All patches from openmoko repository
-http://git.openmoko.org/?p=kernel.git;a=commit;h=e4182f3551f1b8e8f8bd07a2d68e49a0ec4cd04a
+http://git.openmoko.org/?p=kernel.git;a=commit;h=e94595a0f57fba054eadb1926a0143598f71cfec
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index c5191b1..7e5e893 100644
.macro loadsp, rb, tmp
mov \rb, #0x50000000
add \rb, \rb, #0x4000 * CONFIG_S3C_LOWLEVEL_UART_PORT
-diff --git a/arch/arm/configs/gta02_defconfig b/arch/arm/configs/gta02_defconfig
+diff --git a/arch/arm/configs/gta01_defconfig b/arch/arm/configs/gta01_defconfig
new file mode 100644
-index 0000000..59e805f
+index 0000000..7cac1db
--- /dev/null
-+++ b/arch/arm/configs/gta02_defconfig
-@@ -0,0 +1,2229 @@
++++ b/arch/arm/configs/gta01_defconfig
+@@ -0,0 +1,1858 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.34
-+# Wed May 19 18:23:25 2010
++# Wed Nov 17 23:53:50 2010
+#
+CONFIG_ARM=y
+CONFIG_HAVE_PWM=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_NEED_DMA_MAP_STATE=y
-+CONFIG_FIQ=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_VECTORS_BASE=0xffff0000
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_BROKEN_ON_SMP=y
-+CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_RCU_FANOUT=32
+# CONFIG_RCU_FANOUT_EXACT is not set
+# CONFIG_TREE_RCU_TRACE is not set
-+CONFIG_IKCONFIG=m
-+CONFIG_IKCONFIG_PROC=y
++# CONFIG_IKCONFIG is not set
+CONFIG_LOG_BUF_SHIFT=18
+# CONFIG_CGROUPS is not set
-+# CONFIG_SYSFS_DEPRECATED_V2 is not set
++CONFIG_SYSFS_DEPRECATED=y
++CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_RELAY is not set
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+CONFIG_RD_GZIP=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
-+CONFIG_RD_LZO=y
++# CONFIG_RD_LZO is not set
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
-+# CONFIG_EMBEDDED is not set
++CONFIG_EMBEDDED=y
+CONFIG_UID16=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
-+# CONFIG_KALLSYMS_EXTRA_PASS is not set
++CONFIG_KALLSYMS_EXTRA_PASS=y
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+#
+# GCOV-based kernel profiling
+#
-+# CONFIG_GCOV_KERNEL is not set
-+CONFIG_SLOW_WORK=y
-+# CONFIG_SLOW_WORK_DEBUG is not set
++# CONFIG_SLOW_WORK is not set
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_BLOCK=y
+# CONFIG_LBDAF is not set
-+CONFIG_BLK_DEV_BSG=y
++# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
+
+#
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_DEADLINE=y
-+CONFIG_IOSCHED_CFQ=m
++# CONFIG_IOSCHED_CFQ is not set
+CONFIG_DEFAULT_DEADLINE=y
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
-+# CONFIG_INLINE_SPIN_UNLOCK is not set
++CONFIG_INLINE_SPIN_UNLOCK=y
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
-+# CONFIG_INLINE_SPIN_UNLOCK_IRQ is not set
++CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
-+# CONFIG_INLINE_READ_UNLOCK is not set
++CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
-+# CONFIG_INLINE_READ_UNLOCK_IRQ is not set
++CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
-+# CONFIG_INLINE_WRITE_UNLOCK is not set
++CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
-+# CONFIG_INLINE_WRITE_UNLOCK_IRQ is not set
++CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
+CONFIG_FREEZER=y
+#
+# Boot options
+#
-+CONFIG_S3C_BOOT_WATCHDOG=y
++# CONFIG_S3C_BOOT_WATCHDOG is not set
+CONFIG_S3C_BOOT_ERROR_RESET=y
+CONFIG_S3C_BOOT_UART_FORCE_FIFO=y
-+CONFIG_S3C_LOWLEVEL_UART_PORT=2
++CONFIG_S3C_LOWLEVEL_UART_PORT=0
+CONFIG_SAMSUNG_GPIO_EXTRA=0
+CONFIG_S3C_GPIO_SPACE=0
+CONFIG_S3C_ADC=y
+# CONFIG_SAMSUNG_PM_DEBUG is not set
+# CONFIG_SAMSUNG_PM_CHECK is not set
+CONFIG_PLAT_S3C24XX=y
-+CONFIG_CPU_LLSERIAL_S3C2440_ONLY=y
-+CONFIG_CPU_LLSERIAL_S3C2440=y
++CONFIG_CPU_LLSERIAL_S3C2410_ONLY=y
++CONFIG_CPU_LLSERIAL_S3C2410=y
+CONFIG_S3C2410_CLOCK=y
+CONFIG_S3C24XX_PWM=y
+CONFIG_S3C24XX_GPIO_EXTRA=0
+#
+# S3C2400 Machines
+#
++CONFIG_CPU_S3C2410=y
+CONFIG_CPU_S3C2410_DMA=y
+CONFIG_S3C2410_PM=y
+CONFIG_S3C2410_GPIO=y
+# CONFIG_MACH_TCT_HAMMER is not set
+# CONFIG_MACH_VR1000 is not set
+# CONFIG_MACH_QT2410 is not set
++CONFIG_MACH_NEO1973_GTA01=y
+
+#
+# S3C2412 Machines
+# CONFIG_MACH_SMDK2413 is not set
+# CONFIG_MACH_SMDK2412 is not set
+# CONFIG_MACH_VSTMS is not set
-+CONFIG_CPU_S3C2442=y
-+CONFIG_CPU_S3C244X=y
+
+#
+# S3C2440 and S3C2442 Machines
+#
+# CONFIG_MACH_ANUBIS is not set
-+CONFIG_MACH_NEO1973_GTA02=y
++# CONFIG_MACH_NEO1973_GTA02 is not set
+# CONFIG_MACH_OSIRIS is not set
+# CONFIG_MACH_RX3715 is not set
+# CONFIG_ARCH_S3C2440 is not set
+# CONFIG_VMSPLIT_2G is not set
+# CONFIG_VMSPLIT_1G is not set
+CONFIG_PAGE_OFFSET=0xC0000000
-+# CONFIG_PREEMPT_NONE is not set
++CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
-+CONFIG_PREEMPT=y
++# CONFIG_PREEMPT is not set
+CONFIG_HZ=200
-+CONFIG_AEABI=y
-+# CONFIG_OABI_COMPAT is not set
++# CONFIG_AEABI is not set
+# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
+# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
+# CONFIG_HIGHMEM is not set
+#
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
-+CONFIG_CMDLINE="unused -- bootloader passes ATAG list quiet "
++CONFIG_CMDLINE="unused -- bootloader passes ATAG list"
+# CONFIG_XIP_KERNEL is not set
+# CONFIG_KEXEC is not set
+
+#
+# At least one emulation must be selected
+#
++CONFIG_FPE_NWFPE=y
++# CONFIG_FPE_NWFPE_XP is not set
++# CONFIG_FPE_FASTFPE is not set
+
+#
+# Userspace binary formats
+CONFIG_HAVE_AOUT=y
+# CONFIG_BINFMT_AOUT is not set
+# CONFIG_BINFMT_MISC is not set
++# CONFIG_ARTHUR is not set
+
+#
+# Power management options
+#
+CONFIG_PACKET=y
+CONFIG_UNIX=y
-+CONFIG_XFRM=y
-+CONFIG_XFRM_USER=m
-+# CONFIG_XFRM_SUB_POLICY is not set
-+CONFIG_XFRM_MIGRATE=y
-+# CONFIG_XFRM_STATISTICS is not set
-+CONFIG_XFRM_IPCOMP=m
-+CONFIG_NET_KEY=m
-+CONFIG_NET_KEY_MIGRATE=y
++# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_PNP_DHCP is not set
+# CONFIG_IP_PNP_BOOTP is not set
+# CONFIG_IP_PNP_RARP is not set
-+CONFIG_NET_IPIP=m
-+CONFIG_NET_IPGRE=m
-+# CONFIG_NET_IPGRE_BROADCAST is not set
++# CONFIG_NET_IPIP is not set
++# CONFIG_NET_IPGRE is not set
+CONFIG_IP_MROUTE=y
+# CONFIG_IP_PIMSM_V1 is not set
+# CONFIG_IP_PIMSM_V2 is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
-+CONFIG_INET_AH=m
-+CONFIG_INET_ESP=m
-+CONFIG_INET_IPCOMP=m
-+CONFIG_INET_XFRM_TUNNEL=m
-+CONFIG_INET_TUNNEL=m
-+CONFIG_INET_XFRM_MODE_TRANSPORT=m
-+CONFIG_INET_XFRM_MODE_TUNNEL=m
-+CONFIG_INET_XFRM_MODE_BEET=m
++# CONFIG_INET_AH is not set
++# CONFIG_INET_ESP is not set
++# CONFIG_INET_IPCOMP is not set
++# CONFIG_INET_XFRM_TUNNEL is not set
++# CONFIG_INET_TUNNEL is not set
++# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
++# CONFIG_INET_XFRM_MODE_TUNNEL is not set
++# CONFIG_INET_XFRM_MODE_BEET is not set
+# CONFIG_INET_LRO is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_TCP_CONG="westwood"
+CONFIG_TCP_MD5SIG=y
-+CONFIG_IPV6=m
-+# CONFIG_IPV6_PRIVACY is not set
-+# CONFIG_IPV6_ROUTER_PREF is not set
-+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
-+CONFIG_INET6_AH=m
-+CONFIG_INET6_ESP=m
-+CONFIG_INET6_IPCOMP=m
-+# CONFIG_IPV6_MIP6 is not set
-+CONFIG_INET6_XFRM_TUNNEL=m
-+CONFIG_INET6_TUNNEL=m
-+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
-+CONFIG_INET6_XFRM_MODE_TUNNEL=m
-+CONFIG_INET6_XFRM_MODE_BEET=m
-+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
-+CONFIG_IPV6_SIT=m
-+# CONFIG_IPV6_SIT_6RD is not set
-+CONFIG_IPV6_NDISC_NODETYPE=y
-+CONFIG_IPV6_TUNNEL=m
-+# CONFIG_IPV6_MULTIPLE_TABLES is not set
-+# CONFIG_IPV6_MROUTE is not set
++# CONFIG_IPV6 is not set
+# CONFIG_NETWORK_SECMARK is not set
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+#
+# Core Netfilter Configuration
+#
-+CONFIG_NETFILTER_NETLINK=m
-+CONFIG_NETFILTER_NETLINK_QUEUE=m
-+CONFIG_NETFILTER_NETLINK_LOG=m
-+CONFIG_NF_CONNTRACK=m
-+CONFIG_NF_CT_ACCT=y
-+CONFIG_NF_CONNTRACK_MARK=y
-+# CONFIG_NF_CONNTRACK_EVENTS is not set
-+# CONFIG_NF_CT_PROTO_DCCP is not set
-+CONFIG_NF_CT_PROTO_GRE=m
-+CONFIG_NF_CT_PROTO_SCTP=m
-+# CONFIG_NF_CT_PROTO_UDPLITE is not set
-+# CONFIG_NF_CONNTRACK_AMANDA is not set
-+CONFIG_NF_CONNTRACK_FTP=m
-+CONFIG_NF_CONNTRACK_H323=m
-+CONFIG_NF_CONNTRACK_IRC=m
-+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-+CONFIG_NF_CONNTRACK_PPTP=m
-+CONFIG_NF_CONNTRACK_SANE=m
-+CONFIG_NF_CONNTRACK_SIP=m
-+CONFIG_NF_CONNTRACK_TFTP=m
-+CONFIG_NF_CT_NETLINK=m
-+# CONFIG_NETFILTER_TPROXY is not set
-+CONFIG_NETFILTER_XTABLES=m
-+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-+# CONFIG_NETFILTER_XT_TARGET_CT is not set
-+CONFIG_NETFILTER_XT_TARGET_DSCP=m
-+CONFIG_NETFILTER_XT_TARGET_HL=m
-+# CONFIG_NETFILTER_XT_TARGET_LED is not set
-+CONFIG_NETFILTER_XT_TARGET_MARK=m
-+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
-+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
-+# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
-+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
-+# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
-+# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
-+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-+# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
-+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-+CONFIG_NETFILTER_XT_MATCH_DCCP=m
-+CONFIG_NETFILTER_XT_MATCH_DSCP=m
-+CONFIG_NETFILTER_XT_MATCH_ESP=m
-+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-+CONFIG_NETFILTER_XT_MATCH_HELPER=m
-+CONFIG_NETFILTER_XT_MATCH_HL=m
-+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-+CONFIG_NETFILTER_XT_MATCH_MAC=m
-+CONFIG_NETFILTER_XT_MATCH_MARK=m
-+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
-+CONFIG_NETFILTER_XT_MATCH_POLICY=m
-+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
-+CONFIG_NETFILTER_XT_MATCH_REALM=m
-+CONFIG_NETFILTER_XT_MATCH_RECENT=m
-+# CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT is not set
-+CONFIG_NETFILTER_XT_MATCH_SCTP=m
-+CONFIG_NETFILTER_XT_MATCH_STATE=m
-+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-+CONFIG_NETFILTER_XT_MATCH_STRING=m
-+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-+CONFIG_NETFILTER_XT_MATCH_TIME=m
-+# CONFIG_NETFILTER_XT_MATCH_U32 is not set
-+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
++# CONFIG_NETFILTER_NETLINK_QUEUE is not set
++# CONFIG_NETFILTER_NETLINK_LOG is not set
++# CONFIG_NF_CONNTRACK is not set
++# CONFIG_NETFILTER_XTABLES is not set
+# CONFIG_IP_VS is not set
+
+#
+# IP: Netfilter Configuration
+#
-+CONFIG_NF_DEFRAG_IPV4=m
-+CONFIG_NF_CONNTRACK_IPV4=m
-+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
++# CONFIG_NF_DEFRAG_IPV4 is not set
+# CONFIG_IP_NF_QUEUE is not set
-+CONFIG_IP_NF_IPTABLES=m
-+CONFIG_IP_NF_MATCH_ADDRTYPE=m
-+CONFIG_IP_NF_MATCH_AH=m
-+CONFIG_IP_NF_MATCH_ECN=m
-+CONFIG_IP_NF_MATCH_TTL=m
-+CONFIG_IP_NF_FILTER=m
-+CONFIG_IP_NF_TARGET_REJECT=m
-+CONFIG_IP_NF_TARGET_LOG=m
-+CONFIG_IP_NF_TARGET_ULOG=m
-+CONFIG_NF_NAT=m
-+CONFIG_NF_NAT_NEEDED=y
-+CONFIG_IP_NF_TARGET_MASQUERADE=m
-+CONFIG_IP_NF_TARGET_NETMAP=m
-+CONFIG_IP_NF_TARGET_REDIRECT=m
-+CONFIG_NF_NAT_SNMP_BASIC=m
-+CONFIG_NF_NAT_PROTO_GRE=m
-+CONFIG_NF_NAT_PROTO_SCTP=m
-+CONFIG_NF_NAT_FTP=m
-+CONFIG_NF_NAT_IRC=m
-+CONFIG_NF_NAT_TFTP=m
-+# CONFIG_NF_NAT_AMANDA is not set
-+CONFIG_NF_NAT_PPTP=m
-+CONFIG_NF_NAT_H323=m
-+CONFIG_NF_NAT_SIP=m
-+CONFIG_IP_NF_MANGLE=m
-+CONFIG_IP_NF_TARGET_CLUSTERIP=m
-+CONFIG_IP_NF_TARGET_ECN=m
-+CONFIG_IP_NF_TARGET_TTL=m
-+CONFIG_IP_NF_RAW=m
++# CONFIG_IP_NF_IPTABLES is not set
+# CONFIG_IP_NF_ARPTABLES is not set
-+
-+#
-+# IPv6: Netfilter Configuration
-+#
-+CONFIG_NF_CONNTRACK_IPV6=m
-+# CONFIG_IP6_NF_QUEUE is not set
-+CONFIG_IP6_NF_IPTABLES=m
-+CONFIG_IP6_NF_MATCH_AH=m
-+CONFIG_IP6_NF_MATCH_EUI64=m
-+CONFIG_IP6_NF_MATCH_FRAG=m
-+CONFIG_IP6_NF_MATCH_OPTS=m
-+CONFIG_IP6_NF_MATCH_HL=m
-+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-+CONFIG_IP6_NF_MATCH_MH=m
-+CONFIG_IP6_NF_MATCH_RT=m
-+CONFIG_IP6_NF_TARGET_HL=m
-+CONFIG_IP6_NF_TARGET_LOG=m
-+CONFIG_IP6_NF_FILTER=m
-+CONFIG_IP6_NF_TARGET_REJECT=m
-+CONFIG_IP6_NF_MANGLE=m
-+# CONFIG_IP6_NF_RAW is not set
-+CONFIG_BRIDGE_NF_EBTABLES=m
-+CONFIG_BRIDGE_EBT_BROUTE=m
-+CONFIG_BRIDGE_EBT_T_FILTER=m
-+CONFIG_BRIDGE_EBT_T_NAT=m
-+CONFIG_BRIDGE_EBT_802_3=m
-+CONFIG_BRIDGE_EBT_AMONG=m
-+CONFIG_BRIDGE_EBT_ARP=m
-+CONFIG_BRIDGE_EBT_IP=m
-+# CONFIG_BRIDGE_EBT_IP6 is not set
-+CONFIG_BRIDGE_EBT_LIMIT=m
-+CONFIG_BRIDGE_EBT_MARK=m
-+CONFIG_BRIDGE_EBT_PKTTYPE=m
-+CONFIG_BRIDGE_EBT_STP=m
-+CONFIG_BRIDGE_EBT_VLAN=m
-+CONFIG_BRIDGE_EBT_ARPREPLY=m
-+CONFIG_BRIDGE_EBT_DNAT=m
-+CONFIG_BRIDGE_EBT_MARK_T=m
-+CONFIG_BRIDGE_EBT_REDIRECT=m
-+CONFIG_BRIDGE_EBT_SNAT=m
-+CONFIG_BRIDGE_EBT_LOG=m
-+CONFIG_BRIDGE_EBT_ULOG=m
-+# CONFIG_BRIDGE_EBT_NFLOG is not set
++# CONFIG_BRIDGE_NF_EBTABLES is not set
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
+#
+# Queueing/Scheduling
+#
-+CONFIG_NET_SCH_CBQ=m
-+CONFIG_NET_SCH_HTB=m
-+CONFIG_NET_SCH_HFSC=m
-+CONFIG_NET_SCH_PRIO=m
++# CONFIG_NET_SCH_CBQ is not set
++# CONFIG_NET_SCH_HTB is not set
++# CONFIG_NET_SCH_HFSC is not set
++# CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
-+CONFIG_NET_SCH_RED=m
-+CONFIG_NET_SCH_SFQ=m
-+CONFIG_NET_SCH_TEQL=m
-+CONFIG_NET_SCH_TBF=m
-+CONFIG_NET_SCH_GRED=m
-+CONFIG_NET_SCH_DSMARK=m
-+CONFIG_NET_SCH_NETEM=m
++# CONFIG_NET_SCH_RED is not set
++# CONFIG_NET_SCH_SFQ is not set
++# CONFIG_NET_SCH_TEQL is not set
++# CONFIG_NET_SCH_TBF is not set
++# CONFIG_NET_SCH_GRED is not set
++# CONFIG_NET_SCH_DSMARK is not set
++# CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
+
+#
+# Classification
+#
+CONFIG_NET_CLS=y
-+CONFIG_NET_CLS_BASIC=m
-+CONFIG_NET_CLS_TCINDEX=m
-+CONFIG_NET_CLS_ROUTE4=m
-+CONFIG_NET_CLS_ROUTE=y
-+CONFIG_NET_CLS_FW=m
-+CONFIG_NET_CLS_U32=m
-+CONFIG_CLS_U32_PERF=y
-+CONFIG_CLS_U32_MARK=y
-+CONFIG_NET_CLS_RSVP=m
-+CONFIG_NET_CLS_RSVP6=m
++CONFIG_NET_CLS_BASIC=y
++# CONFIG_NET_CLS_TCINDEX is not set
++# CONFIG_NET_CLS_ROUTE4 is not set
++# CONFIG_NET_CLS_FW is not set
++# CONFIG_NET_CLS_U32 is not set
++# CONFIG_NET_CLS_RSVP is not set
++# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_EMATCH is not set
+# CONFIG_NET_CLS_ACT is not set
-+# CONFIG_NET_CLS_IND is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
+
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_IRDA is not set
-+CONFIG_BT=y
-+CONFIG_BT_L2CAP=y
-+CONFIG_BT_SCO=y
-+CONFIG_BT_RFCOMM=y
-+CONFIG_BT_RFCOMM_TTY=y
-+CONFIG_BT_BNEP=y
-+CONFIG_BT_BNEP_MC_FILTER=y
-+CONFIG_BT_BNEP_PROTO_FILTER=y
-+CONFIG_BT_HIDP=y
-+
-+#
-+# Bluetooth device drivers
-+#
-+CONFIG_BT_HCIBTUSB=y
-+# CONFIG_BT_HCIBTSDIO is not set
-+# CONFIG_BT_HCIUART is not set
-+# CONFIG_BT_HCIBCM203X is not set
-+# CONFIG_BT_HCIBPA10X is not set
-+# CONFIG_BT_HCIBFUSB is not set
-+# CONFIG_BT_HCIVHCI is not set
-+# CONFIG_BT_MRVL is not set
-+# CONFIG_BT_ATH3K is not set
++# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
-+CONFIG_WIRELESS_EXT=y
-+CONFIG_WEXT_CORE=y
-+CONFIG_WEXT_PROC=y
-+CONFIG_WEXT_PRIV=y
+# CONFIG_CFG80211 is not set
-+CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_LIB80211 is not set
+
+#
+#
+# Generic Driver Options
+#
-+CONFIG_UEVENT_HELPER_PATH=""
++CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_STANDALONE=y
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
++# CONFIG_DEBUG_DRIVER is not set
++# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_SYS_HYPERVISOR is not set
-+CONFIG_CONNECTOR=m
++# CONFIG_CONNECTOR is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+# CONFIG_MTD_TESTS is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+CONFIG_MTD_NAND=y
-+CONFIG_MTD_NAND_VERIFY_WRITE=y
++# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+# CONFIG_MTD_NAND_GPIO is not set
+#
+# UBI - Unsorted block images
+#
-+CONFIG_MTD_UBI=y
-+CONFIG_MTD_UBI_WL_THRESHOLD=4096
-+CONFIG_MTD_UBI_BEB_RESERVE=1
-+CONFIG_MTD_UBI_GLUEBI=y
-+
-+#
-+# UBI debugging options
-+#
-+CONFIG_MTD_UBI_DEBUG=y
-+# CONFIG_MTD_UBI_DEBUG_MSG is not set
-+# CONFIG_MTD_UBI_DEBUG_PARANOID is not set
-+CONFIG_MTD_UBI_DEBUG_DISABLE_BGT=y
-+# CONFIG_MTD_UBI_DEBUG_EMULATE_BITFLIPS is not set
-+# CONFIG_MTD_UBI_DEBUG_EMULATE_WRITE_FAILURES is not set
-+# CONFIG_MTD_UBI_DEBUG_EMULATE_ERASE_FAILURES is not set
-+
-+#
-+# Additional UBI debugging messages
-+#
-+# CONFIG_MTD_UBI_DEBUG_MSG_BLD is not set
-+# CONFIG_MTD_UBI_DEBUG_MSG_EBA is not set
-+# CONFIG_MTD_UBI_DEBUG_MSG_WL is not set
-+# CONFIG_MTD_UBI_DEBUG_MSG_IO is not set
++# CONFIG_MTD_UBI is not set
+# CONFIG_PARPORT is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_COW_COMMON is not set
-+CONFIG_BLK_DEV_LOOP=m
-+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
-+# CONFIG_BLK_DEV_DRBD is not set
++# CONFIG_BLK_DEV_LOOP is not set
++
++#
++# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
++#
+# CONFIG_BLK_DEV_NBD is not set
-+CONFIG_BLK_DEV_UB=m
++# CONFIG_BLK_DEV_UB is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+#
+# SCSI device support
+#
-+CONFIG_SCSI_MOD=m
++CONFIG_SCSI_MOD=y
+# CONFIG_RAID_ATTRS is not set
-+CONFIG_SCSI=m
-+CONFIG_SCSI_DMA=y
-+# CONFIG_SCSI_TGT is not set
++# CONFIG_SCSI is not set
++# CONFIG_SCSI_DMA is not set
+# CONFIG_SCSI_NETLINK is not set
-+CONFIG_SCSI_PROC_FS=y
-+
-+#
-+# SCSI support type (disk, tape, CD-ROM)
-+#
-+CONFIG_BLK_DEV_SD=m
-+# CONFIG_CHR_DEV_ST is not set
-+# CONFIG_CHR_DEV_OSST is not set
-+CONFIG_BLK_DEV_SR=m
-+# CONFIG_BLK_DEV_SR_VENDOR is not set
-+CONFIG_CHR_DEV_SG=m
-+# CONFIG_CHR_DEV_SCH is not set
-+CONFIG_SCSI_MULTI_LUN=y
-+# CONFIG_SCSI_CONSTANTS is not set
-+# CONFIG_SCSI_LOGGING is not set
-+CONFIG_SCSI_SCAN_ASYNC=y
-+CONFIG_SCSI_WAIT_SCAN=m
-+
-+#
-+# SCSI Transports
-+#
-+# CONFIG_SCSI_SPI_ATTRS is not set
-+# CONFIG_SCSI_FC_ATTRS is not set
-+# CONFIG_SCSI_ISCSI_ATTRS is not set
-+# CONFIG_SCSI_SAS_ATTRS is not set
-+# CONFIG_SCSI_SAS_LIBSAS is not set
-+# CONFIG_SCSI_SRP_ATTRS is not set
-+CONFIG_SCSI_LOWLEVEL=y
-+# CONFIG_ISCSI_TCP is not set
-+# CONFIG_LIBFC is not set
-+# CONFIG_LIBFCOE is not set
-+# CONFIG_SCSI_DEBUG is not set
-+# CONFIG_SCSI_DH is not set
-+# CONFIG_SCSI_OSD_INITIATOR is not set
+# CONFIG_ATA is not set
+# CONFIG_MD is not set
+CONFIG_NETDEVICES=y
+# CONFIG_BONDING is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_EQUALIZER is not set
-+CONFIG_TUN=m
++# CONFIG_TUN is not set
+# CONFIG_VETH is not set
+# CONFIG_NET_ETHERNET is not set
-+CONFIG_MII=m
+# CONFIG_NETDEV_1000 is not set
+# CONFIG_NETDEV_10000 is not set
+CONFIG_WLAN=y
+#
+# USB Network Adapters
+#
-+CONFIG_USB_CATC=m
-+CONFIG_USB_KAWETH=m
-+CONFIG_USB_PEGASUS=m
-+CONFIG_USB_RTL8150=m
-+CONFIG_USB_USBNET=m
-+# CONFIG_USB_NET_AX8817X is not set
-+CONFIG_USB_NET_CDCETHER=m
-+# CONFIG_USB_NET_CDC_EEM is not set
-+# CONFIG_USB_NET_DM9601 is not set
-+# CONFIG_USB_NET_SMSC75XX is not set
-+# CONFIG_USB_NET_SMSC95XX is not set
-+# CONFIG_USB_NET_GL620A is not set
-+CONFIG_USB_NET_NET1080=m
-+# CONFIG_USB_NET_PLUSB is not set
-+# CONFIG_USB_NET_MCS7830 is not set
-+# CONFIG_USB_NET_RNDIS_HOST is not set
-+CONFIG_USB_NET_CDC_SUBSET=m
-+# CONFIG_USB_ALI_M5632 is not set
-+# CONFIG_USB_AN2720 is not set
-+CONFIG_USB_BELKIN=y
-+CONFIG_USB_ARMLINUX=y
-+# CONFIG_USB_EPSON2888 is not set
-+# CONFIG_USB_KC2190 is not set
-+CONFIG_USB_NET_ZAURUS=m
++# CONFIG_USB_CATC is not set
++# CONFIG_USB_KAWETH is not set
++# CONFIG_USB_PEGASUS is not set
++# CONFIG_USB_RTL8150 is not set
++# CONFIG_USB_USBNET is not set
+# CONFIG_USB_HSO is not set
-+# CONFIG_USB_NET_INT51X1 is not set
+# CONFIG_USB_IPHETH is not set
-+# CONFIG_USB_SIERRA_NET is not set
+# CONFIG_WAN is not set
-+CONFIG_PPP=m
-+CONFIG_PPP_MULTILINK=y
-+CONFIG_PPP_FILTER=y
-+CONFIG_PPP_ASYNC=m
-+CONFIG_PPP_SYNC_TTY=m
-+CONFIG_PPP_DEFLATE=m
-+CONFIG_PPP_BSDCOMP=m
-+CONFIG_PPP_MPPE=m
-+# CONFIG_PPPOE is not set
-+# CONFIG_PPPOL2TP is not set
++# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
-+CONFIG_SLHC=m
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=480
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=640
-+CONFIG_INPUT_JOYDEV=m
++# CONFIG_INPUT_JOYDEV is not set
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVBUG is not set
+
+# CONFIG_KEYBOARD_MAX7359 is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_OPENCORES is not set
-+CONFIG_KEYBOARD_STOWAWAY=m
++# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_TOUCHSCREEN_DYNAPRO is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
-+CONFIG_TOUCHSCREEN_S3C2410=y
++# CONFIG_TOUCHSCREEN_S3C2410 is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+# CONFIG_INPUT_POWERMATE is not set
+# CONFIG_INPUT_YEALINK is not set
+# CONFIG_INPUT_CM109 is not set
-+CONFIG_INPUT_UINPUT=m
-+CONFIG_INPUT_PCF50633_PMU=y
++# CONFIG_INPUT_UINPUT is not set
++CONFIG_INPUT_PCF50606_PMU=y
+# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set
-+CONFIG_INPUT_LIS302DL=y
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+# CONFIG_SERIO_SERPORT is not set
++# CONFIG_SERIO_LIBPS2 is not set
+# CONFIG_SERIO_RAW is not set
+# CONFIG_SERIO_ALTERA_PS2 is not set
+# CONFIG_GAMEPORT is not set
+CONFIG_SERIAL_SAMSUNG=y
+CONFIG_SERIAL_SAMSUNG_UARTS=3
+CONFIG_SERIAL_SAMSUNG_CONSOLE=y
-+CONFIG_SERIAL_S3C2440=y
++CONFIG_SERIAL_S3C2410=y
+# CONFIG_SERIAL_MAX3100 is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+#
+# I2C Algorithms
+#
-+CONFIG_I2C_ALGOBIT=y
++# CONFIG_I2C_ALGOBIT is not set
+# CONFIG_I2C_ALGOPCF is not set
+# CONFIG_I2C_ALGOPCA is not set
+
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+CONFIG_SPI=y
++# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
+
+#
+#
+CONFIG_SPI_BITBANG=y
+CONFIG_SPI_GPIO=y
-+CONFIG_SPI_S3C24XX=y
-+# CONFIG_SPI_S3C24XX_FIQ is not set
-+CONFIG_SPI_S3C24XX_GPIO=y
++# CONFIG_SPI_S3C24XX is not set
++# CONFIG_SPI_S3C24XX_GPIO is not set
+# CONFIG_SPI_XILINX is not set
+# CONFIG_SPI_DESIGNWARE is not set
+
+# CONFIG_PPS is not set
+CONFIG_ARCH_REQUIRE_GPIOLIB=y
+CONFIG_GPIOLIB=y
++# CONFIG_DEBUG_GPIO is not set
+CONFIG_GPIO_SYSFS=y
+
+#
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_GPIO_ADP5588 is not set
-+CONFIG_GPIO_PCF50633=y
+
+#
+# PCI GPIO expanders:
+# CONFIG_BATTERY_DS2782 is not set
+# CONFIG_BATTERY_BQ27x00 is not set
+# CONFIG_BATTERY_MAX17040 is not set
-+CONFIG_CHARGER_PCF50633=y
-+CONFIG_BATTERY_BQ27000_HDQ=y
-+CONFIG_HDQ_GPIO_BITBANG=y
-+CONFIG_BATTERY_PLATFORM=m
++CONFIG_CHARGER_PCF50606=y
+# CONFIG_HWMON is not set
+# CONFIG_THERMAL is not set
+CONFIG_WATCHDOG=y
-+CONFIG_WATCHDOG_NOWAYOUT=y
++# CONFIG_WATCHDOG_NOWAYOUT is not set
+
+#
+# Watchdog Device Drivers
+#
-+CONFIG_SOFT_WATCHDOG=y
++# CONFIG_SOFT_WATCHDOG is not set
+CONFIG_S3C2410_WATCHDOG=y
++CONFIG_PCF50606_WATCHDOG=y
+# CONFIG_MAX63XX_WATCHDOG is not set
+
+#
+#
+# Multifunction device drivers
+#
-+CONFIG_MFD_CORE=y
++# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_88PM860X is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_MFD_ASIC3 is not set
+# CONFIG_MFD_WM831X is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8994 is not set
-+CONFIG_MFD_PCF50633=y
++# CONFIG_MFD_PCF50633 is not set
+# CONFIG_MFD_MC13783 is not set
-+CONFIG_PCF50633_ADC=y
+# CONFIG_AB3100_CORE is not set
+# CONFIG_EZX_PCAP is not set
+# CONFIG_AB4500_CORE is not set
-+CONFIG_MFD_GLAMO=y
-+CONFIG_MFD_GLAMO_FB=y
-+CONFIG_MFD_GLAMO_GPIO=y
-+CONFIG_MFD_GLAMO_MCI=y
++CONFIG_MFD_PCF50606=y
++CONFIG_PCF50606_ADC=y
+CONFIG_REGULATOR=y
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_DUMMY is not set
-+CONFIG_REGULATOR_FIXED_VOLTAGE=y
++# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
+# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
+# CONFIG_REGULATOR_BQ24022 is not set
+# CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX8649 is not set
+# CONFIG_REGULATOR_MAX8660 is not set
-+CONFIG_REGULATOR_PCF50633=y
+# CONFIG_REGULATOR_LP3971 is not set
+# CONFIG_REGULATOR_TPS65023 is not set
+# CONFIG_REGULATOR_TPS6507X is not set
++CONFIG_REGULATOR_PCF50606=y
+# CONFIG_MEDIA_SUPPORT is not set
+
+#
+# Graphics support
+#
-+# CONFIG_DRM is not set
+# CONFIG_VGASTATE is not set
+CONFIG_VIDEO_OUTPUT_CONTROL=y
+CONFIG_FB=y
+#
+# Frame buffer hardware drivers
+#
-+# CONFIG_FB_UVESA is not set
+# CONFIG_FB_S1D13XXX is not set
-+# CONFIG_FB_TMIO is not set
-+# CONFIG_FB_S3C2410 is not set
++CONFIG_FB_S3C2410=y
++# CONFIG_FB_S3C2410_DEBUG is not set
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX is not set
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_PWM=y
-+CONFIG_BACKLIGHT_PCF50633=y
+
+#
+# Display device support
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
-+# CONFIG_FONTS is not set
-+CONFIG_FONT_8x8=y
-+CONFIG_FONT_8x16=y
-+# CONFIG_LOGO is not set
++CONFIG_FONTS=y
++# CONFIG_FONT_8x8 is not set
++# CONFIG_FONT_8x16 is not set
++CONFIG_FONT_6x11=y
++# CONFIG_FONT_7x14 is not set
++# CONFIG_FONT_PEARL_8x8 is not set
++# CONFIG_FONT_ACORN_8x8 is not set
++# CONFIG_FONT_MINI_4x6 is not set
++# CONFIG_FONT_SUN8x16 is not set
++# CONFIG_FONT_SUN12x22 is not set
++# CONFIG_FONT_10x18 is not set
++CONFIG_LOGO=y
++# CONFIG_LOGO_LINUX_MONO is not set
++# CONFIG_LOGO_LINUX_VGA16 is not set
++# CONFIG_LOGO_LINUX_CLUT224 is not set
+CONFIG_SOUND=y
-+CONFIG_SOUND_OSS_CORE=y
-+CONFIG_SOUND_OSS_CORE_PRECLAIM=y
++# CONFIG_SOUND_OSS_CORE is not set
+CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
+CONFIG_SND_JACK=y
-+CONFIG_SND_SEQUENCER=y
-+CONFIG_SND_SEQ_DUMMY=y
-+CONFIG_SND_OSSEMUL=y
-+CONFIG_SND_MIXER_OSS=y
-+CONFIG_SND_PCM_OSS=y
-+CONFIG_SND_PCM_OSS_PLUGINS=y
-+CONFIG_SND_SEQUENCER_OSS=y
++# CONFIG_SND_SEQUENCER is not set
++# CONFIG_SND_MIXER_OSS is not set
++# CONFIG_SND_PCM_OSS is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+# CONFIG_SND_SUPPORT_OLD_API is not set
+# CONFIG_SND_VERBOSE_PROCFS is not set
+CONFIG_HID_EZKEY=y
+CONFIG_HID_KYE=y
+CONFIG_HID_GYRATION=y
-+CONFIG_HID_TWINHAN=y
++# CONFIG_HID_TWINHAN is not set
+CONFIG_HID_KENSINGTON=y
+CONFIG_HID_LOGITECH=y
+# CONFIG_LOGITECH_FF is not set
+# CONFIG_LOGIRUMBLEPAD2_FF is not set
+# CONFIG_LOGIG940_FF is not set
-+# CONFIG_HID_MAGICMOUSE is not set
+CONFIG_HID_MICROSOFT=y
+# CONFIG_HID_MOSART is not set
+CONFIG_HID_MONTEREY=y
+CONFIG_HID_NTRIG=y
-+CONFIG_HID_ORTEK=y
++# CONFIG_HID_ORTEK is not set
+CONFIG_HID_PANTHERLORD=y
+# CONFIG_PANTHERLORD_FF is not set
+CONFIG_HID_PETALYNX=y
+CONFIG_HID_TOPSEED=y
+CONFIG_HID_THRUSTMASTER=y
+# CONFIG_THRUSTMASTER_FF is not set
-+CONFIG_HID_WACOM=y
+CONFIG_HID_ZEROPLUS=y
+# CONFIG_ZEROPLUS_FF is not set
+CONFIG_USB_SUPPORT=y
+# CONFIG_USB_DEVICEFS is not set
+# CONFIG_USB_DEVICE_CLASS is not set
+# CONFIG_USB_DYNAMIC_MINORS is not set
++# CONFIG_USB_OTG_WHITELIST is not set
++# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+# CONFIG_USB_MON is not set
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
+#
+# USB Device Class drivers
+#
-+CONFIG_USB_ACM=m
-+CONFIG_USB_PRINTER=m
++# CONFIG_USB_ACM is not set
++# CONFIG_USB_PRINTER is not set
+# CONFIG_USB_WDM is not set
-+CONFIG_USB_TMC=m
++# CONFIG_USB_TMC is not set
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+# also be needed; see USB_STORAGE Help for more info
+#
-+CONFIG_USB_STORAGE=m
-+# CONFIG_USB_STORAGE_DEBUG is not set
-+CONFIG_USB_STORAGE_DATAFAB=m
-+CONFIG_USB_STORAGE_FREECOM=m
-+# CONFIG_USB_STORAGE_ISD200 is not set
-+CONFIG_USB_STORAGE_USBAT=m
-+CONFIG_USB_STORAGE_SDDR09=m
-+CONFIG_USB_STORAGE_SDDR55=m
-+CONFIG_USB_STORAGE_JUMPSHOT=m
-+CONFIG_USB_STORAGE_ALAUDA=m
-+# CONFIG_USB_STORAGE_ONETOUCH is not set
-+CONFIG_USB_STORAGE_KARMA=m
-+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_LIBUSUAL is not set
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
-+# CONFIG_USB_MICROTEK is not set
+
+#
+# USB port drivers
+#
-+CONFIG_USB_SERIAL=m
-+CONFIG_USB_EZUSB=y
-+CONFIG_USB_SERIAL_GENERIC=y
-+CONFIG_USB_SERIAL_AIRCABLE=m
-+CONFIG_USB_SERIAL_ARK3116=m
-+CONFIG_USB_SERIAL_BELKIN=m
-+# CONFIG_USB_SERIAL_CH341 is not set
-+CONFIG_USB_SERIAL_WHITEHEAT=m
-+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
-+# CONFIG_USB_SERIAL_CP210X is not set
-+CONFIG_USB_SERIAL_CYPRESS_M8=m
-+CONFIG_USB_SERIAL_EMPEG=m
-+CONFIG_USB_SERIAL_FTDI_SIO=m
-+CONFIG_USB_SERIAL_FUNSOFT=m
-+CONFIG_USB_SERIAL_VISOR=m
-+CONFIG_USB_SERIAL_IPAQ=m
-+CONFIG_USB_SERIAL_IR=m
-+CONFIG_USB_SERIAL_EDGEPORT=m
-+CONFIG_USB_SERIAL_EDGEPORT_TI=m
-+CONFIG_USB_SERIAL_GARMIN=m
-+CONFIG_USB_SERIAL_IPW=m
-+# CONFIG_USB_SERIAL_IUU is not set
-+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
-+CONFIG_USB_SERIAL_KEYSPAN=m
-+CONFIG_USB_SERIAL_KLSI=m
-+CONFIG_USB_SERIAL_KOBIL_SCT=m
-+CONFIG_USB_SERIAL_MCT_U232=m
-+CONFIG_USB_SERIAL_MOS7720=m
-+CONFIG_USB_SERIAL_MOS7840=m
-+# CONFIG_USB_SERIAL_MOTOROLA is not set
-+CONFIG_USB_SERIAL_NAVMAN=m
-+CONFIG_USB_SERIAL_PL2303=m
-+# CONFIG_USB_SERIAL_OTI6858 is not set
-+# CONFIG_USB_SERIAL_QCAUX is not set
-+# CONFIG_USB_SERIAL_QUALCOMM is not set
-+# CONFIG_USB_SERIAL_SPCP8X5 is not set
-+CONFIG_USB_SERIAL_HP4X=m
-+CONFIG_USB_SERIAL_SAFE=m
-+CONFIG_USB_SERIAL_SAFE_PADDED=y
-+# CONFIG_USB_SERIAL_SIEMENS_MPI is not set
-+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
-+# CONFIG_USB_SERIAL_SYMBOL is not set
-+CONFIG_USB_SERIAL_TI=m
-+CONFIG_USB_SERIAL_CYBERJACK=m
-+CONFIG_USB_SERIAL_XIRCOM=m
-+CONFIG_USB_SERIAL_OPTION=m
-+CONFIG_USB_SERIAL_OMNINET=m
-+# CONFIG_USB_SERIAL_OPTICON is not set
-+# CONFIG_USB_SERIAL_VIVOPAY_SERIAL is not set
-+# CONFIG_USB_SERIAL_DEBUG is not set
++# CONFIG_USB_SERIAL is not set
+
+#
+# USB Miscellaneous drivers
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_LD is not set
-+CONFIG_USB_TRANCEVIBRATOR=m
-+CONFIG_USB_IOWARRIOR=m
++# CONFIG_USB_TRANCEVIBRATOR is not set
++# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_TEST is not set
+# CONFIG_USB_ISIGHTFW is not set
+CONFIG_USB_GADGET=y
++# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
-+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_VBUS_DRAW=500
+CONFIG_USB_GADGET_SELECTED=y
+# CONFIG_USB_GADGET_AT91 is not set
+CONFIG_USB_ETH_RNDIS=y
+# CONFIG_USB_ETH_EEM is not set
+# CONFIG_USB_GADGETFS is not set
-+# CONFIG_USB_FILE_STORAGE is not set
++CONFIG_USB_FILE_STORAGE=m
++# CONFIG_USB_FILE_STORAGE_TEST is not set
+# CONFIG_USB_MASS_STORAGE is not set
+# CONFIG_USB_G_SERIAL is not set
+# CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_NOP_USB_XCEIV is not set
+CONFIG_MMC=y
+# CONFIG_MMC_DEBUG is not set
-+CONFIG_MMC_UNSAFE_RESUME=y
++# CONFIG_MMC_UNSAFE_RESUME is not set
+
+#
+# MMC/SD/SDIO Card Drivers
+#
+# LED drivers
+#
-+CONFIG_LEDS_S3C24XX=y
++# CONFIG_LEDS_S3C24XX is not set
+# CONFIG_LEDS_PCA9532 is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_GPIO_PLATFORM=y
+# CONFIG_LEDS_PCA955X is not set
+# CONFIG_LEDS_DAC124S085 is not set
+CONFIG_LEDS_PWM=y
-+CONFIG_LEDS_REGULATOR=y
++# CONFIG_LEDS_REGULATOR is not set
+# CONFIG_LEDS_BD2802 is not set
+# CONFIG_LEDS_LT3593 is not set
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_RTC_DRV_BQ4802 is not set
+# CONFIG_RTC_DRV_RP5C01 is not set
+# CONFIG_RTC_DRV_V3020 is not set
-+CONFIG_RTC_DRV_PCF50633=y
++CONFIG_RTC_DRV_PCF50606=y
+
+#
+# on-CPU RTC drivers
+#
-+CONFIG_RTC_DRV_S3C=y
++# CONFIG_RTC_DRV_S3C is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_UIO is not set
+# TI VLYNQ
+#
+# CONFIG_STAGING is not set
-+CONFIG_AR6000_WLAN=y
-+# CONFIG_AR6000_WLAN_DEBUG is not set
-+# CONFIG_AR6000_WLAN_RESET is not set
+
+#
+# File systems
+#
-+CONFIG_EXT2_FS=y
++CONFIG_EXT2_FS=m
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_FS_XATTR is not set
+# CONFIG_EXT4_FS is not set
+CONFIG_JBD=y
-+# CONFIG_JBD_DEBUG is not set
-+CONFIG_REISERFS_FS=m
-+# CONFIG_REISERFS_CHECK is not set
-+# CONFIG_REISERFS_PROC_INFO is not set
-+# CONFIG_REISERFS_FS_XATTR is not set
++# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
-+CONFIG_FS_POSIX_ACL=y
++# CONFIG_FS_POSIX_ACL is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+CONFIG_FILE_LOCKING=y
-+CONFIG_FSNOTIFY=y
++# CONFIG_FSNOTIFY is not set
+# CONFIG_DNOTIFY is not set
+CONFIG_INOTIFY=y
-+CONFIG_INOTIFY_USER=y
++# CONFIG_INOTIFY_USER is not set
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS_FS is not set
-+CONFIG_AUTOFS4_FS=m
-+CONFIG_FUSE_FS=m
-+CONFIG_CUSE=m
-+CONFIG_GENERIC_ACL=y
++# CONFIG_AUTOFS4_FS is not set
++# CONFIG_FUSE_FS is not set
+
+#
+# Caches
+#
+# CD-ROM/DVD Filesystems
+#
-+CONFIG_ISO9660_FS=m
-+CONFIG_JOLIET=y
-+# CONFIG_ZISOFS is not set
-+CONFIG_UDF_FS=m
-+CONFIG_UDF_NLS=y
++# CONFIG_ISO9660_FS is not set
++# CONFIG_UDF_FS is not set
+
+#
+# DOS/FAT/NT Filesystems
+#
-+CONFIG_FAT_FS=m
++CONFIG_FAT_FS=y
+# CONFIG_MSDOS_FS is not set
-+CONFIG_VFAT_FS=m
++CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_NTFS_FS is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
-+CONFIG_TMPFS_POSIX_ACL=y
++# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_HUGETLB_PAGE is not set
-+CONFIG_CONFIGFS_FS=m
++# CONFIG_CONFIGFS_FS is not set
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_SUMMARY=y
+# CONFIG_JFFS2_FS_XATTR is not set
-+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
++CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
-+CONFIG_UBIFS_FS=y
-+CONFIG_UBIFS_FS_XATTR=y
-+CONFIG_UBIFS_FS_ADVANCED_COMPR=y
-+CONFIG_UBIFS_FS_LZO=y
-+CONFIG_UBIFS_FS_ZLIB=y
-+CONFIG_UBIFS_FS_DEBUG=y
-+CONFIG_UBIFS_FS_DEBUG_MSG_LVL=0
-+CONFIG_UBIFS_FS_DEBUG_CHKS=y
++# CONFIG_JFFS2_CMODE_NONE is not set
++CONFIG_JFFS2_CMODE_PRIORITY=y
++# CONFIG_JFFS2_CMODE_SIZE is not set
++# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
+# CONFIG_LOGFS is not set
+# CONFIG_CRAMFS is not set
-+CONFIG_SQUASHFS=m
-+# CONFIG_SQUASHFS_EMBEDDED is not set
-+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
++# CONFIG_SQUASHFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
-+CONFIG_NETWORK_FILESYSTEMS=y
-+CONFIG_NFS_FS=m
-+CONFIG_NFS_V3=y
-+CONFIG_NFS_V3_ACL=y
-+CONFIG_NFS_V4=y
-+# CONFIG_NFS_V4_1 is not set
-+CONFIG_NFSD=m
-+CONFIG_NFSD_V2_ACL=y
-+CONFIG_NFSD_V3=y
-+CONFIG_NFSD_V3_ACL=y
-+CONFIG_NFSD_V4=y
-+CONFIG_LOCKD=m
-+CONFIG_LOCKD_V4=y
-+CONFIG_EXPORTFS=m
-+CONFIG_NFS_ACL_SUPPORT=m
-+CONFIG_NFS_COMMON=y
-+CONFIG_SUNRPC=m
-+CONFIG_SUNRPC_GSS=m
-+CONFIG_RPCSEC_GSS_KRB5=m
-+# CONFIG_RPCSEC_GSS_SPKM3 is not set
-+# CONFIG_SMB_FS is not set
-+# CONFIG_CEPH_FS is not set
-+CONFIG_CIFS=m
-+# CONFIG_CIFS_STATS is not set
-+# CONFIG_CIFS_WEAK_PW_HASH is not set
-+# CONFIG_CIFS_XATTR is not set
-+# CONFIG_CIFS_DEBUG2 is not set
-+# CONFIG_CIFS_EXPERIMENTAL is not set
-+# CONFIG_NCP_FS is not set
-+# CONFIG_CODA_FS is not set
-+# CONFIG_AFS_FS is not set
++# CONFIG_NETWORK_FILESYSTEMS is not set
+
+#
+# Partition Types
+# CONFIG_SYSV68_PARTITION is not set
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
-+CONFIG_NLS_CODEPAGE_437=y
++# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
-+CONFIG_NLS_CODEPAGE_850=m
++# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
-+CONFIG_NLS_CODEPAGE_866=m
++# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
-+CONFIG_NLS_CODEPAGE_936=m
-+CONFIG_NLS_CODEPAGE_950=m
++# CONFIG_NLS_CODEPAGE_936 is not set
++# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
-+CONFIG_NLS_CODEPAGE_1250=m
-+CONFIG_NLS_CODEPAGE_1251=m
-+CONFIG_NLS_ASCII=m
-+CONFIG_NLS_ISO8859_1=m
-+CONFIG_NLS_ISO8859_2=m
++# CONFIG_NLS_CODEPAGE_1250 is not set
++# CONFIG_NLS_CODEPAGE_1251 is not set
++# CONFIG_NLS_ASCII is not set
++# CONFIG_NLS_ISO8859_1 is not set
++# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
-+CONFIG_NLS_UTF8=m
++# CONFIG_NLS_UTF8 is not set
+# CONFIG_DLM is not set
+
+#
+# Kernel hacking
+#
-+CONFIG_PRINTK_TIME=y
++# CONFIG_PRINTK_TIME is not set
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_FRAME_WARN=1024
+# CONFIG_MAGIC_SYSRQ is not set
-+CONFIG_STRIP_ASM_SYMS=y
++# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_UNUSED_SYMBOLS is not set
-+CONFIG_DEBUG_FS=y
++# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
-+# CONFIG_DEBUG_KERNEL is not set
++CONFIG_DEBUG_KERNEL=y
++# CONFIG_DEBUG_SHIRQ is not set
++CONFIG_DETECT_SOFTLOCKUP=y
++# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
++CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
++CONFIG_DETECT_HUNG_TASK=y
++# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
++CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
++CONFIG_SCHED_DEBUG=y
++# CONFIG_SCHEDSTATS is not set
++# CONFIG_TIMER_STATS is not set
++# CONFIG_DEBUG_OBJECTS is not set
++# CONFIG_DEBUG_SLAB is not set
++# CONFIG_DEBUG_KMEMLEAK is not set
++# CONFIG_DEBUG_RT_MUTEXES is not set
++# CONFIG_RT_MUTEX_TESTER is not set
++# CONFIG_DEBUG_SPINLOCK is not set
++# CONFIG_DEBUG_MUTEXES is not set
++# CONFIG_DEBUG_LOCK_ALLOC is not set
++# CONFIG_PROVE_LOCKING is not set
++# CONFIG_LOCK_STAT is not set
++# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
++# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
++# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
++CONFIG_DEBUG_INFO=y
++# CONFIG_DEBUG_VM is not set
++# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DEBUG_MEMORY_INIT=y
++# CONFIG_DEBUG_LIST is not set
++# CONFIG_DEBUG_SG is not set
++# CONFIG_DEBUG_NOTIFIERS is not set
++# CONFIG_DEBUG_CREDENTIALS is not set
+CONFIG_FRAME_POINTER=y
++# CONFIG_BOOT_PRINTK_DELAY is not set
++# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-+# CONFIG_LKDTM is not set
++# CONFIG_BACKTRACE_SELF_TEST is not set
++# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
++# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
++# CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
+# CONFIG_SYSCTL_SYSCALL_CHECK is not set
++# CONFIG_PAGE_POISONING is not set
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_TRACING_SUPPORT=y
+# CONFIG_FTRACE is not set
-+# CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
-+# CONFIG_ARM_UNWIND is not set
++# CONFIG_KGDB is not set
+# CONFIG_DEBUG_USER is not set
++# CONFIG_DEBUG_ERRORS is not set
++# CONFIG_DEBUG_STACK_USAGE is not set
++# CONFIG_DEBUG_LL is not set
+# CONFIG_OC_ETM is not set
+CONFIG_DEBUG_S3C_UART=2
+
+#
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
-+CONFIG_CRYPTO_AEAD=m
-+CONFIG_CRYPTO_AEAD2=y
-+CONFIG_CRYPTO_BLKCIPHER=m
-+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
-+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
-+CONFIG_CRYPTO_MANAGER=m
-+CONFIG_CRYPTO_MANAGER2=y
-+CONFIG_CRYPTO_GF128MUL=m
-+CONFIG_CRYPTO_NULL=m
-+CONFIG_CRYPTO_WORKQUEUE=y
++# CONFIG_CRYPTO_MANAGER is not set
++# CONFIG_CRYPTO_MANAGER2 is not set
++# CONFIG_CRYPTO_GF128MUL is not set
++# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
-+CONFIG_CRYPTO_AUTHENC=m
-+CONFIG_CRYPTO_TEST=m
++# CONFIG_CRYPTO_AUTHENC is not set
++# CONFIG_CRYPTO_TEST is not set
+
+#
+# Authenticated Encryption with Associated Data
+#
+# Block modes
+#
-+CONFIG_CRYPTO_CBC=m
++# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
-+CONFIG_CRYPTO_ECB=m
-+CONFIG_CRYPTO_LRW=m
-+CONFIG_CRYPTO_PCBC=m
++# CONFIG_CRYPTO_ECB is not set
++# CONFIG_CRYPTO_LRW is not set
++# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+
+#
+# Hash modes
+#
-+CONFIG_CRYPTO_HMAC=m
-+CONFIG_CRYPTO_XCBC=m
++# CONFIG_CRYPTO_HMAC is not set
++# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
-+CONFIG_CRYPTO_CRC32C=m
++# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_GHASH is not set
-+CONFIG_CRYPTO_MD4=m
++# CONFIG_CRYPTO_MD4 is not set
+CONFIG_CRYPTO_MD5=y
-+CONFIG_CRYPTO_MICHAEL_MIC=m
++# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
-+CONFIG_CRYPTO_SHA1=m
-+CONFIG_CRYPTO_SHA256=m
-+CONFIG_CRYPTO_SHA512=m
-+CONFIG_CRYPTO_TGR192=m
-+CONFIG_CRYPTO_WP512=m
++# CONFIG_CRYPTO_SHA1 is not set
++# CONFIG_CRYPTO_SHA256 is not set
++# CONFIG_CRYPTO_SHA512 is not set
++# CONFIG_CRYPTO_TGR192 is not set
++# CONFIG_CRYPTO_WP512 is not set
+
+#
+# Ciphers
+#
+# CONFIG_CRYPTO_AES is not set
-+CONFIG_CRYPTO_ANUBIS=m
-+CONFIG_CRYPTO_ARC4=m
-+CONFIG_CRYPTO_BLOWFISH=m
-+CONFIG_CRYPTO_CAMELLIA=m
-+CONFIG_CRYPTO_CAST5=m
-+CONFIG_CRYPTO_CAST6=m
-+CONFIG_CRYPTO_DES=m
-+CONFIG_CRYPTO_FCRYPT=m
-+CONFIG_CRYPTO_KHAZAD=m
++# CONFIG_CRYPTO_ANUBIS is not set
++# CONFIG_CRYPTO_ARC4 is not set
++# CONFIG_CRYPTO_BLOWFISH is not set
++# CONFIG_CRYPTO_CAMELLIA is not set
++# CONFIG_CRYPTO_CAST5 is not set
++# CONFIG_CRYPTO_CAST6 is not set
++# CONFIG_CRYPTO_DES is not set
++# CONFIG_CRYPTO_FCRYPT is not set
++# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
-+CONFIG_CRYPTO_SERPENT=m
-+CONFIG_CRYPTO_TEA=m
-+CONFIG_CRYPTO_TWOFISH=m
-+CONFIG_CRYPTO_TWOFISH_COMMON=m
++# CONFIG_CRYPTO_SERPENT is not set
++# CONFIG_CRYPTO_TEA is not set
++# CONFIG_CRYPTO_TWOFISH is not set
+
+#
+# Compression
+#
-+CONFIG_CRYPTO_DEFLATE=y
++# CONFIG_CRYPTO_DEFLATE is not set
+CONFIG_CRYPTO_ZLIB=y
-+CONFIG_CRYPTO_LZO=y
++# CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+CONFIG_CRC_ITU_T=y
+CONFIG_CRC32=y
+CONFIG_CRC7=y
-+CONFIG_LIBCRC32C=m
++# CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
-+CONFIG_LZO_COMPRESS=y
-+CONFIG_LZO_DECOMPRESS=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_LZMA=y
-+CONFIG_DECOMPRESS_LZO=y
-+CONFIG_TEXTSEARCH=y
-+CONFIG_TEXTSEARCH_KMP=m
-+CONFIG_TEXTSEARCH_BM=m
-+CONFIG_TEXTSEARCH_FSM=m
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_DMA=y
+CONFIG_NLATTR=y
+CONFIG_GENERIC_ATOMIC64=y
-diff --git a/arch/arm/configs/gta02_drm_defconfig b/arch/arm/configs/gta02_drm_defconfig
+diff --git a/arch/arm/configs/gta02_defconfig b/arch/arm/configs/gta02_defconfig
new file mode 100644
-index 0000000..e966539
+index 0000000..59e805f
--- /dev/null
-+++ b/arch/arm/configs/gta02_drm_defconfig
-@@ -0,0 +1,2234 @@
++++ b/arch/arm/configs/gta02_defconfig
+@@ -0,0 +1,2229 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.34
-+# Wed May 19 18:50:43 2010
++# Wed May 19 18:23:25 2010
+#
+CONFIG_ARM=y
+CONFIG_HAVE_PWM=y
+# CONFIG_EZX_PCAP is not set
+# CONFIG_AB4500_CORE is not set
+CONFIG_MFD_GLAMO=y
-+# CONFIG_MFD_GLAMO_FB is not set
++CONFIG_MFD_GLAMO_FB=y
+CONFIG_MFD_GLAMO_GPIO=y
+CONFIG_MFD_GLAMO_MCI=y
-+CONFIG_MFD_GLAMO_DRM=y
+CONFIG_REGULATOR=y
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_DUMMY is not set
+#
+# Graphics support
+#
-+CONFIG_DRM=y
-+CONFIG_DRM_KMS_HELPER=y
-+# CONFIG_DRM_MGA is not set
-+# CONFIG_DRM_VIA is not set
-+# CONFIG_DRM_SAVAGE is not set
++# CONFIG_DRM is not set
+# CONFIG_VGASTATE is not set
+CONFIG_VIDEO_OUTPUT_CONTROL=y
+CONFIG_FB=y
+CONFIG_HAS_DMA=y
+CONFIG_NLATTR=y
+CONFIG_GENERIC_ATOMIC64=y
-diff --git a/arch/arm/include/asm/fiq.h b/arch/arm/include/asm/fiq.h
-index 2242ce2..7ade2b8 100644
---- a/arch/arm/include/asm/fiq.h
-+++ b/arch/arm/include/asm/fiq.h
-@@ -29,8 +29,9 @@ struct fiq_handler {
- extern int claim_fiq(struct fiq_handler *f);
- extern void release_fiq(struct fiq_handler *f);
- extern void set_fiq_handler(void *start, unsigned int length);
--extern void set_fiq_regs(struct pt_regs *regs);
--extern void get_fiq_regs(struct pt_regs *regs);
-+extern void set_fiq_c_handler(void (*handler)(void));
-+extern void __attribute__((naked)) set_fiq_regs(struct pt_regs *regs);
-+extern void __attribute__((naked)) get_fiq_regs(struct pt_regs *regs);
- extern void enable_fiq(int fiq);
- extern void disable_fiq(int fiq);
-
-diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
-index 6ff7919..c07691e 100644
---- a/arch/arm/kernel/fiq.c
-+++ b/arch/arm/kernel/fiq.c
-@@ -8,6 +8,8 @@
- *
- * FIQ support re-written by Russell King to be more generic
- *
-+ * FIQ handler in C supoprt written by Andy Green <andy@openmoko.com>
-+ *
- * We now properly support a method by which the FIQ handlers can
- * be stacked onto the vector. We still do not support sharing
- * the FIQ vector itself.
