamo->pdata->glamo_external_reset)(1);
-+	mdelay(5);
-+
-+	spin_lock(&glamo->lock);
-+
-+	glamo_run_script(glamo, glamo_init_script,
-+			 ARRAY_SIZE(glamo_init_script), 0);
-+
-+
-+	for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
-+		switch (glamo->engine_state[n]) {
-+		case GLAMO_ENGINE_SUSPENDED:
-+			__glamo_engine_suspend(glamo, n);
-+			break;
-+		case GLAMO_ENGINE_ENABLED:
-+			__glamo_engine_enable(glamo, n);
-+			break;
-+		default:
-+			break;
-+		}
-+	}
-+
-+	__reg_write(glamo, GLAMO_REG_IRQ_ENABLE, glamo->saved_irq_mask);
-+
-+	spin_unlock(&glamo->lock);
-+
-+	return 0;
-+}
-+
-+static const struct dev_pm_ops glamo_pm_ops = {
-+	.suspend    = glamo_suspend,
-+	.resume     = glamo_resume,
-+	.poweroff   = glamo_suspend,
-+	.restore    = glamo_resume,
-+};
-+
-+#define GLAMO_PM_OPS (&glamo_pm_ops)
-+
-+#else
-+#define GLAMO_PM_OPS NULL
-+#endif
-+
-+static struct platform_driver glamo_driver = {
-+	.probe		= glamo_probe,
-+	.remove		= __devexit_p(glamo_remove),
-+	.driver		= {
-+		.name	= "glamo3362",
-+		.owner	= THIS_MODULE,
-+		.pm	= GLAMO_PM_OPS,
-+	},
-+};
-+
-+static int __init glamo_init(void)
-+{
-+	return platform_driver_register(&glamo_driver);
-+}
-+module_init(glamo_init);
-+
-+static void __exit glamo_exit(void)
-+{
-+	platform_driver_unregister(&glamo_driver);
-+}
-+module_exit(glamo_exit);
-+
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("Smedia Glamo 3362 core/resource driver");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("platform:glamo3362");
-diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
-index aed0d2a..54a78c1 100644
---- a/drivers/mfd/pcf50633-adc.c
-+++ b/drivers/mfd/pcf50633-adc.c
-@@ -24,6 +24,8 @@
- #include <linux/platform_device.h>
- #include <linux/completion.h>
- 
-+#include <linux/interrupt.h>
-+
- #include <linux/mfd/pcf50633/core.h>
- #include <linux/mfd/pcf50633/adc.h>
- 
-@@ -49,13 +51,9 @@ struct pcf50633_adc {
- 	int queue_head;
- 	int queue_tail;
- 	struct mutex queue_mutex;
-+	int irq;
- };
- 
--static inline struct pcf50633_adc *__to_adc(struct pcf50633 *pcf)
--{
--	return platform_get_drvdata(pcf->adc_pdev);
--}
--
- static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
- {
- 	channel &= PCF50633_ADCC1_ADCMUX_MASK;
-@@ -71,7 +69,7 @@ static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
- 
- static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
- {
--	struct pcf50633_adc *adc = __to_adc(pcf);
-+	struct pcf50633_adc *adc = pcf->adc;
- 	int head;
- 
- 	head = adc->queue_head;
-@@ -85,7 +83,7 @@ static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
- static int
- adc_enqueue_request(struct pcf50633 *pcf, struct pcf50633_adc_request *req)
- {
--	struct pcf50633_adc *adc = __to_adc(pcf);
-+	struct pcf50633_adc *adc = pcf->adc;
- 	int head, tail;
- 
- 	mutex_lock(&adc->queue_mutex);
-@@ -170,7 +168,7 @@ static int adc_result(struct pcf50633 *pcf)
- 	return result;
- }
- 
--static void pcf50633_adc_irq(int irq, void *data)
-+static irqreturn_t pcf50633_adc_irq(int irq, void *data)
- {
- 	struct pcf50633_adc *adc = data;
- 	struct pcf50633 *pcf = adc->pcf;
-@@ -184,7 +182,7 @@ static void pcf50633_adc_irq(int irq, void *data)
- 	if (WARN_ON(!req)) {
- 		dev_err(pcf->dev, "pcf50633-adc irq: ADC queue empty!\n");
- 		mutex_unlock(&adc->queue_mutex);
--		return;
-+		return IRQ_HANDLED;
- 	}
- 	adc->queue[head] = NULL;
- 	adc->queue_head = (head + 1) &
-@@ -197,25 +195,49 @@ static void pcf50633_adc_irq(int irq, void *data)
- 
- 	req->callback(pcf, req->callback_param, res);
- 	kfree(req);
-+
-+	return IRQ_HANDLED;
- }
- 
- static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
- {
-+	struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
- 	struct pcf50633_adc *adc;
-+	int irq;
-+	int ret;
- 
- 	adc = kzalloc(sizeof(*adc), GFP_KERNEL);
- 	if (!adc)
- 		return -ENOMEM;
- 
--	adc->pcf = dev_to_pcf50633(pdev->dev.parent);
-+	adc->pcf = pcf;
- 	platform_set_drvdata(pdev, adc);
- 
--	pcf50633_register_irq(adc->pcf, PCF50633_IRQ_ADCRDY,
--					pcf50633_adc_irq, adc);
-+	irq = platform_get_irq(pdev, 0);
-+	if (irq <= 0) {
-+		ret = irq;
-+		dev_err(&pdev->dev, "Failed to get irq: %d\n", ret);
-+		goto err_free;
-+	}
- 
- 	mutex_init(&adc->queue_mutex);
- 
-+	ret = request_threaded_irq(irq, NULL, pcf50633_adc_irq, 0,
-+				dev_name(&pdev->dev), adc);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to request irq: %d\n", ret);
-+		goto err_free;
-+	}
-+
-+	adc->irq = irq;
-+
-+	pcf->adc = adc;
-+
- 	return 0;
-+
-+err_free:
-+	kfree(adc);
-+	return ret;
- }
- 
- static int __devexit pcf50633_adc_remove(struct platform_device *pdev)
-@@ -223,7 +245,9 @@ static int __devexit pcf50633_adc_remove(struct platform_device *pdev)
- 	struct pcf50633_adc *adc = platform_get_drvdata(pdev);
- 	int i, head;
- 
--	pcf50633_free_irq(adc->pcf, PCF50633_IRQ_ADCRDY);
-+	adc->pcf->adc = NULL;
-+
-+	free_irq(adc->irq, adc);
- 
- 	mutex_lock(&adc->queue_mutex);
- 	head = adc->queue_head;
-diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
-index 57868416..165a3f3 100644
---- a/drivers/mfd/pcf50633-core.c
-+++ b/drivers/mfd/pcf50633-core.c
-@@ -24,6 +24,8 @@
- #include <linux/pm.h>
- #include <linux/slab.h>
- 
-+#include <linux/mfd/core.h>
-+
- #include <linux/mfd/pcf50633/core.h>
- 
- static int __pcf50633_read(struct pcf50633 *pcf, u8 reg, int num, u8 *data)
-@@ -51,7 +53,7 @@ static int __pcf50633_write(struct pcf50633 *pcf, u8 reg, int num, u8 *data)
- 
- }
- 
--/* Read a block of up to 32 regs  */
-+/* Read a block of upto 32 regs  */
- int pcf50633_read_block(struct pcf50633 *pcf, u8 reg,
- 					int nr_regs, u8 *data)
- {
-@@ -65,7 +67,7 @@ int pcf50633_read_block(struct pcf50633 *pcf, u8 reg,
- }
- EXPORT_SYMBOL_GPL(pcf50633_read_block);
- 
--/* Write a block of up to 32 regs  */
-+/* Write a block of upto 32 regs  */
- int pcf50633_write_block(struct pcf50633 *pcf , u8 reg,
- 					int nr_regs, u8 *data)
- {
-@@ -209,27 +211,6 @@ static struct attribute_group pcf_attr_group = {
- 	.attrs	= pcf_sysfs_entries,
- };
- 
--static void
--pcf50633_client_dev_register(struct pcf50633 *pcf, const char *name,
--						struct platform_device **pdev)
--{
--	int ret;
--
--	*pdev = platform_device_alloc(name, -1);
--	if (!*pdev) {
--		dev_err(pcf->dev, "Falied to allocate %s\n", name);
--		return;
--	}
--
--	(*pdev)->dev.parent = pcf->dev;
--
--	ret = platform_device_add(*pdev);
--	if (ret) {
--		dev_err(pcf->dev, "Failed to register %s: %d\n", name, ret);
--		platform_device_put(*pdev);
--		*pdev = NULL;
--	}
--}
- 
- #ifdef CONFIG_PM_SLEEP
- static int pcf50633_suspend(struct device *dev)
-@@ -251,12 +232,166 @@ static int pcf50633_resume(struct device *dev)
- 
- static SIMPLE_DEV_PM_OPS(pcf50633_pm, pcf50633_suspend, pcf50633_resume);
- 
-+#define PCF50633_CELL(_name) \
-+	{ \
-+		.name = _name, \
-+		.id = -1, \
-+	} \
-+
-+#define PCF50633_CELL_RESOURCES(_name, _resources) \
-+	{ \
-+		.name = _name, \
-+		.num_resources = ARRAY_SIZE(_resources), \
-+		.resources = _resources, \
-+		.id = -1, \
-+	} \
-+
-+#define PCF50633_CELL_ID(_name, _id) \
-+	{ \
-+		.name = _name, \
-+		.id = _id, \
-+	} \
-+
-+static struct resource pcf50633_adc_resources[] = {
-+	{
-+		.start = PCF50633_IRQ_ADCRDY,
-+		.end = PCF50633_IRQ_ADCRDY,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ADCRDY",
-+	}
-+};
-+
-+static struct resource pcf50633_input_resources[] = {
-+	{
-+		.start = PCF50633_IRQ_ONKEYR,
-+		.end = PCF50633_IRQ_ONKEYR,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ONKEYR",
-+	},
-+	{
-+		.start = PCF50633_IRQ_ONKEYF,
-+		.end = PCF50633_IRQ_ONKEYF,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ONKEYF",
-+	}
-+};
-+
-+static struct resource pcf50633_rtc_resources[] = {
-+	{
-+		.start = PCF50633_IRQ_ALARM,
-+		.end = PCF50633_IRQ_ALARM,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ALARM",
-+	},
-+	{
-+		.start = PCF50633_IRQ_SECOND,
-+		.end = PCF50633_IRQ_SECOND,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "SECOND",
-+	}
-+};
-+
-+static struct resource pcf50633_mbc_resources[] = {
-+	{
-+		.start = PCF50633_IRQ_ADPINS,
-+		.end = PCF50633_IRQ_ADPINS,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ADPINS",
-+	},
-+	{
-+		.start = PCF50633_IRQ_ADPREM,
-+		.end = PCF50633_IRQ_ADPREM,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "ADPREM",
-+	},
-+	{
-+		.start = PCF50633_IRQ_USBINS,
-+		.end = PCF50633_IRQ_USBINS,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "USBINS",
-+	},
-+	{
-+		.start = PCF50633_IRQ_USBREM,
-+		.end = PCF50633_IRQ_USBREM,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "USBREM",
-+	},
-+	{
-+		.start = PCF50633_IRQ_BATFULL,
-+		.end = PCF50633_IRQ_BATFULL,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "BATFULL",
-+	},
-+	{
-+		.start = PCF50633_IRQ_CHGHALT,
-+		.end = PCF50633_IRQ_CHGHALT,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "CHGHALT",
-+	},
-+	{
-+		.start = PCF50633_IRQ_THLIMON,
-+		.end = PCF50633_IRQ_THLIMON,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "THLIMON",
-+	},
-+	{
-+		.start = PCF50633_IRQ_THLIMOFF,
-+		.end = PCF50633_IRQ_THLIMOFF,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "THLIMOFF",
-+	},
-+	{
-+		.start = PCF50633_IRQ_USBLIMON,
-+		.end = PCF50633_IRQ_USBLIMON,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "USBLIMON",
-+	},
-+	{
-+		.start = PCF50633_IRQ_USBLIMOFF,
-+		.end = PCF50633_IRQ_USBLIMOFF,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "USBLIMOFF",
-+	},
-+	{
-+		.start = PCF50633_IRQ_LOWSYS,
-+		.end = PCF50633_IRQ_LOWSYS,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "LOWSYS",
-+	},
-+	{
-+		.start = PCF50633_IRQ_LOWBAT,
-+		.end = PCF50633_IRQ_LOWBAT,
-+		.flags = IORESOURCE_IRQ,
-+		.name = "LOWBAT",
-+	},
-+};
-+
-+static struct mfd_cell pcf50633_cells[] = {
-+	PCF50633_CELL_RESOURCES("pcf50633-input", pcf50633_input_resources),
-+	PCF50633_CELL_RESOURCES("pcf50633-rtc", pcf50633_rtc_resources),
-+	PCF50633_CELL_RESOURCES("pcf50633-mbc", pcf50633_mbc_resources),
-+	PCF50633_CELL_RESOURCES("pcf50633-adc", pcf50633_adc_resources),
-+	PCF50633_CELL("pcf50633-backlight"),
-+	PCF50633_CELL("pcf50633-gpio"),
-+	PCF50633_CELL_ID("pcf50633-regltr", 0),
-+	PCF50633_CELL_ID("pcf50633-regltr", 1),
-+	PCF50633_CELL_ID("pcf50633-regltr", 2),
-+	PCF50633_CELL_ID("pcf50633-regltr", 3),
-+	PCF50633_CELL_ID("pcf50633-regltr", 4),
-+	PCF50633_CELL_ID("pcf50633-regltr", 5),
-+	PCF50633_CELL_ID("pcf50633-regltr", 6),
-+	PCF50633_CELL_ID("pcf50633-regltr", 7),
-+	PCF50633_CELL_ID("pcf50633-regltr", 8),
-+	PCF50633_CELL_ID("pcf50633-regltr", 9),
-+	PCF50633_CELL_ID("pcf50633-regltr", 10),
-+};
-+
- static int __devinit pcf50633_probe(struct i2c_client *client,
- 				const struct i2c_device_id *ids)
- {
- 	struct pcf50633 *pcf;
- 	struct pcf50633_platform_data *pdata = client->dev.platform_data;
--	int i, ret;
-+	int ret;
- 	int version, variant;
- 
- 	if (!client->irq) {
-@@ -287,36 +422,15 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
- 	dev_info(pcf->dev, "Probed device version %d variant %d\n",
- 							version, variant);
- 
--	pcf50633_irq_init(pcf, client->irq);
--
--	/* Create sub devices */
--	pcf50633_client_dev_register(pcf, "pcf50633-input",
--						&pcf->input_pdev);
--	pcf50633_client_dev_register(pcf, "pcf50633-rtc",
--						&pcf->rtc_pdev);
--	pcf50633_client_dev_register(pcf, "pcf50633-mbc",
--						&pcf->mbc_pdev);
--	pcf50633_client_dev_register(pcf, "pcf50633-adc",
--						&pcf->adc_pdev);
--	pcf50633_client_dev_register(pcf, "pcf50633-backlight",
--						&pcf->bl_pdev);
--
--
--	for (i = 0; i < PCF50633_NUM_REGULATORS; i++) {
--		struct platform_device *pdev;
--
--		pdev = platform_device_alloc("pcf50633-regltr", i);
--		if (!pdev) {
--			dev_err(pcf->dev, "Cannot create regulator %d\n", i);
--			continue;
--		}
--
--		pdev->dev.parent = pcf->dev;
--		platform_device_add_data(pdev, &pdata->reg_init_data[i],
--					sizeof(pdata->reg_init_data[i]));
--		pcf->regulator_pdev[i] = pdev;
-+	ret = pcf50633_irq_init(pcf, client->irq);
-+	if (ret)
-+		goto err_free;
- 
--		platform_device_add(pdev);
-+	ret = mfd_add_devices(pcf->dev, 0, pcf50633_cells,
-+			ARRAY_SIZE(pcf50633_cells), NULL, pcf->irq_base);
-+	if (ret) {
-+		dev_err(pcf->dev, "Failed to add mfd cells.\n");
-+		goto err_irq_free;
- 	}
- 
- 	ret = sysfs_create_group(&client->dev.kobj, &pcf_attr_group);
-@@ -328,6 +442,8 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
- 
- 	return 0;
- 
-+err_irq_free:
-+	pcf50633_irq_free(pcf);
- err_free:
- 	kfree(pcf);
- 
-@@ -337,19 +453,12 @@ err_free:
- static int __devexit pcf50633_remove(struct i2c_client *client)
- {
- 	struct pcf50633 *pcf = i2c_get_clientdata(client);
--	int i;
- 
- 	sysfs_remove_group(&client->dev.kobj, &pcf_attr_group);
--	pcf50633_irq_free(pcf);
- 
--	platform_device_unregister(pcf->input_pdev);
--	platform_device_unregister(pcf->rtc_pdev);
--	platform_device_unregister(pcf->mbc_pdev);
--	platform_device_unregister(pcf->adc_pdev);
--	platform_device_unregister(pcf->bl_pdev);
-+	mfd_remove_devices(pcf->dev);
- 
--	for (i = 0; i < PCF50633_NUM_REGULATORS; i++)
--		platform_device_unregister(pcf->regulator_pdev[i]);
-+	pcf50633_irq_free(pcf);
- 
- 	kfree(pcf);
- 
-diff --git a/drivers/mfd/pcf50633-gpio.c b/drivers/mfd/pcf50633-gpio.c
-deleted file mode 100644
-index 9ab19a8..0000000
---- a/drivers/mfd/pcf50633-gpio.c
-+++ /dev/null
-@@ -1,121 +0,0 @@
--/* NXP PCF50633 GPIO Driver
-- *
-- * (C) 2006-2008 by Openmoko, Inc.
-- * Author: Balaji Rao <balajirrao@openmoko.org>
-- * All rights reserved.
-- *
-- * Broken down from monstrous PCF50633 driver mainly by
-- * Harald Welte, Andy Green and Werner Almesberger
-- *
-- *  This program is free software; you can redistribute  it and/or modify it
-- *  under  the terms of  the GNU General  Public License as published by the
-- *  Free Software Foundation;  either version 2 of the  License, or (at your
-- *  option) any later version.
-- *
-- */
--
--#include <linux/kernel.h>
--#include <linux/module.h>
--
--#include <linux/mfd/pcf50633/core.h>
--#include <linux/mfd/pcf50633/gpio.h>
--
--enum pcf50633_regulator_id {
--	PCF50633_REGULATOR_AUTO,
--	PCF50633_REGULATOR_DOWN1,
--	PCF50633_REGULATOR_DOWN2,
--	PCF50633_REGULATOR_LDO1,
--	PCF50633_REGULATOR_LDO2,
--	PCF50633_REGULATOR_LDO3,
--	PCF50633_REGULATOR_LDO4,
--	PCF50633_REGULATOR_LDO5,
--	PCF50633_REGULATOR_LDO6,
--	PCF50633_REGULATOR_HCLDO,
--	PCF50633_REGULATOR_MEMLDO,
--};
--
--#define PCF50633_REG_AUTOOUT	0x1a
--#define PCF50633_REG_DOWN1OUT	0x1e
--#define PCF50633_REG_DOWN2OUT	0x22
--#define PCF50633_REG_MEMLDOOUT	0x26
--#define PCF50633_REG_LDO1OUT	0x2d
--#define PCF50633_REG_LDO2OUT	0x2f
--#define PCF50633_REG_LDO3OUT	0x31
--#define PCF50633_REG_LDO4OUT	0x33
--#define PCF50633_REG_LDO5OUT	0x35
--#define PCF50633_REG_LDO6OUT	0x37
--#define PCF50633_REG_HCLDOOUT	0x39
--
--static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
--	[PCF50633_REGULATOR_AUTO]	= PCF50633_REG_AUTOOUT,
--	[PCF50633_REGULATOR_DOWN1]	= PCF50633_REG_DOWN1OUT,
--	[PCF50633_REGULATOR_DOWN2]	= PCF50633_REG_DOWN2OUT,
--	[PCF50633_REGULATOR_MEMLDO]	= PCF50633_REG_MEMLDOOUT,
--	[PCF50633_REGULATOR_LDO1]	= PCF50633_REG_LDO1OUT,
--	[PCF50633_REGULATOR_LDO2]	= PCF50633_REG_LDO2OUT,
--	[PCF50633_REGULATOR_LDO3]	= PCF50633_REG_LDO3OUT,
--	[PCF50633_REGULATOR_LDO4]	= PCF50633_REG_LDO4OUT,
--	[PCF50633_REGULATOR_LDO5]	= PCF50633_REG_LDO5OUT,
--	[PCF50633_REGULATOR_LDO6]	= PCF50633_REG_LDO6OUT,
--	[PCF50633_REGULATOR_HCLDO]	= PCF50633_REG_HCLDOOUT,
--};
--
--int pcf50633_gpio_set(struct pcf50633 *pcf, int gpio, u8 val)
--{
--	u8 reg;
--
--	reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
--
--	return pcf50633_reg_set_bit_mask(pcf, reg, 0x07, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_set);
--
--u8 pcf50633_gpio_get(struct pcf50633 *pcf, int gpio)
--{
--	u8 reg, val;
--
--	reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
--	val = pcf50633_reg_read(pcf, reg) & 0x07;
--
--	return val;
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_get);
--
--int pcf50633_gpio_invert_set(struct pcf50633 *pcf, int gpio, int invert)
--{
--	u8 val, reg;
--
--	reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
--	val = !!invert << 3;
--
--	return pcf50633_reg_set_bit_mask(pcf, reg, 1 << 3, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_set);
--
--int pcf50633_gpio_invert_get(struct pcf50633 *pcf, int gpio)
--{
--	u8 reg, val;
--
--	reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
--	val = pcf50633_reg_read(pcf, reg);
--
--	return val & (1 << 3);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_get);
--
--int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
--					int gpio, int regulator, int on)
--{
--	u8 reg, val, mask;
--
--	/* the *ENA register is always one after the *OUT register */
--	reg = pcf50633_regulator_registers[regulator] + 1;
--
--	val = !!on << (gpio - PCF50633_GPIO1);
--	mask = 1 << (gpio - PCF50633_GPIO1);
--
--	return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
--
--MODULE_LICENSE("GPL");
-diff --git a/drivers/mfd/pcf50633-irq.c b/drivers/mfd/pcf50633-irq.c
-index 1b0192f..4b8269c 100644
---- a/drivers/mfd/pcf50633-irq.c
-+++ b/drivers/mfd/pcf50633-irq.c
-@@ -2,7 +2,7 @@
-  *
-  * (C) 2006-2008 by Openmoko, Inc.
-  * Author: Harald Welte <laforge@openmoko.org>
-- * 	   Balaji Rao <balajirrao@openmoko.org>
-+ * 		Balaji Rao <balajirrao@openmoko.org>
-  * All rights reserved.
-  *
-  *  This program is free software; you can redistribute  it and/or modify it
-@@ -12,6 +12,7 @@
-  *
-  */
- 
-+#include <linux/irq.h>
- #include <linux/interrupt.h>
- #include <linux/kernel.h>
- #include <linux/mutex.h>
-@@ -25,92 +26,63 @@
- #define PCF50633_MBCS1_USBPRES 		0x01
- #define PCF50633_MBCS1_ADAPTPRES	0x01
- 
--int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
--			void (*handler) (int, void *), void *data)
-+static void pcf50633_irq_lock(struct irq_data *data)
- {
--	if (irq < 0 || irq >= PCF50633_NUM_IRQ || !handler)
--		return -EINVAL;
-+	struct pcf50633 *pcf = irq_data_get_irq_chip_data(data);
- 
--	if (WARN_ON(pcf->irq_handler[irq].handler))
--		return -EBUSY;
--
--	mutex_lock(&pcf->lock);
--	pcf->irq_handler[irq].handler = handler;
--	pcf->irq_handler[irq].data = data;
--	mutex_unlock(&pcf->lock);
--
--	return 0;
-+	mutex_lock(&pcf->irq_lock);
- }
--EXPORT_SYMBOL_GPL(pcf50633_register_irq);
- 
--int pcf50633_free_irq(struct pcf50633 *pcf, int irq)
-+static void pcf50633_irq_sync_unlock(struct irq_data *data)
- {
--	if (irq < 0 || irq >= PCF50633_NUM_IRQ)
--		return -EINVAL;
-+	struct pcf50633 *pcf = irq_data_get_irq_chip_data(data);
-+	unsigned int i;
- 
--	mutex_lock(&pcf->lock);
--	pcf->irq_handler[irq].handler = NULL;
--	mutex_unlock(&pcf->lock);
-+	for (i = 0; i < ARRAY_SIZE(pcf->mask_regs); ++i) {
-+		if (pcf->mask_regs[i] == pcf->mask_regs_cur[i])
-+			continue;
- 
--	return 0;
-+		pcf->mask_regs[i] = pcf->mask_regs_cur[i];
-+		pcf50633_reg_write(pcf, PCF50633_REG_INT1M + i,
-+				pcf->mask_regs[i]);
-+	}
-+
-+	mutex_unlock(&pcf->irq_lock);
- }
--EXPORT_SYMBOL_GPL(pcf50633_free_irq);
- 
--static int __pcf50633_irq_mask_set(struct pcf50633 *pcf, int irq, u8 mask)
-+static void pcf50633_irq_mask(struct irq_data *data)
- {
--	u8 reg, bit;
--	int ret = 0, idx;
-+	struct pcf50633 *pcf = irq_data_get_irq_chip_data(data);
-+	int irq = data->irq;
-+	u8 bit;
-+	int idx;
- 
- 	idx = irq >> 3;
--	reg = PCF50633_REG_INT1M + idx;
- 	bit = 1 << (irq & 0x07);
- 
--	pcf50633_reg_set_bit_mask(pcf, reg, bit, mask ? bit : 0);
--
--	mutex_lock(&pcf->lock);
--
--	if (mask)
--		pcf->mask_regs[idx] |= bit;
--	else
--		pcf->mask_regs[idx] &= ~bit;
--
--	mutex_unlock(&pcf->lock);
--
--	return ret;
-+	pcf->mask_regs[idx] |= bit;
- }
- 
--int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
-+static void pcf50633_irq_unmask(struct irq_data *data)
- {
--	dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
-+	struct pcf50633 *pcf = irq_data_get_irq_chip_data(data);
-+	int irq = data->irq;
-+	u8 bit;
-+	int idx;
- 
--	return __pcf50633_irq_mask_set(pcf, irq, 1);
--}
--EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
--
--int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
--{
--	dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
-+	idx = irq >> 3;
-+	bit = 1 << (irq & 0x07);
- 
--	return __pcf50633_irq_mask_set(pcf, irq, 0);
-+	pcf->mask_regs[idx] &= ~bit;
- }
--EXPORT_SYMBOL_GPL(pcf50633_irq_unmask);
- 
--int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq)
--{
--	u8 reg, bits;
--
--	reg =  irq >> 3;
--	bits = 1 << (irq & 0x07);
--
--	return pcf->mask_regs[reg] & bits;
--}
--EXPORT_SYMBOL_GPL(pcf50633_irq_mask_get);
--
--static void pcf50633_irq_call_handler(struct pcf50633 *pcf, int irq)
--{
--	if (pcf->irq_handler[irq].handler)
--		pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
--}
-+static struct irq_chip pcf50633_irq_chip = {
-+	.name = "pcf50633-irq",
-+	.irq_mask = pcf50633_irq_mask,
-+	.irq_unmask = pcf50633_irq_unmask,
-+	.irq_bus_lock = pcf50633_irq_lock,
-+	.irq_bus_sync_unlock = pcf50633_irq_sync_unlock,
-+};
- 
- /* Maximum amount of time ONKEY is held before emergency action is taken */
- #define PCF50633_ONKEY1S_TIMEOUT 8
-@@ -214,13 +186,16 @@ static irqreturn_t pcf50633_irq(int irq, void *data)
- 		pcf_int[1] &= ~(PCF50633_INT2_ONKEYR | PCF50633_INT2_ONKEYF);
- 	}
- 
-+	irq = pcf->irq_base;
- 	for (i = 0; i < ARRAY_SIZE(pcf_int); i++) {
- 		/* Unset masked interrupts */
- 		pcf_int[i] &= ~pcf->mask_regs[i];
- 
--		for (j = 0; j < 8 ; j++)
-+		for (j = 0; j < 8 ; j++) {
- 			if (pcf_int[i] & (1 << j))
--				pcf50633_irq_call_handler(pcf, (i * 8) + j);
-+				handle_nested_irq(irq);
-+			++irq;
-+		}
- 	}
- 
- out:
-@@ -240,15 +215,6 @@ int pcf50633_irq_suspend(struct pcf50633 *pcf)
- 	 * henceforth */
- 	disable_irq(pcf->irq);
- 
--	/* Save the masks */
--	ret = pcf50633_read_block(pcf, PCF50633_REG_INT1M,
--				ARRAY_SIZE(pcf->suspend_irq_masks),
--					pcf->suspend_irq_masks);
--	if (ret < 0) {
--		dev_err(pcf->dev, "error saving irq masks\n");
--		goto out;
--	}
--
- 	/* Write wakeup irq masks */
- 	for (i = 0; i < ARRAY_SIZE(res); i++)
- 		res[i] = ~pcf->pdata->resumers[i];
-@@ -272,8 +238,8 @@ int pcf50633_irq_resume(struct pcf50633 *pcf)
- 
- 	/* Write the saved mask registers */
- 	ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
--				ARRAY_SIZE(pcf->suspend_irq_masks),
--					pcf->suspend_irq_masks);
-+				ARRAY_SIZE(pcf->mask_regs),
-+					pcf->mask_regs);
- 	if (ret < 0)
- 		dev_err(pcf->dev, "Error restoring saved suspend masks\n");
- 
-@@ -286,33 +252,61 @@ int pcf50633_irq_resume(struct pcf50633 *pcf)
- 
- int pcf50633_irq_init(struct pcf50633 *pcf, int irq)
- {
-+	int irq_base;
- 	int ret;
-+	int i;
- 
-+	irq_base = irq_alloc_descs(-1, 0, PCF50633_NUM_IRQ, 0);
-+	if (irq_base < 0) {
-+		dev_err(pcf->dev, "Failed to allocate irq descs: %d\n", irq_base);
-+		return irq_base;
-+	}
-+
-+	mutex_init(&pcf->irq_lock);
- 	pcf->irq = irq;
-+	pcf->irq_base = irq_base;
-+
-+	/* Mask all irqs */
-+	for (i = 0; i < 5; ++i)
-+		pcf->mask_regs[i] = 0xff;
- 
--	/* Enable all interrupts except RTC SECOND */
--	pcf->mask_regs[0] = 0x80;
--	pcf50633_reg_write(pcf, PCF50633_REG_INT1M, pcf->mask_regs[0]);
--	pcf50633_reg_write(pcf, PCF50633_REG_INT2M, 0x00);
--	pcf50633_reg_write(pcf, PCF50633_REG_INT3M, 0x00);
--	pcf50633_reg_write(pcf, PCF50633_REG_INT4M, 0x00);
--	pcf50633_reg_write(pcf, PCF50633_REG_INT5M, 0x00);
-+	ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
-+					ARRAY_SIZE(pcf->mask_regs), pcf->mask_regs);
-+	if (ret < 0)
-+		goto err_irq_free_descs;
-+
-+
-+	for (i = irq_base; i < irq_base + PCF50633_NUM_IRQ; ++i) {
-+		irq_set_chip_data(i, pcf);
-+		irq_set_nested_thread(i, 1);
-+		irq_set_chip_and_handler(i, &pcf50633_irq_chip, handle_simple_irq);
-+		irq_modify_status(i, IRQ_NOREQUEST, IRQ_NOPROBE);
-+	}
- 
- 	ret = request_threaded_irq(irq, NULL, pcf50633_irq,
- 					IRQF_TRIGGER_LOW | IRQF_ONESHOT,
- 					"pcf50633", pcf);
- 
--	if (ret)
-+	if (ret) {
- 		dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
-+		goto err_irq_free_descs;
-+	}
- 
- 	if (enable_irq_wake(irq) < 0)
- 		dev_err(pcf->dev, "IRQ %u cannot be enabled as wake-up source"
- 			"in this hardware revision", irq);
- 
-+
-+	return 0;
-+
-+err_irq_free_descs:
-+	irq_free_descs(pcf->irq_base, PCF50633_NUM_IRQ);
-+
- 	return ret;
- }
- 
- void pcf50633_irq_free(struct pcf50633 *pcf)
- {
- 	free_irq(pcf->irq, pcf);
-+	irq_free_descs(pcf->irq_base, PCF50633_NUM_IRQ);
- }
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 61d233a..4b530ae 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -79,6 +79,13 @@ struct mmc_blk_data {
- 
- static DEFINE_MUTEX(open_lock);
- 
-+enum mmc_blk_status {
-+	MMC_BLK_SUCCESS = 0,
-+	MMC_BLK_RETRY,
-+	MMC_BLK_DATA_ERR,
-+	MMC_BLK_CMD_ERR,
-+};
-+
- module_param(perdev_minors, int, 0444);
- MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
- 
-@@ -165,13 +172,6 @@ static const struct block_device_operations mmc_bdops = {
- 	.owner			= THIS_MODULE,
- };
- 
--struct mmc_blk_request {
--	struct mmc_request	mrq;
--	struct mmc_command	cmd;
--	struct mmc_command	stop;
--	struct mmc_data		data;
--};
--
- static u32 mmc_sd_num_wr_blocks(struct mmc_card *card)
- {
- 	int err;
-@@ -331,200 +331,341 @@ out:
- 	return err ? 0 : 1;
- }
- 
--static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *req)
-+static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
-+			       struct mmc_card *card,
-+			       int disable_multi,
-+			       struct mmc_queue *mq)
- {
--	struct mmc_blk_data *md = mq->data;
--	struct mmc_card *card = md->queue.card;
--	struct mmc_blk_request brq;
--	int ret = 1, disable_multi = 0;
-+	u32 readcmd, writecmd;
-+	struct mmc_blk_request *brq = &mqrq->brq;
-+	struct request *req = mqrq->req;
- 
--	mmc_claim_host(card->host);
-+	memset(brq, 0, sizeof(struct mmc_blk_request));
- 
--	do {
--		struct mmc_command cmd;
--		u32 readcmd, writecmd, status = 0;
--
--		memset(&brq, 0, sizeof(struct mmc_blk_request));
--		brq.mrq.cmd = &brq.cmd;
--		brq.mrq.data = &brq.data;
--
--		brq.cmd.arg = blk_rq_pos(req);
--		if (!mmc_card_blockaddr(card))
--			brq.cmd.arg <<= 9;
--		brq.cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
--		brq.data.blksz = 512;
--		brq.stop.opcode = MMC_STOP_TRANSMISSION;
--		brq.stop.arg = 0;
--		brq.stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
--		brq.data.blocks = blk_rq_sectors(req);
-+	brq->mrq.cmd = &brq->cmd;
-+	brq->mrq.data = &brq->data;
- 
--		/*
--		 * The block layer doesn't support all sector count
--		 * restrictions, so we need to be prepared for too big
--		 * requests.
--		 */
--		if (brq.data.blocks > card->host->max_blk_count)
--			brq.data.blocks = card->host->max_blk_count;
-+	brq->cmd.arg = blk_rq_pos(req);
-+	if (!mmc_card_blockaddr(card))
-+		brq->cmd.arg <<= 9;
-+	brq->cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
-+	brq->data.blksz = 512;
-+	brq->stop.opcode = MMC_STOP_TRANSMISSION;
-+	brq->stop.arg = 0;
-+	brq->stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
-+	brq->data.blocks = blk_rq_sectors(req);
- 
--		/*
--		 * After a read error, we redo the request one sector at a time
--		 * in order to accurately determine which sectors can be read
--		 * successfully.
-+	/*
-+	 * The block layer doesn't support all sector count
-+	 * restrictions, so we need to be prepared for too big
-+	 * requests.
-+	 */
-+	if (brq->data.blocks > card->host->max_blk_count)
-+		brq->data.blocks = card->host->max_blk_count;
-+
-+	/*
-+	 * After a read error, we redo the request one sector at a time
-+	 * in order to accurately determine which sectors can be read
-+	 * successfully.
-+	 */
-+	if (disable_multi && brq->data.blocks > 1)
-+		brq->data.blocks = 1;
-+
-+	if (brq->data.blocks > 1) {
-+		/* SPI multiblock writes terminate using a special
-+		 * token, not a STOP_TRANSMISSION request.
- 		 */
--		if (disable_multi && brq.data.blocks > 1)
--			brq.data.blocks = 1;
-+		if (!mmc_host_is_spi(card->host)
-+		    || rq_data_dir(req) == READ)
-+			brq->mrq.stop = &brq->stop;
-+		readcmd = MMC_READ_MULTIPLE_BLOCK;
-+		writecmd = MMC_WRITE_MULTIPLE_BLOCK;
-+	} else {
-+		brq->mrq.stop = NULL;
-+		readcmd = MMC_READ_SINGLE_BLOCK;
-+		writecmd = MMC_WRITE_BLOCK;
-+	}
-+	if (rq_data_dir(req) == READ) {
-+		brq->cmd.opcode = readcmd;
-+		brq->data.flags |= MMC_DATA_READ;
-+	} else {
-+		brq->cmd.opcode = writecmd;
-+		brq->data.flags |= MMC_DATA_WRITE;
-+	}
- 
--		if (brq.data.blocks > 1) {
--			/* SPI multiblock writes terminate using a special
--			 * token, not a STOP_TRANSMISSION request.
--			 */
--			if (!mmc_host_is_spi(card->host)
--					|| rq_data_dir(req) == READ)
--				brq.mrq.stop = &brq.stop;
--			readcmd = MMC_READ_MULTIPLE_BLOCK;
--			writecmd = MMC_WRITE_MULTIPLE_BLOCK;
--		} else {
--			brq.mrq.stop = NULL;
--			readcmd = MMC_READ_SINGLE_BLOCK;
--			writecmd = MMC_WRITE_BLOCK;
-+	mmc_set_data_timeout(&brq->data, card);
-+
-+	brq->data.sg = mqrq->sg;
-+	brq->data.sg_len = mmc_queue_map_sg(mq, mqrq);
-+
-+	/*
-+	 * Adjust the sg list so it is the same size as the
-+	 * request.
-+	 */
-+	if (brq->data.blocks != blk_rq_sectors(req)) {
-+		int i, data_size = brq->data.blocks << 9;
-+		struct scatterlist *sg;
-+
-+		for_each_sg(brq->data.sg, sg, brq->data.sg_len, i) {
-+			data_size -= sg->length;
-+			if (data_size <= 0) {
-+				sg->length += data_size;
-+				i++;
-+				break;
-+			}
- 		}
--		if (rq_data_dir(req) == READ) {
--			brq.cmd.opcode = readcmd;
--			brq.data.flags |= MMC_DATA_READ;
--		} else {
--			brq.cmd.opcode = writecmd;
--			brq.data.flags |= MMC_DATA_WRITE;
-+		brq->data.sg_len = i;
-+	}
-+
-+	mmc_queue_bounce_pre(mqrq);
-+}
-+
-+static enum mmc_blk_status mmc_blk_get_status(struct mmc_blk_request *brq,
-+					      struct request *req,
-+					      struct mmc_card *card,
-+					      struct mmc_blk_data *md)
-+{
-+	struct mmc_command cmd;
-+	u32 status;
-+	enum mmc_blk_status ret = MMC_BLK_SUCCESS;
-+
-+	/*
-+	 * Check for errors here, but don't jump to cmd_err
-+	 * until later as we need to wait for the card to leave
-+	 * programming mode even when things go wrong.
-+	 */
-+	if (brq->cmd.error || brq->data.error || brq->stop.error) {
-+		if (brq->data.blocks > 1 && rq_data_dir(req) == READ) {
-+			/* Redo read one sector at a time */
-+			printk(KERN_WARNING "%s: retrying using single "
-+			       "block read, brq %p\n",
-+			       req->rq_disk->disk_name, brq);
-+			ret = MMC_BLK_RETRY;
-+			goto out;
- 		}
-+		status = get_card_status(card, req);
-+	}
- 
--		mmc_set_data_timeout(&brq.data, card);
-+	if (brq->cmd.error) {
-+		printk(KERN_ERR "%s: error %d sending read/write "
-+		       "command, response %#x, card status %#x\n",
-+		       req->rq_disk->disk_name, brq->cmd.error,
-+		       brq->cmd.resp[0], status);
-+	}
- 
--		brq.data.sg = mq->sg;
--		brq.data.sg_len = mmc_queue_map_sg(mq);
-+	if (brq->data.error) {
-+		if (brq->data.error == -ETIMEDOUT && brq->mrq.stop)
-+			/* 'Stop' response contains card status */
-+			status = brq->mrq.stop->resp[0];
-+		printk(KERN_ERR "%s: error %d transferring data,"
-+		       " sector %u, nr %u, card status %#x\n",
-+		       req->rq_disk->disk_name, brq->data.error,
-+		       (unsigned)blk_rq_pos(req),
-+		       (unsigned)blk_rq_sectors(req), status);
-+	}
- 
--		/*
--		 * Adjust the sg list so it is the same size as the
--		 * request.
--		 */
--		if (brq.data.blocks != blk_rq_sectors(req)) {
--			int i, data_size = brq.data.blocks << 9;
--			struct scatterlist *sg;
--
--			for_each_sg(brq.data.sg, sg, brq.data.sg_len, i) {
--				data_size -= sg->length;
--				if (data_size <= 0) {
--					sg->length += data_size;
--					i++;
--					break;
--				}
-+	if (brq->stop.error) {
-+		printk(KERN_ERR "%s: error %d sending stop command, "
-+		       "response %#x, card status %#x\n",
-+		       req->rq_disk->disk_name, brq->stop.error,
-+		       brq->stop.resp[0], status);
-+	}
-+
-+	if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
-+		do {
-+			int err;
-+
-+			cmd.opcode = MMC_SEND_STATUS;
-+			cmd.arg = card->rca << 16;
-+			cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
-+			err = mmc_wait_for_cmd(card->host, &cmd, 5);
-+			if (err) {
-+				printk(KERN_ERR "%s: error %d requesting status\n",
-+				       req->rq_disk->disk_name, err);
-+				ret = MMC_BLK_CMD_ERR;
-+				goto out;
- 			}
--			brq.data.sg_len = i;
-+			/*
-+			 * Some cards mishandle the status bits,
-+			 * so make sure to check both the busy
-+			 * indication and the card state.
-+			 */
-+		} while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
-+			 (R1_CURRENT_STATE(cmd.resp[0]) == 7));
-+
-+#if 0
-+		if (cmd.resp[0] & ~0x00000900)
-+			printk(KERN_ERR "%s: status = %08x\n",
-+			       req->rq_disk->disk_name, cmd.resp[0]);
-+		if (mmc_decode_status(cmd.resp)) {
-+			ret = MMC_BLK_CMD_ERR;
-+			goto out;
- 		}
- 
--		mmc_queue_bounce_pre(mq);
-+#endif
-+	}
- 
--		mmc_wait_for_req(card->host, &brq.mrq);
-+	if (brq->cmd.error || brq->stop.error || brq->data.error) {
-+		if (rq_data_dir(req) == READ)
-+			ret = MMC_BLK_DATA_ERR;
-+		else
-+			ret = MMC_BLK_CMD_ERR;
-+	}
-+ out:
-+	return ret;
- 
--		mmc_queue_bounce_post(mq);
-+}
- 
-+static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
-+{
-+	struct mmc_blk_data *md = mq->data;
-+	struct mmc_card *card = md->queue.card;
-+	struct mmc_blk_request *brqc = &mq->mqrq_cur->brq;
-+	struct mmc_blk_request *brqp = &mq->mqrq_prev->brq;
-+	struct mmc_queue_req  *mqrqp = mq->mqrq_prev;
-+	struct request *rqp = mqrqp->req;
-+	int ret = 0;
-+	int disable_multi = 0;
-+	enum mmc_blk_status status;
-+
-+	if (!rqc && !rqp)
-+		return 0;
-+
-+	if (rqc) {
-+		/* Claim host for the first request in a serie of requests */
-+		if (!rqp)
-+			mmc_claim_host(card->host);
-+
-+		/* Prepare a new request */
-+		mmc_blk_rw_rq_prep(mq->mqrq_cur, card, 0, mq);
-+		mmc_pre_req(card->host, &brqc->mrq, !rqp);
-+	}
-+	do {
- 		/*
--		 * Check for errors here, but don't jump to cmd_err
--		 * until later as we need to wait for the card to leave
--		 * programming mode even when things go wrong.
-+		 * If there is an ongoing request, indicated by rqp, wait for
-+		 * it to finish before starting a new one.
- 		 */
--		if (brq.cmd.error || brq.data.error || brq.stop.error) {
--			if (brq.data.blocks > 1 && rq_data_dir(req) == READ) {
--				/* Redo read one sector at a time */
--				printk(KERN_WARNING "%s: retrying using single "
--				       "block read\n", req->rq_disk->disk_name);
--				disable_multi = 1;
--				continue;
--			}
--			status = get_card_status(card, req);
-+		if (rqp)
-+			mmc_wait_for_req_done(&brqp->mrq);
-+		else {
-+			/* start a new asynchronous request */
-+			mmc_start_req(card->host, &brqc->mrq);
-+			goto out;
- 		}
--
--		if (brq.cmd.error) {
--			printk(KERN_ERR "%s: error %d sending read/write "
--			       "command, response %#x, card status %#x\n",
--			       req->rq_disk->disk_name, brq.cmd.error,
--			       brq.cmd.resp[0], status);
-+		status = mmc_blk_get_status(brqp, rqp, card, md);
-+		if (status != MMC_BLK_SUCCESS) {
-+			mmc_post_req(card->host, &brqp->mrq, -EINVAL);
-+			mmc_queue_bounce_post(mqrqp);
-+			if (rqc)
-+				mmc_post_req(card->host, &brqc->mrq, -EINVAL);
- 		}
- 
--		if (brq.data.error) {
--			if (brq.data.error == -ETIMEDOUT && brq.mrq.stop)
--				/* 'Stop' response contains card status */
--				status = brq.mrq.stop->resp[0];
--			printk(KERN_ERR "%s: error %d transferring data,"
--			       " sector %u, nr %u, card status %#x\n",
--			       req->rq_disk->disk_name, brq.data.error,
--			       (unsigned)blk_rq_pos(req),
--			       (unsigned)blk_rq_sectors(req), status);
--		}
-+		switch (status) {
-+		case MMC_BLK_SUCCESS:
-+			/*
-+			 * A block was successfully transferred.