-@@ -124,6 +126,83 @@ void __naked get_fiq_regs(struct pt_regs *regs)
- : "r" (®s->ARM_r8), "I" (PSR_I_BIT | PSR_F_BIT | FIQ_MODE));
- }
-
-+/* -------- FIQ handler in C ---------
-+ *
-+ * Major Caveats for using this
-+ * ---------------------------
-+ * *
-+ * * 1) it CANNOT touch any vmalloc()'d memory, only memory
-+ * that was kmalloc()'d. Static allocations in the monolithic kernel
-+ * are kmalloc()'d so they are okay. You can touch memory-mapped IO, but
-+ * the pointer for it has to have been stored in kmalloc'd memory. The
-+ * reason for this is simple: every now and then Linux turns off interrupts
-+ * and reorders the paging tables. If a FIQ happens during this time, the
-+ * virtual memory space can be partly or entirely disordered or missing.
-+ *
-+ * 2) Because vmalloc() is used when a module is inserted, THIS FIQ
-+ * ISR HAS TO BE IN THE MONOLITHIC KERNEL, not a module. But the way
-+ * it is set up, you can all to enable and disable it from your module
-+ * and intercommunicate with it through struct fiq_ipc
-+ * fiq_ipc which you can define in
-+ * asm/archfiq_ipc_type.h. The reason is the same as above, a
-+ * FIQ could happen while even the ISR is not present in virtual memory
-+ * space due to pagetables being changed at the time.
-+ *
-+ * 3) You can't call any Linux API code except simple macros
-+ * - understand that FIQ can come in at any time, no matter what
-+ * state of undress the kernel may privately be in, thinking it
-+ * locked the door by turning off interrupts... FIQ is an
-+ * unstoppable monster force (which is its value)
-+ * - they are not vmalloc()'d memory safe
-+ * - they might do crazy stuff like sleep: FIQ pisses fire and
-+ * is not interested in 'sleep' that the weak seem to need
-+ * - calling APIs from FIQ can re-enter un-renterable things
-+ * - summary: you cannot interoperate with linux APIs directly in the FIQ ISR
-+ *
-+ * If you follow these rules, it is fantastic, an extremely powerful, solid,
-+ * genuine hard realtime feature.
-+ */
+diff --git a/arch/arm/configs/gta02_drm_defconfig b/arch/arm/configs/gta02_drm_defconfig
+new file mode 100644
+index 0000000..e966539
+--- /dev/null
++++ b/arch/arm/configs/gta02_drm_defconfig
+@@ -0,0 +1,2234 @@
++#
++# Automatically generated make config: don't edit
++# Linux kernel version: 2.6.34
++# Wed May 19 18:50:43 2010
++#
++CONFIG_ARM=y
++CONFIG_HAVE_PWM=y
++CONFIG_SYS_SUPPORTS_APM_EMULATION=y
++CONFIG_GENERIC_GPIO=y
++CONFIG_HAVE_PROC_CPU=y
++CONFIG_NO_IOPORT=y
++CONFIG_GENERIC_HARDIRQS=y
++CONFIG_STACKTRACE_SUPPORT=y
++CONFIG_HAVE_LATENCYTOP_SUPPORT=y
++CONFIG_LOCKDEP_SUPPORT=y
++CONFIG_TRACE_IRQFLAGS_SUPPORT=y
++CONFIG_HARDIRQS_SW_RESEND=y
++CONFIG_GENERIC_IRQ_PROBE=y
++CONFIG_RWSEM_GENERIC_SPINLOCK=y
++CONFIG_ARCH_HAS_CPUFREQ=y
++CONFIG_GENERIC_HWEIGHT=y
++CONFIG_GENERIC_CALIBRATE_DELAY=y
++CONFIG_NEED_DMA_MAP_STATE=y
++CONFIG_FIQ=y
++CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
++CONFIG_VECTORS_BASE=0xffff0000
++CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
++CONFIG_CONSTRUCTORS=y
+
-+static void (*current_fiq_c_isr)(void);
-+#define FIQ_C_ISR_STACK_SIZE 256
++#
++# General setup
++#
++CONFIG_EXPERIMENTAL=y
++CONFIG_BROKEN_ON_SMP=y
++CONFIG_LOCK_KERNEL=y
++CONFIG_INIT_ENV_ARG_LIMIT=32
++CONFIG_LOCALVERSION=""
++# CONFIG_LOCALVERSION_AUTO is not set
++CONFIG_HAVE_KERNEL_GZIP=y
++CONFIG_HAVE_KERNEL_LZO=y
++CONFIG_KERNEL_GZIP=y
++# CONFIG_KERNEL_BZIP2 is not set
++# CONFIG_KERNEL_LZMA is not set
++# CONFIG_KERNEL_LZO is not set
++CONFIG_SWAP=y
++CONFIG_SYSVIPC=y
++CONFIG_SYSVIPC_SYSCTL=y
++# CONFIG_POSIX_MQUEUE is not set
++# CONFIG_BSD_PROCESS_ACCT is not set
++# CONFIG_TASKSTATS is not set
++# CONFIG_AUDIT is not set
+
-+static void __attribute__((naked)) __jump_to_isr(void)
-+{
-+ asm __volatile__ ("mov pc, r8");
-+}
++#
++# RCU Subsystem
++#
++CONFIG_TREE_RCU=y
++# CONFIG_TREE_PREEMPT_RCU is not set
++# CONFIG_TINY_RCU is not set
++# CONFIG_RCU_TRACE is not set
++CONFIG_RCU_FANOUT=32
++# CONFIG_RCU_FANOUT_EXACT is not set
++# CONFIG_TREE_RCU_TRACE is not set
++CONFIG_IKCONFIG=m
++CONFIG_IKCONFIG_PROC=y
++CONFIG_LOG_BUF_SHIFT=18
++# CONFIG_CGROUPS is not set
++# CONFIG_SYSFS_DEPRECATED_V2 is not set
++# CONFIG_RELAY is not set
++CONFIG_NAMESPACES=y
++# CONFIG_UTS_NS is not set
++# CONFIG_IPC_NS is not set
++# CONFIG_USER_NS is not set
++# CONFIG_PID_NS is not set
++# CONFIG_NET_NS is not set
++CONFIG_BLK_DEV_INITRD=y
++CONFIG_INITRAMFS_SOURCE=""
++CONFIG_RD_GZIP=y
++CONFIG_RD_BZIP2=y
++CONFIG_RD_LZMA=y
++CONFIG_RD_LZO=y
++# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
++CONFIG_SYSCTL=y
++CONFIG_ANON_INODES=y
++# CONFIG_EMBEDDED is not set
++CONFIG_UID16=y
++CONFIG_SYSCTL_SYSCALL=y
++CONFIG_KALLSYMS=y
++CONFIG_KALLSYMS_ALL=y
++# CONFIG_KALLSYMS_EXTRA_PASS is not set
++CONFIG_HOTPLUG=y
++CONFIG_PRINTK=y
++CONFIG_BUG=y
++CONFIG_ELF_CORE=y
++CONFIG_BASE_FULL=y
++CONFIG_FUTEX=y
++CONFIG_EPOLL=y
++CONFIG_SIGNALFD=y
++CONFIG_TIMERFD=y
++CONFIG_EVENTFD=y
++CONFIG_SHMEM=y
++CONFIG_AIO=y
++CONFIG_HAVE_PERF_EVENTS=y
++CONFIG_PERF_USE_VMALLOC=y
+
++#
++# Kernel Performance Events And Counters
++#
++# CONFIG_PERF_EVENTS is not set
++# CONFIG_PERF_COUNTERS is not set
++CONFIG_VM_EVENT_COUNTERS=y
++CONFIG_COMPAT_BRK=y
++CONFIG_SLAB=y
++# CONFIG_SLUB is not set
++# CONFIG_SLOB is not set
++# CONFIG_PROFILING is not set
++CONFIG_HAVE_OPROFILE=y
++# CONFIG_KPROBES is not set
++CONFIG_HAVE_KPROBES=y
++CONFIG_HAVE_KRETPROBES=y
++CONFIG_HAVE_CLK=y
+
-+static void __attribute__((naked)) __actual_isr(void)
-+{
-+ asm __volatile__ (
-+ "stmdb sp!, {r0-r12, lr};"
-+ "mov fp, sp;"
-+ );
++#
++# GCOV-based kernel profiling
++#
++# CONFIG_GCOV_KERNEL is not set
++CONFIG_SLOW_WORK=y
++# CONFIG_SLOW_WORK_DEBUG is not set
++CONFIG_HAVE_GENERIC_DMA_COHERENT=y
++CONFIG_SLABINFO=y
++CONFIG_RT_MUTEXES=y
++CONFIG_BASE_SMALL=0
++CONFIG_MODULES=y
++# CONFIG_MODULE_FORCE_LOAD is not set
++CONFIG_MODULE_UNLOAD=y
++CONFIG_MODULE_FORCE_UNLOAD=y
++# CONFIG_MODVERSIONS is not set
++# CONFIG_MODULE_SRCVERSION_ALL is not set
++CONFIG_BLOCK=y
++# CONFIG_LBDAF is not set
++CONFIG_BLK_DEV_BSG=y
++# CONFIG_BLK_DEV_INTEGRITY is not set
+
-+ current_fiq_c_isr();
++#
++# IO Schedulers
++#
++CONFIG_IOSCHED_NOOP=y
++CONFIG_IOSCHED_DEADLINE=y
++CONFIG_IOSCHED_CFQ=m
++CONFIG_DEFAULT_DEADLINE=y
++# CONFIG_DEFAULT_CFQ is not set
++# CONFIG_DEFAULT_NOOP is not set
++CONFIG_DEFAULT_IOSCHED="deadline"
++# CONFIG_INLINE_SPIN_TRYLOCK is not set
++# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
++# CONFIG_INLINE_SPIN_LOCK is not set
++# CONFIG_INLINE_SPIN_LOCK_BH is not set
++# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
++# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
++# CONFIG_INLINE_SPIN_UNLOCK is not set
++# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
++# CONFIG_INLINE_SPIN_UNLOCK_IRQ is not set
++# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
++# CONFIG_INLINE_READ_TRYLOCK is not set
++# CONFIG_INLINE_READ_LOCK is not set
++# CONFIG_INLINE_READ_LOCK_BH is not set
++# CONFIG_INLINE_READ_LOCK_IRQ is not set
++# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
++# CONFIG_INLINE_READ_UNLOCK is not set
++# CONFIG_INLINE_READ_UNLOCK_BH is not set
++# CONFIG_INLINE_READ_UNLOCK_IRQ is not set
++# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
++# CONFIG_INLINE_WRITE_TRYLOCK is not set
++# CONFIG_INLINE_WRITE_LOCK is not set
++# CONFIG_INLINE_WRITE_LOCK_BH is not set
++# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
++# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
++# CONFIG_INLINE_WRITE_UNLOCK is not set
++# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
++# CONFIG_INLINE_WRITE_UNLOCK_IRQ is not set
++# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
++# CONFIG_MUTEX_SPIN_ON_OWNER is not set
++CONFIG_FREEZER=y
+
-+ asm __volatile__ (
-+ "ldmia sp!, {r0-r12, lr};"
-+ "subs pc, lr, #4;"
-+ );
-+}
++#
++# System Type
++#
++CONFIG_MMU=y
++# CONFIG_ARCH_AAEC2000 is not set
++# CONFIG_ARCH_INTEGRATOR is not set
++# CONFIG_ARCH_REALVIEW is not set
++# CONFIG_ARCH_VERSATILE is not set
++# CONFIG_ARCH_AT91 is not set
++# CONFIG_ARCH_BCMRING is not set
++# CONFIG_ARCH_CLPS711X is not set
++# CONFIG_ARCH_GEMINI is not set
++# CONFIG_ARCH_EBSA110 is not set
++# CONFIG_ARCH_EP93XX is not set
++# CONFIG_ARCH_FOOTBRIDGE is not set
++# CONFIG_ARCH_MXC is not set
++# CONFIG_ARCH_STMP3XXX is not set
++# CONFIG_ARCH_NETX is not set
++# CONFIG_ARCH_H720X is not set
++# CONFIG_ARCH_IOP13XX is not set
++# CONFIG_ARCH_IOP32X is not set
++# CONFIG_ARCH_IOP33X is not set
++# CONFIG_ARCH_IXP23XX is not set
++# CONFIG_ARCH_IXP2000 is not set
++# CONFIG_ARCH_IXP4XX is not set
++# CONFIG_ARCH_L7200 is not set
++# CONFIG_ARCH_DOVE is not set
++# CONFIG_ARCH_KIRKWOOD is not set
++# CONFIG_ARCH_LOKI is not set
++# CONFIG_ARCH_MV78XX0 is not set
++# CONFIG_ARCH_ORION5X is not set
++# CONFIG_ARCH_MMP is not set
++# CONFIG_ARCH_KS8695 is not set
++# CONFIG_ARCH_NS9XXX is not set
++# CONFIG_ARCH_W90X900 is not set
++# CONFIG_ARCH_NUC93X is not set
++# CONFIG_ARCH_PNX4008 is not set
++# CONFIG_ARCH_PXA is not set
++# CONFIG_ARCH_MSM is not set
++# CONFIG_ARCH_SHMOBILE is not set
++# CONFIG_ARCH_RPC is not set
++# CONFIG_ARCH_SA1100 is not set
++CONFIG_ARCH_S3C2410=y
++# CONFIG_ARCH_S3C64XX is not set
++# CONFIG_ARCH_S5P6440 is not set
++# CONFIG_ARCH_S5P6442 is not set
++# CONFIG_ARCH_S5PC1XX is not set
++# CONFIG_ARCH_S5PV210 is not set
++# CONFIG_ARCH_SHARK is not set
++# CONFIG_ARCH_LH7A40X is not set
++# CONFIG_ARCH_U300 is not set
++# CONFIG_ARCH_U8500 is not set
++# CONFIG_ARCH_NOMADIK is not set
++# CONFIG_ARCH_DAVINCI is not set
++# CONFIG_ARCH_OMAP is not set
++CONFIG_PLAT_SAMSUNG=y
+
-+void set_fiq_c_handler(void (*isr)(void))
-+{
-+ struct pt_regs regs;
++#
++# Boot options
++#
++CONFIG_S3C_BOOT_WATCHDOG=y
++CONFIG_S3C_BOOT_ERROR_RESET=y
++CONFIG_S3C_BOOT_UART_FORCE_FIFO=y
++CONFIG_S3C_LOWLEVEL_UART_PORT=2
++CONFIG_SAMSUNG_GPIO_EXTRA=0
++CONFIG_S3C_GPIO_SPACE=0
++CONFIG_S3C_ADC=y
++CONFIG_S3C_DEV_USB_HOST=y
++CONFIG_S3C_DEV_NAND=y
++CONFIG_S3C_DMA=y
+
-+ memset(®s, 0, sizeof(regs));
-+ regs.ARM_r8 = (unsigned long) __actual_isr;
-+ regs.ARM_sp = 0xffff001c + FIQ_C_ISR_STACK_SIZE;
++#
++# Power management
++#
++# CONFIG_SAMSUNG_PM_DEBUG is not set
++# CONFIG_SAMSUNG_PM_CHECK is not set
++CONFIG_PLAT_S3C24XX=y
++CONFIG_CPU_LLSERIAL_S3C2440_ONLY=y
++CONFIG_CPU_LLSERIAL_S3C2440=y
++CONFIG_S3C2410_CLOCK=y
++CONFIG_S3C24XX_PWM=y
++CONFIG_S3C24XX_GPIO_EXTRA=0
++CONFIG_S3C2410_DMA=y
++# CONFIG_S3C2410_DMA_DEBUG is not set
+
-+ set_fiq_handler(__jump_to_isr, 4);
++#
++# S3C2400 Machines
++#
++CONFIG_CPU_S3C2410_DMA=y
++CONFIG_S3C2410_PM=y
++CONFIG_S3C2410_GPIO=y
+
-+ current_fiq_c_isr = isr;
++#
++# S3C2410 Machines
++#
++# CONFIG_ARCH_SMDK2410 is not set
++# CONFIG_ARCH_H1940 is not set
++# CONFIG_MACH_N30 is not set
++# CONFIG_ARCH_BAST is not set
++# CONFIG_MACH_OTOM is not set
++# CONFIG_MACH_AML_M5900 is not set
++# CONFIG_MACH_TCT_HAMMER is not set
++# CONFIG_MACH_VR1000 is not set
++# CONFIG_MACH_QT2410 is not set
+
-+ set_fiq_regs(®s);
-+}
-+/* -------- FIQ handler in C ---------*/
++#
++# S3C2412 Machines
++#
++# CONFIG_MACH_JIVE is not set
++# CONFIG_MACH_SMDK2413 is not set
++# CONFIG_MACH_SMDK2412 is not set
++# CONFIG_MACH_VSTMS is not set
++CONFIG_CPU_S3C2442=y
++CONFIG_CPU_S3C244X=y
+
- int claim_fiq(struct fiq_handler *f)
- {
- int ret = 0;
-diff --git a/arch/arm/mach-s3c2410/include/mach/gpio.h b/arch/arm/mach-s3c2410/include/mach/gpio.h
-index 15f0b3e..0b53cad 100644
---- a/arch/arm/mach-s3c2410/include/mach/gpio.h
-+++ b/arch/arm/mach-s3c2410/include/mach/gpio.h
-@@ -20,10 +20,11 @@
- * devices that need GPIO.
- */
-
--#define ARCH_NR_GPIOS (256 + CONFIG_S3C24XX_GPIO_EXTRA)
-+#define ARCH_NR_GPIOS (512 + CONFIG_S3C24XX_GPIO_EXTRA)
-
- #include <asm-generic/gpio.h>
- #include <mach/gpio-nrs.h>
- #include <mach/gpio-fns.h>
-+#include <mach/regs-gpioj.h>
-
--#define S3C_GPIO_END (S3C2410_GPIO_BANKH + 32)
-+#define S3C_GPIO_END (S3C2440_GPIO_BANKJ + 32)
-diff --git a/arch/arm/mach-s3c2410/include/mach/irqs.h b/arch/arm/mach-s3c2410/include/mach/irqs.h
-index 6c12c63..fc0e3c9 100644
---- a/arch/arm/mach-s3c2410/include/mach/irqs.h
-+++ b/arch/arm/mach-s3c2410/include/mach/irqs.h
-@@ -153,9 +153,9 @@
- #define IRQ_S3C2443_AC97 S3C2410_IRQSUB(28)
-
- #ifdef CONFIG_CPU_S3C2443
--#define NR_IRQS (IRQ_S3C2443_AC97+1)
-+#define S3C2410_NR_INTERNAL_IRQS (IRQ_S3C2443_AC97+1)
- #else
--#define NR_IRQS (IRQ_S3C2440_AC97+1)
-+#define S3C2410_NR_INTERNAL_IRQS (IRQ_S3C2440_AC97+1)
- #endif
-
- /* compatibility define. */
-@@ -173,4 +173,22 @@
- /* Our FIQs are routable from IRQ_EINT0 to IRQ_ADCPARENT */
- #define FIQ_START IRQ_EINT0
-
-+/* Board specific IRQs
-+ * If your board needs a extra set of IRQ numbers add it to the list here.
-+ * Make sure that the numbers are kept in descending order, so if support for
-+ * multiple boards is compiled in the maximum will be used and there are enough
-+ * IRQ numbers available for each board.
-+ */
-+
-+#if defined(CONFIG_MACH_NEO1973_GTA02)
-+#define IRQ_BOARD_NR (9 + 40)
-+#else
-+#define IRQ_BOARD_NR 0
-+#endif
-+
-+#define IRQ_BOARD_START S3C2410_NR_INTERNAL_IRQS
-+#define IRQ_BOARD_END (IRQ_BOARD_START + IRQ_BOARD_NR)
-+
-+#define NR_IRQS IRQ_BOARD_END
++#
++# S3C2440 and S3C2442 Machines
++#
++# CONFIG_MACH_ANUBIS is not set
++CONFIG_MACH_NEO1973_GTA02=y
++# CONFIG_MACH_OSIRIS is not set
++# CONFIG_MACH_RX3715 is not set
++# CONFIG_ARCH_S3C2440 is not set
++# CONFIG_MACH_NEXCODER_2440 is not set
++# CONFIG_SMDK2440_CPU2440 is not set
++# CONFIG_SMDK2440_CPU2442 is not set
++# CONFIG_MACH_AT2440EVB is not set
++# CONFIG_MACH_MINI2440 is not set
+
- #endif /* __ASM_ARCH_IRQ_H */
-diff --git a/arch/arm/mach-s3c2440/Kconfig b/arch/arm/mach-s3c2440/Kconfig
-index 7f46526..cb5a8e5 100644
---- a/arch/arm/mach-s3c2440/Kconfig
-+++ b/arch/arm/mach-s3c2440/Kconfig
-@@ -99,6 +99,10 @@ config MACH_NEO1973_GTA02
- select POWER_SUPPLY
- select MACH_NEO1973
- select S3C2410_PWM
-+ select S3C_DEV_USB_HOST
-+ select S3C_DEV_NAND
-+ select FIQ
-+ select S3C24XX_GPIO_EXTRA64
- help
- Say Y here if you are using the Openmoko GTA02 / Freerunner GSM Phone
-
-diff --git a/arch/arm/mach-s3c2440/Makefile b/arch/arm/mach-s3c2440/Makefile
-index c85ba32..6ce800d 100644
---- a/arch/arm/mach-s3c2440/Makefile
-+++ b/arch/arm/mach-s3c2440/Makefile
-@@ -33,7 +33,12 @@ obj-$(CONFIG_ARCH_S3C2440) += mach-smdk2440.o
- obj-$(CONFIG_MACH_NEXCODER_2440) += mach-nexcoder.o
- obj-$(CONFIG_MACH_AT2440EVB) += mach-at2440evb.o
- obj-$(CONFIG_MACH_MINI2440) += mach-mini2440.o
--obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o
-+obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o \
-+ gta02-pm-bt.o \
-+ gta02-pm-gps.o \
-+ gta02-pm-gsm.o \
-+ gta02-pm-wlan.o \
-+ gta02-fiq.o \
-
- # extra machine support
-
-diff --git a/arch/arm/mach-s3c2440/gta02-fiq.c b/arch/arm/mach-s3c2440/gta02-fiq.c
-new file mode 100644
-index 0000000..d91c523
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-fiq.c
-@@ -0,0 +1,135 @@
-+#include <linux/kernel.h>
++#
++# S3C2443 Machines
++#
++# CONFIG_MACH_SMDK2443 is not set
+
-+#include <asm/fiq.h>
-+#include <mach/regs-irq.h>
-+#include <plat/regs-timer.h>
-+#include <mach/irqs.h>
-+#include <linux/io.h>
-+#include <linux/pwm.h>
-+#include <linux/err.h>
-+#include <linux/hdq.h>
++#
++# Processor Type
++#
++CONFIG_CPU_ARM920T=y
++CONFIG_CPU_32v4T=y
++CONFIG_CPU_ABRT_EV4T=y
++CONFIG_CPU_PABRT_LEGACY=y
++CONFIG_CPU_CACHE_V4WT=y
++CONFIG_CPU_CACHE_VIVT=y
++CONFIG_CPU_COPY_V4WB=y
++CONFIG_CPU_TLB_V4WBI=y
++CONFIG_CPU_CP15=y
++CONFIG_CPU_CP15_MMU=y
+
-+/* -------------------------------------------------------------------------------
-+ * GTA02 FIQ related
-+ *
-+ * Calls into vibrator and hdq and based on the return values
-+ * determines if we the FIQ source be kept alive
-+ */
++#
++# Processor Features
++#
++CONFIG_ARM_THUMB=y
++# CONFIG_CPU_ICACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_DISABLE is not set
++# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
++CONFIG_ARM_L1_CACHE_SHIFT=5
+
-+#define DIVISOR_FROM_US(x) ((x) << 3)
++#
++# Bus support
++#
++# CONFIG_PCI_SYSCALL is not set
++# CONFIG_ARCH_SUPPORTS_MSI is not set
++# CONFIG_PCCARD is not set
+
-+#ifdef CONFIG_HDQ_GPIO_BITBANG
-+#define FIQ_DIVISOR_HDQ DIVISOR_FROM_US(HDQ_SAMPLE_PERIOD_US)
-+extern int hdq_fiq_handler(void);
-+#endif
++#
++# Kernel Features
++#
++CONFIG_VMSPLIT_3G=y
++# CONFIG_VMSPLIT_2G is not set
++# CONFIG_VMSPLIT_1G is not set
++CONFIG_PAGE_OFFSET=0xC0000000
++# CONFIG_PREEMPT_NONE is not set
++# CONFIG_PREEMPT_VOLUNTARY is not set
++CONFIG_PREEMPT=y
++CONFIG_HZ=200
++CONFIG_AEABI=y
++# CONFIG_OABI_COMPAT is not set
++# CONFIG_ARCH_SPARSEMEM_DEFAULT is not set
++# CONFIG_ARCH_SELECT_MEMORY_MODEL is not set
++# CONFIG_HIGHMEM is not set
++CONFIG_SELECT_MEMORY_MODEL=y
++CONFIG_FLATMEM_MANUAL=y
++# CONFIG_DISCONTIGMEM_MANUAL is not set
++# CONFIG_SPARSEMEM_MANUAL is not set
++CONFIG_FLATMEM=y
++CONFIG_FLAT_NODE_MEM_MAP=y
++CONFIG_PAGEFLAGS_EXTENDED=y
++CONFIG_SPLIT_PTLOCK_CPUS=999999
++# CONFIG_PHYS_ADDR_T_64BIT is not set
++CONFIG_ZONE_DMA_FLAG=0
++CONFIG_VIRT_TO_BUS=y
++# CONFIG_KSM is not set
++CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
++CONFIG_ALIGNMENT_TRAP=y
++# CONFIG_UACCESS_WITH_MEMCPY is not set
+
-+/* Global data related to our fiq source */
-+static uint32_t gta02_fiq_ack_mask;
-+static const int gta02_gta02_fiq_timer_id = 2;
++#
++# Boot options
++#
++CONFIG_ZBOOT_ROM_TEXT=0x0
++CONFIG_ZBOOT_ROM_BSS=0x0
++CONFIG_CMDLINE="unused -- bootloader passes ATAG list quiet "
++# CONFIG_XIP_KERNEL is not set
++# CONFIG_KEXEC is not set
+
-+struct pwm_device* gta02_fiq_timer;
++#
++# CPU Power Management
++#
++# CONFIG_CPU_FREQ is not set
++CONFIG_CPU_IDLE=y
++CONFIG_CPU_IDLE_GOV_LADDER=y
+
-+void gta02_fiq_handler(void)
-+{
-+ unsigned long intmask;
-+ int keep_running = 0;
-+ /* disable further timer interrupts if nobody has any work
-+ * or adjust rate according to who still has work
-+ *
-+ * CAUTION: it means forground code must disable FIQ around
-+ * its own non-atomic S3C2410_INTMSK changes... not common
-+ * thankfully and taken care of by the fiq-basis patch
-+ */
++#
++# Floating point emulation
++#
+
-+#ifdef CONFIG_HDQ_GPIO_BITBANG
-+ keep_running = hdq_fiq_handler();
-+#endif
-+ if (!keep_running) {
-+ /* Disable irq */
-+ intmask = __raw_readl(S3C2410_INTMSK);
-+ intmask |= (gta02_fiq_ack_mask);
-+ __raw_writel(intmask, S3C2410_INTMSK);
-+ }
++#
++# At least one emulation must be selected
++#
+
-+ __raw_writel(gta02_fiq_ack_mask, S3C2410_SRCPND);
-+}
++#
++# Userspace binary formats
++#
++CONFIG_BINFMT_ELF=y
++# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
++CONFIG_HAVE_AOUT=y
++# CONFIG_BINFMT_AOUT is not set
++# CONFIG_BINFMT_MISC is not set
+
-+void gta02_fiq_kick(void)
-+{
-+ unsigned long flags;
-+ unsigned long intmask;
-+ /* we have to take care about FIQ because this modification is
-+ * non-atomic, FIQ could come in after the read and before the
-+ * writeback and its changes to the register would be lost
-+ * (platform INTMSK mod code is taken care of already)
-+ */
-+ local_save_flags(flags);
-+ local_fiq_disable();
++#
++# Power management options
++#
++CONFIG_PM=y
++# CONFIG_PM_DEBUG is not set
++CONFIG_PM_SLEEP=y
++CONFIG_SUSPEND=y
++CONFIG_SUSPEND_FREEZER=y
++# CONFIG_APM_EMULATION is not set
++# CONFIG_PM_RUNTIME is not set
++CONFIG_PM_OPS=y
++CONFIG_ARCH_SUSPEND_POSSIBLE=y
++CONFIG_NET=y
+
-+ /* allow FIQs to resume */
-+ intmask = __raw_readl(S3C2410_INTMSK);
-+ intmask &= ~(gta02_fiq_ack_mask);
-+ __raw_writel(intmask, S3C2410_INTMSK);
++#
++# Networking options
++#
++CONFIG_PACKET=y
++CONFIG_UNIX=y
++CONFIG_XFRM=y
++CONFIG_XFRM_USER=m
++# CONFIG_XFRM_SUB_POLICY is not set
++CONFIG_XFRM_MIGRATE=y
++# CONFIG_XFRM_STATISTICS is not set
++CONFIG_XFRM_IPCOMP=m
++CONFIG_NET_KEY=m
++CONFIG_NET_KEY_MIGRATE=y
++CONFIG_INET=y
++CONFIG_IP_MULTICAST=y
++CONFIG_IP_ADVANCED_ROUTER=y
++CONFIG_ASK_IP_FIB_HASH=y
++# CONFIG_IP_FIB_TRIE is not set
++CONFIG_IP_FIB_HASH=y
++CONFIG_IP_MULTIPLE_TABLES=y
++# CONFIG_IP_ROUTE_MULTIPATH is not set
++# CONFIG_IP_ROUTE_VERBOSE is not set
++CONFIG_IP_PNP=y
++# CONFIG_IP_PNP_DHCP is not set
++# CONFIG_IP_PNP_BOOTP is not set
++# CONFIG_IP_PNP_RARP is not set
++CONFIG_NET_IPIP=m
++CONFIG_NET_IPGRE=m
++# CONFIG_NET_IPGRE_BROADCAST is not set
++CONFIG_IP_MROUTE=y
++# CONFIG_IP_PIMSM_V1 is not set
++# CONFIG_IP_PIMSM_V2 is not set
++# CONFIG_ARPD is not set
++CONFIG_SYN_COOKIES=y
++CONFIG_INET_AH=m
++CONFIG_INET_ESP=m
++CONFIG_INET_IPCOMP=m
++CONFIG_INET_XFRM_TUNNEL=m
++CONFIG_INET_TUNNEL=m
++CONFIG_INET_XFRM_MODE_TRANSPORT=m
++CONFIG_INET_XFRM_MODE_TUNNEL=m
++CONFIG_INET_XFRM_MODE_BEET=m
++# CONFIG_INET_LRO is not set
++CONFIG_INET_DIAG=y
++CONFIG_INET_TCP_DIAG=y
++CONFIG_TCP_CONG_ADVANCED=y
++# CONFIG_TCP_CONG_BIC is not set
++# CONFIG_TCP_CONG_CUBIC is not set
++CONFIG_TCP_CONG_WESTWOOD=y
++# CONFIG_TCP_CONG_HTCP is not set
++# CONFIG_TCP_CONG_HSTCP is not set
++# CONFIG_TCP_CONG_HYBLA is not set
++# CONFIG_TCP_CONG_VEGAS is not set
++# CONFIG_TCP_CONG_SCALABLE is not set
++# CONFIG_TCP_CONG_LP is not set
++# CONFIG_TCP_CONG_VENO is not set
++# CONFIG_TCP_CONG_YEAH is not set
++# CONFIG_TCP_CONG_ILLINOIS is not set
++# CONFIG_DEFAULT_BIC is not set
++# CONFIG_DEFAULT_CUBIC is not set
++# CONFIG_DEFAULT_HTCP is not set
++# CONFIG_DEFAULT_VEGAS is not set
++CONFIG_DEFAULT_WESTWOOD=y
++# CONFIG_DEFAULT_RENO is not set
++CONFIG_DEFAULT_TCP_CONG="westwood"
++CONFIG_TCP_MD5SIG=y
++CONFIG_IPV6=m
++# CONFIG_IPV6_PRIVACY is not set
++# CONFIG_IPV6_ROUTER_PREF is not set
++# CONFIG_IPV6_OPTIMISTIC_DAD is not set
++CONFIG_INET6_AH=m
++CONFIG_INET6_ESP=m
++CONFIG_INET6_IPCOMP=m
++# CONFIG_IPV6_MIP6 is not set
++CONFIG_INET6_XFRM_TUNNEL=m
++CONFIG_INET6_TUNNEL=m
++CONFIG_INET6_XFRM_MODE_TRANSPORT=m
++CONFIG_INET6_XFRM_MODE_TUNNEL=m
++CONFIG_INET6_XFRM_MODE_BEET=m
++# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
++CONFIG_IPV6_SIT=m
++# CONFIG_IPV6_SIT_6RD is not set
++CONFIG_IPV6_NDISC_NODETYPE=y
++CONFIG_IPV6_TUNNEL=m
++# CONFIG_IPV6_MULTIPLE_TABLES is not set
++# CONFIG_IPV6_MROUTE is not set
++# CONFIG_NETWORK_SECMARK is not set
++CONFIG_NETFILTER=y
++# CONFIG_NETFILTER_DEBUG is not set
++CONFIG_NETFILTER_ADVANCED=y
++CONFIG_BRIDGE_NETFILTER=y
+
-+ local_irq_restore(flags);
++#
++# Core Netfilter Configuration
++#
++CONFIG_NETFILTER_NETLINK=m
++CONFIG_NETFILTER_NETLINK_QUEUE=m
++CONFIG_NETFILTER_NETLINK_LOG=m
++CONFIG_NF_CONNTRACK=m
++CONFIG_NF_CT_ACCT=y
++CONFIG_NF_CONNTRACK_MARK=y
++# CONFIG_NF_CONNTRACK_EVENTS is not set
++# CONFIG_NF_CT_PROTO_DCCP is not set
++CONFIG_NF_CT_PROTO_GRE=m
++CONFIG_NF_CT_PROTO_SCTP=m
++# CONFIG_NF_CT_PROTO_UDPLITE is not set
++# CONFIG_NF_CONNTRACK_AMANDA is not set
++CONFIG_NF_CONNTRACK_FTP=m
++CONFIG_NF_CONNTRACK_H323=m
++CONFIG_NF_CONNTRACK_IRC=m
++CONFIG_NF_CONNTRACK_NETBIOS_NS=m
++CONFIG_NF_CONNTRACK_PPTP=m
++CONFIG_NF_CONNTRACK_SANE=m
++CONFIG_NF_CONNTRACK_SIP=m
++CONFIG_NF_CONNTRACK_TFTP=m
++CONFIG_NF_CT_NETLINK=m
++# CONFIG_NETFILTER_TPROXY is not set
++CONFIG_NETFILTER_XTABLES=m
++CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
++CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
++# CONFIG_NETFILTER_XT_TARGET_CT is not set
++CONFIG_NETFILTER_XT_TARGET_DSCP=m
++CONFIG_NETFILTER_XT_TARGET_HL=m
++# CONFIG_NETFILTER_XT_TARGET_LED is not set
++CONFIG_NETFILTER_XT_TARGET_MARK=m
++CONFIG_NETFILTER_XT_TARGET_NFLOG=m
++CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
++CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
++# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
++# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
++CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
++# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
++# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
++# CONFIG_NETFILTER_XT_MATCH_COMMENT is not set
++CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
++# CONFIG_NETFILTER_XT_MATCH_CONNLIMIT is not set
++CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
++CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
++CONFIG_NETFILTER_XT_MATCH_DCCP=m
++CONFIG_NETFILTER_XT_MATCH_DSCP=m
++CONFIG_NETFILTER_XT_MATCH_ESP=m
++CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
++CONFIG_NETFILTER_XT_MATCH_HELPER=m
++CONFIG_NETFILTER_XT_MATCH_HL=m
++CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
++CONFIG_NETFILTER_XT_MATCH_LENGTH=m
++CONFIG_NETFILTER_XT_MATCH_LIMIT=m
++CONFIG_NETFILTER_XT_MATCH_MAC=m
++CONFIG_NETFILTER_XT_MATCH_MARK=m
++CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
++# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
++CONFIG_NETFILTER_XT_MATCH_POLICY=m
++CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
++CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
++CONFIG_NETFILTER_XT_MATCH_QUOTA=m
++# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
++CONFIG_NETFILTER_XT_MATCH_REALM=m
++CONFIG_NETFILTER_XT_MATCH_RECENT=m
++# CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT is not set
++CONFIG_NETFILTER_XT_MATCH_SCTP=m
++CONFIG_NETFILTER_XT_MATCH_STATE=m
++CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
++CONFIG_NETFILTER_XT_MATCH_STRING=m
++CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
++CONFIG_NETFILTER_XT_MATCH_TIME=m
++# CONFIG_NETFILTER_XT_MATCH_U32 is not set
++# CONFIG_NETFILTER_XT_MATCH_OSF is not set
++# CONFIG_IP_VS is not set
+
-+}
++#
++# IP: Netfilter Configuration
++#
++CONFIG_NF_DEFRAG_IPV4=m
++CONFIG_NF_CONNTRACK_IPV4=m
++CONFIG_NF_CONNTRACK_PROC_COMPAT=y
++# CONFIG_IP_NF_QUEUE is not set
++CONFIG_IP_NF_IPTABLES=m
++CONFIG_IP_NF_MATCH_ADDRTYPE=m
++CONFIG_IP_NF_MATCH_AH=m
++CONFIG_IP_NF_MATCH_ECN=m
++CONFIG_IP_NF_MATCH_TTL=m
++CONFIG_IP_NF_FILTER=m
++CONFIG_IP_NF_TARGET_REJECT=m
++CONFIG_IP_NF_TARGET_LOG=m
++CONFIG_IP_NF_TARGET_ULOG=m
++CONFIG_NF_NAT=m
++CONFIG_NF_NAT_NEEDED=y
++CONFIG_IP_NF_TARGET_MASQUERADE=m
++CONFIG_IP_NF_TARGET_NETMAP=m
++CONFIG_IP_NF_TARGET_REDIRECT=m
++CONFIG_NF_NAT_SNMP_BASIC=m
++CONFIG_NF_NAT_PROTO_GRE=m
++CONFIG_NF_NAT_PROTO_SCTP=m
++CONFIG_NF_NAT_FTP=m
++CONFIG_NF_NAT_IRC=m
++CONFIG_NF_NAT_TFTP=m
++# CONFIG_NF_NAT_AMANDA is not set
++CONFIG_NF_NAT_PPTP=m
++CONFIG_NF_NAT_H323=m
++CONFIG_NF_NAT_SIP=m
++CONFIG_IP_NF_MANGLE=m
++CONFIG_IP_NF_TARGET_CLUSTERIP=m
++CONFIG_IP_NF_TARGET_ECN=m
++CONFIG_IP_NF_TARGET_TTL=m
++CONFIG_IP_NF_RAW=m
++# CONFIG_IP_NF_ARPTABLES is not set
+
-+int gta02_fiq_enable(void)
-+{
-+ int ret = 0;
++#
++# IPv6: Netfilter Configuration
++#
++CONFIG_NF_CONNTRACK_IPV6=m
++# CONFIG_IP6_NF_QUEUE is not set
++CONFIG_IP6_NF_IPTABLES=m
++CONFIG_IP6_NF_MATCH_AH=m
++CONFIG_IP6_NF_MATCH_EUI64=m
++CONFIG_IP6_NF_MATCH_FRAG=m
++CONFIG_IP6_NF_MATCH_OPTS=m
++CONFIG_IP6_NF_MATCH_HL=m
++CONFIG_IP6_NF_MATCH_IPV6HEADER=m
++CONFIG_IP6_NF_MATCH_MH=m
++CONFIG_IP6_NF_MATCH_RT=m
++CONFIG_IP6_NF_TARGET_HL=m
++CONFIG_IP6_NF_TARGET_LOG=m
++CONFIG_IP6_NF_FILTER=m
++CONFIG_IP6_NF_TARGET_REJECT=m
++CONFIG_IP6_NF_MANGLE=m
++# CONFIG_IP6_NF_RAW is not set
++CONFIG_BRIDGE_NF_EBTABLES=m
++CONFIG_BRIDGE_EBT_BROUTE=m
++CONFIG_BRIDGE_EBT_T_FILTER=m
++CONFIG_BRIDGE_EBT_T_NAT=m
++CONFIG_BRIDGE_EBT_802_3=m
++CONFIG_BRIDGE_EBT_AMONG=m
++CONFIG_BRIDGE_EBT_ARP=m
++CONFIG_BRIDGE_EBT_IP=m
++# CONFIG_BRIDGE_EBT_IP6 is not set
++CONFIG_BRIDGE_EBT_LIMIT=m
++CONFIG_BRIDGE_EBT_MARK=m
++CONFIG_BRIDGE_EBT_PKTTYPE=m
++CONFIG_BRIDGE_EBT_STP=m
++CONFIG_BRIDGE_EBT_VLAN=m
++CONFIG_BRIDGE_EBT_ARPREPLY=m
++CONFIG_BRIDGE_EBT_DNAT=m
++CONFIG_BRIDGE_EBT_MARK_T=m
++CONFIG_BRIDGE_EBT_REDIRECT=m
++CONFIG_BRIDGE_EBT_SNAT=m
++CONFIG_BRIDGE_EBT_LOG=m
++CONFIG_BRIDGE_EBT_ULOG=m
++# CONFIG_BRIDGE_EBT_NFLOG is not set
++# CONFIG_IP_DCCP is not set
++# CONFIG_IP_SCTP is not set
++# CONFIG_RDS is not set
++# CONFIG_TIPC is not set
++# CONFIG_ATM is not set
++CONFIG_STP=y
++CONFIG_BRIDGE=y
++CONFIG_BRIDGE_IGMP_SNOOPING=y
++# CONFIG_NET_DSA is not set
++# CONFIG_VLAN_8021Q is not set
++# CONFIG_DECNET is not set
++CONFIG_LLC=y
++# CONFIG_LLC2 is not set
++# CONFIG_IPX is not set
++# CONFIG_ATALK is not set
++# CONFIG_X25 is not set
++# CONFIG_LAPB is not set
++# CONFIG_ECONET is not set
++# CONFIG_WAN_ROUTER is not set
++# CONFIG_PHONET is not set
++# CONFIG_IEEE802154 is not set
++CONFIG_NET_SCHED=y
+
-+ local_fiq_disable();
++#
++# Queueing/Scheduling
++#
++CONFIG_NET_SCH_CBQ=m
++CONFIG_NET_SCH_HTB=m
++CONFIG_NET_SCH_HFSC=m
++CONFIG_NET_SCH_PRIO=m
++# CONFIG_NET_SCH_MULTIQ is not set
++CONFIG_NET_SCH_RED=m
++CONFIG_NET_SCH_SFQ=m
++CONFIG_NET_SCH_TEQL=m
++CONFIG_NET_SCH_TBF=m
++CONFIG_NET_SCH_GRED=m
++CONFIG_NET_SCH_DSMARK=m
++CONFIG_NET_SCH_NETEM=m
++# CONFIG_NET_SCH_DRR is not set
+
-+ gta02_fiq_timer = pwm_request(gta02_gta02_fiq_timer_id, "fiq timer");
++#
++# Classification
++#
++CONFIG_NET_CLS=y
++CONFIG_NET_CLS_BASIC=m
++CONFIG_NET_CLS_TCINDEX=m
++CONFIG_NET_CLS_ROUTE4=m
++CONFIG_NET_CLS_ROUTE=y
++CONFIG_NET_CLS_FW=m
++CONFIG_NET_CLS_U32=m
++CONFIG_CLS_U32_PERF=y
++CONFIG_CLS_U32_MARK=y
++CONFIG_NET_CLS_RSVP=m
++CONFIG_NET_CLS_RSVP6=m
++# CONFIG_NET_CLS_FLOW is not set
++# CONFIG_NET_EMATCH is not set
++# CONFIG_NET_CLS_ACT is not set
++# CONFIG_NET_CLS_IND is not set
++CONFIG_NET_SCH_FIFO=y
++# CONFIG_DCB is not set
+
-+ if (IS_ERR(gta02_fiq_timer)) {
-+ ret = PTR_ERR(gta02_fiq_timer);
-+ printk("GTA02 FIQ: Could not request fiq timer: %d\n", ret);
-+ return ret;
-+ }
++#
++# Network testing
++#
++# CONFIG_NET_PKTGEN is not set
++# CONFIG_HAMRADIO is not set
++# CONFIG_CAN is not set
++# CONFIG_IRDA is not set
++CONFIG_BT=y
++CONFIG_BT_L2CAP=y
++CONFIG_BT_SCO=y
++CONFIG_BT_RFCOMM=y
++CONFIG_BT_RFCOMM_TTY=y
++CONFIG_BT_BNEP=y
++CONFIG_BT_BNEP_MC_FILTER=y
++CONFIG_BT_BNEP_PROTO_FILTER=y
++CONFIG_BT_HIDP=y
+
-+ gta02_fiq_ack_mask = 1 << (IRQ_TIMER0 + gta02_gta02_fiq_timer_id
-+ - S3C2410_CPUIRQ_OFFSET);
++#
++# Bluetooth device drivers
++#
++CONFIG_BT_HCIBTUSB=y
++# CONFIG_BT_HCIBTSDIO is not set
++# CONFIG_BT_HCIUART is not set
++# CONFIG_BT_HCIBCM203X is not set
++# CONFIG_BT_HCIBPA10X is not set
++# CONFIG_BT_HCIBFUSB is not set
++# CONFIG_BT_HCIVHCI is not set
++# CONFIG_BT_MRVL is not set
++# CONFIG_BT_ATH3K is not set
++# CONFIG_AF_RXRPC is not set
++CONFIG_FIB_RULES=y
++CONFIG_WIRELESS=y
++CONFIG_WIRELESS_EXT=y
++CONFIG_WEXT_CORE=y
++CONFIG_WEXT_PROC=y
++CONFIG_WEXT_PRIV=y
++# CONFIG_CFG80211 is not set
++CONFIG_WIRELESS_EXT_SYSFS=y
++# CONFIG_LIB80211 is not set
+
++#
++# CFG80211 needs to be enabled for MAC80211
++#
++# CONFIG_WIMAX is not set
++CONFIG_RFKILL=y
++CONFIG_RFKILL_LEDS=y
++CONFIG_RFKILL_INPUT=y
++# CONFIG_NET_9P is not set
+
-+ ret = pwm_config(gta02_fiq_timer, HDQ_SAMPLE_PERIOD_US * 1000,
-+ HDQ_SAMPLE_PERIOD_US * 1000);
-+ if (ret) {
-+ printk("GTA02 FIQ: Could not configure fiq timer: %d\n", ret);
-+ goto err;
-+ }
++#
++# Device Drivers
++#
+
-+ set_fiq_c_handler(gta02_fiq_handler);
++#
++# Generic Driver Options
++#
++CONFIG_UEVENT_HELPER_PATH=""
++CONFIG_DEVTMPFS=y
++CONFIG_DEVTMPFS_MOUNT=y
++CONFIG_STANDALONE=y
++CONFIG_PREVENT_FIRMWARE_BUILD=y
++CONFIG_FW_LOADER=y
++# CONFIG_FIRMWARE_IN_KERNEL is not set
++CONFIG_EXTRA_FIRMWARE=""
++# CONFIG_SYS_HYPERVISOR is not set
++CONFIG_CONNECTOR=m
++CONFIG_MTD=y
++# CONFIG_MTD_DEBUG is not set
++# CONFIG_MTD_TESTS is not set
++CONFIG_MTD_CONCAT=y
++CONFIG_MTD_PARTITIONS=y
++# CONFIG_MTD_REDBOOT_PARTS is not set
++CONFIG_MTD_CMDLINE_PARTS=y
++# CONFIG_MTD_AFS_PARTS is not set
++# CONFIG_MTD_AR7_PARTS is not set
+
-+ __raw_writel(gta02_fiq_ack_mask, S3C2410_INTMOD);
++#
++# User Modules And Translation Layers
++#
++CONFIG_MTD_CHAR=y
++CONFIG_MTD_BLKDEVS=y
++CONFIG_MTD_BLOCK=y
++# CONFIG_FTL is not set
++# CONFIG_NFTL is not set
++# CONFIG_INFTL is not set
++# CONFIG_RFD_FTL is not set
++# CONFIG_SSFDC is not set
++# CONFIG_MTD_OOPS is not set
+
-+ pwm_enable(gta02_fiq_timer);
++#
++# RAM/ROM/Flash chip drivers
++#
++CONFIG_MTD_CFI=y
++# CONFIG_MTD_JEDECPROBE is not set
++CONFIG_MTD_GEN_PROBE=y
++# CONFIG_MTD_CFI_ADV_OPTIONS is not set
++CONFIG_MTD_MAP_BANK_WIDTH_1=y
++CONFIG_MTD_MAP_BANK_WIDTH_2=y
++CONFIG_MTD_MAP_BANK_WIDTH_4=y
++# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
++# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
++# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
++CONFIG_MTD_CFI_I1=y
++CONFIG_MTD_CFI_I2=y
++# CONFIG_MTD_CFI_I4 is not set
++# CONFIG_MTD_CFI_I8 is not set
++CONFIG_MTD_CFI_INTELEXT=y
++# CONFIG_MTD_CFI_AMDSTD is not set
++# CONFIG_MTD_CFI_STAA is not set
++CONFIG_MTD_CFI_UTIL=y
++# CONFIG_MTD_RAM is not set
++CONFIG_MTD_ROM=y
++CONFIG_MTD_ABSENT=y
+
-+ local_fiq_enable();
++#
++# Mapping drivers for chip access
++#
++# CONFIG_MTD_COMPLEX_MAPPINGS is not set
++CONFIG_MTD_PHYSMAP=y
++# CONFIG_MTD_PHYSMAP_COMPAT is not set
++# CONFIG_MTD_ARM_INTEGRATOR is not set
++# CONFIG_MTD_PLATRAM is not set
+
-+ return 0;
++#
++# Self-contained MTD device drivers
++#
++# CONFIG_MTD_DATAFLASH is not set
++# CONFIG_MTD_M25P80 is not set
++# CONFIG_MTD_SST25L is not set
++# CONFIG_MTD_SLRAM is not set
++# CONFIG_MTD_PHRAM is not set
++# CONFIG_MTD_MTDRAM is not set
++# CONFIG_MTD_BLOCK2MTD is not set
+
-+err:
-+ pwm_free(gta02_fiq_timer);
++#
++# Disk-On-Chip Device Drivers
++#
++# CONFIG_MTD_DOC2000 is not set
++# CONFIG_MTD_DOC2001 is not set
++# CONFIG_MTD_DOC2001PLUS is not set
++CONFIG_MTD_NAND=y
++CONFIG_MTD_NAND_VERIFY_WRITE=y
++# CONFIG_MTD_NAND_ECC_SMC is not set
++# CONFIG_MTD_NAND_MUSEUM_IDS is not set
++# CONFIG_MTD_NAND_GPIO is not set
++CONFIG_MTD_NAND_IDS=y
++CONFIG_MTD_NAND_S3C2410=y
++# CONFIG_MTD_NAND_S3C2410_DEBUG is not set
++CONFIG_MTD_NAND_S3C2410_HWECC=y
++# CONFIG_MTD_NAND_S3C2410_CLKSTOP is not set
++# CONFIG_MTD_NAND_DISKONCHIP is not set
++# CONFIG_MTD_NAND_NANDSIM is not set
++# CONFIG_MTD_NAND_PLATFORM is not set
++# CONFIG_MTD_ALAUDA is not set
++# CONFIG_MTD_ONENAND is not set
+
-+ return ret;
-+}
++#
++# LPDDR flash memory drivers
++#
++# CONFIG_MTD_LPDDR is not set
+
-+void gta02_fiq_disable(void)
-+{
-+ local_fiq_disable();
++#
++# UBI - Unsorted block images
++#
++CONFIG_MTD_UBI=y
++CONFIG_MTD_UBI_WL_THRESHOLD=4096
++CONFIG_MTD_UBI_BEB_RESERVE=1
++CONFIG_MTD_UBI_GLUEBI=y
+
-+ if (!gta02_fiq_timer)
-+ return;
++#
++# UBI debugging options
++#
++CONFIG_MTD_UBI_DEBUG=y
++# CONFIG_MTD_UBI_DEBUG_MSG is not set
++# CONFIG_MTD_UBI_DEBUG_PARANOID is not set
++CONFIG_MTD_UBI_DEBUG_DISABLE_BGT=y
++# CONFIG_MTD_UBI_DEBUG_EMULATE_BITFLIPS is not set
++# CONFIG_MTD_UBI_DEBUG_EMULATE_WRITE_FAILURES is not set
++# CONFIG_MTD_UBI_DEBUG_EMULATE_ERASE_FAILURES is not set
+
-+ __raw_writel(0, S3C2410_INTMOD);
-+ set_fiq_c_handler(NULL);
++#
++# Additional UBI debugging messages
++#
++# CONFIG_MTD_UBI_DEBUG_MSG_BLD is not set
++# CONFIG_MTD_UBI_DEBUG_MSG_EBA is not set
++# CONFIG_MTD_UBI_DEBUG_MSG_WL is not set
++# CONFIG_MTD_UBI_DEBUG_MSG_IO is not set
++# CONFIG_PARPORT is not set
++CONFIG_BLK_DEV=y
++# CONFIG_BLK_DEV_COW_COMMON is not set
++CONFIG_BLK_DEV_LOOP=m
++# CONFIG_BLK_DEV_CRYPTOLOOP is not set
++# CONFIG_BLK_DEV_DRBD is not set
++# CONFIG_BLK_DEV_NBD is not set
++CONFIG_BLK_DEV_UB=m
++CONFIG_BLK_DEV_RAM=y
++CONFIG_BLK_DEV_RAM_COUNT=16
++CONFIG_BLK_DEV_RAM_SIZE=4096
++# CONFIG_BLK_DEV_XIP is not set
++# CONFIG_CDROM_PKTCDVD is not set
++# CONFIG_ATA_OVER_ETH is not set
++# CONFIG_MG_DISK is not set
++# CONFIG_MISC_DEVICES is not set
++CONFIG_HAVE_IDE=y
++# CONFIG_IDE is not set
+
-+ pwm_disable(gta02_fiq_timer);
++#
++# SCSI device support
++#
++CONFIG_SCSI_MOD=m
++# CONFIG_RAID_ATTRS is not set
++CONFIG_SCSI=m
++CONFIG_SCSI_DMA=y
++# CONFIG_SCSI_TGT is not set
++# CONFIG_SCSI_NETLINK is not set
++CONFIG_SCSI_PROC_FS=y
+
-+ pwm_free(gta02_fiq_timer);
++#
++# SCSI support type (disk, tape, CD-ROM)
++#
++CONFIG_BLK_DEV_SD=m
++# CONFIG_CHR_DEV_ST is not set
++# CONFIG_CHR_DEV_OSST is not set
++CONFIG_BLK_DEV_SR=m
++# CONFIG_BLK_DEV_SR_VENDOR is not set
++CONFIG_CHR_DEV_SG=m
++# CONFIG_CHR_DEV_SCH is not set
++CONFIG_SCSI_MULTI_LUN=y
++# CONFIG_SCSI_CONSTANTS is not set
++# CONFIG_SCSI_LOGGING is not set
++CONFIG_SCSI_SCAN_ASYNC=y
++CONFIG_SCSI_WAIT_SCAN=m
+
-+ gta02_fiq_timer = NULL;
-+}
-+/* -------------------- /GTA02 FIQ Handler ------------------------------------- */
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-bt.c b/arch/arm/mach-s3c2440/gta02-pm-bt.c
-new file mode 100644
-index 0000000..5cf35d8
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-bt.c
-@@ -0,0 +1,259 @@
-+/*
-+ * Bluetooth PM code for the Openmoko Freerunner GSM Phone
-+ *
-+ * (C) 2007 by Openmoko Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
++#
++# SCSI Transports
++#
++# CONFIG_SCSI_SPI_ATTRS is not set
++# CONFIG_SCSI_FC_ATTRS is not set
++# CONFIG_SCSI_ISCSI_ATTRS is not set
++# CONFIG_SCSI_SAS_ATTRS is not set
++# CONFIG_SCSI_SAS_LIBSAS is not set
++# CONFIG_SCSI_SRP_ATTRS is not set
++CONFIG_SCSI_LOWLEVEL=y
++# CONFIG_ISCSI_TCP is not set
++# CONFIG_LIBFC is not set
++# CONFIG_LIBFCOE is not set
++# CONFIG_SCSI_DEBUG is not set
++# CONFIG_SCSI_DH is not set
++# CONFIG_SCSI_OSD_INITIATOR is not set
++# CONFIG_ATA is not set
++# CONFIG_MD is not set
++CONFIG_NETDEVICES=y
++# CONFIG_DUMMY is not set
++# CONFIG_BONDING is not set
++# CONFIG_MACVLAN is not set
++# CONFIG_EQUALIZER is not set
++CONFIG_TUN=m
++# CONFIG_VETH is not set
++# CONFIG_NET_ETHERNET is not set
++CONFIG_MII=m
++# CONFIG_NETDEV_1000 is not set
++# CONFIG_NETDEV_10000 is not set
++CONFIG_WLAN=y
++# CONFIG_USB_ZD1201 is not set
++# CONFIG_HOSTAP is not set
+
-+#include <linux/init.h>
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
-+#include <linux/rfkill.h>
-+#include <linux/slab.h>
++#
++# Enable WiMAX (Networking options) to see the WiMAX drivers
++#
+
-+#include <linux/err.h>
++#
++# USB Network Adapters
++#
++CONFIG_USB_CATC=m
++CONFIG_USB_KAWETH=m
++CONFIG_USB_PEGASUS=m
++CONFIG_USB_RTL8150=m
++CONFIG_USB_USBNET=m
++# CONFIG_USB_NET_AX8817X is not set
++CONFIG_USB_NET_CDCETHER=m
++# CONFIG_USB_NET_CDC_EEM is not set
++# CONFIG_USB_NET_DM9601 is not set
++# CONFIG_USB_NET_SMSC75XX is not set
++# CONFIG_USB_NET_SMSC95XX is not set
++# CONFIG_USB_NET_GL620A is not set
++CONFIG_USB_NET_NET1080=m
++# CONFIG_USB_NET_PLUSB is not set
++# CONFIG_USB_NET_MCS7830 is not set
++# CONFIG_USB_NET_RNDIS_HOST is not set
++CONFIG_USB_NET_CDC_SUBSET=m
++# CONFIG_USB_ALI_M5632 is not set
++# CONFIG_USB_AN2720 is not set
++CONFIG_USB_BELKIN=y
++CONFIG_USB_ARMLINUX=y
++# CONFIG_USB_EPSON2888 is not set
++# CONFIG_USB_KC2190 is not set
++CONFIG_USB_NET_ZAURUS=m
++# CONFIG_USB_HSO is not set
++# CONFIG_USB_NET_INT51X1 is not set
++# CONFIG_USB_IPHETH is not set
++# CONFIG_USB_SIERRA_NET is not set
++# CONFIG_WAN is not set
++CONFIG_PPP=m
++CONFIG_PPP_MULTILINK=y
++CONFIG_PPP_FILTER=y
++CONFIG_PPP_ASYNC=m
++CONFIG_PPP_SYNC_TTY=m
++CONFIG_PPP_DEFLATE=m
++CONFIG_PPP_BSDCOMP=m
++CONFIG_PPP_MPPE=m
++# CONFIG_PPPOE is not set
++# CONFIG_PPPOL2TP is not set
++# CONFIG_SLIP is not set
++CONFIG_SLHC=m
++# CONFIG_NETCONSOLE is not set
++# CONFIG_NETPOLL is not set
++# CONFIG_NET_POLL_CONTROLLER is not set
++# CONFIG_ISDN is not set
++# CONFIG_PHONE is not set
+
-+#include <mach/gpio-fns.h>
++#
++# Input device support
++#
++CONFIG_INPUT=y
++# CONFIG_INPUT_FF_MEMLESS is not set
++# CONFIG_INPUT_POLLDEV is not set
++# CONFIG_INPUT_SPARSEKMAP is not set
+
-+#include <mach/hardware.h>
-+#include <asm/mach-types.h>
++#
++# Userland interfaces
++#
++CONFIG_INPUT_MOUSEDEV=y
++# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
++CONFIG_INPUT_MOUSEDEV_SCREEN_X=480
++CONFIG_INPUT_MOUSEDEV_SCREEN_Y=640
++CONFIG_INPUT_JOYDEV=m
++CONFIG_INPUT_EVDEV=y
++# CONFIG_INPUT_EVBUG is not set
+
-+#include <mach/gta02.h>
++#
++# Input Device Drivers
++#
++CONFIG_INPUT_KEYBOARD=y
++# CONFIG_KEYBOARD_ADP5588 is not set
++# CONFIG_KEYBOARD_ATKBD is not set
++# CONFIG_QT2160 is not set
++# CONFIG_KEYBOARD_LKKBD is not set
++CONFIG_KEYBOARD_GPIO=y
++# CONFIG_KEYBOARD_MATRIX is not set
++# CONFIG_KEYBOARD_LM8323 is not set
++# CONFIG_KEYBOARD_MAX7359 is not set
++# CONFIG_KEYBOARD_NEWTON is not set
++# CONFIG_KEYBOARD_OPENCORES is not set
++CONFIG_KEYBOARD_STOWAWAY=m
++# CONFIG_KEYBOARD_SUNKBD is not set
++# CONFIG_KEYBOARD_XTKBD is not set
++# CONFIG_INPUT_MOUSE is not set
++# CONFIG_INPUT_JOYSTICK is not set
++# CONFIG_INPUT_TABLET is not set
++CONFIG_INPUT_TOUCHSCREEN=y
++# CONFIG_TOUCHSCREEN_ADS7846 is not set
++# CONFIG_TOUCHSCREEN_AD7877 is not set
++# CONFIG_TOUCHSCREEN_AD7879_I2C is not set
++# CONFIG_TOUCHSCREEN_AD7879_SPI is not set
++# CONFIG_TOUCHSCREEN_AD7879 is not set
++# CONFIG_TOUCHSCREEN_DYNAPRO is not set
++# CONFIG_TOUCHSCREEN_EETI is not set
++# CONFIG_TOUCHSCREEN_FUJITSU is not set
++CONFIG_TOUCHSCREEN_S3C2410=y
++# CONFIG_TOUCHSCREEN_GUNZE is not set
++# CONFIG_TOUCHSCREEN_ELO is not set
++# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
++# CONFIG_TOUCHSCREEN_MCS5000 is not set
++# CONFIG_TOUCHSCREEN_MTOUCH is not set
++# CONFIG_TOUCHSCREEN_INEXIO is not set
++# CONFIG_TOUCHSCREEN_MK712 is not set
++# CONFIG_TOUCHSCREEN_PENMOUNT is not set
++# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
++# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
++# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
++# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
++# CONFIG_TOUCHSCREEN_TSC2007 is not set
++# CONFIG_TOUCHSCREEN_W90X900 is not set
++CONFIG_INPUT_MISC=y
++# CONFIG_INPUT_ATI_REMOTE is not set
++# CONFIG_INPUT_ATI_REMOTE2 is not set
++# CONFIG_INPUT_KEYSPAN_REMOTE is not set
++# CONFIG_INPUT_POWERMATE is not set
++# CONFIG_INPUT_YEALINK is not set
++# CONFIG_INPUT_CM109 is not set
++CONFIG_INPUT_UINPUT=m
++CONFIG_INPUT_PCF50633_PMU=y
++# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set
++CONFIG_INPUT_LIS302DL=y
+
-+#include <linux/regulator/consumer.h>
++#
++# Hardware I/O ports
++#
++CONFIG_SERIO=y
++# CONFIG_SERIO_SERPORT is not set
++# CONFIG_SERIO_RAW is not set
++# CONFIG_SERIO_ALTERA_PS2 is not set
++# CONFIG_GAMEPORT is not set
+
-+#define DRVMSG "Openmoko Freerunner Bluetooth Power Management"
++#
++# Character devices
++#
++CONFIG_VT=y
++CONFIG_CONSOLE_TRANSLATIONS=y
++CONFIG_VT_CONSOLE=y
++CONFIG_HW_CONSOLE=y
++CONFIG_VT_HW_CONSOLE_BINDING=y
++# CONFIG_DEVKMEM is not set
++# CONFIG_SERIAL_NONSTANDARD is not set
+
-+struct gta02_pm_bt_data {
-+ struct regulator *regulator;
-+ struct rfkill *rfkill;
-+ int pre_resume_state;
-+};
++#
++# Serial drivers
++#
++# CONFIG_SERIAL_8250 is not set
+
-+static ssize_t bt_read(struct device *dev, struct device_attribute *attr,
-+ char *buf)
-+{
-+ int ret = 0;
-+ if (!strcmp(attr->attr.name, "power_on")) {
-+ if (s3c2410_gpio_getpin(GTA02_GPIO_BT_EN))
-+ ret = 1;
-+ } else if (!strcmp(attr->attr.name, "reset")) {
-+ if (s3c2410_gpio_getpin(GTA02_GPIO_BT_EN) == 0)
-+ ret = 1;
-+ }
-+
-+ if (!ret) {
-+ return strlcpy(buf, "0\n", 3);
-+ } else {
-+ return strlcpy(buf, "1\n", 3);
-+ }
-+}
-+
-+static void __gta02_pm_bt_toggle_radio(struct device *dev, unsigned int on)
-+{
-+ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
++#
++# Non-8250 serial port support
++#
++CONFIG_SERIAL_SAMSUNG=y
++CONFIG_SERIAL_SAMSUNG_UARTS=3
++CONFIG_SERIAL_SAMSUNG_CONSOLE=y
++CONFIG_SERIAL_S3C2440=y
++# CONFIG_SERIAL_MAX3100 is not set
++CONFIG_SERIAL_CORE=y
++CONFIG_SERIAL_CORE_CONSOLE=y
++# CONFIG_SERIAL_TIMBERDALE is not set
++CONFIG_UNIX98_PTYS=y
++# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
++# CONFIG_LEGACY_PTYS is not set
++# CONFIG_IPMI_HANDLER is not set
++# CONFIG_HW_RANDOM is not set
++# CONFIG_R3964 is not set
++# CONFIG_RAW_DRIVER is not set
++# CONFIG_TCG_TPM is not set
++CONFIG_I2C=y
++CONFIG_I2C_BOARDINFO=y
++CONFIG_I2C_COMPAT=y
++CONFIG_I2C_CHARDEV=y
++# CONFIG_I2C_HELPER_AUTO is not set
++# CONFIG_I2C_SMBUS is not set
+
-+ dev_info(dev, "__gta02_pm_bt_toggle_radio %d\n", on);
++#
++# I2C Algorithms
++#
++CONFIG_I2C_ALGOBIT=y
++# CONFIG_I2C_ALGOPCF is not set
++# CONFIG_I2C_ALGOPCA is not set
+
-+ bt_data = dev_get_drvdata(dev);
++#
++# I2C Hardware Bus support
++#
+
-+ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, !on);
++#
++# I2C system bus drivers (mostly embedded / system-on-chip)
++#
++# CONFIG_I2C_DESIGNWARE is not set
++# CONFIG_I2C_GPIO is not set
++# CONFIG_I2C_OCORES is not set
++CONFIG_I2C_S3C2410=y
++# CONFIG_I2C_SIMTEC is not set
++# CONFIG_I2C_XILINX is not set
+
-+ if (on) {
-+ if (!regulator_is_enabled(bt_data->regulator))
-+ regulator_enable(bt_data->regulator);
-+ } else {
-+ if (regulator_is_enabled(bt_data->regulator))
-+ regulator_disable(bt_data->regulator);
-+ }
++#
++# External I2C/SMBus adapter drivers
++#
++# CONFIG_I2C_PARPORT_LIGHT is not set
++# CONFIG_I2C_TAOS_EVM is not set
++# CONFIG_I2C_TINY_USB is not set
+
-+ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, on);
-+}
++#
++# Other I2C/SMBus bus drivers
++#
++# CONFIG_I2C_PCA_PLATFORM is not set
++# CONFIG_I2C_STUB is not set
++# CONFIG_I2C_DEBUG_CORE is not set
++# CONFIG_I2C_DEBUG_ALGO is not set
++# CONFIG_I2C_DEBUG_BUS is not set
++CONFIG_SPI=y
++CONFIG_SPI_MASTER=y
+
++#
++# SPI Master Controller Drivers
++#
++CONFIG_SPI_BITBANG=y
++CONFIG_SPI_GPIO=y
++CONFIG_SPI_S3C24XX=y
++# CONFIG_SPI_S3C24XX_FIQ is not set
++CONFIG_SPI_S3C24XX_GPIO=y
++# CONFIG_SPI_XILINX is not set
++# CONFIG_SPI_DESIGNWARE is not set
+
-+static int bt_rfkill_set_block(void *data, bool blocked)
-+{
-+ struct device *dev = data;
++#
++# SPI Protocol Masters
++#
++# CONFIG_SPI_SPIDEV is not set
++# CONFIG_SPI_TLE62X0 is not set
+
-+ __gta02_pm_bt_toggle_radio(dev, !blocked);
++#
++# PPS support
++#
++# CONFIG_PPS is not set
++CONFIG_ARCH_REQUIRE_GPIOLIB=y
++CONFIG_GPIOLIB=y
++CONFIG_GPIO_SYSFS=y
+
-+ return 0;
-+}
++#
++# Memory mapped GPIO expanders:
++#
++# CONFIG_GPIO_IT8761E is not set
+
-+static const struct rfkill_ops gta02_bt_rfkill_ops = {
-+ .set_block = bt_rfkill_set_block,
-+};
++#
++# I2C GPIO expanders:
++#
++# CONFIG_GPIO_MAX7300 is not set
++# CONFIG_GPIO_MAX732X is not set
++# CONFIG_GPIO_PCA953X is not set
++# CONFIG_GPIO_PCF857X is not set
++# CONFIG_GPIO_ADP5588 is not set
++CONFIG_GPIO_PCF50633=y
+
++#
++# PCI GPIO expanders:
++#
+
-+static ssize_t bt_write(struct device *dev, struct device_attribute *attr,
-+ const char *buf, size_t count)
-+{
-+ unsigned long on = simple_strtoul(buf, NULL, 10);
-+ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
++#
++# SPI GPIO expanders:
++#
++# CONFIG_GPIO_MAX7301 is not set
++# CONFIG_GPIO_MCP23S08 is not set
++# CONFIG_GPIO_MC33880 is not set
+
-+ if (!strcmp(attr->attr.name, "power_on")) {
-+ rfkill_set_sw_state(bt_data->rfkill, on ? 1 : 0);
++#
++# AC97 GPIO expanders:
++#
++# CONFIG_W1 is not set
++CONFIG_POWER_SUPPLY=y
++# CONFIG_POWER_SUPPLY_DEBUG is not set
++# CONFIG_PDA_POWER is not set
++# CONFIG_BATTERY_DS2760 is not set
++# CONFIG_BATTERY_DS2782 is not set
++# CONFIG_BATTERY_BQ27x00 is not set
++# CONFIG_BATTERY_MAX17040 is not set
++CONFIG_CHARGER_PCF50633=y
++CONFIG_BATTERY_BQ27000_HDQ=y
++CONFIG_HDQ_GPIO_BITBANG=y
++CONFIG_BATTERY_PLATFORM=m
++# CONFIG_HWMON is not set
++# CONFIG_THERMAL is not set
++CONFIG_WATCHDOG=y
++CONFIG_WATCHDOG_NOWAYOUT=y
+
-+ __gta02_pm_bt_toggle_radio(dev, on);
-+ } else if (!strcmp(attr->attr.name, "reset")) {
-+ /* reset is low-active, so we need to invert */
-+ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, on ? 0 : 1);
-+ }
++#
++# Watchdog Device Drivers
++#
++CONFIG_SOFT_WATCHDOG=y
++CONFIG_S3C2410_WATCHDOG=y
++# CONFIG_MAX63XX_WATCHDOG is not set
+
-+ return count;
-+}
++#
++# USB-based Watchdog Cards
++#
++# CONFIG_USBPCWATCHDOG is not set
++CONFIG_SSB_POSSIBLE=y
+
-+static DEVICE_ATTR(power_on, 0644, bt_read, bt_write);
-+static DEVICE_ATTR(reset, 0644, bt_read, bt_write);
++#
++# Sonics Silicon Backplane
++#
++# CONFIG_SSB is not set
+
-+#ifdef CONFIG_PM
-+static int gta02_bt_suspend(struct platform_device *pdev, pm_message_t state)
-+{
-+ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
++#
++# Multifunction device drivers
++#
++CONFIG_MFD_CORE=y
++# CONFIG_MFD_88PM860X is not set
++# CONFIG_MFD_SM501 is not set
++# CONFIG_MFD_ASIC3 is not set
++# CONFIG_HTC_EGPIO is not set
++# CONFIG_HTC_PASIC3 is not set
++# CONFIG_HTC_I2CPLD is not set
++# CONFIG_TPS65010 is not set
++# CONFIG_TWL4030_CORE is not set
++# CONFIG_MFD_TMIO is not set
++# CONFIG_MFD_T7L66XB is not set
++# CONFIG_MFD_TC6387XB is not set
++# CONFIG_MFD_TC6393XB is not set
++# CONFIG_PMIC_DA903X is not set
++# CONFIG_PMIC_ADP5520 is not set
++# CONFIG_MFD_MAX8925 is not set
++# CONFIG_MFD_WM8400 is not set
++# CONFIG_MFD_WM831X is not set
++# CONFIG_MFD_WM8350_I2C is not set
++# CONFIG_MFD_WM8994 is not set
++CONFIG_MFD_PCF50633=y
++# CONFIG_MFD_MC13783 is not set
++CONFIG_PCF50633_ADC=y
++# CONFIG_AB3100_CORE is not set
++# CONFIG_EZX_PCAP is not set
++# CONFIG_AB4500_CORE is not set
++CONFIG_MFD_GLAMO=y
++# CONFIG_MFD_GLAMO_FB is not set
++CONFIG_MFD_GLAMO_GPIO=y
++CONFIG_MFD_GLAMO_MCI=y
++CONFIG_MFD_GLAMO_DRM=y
++CONFIG_REGULATOR=y
++# CONFIG_REGULATOR_DEBUG is not set
++# CONFIG_REGULATOR_DUMMY is not set
++CONFIG_REGULATOR_FIXED_VOLTAGE=y
++# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
++# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
++# CONFIG_REGULATOR_BQ24022 is not set
++# CONFIG_REGULATOR_MAX1586 is not set
++# CONFIG_REGULATOR_MAX8649 is not set
++# CONFIG_REGULATOR_MAX8660 is not set
++CONFIG_REGULATOR_PCF50633=y
++# CONFIG_REGULATOR_LP3971 is not set
++# CONFIG_REGULATOR_TPS65023 is not set
++# CONFIG_REGULATOR_TPS6507X is not set
++# CONFIG_MEDIA_SUPPORT is not set
+
-+ dev_dbg(&pdev->dev, DRVMSG ": suspending\n");
++#
++# Graphics support
++#
++CONFIG_DRM=y
++CONFIG_DRM_KMS_HELPER=y
++# CONFIG_DRM_MGA is not set
++# CONFIG_DRM_VIA is not set
++# CONFIG_DRM_SAVAGE is not set
++# CONFIG_VGASTATE is not set
++CONFIG_VIDEO_OUTPUT_CONTROL=y
++CONFIG_FB=y
++# CONFIG_FIRMWARE_EDID is not set
++# CONFIG_FB_DDC is not set
++# CONFIG_FB_BOOT_VESA_SUPPORT is not set
++CONFIG_FB_CFB_FILLRECT=y
++CONFIG_FB_CFB_COPYAREA=y
++CONFIG_FB_CFB_IMAGEBLIT=y
++# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
++# CONFIG_FB_SYS_FILLRECT is not set
++# CONFIG_FB_SYS_COPYAREA is not set
++# CONFIG_FB_SYS_IMAGEBLIT is not set
++# CONFIG_FB_FOREIGN_ENDIAN is not set
++# CONFIG_FB_SYS_FOPS is not set
++# CONFIG_FB_SVGALIB is not set
++# CONFIG_FB_MACMODES is not set
++# CONFIG_FB_BACKLIGHT is not set
++# CONFIG_FB_MODE_HELPERS is not set
++# CONFIG_FB_TILEBLITTING is not set
+
-+ bt_data->pre_resume_state = s3c2410_gpio_getpin(GTA02_GPIO_BT_EN);
-+ __gta02_pm_bt_toggle_radio(&pdev->dev, 0);
++#
++# Frame buffer hardware drivers
++#
++# CONFIG_FB_UVESA is not set
++# CONFIG_FB_S1D13XXX is not set
++# CONFIG_FB_TMIO is not set
++# CONFIG_FB_S3C2410 is not set
++# CONFIG_FB_VIRTUAL is not set
++# CONFIG_FB_METRONOME is not set
++# CONFIG_FB_MB862XX is not set
++# CONFIG_FB_BROADSHEET is not set
++CONFIG_BACKLIGHT_LCD_SUPPORT=y
++CONFIG_LCD_CLASS_DEVICE=y
++# CONFIG_LCD_L4F00242T03 is not set
++# CONFIG_LCD_LMS283GF05 is not set
++# CONFIG_LCD_LTV350QV is not set
++# CONFIG_LCD_ILI9320 is not set
++# CONFIG_LCD_TDO24M is not set
++# CONFIG_LCD_VGG2432A4 is not set
++# CONFIG_LCD_PLATFORM is not set
++CONFIG_LCD_JBT6K74=y
++CONFIG_BACKLIGHT_CLASS_DEVICE=y
++# CONFIG_BACKLIGHT_GENERIC is not set
++CONFIG_BACKLIGHT_PWM=y
++CONFIG_BACKLIGHT_PCF50633=y
+
-+ return 0;
-+}
++#
++# Display device support
++#
++# CONFIG_DISPLAY_SUPPORT is not set
+
-+static int gta02_bt_resume(struct platform_device *pdev)
-+{
-+ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
-+ dev_dbg(&pdev->dev, DRVMSG ": resuming\n");
++#
++# Console display driver support
++#
++# CONFIG_VGA_CONSOLE is not set
++CONFIG_DUMMY_CONSOLE=y
++CONFIG_FRAMEBUFFER_CONSOLE=y
++# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
++# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
++# CONFIG_FONTS is not set
++CONFIG_FONT_8x8=y
++CONFIG_FONT_8x16=y
++# CONFIG_LOGO is not set
++CONFIG_SOUND=y
++CONFIG_SOUND_OSS_CORE=y
++CONFIG_SOUND_OSS_CORE_PRECLAIM=y
++CONFIG_SND=y
++CONFIG_SND_TIMER=y
++CONFIG_SND_PCM=y
++CONFIG_SND_JACK=y
++CONFIG_SND_SEQUENCER=y
++CONFIG_SND_SEQ_DUMMY=y
++CONFIG_SND_OSSEMUL=y
++CONFIG_SND_MIXER_OSS=y
++CONFIG_SND_PCM_OSS=y
++CONFIG_SND_PCM_OSS_PLUGINS=y
++CONFIG_SND_SEQUENCER_OSS=y
++# CONFIG_SND_DYNAMIC_MINORS is not set
++# CONFIG_SND_SUPPORT_OLD_API is not set
++# CONFIG_SND_VERBOSE_PROCFS is not set
++# CONFIG_SND_VERBOSE_PRINTK is not set
++# CONFIG_SND_DEBUG is not set
++# CONFIG_SND_RAWMIDI_SEQ is not set
++# CONFIG_SND_OPL3_LIB_SEQ is not set
++# CONFIG_SND_OPL4_LIB_SEQ is not set
++# CONFIG_SND_SBAWE_SEQ is not set
++# CONFIG_SND_EMU10K1_SEQ is not set
++# CONFIG_SND_DRIVERS is not set
++# CONFIG_SND_ARM is not set
++# CONFIG_SND_SPI is not set
++# CONFIG_SND_USB is not set
++CONFIG_SND_SOC=y
++CONFIG_SND_S3C24XX_SOC=y
++CONFIG_SND_S3C24XX_SOC_I2S=y
++CONFIG_SND_S3C24XX_SOC_NEO1973_WM8753=y
++# CONFIG_SND_S3C24XX_SOC_LN2440SBC_ALC650 is not set
++# CONFIG_SND_S3C24XX_SOC_S3C24XX_UDA134X is not set
++# CONFIG_SND_S3C24XX_SOC_SIMTEC_TLV320AIC23 is not set
++# CONFIG_SND_S3C24XX_SOC_SIMTEC_HERMES is not set
++CONFIG_SND_SOC_I2C_AND_SPI=y
++# CONFIG_SND_SOC_ALL_CODECS is not set
++CONFIG_SND_SOC_WM8753=y
++CONFIG_SND_SOC_LM4857=y
++# CONFIG_SOUND_PRIME is not set
++CONFIG_HID_SUPPORT=y
++CONFIG_HID=y
++# CONFIG_HIDRAW is not set
+
-+ __gta02_pm_bt_toggle_radio(&pdev->dev, bt_data->pre_resume_state);
-+ return 0;
-+}
-+#else
-+#define gta02_bt_suspend NULL
-+#define gta02_bt_resume NULL
-+#endif
++#
++# USB Input Devices
++#
++CONFIG_USB_HID=y
++# CONFIG_HID_PID is not set
++# CONFIG_USB_HIDDEV is not set
+
-+static struct attribute *gta02_bt_sysfs_entries[] = {
-+ &dev_attr_power_on.attr,
-+ &dev_attr_reset.attr,
-+ NULL
-+};
++#
++# Special HID drivers
++#
++# CONFIG_HID_3M_PCT is not set
++CONFIG_HID_A4TECH=y
++CONFIG_HID_APPLE=y
++CONFIG_HID_BELKIN=y
++CONFIG_HID_CHERRY=y
++CONFIG_HID_CHICONY=y
++CONFIG_HID_CYPRESS=y
++CONFIG_HID_DRAGONRISE=y
++# CONFIG_DRAGONRISE_FF is not set
++CONFIG_HID_EZKEY=y
++CONFIG_HID_KYE=y
++CONFIG_HID_GYRATION=y
++CONFIG_HID_TWINHAN=y
++CONFIG_HID_KENSINGTON=y
++CONFIG_HID_LOGITECH=y
++# CONFIG_LOGITECH_FF is not set
++# CONFIG_LOGIRUMBLEPAD2_FF is not set
++# CONFIG_LOGIG940_FF is not set
++# CONFIG_HID_MAGICMOUSE is not set
++CONFIG_HID_MICROSOFT=y
++# CONFIG_HID_MOSART is not set
++CONFIG_HID_MONTEREY=y
++CONFIG_HID_NTRIG=y
++CONFIG_HID_ORTEK=y
++CONFIG_HID_PANTHERLORD=y
++# CONFIG_PANTHERLORD_FF is not set
++CONFIG_HID_PETALYNX=y
++# CONFIG_HID_QUANTA is not set
++CONFIG_HID_SAMSUNG=y
++CONFIG_HID_SONY=y
++# CONFIG_HID_STANTUM is not set
++CONFIG_HID_SUNPLUS=y
++CONFIG_HID_GREENASIA=y
++# CONFIG_GREENASIA_FF is not set
++CONFIG_HID_SMARTJOYPLUS=y
++# CONFIG_SMARTJOYPLUS_FF is not set
++CONFIG_HID_TOPSEED=y
++CONFIG_HID_THRUSTMASTER=y
++# CONFIG_THRUSTMASTER_FF is not set
++CONFIG_HID_WACOM=y
++CONFIG_HID_ZEROPLUS=y
++# CONFIG_ZEROPLUS_FF is not set
++CONFIG_USB_SUPPORT=y
++CONFIG_USB_ARCH_HAS_HCD=y
++CONFIG_USB_ARCH_HAS_OHCI=y
++# CONFIG_USB_ARCH_HAS_EHCI is not set
++CONFIG_USB=y
++# CONFIG_USB_DEBUG is not set
++CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+
-+static struct attribute_group gta02_bt_attr_group = {
-+ .name = NULL,
-+ .attrs = gta02_bt_sysfs_entries,
-+};
++#
++# Miscellaneous USB options
++#
++# CONFIG_USB_DEVICEFS is not set
++# CONFIG_USB_DEVICE_CLASS is not set
++# CONFIG_USB_DYNAMIC_MINORS is not set
++# CONFIG_USB_MON is not set
++# CONFIG_USB_WUSB is not set
++# CONFIG_USB_WUSB_CBAF is not set
+
-+static int __init gta02_bt_probe(struct platform_device *pdev)
-+{
-+ struct rfkill *rfkill;
-+ struct regulator *regulator;
-+ struct gta02_pm_bt_data *bt_data;
-+ int ret;
++#
++# USB Host Controller Drivers
++#
++# CONFIG_USB_C67X00_HCD is not set
++# CONFIG_USB_OXU210HP_HCD is not set
++# CONFIG_USB_ISP116X_HCD is not set
++# CONFIG_USB_ISP1760_HCD is not set
++# CONFIG_USB_ISP1362_HCD is not set
++CONFIG_USB_OHCI_HCD=y
++# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
++# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set
++CONFIG_USB_OHCI_LITTLE_ENDIAN=y
++# CONFIG_USB_SL811_HCD is not set
++# CONFIG_USB_R8A66597_HCD is not set
++# CONFIG_USB_HWA_HCD is not set
++# CONFIG_USB_MUSB_HDRC is not set
++# CONFIG_USB_GADGET_MUSB_HDRC is not set
+
-+ dev_info(&pdev->dev, DRVMSG ": starting\n");
++#
++# USB Device Class drivers
++#
++CONFIG_USB_ACM=m
++CONFIG_USB_PRINTER=m
++# CONFIG_USB_WDM is not set
++CONFIG_USB_TMC=m
+
-+ bt_data = kzalloc(sizeof(*bt_data), GFP_KERNEL);
-+ dev_set_drvdata(&pdev->dev, bt_data);
++#
++# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
++#
+
-+ regulator = regulator_get(&pdev->dev, "BT_3V2");
-+ if (IS_ERR(regulator))
-+ return -ENODEV;
++#
++# also be needed; see USB_STORAGE Help for more info
++#
++CONFIG_USB_STORAGE=m
++# CONFIG_USB_STORAGE_DEBUG is not set
++CONFIG_USB_STORAGE_DATAFAB=m
++CONFIG_USB_STORAGE_FREECOM=m
++# CONFIG_USB_STORAGE_ISD200 is not set
++CONFIG_USB_STORAGE_USBAT=m
++CONFIG_USB_STORAGE_SDDR09=m
++CONFIG_USB_STORAGE_SDDR55=m
++CONFIG_USB_STORAGE_JUMPSHOT=m
++CONFIG_USB_STORAGE_ALAUDA=m
++# CONFIG_USB_STORAGE_ONETOUCH is not set
++CONFIG_USB_STORAGE_KARMA=m
++# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
++# CONFIG_USB_LIBUSUAL is not set
+
-+ bt_data->regulator = regulator;
++#
++# USB Imaging devices
++#
++# CONFIG_USB_MDC800 is not set
++# CONFIG_USB_MICROTEK is not set
+
-+ /* this tests the true physical state of the regulator... */
-+ if (regulator_is_enabled(regulator)) {
-+ /*
-+ * but these only operate on the logical state of the
-+ * regulator... so we need to logicaly "adopt" it on
-+ * to turn it off
-+ */
-+ regulator_enable(regulator);
-+ regulator_disable(regulator);
-+ }
++#
++# USB port drivers
++#
++CONFIG_USB_SERIAL=m
++CONFIG_USB_EZUSB=y
++CONFIG_USB_SERIAL_GENERIC=y
++CONFIG_USB_SERIAL_AIRCABLE=m
++CONFIG_USB_SERIAL_ARK3116=m
++CONFIG_USB_SERIAL_BELKIN=m
++# CONFIG_USB_SERIAL_CH341 is not set
++CONFIG_USB_SERIAL_WHITEHEAT=m
++CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
++# CONFIG_USB_SERIAL_CP210X is not set
++CONFIG_USB_SERIAL_CYPRESS_M8=m
++CONFIG_USB_SERIAL_EMPEG=m
++CONFIG_USB_SERIAL_FTDI_SIO=m
++CONFIG_USB_SERIAL_FUNSOFT=m
++CONFIG_USB_SERIAL_VISOR=m
++CONFIG_USB_SERIAL_IPAQ=m
++CONFIG_USB_SERIAL_IR=m
++CONFIG_USB_SERIAL_EDGEPORT=m
++CONFIG_USB_SERIAL_EDGEPORT_TI=m
++CONFIG_USB_SERIAL_GARMIN=m
++CONFIG_USB_SERIAL_IPW=m
++# CONFIG_USB_SERIAL_IUU is not set
++CONFIG_USB_SERIAL_KEYSPAN_PDA=m
++CONFIG_USB_SERIAL_KEYSPAN=m
++CONFIG_USB_SERIAL_KLSI=m
++CONFIG_USB_SERIAL_KOBIL_SCT=m
++CONFIG_USB_SERIAL_MCT_U232=m
++CONFIG_USB_SERIAL_MOS7720=m
++CONFIG_USB_SERIAL_MOS7840=m
++# CONFIG_USB_SERIAL_MOTOROLA is not set
++CONFIG_USB_SERIAL_NAVMAN=m
++CONFIG_USB_SERIAL_PL2303=m
++# CONFIG_USB_SERIAL_OTI6858 is not set
++# CONFIG_USB_SERIAL_QCAUX is not set
++# CONFIG_USB_SERIAL_QUALCOMM is not set
++# CONFIG_USB_SERIAL_SPCP8X5 is not set
++CONFIG_USB_SERIAL_HP4X=m
++CONFIG_USB_SERIAL_SAFE=m
++CONFIG_USB_SERIAL_SAFE_PADDED=y
++# CONFIG_USB_SERIAL_SIEMENS_MPI is not set
++CONFIG_USB_SERIAL_SIERRAWIRELESS=m
++# CONFIG_USB_SERIAL_SYMBOL is not set
++CONFIG_USB_SERIAL_TI=m
++CONFIG_USB_SERIAL_CYBERJACK=m
++CONFIG_USB_SERIAL_XIRCOM=m
++CONFIG_USB_SERIAL_OPTION=m
++CONFIG_USB_SERIAL_OMNINET=m
++# CONFIG_USB_SERIAL_OPTICON is not set
++# CONFIG_USB_SERIAL_VIVOPAY_SERIAL is not set
++# CONFIG_USB_SERIAL_DEBUG is not set
+
-+ /* we pull reset to low to make sure that the chip doesn't
-+ * drain power through the reset line */
-+ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, 0);
++#
++# USB Miscellaneous drivers
++#
++# CONFIG_USB_EMI62 is not set
++# CONFIG_USB_EMI26 is not set
++# CONFIG_USB_ADUTUX is not set
++# CONFIG_USB_SEVSEG is not set
++# CONFIG_USB_RIO500 is not set
++# CONFIG_USB_LEGOTOWER is not set
++# CONFIG_USB_LCD is not set
++# CONFIG_USB_LED is not set
++# CONFIG_USB_CYPRESS_CY7C63 is not set
++# CONFIG_USB_CYTHERM is not set
++# CONFIG_USB_IDMOUSE is not set
++# CONFIG_USB_FTDI_ELAN is not set
++# CONFIG_USB_APPLEDISPLAY is not set
++# CONFIG_USB_LD is not set
++CONFIG_USB_TRANCEVIBRATOR=m
++CONFIG_USB_IOWARRIOR=m
++# CONFIG_USB_TEST is not set
++# CONFIG_USB_ISIGHTFW is not set
++CONFIG_USB_GADGET=y
++# CONFIG_USB_GADGET_DEBUG_FILES is not set
++# CONFIG_USB_GADGET_DEBUG_FS is not set
++CONFIG_USB_GADGET_VBUS_DRAW=500
++CONFIG_USB_GADGET_SELECTED=y
++# CONFIG_USB_GADGET_AT91 is not set
++# CONFIG_USB_GADGET_ATMEL_USBA is not set
++# CONFIG_USB_GADGET_FSL_USB2 is not set
++# CONFIG_USB_GADGET_LH7A40X is not set
++# CONFIG_USB_GADGET_OMAP is not set
++# CONFIG_USB_GADGET_PXA25X is not set
++# CONFIG_USB_GADGET_R8A66597 is not set
++# CONFIG_USB_GADGET_PXA27X is not set
++# CONFIG_USB_GADGET_S3C_HSOTG is not set
++# CONFIG_USB_GADGET_IMX is not set
++CONFIG_USB_GADGET_S3C2410=y
++CONFIG_USB_S3C2410=y
++# CONFIG_USB_S3C2410_DEBUG is not set
++# CONFIG_USB_GADGET_M66592 is not set
++# CONFIG_USB_GADGET_AMD5536UDC is not set
++# CONFIG_USB_GADGET_FSL_QE is not set
++# CONFIG_USB_GADGET_CI13XXX is not set
++# CONFIG_USB_GADGET_NET2280 is not set
++# CONFIG_USB_GADGET_GOKU is not set
++# CONFIG_USB_GADGET_LANGWELL is not set
++# CONFIG_USB_GADGET_DUMMY_HCD is not set
++# CONFIG_USB_GADGET_DUALSPEED is not set
++# CONFIG_USB_ZERO is not set
++# CONFIG_USB_AUDIO is not set
++CONFIG_USB_ETH=m
++CONFIG_USB_ETH_RNDIS=y
++# CONFIG_USB_ETH_EEM is not set
++# CONFIG_USB_GADGETFS is not set
++# CONFIG_USB_FILE_STORAGE is not set
++# CONFIG_USB_MASS_STORAGE is not set
++# CONFIG_USB_G_SERIAL is not set
++# CONFIG_USB_MIDI_GADGET is not set
++# CONFIG_USB_G_PRINTER is not set
++# CONFIG_USB_CDC_COMPOSITE is not set
++# CONFIG_USB_G_NOKIA is not set
++# CONFIG_USB_G_MULTI is not set
+
-+ rfkill = rfkill_alloc(pdev->name, &pdev->dev, RFKILL_TYPE_BLUETOOTH,
-+ >a02_bt_rfkill_ops, &pdev->dev);
++#
++# OTG and related infrastructure
++#
++# CONFIG_USB_GPIO_VBUS is not set
++# CONFIG_USB_ULPI is not set
++# CONFIG_NOP_USB_XCEIV is not set
++CONFIG_MMC=y
++# CONFIG_MMC_DEBUG is not set
++CONFIG_MMC_UNSAFE_RESUME=y
+
-+ if (!rfkill) {
-+ dev_err(&pdev->dev, "Failed to allocate rfkill\n");
-+ return -ENOMEM;
-+ }
++#
++# MMC/SD/SDIO Card Drivers
++#
++CONFIG_MMC_BLOCK=y
++CONFIG_MMC_BLOCK_BOUNCE=y
++# CONFIG_SDIO_UART is not set
++# CONFIG_MMC_TEST is not set
+
-+ rfkill_init_sw_state(rfkill, 0);
++#
++# MMC/SD/SDIO Host Controller Drivers
++#
++# CONFIG_MMC_SDHCI is not set
++# CONFIG_MMC_SPI is not set
++CONFIG_MMC_S3C=y
++# CONFIG_MMC_S3C_HW_SDIO_IRQ is not set
++CONFIG_MMC_S3C_PIO=y
++# CONFIG_MMC_S3C_DMA is not set
++# CONFIG_MMC_S3C_PIODMA is not set
++# CONFIG_MEMSTICK is not set
++CONFIG_NEW_LEDS=y
++CONFIG_LEDS_CLASS=y
+
-+ ret = rfkill_register(rfkill);
-+ if (ret) {
-+ rfkill_destroy(rfkill);
-+ dev_err(&pdev->dev, "Failed to register rfkill\n");
-+ return ret;
-+ }
++#
++# LED drivers
++#
++CONFIG_LEDS_S3C24XX=y
++# CONFIG_LEDS_PCA9532 is not set
++CONFIG_LEDS_GPIO=y
++CONFIG_LEDS_GPIO_PLATFORM=y
++# CONFIG_LEDS_LP3944 is not set
++# CONFIG_LEDS_PCA955X is not set
++# CONFIG_LEDS_DAC124S085 is not set
++CONFIG_LEDS_PWM=y
++CONFIG_LEDS_REGULATOR=y
++# CONFIG_LEDS_BD2802 is not set
++# CONFIG_LEDS_LT3593 is not set
++CONFIG_LEDS_TRIGGERS=y
+
-+ bt_data->rfkill = rfkill;
++#
++# LED Triggers
++#
++CONFIG_LEDS_TRIGGER_TIMER=y
++CONFIG_LEDS_TRIGGER_HEARTBEAT=y
++# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
++# CONFIG_LEDS_TRIGGER_GPIO is not set
++# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
+
-+ return sysfs_create_group(&pdev->dev.kobj, >a02_bt_attr_group);
-+}
++#
++# iptables trigger is under Netfilter config (LED target)
++#
++# CONFIG_ACCESSIBILITY is not set
++CONFIG_RTC_LIB=y
++CONFIG_RTC_CLASS=y
++CONFIG_RTC_HCTOSYS=y
++CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
++# CONFIG_RTC_DEBUG is not set
+
-+static int gta02_bt_remove(struct platform_device *pdev)
-+{
-+ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
-+ struct regulator *regulator;
++#
++# RTC interfaces
++#
++CONFIG_RTC_INTF_SYSFS=y
++CONFIG_RTC_INTF_PROC=y
++CONFIG_RTC_INTF_DEV=y
++# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
++# CONFIG_RTC_DRV_TEST is not set
+
-+ sysfs_remove_group(&pdev->dev.kobj, >a02_bt_attr_group);
++#
++# I2C RTC drivers
++#
++# CONFIG_RTC_DRV_DS1307 is not set
++# CONFIG_RTC_DRV_DS1374 is not set
++# CONFIG_RTC_DRV_DS1672 is not set
++# CONFIG_RTC_DRV_MAX6900 is not set
++# CONFIG_RTC_DRV_RS5C372 is not set
++# CONFIG_RTC_DRV_ISL1208 is not set
++# CONFIG_RTC_DRV_X1205 is not set
++# CONFIG_RTC_DRV_PCF8563 is not set
++# CONFIG_RTC_DRV_PCF8583 is not set
++# CONFIG_RTC_DRV_M41T80 is not set
++# CONFIG_RTC_DRV_BQ32K is not set
++# CONFIG_RTC_DRV_S35390A is not set
++# CONFIG_RTC_DRV_FM3130 is not set
++# CONFIG_RTC_DRV_RX8581 is not set
++# CONFIG_RTC_DRV_RX8025 is not set
+
-+ if (bt_data->rfkill) {
-+ rfkill_destroy(bt_data->rfkill);
-+ }
++#
++# SPI RTC drivers
++#
++# CONFIG_RTC_DRV_M41T94 is not set
++# CONFIG_RTC_DRV_DS1305 is not set
++# CONFIG_RTC_DRV_DS1390 is not set
++# CONFIG_RTC_DRV_MAX6902 is not set
++# CONFIG_RTC_DRV_R9701 is not set
++# CONFIG_RTC_DRV_RS5C348 is not set
++# CONFIG_RTC_DRV_DS3234 is not set
++# CONFIG_RTC_DRV_PCF2123 is not set
+
-+ if (!bt_data || !bt_data->regulator)
-+ return 0;
++#
++# Platform RTC drivers
++#
++# CONFIG_RTC_DRV_CMOS is not set
++# CONFIG_RTC_DRV_DS1286 is not set
++# CONFIG_RTC_DRV_DS1511 is not set
++# CONFIG_RTC_DRV_DS1553 is not set
++# CONFIG_RTC_DRV_DS1742 is not set
++# CONFIG_RTC_DRV_STK17TA8 is not set
++# CONFIG_RTC_DRV_M48T86 is not set
++# CONFIG_RTC_DRV_M48T35 is not set
++# CONFIG_RTC_DRV_M48T59 is not set
++# CONFIG_RTC_DRV_MSM6242 is not set
++# CONFIG_RTC_DRV_BQ4802 is not set
++# CONFIG_RTC_DRV_RP5C01 is not set
++# CONFIG_RTC_DRV_V3020 is not set
++CONFIG_RTC_DRV_PCF50633=y
+
-+ regulator = bt_data->regulator;
++#
++# on-CPU RTC drivers
++#
++CONFIG_RTC_DRV_S3C=y
++# CONFIG_DMADEVICES is not set
++# CONFIG_AUXDISPLAY is not set
++# CONFIG_UIO is not set
+
-+ /* Make sure regulator is disabled before calling regulator_put */
-+ if (regulator_is_enabled(regulator))
-+ regulator_disable(regulator);
++#
++# TI VLYNQ
++#
++# CONFIG_STAGING is not set
++CONFIG_AR6000_WLAN=y
++# CONFIG_AR6000_WLAN_DEBUG is not set
++# CONFIG_AR6000_WLAN_RESET is not set
+
-+ regulator_put(regulator);
++#
++# File systems
++#
++CONFIG_EXT2_FS=y
++# CONFIG_EXT2_FS_XATTR is not set
++# CONFIG_EXT2_FS_XIP is not set
++CONFIG_EXT3_FS=y
++# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
++# CONFIG_EXT3_FS_XATTR is not set
++# CONFIG_EXT4_FS is not set
++CONFIG_JBD=y
++# CONFIG_JBD_DEBUG is not set
++CONFIG_REISERFS_FS=m
++# CONFIG_REISERFS_CHECK is not set
++# CONFIG_REISERFS_PROC_INFO is not set
++# CONFIG_REISERFS_FS_XATTR is not set
++# CONFIG_JFS_FS is not set
++CONFIG_FS_POSIX_ACL=y
++# CONFIG_XFS_FS is not set
++# CONFIG_OCFS2_FS is not set
++# CONFIG_BTRFS_FS is not set
++# CONFIG_NILFS2_FS is not set
++CONFIG_FILE_LOCKING=y
++CONFIG_FSNOTIFY=y
++# CONFIG_DNOTIFY is not set
++CONFIG_INOTIFY=y
++CONFIG_INOTIFY_USER=y
++# CONFIG_QUOTA is not set
++# CONFIG_AUTOFS_FS is not set
++CONFIG_AUTOFS4_FS=m
++CONFIG_FUSE_FS=m
++CONFIG_CUSE=m
++CONFIG_GENERIC_ACL=y
+
-+ kfree(bt_data);
++#
++# Caches
++#
++# CONFIG_FSCACHE is not set
+
-+ return 0;
-+}
++#
++# CD-ROM/DVD Filesystems
++#
++CONFIG_ISO9660_FS=m
++CONFIG_JOLIET=y
++# CONFIG_ZISOFS is not set
++CONFIG_UDF_FS=m
++CONFIG_UDF_NLS=y
+
-+static struct platform_driver gta02_bt_driver = {
-+ .probe = gta02_bt_probe,
-+ .remove = gta02_bt_remove,
-+ .suspend = gta02_bt_suspend,
-+ .resume = gta02_bt_resume,
-+ .driver = {
-+ .name = "gta02-pm-bt",
-+ },
-+};
++#
++# DOS/FAT/NT Filesystems
++#
++CONFIG_FAT_FS=m
++# CONFIG_MSDOS_FS is not set
++CONFIG_VFAT_FS=m
++CONFIG_FAT_DEFAULT_CODEPAGE=437
++CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
++# CONFIG_NTFS_FS is not set
+
-+static int __devinit gta02_bt_init(void)
-+{
-+ return platform_driver_register(>a02_bt_driver);
-+}
-+module_init(gta02_bt_init);
++#
++# Pseudo filesystems
++#
++CONFIG_PROC_FS=y
++CONFIG_PROC_SYSCTL=y
++CONFIG_PROC_PAGE_MONITOR=y
++CONFIG_SYSFS=y
++CONFIG_TMPFS=y
++CONFIG_TMPFS_POSIX_ACL=y
++# CONFIG_HUGETLB_PAGE is not set
++CONFIG_CONFIGFS_FS=m
++CONFIG_MISC_FILESYSTEMS=y
++# CONFIG_ADFS_FS is not set
++# CONFIG_AFFS_FS is not set
++# CONFIG_HFS_FS is not set
++# CONFIG_HFSPLUS_FS is not set
++# CONFIG_BEFS_FS is not set
++# CONFIG_BFS_FS is not set
++# CONFIG_EFS_FS is not set
++CONFIG_JFFS2_FS=y
++CONFIG_JFFS2_FS_DEBUG=0
++CONFIG_JFFS2_FS_WRITEBUFFER=y
++# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
++CONFIG_JFFS2_SUMMARY=y
++# CONFIG_JFFS2_FS_XATTR is not set
++# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
++CONFIG_JFFS2_ZLIB=y
++# CONFIG_JFFS2_LZO is not set
++CONFIG_JFFS2_RTIME=y
++# CONFIG_JFFS2_RUBIN is not set
++CONFIG_UBIFS_FS=y
++CONFIG_UBIFS_FS_XATTR=y
++CONFIG_UBIFS_FS_ADVANCED_COMPR=y
++CONFIG_UBIFS_FS_LZO=y
++CONFIG_UBIFS_FS_ZLIB=y
++CONFIG_UBIFS_FS_DEBUG=y
++CONFIG_UBIFS_FS_DEBUG_MSG_LVL=0
++CONFIG_UBIFS_FS_DEBUG_CHKS=y
++# CONFIG_LOGFS is not set
++# CONFIG_CRAMFS is not set
++CONFIG_SQUASHFS=m
++# CONFIG_SQUASHFS_EMBEDDED is not set
++CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
++# CONFIG_VXFS_FS is not set
++# CONFIG_MINIX_FS is not set
++# CONFIG_OMFS_FS is not set
++# CONFIG_HPFS_FS is not set
++# CONFIG_QNX4FS_FS is not set
++# CONFIG_ROMFS_FS is not set
++# CONFIG_SYSV_FS is not set
++# CONFIG_UFS_FS is not set
++CONFIG_NETWORK_FILESYSTEMS=y
++CONFIG_NFS_FS=m
++CONFIG_NFS_V3=y
++CONFIG_NFS_V3_ACL=y
++CONFIG_NFS_V4=y
++# CONFIG_NFS_V4_1 is not set
++CONFIG_NFSD=m
++CONFIG_NFSD_V2_ACL=y
++CONFIG_NFSD_V3=y
++CONFIG_NFSD_V3_ACL=y
++CONFIG_NFSD_V4=y
++CONFIG_LOCKD=m
++CONFIG_LOCKD_V4=y
++CONFIG_EXPORTFS=m
++CONFIG_NFS_ACL_SUPPORT=m
++CONFIG_NFS_COMMON=y
++CONFIG_SUNRPC=m
++CONFIG_SUNRPC_GSS=m
++CONFIG_RPCSEC_GSS_KRB5=m
++# CONFIG_RPCSEC_GSS_SPKM3 is not set
++# CONFIG_SMB_FS is not set
++# CONFIG_CEPH_FS is not set
++CONFIG_CIFS=m
++# CONFIG_CIFS_STATS is not set
++# CONFIG_CIFS_WEAK_PW_HASH is not set
++# CONFIG_CIFS_XATTR is not set
++# CONFIG_CIFS_DEBUG2 is not set
++# CONFIG_CIFS_EXPERIMENTAL is not set
++# CONFIG_NCP_FS is not set
++# CONFIG_CODA_FS is not set
++# CONFIG_AFS_FS is not set
+
-+static void gta02_bt_exit(void)
-+{
-+ platform_driver_unregister(>a02_bt_driver);
-+}
-+module_exit(gta02_bt_exit);
++#
++# Partition Types
++#
++CONFIG_PARTITION_ADVANCED=y
++# CONFIG_ACORN_PARTITION is not set
++# CONFIG_OSF_PARTITION is not set
++# CONFIG_AMIGA_PARTITION is not set
++# CONFIG_ATARI_PARTITION is not set
++# CONFIG_MAC_PARTITION is not set
++CONFIG_MSDOS_PARTITION=y
++# CONFIG_BSD_DISKLABEL is not set
++# CONFIG_MINIX_SUBPARTITION is not set
++# CONFIG_SOLARIS_X86_PARTITION is not set
++# CONFIG_UNIXWARE_DISKLABEL is not set
++# CONFIG_LDM_PARTITION is not set
++# CONFIG_SGI_PARTITION is not set
++# CONFIG_ULTRIX_PARTITION is not set
++# CONFIG_SUN_PARTITION is not set
++# CONFIG_KARMA_PARTITION is not set
++# CONFIG_EFI_PARTITION is not set
++# CONFIG_SYSV68_PARTITION is not set
++CONFIG_NLS=y
++CONFIG_NLS_DEFAULT="iso8859-1"
++CONFIG_NLS_CODEPAGE_437=y
++# CONFIG_NLS_CODEPAGE_737 is not set
++# CONFIG_NLS_CODEPAGE_775 is not set
++CONFIG_NLS_CODEPAGE_850=m
++# CONFIG_NLS_CODEPAGE_852 is not set
++# CONFIG_NLS_CODEPAGE_855 is not set
++# CONFIG_NLS_CODEPAGE_857 is not set
++# CONFIG_NLS_CODEPAGE_860 is not set
++# CONFIG_NLS_CODEPAGE_861 is not set
++# CONFIG_NLS_CODEPAGE_862 is not set
++# CONFIG_NLS_CODEPAGE_863 is not set
++# CONFIG_NLS_CODEPAGE_864 is not set
++# CONFIG_NLS_CODEPAGE_865 is not set
++CONFIG_NLS_CODEPAGE_866=m
++# CONFIG_NLS_CODEPAGE_869 is not set
++CONFIG_NLS_CODEPAGE_936=m
++CONFIG_NLS_CODEPAGE_950=m
++# CONFIG_NLS_CODEPAGE_932 is not set
++# CONFIG_NLS_CODEPAGE_949 is not set
++# CONFIG_NLS_CODEPAGE_874 is not set
++# CONFIG_NLS_ISO8859_8 is not set
++CONFIG_NLS_CODEPAGE_1250=m
++CONFIG_NLS_CODEPAGE_1251=m
++CONFIG_NLS_ASCII=m
++CONFIG_NLS_ISO8859_1=m
++CONFIG_NLS_ISO8859_2=m
++# CONFIG_NLS_ISO8859_3 is not set
++# CONFIG_NLS_ISO8859_4 is not set
++# CONFIG_NLS_ISO8859_5 is not set
++# CONFIG_NLS_ISO8859_6 is not set
++# CONFIG_NLS_ISO8859_7 is not set
++# CONFIG_NLS_ISO8859_9 is not set
++# CONFIG_NLS_ISO8859_13 is not set
++# CONFIG_NLS_ISO8859_14 is not set
++# CONFIG_NLS_ISO8859_15 is not set
++# CONFIG_NLS_KOI8_R is not set
++# CONFIG_NLS_KOI8_U is not set
++CONFIG_NLS_UTF8=m
++# CONFIG_DLM is not set
+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_DESCRIPTION(DRVMSG);
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-gps.c b/arch/arm/mach-s3c2440/gta02-pm-gps.c
-new file mode 100644
-index 0000000..9721f9a
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-gps.c
-@@ -0,0 +1,222 @@
-+/*
-+ * GPS Power Management code for the Openmoko Freerunner GSM Phone
-+ *
-+ * (C) 2007-2009 by Openmoko Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
++#
++# Kernel hacking
++#
++CONFIG_PRINTK_TIME=y
++# CONFIG_ENABLE_WARN_DEPRECATED is not set
++# CONFIG_ENABLE_MUST_CHECK is not set
++CONFIG_FRAME_WARN=1024
++# CONFIG_MAGIC_SYSRQ is not set
++CONFIG_STRIP_ASM_SYMS=y
++# CONFIG_UNUSED_SYMBOLS is not set
++CONFIG_DEBUG_FS=y
++# CONFIG_HEADERS_CHECK is not set
++# CONFIG_DEBUG_KERNEL is not set
++CONFIG_DEBUG_BUGVERBOSE=y
++CONFIG_DEBUG_MEMORY_INIT=y
++CONFIG_FRAME_POINTER=y
++# CONFIG_RCU_CPU_STALL_DETECTOR is not set
++# CONFIG_LKDTM is not set
++# CONFIG_LATENCYTOP is not set
++# CONFIG_SYSCTL_SYSCALL_CHECK is not set
++CONFIG_HAVE_FUNCTION_TRACER=y
++CONFIG_TRACING_SUPPORT=y
++# CONFIG_FTRACE is not set
++# CONFIG_DYNAMIC_DEBUG is not set
++# CONFIG_SAMPLES is not set
++CONFIG_HAVE_ARCH_KGDB=y
++# CONFIG_ARM_UNWIND is not set
++# CONFIG_DEBUG_USER is not set
++# CONFIG_OC_ETM is not set
++CONFIG_DEBUG_S3C_UART=2
+
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
++#
++# Security options
++#
++# CONFIG_KEYS is not set
++# CONFIG_SECURITY is not set
++# CONFIG_SECURITYFS is not set
++# CONFIG_DEFAULT_SECURITY_SELINUX is not set
++# CONFIG_DEFAULT_SECURITY_SMACK is not set
++# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
++CONFIG_DEFAULT_SECURITY_DAC=y
++CONFIG_DEFAULT_SECURITY=""
++CONFIG_CRYPTO=y
+
-+#include <mach/hardware.h>
-+#include <mach/gpio-fns.h>
++#
++# Crypto core or helper
++#
++CONFIG_CRYPTO_ALGAPI=y
++CONFIG_CRYPTO_ALGAPI2=y
++CONFIG_CRYPTO_AEAD=m
++CONFIG_CRYPTO_AEAD2=y
++CONFIG_CRYPTO_BLKCIPHER=m
++CONFIG_CRYPTO_BLKCIPHER2=y
++CONFIG_CRYPTO_HASH=y
++CONFIG_CRYPTO_HASH2=y
++CONFIG_CRYPTO_RNG2=y
++CONFIG_CRYPTO_PCOMP=y
++CONFIG_CRYPTO_MANAGER=m
++CONFIG_CRYPTO_MANAGER2=y
++CONFIG_CRYPTO_GF128MUL=m
++CONFIG_CRYPTO_NULL=m
++CONFIG_CRYPTO_WORKQUEUE=y
++# CONFIG_CRYPTO_CRYPTD is not set
++CONFIG_CRYPTO_AUTHENC=m
++CONFIG_CRYPTO_TEST=m
+
-+#include <mach/gta02.h>
++#
++# Authenticated Encryption with Associated Data
++#
++# CONFIG_CRYPTO_CCM is not set
++# CONFIG_CRYPTO_GCM is not set
++# CONFIG_CRYPTO_SEQIV is not set
+
-+#include <linux/regulator/consumer.h>
-+#include <linux/err.h>
++#
++# Block modes
++#
++CONFIG_CRYPTO_CBC=m
++# CONFIG_CRYPTO_CTR is not set
++# CONFIG_CRYPTO_CTS is not set
++CONFIG_CRYPTO_ECB=m
++CONFIG_CRYPTO_LRW=m
++CONFIG_CRYPTO_PCBC=m
++# CONFIG_CRYPTO_XTS is not set
+
-+struct gta02_pm_gps_data {
-+#ifdef CONFIG_PM
-+ int keep_on_in_suspend;
-+#endif
-+ int power_was_on;
-+ struct regulator *regulator;
-+};
++#
++# Hash modes
++#
++CONFIG_CRYPTO_HMAC=m
++CONFIG_CRYPTO_XCBC=m
++# CONFIG_CRYPTO_VMAC is not set
+
-+static struct gta02_pm_gps_data gta02_gps;
++#
++# Digest
++#
++CONFIG_CRYPTO_CRC32C=m
++# CONFIG_CRYPTO_GHASH is not set
++CONFIG_CRYPTO_MD4=m
++CONFIG_CRYPTO_MD5=y
++CONFIG_CRYPTO_MICHAEL_MIC=m
++# CONFIG_CRYPTO_RMD128 is not set
++# CONFIG_CRYPTO_RMD160 is not set
++# CONFIG_CRYPTO_RMD256 is not set
++# CONFIG_CRYPTO_RMD320 is not set
++CONFIG_CRYPTO_SHA1=m
++CONFIG_CRYPTO_SHA256=m
++CONFIG_CRYPTO_SHA512=m
++CONFIG_CRYPTO_TGR192=m
++CONFIG_CRYPTO_WP512=m
+
-+int gta02_pm_gps_is_on(void)
-+{
-+ return gta02_gps.power_was_on;
-+}
-+EXPORT_SYMBOL_GPL(gta02_pm_gps_is_on);
++#
++# Ciphers
++#
++# CONFIG_CRYPTO_AES is not set
++CONFIG_CRYPTO_ANUBIS=m
++CONFIG_CRYPTO_ARC4=m
++CONFIG_CRYPTO_BLOWFISH=m
++CONFIG_CRYPTO_CAMELLIA=m
++CONFIG_CRYPTO_CAST5=m
++CONFIG_CRYPTO_CAST6=m
++CONFIG_CRYPTO_DES=m
++CONFIG_CRYPTO_FCRYPT=m
++CONFIG_CRYPTO_KHAZAD=m
++# CONFIG_CRYPTO_SALSA20 is not set
++# CONFIG_CRYPTO_SEED is not set
++CONFIG_CRYPTO_SERPENT=m
++CONFIG_CRYPTO_TEA=m
++CONFIG_CRYPTO_TWOFISH=m
++CONFIG_CRYPTO_TWOFISH_COMMON=m
+
-+/* This is the POWERON pin */
-+static void gps_pwron_set(int on)
-+{
-+ if (on) {
-+ /* return UART pins to being UART pins */
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPH4_TXD1);
-+ /* remove pulldown now it won't be floating any more */
-+ s3c2410_gpio_pullup(S3C2410_GPH(5), 0);
++#
++# Compression
++#
++CONFIG_CRYPTO_DEFLATE=y
++CONFIG_CRYPTO_ZLIB=y
++CONFIG_CRYPTO_LZO=y
+
-+ if (!gta02_gps.power_was_on)
-+ regulator_enable(gta02_gps.regulator);
-+ } else {
-+ /*
-+ * take care not to power unpowered GPS from UART TX
-+ * return them to GPIO and force low
-+ */
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPIO_OUTPUT);
-+ s3c2410_gpio_setpin(S3C2410_GPH(4), 0);
-+ /* don't let RX from unpowered GPS float */
-+ s3c2410_gpio_pullup(S3C2410_GPH(5), 1);
-+ if (gta02_gps.power_was_on)
-+ regulator_disable(gta02_gps.regulator);
-+ }
-+}
++#
++# Random Number Generation
++#
++# CONFIG_CRYPTO_ANSI_CPRNG is not set
++# CONFIG_CRYPTO_HW is not set
++# CONFIG_BINARY_PRINTF is not set
+
-+static int gps_pwron_get(void)
-+{
-+ return regulator_is_enabled(gta02_gps.regulator);
-+}
++#
++# Library routines
++#
++CONFIG_BITREVERSE=y
++CONFIG_GENERIC_FIND_LAST_BIT=y
++CONFIG_CRC_CCITT=y
++CONFIG_CRC16=y
++CONFIG_CRC_T10DIF=y
++CONFIG_CRC_ITU_T=y
++CONFIG_CRC32=y
++CONFIG_CRC7=y
++CONFIG_LIBCRC32C=m
++CONFIG_ZLIB_INFLATE=y
++CONFIG_ZLIB_DEFLATE=y
++CONFIG_LZO_COMPRESS=y
++CONFIG_LZO_DECOMPRESS=y
++CONFIG_DECOMPRESS_GZIP=y
++CONFIG_DECOMPRESS_BZIP2=y
++CONFIG_DECOMPRESS_LZMA=y
++CONFIG_DECOMPRESS_LZO=y
++CONFIG_TEXTSEARCH=y
++CONFIG_TEXTSEARCH_KMP=m
++CONFIG_TEXTSEARCH_BM=m
++CONFIG_TEXTSEARCH_FSM=m
++CONFIG_HAS_IOMEM=y
++CONFIG_HAS_DMA=y
++CONFIG_NLATTR=y
++CONFIG_GENERIC_ATOMIC64=y
+diff --git a/arch/arm/include/asm/fiq.h b/arch/arm/include/asm/fiq.h
+index 2242ce2..7ade2b8 100644
+--- a/arch/arm/include/asm/fiq.h
++++ b/arch/arm/include/asm/fiq.h
+@@ -29,8 +29,9 @@ struct fiq_handler {
+ extern int claim_fiq(struct fiq_handler *f);
+ extern void release_fiq(struct fiq_handler *f);
+ extern void set_fiq_handler(void *start, unsigned int length);
+-extern void set_fiq_regs(struct pt_regs *regs);
+-extern void get_fiq_regs(struct pt_regs *regs);
++extern void set_fiq_c_handler(void (*handler)(void));
++extern void __attribute__((naked)) set_fiq_regs(struct pt_regs *regs);
++extern void __attribute__((naked)) get_fiq_regs(struct pt_regs *regs);
+ extern void enable_fiq(int fiq);
+ extern void disable_fiq(int fiq);
+
+diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
+index 6ff7919..c07691e 100644
+--- a/arch/arm/kernel/fiq.c
++++ b/arch/arm/kernel/fiq.c
+@@ -8,6 +8,8 @@
+ *
+ * FIQ support re-written by Russell King to be more generic
+ *
++ * FIQ handler in C supoprt written by Andy Green <andy@openmoko.com>
++ *
+ * We now properly support a method by which the FIQ handlers can
+ * be stacked onto the vector. We still do not support sharing
+ * the FIQ vector itself.
+@@ -124,6 +126,83 @@ void __naked get_fiq_regs(struct pt_regs *regs)
+ : "r" (®s->ARM_r8), "I" (PSR_I_BIT | PSR_F_BIT | FIQ_MODE));
+ }
+
++/* -------- FIQ handler in C ---------
++ *
++ * Major Caveats for using this
++ * ---------------------------
++ * *
++ * * 1) it CANNOT touch any vmalloc()'d memory, only memory
++ * that was kmalloc()'d. Static allocations in the monolithic kernel
++ * are kmalloc()'d so they are okay. You can touch memory-mapped IO, but
++ * the pointer for it has to have been stored in kmalloc'd memory. The
++ * reason for this is simple: every now and then Linux turns off interrupts
++ * and reorders the paging tables. If a FIQ happens during this time, the
++ * virtual memory space can be partly or entirely disordered or missing.
++ *
++ * 2) Because vmalloc() is used when a module is inserted, THIS FIQ
++ * ISR HAS TO BE IN THE MONOLITHIC KERNEL, not a module. But the way
++ * it is set up, you can all to enable and disable it from your module
++ * and intercommunicate with it through struct fiq_ipc
++ * fiq_ipc which you can define in
++ * asm/archfiq_ipc_type.h. The reason is the same as above, a
++ * FIQ could happen while even the ISR is not present in virtual memory
++ * space due to pagetables being changed at the time.
++ *
++ * 3) You can't call any Linux API code except simple macros
++ * - understand that FIQ can come in at any time, no matter what
++ * state of undress the kernel may privately be in, thinking it
++ * locked the door by turning off interrupts... FIQ is an
++ * unstoppable monster force (which is its value)
++ * - they are not vmalloc()'d memory safe
++ * - they might do crazy stuff like sleep: FIQ pisses fire and
++ * is not interested in 'sleep' that the weak seem to need
++ * - calling APIs from FIQ can re-enter un-renterable things
++ * - summary: you cannot interoperate with linux APIs directly in the FIQ ISR
++ *
++ * If you follow these rules, it is fantastic, an extremely powerful, solid,
++ * genuine hard realtime feature.