-+			 */
- 
--		if (brq.stop.error) {
--			printk(KERN_ERR "%s: error %d sending stop command, "
--			       "response %#x, card status %#x\n",
--			       req->rq_disk->disk_name, brq.stop.error,
--			       brq.stop.resp[0], status);
--		}
-+			/*
-+			 * All data is transferred without errors.
-+			 * Defer mmc post processing and _blk_end_request
-+			 * until after the new request is started.
-+			 */
-+			if (blk_rq_bytes(rqp) == brqp->data.bytes_xfered)
-+				break;
- 
--		if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
--			do {
--				int err;
--
--				cmd.opcode = MMC_SEND_STATUS;
--				cmd.arg = card->rca << 16;
--				cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
--				err = mmc_wait_for_cmd(card->host, &cmd, 5);
--				if (err) {
--					printk(KERN_ERR "%s: error %d requesting status\n",
--					       req->rq_disk->disk_name, err);
--					goto cmd_err;
--				}
--				/*
--				 * Some cards mishandle the status bits,
--				 * so make sure to check both the busy
--				 * indication and the card state.
--				 */
--			} while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
--				(R1_CURRENT_STATE(cmd.resp[0]) == 7));
-+			mmc_post_req(card->host, &brqp->mrq, 0);
-+			mmc_queue_bounce_post(mqrqp);
- 
--#if 0
--			if (cmd.resp[0] & ~0x00000900)
--				printk(KERN_ERR "%s: status = %08x\n",
--				       req->rq_disk->disk_name, cmd.resp[0]);
--			if (mmc_decode_status(cmd.resp))
--				goto cmd_err;
--#endif
--		}
-+			spin_lock_irq(&md->lock);
-+			ret = __blk_end_request(rqp, 0,
-+						brqp->data.bytes_xfered);
-+			spin_unlock_irq(&md->lock);
- 
--		if (brq.cmd.error || brq.stop.error || brq.data.error) {
--			if (rq_data_dir(req) == READ) {
--				/*
--				 * After an error, we redo I/O one sector at a
--				 * time, so we only reach here after trying to
--				 * read a single sector.
--				 */
--				spin_lock_irq(&md->lock);
--				ret = __blk_end_request(req, -EIO, brq.data.blksz);
--				spin_unlock_irq(&md->lock);
--				continue;
--			}
-+			if (rqc)
-+				mmc_post_req(card->host, &brqc->mrq, -EINVAL);
-+			break;
-+		case MMC_BLK_CMD_ERR:
- 			goto cmd_err;
-+			break;
-+		case MMC_BLK_RETRY:
-+			disable_multi = 1;
-+			ret = 1;
-+			break;
-+		case MMC_BLK_DATA_ERR:
-+			/*
-+			 * After an error, we redo I/O one sector at a
-+			 * time, so we only reach here after trying to
-+			 * read a single sector.
-+			 */
-+			spin_lock_irq(&md->lock);
-+			ret = __blk_end_request(rqp, -EIO, brqp->data.blksz);
-+			spin_unlock_irq(&md->lock);
-+			if (rqc && !ret)
-+				mmc_pre_req(card->host, &brqc->mrq, false);
-+			break;
- 		}
- 
--		/*
--		 * A block was successfully transferred.
--		 */
-+		if (ret) {
-+			/*
-+			 * In case of a none complete request
-+			 * prepare it again and resend.
-+			 */
-+			mmc_blk_rw_rq_prep(mqrqp, card, disable_multi, mq);
-+			mmc_pre_req(card->host, &brqp->mrq, true);
-+			mmc_start_req(card->host, &brqp->mrq);
-+			if (rqc)
-+				mmc_pre_req(card->host, &brqc->mrq, false);
-+		}
-+	} while (ret);
-+
-+	/* Previous request is completed, start the new request if any */
-+	if (rqc)
-+		mmc_start_req(card->host, &brqc->mrq);
-+
-+	/*
-+	 * Post process the previous request while the new request is active.
-+	 * In case of error the reuqest is already ended.
-+	 */
-+	if (status == MMC_BLK_SUCCESS) {
-+		mmc_post_req(card->host, &brqp->mrq, 0);
-+		mmc_queue_bounce_post(mqrqp);
-+
- 		spin_lock_irq(&md->lock);
--		ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
-+		ret = __blk_end_request(rqp, 0, brqp->data.bytes_xfered);
- 		spin_unlock_irq(&md->lock);
--	} while (ret);
- 
--	mmc_release_host(card->host);
-+		if (ret) {
-+			/* If this happen it is a bug */
-+			printk(KERN_ERR "[%s] BUG: rq_bytes %d xfered %d\n",
-+			       __func__, blk_rq_bytes(rqp),
-+			       brqp->data.bytes_xfered);
-+			goto cmd_err;
-+		}
-+	}
-+
-+	/* 1 indicates one request has been completed */
-+	ret = 1;
-+ out:
-+	/*
-+	 * TODO: Find out if it is OK to only release host after the
-+	 *       last request. For the last request the current request
-+	 *        is NULL, which means no requests are pending.
-+	 */
-+	/* Release host for the last request in a serie of requests */
-+	if (!rqc)
-+		mmc_release_host(card->host);
- 
--	return 1;
-+	/* Current request becomes previous request and vice versa. */
-+	mqrqp->brq.mrq.data = NULL;
-+	mqrqp->req = NULL;
-+	mq->mqrq_prev = mq->mqrq_cur;
-+	mq->mqrq_cur = mqrqp;
-+
-+	return ret;
- 
-  cmd_err:
-+
-  	/*
-  	 * If this is an SD card and we're writing, we can first
-  	 * mark the known good sectors as ok.
-@@ -539,12 +680,12 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *req)
- 		blocks = mmc_sd_num_wr_blocks(card);
- 		if (blocks != (u32)-1) {
- 			spin_lock_irq(&md->lock);
--			ret = __blk_end_request(req, 0, blocks << 9);
-+			ret = __blk_end_request(rqp, 0, blocks << 9);
- 			spin_unlock_irq(&md->lock);
- 		}
- 	} else {
- 		spin_lock_irq(&md->lock);
--		ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
-+		ret = __blk_end_request(rqp, 0, brqp->data.bytes_xfered);
- 		spin_unlock_irq(&md->lock);
- 	}
- 
-@@ -552,15 +693,27 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *req)
- 
- 	spin_lock_irq(&md->lock);
- 	while (ret)
--		ret = __blk_end_request(req, -EIO, blk_rq_cur_bytes(req));
-+		ret = __blk_end_request(rqp, -EIO, blk_rq_cur_bytes(rqp));
- 	spin_unlock_irq(&md->lock);
- 
-+	if (rqc) {
-+		mmc_claim_host(card->host);
-+		mmc_pre_req(card->host, &brqc->mrq, false);
-+		mmc_start_req(card->host, &brqc->mrq);
-+	}
-+
-+	/* Current request becomes previous request and vice versa. */
-+	mqrqp->brq.mrq.data = NULL;
-+	mqrqp->req = NULL;
-+	mq->mqrq_prev = mq->mqrq_cur;
-+	mq->mqrq_cur = mqrqp;
-+
- 	return 0;
- }
- 
- static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
- {
--	if (req->cmd_flags & REQ_DISCARD) {
-+	if (req && req->cmd_flags & REQ_DISCARD) {
- 		if (req->cmd_flags & REQ_SECURE)
- 			return mmc_blk_issue_secdiscard_rq(mq, req);
- 		else
-diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
-index abc1a63..8f7ffad 100644
---- a/drivers/mmc/card/mmc_test.c
-+++ b/drivers/mmc/card/mmc_test.c
-@@ -22,6 +22,7 @@
- #include <linux/debugfs.h>
- #include <linux/uaccess.h>
- #include <linux/seq_file.h>
-+#include <linux/random.h>
- 
- #define RESULT_OK		0
- #define RESULT_FAIL		1
-@@ -51,10 +52,12 @@ struct mmc_test_pages {
-  * struct mmc_test_mem - allocated memory.
-  * @arr: array of allocations
-  * @cnt: number of allocations
-+ * @size_min_cmn: lowest common size in array of allocations
-  */
- struct mmc_test_mem {
- 	struct mmc_test_pages *arr;
- 	unsigned int cnt;
-+	unsigned int size_min_cmn;
- };
- 
- /**
-@@ -148,6 +151,21 @@ struct mmc_test_card {
- 	struct mmc_test_general_result	*gr;
- };
- 
-+enum mmc_test_prep_media {
-+	MMC_TEST_PREP_NONE = 0,
-+	MMC_TEST_PREP_WRITE_FULL = 1 << 0,
-+	MMC_TEST_PREP_ERASE = 1 << 1,
-+};
-+
-+struct mmc_test_multiple_rw {
-+	unsigned int *bs;
-+	unsigned int len;
-+	unsigned int size;
-+	bool do_write;
-+	bool do_nonblock_req;
-+	enum mmc_test_prep_media prepare;
-+};
-+
- /*******************************************************************/
- /*  General helper functions                                       */
- /*******************************************************************/
-@@ -307,6 +325,7 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 	unsigned long max_seg_page_cnt = DIV_ROUND_UP(max_seg_sz, PAGE_SIZE);
- 	unsigned long page_cnt = 0;
- 	unsigned long limit = nr_free_buffer_pages() >> 4;
-+	unsigned int min_cmn = 0;
- 	struct mmc_test_mem *mem;
- 
- 	if (max_page_cnt > limit)
-@@ -350,6 +369,12 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 		mem->arr[mem->cnt].page = page;
- 		mem->arr[mem->cnt].order = order;
- 		mem->cnt += 1;
-+		if (!min_cmn)
-+			min_cmn = PAGE_SIZE << order;
-+		else
-+			min_cmn = min(min_cmn,
-+				      (unsigned int) (PAGE_SIZE << order));
-+
- 		if (max_page_cnt <= (1UL << order))
- 			break;
- 		max_page_cnt -= 1UL << order;
-@@ -360,6 +385,7 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 			break;
- 		}
- 	}
-+	mem->size_min_cmn = min_cmn;
- 
- 	return mem;
- 
-@@ -386,7 +412,6 @@ static int mmc_test_map_sg(struct mmc_test_mem *mem, unsigned long sz,
- 	do {
- 		for (i = 0; i < mem->cnt; i++) {
- 			unsigned long len = PAGE_SIZE << mem->arr[i].order;
--
- 			if (len > sz)
- 				len = sz;
- 			if (len > max_seg_sz)
-@@ -725,6 +750,94 @@ static int mmc_test_check_broken_result(struct mmc_test_card *test,
- }
- 
- /*
-+ * Tests nonblock transfer with certain parameters
-+ */
-+static void mmc_test_nonblock_reset(struct mmc_request *mrq,
-+				    struct mmc_command *cmd,
-+				    struct mmc_command *stop,
-+				    struct mmc_data *data)
-+{
-+	memset(mrq, 0, sizeof(struct mmc_request));
-+	memset(cmd, 0, sizeof(struct mmc_command));
-+	memset(data, 0, sizeof(struct mmc_data));
-+	memset(stop, 0, sizeof(struct mmc_command));
-+
-+	mrq->cmd = cmd;
-+	mrq->data = data;
-+	mrq->stop = stop;
-+}
-+static int mmc_test_nonblock_transfer(struct mmc_test_card *test,
-+				      struct scatterlist *sg, unsigned sg_len,
-+				      unsigned dev_addr, unsigned blocks,
-+				      unsigned blksz, int write, int count)
-+{
-+	struct mmc_request mrq1;
-+	struct mmc_command cmd1;
-+	struct mmc_command stop1;
-+	struct mmc_data data1;
-+
-+	struct mmc_request mrq2;
-+	struct mmc_command cmd2;
-+	struct mmc_command stop2;
-+	struct mmc_data data2;
-+
-+	struct mmc_request *cur_mrq;
-+	struct mmc_request *prev_mrq;
-+	int i;
-+	int ret = 0;
-+
-+	if (!test->card->host->ops->pre_req ||
-+		!test->card->host->ops->post_req)
-+		return -RESULT_UNSUP_HOST;
-+
-+	mmc_test_nonblock_reset(&mrq1, &cmd1, &stop1, &data1);
-+	mmc_test_nonblock_reset(&mrq2, &cmd2, &stop2, &data2);
-+
-+	cur_mrq = &mrq1;
-+	prev_mrq = NULL;
-+
-+	for (i = 0; i < count; i++) {
-+		mmc_test_prepare_mrq(test, cur_mrq, sg, sg_len, dev_addr,
-+				blocks, blksz, write);
-+		mmc_pre_req(test->card->host, cur_mrq, !prev_mrq);
-+
-+		if (prev_mrq) {
-+			mmc_wait_for_req_done(prev_mrq);
-+			mmc_test_wait_busy(test);
-+			ret = mmc_test_check_result(test, prev_mrq);
-+			if (ret)
-+				goto err;
-+		}
-+
-+		mmc_start_req(test->card->host, cur_mrq);
-+
-+		if (prev_mrq)
-+			mmc_post_req(test->card->host, prev_mrq, 0);
-+
-+		prev_mrq = cur_mrq;
-+		if (cur_mrq == &mrq1) {
-+			mmc_test_nonblock_reset(&mrq2, &cmd2, &stop2, &data2);
-+			cur_mrq = &mrq2;
-+		} else {
-+			mmc_test_nonblock_reset(&mrq1, &cmd1, &stop1, &data1);
-+			cur_mrq = &mrq1;
-+		}
-+		dev_addr += blocks;
-+	}
-+
-+	mmc_wait_for_req_done(prev_mrq);
-+	mmc_test_wait_busy(test);
-+	ret = mmc_test_check_result(test, prev_mrq);
-+	if (ret)
-+		goto err;
-+	mmc_post_req(test->card->host, prev_mrq, 0);
-+
-+	return ret;
-+err:
-+	return ret;
-+}
-+
-+/*
-  * Tests a basic transfer with certain parameters
-  */
- static int mmc_test_simple_transfer(struct mmc_test_card *test,
-@@ -1351,14 +1464,17 @@ static int mmc_test_area_transfer(struct mmc_test_card *test,
- }
- 
- /*
-- * Map and transfer bytes.
-+ * Map and transfer bytes for multiple transfers.
-  */
--static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
--			    unsigned int dev_addr, int write, int max_scatter,
--			    int timed)
-+static int mmc_test_area_io_seq(struct mmc_test_card *test, unsigned long sz,
-+				unsigned int dev_addr, int write,
-+				int max_scatter, int timed, int count,
-+				bool nonblock)
- {
- 	struct timespec ts1, ts2;
--	int ret;
-+	int ret = 0;
-+	int i;
-+	struct mmc_test_area *t = &test->area;
- 
- 	/*
- 	 * In the case of a maximally scattered transfer, the maximum transfer
-@@ -1382,8 +1498,15 @@ static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
- 
- 	if (timed)
- 		getnstimeofday(&ts1);
-+	if (nonblock)
-+		ret = mmc_test_nonblock_transfer(test, t->sg, t->sg_len,
-+				 dev_addr, t->blocks, 512, write, count);
-+	else
-+		for (i = 0; i < count && ret == 0; i++) {
-+			ret = mmc_test_area_transfer(test, dev_addr, write);
-+			dev_addr += sz >> 9;
-+		}
- 
--	ret = mmc_test_area_transfer(test, dev_addr, write);
- 	if (ret)
- 		return ret;
- 
-@@ -1391,11 +1514,19 @@ static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
- 		getnstimeofday(&ts2);
- 
- 	if (timed)
--		mmc_test_print_rate(test, sz, &ts1, &ts2);
-+		mmc_test_print_avg_rate(test, sz, count, &ts1, &ts2);
- 
- 	return 0;
- }
- 
-+static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
-+			    unsigned int dev_addr, int write, int max_scatter,
-+			    int timed)
-+{
-+	return mmc_test_area_io_seq(test, sz, dev_addr, write, max_scatter,
-+				    timed, 1, false);
-+}
-+
- /*
-  * Write the test area entirely.
-  */
-@@ -1956,6 +2087,144 @@ static int mmc_test_large_seq_write_perf(struct mmc_test_card *test)
- 	return mmc_test_large_seq_perf(test, 1);
- }
- 
-+static int mmc_test_rw_multiple(struct mmc_test_card *test,
-+				struct mmc_test_multiple_rw *tdata,
-+				unsigned int reqsize, unsigned int size)
-+{
-+	unsigned int dev_addr;
-+	struct mmc_test_area *t = &test->area;
-+	int ret = 0;
-+	int max_reqsize = max(t->mem->size_min_cmn *
-+			      min(t->max_segs, t->mem->cnt), t->max_tfr);
-+
-+	/* Set up test area */
-+	if (size > mmc_test_capacity(test->card) / 2 * 512)
-+		size = mmc_test_capacity(test->card) / 2 * 512;
-+	if (reqsize > max_reqsize)
-+		reqsize = max_reqsize;
-+	dev_addr = mmc_test_capacity(test->card) / 4;
-+	if ((dev_addr & 0xffff0000))
-+		dev_addr &= 0xffff0000; /* Round to 64MiB boundary */
-+	else
-+		dev_addr &= 0xfffff800; /* Round to 1MiB boundary */
-+	if (!dev_addr)
-+		goto err;
-+
-+	/* prepare test area */
-+	if (mmc_can_erase(test->card) &&
-+	    tdata->prepare & MMC_TEST_PREP_ERASE) {
-+		ret = mmc_erase(test->card, dev_addr,
-+				size / 512, MMC_SECURE_ERASE_ARG);
-+		if (ret)
-+			ret = mmc_erase(test->card, dev_addr,
-+					size / 512, MMC_ERASE_ARG);
-+		if (ret)
-+			goto err;
-+	}
-+
-+	/* Run test */
-+	ret = mmc_test_area_io_seq(test, reqsize, dev_addr,
-+				   tdata->do_write, 0, 1, size / reqsize,
-+				   tdata->do_nonblock_req);
-+	if (ret)
-+		goto err;
-+
-+	return ret;
-+ err:
-+	printk(KERN_INFO "[%s] error\n", __func__);
-+	return ret;
-+}
-+
-+static int mmc_test_rw_multiple_size(struct mmc_test_card *test,
-+				     struct mmc_test_multiple_rw *rw)
-+{
-+	int ret = 0;
-+	int i;
-+
-+	for (i = 0 ; i < rw->len && ret == 0; i++) {
-+		ret = mmc_test_rw_multiple(test, rw, rw->bs[i], rw->size);
-+		if (ret)
-+			break;
-+	}
-+	return ret;
-+}
-+
-+/*
-+ * Multiple blocking write 4k to 4 MB chunks
-+ */
-+static int mmc_test_profile_mult_write_blocking_perf(struct mmc_test_card *test)
-+{
-+	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
-+			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
-+	struct mmc_test_multiple_rw test_data = {
-+		.bs = bs,
-+		.size = 128*1024*1024,
-+		.len = ARRAY_SIZE(bs),
-+		.do_write = true,
-+		.do_nonblock_req = false,
-+		.prepare = MMC_TEST_PREP_ERASE,
-+	};
-+
-+	return mmc_test_rw_multiple_size(test, &test_data);
-+};
-+
-+/*
-+ * Multiple none blocking write 4k to 4 MB chunks
-+ */
-+static int mmc_test_profile_mult_write_nonblock_perf(struct mmc_test_card *test)
-+{
-+	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
-+			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
-+	struct mmc_test_multiple_rw test_data = {
-+		.bs = bs,
-+		.size = 128*1024*1024,
-+		.len = ARRAY_SIZE(bs),
-+		.do_write = true,
-+		.do_nonblock_req = true,
-+		.prepare = MMC_TEST_PREP_ERASE,
-+	};
-+
-+	return mmc_test_rw_multiple_size(test, &test_data);
-+}
-+
-+/*
-+ * Multiple blocking read 4k to 4 MB chunks
-+ */
-+static int mmc_test_profile_mult_read_blocking_perf(struct mmc_test_card *test)
-+{
-+	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
-+			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
-+	struct mmc_test_multiple_rw test_data = {
-+		.bs = bs,
-+		.size = 128*1024*1024,
-+		.len = ARRAY_SIZE(bs),
-+		.do_write = false,
-+		.do_nonblock_req = false,
-+		.prepare = MMC_TEST_PREP_NONE,
-+	};
-+
-+	return mmc_test_rw_multiple_size(test, &test_data);
-+}
-+
-+/*
-+ * Multiple none blocking read 4k to 4 MB chunks
-+ */
-+static int mmc_test_profile_mult_read_nonblock_perf(struct mmc_test_card *test)
-+{
-+	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
-+			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
-+	struct mmc_test_multiple_rw test_data = {
-+		.bs = bs,
-+		.size = 128*1024*1024,
-+		.len = ARRAY_SIZE(bs),
-+		.do_write = false,
-+		.do_nonblock_req = true,
-+		.prepare = MMC_TEST_PREP_NONE,
-+	};
-+
-+	return mmc_test_rw_multiple_size(test, &test_data);
-+}
-+
- static const struct mmc_test_case mmc_test_cases[] = {
- 	{
- 		.name = "Basic write (no data verification)",
-@@ -2223,6 +2492,33 @@ static const struct mmc_test_case mmc_test_cases[] = {
- 		.cleanup = mmc_test_area_cleanup,
- 	},
- 
-+	{
-+		.name = "Write performance with blocking req 4k to 4MB",
-+		.prepare = mmc_test_area_prepare,
-+		.run = mmc_test_profile_mult_write_blocking_perf,
-+		.cleanup = mmc_test_area_cleanup,
-+	},
-+
-+	{
-+		.name = "Write performance with none blocking req 4k to 4MB",
-+		.prepare = mmc_test_area_prepare,
-+		.run = mmc_test_profile_mult_write_nonblock_perf,
-+		.cleanup = mmc_test_area_cleanup,
-+	},
-+
-+	{
-+		.name = "Read performance with blocking req 4k to 4MB",
-+		.prepare = mmc_test_area_prepare,
-+		.run = mmc_test_profile_mult_read_blocking_perf,
-+		.cleanup = mmc_test_area_cleanup,
-+	},
-+
-+	{
-+		.name = "Read performance with none blocking req 4k to 4MB",
-+		.prepare = mmc_test_area_prepare,
-+		.run = mmc_test_profile_mult_read_nonblock_perf,
-+		.cleanup = mmc_test_area_cleanup,
-+	},
- };
- 
- static DEFINE_MUTEX(mmc_test_lock);
-@@ -2447,6 +2743,32 @@ static const struct file_operations mmc_test_fops_test = {
- 	.release	= single_release,
- };
- 
-+static int mtf_testlist_show(struct seq_file *sf, void *data)
-+{
-+	int i;
-+
-+	mutex_lock(&mmc_test_lock);
-+
-+	for (i = 0; i < ARRAY_SIZE(mmc_test_cases); i++)
-+		seq_printf(sf, "%d:\t%s\n", i+1, mmc_test_cases[i].name);
-+
-+	mutex_unlock(&mmc_test_lock);
-+
-+	return 0;
-+}
-+
-+static int mtf_testlist_open(struct inode *inode, struct file *file)
-+{
-+	return single_open(file, mtf_testlist_show, inode->i_private);
-+}
-+
-+static const struct file_operations mmc_test_fops_testlist = {
-+	.open		= mtf_testlist_open,
-+	.read		= seq_read,
-+	.llseek		= seq_lseek,
-+	.release	= single_release,
-+};
-+
- static void mmc_test_free_file_test(struct mmc_card *card)
- {
- 	struct mmc_test_dbgfs_file *df, *dfs;
-@@ -2476,6 +2798,10 @@ static int mmc_test_register_file_test(struct mmc_card *card)
- 		file = debugfs_create_file("test", S_IWUSR | S_IRUGO,
- 			card->debugfs_root, card, &mmc_test_fops_test);
- 
-+	if (card->debugfs_root)
-+		file = debugfs_create_file("testlist", S_IRUGO,
-+			card->debugfs_root, card, &mmc_test_fops_testlist);
-+
- 	if (IS_ERR_OR_NULL(file)) {
- 		dev_err(&card->dev,
- 			"Can't create file. Perhaps debugfs is disabled.\n");
-diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
-index 2ae7275..2b14d1c 100644
---- a/drivers/mmc/card/queue.c
-+++ b/drivers/mmc/card/queue.c
-@@ -56,9 +56,10 @@ static int mmc_queue_thread(void *d)
- 		spin_lock_irq(q->queue_lock);
- 		set_current_state(TASK_INTERRUPTIBLE);
- 		req = blk_fetch_request(q);
--		mq->req = req;
-+		mq->mqrq_cur->req = req;
- 		spin_unlock_irq(q->queue_lock);
- 
-+		mq->issue_fn(mq, req);
- 		if (!req) {
- 			if (kthread_should_stop()) {
- 				set_current_state(TASK_RUNNING);
-@@ -71,7 +72,6 @@ static int mmc_queue_thread(void *d)
- 		}
- 		set_current_state(TASK_RUNNING);
- 
--		mq->issue_fn(mq, req);
- 	} while (1);
- 	up(&mq->thread_sem);
- 
-@@ -97,10 +97,25 @@ static void mmc_request(struct request_queue *q)
- 		return;
- 	}
- 
--	if (!mq->req)
-+	if (!mq->mqrq_cur->req)
- 		wake_up_process(mq->thread);
- }
- 
-+struct scatterlist *mmc_alloc_sg(int sg_len, int *err)
-+{
-+	struct scatterlist *sg;
-+
-+	sg = kmalloc(sizeof(struct scatterlist)*sg_len, GFP_KERNEL);
-+	if (!sg)
-+		*err = -ENOMEM;
-+	else {
-+		*err = 0;
-+		sg_init_table(sg, sg_len);
-+	}
-+
-+	return sg;
-+}
-+
- /**
-  * mmc_init_queue - initialise a queue structure.
-  * @mq: mmc queue
-@@ -114,6 +129,8 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 	struct mmc_host *host = card->host;
- 	u64 limit = BLK_BOUNCE_HIGH;
- 	int ret;
-+	struct mmc_queue_req *mqrq_cur = &mq->mqrq[0];
-+	struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
- 
- 	if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
- 		limit = *mmc_dev(host)->dma_mask;
-@@ -123,8 +140,11 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 	if (!mq->queue)
- 		return -ENOMEM;
- 
-+	memset(&mq->mqrq_cur, 0, sizeof(mq->mqrq_cur));
-+	memset(&mq->mqrq_prev, 0, sizeof(mq->mqrq_prev));
-+	mq->mqrq_cur = mqrq_cur;
-+	mq->mqrq_prev = mqrq_prev;
- 	mq->queue->queuedata = mq;
--	mq->req = NULL;
- 
- 	blk_queue_prep_rq(mq->queue, mmc_prep_request);
- 	queue_flag_set_unlocked(QUEUE_FLAG_NONROT, mq->queue);
-@@ -158,53 +178,64 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 			bouncesz = host->max_blk_count * 512;
- 
- 		if (bouncesz > 512) {
--			mq->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
--			if (!mq->bounce_buf) {
-+			mqrq_cur->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
-+			if (!mqrq_cur->bounce_buf) {
-+				printk(KERN_WARNING "%s: unable to "
-+					"allocate bounce cur buffer\n",
-+					mmc_card_name(card));
-+			}
-+			mqrq_prev->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
-+			if (!mqrq_prev->bounce_buf) {
- 				printk(KERN_WARNING "%s: unable to "
--					"allocate bounce buffer\n",
-+					"allocate bounce prev buffer\n",
- 					mmc_card_name(card));
-+				kfree(mqrq_cur->bounce_buf);
-+				mqrq_cur->bounce_buf = NULL;
- 			}
- 		}
- 
--		if (mq->bounce_buf) {
-+		if (mqrq_cur->bounce_buf && mqrq_prev->bounce_buf) {
- 			blk_queue_bounce_limit(mq->queue, BLK_BOUNCE_ANY);
- 			blk_queue_max_hw_sectors(mq->queue, bouncesz / 512);
- 			blk_queue_max_segments(mq->queue, bouncesz / 512);
- 			blk_queue_max_segment_size(mq->queue, bouncesz);
- 
--			mq->sg = kmalloc(sizeof(struct scatterlist),
--				GFP_KERNEL);
--			if (!mq->sg) {
--				ret = -ENOMEM;
-+			mqrq_cur->sg = mmc_alloc_sg(1, &ret);
-+			if (ret)
- 				goto cleanup_queue;
--			}
--			sg_init_table(mq->sg, 1);
- 
--			mq->bounce_sg = kmalloc(sizeof(struct scatterlist) *
--				bouncesz / 512, GFP_KERNEL);
--			if (!mq->bounce_sg) {
--				ret = -ENOMEM;
-+			mqrq_cur->bounce_sg =
-+				mmc_alloc_sg(bouncesz / 512, &ret);
-+			if (ret)
-+				goto cleanup_queue;
-+
-+			mqrq_prev->sg = mmc_alloc_sg(1, &ret);
-+			if (ret)
-+				goto cleanup_queue;
-+
-+			mqrq_prev->bounce_sg =
-+				mmc_alloc_sg(bouncesz / 512, &ret);
-+			if (ret)
- 				goto cleanup_queue;
--			}
--			sg_init_table(mq->bounce_sg, bouncesz / 512);
- 		}
- 	}
- #endif
- 
--	if (!mq->bounce_buf) {
-+	if (!mqrq_cur->bounce_buf && !mqrq_prev->bounce_buf) {
- 		blk_queue_bounce_limit(mq->queue, limit);
- 		blk_queue_max_hw_sectors(mq->queue,
- 			min(host->max_blk_count, host->max_req_size / 512));
- 		blk_queue_max_segments(mq->queue, host->max_segs);
- 		blk_queue_max_segment_size(mq->queue, host->max_seg_size);
- 
--		mq->sg = kmalloc(sizeof(struct scatterlist) *
--			host->max_segs, GFP_KERNEL);
--		if (!mq->sg) {
--			ret = -ENOMEM;
-+		mqrq_cur->sg = mmc_alloc_sg(host->max_segs, &ret);
-+		if (ret)
-+			goto cleanup_queue;
-+
-+
-+		mqrq_prev->sg = mmc_alloc_sg(host->max_segs, &ret);
-+		if (ret)
- 			goto cleanup_queue;
--		}
--		sg_init_table(mq->sg, host->max_segs);
- 	}
- 
- 	sema_init(&mq->thread_sem, 1);
-@@ -219,16 +250,22 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 
- 	return 0;
-  free_bounce_sg:
-- 	if (mq->bounce_sg)
-- 		kfree(mq->bounce_sg);
-- 	mq->bounce_sg = NULL;
-+	kfree(mqrq_cur->bounce_sg);
-+	mqrq_cur->bounce_sg = NULL;
-+	kfree(mqrq_prev->bounce_sg);
-+	mqrq_prev->bounce_sg = NULL;
-+
-  cleanup_queue:
-- 	if (mq->sg)
--		kfree(mq->sg);
--	mq->sg = NULL;
--	if (mq->bounce_buf)
--		kfree(mq->bounce_buf);
--	mq->bounce_buf = NULL;
-+	kfree(mqrq_cur->sg);
-+	mqrq_cur->sg = NULL;
-+	kfree(mqrq_cur->bounce_buf);
-+	mqrq_cur->bounce_buf = NULL;
-+
-+	kfree(mqrq_prev->sg);
-+	mqrq_prev->sg = NULL;
-+	kfree(mqrq_prev->bounce_buf);
-+	mqrq_prev->bounce_buf = NULL;
-+
- 	blk_cleanup_queue(mq->queue);
- 	return ret;
- }
-@@ -237,6 +274,8 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
- {
- 	struct request_queue *q = mq->queue;
- 	unsigned long flags;
-+	struct mmc_queue_req *mqrq_cur = mq->mqrq_cur;
-+	struct mmc_queue_req *mqrq_prev = mq->mqrq_prev;
- 
- 	/* Make sure the queue isn't suspended, as that will deadlock */
- 	mmc_queue_resume(mq);
-@@ -250,16 +289,23 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
- 	blk_start_queue(q);
- 	spin_unlock_irqrestore(q->queue_lock, flags);
- 
-- 	if (mq->bounce_sg)
-- 		kfree(mq->bounce_sg);
-- 	mq->bounce_sg = NULL;
-+	kfree(mqrq_cur->bounce_sg);
-+	mqrq_cur->bounce_sg = NULL;
-+
-+	kfree(mqrq_cur->sg);
-+	mqrq_cur->sg = NULL;
- 
--	kfree(mq->sg);
--	mq->sg = NULL;
-+	kfree(mqrq_cur->bounce_buf);
-+	mqrq_cur->bounce_buf = NULL;
- 
--	if (mq->bounce_buf)
--		kfree(mq->bounce_buf);
--	mq->bounce_buf = NULL;
-+	kfree(mqrq_prev->bounce_sg);
-+	mqrq_prev->bounce_sg = NULL;
-+
-+	kfree(mqrq_prev->sg);
-+	mqrq_prev->sg = NULL;
-+
-+	kfree(mqrq_prev->bounce_buf);
-+	mqrq_prev->bounce_buf = NULL;
- 
- 	mq->card = NULL;
- }
-@@ -312,27 +358,27 @@ void mmc_queue_resume(struct mmc_queue *mq)
- /*
-  * Prepare the sg list(s) to be handed of to the host driver
-  */
--unsigned int mmc_queue_map_sg(struct mmc_queue *mq)
-+unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
- {
- 	unsigned int sg_len;
- 	size_t buflen;
- 	struct scatterlist *sg;
- 	int i;
- 
--	if (!mq->bounce_buf)
--		return blk_rq_map_sg(mq->queue, mq->req, mq->sg);
-+	if (!mqrq->bounce_buf)
-+		return blk_rq_map_sg(mq->queue, mqrq->req, mqrq->sg);
- 
--	BUG_ON(!mq->bounce_sg);
-+	BUG_ON(!mqrq->bounce_sg);
- 
--	sg_len = blk_rq_map_sg(mq->queue, mq->req, mq->bounce_sg);
-+	sg_len = blk_rq_map_sg(mq->queue, mqrq->req, mqrq->bounce_sg);
- 
--	mq->bounce_sg_len = sg_len;
-+	mqrq->bounce_sg_len = sg_len;
- 
- 	buflen = 0;
--	for_each_sg(mq->bounce_sg, sg, sg_len, i)
-+	for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
- 		buflen += sg->length;
- 
--	sg_init_one(mq->sg, mq->bounce_buf, buflen);
-+	sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
- 
- 	return 1;
- }
-@@ -341,19 +387,19 @@ unsigned int mmc_queue_map_sg(struct mmc_queue *mq)
-  * If writing, bounce the data to the buffer before the request
-  * is sent to the host driver
-  */
--void mmc_queue_bounce_pre(struct mmc_queue *mq)
-+void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
- {
- 	unsigned long flags;
- 
--	if (!mq->bounce_buf)
-+	if (!mqrq->bounce_buf)
- 		return;
- 
--	if (rq_data_dir(mq->req) != WRITE)
-+	if (rq_data_dir(mqrq->req) != WRITE)
- 		return;
- 
- 	local_irq_save(flags);
--	sg_copy_to_buffer(mq->bounce_sg, mq->bounce_sg_len,
--		mq->bounce_buf, mq->sg[0].length);
-+	sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-+		mqrq->bounce_buf, mqrq->sg[0].length);
- 	local_irq_restore(flags);
- }
- 
-@@ -361,19 +407,18 @@ void mmc_queue_bounce_pre(struct mmc_queue *mq)
-  * If reading, bounce the data from the buffer after the request
-  * has been handled by the host driver
-  */
--void mmc_queue_bounce_post(struct mmc_queue *mq)
-+void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
- {
- 	unsigned long flags;
- 
--	if (!mq->bounce_buf)
-+	if (!mqrq->bounce_buf)
- 		return;
- 
--	if (rq_data_dir(mq->req) != READ)
-+	if (rq_data_dir(mqrq->req) != READ)
- 		return;
- 
- 	local_irq_save(flags);
--	sg_copy_from_buffer(mq->bounce_sg, mq->bounce_sg_len,
--		mq->bounce_buf, mq->sg[0].length);
-+	sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-+		mqrq->bounce_buf, mqrq->sg[0].length);
- 	local_irq_restore(flags);
- }
--
-diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
-index 64e66e0..0e65807 100644
---- a/drivers/mmc/card/queue.h
-+++ b/drivers/mmc/card/queue.h
-@@ -4,19 +4,33 @@
- struct request;
- struct task_struct;
- 
-+struct mmc_blk_request {
-+	struct mmc_request	mrq;
-+	struct mmc_command	cmd;
-+	struct mmc_command	stop;
-+	struct mmc_data		data;
-+};
-+
-+struct mmc_queue_req {
-+	struct request		*req;
-+	struct mmc_blk_request	brq;
-+	struct scatterlist	*sg;
-+	char			*bounce_buf;
-+	struct scatterlist	*bounce_sg;
-+	unsigned int		bounce_sg_len;
-+};
-+
- struct mmc_queue {
- 	struct mmc_card		*card;
- 	struct task_struct	*thread;
- 	struct semaphore	thread_sem;
- 	unsigned int		flags;
--	struct request		*req;
- 	int			(*issue_fn)(struct mmc_queue *, struct request *);
- 	void			*data;
- 	struct request_queue	*queue;
--	struct scatterlist	*sg;
--	char			*bounce_buf;
--	struct scatterlist	*bounce_sg;
--	unsigned int		bounce_sg_len;
-+	struct mmc_queue_req	mqrq[2];
-+	struct mmc_queue_req	*mqrq_cur;
-+	struct mmc_queue_req	*mqrq_prev;
- };
- 
- extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *);
-@@ -24,8 +38,9 @@ extern void mmc_cleanup_queue(struct mmc_queue *);
- extern void mmc_queue_suspend(struct mmc_queue *);
- extern void mmc_queue_resume(struct mmc_queue *);
- 
--extern unsigned int mmc_queue_map_sg(struct mmc_queue *);
--extern void mmc_queue_bounce_pre(struct mmc_queue *);
--extern void mmc_queue_bounce_post(struct mmc_queue *);
-+extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
-+				     struct mmc_queue_req *);
-+extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
-+extern void mmc_queue_bounce_post(struct mmc_queue_req *);
- 
- #endif
-diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
-index 1f453ac..85296df 100644
---- a/drivers/mmc/core/core.c
-+++ b/drivers/mmc/core/core.c
-@@ -23,6 +23,8 @@
- #include <linux/log2.h>
- #include <linux/regulator/consumer.h>
- #include <linux/pm_runtime.h>
-+#include <linux/fault-inject.h>
-+#include <linux/random.h>
- 
- #include <linux/mmc/card.h>
- #include <linux/mmc/host.h>
-@@ -82,6 +84,56 @@ static void mmc_flush_scheduled_work(void)
- 	flush_workqueue(workqueue);
- }
- 
-+#ifdef CONFIG_FAIL_MMC_REQUEST
-+
-+static DECLARE_FAULT_ATTR(fail_mmc_request);
-+
-+static int __init setup_fail_mmc_request(char *str)
-+{
-+	return setup_fault_attr(&fail_mmc_request, str);
-+}
-+__setup("fail_mmc_request=", setup_fail_mmc_request);
-+
-+static void mmc_should_fail_request(struct mmc_host *host,
-+				    struct mmc_request *mrq)
-+{
-+	struct mmc_command *cmd = mrq->cmd;
-+	struct mmc_data *data = mrq->data;
-+	static const int data_errors[] = {
-+		-ETIMEDOUT,
-+		-EILSEQ,
-+		-EIO,
-+	};
-+
-+	if (!data)
-+		return;
-+
-+	if (cmd->error || data->error || !host->make_it_fail ||
-+	    !should_fail(&fail_mmc_request, data->blksz * data->blocks))
-+		return;
-+
-+	data->error = data_errors[random32() % ARRAY_SIZE(data_errors)];
-+	data->bytes_xfered = (random32() % (data->bytes_xfered >> 9)) << 9;
-+}
-+
-+static int __init fail_mmc_request_debugfs(void)
-+{
-+	return init_fault_attr_dentries(&fail_mmc_request,
-+					"fail_mmc_request");
-+}
-+
-+late_initcall(fail_mmc_request_debugfs);
-+
-+#else /* CONFIG_FAIL_MMC_REQUEST */
-+
-+static inline void mmc_should_fail_request(struct mmc_host *host,
-+					   struct mmc_data *data)
-+{
-+}
-+
-+#endif /* CONFIG_FAIL_MMC_REQUEST */
-+
-+
- /**
-  *	mmc_request_done - finish processing an MMC request
-  *	@host: MMC host which completed request
-@@ -108,6 +160,8 @@ void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
- 		cmd->error = 0;
- 		host->ops->request(host, mrq);
- 	} else {
-+		mmc_should_fail_request(host, mrq);
-+
- 		led_trigger_event(host->led, LED_OFF);
- 
- 		pr_debug("%s: req done (CMD%u): %d: %08x %08x %08x %08x\n",
-@@ -198,30 +252,88 @@ mmc_start_request(struct mmc_host *host, struct mmc_request *mrq)
- 
- static void mmc_wait_done(struct mmc_request *mrq)
- {
--	complete(mrq->done_data);
-+	complete(&mrq->completion);
- }
- 
- /**
-- *	mmc_wait_for_req - start a request and wait for completion
-+ *	mmc_pre_req - Prepare for a new request
-+ *	@host: MMC host to prepare command
-+ *	@mrq: MMC request to prepare for
-+ *	@is_first_req: true if there is no previous started request
-+ *                     that may run in parellel to this call, otherwise false
-+ *
-+ *	mmc_pre_req() is called in prior to mmc_start_req() to let
-+ *	host prepare for the new request. Preparation of a request may be
-+ *	performed while another request is running on the host.
-+ */
-+void mmc_pre_req(struct mmc_host *host, struct mmc_request *mrq,
-+		 bool is_first_req)
-+{
-+	if (host->ops->pre_req)
-+		host->ops->pre_req(host, mrq, is_first_req);
-+}
-+EXPORT_SYMBOL(mmc_pre_req);
-+
-+/**
-+ *	mmc_post_req - Post process a completed request
-+ *	@host: MMC host to post process command
-+ *	@mrq: MMC request to post process for
-+ *	@err: Error, if none zero, clean up any resources made in pre_req
-+ *
-+ *	Let the host post process a completed request. Post processing of
-+ *	a request may be performed while another reuqest is running.
-+ */
-+void mmc_post_req(struct mmc_host *host, struct mmc_request *mrq, int err)
-+{
-+	if (host->ops->post_req)
-+		host->ops->post_req(host, mrq, err);
-+}
-+EXPORT_SYMBOL(mmc_post_req);
-+
-+/**
-+ *	mmc_start_req - start a request
-  *	@host: MMC host to start command
-  *	@mrq: MMC request to start
-  *
-- *	Start a new MMC custom command request for a host, and wait
-- *	for the command to complete. Does not attempt to parse the
-- *	response.
-+ *	Start a new MMC custom command request for a host.
-+ *	Does not wait for the command to complete.
-  */
--void mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)
-+void mmc_start_req(struct mmc_host *host, struct mmc_request *mrq)
- {
--	DECLARE_COMPLETION_ONSTACK(complete);
--
--	mrq->done_data = &complete;
-+	init_completion(&mrq->completion);
- 	mrq->done = mmc_wait_done;
- 
- 	mmc_start_request(host, mrq);
-+}
-+EXPORT_SYMBOL(mmc_start_req);
- 
--	wait_for_completion(&complete);
-+/**
-+ *	mmc_wait_for_req_done - wait for completion of request
-+ *	@mrq: MMC request to wait for
-+ *
-+ *	Wait for the command to complete. Does not attempt to parse the
-+ *	response.
-+ */
-+void mmc_wait_for_req_done(struct mmc_request *mrq)
-+{
-+	wait_for_completion(&mrq->completion);
- }
-+EXPORT_SYMBOL(mmc_wait_for_req_done);
- 
-+/**
-+ *	mmc_wait_for_req - start a request and wait for completion
-+ *	@host: MMC host to start command
-+ *	@mrq: MMC request to start
-+ *
-+ *	Start a new MMC custom command request for a host, and wait
-+ *	for the command to complete. Does not attempt to parse the
-+ *	response.
-+ */
-+void mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)
-+{
-+	mmc_start_req(host, mrq);
-+	mmc_wait_for_req_done(mrq);
-+}
- EXPORT_SYMBOL(mmc_wait_for_req);
- 
- /**
-diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c
-index 998797e..588e76f 100644
---- a/drivers/mmc/core/debugfs.c
-+++ b/drivers/mmc/core/debugfs.c
-@@ -188,6 +188,11 @@ void mmc_add_host_debugfs(struct mmc_host *host)
- 				root, &host->clk_delay))
- 		goto err_node;
- #endif
-+#ifdef CONFIG_FAIL_MMC_REQUEST
-+	if (!debugfs_create_u8("make-it-fail", S_IRUSR | S_IWUSR,
-+			       root, &host->make_it_fail))
-+		goto err_node;
-+#endif
- 	return;
- 
- err_node:
-diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
-index 94df405..872ef4a 100644
---- a/drivers/mmc/host/Kconfig
-+++ b/drivers/mmc/host/Kconfig
-@@ -429,6 +429,17 @@ config MMC_S3C_PIODMA
- 
- endchoice
- 
-+config MMC_GLAMO
-+	tristate "Glamo S3C SD/MMC Card Interface support"
-+	depends on MFD_GLAMO && MMC && REGULATOR
-+	select CRC7
-+	help
-+	  This selects a driver for the MCI interface found in
-+	  the S-Media GLAMO chip, as used in Openmoko
-+	  neo1973 GTA-02.
-+
-+	  If unsure, say N.
-+
- config MMC_SDRICOH_CS
- 	tristate "MMC/SD driver for Ricoh Bay1Controllers (EXPERIMENTAL)"
- 	depends on EXPERIMENTAL && PCI && PCMCIA
-diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
-index 4f1df0a..7133627 100644
---- a/drivers/mmc/host/Makefile
-+++ b/drivers/mmc/host/Makefile
-@@ -27,6 +27,7 @@ ifeq ($(CONFIG_OF),y)
- obj-$(CONFIG_MMC_SPI)		+= of_mmc_spi.o
- endif
- obj-$(CONFIG_MMC_S3C)   	+= s3cmci.o
-+obj-$(CONFIG_MMC_GLAMO)		+= glamo-mci.o
- obj-$(CONFIG_MMC_SDRICOH_CS)	+= sdricoh_cs.o
- obj-$(CONFIG_MMC_TMIO)		+= tmio_mmc.o
- obj-$(CONFIG_MMC_TMIO_CORE)	+= tmio_mmc_core.o
-diff --git a/drivers/mmc/host/glamo-mci.c b/drivers/mmc/host/glamo-mci.c
-new file mode 100644
-index 0000000..02c4b69
---- /dev/null
-+++ b/drivers/mmc/host/glamo-mci.c
-@@ -0,0 +1,939 @@
-+/*
-+ *  linux/drivers/mmc/host/glamo-mmc.c - Glamo MMC driver
-+ *
-+ *  Copyright (C) 2007 Openmoko, Inc,  Andy Green <andy@openmoko.com>
-+ *  Copyright (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
-+ *  Based on S3C MMC driver that was:
-+ *  Copyright (C) 2004-2006 maintech GmbH, Thomas Kleffel <tk@maintech.de>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/mmc/mmc.h>
-+#include <linux/mmc/sd.h>
-+#include <linux/mmc/host.h>
-+#include <linux/platform_device.h>
-+#include <linux/irq.h>
-+#include <linux/delay.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/crc7.h>
-+#include <linux/scatterlist.h>
-+#include <linux/io.h>
-+#include <linux/regulator/consumer.h>
-+#include <linux/err.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/mfd/glamo-regs.h>
-+
-+struct glamo_mci_host {
-+	struct glamo_mmc_platform_data *pdata;
-+	struct platform_device	*pdev;
-+	struct glamo_core	*core;
-+	struct mmc_host		*mmc;
-+	struct resource		*mmio_mem;
-+	struct resource		*data_mem;
-+	void __iomem		*mmio_base;
-+	uint16_t __iomem	*data_base;
-+
-+	unsigned int irq;
-+
-+	struct regulator *regulator;
-+	struct mmc_request *mrq;
-+
-+	unsigned int clk_rate;
-+
-+	unsigned short vdd;
-+	char power_mode;
-+
-+	unsigned long transfer_start;
-+	unsigned long request_start;
-+
-+	unsigned char request_counter;
-+};
-+
-+static void glamo_mci_send_request(struct mmc_host *mmc,
-+				   struct mmc_request *mrq);
-+static void glamo_mci_send_command(struct glamo_mci_host *host,
-+				   struct mmc_command *cmd);
-+
-+/*
-+ * Max SD clock rate
-+ *
-+ * held at /(3 + 1) due to concerns of 100R recommended series resistor
-+ * allows 16MHz @ 4-bit --> 8MBytes/sec raw
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ *   glamo_mci.sd_max_clk=10000000
-+ *
-+ * for example
-+ */
-+
-+static int sd_max_clk = 17000000;
-+module_param(sd_max_clk, int, 0644);
-+
-+/*
-+ * Slow SD clock rate
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ *   glamo_mci.sd_slow_ratio=8
-+ *
-+ * for example
-+ *
-+ * platform callback is used to decide effective clock rate, if not
-+ * defined then max is used, if defined and returns nonzero, rate is
-+ * divided by this factor
-+ */
-+
-+static int sd_slow_ratio = 8;
-+module_param(sd_slow_ratio, int, 0644);
-+
-+/*
-+ * Post-power SD clock rate
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ *   glamo_mci.sd_post_power_clock=1000000
-+ *
-+ * for example
-+ *
-+ * After changing power to card, clock is held at this rate until first bulk
-+ * transfer completes
-+ */
-+
-+static int sd_post_power_clock = 1000000;
-+module_param(sd_post_power_clock, int, 0644);
-+
-+
-+static inline void glamomci_reg_write(struct glamo_mci_host *glamo,
-+		uint16_t reg, uint16_t val)
-+{
-+	writew(val, glamo->mmio_base + reg);
-+}
-+
-+static inline uint16_t glamomci_reg_read(struct glamo_mci_host *glamo,
-+		uint16_t reg)
-+{
-+	return readw(glamo->mmio_base + reg);
-+}
-+
-+static void glamomci_reg_set_bit_mask(struct glamo_mci_host *glamo,
-+		uint16_t reg, uint16_t mask, uint16_t val)
-+{
-+	uint16_t tmp;
-+
-+	val &= mask;
-+
-+	tmp = glamomci_reg_read(glamo, reg);
-+	tmp &= ~mask;
-+	tmp |= val;
-+	glamomci_reg_write(glamo, reg, tmp);
-+}
-+
-+static void glamo_mci_reset(struct glamo_mci_host *host)
-+{
-+	glamo_engine_reset(host->core, GLAMO_ENGINE_MMC);
-+
-+	glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS1,
-+			(uint16_t)(host->data_mem->start));
-+	glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS2,
-+			(uint16_t)(host->data_mem->start >> 16));
-+
-+	glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS1,
-+			(uint16_t)(host->data_mem->start));
-+	glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS2,
-+			(uint16_t)(host->data_mem->start >> 16));
-+
-+}
-+
-+static int glamo_mci_clock_disable(struct mmc_host *mmc, int lazy)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	glamo_engine_suspend(host->core, GLAMO_ENGINE_MMC);
-+	return 0;
-+}
-+
-+static int glamo_mci_clock_enable(struct mmc_host *mmc)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	glamo_engine_enable(host->core, GLAMO_ENGINE_MMC);
-+	return 0;
-+}
-+
-+static void __iomem *glamo_mci_get_data_addr(struct glamo_mci_host *host,
-+	struct mmc_data *data)
-+{
-+	void __iomem *addr = host->data_base;
-+
-+	if (data->host_cookie & 1)
-+		addr += resource_size(host->data_mem) / 2;
-+
-+	return addr;
-+}
-+
-+static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
-+{
-+	void __iomem *from_ptr = glamo_mci_get_data_addr(host, data);
-+	struct sg_mapping_iter miter;
-+
-+	dev_dbg(&host->pdev->dev, "pio_read():\n");
-+
-+	sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_TO_SG);
-+
-+	while (sg_miter_next(&miter)) {
-+		memcpy(miter.addr, from_ptr, miter.length);
-+		from_ptr += miter.length;
-+	}
-+
-+	sg_miter_stop(&miter);
-+
-+	dev_dbg(&host->pdev->dev, "pio_read(): "
-+			"complete (no more data)\n");
-+}
-+
-+static void do_pio_write(struct glamo_mci_host *host, struct mmc_data *data)
-+{
-+	void __iomem *to_ptr = glamo_mci_get_data_addr(host, data);
-+	struct sg_mapping_iter miter;
-+
-+	dev_dbg(&host->pdev->dev, "pio_write():\n");
-+	sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_FROM_SG);
-+
-+	while (sg_miter_next(&miter)) {
-+		memcpy(to_ptr, miter.addr, miter.length);
-+		to_ptr += miter.length;
-+
-+		data->bytes_xfered += miter.length;
-+	}
-+	sg_miter_stop(&miter);
-+
-+	dev_dbg(&host->pdev->dev, "pio_write(): complete\n");
-+}
-+
-+static int glamo_mci_set_card_clock(struct glamo_mci_host *host, int freq)
-+{
-+	int real_rate = 0;
-+
-+	if (freq)
-+		real_rate = glamo_engine_reclock(host->core, GLAMO_ENGINE_MMC,
-+						 freq);
-+
-+	return real_rate;
-+}
-+
-+static int glamo_mci_wait_idle(struct glamo_mci_host *host,
-+			       unsigned long timeout)
-+{
-+	uint16_t status;
-+
-+	do {
-+		status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+	} while (!(status & GLAMO_STAT1_MMC_IDLE) &&
-+		  time_is_after_jiffies(timeout));
-+
-+	if (time_is_before_eq_jiffies(timeout)) {
-+		glamo_mci_reset(host);
-+		return -ETIMEDOUT;
-+	}
-+
-+	return 0;
-+}
-+
-+static void glamo_mci_request_done(struct glamo_mci_host *host,
-+				   struct mmc_request *mrq)
-+{
-+	mmc_request_done(host->mmc, mrq);
-+}
-+
-+static irqreturn_t glamo_mci_irq(int irq, void *data)
-+{
-+	struct glamo_mci_host *host = data;
-+	struct mmc_request *mrq;
-+	struct mmc_command *cmd;
-+	uint16_t status;
-+
-+	if (!host->mrq || !host->mrq->cmd)
-+		return IRQ_HANDLED;
-+
-+	mrq = host->mrq;
-+	cmd = mrq->cmd;
-+
-+	status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+	dev_dbg(&host->pdev->dev, "status = 0x%04x\n", status);
-+
-+	/* we ignore a data timeout report if we are also told the data came */
-+	if (status & GLAMO_STAT1_MMC_RB_DRDY)
-+		status &= ~GLAMO_STAT1_MMC_DTOUT;
-+
-+	if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
-+		cmd->error = -ETIMEDOUT;
-+	else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
-+		cmd->error = -EILSEQ;
-+
-+	if (cmd->error) {
-+		dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n", status);
-+		goto done;
-+	}
-+
-+	/* issue STOP if we have been given one to use */
-+	if (mrq->stop)
-+		glamo_mci_send_command(host, mrq->stop);
-+
-+	if (mrq->data && (mrq->data->flags & MMC_DATA_READ)) {
-+		mrq->data->bytes_xfered = mrq->data->blocks * mrq->data->blksz;
-+		if (!mrq->data->host_cookie)
-+			do_pio_read(host, mrq->data);
-+	}
-+
-+	if (mrq->stop)
-+		mrq->stop->error = glamo_mci_wait_idle(host, jiffies + HZ);
-+
-+done:
-+	host->mrq = NULL;
-+	glamo_mci_request_done(host, cmd->mrq);
-+
-+	return IRQ_HANDLED;
-+}
-+
-+static void glamo_mci_send_command(struct glamo_mci_host *host,
-+		struct mmc_command *cmd)
-+{
-+	uint8_t u8a[6];
-+	uint16_t fire = 0;
-+	unsigned int timeout = 1000000;
-+	uint16_t *reg_resp = (uint16_t *)(host->mmio_base + GLAMO_REG_MMC_CMD_RSP1);
-+	uint16_t status;
-+	int triggers_int = 1;
-+
-+	/* if we can't do it, reject as busy */
-+	if (!(glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1) &
-+		 GLAMO_STAT1_MMC_IDLE)) {
-+		cmd->error = -EBUSY;
-+		return;
-+	}
-+
-+	/* create an array in wire order for CRC computation */
-+	u8a[0] = 0x40 | (cmd->opcode & 0x3f);
-+	u8a[1] = (uint8_t)(cmd->arg >> 24);
-+	u8a[2] = (uint8_t)(cmd->arg >> 16);
-+	u8a[3] = (uint8_t)(cmd->arg >> 8);
-+	u8a[4] = (uint8_t)cmd->arg;
-+	u8a[5] = (crc7(0, u8a, 5) << 1) | 0x01;
-+
-+	/* issue the wire-order array including CRC in register order */
-+	glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG1, ((u8a[4] << 8) | u8a[5]));
-+	glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG2, ((u8a[2] << 8) | u8a[3]));
-+	glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG3, ((u8a[0] << 8) | u8a[1]));
-+
-+	/* command index toggle */
-+	fire |= (host->request_counter & 1) << 12;
-+
-+	/* set type of command */
-+	switch (mmc_cmd_type(cmd)) {
-+	case MMC_CMD_BC:
-+		fire |= GLAMO_FIRE_MMC_CMDT_BNR;
-+		break;
-+	case MMC_CMD_BCR:
-+		fire |= GLAMO_FIRE_MMC_CMDT_BR;
-+		break;
-+	case MMC_CMD_AC:
-+		fire |= GLAMO_FIRE_MMC_CMDT_AND;
-+		break;
-+	case MMC_CMD_ADTC:
-+		fire |= GLAMO_FIRE_MMC_CMDT_AD;
-+		break;
-+	}
-+	/*
-+	 * if it expects a response, set the type expected
-+	 *
-+	 * R1, Length  : 48bit, Normal response
-+	 * R1b, Length : 48bit, same R1, but added card busy status
-+	 * R2, Length  : 136bit (really 128 bits with CRC snipped)
-+	 * R3, Length  : 48bit (OCR register value)
-+	 * R4, Length  : 48bit, SDIO_OP_CONDITION, Reverse SDIO Card
-+	 * R5, Length  : 48bit, IO_RW_DIRECTION, Reverse SDIO Card
-+	 * R6, Length  : 48bit (RCA register)
-+	 * R7, Length  : 48bit (interface condition, VHS(voltage supplied),
-+	 *                     check pattern, CRC7)
-+	 */
-+	switch (mmc_resp_type(cmd)) {
-+	case MMC_RSP_R1: /* same index as R6 and R7 */
-+		fire |= GLAMO_FIRE_MMC_RSPT_R1;
-+		break;
-+	case MMC_RSP_R1B:
-+		fire |= GLAMO_FIRE_MMC_RSPT_R1b;
-+		break;
-+	case MMC_RSP_R2:
-+		fire |= GLAMO_FIRE_MMC_RSPT_R2;
-+		break;
-+	case MMC_RSP_R3:
-+		fire |= GLAMO_FIRE_MMC_RSPT_R3;
-+		break;
-+	/* R4 and R5 supported by chip not defined in linux/mmc/core.h (sdio) */
-+	}
-+	/*
-+	 * From the command index, set up the command class in the host ctrllr
-+	 *
-+	 * missing guys present on chip but couldn't figure out how to use yet:
-+	 *     0x0 "stream read"
-+	 *     0x9 "cancel running command"
-+	 */
-+	switch (cmd->opcode) {
-+	case MMC_READ_SINGLE_BLOCK:
-+		fire |= GLAMO_FIRE_MMC_CC_SBR; /* single block read */
-+		break;
-+	case MMC_SWITCH: /* 64 byte payload */
-+	case SD_APP_SD_STATUS:
-+	case SD_APP_SEND_SCR:
-+	case MMC_READ_MULTIPLE_BLOCK:
-+		/* we will get an interrupt off this */
-+		if (!cmd->mrq->stop) {
-+			/* multiblock no stop */
-+			fire |= GLAMO_FIRE_MMC_CC_MBRNS;
-+		} else {
-+			/* multiblock with stop */
-+			fire |= GLAMO_FIRE_MMC_CC_MBRS;
-+		}
-+		break;
-+	case MMC_WRITE_BLOCK:
-+		fire |= GLAMO_FIRE_MMC_CC_SBW; /* single block write */
-+		break;
-+	case MMC_WRITE_MULTIPLE_BLOCK:
-+		if (cmd->mrq->stop) {
-+			/* multiblock with stop */
-+			fire |= GLAMO_FIRE_MMC_CC_MBWS;
-+		} else {
-+			/* multiblock NO stop-- 'RESERVED'? */
-+			fire |= GLAMO_FIRE_MMC_CC_MBWNS;
-+		}
-+		break;
-+	case MMC_STOP_TRANSMISSION:
-+		fire |= GLAMO_FIRE_MMC_CC_STOP; /* STOP */
-+		triggers_int = 0;
-+		break;
-+	default:
-+		fire |= GLAMO_FIRE_MMC_CC_BASIC; /* "basic command" */
-+		triggers_int = 0;
-+		break;
-+	}
-+
-+	if (cmd->data)
-+		host->mrq = cmd->mrq;
-+
-+	/* always largest timeout */
-+	glamomci_reg_write(host, GLAMO_REG_MMC_TIMEOUT, 0xfff);
-+
-+	/* Generate interrupt on txfer */
-+	glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC, 0xff36,
-+			0x0800 |
-+			GLAMO_BASIC_MMC_NO_CLK_RD_WAIT |
-+			GLAMO_BASIC_MMC_EN_COMPL_INT |
-+			GLAMO_BASIC_MMC_EN_DATA_PUPS |
-+			GLAMO_BASIC_MMC_EN_CMD_PUP);
-+
-+	/* send the command out on the wire */
-+	/* dev_info(&host->pdev->dev, "Using FIRE %04X\n", fire); */
-+	glamomci_reg_write(host, GLAMO_REG_MMC_CMD_FIRE, fire);
-+
-+	/* we are deselecting card?  because it isn't going to ack then... */
-+	if ((cmd->opcode == 7) && (cmd->arg == 0))
-+		return;
-+
-+	/*
-+	 * we must spin until response is ready or timed out
-+	 * -- we don't get interrupts unless there is a bulk rx
-+	 */
-+	do
-+		status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+	while (((((status >> 15) & 1) != (host->request_counter & 1)) ||
-+		(!(status & (GLAMO_STAT1_MMC_RB_RRDY |
-+			     GLAMO_STAT1_MMC_RTOUT |
-+			     GLAMO_STAT1_MMC_DTOUT |
-+			     GLAMO_STAT1_MMC_BWERR |
-+			     GLAMO_STAT1_MMC_BRERR)))) && (timeout--));
-+
-+	if ((status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT)) ||
-+	    (timeout == 0)) {
-+		cmd->error = -ETIMEDOUT;
-+	} else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR)) {
-+		cmd->error = -EILSEQ;
-+	}
-+
-+	if (cmd->flags & MMC_RSP_PRESENT) {
-+		if (cmd->flags & MMC_RSP_136) {
-+			cmd->resp[3] = readw(&reg_resp[0]) |
-+						   (readw(&reg_resp[1]) << 16);
-+			cmd->resp[2] = readw(&reg_resp[2]) |
-+						   (readw(&reg_resp[3]) << 16);
-+			cmd->resp[1] = readw(&reg_resp[4]) |
-+						   (readw(&reg_resp[5]) << 16);
-+			cmd->resp[0] = readw(&reg_resp[6]) |
-+						   (readw(&reg_resp[7]) << 16);
-+		} else {
-+			cmd->resp[0] = (readw(&reg_resp[0]) >> 8) |
-+					   (readw(&reg_resp[1]) << 8) |
-+					   (readw(&reg_resp[2]) << 24);
-+		}
-+	}
-+}
-+
-+static int glamo_mci_prepare_pio(struct glamo_mci_host *host,
-+		struct mmc_data *data)
-+{
-+	unsigned long addr = host->data_mem->start;
-+
-+	if (data->host_cookie & 1)
-+		addr += resource_size(host->data_mem) / 2;
-+
-+	/* set up the block info */
-+	glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKLEN, data->blksz);
-+	glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKCNT, data->blocks);
-+
-+	if (data->flags & MMC_DATA_WRITE) {
-+		glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS1, addr);
-+		glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS2, addr >> 16);
-+	} else {
-+		glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS1, addr);
-+		glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS2, addr >> 16);
-+	}
-+
-+	if ((data->flags & MMC_DATA_WRITE) && !data->host_cookie)
-+		do_pio_write(host, data);
-+
-+	dev_dbg(&host->pdev->dev, "(blksz=%d, count=%d)\n",
-+				   data->blksz, data->blocks);
-+	return 0;
-+}
-+
-+static void glamo_mci_send_request(struct mmc_host *mmc,
-+		struct mmc_request *mrq)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	struct mmc_command *cmd = mrq->cmd;
-+
-+	host->request_counter++;
-+	host->request_start = jiffies;
-+
-+	if (cmd->data) {
-+		if (glamo_mci_prepare_pio(host, cmd->data)) {
-+			cmd->error = -EIO;
-+			cmd->data->error = -EIO;
-+			goto done;
-+		}
-+	}
-+
-+	dev_dbg(&host->pdev->dev, "cmd 0x%x, "
-+		 "arg 0x%x data=%p mrq->stop=%p flags 0x%x\n",
-+		 cmd->opcode, cmd->arg, cmd->data, cmd->mrq->stop,
-+		 cmd->flags);
-+
-+	glamo_mci_send_command(host, cmd);
-+
-+	/*
-+	 * if we don't have bulk data to take care of, we're done
-+	 */
-+	if (!cmd->data || cmd->error)
-+		goto done;
-+
-+	/*
-+	 * Otherwise can can use the interrupt as async completion --
-+	 * if there is read data coming, or we wait for write data to complete,
-+	 * exit without mmc_request_done() as the payload interrupt
-+	 * will service it
-+	 */
-+	dev_dbg(&host->pdev->dev, "Waiting for payload data\n");
-+	return;
-+done:
-+	if (!cmd->error)
-+		cmd->error = glamo_mci_wait_idle(host, jiffies + 2 * HZ);
-+	glamo_mci_request_done(host, mrq);
-+}
-+
-+static void glamo_mci_set_power_mode(struct glamo_mci_host *host,
-+				     unsigned char power_mode)
-+{
-+	int ret;
-+
-+	if (power_mode == host->power_mode)
-+		return;
-+
-+	switch (power_mode) {
-+	case MMC_POWER_UP:
-+		if (host->power_mode == MMC_POWER_OFF) {
-+			ret = regulator_enable(host->regulator);
-+			if (ret)
-+				dev_err(&host->pdev->dev,
-+					"Failed to enable regulator: %d\n",
-+					ret);
-+		}
-+		break;
-+	case MMC_POWER_ON:
-+		break;
-+	case MMC_POWER_OFF:
-+	default:
-+		ret = regulator_disable(host->regulator);
-+		if (ret)
-+			dev_warn(&host->pdev->dev,
-+				"Failed to disable regulator: %d\n",
-+				ret);
-+		break;
-+	}
-+	host->power_mode = power_mode;
-+}
-+
-+static void glamo_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	int bus_width = 0;
-+	int rate;
-+	int sd_drive;
-+	int ret;
-+
-+	mmc_host_enable(mmc);
-+
-+	/* Set power */
-+	glamo_mci_set_power_mode(host, ios->power_mode);
-+
-+	if (host->vdd != ios->vdd) {
-+		ret = mmc_regulator_set_ocr(mmc, host->regulator, ios->vdd);
-+		if (ret)
-+			dev_err(&host->pdev->dev,
-+				"Failed to set regulator voltage: %d\n", ret);
-+		else
-+			host->vdd = ios->vdd;
-+	}
-+
-+	rate = glamo_mci_set_card_clock(host, ios->clock);
-+
-+	if ((ios->power_mode == MMC_POWER_ON) ||
-+		(ios->power_mode == MMC_POWER_UP)) {
-+		dev_info(&host->pdev->dev,
-+			"powered (vdd = %hu) clk: %dkHz div=%hu (req: %ukHz). "
-+			"Bus width=%d\n", ios->vdd,
-+			rate / 1000, 0,
-+			ios->clock / 1000, (int)ios->bus_width);
-+	} else {
-+		dev_info(&host->pdev->dev, "glamo_mci_set_ios: power down.\n");
-+	}
-+
-+	/* set bus width */
-+	if (ios->bus_width == MMC_BUS_WIDTH_4)
-+		bus_width = GLAMO_BASIC_MMC_EN_4BIT_DATA;
-+
-+	sd_drive = (rate * 4) / host->clk_rate;
-+	if (sd_drive > 3)
-+		sd_drive = 3;
-+
-+	glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC,
-+				GLAMO_BASIC_MMC_EN_4BIT_DATA | 0xc0,
-+						   bus_width | sd_drive << 6);
-+
-+	if (host->power_mode == MMC_POWER_OFF)
-+		mmc_host_disable(host->mmc);
-+	else
-+		mmc_host_lazy_disable(host->mmc);
-+}
-+
-+static void glamo_mci_pre_request(struct mmc_host *mmc,
-+		struct mmc_request *mrq, bool is_first_req)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+
-+	mrq->data->host_cookie = (host->request_counter & 1) | 2;
-+
-+	/* if write, prep the write into the shared RAM before the command */
-+	if (mrq->data->flags & MMC_DATA_WRITE)
-+		do_pio_write(host, mrq->data);
-+}
-+
-+static void glamo_mci_post_request(struct mmc_host *mmc,
-+		struct mmc_request *mrq, int err)
-+{
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+
-+	if (!mrq->data->host_cookie)
-+		return;
-+
-+	if (err)
-+		return;
-+
-+	if (mrq->data->flags & MMC_DATA_READ)
-+		do_pio_read(host, mrq->data);
-+
-+	mrq->data->host_cookie = 0;
-+}
-+
-+static struct mmc_host_ops glamo_mci_ops = {
-+	.enable		= glamo_mci_clock_enable,
-+	.disable	= glamo_mci_clock_disable,
-+	.request	= glamo_mci_send_request,
-+	.post_req	= glamo_mci_post_request,
-+	.pre_req	= glamo_mci_pre_request,
-+	.set_ios	= glamo_mci_set_ios,
-+};
-+
-+static int __devinit glamo_mci_probe(struct platform_device *pdev)
-+{
-+	struct mmc_host *mmc;
-+	struct glamo_mci_host *host;
-+	struct glamo_core *core = dev_get_drvdata(pdev->dev.parent);
-+	int ret;
-+
-+	dev_info(&pdev->dev, "glamo_mci driver (C)2007 Openmoko, Inc\n");
-+
-+	mmc = mmc_alloc_host(sizeof(struct glamo_mci_host), &pdev->dev);
-+	if (!mmc) {
-+		ret = -ENOMEM;
-+		goto probe_out;
-+	}
-+
-+	host = mmc_priv(mmc);
-+	host->mmc = mmc;
-+	host->pdev = pdev;
-+	if (core->pdata)
-+		host->pdata = core->pdata->mmc_data;
-+	host->power_mode = MMC_POWER_OFF;
-+	host->core = core;
-+
-+	host->irq = platform_get_irq(pdev, 0);
-+
-+	host->regulator = regulator_get(pdev->dev.parent, "SD_3V3");
-+	if (IS_ERR(host->regulator)) {
-+		dev_err(&pdev->dev, "Cannot proceed without regulator.\n");
-+		ret = PTR_ERR(host->regulator);
-+		goto probe_free_host;
-+	}
-+
-+	host->mmio_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-+	if (!host->mmio_mem) {
-+		dev_err(&pdev->dev,
-+			"failed to get io memory region resouce.\n");
-+		ret = -ENOENT;
-+		goto probe_regulator_put;
-+	}
-+
-+	host->mmio_mem = request_mem_region(host->mmio_mem->start,
-+					    resource_size(host->mmio_mem),
-+					    pdev->name);
-+
-+	if (!host->mmio_mem) {
-+		dev_err(&pdev->dev, "failed to request io memory region.\n");
-+		ret = -ENOENT;
-+		goto probe_regulator_put;
-+	}
-+
-+	host->mmio_base = ioremap(host->mmio_mem->start,
-+				  resource_size(host->mmio_mem));
-+	if (!host->mmio_base) {
-+		dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
-+		ret = -EINVAL;
-+		goto probe_free_mem_region_mmio;
-+	}
-+
-+
-+	/* Get ahold of our data buffer we use for data in and out on MMC */
-+	host->data_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-+	if (!host->data_mem) {
-+		dev_err(&pdev->dev,
-+			"failed to get io memory region resource.\n");
-+		ret = -ENOENT;
-+		goto probe_iounmap_mmio;
-+	}
-+
-+	host->data_mem = request_mem_region(host->data_mem->start,
-+					    resource_size(host->data_mem),
-+					    pdev->name);
-+
-+	if (!host->data_mem) {
-+		dev_err(&pdev->dev, "failed to request io memory region.\n");
-+		ret = -ENOENT;
-+		goto probe_iounmap_mmio;
-+	}
-+	host->data_base = ioremap(host->data_mem->start,
-+				  resource_size(host->data_mem));
-+
-+	if (host->data_base == 0) {
-+		dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
-+		ret = -EINVAL;
-+		goto probe_free_mem_region_data;
-+	}
-+
-+	ret = request_threaded_irq(host->irq, NULL, glamo_mci_irq, IRQF_SHARED,
-+				   pdev->name, host);
-+	if (ret) {
-+		dev_err(&pdev->dev, "failed to register irq.\n");
-+		goto probe_iounmap_data;
-+	}
-+
-+
-+	host->vdd = 0;
-+	host->clk_rate = glamo_pll_rate(host->core, GLAMO_PLL1);
-+
-+	/* explain our host controller capabilities */
-+	mmc->ops	= &glamo_mci_ops;
-+	mmc->ocr_avail	= mmc_regulator_get_ocrmask(host->regulator);
-+	mmc->caps	= MMC_CAP_4_BIT_DATA |
-+			    MMC_CAP_MMC_HIGHSPEED |
-+			    MMC_CAP_SD_HIGHSPEED;
-+
-+	if (host->pdata->nonremovable)
-+		mmc->caps |= MMC_CAP_NONREMOVABLE;
-+
-+	mmc->f_min	= host->clk_rate / 256;
-+	mmc->f_max	= sd_max_clk;
-+
-+	mmc->max_blk_count = (1 << 16) - 1; /* GLAMO_REG_MMC_RB_BLKCNT */
-+	mmc->max_blk_size  = (1 << 12) - 1; /* GLAMO_REG_MMC_RB_BLKLEN */
-+	mmc->max_req_size  = resource_size(host->data_mem) / 2;
-+	mmc->max_seg_size  = mmc->max_req_size;
-+	mmc->max_segs = 128;
-+
-+	if (mmc->ocr_avail < 0) {
-+		dev_warn(&pdev->dev,
-+			"Failed to get ocr list for regulator: %d.\n",
-+			mmc->ocr_avail);
-+		mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-+	}
-+
-+	platform_set_drvdata(pdev, mmc);
-+
-+	mmc->caps |= MMC_CAP_DISABLE;
-+	mmc_set_disable_delay(mmc, 1000 / 16);
-+
-+	mmc_host_enable(mmc);
-+	glamo_mci_reset(host);
-+
-+	ret = mmc_add_host(mmc);
-+	if (ret) {
-+		dev_err(&pdev->dev, "failed to add mmc host.\n");
-+		goto probe_mmc_host_disable;
-+	}
-+
-+	mmc_host_lazy_disable(mmc);
-+
-+	return 0;
-+
-+probe_mmc_host_disable:
-+	mmc_host_disable(mmc);
-+	free_irq(host->irq, host);
-+probe_iounmap_data:
-+	iounmap(host->data_base);
-+probe_free_mem_region_data:
-+	release_mem_region(host->data_mem->start,
-+			   resource_size(host->data_mem));
-+probe_iounmap_mmio:
-+	iounmap(host->mmio_base);
-+probe_free_mem_region_mmio:
-+	release_mem_region(host->mmio_mem->start,
-+			   resource_size(host->mmio_mem));
-+probe_regulator_put:
-+	regulator_put(host->regulator);
-+probe_free_host:
-+	mmc_free_host(mmc);
-+probe_out:
-+	return ret;
-+}
-+
-+static int __devexit glamo_mci_remove(struct platform_device *pdev)
-+{
-+	struct mmc_host	*mmc = platform_get_drvdata(pdev);
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+
-+	mmc_host_enable(mmc);
-+	mmc_remove_host(mmc);
-+	mmc_host_disable(mmc);
-+
-+	synchronize_irq(host->irq);
-+	free_irq(host->irq, host);
-+
-+	iounmap(host->mmio_base);
-+	iounmap(host->data_base);
-+	release_mem_region(host->mmio_mem->start,
-+				resource_size(host->mmio_mem));
-+	release_mem_region(host->data_mem->start,
-+				resource_size(host->data_mem));
-+
-+	regulator_put(host->regulator);
-+
-+	mmc_free_host(mmc);
-+
-+	return 0;
-+}
-+
-+
-+#ifdef CONFIG_PM
-+
-+static int glamo_mci_suspend(struct device *dev)
-+{
-+	struct mmc_host *mmc = dev_get_drvdata(dev);
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	int ret;
-+
-+	disable_irq(host->irq);
-+
-+	mmc_host_enable(mmc);
-+	ret = mmc_suspend_host(mmc);
-+	mmc_host_disable(mmc);
-+
-+	return ret;
-+}
-+
-+static int glamo_mci_resume(struct device *dev)
-+{
-+	struct mmc_host *mmc = dev_get_drvdata(dev);
-+	struct glamo_mci_host *host = mmc_priv(mmc);
-+	int ret;
-+
-+	mmc_host_enable(mmc);
-+	glamo_mci_reset(host);
-+	mdelay(10);
-+
-+	enable_irq(host->irq);
-+
-+	ret = mmc_resume_host(host->mmc);
-+
-+	mmc_host_lazy_disable(host->mmc);
-+
-+	return ret;
-+}
-+
-+static SIMPLE_DEV_PM_OPS(glamo_mci_pm_ops, glamo_mci_suspend, glamo_mci_resume);
-+#define GLAMO_MCI_PM_OPS (&glamo_mci_pm_ops)
-+
-+#else /* CONFIG_PM */
-+#define GLAMO_MCI_PM_OPS NULL
-+#endif /* CONFIG_PM */
-+
-+
-+static struct platform_driver glamo_mci_driver = {
-+	.probe  = glamo_mci_probe,
-+	.remove = __devexit_p(glamo_mci_remove),
-+	.driver = {
-+		.name	= "glamo-mci",
-+		.owner	= THIS_MODULE,
-+		.pm	= GLAMO_MCI_PM_OPS,
-+	},
-+};
-+
-+static int __init glamo_mci_init(void)
-+{
-+	platform_driver_register(&glamo_mci_driver);
-+	return 0;
-+}
-+module_init(glamo_mci_init);
-+
-+static void __exit glamo_mci_exit(void)
-+{
-+	platform_driver_unregister(&glamo_mci_driver);
-+}
-+module_exit(glamo_mci_exit);
-+
-+MODULE_DESCRIPTION("Glamo MMC/SD Card Interface driver");
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_ALIAS("platform:glamo-mci");
-diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
-index 33d832d..cb5d2c0 100644
---- a/drivers/mtd/nand/s3c2410.c
-+++ b/drivers/mtd/nand/s3c2410.c
-@@ -813,7 +813,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
- 	nmtd->mtd.owner    = THIS_MODULE;
- 	nmtd->set	   = set;
- 
--	if (hardware_ecc) {
-+	if (!(info->platform && info->platform->software_ecc) && hardware_ecc) {
- 		chip->ecc.calculate = s3c2410_nand_calculate_ecc;
- 		chip->ecc.correct   = s3c2410_nand_correct_data;
- 		chip->ecc.mode	    = NAND_ECC_HW;
-diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
-index 52a462f..985f350 100644
---- a/drivers/power/Kconfig
-+++ b/drivers/power/Kconfig
-@@ -14,6 +14,12 @@ config POWER_SUPPLY_DEBUG
- 	  Say Y here to enable debugging messages for power supply class
- 	  and drivers.
- 
-+config BATTERY_PLATFORM
-+	tristate "Platform battery driver"
-+	help
-+	  Say Y here to include support for battery driver that gets all
-+	  information from platform functions.
-+
- config PDA_POWER
- 	tristate "Generic PDA/phone power driver"
- 	depends on !S390
-diff --git a/drivers/power/Makefile b/drivers/power/Makefile
-index 8385bfa..59530ee 100644
---- a/drivers/power/Makefile
-+++ b/drivers/power/Makefile
-@@ -14,6 +14,7 @@ obj-$(CONFIG_WM831X_POWER)	+= wm831x_power.o
- obj-$(CONFIG_WM8350_POWER)	+= wm8350_power.o
- obj-$(CONFIG_TEST_POWER)	+= test_power.o
- 
-+obj-$(CONFIG_BATTERY_PLATFORM)	+= platform_battery.o
- obj-$(CONFIG_BATTERY_DS2760)	+= ds2760_battery.o
- obj-$(CONFIG_BATTERY_DS2782)	+= ds2782_battery.o
- obj-$(CONFIG_BATTERY_PMU)	+= pmu_battery.o
-diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
-index 4fa52e1..97dbcb2 100644
---- a/drivers/power/pcf50633-charger.c
-+++ b/drivers/power/pcf50633-charger.c
-@@ -24,9 +24,27 @@
- #include <linux/platform_device.h>
- #include <linux/power_supply.h>
- 
-+#include <linux/interrupt.h>
-+
- #include <linux/mfd/pcf50633/core.h>
- #include <linux/mfd/pcf50633/mbc.h>
- 
-+enum pcf50633_mbc_irqs {
-+	PCF50633_MBC_IRQ_ADPINS,
-+	PCF50633_MBC_IRQ_ADPREM,
-+	PCF50633_MBC_IRQ_USBINS,
-+	PCF50633_MBC_IRQ_USBREM,
-+	PCF50633_MBC_IRQ_BATFULL,
-+	PCF50633_MBC_IRQ_CHGHALT,
-+	PCF50633_MBC_IRQ_THLIMON,
-+	PCF50633_MBC_IRQ_THLIMOFF,
-+	PCF50633_MBC_IRQ_USBLIMON,
-+	PCF50633_MBC_IRQ_USBLIMOFF,
-+	PCF50633_MBC_IRQ_LOWSYS,
-+	PCF50633_MBC_IRQ_LOWBAT,
-+	PCF50633_MBC_NUM_IRQS,
-+};
-+
- struct pcf50633_mbc {
- 	struct pcf50633 *pcf;
- 
-@@ -36,11 +54,13 @@ struct pcf50633_mbc {
- 	struct power_supply usb;
- 	struct power_supply adapter;
- 	struct power_supply ac;
-+
-+	int irqs[PCF50633_MBC_NUM_IRQS];
- };
- 
--int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
-+static int __pcf50633_mbc_usb_curlim_set(struct pcf50633_mbc *mbc, int ma)
- {
--	struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
-+	struct pcf50633 *pcf = mbc->pcf;
- 	int ret = 0;
- 	u8 bits;
- 	int charging_start = 1;
-@@ -80,14 +100,14 @@ int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
- 	 * gets reset to the wrong thing
- 	 */
- 
--	if (mbc->pcf->pdata->charger_reference_current_ma) {
--		mbcc5 = (ma << 8) / mbc->pcf->pdata->charger_reference_current_ma;
-+	if (pcf->pdata->charger_reference_current_ma) {
-+		mbcc5 = (ma << 8) / pcf->pdata->charger_reference_current_ma;
- 		if (mbcc5 > 255)
- 			mbcc5 = 255;
--		pcf50633_reg_write(mbc->pcf, PCF50633_REG_MBCC5, mbcc5);
-+		pcf50633_reg_write(pcf, PCF50633_REG_MBCC5, mbcc5);
- 	}
- 
--	mbcs2 = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS2);
-+	mbcs2 = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
- 	chgmod = (mbcs2 & PCF50633_MBCS2_MBC_MASK);
- 
- 	/* If chgmod == BATFULL, setting chgena has no effect.
-@@ -108,18 +128,29 @@ int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
- 
- 	return ret;
- }
-+
-+int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
-+{
-+	struct pcf50633_mbc *mbc = pcf->mbc;
-+
-+	if (!mbc)
-+		return -ENODEV;
-+
-+	return __pcf50633_mbc_usb_curlim_set(mbc, ma);
-+}
- EXPORT_SYMBOL_GPL(pcf50633_mbc_usb_curlim_set);
- 
-+
- int pcf50633_mbc_get_status(struct pcf50633 *pcf)
- {
--	struct pcf50633_mbc *mbc  = platform_get_drvdata(pcf->mbc_pdev);
-+	struct pcf50633_mbc *mbc = pcf->mbc;
- 	int status = 0;
- 	u8 chgmod;
- 
- 	if (!mbc)
- 		return 0;
- 
--	chgmod = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS2)
-+	chgmod = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2)
- 		& PCF50633_MBCS2_MBC_MASK;
- 
- 	if (mbc->usb_online)
-@@ -143,7 +174,7 @@ EXPORT_SYMBOL_GPL(pcf50633_mbc_get_status);
- 
- int pcf50633_mbc_get_usb_online_status(struct pcf50633 *pcf)
- {
--	struct pcf50633_mbc *mbc  = platform_get_drvdata(pcf->mbc_pdev);
-+	struct pcf50633_mbc *mbc = pcf->mbc;
- 
- 	if (!mbc)
- 		return 0;
-@@ -195,7 +226,7 @@ static ssize_t set_usblim(struct device *dev,
- 	if (ret)
- 		return -EINVAL;
- 
--	pcf50633_mbc_usb_curlim_set(mbc->pcf, ma);
-+	__pcf50633_mbc_usb_curlim_set(mbc, ma);
- 
- 	return count;
- }
-@@ -259,31 +290,34 @@ static struct attribute_group mbc_attr_group = {
- 	.attrs	= pcf50633_mbc_sysfs_entries,
- };
- 
--static void
--pcf50633_mbc_irq_handler(int irq, void *data)
-+static irqreturn_t pcf50633_mbc_irq_handler(int irq, void *data)
- {
- 	struct pcf50633_mbc *mbc = data;
- 
- 	/* USB */
--	if (irq == PCF50633_IRQ_USBINS) {
-+	if (irq == mbc->irqs[PCF50633_MBC_IRQ_USBINS]) {
- 		mbc->usb_online = 1;
--	} else if (irq == PCF50633_IRQ_USBREM) {
-+	} else if (irq == mbc->irqs[PCF50633_MBC_IRQ_USBREM]) {
- 		mbc->usb_online = 0;
--		pcf50633_mbc_usb_curlim_set(mbc->pcf, 0);
-+		__pcf50633_mbc_usb_curlim_set(mbc, 0);
- 	}
- 
- 	/* Adapter */
--	if (irq == PCF50633_IRQ_ADPINS)
-+	if (irq == mbc->irqs[PCF50633_MBC_IRQ_ADPINS])
- 		mbc->adapter_online = 1;
--	else if (irq == PCF50633_IRQ_ADPREM)
-+	else if (irq == mbc->irqs[PCF50633_MBC_IRQ_ADPREM])
- 		mbc->adapter_online = 0;
- 
- 	power_supply_changed(&mbc->ac);
- 	power_supply_changed(&mbc->usb);
- 	power_supply_changed(&mbc->adapter);
- 
--	if (mbc->pcf->pdata->mbc_event_callback)
-+	if (mbc->pcf->pdata->mbc_event_callback) {
-+		irq -= mbc->pcf->irq_base;
- 		mbc->pcf->pdata->mbc_event_callback(mbc->pcf, irq);
-+	}
-+
-+	return IRQ_HANDLED;
- }
- 
- static int adapter_get_property(struct power_supply *psy,
-@@ -351,25 +385,27 @@ static enum power_supply_property power_props[] = {
- 	POWER_SUPPLY_PROP_ONLINE,
- };
- 
--static const u8 mbc_irq_handlers[] = {
--	PCF50633_IRQ_ADPINS,
--	PCF50633_IRQ_ADPREM,
--	PCF50633_IRQ_USBINS,
--	PCF50633_IRQ_USBREM,
--	PCF50633_IRQ_BATFULL,
--	PCF50633_IRQ_CHGHALT,
--	PCF50633_IRQ_THLIMON,
--	PCF50633_IRQ_THLIMOFF,
--	PCF50633_IRQ_USBLIMON,
--	PCF50633_IRQ_USBLIMOFF,
--	PCF50633_IRQ_LOWSYS,
--	PCF50633_IRQ_LOWBAT,
-+static const char *pcf50633_mbc_irq_names[PCF50633_MBC_NUM_IRQS] = {
-+	"ADPINS",
-+	"ADPREM",
-+	"USBINS",
-+	"USBREM",
-+	"BATFULL",
-+	"CHGHALT",
-+	"THLIMON",
-+	"THLIMOFF",
-+	"USBLIMON",
-+	"USBLIMOFF",
-+	"LOWSYS",
-+	"LOWBAT",
- };
- 
- static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- {
-+	struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
- 	struct pcf50633_mbc *mbc;
- 	int ret;
-+	int irq;
- 	int i;
- 	u8 mbcs1;
- 
-@@ -377,13 +413,19 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- 	if (!mbc)
- 		return -ENOMEM;
- 
--	platform_set_drvdata(pdev, mbc);
--	mbc->pcf = dev_to_pcf50633(pdev->dev.parent);
-+	for (i = 0; i < PCF50633_MBC_NUM_IRQS; ++i) {
-+		irq = platform_get_irq_byname(pdev, pcf50633_mbc_irq_names[i]);
-+		if (irq <= 0) {
-+			dev_err(&pdev->dev, "Failed to get %s irq: %d\n",
-+					pcf50633_mbc_irq_names[i], irq);
-+			ret = irq ?: -EINVAL;
-+			goto err_free;
-+		}
-+		mbc->irqs[i] = irq;
-+	}
- 
--	/* Set up IRQ handlers */
--	for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
--		pcf50633_register_irq(mbc->pcf, mbc_irq_handlers[i],
--					pcf50633_mbc_irq_handler, mbc);
-+	platform_set_drvdata(pdev, mbc);
-+	mbc->pcf = pcf;
- 
- 	/* Create power supplies */
- 	mbc->adapter.name		= "adapter";
-@@ -413,38 +455,63 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- 	ret = power_supply_register(&pdev->dev, &mbc->adapter);
- 	if (ret) {
- 		dev_err(mbc->pcf->dev, "failed to register adapter\n");
--		kfree(mbc);
--		return ret;
-+		goto err_free;
- 	}
- 
- 	ret = power_supply_register(&pdev->dev, &mbc->usb);
- 	if (ret) {
- 		dev_err(mbc->pcf->dev, "failed to register usb\n");
--		power_supply_unregister(&mbc->adapter);
--		kfree(mbc);
--		return ret;
-+		goto err_unregister_adapter;
- 	}
- 
- 	ret = power_supply_register(&pdev->dev, &mbc->ac);
- 	if (ret) {
- 		dev_err(mbc->pcf->dev, "failed to register ac\n");
--		power_supply_unregister(&mbc->adapter);
--		power_supply_unregister(&mbc->usb);
--		kfree(mbc);
--		return ret;
-+		goto err_unregister_usb;
- 	}
- 
- 	ret = sysfs_create_group(&pdev->dev.kobj, &mbc_attr_group);
--	if (ret)
-+	if (ret) {
- 		dev_err(mbc->pcf->dev, "failed to create sysfs entries\n");
-+		goto err_unregister_ac;
-+	}
-+
-+	/* Set up IRQ handlers */
-+	for (i = 0; i < PCF50633_MBC_NUM_IRQS; ++i) {
-+		ret = request_threaded_irq(mbc->irqs[i], NULL,
-+				pcf50633_mbc_irq_handler, 0,
-+				pcf50633_mbc_irq_names[i], mbc);
-+		if (ret) {
-+			dev_err(&pdev->dev, "Failed to request %s irq: %d\n",
-+						pcf50633_mbc_irq_names[i], ret);
-+			goto err_free_irq;
-+		}
-+	}
- 
- 	mbcs1 = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS1);
- 	if (mbcs1 & PCF50633_MBCS1_USBPRES)
--		pcf50633_mbc_irq_handler(PCF50633_IRQ_USBINS, mbc);
-+		pcf50633_mbc_irq_handler(mbc->irqs[PCF50633_MBC_IRQ_USBINS], mbc);
- 	if (mbcs1 & PCF50633_MBCS1_ADAPTPRES)
--		pcf50633_mbc_irq_handler(PCF50633_IRQ_ADPINS, mbc);
-+		pcf50633_mbc_irq_handler(mbc->irqs[PCF50633_MBC_IRQ_ADPINS], mbc);
-+
-+	pcf->mbc = mbc;
- 
- 	return 0;
-+
-+err_free_irq:
-+	for (--i; i >= 0; --i)
-+		free_irq(mbc->irqs[i], mbc);
-+	sysfs_remove_group(&pdev->dev.kobj, &mbc_attr_group);
-+err_unregister_ac:
-+	power_supply_unregister(&mbc->ac);
-+err_unregister_usb:
-+	power_supply_unregister(&mbc->usb);
-+err_unregister_adapter:
-+	power_supply_unregister(&mbc->adapter);
-+err_free:
-+	kfree(mbc);
-+
-+	return ret;
- }
- 
- static int __devexit pcf50633_mbc_remove(struct platform_device *pdev)
-@@ -452,9 +519,11 @@ static int __devexit pcf50633_mbc_remove(struct platform_device *pdev)
- 	struct pcf50633_mbc *mbc = platform_get_drvdata(pdev);
- 	int i;
- 
-+	mbc->pcf->mbc = NULL;
-+
- 	/* Remove IRQ handlers */
--	for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
--		pcf50633_free_irq(mbc->pcf, mbc_irq_handlers[i]);
-+	for (i = PCF50633_MBC_NUM_IRQS - 1; i >= 0; --i)
-+		free_irq(mbc->irqs[i], mbc);
- 
- 	sysfs_remove_group(&pdev->dev.kobj, &mbc_attr_group);
- 	power_supply_unregister(&mbc->usb);
-diff --git a/drivers/power/platform_battery.c b/drivers/power/platform_battery.c
-new file mode 100644
-index 0000000..a5c9f35
---- /dev/null
-+++ b/drivers/power/platform_battery.c
-@@ -0,0 +1,120 @@
-+/*
-+ * Driver for platform battery
-+ *
-+ * Copyright (c) Paul Fertser <fercerpav@gmail.com>
-+ * Inspired by Balaji Rao <balajirrao@openmoko.org>
-+ *
-+ * This driver can be used for dumb batteries when all knowledge about
-+ * their state belongs to the platform that does necessary ADC readings,
-+ * conversions, guessimations etc.