++ */
+
-+#ifdef CONFIG_PM
-+/* This is the flag for keeping gps ON during suspend */
-+static void gps_keep_on_in_suspend_set(int on)
-+{
-+ gta02_gps.keep_on_in_suspend = on;
-+}
++static void (*current_fiq_c_isr)(void);
++#define FIQ_C_ISR_STACK_SIZE 256
+
-+static int gps_keep_on_in_suspend_get(void)
++static void __attribute__((naked)) __jump_to_isr(void)
+{
-+ return gta02_gps.keep_on_in_suspend;
++ asm __volatile__ ("mov pc, r8");
+}
-+#endif
+
-+static ssize_t power_gps_read(struct device *dev,
-+ struct device_attribute *attr, char *buf)
++
++static void __attribute__((naked)) __actual_isr(void)
+{
-+ int ret = 0;
++ asm __volatile__ (
++ "stmdb sp!, {r0-r12, lr};"
++ "mov fp, sp;"
++ );
+
-+ if (!strcmp(attr->attr.name, "power_on"))
-+ ret = gps_pwron_get();
-+#ifdef CONFIG_PM
-+ else if (!strcmp(attr->attr.name, "keep_on_in_suspend"))
-+ ret = gps_keep_on_in_suspend_get();
-+#endif
-+ if (ret)
-+ return strlcpy(buf, "1\n", 3);
-+ else
-+ return strlcpy(buf, "0\n", 3);
++ current_fiq_c_isr();
++
++ asm __volatile__ (
++ "ldmia sp!, {r0-r12, lr};"
++ "subs pc, lr, #4;"
++ );
+}
+
-+static ssize_t power_gps_write(struct device *dev,
-+ struct device_attribute *attr, const char *buf,
-+ size_t count)
++void set_fiq_c_handler(void (*isr)(void))
+{
-+ unsigned long on = simple_strtoul(buf, NULL, 10);
++ struct pt_regs regs;
+
-+ if (!strcmp(attr->attr.name, "power_on")) {
-+ gps_pwron_set(on);
-+ gta02_gps.power_was_on = !!on;
-+#ifdef CONFIG_PM
-+ } else if (!strcmp(attr->attr.name, "keep_on_in_suspend")) {
-+ gps_keep_on_in_suspend_set(on);
-+#endif
-+ }
-+ return count;
-+}
++ memset(®s, 0, sizeof(regs));
++ regs.ARM_r8 = (unsigned long) __actual_isr;
++ regs.ARM_sp = 0xffff001c + FIQ_C_ISR_STACK_SIZE;
+
-+#ifdef CONFIG_PM
-+static int gta02_pm_gps_suspend(struct device *dev)
-+{
-+ if (!gta02_gps.keep_on_in_suspend ||
-+ !gta02_gps.power_was_on)
-+ gps_pwron_set(0);
-+ else
-+ dev_warn(dev, "GTA02: keeping gps ON "
-+ "during suspend\n");
-+ return 0;
-+}
++ set_fiq_handler(__jump_to_isr, 4);
+
-+static int gta02_pm_gps_resume(struct device *dev)
-+{
-+ if (!gta02_gps.keep_on_in_suspend && gta02_gps.power_was_on)
-+ gps_pwron_set(1);
++ current_fiq_c_isr = isr;
+
-+ return 0;
++ set_fiq_regs(®s);
+}
++/* -------- FIQ handler in C ---------*/
+
-+static DEVICE_ATTR(keep_on_in_suspend, 0644, power_gps_read, power_gps_write);
+ int claim_fiq(struct fiq_handler *f)
+ {
+ int ret = 0;
+diff --git a/arch/arm/mach-s3c2410/Kconfig b/arch/arm/mach-s3c2410/Kconfig
+index 5547318..da71ace 100644
+--- a/arch/arm/mach-s3c2410/Kconfig
++++ b/arch/arm/mach-s3c2410/Kconfig
+@@ -168,4 +168,24 @@ config MACH_QT2410
+ help
+ Say Y here if you are using the Armzone QT2410
+
++config MACH_NEO1973_GTA01
++ bool "FIC Neo1973 GSM Phone (GTA01 Hardware)"
++ select CPU_S3C2410
++ select MACH_NEO1973
++ select S3C_DEV_USB_HOST
++ select MFD_PCF50606
++ select INPUT_PCF50606_PMU
++ select PCF50606_ADC
++ select PCF50606_GPIO
++ select RTC_DRV_PCF50606
++ select REGULATOR_PCF50606
++ select CHARGER_PCF50606
++ select PCF50606_WATCHDOG
++ select POWER_SUPPLY
++ select BATTERY_GTA01
++ select S3C24XX_ADC
++ select S3C_DEV_NAND
++ help
++ Say Y here if you are using the FIC Neo1973 GSM Phone
+
-+static struct dev_pm_ops gta02_gps_pm_ops = {
-+ .suspend = gta02_pm_gps_suspend,
-+ .resume = gta02_pm_gps_resume,
-+};
+ endmenu
+diff --git a/arch/arm/mach-s3c2410/Makefile b/arch/arm/mach-s3c2410/Makefile
+index 0d468e9..aecf5e5 100644
+--- a/arch/arm/mach-s3c2410/Makefile
++++ b/arch/arm/mach-s3c2410/Makefile
+@@ -40,3 +40,4 @@ obj-$(CONFIG_SIMTEC_NOR) += nor-simtec.o
+ # machine additions
+
+ obj-$(CONFIG_MACH_BAST_IDE) += bast-ide.o
++obj-$(CONFIG_MACH_NEO1973_GTA01) += mach-gta01.o
+diff --git a/arch/arm/mach-s3c2410/include/mach/gpio.h b/arch/arm/mach-s3c2410/include/mach/gpio.h
+index 15f0b3e..0b53cad 100644
+--- a/arch/arm/mach-s3c2410/include/mach/gpio.h
++++ b/arch/arm/mach-s3c2410/include/mach/gpio.h
+@@ -20,10 +20,11 @@
+ * devices that need GPIO.
+ */
+
+-#define ARCH_NR_GPIOS (256 + CONFIG_S3C24XX_GPIO_EXTRA)
++#define ARCH_NR_GPIOS (512 + CONFIG_S3C24XX_GPIO_EXTRA)
+
+ #include <asm-generic/gpio.h>
+ #include <mach/gpio-nrs.h>
+ #include <mach/gpio-fns.h>
++#include <mach/regs-gpioj.h>
+
+-#define S3C_GPIO_END (S3C2410_GPIO_BANKH + 32)
++#define S3C_GPIO_END (S3C2440_GPIO_BANKJ + 32)
+diff --git a/arch/arm/mach-s3c2410/include/mach/gta01.h b/arch/arm/mach-s3c2410/include/mach/gta01.h
+new file mode 100644
+index 0000000..673a116
+--- /dev/null
++++ b/arch/arm/mach-s3c2410/include/mach/gta01.h
+@@ -0,0 +1,67 @@
++#ifndef _GTA01_H
++#define _GTA01_H
+
-+#define GTA02_GPS_PM_OPS (>a02_gps_pm_ops)
++#include <mach/regs-gpio.h>
++#include <mach/irqs.h>
+
-+#else
-+#define GTA02_GPS_PM_OPS NULL
-+#endif
++/* Different hardware revisions, passed in ATAG_REVISION by u-boot */
++#define GTA01v3_SYSTEM_REV 0x00000130
++#define GTA01v4_SYSTEM_REV 0x00000140
++#define GTA01Bv2_SYSTEM_REV 0x00000220
++#define GTA01Bv3_SYSTEM_REV 0x00000230
++#define GTA01Bv4_SYSTEM_REV 0x00000240
+
-+static DEVICE_ATTR(power_on, 0644, power_gps_read, power_gps_write);
++/* !!!!!!!!!!! */
++#define S3C_SYSTEM_REV_ATAG GTA01Bv2_SYSTEM_REV
+
-+static struct attribute *gta02_gps_sysfs_entries[] = {
-+ &dev_attr_power_on.attr,
-+#ifdef CONFIG_PM
-+ &dev_attr_keep_on_in_suspend.attr,
-+#endif
-+ NULL
-+};
++/* Backlight */
+
-+static struct attribute_group gta02_gps_attr_group = {
-+ .name = NULL,
-+ .attrs = gta02_gps_sysfs_entries,
-+};
++/* Definitions common to all revisions */
++#define GTA01_GPIO_BACKLIGHT S3C2410_GPB(0)
++#define GTA01_GPIO_GPS_PWRON S3C2410_GPB(1)
++#define GTA01_GPIO_MODEM_RST S3C2410_GPB(6)
++#define GTA01_GPIO_MODEM_ON S3C2410_GPB(7)
++#define GTA01_GPIO_LCD_RESET S3C2410_GPC(6)
++#define GTA01_GPIO_PMU_IRQ S3C2410_GPG(8)
++#define GTA01_GPIO_JACK_INSERT S3C2410_GPF(4)
++#define GTA01_GPIO_nSD_DETECT S3C2410_GPF(5)
++#define GTA01_GPIO_AUX_KEY S3C2410_GPF(6)
++#define GTA01_GPIO_HOLD_KEY S3C2410_GPF(7)
+
-+static int __init gta02_pm_gps_probe(struct platform_device *pdev)
-+{
-+ gta02_gps.regulator = regulator_get(&pdev->dev, "RF_3V");
-+ if (IS_ERR(gta02_gps.regulator)) {
-+ dev_err(&pdev->dev, "probe failed %ld\n",
-+ PTR_ERR(gta02_gps.regulator));
++#define GTA01_IRQ_MODEM IRQ_EINT1
++#define GTA01_IRQ_JACK_INSERT IRQ_EINT4
++#define GTA01_IRQ_nSD_DETECT IRQ_EINT5
++#define GTA01_IRQ_AUX_KEY IRQ_EINT6
+
-+ return PTR_ERR(gta02_gps.regulator);
-+ }
++/* GTA01v3 */
++#define GTA01v3_GPIO_nGSM_EN S3C2410_GPG(9)
+
-+ dev_info(&pdev->dev, "starting\n");
++/* GTA01v4 */
++#define GTA01_GPIO_MODEM_DNLOAD S3C2410_GPG(0)
+
-+ /*
-+ * take care not to power unpowered GPS from UART TX
-+ * return them to GPIO and force low
-+ */
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPIO_OUTPUT);
-+ s3c2410_gpio_setpin(S3C2410_GPH(4), 0);
-+ /* don't let RX from unpowered GPS float */
-+ s3c2410_gpio_pullup(S3C2410_GPH(5), 1);
++/* GTA01Bv2 */
++#define GTA01Bv2_GPIO_nGSM_EN S3C2410_GPF(2)
++#define GTA01Bv2_GPIO_VIBRATOR_ON S3C2410_GPB(10)
++#define GTA01Bv2_IRQ_PCF50606 IRQ_EINT16
+
-+ return sysfs_create_group(&pdev->dev.kobj,
-+ >a02_gps_attr_group);
-+}
++/* GTA01Bv3 */
++#define GTA01_GPIO_GPS_EN_3V3 S3C2410_GPG(9)
+
-+static int gta02_pm_gps_remove(struct platform_device *pdev)
-+{
-+ regulator_put(gta02_gps.regulator);
-+ sysfs_remove_group(&pdev->dev.kobj, >a02_gps_attr_group);
-+ return 0;
-+}
++#define GTA01_GPIO_SDMMC_ON S3C2410_GPB(2)
++#define GTA01_GPIO_BT_EN S3C2410_GPB(5)
++#define GTA01_GPIO_USB_PULLUP S3C2410_GPB(9)
+
-+static struct platform_driver gta02_pm_gps_driver = {
-+ .probe = gta02_pm_gps_probe,
-+ .remove = gta02_pm_gps_remove,
-+ .driver = {
-+ .name = "gta02-pm-gps",
-+ .pm = GTA02_GPS_PM_OPS,
-+ },
-+};
++#define GTA01_GPIO_GPS_EN_2V8 S3C2410_GPG(9)
++#define GTA01_GPIO_GPS_EN_3V S3C2410_GPG(10)
++#define GTA01_GPIO_GPS_RESET S3C2410_GPC(0)
+
-+static int __devinit gta02_pm_gps_init(void)
-+{
-+ return platform_driver_register(>a02_pm_gps_driver);
-+}
-+module_init(gta02_pm_gps_init);
++/* GTA01Bv4 */
++#define GTA01Bv4_GPIO_nNAND_WP S3C2410_GPA(16)
++#define GTA01Bv4_GPIO_VIBRATOR_ON S3C2410_GPB(3)
++#define GTA01Bv4_GPIO_PMU_IRQ S3C2410_GPG(1)
+
-+static void gta02_pm_gps_exit(void)
-+{
-+ platform_driver_unregister(>a02_pm_gps_driver);
-+}
-+module_exit(gta02_pm_gps_exit);
++#define GTA01Bv4_IRQ_PCF50606 IRQ_EINT9
+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-gsm.c b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
++extern struct pcf50606 *gta01_pcf;
++
++#endif /* _GTA01_H */
+diff --git a/arch/arm/mach-s3c2410/include/mach/irqs.h b/arch/arm/mach-s3c2410/include/mach/irqs.h
+index 6c12c63..fc0e3c9 100644
+--- a/arch/arm/mach-s3c2410/include/mach/irqs.h
++++ b/arch/arm/mach-s3c2410/include/mach/irqs.h
+@@ -153,9 +153,9 @@
+ #define IRQ_S3C2443_AC97 S3C2410_IRQSUB(28)
+
+ #ifdef CONFIG_CPU_S3C2443
+-#define NR_IRQS (IRQ_S3C2443_AC97+1)
++#define S3C2410_NR_INTERNAL_IRQS (IRQ_S3C2443_AC97+1)
+ #else
+-#define NR_IRQS (IRQ_S3C2440_AC97+1)
++#define S3C2410_NR_INTERNAL_IRQS (IRQ_S3C2440_AC97+1)
+ #endif
+
+ /* compatibility define. */
+@@ -173,4 +173,22 @@
+ /* Our FIQs are routable from IRQ_EINT0 to IRQ_ADCPARENT */
+ #define FIQ_START IRQ_EINT0
+
++/* Board specific IRQs
++ * If your board needs a extra set of IRQ numbers add it to the list here.
++ * Make sure that the numbers are kept in descending order, so if support for
++ * multiple boards is compiled in the maximum will be used and there are enough
++ * IRQ numbers available for each board.
++ */
++
++#if defined(CONFIG_MACH_NEO1973_GTA02)
++#define IRQ_BOARD_NR (9 + 40)
++#else
++#define IRQ_BOARD_NR 0
++#endif
++
++#define IRQ_BOARD_START S3C2410_NR_INTERNAL_IRQS
++#define IRQ_BOARD_END (IRQ_BOARD_START + IRQ_BOARD_NR)
++
++#define NR_IRQS IRQ_BOARD_END
++
+ #endif /* __ASM_ARCH_IRQ_H */
+diff --git a/arch/arm/mach-s3c2410/mach-gta01.c b/arch/arm/mach-s3c2410/mach-gta01.c
new file mode 100644
-index 0000000..d1831b5
+index 0000000..45fe03a
--- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
-@@ -0,0 +1,361 @@
++++ b/arch/arm/mach-s3c2410/mach-gta01.c
+@@ -0,0 +1,976 @@
+/*
-+ * GSM Management code for the Openmoko Freerunner GSM Phone
++ * linux/arch/arm/mach-s3c2410/mach-gta01.c
+ *
-+ * (C) 2007 by Openmoko Inc.
++ * S3C2410 Machine Support for the FIC Neo1973 GTA01
++ *
++ * Copyright (C) 2006-2007 by Openmoko, Inc.
+ * Author: Harald Welte <laforge@openmoko.org>
++ * Copyright (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
+ * All rights reserved.
+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
++ * MA 02111-1307 USA
+ *
+ */
+
-+#include <linux/module.h>
-+#include <linux/init.h>
+#include <linux/kernel.h>
-+#include <linux/platform_device.h>
-+#include <linux/console.h>
-+#include <linux/errno.h>
++#include <linux/types.h>
+#include <linux/interrupt.h>
-+#include <linux/delay.h>
-+#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/workqueue.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <linux/serial_core.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/host.h>
++
++#include <linux/mtd/mtd.h>
++#include <linux/mtd/nand.h>
++#include <linux/mtd/nand_ecc.h>
++#include <linux/mtd/partitions.h>
++
++#include <linux/mmc/host.h>
++
++#include <linux/mfd/pcf50606/core.h>
++#include <linux/mfd/pcf50606/pmic.h>
++#include <linux/mfd/pcf50606/mbc.h>
++#include <linux/mfd/pcf50606/adc.h>
++
++#include <linux/regulator/machine.h>
+#include <linux/regulator/consumer.h>
+
-+#include <mach/gpio.h>
-+#include <asm/mach-types.h>
++
++#include <asm/mach/arch.h>
++#include <asm/mach/map.h>
++#include <asm/mach/irq.h>
+
+#include <mach/hardware.h>
++#include <mach/io.h>
++#include <asm/mach-types.h>
+
-+#include <mach/gta02.h>
+#include <mach/regs-gpio.h>
-+#include <mach/regs-gpioj.h>
++#include <mach/gpio-fns.h>
++#include <mach/fb.h>
+
-+static int gta02_gsm_interrupts;
++#include <linux/spi/spi.h>
++#include <linux/spi/spi_gpio.h>
+
-+extern void s3c24xx_serial_console_set_silence(int);
++#include <mach/gta01.h>
+
-+struct gta02pm_priv {
-+ int gpio_ndl_gsm;
-+ struct console *con;
-+ struct regulator *regulator;
-+};
++#include <plat/regs-serial.h>
++#include <plat/nand.h>
++#include <plat/devs.h>
++#include <plat/cpu.h>
++#include <plat/pm.h>
++#include <plat/udc.h>
++#include <plat/iic.h>
++#include <plat/mci.h>
++#include <plat/usb-control.h>
++/*#include <mach/neo1973-pm-gsm.h>*/
+
-+static struct gta02pm_priv gta02_gsm;
++#include <linux/jbt6k74.h>
+
-+static struct console *find_s3c24xx_console(void)
-+{
-+ struct console *con;
++#include <linux/input.h>
++#include <linux/gpio_keys.h>
+
-+ acquire_console_sem();
++#include <linux/pwm_backlight.h>
++#include <linux/leds_pwm.h>
+
-+ for (con = console_drivers; con; con = con->next) {
-+ if (!strcmp(con->name, "ttySAC"))
-+ break;
-+ }
++#include <linux/gpio.h>
+
-+ release_console_sem();
++/*
++#include <../drivers/input/touchscreen/ts_filter_chain.h>
++#ifdef CONFIG_TOUCHSCREEN_FILTER
++#include <../drivers/input/touchscreen/ts_filter_linear.h>
++#include <../drivers/input/touchscreen/ts_filter_mean.h>
++#include <../drivers/input/touchscreen/ts_filter_median.h>
++#include <../drivers/input/touchscreen/ts_filter_group.h>
++#endif
++*/
+
-+ return con;
-+}
++static void gta01_pmu_attach_child_devices(struct pcf50606 *pcf);
+
-+static ssize_t gsm_read(struct device *dev, struct device_attribute *attr,
-+ char *buf)
-+{
-+ if (!strcmp(attr->attr.name, "power_on")) {
-+ if (regulator_is_enabled(gta02_gsm.regulator))
-+ goto out_1;
-+ } else if (!strcmp(attr->attr.name, "download")) {
-+ if (!s3c2410_gpio_getpin(GTA02_GPIO_nDL_GSM))
-+ goto out_1;
-+ } else if (!strcmp(attr->attr.name, "flowcontrolled")) {
-+ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT)
-+ goto out_1;
-+ }
++static struct map_desc gta01_iodesc[] __initdata = {
++ {
++ .virtual = 0xe0000000,
++ .pfn = __phys_to_pfn(S3C2410_CS3+0x01000000),
++ .length = SZ_1M,
++ .type = MT_DEVICE
++ },
++};
+
-+ return strlcpy(buf, "0\n", 3);
-+out_1:
-+ return strlcpy(buf, "1\n", 3);
-+}
++#define UCON S3C2410_UCON_DEFAULT
++#define ULCON S3C2410_LCON_CS8 | S3C2410_LCON_PNONE | S3C2410_LCON_STOPB
++#define UFCON S3C2410_UFCON_RXTRIG8 | S3C2410_UFCON_FIFOMODE
++/* UFCON for the gta01 sets the FIFO trigger level at 4, not 8 */
++#define UFCON_GTA01_PORT0 S3C2410_UFCON_FIFOMODE
+
-+static void gsm_on_off(struct device *dev, int on)
++static struct s3c2410_uartcfg gta01_uartcfgs[] = {
++ [0] = {
++ .hwport = 0,
++ .flags = 0,
++ .ucon = UCON,
++ .ulcon = ULCON,
++ .ufcon = UFCON_GTA01_PORT0,
++ },
++ [1] = {
++ .hwport = 1,
++ .flags = 0,
++ .ucon = UCON,
++ .ulcon = ULCON,
++ .ufcon = UFCON,
++ },
++};
++
++/* TODO */
++static void gta01_pmu_event_callback(struct pcf50606 *pcf, int irq)
+{
++ /*TODO : Handle ACD here */
++}
++#if 0
++/* FIXME : Goes away when ACD is handled above */
++static int pmu_callback(struct device *dev, unsigned int feature,
++ enum pmu_event event)
++{
++ switch (feature) {
++ case PCF50606_FEAT_ACD:
++ switch (event) {
++ case PMU_EVT_INSERT:
++ pcf50606_charge_fast(pcf50606_global, 1);
++ break;
++ case PMU_EVT_REMOVE:
++ pcf50606_charge_fast(pcf50606_global, 0);
++ break;
++ default:
++ break;
++ }
++ break;
++ default:
++ break;
++ }
+
-+ on = !!on;
++ return 0;
++}
++#endif
++struct pcf50606 *gta01_pcf;
+
-+ if (on == regulator_is_enabled(gta02_gsm.regulator))
-+ return;
++static struct platform_device gta01_pm_gsm_dev = {
++ .name = "neo1973-pm-gsm",
++};
+
-+ if (!on) {
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_INPUT);
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPIO_INPUT);
++static struct platform_device gta01_pm_bt_dev = {
++ .name = "neo1973-pm-bt",
++};
++static struct platform_device gta01_pm_gps_dev = {
++ .name = "neo1973-pm-gps",
++};
+
-+ regulator_disable(gta02_gsm.regulator);
++static struct regulator_consumer_supply ioreg_consumers[] = {
++ {
++ .dev = >a01_pm_gps_dev.dev,
++ .supply = "GPS_2V8",
++ },
++};
+
-+ if (gta02_gsm.con) {
-+ s3c24xx_serial_console_set_silence(0);
-+ console_start(gta02_gsm.con);
++static struct regulator_consumer_supply d1reg_consumers[] = {
++ {
++ .dev = >a01_pm_gps_dev.dev,
++ .supply = "GPS_3V",
++ },
++ {
++ .dev = >a01_pm_bt_dev.dev,
++ .supply = "BT_3V1",
++ },
++};
+
-+ dev_dbg(dev, "powered down gta02 GSM, enabling "
-+ "serial console\n");
-+ }
++static struct regulator_consumer_supply dcd_consumers[] = {
++ {
++ .dev = >a01_pm_gps_dev.dev,
++ .supply = "GPS_3V3",
++ },
++ {
++ .dev = >a01_pm_gps_dev.dev,
++ .supply = "GPS_1V5",
++ },
++};
+
-+ return;
-+ }
++static struct regulator_consumer_supply d2reg_consumers[] = {
++ {
++ .dev = >a01_pm_gps_dev.dev,
++ .supply = "GPS_2V5",
++ },
++ {
++ .dev = &s3c_device_sdi.dev,
++ .supply = "SD_3V3",
++ },
++};
+
-+ if (gta02_gsm.con) {
-+ dev_dbg(dev, "powering up GSM, thus "
-+ "disconnecting serial console\n");
++#if 0
++/* This will come with 2.6.32. Don't forget to uncomment it then. */
++static struct regulator_consumer_supply lpreg_consumers[] = {
++ REGULATOR_SUPPLY("VDC", "jbt6k74"),
++ REGULATOR_SUPPLY("VDDIO", "jbt6k74"),
++};
++#else
++static struct regulator_consumer_supply lpreg_consumers[] = {
++ { .supply = "VDC", },
++ { .supply = "VDDIO", },
++};
++#endif
+
-+ console_stop(gta02_gsm.con);
-+ s3c24xx_serial_console_set_silence(1);
-+ }
++#if 0
+
-+ /* allow UART to talk to GSM side now we will power it */
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPH2_TXD0);
++static int gta01_bat_get_charging_status(void)
++{
++ struct pcf50606 *pcf = gta01_pcf;
++ u8 mbcc1, chgmod;
+
-+ regulator_enable(gta02_gsm.regulator);
++ mbcc1 = pcf50606_reg_read(pcf, PCF50606_REG_MBCC1);
++ chgmod = mbcc1 & PCF50606_MBCC1_CHGMOD_MASK;
+
-+ msleep(100);
++ if (chgmod == PCF50606_MBCC1_CHGMOD_IDLE)
++ return 0;
++ else
++ return 1;
++}
+
-+ s3c2410_gpio_setpin(GTA02_GPIO_MODEM_ON, 1);
-+ msleep(500);
-+ s3c2410_gpio_setpin(GTA02_GPIO_MODEM_ON, 0);
++static int gta01_bat_get_voltage(void)
++{
++ struct pcf50606 *pcf = gta01_pcf;
++ u16 adc, mv = 0;
+
-+ /*
-+ * workaround for calypso firmware moko10 and earlier,
-+ * without this it will leave IRQ line high after
-+ * booting
-+ */
-+ s3c2410_gpio_setpin(S3C2410_GPH(1), 1);
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
-+ msleep(1000);
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
++ adc = pcf50606_adc_sync_read(pcf, PCF50606_ADCMUX_BATVOLT_RES);
++ mv = (adc * 6000) / 1024;
+
++ return mv * 1000;
+}
+
-+static ssize_t gsm_write(struct device *dev, struct device_attribute *attr,
-+ const char *buf, size_t count)
++static int gta01_bat_get_current(void)
+{
-+ unsigned long on = simple_strtoul(buf, NULL, 10);
-+
-+ if (!strcmp(attr->attr.name, "power_on")) {
-+ gsm_on_off(dev, on);
++ struct pcf50606 *pcf = gta01_pcf;
++ u16 adc_battvolt, adc_adcin1;
++ s32 res;
+
-+ return count;
-+ }
++ adc_battvolt = pcf50606_adc_sync_read(pcf, PCF50606_ADCMUX_BATVOLT_SUBTR);
++ adc_adcin1 = pcf50606_adc_sync_read(pcf, PCF50606_ADCMUX_ADCIN1_SUBTR);
++ res = (adc_battvolt - adc_adcin1) * 2400;
+
-+ if (!strcmp(attr->attr.name, "download")) {
-+ /*
-+ * the keyboard / buttons driver requests and enables
-+ * the JACK_INSERT IRQ. We have to take care about
-+ * not enabling and disabling the IRQ when it was
-+ * already in that state or we get "unblanaced IRQ"
-+ * kernel warnings and stack dumps. So we use the
-+ * copy of the ndl_gsm state to figure out if we should
-+ * enable or disable the jack interrupt
-+ */
-+ if (on) {
-+ if (gta02_gsm.gpio_ndl_gsm)
-+ disable_irq(gpio_to_irq(
-+ GTA02_GPIO_JACK_INSERT));
-+ } else {
-+ if (!gta02_gsm.gpio_ndl_gsm)
-+ enable_irq(gpio_to_irq(
-+ GTA02_GPIO_JACK_INSERT));
-+ }
++ /*rsense is 220 milli */
++ return (res * 1000) / (220 * 1024) * 1000;
++}
+
-+ gta02_gsm.gpio_ndl_gsm = !on;
-+ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, !on);
++static struct gta01_bat_platform_data gta01_bat_pdata = {
++ .get_charging_status = gta01_bat_get_charging_status,
++ .get_voltage = gta01_bat_get_voltage,
++ .get_current = gta01_bat_get_current,
++};
+
-+ return count;
++static struct platform_device gta01_bat = {
++ .name = "gta01_battery",
++ .id = -1,
++ .dev = {
++ .platform_data = >a01_bat_pdata,
+ }
++};
++#endif
+
-+ if (!strcmp(attr->attr.name, "flowcontrolled")) {
-+ if (on) {
-+ gta02_gsm_interrupts = 0;
-+ s3c2410_gpio_setpin(S3C2410_GPH(1), 1);
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
-+ } else
-+ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
-+ }
++static void __devinit gta01_pcf_probe_done(struct pcf50606 *pcf)
++{
++ gta01_pcf = pcf;
+
-+ return count;
++ gta01_pmu_attach_child_devices(pcf);
+}
+
-+static DEVICE_ATTR(power_on, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(reset, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(download, 0644, gsm_read, gsm_write);
-+static DEVICE_ATTR(flowcontrolled, 0644, gsm_read, gsm_write);
-+
-+#ifdef CONFIG_PM
++static int gps_registered_regulators = 0;
+
-+static int gta02_gsm_suspend(struct device *dev)
++static void gta01_pmu_regulator_registered(struct pcf50606 *pcf, int id)
+{
-+ /* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
-+ * don't need to do much here. */
-+
-+
-+ /* If flowcontrol asserted, abort if GSM already interrupted */
-+ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
-+ if (gta02_gsm_interrupts)
-+ goto busy;
++ switch(id) {
++ case PCF50606_REGULATOR_D1REG:
++ platform_device_register(>a01_pm_bt_dev);
++ gps_registered_regulators++;
++ break;
++ case PCF50606_REGULATOR_D2REG:
++ gps_registered_regulators++;
++ break;
++ case PCF50606_REGULATOR_IOREG:
++ case PCF50606_REGULATOR_DCD:
++ gps_registered_regulators++;
++ break;
+ }
+
-+ /* disable DL GSM to prevent jack_insert becoming 'floating' */
-+ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, 1);
++ /* All GPS related regulators registered ? */
++ if (gps_registered_regulators == 4)
++ platform_device_register(>a01_pm_gps_dev);
++}
++
++static struct pcf50606_platform_data gta01_pcf_pdata __devinitdata = {
++ .resumers = {
++ [0] = PCF50606_INT1_ALARM |
++ PCF50606_INT1_ONKEYF |
++ PCF50606_INT1_EXTONR,
++ [1] = PCF50606_INT2_CHGWD10S |
++ PCF50606_INT2_CHGPROT |
++ PCF50606_INT2_CHGERR,
++ [2] = PCF50606_INT3_LOWBAT |
++ PCF50606_INT3_HIGHTMP |
++ PCF50606_INT3_ACDINS,
++ },
++ .mbc_event_callback = gta01_pmu_event_callback,
++ .reg_init_data = {
++ /* BT, GPS */
++ [PCF50606_REGULATOR_D1REG] = {
++ .constraints = {
++ .min_uV = 3000000,
++ .max_uV = 3150000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ },
++ .num_consumer_supplies = ARRAY_SIZE(d1reg_consumers),
++ .consumer_supplies = d1reg_consumers,
++ },
++ /* GPS */
++ [PCF50606_REGULATOR_D2REG] = {
++ .constraints = {
++ .min_uV = 1650000,
++ .max_uV = 3300000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE,
++ .apply_uV = 1,
++ },
++ .num_consumer_supplies = ARRAY_SIZE(d2reg_consumers),
++ .consumer_supplies = d2reg_consumers,
+
-+ if (device_may_wakeup(dev))
-+ enable_irq_wake(GTA02_IRQ_MODEM);
++ },
++ /* RTC/Standby */
++ [PCF50606_REGULATOR_D3REG] = {
++ .constraints = {
++ .min_uV = 1800000,
++ .max_uV = 2100000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .always_on = 1,
++ .state_mem = {
++ .enabled = 1,
++ },
++ },
++ .num_consumer_supplies = 0,
++ },
++ /* GPS */
++ [PCF50606_REGULATOR_DCD] = {
++ .constraints = {
++ .min_uV = 1500000,
++ .max_uV = 1500000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ },
++ .num_consumer_supplies = ARRAY_SIZE(dcd_consumers),
++ .consumer_supplies = dcd_consumers,
++ },
+
-+ return 0;
++ /* S3C2410 Memory and IO, Vibrator, RAM, NAND, AMP, SD Card */
++ [PCF50606_REGULATOR_DCDE] = {
++ .constraints = {
++ .min_uV = 3300000,
++ .max_uV = 3300000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ .always_on = 1,
++ .state_mem = {
++ .enabled = 1,
++ },
++ },
++ .num_consumer_supplies = 0,
++ },
++ /* SoC */
++ [PCF50606_REGULATOR_DCUD] = {
++ .constraints = {
++ .min_uV = 2100000,
++ .max_uV = 2100000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ .always_on = 1,
++ .state_mem = {
++ .enabled = 1,
++ },
++ },
++ .num_consumer_supplies = 0,
++ },
++ /* Codec, GPS */
++ [PCF50606_REGULATOR_IOREG] = {
++ .constraints = {
++ .min_uV = 3300000,
++ .max_uV = 3300000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ .always_on = 1,
++ },
++ .num_consumer_supplies = ARRAY_SIZE(ioreg_consumers),
++ .consumer_supplies = ioreg_consumers,
+
-+busy:
-+ return -EBUSY;
-+}
++ },
++ /* LCM */
++ [PCF50606_REGULATOR_LPREG] = {
++ .constraints = {
++ .min_uV = 3300000,
++ .max_uV = 3300000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .apply_uV = 1,
++ },
++ .num_consumer_supplies = ARRAY_SIZE(lpreg_consumers),
++ .consumer_supplies = lpreg_consumers,
++ },
++ },
++ .probe_done = gta01_pcf_probe_done,
++ .regulator_registered = gta01_pmu_regulator_registered,
++};
+
-+static int gta02_gsm_suspend_late(struct device *dev)
++static void mangle_pmu_pdata_by_system_rev(void)
+{
-+ /* Last chance: abort if GSM already interrupted */
-+ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
-+ if (gta02_gsm_interrupts)
-+ return -EBUSY;
++ struct regulator_init_data *reg_init_data;
++
++ reg_init_data = gta01_pcf_pdata.reg_init_data;
++
++ switch (S3C_SYSTEM_REV_ATAG) {
++ case GTA01Bv4_SYSTEM_REV:
++ /* FIXME : gta01_pcf_pdata.used_features |= PCF50606_FEAT_ACD; */
++ break;
++ case GTA01Bv3_SYSTEM_REV:
++ case GTA01Bv2_SYSTEM_REV:
++ reg_init_data[PCF50606_REGULATOR_D3REG].constraints.state_mem.enabled = 1;
++ break;
++ default:
++ break;
+ }
-+ return 0;
+}
+
-+static int gta02_gsm_resume(struct device *dev)
++static void gta01_power_off(void)
+{
-+ if (device_may_wakeup(dev))
-+ disable_irq_wake(GTA02_IRQ_MODEM);
-+
-+ /* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
-+ * don't need to do much here. */
-+
-+ /* Make sure that the kernel console on the serial port is still
-+ * disabled. FIXME: resume ordering race with serial driver! */
-+ if (gta02_gsm.con && s3c2410_gpio_getpin(GTA02_GPIO_MODEM_ON))
-+ console_stop(gta02_gsm.con);
-+
-+ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, gta02_gsm.gpio_ndl_gsm);
-+
-+ return 0;
++ pcf50606_reg_write(gta01_pcf, PCF50606_REG_OOCC1,
++ PCF50606_OOCC1_GOSTDBY);
+}
+
-+static struct dev_pm_ops gta02_gsm_pm_ops = {
-+ .suspend = gta02_gsm_suspend,
-+ .suspend_noirq = gta02_gsm_suspend_late,
-+ .resume = gta02_gsm_resume,
++/* LCD driver info */
++
++/* Configuration for 480x640 toppoly TD028TTEC1.
++ * Do not mark this as __initdata or it will break! */
++static struct s3c2410fb_display gta01_displays[] = {
++ {
++ .type = S3C2410_LCDCON1_TFT,
++ .width = 43,
++ .height = 58,
++ .xres = 480,
++ .yres = 640,
++ .bpp = 16,
++
++ .pixclock = 40000, /* HCLK/4 */
++ .left_margin = 104,
++ .right_margin = 8,
++ .hsync_len = 8,
++ .upper_margin = 2,
++ .lower_margin = 16,
++ .vsync_len = 2,
++ .lcdcon5 = S3C2410_LCDCON5_FRM565 |
++ S3C2410_LCDCON5_INVVCLK |
++ S3C2410_LCDCON5_INVVLINE |
++ S3C2410_LCDCON5_INVVFRAME |
++ S3C2410_LCDCON5_PWREN |
++ S3C2410_LCDCON5_HWSWP,
++ },
++ {
++ .type = S3C2410_LCDCON1_TFT,
++ .width = 43,
++ .height = 58,
++ .xres = 480,
++ .yres = 640,
++ .bpp = 32,
++
++ .pixclock = 40000, /* HCLK/4 */
++ .left_margin = 104,
++ .right_margin = 8,
++ .hsync_len = 8,
++ .upper_margin = 2,
++ .lower_margin = 16,
++ .vsync_len = 2,
++ .lcdcon5 = S3C2410_LCDCON5_FRM565 |
++ S3C2410_LCDCON5_INVVCLK |
++ S3C2410_LCDCON5_INVVLINE |
++ S3C2410_LCDCON5_INVVFRAME |
++ S3C2410_LCDCON5_PWREN |
++ S3C2410_LCDCON5_HWSWP,
++ },
++ {
++ .type = S3C2410_LCDCON1_TFT,
++ .width = 43,
++ .height = 58,
++ .xres = 240,
++ .yres = 320,
++ .bpp = 16,
++
++ .pixclock = 40000, /* HCLK/4 */
++ .left_margin = 104,
++ .right_margin = 8,
++ .hsync_len = 8,
++ .upper_margin = 2,
++ .lower_margin = 16,
++ .vsync_len = 2,
++ .lcdcon5 = S3C2410_LCDCON5_FRM565 |
++ S3C2410_LCDCON5_INVVCLK |
++ S3C2410_LCDCON5_INVVLINE |
++ S3C2410_LCDCON5_INVVFRAME |
++ S3C2410_LCDCON5_PWREN |
++ S3C2410_LCDCON5_HWSWP,
++ },
+};
+
-+#define GTA02_GSM_PM_OPS (>a02_gsm_pm_ops)
++static struct s3c2410fb_mach_info gta01_lcd_cfg __initdata = {
++ .displays = gta01_displays,
++ .num_displays = ARRAY_SIZE(gta01_displays),
++ .default_display = 0,
+
-+#else
-+#define GTA02_GSM_PM_OPS NULL
-+#endif /* CONFIG_PM */
++ .lpcsel = ((0xCE6) & ~7) | 1<<4,
++};
+
-+static struct attribute *gta02_gsm_sysfs_entries[] = {
-+ &dev_attr_power_on.attr,
-+ &dev_attr_reset.attr,
-+ &dev_attr_download.attr,
-+ &dev_attr_flowcontrolled.attr,
-+ NULL
++static struct s3c2410_nand_set gta01_nand_sets[] = {
++ [0] = {
++ .name = "neo1973-nand",
++ .nr_chips = 1,
++/* .flags = S3C2410_NAND_BBT,*/
++ },
+};
+
-+static struct attribute_group gta02_gsm_attr_group = {
-+ .name = NULL,
-+ .attrs = gta02_gsm_sysfs_entries,
++static struct s3c2410_platform_nand gta01_nand_info = {
++ .tacls = 20,
++ .twrph0 = 60,
++ .twrph1 = 20,
++ .nr_sets = ARRAY_SIZE(gta01_nand_sets),
++ .sets = gta01_nand_sets,
+};
+
-+static irqreturn_t gta02_gsm_irq(int irq, void *devid)
++/* MMC */
++
++static void gta01_mmc_set_power(unsigned char power_mode, unsigned short vdd)
+{
-+ gta02_gsm_interrupts++;
-+ return IRQ_HANDLED;
++ printk(KERN_DEBUG "mmc_set_power(power_mode=%u, vdd=%u)\n",
++ power_mode, vdd);
++
++ switch (power_mode) {
++ case MMC_POWER_OFF:
++ gpio_set_value(GTA01_GPIO_SDMMC_ON, 1);
++ break;
++ case MMC_POWER_UP:
++ gpio_set_value(GTA01_GPIO_SDMMC_ON, 0);
++ break;
++ }
+}
+
-+static int __init gta02_gsm_probe(struct platform_device *pdev)
++static struct s3c24xx_mci_pdata gta01_mmc_cfg = {
++ .gpio_detect = GTA01_GPIO_nSD_DETECT,
++ .set_power = >a01_mmc_set_power,
++ .ocr_avail = MMC_VDD_32_33,
++};
++
++/* UDC */
++
++static void gta01_udc_command(enum s3c2410_udc_cmd_e cmd)
+{
-+ int ret;
++ printk("udc command: %d\n", cmd);
++ switch (cmd) {
++ case S3C2410_UDC_P_ENABLE:
++ gpio_set_value(GTA01_GPIO_USB_PULLUP, 1);
++ break;
++ case S3C2410_UDC_P_DISABLE:
++ gpio_set_value(GTA01_GPIO_USB_PULLUP, 0);
++ break;
++ default:
++ break;
++ }
++}
+
-+ gta02_gsm.con = find_s3c24xx_console();
-+ if (!gta02_gsm.con)
-+ dev_warn(&pdev->dev,
-+ "cannot find S3C24xx console driver\n");
++/* use a work queue, since I2C API inherently schedules
++ * and we get called in hardirq context from UDC driver */
+
-+ gta02_gsm.regulator = regulator_get_exclusive(&pdev->dev, "GSM");
++struct vbus_draw {
++ struct work_struct work;
++ int ma;
++};
++static struct vbus_draw gta01_udc_vbus_drawer;
+
-+ if (IS_ERR(gta02_gsm.regulator)) {
-+ ret = PTR_ERR(gta02_gsm.regulator);
-+ dev_err(&pdev->dev, "Failed to get regulator: %d\n", ret);
-+ return ret;
++static void __gta01_udc_vbus_draw(struct work_struct *work)
++{
++ /*
++ * This is a fix to work around boot-time ordering problems if the
++ * s3c2410_udc is initialized before the pcf50606 driver has defined
++ * pcf50606_global
++ */
++ if (!gta01_pcf)
++ return;
++#if 0
++ if (gta01_udc_vbus_drawer.ma >= 500) {
++ /* enable fast charge */
++ printk(KERN_DEBUG "udc: enabling fast charge\n");
++ pcf50606_charge_fast(gta01_pcf, 1);
++ } else {
++ /* disable fast charge */
++ printk(KERN_DEBUG "udc: disabling fast charge\n");
++ pcf50606_charge_fast(gta01_pcf, 0);
+ }
++#endif
++}
+
-+ ret = request_irq(GTA02_IRQ_MODEM, gta02_gsm_irq,
-+ IRQF_DISABLED | IRQF_TRIGGER_RISING, "modem", NULL);
++static void gta01_udc_vbus_draw(unsigned int ma)
++{
++ gta01_udc_vbus_drawer.ma = ma;
++ schedule_work(>a01_udc_vbus_drawer.work);
++}
+
-+ if (ret) {
-+ regulator_put(gta02_gsm.regulator);
-+ dev_err(&pdev->dev, "Failed to get modem irq: %d\n", ret);
-+ goto err_regulator_put;
-+ }
++static struct s3c2410_udc_mach_info gta01_udc_cfg = {
++ .vbus_draw = gta01_udc_vbus_draw,
++ .udc_command = gta01_udc_command,
++};
+
-+ ret = sysfs_create_group(&pdev->dev.kobj, >a02_gsm_attr_group);
-+ if (ret) {
-+ dev_err(&pdev->dev, "Failed to create sysfs entries: %d\n", ret);
-+ goto err_free_irq;
-+ }
++/* Touchscreen configuration. */
+
-+ device_init_wakeup(&pdev->dev, 1);
++#if 0
+
-+ /* GSM is to be initially off (at boot, or if this module inserted) */
-+ gsm_on_off(&pdev->dev, 0);
++#ifdef CONFIG_TOUCHSCREEN_FILTER
++const static struct ts_filter_group_configuration gta01_ts_group = {
++ .length = 12,
++ .close_enough = 10,
++ .threshold = 6, /* At least half of the points in a group. */
++ .attempts = 10,
++};
+
-+ /* note that download initially disabled, and enforce that */
-+ gta02_gsm.gpio_ndl_gsm = 1;
-+ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, 1);
++const static struct ts_filter_median_configuration gta01_ts_median = {
++ .extent = 20,
++ .decimation_below = 3,
++ .decimation_threshold = 8 * 3,
++ .decimation_above = 4,
++};
+
-+ return 0;
-+err_free_irq:
-+ free_irq(GTA02_IRQ_MODEM, NULL);
-+err_regulator_put:
-+ regulator_put(gta02_gsm.regulator);
++const static struct ts_filter_mean_configuration gta01_ts_mean = {
++ .length = 4,
++};
+
-+ return ret;
-+}
++const static struct ts_filter_linear_configuration gta01_ts_linear = {
++ .constants = {1, 0, 0, 0, 1, 0, 1}, /* Don't modify coords. */
++ .coord0 = 0,
++ .coord1 = 1,
++};
++#endif
+
-+static int gta02_gsm_remove(struct platform_device *pdev)
++const static struct ts_filter_chain_configuration gta01_filter_configuration[] =
+{
-+ gsm_on_off(&pdev->dev, 0);
++#ifdef CONFIG_TOUCHSCREEN_FILTER
++ {&ts_filter_group_api, >a01_ts_group.config},
++ {&ts_filter_median_api, >a01_ts_median.config},
++ {&ts_filter_mean_api, >a01_ts_mean.config},
++ {&ts_filter_linear_api, >a01_ts_linear.config},
++#endif
++ {NULL, NULL},
++};
+
-+ sysfs_remove_group(&pdev->dev.kobj, >a02_gsm_attr_group);
-+ free_irq(GTA02_IRQ_MODEM, NULL);
-+ regulator_put(gta02_gsm.regulator);
++const static struct s3c2410_ts_mach_info gta01_ts_cfg = {
++ .delay = 10000,
++ .presc = 0xff, /* slow as we can go */
++ .filter_config = gta01_filter_configuration,
++};
++#endif
+
-+ return 0;
-+}
++/* SPI / Display */
+
-+static struct platform_driver gta02_gsm_driver = {
-+ .probe = gta02_gsm_probe,
-+ .remove = gta02_gsm_remove,
-+ .driver = {
-+ .name = "gta02-pm-gsm",
-+ .pm = GTA02_GSM_PM_OPS,
++const struct jbt6k74_platform_data gta01_jbt6k74_pdata = {
++ .gpio_reset = GTA01_GPIO_LCD_RESET,
++};
++
++static struct spi_board_info gta01_spi_board_info[] = {
++ {
++ .modalias = "jbt6k74",
++ .platform_data = >a01_jbt6k74_pdata,
++ .controller_data = (void*)S3C2410_GPG(3),
++ .max_speed_hz = 10 * 1000 * 1000,
++ .bus_num = 1,
+ },
+};
+
-+static int __devinit gta02_gsm_init(void)
-+{
-+ return platform_driver_register(>a02_gsm_driver);
-+}
-+module_init(gta02_gsm_init);
++static struct spi_gpio_platform_data spigpio_platform_data = {
++ .sck = S3C2410_GPG(7),
++ .mosi = S3C2410_GPG(6),
++ .miso = S3C2410_GPG(5),
++ .num_chipselect = 1,
++};
+
-+static void gta02_gsm_exit(void)
-+{
-+ platform_driver_unregister(>a02_gsm_driver);
-+}
-+module_exit(gta02_gsm_exit);
++static struct platform_device gta01_lcm_spigpio_device = {
++ .name = "spi_gpio",
++ .id = 1,
++ .dev = {
++ .platform_data = &spigpio_platform_data,
++ },
++};
+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_DESCRIPTION("Openmoko Freerunner GSM Power Management");
-diff --git a/arch/arm/mach-s3c2440/gta02-pm-wlan.c b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
-new file mode 100644
-index 0000000..c6ae6f3
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
-@@ -0,0 +1,201 @@
-+/*
-+ * GTA02 WLAN power management
-+ *
-+ * (C) 2008, 2009 by Openmoko Inc.
-+ * Author: Andy Green <andy@openmoko.com>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation
-+ *
-+ */
++/* Backlight */
+
-+#include <linux/module.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/mutex.h>
-+#include <linux/platform_device.h>
++static struct platform_pwm_backlight_data gta01_bl_pdata = {
++ .max_brightness = 0xff,
++ .dft_brightness = 0xff,
++ .pwm_period_ns = 5000000, /* TODO: Tweak this */
++ .pwm_id = 0,
++};
+
-+#include <mach/hardware.h>
-+#include <asm/mach-types.h>
++static struct platform_device gta01_bl_device = {
++ .name = "pwm-backlight",
++ .id = -1,
++ .dev = {
++ .platform_data = >a01_bl_pdata,
++ .parent = &s3c_device_timer[0].dev,
++ },
++};
+
-+#include <mach/gta02.h>
-+#include <mach/gta02-pm-wlan.h>
-+#include <mach/regs-gpio.h>
-+#include <mach/regs-gpioj.h>
-+#include <mach/gpio-fns.h>
++/* Vibrator */
++static struct led_pwm gta01_vibrator = {
++ .name = "gta01::vibrator",
++ .max_brightness = 0xff,
++ .pwm_period_ns = 500000, /* TODO: Tweak this */
++ .pwm_id = 3,
++};
+
-+#include <linux/delay.h>
-+#include <linux/rfkill.h>
++static struct led_pwm_platform_data gta01_vibrator_pdata = {
++ .num_leds = 1,
++ .leds = >a01_vibrator,
++};
+
++static struct platform_device gta01_vibrator_device_bv4 = {
++ .name = "leds_pwm",
++ .id = -1,
++ .dev = {
++ .platform_data = >a01_vibrator_pdata,
++ .parent = &s3c_device_timer[3].dev,
++ }
++};
+
-+/* ----- Module hardware reset ("power") ----------------------------------- */
++static struct gpio_led gta01_vibrator_bv2 = {
++ .name = "gta01::vibrator",
++ .gpio = GTA01Bv2_GPIO_VIBRATOR_ON,
++ .default_state = LEDS_GPIO_DEFSTATE_OFF,
++};
+
++static struct gpio_led_platform_data gta01_vibrator_pdata_bv2 = {
++ .num_leds = 1,
++ .leds = >a01_vibrator_bv2,
++};
+
-+void gta02_wlan_reset(int assert_reset)
-+{
-+ if (assert_reset) {
-+ s3c2410_gpio_setpin(GTA02_GPIO_nWLAN_RESET, 0);
-+ msleep(200); /* probably excessive but we don't have specs */
-+ } else {
-+ s3c2410_gpio_setpin(GTA02_GPIO_nWLAN_RESET, 1);
-+ }
-+}
++static struct platform_device gta01_vibrator_device_bv2 = {
++ .name = "leds-gpio",
++ .id = -1,
++ .dev = {
++ .platform_data = >a01_vibrator_pdata_bv2,
++ }
++};
+
-+/* ----- rfkill ------------------------------------------------------------ */
++static struct platform_device *gta01_vibrator_device = >a01_vibrator_device_bv4;
++/* Buttons */
+
-+/*
-+ * S3C MCI handles suspend/resume through device removal/insertion. In order to
-+ * preserve rfkill state, as required in clause 7 of section 3.1 in rfkill.txt,
-+ * we therefore need to maintain rfkill state outside the driver.
-+ *
-+ * This platform driver is as good a place as any other.
-+ */
++static struct gpio_keys_button gta01_buttons[] = {
++ {
++ .gpio = GTA01_GPIO_AUX_KEY,
++ .code = KEY_PHONE,
++ .desc = "Aux",
++ .type = EV_KEY,
++ .debounce_interval = 100,
++ },
++ {
++ .gpio = GTA01_GPIO_HOLD_KEY,
++ .code = KEY_PAUSE,
++ .desc = "Hold",
++ .type = EV_KEY,
++ .debounce_interval = 100,
++ },
++};
+
-+static int (*gta02_wlan_rfkill_cb)(void *user, int on);
-+static void *gta02_wlan_rfkill_user;
-+static DEFINE_MUTEX(gta02_wlan_rfkill_lock);
-+static int gta02_wlan_rfkill_on;
++static struct gpio_keys_platform_data gta01_buttons_pdata = {
++ .buttons = gta01_buttons,
++ .nbuttons = ARRAY_SIZE(gta01_buttons),
++};
+
-+/*
-+ * gta02_wlan_query_rfkill_lock is used to obtain the rfkill state before the
-+ * driver is ready to process rfkill callbacks. To prevent the state from
-+ * changing until the driver has completed its initialization, we grab and hold
-+ * the rfkill lock.
-+ *
-+ * A call to gta02_wlan_query_rfkill_lock must be followed by either
-+ * - a call to gta02_wlan_set_rfkill_cb, to complete the setup, or
-+ * - a call to gta02_wlan_query_rfkill_unlock to abort the setup process.
-+ */
++static struct platform_device gta01_buttons_device = {
++ .name = "gpio-keys",
++ .id = -1,
++ .dev = {
++ .platform_data = >a01_buttons_pdata,
++ },
++};
+
-+int gta02_wlan_query_rfkill_lock(void)
-+{
-+ mutex_lock(>a02_wlan_rfkill_lock);
-+ return gta02_wlan_rfkill_on;
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_lock);
++/* USB */
+
-+void gta02_wlan_query_rfkill_unlock(void)
-+{
-+ mutex_unlock(>a02_wlan_rfkill_lock);
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_unlock);
++static struct s3c2410_hcd_info gta01_usb_info = {
++ .port[0] = {
++ .flags = S3C_HCDFLG_USED,
++ },
++ .port[1] = {
++ .flags = 0,
++ },
++};
+
-+void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user)
++static struct platform_device *gta01_devices[] __initdata = {
++ &s3c_device_ohci,
++ &s3c_device_lcd,
++ &s3c_device_wdt,
++ &s3c_device_i2c0,
++ &s3c_device_iis,
++ &s3c_device_sdi,
++ &s3c_device_usbgadget,
++ &s3c_device_nand,
++ &s3c_device_adc,
++ &s3c_device_ts,
++ &s3c_device_timer[0],
++ &s3c_device_timer[3],
++ >a01_bl_device,
++ >a01_buttons_device,
++ >a01_pm_gsm_dev,
++};
++
++static struct platform_device *gta01_pmu_child_devices[] __devinitdata = {
++ >a01_lcm_spigpio_device,
++};
++
++static void __devinit gta01_pmu_attach_child_devices(struct pcf50606 *pcf)
+{
-+ BUG_ON(!mutex_is_locked(>a02_wlan_rfkill_lock));
-+ BUG_ON(gta02_wlan_rfkill_cb);
-+ gta02_wlan_rfkill_cb = cb;
-+ gta02_wlan_rfkill_user = user;
-+ mutex_unlock(>a02_wlan_rfkill_lock);
-+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_set_rfkill_cb);
++ size_t i;
+
-+void gta02_wlan_clear_rfkill_cb(void)
++ for (i = 0; i < ARRAY_SIZE(gta01_pmu_child_devices); ++i)
++ gta01_pmu_child_devices[i]->dev.parent = pcf->dev;
++
++ platform_add_devices(gta01_pmu_child_devices,
++ ARRAY_SIZE(gta01_pmu_child_devices));
++}
++static void __init gta01_map_io(void)
+{
-+ mutex_lock(>a02_wlan_rfkill_lock);
-+ BUG_ON(!gta02_wlan_rfkill_cb);
-+ gta02_wlan_rfkill_cb = NULL;
-+ mutex_unlock(>a02_wlan_rfkill_lock);
++ s3c24xx_init_io(gta01_iodesc, ARRAY_SIZE(gta01_iodesc));
++ s3c24xx_init_clocks(12*1000*1000);
++ s3c24xx_init_uarts(gta01_uartcfgs, ARRAY_SIZE(gta01_uartcfgs));
+}
-+EXPORT_SYMBOL_GPL(gta02_wlan_clear_rfkill_cb);
+
-+static int gta02_wlan_set_radio_block(void *data, bool blocked)
++static irqreturn_t gta01_modem_irq(int irq, void *param)
+{
-+ struct device *dev = data;
-+ int res = 0;
-+
-+ dev_dbg(dev, "gta02_wlan_toggle_radio: blocked %d (%p)\n",
-+ blocked, gta02_wlan_rfkill_cb);
-+ mutex_lock(>a02_wlan_rfkill_lock);
-+ if (gta02_wlan_rfkill_cb)
-+ res = gta02_wlan_rfkill_cb(gta02_wlan_rfkill_user, !blocked);
-+ if (!res)
-+ gta02_wlan_rfkill_on = !blocked;
-+ mutex_unlock(>a02_wlan_rfkill_lock);
-+ return res;
++ printk(KERN_DEBUG "GSM wakeup interrupt (IRQ %d)\n", irq);
++/* gta_gsm_interrupts++;*/
++ return IRQ_HANDLED;
+}
+
-+static const struct rfkill_ops gta02_wlan_rfkill_ops = {
-+ .set_block = gta02_wlan_set_radio_block,
++static struct i2c_board_info gta01_i2c_devs[] __initdata = {
++ {
++ I2C_BOARD_INFO("pcf50606", 0x08),
++ .irq = GTA01Bv4_IRQ_PCF50606,
++ .platform_data = >a01_pcf_pdata,
++ },
++ {
++ I2C_BOARD_INFO("lm4857", 0x7c),
++ },
++ {
++ I2C_BOARD_INFO("wm8753", 0x1a),
++ },
+};
+
-+/* ----- Initialization/removal -------------------------------------------- */
-+
-+
-+static int __init gta02_wlan_probe(struct platform_device *pdev)
++static int __init gta01_init_gpio(void)
+{
-+ /* default-on for now */
-+ const int default_state = 1;
-+ struct rfkill *rfkill;
+ int ret;
+
-+ dev_info(&pdev->dev, "starting\n");
++ ret = gpio_request(GTA01_GPIO_USB_PULLUP, "udc pullup");
+
-+ s3c2410_gpio_cfgpin(GTA02_GPIO_nWLAN_RESET, S3C2410_GPIO_OUTPUT);
-+ gta02_wlan_reset(1);
-+ gta02_wlan_reset(0);
++ ret = gpio_direction_output(GTA01_GPIO_USB_PULLUP, 0);
+
-+ rfkill = rfkill_alloc("ar6000", &pdev->dev, RFKILL_TYPE_WLAN,
-+ >a02_wlan_rfkill_ops, &pdev->dev);
++ ret = gpio_request(GTA01_GPIO_SDMMC_ON, "SD/MMC power");
+
++ ret = gpio_direction_output(GTA01_GPIO_SDMMC_ON, 1);
+
-+ if (!rfkill) {
-+ dev_err(&pdev->dev, "Failed to allocate rfkill\n");
-+ return -ENOMEM;
-+ }
++ s3c2410_gpio_cfgpin(GTA01_GPIO_BACKLIGHT, S3C2410_GPB0_TOUT0);
++ if (S3C_SYSTEM_REV_ATAG == GTA01Bv4_SYSTEM_REV)
++ s3c2410_gpio_cfgpin(GTA01Bv4_GPIO_VIBRATOR_ON, S3C2410_GPB3_TOUT3);
+
-+ rfkill_init_sw_state(rfkill, default_state);
-+ /*
-+ * If the WLAN driver somehow managed to get activated before we're
-+ * ready, the driver is now in an unknown state, which isn't something
-+ * we're prepared to handle. This can't happen, so just fail hard.