-+ *
-+ * Use consistent with the GNU GPL is permitted, provided that this
-+ * copyright notice is preserved in its entirety in all copies and derived
-+ * works.
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/platform_device.h>
-+#include <linux/power_supply.h>
-+#include <linux/slab.h>
-+#include <linux/workqueue.h>
-+
-+#include <linux/delay.h>
-+#include <linux/platform_battery.h>
-+
-+struct platform_battery {
-+	struct power_supply psy;
-+	struct platform_bat_platform_data *pdata;
-+};
-+
-+static int platform_bat_get_property(struct power_supply *psy,
-+				       enum power_supply_property psp,
-+				       union power_supply_propval *val)
-+{
-+	struct platform_battery *bat =
-+				container_of(psy, struct platform_battery, psy);
-+	size_t i;
-+	int present=1;
-+
-+	if (bat->pdata->is_present)
-+		present = bat->pdata->is_present();
-+
-+	if (psp != POWER_SUPPLY_PROP_PRESENT && !present)
-+		return -ENODEV;
-+
-+	for (i = 0; i < psy->num_properties; i++)
-+		if (psy->properties[i] == psp) {
-+			val->intval = bat->pdata->get_property[i]();
-+			return 0;
-+		}
-+
-+	return -EINVAL;
-+}
-+
-+static void platform_bat_ext_changed(struct power_supply *psy)
-+{
-+	struct platform_battery *bat =
-+				container_of(psy, struct platform_battery, psy);
-+	power_supply_changed(&bat->psy);
-+}
-+
-+static int platform_battery_probe(struct platform_device *pdev)
-+{
-+	struct platform_battery *platform_bat;
-+	struct platform_bat_platform_data *pdata =
-+		(struct platform_bat_platform_data *)pdev->dev.platform_data;
-+
-+	platform_bat = kzalloc(sizeof(*platform_bat), GFP_KERNEL);
-+	if (!platform_bat)
-+		return -ENOMEM;
-+
-+	if (pdata->name)
-+		platform_bat->psy.name = pdata->name;
-+	else
-+		platform_bat->psy.name = dev_name(&pdev->dev);
-+	platform_bat->psy.type = POWER_SUPPLY_TYPE_BATTERY;
-+	platform_bat->psy.properties = pdata->properties;
-+	platform_bat->psy.num_properties = pdata->num_properties;
-+	platform_bat->psy.get_property = platform_bat_get_property;
-+	platform_bat->psy.external_power_changed = platform_bat_ext_changed;
-+
-+	platform_bat->pdata = pdata;
-+	platform_set_drvdata(pdev, platform_bat);
-+	power_supply_register(&pdev->dev, &platform_bat->psy);
-+
-+	return 0;
-+}
-+
-+static int platform_battery_remove(struct platform_device *pdev)
-+{
-+	struct platform_battery *bat = platform_get_drvdata(pdev);
-+
-+	power_supply_unregister(&bat->psy);
-+	kfree(bat);
-+
-+	return 0;
-+}
-+
-+static struct platform_driver platform_battery_driver = {
-+	.driver = {
-+		.name = "platform_battery",
-+	},
-+	.probe	  = platform_battery_probe,
-+	.remove   = platform_battery_remove,
-+};
-+
-+static int __init platform_battery_init(void)
-+{
-+	return platform_driver_register(&platform_battery_driver);
-+}
-+module_init(platform_battery_init);
-+
-+static void __exit platform_battery_exit(void)
-+{
-+	platform_driver_unregister(&platform_battery_driver);
-+}
-+module_exit(platform_battery_exit);
-+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Paul Fertser <fercerpav@gmail.com>");
-+MODULE_DESCRIPTION("platform battery driver");
-diff --git a/drivers/regulator/pcf50633-regulator.c b/drivers/regulator/pcf50633-regulator.c
-index 69a11d9..5e7deb5 100644
---- a/drivers/regulator/pcf50633-regulator.c
-+++ b/drivers/regulator/pcf50633-regulator.c
-@@ -316,11 +316,10 @@ static int __devinit pcf50633_regulator_probe(struct platform_device *pdev)
- 	struct regulator_dev *rdev;
- 	struct pcf50633 *pcf;
- 
--	/* Already set by core driver */
- 	pcf = dev_to_pcf50633(pdev->dev.parent);
- 
- 	rdev = regulator_register(&regulators[pdev->id], &pdev->dev,
--				  pdev->dev.platform_data, pcf);
-+				  &pcf->pdata->reg_init_data[pdev->id], pcf);
- 	if (IS_ERR(rdev))
- 		return PTR_ERR(rdev);
- 
-diff --git a/drivers/rtc/rtc-pcf50633.c b/drivers/rtc/rtc-pcf50633.c
-index f90c574..b0dc8c2 100644
---- a/drivers/rtc/rtc-pcf50633.c
-+++ b/drivers/rtc/rtc-pcf50633.c
-@@ -58,11 +58,12 @@ struct pcf50633_time {
- 
- struct pcf50633_rtc {
- 	int alarm_enabled;
--	int second_enabled;
- 	int alarm_pending;
- 
- 	struct pcf50633 *pcf;
- 	struct rtc_device *rtc_dev;
-+
-+	int irq_alarm;
- };
- 
- static void pcf2rtc_time(struct rtc_time *rtc, struct pcf50633_time *pcf)
-@@ -91,15 +92,11 @@ static int
- pcf50633_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
- {
- 	struct pcf50633_rtc *rtc = dev_get_drvdata(dev);
--	int err;
--
--	if (enabled)
--		err = pcf50633_irq_unmask(rtc->pcf, PCF50633_IRQ_ALARM);
--	else
--		err = pcf50633_irq_mask(rtc->pcf, PCF50633_IRQ_ALARM);
- 
--	if (err < 0)
--		return err;
-+	if (enabled && !rtc->alarm_enabled)
-+		enable_irq(rtc->irq_alarm);
-+	else if (!enabled && rtc->alarm_enabled)
-+		disable_irq(rtc->irq_alarm);
- 
- 	rtc->alarm_enabled = enabled;
- 
-@@ -143,7 +140,7 @@ static int pcf50633_rtc_set_time(struct device *dev, struct rtc_time *tm)
- {
- 	struct pcf50633_rtc *rtc;
- 	struct pcf50633_time pcf_tm;
--	int second_masked, alarm_masked, ret = 0;
-+	int ret = 0;
- 
- 	rtc = dev_get_drvdata(dev);
- 
-@@ -162,23 +159,16 @@ static int pcf50633_rtc_set_time(struct device *dev, struct rtc_time *tm)
- 		pcf_tm.time[PCF50633_TI_SEC]);
- 
- 
--	second_masked = pcf50633_irq_mask_get(rtc->pcf, PCF50633_IRQ_SECOND);
--	alarm_masked = pcf50633_irq_mask_get(rtc->pcf, PCF50633_IRQ_ALARM);
--
--	if (!second_masked)
--		pcf50633_irq_mask(rtc->pcf, PCF50633_IRQ_SECOND);
--	if (!alarm_masked)
--		pcf50633_irq_mask(rtc->pcf, PCF50633_IRQ_ALARM);
-+	if (rtc->alarm_enabled)
-+		disable_irq(rtc->irq_alarm);
- 
- 	/* Returns 0 on success */
- 	ret = pcf50633_write_block(rtc->pcf, PCF50633_REG_RTCSC,
- 					     PCF50633_TI_EXTENT,
- 					     &pcf_tm.time[0]);
- 
--	if (!second_masked)
--		pcf50633_irq_unmask(rtc->pcf, PCF50633_IRQ_SECOND);
--	if (!alarm_masked)
--		pcf50633_irq_unmask(rtc->pcf, PCF50633_IRQ_ALARM);
-+	if (rtc->alarm_enabled)
-+		enable_irq(rtc->irq_alarm);
- 
- 	return ret;
- }
-@@ -210,7 +200,7 @@ static int pcf50633_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
- {
- 	struct pcf50633_rtc *rtc;
- 	struct pcf50633_time pcf_tm;
--	int alarm_masked, ret = 0;
-+	int ret = 0;
- 
- 	rtc = dev_get_drvdata(dev);
- 
-@@ -219,11 +209,9 @@ static int pcf50633_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
- 	/* do like mktime does and ignore tm_wday */
- 	pcf_tm.time[PCF50633_TI_WKDAY] = 7;
- 
--	alarm_masked = pcf50633_irq_mask_get(rtc->pcf, PCF50633_IRQ_ALARM);
--
- 	/* disable alarm interrupt */
--	if (!alarm_masked)
--		pcf50633_irq_mask(rtc->pcf, PCF50633_IRQ_ALARM);
-+	if (rtc->alarm_enabled)
-+		disable_irq(rtc->irq_alarm);
- 
- 	/* Returns 0 on success */
- 	ret = pcf50633_write_block(rtc->pcf, PCF50633_REG_RTCSCA,
-@@ -231,8 +219,8 @@ static int pcf50633_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
- 	if (!alrm->enabled)
- 		rtc->alarm_pending = 0;
- 
--	if (!alarm_masked || alrm->enabled)
--		pcf50633_irq_unmask(rtc->pcf, PCF50633_IRQ_ALARM);
-+	if (!rtc->alarm_enabled && alrm->enabled)
-+		enable_irq(rtc->irq_alarm);
- 	rtc->alarm_enabled = alrm->enabled;
- 
- 	return ret;
-@@ -246,24 +234,26 @@ static struct rtc_class_ops pcf50633_rtc_ops = {
- 	.alarm_irq_enable	= pcf50633_rtc_alarm_irq_enable,
- };
- 
--static void pcf50633_rtc_irq(int irq, void *data)
-+static irqreturn_t pcf50633_rtc_alarm_irq(int irq, void *data)
- {
- 	struct pcf50633_rtc *rtc = data;
-+	rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
-+	rtc->alarm_pending = 1;
- 
--	switch (irq) {
--	case PCF50633_IRQ_ALARM:
--		rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
--		rtc->alarm_pending = 1;
--		break;
--	case PCF50633_IRQ_SECOND:
--		rtc_update_irq(rtc->rtc_dev, 1, RTC_UF | RTC_IRQF);
--		break;
--	}
-+	return IRQ_HANDLED;
- }
- 
- static int __devinit pcf50633_rtc_probe(struct platform_device *pdev)
- {
- 	struct pcf50633_rtc *rtc;
-+	int irq_alarm;
-+	int ret;
-+
-+	irq_alarm = platform_get_irq_byname(pdev, "ALARM");
-+	if (irq_alarm <= 0) {
-+		dev_err(&pdev->dev, "Failed to get alarm irq: %d\n", irq_alarm);
-+		return irq_alarm ?: -EINVAL;
-+	}
- 
- 	rtc = kzalloc(sizeof(*rtc), GFP_KERNEL);
- 	if (!rtc)
-@@ -280,12 +270,23 @@ static int __devinit pcf50633_rtc_probe(struct platform_device *pdev)
- 		return ret;
- 	}
- 
--	pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM,
--					pcf50633_rtc_irq, rtc);
--	pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_SECOND,
--					pcf50633_rtc_irq, rtc);
-+	ret = request_threaded_irq(irq_alarm, NULL, pcf50633_rtc_alarm_irq, 0,
-+			"pcf50633-rtc alarm", rtc);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to request alarm irq: %d\n", ret);
-+		goto err_free;
-+	}
-+	disable_irq(irq_alarm);
-+
-+	rtc->irq_alarm = irq_alarm;
- 
- 	return 0;
-+
-+err_free_irq:
-+	free_irq(irq_alarm, rtc);
-+err_free:
-+	kfree(rtc);
-+	return ret;
- }
- 
- static int __devexit pcf50633_rtc_remove(struct platform_device *pdev)
-@@ -294,8 +295,7 @@ static int __devexit pcf50633_rtc_remove(struct platform_device *pdev)
- 
- 	rtc = platform_get_drvdata(pdev);
- 
--	pcf50633_free_irq(rtc->pcf, PCF50633_IRQ_ALARM);
--	pcf50633_free_irq(rtc->pcf, PCF50633_IRQ_SECOND);
-+	free_irq(rtc->irq_alarm, rtc);
- 
- 	rtc_device_unregister(rtc->rtc_dev);
- 	kfree(rtc);
-diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
-index 9e2fa8d..318093c 100644
---- a/drivers/tty/serial/samsung.c
-+++ b/drivers/tty/serial/samsung.c
-@@ -1268,6 +1268,13 @@ module_exit(s3c24xx_serial_modexit);
- #ifdef CONFIG_SERIAL_SAMSUNG_CONSOLE
- 
- static struct uart_port *cons_uart;
-+static int cons_silenced;
-+
-+void s3c24xx_serial_console_set_silence(int silenced)
-+{
-+	cons_silenced = silenced;
-+}
-+EXPORT_SYMBOL(s3c24xx_serial_console_set_silence);
- 
- static int
- s3c24xx_serial_console_txrdy(struct uart_port *port, unsigned int ufcon)
-@@ -1292,9 +1299,21 @@ static void
- s3c24xx_serial_console_putchar(struct uart_port *port, int ch)
- {
- 	unsigned int ufcon = rd_regl(cons_uart, S3C2410_UFCON);
-+	unsigned int umcon = rd_regl(cons_uart, S3C2410_UMCON);
-+
-+	if (cons_silenced)
-+		return;
-+
-+	/* If auto HW flow control enabled, temporarily turn it off */
-+	if (umcon & S3C2410_UMCOM_AFC)
-+		wr_regl(port, S3C2410_UMCON, (umcon & !S3C2410_UMCOM_AFC));
-+
- 	while (!s3c24xx_serial_console_txrdy(port, ufcon))
- 		barrier();
- 	wr_regb(cons_uart, S3C2410_UTXH, ch);
-+
-+	if (umcon & S3C2410_UMCOM_AFC)
-+		wr_regl(port, S3C2410_UMCON, umcon);
- }
- 
- static void
-diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
-index e6a8d8c..03ff799 100644
---- a/drivers/video/Kconfig
-+++ b/drivers/video/Kconfig
-@@ -2341,6 +2341,23 @@ config FB_PUV3_UNIGFX
- 	  Choose this option if you want to use the Unigfx device as a
- 	  framebuffer device. Without the support of PCI & AGP.
- 
-+config FB_GLAMO
-+	tristate "Smedia Glamo 336x/337x framebuffer support"
-+	depends on FB && MFD_GLAMO
-+	select FB_CFB_FILLRECT
-+	select FB_CFB_COPYAREA
-+	select FB_CFB_IMAGEBLIT
-+	help
-+	  Frame buffer driver for the LCD controller in the Smedia Glamo
-+	  336x/337x.
-+
-+	  This driver is also available as a module ( = code which can be
-+	  inserted and removed from the running kernel whenever you want). The
-+	  module will be called glamofb. If you want to compile it as a module,
-+	  say M here and read <file:Documentation/modules.txt>.
-+
-+	  If unsure, say N.
-+
- source "drivers/video/omap/Kconfig"
- source "drivers/video/omap2/Kconfig"
- 
-diff --git a/drivers/video/Makefile b/drivers/video/Makefile
-index 2ea44b6..c92cacf 100644
---- a/drivers/video/Makefile
-+++ b/drivers/video/Makefile
-@@ -140,6 +140,7 @@ obj-$(CONFIG_FB_MSM)              += msm/
- obj-$(CONFIG_FB_NUC900)           += nuc900fb.o
- obj-$(CONFIG_FB_JZ4740)		  += jz4740_fb.o
- obj-$(CONFIG_FB_PUV3_UNIGFX)      += fb-puv3.o
-+obj-$(CONFIG_FB_GLAMO)            += glamo-fb.o
- 
- # Platform or fallback drivers go here
- obj-$(CONFIG_FB_UVESA)            += uvesafb.o
-diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
-index 0c9373b..664509e 100644
---- a/drivers/video/backlight/Kconfig
-+++ b/drivers/video/backlight/Kconfig
-@@ -117,6 +117,20 @@ config LCD_LD9040
- 	  If you have an LD9040 Panel, say Y to enable its
- 	  control driver.
- 
-+config LCD_JBT6K74
-+	tristate "TPO JBT6K74-AS TFT display ASIC control interface"
-+	depends on SPI_MASTER && SYSFS && LCD_CLASS_DEVICE
-+	help
-+	  SPI driver for the control interface of TFT panels containing
-+	  the TPO JBT6K74-AS controller ASIC, such as the TPO TD028TTEC1
-+	  TFT diplay module used in the Openmoko Freerunner GSM phone.
-+
-+	  The control interface is required for display operation, as it
-+	  controls power management, display timing and gamma calibration.
-+
-+	  This driver can also be build as a module, if so it will be called
-+	  jbt6k74.
-+
- endif # LCD_CLASS_DEVICE
- 
- #
-diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
-index b9ca849..fe67e97 100644
---- a/drivers/video/backlight/Makefile
-+++ b/drivers/video/backlight/Makefile
-@@ -13,6 +13,7 @@ obj-$(CONFIG_LCD_TDO24M)	   += tdo24m.o
- obj-$(CONFIG_LCD_TOSA)		   += tosa_lcd.o
- obj-$(CONFIG_LCD_S6E63M0)	+= s6e63m0.o
- obj-$(CONFIG_LCD_LD9040)	+= ld9040.o
-+obj-$(CONFIG_LCD_JBT6K74) 	   += jbt6k74.o
- 
- obj-$(CONFIG_BACKLIGHT_CLASS_DEVICE) += backlight.o
- obj-$(CONFIG_BACKLIGHT_ATMEL_PWM)    += atmel-pwm-bl.o
-diff --git a/drivers/video/backlight/jbt6k74.c b/drivers/video/backlight/jbt6k74.c
-new file mode 100644
-index 0000000..d53a366
---- /dev/null
-+++ b/drivers/video/backlight/jbt6k74.c
-@@ -0,0 +1,895 @@
-+/* Linux kernel driver for the tpo JBT6K74-AS LCM ASIC
-+ *
-+ * Copyright (C) 2006-2007 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>,
-+ *	Stefan Schmidt <stefan@openmoko.org>
-+ * Copyright (C) 2008 by Harald Welte <laforge@openmoko.org>
-+ * Copyright (C) 2009 by Lars-Peter Clausen <lars@metafoo.de>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ *
-+ */
-+
-+#include <linux/kernel.h>
-+#include <linux/types.h>
-+#include <linux/module.h>
-+#include <linux/device.h>
-+#include <linux/platform_device.h>
-+#include <linux/delay.h>
-+#include <linux/workqueue.h>
-+#include <linux/jbt6k74.h>
-+#include <linux/fb.h>
-+#include <linux/lcd.h>
-+#include <linux/time.h>
-+#include <linux/regulator/consumer.h>
-+#include <linux/gpio.h>
-+
-+enum jbt6k74_register {
-+	JBT_REG_SLEEP_IN		= 0x10,
-+	JBT_REG_SLEEP_OUT		= 0x11,
-+
-+	JBT_REG_DISPLAY_OFF		= 0x28,
-+	JBT_REG_DISPLAY_ON		= 0x29,
-+
-+	JBT_REG_RGB_FORMAT		= 0x3a,
-+	JBT_REG_QUAD_RATE		= 0x3b,
-+
-+	JBT_REG_POWER_ON_OFF		= 0xb0,
-+	JBT_REG_BOOSTER_OP		= 0xb1,
-+	JBT_REG_BOOSTER_MODE		= 0xb2,
-+	JBT_REG_BOOSTER_FREQ		= 0xb3,
-+	JBT_REG_OPAMP_SYSCLK		= 0xb4,
-+	JBT_REG_VSC_VOLTAGE		= 0xb5,
-+	JBT_REG_VCOM_VOLTAGE		= 0xb6,
-+	JBT_REG_EXT_DISPL		= 0xb7,
-+	JBT_REG_OUTPUT_CONTROL		= 0xb8,
-+	JBT_REG_DCCLK_DCEV		= 0xb9,
-+	JBT_REG_DISPLAY_MODE1		= 0xba,
-+	JBT_REG_DISPLAY_MODE2		= 0xbb,
-+	JBT_REG_DISPLAY_MODE		= 0xbc,
-+	JBT_REG_ASW_SLEW		= 0xbd,
-+	JBT_REG_DUMMY_DISPLAY		= 0xbe,
-+	JBT_REG_DRIVE_SYSTEM		= 0xbf,
-+
-+	JBT_REG_SLEEP_OUT_FR_A		= 0xc0,
-+	JBT_REG_SLEEP_OUT_FR_B		= 0xc1,
-+	JBT_REG_SLEEP_OUT_FR_C		= 0xc2,
-+	JBT_REG_SLEEP_IN_LCCNT_D	= 0xc3,
-+	JBT_REG_SLEEP_IN_LCCNT_E	= 0xc4,
-+	JBT_REG_SLEEP_IN_LCCNT_F	= 0xc5,
-+	JBT_REG_SLEEP_IN_LCCNT_G	= 0xc6,
-+
-+	JBT_REG_GAMMA1_FINE_1		= 0xc7,
-+	JBT_REG_GAMMA1_FINE_2		= 0xc8,
-+	JBT_REG_GAMMA1_INCLINATION	= 0xc9,
-+	JBT_REG_GAMMA1_BLUE_OFFSET	= 0xca,
-+
-+	/* VGA */
-+	JBT_REG_BLANK_CONTROL		= 0xcf,
-+	JBT_REG_BLANK_TH_TV		= 0xd0,
-+	JBT_REG_CKV_ON_OFF		= 0xd1,
-+	JBT_REG_CKV_1_2			= 0xd2,
-+	JBT_REG_OEV_TIMING		= 0xd3,
-+	JBT_REG_ASW_TIMING_1		= 0xd4,
-+	JBT_REG_ASW_TIMING_2		= 0xd5,
-+
-+	/* QVGA */
-+	JBT_REG_BLANK_CONTROL_QVGA	= 0xd6,
-+	JBT_REG_BLANK_TH_TV_QVGA	= 0xd7,
-+	JBT_REG_CKV_ON_OFF_QVGA		= 0xd8,
-+	JBT_REG_CKV_1_2_QVGA		= 0xd9,
-+	JBT_REG_OEV_TIMING_QVGA		= 0xde,
-+	JBT_REG_ASW_TIMING_1_QVGA	= 0xdf,
-+	JBT_REG_ASW_TIMING_2_QVGA	= 0xe0,
-+
-+
-+	JBT_REG_HCLOCK_VGA		= 0xec,
-+	JBT_REG_HCLOCK_QVGA		= 0xed,
-+};
-+
-+enum jbt6k74_resolution {
-+	JBT_RESOLUTION_VGA,
-+	JBT_RESOLUTION_QVGA,
-+};
-+
-+enum jbt6k74_power_mode {
-+	JBT_POWER_MODE_DEEP_STANDBY,
-+	JBT_POWER_MODE_SLEEP,
-+	JBT_POWER_MODE_NORMAL,
-+};
-+
-+static const char * const jbt6k74_power_mode_names[] = {
-+	[JBT_POWER_MODE_DEEP_STANDBY]	= "deep-standby",
-+	[JBT_POWER_MODE_SLEEP]		= "sleep",
-+	[JBT_POWER_MODE_NORMAL]		= "normal",
-+};
-+
-+static const char * const jbt6k74_resolution_names[] = {
-+	[JBT_RESOLUTION_VGA] = "vga",
-+	[JBT_RESOLUTION_QVGA] = "qvga",
-+};
-+
-+struct jbt6k74_info {
-+	struct mutex lock;		/* protects this structure */
-+	enum jbt6k74_resolution resolution;
-+	enum jbt6k74_power_mode power_mode;
-+	enum jbt6k74_power_mode suspend_mode;
-+	int suspended;
-+
-+	struct spi_device *spi;
-+	struct lcd_device *lcd_dev;
-+
-+	unsigned long next_sleep;
-+	struct delayed_work blank_work;
-+	int blank_mode;
-+	struct regulator_bulk_data supplies[2];
-+	uint16_t tx_buf[3];
-+	uint16_t reg_cache[0xEE];
-+};
-+
-+#define JBT_COMMAND	0x000
-+#define JBT_DATA	0x100
-+
-+static int jbt6k74_reg_write_nodata(struct jbt6k74_info *jbt, uint8_t reg)
-+{
-+	int ret;
-+
-+	jbt->tx_buf[0] = JBT_COMMAND | reg;
-+	ret = spi_write(jbt->spi, (uint8_t *)jbt->tx_buf,
-+					sizeof(uint16_t));
-+	if (ret == 0)
-+		jbt->reg_cache[reg] = 0;
-+	else
-+		dev_err(&jbt->spi->dev, "Write failed: %d\n", ret);
-+
-+	return ret;
-+}
-+
-+
-+static int jbt6k74_reg_write(struct jbt6k74_info *jbt, uint8_t reg, uint8_t data)
-+{
-+	int ret;
-+
-+	jbt->tx_buf[0] = JBT_COMMAND | reg;
-+	jbt->tx_buf[1] = JBT_DATA | data;
-+	ret = spi_write(jbt->spi, (uint8_t *)jbt->tx_buf,
-+			2*sizeof(uint16_t));
-+	if (ret == 0)
-+		jbt->reg_cache[reg] = data;
-+	else
-+		dev_err(&jbt->spi->dev, "Write failed: %d\n", ret);
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_reg_write16(struct jbt6k74_info *jbt, uint8_t reg, uint16_t data)
-+{
-+	int ret;
-+
-+	jbt->tx_buf[0] = JBT_COMMAND | reg;
-+	jbt->tx_buf[1] = JBT_DATA | (data >> 8);
-+	jbt->tx_buf[2] = JBT_DATA | (data & 0xff);
-+
-+	ret = spi_write(jbt->spi, (uint8_t *)jbt->tx_buf,
-+			3*sizeof(uint16_t));
-+	if (ret == 0)
-+		jbt->reg_cache[reg] = data;
-+	else
-+		dev_err(&jbt->spi->dev, "Write failed: %d\n", ret);
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_init_regs(struct jbt6k74_info *jbt)
-+{
-+	int ret;
-+
-+	dev_dbg(&jbt->spi->dev, "entering %cVGA mode\n",
-+			jbt->resolution == JBT_RESOLUTION_QVGA ? 'Q' : ' ');
-+
-+	ret = jbt6k74_reg_write(jbt, JBT_REG_DISPLAY_MODE1, 0x01);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_DISPLAY_MODE2, 0x00);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_RGB_FORMAT, 0x60);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_DRIVE_SYSTEM, 0x10);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_BOOSTER_OP, 0x56);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_BOOSTER_MODE, 0x33);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_BOOSTER_FREQ, 0x11);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_OPAMP_SYSCLK, 0x02);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_VSC_VOLTAGE, 0x2b);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_VCOM_VOLTAGE, 0x40);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_EXT_DISPL, 0x03);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_DCCLK_DCEV, 0x04);
-+	/*
-+	 * default of 0x02 in JBT_REG_ASW_SLEW responsible for 72Hz requirement
-+	 * to avoid red / blue flicker
-+	 */
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_ASW_SLEW, 0x00 | (1 << 5));
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_DUMMY_DISPLAY, 0x00);
-+
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_SLEEP_OUT_FR_A, 0x11);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_SLEEP_OUT_FR_B, 0x11);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_SLEEP_OUT_FR_C, 0x11);
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_SLEEP_IN_LCCNT_D, 0x2040);
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_SLEEP_IN_LCCNT_E, 0x60c0);
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_SLEEP_IN_LCCNT_F, 0x1020);
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_SLEEP_IN_LCCNT_G, 0x60c0);
-+
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_GAMMA1_FINE_1, 0x5533);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_GAMMA1_FINE_2, 0x00);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_GAMMA1_INCLINATION, 0x00);
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_GAMMA1_BLUE_OFFSET, 0x00);
-+
-+	if (jbt->resolution != JBT_RESOLUTION_QVGA) {
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_HCLOCK_VGA, 0x1f0);
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_BLANK_CONTROL, 0x02);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_BLANK_TH_TV, 0x0804);
-+
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_CKV_ON_OFF, 0x01);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_CKV_1_2, 0x0000);
-+
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_OEV_TIMING, 0x0d0e);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_ASW_TIMING_1, 0x11a4);
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_ASW_TIMING_2, 0x0e);
-+	} else {
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_HCLOCK_QVGA, 0x00ff);
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_BLANK_CONTROL_QVGA, 0x02);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_BLANK_TH_TV_QVGA, 0x0804);
-+
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_CKV_ON_OFF_QVGA, 0x01);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_CKV_1_2_QVGA, 0x0008);
-+
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_OEV_TIMING_QVGA, 0x050a);
-+		ret |= jbt6k74_reg_write16(jbt, JBT_REG_ASW_TIMING_1_QVGA, 0x0a19);
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_ASW_TIMING_2_QVGA, 0x0a);
-+	}
-+
-+	return ret ? -EIO : 0;
-+}
-+
-+static int jbt6k74_standby_to_sleep(struct jbt6k74_info *jbt)
-+{
-+	int ret;
-+	struct jbt6k74_platform_data *pdata = jbt->spi->dev.platform_data;
-+
-+	ret = regulator_bulk_enable(ARRAY_SIZE(jbt->supplies), jbt->supplies);
-+	if (ret)
-+		return ret;
-+
-+	gpio_set_value_cansleep(pdata->gpio_reset, 1);
-+	mdelay(100);
-+
-+	/* three times command zero */
-+	ret |= jbt6k74_reg_write_nodata(jbt, 0x00);
-+	mdelay(1);
-+	ret |= jbt6k74_reg_write_nodata(jbt, 0x00);
-+	mdelay(1);
-+	ret |= jbt6k74_reg_write_nodata(jbt, 0x00);
-+	mdelay(1);
-+
-+	/* deep standby out */
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_POWER_ON_OFF, 0x11);
-+	mdelay(1);
-+	ret = jbt6k74_reg_write(jbt, JBT_REG_DISPLAY_MODE, 0x28);
-+
-+	/* (re)initialize register set */
-+	ret |= jbt6k74_init_regs(jbt);
-+
-+	return ret ? -EIO : 0;
-+}
-+
-+static int jbt6k74_sleep_to_normal(struct jbt6k74_info *jbt)
-+{
-+	int ret;
-+
-+	/* Make sure we are 120 ms after SLEEP_OUT */
-+	if (time_before(jiffies, jbt->next_sleep))
-+		mdelay(jiffies_to_msecs(jbt->next_sleep - jiffies));
-+
-+	if (jbt->resolution == JBT_RESOLUTION_VGA) {
-+		/* RGB I/F on, RAM wirte off, QVGA through, SIGCON enable */
-+		ret = jbt6k74_reg_write(jbt, JBT_REG_DISPLAY_MODE, 0x80);
-+
-+		/* Quad mode off */
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_QUAD_RATE, 0x00);
-+	} else {
-+		/* RGB I/F on, RAM wirte off, QVGA through, SIGCON enable */
-+		ret = jbt6k74_reg_write(jbt, JBT_REG_DISPLAY_MODE, 0x81);
-+
-+		/* Quad mode on */
-+		ret |= jbt6k74_reg_write(jbt, JBT_REG_QUAD_RATE, 0x22);
-+	}
-+
-+	/* AVDD on, XVDD on */
-+	ret |= jbt6k74_reg_write(jbt, JBT_REG_POWER_ON_OFF, 0x16);
-+
-+	/* Output control */
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_OUTPUT_CONTROL, 0xdff9);
-+
-+	/* Turn on display */
-+	ret |= jbt6k74_reg_write_nodata(jbt, JBT_REG_DISPLAY_ON);
-+
-+	/* Sleep mode off */
-+	ret |= jbt6k74_reg_write_nodata(jbt, JBT_REG_SLEEP_OUT);
-+	jbt->next_sleep = jiffies + msecs_to_jiffies(120);
-+
-+	/* Allow the booster and display controller to restart stably */
-+	mdelay(5);
-+
-+	return ret ? -EIO : 0;
-+}
-+
-+static int jbt6k74_normal_to_sleep(struct jbt6k74_info *jbt)
-+{
-+	int ret;
-+
-+	/* Make sure we are 120 ms after SLEEP_OUT */
-+	if (time_before(jiffies, jbt->next_sleep))
-+		mdelay(jiffies_to_msecs(jbt->next_sleep - jiffies));
-+
-+	ret = jbt6k74_reg_write_nodata(jbt, JBT_REG_DISPLAY_OFF);
-+	ret |= jbt6k74_reg_write16(jbt, JBT_REG_OUTPUT_CONTROL, 0x8000 | 1 << 3);
-+	ret |= jbt6k74_reg_write_nodata(jbt, JBT_REG_SLEEP_IN);
-+	jbt->next_sleep = jiffies + msecs_to_jiffies(120);
-+
-+	/* Allow the internal circuits to stop automatically */
-+	mdelay(5);
-+
-+	return ret ? -EIO : 0;
-+}
-+
-+static int jbt6k74_sleep_to_standby(struct jbt6k74_info *jbt)
-+{
-+	int ret;
-+	struct jbt6k74_platform_data *pdata = jbt->spi->dev.platform_data;
-+
-+	ret = jbt6k74_reg_write(jbt, JBT_REG_POWER_ON_OFF, 0x00);
-+
-+	if (!ret) {
-+		gpio_set_value_cansleep(pdata->gpio_reset, 0);
-+		ret = regulator_bulk_disable(ARRAY_SIZE(jbt->supplies),
-+			jbt->supplies);
-+	}
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_enter_power_mode(struct jbt6k74_info *jbt,
-+					enum jbt6k74_power_mode new_mode)
-+{
-+	struct jbt6k74_platform_data *pdata = jbt->spi->dev.platform_data;
-+	int ret = -EINVAL;
-+
-+	dev_dbg(&jbt->spi->dev, "entering (old_state=%s, new_state=%s)\n",
-+			jbt6k74_power_mode_names[jbt->power_mode],
-+			jbt6k74_power_mode_names[new_mode]);
-+
-+	mutex_lock(&jbt->lock);
-+
-+	if (jbt->suspended) {
-+		switch (new_mode) {
-+		case JBT_POWER_MODE_DEEP_STANDBY:
-+		case JBT_POWER_MODE_SLEEP:
-+		case JBT_POWER_MODE_NORMAL:
-+			ret = 0;
-+			jbt->suspend_mode = new_mode;
-+			break;
-+		default:
-+			break;
-+		}
-+	} else if (new_mode == JBT_POWER_MODE_NORMAL &&
-+			pdata->enable_pixel_clock) {
-+		pdata->enable_pixel_clock(&jbt->spi->dev, 1);
-+	}
-+
-+	switch (jbt->power_mode) {
-+	case JBT_POWER_MODE_DEEP_STANDBY:
-+		switch (new_mode) {
-+		case JBT_POWER_MODE_DEEP_STANDBY:
-+			ret = 0;
-+			break;
-+		case JBT_POWER_MODE_SLEEP:
-+			ret = jbt6k74_standby_to_sleep(jbt);
-+			break;
-+		case JBT_POWER_MODE_NORMAL:
-+			/* first transition into sleep */
-+			ret = jbt6k74_standby_to_sleep(jbt);
-+			/* then transition into normal */
-+			ret |= jbt6k74_sleep_to_normal(jbt);
-+			break;
-+		}
-+		break;
-+	case JBT_POWER_MODE_SLEEP:
-+		switch (new_mode) {
-+		case JBT_POWER_MODE_SLEEP:
-+			ret = 0;
-+			break;
-+		case JBT_POWER_MODE_DEEP_STANDBY:
-+			ret = jbt6k74_sleep_to_standby(jbt);
-+			break;
-+		case JBT_POWER_MODE_NORMAL:
-+			ret = jbt6k74_sleep_to_normal(jbt);
-+			break;
-+		}
-+		break;
-+	case JBT_POWER_MODE_NORMAL:
-+		switch (new_mode) {
-+		case JBT_POWER_MODE_NORMAL:
-+			ret = 0;
-+			break;
-+		case JBT_POWER_MODE_DEEP_STANDBY:
-+			/* first transition into sleep */
-+			ret = jbt6k74_normal_to_sleep(jbt);
-+			/* then transition into deep standby */
-+			ret |= jbt6k74_sleep_to_standby(jbt);
-+			break;
-+		case JBT_POWER_MODE_SLEEP:
-+			ret = jbt6k74_normal_to_sleep(jbt);
-+			break;
-+		}
-+	}
-+
-+	if (ret == 0) {
-+		jbt->power_mode = new_mode;
-+		if (new_mode != JBT_POWER_MODE_NORMAL &&
-+			pdata->enable_pixel_clock)
-+			pdata->enable_pixel_clock(&jbt->spi->dev, 0);
-+	} else {
-+		dev_err(&jbt->spi->dev, "Failed enter state '%s': %d\n",
-+				jbt6k74_power_mode_names[new_mode], ret);
-+	}
-+
-+	mutex_unlock(&jbt->lock);
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_set_resolution(struct jbt6k74_info *jbt,
-+					enum jbt6k74_resolution new_resolution)
-+{
-+	int ret = 0;
-+	enum jbt6k74_resolution old_resolution;
-+
-+	mutex_lock(&jbt->lock);
-+
-+	if (jbt->resolution == new_resolution)
-+		goto out_unlock;
-+
-+	old_resolution = jbt->resolution;
-+	jbt->resolution = new_resolution;
-+
-+	if (jbt->power_mode == JBT_POWER_MODE_NORMAL) {
-+
-+		/* first transition into sleep */
-+		ret = jbt6k74_normal_to_sleep(jbt);
-+		ret |= jbt6k74_sleep_to_normal(jbt);
-+
-+		if (ret) {
-+			jbt->resolution = old_resolution;
-+			dev_err(&jbt->spi->dev, "Failed to set resolution '%s')\n",
-+				jbt6k74_resolution_names[new_resolution]);
-+		}
-+	}
-+
-+out_unlock:
-+	mutex_unlock(&jbt->lock);
-+
-+	return ret;
-+}
-+
-+static ssize_t resolution_read(struct device *dev,
-+				struct device_attribute *attr, char *buf)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(dev);
-+
-+	if (jbt->resolution >= ARRAY_SIZE(jbt6k74_resolution_names))
-+		return -EIO;
-+
-+	return sprintf(buf, "%s\n", jbt6k74_resolution_names[jbt->resolution]);
-+}
-+
-+static ssize_t resolution_write(struct device *dev,
-+				struct device_attribute *attr,
-+				const char *buf, size_t count)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(dev);
-+	int i, ret;
-+
-+	for (i = 0; i < ARRAY_SIZE(jbt6k74_resolution_names); i++) {
-+		if (!strncmp(buf, jbt6k74_resolution_names[i],
-+			strlen(jbt6k74_resolution_names[i]))) {
-+			ret = jbt6k74_set_resolution(jbt, i);
-+			if (ret)
-+				return ret;
-+			return count;
-+		}
-+	}
-+
-+	return -EINVAL;
-+}
-+
-+static DEVICE_ATTR(resolution, 0644, resolution_read, resolution_write);
-+
-+static int reg_by_string(const char *name)
-+{
-+	if (!strcmp(name, "gamma_fine1"))
-+		return JBT_REG_GAMMA1_FINE_1;
-+	else if (!strcmp(name, "gamma_fine2"))
-+		return JBT_REG_GAMMA1_FINE_2;
-+	else if (!strcmp(name, "gamma_inclination"))
-+		return JBT_REG_GAMMA1_INCLINATION;
-+	else
-+		return JBT_REG_GAMMA1_BLUE_OFFSET;
-+}
-+
-+static ssize_t gamma_read(struct device *dev, struct device_attribute *attr,
-+			  char *buf)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(dev);
-+	int reg = reg_by_string(attr->attr.name);
-+	uint16_t val;
-+
-+	mutex_lock(&jbt->lock);
-+	val = jbt->reg_cache[reg];
-+	mutex_unlock(&jbt->lock);
-+
-+	return sprintf(buf, "0x%04x\n", val);
-+}
-+
-+static ssize_t gamma_write(struct device *dev, struct device_attribute *attr,
-+			   const char *buf, size_t count)
-+{
-+	int ret;
-+	struct jbt6k74_info *jbt = dev_get_drvdata(dev);
-+	int reg = reg_by_string(attr->attr.name);
-+	unsigned long val;
-+
-+	ret = strict_strtoul(buf, 10, &val);
-+	if (ret)
-+		return ret;
-+
-+	mutex_lock(&jbt->lock);
-+	jbt6k74_reg_write(jbt, reg, val & 0xff);
-+	mutex_unlock(&jbt->lock);
-+
-+	return count;
-+}
-+
-+static ssize_t reset_write(struct device *dev, struct device_attribute *attr,
-+			   const char *buf, size_t count)
-+{
-+	int ret;
-+	struct jbt6k74_info *jbt = dev_get_drvdata(dev);
-+	struct jbt6k74_platform_data *pdata = jbt->spi->dev.platform_data;
-+	enum jbt6k74_power_mode old_power_mode = jbt->power_mode;
-+
-+	mutex_lock(&jbt->lock);
-+
-+	if (gpio_is_valid(pdata->gpio_reset)) {
-+		/* hard reset the jbt6k74 */
-+		gpio_set_value_cansleep(pdata->gpio_reset, 0);
-+		mdelay(120);
-+		gpio_set_value_cansleep(pdata->gpio_reset, 1);
-+		mdelay(120);
-+	}
-+
-+	ret = jbt6k74_reg_write_nodata(jbt, 0x01);
-+	if (ret < 0)
-+		dev_err(&jbt->spi->dev, "cannot soft reset\n");
-+	mdelay(120);
-+
-+	mutex_unlock(&jbt->lock);
-+
-+	jbt->power_mode = JBT_POWER_MODE_DEEP_STANDBY;
-+	jbt6k74_enter_power_mode(jbt, old_power_mode);
-+
-+	return count;
-+}
-+
-+static DEVICE_ATTR(gamma_fine1, 0644, gamma_read, gamma_write);
-+static DEVICE_ATTR(gamma_fine2, 0644, gamma_read, gamma_write);
-+static DEVICE_ATTR(gamma_inclination, 0644, gamma_read, gamma_write);
-+static DEVICE_ATTR(gamma_blue_offset, 0644, gamma_read, gamma_write);
-+static DEVICE_ATTR(reset, 0600, NULL, reset_write);
-+
-+static struct attribute *jbt6k74_sysfs_entries[] = {
-+	&dev_attr_resolution.attr,
-+	&dev_attr_gamma_fine1.attr,
-+	&dev_attr_gamma_fine2.attr,
-+	&dev_attr_gamma_inclination.attr,
-+	&dev_attr_gamma_blue_offset.attr,
-+	&dev_attr_reset.attr,
-+	NULL,
-+};
-+
-+static struct attribute_group jbt6k74_attr_group = {
-+	.name	= NULL,
-+	.attrs	= jbt6k74_sysfs_entries,
-+};
-+
-+/* FIXME: This in an ugly hack to delay display blanking.
-+  When the jbt is in sleep mode it displays an all white screen and thus one
-+  will a see a short flash.
-+  By delaying the blanking we will give the backlight a chance to turn off and
-+  thus avoid getting the flash */
-+static void jbt6k74_blank_worker(struct work_struct *work)
-+{
-+	struct jbt6k74_info *jbt  = container_of(work, struct jbt6k74_info,
-+						blank_work.work);
-+
-+	switch (jbt->blank_mode) {
-+	case FB_BLANK_NORMAL:
-+		jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_SLEEP);
-+		break;
-+	case FB_BLANK_POWERDOWN:
-+		jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_DEEP_STANDBY);
-+		break;
-+	default:
-+		break;
-+	}
-+}
-+
-+static int jbt6k74_set_mode(struct lcd_device *ld, struct fb_videomode *m)
-+{
-+	int ret = -EINVAL;
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&ld->dev);
-+
-+	if (m->xres == 240 && m->yres == 320) {
-+		ret = jbt6k74_set_resolution(jbt, JBT_RESOLUTION_QVGA);
-+	} else if (m->xres == 480 && m->yres == 640) {
-+		ret = jbt6k74_set_resolution(jbt, JBT_RESOLUTION_VGA);
-+	} else {
-+		dev_err(&jbt->spi->dev, "Unknown resolution.\n");
-+		jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_SLEEP);
-+	}
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_set_power(struct lcd_device *ld, int power)
-+{
-+	int ret = -EINVAL;
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&ld->dev);
-+
-+	jbt->blank_mode = power;
-+	cancel_rearming_delayed_work(&jbt->blank_work);
-+
-+	switch (power) {
-+	case FB_BLANK_UNBLANK:
-+		dev_dbg(&jbt->spi->dev, "unblank\n");
-+		mdelay(20);
-+		ret = jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_NORMAL);
-+		break;
-+	case FB_BLANK_NORMAL:
-+		dev_dbg(&jbt->spi->dev, "blank\n");
-+		ret = schedule_delayed_work(&jbt->blank_work, HZ);
-+		break;
-+	case FB_BLANK_POWERDOWN:
-+		dev_dbg(&jbt->spi->dev, "powerdown\n");
-+		ret = schedule_delayed_work(&jbt->blank_work, HZ);
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return ret;
-+}
-+
-+static int jbt6k74_get_power(struct lcd_device *ld)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&ld->dev);
-+
-+	switch (jbt->power_mode) {
-+	case JBT_POWER_MODE_NORMAL:
-+		return FB_BLANK_UNBLANK;
-+	case JBT_POWER_MODE_SLEEP:
-+		return FB_BLANK_NORMAL;
-+	default:
-+		return JBT_POWER_MODE_DEEP_STANDBY;
-+	}
-+}
-+
-+static struct lcd_ops jbt6k74_lcd_ops = {
-+	.set_power = jbt6k74_set_power,
-+	.get_power = jbt6k74_get_power,
-+	.set_mode  = jbt6k74_set_mode,
-+};
-+
-+/* linux device model infrastructure */
-+
-+static int __devinit jbt6k74_probe(struct spi_device *spi)
-+{
-+	int ret;
-+	struct jbt6k74_info *jbt;
-+	struct jbt6k74_platform_data *pdata = spi->dev.platform_data;
-+
-+	/* the controller doesn't have a MISO pin; we can't do detection */
-+
-+	spi->mode = SPI_CPOL | SPI_CPHA;
-+	spi->bits_per_word = 9;
-+
-+	ret = spi_setup(spi);
-+	if (ret < 0) {
-+		dev_err(&spi->dev,
-+			"Failed to setup spi\n");
-+		return ret;
-+	}
-+
-+	jbt = kzalloc(sizeof(*jbt), GFP_KERNEL);
-+	if (!jbt)
-+		return -ENOMEM;
-+
-+	jbt->spi = spi;
-+
-+	jbt->lcd_dev = lcd_device_register("jbt6k74-lcd", &spi->dev, jbt,
-+						&jbt6k74_lcd_ops);
-+
-+	if (IS_ERR(jbt->lcd_dev)) {
-+		ret = PTR_ERR(jbt->lcd_dev);
-+		goto err_free_drvdata;
-+	}
-+
-+	INIT_DELAYED_WORK(&jbt->blank_work, jbt6k74_blank_worker);
-+
-+	jbt->resolution = JBT_RESOLUTION_VGA;
-+	jbt->power_mode = JBT_POWER_MODE_DEEP_STANDBY;
-+	jbt->next_sleep = jiffies + msecs_to_jiffies(120);
-+	mutex_init(&jbt->lock);
-+
-+	dev_set_drvdata(&spi->dev, jbt);
-+
-+	jbt->supplies[0].supply = "VDC";
-+	jbt->supplies[1].supply = "VDDIO";
-+
-+	ret = regulator_bulk_get(&spi->dev, ARRAY_SIZE(jbt->supplies),
-+					jbt->supplies);
-+	if (ret) {
-+		dev_err(&spi->dev, "Failed to power get supplies: %d\n", ret);
-+		goto err_unregister_lcd;
-+	}
-+
-+	if (gpio_is_valid(pdata->gpio_reset)) {
-+		ret = gpio_request(pdata->gpio_reset, "jbt6k74 reset");
-+		if (ret) {
-+			dev_err(&spi->dev, "Failed to request reset gpio: %d\n",
-+				ret);
-+			goto err_free_supplies;
-+		}
-+
-+		ret = gpio_direction_output(pdata->gpio_reset, 1);
-+		if (ret) {
-+			dev_err(&spi->dev, "Failed to set reset gpio direction: %d\n",
-+				ret);
-+			goto err_gpio_free;
-+		}
-+	}
-+
-+	ret = sysfs_create_group(&spi->dev.kobj, &jbt6k74_attr_group);
-+	if (ret < 0) {
-+		dev_err(&spi->dev, "cannot create sysfs group\n");
-+		goto err_gpio_free;
-+	}
-+
-+	mdelay(50);
-+	ret = jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_NORMAL);
-+	if (ret < 0) {
-+		dev_err(&spi->dev, "cannot enter NORMAL state\n");
-+		goto err_sysfs_remove;
-+	}
-+
-+	return 0;
-+
-+err_sysfs_remove:
-+	sysfs_remove_group(&spi->dev.kobj, &jbt6k74_attr_group);
-+err_gpio_free:
-+	gpio_free(pdata->gpio_reset);
-+err_free_supplies:
-+	regulator_bulk_free(ARRAY_SIZE(jbt->supplies), jbt->supplies);
-+err_unregister_lcd:
-+	lcd_device_unregister(jbt->lcd_dev);
-+err_free_drvdata:
-+	dev_set_drvdata(&spi->dev, NULL);
-+	kfree(jbt);
-+
-+	return ret;
-+}
-+
-+static int __devexit jbt6k74_remove(struct spi_device *spi)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&spi->dev);
-+	struct jbt6k74_platform_data *pdata = jbt->spi->dev.platform_data;
-+
-+	/* We don't want to switch off the display in case the user
-+	 * accidentially unloads the module (whose use count normally is 0) */
-+	jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_NORMAL);
-+
-+	sysfs_remove_group(&spi->dev.kobj, &jbt6k74_attr_group);
-+
-+	if (gpio_is_valid(pdata->gpio_reset))
-+		gpio_free(pdata->gpio_reset);
-+
-+	lcd_device_unregister(jbt->lcd_dev);
-+
-+	dev_set_drvdata(&spi->dev, NULL);
-+
-+	regulator_bulk_free(ARRAY_SIZE(jbt->supplies), jbt->supplies);
-+	kfree(jbt);
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_PM
-+static int jbt6k74_suspend(struct spi_device *spi, pm_message_t state)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&spi->dev);
-+
-+	jbt->suspend_mode = jbt->power_mode;
-+
-+	jbt6k74_enter_power_mode(jbt, JBT_POWER_MODE_DEEP_STANDBY);
-+	jbt->suspended = 1;
-+
-+	dev_info(&spi->dev, "suspended\n");
-+
-+	return 0;
-+}
-+
-+static int jbt6k74_resume(struct spi_device *spi)
-+{
-+	struct jbt6k74_info *jbt = dev_get_drvdata(&spi->dev);
-+	dev_info(&spi->dev, "starting resume: %d\n", jbt->suspend_mode);
-+
-+	mdelay(20);
-+
-+	jbt->suspended = 0;
-+	jbt6k74_enter_power_mode(jbt, jbt->suspend_mode);
-+
-+	dev_info(&spi->dev, "resumed: %d\n", jbt->suspend_mode);
-+
-+	return 0;
-+}
-+
-+#else
-+#define jbt6k74_suspend	NULL
-+#define jbt6k74_resume	NULL
-+#endif
-+
-+static struct spi_driver jbt6k74_driver = {
-+	.driver = {
-+		.name	= "jbt6k74",
-+		.owner	= THIS_MODULE,
-+	},
-+
-+	.probe	 = jbt6k74_probe,
-+	.remove	 = __devexit_p(jbt6k74_remove),
-+	.suspend = jbt6k74_suspend,
-+	.resume	 = jbt6k74_resume,
-+};
-+
-+static int __init jbt6k74_init(void)
-+{
-+	return spi_register_driver(&jbt6k74_driver);
-+}
-+module_init(jbt6k74_init);
-+
-+static void __exit jbt6k74_exit(void)
-+{
-+	spi_unregister_driver(&jbt6k74_driver);
-+}
-+module_exit(jbt6k74_exit);
-+
-+MODULE_DESCRIPTION("SPI driver for tpo JBT6K74-AS LCM control interface");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_LICENSE("GPL");
-diff --git a/drivers/video/backlight/pcf50633-backlight.c b/drivers/video/backlight/pcf50633-backlight.c
-index ef5628d..7d80574 100644
---- a/drivers/video/backlight/pcf50633-backlight.c
-+++ b/drivers/video/backlight/pcf50633-backlight.c
-@@ -44,7 +44,7 @@ struct pcf50633_bl {
-  */
- int pcf50633_bl_set_brightness_limit(struct pcf50633 *pcf, unsigned int limit)
- {
--	struct pcf50633_bl *pcf_bl = platform_get_drvdata(pcf->bl_pdev);
-+	struct pcf50633_bl *pcf_bl = pcf->bl;
- 
- 	if (!pcf_bl)
- 		return -ENODEV;
-@@ -102,6 +102,7 @@ static const struct backlight_ops pcf50633_bl_ops = {
- static int __devinit pcf50633_bl_probe(struct platform_device *pdev)
- {
- 	int ret;
-+	struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
- 	struct pcf50633_bl *pcf_bl;
- 	struct device *parent = pdev->dev.parent;
- 	struct pcf50633_platform_data *pcf50633_data = parent->platform_data;
-@@ -124,7 +125,7 @@ static int __devinit pcf50633_bl_probe(struct platform_device *pdev)
- 		pcf_bl->brightness_limit = 0x3f;
- 	}
- 
--	pcf_bl->pcf = dev_to_pcf50633(pdev->dev.parent);
-+	pcf_bl->pcf = pcf;
- 
- 	pcf_bl->bl = backlight_device_register(pdev->name, &pdev->dev, pcf_bl,
- 						&pcf50633_bl_ops, &bl_props);
-@@ -134,6 +135,7 @@ static int __devinit pcf50633_bl_probe(struct platform_device *pdev)
- 		goto err_free;
- 	}
- 
-+	pcf->bl = pcf_bl;
- 	platform_set_drvdata(pdev, pcf_bl);
- 
- 	pcf50633_reg_write(pcf_bl->pcf, PCF50633_REG_LEDDIM, pdata->ramp_time);
-@@ -156,6 +158,8 @@ static int __devexit pcf50633_bl_remove(struct platform_device *pdev)
- {
- 	struct pcf50633_bl *pcf_bl = platform_get_drvdata(pdev);
- 
-+	pcf_bl->pcf->bl = NULL;
-+
- 	backlight_device_unregister(pcf_bl->bl);
- 
- 	platform_set_drvdata(pdev, NULL);
-diff --git a/drivers/video/glamo-fb.c b/drivers/video/glamo-fb.c
-new file mode 100644
-index 0000000..45f5a2b
---- /dev/null
-+++ b/drivers/video/glamo-fb.c
-@@ -0,0 +1,943 @@
-+/* Smedia Glamo 336x/337x driver
-+ *
-+ * (C) 2007-2008 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/string.h>
-+#include <linux/mm.h>
-+#include <linux/delay.h>
-+#include <linux/fb.h>
-+#include <linux/console.h>
-+#include <linux/init.h>
-+#include <linux/platform_device.h>
-+#include <linux/spinlock.h>
-+#include <linux/io.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/mfd/glamo-regs.h>
-+
-+#include <asm/div64.h>
-+
-+#ifdef CONFIG_PM
-+#include <linux/pm.h>
-+#endif
-+
-+#include <linux/glamofb.h>
-+
-+struct glamofb_handle {
-+	struct glamo_core *core;
-+	struct fb_info *fb;
-+	struct device *dev;
-+
-+	struct resource *reg;
-+	struct resource *fb_res;
-+	void __iomem *base;
-+	void __iomem *cursor_addr;
-+
-+	struct glamo_fb_platform_data *mach_info;
-+
-+	int cursor_on;
-+	int blank_mode;
-+	int mode_set; /* 0 if the current display mode hasn't been set on the glamo */
-+	int output_enabled; /* 0 if the video output is disabled */
-+
-+	spinlock_t lock_cmd;
-+	uint32_t pseudo_pal[16];
-+};
-+
-+static void glamofb_program_mode(struct glamofb_handle *glamo);
-+
-+static void glamo_output_enable(struct glamofb_handle *gfb)
-+{
-+	struct glamo_core *gcore = gfb->core;
-+
-+	if (gfb->output_enabled)
-+		return;
-+
-+	/* enable the pixel clock if off */
-+	glamo_engine_enable(gcore, GLAMO_ENGINE_LCD);
-+
-+	gfb->output_enabled = 1;
-+	if (!gfb->mode_set)
-+		glamofb_program_mode(gfb);
-+}
-+
-+static void glamo_output_disable(struct glamofb_handle *gfb)
-+{
-+	struct glamo_core *gcore = gfb->core;
-+
-+	if (!gfb->output_enabled)
-+		return;
-+
-+	/* enable the pixel clock if off */
-+	glamo_engine_suspend(gcore, GLAMO_ENGINE_LCD);
-+
-+	gfb->output_enabled = 0;
-+}
-+
-+
-+static inline int glamofb_reg_read(struct glamofb_handle *glamo, uint16_t reg)
-+{
-+	return readw(glamo->base + reg);
-+}
-+
-+static inline void glamofb_reg_write(struct glamofb_handle *glamo, uint16_t reg,
-+	uint16_t val)
-+{
-+	writew(val, glamo->base + reg);
-+}
-+
-+static const struct glamo_script glamo_regs[] = {
-+	{ GLAMO_REG_LCD_MODE1, 0x0020 },
-+	/* no display rotation, no hardware cursor, no dither, no gamma,
-+	 * no retrace flip, vsync low-active, hsync low active,
-+	 * no TVCLK, no partial display, hw dest color from fb,
-+	 * no partial display mode, LCD1, software flip,  */
-+	{ GLAMO_REG_LCD_MODE2, 0x9020 },
-+	  /* video flip, no ptr, no ptr, dhclk off,
-+	   * normal mode,  no cpuif,
-+	   * res, serial msb first, single fb, no fr ctrl,
-+	   * cpu if bits all zero, no crc
-+	   * 0000 0000 0010  0000 */
-+	{ GLAMO_REG_LCD_MODE3, 0x0b40 },
-+	  /* src data rgb565, res, 18bit rgb666
-+	   * 000 01 011 0100 0000 */
-+	{ GLAMO_REG_LCD_POLARITY, 0x440c },
-+	  /* DE high active, no cpu/lcd if, cs0 force low, a0 low active,
-+	   * np cpu if, 9bit serial data, sclk rising edge latch data
-+	   * 01 00 0 100 0 000 01 0 0 */
-+	/* The following values assume 640*480@16bpp */
-+	{ GLAMO_REG_LCD_A_BASE1, 0x0000 }, /* display A base address 15:0 */
-+	{ GLAMO_REG_LCD_A_BASE2, 0x4000 }, /* display A base address 22:16 */
-+	{ GLAMO_REG_LCD_CURSOR_BASE1, 0xC000 }, /* cursor base address 15:0 */
-+	{ GLAMO_REG_LCD_CURSOR_BASE2, 0x0012 }, /* cursor base address 22:16 */
-+	{ GLAMO_REG_LCD_COMMAND2, 0x0000 }, /* display page A */
-+};
-+
-+static int glamofb_run_script(struct glamofb_handle *glamo,
-+	const struct glamo_script *script, size_t len)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < len; i++) {
-+		const struct glamo_script *line = &script[i];
-+
-+		if (line->reg == 0xffff)
-+			return 0;
-+		else if (line->reg == 0xfffe)
-+			msleep(line->val);
-+		else
-+			glamofb_reg_write(glamo, script[i].reg, script[i].val);
-+	}
-+
-+	return 0;
-+}
-+
-+static int glamofb_check_var(struct fb_var_screeninfo *var,
-+	struct fb_info *info)
-+{
-+	struct glamofb_handle *glamo = info->par;
-+
-+	if (var->bits_per_pixel != 16)
-+		var->bits_per_pixel = 16;
-+
-+	var->height = glamo->mach_info->height;
-+	var->width = glamo->mach_info->width;
-+
-+	/* FIXME: set rgb positions */
-+	switch (var->bits_per_pixel) {
-+	case 16:
-+		switch (glamofb_reg_read(glamo, GLAMO_REG_LCD_MODE3) & 0xc000) {
-+		case GLAMO_LCD_SRC_RGB565:
-+			var->red.offset		= 11;
-+			var->green.offset	= 5;
-+			var->blue.offset	= 0;
-+			var->red.length		= 5;
-+			var->green.length	= 6;
-+			var->blue.length	= 5;
-+			var->transp.length	= 0;
-+			break;
-+		case GLAMO_LCD_SRC_ARGB1555:
-+			var->transp.offset	= 15;
-+			var->red.offset		= 10;
-+			var->green.offset	= 5;
-+			var->blue.offset	= 0;
-+			var->transp.length	= 1;
-+			var->red.length		= 5;
-+			var->green.length	= 5;
-+			var->blue.length	= 5;
-+			break;
-+		case GLAMO_LCD_SRC_ARGB4444:
-+			var->transp.offset	= 12;
-+			var->red.offset		= 8;
-+			var->green.offset	= 4;
-+			var->blue.offset	= 0;
-+			var->transp.length	= 4;
-+			var->red.length		= 4;
-+			var->green.length	= 4;
-+			var->blue.length	= 4;
-+			break;
-+		}
-+		break;
-+	case 24:
-+	case 32:
-+	default:
-+		/* The Smedia Glamo doesn't support anything but 16bit color */
-+		return -EINVAL;
-+	}
-+
-+	return 0;
-+}
-+
-+static void glamofb_reg_set_bit_mask(struct glamofb_handle *glamo, uint16_t reg,
-+	uint16_t mask, uint16_t val)
-+{
-+	uint16_t tmp;
-+
-+	val &= mask;
-+
-+	tmp = glamofb_reg_read(glamo, reg);
-+	tmp &= ~mask;
-+	tmp |= val;
-+	glamofb_reg_write(glamo, reg, tmp);
-+}
-+
-+#define GLAMO_LCD_WIDTH_MASK 0x03FF
-+#define GLAMO_LCD_HEIGHT_MASK 0x03FF
-+#define GLAMO_LCD_PITCH_MASK 0x07FE
-+#define GLAMO_LCD_HV_TOTAL_MASK 0x03FF
-+#define GLAMO_LCD_HV_RETR_START_MASK 0x03FF
-+#define GLAMO_LCD_HV_RETR_END_MASK 0x03FF
-+#define GLAMO_LCD_HV_RETR_DISP_START_MASK 0x03FF
-+#define GLAMO_LCD_HV_RETR_DISP_END_MASK 0x03FF
-+
-+/* the caller has to ensure lock_cmd is held and we are in cmd mode */
-+static void __rotate_lcd(struct glamofb_handle *glamo, uint32_t rotation)
-+{
-+	uint32_t glamo_rot;
-+
-+	switch (rotation) {
-+	case FB_ROTATE_CW:
-+		glamo_rot = GLAMO_LCD_ROT_MODE_90;
-+		break;
-+	case FB_ROTATE_UD:
-+		glamo_rot = GLAMO_LCD_ROT_MODE_180;
-+		break;
-+	case FB_ROTATE_CCW:
-+		glamo_rot = GLAMO_LCD_ROT_MODE_270;
-+		break;
-+	default:
-+		glamo_rot = GLAMO_LCD_ROT_MODE_0;
-+		break;
-+	}
-+
-+	glamofb_reg_set_bit_mask(glamo,
-+			 GLAMO_REG_LCD_WIDTH,
-+			 GLAMO_LCD_ROT_MODE_MASK,
-+			 glamo_rot);
-+	glamofb_reg_set_bit_mask(glamo,
-+			 GLAMO_REG_LCD_MODE1,
-+			 GLAMO_LCD_MODE1_ROTATE_EN,
-+			 (glamo_rot != GLAMO_LCD_ROT_MODE_0) ?
-+				 GLAMO_LCD_MODE1_ROTATE_EN : 0);
-+}
-+
-+static inline int glamofb_cmdq_empty(struct glamofb_handle *gfb)
-+{
-+	/* DGCMdQempty -- 1 == command queue is empty */
-+	return glamofb_reg_read(gfb, GLAMO_REG_LCD_STATUS1) & (1 << 15);
-+}
-+
-+/* call holding gfb->lock_cmd  when locking, until you unlock */
-+static int glamofb_cmd_mode(struct glamofb_handle *gfb, int on)
-+{
-+	int timeout = 2000000;
-+
-+	dev_dbg(gfb->dev, "glamofb_cmd_mode(gfb=%p, on=%d)\n", gfb, on);
-+	if (on) {
-+		dev_dbg(gfb->dev, "%s: waiting for cmdq empty: ",
-+			__func__);
-+		while (!glamofb_cmdq_empty(gfb) && (timeout--))
-+			cpu_relax();
-+		if (timeout < 0) {
-+			printk(KERN_ERR "glamofb cmd_queue never got empty\n");
-+			return -EIO;
-+		}
-+		dev_dbg(gfb->dev, "empty!\n");
-+
-+		/* display the entire frame then switch to command */
-+		glamofb_reg_write(gfb, GLAMO_REG_LCD_COMMAND1,
-+			  GLAMO_LCD_CMD_TYPE_DISP |
-+			  GLAMO_LCD_CMD_DATA_FIRE_VSYNC);
-+
-+		/* wait until lcd idle */
-+		dev_dbg(gfb->dev, "waiting for lcd idle: ");
-+		timeout = 2000000;
-+		while (!(glamofb_reg_read(gfb, GLAMO_REG_LCD_STATUS2) & (1 << 12)) &&
-+		      (timeout--))
-+			cpu_relax();
-+		if (timeout < 0) {
-+			printk(KERN_ERR"*************"
-+				       "glamofb lcd never idle"
-+				       "*************\n");
-+			return -EIO;
-+		}
-+
-+		mdelay(100);
-+
-+		dev_dbg(gfb->dev, "cmd mode entered\n");
-+
-+	} else {
-+		/* RGB interface needs vsync/hsync */
-+		if (glamofb_reg_read(gfb, GLAMO_REG_LCD_MODE3) & GLAMO_LCD_MODE3_RGB)
-+			glamofb_reg_write(gfb, GLAMO_REG_LCD_COMMAND1,
-+				  GLAMO_LCD_CMD_TYPE_DISP |
-+				  GLAMO_LCD_CMD_DATA_DISP_SYNC);
-+
-+		glamofb_reg_write(gfb, GLAMO_REG_LCD_COMMAND1,
-+			  GLAMO_LCD_CMD_TYPE_DISP |
-+			  GLAMO_LCD_CMD_DATA_DISP_FIRE);
-+	}
-+
-+	return 0;
-+}
-+
-+static void glamofb_program_mode(struct glamofb_handle *gfb)
-+{
-+	unsigned int sync, bp, disp, fp, total;
-+	unsigned long flags;
-+	struct glamo_core *gcore = gfb->core;
-+	struct fb_var_screeninfo *var = &gfb->fb->var;
-+
-+	dev_dbg(&gcore->pdev->dev,
-+			  "glamofb_program_mode spin_lock_irqsave\n");
-+	spin_lock_irqsave(&gfb->lock_cmd, flags);
-+
-+	if (glamofb_cmd_mode(gfb, 1))
-+		goto out_unlock;
-+
-+	if (var->pixclock)
-+		glamo_engine_reclock(gcore, GLAMO_ENGINE_LCD,
-+				 (1000000000UL / gfb->fb->var.pixclock) * 1000);
-+
-+	glamofb_reg_set_bit_mask(gfb,
-+			 GLAMO_REG_LCD_WIDTH,
-+			 GLAMO_LCD_WIDTH_MASK,
-+			 var->xres);
-+	glamofb_reg_set_bit_mask(gfb,
-+			 GLAMO_REG_LCD_HEIGHT,
-+			 GLAMO_LCD_HEIGHT_MASK,
-+			 var->yres);
-+	glamofb_reg_set_bit_mask(gfb,
-+			 GLAMO_REG_LCD_PITCH,
-+			 GLAMO_LCD_PITCH_MASK,
-+			 gfb->fb->fix.line_length);
-+
-+	/* honour the rotation request */
-+	__rotate_lcd(gfb, var->rotate);
-+
-+	/* update scannout timings */
-+	sync = 0;
-+	bp = sync + var->hsync_len;
-+	disp = bp + var->left_margin;
-+	fp = disp + var->xres;
-+	total = fp + var->right_margin;
-+
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_HORIZ_TOTAL,
-+			 GLAMO_LCD_HV_TOTAL_MASK, total);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_HORIZ_RETR_START,
-+			 GLAMO_LCD_HV_RETR_START_MASK, sync);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_HORIZ_RETR_END,
-+			 GLAMO_LCD_HV_RETR_END_MASK, bp);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_HORIZ_DISP_START,
-+			  GLAMO_LCD_HV_RETR_DISP_START_MASK, disp);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_HORIZ_DISP_END,
-+			 GLAMO_LCD_HV_RETR_DISP_END_MASK, fp);
-+
-+	sync = 0;
-+	bp = sync + var->vsync_len;
-+	disp = bp + var->upper_margin;
-+	fp = disp + var->yres;
-+	total = fp + var->lower_margin;
-+
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_VERT_TOTAL,
-+			 GLAMO_LCD_HV_TOTAL_MASK, total);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_VERT_RETR_START,
-+			  GLAMO_LCD_HV_RETR_START_MASK, sync);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_VERT_RETR_END,
-+			 GLAMO_LCD_HV_RETR_END_MASK, bp);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_VERT_DISP_START,
-+			 GLAMO_LCD_HV_RETR_DISP_START_MASK, disp);
-+	glamofb_reg_set_bit_mask(gfb, GLAMO_REG_LCD_VERT_DISP_END,
-+			 GLAMO_LCD_HV_RETR_DISP_END_MASK, fp);
-+
-+	glamofb_cmd_mode(gfb, 0);
-+
-+	gfb->mode_set = 1;
-+
-+out_unlock:
-+	dev_dbg(&gcore->pdev->dev,
-+		  "glamofb_program_mode spin_unlock_irqrestore\n");
-+	spin_unlock_irqrestore(&gfb->lock_cmd, flags);
-+}
-+
-+static struct fb_videomode *glamofb_find_mode(struct fb_info *info,
-+	struct fb_var_screeninfo *var)
-+{
-+	struct glamofb_handle *glamo = info->par;
-+	struct glamo_fb_platform_data *pdata = glamo->mach_info;
-+	struct fb_videomode *mode;
-+	int i;
-+
-+	for (i = pdata->num_modes, mode = pdata->modes; i; --i, ++mode) {
-+		if (mode->xres == var->xres &&
-+			mode->yres == var->yres)
-+			return mode;
-+	}
-+
-+	return NULL;
-+}
-+
-+static int glamofb_set_par(struct fb_info *info)
-+{
-+	struct glamofb_handle *glamo = info->par;
-+	struct fb_var_screeninfo *var = &info->var;
-+	struct fb_videomode *mode;
-+
-+	mode = glamofb_find_mode(info, var);
-+	if (!mode)
-+		return -EINVAL;
-+
-+	fb_videomode_to_var(var, mode);
-+
-+	info->mode = mode;
-+
-+	glamo->mode_set = 0;
-+
-+	switch (var->rotate) {
-+	case FB_ROTATE_CW:
-+	case FB_ROTATE_CCW:
-+		info->fix.line_length = (var->yres * var->bits_per_pixel) / 8;
-+		/* FIXME: Limit pixelclock */
-+		var->pixclock *= 2;
-+		break;
-+	default:
-+		info->fix.line_length = (var->xres * var->bits_per_pixel) / 8;
-+		break;
-+	}
-+
-+	if (glamo->output_enabled)
-+		glamofb_program_mode(glamo);
-+
-+	return 0;
-+}
-+
-+static int glamofb_blank(int blank_mode, struct fb_info *info)
-+{
-+	struct glamofb_handle *gfb = info->par;
-+
-+	dev_dbg(gfb->dev, "glamofb_blank(%u)\n", blank_mode);
-+
-+	switch (blank_mode) {
-+	case FB_BLANK_VSYNC_SUSPEND:
-+	case FB_BLANK_HSYNC_SUSPEND:
-+		/* FIXME: add pdata hook/flag to indicate whether
-+		 * we should already switch off pixel clock here */
-+		break;
-+	case FB_BLANK_POWERDOWN:
-+		/* disable the pixel clock */
-+		glamo_output_disable(gfb);
-+		gfb->blank_mode = blank_mode;
-+		break;
-+	case FB_BLANK_UNBLANK:
-+	case FB_BLANK_NORMAL:
-+		glamo_output_enable(gfb);
-+		gfb->blank_mode = blank_mode;
-+		break;
-+	}
-+
-+	/* FIXME: once we have proper clock management in glamo-core,
-+	 * we can determine if other units need MCLK1 or the PLL, and
-+	 * disable it if not used. */
-+	return 0;
-+}
-+
-+static inline unsigned int chan_to_field(unsigned int chan,
-+	struct fb_bitfield *bf)
-+{
-+	chan &= 0xffff;
-+	chan >>= 16 - bf->length;
-+	return chan << bf->offset;
-+}
-+
-+static int glamofb_setcolreg(unsigned regno, unsigned red, unsigned green,
-+	unsigned blue, unsigned transp, struct fb_info *info)
-+{
-+	struct glamofb_handle *glamo = info->par;
-+	unsigned int val;
-+
-+	switch (glamo->fb->fix.visual) {
-+	case FB_VISUAL_TRUECOLOR:
-+	case FB_VISUAL_DIRECTCOLOR:
-+		/* true-colour, use pseuo-palette */
-+
-+		if (regno < 16) {
-+			u32 *pal = glamo->fb->pseudo_palette;
-+
-+			val  = chan_to_field(red, &glamo->fb->var.red);
-+			val |= chan_to_field(green, &glamo->fb->var.green);
-+			val |= chan_to_field(blue, &glamo->fb->var.blue);
-+
-+			pal[regno] = val;
-+		};
-+		break;
-+	default:
-+		return 1; /* unknown type */
-+	}
-+
-+	return 0;
-+}
-+
-+static int glamofb_ioctl(struct fb_info *info, unsigned int cmd,
-+	unsigned long arg)
-+{
-+	struct glamofb_handle *gfb = (struct glamofb_handle *)info->par;
-+	struct glamo_core *gcore = gfb->core;
-+	int retval = -ENOTTY;
-+
-+	switch (cmd) {
-+	case GLAMOFB_ENGINE_ENABLE:
-+		retval = glamo_engine_enable(gcore, arg);
-+		break;
-+	case GLAMOFB_ENGINE_DISABLE:
-+		retval = glamo_engine_disable(gcore, arg);
-+		break;
-+	case GLAMOFB_ENGINE_RESET:
-+		glamo_engine_reset(gcore, arg);
-+		retval = 0;
-+		break;
-+	default:
-+		break;
-+	}
-+
-+	return retval;
-+}
-+
-+
-+#ifdef CONFIG_MFD_GLAMO_HWACCEL
-+static inline void glamofb_vsync_wait(struct glamofb_handle *glamo, int line,
-+	int size, int range)
-+{
-+	int count[2];
-+
-+	do {
-+		count[0] = glamofb_reg_read(glamo, GLAMO_REG_LCD_STATUS2) & 0x3ff;
-+		count[1] = glamofb_reg_read(glamo, GLAMO_REG_LCD_STATUS2) & 0x3ff;
-+	} while (count[0] != count[1] ||
-+			(line < count[0] + range &&
-+			 size > count[0] - range) ||
-+			count[0] < range * 2);
-+}
-+
-+/*
-+ * Enable/disable the hardware cursor mode altogether
-+ * (for blinking and such, use glamofb_cursor()).
-+ */
-+static void glamofb_cursor_onoff(struct glamofb_handle *glamo, int on)
-+{
-+	int y, size;
-+
-+	if (glamo->cursor_on) {
-+		y = glamofb_reg_read(glamo, GLAMO_REG_LCD_CURSOR_Y_POS);
-+		size = glamofb_reg_read(glamo, GLAMO_REG_LCD_CURSOR_Y_SIZE);
-+
-+		glamofb_vsync_wait(glamo, y, size, 30);
-+	}
-+
-+	glamofb_reg_set_bit_mask(glamo, GLAMO_REG_LCD_MODE1,
-+			GLAMO_LCD_MODE1_CURSOR_EN,
-+			on ? GLAMO_LCD_MODE1_CURSOR_EN : 0);
-+	glamo->cursor_on = on;
-+
-+	/* Hide the cursor by default */
-+	glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_X_SIZE, 0);
-+}
-+
-+static int glamofb_cursor(struct fb_info *info, struct fb_cursor *cursor)
-+{
-+	struct glamofb_handle *glamo = info->par;
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&glamo->lock_cmd, flags);
-+
-+	glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_X_SIZE,
-+			cursor->enable ? cursor->image.width : 0);
-+
-+	if (cursor->set & FB_CUR_SETPOS) {
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_X_POS,
-+			  cursor->image.dx);
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_Y_POS,
-+			  cursor->image.dy);
-+	}
-+
-+	if (cursor->set & FB_CUR_SETCMAP) {
-+		uint16_t fg = glamo->pseudo_pal[cursor->image.fg_color];
-+		uint16_t bg = glamo->pseudo_pal[cursor->image.bg_color];
-+
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_FG_COLOR, fg);
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_BG_COLOR, bg);
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_DST_COLOR, fg);
-+	}
-+
-+	if (cursor->set & FB_CUR_SETHOT)
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_PRESET,
-+				(cursor->hot.x << 8) | cursor->hot.y);
-+
-+	if ((cursor->set & FB_CUR_SETSIZE) ||
-+	    (cursor->set & (FB_CUR_SETIMAGE | FB_CUR_SETSHAPE))) {
-+		int x, y, pitch, op;
-+		const uint8_t *pcol = cursor->image.data;
-+		const uint8_t *pmsk = cursor->mask;
-+		uint8_t __iomem *dst = glamo->cursor_addr;
-+		uint8_t dcol = 0;
-+		uint8_t dmsk = 0;
-+		uint8_t byte = 0;
-+
-+		if (cursor->image.depth > 1) {
-+			spin_unlock_irqrestore(&glamo->lock_cmd, flags);
-+			return -EINVAL;
-+		}
-+
-+		pitch = ((cursor->image.width + 7) >> 2) & ~1;
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_PITCH,
-+			pitch);
-+		glamofb_reg_write(glamo, GLAMO_REG_LCD_CURSOR_Y_SIZE,
-+			cursor->image.height);
-+
-+		for (y = 0; y < cursor->image.height; y++) {
-+			byte = 0;
-+			for (x = 0; x < cursor->image.width; x++) {
-+				if ((x % 8) == 0) {
-+					dcol = *pcol++;
-+					dmsk = *pmsk++;
-+				} else {
-+					dcol >>= 1;
-+					dmsk >>= 1;
-+				}
-+
-+				if (cursor->rop == ROP_COPY)
-+					op = (dmsk & 1) ?
-+						(dcol & 1) ? 1 : 3 : 0;
-+				else
-+					op = ((dmsk & 1) << 1) |
-+						((dcol & 1) << 0);
-+				byte |= op << ((x & 3) << 1);
-+
-+				if (x % 4 == 3) {
-+					writeb(byte, dst + x / 4);
-+					byte = 0;
-+				}
-+			}
-+			if (x % 4) {
-+				writeb(byte, dst + x / 4);
-+				byte = 0;
-+			}
-+
-+			dst += pitch;
-+		}
-+	}
-+
-+	spin_unlock_irqrestore(&glamo->lock_cmd, flags);
-+
-+	return 0;
-+}
-+#endif
-+
-+static struct fb_ops glamofb_ops = {
-+	.owner		= THIS_MODULE,
-+	.fb_check_var	= glamofb_check_var,
-+	.fb_set_par	= glamofb_set_par,
-+	.fb_blank	= glamofb_blank,
-+	.fb_setcolreg	= glamofb_setcolreg,
-+	.fb_ioctl = glamofb_ioctl,
-+#ifdef CONFIG_MFD_GLAMO_HWACCEL
-+	.fb_cursor	= glamofb_cursor,
-+#endif
-+	.fb_fillrect	= cfb_fillrect,
-+	.fb_copyarea	= cfb_copyarea,
-+	.fb_imageblit	= cfb_imageblit,
-+};
-+
-+static int glamofb_init_regs(struct glamofb_handle *glamo)
-+{
-+	struct fb_info *info = glamo->fb;
-+
-+	glamofb_check_var(&info->var, info);
-+	glamofb_run_script(glamo, glamo_regs, ARRAY_SIZE(glamo_regs));
-+	glamofb_set_par(info);
-+
-+	return 0;
-+}
-+
-+static int __devinit glamofb_probe(struct platform_device *pdev)
-+{
-+	int rc = -EIO;
-+	struct fb_info *fbinfo;
-+	struct glamofb_handle *glamofb;
-+	struct glamo_core *core = dev_get_drvdata(pdev->dev.parent);
-+	struct glamo_fb_platform_data *mach_info;
-+
-+	printk(KERN_INFO "SMEDIA Glamo frame buffer driver (C) 2007 "
-+		"Openmoko, Inc.\n");
-+
-+	if (!core->pdata || !core->pdata->fb_data)
-+		return -ENOENT;
-+
-+
-+	fbinfo = framebuffer_alloc(sizeof(struct glamofb_handle), &pdev->dev);
-+	if (!fbinfo)
-+		return -ENOMEM;
-+
-+
-+	glamofb = fbinfo->par;
-+	glamofb->fb = fbinfo;
-+	glamofb->dev = &pdev->dev;
-+
-+	glamofb->blank_mode = FB_BLANK_POWERDOWN;
-+
-+	strcpy(fbinfo->fix.id, "SMedia Glamo");
-+
-+	glamofb->reg = platform_get_resource_byname(pdev, IORESOURCE_MEM,
-+						    "glamo-fb-regs");
-+	if (!glamofb->reg) {
-+		dev_err(&pdev->dev, "platform device with no registers?\n");
-+		rc = -ENOENT;
-+		goto out_free;
-+	}
-+
-+	glamofb->fb_res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
-+							"glamo-fb-mem");
-+	if (!glamofb->fb_res) {
-+		dev_err(&pdev->dev, "platform device with no memory ?\n");
-+		rc = -ENOENT;
-+		goto out_free;
-+	}
-+
-+	glamofb->reg = request_mem_region(glamofb->reg->start,
-+					      resource_size(glamofb->reg),
-+					      pdev->name);
-+	if (!glamofb->reg) {
-+		dev_err(&pdev->dev, "failed to request mmio region\n");
-+		goto out_free;
-+	}
-+
-+	glamofb->fb_res = request_mem_region(glamofb->fb_res->start,
-+						 resource_size(glamofb->fb_res),
-+						 pdev->name);
-+	if (!glamofb->fb_res) {
-+		dev_err(&pdev->dev, "failed to request vram region\n");
-+		goto out_release_reg;
-+	}
-+
-+	/* we want to remap only the registers required for this core
-+	 * driver. */
-+	glamofb->base = ioremap_nocache(glamofb->reg->start,
-+					resource_size(glamofb->reg));
-+	if (!glamofb->base) {
-+		dev_err(&pdev->dev, "failed to ioremap() mmio memory\n");
-+		goto out_release_fb;
-+	}
-+
-+	fbinfo->fix.smem_start = (unsigned long)glamofb->fb_res->start;
-+	fbinfo->fix.smem_len = (__u32)resource_size(glamofb->fb_res);
-+
-+	fbinfo->screen_base = ioremap(glamofb->fb_res->start,
-+					   resource_size(glamofb->fb_res));
-+	if (!fbinfo->screen_base) {
-+		dev_err(&pdev->dev, "failed to ioremap() vram memory\n");
-+		goto out_release_fb;
-+	}
-+	glamofb->cursor_addr = fbinfo->screen_base + 0x12C000;
-+
-+	platform_set_drvdata(pdev, glamofb);
-+
-+	mach_info = core->pdata->fb_data;
-+	glamofb->core = core;
-+	glamofb->mach_info = mach_info;
-+
-+	fbinfo->fix.visual = FB_VISUAL_TRUECOLOR;
-+	fbinfo->fix.type = FB_TYPE_PACKED_PIXELS;
-+	fbinfo->fix.type_aux = 0;
-+	fbinfo->fix.xpanstep = 0;
-+	fbinfo->fix.ypanstep = 0;
-+	fbinfo->fix.ywrapstep = 0;
-+	fbinfo->fix.accel = FB_ACCEL_GLAMO;
-+
-+
-+	fbinfo->fbops = &glamofb_ops;
-+	fbinfo->flags = FBINFO_FLAG_DEFAULT;
-+	fbinfo->pseudo_palette = &glamofb->pseudo_pal;
-+
-+	fbinfo->mode = mach_info->modes;
-+	fb_videomode_to_var(&fbinfo->var, fbinfo->mode);
-+	fbinfo->var.bits_per_pixel = 16;
-+	fbinfo->var.nonstd = 0;
-+	fbinfo->var.activate = FB_ACTIVATE_NOW;
-+	fbinfo->var.height = mach_info->height;
-+	fbinfo->var.width = mach_info->width;
-+	fbinfo->var.accel_flags = 0;
-+	fbinfo->var.vmode = FB_VMODE_NONINTERLACED;
-+
-+	glamo_engine_enable(core, GLAMO_ENGINE_LCD);
-+	glamo_engine_reset(core, GLAMO_ENGINE_LCD);
-+	glamofb->output_enabled = 1;
-+	glamofb->mode_set = 1;
-+
-+	dev_info(&pdev->dev, "spin_lock_init\n");
-+	spin_lock_init(&glamofb->lock_cmd);
-+	glamofb_init_regs(glamofb);
-+#ifdef CONFIG_MFD_GLAMO_HWACCEL
-+	glamofb_cursor_onoff(glamofb, 1);
-+#endif
-+
-+	fb_videomode_to_modelist(mach_info->modes, mach_info->num_modes,
-+				 &fbinfo->modelist);
-+
-+	rc = register_framebuffer(fbinfo);
-+	if (rc < 0) {
-+		dev_err(&pdev->dev, "failed to register framebuffer\n");
-+		goto out_unmap_fb;
-+	}
-+
-+	printk(KERN_INFO "fb%d: %s frame buffer device\n",
-+		fbinfo->node, fbinfo->fix.id);
-+
-+	return 0;
-+
-+out_unmap_fb:
-+	iounmap(fbinfo->screen_base);
-+	iounmap(glamofb->base);
-+out_release_fb:
-+	release_mem_region(glamofb->fb_res->start,
-+				resource_size(glamofb->fb_res));
-+out_release_reg:
-+	release_mem_region(glamofb->reg->start,
-+				resource_size(glamofb->reg));
-+out_free:
-+	framebuffer_release(fbinfo);
-+	return rc;
-+}
-+
-+static int __devexit glamofb_remove(struct platform_device *pdev)
-+{
-+	struct glamofb_handle *glamofb = platform_get_drvdata(pdev);
-+
-+	iounmap(glamofb->fb->screen_base);
-+	iounmap(glamofb->base);
-+
-+	release_mem_region(glamofb->fb_res->start,
-+				resource_size(glamofb->fb_res));
-+	release_mem_region(glamofb->reg->start, resource_size(glamofb->reg));
-+
-+	platform_set_drvdata(pdev, NULL);
-+	framebuffer_release(glamofb->fb);
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_PM
-+
-+static int glamofb_suspend(struct device *dev)
-+{
-+	struct glamofb_handle *gfb = dev_get_drvdata(dev);
-+
-+	console_lock();
-+	fb_set_suspend(gfb->fb, 1);
-+	console_unlock();
-+
-+	/* seriously -- nobody is allowed to touch glamo memory when we
-+	 * are suspended or we lock on nWAIT
-+	 */
-+	/* iounmap(gfb->fb->screen_base); */
-+
-+	return 0;
-+}
-+
-+static int glamofb_resume(struct device *dev)
-+{
-+	struct glamofb_handle *gfb = dev_get_drvdata(dev);
-+
-+	/* OK let's allow framebuffer ops again */
-+	/* gfb->fb->screen_base = ioremap(gfb->fb_res->start,
-+					   resource_size(gfb->fb_res)); */
-+	glamo_engine_enable(gfb->core, GLAMO_ENGINE_LCD);
-+	glamo_engine_reset(gfb->core, GLAMO_ENGINE_LCD);
-+
-+	glamofb_init_regs(gfb);
-+#ifdef CONFIG_MFD_GLAMO_HWACCEL
-+	glamofb_cursor_onoff(gfb, 1);
-+#endif
-+
-+	console_lock();
-+	fb_set_suspend(gfb->fb, 0);
-+	console_unlock();
-+
-+	return 0;
-+}
-+
-+static const struct dev_pm_ops glamofb_pm_ops = {
-+	.suspend = glamofb_suspend,
-+	.resume = glamofb_resume,
-+};
-+
-+#define GLAMOFB_PM_OPS (&glamofb_pm_ops)
-+
-+#else
-+#define GLAMOFB_PM_OPS NULL
-+#endif
-+
-+static struct platform_driver glamofb_driver = {
-+	.probe		= glamofb_probe,
-+	.remove		= __devexit_p(glamofb_remove),
-+	.driver		= {
-+		.name	= "glamo-fb",
-+		.owner	= THIS_MODULE,
-+		.pm	= GLAMOFB_PM_OPS
-+	},
-+};
-+
-+static int __init glamofb_init(void)
-+{
-+	return platform_driver_register(&glamofb_driver);
-+}
-+module_init(glamofb_init);
-+
-+static void __exit glamofb_cleanup(void)
-+{
-+	platform_driver_unregister(&glamofb_driver);
-+}
-+module_exit(glamofb_cleanup);
-+
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_DESCRIPTION("Smedia Glamo 336x/337x framebuffer driver");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("platform:glamo-fb");
-diff --git a/include/linux/fb.h b/include/linux/fb.h
-index 6a82748..6965285 100644
---- a/include/linux/fb.h
-+++ b/include/linux/fb.h
-@@ -135,6 +135,7 @@
- #define FB_ACCEL_NEOMAGIC_NM2360 97	/* NeoMagic NM2360              */
- #define FB_ACCEL_NEOMAGIC_NM2380 98	/* NeoMagic NM2380              */
- #define FB_ACCEL_PXA3XX		 99	/* PXA3xx			*/
-+#define FB_ACCEL_GLAMO		100	/* Smedia Glamo 3362            */
- 
- #define FB_ACCEL_SAVAGE4        0x80	/* S3 Savage4                   */
- #define FB_ACCEL_SAVAGE3D       0x81	/* S3 Savage3D                  */
-diff --git a/include/linux/glamofb.h b/include/linux/glamofb.h
-new file mode 100644
-index 0000000..896579b
---- /dev/null
-+++ b/include/linux/glamofb.h
-@@ -0,0 +1,21 @@
-+#ifndef _LINUX_GLAMOFB_H
-+#define _LINUX_GLAMOFB_H
-+
-+#ifdef __KERNEL__
-+
-+#include <linux/fb.h>
-+
-+struct glamo_fb_platform_data {
-+    int width, height;
-+
-+    int num_modes;
-+    struct fb_videomode *modes;
-+};
-+
-+#endif
-+
-+#define GLAMOFB_ENGINE_ENABLE _IOW('F', 0x1, __u32)
-+#define GLAMOFB_ENGINE_DISABLE _IOW('F', 0x2, __u32)
-+#define GLAMOFB_ENGINE_RESET _IOW('F', 0x3, __u32)
-+
-+#endif
-diff --git a/include/linux/jbt6k74.h b/include/linux/jbt6k74.h
-new file mode 100644
-index 0000000..3f0735d
---- /dev/null
-+++ b/include/linux/jbt6k74.h
-@@ -0,0 +1,18 @@
-+#ifndef __JBT6K74_H__
-+#define __JBT6K74_H__
-+
-+#include <linux/spi/spi.h>
-+
-+/*
-+ *  struct jbt6k74_platform_data - Platform data for jbt6k74 driver
-+ *  @enable_pixel_clock: Callback to enable or disable the pixelclock of the
-+ *  gpu.