-+ */
-+ BUG_ON(gta02_wlan_rfkill_cb);
-+ gta02_wlan_rfkill_on = default_state;
++ return ret;
++}
+
-+ ret = rfkill_register(rfkill);
-+ if (ret) {
-+ rfkill_destroy(rfkill);
-+ dev_err(&pdev->dev, "Failed to register rfkill\n");
-+ return ret;
++static void __init gta01_machine_init(void)
++{
++ int rc;
++
++ gta01_init_gpio();
++
++ if (S3C_SYSTEM_REV_ATAG != GTA01Bv4_SYSTEM_REV) {
++ gta01_vibrator_device = >a01_vibrator_device_bv2;
++ gta01_i2c_devs[0].irq = GTA01Bv2_IRQ_PCF50606;
+ }
+
-+ dev_set_drvdata(&pdev->dev, rfkill);
++ s3c_ohci_set_platdata(>a01_usb_info);
++ s3c_device_nand.dev.platform_data = >a01_nand_info;
++ s3c_device_sdi.dev.platform_data = >a01_mmc_cfg;
+
-+ return 0;
-+}
++ s3c24xx_fb_set_platdata(>a01_lcd_cfg);
+
-+static int gta02_wlan_remove(struct platform_device *pdev)
-+{
-+ struct rfkill *rfkill = dev_get_drvdata(&pdev->dev);
++ INIT_WORK(>a01_udc_vbus_drawer.work, __gta01_udc_vbus_draw);
++ s3c24xx_udc_set_platdata(>a01_udc_cfg);
++ s3c_i2c0_set_platdata(NULL);
+
-+ rfkill_destroy(rfkill);
++/* set_s3c2410ts_info(>a01_ts_cfg);*/
+
-+ return 0;
-+}
++#if 0
++ switch (S3C_SYSTEM_REV_ATAG) {
++ case GTA01v3_SYSTEM_REV:
++ case GTA01v4_SYSTEM_REV:
++ /* just use the default (GTA01_IRQ_PCF50606) */
++ break;
++ case GTA01Bv2_SYSTEM_REV:
++ case GTA01Bv3_SYSTEM_REV:
++ /* just use the default (GTA01_IRQ_PCF50606) */
++ gta01_led_resources[0].start =
++ gta01_led_resources[0].end = GTA01Bv2_GPIO_VIBRATOR_ON;
++ break;
++ case GTA01Bv4_SYSTEM_REV:
++ gta01_i2c_devs[0].irq = GTA01Bv4_IRQ_PCF50606;
++ gta01_led_resources[0].start =
++ gta01_led_resources[0].end = GTA01Bv4_GPIO_VIBRATOR_ON;
++ break;
++ }
++#endif
++ mangle_pmu_pdata_by_system_rev();
+
-+static struct platform_driver gta02_wlan_driver = {
-+ .probe = gta02_wlan_probe,
-+ .remove = gta02_wlan_remove,
-+ .driver = {
-+ .name = "gta02-pm-wlan",
-+ },
-+};
++ i2c_register_board_info(0, gta01_i2c_devs, ARRAY_SIZE(gta01_i2c_devs));
++ spi_register_board_info(gta01_spi_board_info,
++ ARRAY_SIZE(gta01_spi_board_info));
+
-+static int __devinit gta02_wlan_init(void)
-+{
-+ return platform_driver_register(>a02_wlan_driver);
-+}
-+module_init(gta02_wlan_init);
++ platform_add_devices(gta01_devices, ARRAY_SIZE(gta01_devices));
++/* platform_add_devices(gta01_vibrator_device, 1);*/
+
-+static void gta02_wlan_exit(void)
-+{
-+ platform_driver_unregister(>a02_wlan_driver);
++ s3c_pm_init();
++
++ set_irq_type(GTA01_IRQ_MODEM, IRQ_TYPE_EDGE_RISING);
++ rc = request_irq(GTA01_IRQ_MODEM, gta01_modem_irq, IRQF_DISABLED,
++ "modem", NULL);
++ enable_irq_wake(GTA01_IRQ_MODEM);
++
++ printk(KERN_DEBUG "Enabled GSM wakeup IRQ %d (rc=%d)\n",
++ GTA01_IRQ_MODEM, rc);
++
++ pm_power_off = >a01_power_off;
+}
-+module_exit(gta02_wlan_exit);
+
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_DESCRIPTION("Openmoko GTA02 WLAN power management");
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
++MACHINE_START(NEO1973_GTA01, "GTA01")
++ .phys_io = S3C2410_PA_UART,
++ .io_pg_offst = (((u32)S3C24XX_VA_UART) >> 18) & 0xfffc,
++ .boot_params = S3C2410_SDRAM_PA + 0x100,
++ .map_io = gta01_map_io,
++ .init_irq = s3c24xx_init_irq,
++ .init_machine = gta01_machine_init,
++ .timer = &s3c24xx_timer,
++MACHINE_END
+diff --git a/arch/arm/mach-s3c2440/Kconfig b/arch/arm/mach-s3c2440/Kconfig
+index 7f46526..cb5a8e5 100644
+--- a/arch/arm/mach-s3c2440/Kconfig
++++ b/arch/arm/mach-s3c2440/Kconfig
+@@ -99,6 +99,10 @@ config MACH_NEO1973_GTA02
+ select POWER_SUPPLY
+ select MACH_NEO1973
+ select S3C2410_PWM
++ select S3C_DEV_USB_HOST
++ select S3C_DEV_NAND
++ select FIQ
++ select S3C24XX_GPIO_EXTRA64
+ help
+ Say Y here if you are using the Openmoko GTA02 / Freerunner GSM Phone
+
+diff --git a/arch/arm/mach-s3c2440/Makefile b/arch/arm/mach-s3c2440/Makefile
+index c85ba32..6ce800d 100644
+--- a/arch/arm/mach-s3c2440/Makefile
++++ b/arch/arm/mach-s3c2440/Makefile
+@@ -33,7 +33,12 @@ obj-$(CONFIG_ARCH_S3C2440) += mach-smdk2440.o
+ obj-$(CONFIG_MACH_NEXCODER_2440) += mach-nexcoder.o
+ obj-$(CONFIG_MACH_AT2440EVB) += mach-at2440evb.o
+ obj-$(CONFIG_MACH_MINI2440) += mach-mini2440.o
+-obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o
++obj-$(CONFIG_MACH_NEO1973_GTA02) += mach-gta02.o \
++ gta02-pm-bt.o \
++ gta02-pm-gps.o \
++ gta02-pm-gsm.o \
++ gta02-pm-wlan.o \
++ gta02-fiq.o \
+
+ # extra machine support
+
+diff --git a/arch/arm/mach-s3c2440/gta02-fiq.c b/arch/arm/mach-s3c2440/gta02-fiq.c
new file mode 100644
-index 0000000..90de353
+index 0000000..d91c523
--- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
-@@ -0,0 +1,9 @@
-+#ifndef __GTA02_FIQ_H
-+#define __GTA02_FIQ_H
++++ b/arch/arm/mach-s3c2440/gta02-fiq.c
+@@ -0,0 +1,135 @@
++#include <linux/kernel.h>
+
-+extern void gta02_fiq_handler(void);
-+extern void gta02_fiq_kick(void);
-+extern int gta02_fiq_enable(void);
-+extern void gta02_fiq_disable(void);
++#include <asm/fiq.h>
++#include <mach/regs-irq.h>
++#include <plat/regs-timer.h>
++#include <mach/irqs.h>
++#include <linux/io.h>
++#include <linux/pwm.h>
++#include <linux/err.h>
++#include <linux/hdq.h>
++
++/* -------------------------------------------------------------------------------
++ * GTA02 FIQ related
++ *
++ * Calls into vibrator and hdq and based on the return values
++ * determines if we the FIQ source be kept alive
++ */
++
++#define DIVISOR_FROM_US(x) ((x) << 3)
+
++#ifdef CONFIG_HDQ_GPIO_BITBANG
++#define FIQ_DIVISOR_HDQ DIVISOR_FROM_US(HDQ_SAMPLE_PERIOD_US)
++extern int hdq_fiq_handler(void);
+#endif
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
-new file mode 100644
-index 0000000..f15180a
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
-@@ -0,0 +1 @@
-+extern int gta02_pm_gps_is_on(void);
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
-new file mode 100644
-index 0000000..4836978
---- /dev/null
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
-@@ -0,0 +1,10 @@
-+#ifndef __MACH_GTA02_PM_WLAN_H
-+#define __MACH_GTA02_PM_WLAN_H
+
-+void gta02_wlan_reset(int assert_reset);
-+int gta02_wlan_query_rfkill_lock(void);
-+void gta02_wlan_query_rfkill_unlock(void);
-+void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user);
-+void gta02_wlan_clear_rfkill_cb(void);
++/* Global data related to our fiq source */
++static uint32_t gta02_fiq_ack_mask;
++static const int gta02_gta02_fiq_timer_id = 2;
+
-+#endif /* __MACH_GTA02_PM_WLAN_H */
-diff --git a/arch/arm/mach-s3c2440/include/mach/gta02.h b/arch/arm/mach-s3c2440/include/mach/gta02.h
-index 953331d..f11f794 100644
---- a/arch/arm/mach-s3c2440/include/mach/gta02.h
-+++ b/arch/arm/mach-s3c2440/include/mach/gta02.h
-@@ -2,6 +2,7 @@
- #define _GTA02_H
-
- #include <mach/regs-gpio.h>
-+#include <mach/regs-gpioj.h>
-
- /* Different hardware revisions, passed in ATAG_REVISION by u-boot */
- #define GTA02v1_SYSTEM_REV 0x00000310
-@@ -79,6 +80,11 @@
- #define GTA02_PCB_ID2_0 S3C2410_GPD(3)
- #define GTA02_PCB_ID2_1 S3C2410_GPD(4)
-
-+#define GTA02_GPIO_GLAMO_BASE S3C_GPIO_END
-+#define GTA02_GPIO_GLAMO(x) (GTA02_GPIO_GLAMO_BASE + (x))
-+#define GTA02_GPIO_PCF_BASE (GTA02_GPIO_GLAMO_BASE + 32)
-+#define GTA02_GPIO_PCF(x) (GTA02_GPIO_PCF_BASE + (x))
++struct pwm_device* gta02_fiq_timer;
+
- int gta02_get_pcb_revision(void);
-
- #endif /* _GTA02_H */
-diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
-index 45799c6..9a9461d 100644
---- a/arch/arm/mach-s3c2440/mach-gta02.c
-+++ b/arch/arm/mach-s3c2440/mach-gta02.c
-@@ -38,6 +38,7 @@
- #include <linux/platform_device.h>
- #include <linux/serial_core.h>
- #include <linux/spi/spi.h>
-+#include <linux/spi/spi_gpio.h>
-
- #include <linux/mmc/host.h>
-
-@@ -49,14 +50,21 @@
- #include <linux/io.h>
-
- #include <linux/i2c.h>
--#include <linux/backlight.h>
- #include <linux/regulator/machine.h>
-+#include <linux/regulator/fixed.h>
-
- #include <linux/mfd/pcf50633/core.h>
- #include <linux/mfd/pcf50633/mbc.h>
- #include <linux/mfd/pcf50633/adc.h>
- #include <linux/mfd/pcf50633/gpio.h>
- #include <linux/mfd/pcf50633/pmic.h>
-+#include <linux/mfd/pcf50633/backlight.h>
++void gta02_fiq_handler(void)
++{
++ unsigned long intmask;
++ int keep_running = 0;
++ /* disable further timer interrupts if nobody has any work
++ * or adjust rate according to who still has work
++ *
++ * CAUTION: it means forground code must disable FIQ around
++ * its own non-atomic S3C2410_INTMSK changes... not common
++ * thankfully and taken care of by the fiq-basis patch
++ */
+
-+#include <linux/input.h>
-+#include <linux/gpio_keys.h>
++#ifdef CONFIG_HDQ_GPIO_BITBANG
++ keep_running = hdq_fiq_handler();
++#endif
++ if (!keep_running) {
++ /* Disable irq */
++ intmask = __raw_readl(S3C2410_INTMSK);
++ intmask |= (gta02_fiq_ack_mask);
++ __raw_writel(intmask, S3C2410_INTMSK);
++ }
+
-+#include <linux/leds.h>
-+#include <linux/leds_pwm.h>
-
- #include <asm/mach/arch.h>
- #include <asm/mach/map.h>
-@@ -76,6 +84,8 @@
- #include <mach/regs-mem.h>
- #include <mach/hardware.h>
-
-+#include <mach/ts.h>
++ __raw_writel(gta02_fiq_ack_mask, S3C2410_SRCPND);
++}
+
- #include <mach/gta02.h>
-
- #include <plat/regs-serial.h>
-@@ -85,8 +95,22 @@
- #include <plat/pm.h>
- #include <plat/udc.h>
- #include <plat/gpio-cfg.h>
-+#include <plat/gpio-core.h>
- #include <plat/iic.h>
-
-+#include <mach/gta02-pm-gps.h>
-+#include <mach/gta02-pm-wlan.h>
++void gta02_fiq_kick(void)
++{
++ unsigned long flags;
++ unsigned long intmask;
++ /* we have to take care about FIQ because this modification is
++ * non-atomic, FIQ could come in after the read and before the
++ * writeback and its changes to the register would be lost
++ * (platform INTMSK mod code is taken care of already)
++ */
++ local_save_flags(flags);
++ local_fiq_disable();
+
-+#include <mach/gta02-fiq.h>
++ /* allow FIQs to resume */
++ intmask = __raw_readl(S3C2410_INTMSK);
++ intmask &= ~(gta02_fiq_ack_mask);
++ __raw_writel(intmask, S3C2410_INTMSK);
+
-+#include <linux/hdq.h>
-+#include <linux/bq27000_battery.h>
-+#include <linux/platform_battery.h>
++ local_irq_restore(flags);
+
-+#include <linux/jbt6k74.h>
-+#include <linux/glamofb.h>
-+#include <linux/mfd/glamo.h>
++}
+
- static struct pcf50633 *gta02_pcf;
-
- /*
-@@ -149,6 +173,194 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
- },
- };
-
-+static struct platform_device gta02_pm_bt_dev = {
-+ .name = "gta02-pm-bt",
-+};
++int gta02_fiq_enable(void)
++{
++ int ret = 0;
+
-+static struct platform_device gta02_pm_gps_dev = {
-+ .name = "gta02-pm-gps",
-+};
++ local_fiq_disable();
+
-+static struct platform_device gta02_pm_gsm_dev = {
-+ .name = "gta02-pm-gsm",
-+};
++ gta02_fiq_timer = pwm_request(gta02_gta02_fiq_timer_id, "fiq timer");
+
-+static struct platform_device gta02_pm_wlan_dev = {
-+ .name = "gta02-pm-wlan",
-+};
++ if (IS_ERR(gta02_fiq_timer)) {
++ ret = PTR_ERR(gta02_fiq_timer);
++ printk("GTA02 FIQ: Could not request fiq timer: %d\n", ret);
++ return ret;
++ }
+
-+static struct regulator_consumer_supply gsm_supply_consumer = {
-+ .dev = >a02_pm_gsm_dev.dev,
-+ .supply = "GSM",
-+};
++ gta02_fiq_ack_mask = 1 << (IRQ_TIMER0 + gta02_gta02_fiq_timer_id
++ - S3C2410_CPUIRQ_OFFSET);
+
-+static struct regulator_init_data gsm_supply_init_data = {
-+ .constraints = {
-+ .min_uV = 3700000,
-+ .max_uV = 3700000,
-+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
-+ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
-+ },
-+ .num_consumer_supplies = 1,
-+ .consumer_supplies = &gsm_supply_consumer,
-+};
+
-+static struct fixed_voltage_config gsm_supply_config = {
-+ .supply_name = "GSM",
-+ .microvolts = 3700000,
-+ .gpio = GTA02_GPIO_PCF(PCF50633_GPIO2),
-+ .enable_high = 1,
-+ .init_data = &gsm_supply_init_data,
-+};
++ ret = pwm_config(gta02_fiq_timer, HDQ_SAMPLE_PERIOD_US * 1000,
++ HDQ_SAMPLE_PERIOD_US * 1000);
++ if (ret) {
++ printk("GTA02 FIQ: Could not configure fiq timer: %d\n", ret);
++ goto err;
++ }
+
-+static struct platform_device gta02_gsm_supply_device = {
-+ .name = "reg-fixed-voltage",
-+ .id = 1,
-+ .dev = {
-+ .platform_data = &gsm_supply_config,
-+ },
-+};
++ set_fiq_c_handler(gta02_fiq_handler);
+
-+/*
-+ * we crank down SD Card clock dynamically when GPS is powered
-+ */
++ __raw_writel(gta02_fiq_ack_mask, S3C2410_INTMOD);
+
-+static int gta02_glamo_mci_use_slow(void)
-+{
-+ return gta02_pm_gps_is_on();
++ pwm_enable(gta02_fiq_timer);
++
++ local_fiq_enable();
++
++ return 0;
++
++err:
++ pwm_free(gta02_fiq_timer);
++
++ return ret;
+}
+
-+static void gta02_glamo_external_reset(int level)
++void gta02_fiq_disable(void)
+{
-+ s3c2410_gpio_setpin(GTA02_GPIO_3D_RESET, level);
-+ s3c2410_gpio_cfgpin(GTA02_GPIO_3D_RESET, S3C2410_GPIO_OUTPUT);
-+}
++ local_fiq_disable();
+
-+struct spi_gpio_platform_data spigpio_platform_data = {
-+ .sck = GTA02_GPIO_GLAMO(10),
-+ .mosi = GTA02_GPIO_GLAMO(11),
-+ .miso = GTA02_GPIO_GLAMO(5),
-+ .num_chipselect = 1,
-+};
++ if (!gta02_fiq_timer)
++ return;
+
-+static struct platform_device spigpio_device = {
-+ .name = "spi_gpio",
-+ .id = 2,
-+ .dev = {
-+ .platform_data = &spigpio_platform_data,
-+ },
-+};
++ __raw_writel(0, S3C2410_INTMOD);
++ set_fiq_c_handler(NULL);
+
-+static void gta02_glamo_registered(struct device *dev)
-+{
-+ spigpio_device.dev.parent = dev;
-+ platform_device_register(&spigpio_device);
-+}
++ pwm_disable(gta02_fiq_timer);
+
-+static struct fb_videomode gta02_glamo_modes[] = {
-+ {
-+ .name = "480x640",
-+ .xres = 480,
-+ .yres = 640,
-+ .pixclock = 40816,
-+ .left_margin = 8,
-+ .right_margin = 16,
-+ .upper_margin = 2,
-+ .lower_margin = 16,
-+ .hsync_len = 8,
-+ .vsync_len = 2,
-+ .vmode = FB_VMODE_NONINTERLACED,
-+ }, {
-+ .name = "240x320",
-+ .xres = 240,
-+ .yres = 320,
-+ .pixclock = 40816,
-+ .left_margin = 8,
-+ .right_margin = 16,
-+ .upper_margin = 2,
-+ .lower_margin = 16,
-+ .hsync_len = 8,
-+ .vsync_len = 2,
-+ .vmode = FB_VMODE_NONINTERLACED,
-+ }
-+};
-+
-+static struct glamo_fb_platform_data gta02_glamo_fb_pdata = {
-+ .width = 43,
-+ .height = 58,
++ pwm_free(gta02_fiq_timer);
+
-+ .num_modes = ARRAY_SIZE(gta02_glamo_modes),
-+ .modes = gta02_glamo_modes,
-+};
++ gta02_fiq_timer = NULL;
++}
++/* -------------------- /GTA02 FIQ Handler ------------------------------------- */
+diff --git a/arch/arm/mach-s3c2440/gta02-pm-bt.c b/arch/arm/mach-s3c2440/gta02-pm-bt.c
+new file mode 100644
+index 0000000..5cf35d8
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/gta02-pm-bt.c
+@@ -0,0 +1,259 @@
++/*
++ * Bluetooth PM code for the Openmoko Freerunner GSM Phone
++ *
++ * (C) 2007 by Openmoko Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation
++ *
++ */
+
-+static struct glamo_mmc_platform_data gta02_glamo_mmc_pdata = {
-+ .glamo_mmc_use_slow = gta02_glamo_mci_use_slow,
-+};
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/platform_device.h>
++#include <linux/rfkill.h>
++#include <linux/slab.h>
+
-+static struct glamo_gpio_platform_data gta02_glamo_gpio_pdata = {
-+ .base = GTA02_GPIO_GLAMO_BASE,
-+ .registered = gta02_glamo_registered,
-+};
++#include <linux/err.h>
+
-+static struct glamo_platform_data gta02_glamo_pdata = {
-+ .fb_data = >a02_glamo_fb_pdata,
-+ .mmc_data = >a02_glamo_mmc_pdata,
-+ .gpio_data = >a02_glamo_gpio_pdata,
++#include <mach/gpio-fns.h>
+
-+ .osci_clock_rate = 32768,
++#include <mach/hardware.h>
++#include <asm/mach-types.h>
+
-+ .glamo_external_reset = gta02_glamo_external_reset,
-+};
++#include <mach/gta02.h>
+
-+/* JBT6k74 display controller */
-+static void gta02_jbt6k74_probe_completed(struct device *dev)
-+ {
-+ pcf50633_bl_set_brightness_limit(gta02_pcf, 0x3f);
-+}
-+
-+const static struct jbt6k74_platform_data jbt6k74_pdata = {
-+ .gpio_reset = GTA02_GPIO_GLAMO(4),
-+};
++#include <linux/regulator/consumer.h>
+
-+static struct spi_board_info gta02_spi_board_info[] = {
-+ {
-+ .modalias = "jbt6k74",
-+ .platform_data = &jbt6k74_pdata,
-+ .controller_data = (void*)GTA02_GPIO_GLAMO(12),
-+ /* irq */
-+ .max_speed_hz = 100 * 1000,
-+ .bus_num = 2,
-+ .chip_select = 0
-+ },
-+};
-+
-+static struct resource gta02_glamo_resources[] = {
-+ [0] = {
-+ .start = S3C2410_CS1,
-+ .end = S3C2410_CS1 + 0x1000000 - 1,
-+ .flags = IORESOURCE_MEM,
-+ },
-+ [1] = {
-+ .start = GTA02_IRQ_3D,
-+ .end = GTA02_IRQ_3D,
-+ .flags = IORESOURCE_IRQ,
-+ },
-+ [2] = {
-+ .start = IRQ_BOARD_START,
-+ .flags = IORESOURCE_IRQ,
-+ },
-+};
++#define DRVMSG "Openmoko Freerunner Bluetooth Power Management"
+
-+static struct platform_device gta02_glamo_dev = {
-+ .name = "glamo3362",
-+ .num_resources = ARRAY_SIZE(gta02_glamo_resources),
-+ .resource = gta02_glamo_resources,
-+ .dev = {
-+ .platform_data = >a02_glamo_pdata,
-+ },
++struct gta02_pm_bt_data {
++ struct regulator *regulator;
++ struct rfkill *rfkill;
++ int pre_resume_state;
+};
+
-+
- #ifdef CONFIG_CHARGER_PCF50633
- /*
- * On GTA02 the 1A charger features a 48K resistor to 0V on the ID pin.
-@@ -161,22 +373,28 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
- #define ADC_NOM_CHG_DETECT_1A 6
- #define ADC_NOM_CHG_DETECT_USB 43
-
--static void
--gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
-+static int gta02_get_charger_online_status(void)
- {
-- int ma;
-+ struct pcf50633 *pcf = gta02_pcf;
-
-- /* Interpret charger type */
-- if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2)) {
-+ return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ONLINE;
-+}
-
-- /*
-- * Sanity - stop GPO driving out now that we have a 1A charger
-- * GPO controls USB Host power generation on GTA02
-- */
-- pcf50633_gpio_set(pcf, PCF50633_GPO, 0);
-+static int gta02_get_charger_active_status(void)
++static ssize_t bt_read(struct device *dev, struct device_attribute *attr,
++ char *buf)
+{
-+ struct pcf50633 *pcf = gta02_pcf;
-
-+ return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ACTIVE;
++ int ret = 0;
++ if (!strcmp(attr->attr.name, "power_on")) {
++ if (s3c2410_gpio_getpin(GTA02_GPIO_BT_EN))
++ ret = 1;
++ } else if (!strcmp(attr->attr.name, "reset")) {
++ if (s3c2410_gpio_getpin(GTA02_GPIO_BT_EN) == 0)
++ ret = 1;
++ }
++
++ if (!ret) {
++ return strlcpy(buf, "0\n", 3);
++ } else {
++ return strlcpy(buf, "1\n", 3);
++ }
+}
+
-+static void
-+gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
++static void __gta02_pm_bt_toggle_radio(struct device *dev, unsigned int on)
+{
-+ int ma;
++ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
+
-+ if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2))
- ma = 1000;
-- } else
-+ else
- ma = 100;
-
- pcf50633_mbc_usb_curlim_set(pcf, ma);
-@@ -237,6 +455,8 @@ static void gta02_udc_vbus_draw(unsigned int ma)
- #else /* !CONFIG_CHARGER_PCF50633 */
- #define gta02_pmu_event_callback NULL
- #define gta02_udc_vbus_draw NULL
-+#define gta02_get_charger_online_status NULL
-+#define gta02_get_charger_active_status NULL
- #endif
-
- /*
-@@ -254,6 +474,38 @@ static char *gta02_batteries[] = {
- "battery",
- };
-
-+static struct regulator_consumer_supply ldo4_consumers[] = {
-+ {
-+ .dev = >a02_pm_bt_dev.dev,
-+ .supply = "BT_3V2",
-+ },
-+};
++ dev_info(dev, "__gta02_pm_bt_toggle_radio %d\n", on);
+
-+static struct regulator_consumer_supply ldo5_consumers[] = {
-+ {
-+ .dev = >a02_pm_gps_dev.dev,
-+ .supply = "RF_3V",
-+ },
-+};
++ bt_data = dev_get_drvdata(dev);
+
-+static struct regulator_consumer_supply ldo6_consumers[] = {
-+ REGULATOR_SUPPLY("VDC", "spi2.0"),
-+ REGULATOR_SUPPLY("VDDIO", "spi2.0"),
-+};
++ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, !on);
+
-+static struct regulator_consumer_supply hcldo_consumers[] = {
-+ {
-+ .dev = >a02_glamo_dev.dev,
-+ .supply = "SD_3V3",
-+ },
-+};
++ if (on) {
++ if (!regulator_is_enabled(bt_data->regulator))
++ regulator_enable(bt_data->regulator);
++ } else {
++ if (regulator_is_enabled(bt_data->regulator))
++ regulator_disable(bt_data->regulator);
++ }
+
-+static struct pcf50633_bl_platform_data gta02_backlight_data = {
-+ .default_brightness = 0x3f,
-+ .default_brightness_limit = 0,
-+ .ramp_time = 3,
-+};
++ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, on);
++}
+
- struct pcf50633_platform_data gta02_pcf_pdata = {
- .resumers = {
- [0] = PCF50633_INT1_USBINS |
-@@ -271,6 +523,10 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
-
- .charger_reference_current_ma = 1000,
-
-+ .backlight_data = >a02_backlight_data,
+
-+ .gpio_base = GTA02_GPIO_PCF_BASE,
++static int bt_rfkill_set_block(void *data, bool blocked)
++{
++ struct device *dev = data;
+
- .reg_init_data = {
- [PCF50633_REGULATOR_AUTO] = {
- .constraints = {
-@@ -310,15 +566,18 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- .min_uV = 2000000,
- .max_uV = 3300000,
- .valid_modes_mask = REGULATOR_MODE_NORMAL,
-- .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE,
-- .always_on = 1,
-+ .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE |
-+ REGULATOR_CHANGE_STATUS,
- },
-+ .num_consumer_supplies = ARRAY_SIZE(hcldo_consumers),
-+ .consumer_supplies = hcldo_consumers,
- },
- [PCF50633_REGULATOR_LDO1] = {
- .constraints = {
- .min_uV = 3300000,
- .max_uV = 3300000,
- .valid_modes_mask = REGULATOR_MODE_NORMAL,
-+ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
- .apply_uV = 1,
- .state_mem = {
- .enabled = 0,
-@@ -346,26 +605,35 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
- .min_uV = 3200000,
- .max_uV = 3200000,
- .valid_modes_mask = REGULATOR_MODE_NORMAL,
-+ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
- .apply_uV = 1,
- },
-+ .num_consumer_supplies = ARRAY_SIZE(ldo4_consumers),
-+ .consumer_supplies = ldo4_consumers,
- },
- [PCF50633_REGULATOR_LDO5] = {
- .constraints = {
- .min_uV = 3000000,
- .max_uV = 3000000,
- .valid_modes_mask = REGULATOR_MODE_NORMAL,
-+ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
- .apply_uV = 1,
- .state_mem = {
- .enabled = 1,
- },
- },
-+ .num_consumer_supplies = ARRAY_SIZE(ldo5_consumers),
-+ .consumer_supplies = ldo5_consumers,
- },
- [PCF50633_REGULATOR_LDO6] = {
- .constraints = {
- .min_uV = 3000000,
- .max_uV = 3000000,
- .valid_modes_mask = REGULATOR_MODE_NORMAL,
-+ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
- },
-+ .num_consumer_supplies = ARRAY_SIZE(ldo6_consumers),
-+ .consumer_supplies = ldo6_consumers,
- },
- [PCF50633_REGULATOR_MEMLDO] = {
- .constraints = {
-@@ -409,12 +677,6 @@ static struct platform_device gta02_nor_flash = {
- .num_resources = 1,
- };
-
--
--struct platform_device s3c24xx_pwm_device = {
-- .name = "s3c24xx_pwm",
-- .num_resources = 0,
--};
--
- static struct i2c_board_info gta02_i2c_devs[] __initdata = {
- {
- I2C_BOARD_INFO("pcf50633", 0x73),
-@@ -451,6 +713,7 @@ static struct s3c2410_platform_nand __initdata gta02_nand_info = {
- .twrph1 = 15,
- .nr_sets = ARRAY_SIZE(gta02_nand_sets),
- .sets = gta02_nand_sets,
-+ .software_ecc = 1,
- };
-
-
-@@ -459,11 +722,11 @@ static void gta02_udc_command(enum s3c2410_udc_cmd_e cmd)
- switch (cmd) {
- case S3C2410_UDC_P_ENABLE:
- pr_debug("%s S3C2410_UDC_P_ENABLE\n", __func__);
-- gpio_direction_output(GTA02_GPIO_USB_PULLUP, 1);
-+ gpio_set_value(GTA02_GPIO_USB_PULLUP, 1);
- break;
- case S3C2410_UDC_P_DISABLE:
- pr_debug("%s S3C2410_UDC_P_DISABLE\n", __func__);
-- gpio_direction_output(GTA02_GPIO_USB_PULLUP, 0);
-+ gpio_set_value(GTA02_GPIO_USB_PULLUP, 0);
- break;
- case S3C2410_UDC_P_RESET:
- pr_debug("%s S3C2410_UDC_P_RESET\n", __func__);
-@@ -478,81 +741,325 @@ static struct s3c2410_udc_mach_info gta02_udc_cfg = {
-
- };
-
-+/* USB */
-+static struct s3c2410_hcd_info gta02_usb_info __initdata = {
-+ .port[0] = {
-+ .flags = S3C_HCDFLG_USED,
-+ },
-+ .port[1] = {
-+ .flags = 0,
-+ },
-+};
++ __gta02_pm_bt_toggle_radio(dev, !blocked);
+
-+/* Touchscreen */
-+static struct s3c2410_ts_mach_info gta02_ts_info = {
-+ .delay = 10000,
-+ .presc = 0xff, /* slow as we can go */
-+ .oversampling_shift = 2,
-+};
++ return 0;
++}
+
-+/* Buttons */
-+static struct gpio_keys_button gta02_buttons[] = {
-+ {
-+ .gpio = GTA02_GPIO_AUX_KEY,
-+ .code = KEY_PHONE,
-+ .desc = "Aux",
-+ .type = EV_KEY,
-+ .debounce_interval = 100,
-+ },
-+ {
-+ .gpio = GTA02_GPIO_HOLD_KEY,
-+ .code = KEY_PAUSE,
-+ .desc = "Hold",
-+ .type = EV_KEY,
-+ .debounce_interval = 100,
-+ },
++static const struct rfkill_ops gta02_bt_rfkill_ops = {
++ .set_block = bt_rfkill_set_block,
+};
+
-+static struct gpio_keys_platform_data gta02_buttons_pdata = {
-+ .buttons = gta02_buttons,
-+ .nbuttons = ARRAY_SIZE(gta02_buttons),
-+};
+
-+static struct platform_device gta02_buttons_device = {
-+ .name = "gpio-keys",
-+ .id = -1,
-+ .dev = {
-+ .platform_data = >a02_buttons_pdata,
-+ },
-+};
++static ssize_t bt_write(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t count)
++{
++ unsigned long on = simple_strtoul(buf, NULL, 10);
++ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(dev);
+
-+/* LEDs */
-+static struct gpio_led gta02_gpio_leds[] = {
-+ {
-+ .name = "gta02:red:aux",
-+ .gpio = GTA02_GPIO_AUX_LED,
-+ },
-+};
-
-+static struct gpio_led_platform_data gta02_gpio_leds_pdata = {
-+ .leds = gta02_gpio_leds,
-+ .num_leds = ARRAY_SIZE(gta02_gpio_leds),
-+};
-
--static void gta02_bl_set_intensity(int intensity)
-+static struct platform_device gta02_leds_device = {
-+ .name = "leds-gpio",
-+ .id = -1,
-+ .dev = {
-+ .platform_data = >a02_gpio_leds_pdata,
-+ },
-+};
++ if (!strcmp(attr->attr.name, "power_on")) {
++ rfkill_set_sw_state(bt_data->rfkill, on ? 1 : 0);
+
-+static inline int gta02_pwm_to_gpio(int pwm_id)
- {
-- struct pcf50633 *pcf = gta02_pcf;
-- int old_intensity = pcf50633_reg_read(pcf, PCF50633_REG_LEDOUT);
-+ return S3C2410_GPB(pwm_id);
++ __gta02_pm_bt_toggle_radio(dev, on);
++ } else if (!strcmp(attr->attr.name, "reset")) {
++ /* reset is low-active, so we need to invert */
++ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, on ? 0 : 1);
++ }
++
++ return count;
+}
-
-- /* We map 8-bit intensity to 6-bit intensity in hardware. */
-- intensity >>= 2;
-+static int gta02_pwm_led_init(struct device *dev, struct led_pwm *led)
++
++static DEVICE_ATTR(power_on, 0644, bt_read, bt_write);
++static DEVICE_ATTR(reset, 0644, bt_read, bt_write);
++
++#ifdef CONFIG_PM
++static int gta02_bt_suspend(struct platform_device *pdev, pm_message_t state)
+{
-+ int ret;
-+ int gpio = gta02_pwm_to_gpio(led->pwm_id);
-
-- /*
-- * This can happen during, eg, print of panic on blanked console,
-- * but we can't service i2c without interrupts active, so abort.
-- */
-- if (in_atomic()) {
-- printk(KERN_ERR "gta02_bl_set_intensity called while atomic\n");
-- return;
-+ ret = gpio_request(gpio, dev_name(dev));
-+ if (ret)
-+ return ret;
++ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
+
-+ gpio_direction_output(gpio, 0);
++ dev_dbg(&pdev->dev, DRVMSG ": suspending\n");
++
++ bt_data->pre_resume_state = s3c2410_gpio_getpin(GTA02_GPIO_BT_EN);
++ __gta02_pm_bt_toggle_radio(&pdev->dev, 0);
+
+ return 0;
+}
+
-+static enum led_brightness gta02_pwm_led_notify(struct device *dev,
-+ struct led_pwm *led, enum led_brightness brightness)
++static int gta02_bt_resume(struct platform_device *pdev)
+{
-+ int gpio = gta02_pwm_to_gpio(led->pwm_id);
-+
-+ if (brightness == led->max_brightness || brightness == 0) {
-+ s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
-+ gpio_set_value(gpio, brightness ? 1 : 0);
++ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
++ dev_dbg(&pdev->dev, DRVMSG ": resuming\n");
+
-+ brightness = 0;
-+ } else {
-+ s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_SFN2);
- }
-
-- old_intensity = pcf50633_reg_read(pcf, PCF50633_REG_LEDOUT);
-- if (intensity == old_intensity)
-- return;
-+ return brightness;
++ __gta02_pm_bt_toggle_radio(&pdev->dev, bt_data->pre_resume_state);
++ return 0;
+}
++#else
++#define gta02_bt_suspend NULL
++#define gta02_bt_resume NULL
++#endif
+
-+static void gta02_pwm_led_exit(struct device *dev, struct led_pwm *led)
++static struct attribute *gta02_bt_sysfs_entries[] = {
++ &dev_attr_power_on.attr,
++ &dev_attr_reset.attr,
++ NULL
++};
++
++static struct attribute_group gta02_bt_attr_group = {
++ .name = NULL,
++ .attrs = gta02_bt_sysfs_entries,
++};
++
++static int __init gta02_bt_probe(struct platform_device *pdev)
+{
-+ gpio_free(gta02_pwm_to_gpio(led->pwm_id));
-+}
++ struct rfkill *rfkill;
++ struct regulator *regulator;
++ struct gta02_pm_bt_data *bt_data;
++ int ret;
+
-+static struct led_pwm gta02_pwm_leds[] = {
-+ {
-+ .name = "gta02:orange:power",
-+ .max_brightness = 0xff,
-+ .pwm_period_ns = 1000000,
-+ .pwm_id = 0,
-+ },
-+ {
-+ .name = "gta02:blue:power",
-+ .max_brightness = 0xff,
-+ .pwm_period_ns = 1000000,
-+ .pwm_id = 1,
-+ },
-+ {
-+ .name = "gta02::vibrator",
-+ .max_brightness = 0x3f,
-+ .pwm_period_ns = 60000000,
-+ .pwm_id = 3,
-+ }
-+};
-
-- /* We can't do this anywhere else. */
-- pcf50633_reg_write(pcf, PCF50633_REG_LEDDIM, 5);
-+static struct led_pwm_platform_data gta02_pwm_leds_pdata = {
-+ .num_leds = ARRAY_SIZE(gta02_pwm_leds),
-+ .leds = gta02_pwm_leds,
-
-- if (!(pcf50633_reg_read(pcf, PCF50633_REG_LEDENA) & 3))
-- old_intensity = 0;
-+ .init = gta02_pwm_led_init,
-+ .notify = gta02_pwm_led_notify,
-+ .exit = gta02_pwm_led_exit,
-+};
-
-- /*
-- * The PCF50633 cannot handle LEDOUT = 0 (datasheet p60)
-- * if seen, you have to re-enable the LED unit.
-- */
-- if (!intensity || !old_intensity)
-- pcf50633_reg_write(pcf, PCF50633_REG_LEDENA, 0);
-+static struct platform_device gta02_pwm_leds_device = {
-+ .name = "leds_pwm",
-+ .id = -1,
-+ .dev = {
-+ .platform_data = >a02_pwm_leds_pdata,
-+ }
-+};
-+
-+/* BQ27000 Battery */
++ dev_info(&pdev->dev, DRVMSG ": starting\n");
+
-+struct bq27000_platform_data bq27000_pdata = {
-+ .name = "battery",
-+ .rsense_mohms = 20,
-+ .hdq_read = hdq_read,
-+ .hdq_write = hdq_write,
-+ .hdq_initialized = hdq_initialized,
-+ .get_charger_online_status = gta02_get_charger_online_status,
-+ .get_charger_active_status = gta02_get_charger_active_status
-+};
++ bt_data = kzalloc(sizeof(*bt_data), GFP_KERNEL);
++ dev_set_drvdata(&pdev->dev, bt_data);
+
-+struct platform_device bq27000_battery_device = {
-+ .name = "bq27000-battery",
-+ .dev = {
-+ .platform_data = &bq27000_pdata,
-+ },
-+};
++ regulator = regulator_get(&pdev->dev, "BT_3V2");
++ if (IS_ERR(regulator))
++ return -ENODEV;
+
-+/* Platform battery */
++ bt_data->regulator = regulator;
+
-+/* Capacity of a typical BL-5C dumb battery */
-+#define GTA02_BAT_CHARGE_FULL 850000
++ /* this tests the true physical state of the regulator... */
++ if (regulator_is_enabled(regulator)) {
++ /*
++ * but these only operate on the logical state of the
++ * regulator... so we need to logicaly "adopt" it on
++ * to turn it off
++ */
++ regulator_enable(regulator);
++ regulator_disable(regulator);
++ }
+
-+static int gta02_bat_voltscale(int volt)
-+{
-+ /* This table is suggested by SpeedEvil based on analysis of
-+ * experimental data */
-+ static const int lut[][2] = {
-+ { 4120, 100 },
-+ { 3900, 60 },
-+ { 3740, 25 },
-+ { 3600, 5 },
-+ { 3000, 0 } };
-+ int i, res = 0;
++ /* we pull reset to low to make sure that the chip doesn't
++ * drain power through the reset line */
++ s3c2410_gpio_setpin(GTA02_GPIO_BT_EN, 0);
+
-+ if (volt > lut[0][0])
-+ res = lut[0][1];
-+ else
-+ for (i = 0; lut[i][1]; i++) {
-+ if (volt <= lut[i][0] && volt >= lut[i+1][0]) {
-+ res = lut[i][1] - (lut[i][0]-volt)*
-+ (lut[i][1]-lut[i+1][1])/
-+ (lut[i][0]-lut[i+1][0]);
-+ break;
-+ }
-+ }
-+ return res;
-+}
++ rfkill = rfkill_alloc(pdev->name, &pdev->dev, RFKILL_TYPE_BLUETOOTH,
++ >a02_bt_rfkill_ops, &pdev->dev);
+
-+static int gta02_bat_get_voltage(void)
-+{
-+ struct pcf50633 *pcf = gta02_pcf;
-+ u16 adc, mv = 0;
-+ adc = pcf50633_adc_sync_read(pcf,
-+ PCF50633_ADCC1_MUX_BATSNS_RES,
-+ PCF50633_ADCC1_AVERAGE_16);
-+ /* The formula from DS is for divide-by-two mode, current driver uses
-+ divide-by-three */
-+ mv = (adc * 6000) / 1023;
-+ return mv * 1000;
-+}
-
-- /* Illegal to set LEDOUT to 0. */
-- if (!intensity)
-- pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_LEDOUT, 0x3f, 2);
-+static int gta02_bat_get_present(void)
-+{
-+ /* There is no reliable way to tell if it is present or not */
-+ return 1;
-+}
++ if (!rfkill) {
++ dev_err(&pdev->dev, "Failed to allocate rfkill\n");
++ return -ENOMEM;
++ }
+
-+static int gta02_bat_get_status(void)
-+{
-+#ifdef CONFIG_CHARGER_PCF50633
-+ if (gta02_get_charger_active_status())
-+ return POWER_SUPPLY_STATUS_CHARGING;
- else
-- pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_LEDOUT, 0x3f,
-- intensity);
-+ return POWER_SUPPLY_STATUS_DISCHARGING;
-+#else
-+ return POWER_SUPPLY_STATUS_UNKNOWN;
-+#endif
-+}
-
-- if (intensity)
-- pcf50633_reg_write(pcf, PCF50633_REG_LEDENA, 2);
-+static int gta02_bat_get_capacity(void)
-+{
-+ return gta02_bat_voltscale(gta02_bat_get_voltage()/1000);
-+}
++ rfkill_init_sw_state(rfkill, 0);
+
-+static int gta02_bat_get_charge_full(void)
-+{
-+ return GTA02_BAT_CHARGE_FULL;
-+}
-
-+static int gta02_bat_get_charge_now(void)
-+{
-+ return gta02_bat_get_capacity() * gta02_bat_get_charge_full() / 100;
- }
-
--static struct generic_bl_info gta02_bl_info = {
-- .name = "gta02-bl",
-- .max_intensity = 0xff,
-- .default_intensity = 0xff,
-- .set_bl_intensity = gta02_bl_set_intensity,
-+static enum power_supply_property gta02_platform_bat_properties[] = {
-+ POWER_SUPPLY_PROP_PRESENT,
-+ POWER_SUPPLY_PROP_STATUS,
-+ POWER_SUPPLY_PROP_VOLTAGE_NOW,
-+ POWER_SUPPLY_PROP_CAPACITY,
-+ POWER_SUPPLY_PROP_CHARGE_FULL,
-+ POWER_SUPPLY_PROP_CHARGE_NOW,
-+};
++ ret = rfkill_register(rfkill);
++ if (ret) {
++ rfkill_destroy(rfkill);
++ dev_err(&pdev->dev, "Failed to register rfkill\n");
++ return ret;
++ }
+
-+int (*gta02_platform_bat_get_property[])(void) = {
-+ gta02_bat_get_present,
-+ gta02_bat_get_status,
-+ gta02_bat_get_voltage,
-+ gta02_bat_get_capacity,
-+ gta02_bat_get_charge_full,
-+ gta02_bat_get_charge_now,
-+};
++ bt_data->rfkill = rfkill;
+
-+static struct platform_bat_platform_data gta02_platform_bat_pdata = {
-+ .name = "battery",
-+ .properties = gta02_platform_bat_properties,
-+ .num_properties = ARRAY_SIZE(gta02_platform_bat_properties),
-+ .get_property = gta02_platform_bat_get_property,
-+ .is_present = gta02_bat_get_present,
- };
-
--static struct platform_device gta02_bl_dev = {
-- .name = "generic-bl",
-- .id = 1,
-+struct platform_device gta02_platform_bat = {
-+ .name = "platform_battery",
-+ .id = -1,
- .dev = {
-- .platform_data = >a02_bl_info,
-- },
-+ .platform_data = >a02_platform_bat_pdata,
-+ }
- };
-
-+/* HDQ */
-
-+static void gta02_hdq_gpio_direction_out(void)
-+{
-+ s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_OUTPUT);
-+}
-
--/* USB */
--static struct s3c2410_hcd_info gta02_usb_info __initdata = {
-- .port[0] = {
-- .flags = S3C_HCDFLG_USED,
-- },
-- .port[1] = {
-- .flags = 0,
-- },
-+static void gta02_hdq_gpio_direction_in(void)
-+{
-+ s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_INPUT);
++ return sysfs_create_group(&pdev->dev.kobj, >a02_bt_attr_group);
+}
+
-+static void gta02_hdq_gpio_set_value(int val)
++static int gta02_bt_remove(struct platform_device *pdev)
+{
-+ s3c2410_gpio_setpin(GTA02v5_GPIO_HDQ, val);
-+}
++ struct gta02_pm_bt_data *bt_data = dev_get_drvdata(&pdev->dev);
++ struct regulator *regulator;
+
-+static int gta02_hdq_gpio_get_value(void)
-+{
-+ return s3c2410_gpio_getpin(GTA02v5_GPIO_HDQ);
-+}
++ sysfs_remove_group(&pdev->dev.kobj, >a02_bt_attr_group);
+
-+struct hdq_platform_data gta02_hdq_platform_data = {
-+ .gpio_dir_out = gta02_hdq_gpio_direction_out,
-+ .gpio_dir_in = gta02_hdq_gpio_direction_in,
-+ .gpio_set = gta02_hdq_gpio_set_value,
-+ .gpio_get = gta02_hdq_gpio_get_value,
++ if (bt_data->rfkill) {
++ rfkill_destroy(bt_data->rfkill);
++ }
+
-+ .enable_fiq = gta02_fiq_enable,
-+ .disable_fiq = gta02_fiq_disable,
-+ .kick_fiq = gta02_fiq_kick,
- };
-
-+struct platform_device gta02_hdq_device = {
-+ .name = "hdq",
-+ .id = -1,
-+ .dev = {
-+ .platform_data = >a02_hdq_platform_data,
-+ .parent = &s3c_device_timer[2].dev,
-+ },
-+};
-
- static void __init gta02_map_io(void)
- {
-@@ -571,18 +1078,30 @@ static struct platform_device *gta02_devices[] __initdata = {
- &s3c_device_usbgadget,
- &s3c_device_nand,
- >a02_nor_flash,
-- &s3c24xx_pwm_device,
-+ &s3c_device_timer[0],
-+ &s3c_device_timer[1],
-+ &s3c_device_timer[2],
-+ &s3c_device_timer[3],
- &s3c_device_iis,
- &s3c_device_i2c0,
-+ >a02_buttons_device,
-+ >a02_leds_device,
-+ >a02_pwm_leds_device,
-+ >a02_pm_gps_dev,
-+ >a02_pm_bt_dev,
-+ >a02_pm_wlan_dev,
-+ >a02_glamo_dev,
-+ &s3c_device_adc,
-+ &s3c_device_ts,
- };
-
- /* These guys DO need to be children of PMU. */
-
- static struct platform_device *gta02_devices_pmu_children[] = {
-- >a02_bl_dev,
-+ >a02_hdq_device,
-+ >a02_platform_bat,
- };
-
--
- /*
- * This is called when pc50633 is probed, quite late in the day since it is an
- * I2C bus device. Here we can define platform devices with the advantage that
-@@ -612,11 +1131,184 @@ static void gta02_poweroff(void)
- pcf50633_reg_set_bit_mask(gta02_pcf, PCF50633_REG_OOCSHDWN, 1, 1);
- }
-
-+struct gta02_device_children {
-+ const char *dev_name;
-+ size_t num_children;
-+ struct platform_device **children;
-+ void (*probed_callback)(struct device *dev);
-+};
++ if (!bt_data || !bt_data->regulator)
++ return 0;
+
-+static struct platform_device* gta02_pcf50633_gpio_children[] = {
-+ >a02_gsm_supply_device,
-+};
++ regulator = bt_data->regulator;
+
-+static struct platform_device* gta02_gsm_supply_children[] = {
-+ >a02_pm_gsm_dev,
-+};
++ /* Make sure regulator is disabled before calling regulator_put */
++ if (regulator_is_enabled(regulator))
++ regulator_disable(regulator);
+
-+static struct platform_device* gta02_hdq_children[] = {
-+ &bq27000_battery_device,
-+};
++ regulator_put(regulator);
+
++ kfree(bt_data);
+
-+static struct gta02_device_children gta02_device_children[] = {
-+ {
-+ .dev_name = "pcf50633-gpio.0",
-+ .num_children = 1,
-+ .children = gta02_pcf50633_gpio_children,
-+ },
-+ {
-+ .dev_name = "reg-fixed-voltage.1",
-+ .num_children = 1,
-+ .children = gta02_gsm_supply_children,
-+ },
-+ {
-+ .dev_name = "spi2.0",
-+ .probed_callback = gta02_jbt6k74_probe_completed,
-+ },
-+ {
-+ .dev_name = "hdq",
-+ .num_children = 1,
-+ .children = gta02_hdq_children,
++ return 0;
++}
++
++static struct platform_driver gta02_bt_driver = {
++ .probe = gta02_bt_probe,
++ .remove = gta02_bt_remove,
++ .suspend = gta02_bt_suspend,
++ .resume = gta02_bt_resume,
++ .driver = {
++ .name = "gta02-pm-bt",
+ },
+};
+
-+static int gta02_add_child_devices(struct device *parent,
-+ struct platform_device **children,
-+ size_t num_children)
++static int __devinit gta02_bt_init(void)
+{
-+ size_t i;
-+
-+ for (i = 0; i < num_children; ++i)
-+ children[i]->dev.parent = parent;
-+
-+ return platform_add_devices(children, num_children);
++ return platform_driver_register(>a02_bt_driver);
+}
++module_init(gta02_bt_init);
+
-+static int gta02_device_registered(struct notifier_block *block,
-+ unsigned long action, void *data)
++static void gta02_bt_exit(void)
+{
-+ struct device *dev = data;
-+ const char *devname = dev_name(dev);
-+ size_t i;
++ platform_driver_unregister(>a02_bt_driver);
++}
++module_exit(gta02_bt_exit);
+
-+ if (action != BUS_NOTIFY_BOUND_DRIVER)
-+ return 0;
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
++MODULE_DESCRIPTION(DRVMSG);
+diff --git a/arch/arm/mach-s3c2440/gta02-pm-gps.c b/arch/arm/mach-s3c2440/gta02-pm-gps.c
+new file mode 100644
+index 0000000..9721f9a
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/gta02-pm-gps.c
+@@ -0,0 +1,222 @@
++/*
++ * GPS Power Management code for the Openmoko Freerunner GSM Phone
++ *
++ * (C) 2007-2009 by Openmoko Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation
++ *
++ */
+
-+ for (i = 0; i < ARRAY_SIZE(gta02_device_children); ++i) {
-+ if (strcmp(devname, gta02_device_children[i].dev_name) == 0) {
-+ gta02_add_child_devices(dev, gta02_device_children[i].children,
-+ gta02_device_children[i].num_children);
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/platform_device.h>
+
-+ if (gta02_device_children[i].probed_callback)
-+ gta02_device_children[i].probed_callback(dev);
-+ break;
-+ }
-+ }
++#include <mach/hardware.h>
++#include <mach/gpio-fns.h>
+
-+ return 0;
-+}
++#include <mach/gta02.h>
+
-+static struct notifier_block gta02_device_register_notifier = {
-+ .notifier_call = gta02_device_registered,
-+ .priority = INT_MAX,
-+};
++#include <linux/regulator/consumer.h>
++#include <linux/err.h>
+
++struct gta02_pm_gps_data {
++#ifdef CONFIG_PM
++ int keep_on_in_suspend;
++#endif
++ int power_was_on;
++ struct regulator *regulator;
++};
+
-+/* On hardware rev 5 and earlier the leds are missing a resistor and reading
-+ * from their gpio pins will always return 0, so we have to shadow the
-+ * led states software */
-+static unsigned long gpb_shadow;
-+extern struct s3c_gpio_chip s3c24xx_gpios[];
++static struct gta02_pm_gps_data gta02_gps;
+
-+static void gta02_gpb_set(struct gpio_chip *chip,
-+ unsigned offset, int value)
++int gta02_pm_gps_is_on(void)
+{
-+ void __iomem *base = S3C24XX_GPIO_BASE(S3C2410_GPB(0));
-+ unsigned long flags;
-+ unsigned long dat;
++ return gta02_gps.power_was_on;
++}
++EXPORT_SYMBOL_GPL(gta02_pm_gps_is_on);
+
-+ local_irq_save(flags);
++/* This is the POWERON pin */
++static void gps_pwron_set(int on)
++{
++ if (on) {
++ /* return UART pins to being UART pins */
++ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPH4_TXD1);
++ /* remove pulldown now it won't be floating any more */
++ s3c2410_gpio_pullup(S3C2410_GPH(5), 0);
+
-+ dat = __raw_readl(base + 0x04) | gpb_shadow;
-+ dat &= ~(1 << offset);
-+ gpb_shadow &= ~(1 << offset);
-+ if (value) {
-+ dat |= 1 << offset;
-+ switch (offset) {
-+ case 0 ... 2:
-+ gpb_shadow |= 1 << offset;
-+ break;
-+ default:
-+ break;
-+ }
++ if (!gta02_gps.power_was_on)
++ regulator_enable(gta02_gps.regulator);
++ } else {
++ /*
++ * take care not to power unpowered GPS from UART TX
++ * return them to GPIO and force low
++ */
++ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPIO_OUTPUT);
++ s3c2410_gpio_setpin(S3C2410_GPH(4), 0);
++ /* don't let RX from unpowered GPS float */
++ s3c2410_gpio_pullup(S3C2410_GPH(5), 1);
++ if (gta02_gps.power_was_on)
++ regulator_disable(gta02_gps.regulator);
+ }
-+ __raw_writel(dat, base + 0x04);
-+
-+ local_irq_restore(flags);
+}
+
-+static int gta02_gpb_get(struct gpio_chip *chip, unsigned offset)
++static int gps_pwron_get(void)
+{
-+ void __iomem *base = S3C24XX_GPIO_BASE(S3C2410_GPB(0));
-+ unsigned long val;
-+
-+ val = __raw_readl(base + 0x04) | gpb_shadow;
-+ val >>= offset;
-+ val &= 1;
-+
-+ return val;
++ return regulator_is_enabled(gta02_gps.regulator);
+}
+
-+static void gta02_hijack_gpb(void)
++#ifdef CONFIG_PM
++/* This is the flag for keeping gps ON during suspend */
++static void gps_keep_on_in_suspend_set(int on)
+{
-+/* Uncomment this, once support for S3C_SYSTEM_REV_ATAG has been merged
-+ * upstream.
-+ if (S3C_SYSTEM_REV_ATAG > GTA02v5_SYSTEM_REV)
-+ return;
-+*/
-+
-+ s3c24xx_gpios[1].chip.set = gta02_gpb_set;
-+ s3c24xx_gpios[1].chip.get = gta02_gpb_get;
++ gta02_gps.keep_on_in_suspend = on;
+}
+
-+/*
-+ * Allow the bootloader to enable hw ecc
-+ * hardware_ecc=1|0
-+ */
-+static int __init hardware_ecc_setup(char *str)
++static int gps_keep_on_in_suspend_get(void)
+{
-+ if (str && str[0] == '1')
-+ gta02_nand_info.software_ecc = 0;
-+ return 1;
++ return gta02_gps.keep_on_in_suspend;
+}
-+__setup("hardware_ecc=", hardware_ecc_setup);
++#endif
+
-+static void gta02_request_gpios(void)
++static ssize_t power_gps_read(struct device *dev,
++ struct device_attribute *attr, char *buf)
+{
-+ int ret;
-+ ret = gpio_request(GTA02_GPIO_USB_PULLUP, "USB pullup");
-+ if (ret) {
-+ printk(KERN_ERR "Failed to request USB pullup gpio pin: %d\n", ret);
-+ } else {
-+ ret = gpio_direction_output(GTA02_GPIO_USB_PULLUP, 0);
-+ if (ret)
-+ printk(KERN_ERR "Failed to set USB pullup gpio direction: %d\n", ret);
-+ }
-+}
-+
- static void __init gta02_machine_init(void)
- {
- /* Set the panic callback to make AUX LED blink at ~5Hz. */
- panic_blink = gta02_panic_blink;
-
-+ bus_register_notifier(&platform_bus_type, >a02_device_register_notifier);
-+ bus_register_notifier(&spi_bus_type, >a02_device_register_notifier);
-+
-+ gta02_hijack_gpb();
++ int ret = 0;
+
-+ gta02_request_gpios();
++ if (!strcmp(attr->attr.name, "power_on"))
++ ret = gps_pwron_get();
++#ifdef CONFIG_PM
++ else if (!strcmp(attr->attr.name, "keep_on_in_suspend"))
++ ret = gps_keep_on_in_suspend_get();
++#endif
++ if (ret)
++ return strlcpy(buf, "1\n", 3);
++ else
++ return strlcpy(buf, "0\n", 3);
++}
+
- s3c_pm_init();
-
- #ifdef CONFIG_CHARGER_PCF50633
-@@ -624,13 +1316,17 @@ static void __init gta02_machine_init(void)
- #endif
-
- s3c24xx_udc_set_platdata(>a02_udc_cfg);
-+ s3c24xx_ts_set_platdata(>a02_ts_info);
- s3c_ohci_set_platdata(>a02_usb_info);
- s3c_nand_set_platdata(>a02_nand_info);
- s3c_i2c0_set_platdata(NULL);
-+ spi_register_board_info(gta02_spi_board_info,
-+ ARRAY_SIZE(gta02_spi_board_info));
-
- i2c_register_board_info(0, gta02_i2c_devs, ARRAY_SIZE(gta02_i2c_devs));
-
- platform_add_devices(gta02_devices, ARRAY_SIZE(gta02_devices));
++static ssize_t power_gps_write(struct device *dev,
++ struct device_attribute *attr, const char *buf,
++ size_t count)
++{
++ unsigned long on = simple_strtoul(buf, NULL, 10);
+
- pm_power_off = gta02_poweroff;
- }
-
-diff --git a/arch/arm/plat-s3c24xx/gpiolib.c b/arch/arm/plat-s3c24xx/gpiolib.c
-index 4f0f11a..c0b0366 100644
---- a/arch/arm/plat-s3c24xx/gpiolib.c
-+++ b/arch/arm/plat-s3c24xx/gpiolib.c
-@@ -26,6 +26,7 @@
- #include <plat/pm.h>
-
- #include <mach/regs-gpio.h>
-+#include <mach/regs-gpioj.h>
-
- static int s3c24xx_gpiolib_banka_input(struct gpio_chip *chip, unsigned offset)
- {
-@@ -160,8 +161,16 @@ struct s3c_gpio_chip s3c24xx_gpios[] = {
- .label = "GPIOH",
- .ngpio = 11,
- },
-- },
--};
-+ }, {
-+ .base = S3C2440_GPJCON,
-+ .pm = __gpio_pm(&s3c_gpio_pm_2bit),
-+ .chip = {
-+ .base = S3C2440_GPJ0,
-+ .owner = THIS_MODULE,
-+ .label = "GPIOJ",
-+ .ngpio = 11,
-+ },
-+ },};
-
- static __init int s3c24xx_gpiolib_init(void)
- {
-diff --git a/arch/arm/plat-s3c24xx/include/plat/irq.h b/arch/arm/plat-s3c24xx/include/plat/irq.h
-index 69e1be8..11a8664 100644
---- a/arch/arm/plat-s3c24xx/include/plat/irq.h
-+++ b/arch/arm/plat-s3c24xx/include/plat/irq.h
-@@ -12,6 +12,7 @@
-
- #include <linux/io.h>
-
-+#include <mach/irqs.h>
- #include <mach/hardware.h>
- #include <mach/regs-irq.h>
- #include <mach/regs-gpio.h>
-@@ -31,8 +32,15 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
- {
- unsigned long mask;
- unsigned long submask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ unsigned long flags;
-+#endif
-
- submask = __raw_readl(S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_save_flags(flags);
-+ local_fiq_disable();
-+#endif
- mask = __raw_readl(S3C2410_INTMSK);
-
- submask |= (1UL << (irqno - IRQ_S3CUART_RX0));
-@@ -45,6 +53,9 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
-
- /* write back masks */
- __raw_writel(submask, S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_irq_restore(flags);
-+#endif
-
- }
-
-@@ -53,8 +64,15 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
- {
- unsigned long mask;
- unsigned long submask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ unsigned long flags;
-+#endif
-
- submask = __raw_readl(S3C2410_INTSUBMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_save_flags(flags);
-+ local_fiq_disable();
-+#endif
- mask = __raw_readl(S3C2410_INTMSK);
-
- submask &= ~(1UL << (irqno - IRQ_S3CUART_RX0));
-@@ -63,6 +81,9 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
- /* write back masks */
- __raw_writel(submask, S3C2410_INTSUBMSK);
- __raw_writel(mask, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_irq_restore(flags);
-+#endif
- }
-
-
-diff --git a/arch/arm/plat-s3c24xx/irq.c b/arch/arm/plat-s3c24xx/irq.c
-index ad0d44e..0a8553b 100644
---- a/arch/arm/plat-s3c24xx/irq.c
-+++ b/arch/arm/plat-s3c24xx/irq.c
-@@ -28,6 +28,8 @@
- #include <asm/mach/irq.h>
-
- #include <plat/regs-irqtype.h>
-+#include <mach/regs-irq.h>
-+#include <mach/regs-gpio.h>
-
- #include <plat/cpu.h>
- #include <plat/pm.h>
-@@ -37,12 +39,20 @@ static void
- s3c_irq_mask(unsigned int irqno)
- {
- unsigned long mask;
--
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ unsigned long flags;
-+#endif
- irqno -= IRQ_EINT0;
--
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_save_flags(flags);
-+ local_fiq_disable();
-+#endif
- mask = __raw_readl(S3C2410_INTMSK);
- mask |= 1UL << irqno;
- __raw_writel(mask, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_irq_restore(flags);
-+#endif
- }
-
- static inline void
-@@ -59,9 +69,19 @@ s3c_irq_maskack(unsigned int irqno)
- {
- unsigned long bitval = 1UL << (irqno - IRQ_EINT0);
- unsigned long mask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ unsigned long flags;
-+#endif
-
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_save_flags(flags);
-+ local_fiq_disable();
-+#endif
- mask = __raw_readl(S3C2410_INTMSK);
- __raw_writel(mask|bitval, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_irq_restore(flags);
-+#endif
-
- __raw_writel(bitval, S3C2410_SRCPND);
- __raw_writel(bitval, S3C2410_INTPND);
-@@ -72,15 +92,25 @@ static void
- s3c_irq_unmask(unsigned int irqno)
- {
- unsigned long mask;
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ unsigned long flags;
-+#endif
-
- if (irqno != IRQ_TIMER4 && irqno != IRQ_EINT8t23)
- irqdbf2("s3c_irq_unmask %d\n", irqno);
-
- irqno -= IRQ_EINT0;
-
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_save_flags(flags);
-+ local_fiq_disable();
-+#endif
- mask = __raw_readl(S3C2410_INTMSK);
- mask &= ~(1UL << irqno);
- __raw_writel(mask, S3C2410_INTMSK);
-+#ifdef CONFIG_S3C2440_C_FIQ
-+ local_irq_restore(flags);
++ if (!strcmp(attr->attr.name, "power_on")) {
++ gps_pwron_set(on);
++ gta02_gps.power_was_on = !!on;
++#ifdef CONFIG_PM
++ } else if (!strcmp(attr->attr.name, "keep_on_in_suspend")) {
++ gps_keep_on_in_suspend_set(on);
+#endif
- }
-
- struct irq_chip s3c_irq_level_chip = {
-@@ -561,26 +591,26 @@ void __init s3c24xx_init_irq(void)
-
- last = 0;
- for (i = 0; i < 4; i++) {
-- pend = __raw_readl(S3C2410_INTPND);
-+ pend = __raw_readl(S3C2410_SUBSRCPND);
-
- if (pend == 0 || pend == last)
- break;
-
-- __raw_writel(pend, S3C2410_SRCPND);
-- __raw_writel(pend, S3C2410_INTPND);
-- printk("irq: clearing pending status %08x\n", (int)pend);
-+ printk("irq: clearing subpending status %08x\n", (int)pend);
-+ __raw_writel(pend, S3C2410_SUBSRCPND);
- last = pend;
- }
-
- last = 0;
- for (i = 0; i < 4; i++) {
-- pend = __raw_readl(S3C2410_SUBSRCPND);
-+ pend = __raw_readl(S3C2410_INTPND);
-
- if (pend == 0 || pend == last)
- break;
-
-- printk("irq: clearing subpending status %08x\n", (int)pend);
-- __raw_writel(pend, S3C2410_SUBSRCPND);
-+ __raw_writel(pend, S3C2410_SRCPND);
-+ __raw_writel(pend, S3C2410_INTPND);
-+ printk("irq: clearing pending status %08x\n", (int)pend);
- last = pend;
- }
-
-@@ -631,15 +661,13 @@ void __init s3c24xx_init_irq(void)
-
- for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
- irqdbf("registering irq %d (ext int)\n", irqno);
-- set_irq_chip(irqno, &s3c_irq_eint0t4);
-- set_irq_handler(irqno, handle_edge_irq);
-+ set_irq_chip_and_handler(irqno, &s3c_irq_eint0t4, handle_level_irq);
- set_irq_flags(irqno, IRQF_VALID);
- }
-
- for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
- irqdbf("registering irq %d (extended s3c irq)\n", irqno);
-- set_irq_chip(irqno, &s3c_irqext_chip);
-- set_irq_handler(irqno, handle_edge_irq);
-+ set_irq_chip_and_handler(irqno, &s3c_irqext_chip, handle_level_irq);
- set_irq_flags(irqno, IRQF_VALID);
- }
-
-diff --git a/arch/arm/plat-samsung/include/plat/nand.h b/arch/arm/plat-samsung/include/plat/nand.h
-index b64115f..cbdc8f0 100644
---- a/arch/arm/plat-samsung/include/plat/nand.h
-+++ b/arch/arm/plat-samsung/include/plat/nand.h
-@@ -49,6 +49,7 @@ struct s3c2410_platform_nand {
- int twrph1; /* time for release CLE/ALE from nWE/nOE inactive */
-
- unsigned int ignore_unset_ecc:1;
-+ unsigned int software_ecc:1; /* force software ecc at runtime */
-
- int nr_sets;
- struct s3c2410_nand_set *sets;
-diff --git a/arch/arm/plat-samsung/include/plat/uncompress.h b/arch/arm/plat-samsung/include/plat/uncompress.h
-index 7d6ed72..152c496 100644
---- a/arch/arm/plat-samsung/include/plat/uncompress.h
-+++ b/arch/arm/plat-samsung/include/plat/uncompress.h
-@@ -37,6 +37,8 @@ static void arch_detect_cpu(void);
- /* how many bytes we allow into the FIFO at a time in FIFO mode */
- #define FIFO_MAX (14)
-
-+#if CONFIG_S3C_LOWLEVEL_UART_PORT >= 0
++ }
++ return count;
++}
+
- #define uart_base S3C_PA_UART + (S3C_UART_OFFSET * CONFIG_S3C_LOWLEVEL_UART_PORT)
-
- static __inline__ void
-@@ -86,10 +88,6 @@ static void putc(int ch)
- uart_wr(S3C2410_UTXH, ch);
- }
-
--static inline void flush(void)
--{
--}
--
- #define __raw_writel(d, ad) \
- do { \
- *((volatile unsigned int __force *)(ad)) = (d); \
-@@ -161,6 +159,19 @@ static inline void arch_enable_uart_fifo(void)
- #define arch_enable_uart_fifo() do { } while(0)
- #endif
-
-+#else
-+static inline void putc(int ch)
++#ifdef CONFIG_PM
++static int gta02_pm_gps_suspend(struct device *dev)
+{
++ if (!gta02_gps.keep_on_in_suspend ||
++ !gta02_gps.power_was_on)
++ gps_pwron_set(0);
++ else
++ dev_warn(dev, "GTA02: keeping gps ON "
++ "during suspend\n");
++ return 0;
+}
+
-+#define arch_enable_uart_fifo() do { } while(0)
-+#define arch_decomp_wdog_start()
-+#define arch_decomp_wdog()
-+#endif
-+
-+static inline void flush(void)
++static int gta02_pm_gps_resume(struct device *dev)
+{
++ if (!gta02_gps.keep_on_in_suspend && gta02_gps.power_was_on)
++ gps_pwron_set(1);
++
++ return 0;
+}
-
- static void
- arch_decomp_setup(void)
-diff --git a/drivers/Kconfig b/drivers/Kconfig
-index a2b902f..a211562 100644
---- a/drivers/Kconfig
-+++ b/drivers/Kconfig
-@@ -111,4 +111,6 @@ source "drivers/xen/Kconfig"
- source "drivers/staging/Kconfig"
-
- source "drivers/platform/Kconfig"
+
-+source "drivers/ar6000/Kconfig"
- endmenu
-diff --git a/drivers/Makefile b/drivers/Makefile
-index f42a030..8794a27 100644
---- a/drivers/Makefile
-+++ b/drivers/Makefile
-@@ -94,6 +94,7 @@ obj-$(CONFIG_CPU_IDLE) += cpuidle/
- obj-y += idle/
- obj-$(CONFIG_MMC) += mmc/
- obj-$(CONFIG_MEMSTICK) += memstick/
-+obj-$(CONFIG_AR6000_WLAN) += ar6000/
- obj-$(CONFIG_NEW_LEDS) += leds/
- obj-$(CONFIG_INFINIBAND) += infiniband/
- obj-$(CONFIG_SGI_SN) += sn/
-diff --git a/drivers/ar6000/Kconfig b/drivers/ar6000/Kconfig
-new file mode 100644
-index 0000000..29b28b8
---- /dev/null
-+++ b/drivers/ar6000/Kconfig
-@@ -0,0 +1,32 @@
-+config AR6000_WLAN
-+ tristate "AR6000 wireless networking over SDIO"
-+ depends on MMC
-+ select WIRELESS_EXT
-+ select WEXT_PRIV
-+ default m
-+ help
-+ good luck.