-+ *  @gpio_reset: Reset gpio pin number.
-+ */
-+struct jbt6k74_platform_data {
-+	void (*enable_pixel_clock)(struct device *dev, int enable);
-+
-+	int gpio_reset;
-+};
-+
-+#endif
-diff --git a/include/linux/leds_pwm.h b/include/linux/leds_pwm.h
-index 33a0711..42d4969 100644
---- a/include/linux/leds_pwm.h
-+++ b/include/linux/leds_pwm.h
-@@ -16,6 +16,26 @@ struct led_pwm {
- struct led_pwm_platform_data {
- 	int			num_leds;
- 	struct led_pwm	*leds;
-+
-+	/* @init: The init callback is called after the pwm device for a led has
-+	 * been successfully configured. If the return value is negative it will be
-+	 * seen as an error and initzalisation of the leds-pwm device will fail.
-+	 */
-+	int (*init)(struct device *dev, struct led_pwm *led);
-+
-+	/* @notify: The notify callback is called whenever the brightness of a led
-+	 * is changed.
-+	 * The return value of the callback will be the brightness which is used to
-+	 * configure the pwm device.
-+	 */
-+	enum led_brightness (*notify)(struct device *dev, struct led_pwm *led,
-+	    enum led_brightness brightness);
-+
-+	/* @exit: The exit callback is called, whenever a led device registered by
-+	 * the leds-pwm device is unregistered. It will be called prior to freeing
-+	 * the pwm device.
-+	 */
-+	void (*exit)(struct device *dev, struct led_pwm *led);
- };
- 
- #endif
-diff --git a/include/linux/mfd/glamo-core.h b/include/linux/mfd/glamo-core.h
-new file mode 100644
-index 0000000..8275a2f
---- /dev/null
-+++ b/include/linux/mfd/glamo-core.h
-@@ -0,0 +1,58 @@
-+#ifndef __GLAMO_CORE_H
-+#define __GLAMO_CORE_H
-+
-+#include <linux/mfd/glamo.h>
-+
-+/* for the time being, we put the on-screen framebuffer into the lowest
-+ * VRAM space.  This should make the code easily compatible with the various
-+ * 2MB/4MB/8MB variants of the Smedia chips */
-+#define GLAMO_OFFSET_VRAM	0x800000
-+#define GLAMO_OFFSET_FB	(GLAMO_OFFSET_VRAM)
-+
-+/* we only allocate the minimum possible size for the framebuffer to make
-+ * sure we have sufficient memory for other functions of the chip */
-+/*#define GLAMO_FB_SIZE	(640*480*4)	*//* == 0x12c000 */
-+#define GLAMO_INTERNAL_RAM_SIZE 0x800000
-+#define GLAMO_MMC_BUFFER_SIZE (64 * 1024)
-+#define GLAMO_FB_SIZE	(GLAMO_INTERNAL_RAM_SIZE - GLAMO_MMC_BUFFER_SIZE)
-+
-+enum glamo_pll {
-+	GLAMO_PLL1,
-+	GLAMO_PLL2,
-+};
-+
-+enum glamo_engine_state {
-+	GLAMO_ENGINE_DISABLED,
-+	GLAMO_ENGINE_SUSPENDED,
-+	GLAMO_ENGINE_ENABLED,
-+};
-+
-+struct glamo_core {
-+	int irq;
-+	int irq_base;
-+	struct resource *mem;
-+	void __iomem *base;
-+	struct platform_device *pdev;
-+	struct glamo_platform_data *pdata;
-+	enum glamo_engine_state engine_state[__NUM_GLAMO_ENGINES];
-+	spinlock_t lock;
-+	uint16_t saved_irq_mask;
-+#ifdef CONFIG_DEBUG_FS
-+	struct dentry *debugfs_dir;
-+#endif
-+};
-+
-+struct glamo_script {
-+	uint16_t reg;
-+	uint16_t val;
-+};
-+
-+int glamo_pll_rate(struct glamo_core *glamo, enum glamo_pll pll);
-+
-+int glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine);
-+int glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine);
-+int glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine);
-+void glamo_engine_reset(struct glamo_core *glamo, enum glamo_engine engine);
-+int glamo_engine_reclock(struct glamo_core *glamo,
-+			 enum glamo_engine engine, int ps);
-+#endif /* __GLAMO_CORE_H */
-diff --git a/include/linux/mfd/glamo-regs.h b/include/linux/mfd/glamo-regs.h
-new file mode 100644
-index 0000000..59848e1
---- /dev/null
-+++ b/include/linux/mfd/glamo-regs.h
-@@ -0,0 +1,630 @@
-+#ifndef _GLAMO_REGS_H
-+#define _GLAMO_REGS_H
-+
-+/* Smedia Glamo 336x/337x driver
-+ *
-+ * (C) 2007 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
-+
-+enum glamo_regster_offsets {
-+	GLAMO_REGOFS_GENERIC	= 0x0000,
-+	GLAMO_REGOFS_HOSTBUS	= 0x0200,
-+	GLAMO_REGOFS_MEMORY	= 0x0300,
-+	GLAMO_REGOFS_VIDCAP	= 0x0400,
-+	GLAMO_REGOFS_ISP	= 0x0500,
-+	GLAMO_REGOFS_JPEG	= 0x0800,
-+	GLAMO_REGOFS_MPEG	= 0x0c00,
-+	GLAMO_REGOFS_LCD	= 0x1100,
-+	GLAMO_REGOFS_MMC	= 0x1400,
-+	GLAMO_REGOFS_MPROC0	= 0x1500,
-+	GLAMO_REGOFS_MPROC1	= 0x1580,
-+	GLAMO_REGOFS_CMDQUEUE	= 0x1600,
-+	GLAMO_REGOFS_RISC	= 0x1680,
-+	GLAMO_REGOFS_2D		= 0x1700,
-+	GLAMO_REGOFS_3D		= 0x1b00,
-+	GLAMO_REGOFS_END	= 0x2400,
-+};
-+
-+
-+enum glamo_register_generic {
-+	GLAMO_REG_GCONF1	= 0x0000,
-+	GLAMO_REG_GCONF2	= 0x0002,
-+#define	GLAMO_REG_DEVICE_ID	GLAMO_REG_GCONF2
-+	GLAMO_REG_GCONF3	= 0x0004,
-+#define	GLAMO_REG_REVISION_ID	GLAMO_REG_GCONF3
-+	GLAMO_REG_IRQ_GEN1	= 0x0006,
-+#define GLAMO_REG_IRQ_ENABLE	GLAMO_REG_IRQ_GEN1
-+	GLAMO_REG_IRQ_GEN2	= 0x0008,
-+#define GLAMO_REG_IRQ_SET	GLAMO_REG_IRQ_GEN2
-+	GLAMO_REG_IRQ_GEN3	= 0x000a,
-+#define GLAMO_REG_IRQ_CLEAR	GLAMO_REG_IRQ_GEN3
-+	GLAMO_REG_IRQ_GEN4	= 0x000c,
-+#define GLAMO_REG_IRQ_STATUS	GLAMO_REG_IRQ_GEN4
-+	GLAMO_REG_CLOCK_HOST	= 0x0010,
-+	GLAMO_REG_CLOCK_MEMORY	= 0x0012,
-+	GLAMO_REG_CLOCK_LCD	= 0x0014,
-+	GLAMO_REG_CLOCK_MMC	= 0x0016,
-+	GLAMO_REG_CLOCK_ISP	= 0x0018,
-+	GLAMO_REG_CLOCK_JPEG	= 0x001a,
-+	GLAMO_REG_CLOCK_3D	= 0x001c,
-+	GLAMO_REG_CLOCK_2D	= 0x001e,
-+	GLAMO_REG_CLOCK_RISC1	= 0x0020,	/* 3365 only? */
-+	GLAMO_REG_CLOCK_RISC2	= 0x0022,	/* 3365 only? */
-+	GLAMO_REG_CLOCK_MPEG	= 0x0024,
-+	GLAMO_REG_CLOCK_MPROC	= 0x0026,
-+
-+	GLAMO_REG_CLOCK_GEN5_1	= 0x0030,
-+	GLAMO_REG_CLOCK_GEN5_2	= 0x0032,
-+	GLAMO_REG_CLOCK_GEN6	= 0x0034,
-+	GLAMO_REG_CLOCK_GEN7	= 0x0036,
-+	GLAMO_REG_CLOCK_GEN8	= 0x0038,
-+	GLAMO_REG_CLOCK_GEN9	= 0x003a,
-+	GLAMO_REG_CLOCK_GEN10	= 0x003c,
-+	GLAMO_REG_CLOCK_GEN11	= 0x003e,
-+	GLAMO_REG_PLL_GEN1	= 0x0040,
-+	GLAMO_REG_PLL_GEN2	= 0x0042,
-+	GLAMO_REG_PLL_GEN3	= 0x0044,
-+	GLAMO_REG_PLL_GEN4	= 0x0046,
-+	GLAMO_REG_PLL_GEN5	= 0x0048,
-+	GLAMO_REG_GPIO_GEN1	= 0x0050,
-+	GLAMO_REG_GPIO_GEN2	= 0x0052,
-+	GLAMO_REG_GPIO_GEN3	= 0x0054,
-+	GLAMO_REG_GPIO_GEN4	= 0x0056,
-+	GLAMO_REG_GPIO_GEN5	= 0x0058,
-+	GLAMO_REG_GPIO_GEN6	= 0x005a,
-+	GLAMO_REG_GPIO_GEN7	= 0x005c,
-+	GLAMO_REG_GPIO_GEN8	= 0x005e,
-+	GLAMO_REG_GPIO_GEN9	= 0x0060,
-+	GLAMO_REG_GPIO_GEN10	= 0x0062,
-+	GLAMO_REG_DFT_GEN1	= 0x0070,
-+	GLAMO_REG_DFT_GEN2	= 0x0072,
-+	GLAMO_REG_DFT_GEN3	= 0x0074,
-+	GLAMO_REG_DFT_GEN4	= 0x0076,
-+
-+	GLAMO_REG_DFT_GEN5	= 0x01e0,
-+	GLAMO_REG_DFT_GEN6	= 0x01f0,
-+};
-+
-+#define GLAMO_REG_HOSTBUS(x)	(GLAMO_REGOFS_HOSTBUS-2+(x*2))
-+
-+#define REG_MEM(x)		(GLAMO_REGOFS_MEMORY+(x))
-+#define GLAMO_REG_MEM_TIMING(x)	(GLAMO_REG_MEM_TIMING1-2+(x*2))
-+
-+enum glamo_register_mem {
-+	GLAMO_REG_MEM_TYPE	= REG_MEM(0x00),
-+	GLAMO_REG_MEM_GEN	= REG_MEM(0x02),
-+	GLAMO_REG_MEM_TIMING1	= REG_MEM(0x04),
-+	GLAMO_REG_MEM_TIMING2	= REG_MEM(0x06),
-+	GLAMO_REG_MEM_TIMING3	= REG_MEM(0x08),
-+	GLAMO_REG_MEM_TIMING4	= REG_MEM(0x0a),
-+	GLAMO_REG_MEM_TIMING5	= REG_MEM(0x0c),
-+	GLAMO_REG_MEM_TIMING6	= REG_MEM(0x0e),
-+	GLAMO_REG_MEM_TIMING7	= REG_MEM(0x10),
-+	GLAMO_REG_MEM_TIMING8	= REG_MEM(0x12),
-+	GLAMO_REG_MEM_TIMING9	= REG_MEM(0x14),
-+	GLAMO_REG_MEM_TIMING10	= REG_MEM(0x16),
-+	GLAMO_REG_MEM_TIMING11	= REG_MEM(0x18),
-+	GLAMO_REG_MEM_POWER1	= REG_MEM(0x1a),
-+	GLAMO_REG_MEM_POWER2	= REG_MEM(0x1c),
-+	GLAMO_REG_MEM_LCD_BUF1	= REG_MEM(0x1e),
-+	GLAMO_REG_MEM_LCD_BUF2	= REG_MEM(0x20),
-+	GLAMO_REG_MEM_LCD_BUF3	= REG_MEM(0x22),
-+	GLAMO_REG_MEM_LCD_BUF4	= REG_MEM(0x24),
-+	GLAMO_REG_MEM_BIST1	= REG_MEM(0x26),
-+	GLAMO_REG_MEM_BIST2	= REG_MEM(0x28),
-+	GLAMO_REG_MEM_BIST3	= REG_MEM(0x2a),
-+	GLAMO_REG_MEM_BIST4	= REG_MEM(0x2c),
-+	GLAMO_REG_MEM_BIST5	= REG_MEM(0x2e),
-+	GLAMO_REG_MEM_MAH1	= REG_MEM(0x30),
-+	GLAMO_REG_MEM_MAH2	= REG_MEM(0x32),
-+	GLAMO_REG_MEM_DRAM1	= REG_MEM(0x34),
-+	GLAMO_REG_MEM_DRAM2	= REG_MEM(0x36),
-+	GLAMO_REG_MEM_CRC	= REG_MEM(0x38),
-+};
-+
-+#define GLAMO_MEM_TYPE_MASK	0x03
-+
-+enum glamo_reg_mem_dram1 {
-+	/* b0 - b10 == refresh period, 1 -> 2048 clocks */
-+	GLAMO_MEM_DRAM1_EN_GATE_CLK	= (1 << 11),
-+	GLAMO_MEM_DRAM1_SELF_REFRESH	= (1 << 12),
-+	GLAMO_MEM_DRAM1_EN_GATE_CKE	= (1 << 13),
-+	GLAMO_MEM_DRAM1_EN_DRAM_REFRESH	= (1 << 14),
-+	GLAMO_MEM_DRAM1_EN_MODEREG_SET	= (1 << 15),
-+};
-+
-+enum glamo_reg_mem_dram2 {
-+	GLAMO_MEM_DRAM2_DEEP_PWRDOWN	= (1 << 12),
-+};
-+
-+enum glamo_irq_index {
-+	GLAMO_IRQIDX_HOSTBUS	= 0,
-+	GLAMO_IRQIDX_JPEG	= 1,
-+	GLAMO_IRQIDX_MPEG	= 2,
-+	GLAMO_IRQIDX_MPROC1	= 3,
-+	GLAMO_IRQIDX_MPROC0	= 4,
-+	GLAMO_IRQIDX_CMDQUEUE	= 5,
-+	GLAMO_IRQIDX_2D		= 6,
-+	GLAMO_IRQIDX_MMC	= 7,
-+	GLAMO_IRQIDX_RISC	= 8,
-+};
-+
-+enum glamo_irq {
-+	GLAMO_IRQ_HOSTBUS	= (1 << GLAMO_IRQIDX_HOSTBUS),
-+	GLAMO_IRQ_JPEG		= (1 << GLAMO_IRQIDX_JPEG),
-+	GLAMO_IRQ_MPEG		= (1 << GLAMO_IRQIDX_MPEG),
-+	GLAMO_IRQ_MPROC1	= (1 << GLAMO_IRQIDX_MPROC1),
-+	GLAMO_IRQ_MPROC0	= (1 << GLAMO_IRQIDX_MPROC0),
-+	GLAMO_IRQ_CMDQUEUE	= (1 << GLAMO_IRQIDX_CMDQUEUE),
-+	GLAMO_IRQ_2D		= (1 << GLAMO_IRQIDX_2D),
-+	GLAMO_IRQ_MMC		= (1 << GLAMO_IRQIDX_MMC),
-+	GLAMO_IRQ_RISC		= (1 << GLAMO_IRQIDX_RISC),
-+};
-+
-+enum glamo_reg_clock_host {
-+	GLAMO_CLOCK_HOST_DG_BCLK	= 0x0001,
-+	GLAMO_CLOCK_HOST_DG_M0CLK	= 0x0004,
-+	GLAMO_CLOCK_HOST_RESET		= 0x1000,
-+};
-+
-+enum glamo_reg_clock_mem {
-+	GLAMO_CLOCK_MEM_DG_M1CLK	= 0x0001,
-+	GLAMO_CLOCK_MEM_EN_M1CLK	= 0x0002,
-+	GLAMO_CLOCK_MEM_DG_MOCACLK	= 0x0004,
-+	GLAMO_CLOCK_MEM_EN_MOCACLK	= 0x0008,
-+	GLAMO_CLOCK_MEM_RESET		= 0x1000,
-+	GLAMO_CLOCK_MOCA_RESET		= 0x2000,
-+};
-+
-+enum glamo_reg_clock_lcd {
-+	GLAMO_CLOCK_LCD_DG_DCLK		= 0x0001,
-+	GLAMO_CLOCK_LCD_EN_DCLK		= 0x0002,
-+	GLAMO_CLOCK_LCD_DG_DMCLK	= 0x0004,
-+	GLAMO_CLOCK_LCD_EN_DMCLK	= 0x0008,
-+	GLAMO_CLOCK_LCD_EN_DHCLK	= 0x0020,
-+	GLAMO_CLOCK_LCD_DG_M5CLK	= 0x0040,
-+	GLAMO_CLOCK_LCD_EN_M5CLK	= 0x0080,
-+	GLAMO_CLOCK_LCD_RESET		= 0x1000,
-+};
-+
-+enum glamo_reg_clock_mmc {
-+	GLAMO_CLOCK_MMC_DG_TCLK		= 0x0001,
-+	GLAMO_CLOCK_MMC_EN_TCLK		= 0x0002,
-+	GLAMO_CLOCK_MMC_DG_M9CLK	= 0x0004,
-+	GLAMO_CLOCK_MMC_EN_M9CLK	= 0x0008,
-+	GLAMO_CLOCK_MMC_RESET		= 0x1000,
-+};
-+
-+enum glamo_reg_basic_mmc {
-+	/* set to disable CRC error rejection */
-+	GLAMO_BASIC_MMC_DISABLE_CRC	= 0x0001,
-+	/* enable completion interrupt */
-+	GLAMO_BASIC_MMC_EN_COMPL_INT	= 0x0002,
-+	/* stop MMC clock while enforced idle waiting for data from card */
-+	GLAMO_BASIC_MMC_NO_CLK_RD_WAIT	= 0x0004,
-+	/* 0 = 1-bit bus to card, 1 = use 4-bit bus (has to be negotiated) */
-+	GLAMO_BASIC_MMC_EN_4BIT_DATA	= 0x0008,
-+	/* enable 75K pullups on D3..D0 */
-+	GLAMO_BASIC_MMC_EN_DATA_PUPS	= 0x0010,
-+	/* enable 75K pullup on CMD */
-+	GLAMO_BASIC_MMC_EN_CMD_PUP	= 0x0020,
-+	/* IO drive strength 00=weak -> 11=strongest */
-+	GLAMO_BASIC_MMC_EN_DR_STR0	= 0x0040,
-+	GLAMO_BASIC_MMC_EN_DR_STR1	= 0x0080,
-+	/* TCLK delay stage A, 0000 = 500ps --> 1111 = 8ns */
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYA0	= 0x0100,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYA1	= 0x0200,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYA2	= 0x0400,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYA3	= 0x0800,
-+	/* TCLK delay stage B (cumulative), 0000 = 500ps --> 1111 = 8ns */
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYB0	= 0x1000,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYB1	= 0x2000,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYB2	= 0x4000,
-+	GLAMO_BASIC_MMC_EN_TCLK_DLYB3	= 0x8000,
-+};
-+
-+enum glamo_reg_stat1_mmc {
-+	/* command "counter" (really: toggle) */
-+	GLAMO_STAT1_MMC_CMD_CTR	= 0x8000,
-+	/* engine is idle */
-+	GLAMO_STAT1_MMC_IDLE	= 0x4000,
-+	/* readback response is ready */
-+	GLAMO_STAT1_MMC_RB_RRDY	= 0x0200,
-+	/* readback data is ready */
-+	GLAMO_STAT1_MMC_RB_DRDY	= 0x0100,
-+	/* no response timeout */
-+	GLAMO_STAT1_MMC_RTOUT	= 0x0020,
-+	/* no data timeout */
-+	GLAMO_STAT1_MMC_DTOUT	= 0x0010,
-+	/* CRC error on block write */
-+	GLAMO_STAT1_MMC_BWERR	= 0x0004,
-+	/* CRC error on block read */
-+	GLAMO_STAT1_MMC_BRERR	= 0x0002
-+};
-+
-+enum glamo_reg_fire_mmc {
-+	/* command "counter" (really: toggle)
-+	 * the STAT1 register reflects this so you can ensure you don't look
-+	 * at status for previous command
-+	 */
-+	GLAMO_FIRE_MMC_CMD_CTR	= 0x8000,
-+	/* sets kind of response expected */
-+	GLAMO_FIRE_MMC_RES_MASK	= 0x0700,
-+	/* sets command type */
-+	GLAMO_FIRE_MMC_TYP_MASK	= 0x00C0,
-+	/* sets command class */
-+	GLAMO_FIRE_MMC_CLS_MASK	= 0x000F,
-+};
-+
-+enum glamo_fire_mmc_response_types {
-+	GLAMO_FIRE_MMC_RSPT_R1	= 0x0000,
-+	GLAMO_FIRE_MMC_RSPT_R1b	= 0x0100,
-+	GLAMO_FIRE_MMC_RSPT_R2	= 0x0200,
-+	GLAMO_FIRE_MMC_RSPT_R3	= 0x0300,
-+	GLAMO_FIRE_MMC_RSPT_R4	= 0x0400,
-+	GLAMO_FIRE_MMC_RSPT_R5	= 0x0500,
-+};
-+
-+enum glamo_fire_mmc_command_types {
-+	/* broadcast, no response */
-+	GLAMO_FIRE_MMC_CMDT_BNR	= 0x0000,
-+	/* broadcast, with response */
-+	GLAMO_FIRE_MMC_CMDT_BR	= 0x0040,
-+	/* addressed, no data */
-+	GLAMO_FIRE_MMC_CMDT_AND	= 0x0080,
-+	/* addressed, with data */
-+	GLAMO_FIRE_MMC_CMDT_AD	= 0x00C0,
-+};
-+
-+enum glamo_fire_mmc_command_class {
-+	/* "Stream Read" */
-+	GLAMO_FIRE_MMC_CC_STRR	= 0x0000,
-+	/* Single Block Read */
-+	GLAMO_FIRE_MMC_CC_SBR	= 0x0001,
-+	/* Multiple Block Read With Stop */
-+	GLAMO_FIRE_MMC_CC_MBRS	= 0x0002,
-+	/* Multiple Block Read No Stop */
-+	GLAMO_FIRE_MMC_CC_MBRNS	= 0x0003,
-+	/* RESERVED for "Stream Write" */
-+	GLAMO_FIRE_MMC_CC_STRW	= 0x0004,
-+	/* "Stream Write" */
-+	GLAMO_FIRE_MMC_CC_SBW	= 0x0005,
-+	/* RESERVED for Multiple Block Write With Stop */
-+	GLAMO_FIRE_MMC_CC_MBWS	= 0x0006,
-+	/* Multiple Block Write No Stop */
-+	GLAMO_FIRE_MMC_CC_MBWNS	= 0x0007,
-+	/* STOP command */
-+	GLAMO_FIRE_MMC_CC_STOP	= 0x0008,
-+	/* Cancel on Running Command */
-+	GLAMO_FIRE_MMC_CC_CANCL	= 0x0009,
-+	/* "Basic Command" */
-+	GLAMO_FIRE_MMC_CC_BASIC	= 0x000a,
-+};
-+
-+/* these are offsets from the start of the MMC register region */
-+enum glamo_register_mmc {
-+	/* MMC command, b15..8 = cmd arg b7..0; b7..1 = CRC; b0 = end bit */
-+	GLAMO_REG_MMC_CMD_REG1	= 0x00,
-+	/* MMC command, b15..0 = cmd arg b23 .. 8 */
-+	GLAMO_REG_MMC_CMD_REG2	= 0x02,
-+	/* MMC command, b15=start, b14=transmission,
-+	 * b13..8=cmd idx, b7..0=cmd arg b31..24
-+	 */
-+	GLAMO_REG_MMC_CMD_REG3	= 0x04,
-+	GLAMO_REG_MMC_CMD_FIRE	= 0x06,
-+	GLAMO_REG_MMC_CMD_RSP1	= 0x10,
-+	GLAMO_REG_MMC_CMD_RSP2	= 0x12,
-+	GLAMO_REG_MMC_CMD_RSP3	= 0x14,
-+	GLAMO_REG_MMC_CMD_RSP4	= 0x16,
-+	GLAMO_REG_MMC_CMD_RSP5	= 0x18,
-+	GLAMO_REG_MMC_CMD_RSP6	= 0x1a,
-+	GLAMO_REG_MMC_CMD_RSP7	= 0x1c,
-+	GLAMO_REG_MMC_CMD_RSP8	= 0x1e,
-+	GLAMO_REG_MMC_RB_STAT1	= 0x20,
-+	GLAMO_REG_MMC_RB_BLKCNT	= 0x22,
-+	GLAMO_REG_MMC_RB_BLKLEN	= 0x24,
-+	GLAMO_REG_MMC_BASIC	= 0x30,
-+	GLAMO_REG_MMC_RDATADS1	= 0x34,
-+	GLAMO_REG_MMC_RDATADS2	= 0x36,
-+	GLAMO_REG_MMC_WDATADS1	= 0x38,
-+	GLAMO_REG_MMC_WDATADS2	= 0x3a,
-+	GLAMO_REG_MMC_DATBLKCNT	= 0x3c,
-+	GLAMO_REG_MMC_DATBLKLEN	= 0x3e,
-+	GLAMO_REG_MMC_TIMEOUT	= 0x40,
-+
-+};
-+
-+enum glamo_reg_clock_isp {
-+	GLAMO_CLOCK_ISP_DG_I1CLK	= 0x0001,
-+	GLAMO_CLOCK_ISP_EN_I1CLK	= 0x0002,
-+	GLAMO_CLOCK_ISP_DG_CCLK		= 0x0004,
-+	GLAMO_CLOCK_ISP_EN_CCLK		= 0x0008,
-+	GLAMO_CLOCK_ISP_EN_SCLK		= 0x0020,
-+	GLAMO_CLOCK_ISP_DG_M2CLK	= 0x0040,
-+	GLAMO_CLOCK_ISP_EN_M2CLK	= 0x0080,
-+	GLAMO_CLOCK_ISP_DG_M15CLK	= 0x0100,
-+	GLAMO_CLOCK_ISP_EN_M15CLK	= 0x0200,
-+	GLAMO_CLOCK_ISP1_RESET		= 0x1000,
-+	GLAMO_CLOCK_ISP2_RESET		= 0x2000,
-+};
-+
-+enum glamo_reg_clock_jpeg {
-+	GLAMO_CLOCK_JPEG_DG_JCLK	= 0x0001,
-+	GLAMO_CLOCK_JPEG_EN_JCLK	= 0x0002,
-+	GLAMO_CLOCK_JPEG_DG_M3CLK	= 0x0004,
-+	GLAMO_CLOCK_JPEG_EN_M3CLK	= 0x0008,
-+	GLAMO_CLOCK_JPEG_RESET		= 0x1000,
-+};
-+
-+enum glamo_reg_clock_2d {
-+	GLAMO_CLOCK_2D_DG_GCLK		= 0x0001,
-+	GLAMO_CLOCK_2D_EN_GCLK		= 0x0002,
-+	GLAMO_CLOCK_2D_DG_M7CLK		= 0x0004,
-+	GLAMO_CLOCK_2D_EN_M7CLK		= 0x0008,
-+	GLAMO_CLOCK_2D_DG_M6CLK		= 0x0010,
-+	GLAMO_CLOCK_2D_EN_M6CLK		= 0x0020,
-+	GLAMO_CLOCK_2D_RESET		= 0x1000,
-+	GLAMO_CLOCK_2D_CQ_RESET		= 0x2000,
-+};
-+
-+enum glamo_reg_clock_3d {
-+	GLAMO_CLOCK_3D_DG_ECLK		= 0x0001,
-+	GLAMO_CLOCK_3D_EN_ECLK		= 0x0002,
-+	GLAMO_CLOCK_3D_DG_RCLK		= 0x0004,
-+	GLAMO_CLOCK_3D_EN_RCLK		= 0x0008,
-+	GLAMO_CLOCK_3D_DG_M8CLK		= 0x0010,
-+	GLAMO_CLOCK_3D_EN_M8CLK		= 0x0020,
-+	GLAMO_CLOCK_3D_BACK_RESET	= 0x1000,
-+	GLAMO_CLOCK_3D_FRONT_RESET	= 0x2000,
-+};
-+
-+enum glamo_reg_clock_mpeg {
-+	GLAMO_CLOCK_MPEG_DG_X0CLK	= 0x0001,
-+	GLAMO_CLOCK_MPEG_EN_X0CLK	= 0x0002,
-+	GLAMO_CLOCK_MPEG_DG_X1CLK	= 0x0004,
-+	GLAMO_CLOCK_MPEG_EN_X1CLK	= 0x0008,
-+	GLAMO_CLOCK_MPEG_DG_X2CLK	= 0x0010,
-+	GLAMO_CLOCK_MPEG_EN_X2CLK	= 0x0020,
-+	GLAMO_CLOCK_MPEG_DG_X3CLK	= 0x0040,
-+	GLAMO_CLOCK_MPEG_EN_X3CLK	= 0x0080,
-+	GLAMO_CLOCK_MPEG_DG_X4CLK	= 0x0100,
-+	GLAMO_CLOCK_MPEG_EN_X4CLK	= 0x0200,
-+	GLAMO_CLOCK_MPEG_DG_X6CLK	= 0x0400,
-+	GLAMO_CLOCK_MPEG_EN_X6CLK	= 0x0800,
-+	GLAMO_CLOCK_MPEG_ENC_RESET	= 0x1000,
-+	GLAMO_CLOCK_MPEG_DEC_RESET	= 0x2000,
-+};
-+
-+enum glamo_reg_clock51 {
-+	GLAMO_CLOCK_GEN51_EN_DIV_MCLK	= 0x0001,
-+	GLAMO_CLOCK_GEN51_EN_DIV_SCLK	= 0x0002,
-+	GLAMO_CLOCK_GEN51_EN_DIV_JCLK	= 0x0004,
-+	GLAMO_CLOCK_GEN51_EN_DIV_DCLK	= 0x0008,
-+	GLAMO_CLOCK_GEN51_EN_DIV_DMCLK	= 0x0010,
-+	GLAMO_CLOCK_GEN51_EN_DIV_DHCLK	= 0x0020,
-+	GLAMO_CLOCK_GEN51_EN_DIV_GCLK	= 0x0040,
-+	GLAMO_CLOCK_GEN51_EN_DIV_TCLK	= 0x0080,
-+	/* FIXME: higher bits */
-+};
-+
-+enum glamo_reg_hostbus2 {
-+	GLAMO_HOSTBUS2_MMIO_EN_ISP	= 0x0001,
-+	GLAMO_HOSTBUS2_MMIO_EN_JPEG	= 0x0002,
-+	GLAMO_HOSTBUS2_MMIO_EN_MPEG	= 0x0004,
-+	GLAMO_HOSTBUS2_MMIO_EN_LCD	= 0x0008,
-+	GLAMO_HOSTBUS2_MMIO_EN_MMC	= 0x0010,
-+	GLAMO_HOSTBUS2_MMIO_EN_MICROP0	= 0x0020,
-+	GLAMO_HOSTBUS2_MMIO_EN_MICROP1	= 0x0040,
-+	GLAMO_HOSTBUS2_MMIO_EN_CQ	= 0x0080,
-+	GLAMO_HOSTBUS2_MMIO_EN_RISC	= 0x0100,
-+	GLAMO_HOSTBUS2_MMIO_EN_2D	= 0x0200,
-+	GLAMO_HOSTBUS2_MMIO_EN_3D	= 0x0400,
-+};
-+
-+/* LCD Controller */
-+
-+#define REG_LCD(x)	(x)
-+enum glamo_reg_lcd {
-+	GLAMO_REG_LCD_MODE1		= REG_LCD(0x00),
-+	GLAMO_REG_LCD_MODE2		= REG_LCD(0x02),
-+	GLAMO_REG_LCD_MODE3		= REG_LCD(0x04),
-+	GLAMO_REG_LCD_WIDTH		= REG_LCD(0x06),
-+	GLAMO_REG_LCD_HEIGHT		= REG_LCD(0x08),
-+	GLAMO_REG_LCD_POLARITY		= REG_LCD(0x0a),
-+	GLAMO_REG_LCD_A_BASE1		= REG_LCD(0x0c),
-+	GLAMO_REG_LCD_A_BASE2		= REG_LCD(0x0e),
-+	GLAMO_REG_LCD_B_BASE1		= REG_LCD(0x10),
-+	GLAMO_REG_LCD_B_BASE2		= REG_LCD(0x12),
-+	GLAMO_REG_LCD_C_BASE1		= REG_LCD(0x14),
-+	GLAMO_REG_LCD_C_BASE2		= REG_LCD(0x16),
-+	GLAMO_REG_LCD_PITCH		= REG_LCD(0x18),
-+	/* RES */
-+	GLAMO_REG_LCD_HORIZ_TOTAL	= REG_LCD(0x1c),
-+	/* RES */
-+	GLAMO_REG_LCD_HORIZ_RETR_START	= REG_LCD(0x20),
-+	/* RES */
-+	GLAMO_REG_LCD_HORIZ_RETR_END	= REG_LCD(0x24),
-+	/* RES */
-+	GLAMO_REG_LCD_HORIZ_DISP_START	= REG_LCD(0x28),
-+	/* RES */
-+	GLAMO_REG_LCD_HORIZ_DISP_END	= REG_LCD(0x2c),
-+	/* RES */
-+	GLAMO_REG_LCD_VERT_TOTAL	= REG_LCD(0x30),
-+	/* RES */
-+	GLAMO_REG_LCD_VERT_RETR_START	= REG_LCD(0x34),
-+	/* RES */
-+	GLAMO_REG_LCD_VERT_RETR_END	= REG_LCD(0x38),
-+	/* RES */
-+	GLAMO_REG_LCD_VERT_DISP_START	= REG_LCD(0x3c),
-+	/* RES */
-+	GLAMO_REG_LCD_VERT_DISP_END	= REG_LCD(0x40),
-+	/* RES */
-+	GLAMO_REG_LCD_POL		= REG_LCD(0x44),
-+	GLAMO_REG_LCD_DATA_START	= REG_LCD(0x46),
-+	GLAMO_REG_LCD_FRATE_CONTRO	= REG_LCD(0x48),
-+	GLAMO_REG_LCD_DATA_CMD_HDR	= REG_LCD(0x4a),
-+	GLAMO_REG_LCD_SP_START		= REG_LCD(0x4c),
-+	GLAMO_REG_LCD_SP_END		= REG_LCD(0x4e),
-+	GLAMO_REG_LCD_CURSOR_BASE1	= REG_LCD(0x50),
-+	GLAMO_REG_LCD_CURSOR_BASE2	= REG_LCD(0x52),
-+	GLAMO_REG_LCD_CURSOR_PITCH	= REG_LCD(0x54),
-+	GLAMO_REG_LCD_CURSOR_X_SIZE	= REG_LCD(0x56),
-+	GLAMO_REG_LCD_CURSOR_Y_SIZE	= REG_LCD(0x58),
-+	GLAMO_REG_LCD_CURSOR_X_POS	= REG_LCD(0x5a),
-+	GLAMO_REG_LCD_CURSOR_Y_POS	= REG_LCD(0x5c),
-+	GLAMO_REG_LCD_CURSOR_PRESET	= REG_LCD(0x5e),
-+	GLAMO_REG_LCD_CURSOR_FG_COLOR	= REG_LCD(0x60),
-+	/* RES */
-+	GLAMO_REG_LCD_CURSOR_BG_COLOR	= REG_LCD(0x64),
-+	/* RES */
-+	GLAMO_REG_LCD_CURSOR_DST_COLOR	= REG_LCD(0x68),
-+	/* RES */
-+	GLAMO_REG_LCD_STATUS1		= REG_LCD(0x80),
-+	GLAMO_REG_LCD_STATUS2		= REG_LCD(0x82),
-+	GLAMO_REG_LCD_STATUS3		= REG_LCD(0x84),
-+	GLAMO_REG_LCD_STATUS4		= REG_LCD(0x86),
-+	/* RES */
-+	GLAMO_REG_LCD_COMMAND1		= REG_LCD(0xa0),
-+	GLAMO_REG_LCD_COMMAND2		= REG_LCD(0xa2),
-+	/* RES */
-+	GLAMO_REG_LCD_WFORM_DELAY1	= REG_LCD(0xb0),
-+	GLAMO_REG_LCD_WFORM_DELAY2	= REG_LCD(0xb2),
-+	/* RES */
-+	GLAMO_REG_LCD_GAMMA_CORR	= REG_LCD(0x100),
-+	/* RES */
-+	GLAMO_REG_LCD_GAMMA_R_ENTRY01	= REG_LCD(0x110),
-+	GLAMO_REG_LCD_GAMMA_R_ENTRY23	= REG_LCD(0x112),
-+	GLAMO_REG_LCD_GAMMA_R_ENTRY45	= REG_LCD(0x114),
-+	GLAMO_REG_LCD_GAMMA_R_ENTRY67	= REG_LCD(0x116),
-+	GLAMO_REG_LCD_GAMMA_R_ENTRY8	= REG_LCD(0x118),
-+	/* RES */
-+	GLAMO_REG_LCD_GAMMA_G_ENTRY01	= REG_LCD(0x130),
-+	GLAMO_REG_LCD_GAMMA_G_ENTRY23	= REG_LCD(0x132),
-+	GLAMO_REG_LCD_GAMMA_G_ENTRY45	= REG_LCD(0x134),
-+	GLAMO_REG_LCD_GAMMA_G_ENTRY67	= REG_LCD(0x136),
-+	GLAMO_REG_LCD_GAMMA_G_ENTRY8	= REG_LCD(0x138),
-+	/* RES */
-+	GLAMO_REG_LCD_GAMMA_B_ENTRY01	= REG_LCD(0x150),
-+	GLAMO_REG_LCD_GAMMA_B_ENTRY23	= REG_LCD(0x152),
-+	GLAMO_REG_LCD_GAMMA_B_ENTRY45	= REG_LCD(0x154),
-+	GLAMO_REG_LCD_GAMMA_B_ENTRY67	= REG_LCD(0x156),
-+	GLAMO_REG_LCD_GAMMA_B_ENTRY8	= REG_LCD(0x158),
-+	/* RES */
-+	GLAMO_REG_LCD_SRAM_DRIVING1	= REG_LCD(0x160),
-+	GLAMO_REG_LCD_SRAM_DRIVING2	= REG_LCD(0x162),
-+	GLAMO_REG_LCD_SRAM_DRIVING3	= REG_LCD(0x164),
-+};
-+
-+enum glamo_reg_lcd_mode1 {
-+	GLAMO_LCD_MODE1_PWRSAVE		= 0x0001,
-+	GLAMO_LCD_MODE1_PARTIAL_PRT	= 0x0002,
-+	GLAMO_LCD_MODE1_HWFLIP		= 0x0004,
-+	GLAMO_LCD_MODE1_LCD2		= 0x0008,
-+	/* RES */
-+	GLAMO_LCD_MODE1_PARTIAL_MODE	= 0x0020,
-+	GLAMO_LCD_MODE1_CURSOR_DSTCOLOR	= 0x0040,
-+	GLAMO_LCD_MODE1_PARTIAL_ENABLE	= 0x0080,
-+	GLAMO_LCD_MODE1_TVCLK_IN_ENABLE	= 0x0100,
-+	GLAMO_LCD_MODE1_HSYNC_HIGH_ACT	= 0x0200,
-+	GLAMO_LCD_MODE1_VSYNC_HIGH_ACT	= 0x0400,
-+	GLAMO_LCD_MODE1_HSYNC_FLIP	= 0x0800,
-+	GLAMO_LCD_MODE1_GAMMA_COR_EN	= 0x1000,
-+	GLAMO_LCD_MODE1_DITHER_EN	= 0x2000,
-+	GLAMO_LCD_MODE1_CURSOR_EN	= 0x4000,
-+	GLAMO_LCD_MODE1_ROTATE_EN	= 0x8000,
-+};
-+
-+enum glamo_reg_lcd_mode2 {
-+	GLAMO_LCD_MODE2_CRC_CHECK_EN	= 0x0001,
-+	GLAMO_LCD_MODE2_DCMD_PER_LINE	= 0x0002,
-+	GLAMO_LCD_MODE2_NOUSE_BDEF	= 0x0004,
-+	GLAMO_LCD_MODE2_OUT_POS_MODE	= 0x0008,
-+	GLAMO_LCD_MODE2_FRATE_CTRL_EN	= 0x0010,
-+	GLAMO_LCD_MODE2_SINGLE_BUFFER	= 0x0020,
-+	GLAMO_LCD_MODE2_SER_LSB_TO_MSB	= 0x0040,
-+	/* FIXME */
-+};
-+
-+enum glamo_reg_lcd_mode3 {
-+	/* LCD color source data format */
-+	GLAMO_LCD_SRC_RGB565		= 0x0000,
-+	GLAMO_LCD_SRC_ARGB1555		= 0x4000,
-+	GLAMO_LCD_SRC_ARGB4444		= 0x8000,
-+	/* interface type */
-+	GLAMO_LCD_MODE3_LCD		= 0x1000,
-+	GLAMO_LCD_MODE3_RGB		= 0x0800,
-+	GLAMO_LCD_MODE3_CPU		= 0x0000,
-+	/* mode */
-+	GLAMO_LCD_MODE3_RGB332		= 0x0000,
-+	GLAMO_LCD_MODE3_RGB444		= 0x0100,
-+	GLAMO_LCD_MODE3_RGB565		= 0x0200,
-+	GLAMO_LCD_MODE3_RGB666		= 0x0300,
-+	/* depth */
-+	GLAMO_LCD_MODE3_6BITS		= 0x0000,
-+	GLAMO_LCD_MODE3_8BITS		= 0x0010,
-+	GLAMO_LCD_MODE3_9BITS		= 0x0020,
-+	GLAMO_LCD_MODE3_16BITS		= 0x0030,
-+	GLAMO_LCD_MODE3_18BITS		= 0x0040,
-+};
-+
-+enum glamo_lcd_rot_mode {
-+	GLAMO_LCD_ROT_MODE_0            = 0x0000,
-+	GLAMO_LCD_ROT_MODE_180          = 0x2000,
-+	GLAMO_LCD_ROT_MODE_MIRROR       = 0x4000,
-+	GLAMO_LCD_ROT_MODE_FLIP         = 0x6000,
-+	GLAMO_LCD_ROT_MODE_90           = 0x8000,
-+	GLAMO_LCD_ROT_MODE_270          = 0xa000,
-+};
-+#define GLAMO_LCD_ROT_MODE_MASK         0xe000
-+
-+enum glamo_lcd_cmd_type {
-+	GLAMO_LCD_CMD_TYPE_DISP		 = 0x0000,
-+	GLAMO_LCD_CMD_TYPE_PARALLEL	 = 0x4000,
-+	GLAMO_LCD_CMD_TYPE_SERIAL	 = 0x8000,
-+	GLAMO_LCD_CMD_TYPE_SERIAL_DIRECT = 0xc000,
-+};
-+#define GLAMO_LCD_CMD_TYPE_MASK		0xc000
-+
-+enum glamo_lcd_cmds {
-+	GLAMO_LCD_CMD_DATA_DISP_FIRE	= 0x00,
-+	GLAMO_LCD_CMD_DATA_DISP_SYNC	= 0x01,		/* RGB only */
-+	/* switch to command mode, no display */
-+	GLAMO_LCD_CMD_DATA_FIRE_NO_DISP	= 0x02,
-+	/* display until VSYNC, switch to command */
-+	GLAMO_LCD_CMD_DATA_FIRE_VSYNC	= 0x11,
-+	/* display until HSYNC, switch to command */
-+	GLAMO_LCD_CMD_DATA_FIRE_HSYNC	= 0x12,
-+	/* display until VSYNC, 1 black frame, VSYNC, switch to command */
-+	GLAMO_LCD_CMD_DATA_FIRE_VSYNC_B	= 0x13,
-+	/* don't care about display and switch to command */
-+	GLAMO_LCD_CMD_DATA_FIRE_FREE	= 0x14,		/* RGB only */
-+	/* don't care about display, keep data display but disable data,
-+	 * and switch to command */
-+	GLAMO_LCD_CMD_DATA_FIRE_FREE_D	= 0x15,		/* RGB only */
-+};
-+
-+enum glamo_core_revisions {
-+	GLAMO_CORE_REV_A0		= 0x0000,
-+	GLAMO_CORE_REV_A1		= 0x0001,
-+	GLAMO_CORE_REV_A2		= 0x0002,
-+	GLAMO_CORE_REV_A3		= 0x0003,
-+};
-+
-+#endif /* _GLAMO_REGS_H */
-diff --git a/include/linux/mfd/glamo.h b/include/linux/mfd/glamo.h
-new file mode 100644
-index 0000000..b8dfaef
---- /dev/null
-+++ b/include/linux/mfd/glamo.h
-@@ -0,0 +1,53 @@
-+#ifndef __GLAMO_MFD_H
-+#define __GLAMO_MFD_H
-+
-+struct glamo_core;
-+struct glamo_spigpio_platform_data;
-+struct glamo_fb_platform_data;
-+
-+struct glamo_mmc_platform_data {
-+	int	(*glamo_mmc_use_slow)(void);
-+
-+	unsigned nonremovable:1;
-+
-+	struct glamo_core *core;
-+};
-+
-+struct glamo_gpio_platform_data {
-+	int base;
-+};
-+
-+struct glamo_platform_data {
-+	struct glamo_fb_platform_data	*fb_data;
-+	struct glamo_mmc_platform_data	*mmc_data;
-+	struct glamo_gpio_platform_data	*gpio_data;
-+
-+	unsigned int osci_clock_rate;
-+
-+	void (*glamo_external_reset)(int);
-+};
-+
-+enum glamo_engine {
-+	GLAMO_ENGINE_CAPTURE = 0,
-+	GLAMO_ENGINE_ISP = 1,
-+	GLAMO_ENGINE_JPEG = 2,
-+	GLAMO_ENGINE_MPEG_ENC = 3,
-+	GLAMO_ENGINE_MPEG_DEC = 4,
-+	GLAMO_ENGINE_LCD = 5,
-+	GLAMO_ENGINE_CMDQ = 6,
-+	GLAMO_ENGINE_2D = 7,
-+	GLAMO_ENGINE_3D = 8,
-+	GLAMO_ENGINE_MMC = 9,
-+	GLAMO_ENGINE_MICROP0 = 10,
-+	GLAMO_ENGINE_RISC = 11,
-+	GLAMO_ENGINE_MICROP1_MPEG_ENC = 12,
-+	GLAMO_ENGINE_MICROP1_MPEG_DEC = 13,
-+#if 0
-+	GLAMO_ENGINE_H264_DEC = 14,
-+	GLAMO_ENGINE_RISC1 = 15,
-+	GLAMO_ENGINE_SPI = 16,
-+#endif
-+	__NUM_GLAMO_ENGINES
-+};
-+
-+#endif
-diff --git a/include/linux/mfd/pcf50633/core.h b/include/linux/mfd/pcf50633/core.h
-index 50d4a04..bec3cb7 100644
---- a/include/linux/mfd/pcf50633/core.h
-+++ b/include/linux/mfd/pcf50633/core.h
-@@ -1,4 +1,5 @@
- /*
-+
-  * core.h  -- Core driver for NXP PCF50633
-  *
-  * (C) 2006-2008 by Openmoko, Inc.