++static DEVICE_ATTR(keep_on_in_suspend, 0644, power_gps_read, power_gps_write);
+
-+config AR6000_WLAN_DEBUG
-+ bool "Enable retrieval of firmware debugging information"
-+ depends on AR6000_WLAN
-+ default n
-+ help
-+ The AR6k firmware maintains a log of debugging events that
-+ gets flushed to the host on various occasions. Retrieval of
-+ this data is very slow, taking several seconds.
++static struct dev_pm_ops gta02_gps_pm_ops = {
++ .suspend = gta02_pm_gps_suspend,
++ .resume = gta02_pm_gps_resume,
++};
+
-+ If in doubt, say N.
++#define GTA02_GPS_PM_OPS (>a02_gps_pm_ops)
+
-+config AR6000_WLAN_RESET
-+ bool "Soft-reset when shutting down"
-+ depends on AR6000_WLAN
-+ default n
-+ help
-+ The AR6k module can be explicitly reset when shutting down
-+ the device. This adds a delay of about two seconds to suspend,
-+ module removal, and so on. Since the WLAN SDIO function is
-+ generally disabled soon thereafter anyway, this reset seems
-+ superfluous.
++#else
++#define GTA02_GPS_PM_OPS NULL
++#endif
+
-+ If in doubt, say N.
-diff --git a/drivers/ar6000/Makefile b/drivers/ar6000/Makefile
-new file mode 100644
-index 0000000..f8f4431
---- /dev/null
-+++ b/drivers/ar6000/Makefile
-@@ -0,0 +1,38 @@
-+REV ?= 2
++static DEVICE_ATTR(power_on, 0644, power_gps_read, power_gps_write);
+
-+PWD := $(shell pwd)
++static struct attribute *gta02_gps_sysfs_entries[] = {
++ &dev_attr_power_on.attr,
++#ifdef CONFIG_PM
++ &dev_attr_keep_on_in_suspend.attr,
++#endif
++ NULL
++};
+
-+EXTRA_CFLAGS += -I$(src)/include
++static struct attribute_group gta02_gps_attr_group = {
++ .name = NULL,
++ .attrs = gta02_gps_sysfs_entries,
++};
+
-+EXTRA_CFLAGS += -DLINUX -D__KERNEL__ -DHTC_RAW_INTERFACE\
-+ -DTCMD -DUSER_KEYS \
-+ -DNO_SYNC_FLUSH #\
-+ -DMULTIPLE_FRAMES_PER_INTERRUPT -DAR6000REV$(REV) \
-+ -DBLOCK_TX_PATH_FLAG \
-+ -DSDIO \
++static int __init gta02_pm_gps_probe(struct platform_device *pdev)
++{
++ gta02_gps.regulator = regulator_get(&pdev->dev, "RF_3V");
++ if (IS_ERR(gta02_gps.regulator)) {
++ dev_err(&pdev->dev, "probe failed %ld\n",
++ PTR_ERR(gta02_gps.regulator));
+
-+EXTRA_CFLAGS += -DKERNEL_2_6
++ return PTR_ERR(gta02_gps.regulator);
++ }
+
-+obj-$(CONFIG_AR6000_WLAN) += ar6000.o
++ dev_info(&pdev->dev, "starting\n");
+
-+ar6000-objs += htc/ar6k.o \
-+ htc/ar6k_events.o \
-+ htc/htc_send.o \
-+ htc/htc_recv.o \
-+ htc/htc_services.o \
-+ htc/htc.o \
-+ hif/hif2.o \
-+ bmi/bmi.o \
-+ ar6000/ar6000_drv.o \
-+ ar6000/ar6000_raw_if.o \
-+ ar6000/netbuf.o \
-+ ar6000/wireless_ext.o \
-+ ar6000/ioctl.o \
-+ miscdrv/common_drv.o \
-+ miscdrv/credit_dist.o \
-+ wmi/wmi.o \
-+ wlan/wlan_node.o \
-+ wlan/wlan_recv_beacon.o \
-+ wlan/wlan_utils.o
++ /*
++ * take care not to power unpowered GPS from UART TX
++ * return them to GPIO and force low
++ */
++ s3c2410_gpio_cfgpin(S3C2410_GPH(4), S3C2410_GPIO_OUTPUT);
++ s3c2410_gpio_setpin(S3C2410_GPH(4), 0);
++ /* don't let RX from unpowered GPS float */
++ s3c2410_gpio_pullup(S3C2410_GPH(5), 1);
+
++ return sysfs_create_group(&pdev->dev.kobj,
++ >a02_gps_attr_group);
++}
+
-diff --git a/drivers/ar6000/ar6000/ar6000_drv.c b/drivers/ar6000/ar6000/ar6000_drv.c
-new file mode 100644
-index 0000000..90533ab
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_drv.c
-@@ -0,0 +1,3129 @@
-+/*
++static int gta02_pm_gps_remove(struct platform_device *pdev)
++{
++ regulator_put(gta02_gps.regulator);
++ sysfs_remove_group(&pdev->dev.kobj, >a02_gps_attr_group);
++ return 0;
++}
++
++static struct platform_driver gta02_pm_gps_driver = {
++ .probe = gta02_pm_gps_probe,
++ .remove = gta02_pm_gps_remove,
++ .driver = {
++ .name = "gta02-pm-gps",
++ .pm = GTA02_GPS_PM_OPS,
++ },
++};
++
++static int __devinit gta02_pm_gps_init(void)
++{
++ return platform_driver_register(>a02_pm_gps_driver);
++}
++module_init(gta02_pm_gps_init);
++
++static void gta02_pm_gps_exit(void)
++{
++ platform_driver_unregister(>a02_pm_gps_driver);
++}
++module_exit(gta02_pm_gps_exit);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
+diff --git a/arch/arm/mach-s3c2440/gta02-pm-gsm.c b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
+new file mode 100644
+index 0000000..d1831b5
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/gta02-pm-gsm.c
+@@ -0,0 +1,361 @@
++/*
++ * GSM Management code for the Openmoko Freerunner GSM Phone
+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * (C) 2007 by Openmoko Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
+ * All rights reserved.
+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation
+ *
+ */
+
-+/*
-+ * This driver is a pseudo ethernet driver to access the Atheros AR6000
-+ * WLAN Device
-+ */
-+static const char athId[] __attribute__ ((unused)) = "$Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/ar6000_drv.c#2 $";
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/platform_device.h>
++#include <linux/console.h>
++#include <linux/errno.h>
++#include <linux/interrupt.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/regulator/consumer.h>
+
-+#include "ar6000_drv.h"
-+#include "htc.h"
++#include <mach/gpio.h>
++#include <asm/mach-types.h>
+
-+MODULE_LICENSE("GPL and additional rights");
++#include <mach/hardware.h>
+
-+#ifndef REORG_APTC_HEURISTICS
-+#undef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+#endif /* REORG_APTC_HEURISTICS */
++#include <mach/gta02.h>
++#include <mach/regs-gpio.h>
++#include <mach/regs-gpioj.h>
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+#define APTC_TRAFFIC_SAMPLING_INTERVAL 100 /* msec */
-+#define APTC_UPPER_THROUGHPUT_THRESHOLD 3000 /* Kbps */
-+#define APTC_LOWER_THROUGHPUT_THRESHOLD 2000 /* Kbps */
++static int gta02_gsm_interrupts;
+
-+typedef struct aptc_traffic_record {
-+ A_BOOL timerScheduled;
-+ struct timeval samplingTS;
-+ unsigned long bytesReceived;
-+ unsigned long bytesTransmitted;
-+} APTC_TRAFFIC_RECORD;
++extern void s3c24xx_serial_console_set_silence(int);
+
-+A_TIMER aptcTimer;
-+APTC_TRAFFIC_RECORD aptcTR;
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++struct gta02pm_priv {
++ int gpio_ndl_gsm;
++ struct console *con;
++ struct regulator *regulator;
++};
+
-+unsigned int bypasswmi = 0;
-+unsigned int debuglevel = 0;
-+int tspecCompliance = 1;
-+unsigned int busspeedlow = 0;
-+unsigned int onebitmode = 0;
-+unsigned int skipflash = 0;
-+unsigned int wmitimeout = 2;
-+unsigned int wlanNodeCaching = 1;
-+unsigned int enableuartprint = 0;
-+unsigned int logWmiRawMsgs = 0;
-+unsigned int enabletimerwar = 0;
-+unsigned int mbox_yield_limit = 99;
-+int reduce_credit_dribble = 1 + HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF;
-+int allow_trace_signal = 0;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+unsigned int testmode =0;
-+#endif
++static struct gta02pm_priv gta02_gsm;
+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(bypasswmi, int, 0644);
-+module_param(debuglevel, int, 0644);
-+module_param(tspecCompliance, int, 0644);
-+module_param(onebitmode, int, 0644);
-+module_param(busspeedlow, int, 0644);
-+module_param(skipflash, int, 0644);
-+module_param(wmitimeout, int, 0644);
-+module_param(wlanNodeCaching, int, 0644);
-+module_param(logWmiRawMsgs, int, 0644);
-+module_param(enableuartprint, int, 0644);
-+module_param(enabletimerwar, int, 0644);
-+module_param(mbox_yield_limit, int, 0644);
-+module_param(reduce_credit_dribble, int, 0644);
-+module_param(allow_trace_signal, int, 0644);
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+module_param(testmode, int, 0644);
-+#endif
-+#else
++static struct console *find_s3c24xx_console(void)
++{
++ struct console *con;
+
-+#define __user
-+/* for linux 2.4 and lower */
-+MODULE_PARM(bypasswmi,"i");
-+MODULE_PARM(debuglevel, "i");
-+MODULE_PARM(onebitmode,"i");
-+MODULE_PARM(busspeedlow, "i");
-+MODULE_PARM(skipflash, "i");
-+MODULE_PARM(wmitimeout, "i");
-+MODULE_PARM(wlanNodeCaching, "i");
-+MODULE_PARM(enableuartprint,"i");
-+MODULE_PARM(logWmiRawMsgs, "i");
-+MODULE_PARM(enabletimerwar,"i");
-+MODULE_PARM(mbox_yield_limit,"i");
-+MODULE_PARM(reduce_credit_dribble,"i");
-+MODULE_PARM(allow_trace_signal,"i");
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+MODULE_PARM(testmode, "i");
-+#endif
-+#endif
++ acquire_console_sem();
+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
-+/* in 2.6.10 and later this is now a pointer to a uint */
-+unsigned int _mboxnum = HTC_MAILBOX_NUM_MAX;
-+#define mboxnum &_mboxnum
-+#else
-+unsigned int mboxnum = HTC_MAILBOX_NUM_MAX;
-+#endif
++ for (con = console_drivers; con; con = con->next) {
++ if (!strcmp(con->name, "ttySAC"))
++ break;
++ }
+
-+#ifdef CONFIG_AR6000_WLAN_RESET
-+unsigned int resetok = 1;
-+#else
-+unsigned int resetok = 0;
-+#endif
++ release_console_sem();
+
-+#ifdef DEBUG
-+A_UINT32 g_dbg_flags = DBG_DEFAULTS;
-+unsigned int debugflags = 0;
-+int debugdriver = 1;
-+unsigned int debughtc = 128;
-+unsigned int debugbmi = 1;
-+unsigned int debughif = 2;
-+unsigned int txcreditsavailable[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditsconsumed[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditintrenable[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int txcreditintrenableaggregate[HTC_MAILBOX_NUM_MAX] = {0};
++ return con;
++}
+
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(debugflags, int, 0644);
-+module_param(debugdriver, int, 0644);
-+module_param(debughtc, int, 0644);
-+module_param(debugbmi, int, 0644);
-+module_param(debughif, int, 0644);
-+module_param(resetok, int, 0644);
-+module_param_array(txcreditsavailable, int, mboxnum, 0644);
-+module_param_array(txcreditsconsumed, int, mboxnum, 0644);
-+module_param_array(txcreditintrenable, int, mboxnum, 0644);
-+module_param_array(txcreditintrenableaggregate, int, mboxnum, 0644);
-+#else
-+/* linux 2.4 and lower */
-+MODULE_PARM(debugflags,"i");
-+MODULE_PARM(debugdriver, "i");
-+MODULE_PARM(debughtc, "i");
-+MODULE_PARM(debugbmi, "i");
-+MODULE_PARM(debughif, "i");
-+MODULE_PARM(resetok, "i");
-+MODULE_PARM(txcreditsavailable, "0-3i");
-+MODULE_PARM(txcreditsconsumed, "0-3i");
-+MODULE_PARM(txcreditintrenable, "0-3i");
-+MODULE_PARM(txcreditintrenableaggregate, "0-3i");
-+#endif
++static ssize_t gsm_read(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ if (!strcmp(attr->attr.name, "power_on")) {
++ if (regulator_is_enabled(gta02_gsm.regulator))
++ goto out_1;
++ } else if (!strcmp(attr->attr.name, "download")) {
++ if (!s3c2410_gpio_getpin(GTA02_GPIO_nDL_GSM))
++ goto out_1;
++ } else if (!strcmp(attr->attr.name, "flowcontrolled")) {
++ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT)
++ goto out_1;
++ }
+
-+#endif /* DEBUG */
++ return strlcpy(buf, "0\n", 3);
++out_1:
++ return strlcpy(buf, "1\n", 3);
++}
+
-+unsigned int tx_attempt[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int tx_post[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int tx_complete[HTC_MAILBOX_NUM_MAX] = {0};
-+unsigned int hifBusRequestNumMax = 40;
-+unsigned int war23838_disabled = 0;
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+unsigned int enableAPTCHeuristics = 1;
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param_array(tx_attempt, int, mboxnum, 0644);
-+module_param_array(tx_post, int, mboxnum, 0644);
-+module_param_array(tx_complete, int, mboxnum, 0644);
-+module_param(hifBusRequestNumMax, int, 0644);
-+module_param(war23838_disabled, int, 0644);
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+module_param(enableAPTCHeuristics, int, 0644);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#else
-+MODULE_PARM(tx_attempt, "0-3i");
-+MODULE_PARM(tx_post, "0-3i");
-+MODULE_PARM(tx_complete, "0-3i");
-+MODULE_PARM(hifBusRequestNumMax, "i");
-+MODULE_PARM(war23838_disabled, "i");
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+MODULE_PARM(enableAPTCHeuristics, "i");
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+#endif
++static void gsm_on_off(struct device *dev, int on)
++{
+
-+#ifdef BLOCK_TX_PATH_FLAG
-+int blocktx = 0;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+module_param(blocktx, int, 0644);
-+#else
-+MODULE_PARM(blocktx, "i");
-+#endif
-+#endif /* BLOCK_TX_PATH_FLAG */
++ on = !!on;
+
-+// TODO move to arsoft_c
-+USER_RSSI_THOLD rssi_map[12];
++ if (on == regulator_is_enabled(gta02_gsm.regulator))
++ return;
+
-+int reconnect_flag = 0;
++ if (!on) {
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_INPUT);
++ s3c2410_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPIO_INPUT);
+
-+DECLARE_WAIT_QUEUE_HEAD(ar6000_scan_queue);
++ regulator_disable(gta02_gsm.regulator);
+
-+/* Function declarations */
-+static int ar6000_init_module(void);
-+static void ar6000_cleanup_module(void);
++ if (gta02_gsm.con) {
++ s3c24xx_serial_console_set_silence(0);
++ console_start(gta02_gsm.con);
+
-+int ar6000_init(struct net_device *dev);
-+static int ar6000_open(struct net_device *dev);
-+static int ar6000_close(struct net_device *dev);
-+static int ar6000_cleanup(struct net_device *dev);
-+static void ar6000_init_control_info(AR_SOFTC_T *ar);
-+static int ar6000_data_tx(struct sk_buff *skb, struct net_device *dev);
++ dev_dbg(dev, "powered down gta02 GSM, enabling "
++ "serial console\n");
++ }
+
-+static void ar6000_destroy(struct net_device *dev, unsigned int unregister);
-+static void ar6000_detect_error(unsigned long ptr);
-+static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
-+static struct iw_statistics *ar6000_get_iwstats(struct net_device * dev);
++ return;
++ }
+
-+/*
-+ * HTC service connection handlers
-+ */
-+static void ar6000_avail_ev(HTC_HANDLE HTCHandle);
++ if (gta02_gsm.con) {
++ dev_dbg(dev, "powering up GSM, thus "
++ "disconnecting serial console\n");
+
-+static void ar6000_unavail_ev(void *Instance);
++ console_stop(gta02_gsm.con);
++ s3c24xx_serial_console_set_silence(1);
++ }
+
-+static void ar6000_target_failure(void *Instance, A_STATUS Status);
++ /* allow UART to talk to GSM side now we will power it */
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
++ s3c2410_gpio_cfgpin(S3C2410_GPH(2), S3C2410_GPH2_TXD0);
+
-+static void ar6000_rx(void *Context, HTC_PACKET *pPacket);
++ regulator_enable(gta02_gsm.regulator);
+
-+static void ar6000_rx_refill(void *Context,HTC_ENDPOINT_ID Endpoint);
++ msleep(100);
+
-+static void ar6000_tx_complete(void *Context, HTC_PACKET *pPacket);
++ s3c2410_gpio_setpin(GTA02_GPIO_MODEM_ON, 1);
++ msleep(500);
++ s3c2410_gpio_setpin(GTA02_GPIO_MODEM_ON, 0);
+
-+static void ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint);
++ /*
++ * workaround for calypso firmware moko10 and earlier,
++ * without this it will leave IRQ line high after
++ * booting
++ */
++ s3c2410_gpio_setpin(S3C2410_GPH(1), 1);
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
++ msleep(1000);
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
+
-+static void ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint);
++}
+
-+/*
-+ * Static variables
-+ */
++static ssize_t gsm_write(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t count)
++{
++ unsigned long on = simple_strtoul(buf, NULL, 10);
+
-+static struct net_device *ar6000_devices[MAX_AR6000];
-+extern struct iw_handler_def ath_iw_handler_def;
-+DECLARE_WAIT_QUEUE_HEAD(arEvent);
-+static void ar6000_cookie_init(AR_SOFTC_T *ar);
-+static void ar6000_cookie_cleanup(AR_SOFTC_T *ar);
-+static void ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie);
-+static struct ar_cookie *ar6000_alloc_cookie(AR_SOFTC_T *ar);
-+static void ar6000_TxDataCleanup(AR_SOFTC_T *ar);
++ if (!strcmp(attr->attr.name, "power_on")) {
++ gsm_on_off(dev, on);
+
-+#ifdef USER_KEYS
-+static A_STATUS ar6000_reinstall_keys(AR_SOFTC_T *ar,A_UINT8 key_op_ctrl);
-+#endif
++ return count;
++ }
+
++ if (!strcmp(attr->attr.name, "download")) {
++ /*
++ * the keyboard / buttons driver requests and enables
++ * the JACK_INSERT IRQ. We have to take care about
++ * not enabling and disabling the IRQ when it was
++ * already in that state or we get "unblanaced IRQ"
++ * kernel warnings and stack dumps. So we use the
++ * copy of the ndl_gsm state to figure out if we should
++ * enable or disable the jack interrupt
++ */
++ if (on) {
++ if (gta02_gsm.gpio_ndl_gsm)
++ disable_irq(gpio_to_irq(
++ GTA02_GPIO_JACK_INSERT));
++ } else {
++ if (!gta02_gsm.gpio_ndl_gsm)
++ enable_irq(gpio_to_irq(
++ GTA02_GPIO_JACK_INSERT));
++ }
+
-+static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
++ gta02_gsm.gpio_ndl_gsm = !on;
++ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, !on);
+
-+#define HOST_INTEREST_ITEM_ADDRESS(ar, item) \
-+((ar->arTargetType == TARGET_TYPE_AR6001) ? \
-+ AR6001_HOST_INTEREST_ITEM_ADDRESS(item) : \
-+ AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
++ return count;
++ }
+
++ if (!strcmp(attr->attr.name, "flowcontrolled")) {
++ if (on) {
++ gta02_gsm_interrupts = 0;
++ s3c2410_gpio_setpin(S3C2410_GPH(1), 1);
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPIO_OUTPUT);
++ } else
++ s3c2410_gpio_cfgpin(S3C2410_GPH(1), S3C2410_GPH1_nRTS0);
++ }
+
-+/* Debug log support */
++ return count;
++}
+
-+/*
-+ * Flag to govern whether the debug logs should be parsed in the kernel
-+ * or reported to the application.
-+ */
-+#ifdef DEBUG
-+#define REPORT_DEBUG_LOGS_TO_APP
-+#endif
++static DEVICE_ATTR(power_on, 0644, gsm_read, gsm_write);
++static DEVICE_ATTR(reset, 0644, gsm_read, gsm_write);
++static DEVICE_ATTR(download, 0644, gsm_read, gsm_write);
++static DEVICE_ATTR(flowcontrolled, 0644, gsm_read, gsm_write);
+
-+A_STATUS
-+ar6000_set_host_app_area(AR_SOFTC_T *ar)
++#ifdef CONFIG_PM
++
++static int gta02_gsm_suspend(struct device *dev)
+{
-+ A_UINT32 address, data;
-+ struct host_app_area_s host_app_area;
++ /* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
++ * don't need to do much here. */
+
-+ /* Fetch the address of the host_app_area_s instance in the host interest area */
-+ address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_app_host_interest);
-+ if (ar6000_ReadRegDiag(ar->arHifDevice, &address, &data) != A_OK) {
-+ return A_ERROR;
-+ }
-+ address = data;
-+ host_app_area.wmi_protocol_ver = WMI_PROTOCOL_VERSION;
-+ if (ar6000_WriteDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)&host_app_area,
-+ sizeof(struct host_app_area_s)) != A_OK)
-+ {
-+ return A_ERROR;
-+ }
+
-+ return A_OK;
-+}
++ /* If flowcontrol asserted, abort if GSM already interrupted */
++ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
++ if (gta02_gsm_interrupts)
++ goto busy;
++ }
+
-+A_UINT32
-+dbglog_get_debug_hdr_ptr(AR_SOFTC_T *ar)
-+{
-+ A_UINT32 param;
-+ A_UINT32 address;
-+ A_STATUS status;
++ /* disable DL GSM to prevent jack_insert becoming 'floating' */
++ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, 1);
+
-+ address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_dbglog_hdr);
-+ if ((status = ar6000_ReadDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)¶m, 4)) != A_OK)
-+ {
-+ param = 0;
-+ }
++ if (device_may_wakeup(dev))
++ enable_irq_wake(GTA02_IRQ_MODEM);
+
-+ return param;
++ return 0;
++
++busy:
++ return -EBUSY;
+}
+
-+/*
-+ * The dbglog module has been initialized. Its ok to access the relevant
-+ * data stuctures over the diagnostic window.
-+ */
-+void
-+ar6000_dbglog_init_done(AR_SOFTC_T *ar)
++static int gta02_gsm_suspend_late(struct device *dev)
+{
-+ ar->dbglog_init_done = TRUE;
++ /* Last chance: abort if GSM already interrupted */
++ if (s3c2410_gpio_getcfg(S3C2410_GPH(1)) == S3C2410_GPIO_OUTPUT) {
++ if (gta02_gsm_interrupts)
++ return -EBUSY;
++ }
++ return 0;
+}
+
-+A_UINT32
-+dbglog_get_debug_fragment(A_INT8 *datap, A_UINT32 len, A_UINT32 limit)
++static int gta02_gsm_resume(struct device *dev)
+{
-+ A_INT32 *buffer;
-+ A_UINT32 count;
-+ A_UINT32 numargs;
-+ A_UINT32 length;
-+ A_UINT32 fraglen;
++ if (device_may_wakeup(dev))
++ disable_irq_wake(GTA02_IRQ_MODEM);
+
-+ count = fraglen = 0;
-+ buffer = (A_INT32 *)datap;
-+ length = (limit >> 2);
++ /* GPIO state is saved/restored by S3C2410 core GPIO driver, so we
++ * don't need to do much here. */
+
-+ if (len <= limit) {
-+ fraglen = len;
-+ } else {
-+ while (count < length) {
-+ numargs = DBGLOG_GET_NUMARGS(buffer[count]);
-+ fraglen = (count << 2);
-+ count += numargs + 1;
-+ }
-+ }
++ /* Make sure that the kernel console on the serial port is still
++ * disabled. FIXME: resume ordering race with serial driver! */
++ if (gta02_gsm.con && s3c2410_gpio_getpin(GTA02_GPIO_MODEM_ON))
++ console_stop(gta02_gsm.con);
+
-+ return fraglen;
++ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, gta02_gsm.gpio_ndl_gsm);
++
++ return 0;
+}
+
-+void
-+dbglog_parse_debug_logs(A_INT8 *datap, A_UINT32 len)
-+{
-+ A_INT32 *buffer;
-+ A_UINT32 count;
-+ A_UINT32 timestamp;
-+ A_UINT32 debugid;
-+ A_UINT32 moduleid;
-+ A_UINT32 numargs;
-+ A_UINT32 length;
++static struct dev_pm_ops gta02_gsm_pm_ops = {
++ .suspend = gta02_gsm_suspend,
++ .suspend_noirq = gta02_gsm_suspend_late,
++ .resume = gta02_gsm_resume,
++};
+
-+ count = 0;
-+ buffer = (A_INT32 *)datap;
-+ length = (len >> 2);
-+ while (count < length) {
-+ debugid = DBGLOG_GET_DBGID(buffer[count]);
-+ moduleid = DBGLOG_GET_MODULEID(buffer[count]);
-+ numargs = DBGLOG_GET_NUMARGS(buffer[count]);
-+ timestamp = DBGLOG_GET_TIMESTAMP(buffer[count]);
-+ switch (numargs) {
-+ case 0:
-+ AR_DEBUG_PRINTF("%d %d (%d)\n", moduleid, debugid, timestamp);
-+ break;
++#define GTA02_GSM_PM_OPS (>a02_gsm_pm_ops)
+
-+ case 1:
-+ AR_DEBUG_PRINTF("%d %d (%d): 0x%x\n", moduleid, debugid,
-+ timestamp, buffer[count+1]);
-+ break;
++#else
++#define GTA02_GSM_PM_OPS NULL
++#endif /* CONFIG_PM */
+
-+ case 2:
-+ AR_DEBUG_PRINTF("%d %d (%d): 0x%x, 0x%x\n", moduleid, debugid,
-+ timestamp, buffer[count+1], buffer[count+2]);
-+ break;
++static struct attribute *gta02_gsm_sysfs_entries[] = {
++ &dev_attr_power_on.attr,
++ &dev_attr_reset.attr,
++ &dev_attr_download.attr,
++ &dev_attr_flowcontrolled.attr,
++ NULL
++};
+
-+ default:
-+ AR_DEBUG_PRINTF("Invalid args: %d\n", numargs);
-+ }
-+ count += numargs + 1;
-+ }
-+}
++static struct attribute_group gta02_gsm_attr_group = {
++ .name = NULL,
++ .attrs = gta02_gsm_sysfs_entries,
++};
+
-+int
-+ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar)
++static irqreturn_t gta02_gsm_irq(int irq, void *devid)
+{
-+ struct dbglog_hdr_s debug_hdr;
-+ struct dbglog_buf_s debug_buf;
-+ A_UINT32 address;
-+ A_UINT32 length;
-+ A_UINT32 dropped;
-+ A_UINT32 firstbuf;
-+ A_UINT32 debug_hdr_ptr;
-+
-+ if (!ar->dbglog_init_done) return A_ERROR;
++ gta02_gsm_interrupts++;
++ return IRQ_HANDLED;
++}
+
-+#ifndef CONFIG_AR6000_WLAN_DEBUG
-+ return 0;
-+#endif
++static int __init gta02_gsm_probe(struct platform_device *pdev)
++{
++ int ret;
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ gta02_gsm.con = find_s3c24xx_console();
++ if (!gta02_gsm.con)
++ dev_warn(&pdev->dev,
++ "cannot find S3C24xx console driver\n");
+
-+ if (ar->dbgLogFetchInProgress) {
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ return A_EBUSY;
-+ }
++ gta02_gsm.regulator = regulator_get_exclusive(&pdev->dev, "GSM");
+
-+ /* block out others */
-+ ar->dbgLogFetchInProgress = TRUE;
++ if (IS_ERR(gta02_gsm.regulator)) {
++ ret = PTR_ERR(gta02_gsm.regulator);
++ dev_err(&pdev->dev, "Failed to get regulator: %d\n", ret);
++ return ret;
++ }
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ ret = request_irq(GTA02_IRQ_MODEM, gta02_gsm_irq,
++ IRQF_DISABLED | IRQF_TRIGGER_RISING, "modem", NULL);
+
-+ debug_hdr_ptr = dbglog_get_debug_hdr_ptr(ar);
-+ printk("debug_hdr_ptr: 0x%x\n", debug_hdr_ptr);
++ if (ret) {
++ regulator_put(gta02_gsm.regulator);
++ dev_err(&pdev->dev, "Failed to get modem irq: %d\n", ret);
++ goto err_regulator_put;
++ }
+
-+ /* Get the contents of the ring buffer */
-+ if (debug_hdr_ptr) {
-+ address = debug_hdr_ptr;
-+ length = sizeof(struct dbglog_hdr_s);
-+ ar6000_ReadDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)&debug_hdr, length);
-+ address = (A_UINT32)debug_hdr.dbuf;
-+ firstbuf = address;
-+ dropped = debug_hdr.dropped;
-+ length = sizeof(struct dbglog_buf_s);
-+ ar6000_ReadDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)&debug_buf, length);
++ ret = sysfs_create_group(&pdev->dev.kobj, >a02_gsm_attr_group);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to create sysfs entries: %d\n", ret);
++ goto err_free_irq;
++ }
+
-+ do {
-+ address = (A_UINT32)debug_buf.buffer;
-+ length = debug_buf.length;
-+ if ((length) && (debug_buf.length <= debug_buf.bufsize)) {
-+ /* Rewind the index if it is about to overrun the buffer */
-+ if (ar->log_cnt > (DBGLOG_HOST_LOG_BUFFER_SIZE - length)) {
-+ ar->log_cnt = 0;
-+ }
-+ if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)&ar->log_buffer[ar->log_cnt], length))
-+ {
-+ break;
-+ }
-+ ar6000_dbglog_event(ar, dropped, &ar->log_buffer[ar->log_cnt], length);
-+ ar->log_cnt += length;
-+ } else {
-+ AR_DEBUG_PRINTF("Length: %d (Total size: %d)\n",
-+ debug_buf.length, debug_buf.bufsize);
-+ }
++ device_init_wakeup(&pdev->dev, 1);
+
-+ address = (A_UINT32)debug_buf.next;
-+ length = sizeof(struct dbglog_buf_s);
-+ if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
-+ (A_UCHAR *)&debug_buf, length))
-+ {
-+ break;
-+ }
++ /* GSM is to be initially off (at boot, or if this module inserted) */
++ gsm_on_off(&pdev->dev, 0);
+
-+ } while (address != firstbuf);
-+ }
++ /* note that download initially disabled, and enforce that */
++ gta02_gsm.gpio_ndl_gsm = 1;
++ s3c2410_gpio_setpin(GTA02_GPIO_nDL_GSM, 1);
+
-+ ar->dbgLogFetchInProgress = FALSE;
++ return 0;
++err_free_irq:
++ free_irq(GTA02_IRQ_MODEM, NULL);
++err_regulator_put:
++ regulator_put(gta02_gsm.regulator);
+
-+ return A_OK;
++ return ret;
+}
+
-+void
-+ar6000_dbglog_event(AR_SOFTC_T *ar, A_UINT32 dropped,
-+ A_INT8 *buffer, A_UINT32 length)
++static int gta02_gsm_remove(struct platform_device *pdev)
+{
-+#ifdef REPORT_DEBUG_LOGS_TO_APP
-+ #define MAX_WIRELESS_EVENT_SIZE 252
-+ /*
-+ * Break it up into chunks of MAX_WIRELESS_EVENT_SIZE bytes of messages.
-+ * There seems to be a limitation on the length of message that could be
-+ * transmitted to the user app via this mechanism.
-+ */
-+ A_UINT32 send, sent;
++ gsm_on_off(&pdev->dev, 0);
+
-+ sent = 0;
-+ send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
-+ MAX_WIRELESS_EVENT_SIZE);
-+ while (send) {
-+ ar6000_send_event_to_app(ar, WMIX_DBGLOG_EVENTID, &buffer[sent], send);
-+ sent += send;
-+ send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
-+ MAX_WIRELESS_EVENT_SIZE);
-+ }
-+#else
-+ AR_DEBUG_PRINTF("Dropped logs: 0x%x\nDebug info length: %d\n",
-+ dropped, length);
++ sysfs_remove_group(&pdev->dev.kobj, >a02_gsm_attr_group);
++ free_irq(GTA02_IRQ_MODEM, NULL);
++ regulator_put(gta02_gsm.regulator);
+
-+ /* Interpret the debug logs */
-+ dbglog_parse_debug_logs(buffer, length);
-+#endif /* REPORT_DEBUG_LOGS_TO_APP */
++ return 0;
+}
+
++static struct platform_driver gta02_gsm_driver = {
++ .probe = gta02_gsm_probe,
++ .remove = gta02_gsm_remove,
++ .driver = {
++ .name = "gta02-pm-gsm",
++ .pm = GTA02_GSM_PM_OPS,
++ },
++};
+
++static int __devinit gta02_gsm_init(void)
++{
++ return platform_driver_register(>a02_gsm_driver);
++}
++module_init(gta02_gsm_init);
+
-+static int __init
-+ar6000_init_module(void)
++static void gta02_gsm_exit(void)
+{
-+ static int probed = 0;
-+ A_STATUS status;
-+ HTC_INIT_INFO initInfo;
++ platform_driver_unregister(>a02_gsm_driver);
++}
++module_exit(gta02_gsm_exit);
+
-+ A_MEMZERO(&initInfo,sizeof(initInfo));
-+ initInfo.AddInstance = ar6000_avail_ev;
-+ initInfo.DeleteInstance = ar6000_unavail_ev;
-+ initInfo.TargetFailure = ar6000_target_failure;
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
++MODULE_DESCRIPTION("Openmoko Freerunner GSM Power Management");
+diff --git a/arch/arm/mach-s3c2440/gta02-pm-wlan.c b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
+new file mode 100644
+index 0000000..c6ae6f3
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/gta02-pm-wlan.c
+@@ -0,0 +1,201 @@
++/*
++ * GTA02 WLAN power management
++ *
++ * (C) 2008, 2009 by Openmoko Inc.
++ * Author: Andy Green <andy@openmoko.com>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation
++ *
++ */
+
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/mutex.h>
++#include <linux/platform_device.h>
+
-+#ifdef DEBUG
-+ /* Set the debug flags if specified at load time */
-+ if(debugflags != 0)
-+ {
-+ g_dbg_flags = debugflags;
-+ }
-+#endif
++#include <mach/hardware.h>
++#include <asm/mach-types.h>
+
-+ if (probed) {
-+ return -ENODEV;
-+ }
-+ probed++;
++#include <mach/gta02.h>
++#include <mach/gta02-pm-wlan.h>
++#include <mach/regs-gpio.h>
++#include <mach/regs-gpioj.h>
++#include <mach/gpio-fns.h>
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+ memset(&aptcTR, 0, sizeof(APTC_TRAFFIC_RECORD));
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++#include <linux/delay.h>
++#include <linux/rfkill.h>
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+ ar6000_gpio_init();
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ status = HTCInit(&initInfo);
-+ if(status != A_OK)
-+ return -ENODEV;
++/* ----- Module hardware reset ("power") ----------------------------------- */
+
-+ return 0;
-+}
+
-+static void __exit
-+ar6000_cleanup_module(void)
++void gta02_wlan_reset(int assert_reset)
+{
-+ int i = 0;
-+ struct net_device *ar6000_netdev;
++ if (assert_reset) {
++ s3c2410_gpio_setpin(GTA02_GPIO_nWLAN_RESET, 0);
++ msleep(200); /* probably excessive but we don't have specs */
++ } else {
++ s3c2410_gpio_setpin(GTA02_GPIO_nWLAN_RESET, 1);
++ }
++}
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+ /* Delete the Adaptive Power Control timer */
-+ if (timer_pending(&aptcTimer)) {
-+ del_timer_sync(&aptcTimer);
-+ }
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++/* ----- rfkill ------------------------------------------------------------ */
+
-+ for (i=0; i < MAX_AR6000; i++) {
-+ if (ar6000_devices[i] != NULL) {
-+ ar6000_netdev = ar6000_devices[i];
-+ ar6000_devices[i] = NULL;
-+ ar6000_destroy(ar6000_netdev, 1);
-+ }
-+ }
++/*
++ * S3C MCI handles suspend/resume through device removal/insertion. In order to
++ * preserve rfkill state, as required in clause 7 of section 3.1 in rfkill.txt,
++ * we therefore need to maintain rfkill state outside the driver.
++ *
++ * This platform driver is as good a place as any other.
++ */
+
-+ /* shutting down HTC will cause the HIF layer to detach from the
-+ * underlying bus driver which will cause the subsequent deletion of
-+ * all HIF and HTC instances */
-+ HTCShutDown();
++static int (*gta02_wlan_rfkill_cb)(void *user, int on);
++static void *gta02_wlan_rfkill_user;
++static DEFINE_MUTEX(gta02_wlan_rfkill_lock);
++static int gta02_wlan_rfkill_on;
+
-+ AR_DEBUG_PRINTF("ar6000_cleanup: success\n");
-+}
++/*
++ * gta02_wlan_query_rfkill_lock is used to obtain the rfkill state before the
++ * driver is ready to process rfkill callbacks. To prevent the state from
++ * changing until the driver has completed its initialization, we grab and hold
++ * the rfkill lock.
++ *
++ * A call to gta02_wlan_query_rfkill_lock must be followed by either
++ * - a call to gta02_wlan_set_rfkill_cb, to complete the setup, or
++ * - a call to gta02_wlan_query_rfkill_unlock to abort the setup process.
++ */
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+void
-+aptcTimerHandler(unsigned long arg)
++int gta02_wlan_query_rfkill_lock(void)
+{
-+ A_UINT32 numbytes;
-+ A_UINT32 throughput;
-+ AR_SOFTC_T *ar;
-+ A_STATUS status;
++ mutex_lock(>a02_wlan_rfkill_lock);
++ return gta02_wlan_rfkill_on;
++}
++EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_lock);
+
-+ ar = (AR_SOFTC_T *)arg;
-+ A_ASSERT(ar != NULL);
-+ A_ASSERT(!timer_pending(&aptcTimer));
++void gta02_wlan_query_rfkill_unlock(void)
++{
++ mutex_unlock(>a02_wlan_rfkill_lock);
++}
++EXPORT_SYMBOL_GPL(gta02_wlan_query_rfkill_unlock);
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user)
++{
++ BUG_ON(!mutex_is_locked(>a02_wlan_rfkill_lock));
++ BUG_ON(gta02_wlan_rfkill_cb);
++ gta02_wlan_rfkill_cb = cb;
++ gta02_wlan_rfkill_user = user;
++ mutex_unlock(>a02_wlan_rfkill_lock);
++}
++EXPORT_SYMBOL_GPL(gta02_wlan_set_rfkill_cb);
+
-+ /* Get the number of bytes transferred */
-+ numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
-+ aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
++void gta02_wlan_clear_rfkill_cb(void)
++{
++ mutex_lock(>a02_wlan_rfkill_lock);
++ BUG_ON(!gta02_wlan_rfkill_cb);
++ gta02_wlan_rfkill_cb = NULL;
++ mutex_unlock(>a02_wlan_rfkill_lock);
++}
++EXPORT_SYMBOL_GPL(gta02_wlan_clear_rfkill_cb);
+
-+ /* Calculate and decide based on throughput thresholds */
-+ throughput = ((numbytes * 8)/APTC_TRAFFIC_SAMPLING_INTERVAL); /* Kbps */
-+ if (throughput < APTC_LOWER_THROUGHPUT_THRESHOLD) {
-+ /* Enable Sleep and delete the timer */
-+ A_ASSERT(ar->arWmiReady == TRUE);
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ status = wmi_powermode_cmd(ar->arWmi, REC_POWER);
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ A_ASSERT(status == A_OK);
-+ aptcTR.timerScheduled = FALSE;
-+ } else {
-+ A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
-+ }
++static int gta02_wlan_set_radio_block(void *data, bool blocked)
++{
++ struct device *dev = data;
++ int res = 0;
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ dev_dbg(dev, "gta02_wlan_toggle_radio: blocked %d (%p)\n",
++ blocked, gta02_wlan_rfkill_cb);
++ mutex_lock(>a02_wlan_rfkill_lock);
++ if (gta02_wlan_rfkill_cb)
++ res = gta02_wlan_rfkill_cb(gta02_wlan_rfkill_user, !blocked);
++ if (!res)
++ gta02_wlan_rfkill_on = !blocked;
++ mutex_unlock(>a02_wlan_rfkill_lock);
++ return res;
+}
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
++static const struct rfkill_ops gta02_wlan_rfkill_ops = {
++ .set_block = gta02_wlan_set_radio_block,
++};
+
++/* ----- Initialization/removal -------------------------------------------- */
+
-+/* set HTC block size, assume BMI is already initialized */
-+A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar)
++
++static int __init gta02_wlan_probe(struct platform_device *pdev)
+{
-+ A_STATUS status;
-+ A_UINT32 blocksizes[HTC_MAILBOX_NUM_MAX];
++ /* default-on for now */
++ const int default_state = 1;
++ struct rfkill *rfkill;
++ int ret;
+
-+ do {
-+ /* get the block sizes */
-+ status = HIFConfigureDevice(ar->arHifDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+ blocksizes, sizeof(blocksizes));
++ dev_info(&pdev->dev, "starting\n");
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF("Failed to get block size info from HIF layer...\n");
-+ break;
-+ }
-+ /* note: we actually get the block size for mailbox 1, for SDIO the block
-+ * size on mailbox 0 is artificially set to 1 */
-+ /* must be a power of 2 */
-+ A_ASSERT((blocksizes[1] & (blocksizes[1] - 1)) == 0);
++ s3c2410_gpio_cfgpin(GTA02_GPIO_nWLAN_RESET, S3C2410_GPIO_OUTPUT);
++ gta02_wlan_reset(1);
++ gta02_wlan_reset(0);
+
-+ /* set the host interest area for the block size */
-+ status = BMIWriteMemory(ar->arHifDevice,
-+ HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz),
-+ (A_UCHAR *)&blocksizes[1],
-+ 4);
++ rfkill = rfkill_alloc("ar6000", &pdev->dev, RFKILL_TYPE_WLAN,
++ >a02_wlan_rfkill_ops, &pdev->dev);
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF("BMIWriteMemory for IO block size failed \n");
-+ break;
-+ }
+
-+ AR_DEBUG_PRINTF("Block Size Set: %d (target address:0x%X)\n",
-+ blocksizes[1], HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz));
++ if (!rfkill) {
++ dev_err(&pdev->dev, "Failed to allocate rfkill\n");
++ return -ENOMEM;
++ }
+
-+ /* set the host interest area for the mbox ISR yield limit */
-+ status = BMIWriteMemory(ar->arHifDevice,
-+ HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_isr_yield_limit),
-+ (A_UCHAR *)&mbox_yield_limit,
-+ 4);
++ rfkill_init_sw_state(rfkill, default_state);
++ /*
++ * If the WLAN driver somehow managed to get activated before we're
++ * ready, the driver is now in an unknown state, which isn't something
++ * we're prepared to handle. This can't happen, so just fail hard.
++ */
++ BUG_ON(gta02_wlan_rfkill_cb);
++ gta02_wlan_rfkill_on = default_state;
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF("BMIWriteMemory for yield limit failed \n");
-+ break;
-+ }
++ ret = rfkill_register(rfkill);
++ if (ret) {
++ rfkill_destroy(rfkill);
++ dev_err(&pdev->dev, "Failed to register rfkill\n");
++ return ret;
++ }
+
-+ } while (FALSE);
++ dev_set_drvdata(&pdev->dev, rfkill);
+
-+ return status;
++ return 0;
+}
+
-+static void free_raw_buffers(AR_SOFTC_T *ar)
++static int gta02_wlan_remove(struct platform_device *pdev)
+{
-+ int i, j;
++ struct rfkill *rfkill = dev_get_drvdata(&pdev->dev);
+
-+ for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
-+ for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++)
-+ kfree(ar->raw_htc_read_buffer[i][j]);
-+ for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++)
-+ kfree(ar->raw_htc_write_buffer[i][j]);
-+ }
++ rfkill_destroy(rfkill);
++
++ return 0;
+}
+
-+static int alloc_raw_buffers(AR_SOFTC_T *ar)
-+{
-+ int i, j;
-+ raw_htc_buffer *b;
++static struct platform_driver gta02_wlan_driver = {
++ .probe = gta02_wlan_probe,
++ .remove = gta02_wlan_remove,
++ .driver = {
++ .name = "gta02-pm-wlan",
++ },
++};
+
-+ for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
-+ for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++) {
-+ b = kzalloc(sizeof(*b), GFP_KERNEL);
-+ if (!b)
-+ return -ENOMEM;
-+ ar->raw_htc_read_buffer[i][j] = b;
-+ }
-+ for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++) {
-+ b = kzalloc(sizeof(*b), GFP_KERNEL);
-+ if (!b)
-+ return -ENOMEM;
-+ ar->raw_htc_write_buffer[i][j] = b;
-+ }
-+ }
-+ return 0;
++static int __devinit gta02_wlan_init(void)
++{
++ return platform_driver_register(>a02_wlan_driver);
+}
++module_init(gta02_wlan_init);
+
-+static const struct net_device_ops ar6000_netdev_ops = {
-+ .ndo_init = &ar6000_init,
-+ .ndo_open = &ar6000_open,
-+ .ndo_stop = &ar6000_close,
-+ .ndo_start_xmit = &ar6000_data_tx,
-+ .ndo_get_stats = &ar6000_get_stats,
-+ .ndo_do_ioctl = &ar6000_ioctl,
-+};
-+/*
-+ * HTC Event handlers
-+ */
-+static void
-+ar6000_avail_ev(HTC_HANDLE HTCHandle)
++static void gta02_wlan_exit(void)
+{
-+ int i;
-+ struct net_device *dev;
-+ AR_SOFTC_T *ar;
-+ int device_index = 0;
-+
-+ AR_DEBUG_PRINTF("ar6000_available\n");
-+
-+ for (i=0; i < MAX_AR6000; i++) {
-+ if (ar6000_devices[i] == NULL) {
-+ break;
-+ }
-+ }
-+
-+ if (i == MAX_AR6000) {
-+ AR_DEBUG_PRINTF("ar6000_available: max devices reached\n");
-+ return;
-+ }
-+
-+ /* Save this. It gives a bit better readability especially since */
-+ /* we use another local "i" variable below. */
-+ device_index = i;
-+
-+ A_ASSERT(HTCHandle != NULL);
-+
-+ dev = alloc_etherdev(sizeof(AR_SOFTC_T));
-+ if (dev == NULL) {
-+ AR_DEBUG_PRINTF("ar6000_available: can't alloc etherdev\n");
-+ return;
-+ }
-+
-+ ether_setup(dev);
-+
-+ if (netdev_priv(dev) == NULL) {
-+ printk(KERN_CRIT "ar6000_available: Could not allocate memory\n");
-+ return;
-+ }
-+
-+ A_MEMZERO(netdev_priv(dev), sizeof(AR_SOFTC_T));
-+
-+ ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ ar->arNetDev = dev;
-+ ar->arHtcTarget = HTCHandle;
-+ ar->arHifDevice = HTCGetHifDevice(HTCHandle);
-+ ar->arWlanState = WLAN_ENABLED;
-+ ar->arRadioSwitch = WLAN_ENABLED;
-+ ar->arDeviceIndex = device_index;
++ platform_driver_unregister(>a02_wlan_driver);
++}
++module_exit(gta02_wlan_exit);
+
-+ A_INIT_TIMER(&ar->arHBChallengeResp.timer, ar6000_detect_error, dev);
-+ ar->arHBChallengeResp.seqNum = 0;
-+ ar->arHBChallengeResp.outstanding = FALSE;
-+ ar->arHBChallengeResp.missCnt = 0;
-+ ar->arHBChallengeResp.frequency = AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT;
-+ ar->arHBChallengeResp.missThres = AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT;
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
++MODULE_DESCRIPTION("Openmoko GTA02 WLAN power management");
+diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
+new file mode 100644
+index 0000000..90de353
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/include/mach/gta02-fiq.h
+@@ -0,0 +1,9 @@
++#ifndef __GTA02_FIQ_H
++#define __GTA02_FIQ_H
+
-+ ar6000_init_control_info(ar);
-+ init_waitqueue_head(&arEvent);
-+ sema_init(&ar->arSem, 1);
++extern void gta02_fiq_handler(void);
++extern void gta02_fiq_kick(void);
++extern int gta02_fiq_enable(void);
++extern void gta02_fiq_disable(void);
+
-+ if (alloc_raw_buffers(ar)) {
-+ free_raw_buffers(ar);
-+ /*
-+ * @@@ Clean up our own mess, but for anything else, cheerfully mimick
-+ * the beautiful error non-handling of the rest of this function.
-+ */
-+ return;
-+ }
++#endif
+diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
+new file mode 100644
+index 0000000..f15180a
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-gps.h
+@@ -0,0 +1 @@
++extern int gta02_pm_gps_is_on(void);
+diff --git a/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
+new file mode 100644
+index 0000000..4836978
+--- /dev/null
++++ b/arch/arm/mach-s3c2440/include/mach/gta02-pm-wlan.h
+@@ -0,0 +1,10 @@
++#ifndef __MACH_GTA02_PM_WLAN_H
++#define __MACH_GTA02_PM_WLAN_H
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+ A_INIT_TIMER(&aptcTimer, aptcTimerHandler, ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++void gta02_wlan_reset(int assert_reset);
++int gta02_wlan_query_rfkill_lock(void);
++void gta02_wlan_query_rfkill_unlock(void);
++void gta02_wlan_set_rfkill_cb(int (*cb)(void *user, int on), void *user);
++void gta02_wlan_clear_rfkill_cb(void);
+
-+ /*
-+ * If requested, perform some magic which requires no cooperation from
-+ * the Target. It causes the Target to ignore flash and execute to the
-+ * OS from ROM.
-+ *
-+ * This is intended to support recovery from a corrupted flash on Targets
-+ * that support flash.
-+ */
-+ if (skipflash)
-+ {
-+ ar6000_reset_device_skipflash(ar->arHifDevice);
-+ }
++#endif /* __MACH_GTA02_PM_WLAN_H */
+diff --git a/arch/arm/mach-s3c2440/include/mach/gta02.h b/arch/arm/mach-s3c2440/include/mach/gta02.h
+index 953331d..f11f794 100644
+--- a/arch/arm/mach-s3c2440/include/mach/gta02.h
++++ b/arch/arm/mach-s3c2440/include/mach/gta02.h
+@@ -2,6 +2,7 @@
+ #define _GTA02_H
+
+ #include <mach/regs-gpio.h>
++#include <mach/regs-gpioj.h>
+
+ /* Different hardware revisions, passed in ATAG_REVISION by u-boot */
+ #define GTA02v1_SYSTEM_REV 0x00000310
+@@ -79,6 +80,11 @@
+ #define GTA02_PCB_ID2_0 S3C2410_GPD(3)
+ #define GTA02_PCB_ID2_1 S3C2410_GPD(4)
+
++#define GTA02_GPIO_GLAMO_BASE S3C_GPIO_END
++#define GTA02_GPIO_GLAMO(x) (GTA02_GPIO_GLAMO_BASE + (x))
++#define GTA02_GPIO_PCF_BASE (GTA02_GPIO_GLAMO_BASE + 32)
++#define GTA02_GPIO_PCF(x) (GTA02_GPIO_PCF_BASE + (x))
+
-+ BMIInit();
-+ {
-+ struct bmi_target_info targ_info;
+ int gta02_get_pcb_revision(void);
+
+ #endif /* _GTA02_H */
+diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
+index 45799c6..9a9461d 100644
+--- a/arch/arm/mach-s3c2440/mach-gta02.c
++++ b/arch/arm/mach-s3c2440/mach-gta02.c
+@@ -38,6 +38,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/serial_core.h>
+ #include <linux/spi/spi.h>
++#include <linux/spi/spi_gpio.h>
+
+ #include <linux/mmc/host.h>
+
+@@ -49,14 +50,21 @@
+ #include <linux/io.h>
+
+ #include <linux/i2c.h>
+-#include <linux/backlight.h>
+ #include <linux/regulator/machine.h>
++#include <linux/regulator/fixed.h>
+
+ #include <linux/mfd/pcf50633/core.h>
+ #include <linux/mfd/pcf50633/mbc.h>
+ #include <linux/mfd/pcf50633/adc.h>
+ #include <linux/mfd/pcf50633/gpio.h>
+ #include <linux/mfd/pcf50633/pmic.h>
++#include <linux/mfd/pcf50633/backlight.h>
+
-+ if (BMIGetTargetInfo(ar->arHifDevice, &targ_info) != A_OK) {
-+ return;
-+ }
++#include <linux/input.h>
++#include <linux/gpio_keys.h>
+
-+ ar->arVersion.target_ver = targ_info.target_ver;
-+ ar->arTargetType = targ_info.target_type;
-+ }
++#include <linux/leds.h>
++#include <linux/leds_pwm.h>
+
+ #include <asm/mach/arch.h>
+ #include <asm/mach/map.h>
+@@ -76,6 +84,8 @@
+ #include <mach/regs-mem.h>
+ #include <mach/hardware.h>
+
++#include <mach/ts.h>
+
-+ if (enableuartprint) {
-+ A_UINT32 param;
-+ param = 1;
-+ if (BMIWriteMemory(ar->arHifDevice,
-+ HOST_INTEREST_ITEM_ADDRESS(ar, hi_serial_enable),
-+ (A_UCHAR *)¶m,
-+ 4)!= A_OK)
-+ {
-+ AR_DEBUG_PRINTF("BMIWriteMemory for enableuartprint failed \n");
-+ return ;
-+ }
-+ AR_DEBUG_PRINTF("Serial console prints enabled\n");
-+ }
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+ if(testmode) {
-+ ar->arTargetMode = AR6000_TCMD_MODE;
-+ }else {
-+ ar->arTargetMode = AR6000_WLAN_MODE;
-+ }
-+#endif
-+ if (enabletimerwar) {
-+ A_UINT32 param;
+ #include <mach/gta02.h>
+
+ #include <plat/regs-serial.h>
+@@ -85,8 +95,22 @@
+ #include <plat/pm.h>
+ #include <plat/udc.h>
+ #include <plat/gpio-cfg.h>
++#include <plat/gpio-core.h>
+ #include <plat/iic.h>
+
++#include <mach/gta02-pm-gps.h>
++#include <mach/gta02-pm-wlan.h>
+
-+ if (BMIReadMemory(ar->arHifDevice,
-+ HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
-+ (A_UCHAR *)¶m,
-+ 4)!= A_OK)
-+ {
-+ AR_DEBUG_PRINTF("BMIReadMemory for enabletimerwar failed \n");
-+ return;
-+ }
++#include <mach/gta02-fiq.h>
+
-+ param |= HI_OPTION_TIMER_WAR;
++#include <linux/hdq.h>
++#include <linux/bq27000_battery.h>
++#include <linux/platform_battery.h>
+
-+ if (BMIWriteMemory(ar->arHifDevice,
-+ HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
-+ (A_UCHAR *)¶m,
-+ 4) != A_OK)
-+ {
-+ AR_DEBUG_PRINTF("BMIWriteMemory for enabletimerwar failed \n");
-+ return;
-+ }
-+ AR_DEBUG_PRINTF("Timer WAR enabled\n");
-+ }
++#include <linux/jbt6k74.h>
++#include <linux/glamofb.h>
++#include <linux/mfd/glamo.h>
+
+ static struct pcf50633 *gta02_pcf;
+
+ /*
+@@ -149,6 +173,194 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
+ },
+ };
+
++static struct platform_device gta02_pm_bt_dev = {
++ .name = "gta02-pm-bt",
++};
+
-+ /* since BMIInit is called in the driver layer, we have to set the block
-+ * size here for the target */
++static struct platform_device gta02_pm_gps_dev = {
++ .name = "gta02-pm-gps",
++};
+
-+ if (A_FAILED(ar6000_SetHTCBlockSize(ar))) {
-+ return;
-+ }
++static struct platform_device gta02_pm_gsm_dev = {
++ .name = "gta02-pm-gsm",
++};
+
-+ spin_lock_init(&ar->arLock);
++static struct platform_device gta02_pm_wlan_dev = {
++ .name = "gta02-pm-wlan",
++};
+
-+ dev->netdev_ops = &ar6000_netdev_ops;
-+ dev->watchdog_timeo = AR6000_TX_TIMEOUT;
-+ ar6000_ioctl_iwsetup(&ath_iw_handler_def);
-+ dev->wireless_handlers = &ath_iw_handler_def;
-+ ath_iw_handler_def.get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
++static struct regulator_consumer_supply gsm_supply_consumer = {
++ .dev = >a02_pm_gsm_dev.dev,
++ .supply = "GSM",
++};
+
-+ /*
-+ * We need the OS to provide us with more headroom in order to
-+ * perform dix to 802.3, WMI header encap, and the HTC header
-+ */
-+ dev->hard_header_len = ETH_HLEN + sizeof(ATH_LLC_SNAP_HDR) +
-+ sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN;
++static struct regulator_init_data gsm_supply_init_data = {
++ .constraints = {
++ .min_uV = 3700000,
++ .max_uV = 3700000,
++ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
++ },
++ .num_consumer_supplies = 1,
++ .consumer_supplies = &gsm_supply_consumer,
++};
+
-+ /* This runs the init function */
-+ SET_NETDEV_DEV(dev, HIFGetOSDevice(ar->arHifDevice));
-+ if (register_netdev(dev)) {
-+ AR_DEBUG_PRINTF("ar6000_avail: register_netdev failed\n");
-+ ar6000_destroy(dev, 0);
-+ return;
-+ }
++static struct fixed_voltage_config gsm_supply_config = {
++ .supply_name = "GSM",
++ .microvolts = 3700000,
++ .gpio = GTA02_GPIO_PCF(PCF50633_GPIO2),
++ .enable_high = 1,
++ .init_data = &gsm_supply_init_data,
++};
+
-+ HTCSetInstance(ar->arHtcTarget, ar);
++static struct platform_device gta02_gsm_supply_device = {
++ .name = "reg-fixed-voltage",
++ .id = 1,
++ .dev = {
++ .platform_data = &gsm_supply_config,
++ },
++};
+
-+ /* We only register the device in the global list if we succeed. */
-+ /* If the device is in the global list, it will be destroyed */
-+ /* when the module is unloaded. */
-+ ar6000_devices[device_index] = dev;
++/*
++ * we crank down SD Card clock dynamically when GPS is powered
++ */
+
-+ AR_DEBUG_PRINTF("ar6000_avail: name=%s htcTarget=0x%x, dev=0x%x (%d), ar=0x%x\n",
-+ dev->name, (A_UINT32)HTCHandle, (A_UINT32)dev, device_index,
-+ (A_UINT32)ar);
++static int gta02_glamo_mci_use_slow(void)
++{
++ return gta02_pm_gps_is_on();
+}
+
-+static void ar6000_target_failure(void *Instance, A_STATUS Status)
++static void gta02_glamo_external_reset(int level)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
-+ WMI_TARGET_ERROR_REPORT_EVENT errEvent;
-+ static A_BOOL sip = FALSE;
-+
-+ if (Status != A_OK) {
-+ if (timer_pending(&ar->arHBChallengeResp.timer)) {
-+ A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
-+ }
-+
-+ /* try dumping target assertion information (if any) */
-+ ar6000_dump_target_assert_info(ar->arHifDevice,ar->arTargetType);
++ s3c2410_gpio_setpin(GTA02_GPIO_3D_RESET, level);
++ s3c2410_gpio_cfgpin(GTA02_GPIO_3D_RESET, S3C2410_GPIO_OUTPUT);
++}
+
-+ /*
-+ * Fetch the logs from the target via the diagnostic
-+ * window.