-@@ -14,7 +15,6 @@
- #define __LINUX_MFD_PCF50633_CORE_H
- 
- #include <linux/i2c.h>
--#include <linux/workqueue.h>
- #include <linux/regulator/driver.h>
- #include <linux/regulator/machine.h>
- #include <linux/power_supply.h>
-@@ -46,21 +46,10 @@ struct pcf50633_platform_data {
- 	u8 resumers[5];
- 
- 	struct pcf50633_bl_platform_data *backlight_data;
--};
- 
--struct pcf50633_irq {
--	void (*handler) (int, void *);
--	void *data;
-+	int gpio_base;
- };
- 
--int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
--			void (*handler) (int, void *), void *data);
--int pcf50633_free_irq(struct pcf50633 *pcf, int irq);
--
--int pcf50633_irq_mask(struct pcf50633 *pcf, int irq);
--int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq);
--int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq);
--
- int pcf50633_read_block(struct pcf50633 *, u8 reg,
- 					int nr_regs, u8 *data);
- int pcf50633_write_block(struct pcf50633 *pcf, u8 reg,
-@@ -138,12 +127,11 @@ struct pcf50633 {
- 
- 	struct pcf50633_platform_data *pdata;
- 	int irq;
--	struct pcf50633_irq irq_handler[PCF50633_NUM_IRQ];
--	struct work_struct irq_work;
--	struct workqueue_struct *work_queue;
- 	struct mutex lock;
-+	struct mutex irq_lock;
- 
- 	u8 mask_regs[5];
-+	u8 mask_regs_cur[5];
- 
- 	u8 suspend_irq_masks[5];
- 	u8 resume_reason[5];
-@@ -151,12 +139,11 @@ struct pcf50633 {
- 
- 	int onkey1s_held;
- 
--	struct platform_device *rtc_pdev;
--	struct platform_device *mbc_pdev;
--	struct platform_device *adc_pdev;
--	struct platform_device *input_pdev;
--	struct platform_device *bl_pdev;
--	struct platform_device *regulator_pdev[PCF50633_NUM_REGULATORS];
-+	unsigned int irq_base;
-+
-+	struct pcf50633_mbc *mbc;
-+	struct pcf50633_adc *adc;
-+	struct pcf50633_bl *bl;
- };
- 
- enum pcf50633_reg_int1 {
-diff --git a/include/linux/mfd/pcf50633/gpio.h b/include/linux/mfd/pcf50633/gpio.h
-index a42b845..af2c341 100644
---- a/include/linux/mfd/pcf50633/gpio.h
-+++ b/include/linux/mfd/pcf50633/gpio.h
-@@ -15,37 +15,40 @@
- 
- #include <linux/mfd/pcf50633/core.h>
- 
--#define PCF50633_GPIO1		1
--#define PCF50633_GPIO2		2
--#define PCF50633_GPIO3		3
--#define PCF50633_GPO		4
--
--#define PCF50633_REG_GPIO1CFG	0x14
--#define PCF50633_REG_GPIO2CFG	0x15
--#define PCF50633_REG_GPIO3CFG	0x16
--#define PCF50633_REG_GPOCFG 	0x17
--
--#define PCF50633_GPOCFG_GPOSEL_MASK	0x07
--
--enum pcf50633_reg_gpocfg {
--	PCF50633_GPOCFG_GPOSEL_0	= 0x00,
--	PCF50633_GPOCFG_GPOSEL_LED_NFET	= 0x01,
--	PCF50633_GPOCFG_GPOSEL_SYSxOK	= 0x02,
--	PCF50633_GPOCFG_GPOSEL_CLK32K	= 0x03,
--	PCF50633_GPOCFG_GPOSEL_ADAPUSB	= 0x04,
--	PCF50633_GPOCFG_GPOSEL_USBxOK	= 0x05,
--	PCF50633_GPOCFG_GPOSEL_ACTPH4	= 0x06,
--	PCF50633_GPOCFG_GPOSEL_1	= 0x07,
--	PCF50633_GPOCFG_GPOSEL_INVERSE	= 0x08,
-+#define PCF50633_GPIO1		0
-+#define PCF50633_GPIO2		1
-+#define PCF50633_GPIO3		2
-+#define PCF50633_GPO		3
-+
-+#define PCF50633_REG_GPIOCFG(x) (0x14 + (x))
-+
-+enum pcf50633_gpio_config {
-+	PCF50633_GPIO_CONFIG_OUTPUT	= 0x0,
-+	PCF50633_GPIO_CONFIG_SYSxOK	= 0x2,
-+	PCF50633_GPIO_CONFIG_CHARGING	= 0x3,
-+	PCF50633_GPIO_CONFIG_MOBILE_MODE = 0x4,
-+	PCF50633_GPIO_CONFIG_USBxOK	= 0x5,
-+	PCF50633_GPIO_CONFIG_ACTPH	= 0x6,
-+	PCF50633_GPIO_CONFIG_INPUT	= 0x7,
-+
-+	PCF50633_GPIO_CONFIG_INVERT	= 0x8,
-+
-+	PCF50633_GPO_CONFIG_OUTPUT	= 0x0,
-+	PCF50633_GPO_CONFIG_LED_NFET	= 0x1,
-+	PCF50633_GPO_CONFIG_SYSxOK	= 0x2,
-+	PCF50633_GPO_CONFIG_CLK32K	= 0x3,
-+	PCF50633_GPO_CONFIG_MOBILE_MODE = 0x4,
-+	PCF50633_GPO_CONFIG_USBxOK	= 0x5,
-+	PCF50633_GPO_CONFIG_ACTPH	= 0x6,
-+	PCF50633_GPO_CONFIG_INPUT	= 0x7,
-+
-+	PCF50633_GPO_CONFIG_INVERT	= 0x8,
- };
- 
--int pcf50633_gpio_set(struct pcf50633 *pcf, int gpio, u8 val);
--u8 pcf50633_gpio_get(struct pcf50633 *pcf, int gpio);
-+int pcf50633_gpio_set_config(struct pcf50633 *pcf, unsigned gpio,
-+                              enum pcf50633_gpio_config config);
- 
--int pcf50633_gpio_invert_set(struct pcf50633 *, int gpio, int invert);
--int pcf50633_gpio_invert_get(struct pcf50633 *pcf, int gpio);
--
--int pcf50633_gpio_power_supply_set(struct pcf50633 *,
-+int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
- 					int gpio, int regulator, int on);
- #endif /* __LINUX_MFD_PCF50633_GPIO_H */
- 
-diff --git a/include/linux/mmc/core.h b/include/linux/mmc/core.h
-index 07f27af..5bbfb71 100644
---- a/include/linux/mmc/core.h
-+++ b/include/linux/mmc/core.h
-@@ -117,6 +117,7 @@ struct mmc_data {
- 
- 	unsigned int		sg_len;		/* size of scatter list */
- 	struct scatterlist	*sg;		/* I/O scatter list */
-+	s32			host_cookie;	/* host private data */
- };
- 
- struct mmc_request {
-@@ -124,13 +125,19 @@ struct mmc_request {
- 	struct mmc_data		*data;
- 	struct mmc_command	*stop;
- 
--	void			*done_data;	/* completion data */
-+	struct completion	completion;
- 	void			(*done)(struct mmc_request *);/* completion function */
- };
- 
- struct mmc_host;
- struct mmc_card;
- 
-+extern void mmc_pre_req(struct mmc_host *host, struct mmc_request *mrq,
-+			bool is_first_req);
-+extern void mmc_post_req(struct mmc_host *host, struct mmc_request *mrq,
-+			 int err);
-+extern void mmc_start_req(struct mmc_host *host, struct mmc_request *mrq);
-+extern void mmc_wait_for_req_done(struct mmc_request *mrq);
- extern void mmc_wait_for_req(struct mmc_host *, struct mmc_request *);
- extern int mmc_wait_for_cmd(struct mmc_host *, struct mmc_command *, int);
- extern int mmc_wait_for_app_cmd(struct mmc_host *, struct mmc_card *,
-diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
-index bcb793e..8b2b44b 100644
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -88,6 +88,15 @@ struct mmc_host_ops {
- 	 */
- 	int (*enable)(struct mmc_host *host);
- 	int (*disable)(struct mmc_host *host, int lazy);
-+	/*
-+	 * It is optional for the host to implement pre_req and post_req in
-+	 * order to support double buffering of requests (prepare one
-+	 * request while another request is active).
-+	 */
-+	void	(*post_req)(struct mmc_host *host, struct mmc_request *req,
-+			    int err);
-+	void	(*pre_req)(struct mmc_host *host, struct mmc_request *req,
-+			   bool is_first_req);
- 	void	(*request)(struct mmc_host *host, struct mmc_request *req);
- 	/*
- 	 * Avoid calling these three functions too often or in a "fast path",
-@@ -242,7 +251,9 @@ struct mmc_host {
- #endif
- 
- 	struct dentry		*debugfs_root;
--
-+#ifdef CONFIG_FAIL_MMC_REQUEST
-+	u8			make_it_fail;
-+#endif
- 	unsigned long		private[0] ____cacheline_aligned;
- };
- 
-diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
-index a36ab3b..c2bb43b 100644
---- a/include/linux/mmc/sdio_ids.h
-+++ b/include/linux/mmc/sdio_ids.h
-@@ -44,4 +44,9 @@
- #define SDIO_DEVICE_ID_SIANO_NOVA_A0		0x1100
- #define SDIO_DEVICE_ID_SIANO_STELLAR 		0x5347
- 
-+#define SDIO_DEVICE_ID_MARVELL_88W8688		0x9104
-+#define SDIO_VENDOR_ID_ATHEROS			0x0271
-+#define SDIO_DEVICE_ID_ATHEROS_AR6001		0x0100
-+#define SDIO_DEVICE_ID_ATHEROS_AR6002		0x0200
-+
- #endif
-diff --git a/include/linux/platform_battery.h b/include/linux/platform_battery.h
-new file mode 100644
-index 0000000..00f7651
---- /dev/null
-+++ b/include/linux/platform_battery.h
-@@ -0,0 +1,12 @@
-+#ifndef __PLATFORM_BATTERY_H__
-+#define __PLATFORM_BATTERY_H__
-+
-+struct platform_bat_platform_data {
-+	const char *name;
-+	int (**get_property)(void);
-+	int (*is_present)(void);
-+	enum power_supply_property *properties;
-+	size_t num_properties;
-+};
-+
-+#endif
-diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
-index c768bcd..330fc70 100644
---- a/lib/Kconfig.debug
-+++ b/lib/Kconfig.debug
-@@ -1057,6 +1057,17 @@ config FAIL_IO_TIMEOUT
- 	  Only works with drivers that use the generic timeout handling,
- 	  for others it wont do anything.
- 
-+config FAIL_MMC_REQUEST
-+	bool "Fault-injection capability for MMC IO"
-+	select DEBUG_FS
-+	depends on FAULT_INJECTION
-+	help
-+	  Provide fault-injection capability for MMC IO.
-+	  This will make the mmc core return data errors. This is
-+	  useful for testing the error handling in the mmc block device
-+	  and how the mmc host driver handle retries from
-+	  the block device.
-+
- config FAULT_INJECTION_DEBUG_FS
- 	bool "Debugfs entries for fault-injection capabilities"
- 	depends on FAULT_INJECTION && SYSFS && DEBUG_FS
-diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
-index 4522309..4f845fe 100644
---- a/sound/soc/samsung/neo1973_wm8753.c
-+++ b/sound/soc/samsung/neo1973_wm8753.c
-@@ -27,6 +27,9 @@
- #include "../codecs/wm8753.h"
- #include "s3c24xx-i2s.h"
- 
-+/* HACK */
-+#define machine_is_neo1973_gta01() (0)
-+
- static int neo1973_hifi_hw_params(struct snd_pcm_substream *substream,
- 	struct snd_pcm_hw_params *params)
- {
diff --git a/recipes-kernel/linux/linux-2.6.39/shr.patch b/recipes-kernel/linux/linux-2.6.39/shr.patch
deleted file mode 100644
index 330cbf7..0000000
--- a/recipes-kernel/linux/linux-2.6.39/shr.patch
+++ /dev/null
@@ -1,2021 +0,0 @@
-All patches from shr kernel repository
-rebased on top of openmoko kernel repository
-
-https://gitorious.org/shr/linux/commits/shr-2.6.39-nodrm
-
-efd94d3 nand/s3c2410: add mising badblocksbits value
-56885e2 glamo-mci: revert changes for Per's patchset
-6ab40bf Revert "mmc: add none blocking mmc request function"
-7937634 Revert "mmc: mmc_test: add debugfs file to list all tests"
-cf10e4d Revert "mmc: mmc_test: add test for none blocking transfers"
-29cd7b4 Revert "mmc: add member in mmc queue struct to hold request data"
-8f94eec Revert "mmc: add a block request prepare function"
-eae71b0 Revert "mmc: move error code in mmc_block_issue_rw_rq to a separate function."
-1062d7c Revert "mmc: add a second mmc queue request member"
-e0b2a74 Revert "mmc: add handling for two parallel block requests in issue_rw_rq"
-b59a013 Revert "mmc: test: add random fault injection in core.c"
-
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 4b530ae..61d233a 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -79,13 +79,6 @@ struct mmc_blk_data {
- 
- static DEFINE_MUTEX(open_lock);
- 
--enum mmc_blk_status {
--	MMC_BLK_SUCCESS = 0,
--	MMC_BLK_RETRY,
--	MMC_BLK_DATA_ERR,
--	MMC_BLK_CMD_ERR,
--};
--
- module_param(perdev_minors, int, 0444);
- MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
- 
-@@ -172,6 +165,13 @@ static const struct block_device_operations mmc_bdops = {
- 	.owner			= THIS_MODULE,
- };
- 
-+struct mmc_blk_request {
-+	struct mmc_request	mrq;
-+	struct mmc_command	cmd;
-+	struct mmc_command	stop;
-+	struct mmc_data		data;
-+};
-+
- static u32 mmc_sd_num_wr_blocks(struct mmc_card *card)
- {
- 	int err;
-@@ -331,341 +331,200 @@ out:
- 	return err ? 0 : 1;
- }
- 
--static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
--			       struct mmc_card *card,
--			       int disable_multi,
--			       struct mmc_queue *mq)
-+static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *req)
- {
--	u32 readcmd, writecmd;
--	struct mmc_blk_request *brq = &mqrq->brq;
--	struct request *req = mqrq->req;
--
--	memset(brq, 0, sizeof(struct mmc_blk_request));
--
--	brq->mrq.cmd = &brq->cmd;
--	brq->mrq.data = &brq->data;
--
--	brq->cmd.arg = blk_rq_pos(req);
--	if (!mmc_card_blockaddr(card))
--		brq->cmd.arg <<= 9;
--	brq->cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
--	brq->data.blksz = 512;
--	brq->stop.opcode = MMC_STOP_TRANSMISSION;
--	brq->stop.arg = 0;
--	brq->stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
--	brq->data.blocks = blk_rq_sectors(req);
-+	struct mmc_blk_data *md = mq->data;
-+	struct mmc_card *card = md->queue.card;
-+	struct mmc_blk_request brq;
-+	int ret = 1, disable_multi = 0;
- 
--	/*
--	 * The block layer doesn't support all sector count
--	 * restrictions, so we need to be prepared for too big
--	 * requests.
--	 */
--	if (brq->data.blocks > card->host->max_blk_count)
--		brq->data.blocks = card->host->max_blk_count;
-+	mmc_claim_host(card->host);
- 
--	/*
--	 * After a read error, we redo the request one sector at a time
--	 * in order to accurately determine which sectors can be read
--	 * successfully.
--	 */
--	if (disable_multi && brq->data.blocks > 1)
--		brq->data.blocks = 1;
-+	do {
-+		struct mmc_command cmd;
-+		u32 readcmd, writecmd, status = 0;
-+
-+		memset(&brq, 0, sizeof(struct mmc_blk_request));
-+		brq.mrq.cmd = &brq.cmd;
-+		brq.mrq.data = &brq.data;
-+
-+		brq.cmd.arg = blk_rq_pos(req);
-+		if (!mmc_card_blockaddr(card))
-+			brq.cmd.arg <<= 9;
-+		brq.cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
-+		brq.data.blksz = 512;
-+		brq.stop.opcode = MMC_STOP_TRANSMISSION;
-+		brq.stop.arg = 0;
-+		brq.stop.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
-+		brq.data.blocks = blk_rq_sectors(req);
- 
--	if (brq->data.blocks > 1) {
--		/* SPI multiblock writes terminate using a special
--		 * token, not a STOP_TRANSMISSION request.
-+		/*
-+		 * The block layer doesn't support all sector count
-+		 * restrictions, so we need to be prepared for too big
-+		 * requests.
- 		 */
--		if (!mmc_host_is_spi(card->host)
--		    || rq_data_dir(req) == READ)
--			brq->mrq.stop = &brq->stop;
--		readcmd = MMC_READ_MULTIPLE_BLOCK;
--		writecmd = MMC_WRITE_MULTIPLE_BLOCK;
--	} else {
--		brq->mrq.stop = NULL;
--		readcmd = MMC_READ_SINGLE_BLOCK;
--		writecmd = MMC_WRITE_BLOCK;
--	}
--	if (rq_data_dir(req) == READ) {
--		brq->cmd.opcode = readcmd;
--		brq->data.flags |= MMC_DATA_READ;
--	} else {
--		brq->cmd.opcode = writecmd;
--		brq->data.flags |= MMC_DATA_WRITE;
--	}
--
--	mmc_set_data_timeout(&brq->data, card);
-+		if (brq.data.blocks > card->host->max_blk_count)
-+			brq.data.blocks = card->host->max_blk_count;
- 
--	brq->data.sg = mqrq->sg;
--	brq->data.sg_len = mmc_queue_map_sg(mq, mqrq);
-+		/*
-+		 * After a read error, we redo the request one sector at a time
-+		 * in order to accurately determine which sectors can be read
-+		 * successfully.
-+		 */
-+		if (disable_multi && brq.data.blocks > 1)
-+			brq.data.blocks = 1;
- 
--	/*
--	 * Adjust the sg list so it is the same size as the
--	 * request.
--	 */
--	if (brq->data.blocks != blk_rq_sectors(req)) {
--		int i, data_size = brq->data.blocks << 9;
--		struct scatterlist *sg;
--
--		for_each_sg(brq->data.sg, sg, brq->data.sg_len, i) {
--			data_size -= sg->length;
--			if (data_size <= 0) {
--				sg->length += data_size;
--				i++;
--				break;
--			}
-+		if (brq.data.blocks > 1) {
-+			/* SPI multiblock writes terminate using a special
-+			 * token, not a STOP_TRANSMISSION request.
-+			 */
-+			if (!mmc_host_is_spi(card->host)
-+					|| rq_data_dir(req) == READ)
-+				brq.mrq.stop = &brq.stop;
-+			readcmd = MMC_READ_MULTIPLE_BLOCK;
-+			writecmd = MMC_WRITE_MULTIPLE_BLOCK;
-+		} else {
-+			brq.mrq.stop = NULL;
-+			readcmd = MMC_READ_SINGLE_BLOCK;
-+			writecmd = MMC_WRITE_BLOCK;
- 		}
--		brq->data.sg_len = i;
--	}
--
--	mmc_queue_bounce_pre(mqrq);
--}
--
--static enum mmc_blk_status mmc_blk_get_status(struct mmc_blk_request *brq,
--					      struct request *req,
--					      struct mmc_card *card,
--					      struct mmc_blk_data *md)
--{
--	struct mmc_command cmd;
--	u32 status;
--	enum mmc_blk_status ret = MMC_BLK_SUCCESS;
--
--	/*
--	 * Check for errors here, but don't jump to cmd_err
--	 * until later as we need to wait for the card to leave
--	 * programming mode even when things go wrong.
--	 */
--	if (brq->cmd.error || brq->data.error || brq->stop.error) {
--		if (brq->data.blocks > 1 && rq_data_dir(req) == READ) {
--			/* Redo read one sector at a time */
--			printk(KERN_WARNING "%s: retrying using single "
--			       "block read, brq %p\n",
--			       req->rq_disk->disk_name, brq);
--			ret = MMC_BLK_RETRY;
--			goto out;
-+		if (rq_data_dir(req) == READ) {
-+			brq.cmd.opcode = readcmd;
-+			brq.data.flags |= MMC_DATA_READ;
-+		} else {
-+			brq.cmd.opcode = writecmd;
-+			brq.data.flags |= MMC_DATA_WRITE;
- 		}
--		status = get_card_status(card, req);
--	}
- 
--	if (brq->cmd.error) {
--		printk(KERN_ERR "%s: error %d sending read/write "
--		       "command, response %#x, card status %#x\n",
--		       req->rq_disk->disk_name, brq->cmd.error,
--		       brq->cmd.resp[0], status);
--	}
--
--	if (brq->data.error) {
--		if (brq->data.error == -ETIMEDOUT && brq->mrq.stop)
--			/* 'Stop' response contains card status */
--			status = brq->mrq.stop->resp[0];
--		printk(KERN_ERR "%s: error %d transferring data,"
--		       " sector %u, nr %u, card status %#x\n",
--		       req->rq_disk->disk_name, brq->data.error,
--		       (unsigned)blk_rq_pos(req),
--		       (unsigned)blk_rq_sectors(req), status);
--	}
-+		mmc_set_data_timeout(&brq.data, card);
- 
--	if (brq->stop.error) {
--		printk(KERN_ERR "%s: error %d sending stop command, "
--		       "response %#x, card status %#x\n",
--		       req->rq_disk->disk_name, brq->stop.error,
--		       brq->stop.resp[0], status);
--	}
-+		brq.data.sg = mq->sg;
-+		brq.data.sg_len = mmc_queue_map_sg(mq);
- 
--	if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
--		do {
--			int err;
--
--			cmd.opcode = MMC_SEND_STATUS;
--			cmd.arg = card->rca << 16;
--			cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
--			err = mmc_wait_for_cmd(card->host, &cmd, 5);
--			if (err) {
--				printk(KERN_ERR "%s: error %d requesting status\n",
--				       req->rq_disk->disk_name, err);
--				ret = MMC_BLK_CMD_ERR;
--				goto out;
-+		/*
-+		 * Adjust the sg list so it is the same size as the
-+		 * request.
-+		 */
-+		if (brq.data.blocks != blk_rq_sectors(req)) {
-+			int i, data_size = brq.data.blocks << 9;
-+			struct scatterlist *sg;
-+
-+			for_each_sg(brq.data.sg, sg, brq.data.sg_len, i) {
-+				data_size -= sg->length;
-+				if (data_size <= 0) {
-+					sg->length += data_size;
-+					i++;
-+					break;
-+				}
- 			}
--			/*
--			 * Some cards mishandle the status bits,
--			 * so make sure to check both the busy
--			 * indication and the card state.
--			 */
--		} while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
--			 (R1_CURRENT_STATE(cmd.resp[0]) == 7));
--
--#if 0
--		if (cmd.resp[0] & ~0x00000900)
--			printk(KERN_ERR "%s: status = %08x\n",
--			       req->rq_disk->disk_name, cmd.resp[0]);
--		if (mmc_decode_status(cmd.resp)) {
--			ret = MMC_BLK_CMD_ERR;
--			goto out;
-+			brq.data.sg_len = i;
- 		}
- 
--#endif
--	}
-+		mmc_queue_bounce_pre(mq);
- 
--	if (brq->cmd.error || brq->stop.error || brq->data.error) {
--		if (rq_data_dir(req) == READ)
--			ret = MMC_BLK_DATA_ERR;
--		else
--			ret = MMC_BLK_CMD_ERR;
--	}
-- out:
--	return ret;
-+		mmc_wait_for_req(card->host, &brq.mrq);
- 
--}
-+		mmc_queue_bounce_post(mq);
- 
--static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
--{
--	struct mmc_blk_data *md = mq->data;
--	struct mmc_card *card = md->queue.card;
--	struct mmc_blk_request *brqc = &mq->mqrq_cur->brq;
--	struct mmc_blk_request *brqp = &mq->mqrq_prev->brq;
--	struct mmc_queue_req  *mqrqp = mq->mqrq_prev;
--	struct request *rqp = mqrqp->req;
--	int ret = 0;
--	int disable_multi = 0;
--	enum mmc_blk_status status;
--
--	if (!rqc && !rqp)
--		return 0;
--
--	if (rqc) {
--		/* Claim host for the first request in a serie of requests */
--		if (!rqp)
--			mmc_claim_host(card->host);
--
--		/* Prepare a new request */
--		mmc_blk_rw_rq_prep(mq->mqrq_cur, card, 0, mq);
--		mmc_pre_req(card->host, &brqc->mrq, !rqp);
--	}
--	do {
- 		/*
--		 * If there is an ongoing request, indicated by rqp, wait for
--		 * it to finish before starting a new one.
-+		 * Check for errors here, but don't jump to cmd_err
-+		 * until later as we need to wait for the card to leave
-+		 * programming mode even when things go wrong.
- 		 */
--		if (rqp)
--			mmc_wait_for_req_done(&brqp->mrq);
--		else {
--			/* start a new asynchronous request */
--			mmc_start_req(card->host, &brqc->mrq);
--			goto out;
--		}
--		status = mmc_blk_get_status(brqp, rqp, card, md);
--		if (status != MMC_BLK_SUCCESS) {
--			mmc_post_req(card->host, &brqp->mrq, -EINVAL);
--			mmc_queue_bounce_post(mqrqp);
--			if (rqc)
--				mmc_post_req(card->host, &brqc->mrq, -EINVAL);
-+		if (brq.cmd.error || brq.data.error || brq.stop.error) {
-+			if (brq.data.blocks > 1 && rq_data_dir(req) == READ) {
-+				/* Redo read one sector at a time */
-+				printk(KERN_WARNING "%s: retrying using single "
-+				       "block read\n", req->rq_disk->disk_name);
-+				disable_multi = 1;
-+				continue;
-+			}
-+			status = get_card_status(card, req);
- 		}
- 
--		switch (status) {
--		case MMC_BLK_SUCCESS:
--			/*
--			 * A block was successfully transferred.
--			 */
--
--			/*
--			 * All data is transferred without errors.
--			 * Defer mmc post processing and _blk_end_request
--			 * until after the new request is started.
--			 */
--			if (blk_rq_bytes(rqp) == brqp->data.bytes_xfered)
--				break;
--
--			mmc_post_req(card->host, &brqp->mrq, 0);
--			mmc_queue_bounce_post(mqrqp);
--
--			spin_lock_irq(&md->lock);
--			ret = __blk_end_request(rqp, 0,
--						brqp->data.bytes_xfered);
--			spin_unlock_irq(&md->lock);
--
--			if (rqc)
--				mmc_post_req(card->host, &brqc->mrq, -EINVAL);
--			break;
--		case MMC_BLK_CMD_ERR:
--			goto cmd_err;
--			break;
--		case MMC_BLK_RETRY:
--			disable_multi = 1;
--			ret = 1;
--			break;
--		case MMC_BLK_DATA_ERR:
--			/*
--			 * After an error, we redo I/O one sector at a
--			 * time, so we only reach here after trying to
--			 * read a single sector.
--			 */
--			spin_lock_irq(&md->lock);
--			ret = __blk_end_request(rqp, -EIO, brqp->data.blksz);
--			spin_unlock_irq(&md->lock);
--			if (rqc && !ret)
--				mmc_pre_req(card->host, &brqc->mrq, false);
--			break;
-+		if (brq.cmd.error) {
-+			printk(KERN_ERR "%s: error %d sending read/write "
-+			       "command, response %#x, card status %#x\n",
-+			       req->rq_disk->disk_name, brq.cmd.error,
-+			       brq.cmd.resp[0], status);
- 		}
- 
--		if (ret) {
--			/*
--			 * In case of a none complete request
--			 * prepare it again and resend.
--			 */
--			mmc_blk_rw_rq_prep(mqrqp, card, disable_multi, mq);
--			mmc_pre_req(card->host, &brqp->mrq, true);
--			mmc_start_req(card->host, &brqp->mrq);
--			if (rqc)
--				mmc_pre_req(card->host, &brqc->mrq, false);
-+		if (brq.data.error) {
-+			if (brq.data.error == -ETIMEDOUT && brq.mrq.stop)
-+				/* 'Stop' response contains card status */
-+				status = brq.mrq.stop->resp[0];
-+			printk(KERN_ERR "%s: error %d transferring data,"
-+			       " sector %u, nr %u, card status %#x\n",
-+			       req->rq_disk->disk_name, brq.data.error,
-+			       (unsigned)blk_rq_pos(req),
-+			       (unsigned)blk_rq_sectors(req), status);
- 		}
--	} while (ret);
- 
--	/* Previous request is completed, start the new request if any */
--	if (rqc)
--		mmc_start_req(card->host, &brqc->mrq);
-+		if (brq.stop.error) {
-+			printk(KERN_ERR "%s: error %d sending stop command, "
-+			       "response %#x, card status %#x\n",
-+			       req->rq_disk->disk_name, brq.stop.error,
-+			       brq.stop.resp[0], status);
-+		}
- 
--	/*
--	 * Post process the previous request while the new request is active.
--	 * In case of error the reuqest is already ended.
--	 */
--	if (status == MMC_BLK_SUCCESS) {
--		mmc_post_req(card->host, &brqp->mrq, 0);
--		mmc_queue_bounce_post(mqrqp);
-+		if (!mmc_host_is_spi(card->host) && rq_data_dir(req) != READ) {
-+			do {
-+				int err;
-+
-+				cmd.opcode = MMC_SEND_STATUS;
-+				cmd.arg = card->rca << 16;
-+				cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
-+				err = mmc_wait_for_cmd(card->host, &cmd, 5);
-+				if (err) {
-+					printk(KERN_ERR "%s: error %d requesting status\n",
-+					       req->rq_disk->disk_name, err);
-+					goto cmd_err;
-+				}
-+				/*
-+				 * Some cards mishandle the status bits,
-+				 * so make sure to check both the busy
-+				 * indication and the card state.
-+				 */
-+			} while (!(cmd.resp[0] & R1_READY_FOR_DATA) ||
-+				(R1_CURRENT_STATE(cmd.resp[0]) == 7));
- 
--		spin_lock_irq(&md->lock);
--		ret = __blk_end_request(rqp, 0, brqp->data.bytes_xfered);
--		spin_unlock_irq(&md->lock);
-+#if 0
-+			if (cmd.resp[0] & ~0x00000900)
-+				printk(KERN_ERR "%s: status = %08x\n",
-+				       req->rq_disk->disk_name, cmd.resp[0]);
-+			if (mmc_decode_status(cmd.resp))
-+				goto cmd_err;
-+#endif
-+		}
- 
--		if (ret) {
--			/* If this happen it is a bug */
--			printk(KERN_ERR "[%s] BUG: rq_bytes %d xfered %d\n",
--			       __func__, blk_rq_bytes(rqp),
--			       brqp->data.bytes_xfered);
-+		if (brq.cmd.error || brq.stop.error || brq.data.error) {
-+			if (rq_data_dir(req) == READ) {
-+				/*
-+				 * After an error, we redo I/O one sector at a
-+				 * time, so we only reach here after trying to
-+				 * read a single sector.
-+				 */
-+				spin_lock_irq(&md->lock);
-+				ret = __blk_end_request(req, -EIO, brq.data.blksz);
-+				spin_unlock_irq(&md->lock);
-+				continue;
-+			}
- 			goto cmd_err;
- 		}
--	}
- 
--	/* 1 indicates one request has been completed */
--	ret = 1;
-- out:
--	/*
--	 * TODO: Find out if it is OK to only release host after the
--	 *       last request. For the last request the current request
--	 *        is NULL, which means no requests are pending.
--	 */
--	/* Release host for the last request in a serie of requests */
--	if (!rqc)
--		mmc_release_host(card->host);
-+		/*
-+		 * A block was successfully transferred.
-+		 */
-+		spin_lock_irq(&md->lock);
-+		ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
-+		spin_unlock_irq(&md->lock);
-+	} while (ret);
- 
--	/* Current request becomes previous request and vice versa. */
--	mqrqp->brq.mrq.data = NULL;
--	mqrqp->req = NULL;
--	mq->mqrq_prev = mq->mqrq_cur;
--	mq->mqrq_cur = mqrqp;
-+	mmc_release_host(card->host);
- 
--	return ret;
-+	return 1;
- 
-  cmd_err:
--
-  	/*
-  	 * If this is an SD card and we're writing, we can first
-  	 * mark the known good sectors as ok.
-@@ -680,12 +539,12 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- 		blocks = mmc_sd_num_wr_blocks(card);
- 		if (blocks != (u32)-1) {
- 			spin_lock_irq(&md->lock);
--			ret = __blk_end_request(rqp, 0, blocks << 9);
-+			ret = __blk_end_request(req, 0, blocks << 9);
- 			spin_unlock_irq(&md->lock);
- 		}
- 	} else {
- 		spin_lock_irq(&md->lock);
--		ret = __blk_end_request(rqp, 0, brqp->data.bytes_xfered);
-+		ret = __blk_end_request(req, 0, brq.data.bytes_xfered);
- 		spin_unlock_irq(&md->lock);
- 	}
- 
-@@ -693,27 +552,15 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- 
- 	spin_lock_irq(&md->lock);
- 	while (ret)
--		ret = __blk_end_request(rqp, -EIO, blk_rq_cur_bytes(rqp));
-+		ret = __blk_end_request(req, -EIO, blk_rq_cur_bytes(req));
- 	spin_unlock_irq(&md->lock);
- 
--	if (rqc) {
--		mmc_claim_host(card->host);
--		mmc_pre_req(card->host, &brqc->mrq, false);
--		mmc_start_req(card->host, &brqc->mrq);
--	}
--
--	/* Current request becomes previous request and vice versa. */
--	mqrqp->brq.mrq.data = NULL;
--	mqrqp->req = NULL;
--	mq->mqrq_prev = mq->mqrq_cur;
--	mq->mqrq_cur = mqrqp;
--
- 	return 0;
- }
- 
- static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
- {
--	if (req && req->cmd_flags & REQ_DISCARD) {
-+	if (req->cmd_flags & REQ_DISCARD) {
- 		if (req->cmd_flags & REQ_SECURE)
- 			return mmc_blk_issue_secdiscard_rq(mq, req);
- 		else
-diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
-index 8f7ffad..abc1a63 100644
---- a/drivers/mmc/card/mmc_test.c
-+++ b/drivers/mmc/card/mmc_test.c
-@@ -22,7 +22,6 @@
- #include <linux/debugfs.h>
- #include <linux/uaccess.h>
- #include <linux/seq_file.h>
--#include <linux/random.h>
- 
- #define RESULT_OK		0
- #define RESULT_FAIL		1
-@@ -52,12 +51,10 @@ struct mmc_test_pages {
-  * struct mmc_test_mem - allocated memory.
-  * @arr: array of allocations
-  * @cnt: number of allocations
-- * @size_min_cmn: lowest common size in array of allocations
-  */
- struct mmc_test_mem {
- 	struct mmc_test_pages *arr;
- 	unsigned int cnt;
--	unsigned int size_min_cmn;
- };
- 
- /**
-@@ -151,21 +148,6 @@ struct mmc_test_card {
- 	struct mmc_test_general_result	*gr;
- };
- 
--enum mmc_test_prep_media {
--	MMC_TEST_PREP_NONE = 0,
--	MMC_TEST_PREP_WRITE_FULL = 1 << 0,
--	MMC_TEST_PREP_ERASE = 1 << 1,
--};
--
--struct mmc_test_multiple_rw {
--	unsigned int *bs;
--	unsigned int len;
--	unsigned int size;
--	bool do_write;
--	bool do_nonblock_req;
--	enum mmc_test_prep_media prepare;
--};
--
- /*******************************************************************/
- /*  General helper functions                                       */
- /*******************************************************************/
-@@ -325,7 +307,6 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 	unsigned long max_seg_page_cnt = DIV_ROUND_UP(max_seg_sz, PAGE_SIZE);
- 	unsigned long page_cnt = 0;
- 	unsigned long limit = nr_free_buffer_pages() >> 4;
--	unsigned int min_cmn = 0;
- 	struct mmc_test_mem *mem;
- 
- 	if (max_page_cnt > limit)
-@@ -369,12 +350,6 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 		mem->arr[mem->cnt].page = page;
- 		mem->arr[mem->cnt].order = order;
- 		mem->cnt += 1;
--		if (!min_cmn)
--			min_cmn = PAGE_SIZE << order;
--		else
--			min_cmn = min(min_cmn,
--				      (unsigned int) (PAGE_SIZE << order));
--
- 		if (max_page_cnt <= (1UL << order))
- 			break;
- 		max_page_cnt -= 1UL << order;
-@@ -385,7 +360,6 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
- 			break;
- 		}
- 	}
--	mem->size_min_cmn = min_cmn;
- 
- 	return mem;
- 
-@@ -412,6 +386,7 @@ static int mmc_test_map_sg(struct mmc_test_mem *mem, unsigned long sz,
- 	do {
- 		for (i = 0; i < mem->cnt; i++) {
- 			unsigned long len = PAGE_SIZE << mem->arr[i].order;
-+
- 			if (len > sz)
- 				len = sz;
- 			if (len > max_seg_sz)
-@@ -750,94 +725,6 @@ static int mmc_test_check_broken_result(struct mmc_test_card *test,
- }
- 
- /*
-- * Tests nonblock transfer with certain parameters
-- */
--static void mmc_test_nonblock_reset(struct mmc_request *mrq,
--				    struct mmc_command *cmd,
--				    struct mmc_command *stop,
--				    struct mmc_data *data)
--{
--	memset(mrq, 0, sizeof(struct mmc_request));
--	memset(cmd, 0, sizeof(struct mmc_command));
--	memset(data, 0, sizeof(struct mmc_data));
--	memset(stop, 0, sizeof(struct mmc_command));
--
--	mrq->cmd = cmd;
--	mrq->data = data;
--	mrq->stop = stop;
--}
--static int mmc_test_nonblock_transfer(struct mmc_test_card *test,
--				      struct scatterlist *sg, unsigned sg_len,
--				      unsigned dev_addr, unsigned blocks,
--				      unsigned blksz, int write, int count)
--{
--	struct mmc_request mrq1;
--	struct mmc_command cmd1;
--	struct mmc_command stop1;
--	struct mmc_data data1;
--
--	struct mmc_request mrq2;
--	struct mmc_command cmd2;
--	struct mmc_command stop2;
--	struct mmc_data data2;
--
--	struct mmc_request *cur_mrq;
--	struct mmc_request *prev_mrq;
--	int i;
--	int ret = 0;
--
--	if (!test->card->host->ops->pre_req ||
--		!test->card->host->ops->post_req)
--		return -RESULT_UNSUP_HOST;
--
--	mmc_test_nonblock_reset(&mrq1, &cmd1, &stop1, &data1);
--	mmc_test_nonblock_reset(&mrq2, &cmd2, &stop2, &data2);
--
--	cur_mrq = &mrq1;
--	prev_mrq = NULL;
--
--	for (i = 0; i < count; i++) {
--		mmc_test_prepare_mrq(test, cur_mrq, sg, sg_len, dev_addr,
--				blocks, blksz, write);
--		mmc_pre_req(test->card->host, cur_mrq, !prev_mrq);
--
--		if (prev_mrq) {
--			mmc_wait_for_req_done(prev_mrq);
--			mmc_test_wait_busy(test);
--			ret = mmc_test_check_result(test, prev_mrq);
--			if (ret)
--				goto err;
--		}
--
--		mmc_start_req(test->card->host, cur_mrq);
--
--		if (prev_mrq)
--			mmc_post_req(test->card->host, prev_mrq, 0);
--
--		prev_mrq = cur_mrq;
--		if (cur_mrq == &mrq1) {
--			mmc_test_nonblock_reset(&mrq2, &cmd2, &stop2, &data2);
--			cur_mrq = &mrq2;
--		} else {
--			mmc_test_nonblock_reset(&mrq1, &cmd1, &stop1, &data1);
--			cur_mrq = &mrq1;
--		}
--		dev_addr += blocks;
--	}
--
--	mmc_wait_for_req_done(prev_mrq);
--	mmc_test_wait_busy(test);
--	ret = mmc_test_check_result(test, prev_mrq);
--	if (ret)
--		goto err;
--	mmc_post_req(test->card->host, prev_mrq, 0);
--
--	return ret;
--err:
--	return ret;
--}
--
--/*
-  * Tests a basic transfer with certain parameters
-  */
- static int mmc_test_simple_transfer(struct mmc_test_card *test,
-@@ -1464,17 +1351,14 @@ static int mmc_test_area_transfer(struct mmc_test_card *test,
- }
- 
- /*
-- * Map and transfer bytes for multiple transfers.
-+ * Map and transfer bytes.
-  */
--static int mmc_test_area_io_seq(struct mmc_test_card *test, unsigned long sz,
--				unsigned int dev_addr, int write,
--				int max_scatter, int timed, int count,
--				bool nonblock)
-+static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
-+			    unsigned int dev_addr, int write, int max_scatter,
-+			    int timed)
- {
- 	struct timespec ts1, ts2;
--	int ret = 0;
--	int i;
--	struct mmc_test_area *t = &test->area;
-+	int ret;
- 
- 	/*
- 	 * In the case of a maximally scattered transfer, the maximum transfer
-@@ -1498,15 +1382,8 @@ static int mmc_test_area_io_seq(struct mmc_test_card *test, unsigned long sz,
- 
- 	if (timed)
- 		getnstimeofday(&ts1);
--	if (nonblock)
--		ret = mmc_test_nonblock_transfer(test, t->sg, t->sg_len,
--				 dev_addr, t->blocks, 512, write, count);
--	else
--		for (i = 0; i < count && ret == 0; i++) {
--			ret = mmc_test_area_transfer(test, dev_addr, write);
--			dev_addr += sz >> 9;
--		}
- 
-+	ret = mmc_test_area_transfer(test, dev_addr, write);
- 	if (ret)
- 		return ret;
- 
-@@ -1514,19 +1391,11 @@ static int mmc_test_area_io_seq(struct mmc_test_card *test, unsigned long sz,
- 		getnstimeofday(&ts2);
- 
- 	if (timed)
--		mmc_test_print_avg_rate(test, sz, count, &ts1, &ts2);
-+		mmc_test_print_rate(test, sz, &ts1, &ts2);
- 
- 	return 0;
- }
- 
--static int mmc_test_area_io(struct mmc_test_card *test, unsigned long sz,
--			    unsigned int dev_addr, int write, int max_scatter,
--			    int timed)
--{
--	return mmc_test_area_io_seq(test, sz, dev_addr, write, max_scatter,
--				    timed, 1, false);
--}
--
- /*
-  * Write the test area entirely.