-+ */
-+ ar6000_dbglog_get_debug_logs(ar);
++struct spi_gpio_platform_data spigpio_platform_data = {
++ .sck = GTA02_GPIO_GLAMO(10),
++ .mosi = GTA02_GPIO_GLAMO(11),
++ .miso = GTA02_GPIO_GLAMO(5),
++ .num_chipselect = 1,
++};
+
-+ /* Report the error only once */
-+ if (!sip) {
-+ sip = TRUE;
-+ errEvent.errorVal = WMI_TARGET_COM_ERR |
-+ WMI_TARGET_FATAL_ERR;
-+#ifdef SEND_EVENT_TO_APP
-+ ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-+ (A_UINT8 *)&errEvent,
-+ sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
-+#endif
-+ }
-+ }
-+}
++static struct platform_device spigpio_device = {
++ .name = "spi_gpio",
++ .id = 2,
++ .dev = {
++ .platform_data = &spigpio_platform_data,
++ },
++};
+
-+static void
-+ar6000_unavail_ev(void *Instance)
++static void gta02_glamo_registered(struct device *dev)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
-+ /* NULL out it's entry in the global list */
-+ ar6000_devices[ar->arDeviceIndex] = NULL;
-+ ar6000_destroy(ar->arNetDev, 1);
++ spigpio_device.dev.parent = dev;
++ platform_device_register(&spigpio_device);
+}
+
-+/*
-+ * We need to differentiate between the surprise and planned removal of the
-+ * device because of the following consideration:
-+ * - In case of surprise removal, the hcd already frees up the pending
-+ * for the device and hence there is no need to unregister the function
-+ * driver inorder to get these requests. For planned removal, the function
-+ * driver has to explictly unregister itself to have the hcd return all the
-+ * pending requests before the data structures for the devices are freed up.
-+ * Note that as per the current implementation, the function driver will
-+ * end up releasing all the devices since there is no API to selectively
-+ * release a particular device.
-+ * - Certain commands issued to the target can be skipped for surprise
-+ * removal since they will anyway not go through.
-+ */
-+static void
-+ar6000_destroy(struct net_device *dev, unsigned int unregister)
-+{
-+ AR_SOFTC_T *ar;
-+
-+ AR_DEBUG_PRINTF("+ar6000_destroy \n");
++static struct fb_videomode gta02_glamo_modes[] = {
++ {
++ .name = "480x640",
++ .xres = 480,
++ .yres = 640,
++ .pixclock = 40816,
++ .left_margin = 8,
++ .right_margin = 16,
++ .upper_margin = 2,
++ .lower_margin = 16,
++ .hsync_len = 8,
++ .vsync_len = 2,
++ .vmode = FB_VMODE_NONINTERLACED,
++ }, {
++ .name = "240x320",
++ .xres = 240,
++ .yres = 320,
++ .pixclock = 40816,
++ .left_margin = 8,
++ .right_margin = 16,
++ .upper_margin = 2,
++ .lower_margin = 16,
++ .hsync_len = 8,
++ .vsync_len = 2,
++ .vmode = FB_VMODE_NONINTERLACED,
++ }
++};
+
-+ if((dev == NULL) || ((ar = netdev_priv(dev)) == NULL))
-+ {
-+ AR_DEBUG_PRINTF("%s(): Failed to get device structure.\n", __func__);
-+ return;
-+ }
++static struct glamo_fb_platform_data gta02_glamo_fb_pdata = {
++ .width = 43,
++ .height = 58,
+
-+ /* Clear the tx counters */
-+ memset(tx_attempt, 0, sizeof(tx_attempt));
-+ memset(tx_post, 0, sizeof(tx_post));
-+ memset(tx_complete, 0, sizeof(tx_complete));
++ .num_modes = ARRAY_SIZE(gta02_glamo_modes),
++ .modes = gta02_glamo_modes,
++};
+
-+ /* Free up the device data structure */
-+ if (unregister) {
-+ unregister_netdev(dev);
-+ } else {
-+ ar6000_close(dev);
-+ ar6000_cleanup(dev);
-+ }
++static struct glamo_mmc_platform_data gta02_glamo_mmc_pdata = {
++ .glamo_mmc_use_slow = gta02_glamo_mci_use_slow,
++};
+
-+ free_raw_buffers(ar);
++static struct glamo_gpio_platform_data gta02_glamo_gpio_pdata = {
++ .base = GTA02_GPIO_GLAMO_BASE,
++ .registered = gta02_glamo_registered,
++};
+
-+#ifndef free_netdev
-+ kfree(dev);
-+#else
-+ free_netdev(dev);
-+#endif
++static struct glamo_platform_data gta02_glamo_pdata = {
++ .fb_data = >a02_glamo_fb_pdata,
++ .mmc_data = >a02_glamo_mmc_pdata,
++ .gpio_data = >a02_glamo_gpio_pdata,
+
-+ AR_DEBUG_PRINTF("-ar6000_destroy \n");
-+}
++ .osci_clock_rate = 32768,
+
-+static void ar6000_detect_error(unsigned long ptr)
-+{
-+ struct net_device *dev = (struct net_device *)ptr;
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_TARGET_ERROR_REPORT_EVENT errEvent;
++ .glamo_external_reset = gta02_glamo_external_reset,
++};
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++/* JBT6k74 display controller */
++static void gta02_jbt6k74_probe_completed(struct device *dev)
++ {
++ pcf50633_bl_set_brightness_limit(gta02_pcf, 0x3f);
++}
++
++const static struct jbt6k74_platform_data jbt6k74_pdata = {
++ .gpio_reset = GTA02_GPIO_GLAMO(4),
++};
+
-+ if (ar->arHBChallengeResp.outstanding) {
-+ ar->arHBChallengeResp.missCnt++;
-+ } else {
-+ ar->arHBChallengeResp.missCnt = 0;
-+ }
-+
-+ if (ar->arHBChallengeResp.missCnt > ar->arHBChallengeResp.missThres) {
-+ /* Send Error Detect event to the application layer and do not reschedule the error detection module timer */
-+ ar->arHBChallengeResp.missCnt = 0;
-+ ar->arHBChallengeResp.seqNum = 0;
-+ errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+#ifdef SEND_EVENT_TO_APP
-+ ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
-+ (A_UINT8 *)&errEvent,
-+ sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
-+#endif
-+ return;
-+ }
-+
-+ /* Generate the sequence number for the next challenge */
-+ ar->arHBChallengeResp.seqNum++;
-+ ar->arHBChallengeResp.outstanding = TRUE;
-+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++static struct spi_board_info gta02_spi_board_info[] = {
++ {
++ .modalias = "jbt6k74",
++ .platform_data = &jbt6k74_pdata,
++ .controller_data = (void*)GTA02_GPIO_GLAMO(12),
++ /* irq */
++ .max_speed_hz = 100 * 1000,
++ .bus_num = 2,
++ .chip_select = 0
++ },
++};
++
++static struct resource gta02_glamo_resources[] = {
++ [0] = {
++ .start = S3C2410_CS1,
++ .end = S3C2410_CS1 + 0x1000000 - 1,
++ .flags = IORESOURCE_MEM,
++ },
++ [1] = {
++ .start = GTA02_IRQ_3D,
++ .end = GTA02_IRQ_3D,
++ .flags = IORESOURCE_IRQ,
++ },
++ [2] = {
++ .start = IRQ_BOARD_START,
++ .flags = IORESOURCE_IRQ,
++ },
++};
+
-+ /* Send the challenge on the control channel */
-+ if (wmi_get_challenge_resp_cmd(ar->arWmi, ar->arHBChallengeResp.seqNum, DRV_HB_CHALLENGE) != A_OK) {
-+ AR_DEBUG_PRINTF("Unable to send heart beat challenge\n");
-+ }
++static struct platform_device gta02_glamo_dev = {
++ .name = "glamo3362",
++ .num_resources = ARRAY_SIZE(gta02_glamo_resources),
++ .resource = gta02_glamo_resources,
++ .dev = {
++ .platform_data = >a02_glamo_pdata,
++ },
++};
+
+
-+ /* Reschedule the timer for the next challenge */
-+ A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
+ #ifdef CONFIG_CHARGER_PCF50633
+ /*
+ * On GTA02 the 1A charger features a 48K resistor to 0V on the ID pin.
+@@ -161,22 +373,28 @@ static struct s3c2410_uartcfg gta02_uartcfgs[] = {
+ #define ADC_NOM_CHG_DETECT_1A 6
+ #define ADC_NOM_CHG_DETECT_USB 43
+
+-static void
+-gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
++static int gta02_get_charger_online_status(void)
+ {
+- int ma;
++ struct pcf50633 *pcf = gta02_pcf;
+
+- /* Interpret charger type */
+- if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2)) {
++ return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ONLINE;
+}
-+
-+void ar6000_init_profile_info(AR_SOFTC_T *ar)
+
+- /*
+- * Sanity - stop GPO driving out now that we have a 1A charger
+- * GPO controls USB Host power generation on GTA02
+- */
+- pcf50633_gpio_set(pcf, PCF50633_GPO, 0);
++static int gta02_get_charger_active_status(void)
+{
-+ ar->arSsidLen = 0;
-+ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+ ar->arNetworkType = INFRA_NETWORK;
-+ ar->arDot11AuthMode = OPEN_AUTH;
-+ ar->arAuthMode = NONE_AUTH;
-+ ar->arPairwiseCrypto = NONE_CRYPT;
-+ ar->arPairwiseCryptoLen = 0;
-+ ar->arGroupCrypto = NONE_CRYPT;
-+ ar->arGroupCryptoLen = 0;
-+ A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
-+ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+ A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-+ ar->arBssChannel = 0;
++ struct pcf50633 *pcf = gta02_pcf;
+
++ return pcf50633_mbc_get_status(pcf) & PCF50633_MBC_USB_ACTIVE;
+}
+
+static void
-+ar6000_init_control_info(AR_SOFTC_T *ar)
-+{
-+ ar->arWmiEnabled = FALSE;
-+ ar6000_init_profile_info(ar);
-+ ar->arDefTxKeyIndex = 0;
-+ A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
-+ ar->arChannelHint = 0;
-+ ar->arListenInterval = MAX_LISTEN_INTERVAL;
-+ ar->arVersion.host_ver = AR6K_SW_VERSION;
-+ ar->arRssi = 0;
-+ ar->arTxPwr = 0;
-+ ar->arTxPwrSet = FALSE;
-+ ar->arSkipScan = 0;
-+ ar->arBeaconInterval = 0;
-+ ar->arBitRate = 0;
-+ ar->arMaxRetries = 0;
-+ ar->arWmmEnabled = TRUE;
-+}
-+
-+static int
-+ar6000_open(struct net_device *dev)
++gta02_configure_pmu_for_charger(struct pcf50633 *pcf, void *unused, int res)
+{
-+ /* Wake up the queues */
-+ netif_start_queue(dev);
++ int ma;
+
-+ return 0;
-+}
++ if (res < ((ADC_NOM_CHG_DETECT_USB + ADC_NOM_CHG_DETECT_1A) / 2))
+ ma = 1000;
+- } else
++ else
+ ma = 100;
+
+ pcf50633_mbc_usb_curlim_set(pcf, ma);
+@@ -237,6 +455,8 @@ static void gta02_udc_vbus_draw(unsigned int ma)
+ #else /* !CONFIG_CHARGER_PCF50633 */
+ #define gta02_pmu_event_callback NULL
+ #define gta02_udc_vbus_draw NULL
++#define gta02_get_charger_online_status NULL
++#define gta02_get_charger_active_status NULL
+ #endif
+
+ /*
+@@ -254,6 +474,38 @@ static char *gta02_batteries[] = {
+ "battery",
+ };
+
++static struct regulator_consumer_supply ldo4_consumers[] = {
++ {
++ .dev = >a02_pm_bt_dev.dev,
++ .supply = "BT_3V2",
++ },
++};
+
-+static int
-+ar6000_close(struct net_device *dev)
-+{
-+ /* Stop the transmit queues */
-+ netif_stop_queue(dev);
-+ return 0;
-+}
++static struct regulator_consumer_supply ldo5_consumers[] = {
++ {
++ .dev = >a02_pm_gps_dev.dev,
++ .supply = "RF_3V",
++ },
++};
+
-+static int
-+ar6000_cleanup(struct net_device *dev)
-+{
-+ AR_SOFTC_T *ar = netdev_priv(dev);
++static struct regulator_consumer_supply ldo6_consumers[] = {
++ REGULATOR_SUPPLY("VDC", "spi2.0"),
++ REGULATOR_SUPPLY("VDDIO", "spi2.0"),
++};
+
-+ /* Stop the transmit queues */
-+ netif_stop_queue(dev);
++static struct regulator_consumer_supply hcldo_consumers[] = {
++ {
++ .dev = >a02_glamo_dev.dev,
++ .supply = "SD_3V3",
++ },
++};
+
-+ /* Disable the target and the interrupts associated with it */
-+ if (ar->arWmiReady == TRUE)
-+ {
-+ if (!bypasswmi)
-+ {
-+ if (ar->arConnected == TRUE || ar->arConnectPending == TRUE)
-+ {
-+ AR_DEBUG_PRINTF("%s(): Disconnect\n", __func__);
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar6000_init_profile_info(ar);
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ wmi_disconnect_cmd(ar->arWmi);
-+ }
++static struct pcf50633_bl_platform_data gta02_backlight_data = {
++ .default_brightness = 0x3f,
++ .default_brightness_limit = 0,
++ .ramp_time = 3,
++};
+
-+ ar6000_dbglog_get_debug_logs(ar);
-+ ar->arWmiReady = FALSE;
-+ ar->arConnected = FALSE;
-+ ar->arConnectPending = FALSE;
-+ wmi_shutdown(ar->arWmi);
-+ ar->arWmiEnabled = FALSE;
-+ ar->arWmi = NULL;
-+ ar->arWlanState = WLAN_ENABLED;
-+#ifdef USER_KEYS
-+ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+ ar->user_key_ctrl = 0;
-+#endif
-+ }
+ struct pcf50633_platform_data gta02_pcf_pdata = {
+ .resumers = {
+ [0] = PCF50633_INT1_USBINS |
+@@ -271,6 +523,10 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
+
+ .charger_reference_current_ma = 1000,
+
++ .backlight_data = >a02_backlight_data,
+
-+ AR_DEBUG_PRINTF("%s(): WMI stopped\n", __func__);
-+ }
-+ else
-+ {
-+ AR_DEBUG_PRINTF("%s(): WMI not ready 0x%08x 0x%08x\n",
-+ __func__, (unsigned int) ar, (unsigned int) ar->arWmi);
++ .gpio_base = GTA02_GPIO_PCF_BASE,
+
-+ /* Shut down WMI if we have started it */
-+ if(ar->arWmiEnabled == TRUE)
-+ {
-+ AR_DEBUG_PRINTF("%s(): Shut down WMI\n", __func__);
-+ wmi_shutdown(ar->arWmi);
-+ ar->arWmiEnabled = FALSE;
-+ ar->arWmi = NULL;
-+ }
-+ }
+ .reg_init_data = {
+ [PCF50633_REGULATOR_AUTO] = {
+ .constraints = {
+@@ -310,15 +566,18 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
+ .min_uV = 2000000,
+ .max_uV = 3300000,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
+- .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE,
+- .always_on = 1,
++ .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE |
++ REGULATOR_CHANGE_STATUS,
+ },
++ .num_consumer_supplies = ARRAY_SIZE(hcldo_consumers),
++ .consumer_supplies = hcldo_consumers,
+ },
+ [PCF50633_REGULATOR_LDO1] = {
+ .constraints = {
+ .min_uV = 3300000,
+ .max_uV = 3300000,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+ .apply_uV = 1,
+ .state_mem = {
+ .enabled = 0,
+@@ -346,26 +605,35 @@ struct pcf50633_platform_data gta02_pcf_pdata = {
+ .min_uV = 3200000,
+ .max_uV = 3200000,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+ .apply_uV = 1,
+ },
++ .num_consumer_supplies = ARRAY_SIZE(ldo4_consumers),
++ .consumer_supplies = ldo4_consumers,
+ },
+ [PCF50633_REGULATOR_LDO5] = {
+ .constraints = {
+ .min_uV = 3000000,
+ .max_uV = 3000000,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+ .apply_uV = 1,
+ .state_mem = {
+ .enabled = 1,
+ },
+ },
++ .num_consumer_supplies = ARRAY_SIZE(ldo5_consumers),
++ .consumer_supplies = ldo5_consumers,
+ },
+ [PCF50633_REGULATOR_LDO6] = {
+ .constraints = {
+ .min_uV = 3000000,
+ .max_uV = 3000000,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL,
++ .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+ },
++ .num_consumer_supplies = ARRAY_SIZE(ldo6_consumers),
++ .consumer_supplies = ldo6_consumers,
+ },
+ [PCF50633_REGULATOR_MEMLDO] = {
+ .constraints = {
+@@ -409,12 +677,6 @@ static struct platform_device gta02_nor_flash = {
+ .num_resources = 1,
+ };
+
+-
+-struct platform_device s3c24xx_pwm_device = {
+- .name = "s3c24xx_pwm",
+- .num_resources = 0,
+-};
+-
+ static struct i2c_board_info gta02_i2c_devs[] __initdata = {
+ {
+ I2C_BOARD_INFO("pcf50633", 0x73),
+@@ -451,6 +713,7 @@ static struct s3c2410_platform_nand __initdata gta02_nand_info = {
+ .twrph1 = 15,
+ .nr_sets = ARRAY_SIZE(gta02_nand_sets),
+ .sets = gta02_nand_sets,
++ .software_ecc = 1,
+ };
+
+
+@@ -459,11 +722,11 @@ static void gta02_udc_command(enum s3c2410_udc_cmd_e cmd)
+ switch (cmd) {
+ case S3C2410_UDC_P_ENABLE:
+ pr_debug("%s S3C2410_UDC_P_ENABLE\n", __func__);
+- gpio_direction_output(GTA02_GPIO_USB_PULLUP, 1);
++ gpio_set_value(GTA02_GPIO_USB_PULLUP, 1);
+ break;
+ case S3C2410_UDC_P_DISABLE:
+ pr_debug("%s S3C2410_UDC_P_DISABLE\n", __func__);
+- gpio_direction_output(GTA02_GPIO_USB_PULLUP, 0);
++ gpio_set_value(GTA02_GPIO_USB_PULLUP, 0);
+ break;
+ case S3C2410_UDC_P_RESET:
+ pr_debug("%s S3C2410_UDC_P_RESET\n", __func__);
+@@ -478,81 +741,325 @@ static struct s3c2410_udc_mach_info gta02_udc_cfg = {
+
+ };
+
++/* USB */
++static struct s3c2410_hcd_info gta02_usb_info __initdata = {
++ .port[0] = {
++ .flags = S3C_HCDFLG_USED,
++ },
++ .port[1] = {
++ .flags = 0,
++ },
++};
+
-+ /* stop HTC */
-+ HTCStop(ar->arHtcTarget);
++/* Touchscreen */
++static struct s3c2410_ts_mach_info gta02_ts_info = {
++ .delay = 10000,
++ .presc = 0xff, /* slow as we can go */
++ .oversampling_shift = 2,
++};
+
-+ /* set the instance to NULL so we do not get called back on remove incase we
-+ * we're explicity destroyed by module unload */
-+ HTCSetInstance(ar->arHtcTarget, NULL);
++/* Buttons */
++static struct gpio_keys_button gta02_buttons[] = {
++ {
++ .gpio = GTA02_GPIO_AUX_KEY,
++ .code = KEY_PHONE,
++ .desc = "Aux",
++ .type = EV_KEY,
++ .debounce_interval = 100,
++ },
++ {
++ .gpio = GTA02_GPIO_HOLD_KEY,
++ .code = KEY_PAUSE,
++ .desc = "Hold",
++ .type = EV_KEY,
++ .debounce_interval = 100,
++ },
++};
+
-+ if (resetok) {
-+ /* try to reset the device if we can
-+ * The driver may have been configure NOT to reset the target during
-+ * a debug session */
-+ AR_DEBUG_PRINTF(" Attempting to reset target on instance destroy.... \n");
-+ ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
-+ } else {
-+ AR_DEBUG_PRINTF(" Host does not want target reset. \n");
-+ }
++static struct gpio_keys_platform_data gta02_buttons_pdata = {
++ .buttons = gta02_buttons,
++ .nbuttons = ARRAY_SIZE(gta02_buttons),
++};
+
-+ /* Done with cookies */
-+ ar6000_cookie_cleanup(ar);
++static struct platform_device gta02_buttons_device = {
++ .name = "gpio-keys",
++ .id = -1,
++ .dev = {
++ .platform_data = >a02_buttons_pdata,
++ },
++};
+
-+ /* Cleanup BMI */
-+ BMIInit();
++/* LEDs */
++static struct gpio_led gta02_gpio_leds[] = {
++ {
++ .name = "gta02:red:aux",
++ .gpio = GTA02_GPIO_AUX_LED,
++ },
++};
+
++static struct gpio_led_platform_data gta02_gpio_leds_pdata = {
++ .leds = gta02_gpio_leds,
++ .num_leds = ARRAY_SIZE(gta02_gpio_leds),
++};
+
+-static void gta02_bl_set_intensity(int intensity)
++static struct platform_device gta02_leds_device = {
++ .name = "leds-gpio",
++ .id = -1,
++ .dev = {
++ .platform_data = >a02_gpio_leds_pdata,
++ },
++};
+
-+ return 0;
++static inline int gta02_pwm_to_gpio(int pwm_id)
+ {
+- struct pcf50633 *pcf = gta02_pcf;
+- int old_intensity = pcf50633_reg_read(pcf, PCF50633_REG_LEDOUT);
++ return S3C2410_GPB(pwm_id);
+}
-+
-+/* connect to a service */
-+static A_STATUS ar6000_connectservice(AR_SOFTC_T *ar,
-+ HTC_SERVICE_CONNECT_REQ *pConnect,
-+ WMI_PRI_STREAM_ID WmiStreamID,
-+ char *pDesc)
+
+- /* We map 8-bit intensity to 6-bit intensity in hardware. */
+- intensity >>= 2;
++static int gta02_pwm_led_init(struct device *dev, struct led_pwm *led)
+{
-+ A_STATUS status;
-+ HTC_SERVICE_CONNECT_RESP response;
-+
-+ do {
-+
-+ A_MEMZERO(&response,sizeof(response));
-+
-+ status = HTCConnectService(ar->arHtcTarget,
-+ pConnect,
-+ &response);
++ int ret;
++ int gpio = gta02_pwm_to_gpio(led->pwm_id);
+
+- /*
+- * This can happen during, eg, print of panic on blanked console,
+- * but we can't service i2c without interrupts active, so abort.
+- */
+- if (in_atomic()) {
+- printk(KERN_ERR "gta02_bl_set_intensity called while atomic\n");
+- return;
++ ret = gpio_request(gpio, dev_name(dev));
++ if (ret)
++ return ret;
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(" Failed to connect to %s service status:%d \n", pDesc, status);
-+ break;
-+ }
++ gpio_direction_output(gpio, 0);
+
-+ if (WmiStreamID == WMI_NOT_MAPPED) {
-+ /* done */
-+ break;
-+ }
++ return 0;
++}
+
-+ /* set endpoint mapping for the WMI stream in the driver layer */
-+ arSetWMIStream2EndpointIDMap(ar,WmiStreamID,response.Endpoint);
++static enum led_brightness gta02_pwm_led_notify(struct device *dev,
++ struct led_pwm *led, enum led_brightness brightness)
++{
++ int gpio = gta02_pwm_to_gpio(led->pwm_id);
+
-+ } while (FALSE);
++ if (brightness == led->max_brightness || brightness == 0) {
++ s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
++ gpio_set_value(gpio, brightness ? 1 : 0);
+
-+ return status;
++ brightness = 0;
++ } else {
++ s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_SFN2);
+ }
+
+- old_intensity = pcf50633_reg_read(pcf, PCF50633_REG_LEDOUT);
+- if (intensity == old_intensity)
+- return;
++ return brightness;
+}
+
-+static void ar6000_TxDataCleanup(AR_SOFTC_T *ar)
++static void gta02_pwm_led_exit(struct device *dev, struct led_pwm *led)
+{
-+ /* flush all the data (non-control) streams
-+ * we only flush packets that are tagged as data, we leave any control packets that
-+ * were in the TX queues alone */
-+ HTCFlushEndpoint(ar->arHtcTarget,
-+ arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI),
-+ AR6K_DATA_PKT_TAG);
-+ HTCFlushEndpoint(ar->arHtcTarget,
-+ arWMIStream2EndpointID(ar,WMI_LOW_PRI),
-+ AR6K_DATA_PKT_TAG);
-+ HTCFlushEndpoint(ar->arHtcTarget,
-+ arWMIStream2EndpointID(ar,WMI_HIGH_PRI),
-+ AR6K_DATA_PKT_TAG);
-+ HTCFlushEndpoint(ar->arHtcTarget,
-+ arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI),
-+ AR6K_DATA_PKT_TAG);
++ gpio_free(gta02_pwm_to_gpio(led->pwm_id));
+}
+
-+/* This function does one time initialization for the lifetime of the device */
-+int ar6000_init(struct net_device *dev)
-+{
-+ AR_SOFTC_T *ar;
-+ A_STATUS status;
-+ A_INT32 timeleft;
-+
-+ if((ar = netdev_priv(dev)) == NULL)
-+ {
-+ return(-EIO);
-+ }
-+
-+ /* Do we need to finish the BMI phase */
-+ if(BMIDone(ar->arHifDevice) != A_OK)
-+ {
-+ return -EIO;
-+ }
-+
-+ if (!bypasswmi)
-+ {
-+#if 0 /* TBDXXX */
-+ if (ar->arVersion.host_ver != ar->arVersion.target_ver) {
-+ A_PRINTF("WARNING: Host version 0x%x does not match Target "
-+ " version 0x%x!\n",
-+ ar->arVersion.host_ver, ar->arVersion.target_ver);
-+ }
-+#endif
-+
-+ /* Indicate that WMI is enabled (although not ready yet) */
-+ ar->arWmiEnabled = TRUE;
-+ if ((ar->arWmi = wmi_init((void *) ar)) == NULL)
-+ {
-+ AR_DEBUG_PRINTF("%s() Failed to initialize WMI.\n", __func__);
-+ return(-EIO);
-+ }
-+
-+ AR_DEBUG_PRINTF("%s() Got WMI @ 0x%08x.\n", __func__,
-+ (unsigned int) ar->arWmi);
-+ }
-+
-+ do {
-+ HTC_SERVICE_CONNECT_REQ connect;
-+
-+ /* the reason we have to wait for the target here is that the driver layer
-+ * has to init BMI in order to set the host block size,
-+ */
-+ status = HTCWaitTarget(ar->arHtcTarget);
-+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ A_MEMZERO(&connect,sizeof(connect));
-+ /* meta data is unused for now */
-+ connect.pMetaData = NULL;
-+ connect.MetaDataLength = 0;
-+ /* these fields are the same for all service endpoints */
-+ connect.EpCallbacks.pContext = ar;
-+ connect.EpCallbacks.EpTxComplete = ar6000_tx_complete;
-+ connect.EpCallbacks.EpRecv = ar6000_rx;
-+ connect.EpCallbacks.EpRecvRefill = ar6000_rx_refill;
-+ connect.EpCallbacks.EpSendFull = ar6000_tx_queue_full;
-+ connect.EpCallbacks.EpSendAvail = ar6000_tx_queue_avail;
-+ /* set the max queue depth so that our ar6000_tx_queue_full handler gets called.
-+ * Linux has the peculiarity of not providing flow control between the
-+ * NIC and the network stack. There is no API to indicate that a TX packet
-+ * was sent which could provide some back pressure to the network stack.
-+ * Under linux you would have to wait till the network stack consumed all sk_buffs
-+ * before any back-flow kicked in. Which isn't very friendly.
-+ * So we have to manage this ourselves */
-+ connect.MaxSendQueueDepth = 32;
-+
-+ /* connect to control service */
-+ connect.ServiceID = WMI_CONTROL_SVC;
-+ status = ar6000_connectservice(ar,
-+ &connect,
-+ WMI_CONTROL_PRI,
-+ "WMI CONTROL");
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ /* for the remaining data services set the connection flag to reduce dribbling,
-+ * if configured to do so */
-+ if (reduce_credit_dribble) {
-+ connect.ConnectionFlags |= HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE;
-+ /* the credit dribble trigger threshold is (reduce_credit_dribble - 1) for a value
-+ * of 0-3 */
-+ connect.ConnectionFlags &= ~HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
-+ connect.ConnectionFlags |=
-+ ((A_UINT16)reduce_credit_dribble - 1) & HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
-+ }
-+ /* connect to best-effort service */
-+ connect.ServiceID = WMI_DATA_BE_SVC;
-+
-+ status = ar6000_connectservice(ar,
-+ &connect,
-+ WMI_BEST_EFFORT_PRI,
-+ "WMI DATA BE");
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ /* connect to back-ground
-+ * map this to WMI LOW_PRI */
-+ connect.ServiceID = WMI_DATA_BK_SVC;
-+ status = ar6000_connectservice(ar,
-+ &connect,
-+ WMI_LOW_PRI,
-+ "WMI DATA BK");
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ /* connect to Video service, map this to
-+ * to HI PRI */
-+ connect.ServiceID = WMI_DATA_VI_SVC;
-+ status = ar6000_connectservice(ar,
-+ &connect,
-+ WMI_HIGH_PRI,
-+ "WMI DATA VI");
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ /* connect to VO service, this is currently not
-+ * mapped to a WMI priority stream due to historical reasons.
-+ * WMI originally defined 3 priorities over 3 mailboxes
-+ * We can change this when WMI is reworked so that priorities are not
-+ * dependent on mailboxes */
-+ connect.ServiceID = WMI_DATA_VO_SVC;
-+ status = ar6000_connectservice(ar,
-+ &connect,
-+ WMI_HIGHEST_PRI,
-+ "WMI DATA VO");
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ A_ASSERT(arWMIStream2EndpointID(ar,WMI_CONTROL_PRI) != 0);
-+ A_ASSERT(arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI) != 0);
-+ A_ASSERT(arWMIStream2EndpointID(ar,WMI_LOW_PRI) != 0);
-+ A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGH_PRI) != 0);
-+ A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI) != 0);
-+ } while (FALSE);
-+
-+ if (A_FAILED(status)) {
-+ return (-EIO);
-+ }
++static struct led_pwm gta02_pwm_leds[] = {
++ {
++ .name = "gta02:orange:power",
++ .max_brightness = 0xff,
++ .pwm_period_ns = 1000000,
++ .pwm_id = 0,
++ },
++ {
++ .name = "gta02:blue:power",
++ .max_brightness = 0xff,
++ .pwm_period_ns = 1000000,
++ .pwm_id = 1,
++ },
++ {
++ .name = "gta02::vibrator",
++ .max_brightness = 0x3f,
++ .pwm_period_ns = 60000000,
++ .pwm_id = 3,
++ }
++};
+
+- /* We can't do this anywhere else. */
+- pcf50633_reg_write(pcf, PCF50633_REG_LEDDIM, 5);
++static struct led_pwm_platform_data gta02_pwm_leds_pdata = {
++ .num_leds = ARRAY_SIZE(gta02_pwm_leds),
++ .leds = gta02_pwm_leds,
+
+- if (!(pcf50633_reg_read(pcf, PCF50633_REG_LEDENA) & 3))
+- old_intensity = 0;
++ .init = gta02_pwm_led_init,
++ .notify = gta02_pwm_led_notify,
++ .exit = gta02_pwm_led_exit,
++};
+
+- /*
+- * The PCF50633 cannot handle LEDOUT = 0 (datasheet p60)
+- * if seen, you have to re-enable the LED unit.
+- */
+- if (!intensity || !old_intensity)
+- pcf50633_reg_write(pcf, PCF50633_REG_LEDENA, 0);
++static struct platform_device gta02_pwm_leds_device = {
++ .name = "leds_pwm",
++ .id = -1,
++ .dev = {
++ .platform_data = >a02_pwm_leds_pdata,
++ }
++};
+
-+ /*
-+ * give our connected endpoints some buffers
-+ */
-+ ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_CONTROL_PRI));
++/* BQ27000 Battery */
+
-+ ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI));
++struct bq27000_platform_data bq27000_pdata = {
++ .name = "battery",
++ .rsense_mohms = 20,
++ .hdq_read = hdq_read,
++ .hdq_write = hdq_write,
++ .hdq_initialized = hdq_initialized,
++ .get_charger_online_status = gta02_get_charger_online_status,
++ .get_charger_active_status = gta02_get_charger_active_status
++};
+
-+ /*
-+ * We will post the receive buffers only for SPE testing and so we are
-+ * making it conditional on the 'bypasswmi' flag.
-+ */
-+ if (bypasswmi) {
-+ ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_LOW_PRI));
-+ ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_HIGH_PRI));
-+ }
++struct platform_device bq27000_battery_device = {
++ .name = "bq27000-battery",
++ .dev = {
++ .platform_data = &bq27000_pdata,
++ },
++};
+
-+ /* setup credit distribution */
-+ ar6000_setup_credit_dist(ar->arHtcTarget, &ar->arCreditStateInfo);
++/* Platform battery */
+
-+ /* Since cookies are used for HTC transports, they should be */
-+ /* initialized prior to enabling HTC. */
-+ ar6000_cookie_init(ar);
++/* Capacity of a typical BL-5C dumb battery */
++#define GTA02_BAT_CHARGE_FULL 850000
+
-+ /* start HTC */
-+ status = HTCStart(ar->arHtcTarget);
++static int gta02_bat_voltscale(int volt)
++{
++ /* This table is suggested by SpeedEvil based on analysis of
++ * experimental data */
++ static const int lut[][2] = {
++ { 4120, 100 },
++ { 3900, 60 },
++ { 3740, 25 },
++ { 3600, 5 },
++ { 3000, 0 } };
++ int i, res = 0;
+
-+ if (status != A_OK) {
-+ if (ar->arWmiEnabled == TRUE) {
-+ wmi_shutdown(ar->arWmi);
-+ ar->arWmiEnabled = FALSE;
-+ ar->arWmi = NULL;
-+ }
-+ ar6000_cookie_cleanup(ar);
-+ return -EIO;
-+ }
++ if (volt > lut[0][0])
++ res = lut[0][1];
++ else
++ for (i = 0; lut[i][1]; i++) {
++ if (volt <= lut[i][0] && volt >= lut[i+1][0]) {
++ res = lut[i][1] - (lut[i][0]-volt)*
++ (lut[i][1]-lut[i+1][1])/
++ (lut[i][0]-lut[i+1][0]);
++ break;
++ }
++ }
++ return res;
++}
+
-+ if (!bypasswmi) {
-+ /* Wait for Wmi event to be ready */
-+ timeleft = wait_event_interruptible_timeout(arEvent,
-+ (ar->arWmiReady == TRUE), wmitimeout * HZ);
++static int gta02_bat_get_voltage(void)
++{
++ struct pcf50633 *pcf = gta02_pcf;
++ u16 adc, mv = 0;
++ adc = pcf50633_adc_sync_read(pcf,
++ PCF50633_ADCC1_MUX_BATSNS_RES,
++ PCF50633_ADCC1_AVERAGE_16);
++ /* The formula from DS is for divide-by-two mode, current driver uses
++ divide-by-three */
++ mv = (adc * 6000) / 1023;
++ return mv * 1000;
++}
+
+- /* Illegal to set LEDOUT to 0. */
+- if (!intensity)
+- pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_LEDOUT, 0x3f, 2);
++static int gta02_bat_get_present(void)
++{
++ /* There is no reliable way to tell if it is present or not */
++ return 1;
++}
+
-+ if(!timeleft || signal_pending(current))
-+ {
-+ AR_DEBUG_PRINTF("WMI is not ready or wait was interrupted\n");
-+#if defined(DWSIM) /* TBDXXX */
-+ AR_DEBUG_PRINTF(".....but proceed anyway.\n");
++static int gta02_bat_get_status(void)
++{
++#ifdef CONFIG_CHARGER_PCF50633
++ if (gta02_get_charger_active_status())
++ return POWER_SUPPLY_STATUS_CHARGING;
+ else
+- pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_LEDOUT, 0x3f,
+- intensity);
++ return POWER_SUPPLY_STATUS_DISCHARGING;
+#else
-+ return -EIO;
++ return POWER_SUPPLY_STATUS_UNKNOWN;
+#endif
-+ }
-+
-+ AR_DEBUG_PRINTF("%s() WMI is ready\n", __func__);
-+
-+ /* Communicate the wmi protocol verision to the target */
-+ if ((ar6000_set_host_app_area(ar)) != A_OK) {
-+ AR_DEBUG_PRINTF("Unable to set the host app area\n");
-+ }
-+ }
-+
-+ ar->arNumDataEndPts = 1;
-+
-+ return(0);
+}
-+
-+
-+void
-+ar6000_bitrate_rx(void *devt, A_INT32 rateKbps)
+
+- if (intensity)
+- pcf50633_reg_write(pcf, PCF50633_REG_LEDENA, 2);
++static int gta02_bat_get_capacity(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+ ar->arBitRate = rateKbps;
-+ wake_up(&arEvent);
++ return gta02_bat_voltscale(gta02_bat_get_voltage()/1000);
+}
+
-+void
-+ar6000_ratemask_rx(void *devt, A_UINT16 ratemask)
++static int gta02_bat_get_charge_full(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+ ar->arRateMask = ratemask;
-+ wake_up(&arEvent);
++ return GTA02_BAT_CHARGE_FULL;
+}
-+
-+void
-+ar6000_txPwr_rx(void *devt, A_UINT8 txPwr)
+
++static int gta02_bat_get_charge_now(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+ ar->arTxPwr = txPwr;
-+ wake_up(&arEvent);
-+}
++ return gta02_bat_get_capacity() * gta02_bat_get_charge_full() / 100;
+ }
+
+-static struct generic_bl_info gta02_bl_info = {
+- .name = "gta02-bl",
+- .max_intensity = 0xff,
+- .default_intensity = 0xff,
+- .set_bl_intensity = gta02_bl_set_intensity,
++static enum power_supply_property gta02_platform_bat_properties[] = {
++ POWER_SUPPLY_PROP_PRESENT,
++ POWER_SUPPLY_PROP_STATUS,
++ POWER_SUPPLY_PROP_VOLTAGE_NOW,
++ POWER_SUPPLY_PROP_CAPACITY,
++ POWER_SUPPLY_PROP_CHARGE_FULL,
++ POWER_SUPPLY_PROP_CHARGE_NOW,
++};
+
++int (*gta02_platform_bat_get_property[])(void) = {
++ gta02_bat_get_present,
++ gta02_bat_get_status,
++ gta02_bat_get_voltage,
++ gta02_bat_get_capacity,
++ gta02_bat_get_charge_full,
++ gta02_bat_get_charge_now,
++};
+
-+void
-+ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList)
++static struct platform_bat_platform_data gta02_platform_bat_pdata = {
++ .name = "battery",
++ .properties = gta02_platform_bat_properties,
++ .num_properties = ARRAY_SIZE(gta02_platform_bat_properties),
++ .get_property = gta02_platform_bat_get_property,
++ .is_present = gta02_bat_get_present,
+ };
+
+-static struct platform_device gta02_bl_dev = {
+- .name = "generic-bl",
+- .id = 1,
++struct platform_device gta02_platform_bat = {
++ .name = "platform_battery",
++ .id = -1,
+ .dev = {
+- .platform_data = >a02_bl_info,
+- },
++ .platform_data = >a02_platform_bat_pdata,
++ }
+ };
+
++/* HDQ */
+
++static void gta02_hdq_gpio_direction_out(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+
-+ A_MEMCPY(ar->arChannelList, chanList, numChan * sizeof (A_UINT16));
-+ ar->arNumChannels = numChan;
-+
-+ wake_up(&arEvent);
++ s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_OUTPUT);
+}
-+
-+A_UINT8
-+ar6000_ibss_map_epid(struct sk_buff *skb, struct net_device *dev, A_UINT32 * mapNo)
+
+-/* USB */
+-static struct s3c2410_hcd_info gta02_usb_info __initdata = {
+- .port[0] = {
+- .flags = S3C_HCDFLG_USED,
+- },
+- .port[1] = {
+- .flags = 0,
+- },
++static void gta02_hdq_gpio_direction_in(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_UINT8 *datap;
-+ ATH_MAC_HDR *macHdr;
-+ A_UINT32 i, eptMap;
-+
-+ (*mapNo) = 0;
-+ datap = A_NETBUF_DATA(skb);
-+ macHdr = (ATH_MAC_HDR *)(datap + sizeof(WMI_DATA_HDR));
-+ if (IEEE80211_IS_MULTICAST(macHdr->dstMac)) {
-+ return ENDPOINT_2;
-+ }
-+
-+ eptMap = -1;
-+ for (i = 0; i < ar->arNodeNum; i ++) {
-+ if (IEEE80211_ADDR_EQ(macHdr->dstMac, ar->arNodeMap[i].macAddress)) {
-+ (*mapNo) = i + 1;
-+ ar->arNodeMap[i].txPending ++;
-+ return ar->arNodeMap[i].epId;
-+ }
-+
-+ if ((eptMap == -1) && !ar->arNodeMap[i].txPending) {
-+ eptMap = i;
-+ }
-+ }
-+
-+ if (eptMap == -1) {
-+ eptMap = ar->arNodeNum;
-+ ar->arNodeNum ++;
-+ A_ASSERT(ar->arNodeNum <= MAX_NODE_NUM);
-+ }
-+
-+ A_MEMCPY(ar->arNodeMap[eptMap].macAddress, macHdr->dstMac, IEEE80211_ADDR_LEN);
-+
-+ for (i = ENDPOINT_2; i <= ENDPOINT_5; i ++) {
-+ if (!ar->arTxPending[i]) {
-+ ar->arNodeMap[eptMap].epId = i;
-+ break;
-+ }
-+ // No free endpoint is available, start redistribution on the inuse endpoints.
-+ if (i == ENDPOINT_5) {
-+ ar->arNodeMap[eptMap].epId = ar->arNexEpId;
-+ ar->arNexEpId ++;
-+ if (ar->arNexEpId > ENDPOINT_5) {
-+ ar->arNexEpId = ENDPOINT_2;
-+ }
-+ }
-+ }
-+
-+ (*mapNo) = eptMap + 1;
-+ ar->arNodeMap[eptMap].txPending ++;
-+
-+ return ar->arNodeMap[eptMap].epId;
++ s3c2410_gpio_cfgpin(GTA02v5_GPIO_HDQ, S3C2410_GPIO_INPUT);
+}
+
-+#ifdef DEBUG
-+static void ar6000_dump_skb(struct sk_buff *skb)
++static void gta02_hdq_gpio_set_value(int val)
+{
-+ u_char *ch;
-+ for (ch = A_NETBUF_DATA(skb);
-+ (A_UINT32)ch < ((A_UINT32)A_NETBUF_DATA(skb) +
-+ A_NETBUF_LEN(skb)); ch++)
-+ {
-+ AR_DEBUG_PRINTF("%2.2x ", *ch);
-+ }
-+ AR_DEBUG_PRINTF("\n");
++ s3c2410_gpio_setpin(GTA02v5_GPIO_HDQ, val);
+}
-+#endif
+
-+static int
-+ar6000_data_tx(struct sk_buff *skb, struct net_device *dev)
++static int gta02_hdq_gpio_get_value(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_PRI_STREAM_ID streamID = WMI_NOT_MAPPED;
-+ A_UINT32 mapNo = 0;
-+ int len;
-+ struct ar_cookie *cookie;
-+ A_BOOL checkAdHocPsMapping = FALSE;
++ return s3c2410_gpio_getpin(GTA02v5_GPIO_HDQ);
++}
+
-+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,13)
-+ skb->list = NULL;
-+#endif
++struct hdq_platform_data gta02_hdq_platform_data = {
++ .gpio_dir_out = gta02_hdq_gpio_direction_out,
++ .gpio_dir_in = gta02_hdq_gpio_direction_in,
++ .gpio_set = gta02_hdq_gpio_set_value,
++ .gpio_get = gta02_hdq_gpio_get_value,
+
-+ AR_DEBUG2_PRINTF("ar6000_data_tx start - skb=0x%x, data=0x%x, len=0x%x\n",
-+ (A_UINT32)skb, (A_UINT32)A_NETBUF_DATA(skb),
-+ A_NETBUF_LEN(skb));
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+ /* TCMD doesnt support any data, free the buf and return */
-+ if(ar->arTargetMode == AR6000_TCMD_MODE) {
-+ A_NETBUF_FREE(skb);
-+ return 0;
-+ }
-+#endif
-+ do {
-+
-+ if (ar->arWmiReady == FALSE && bypasswmi == 0) {
-+ break;
-+ }
-+
-+#ifdef BLOCK_TX_PATH_FLAG
-+ if (blocktx) {
-+ break;
-+ }
-+#endif /* BLOCK_TX_PATH_FLAG */
-+
-+ if (ar->arWmiEnabled) {
-+ if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len) {
-+ struct sk_buff *newbuf;
-+ /*
-+ * We really should have gotten enough headroom but sometimes
-+ * we still get packets with not enough headroom. Copy the packet.
-+ */
-+ len = A_NETBUF_LEN(skb);
-+ newbuf = A_NETBUF_ALLOC(len);
-+ if (newbuf == NULL) {
-+ break;
-+ }
-+ A_NETBUF_PUT(newbuf, len);
-+ A_MEMCPY(A_NETBUF_DATA(newbuf), A_NETBUF_DATA(skb), len);
-+ A_NETBUF_FREE(skb);
-+ skb = newbuf;
-+ /* fall through and assemble header */
-+ }
++ .enable_fiq = gta02_fiq_enable,
++ .disable_fiq = gta02_fiq_disable,
++ .kick_fiq = gta02_fiq_kick,
+ };
+
++struct platform_device gta02_hdq_device = {
++ .name = "hdq",
++ .id = -1,
++ .dev = {
++ .platform_data = >a02_hdq_platform_data,
++ .parent = &s3c_device_timer[2].dev,
++ },
++};
+
+ static void __init gta02_map_io(void)
+ {
+@@ -571,18 +1078,30 @@ static struct platform_device *gta02_devices[] __initdata = {
+ &s3c_device_usbgadget,
+ &s3c_device_nand,
+ >a02_nor_flash,
+- &s3c24xx_pwm_device,
++ &s3c_device_timer[0],
++ &s3c_device_timer[1],
++ &s3c_device_timer[2],
++ &s3c_device_timer[3],
+ &s3c_device_iis,
+ &s3c_device_i2c0,
++ >a02_buttons_device,
++ >a02_leds_device,
++ >a02_pwm_leds_device,
++ >a02_pm_gps_dev,
++ >a02_pm_bt_dev,
++ >a02_pm_wlan_dev,
++ >a02_glamo_dev,
++ &s3c_device_adc,
++ &s3c_device_ts,
+ };
+
+ /* These guys DO need to be children of PMU. */
+
+ static struct platform_device *gta02_devices_pmu_children[] = {
+- >a02_bl_dev,
++ >a02_hdq_device,
++ >a02_platform_bat,
+ };
+
+-
+ /*
+ * This is called when pc50633 is probed, quite late in the day since it is an
+ * I2C bus device. Here we can define platform devices with the advantage that
+@@ -612,11 +1131,184 @@ static void gta02_poweroff(void)
+ pcf50633_reg_set_bit_mask(gta02_pcf, PCF50633_REG_OOCSHDWN, 1, 1);
+ }
+
++struct gta02_device_children {
++ const char *dev_name;
++ size_t num_children;
++ struct platform_device **children;
++ void (*probed_callback)(struct device *dev);
++};
+
-+ if (wmi_dix_2_dot3(ar->arWmi, skb) != A_OK) {
-+ AR_DEBUG_PRINTF("ar6000_data_tx - wmi_dix_2_dot3 failed\n");
-+ break;
-+ }
++static struct platform_device* gta02_pcf50633_gpio_children[] = {
++ >a02_gsm_supply_device,
++};
+
-+ if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE) != A_OK) {
-+ AR_DEBUG_PRINTF("ar6000_data_tx - wmi_data_hdr_add failed\n");
-+ break;
-+ }
++static struct platform_device* gta02_gsm_supply_children[] = {
++ >a02_pm_gsm_dev,
++};
+
-+ if ((ar->arNetworkType == ADHOC_NETWORK) &&
-+ ar->arIbssPsEnable && ar->arConnected) {
-+ /* flag to check adhoc mapping once we take the lock below: */
-+ checkAdHocPsMapping = TRUE;
++static struct platform_device* gta02_hdq_children[] = {
++ &bq27000_battery_device,
++};
+
-+ } else {
-+ /* get the stream mapping */
-+ if (ar->arWmmEnabled) {
-+ streamID = wmi_get_stream_id(ar->arWmi,
-+ wmi_implicit_create_pstream(ar->arWmi, skb, UPLINK_TRAFFIC, UNDEFINED_PRI));
-+ } else {
-+ streamID = WMI_BEST_EFFORT_PRI;
-+ }
-+ }
+
-+ } else {
-+ struct iphdr *ipHdr;
-+ /*
-+ * the endpoint is directly based on the TOS field in the IP
-+ * header **** only for testing ******
-+ */
-+ ipHdr = A_NETBUF_DATA(skb) + sizeof(ATH_MAC_HDR);
-+ /* here we map the TOS field to an endpoint number, this is for
-+ * the endpointping test application */
-+ streamID = IP_TOS_TO_WMI_PRI(ipHdr->tos);
-+ }
++static struct gta02_device_children gta02_device_children[] = {
++ {
++ .dev_name = "pcf50633-gpio.0",
++ .num_children = 1,
++ .children = gta02_pcf50633_gpio_children,
++ },
++ {
++ .dev_name = "reg-fixed-voltage.1",
++ .num_children = 1,
++ .children = gta02_gsm_supply_children,
++ },
++ {
++ .dev_name = "spi2.0",
++ .probed_callback = gta02_jbt6k74_probe_completed,
++ },
++ {
++ .dev_name = "hdq",
++ .num_children = 1,
++ .children = gta02_hdq_children,
++ },
++};
+
-+ } while (FALSE);
++static int gta02_add_child_devices(struct device *parent,
++ struct platform_device **children,
++ size_t num_children)
++{
++ size_t i;
+
-+ /* did we succeed ? */
-+ if ((streamID == WMI_NOT_MAPPED) && !checkAdHocPsMapping) {
-+ /* cleanup and exit */
-+ A_NETBUF_FREE(skb);
-+ AR6000_STAT_INC(ar, tx_dropped);
-+ AR6000_STAT_INC(ar, tx_aborted_errors);
-+ return 0;
-+ }
++ for (i = 0; i < num_children; ++i)
++ children[i]->dev.parent = parent;
+
-+ cookie = NULL;
++ return platform_add_devices(children, num_children);
++}
+
-+ /* take the lock to protect driver data */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++static int gta02_device_registered(struct notifier_block *block,
++ unsigned long action, void *data)
++{
++ struct device *dev = data;
++ const char *devname = dev_name(dev);
++ size_t i;
+
-+ do {
++ if (action != BUS_NOTIFY_BOUND_DRIVER)
++ return 0;
+
-+ if (checkAdHocPsMapping) {
-+ streamID = ar6000_ibss_map_epid(skb, dev, &mapNo);
-+ }
++ for (i = 0; i < ARRAY_SIZE(gta02_device_children); ++i) {
++ if (strcmp(devname, gta02_device_children[i].dev_name) == 0) {
++ gta02_add_child_devices(dev, gta02_device_children[i].children,
++ gta02_device_children[i].num_children);
+
-+ A_ASSERT(streamID != WMI_NOT_MAPPED);
++ if (gta02_device_children[i].probed_callback)
++ gta02_device_children[i].probed_callback(dev);
++ break;
++ }
++ }
+
-+ /* validate that the endpoint is connected */
-+ if (arWMIStream2EndpointID(ar,streamID) == 0) {
-+ AR_DEBUG_PRINTF("Stream %d is NOT mapped!\n",streamID);
-+ break;
-+ }
-+ /* allocate resource for this packet */
-+ cookie = ar6000_alloc_cookie(ar);
++ return 0;
++}
+
-+ if (cookie != NULL) {
-+ /* update counts while the lock is held */
-+ ar->arTxPending[streamID]++;
-+ ar->arTotalTxDataPending++;
-+ }
++static struct notifier_block gta02_device_register_notifier = {
++ .notifier_call = gta02_device_registered,
++ .priority = INT_MAX,
++};
+
-+ } while (FALSE);
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++/* On hardware rev 5 and earlier the leds are missing a resistor and reading
++ * from their gpio pins will always return 0, so we have to shadow the
++ * led states software */
++static unsigned long gpb_shadow;
++extern struct s3c_gpio_chip s3c24xx_gpios[];
+
-+ if (cookie != NULL) {
-+ cookie->arc_bp[0] = (A_UINT32)skb;
-+ cookie->arc_bp[1] = mapNo;
-+ SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
-+ cookie,
-+ A_NETBUF_DATA(skb),
-+ A_NETBUF_LEN(skb),
-+ arWMIStream2EndpointID(ar,streamID),
-+ AR6K_DATA_PKT_TAG);
++static void gta02_gpb_set(struct gpio_chip *chip,
++ unsigned offset, int value)
++{
++ void __iomem *base = S3C24XX_GPIO_BASE(S3C2410_GPB(0));
++ unsigned long flags;
++ unsigned long dat;
+
-+#ifdef DEBUG
-+ if (debugdriver >= 3) {
-+ ar6000_dump_skb(skb);
-+ }
-+#endif
-+ /* HTC interface is asynchronous, if this fails, cleanup will happen in
-+ * the ar6000_tx_complete callback */
-+ HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
-+ } else {
-+ /* no packet to send, cleanup */
-+ A_NETBUF_FREE(skb);
-+ AR6000_STAT_INC(ar, tx_dropped);
-+ AR6000_STAT_INC(ar, tx_aborted_errors);
-+ }
++ local_irq_save(flags);
+
-+ return 0;
-+}
++ dat = __raw_readl(base + 0x04) | gpb_shadow;
++ dat &= ~(1 << offset);
++ gpb_shadow &= ~(1 << offset);
++ if (value) {
++ dat |= 1 << offset;
++ switch (offset) {
++ case 0 ... 2:
++ gpb_shadow |= 1 << offset;
++ break;
++ default:
++ break;
++ }
++ }
++ __raw_writel(dat, base + 0x04);
+
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+static void
-+tvsub(register struct timeval *out, register struct timeval *in)
-+{
-+ if((out->tv_usec -= in->tv_usec) < 0) {
-+ out->tv_sec--;
-+ out->tv_usec += 1000000;
-+ }
-+ out->tv_sec -= in->tv_sec;
++ local_irq_restore(flags);
+}
+
-+void
-+applyAPTCHeuristics(AR_SOFTC_T *ar)
++static int gta02_gpb_get(struct gpio_chip *chip, unsigned offset)
+{
-+ A_UINT32 duration;
-+ A_UINT32 numbytes;
-+ A_UINT32 throughput;
-+ struct timeval ts;
-+ A_STATUS status;
-+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+ if ((enableAPTCHeuristics) && (!aptcTR.timerScheduled)) {
-+ do_gettimeofday(&ts);
-+ tvsub(&ts, &aptcTR.samplingTS);
-+ duration = ts.tv_sec * 1000 + ts.tv_usec / 1000; /* ms */
-+ numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
-+
-+ if (duration > APTC_TRAFFIC_SAMPLING_INTERVAL) {
-+ /* Initialize the time stamp and byte count */
-+ aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
-+ do_gettimeofday(&aptcTR.samplingTS);
++ void __iomem *base = S3C24XX_GPIO_BASE(S3C2410_GPB(0));
++ unsigned long val;
+
-+ /* Calculate and decide based on throughput thresholds */
-+ throughput = ((numbytes * 8) / duration);
-+ if (throughput > APTC_UPPER_THROUGHPUT_THRESHOLD) {
-+ /* Disable Sleep and schedule a timer */
-+ A_ASSERT(ar->arWmiReady == TRUE);
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ status = wmi_powermode_cmd(ar->arWmi, MAX_PERF_POWER);
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
-+ aptcTR.timerScheduled = TRUE;
-+ }
-+ }
-+ }
++ val = __raw_readl(base + 0x04) | gpb_shadow;
++ val >>= offset;
++ val &= 1;
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ return val;
+}
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+static void
-+ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint)
++static void gta02_hijack_gpb(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *) Context;
-+
-+ if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
-+ if (!bypasswmi) {
-+ /* under normal WMI if this is getting full, then something is running rampant
-+ * the host should not be exhausting the WMI queue with too many commands
-+ * the only exception to this is during testing using endpointping */
++/* Uncomment this, once support for S3C_SYSTEM_REV_ATAG has been merged
++ * upstream.