-  */
-@@ -2087,144 +1956,6 @@ static int mmc_test_large_seq_write_perf(struct mmc_test_card *test)
- 	return mmc_test_large_seq_perf(test, 1);
- }
- 
--static int mmc_test_rw_multiple(struct mmc_test_card *test,
--				struct mmc_test_multiple_rw *tdata,
--				unsigned int reqsize, unsigned int size)
--{
--	unsigned int dev_addr;
--	struct mmc_test_area *t = &test->area;
--	int ret = 0;
--	int max_reqsize = max(t->mem->size_min_cmn *
--			      min(t->max_segs, t->mem->cnt), t->max_tfr);
--
--	/* Set up test area */
--	if (size > mmc_test_capacity(test->card) / 2 * 512)
--		size = mmc_test_capacity(test->card) / 2 * 512;
--	if (reqsize > max_reqsize)
--		reqsize = max_reqsize;
--	dev_addr = mmc_test_capacity(test->card) / 4;
--	if ((dev_addr & 0xffff0000))
--		dev_addr &= 0xffff0000; /* Round to 64MiB boundary */
--	else
--		dev_addr &= 0xfffff800; /* Round to 1MiB boundary */
--	if (!dev_addr)
--		goto err;
--
--	/* prepare test area */
--	if (mmc_can_erase(test->card) &&
--	    tdata->prepare & MMC_TEST_PREP_ERASE) {
--		ret = mmc_erase(test->card, dev_addr,
--				size / 512, MMC_SECURE_ERASE_ARG);
--		if (ret)
--			ret = mmc_erase(test->card, dev_addr,
--					size / 512, MMC_ERASE_ARG);
--		if (ret)
--			goto err;
--	}
--
--	/* Run test */
--	ret = mmc_test_area_io_seq(test, reqsize, dev_addr,
--				   tdata->do_write, 0, 1, size / reqsize,
--				   tdata->do_nonblock_req);
--	if (ret)
--		goto err;
--
--	return ret;
-- err:
--	printk(KERN_INFO "[%s] error\n", __func__);
--	return ret;
--}
--
--static int mmc_test_rw_multiple_size(struct mmc_test_card *test,
--				     struct mmc_test_multiple_rw *rw)
--{
--	int ret = 0;
--	int i;
--
--	for (i = 0 ; i < rw->len && ret == 0; i++) {
--		ret = mmc_test_rw_multiple(test, rw, rw->bs[i], rw->size);
--		if (ret)
--			break;
--	}
--	return ret;
--}
--
--/*
-- * Multiple blocking write 4k to 4 MB chunks
-- */
--static int mmc_test_profile_mult_write_blocking_perf(struct mmc_test_card *test)
--{
--	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
--			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
--	struct mmc_test_multiple_rw test_data = {
--		.bs = bs,
--		.size = 128*1024*1024,
--		.len = ARRAY_SIZE(bs),
--		.do_write = true,
--		.do_nonblock_req = false,
--		.prepare = MMC_TEST_PREP_ERASE,
--	};
--
--	return mmc_test_rw_multiple_size(test, &test_data);
--};
--
--/*
-- * Multiple none blocking write 4k to 4 MB chunks
-- */
--static int mmc_test_profile_mult_write_nonblock_perf(struct mmc_test_card *test)
--{
--	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
--			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
--	struct mmc_test_multiple_rw test_data = {
--		.bs = bs,
--		.size = 128*1024*1024,
--		.len = ARRAY_SIZE(bs),
--		.do_write = true,
--		.do_nonblock_req = true,
--		.prepare = MMC_TEST_PREP_ERASE,
--	};
--
--	return mmc_test_rw_multiple_size(test, &test_data);
--}
--
--/*
-- * Multiple blocking read 4k to 4 MB chunks
-- */
--static int mmc_test_profile_mult_read_blocking_perf(struct mmc_test_card *test)
--{
--	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
--			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
--	struct mmc_test_multiple_rw test_data = {
--		.bs = bs,
--		.size = 128*1024*1024,
--		.len = ARRAY_SIZE(bs),
--		.do_write = false,
--		.do_nonblock_req = false,
--		.prepare = MMC_TEST_PREP_NONE,
--	};
--
--	return mmc_test_rw_multiple_size(test, &test_data);
--}
--
--/*
-- * Multiple none blocking read 4k to 4 MB chunks
-- */
--static int mmc_test_profile_mult_read_nonblock_perf(struct mmc_test_card *test)
--{
--	unsigned int bs[] = {1 << 12, 1 << 13, 1 << 14, 1 << 15, 1 << 16,
--			     1 << 17, 1 << 18, 1 << 19, 1 << 20, 1 << 22};
--	struct mmc_test_multiple_rw test_data = {
--		.bs = bs,
--		.size = 128*1024*1024,
--		.len = ARRAY_SIZE(bs),
--		.do_write = false,
--		.do_nonblock_req = true,
--		.prepare = MMC_TEST_PREP_NONE,
--	};
--
--	return mmc_test_rw_multiple_size(test, &test_data);
--}
--
- static const struct mmc_test_case mmc_test_cases[] = {
- 	{
- 		.name = "Basic write (no data verification)",
-@@ -2492,33 +2223,6 @@ static const struct mmc_test_case mmc_test_cases[] = {
- 		.cleanup = mmc_test_area_cleanup,
- 	},
- 
--	{
--		.name = "Write performance with blocking req 4k to 4MB",
--		.prepare = mmc_test_area_prepare,
--		.run = mmc_test_profile_mult_write_blocking_perf,
--		.cleanup = mmc_test_area_cleanup,
--	},
--
--	{
--		.name = "Write performance with none blocking req 4k to 4MB",
--		.prepare = mmc_test_area_prepare,
--		.run = mmc_test_profile_mult_write_nonblock_perf,
--		.cleanup = mmc_test_area_cleanup,
--	},
--
--	{
--		.name = "Read performance with blocking req 4k to 4MB",
--		.prepare = mmc_test_area_prepare,
--		.run = mmc_test_profile_mult_read_blocking_perf,
--		.cleanup = mmc_test_area_cleanup,
--	},
--
--	{
--		.name = "Read performance with none blocking req 4k to 4MB",
--		.prepare = mmc_test_area_prepare,
--		.run = mmc_test_profile_mult_read_nonblock_perf,
--		.cleanup = mmc_test_area_cleanup,
--	},
- };
- 
- static DEFINE_MUTEX(mmc_test_lock);
-@@ -2743,32 +2447,6 @@ static const struct file_operations mmc_test_fops_test = {
- 	.release	= single_release,
- };
- 
--static int mtf_testlist_show(struct seq_file *sf, void *data)
--{
--	int i;
--
--	mutex_lock(&mmc_test_lock);
--
--	for (i = 0; i < ARRAY_SIZE(mmc_test_cases); i++)
--		seq_printf(sf, "%d:\t%s\n", i+1, mmc_test_cases[i].name);
--
--	mutex_unlock(&mmc_test_lock);
--
--	return 0;
--}
--
--static int mtf_testlist_open(struct inode *inode, struct file *file)
--{
--	return single_open(file, mtf_testlist_show, inode->i_private);
--}
--
--static const struct file_operations mmc_test_fops_testlist = {
--	.open		= mtf_testlist_open,
--	.read		= seq_read,
--	.llseek		= seq_lseek,
--	.release	= single_release,
--};
--
- static void mmc_test_free_file_test(struct mmc_card *card)
- {
- 	struct mmc_test_dbgfs_file *df, *dfs;
-@@ -2798,10 +2476,6 @@ static int mmc_test_register_file_test(struct mmc_card *card)
- 		file = debugfs_create_file("test", S_IWUSR | S_IRUGO,
- 			card->debugfs_root, card, &mmc_test_fops_test);
- 
--	if (card->debugfs_root)
--		file = debugfs_create_file("testlist", S_IRUGO,
--			card->debugfs_root, card, &mmc_test_fops_testlist);
--
- 	if (IS_ERR_OR_NULL(file)) {
- 		dev_err(&card->dev,
- 			"Can't create file. Perhaps debugfs is disabled.\n");
-diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
-index 2b14d1c..2ae7275 100644
---- a/drivers/mmc/card/queue.c
-+++ b/drivers/mmc/card/queue.c
-@@ -56,10 +56,9 @@ static int mmc_queue_thread(void *d)
- 		spin_lock_irq(q->queue_lock);
- 		set_current_state(TASK_INTERRUPTIBLE);
- 		req = blk_fetch_request(q);
--		mq->mqrq_cur->req = req;
-+		mq->req = req;
- 		spin_unlock_irq(q->queue_lock);
- 
--		mq->issue_fn(mq, req);
- 		if (!req) {
- 			if (kthread_should_stop()) {
- 				set_current_state(TASK_RUNNING);
-@@ -72,6 +71,7 @@ static int mmc_queue_thread(void *d)
- 		}
- 		set_current_state(TASK_RUNNING);
- 
-+		mq->issue_fn(mq, req);
- 	} while (1);
- 	up(&mq->thread_sem);
- 
-@@ -97,25 +97,10 @@ static void mmc_request(struct request_queue *q)
- 		return;
- 	}
- 
--	if (!mq->mqrq_cur->req)
-+	if (!mq->req)
- 		wake_up_process(mq->thread);
- }
- 
--struct scatterlist *mmc_alloc_sg(int sg_len, int *err)
--{
--	struct scatterlist *sg;
--
--	sg = kmalloc(sizeof(struct scatterlist)*sg_len, GFP_KERNEL);
--	if (!sg)
--		*err = -ENOMEM;
--	else {
--		*err = 0;
--		sg_init_table(sg, sg_len);
--	}
--
--	return sg;
--}
--
- /**
-  * mmc_init_queue - initialise a queue structure.
-  * @mq: mmc queue
-@@ -129,8 +114,6 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 	struct mmc_host *host = card->host;
- 	u64 limit = BLK_BOUNCE_HIGH;
- 	int ret;
--	struct mmc_queue_req *mqrq_cur = &mq->mqrq[0];
--	struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
- 
- 	if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
- 		limit = *mmc_dev(host)->dma_mask;
-@@ -140,11 +123,8 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 	if (!mq->queue)
- 		return -ENOMEM;
- 
--	memset(&mq->mqrq_cur, 0, sizeof(mq->mqrq_cur));
--	memset(&mq->mqrq_prev, 0, sizeof(mq->mqrq_prev));
--	mq->mqrq_cur = mqrq_cur;
--	mq->mqrq_prev = mqrq_prev;
- 	mq->queue->queuedata = mq;
-+	mq->req = NULL;
- 
- 	blk_queue_prep_rq(mq->queue, mmc_prep_request);
- 	queue_flag_set_unlocked(QUEUE_FLAG_NONROT, mq->queue);
-@@ -178,64 +158,53 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 			bouncesz = host->max_blk_count * 512;
- 
- 		if (bouncesz > 512) {
--			mqrq_cur->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
--			if (!mqrq_cur->bounce_buf) {
--				printk(KERN_WARNING "%s: unable to "
--					"allocate bounce cur buffer\n",
--					mmc_card_name(card));
--			}
--			mqrq_prev->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
--			if (!mqrq_prev->bounce_buf) {
-+			mq->bounce_buf = kmalloc(bouncesz, GFP_KERNEL);
-+			if (!mq->bounce_buf) {
- 				printk(KERN_WARNING "%s: unable to "
--					"allocate bounce prev buffer\n",
-+					"allocate bounce buffer\n",
- 					mmc_card_name(card));
--				kfree(mqrq_cur->bounce_buf);
--				mqrq_cur->bounce_buf = NULL;
- 			}
- 		}
- 
--		if (mqrq_cur->bounce_buf && mqrq_prev->bounce_buf) {
-+		if (mq->bounce_buf) {
- 			blk_queue_bounce_limit(mq->queue, BLK_BOUNCE_ANY);
- 			blk_queue_max_hw_sectors(mq->queue, bouncesz / 512);
- 			blk_queue_max_segments(mq->queue, bouncesz / 512);
- 			blk_queue_max_segment_size(mq->queue, bouncesz);
- 
--			mqrq_cur->sg = mmc_alloc_sg(1, &ret);
--			if (ret)
--				goto cleanup_queue;
--
--			mqrq_cur->bounce_sg =
--				mmc_alloc_sg(bouncesz / 512, &ret);
--			if (ret)
--				goto cleanup_queue;
--
--			mqrq_prev->sg = mmc_alloc_sg(1, &ret);
--			if (ret)
-+			mq->sg = kmalloc(sizeof(struct scatterlist),
-+				GFP_KERNEL);
-+			if (!mq->sg) {
-+				ret = -ENOMEM;
- 				goto cleanup_queue;
-+			}
-+			sg_init_table(mq->sg, 1);
- 
--			mqrq_prev->bounce_sg =
--				mmc_alloc_sg(bouncesz / 512, &ret);
--			if (ret)
-+			mq->bounce_sg = kmalloc(sizeof(struct scatterlist) *
-+				bouncesz / 512, GFP_KERNEL);
-+			if (!mq->bounce_sg) {
-+				ret = -ENOMEM;
- 				goto cleanup_queue;
-+			}
-+			sg_init_table(mq->bounce_sg, bouncesz / 512);
- 		}
- 	}
- #endif
- 
--	if (!mqrq_cur->bounce_buf && !mqrq_prev->bounce_buf) {
-+	if (!mq->bounce_buf) {
- 		blk_queue_bounce_limit(mq->queue, limit);
- 		blk_queue_max_hw_sectors(mq->queue,
- 			min(host->max_blk_count, host->max_req_size / 512));
- 		blk_queue_max_segments(mq->queue, host->max_segs);
- 		blk_queue_max_segment_size(mq->queue, host->max_seg_size);
- 
--		mqrq_cur->sg = mmc_alloc_sg(host->max_segs, &ret);
--		if (ret)
--			goto cleanup_queue;
--
--
--		mqrq_prev->sg = mmc_alloc_sg(host->max_segs, &ret);
--		if (ret)
-+		mq->sg = kmalloc(sizeof(struct scatterlist) *
-+			host->max_segs, GFP_KERNEL);
-+		if (!mq->sg) {
-+			ret = -ENOMEM;
- 			goto cleanup_queue;
-+		}
-+		sg_init_table(mq->sg, host->max_segs);
- 	}
- 
- 	sema_init(&mq->thread_sem, 1);
-@@ -250,22 +219,16 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card, spinlock_t *lock
- 
- 	return 0;
-  free_bounce_sg:
--	kfree(mqrq_cur->bounce_sg);
--	mqrq_cur->bounce_sg = NULL;
--	kfree(mqrq_prev->bounce_sg);
--	mqrq_prev->bounce_sg = NULL;
--
-+ 	if (mq->bounce_sg)
-+ 		kfree(mq->bounce_sg);
-+ 	mq->bounce_sg = NULL;
-  cleanup_queue:
--	kfree(mqrq_cur->sg);
--	mqrq_cur->sg = NULL;
--	kfree(mqrq_cur->bounce_buf);
--	mqrq_cur->bounce_buf = NULL;
--
--	kfree(mqrq_prev->sg);
--	mqrq_prev->sg = NULL;
--	kfree(mqrq_prev->bounce_buf);
--	mqrq_prev->bounce_buf = NULL;
--
-+ 	if (mq->sg)
-+		kfree(mq->sg);
-+	mq->sg = NULL;
-+	if (mq->bounce_buf)
-+		kfree(mq->bounce_buf);
-+	mq->bounce_buf = NULL;
- 	blk_cleanup_queue(mq->queue);
- 	return ret;
- }
-@@ -274,8 +237,6 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
- {
- 	struct request_queue *q = mq->queue;
- 	unsigned long flags;
--	struct mmc_queue_req *mqrq_cur = mq->mqrq_cur;
--	struct mmc_queue_req *mqrq_prev = mq->mqrq_prev;
- 
- 	/* Make sure the queue isn't suspended, as that will deadlock */
- 	mmc_queue_resume(mq);
-@@ -289,23 +250,16 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
- 	blk_start_queue(q);
- 	spin_unlock_irqrestore(q->queue_lock, flags);
- 
--	kfree(mqrq_cur->bounce_sg);
--	mqrq_cur->bounce_sg = NULL;
--
--	kfree(mqrq_cur->sg);
--	mqrq_cur->sg = NULL;
-+ 	if (mq->bounce_sg)
-+ 		kfree(mq->bounce_sg);
-+ 	mq->bounce_sg = NULL;
- 
--	kfree(mqrq_cur->bounce_buf);
--	mqrq_cur->bounce_buf = NULL;
-+	kfree(mq->sg);
-+	mq->sg = NULL;
- 
--	kfree(mqrq_prev->bounce_sg);
--	mqrq_prev->bounce_sg = NULL;
--
--	kfree(mqrq_prev->sg);
--	mqrq_prev->sg = NULL;
--
--	kfree(mqrq_prev->bounce_buf);
--	mqrq_prev->bounce_buf = NULL;
-+	if (mq->bounce_buf)
-+		kfree(mq->bounce_buf);
-+	mq->bounce_buf = NULL;
- 
- 	mq->card = NULL;
- }
-@@ -358,27 +312,27 @@ void mmc_queue_resume(struct mmc_queue *mq)
- /*
-  * Prepare the sg list(s) to be handed of to the host driver
-  */
--unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
-+unsigned int mmc_queue_map_sg(struct mmc_queue *mq)
- {
- 	unsigned int sg_len;
- 	size_t buflen;
- 	struct scatterlist *sg;
- 	int i;
- 
--	if (!mqrq->bounce_buf)
--		return blk_rq_map_sg(mq->queue, mqrq->req, mqrq->sg);
-+	if (!mq->bounce_buf)
-+		return blk_rq_map_sg(mq->queue, mq->req, mq->sg);
- 
--	BUG_ON(!mqrq->bounce_sg);
-+	BUG_ON(!mq->bounce_sg);
- 
--	sg_len = blk_rq_map_sg(mq->queue, mqrq->req, mqrq->bounce_sg);
-+	sg_len = blk_rq_map_sg(mq->queue, mq->req, mq->bounce_sg);
- 
--	mqrq->bounce_sg_len = sg_len;
-+	mq->bounce_sg_len = sg_len;
- 
- 	buflen = 0;
--	for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
-+	for_each_sg(mq->bounce_sg, sg, sg_len, i)
- 		buflen += sg->length;
- 
--	sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
-+	sg_init_one(mq->sg, mq->bounce_buf, buflen);
- 
- 	return 1;
- }
-@@ -387,19 +341,19 @@ unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
-  * If writing, bounce the data to the buffer before the request
-  * is sent to the host driver
-  */
--void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-+void mmc_queue_bounce_pre(struct mmc_queue *mq)
- {
- 	unsigned long flags;
- 
--	if (!mqrq->bounce_buf)
-+	if (!mq->bounce_buf)
- 		return;
- 
--	if (rq_data_dir(mqrq->req) != WRITE)
-+	if (rq_data_dir(mq->req) != WRITE)
- 		return;
- 
- 	local_irq_save(flags);
--	sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
--		mqrq->bounce_buf, mqrq->sg[0].length);
-+	sg_copy_to_buffer(mq->bounce_sg, mq->bounce_sg_len,
-+		mq->bounce_buf, mq->sg[0].length);
- 	local_irq_restore(flags);
- }
- 
-@@ -407,18 +361,19 @@ void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-  * If reading, bounce the data from the buffer after the request
-  * has been handled by the host driver
-  */
--void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
-+void mmc_queue_bounce_post(struct mmc_queue *mq)
- {
- 	unsigned long flags;
- 
--	if (!mqrq->bounce_buf)
-+	if (!mq->bounce_buf)
- 		return;
- 
--	if (rq_data_dir(mqrq->req) != READ)
-+	if (rq_data_dir(mq->req) != READ)
- 		return;
- 
- 	local_irq_save(flags);
--	sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
--		mqrq->bounce_buf, mqrq->sg[0].length);
-+	sg_copy_from_buffer(mq->bounce_sg, mq->bounce_sg_len,
-+		mq->bounce_buf, mq->sg[0].length);
- 	local_irq_restore(flags);
- }
-+
-diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
-index 0e65807..64e66e0 100644
---- a/drivers/mmc/card/queue.h
-+++ b/drivers/mmc/card/queue.h
-@@ -4,33 +4,19 @@
- struct request;
- struct task_struct;
- 
--struct mmc_blk_request {
--	struct mmc_request	mrq;
--	struct mmc_command	cmd;
--	struct mmc_command	stop;
--	struct mmc_data		data;
--};
--
--struct mmc_queue_req {
--	struct request		*req;
--	struct mmc_blk_request	brq;
--	struct scatterlist	*sg;
--	char			*bounce_buf;
--	struct scatterlist	*bounce_sg;
--	unsigned int		bounce_sg_len;
--};
--
- struct mmc_queue {
- 	struct mmc_card		*card;
- 	struct task_struct	*thread;
- 	struct semaphore	thread_sem;
- 	unsigned int		flags;
-+	struct request		*req;
- 	int			(*issue_fn)(struct mmc_queue *, struct request *);
- 	void			*data;
- 	struct request_queue	*queue;
--	struct mmc_queue_req	mqrq[2];
--	struct mmc_queue_req	*mqrq_cur;
--	struct mmc_queue_req	*mqrq_prev;
-+	struct scatterlist	*sg;
-+	char			*bounce_buf;
-+	struct scatterlist	*bounce_sg;
-+	unsigned int		bounce_sg_len;
- };
- 
- extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *);
-@@ -38,9 +24,8 @@ extern void mmc_cleanup_queue(struct mmc_queue *);
- extern void mmc_queue_suspend(struct mmc_queue *);
- extern void mmc_queue_resume(struct mmc_queue *);
- 
--extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
--				     struct mmc_queue_req *);
--extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
--extern void mmc_queue_bounce_post(struct mmc_queue_req *);
-+extern unsigned int mmc_queue_map_sg(struct mmc_queue *);
-+extern void mmc_queue_bounce_pre(struct mmc_queue *);
-+extern void mmc_queue_bounce_post(struct mmc_queue *);
- 
- #endif
-diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
-index 85296df..1f453ac 100644
---- a/drivers/mmc/core/core.c
-+++ b/drivers/mmc/core/core.c
-@@ -23,8 +23,6 @@
- #include <linux/log2.h>
- #include <linux/regulator/consumer.h>
- #include <linux/pm_runtime.h>
--#include <linux/fault-inject.h>
--#include <linux/random.h>
- 
- #include <linux/mmc/card.h>
- #include <linux/mmc/host.h>
-@@ -84,56 +82,6 @@ static void mmc_flush_scheduled_work(void)
- 	flush_workqueue(workqueue);
- }
- 
--#ifdef CONFIG_FAIL_MMC_REQUEST
--
--static DECLARE_FAULT_ATTR(fail_mmc_request);
--
--static int __init setup_fail_mmc_request(char *str)
--{
--	return setup_fault_attr(&fail_mmc_request, str);
--}
--__setup("fail_mmc_request=", setup_fail_mmc_request);
--
--static void mmc_should_fail_request(struct mmc_host *host,
--				    struct mmc_request *mrq)
--{
--	struct mmc_command *cmd = mrq->cmd;
--	struct mmc_data *data = mrq->data;
--	static const int data_errors[] = {
--		-ETIMEDOUT,
--		-EILSEQ,
--		-EIO,
--	};
--
--	if (!data)
--		return;
--
--	if (cmd->error || data->error || !host->make_it_fail ||
--	    !should_fail(&fail_mmc_request, data->blksz * data->blocks))
--		return;
--
--	data->error = data_errors[random32() % ARRAY_SIZE(data_errors)];
--	data->bytes_xfered = (random32() % (data->bytes_xfered >> 9)) << 9;
--}
--
--static int __init fail_mmc_request_debugfs(void)
--{
--	return init_fault_attr_dentries(&fail_mmc_request,
--					"fail_mmc_request");
--}
--
--late_initcall(fail_mmc_request_debugfs);
--
--#else /* CONFIG_FAIL_MMC_REQUEST */
--
--static inline void mmc_should_fail_request(struct mmc_host *host,
--					   struct mmc_data *data)
--{
--}
--
--#endif /* CONFIG_FAIL_MMC_REQUEST */
--
--
- /**
-  *	mmc_request_done - finish processing an MMC request
-  *	@host: MMC host which completed request
-@@ -160,8 +108,6 @@ void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
- 		cmd->error = 0;
- 		host->ops->request(host, mrq);
- 	} else {
--		mmc_should_fail_request(host, mrq);
--
- 		led_trigger_event(host->led, LED_OFF);
- 
- 		pr_debug("%s: req done (CMD%u): %d: %08x %08x %08x %08x\n",
-@@ -252,73 +198,8 @@ mmc_start_request(struct mmc_host *host, struct mmc_request *mrq)
- 
- static void mmc_wait_done(struct mmc_request *mrq)
- {
--	complete(&mrq->completion);
--}
--
--/**
-- *	mmc_pre_req - Prepare for a new request
-- *	@host: MMC host to prepare command
-- *	@mrq: MMC request to prepare for
-- *	@is_first_req: true if there is no previous started request
-- *                     that may run in parellel to this call, otherwise false
-- *
-- *	mmc_pre_req() is called in prior to mmc_start_req() to let
-- *	host prepare for the new request. Preparation of a request may be
-- *	performed while another request is running on the host.
-- */
--void mmc_pre_req(struct mmc_host *host, struct mmc_request *mrq,
--		 bool is_first_req)
--{
--	if (host->ops->pre_req)
--		host->ops->pre_req(host, mrq, is_first_req);
-+	complete(mrq->done_data);
- }
--EXPORT_SYMBOL(mmc_pre_req);
--
--/**
-- *	mmc_post_req - Post process a completed request
-- *	@host: MMC host to post process command
-- *	@mrq: MMC request to post process for
-- *	@err: Error, if none zero, clean up any resources made in pre_req
-- *
-- *	Let the host post process a completed request. Post processing of
-- *	a request may be performed while another reuqest is running.
-- */
--void mmc_post_req(struct mmc_host *host, struct mmc_request *mrq, int err)
--{
--	if (host->ops->post_req)
--		host->ops->post_req(host, mrq, err);
--}
--EXPORT_SYMBOL(mmc_post_req);
--
--/**
-- *	mmc_start_req - start a request
-- *	@host: MMC host to start command
-- *	@mrq: MMC request to start
-- *
-- *	Start a new MMC custom command request for a host.
-- *	Does not wait for the command to complete.
-- */
--void mmc_start_req(struct mmc_host *host, struct mmc_request *mrq)
--{
--	init_completion(&mrq->completion);
--	mrq->done = mmc_wait_done;
--
--	mmc_start_request(host, mrq);
--}
--EXPORT_SYMBOL(mmc_start_req);
--
--/**
-- *	mmc_wait_for_req_done - wait for completion of request
-- *	@mrq: MMC request to wait for
-- *
-- *	Wait for the command to complete. Does not attempt to parse the
-- *	response.
-- */
--void mmc_wait_for_req_done(struct mmc_request *mrq)
--{
--	wait_for_completion(&mrq->completion);
--}
--EXPORT_SYMBOL(mmc_wait_for_req_done);
- 
- /**
-  *	mmc_wait_for_req - start a request and wait for completion
-@@ -331,9 +212,16 @@ EXPORT_SYMBOL(mmc_wait_for_req_done);
-  */
- void mmc_wait_for_req(struct mmc_host *host, struct mmc_request *mrq)
- {
--	mmc_start_req(host, mrq);
--	mmc_wait_for_req_done(mrq);
-+	DECLARE_COMPLETION_ONSTACK(complete);
-+
-+	mrq->done_data = &complete;
-+	mrq->done = mmc_wait_done;
-+
-+	mmc_start_request(host, mrq);
-+
-+	wait_for_completion(&complete);
- }
-+
- EXPORT_SYMBOL(mmc_wait_for_req);
- 
- /**
-diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c
-index 588e76f..998797e 100644
---- a/drivers/mmc/core/debugfs.c
-+++ b/drivers/mmc/core/debugfs.c
-@@ -188,11 +188,6 @@ void mmc_add_host_debugfs(struct mmc_host *host)
- 				root, &host->clk_delay))
- 		goto err_node;
- #endif
--#ifdef CONFIG_FAIL_MMC_REQUEST
--	if (!debugfs_create_u8("make-it-fail", S_IRUSR | S_IWUSR,
--			       root, &host->make_it_fail))
--		goto err_node;
--#endif
- 	return;
- 
- err_node:
-diff --git a/drivers/mmc/host/glamo-mci.c b/drivers/mmc/host/glamo-mci.c
-index 02c4b69..f298658 100644
---- a/drivers/mmc/host/glamo-mci.c
-+++ b/drivers/mmc/host/glamo-mci.c
-@@ -49,10 +49,10 @@ struct glamo_mci_host {
- 	unsigned short vdd;
- 	char power_mode;
- 
--	unsigned long transfer_start;
--	unsigned long request_start;
--
- 	unsigned char request_counter;
-+
-+	struct workqueue_struct *workqueue;
-+	struct work_struct read_work;
- };
- 
- static void glamo_mci_send_request(struct mmc_host *mmc,
-@@ -165,21 +165,12 @@ static int glamo_mci_clock_enable(struct mmc_host *mmc)
- 	return 0;
- }
- 
--static void __iomem *glamo_mci_get_data_addr(struct glamo_mci_host *host,
--	struct mmc_data *data)
--{
--	void __iomem *addr = host->data_base;
--
--	if (data->host_cookie & 1)
--		addr += resource_size(host->data_mem) / 2;
--
--	return addr;
--}
- 
-+#ifndef GLAMO_MCI_WORKER
- static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
- {
--	void __iomem *from_ptr = glamo_mci_get_data_addr(host, data);
- 	struct sg_mapping_iter miter;
-+	uint16_t __iomem *from_ptr = host->data_base;
- 
- 	dev_dbg(&host->pdev->dev, "pio_read():\n");
- 
-@@ -187,7 +178,9 @@ static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
- 
- 	while (sg_miter_next(&miter)) {
- 		memcpy(miter.addr, from_ptr, miter.length);
--		from_ptr += miter.length;
-+		from_ptr += miter.length >> 1;
-+
-+		data->bytes_xfered += miter.length;
- 	}
- 
- 	sg_miter_stop(&miter);
-@@ -195,18 +188,19 @@ static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
- 	dev_dbg(&host->pdev->dev, "pio_read(): "
- 			"complete (no more data)\n");
- }
-+#endif
- 
- static void do_pio_write(struct glamo_mci_host *host, struct mmc_data *data)
- {
--	void __iomem *to_ptr = glamo_mci_get_data_addr(host, data);
- 	struct sg_mapping_iter miter;
-+	uint16_t __iomem *to_ptr = host->data_base;
- 
- 	dev_dbg(&host->pdev->dev, "pio_write():\n");
- 	sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_FROM_SG);
- 
- 	while (sg_miter_next(&miter)) {
- 		memcpy(to_ptr, miter.addr, miter.length);
--		to_ptr += miter.length;
-+		to_ptr += miter.length >> 1;
- 
- 		data->bytes_xfered += miter.length;
- 	}
-@@ -284,11 +278,12 @@ static irqreturn_t glamo_mci_irq(int irq, void *data)
- 	if (mrq->stop)
- 		glamo_mci_send_command(host, mrq->stop);
- 
--	if (mrq->data && (mrq->data->flags & MMC_DATA_READ)) {
--		mrq->data->bytes_xfered = mrq->data->blocks * mrq->data->blksz;
--		if (!mrq->data->host_cookie)
--			do_pio_read(host, mrq->data);
--	}
-+	if (cmd->data->flags & MMC_DATA_READ)
-+#ifndef GLAMO_MCI_WORKER
-+		do_pio_read(host, cmd->data);
-+#else
-+		flush_workqueue(host->workqueue);
-+#endif
- 
- 	if (mrq->stop)
- 		mrq->stop->error = glamo_mci_wait_idle(host, jiffies + HZ);
-@@ -300,6 +295,64 @@ done:
- 	return IRQ_HANDLED;
- }
- 
-+#ifdef GLAMO_MCI_WORKER
-+static void glamo_mci_read_worker(struct work_struct *work)
-+{
-+	struct glamo_mci_host *host = container_of(work, struct glamo_mci_host,
-+							read_work);
-+	struct mmc_command *cmd;
-+	uint16_t status;
-+	uint16_t blocks_ready;
-+	size_t data_read = 0;
-+	size_t data_ready;
-+	struct scatterlist *sg;
-+	uint16_t __iomem *from_ptr = host->data_base;
-+	void *sg_pointer;
-+
-+
-+	cmd = host->mrq->cmd;
-+	sg = cmd->data->sg;
-+	do {
-+		/*
-+		 * TODO: How to get rid of that?
-+		 * Maybe just drop it... In fact, it is already handled in
-+		 * the IRQ handler, maybe we should only check cmd->error.
-+		 * But the question is: what happens between the moment
-+		 * the error occurs, and the moment the IRQ handler handles it?
-+		 */
-+		status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+
-+		if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
-+			cmd->error = -ETIMEDOUT;
-+		if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
-+			cmd->error = -EILSEQ;
-+		if (cmd->error) {
-+			dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n",
-+				status);
-+			return;
-+		}
-+
-+		blocks_ready = glamomci_reg_read(host, GLAMO_REG_MMC_RB_BLKCNT);
-+		data_ready = blocks_ready * cmd->data->blksz;
-+
-+		if (data_ready == data_read)
-+			yield();
-+
-+		while (sg && data_read + sg->length <= data_ready) {
-+			sg_pointer = page_address(sg_page(sg)) + sg->offset;
-+			memcpy(sg_pointer, from_ptr, sg->length);
-+			from_ptr += sg->length >> 1;
-+
-+			data_read += sg->length;
-+
-+			sg = sg_next(sg);
-+		}
-+
-+	} while (sg);
-+	cmd->data->bytes_xfered = data_read;
-+}
-+#endif
-+
- static void glamo_mci_send_command(struct glamo_mci_host *host,
- 		struct mmc_command *cmd)
- {
-@@ -480,29 +533,28 @@ static void glamo_mci_send_command(struct glamo_mci_host *host,
- 					   (readw(&reg_resp[2]) << 24);
- 		}
- 	}
-+
-+#ifdef GLAMO_MCI_WORKER
-+	/* We'll only get an interrupt when all data has been transfered.
-+	   By starting to copy data when it's avaiable we can increase
-+	   throughput by up to 30%. */
-+	if (cmd->data && (cmd->data->flags & MMC_DATA_READ))
-+		queue_work(host->workqueue, &host->read_work);
-+#endif
-+
- }
- 
- static int glamo_mci_prepare_pio(struct glamo_mci_host *host,
- 		struct mmc_data *data)
- {
--	unsigned long addr = host->data_mem->start;
--
--	if (data->host_cookie & 1)
--		addr += resource_size(host->data_mem) / 2;
--
- 	/* set up the block info */
- 	glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKLEN, data->blksz);
- 	glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKCNT, data->blocks);
- 
--	if (data->flags & MMC_DATA_WRITE) {
--		glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS1, addr);
--		glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS2, addr >> 16);
--	} else {
--		glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS1, addr);
--		glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS2, addr >> 16);
--	}
-+	data->bytes_xfered = 0;
- 
--	if ((data->flags & MMC_DATA_WRITE) && !data->host_cookie)
-+	/* if write, prep the write into the shared RAM before the command */
-+	if (data->flags & MMC_DATA_WRITE)
- 		do_pio_write(host, data);
- 
- 	dev_dbg(&host->pdev->dev, "(blksz=%d, count=%d)\n",
-@@ -517,8 +569,6 @@ static void glamo_mci_send_request(struct mmc_host *mmc,
- 	struct mmc_command *cmd = mrq->cmd;
- 
- 	host->request_counter++;
--	host->request_start = jiffies;
--
- 	if (cmd->data) {
- 		if (glamo_mci_prepare_pio(host, cmd->data)) {
- 			cmd->error = -EIO;
-@@ -639,42 +689,21 @@ static void glamo_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
- 		mmc_host_lazy_disable(host->mmc);
- }
- 
--static void glamo_mci_pre_request(struct mmc_host *mmc,
--		struct mmc_request *mrq, bool is_first_req)
--{
--	struct glamo_mci_host *host = mmc_priv(mmc);
--
--	mrq->data->host_cookie = (host->request_counter & 1) | 2;
--
--	/* if write, prep the write into the shared RAM before the command */
--	if (mrq->data->flags & MMC_DATA_WRITE)
--		do_pio_write(host, mrq->data);
--}
- 
--static void glamo_mci_post_request(struct mmc_host *mmc,
--		struct mmc_request *mrq, int err)
-+/*
-+ * no physical write protect supported by us
-+ */
-+static int glamo_mci_get_ro(struct mmc_host *mmc)
- {
--	struct glamo_mci_host *host = mmc_priv(mmc);
--
--	if (!mrq->data->host_cookie)
--		return;
--
--	if (err)
--		return;
--
--	if (mrq->data->flags & MMC_DATA_READ)
--		do_pio_read(host, mrq->data);
--
--	mrq->data->host_cookie = 0;
-+	return 0;
- }
- 
- static struct mmc_host_ops glamo_mci_ops = {
- 	.enable		= glamo_mci_clock_enable,
- 	.disable	= glamo_mci_clock_disable,
- 	.request	= glamo_mci_send_request,
--	.post_req	= glamo_mci_post_request,
--	.pre_req	= glamo_mci_pre_request,
- 	.set_ios	= glamo_mci_set_ios,
-+	.get_ro		= glamo_mci_get_ro,
- };
- 
- static int __devinit glamo_mci_probe(struct platform_device *pdev)
-@@ -702,6 +731,11 @@ static int __devinit glamo_mci_probe(struct platform_device *pdev)
- 
- 	host->irq = platform_get_irq(pdev, 0);
- 
-+#ifdef GLAMO_MCI_WORKER
-+	INIT_WORK(&host->read_work, glamo_mci_read_worker);
-+	host->workqueue = create_singlethread_workqueue("glamo-mci-read");
-+#endif
-+
- 	host->regulator = regulator_get(pdev->dev.parent, "SD_3V3");
- 	if (IS_ERR(host->regulator)) {
- 		dev_err(&pdev->dev, "Cannot proceed without regulator.\n");
-@@ -789,7 +823,7 @@ static int __devinit glamo_mci_probe(struct platform_device *pdev)
- 
- 	mmc->max_blk_count = (1 << 16) - 1; /* GLAMO_REG_MMC_RB_BLKCNT */
- 	mmc->max_blk_size  = (1 << 12) - 1; /* GLAMO_REG_MMC_RB_BLKLEN */
--	mmc->max_req_size  = resource_size(host->data_mem) / 2;
-+	mmc->max_req_size  = resource_size(host->data_mem);
- 	mmc->max_seg_size  = mmc->max_req_size;
- 	mmc->max_segs = 128;
- 
-@@ -834,6 +868,9 @@ probe_free_mem_region_mmio:
- probe_regulator_put:
- 	regulator_put(host->regulator);
- probe_free_host:
-+#ifdef GLAMO_MCI_WORKER
-+	destroy_workqueue(host->workqueue);
-+#endif
- 	mmc_free_host(mmc);
- probe_out:
- 	return ret;
-@@ -844,6 +881,11 @@ static int __devexit glamo_mci_remove(struct platform_device *pdev)
- 	struct mmc_host	*mmc = platform_get_drvdata(pdev);
- 	struct glamo_mci_host *host = mmc_priv(mmc);
- 
-+#ifdef GLAMO_MCI_WORKER
-+	flush_workqueue(host->workqueue);
-+	destroy_workqueue(host->workqueue);
-+#endif
-+
- 	mmc_host_enable(mmc);
- 	mmc_remove_host(mmc);
- 	mmc_host_disable(mmc);
-diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
-index cb5d2c0..66b75c6 100644
---- a/drivers/mtd/nand/s3c2410.c
-+++ b/drivers/mtd/nand/s3c2410.c
-@@ -773,6 +773,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
- 	chip->priv	   = nmtd;
- 	chip->options	   = set->options;
- 	chip->controller   = &info->controller;
-+	chip->badblockbits = 8;
- 
- 	switch (info->cpu_type) {
- 	case TYPE_S3C2410:
-diff --git a/include/linux/mmc/core.h b/include/linux/mmc/core.h
-index 5bbfb71..07f27af 100644
---- a/include/linux/mmc/core.h
-+++ b/include/linux/mmc/core.h
-@@ -117,7 +117,6 @@ struct mmc_data {
- 
- 	unsigned int		sg_len;		/* size of scatter list */
- 	struct scatterlist	*sg;		/* I/O scatter list */
--	s32			host_cookie;	/* host private data */
- };
- 
- struct mmc_request {
-@@ -125,19 +124,13 @@ struct mmc_request {
- 	struct mmc_data		*data;
- 	struct mmc_command	*stop;
- 
--	struct completion	completion;
-+	void			*done_data;	/* completion data */
- 	void			(*done)(struct mmc_request *);/* completion function */
- };
- 
- struct mmc_host;
- struct mmc_card;
- 
--extern void mmc_pre_req(struct mmc_host *host, struct mmc_request *mrq,
--			bool is_first_req);
--extern void mmc_post_req(struct mmc_host *host, struct mmc_request *mrq,
--			 int err);
--extern void mmc_start_req(struct mmc_host *host, struct mmc_request *mrq);
--extern void mmc_wait_for_req_done(struct mmc_request *mrq);
- extern void mmc_wait_for_req(struct mmc_host *, struct mmc_request *);
- extern int mmc_wait_for_cmd(struct mmc_host *, struct mmc_command *, int);
- extern int mmc_wait_for_app_cmd(struct mmc_host *, struct mmc_card *,
-diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
-index 8b2b44b..bcb793e 100644
---- a/include/linux/mmc/host.h
-+++ b/include/linux/mmc/host.h
-@@ -88,15 +88,6 @@ struct mmc_host_ops {
- 	 */
- 	int (*enable)(struct mmc_host *host);
- 	int (*disable)(struct mmc_host *host, int lazy);
--	/*
--	 * It is optional for the host to implement pre_req and post_req in
--	 * order to support double buffering of requests (prepare one
--	 * request while another request is active).
--	 */
--	void	(*post_req)(struct mmc_host *host, struct mmc_request *req,
--			    int err);
--	void	(*pre_req)(struct mmc_host *host, struct mmc_request *req,
--			   bool is_first_req);
- 	void	(*request)(struct mmc_host *host, struct mmc_request *req);
- 	/*
- 	 * Avoid calling these three functions too often or in a "fast path",
-@@ -251,9 +242,7 @@ struct mmc_host {
- #endif
- 
- 	struct dentry		*debugfs_root;
--#ifdef CONFIG_FAIL_MMC_REQUEST
--	u8			make_it_fail;
--#endif
-+
- 	unsigned long		private[0] ____cacheline_aligned;
- };
- 
-diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
-index 330fc70..c768bcd 100644
---- a/lib/Kconfig.debug
-+++ b/lib/Kconfig.debug
-@@ -1057,17 +1057,6 @@ config FAIL_IO_TIMEOUT
- 	  Only works with drivers that use the generic timeout handling,
- 	  for others it wont do anything.
- 
--config FAIL_MMC_REQUEST
--	bool "Fault-injection capability for MMC IO"
--	select DEBUG_FS
--	depends on FAULT_INJECTION
--	help
--	  Provide fault-injection capability for MMC IO.
--	  This will make the mmc core return data errors. This is
--	  useful for testing the error handling in the mmc block device
--	  and how the mmc host driver handle retries from
--	  the block device.
--
- config FAULT_INJECTION_DEBUG_FS
- 	bool "Debugfs entries for fault-injection capabilities"
- 	depends on FAULT_INJECTION && SYSFS && DEBUG_FS
diff --git a/recipes-kernel/linux/linux_2.6.39.bb b/recipes-kernel/linux/linux_2.6.39.bb
index 879e1e4..fc30491 100644
--- a/recipes-kernel/linux/linux_2.6.39.bb
+++ b/recipes-kernel/linux/linux_2.6.39.bb
@@ -8,22 +8,11 @@ DEFAULT_PREFERENCE_collie = "1"
 DEFAULT_PREFERENCE_poodle = "1"
 DEFAULT_PREFERENCE_spitz = "1"
 DEFAULT_PREFERENCE_tosa = "1"
-#DEFAULT_PREFERENCE_om-gta01 = "1"
-#DEFAULT_PREFERENCE_om-gta02 = "1"
 DEFAULT_PREFERENCE_h1940 = "1"
 
 SRC_URI = "${KERNELORG_MIRROR}/linux/kernel/v2.6/linux-${PV}.tar.bz2;name=kernel \
            file://defconfig "
 
-SRC_URI_append_om-gta01 = " \
-           file://openmoko.patch \
-           file://shr.patch \
-           "
-SRC_URI_append_om-gta02 = " \
-           file://openmoko.patch \
-           file://shr.patch \
-           "
-
 SRC_URI_append_akita = " file://${LOGO_SIZE}/logo_linux_clut224.ppm.bz2 "
 SRC_URI_append_c7x0 = " file://${LOGO_SIZE}/logo_linux_clut224.ppm.bz2 "
 SRC_URI_append_collie = " file://${LOGO_SIZE}/logo_linux_clut224.ppm.bz2 "
author	Martin Jansa <Martin.Jansa@gmail.com>	2011-09-01 14:03:38 +0200
committer	Paul Eggleton <paul.eggleton@linux.intel.com>	2011-09-04 14:47:10 +0100
commit	51b58b6dd8f7dfff18d6c006ee6ae911ed24411c (patch)
tree	dfe4640a4a6f5d86d2d88ae8b70799f5234d815c /recipes-kernel
parent	3e013ce4211bca15dedbbdc1e714e17d85013746 (diff)
download	meta-handheld-51b58b6dd8f7dfff18d6c006ee6ae911ed24411c.tar.gz