++ if (S3C_SYSTEM_REV_ATAG > GTA02v5_SYSTEM_REV)
++ return;
++*/
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ /* set flag to handle subsequent messages */
-+ ar->arWMIControlEpFull = TRUE;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ AR_DEBUG_PRINTF("WMI Control Endpoint is FULL!!! \n");
-+ }
-+ } else {
-+ /* one of the data endpoints queues is getting full..need to stop network stack
-+ * the queue will resume after credits received */
-+ netif_stop_queue(ar->arNetDev);
-+ }
++ s3c24xx_gpios[1].chip.set = gta02_gpb_set;
++ s3c24xx_gpios[1].chip.get = gta02_gpb_get;
+}
+
-+static void
-+ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint)
++/*
++ * Allow the bootloader to enable hw ecc
++ * hardware_ecc=1|0
++ */
++static int __init hardware_ecc_setup(char *str)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+
-+ if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
-+ /* FIXME: what do for it? */
-+ } else {
-+ /* Wake up interface, rescheduling prevented. */
-+ if (ar->arConnected == TRUE || bypasswmi)
-+ netif_wake_queue(ar->arNetDev);
-+ }
++ if (str && str[0] == '1')
++ gta02_nand_info.software_ecc = 0;
++ return 1;
+}
++__setup("hardware_ecc=", hardware_ecc_setup);
+
-+static void
-+ar6000_tx_complete(void *Context, HTC_PACKET *pPacket)
++static void gta02_request_gpios(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+ void *cookie = (void *)pPacket->pPktContext;
-+ struct sk_buff *skb = NULL;
-+ A_UINT32 mapNo = 0;
-+ A_STATUS status;
-+ struct ar_cookie * ar_cookie;
-+ WMI_PRI_STREAM_ID streamID;
-+ A_BOOL wakeEvent = FALSE;
-+
-+ status = pPacket->Status;
-+ ar_cookie = (struct ar_cookie *)cookie;
-+ skb = (struct sk_buff *)ar_cookie->arc_bp[0];
-+ streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
-+ mapNo = ar_cookie->arc_bp[1];
-+
-+ A_ASSERT(skb);
-+ A_ASSERT(pPacket->pBuffer == A_NETBUF_DATA(skb));
-+
-+ if (A_SUCCESS(status)) {
-+ A_ASSERT(pPacket->ActualLength == A_NETBUF_LEN(skb));
-+ }
-+
-+ AR_DEBUG2_PRINTF("ar6000_tx_complete skb=0x%x data=0x%x len=0x%x sid=%d ",
-+ (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
-+ pPacket->ActualLength,
-+ streamID);
-+
-+ /* lock the driver as we update internal state */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+
-+ ar->arTxPending[streamID]--;
-+
-+ if ((streamID != WMI_CONTROL_PRI) || bypasswmi) {
-+ ar->arTotalTxDataPending--;
-+ }
-+
-+ if (streamID == WMI_CONTROL_PRI)
-+ {
-+ if (ar->arWMIControlEpFull) {
-+ /* since this packet completed, the WMI EP is no longer full */
-+ ar->arWMIControlEpFull = FALSE;
-+ }
-+
-+ if (ar->arTxPending[streamID] == 0) {
-+ wakeEvent = TRUE;
-+ }
-+ }
-+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF("%s() -TX ERROR, status: 0x%x\n", __func__,
-+ status);
-+ AR6000_STAT_INC(ar, tx_errors);
-+ } else {
-+ AR_DEBUG2_PRINTF("OK\n");
-+ AR6000_STAT_INC(ar, tx_packets);
-+ ar->arNetStats.tx_bytes += A_NETBUF_LEN(skb);
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+ aptcTR.bytesTransmitted += a_netbuf_to_len(skb);
-+ applyAPTCHeuristics(ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
-+ }
-+
-+ // TODO this needs to be looked at
-+ if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable
-+ && (streamID != WMI_CONTROL_PRI) && mapNo)
-+ {
-+ mapNo --;
-+ ar->arNodeMap[mapNo].txPending --;
-+
-+ if (!ar->arNodeMap[mapNo].txPending && (mapNo == (ar->arNodeNum - 1))) {
-+ A_UINT32 i;
-+ for (i = ar->arNodeNum; i > 0; i --) {
-+ if (!ar->arNodeMap[i - 1].txPending) {
-+ A_MEMZERO(&ar->arNodeMap[i - 1], sizeof(struct ar_node_mapping));
-+ ar->arNodeNum --;
-+ } else {
-+ break;
-+ }
-+ }
-+ }
-+ }
-+
-+ /* Freeing a cookie should not be contingent on either of */
-+ /* these flags, just if we have a cookie or not. */
-+ /* Can we even get here without a cookie? Fix later. */
-+ if (ar->arWmiReady == TRUE || (bypasswmi))
-+ {
-+ ar6000_free_cookie(ar, cookie);
++ int ret;
++ ret = gpio_request(GTA02_GPIO_USB_PULLUP, "USB pullup");
++ if (ret) {
++ printk(KERN_ERR "Failed to request USB pullup gpio pin: %d\n", ret);
++ } else {
++ ret = gpio_direction_output(GTA02_GPIO_USB_PULLUP, 0);
++ if (ret)
++ printk(KERN_ERR "Failed to set USB pullup gpio direction: %d\n", ret);
+ }
++}
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+ static void __init gta02_machine_init(void)
+ {
+ /* Set the panic callback to make AUX LED blink at ~5Hz. */
+ panic_blink = gta02_panic_blink;
+
++ bus_register_notifier(&platform_bus_type, >a02_device_register_notifier);
++ bus_register_notifier(&spi_bus_type, >a02_device_register_notifier);
+
-+ /* lock is released, we can freely call other kernel APIs */
++ gta02_hijack_gpb();
+
-+ /* this indirectly frees the HTC_PACKET */
-+ A_NETBUF_FREE(skb);
++ gta02_request_gpios();
+
-+ if (wakeEvent) {
-+ wake_up(&arEvent);
-+ }
-+}
+ s3c_pm_init();
+
+ #ifdef CONFIG_CHARGER_PCF50633
+@@ -624,13 +1316,17 @@ static void __init gta02_machine_init(void)
+ #endif
+
+ s3c24xx_udc_set_platdata(>a02_udc_cfg);
++ s3c24xx_ts_set_platdata(>a02_ts_info);
+ s3c_ohci_set_platdata(>a02_usb_info);
+ s3c_nand_set_platdata(>a02_nand_info);
+ s3c_i2c0_set_platdata(NULL);
++ spi_register_board_info(gta02_spi_board_info,
++ ARRAY_SIZE(gta02_spi_board_info));
+
+ i2c_register_board_info(0, gta02_i2c_devs, ARRAY_SIZE(gta02_i2c_devs));
+
+ platform_add_devices(gta02_devices, ARRAY_SIZE(gta02_devices));
+
-+/*
-+ * Receive event handler. This is called by HTC when a packet is received
-+ */
-+int pktcount;
-+static void
-+ar6000_rx(void *Context, HTC_PACKET *pPacket)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+ struct sk_buff *skb = (struct sk_buff *)pPacket->pPktContext;
-+ int minHdrLen;
-+ A_STATUS status = pPacket->Status;
-+ WMI_PRI_STREAM_ID streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
-+ HTC_ENDPOINT_ID ept = pPacket->Endpoint;
+ pm_power_off = gta02_poweroff;
+ }
+
+diff --git a/arch/arm/plat-s3c24xx/gpiolib.c b/arch/arm/plat-s3c24xx/gpiolib.c
+index 4f0f11a..c0b0366 100644
+--- a/arch/arm/plat-s3c24xx/gpiolib.c
++++ b/arch/arm/plat-s3c24xx/gpiolib.c
+@@ -26,6 +26,7 @@
+ #include <plat/pm.h>
+
+ #include <mach/regs-gpio.h>
++#include <mach/regs-gpioj.h>
+
+ static int s3c24xx_gpiolib_banka_input(struct gpio_chip *chip, unsigned offset)
+ {
+@@ -160,8 +161,16 @@ struct s3c_gpio_chip s3c24xx_gpios[] = {
+ .label = "GPIOH",
+ .ngpio = 11,
+ },
+- },
+-};
++ }, {
++ .base = S3C2440_GPJCON,
++ .pm = __gpio_pm(&s3c_gpio_pm_2bit),
++ .chip = {
++ .base = S3C2440_GPJ0,
++ .owner = THIS_MODULE,
++ .label = "GPIOJ",
++ .ngpio = 11,
++ },
++ },};
+
+ static __init int s3c24xx_gpiolib_init(void)
+ {
+diff --git a/arch/arm/plat-s3c24xx/include/plat/irq.h b/arch/arm/plat-s3c24xx/include/plat/irq.h
+index 69e1be8..11a8664 100644
+--- a/arch/arm/plat-s3c24xx/include/plat/irq.h
++++ b/arch/arm/plat-s3c24xx/include/plat/irq.h
+@@ -12,6 +12,7 @@
+
+ #include <linux/io.h>
+
++#include <mach/irqs.h>
+ #include <mach/hardware.h>
+ #include <mach/regs-irq.h>
+ #include <mach/regs-gpio.h>
+@@ -31,8 +32,15 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
+ {
+ unsigned long mask;
+ unsigned long submask;
++#ifdef CONFIG_S3C2440_C_FIQ
++ unsigned long flags;
++#endif
+
+ submask = __raw_readl(S3C2410_INTSUBMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_save_flags(flags);
++ local_fiq_disable();
++#endif
+ mask = __raw_readl(S3C2410_INTMSK);
+
+ submask |= (1UL << (irqno - IRQ_S3CUART_RX0));
+@@ -45,6 +53,9 @@ s3c_irqsub_mask(unsigned int irqno, unsigned int parentbit,
+
+ /* write back masks */
+ __raw_writel(submask, S3C2410_INTSUBMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_irq_restore(flags);
++#endif
+
+ }
+
+@@ -53,8 +64,15 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
+ {
+ unsigned long mask;
+ unsigned long submask;
++#ifdef CONFIG_S3C2440_C_FIQ
++ unsigned long flags;
++#endif
+
+ submask = __raw_readl(S3C2410_INTSUBMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_save_flags(flags);
++ local_fiq_disable();
++#endif
+ mask = __raw_readl(S3C2410_INTMSK);
+
+ submask &= ~(1UL << (irqno - IRQ_S3CUART_RX0));
+@@ -63,6 +81,9 @@ s3c_irqsub_unmask(unsigned int irqno, unsigned int parentbit)
+ /* write back masks */
+ __raw_writel(submask, S3C2410_INTSUBMSK);
+ __raw_writel(mask, S3C2410_INTMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_irq_restore(flags);
++#endif
+ }
+
+
+diff --git a/arch/arm/plat-s3c24xx/irq.c b/arch/arm/plat-s3c24xx/irq.c
+index ad0d44e..0a8553b 100644
+--- a/arch/arm/plat-s3c24xx/irq.c
++++ b/arch/arm/plat-s3c24xx/irq.c
+@@ -28,6 +28,8 @@
+ #include <asm/mach/irq.h>
+
+ #include <plat/regs-irqtype.h>
++#include <mach/regs-irq.h>
++#include <mach/regs-gpio.h>
+
+ #include <plat/cpu.h>
+ #include <plat/pm.h>
+@@ -37,12 +39,20 @@ static void
+ s3c_irq_mask(unsigned int irqno)
+ {
+ unsigned long mask;
+-
++#ifdef CONFIG_S3C2440_C_FIQ
++ unsigned long flags;
++#endif
+ irqno -= IRQ_EINT0;
+-
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_save_flags(flags);
++ local_fiq_disable();
++#endif
+ mask = __raw_readl(S3C2410_INTMSK);
+ mask |= 1UL << irqno;
+ __raw_writel(mask, S3C2410_INTMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_irq_restore(flags);
++#endif
+ }
+
+ static inline void
+@@ -59,9 +69,19 @@ s3c_irq_maskack(unsigned int irqno)
+ {
+ unsigned long bitval = 1UL << (irqno - IRQ_EINT0);
+ unsigned long mask;
++#ifdef CONFIG_S3C2440_C_FIQ
++ unsigned long flags;
++#endif
+
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_save_flags(flags);
++ local_fiq_disable();
++#endif
+ mask = __raw_readl(S3C2410_INTMSK);
+ __raw_writel(mask|bitval, S3C2410_INTMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_irq_restore(flags);
++#endif
+
+ __raw_writel(bitval, S3C2410_SRCPND);
+ __raw_writel(bitval, S3C2410_INTPND);
+@@ -72,15 +92,25 @@ static void
+ s3c_irq_unmask(unsigned int irqno)
+ {
+ unsigned long mask;
++#ifdef CONFIG_S3C2440_C_FIQ
++ unsigned long flags;
++#endif
+
+ if (irqno != IRQ_TIMER4 && irqno != IRQ_EINT8t23)
+ irqdbf2("s3c_irq_unmask %d\n", irqno);
+
+ irqno -= IRQ_EINT0;
+
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_save_flags(flags);
++ local_fiq_disable();
++#endif
+ mask = __raw_readl(S3C2410_INTMSK);
+ mask &= ~(1UL << irqno);
+ __raw_writel(mask, S3C2410_INTMSK);
++#ifdef CONFIG_S3C2440_C_FIQ
++ local_irq_restore(flags);
++#endif
+ }
+
+ struct irq_chip s3c_irq_level_chip = {
+@@ -561,26 +591,26 @@ void __init s3c24xx_init_irq(void)
+
+ last = 0;
+ for (i = 0; i < 4; i++) {
+- pend = __raw_readl(S3C2410_INTPND);
++ pend = __raw_readl(S3C2410_SUBSRCPND);
+
+ if (pend == 0 || pend == last)
+ break;
+
+- __raw_writel(pend, S3C2410_SRCPND);
+- __raw_writel(pend, S3C2410_INTPND);
+- printk("irq: clearing pending status %08x\n", (int)pend);
++ printk("irq: clearing subpending status %08x\n", (int)pend);
++ __raw_writel(pend, S3C2410_SUBSRCPND);
+ last = pend;
+ }
+
+ last = 0;
+ for (i = 0; i < 4; i++) {
+- pend = __raw_readl(S3C2410_SUBSRCPND);
++ pend = __raw_readl(S3C2410_INTPND);
+
+ if (pend == 0 || pend == last)
+ break;
+
+- printk("irq: clearing subpending status %08x\n", (int)pend);
+- __raw_writel(pend, S3C2410_SUBSRCPND);
++ __raw_writel(pend, S3C2410_SRCPND);
++ __raw_writel(pend, S3C2410_INTPND);
++ printk("irq: clearing pending status %08x\n", (int)pend);
+ last = pend;
+ }
+
+@@ -631,15 +661,13 @@ void __init s3c24xx_init_irq(void)
+
+ for (irqno = IRQ_EINT0; irqno <= IRQ_EINT3; irqno++) {
+ irqdbf("registering irq %d (ext int)\n", irqno);
+- set_irq_chip(irqno, &s3c_irq_eint0t4);
+- set_irq_handler(irqno, handle_edge_irq);
++ set_irq_chip_and_handler(irqno, &s3c_irq_eint0t4, handle_level_irq);
+ set_irq_flags(irqno, IRQF_VALID);
+ }
+
+ for (irqno = IRQ_EINT4; irqno <= IRQ_EINT23; irqno++) {
+ irqdbf("registering irq %d (extended s3c irq)\n", irqno);
+- set_irq_chip(irqno, &s3c_irqext_chip);
+- set_irq_handler(irqno, handle_edge_irq);
++ set_irq_chip_and_handler(irqno, &s3c_irqext_chip, handle_level_irq);
+ set_irq_flags(irqno, IRQF_VALID);
+ }
+
+diff --git a/arch/arm/plat-samsung/include/plat/nand.h b/arch/arm/plat-samsung/include/plat/nand.h
+index b64115f..cbdc8f0 100644
+--- a/arch/arm/plat-samsung/include/plat/nand.h
++++ b/arch/arm/plat-samsung/include/plat/nand.h
+@@ -49,6 +49,7 @@ struct s3c2410_platform_nand {
+ int twrph1; /* time for release CLE/ALE from nWE/nOE inactive */
+
+ unsigned int ignore_unset_ecc:1;
++ unsigned int software_ecc:1; /* force software ecc at runtime */
+
+ int nr_sets;
+ struct s3c2410_nand_set *sets;
+diff --git a/arch/arm/plat-samsung/include/plat/uncompress.h b/arch/arm/plat-samsung/include/plat/uncompress.h
+index 7d6ed72..152c496 100644
+--- a/arch/arm/plat-samsung/include/plat/uncompress.h
++++ b/arch/arm/plat-samsung/include/plat/uncompress.h
+@@ -37,6 +37,8 @@ static void arch_detect_cpu(void);
+ /* how many bytes we allow into the FIFO at a time in FIFO mode */
+ #define FIFO_MAX (14)
+
++#if CONFIG_S3C_LOWLEVEL_UART_PORT >= 0
+
-+ A_ASSERT((status != A_OK) || (pPacket->pBuffer == (A_NETBUF_DATA(skb) + HTC_HEADER_LEN)));
+ #define uart_base S3C_PA_UART + (S3C_UART_OFFSET * CONFIG_S3C_LOWLEVEL_UART_PORT)
+
+ static __inline__ void
+@@ -86,10 +88,6 @@ static void putc(int ch)
+ uart_wr(S3C2410_UTXH, ch);
+ }
+
+-static inline void flush(void)
+-{
+-}
+-
+ #define __raw_writel(d, ad) \
+ do { \
+ *((volatile unsigned int __force *)(ad)) = (d); \
+@@ -161,6 +159,19 @@ static inline void arch_enable_uart_fifo(void)
+ #define arch_enable_uart_fifo() do { } while(0)
+ #endif
+
++#else
++static inline void putc(int ch)
++{
++}
+
-+ AR_DEBUG2_PRINTF("ar6000_rx ar=0x%x sid=%d, skb=0x%x, data=0x%x, len=0x%x ",
-+ (A_UINT32)ar, streamID, (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
-+ pPacket->ActualLength);
-+ if (status != A_OK) {
-+ AR_DEBUG2_PRINTF("ERR\n");
-+ } else {
-+ AR_DEBUG2_PRINTF("OK\n");
-+ }
++#define arch_enable_uart_fifo() do { } while(0)
++#define arch_decomp_wdog_start()
++#define arch_decomp_wdog()
++#endif
+
-+ /* take lock to protect buffer counts
-+ * and adaptive power throughput state */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++static inline void flush(void)
++{
++}
+
+ static void
+ arch_decomp_setup(void)
+diff --git a/drivers/Kconfig b/drivers/Kconfig
+index a2b902f..a211562 100644
+--- a/drivers/Kconfig
++++ b/drivers/Kconfig
+@@ -111,4 +111,6 @@ source "drivers/xen/Kconfig"
+ source "drivers/staging/Kconfig"
+
+ source "drivers/platform/Kconfig"
+
-+ ar->arRxBuffers[streamID]--;
++source "drivers/ar6000/Kconfig"
+ endmenu
+diff --git a/drivers/Makefile b/drivers/Makefile
+index f42a030..8794a27 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -94,6 +94,7 @@ obj-$(CONFIG_CPU_IDLE) += cpuidle/
+ obj-y += idle/
+ obj-$(CONFIG_MMC) += mmc/
+ obj-$(CONFIG_MEMSTICK) += memstick/
++obj-$(CONFIG_AR6000_WLAN) += ar6000/
+ obj-$(CONFIG_NEW_LEDS) += leds/
+ obj-$(CONFIG_INFINIBAND) += infiniband/
+ obj-$(CONFIG_SGI_SN) += sn/
+diff --git a/drivers/ar6000/Kconfig b/drivers/ar6000/Kconfig
+new file mode 100644
+index 0000000..29b28b8
+--- /dev/null
++++ b/drivers/ar6000/Kconfig
+@@ -0,0 +1,32 @@
++config AR6000_WLAN
++ tristate "AR6000 wireless networking over SDIO"
++ depends on MMC
++ select WIRELESS_EXT
++ select WEXT_PRIV
++ default m
++ help
++ good luck.
+
-+ if (A_SUCCESS(status)) {
-+ AR6000_STAT_INC(ar, rx_packets);
-+ ar->arNetStats.rx_bytes += pPacket->ActualLength;
-+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
-+ aptcTR.bytesReceived += a_netbuf_to_len(skb);
-+ applyAPTCHeuristics(ar);
-+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++config AR6000_WLAN_DEBUG
++ bool "Enable retrieval of firmware debugging information"
++ depends on AR6000_WLAN
++ default n
++ help
++ The AR6k firmware maintains a log of debugging events that
++ gets flushed to the host on various occasions. Retrieval of
++ this data is very slow, taking several seconds.
+
-+ A_NETBUF_PUT(skb, pPacket->ActualLength + HTC_HEADER_LEN);
-+ A_NETBUF_PULL(skb, HTC_HEADER_LEN);
++ If in doubt, say N.
+
-+#ifdef DEBUG
-+ if (debugdriver >= 2) {
-+ ar6000_dump_skb(skb);
-+ }
-+#endif /* DEBUG */
-+ }
++config AR6000_WLAN_RESET
++ bool "Soft-reset when shutting down"
++ depends on AR6000_WLAN
++ default n
++ help
++ The AR6k module can be explicitly reset when shutting down
++ the device. This adds a delay of about two seconds to suspend,
++ module removal, and so on. Since the WLAN SDIO function is
++ generally disabled soon thereafter anyway, this reset seems
++ superfluous.
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ If in doubt, say N.
+diff --git a/drivers/ar6000/Makefile b/drivers/ar6000/Makefile
+new file mode 100644
+index 0000000..f8f4431
+--- /dev/null
++++ b/drivers/ar6000/Makefile
+@@ -0,0 +1,38 @@
++REV ?= 2
+
-+ if (status != A_OK) {
-+ AR6000_STAT_INC(ar, rx_errors);
-+ A_NETBUF_FREE(skb);
-+ } else if (ar->arWmiEnabled == TRUE) {
-+ if (streamID == WMI_CONTROL_PRI) {
-+ /*
-+ * this is a wmi control msg
-+ */
-+ wmi_control_rx(ar->arWmi, skb);
-+ } else {
-+ WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
-+ if (WMI_DATA_HDR_IS_MSG_TYPE(dhdr, CNTL_MSGTYPE)) {
-+ /*
-+ * this is a wmi control msg
-+ */
-+ /* strip off WMI hdr */
-+ wmi_data_hdr_remove(ar->arWmi, skb);
-+ wmi_control_rx(ar->arWmi, skb);
-+ } else {
-+ /*
-+ * this is a wmi data packet
-+ */
-+ minHdrLen = sizeof (WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) +
-+ sizeof(ATH_LLC_SNAP_HDR);
++PWD := $(shell pwd)
+
-+ if ((pPacket->ActualLength < minHdrLen) ||
-+ (pPacket->ActualLength > AR6000_BUFFER_SIZE))
-+ {
-+ /*
-+ * packet is too short or too long
-+ */
-+ AR_DEBUG_PRINTF("TOO SHORT or TOO LONG\n");
-+ AR6000_STAT_INC(ar, rx_errors);
-+ AR6000_STAT_INC(ar, rx_length_errors);
-+ A_NETBUF_FREE(skb);
-+ } else {
-+ if (ar->arWmmEnabled) {
-+ wmi_implicit_create_pstream(ar->arWmi, skb,
-+ DNLINK_TRAFFIC, UNDEFINED_PRI);
-+ }
-+#if 0
-+ /* Access RSSI values here */
-+ AR_DEBUG_PRINTF("RSSI %d\n",
-+ ((WMI_DATA_HDR *) A_NETBUF_DATA(skb))->rssi);
-+#endif
-+ wmi_data_hdr_remove(ar->arWmi, skb);
-+ wmi_dot3_2_dix(ar->arWmi, skb);
++EXTRA_CFLAGS += -I$(src)/include
+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
-+ /*
-+ * extra push and memcpy, for eth_type_trans() of 2.4 kernel
-+ * will pull out hard_header_len bytes of the skb.
-+ */
-+ A_NETBUF_PUSH(skb, sizeof(WMI_DATA_HDR) + sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN);
-+ A_MEMCPY(A_NETBUF_DATA(skb), A_NETBUF_DATA(skb) + sizeof(WMI_DATA_HDR) +
-+ sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN, sizeof(ATH_MAC_HDR));
-+#endif
-+ if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
-+ {
-+ skb->dev = ar->arNetDev;
-+ skb->protocol = eth_type_trans(skb, ar->arNetDev);
-+ netif_rx(skb);
-+ }
-+ else
-+ {
-+ A_NETBUF_FREE(skb);
-+ }
-+ }
-+ }
-+ }
-+ } else {
-+ if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
-+ {
-+ skb->dev = ar->arNetDev;
-+ skb->protocol = eth_type_trans(skb, ar->arNetDev);
-+ netif_rx(skb);
-+ }
-+ else
-+ {
-+ A_NETBUF_FREE(skb);
-+ }
-+ }
++EXTRA_CFLAGS += -DLINUX -D__KERNEL__ -DHTC_RAW_INTERFACE\
++ -DTCMD -DUSER_KEYS \
++ -DNO_SYNC_FLUSH #\
++ -DMULTIPLE_FRAMES_PER_INTERRUPT -DAR6000REV$(REV) \
++ -DBLOCK_TX_PATH_FLAG \
++ -DSDIO \
+
-+ if (status != A_ECANCELED) {
-+ /*
-+ * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+ * (probably due to a shutdown)
-+ */
-+ ar6000_rx_refill(Context, ept);
-+ }
++EXTRA_CFLAGS += -DKERNEL_2_6
+
++obj-$(CONFIG_AR6000_WLAN) += ar6000.o
+
-+}
++ar6000-objs += htc/ar6k.o \
++ htc/ar6k_events.o \
++ htc/htc_send.o \
++ htc/htc_recv.o \
++ htc/htc_services.o \
++ htc/htc.o \
++ hif/hif2.o \
++ bmi/bmi.o \
++ ar6000/ar6000_drv.o \
++ ar6000/ar6000_raw_if.o \
++ ar6000/netbuf.o \
++ ar6000/wireless_ext.o \
++ ar6000/ioctl.o \
++ miscdrv/common_drv.o \
++ miscdrv/credit_dist.o \
++ wmi/wmi.o \
++ wlan/wlan_node.o \
++ wlan/wlan_recv_beacon.o \
++ wlan/wlan_utils.o
+
-+static void
-+ar6000_rx_refill(void *Context, HTC_ENDPOINT_ID Endpoint)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+ void *osBuf;
-+ int RxBuffers;
-+ int buffersToRefill;
-+ HTC_PACKET *pPacket;
-+ WMI_PRI_STREAM_ID streamId = arEndpoint2WMIStreamID(ar,Endpoint);
+
-+ buffersToRefill = (int)AR6000_MAX_RX_BUFFERS -
-+ (int)ar->arRxBuffers[streamId];
+diff --git a/drivers/ar6000/ar6000/ar6000_drv.c b/drivers/ar6000/ar6000/ar6000_drv.c
+new file mode 100644
+index 0000000..90533ab
+--- /dev/null
++++ b/drivers/ar6000/ar6000/ar6000_drv.c
+@@ -0,0 +1,3129 @@
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ if (buffersToRefill <= 0) {
-+ /* fast return, nothing to fill */
-+ return;
-+ }
++/*
++ * This driver is a pseudo ethernet driver to access the Atheros AR6000
++ * WLAN Device
++ */
++static const char athId[] __attribute__ ((unused)) = "$Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/ar6000_drv.c#2 $";
+
-+ AR_DEBUG2_PRINTF("ar6000_rx_refill: providing htc with %d buffers at eid=%d\n",
-+ buffersToRefill, Endpoint);
++#include "ar6000_drv.h"
++#include "htc.h"
+
-+ for (RxBuffers = 0; RxBuffers < buffersToRefill; RxBuffers++) {
-+ osBuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE);
-+ if (NULL == osBuf) {
-+ break;
-+ }
-+ /* the HTC packet wrapper is at the head of the reserved area
-+ * in the skb */
-+ pPacket = (HTC_PACKET *)(A_NETBUF_HEAD(osBuf));
-+ /* set re-fill info */
-+ SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_BUFFER_SIZE,Endpoint);
-+ /* add this packet */
-+ HTCAddReceivePkt(ar->arHtcTarget, pPacket);
-+ }
++MODULE_LICENSE("GPL and additional rights");
+
-+ /* update count */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar->arRxBuffers[streamId] += RxBuffers;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+}
++#ifndef REORG_APTC_HEURISTICS
++#undef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++#endif /* REORG_APTC_HEURISTICS */
+
-+static struct net_device_stats *
-+ar6000_get_stats(struct net_device *dev)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ return &ar->arNetStats;
-+}
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++#define APTC_TRAFFIC_SAMPLING_INTERVAL 100 /* msec */
++#define APTC_UPPER_THROUGHPUT_THRESHOLD 3000 /* Kbps */
++#define APTC_LOWER_THROUGHPUT_THRESHOLD 2000 /* Kbps */
+
-+static struct iw_statistics *
-+ar6000_get_iwstats(struct net_device * dev)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ TARGET_STATS *pStats = &ar->arTargetStats;
-+ struct iw_statistics * pIwStats = &ar->arIwStats;
++typedef struct aptc_traffic_record {
++ A_BOOL timerScheduled;
++ struct timeval samplingTS;
++ unsigned long bytesReceived;
++ unsigned long bytesTransmitted;
++} APTC_TRAFFIC_RECORD;
++
++A_TIMER aptcTimer;
++APTC_TRAFFIC_RECORD aptcTR;
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++
++unsigned int bypasswmi = 0;
++unsigned int debuglevel = 0;
++int tspecCompliance = 1;
++unsigned int busspeedlow = 0;
++unsigned int onebitmode = 0;
++unsigned int skipflash = 0;
++unsigned int wmitimeout = 2;
++unsigned int wlanNodeCaching = 1;
++unsigned int enableuartprint = 0;
++unsigned int logWmiRawMsgs = 0;
++unsigned int enabletimerwar = 0;
++unsigned int mbox_yield_limit = 99;
++int reduce_credit_dribble = 1 + HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF;
++int allow_trace_signal = 0;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++unsigned int testmode =0;
++#endif
+
-+ if ((ar->arWmiReady == FALSE)
-+ /*
-+ * The in_atomic function is used to determine if the scheduling is
-+ * allowed in the current context or not. This was introduced in 2.6
-+ * From what I have read on the differences between 2.4 and 2.6, the
-+ * 2.4 kernel did not support preemption and so this check might not
-+ * be required for 2.4 kernels.
-+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+ || (in_atomic())
++module_param(bypasswmi, int, 0644);
++module_param(debuglevel, int, 0644);
++module_param(tspecCompliance, int, 0644);
++module_param(onebitmode, int, 0644);
++module_param(busspeedlow, int, 0644);
++module_param(skipflash, int, 0644);
++module_param(wmitimeout, int, 0644);
++module_param(wlanNodeCaching, int, 0644);
++module_param(logWmiRawMsgs, int, 0644);
++module_param(enableuartprint, int, 0644);
++module_param(enabletimerwar, int, 0644);
++module_param(mbox_yield_limit, int, 0644);
++module_param(reduce_credit_dribble, int, 0644);
++module_param(allow_trace_signal, int, 0644);
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++module_param(testmode, int, 0644);
+#endif
-+ )
-+ {
-+ pIwStats->status = 0;
-+ pIwStats->qual.qual = 0;
-+ pIwStats->qual.level =0;
-+ pIwStats->qual.noise = 0;
-+ pIwStats->discard.code =0;
-+ pIwStats->discard.retries=0;
-+ pIwStats->miss.beacon =0;
-+ return pIwStats;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ pIwStats->status = 0;
-+ return pIwStats;
-+ }
++#else
+
++#define __user
++/* for linux 2.4 and lower */
++MODULE_PARM(bypasswmi,"i");
++MODULE_PARM(debuglevel, "i");
++MODULE_PARM(onebitmode,"i");
++MODULE_PARM(busspeedlow, "i");
++MODULE_PARM(skipflash, "i");
++MODULE_PARM(wmitimeout, "i");
++MODULE_PARM(wlanNodeCaching, "i");
++MODULE_PARM(enableuartprint,"i");
++MODULE_PARM(logWmiRawMsgs, "i");
++MODULE_PARM(enabletimerwar,"i");
++MODULE_PARM(mbox_yield_limit,"i");
++MODULE_PARM(reduce_credit_dribble,"i");
++MODULE_PARM(allow_trace_signal,"i");
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++MODULE_PARM(testmode, "i");
++#endif
++#endif
+
-+ ar->statsUpdatePending = TRUE;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
++/* in 2.6.10 and later this is now a pointer to a uint */
++unsigned int _mboxnum = HTC_MAILBOX_NUM_MAX;
++#define mboxnum &_mboxnum
++#else
++unsigned int mboxnum = HTC_MAILBOX_NUM_MAX;
++#endif
+
-+ if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ pIwStats->status = 0;
-+ return pIwStats;
-+ }
++#ifdef CONFIG_AR6000_WLAN_RESET
++unsigned int resetok = 1;
++#else
++unsigned int resetok = 0;
++#endif
+
-+ wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
++#ifdef DEBUG
++A_UINT32 g_dbg_flags = DBG_DEFAULTS;
++unsigned int debugflags = 0;
++int debugdriver = 1;
++unsigned int debughtc = 128;
++unsigned int debugbmi = 1;
++unsigned int debughif = 2;
++unsigned int txcreditsavailable[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int txcreditsconsumed[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int txcreditintrenable[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int txcreditintrenableaggregate[HTC_MAILBOX_NUM_MAX] = {0};
+
-+ if (signal_pending(current)) {
-+ AR_DEBUG_PRINTF("ar6000 : WMI get stats timeout \n");
-+ up(&ar->arSem);
-+ pIwStats->status = 0;
-+ return pIwStats;
-+ }
-+ pIwStats->status = 1 ;
-+ pIwStats->qual.qual = pStats->cs_aveBeacon_rssi;
-+ pIwStats->qual.level =pStats->cs_aveBeacon_rssi + 161; /* noise is -95 dBm */
-+ pIwStats->qual.noise = pStats->noise_floor_calibation;
-+ pIwStats->discard.code = pStats->rx_decrypt_err;
-+ pIwStats->discard.retries = pStats->tx_retry_cnt;
-+ pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
-+ up(&ar->arSem);
-+ return pIwStats;
-+}
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
++module_param(debugflags, int, 0644);
++module_param(debugdriver, int, 0644);
++module_param(debughtc, int, 0644);
++module_param(debugbmi, int, 0644);
++module_param(debughif, int, 0644);
++module_param(resetok, int, 0644);
++module_param_array(txcreditsavailable, int, mboxnum, 0644);
++module_param_array(txcreditsconsumed, int, mboxnum, 0644);
++module_param_array(txcreditintrenable, int, mboxnum, 0644);
++module_param_array(txcreditintrenableaggregate, int, mboxnum, 0644);
++#else
++/* linux 2.4 and lower */
++MODULE_PARM(debugflags,"i");
++MODULE_PARM(debugdriver, "i");
++MODULE_PARM(debughtc, "i");
++MODULE_PARM(debugbmi, "i");
++MODULE_PARM(debughif, "i");
++MODULE_PARM(resetok, "i");
++MODULE_PARM(txcreditsavailable, "0-3i");
++MODULE_PARM(txcreditsconsumed, "0-3i");
++MODULE_PARM(txcreditintrenable, "0-3i");
++MODULE_PARM(txcreditintrenableaggregate, "0-3i");
++#endif
+
-+void
-+ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+ struct net_device *dev = ar->arNetDev;
++#endif /* DEBUG */
+
-+ ar->arWmiReady = TRUE;
-+ wake_up(&arEvent);
-+ A_MEMCPY(dev->dev_addr, datap, AR6000_ETH_ADDR_LEN);
-+ AR_DEBUG_PRINTF("mac address = %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-+ dev->dev_addr[0], dev->dev_addr[1],
-+ dev->dev_addr[2], dev->dev_addr[3],
-+ dev->dev_addr[4], dev->dev_addr[5]);
++unsigned int tx_attempt[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int tx_post[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int tx_complete[HTC_MAILBOX_NUM_MAX] = {0};
++unsigned int hifBusRequestNumMax = 40;
++unsigned int war23838_disabled = 0;
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++unsigned int enableAPTCHeuristics = 1;
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
++module_param_array(tx_attempt, int, mboxnum, 0644);
++module_param_array(tx_post, int, mboxnum, 0644);
++module_param_array(tx_complete, int, mboxnum, 0644);
++module_param(hifBusRequestNumMax, int, 0644);
++module_param(war23838_disabled, int, 0644);
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++module_param(enableAPTCHeuristics, int, 0644);
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++#else
++MODULE_PARM(tx_attempt, "0-3i");
++MODULE_PARM(tx_post, "0-3i");
++MODULE_PARM(tx_complete, "0-3i");
++MODULE_PARM(hifBusRequestNumMax, "i");
++MODULE_PARM(war23838_disabled, "i");
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++MODULE_PARM(enableAPTCHeuristics, "i");
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++#endif
+
-+ ar->arPhyCapability = phyCap;
-+}
++#ifdef BLOCK_TX_PATH_FLAG
++int blocktx = 0;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
++module_param(blocktx, int, 0644);
++#else
++MODULE_PARM(blocktx, "i");
++#endif
++#endif /* BLOCK_TX_PATH_FLAG */
+
-+A_UINT8
-+ar6000_iptos_to_userPriority(A_UINT8 *pkt)
-+{
-+ struct iphdr *ipHdr = (struct iphdr *)pkt;
-+ A_UINT8 userPriority;
++// TODO move to arsoft_c
++USER_RSSI_THOLD rssi_map[12];
+
-+ /*
-+ * IP Tos format :
-+ * (Refer Pg 57 WMM-test-plan-v1.2)
-+ * IP-TOS - 8bits
-+ * : DSCP(6-bits) ECN(2-bits)
-+ * : DSCP - P2 P1 P0 X X X
-+ * where (P2 P1 P0) form 802.1D
-+ */
-+ userPriority = ipHdr->tos >> 5;
-+ return (userPriority & 0x7);
-+}
++int reconnect_flag = 0;
+
-+void
-+ar6000_connect_event(AR_SOFTC_T *ar, A_UINT16 channel, A_UINT8 *bssid,
-+ A_UINT16 listenInterval, A_UINT16 beaconInterval,
-+ NETWORK_TYPE networkType, A_UINT8 beaconIeLen,
-+ A_UINT8 assocReqLen, A_UINT8 assocRespLen,
-+ A_UINT8 *assocInfo)
-+{
-+ union iwreq_data wrqu;
-+ int i, beacon_ie_pos, assoc_resp_ie_pos, assoc_req_ie_pos;
-+ static const char *tag1 = "ASSOCINFO(ReqIEs=";
-+ static const char *tag2 = "ASSOCRESPIE=";
-+ static const char *beaconIetag = "BEACONIE=";
-+ char buf[WMI_CONTROL_MSG_MAX_LEN * 2 + sizeof(tag1)];
-+ char *pos;
-+ A_UINT8 key_op_ctrl;
++DECLARE_WAIT_QUEUE_HEAD(ar6000_scan_queue);
+
-+ A_MEMCPY(ar->arBssid, bssid, sizeof(ar->arBssid));
-+ ar->arBssChannel = channel;
++/* Function declarations */
++static int ar6000_init_module(void);
++static void ar6000_cleanup_module(void);
+
-+ A_PRINTF("AR6000 connected event on freq %d ", channel);
-+ A_PRINTF("with bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
-+ " listenInterval=%d, beaconInterval = %d, beaconIeLen = %d assocReqLen=%d"
-+ " assocRespLen =%d\n",
-+ bssid[0], bssid[1], bssid[2],
-+ bssid[3], bssid[4], bssid[5],
-+ listenInterval, beaconInterval,
-+ beaconIeLen, assocReqLen, assocRespLen);
-+ if (networkType & ADHOC_NETWORK) {
-+ if (networkType & ADHOC_CREATOR) {
-+ A_PRINTF("Network: Adhoc (Creator)\n");
-+ } else {
-+ A_PRINTF("Network: Adhoc (Joiner)\n");
-+ }
-+ } else {
-+ A_PRINTF("Network: Infrastructure\n");
-+ }
++int ar6000_init(struct net_device *dev);
++static int ar6000_open(struct net_device *dev);
++static int ar6000_close(struct net_device *dev);
++static int ar6000_cleanup(struct net_device *dev);
++static void ar6000_init_control_info(AR_SOFTC_T *ar);
++static int ar6000_data_tx(struct sk_buff *skb, struct net_device *dev);
+
-+ if (beaconIeLen && (sizeof(buf) > (9 + beaconIeLen * 2))) {
-+ AR_DEBUG_PRINTF("\nBeaconIEs= ");
++static void ar6000_destroy(struct net_device *dev, unsigned int unregister);
++static void ar6000_detect_error(unsigned long ptr);
++static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
++static struct iw_statistics *ar6000_get_iwstats(struct net_device * dev);
+
-+ beacon_ie_pos = 0;
-+ A_MEMZERO(buf, sizeof(buf));
-+ sprintf(buf, "%s", beaconIetag);
-+ pos = buf + 9;
-+ for (i = beacon_ie_pos; i < beacon_ie_pos + beaconIeLen; i++) {
-+ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+ sprintf(pos, "%2.2x", assocInfo[i]);
-+ pos += 2;
-+ }
-+ AR_DEBUG_PRINTF("\n");
++/*
++ * HTC service connection handlers
++ */
++static void ar6000_avail_ev(HTC_HANDLE HTCHandle);
+
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ wrqu.data.length = strlen(buf);
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+ }
++static void ar6000_unavail_ev(void *Instance);
+
-+ if (assocRespLen && (sizeof(buf) > (12 + (assocRespLen * 2))))
-+ {
-+ assoc_resp_ie_pos = beaconIeLen + assocReqLen +
-+ sizeof(A_UINT16) + /* capinfo*/
-+ sizeof(A_UINT16) + /* status Code */
-+ sizeof(A_UINT16) ; /* associd */
-+ A_MEMZERO(buf, sizeof(buf));
-+ sprintf(buf, "%s", tag2);
-+ pos = buf + 12;
-+ AR_DEBUG_PRINTF("\nAssocRespIEs= ");
-+ /*
-+ * The Association Response Frame w.o. the WLAN header is delivered to
-+ * the host, so skip over to the IEs
-+ */
-+ for (i = assoc_resp_ie_pos; i < assoc_resp_ie_pos + assocRespLen - 6; i++)
-+ {
-+ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+ sprintf(pos, "%2.2x", assocInfo[i]);
-+ pos += 2;
-+ }
-+ AR_DEBUG_PRINTF("\n");
++static void ar6000_target_failure(void *Instance, A_STATUS Status);
+
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ wrqu.data.length = strlen(buf);
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+ }
++static void ar6000_rx(void *Context, HTC_PACKET *pPacket);
+
-+ if (assocReqLen && (sizeof(buf) > (17 + (assocReqLen * 2)))) {
-+ /*
-+ * assoc Request includes capability and listen interval. Skip these.
-+ */
-+ assoc_req_ie_pos = beaconIeLen +
-+ sizeof(A_UINT16) + /* capinfo*/
-+ sizeof(A_UINT16); /* listen interval */
++static void ar6000_rx_refill(void *Context,HTC_ENDPOINT_ID Endpoint);
+
-+ A_MEMZERO(buf, sizeof(buf));
-+ sprintf(buf, "%s", tag1);
-+ pos = buf + 17;
-+ AR_DEBUG_PRINTF("AssocReqIEs= ");
-+ for (i = assoc_req_ie_pos; i < assoc_req_ie_pos + assocReqLen - 4; i++) {
-+ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+ sprintf(pos, "%2.2x", assocInfo[i]);
-+ pos += 2;;
-+ }
-+ AR_DEBUG_PRINTF("\n");
++static void ar6000_tx_complete(void *Context, HTC_PACKET *pPacket);
+
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ wrqu.data.length = strlen(buf);
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+ }
++static void ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint);
+
-+#ifdef USER_KEYS
-+ if (ar->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
-+ ar->user_saved_keys.keyOk == TRUE)
-+ {
++static void ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint);
+
-+ key_op_ctrl = KEY_OP_VALID_MASK & ~KEY_OP_INIT_TSC;
-+ if (ar->user_key_ctrl & AR6000_USER_SETKEYS_RSC_UNCHANGED) {
-+ key_op_ctrl &= ~KEY_OP_INIT_RSC;
-+ } else {
-+ key_op_ctrl |= KEY_OP_INIT_RSC;
-+ }
-+ ar6000_reinstall_keys(ar, key_op_ctrl);
-+ }
-+#endif /* USER_KEYS */
++/*
++ * Static variables
++ */
+
-+ /* flush data queues */
-+ ar6000_TxDataCleanup(ar);
++static struct net_device *ar6000_devices[MAX_AR6000];
++extern struct iw_handler_def ath_iw_handler_def;
++DECLARE_WAIT_QUEUE_HEAD(arEvent);
++static void ar6000_cookie_init(AR_SOFTC_T *ar);
++static void ar6000_cookie_cleanup(AR_SOFTC_T *ar);
++static void ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie);
++static struct ar_cookie *ar6000_alloc_cookie(AR_SOFTC_T *ar);
++static void ar6000_TxDataCleanup(AR_SOFTC_T *ar);
+
-+ netif_start_queue(ar->arNetDev);
++#ifdef USER_KEYS
++static A_STATUS ar6000_reinstall_keys(AR_SOFTC_T *ar,A_UINT8 key_op_ctrl);
++#endif
+
-+ if ((OPEN_AUTH == ar->arDot11AuthMode) &&
-+ (NONE_AUTH == ar->arAuthMode) &&
-+ (WEP_CRYPT == ar->arPairwiseCrypto))
-+ {
-+ if (!ar->arConnected) {
-+ ar6000_install_static_wep_keys(ar);
-+ }
-+ }
+
-+ ar->arConnected = TRUE;
-+ ar->arConnectPending = FALSE;
++static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
+
-+ reconnect_flag = 0;
++#define HOST_INTEREST_ITEM_ADDRESS(ar, item) \
++((ar->arTargetType == TARGET_TYPE_AR6001) ? \
++ AR6001_HOST_INTEREST_ITEM_ADDRESS(item) : \
++ AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
+
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ A_MEMCPY(wrqu.addr.sa_data, bssid, IEEE80211_ADDR_LEN);
-+ wrqu.addr.sa_family = ARPHRD_ETHER;
-+ wireless_send_event(ar->arNetDev, SIOCGIWAP, &wrqu, NULL);
-+ if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable) {
-+ A_MEMZERO(ar->arNodeMap, sizeof(ar->arNodeMap));
-+ ar->arNodeNum = 0;
-+ ar->arNexEpId = ENDPOINT_2;
-+ }
+
-+}
++/* Debug log support */
+
-+void ar6000_set_numdataendpts(AR_SOFTC_T *ar, A_UINT32 num)
-+{
-+ A_ASSERT(num <= (HTC_MAILBOX_NUM_MAX - 1));
-+ ar->arNumDataEndPts = num;
-+}
++/*
++ * Flag to govern whether the debug logs should be parsed in the kernel
++ * or reported to the application.
++ */
++#ifdef DEBUG
++#define REPORT_DEBUG_LOGS_TO_APP
++#endif
+
-+void
-+ar6000_disconnect_event(AR_SOFTC_T *ar, A_UINT8 reason, A_UINT8 *bssid,
-+ A_UINT8 assocRespLen, A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus)
++A_STATUS
++ar6000_set_host_app_area(AR_SOFTC_T *ar)
+{
-+ A_UINT8 i;
++ A_UINT32 address, data;
++ struct host_app_area_s host_app_area;
+
-+ A_PRINTF("AR6000 disconnected");
-+ if (bssid[0] || bssid[1] || bssid[2] || bssid[3] || bssid[4] || bssid[5]) {
-+ A_PRINTF(" from %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
-+ bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
++ /* Fetch the address of the host_app_area_s instance in the host interest area */
++ address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_app_host_interest);
++ if (ar6000_ReadRegDiag(ar->arHifDevice, &address, &data) != A_OK) {
++ return A_ERROR;
+ }
-+ A_PRINTF("\n");
-+
-+ AR_DEBUG_PRINTF("\nDisconnect Reason is %d", reason);
-+ AR_DEBUG_PRINTF("\nProtocol Reason/Status Code is %d", protocolReasonStatus);
-+ AR_DEBUG_PRINTF("\nAssocResp Frame = %s",
-+ assocRespLen ? " " : "NULL");
-+ for (i = 0; i < assocRespLen; i++) {
-+ if (!(i % 0x10)) {
-+ AR_DEBUG_PRINTF("\n");
-+ }
-+ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
-+ }
-+ AR_DEBUG_PRINTF("\n");
-+ /*
-+ * If the event is due to disconnect cmd from the host, only they the target
-+ * would stop trying to connect. Under any other condition, target would
-+ * keep trying to connect.
-+ *
-+ */
-+ if( reason == DISCONNECT_CMD)
++ address = data;
++ host_app_area.wmi_protocol_ver = WMI_PROTOCOL_VERSION;
++ if (ar6000_WriteDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)&host_app_area,
++ sizeof(struct host_app_area_s)) != A_OK)
+ {
-+ ar->arConnectPending = FALSE;
-+ } else {
-+ ar->arConnectPending = TRUE;
-+ if (((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x11)) ||
-+ ((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x0) && (reconnect_flag == 1))) {
-+ ar->arConnected = TRUE;
-+ return;
-+ }
++ return A_ERROR;
+ }
-+ ar->arConnected = FALSE;
+
-+ if( (reason != CSERV_DISCONNECT) || (reconnect_flag != 1) ) {
-+ reconnect_flag = 0;
-+ }
++ return A_OK;
++}
+
-+#ifdef USER_KEYS
-+ if (reason != CSERV_DISCONNECT)
++A_UINT32
++dbglog_get_debug_hdr_ptr(AR_SOFTC_T *ar)
++{
++ A_UINT32 param;
++ A_UINT32 address;
++ A_STATUS status;
++
++ address = HOST_INTEREST_ITEM_ADDRESS(ar, hi_dbglog_hdr);
++ if ((status = ar6000_ReadDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)¶m, 4)) != A_OK)
+ {
-+ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+ ar->user_key_ctrl = 0;
++ param = 0;
+ }
-+#endif /* USER_KEYS */
-+
-+ netif_stop_queue(ar->arNetDev);
-+ A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
-+ ar->arBssChannel = 0;
-+ ar->arBeaconInterval = 0;
+
-+ ar6000_TxDataCleanup(ar);
++ return param;
+}
+
++/*
++ * The dbglog module has been initialized. Its ok to access the relevant
++ * data stuctures over the diagnostic window.
++ */
+void
-+ar6000_regDomain_event(AR_SOFTC_T *ar, A_UINT32 regCode)
++ar6000_dbglog_init_done(AR_SOFTC_T *ar)
+{
-+ A_PRINTF("AR6000 Reg Code = 0x%x\n", regCode);
-+ ar->arRegCode = regCode;
++ ar->dbglog_init_done = TRUE;
+}
+
-+void
-+ar6000_neighborReport_event(AR_SOFTC_T *ar, int numAps, WMI_NEIGHBOR_INFO *info)
++A_UINT32
++dbglog_get_debug_fragment(A_INT8 *datap, A_UINT32 len, A_UINT32 limit)
+{
-+ static const char *tag = "PRE-AUTH";
-+ char buf[128];
-+ union iwreq_data wrqu;
-+ int i;
++ A_INT32 *buffer;
++ A_UINT32 count;
++ A_UINT32 numargs;
++ A_UINT32 length;
++ A_UINT32 fraglen;
+
-+ AR_DEBUG_PRINTF("AR6000 Neighbor Report Event\n");
-+ for (i=0; i < numAps; info++, i++) {
-+ AR_DEBUG_PRINTF("bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
-+ info->bssid[0], info->bssid[1], info->bssid[2],
-+ info->bssid[3], info->bssid[4], info->bssid[5]);
-+ if (info->bssFlags & WMI_PREAUTH_CAPABLE_BSS) {
-+ AR_DEBUG_PRINTF("preauth-cap");
-+ }
-+ if (info->bssFlags & WMI_PMKID_VALID_BSS) {
-+ AR_DEBUG_PRINTF(" pmkid-valid\n");
-+ continue; /* we skip bss if the pmkid is already valid */
++ count = fraglen = 0;
++ buffer = (A_INT32 *)datap;
++ length = (limit >> 2);
++
++ if (len <= limit) {
++ fraglen = len;
++ } else {
++ while (count < length) {
++ numargs = DBGLOG_GET_NUMARGS(buffer[count]);
++ fraglen = (count << 2);
++ count += numargs + 1;
+ }
-+ AR_DEBUG_PRINTF("\n");
-+ snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
-+ tag,
-+ info->bssid[0], info->bssid[1], info->bssid[2],
-+ info->bssid[3], info->bssid[4], info->bssid[5],
-+ i, info->bssFlags);
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ wrqu.data.length = strlen(buf);
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+ }
++
++ return fraglen;
+}
+
+void
-+ar6000_tkip_micerr_event(AR_SOFTC_T *ar, A_UINT8 keyid, A_BOOL ismcast)
++dbglog_parse_debug_logs(A_INT8 *datap, A_UINT32 len)
+{
-+ static const char *tag = "MLME-MICHAELMICFAILURE.indication";
-+ char buf[128];
-+ union iwreq_data wrqu;
++ A_INT32 *buffer;
++ A_UINT32 count;
++ A_UINT32 timestamp;
++ A_UINT32 debugid;
++ A_UINT32 moduleid;
++ A_UINT32 numargs;
++ A_UINT32 length;
+
-+ A_PRINTF("AR6000 TKIP MIC error received for keyid %d %scast\n",
-+ keyid, ismcast ? "multi": "uni");
-+ snprintf(buf, sizeof(buf), "%s(keyid=%d %scat)", tag, keyid,
-+ ismcast ? "multi" : "uni");
-+ memset(&wrqu, 0, sizeof(wrqu));
-+ wrqu.data.length = strlen(buf);
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
-+}
++ count = 0;
++ buffer = (A_INT32 *)datap;
++ length = (len >> 2);
++ while (count < length) {
++ debugid = DBGLOG_GET_DBGID(buffer[count]);
++ moduleid = DBGLOG_GET_MODULEID(buffer[count]);
++ numargs = DBGLOG_GET_NUMARGS(buffer[count]);
++ timestamp = DBGLOG_GET_TIMESTAMP(buffer[count]);
++ switch (numargs) {
++ case 0:
++ AR_DEBUG_PRINTF("%d %d (%d)\n", moduleid, debugid, timestamp);
++ break;
+
-+void
-+ar6000_scanComplete_event(AR_SOFTC_T *ar, A_STATUS status)
-+{
-+ AR_DEBUG_PRINTF("AR6000 scan complete: %d\n", status);
++ case 1:
++ AR_DEBUG_PRINTF("%d %d (%d): 0x%x\n", moduleid, debugid,
++ timestamp, buffer[count+1]);
++ break;
+
-+ ar->scan_complete = 1;
-+ wake_up_interruptible(&ar6000_scan_queue);
++ case 2:
++ AR_DEBUG_PRINTF("%d %d (%d): 0x%x, 0x%x\n", moduleid, debugid,
++ timestamp, buffer[count+1], buffer[count+2]);
++ break;
++
++ default:
++ AR_DEBUG_PRINTF("Invalid args: %d\n", numargs);
++ }
++ count += numargs + 1;
++ }
+}
+
-+void
-+ar6000_targetStats_event(AR_SOFTC_T *ar, WMI_TARGET_STATS *pTarget)
++int
++ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar)
+{
-+ TARGET_STATS *pStats = &ar->arTargetStats;
-+ A_UINT8 ac;
++ struct dbglog_hdr_s debug_hdr;
++ struct dbglog_buf_s debug_buf;
++ A_UINT32 address;
++ A_UINT32 length;
++ A_UINT32 dropped;
++ A_UINT32 firstbuf;
++ A_UINT32 debug_hdr_ptr;
+
-+ /*A_PRINTF("AR6000 updating target stats\n");*/
-+ pStats->tx_packets += pTarget->txrxStats.tx_stats.tx_packets;
-+ pStats->tx_bytes += pTarget->txrxStats.tx_stats.tx_bytes;
-+ pStats->tx_unicast_pkts += pTarget->txrxStats.tx_stats.tx_unicast_pkts;
-+ pStats->tx_unicast_bytes += pTarget->txrxStats.tx_stats.tx_unicast_bytes;
-+ pStats->tx_multicast_pkts += pTarget->txrxStats.tx_stats.tx_multicast_pkts;
-+ pStats->tx_multicast_bytes += pTarget->txrxStats.tx_stats.tx_multicast_bytes;
-+ pStats->tx_broadcast_pkts += pTarget->txrxStats.tx_stats.tx_broadcast_pkts;
-+ pStats->tx_broadcast_bytes += pTarget->txrxStats.tx_stats.tx_broadcast_bytes;
-+ pStats->tx_rts_success_cnt += pTarget->txrxStats.tx_stats.tx_rts_success_cnt;
-+ for(ac = 0; ac < WMM_NUM_AC; ac++)
-+ pStats->tx_packet_per_ac[ac] += pTarget->txrxStats.tx_stats.tx_packet_per_ac[ac];
-+ pStats->tx_errors += pTarget->txrxStats.tx_stats.tx_errors;
-+ pStats->tx_failed_cnt += pTarget->txrxStats.tx_stats.tx_failed_cnt;
-+ pStats->tx_retry_cnt += pTarget->txrxStats.tx_stats.tx_retry_cnt;
-+ pStats->tx_rts_fail_cnt += pTarget->txrxStats.tx_stats.tx_rts_fail_cnt;
-+ pStats->tx_unicast_rate = wmi_get_rate(pTarget->txrxStats.tx_stats.tx_unicast_rate);
++ if (!ar->dbglog_init_done) return A_ERROR;
+
-+ pStats->rx_packets += pTarget->txrxStats.rx_stats.rx_packets;
-+ pStats->rx_bytes += pTarget->txrxStats.rx_stats.rx_bytes;
-+ pStats->rx_unicast_pkts += pTarget->txrxStats.rx_stats.rx_unicast_pkts;
-+ pStats->rx_unicast_bytes += pTarget->txrxStats.rx_stats.rx_unicast_bytes;
-+ pStats->rx_multicast_pkts += pTarget->txrxStats.rx_stats.rx_multicast_pkts;
-+ pStats->rx_multicast_bytes += pTarget->txrxStats.rx_stats.rx_multicast_bytes;
-+ pStats->rx_broadcast_pkts += pTarget->txrxStats.rx_stats.rx_broadcast_pkts;
-+ pStats->rx_broadcast_bytes += pTarget->txrxStats.rx_stats.rx_broadcast_bytes;
-+ pStats->rx_fragment_pkt += pTarget->txrxStats.rx_stats.rx_fragment_pkt;
-+ pStats->rx_errors += pTarget->txrxStats.rx_stats.rx_errors;
-+ pStats->rx_crcerr += pTarget->txrxStats.rx_stats.rx_crcerr;
-+ pStats->rx_key_cache_miss += pTarget->txrxStats.rx_stats.rx_key_cache_miss;
-+ pStats->rx_decrypt_err += pTarget->txrxStats.rx_stats.rx_decrypt_err;
-+ pStats->rx_duplicate_frames += pTarget->txrxStats.rx_stats.rx_duplicate_frames;
-+ pStats->rx_unicast_rate = wmi_get_rate(pTarget->txrxStats.rx_stats.rx_unicast_rate);
++#ifndef CONFIG_AR6000_WLAN_DEBUG
++ return 0;
++#endif
+
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ pStats->tkip_local_mic_failure
-+ += pTarget->txrxStats.tkipCcmpStats.tkip_local_mic_failure;
-+ pStats->tkip_counter_measures_invoked
-+ += pTarget->txrxStats.tkipCcmpStats.tkip_counter_measures_invoked;
-+ pStats->tkip_replays += pTarget->txrxStats.tkipCcmpStats.tkip_replays;
-+ pStats->tkip_format_errors += pTarget->txrxStats.tkipCcmpStats.tkip_format_errors;
-+ pStats->ccmp_format_errors += pTarget->txrxStats.tkipCcmpStats.ccmp_format_errors;
-+ pStats->ccmp_replays += pTarget->txrxStats.tkipCcmpStats.ccmp_replays;
++ if (ar->dbgLogFetchInProgress) {
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ return A_EBUSY;
++ }
+
++ /* block out others */
++ ar->dbgLogFetchInProgress = TRUE;
+
-+ pStats->power_save_failure_cnt += pTarget->pmStats.power_save_failure_cnt;
-+ pStats->noise_floor_calibation = pTarget->noise_floor_calibation;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+ pStats->cs_bmiss_cnt += pTarget->cservStats.cs_bmiss_cnt;
-+ pStats->cs_lowRssi_cnt += pTarget->cservStats.cs_lowRssi_cnt;
-+ pStats->cs_connect_cnt += pTarget->cservStats.cs_connect_cnt;
-+ pStats->cs_disconnect_cnt += pTarget->cservStats.cs_disconnect_cnt;
-+ pStats->cs_aveBeacon_snr = pTarget->cservStats.cs_aveBeacon_snr;
-+ pStats->cs_aveBeacon_rssi = pTarget->cservStats.cs_aveBeacon_rssi;
-+ pStats->cs_lastRoam_msec = pTarget->cservStats.cs_lastRoam_msec;
-+ pStats->cs_snr = pTarget->cservStats.cs_snr;
-+ pStats->cs_rssi = pTarget->cservStats.cs_rssi;
++ debug_hdr_ptr = dbglog_get_debug_hdr_ptr(ar);
++ printk("debug_hdr_ptr: 0x%x\n", debug_hdr_ptr);
+
-+ pStats->lq_val = pTarget->lqVal;
++ /* Get the contents of the ring buffer */
++ if (debug_hdr_ptr) {
++ address = debug_hdr_ptr;
++ length = sizeof(struct dbglog_hdr_s);
++ ar6000_ReadDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)&debug_hdr, length);
++ address = (A_UINT32)debug_hdr.dbuf;
++ firstbuf = address;
++ dropped = debug_hdr.dropped;
++ length = sizeof(struct dbglog_buf_s);
++ ar6000_ReadDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)&debug_buf, length);
+
-+ pStats->wow_num_pkts_dropped += pTarget->wowStats.wow_num_pkts_dropped;
-+ pStats->wow_num_host_pkt_wakeups += pTarget->wowStats.wow_num_host_pkt_wakeups;
-+ pStats->wow_num_host_event_wakeups += pTarget->wowStats.wow_num_host_event_wakeups;
-+ pStats->wow_num_events_discarded += pTarget->wowStats.wow_num_events_discarded;
++ do {
++ address = (A_UINT32)debug_buf.buffer;
++ length = debug_buf.length;
++ if ((length) && (debug_buf.length <= debug_buf.bufsize)) {
++ /* Rewind the index if it is about to overrun the buffer */
++ if (ar->log_cnt > (DBGLOG_HOST_LOG_BUFFER_SIZE - length)) {
++ ar->log_cnt = 0;
++ }
++ if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)&ar->log_buffer[ar->log_cnt], length))
++ {
++ break;
++ }
++ ar6000_dbglog_event(ar, dropped, &ar->log_buffer[ar->log_cnt], length);
++ ar->log_cnt += length;
++ } else {
++ AR_DEBUG_PRINTF("Length: %d (Total size: %d)\n",
++ debug_buf.length, debug_buf.bufsize);
++ }
+
-+ ar->statsUpdatePending = FALSE;
-+ wake_up(&arEvent);
-+}
++ address = (A_UINT32)debug_buf.next;
++ length = sizeof(struct dbglog_buf_s);
++ if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
++ (A_UCHAR *)&debug_buf, length))
++ {
++ break;
++ }
+
-+void
-+ar6000_rssiThreshold_event(AR_SOFTC_T *ar, WMI_RSSI_THRESHOLD_VAL newThreshold, A_INT16 rssi)
-+{
-+ USER_RSSI_THOLD userRssiThold;
++ } while (address != firstbuf);
++ }
+
-+ userRssiThold.tag = rssi_map[newThreshold].tag;
-+ userRssiThold.rssi = rssi;
-+ AR_DEBUG2_PRINTF("rssi Threshold range = %d tag = %d rssi = %d\n", newThreshold, userRssiThold.tag, rssi);
-+#ifdef SEND_EVENT_TO_APP
-+ ar6000_send_event_to_app(ar, WMI_RSSI_THRESHOLD_EVENTID,(A_UINT8 *)&userRssiThold, sizeof(USER_RSSI_THOLD));
-+#endif
-+}
++ ar->dbgLogFetchInProgress = FALSE;
+
++ return A_OK;
++}
+
+void
-+ar6000_hbChallengeResp_event(AR_SOFTC_T *ar, A_UINT32 cookie, A_UINT32 source)
++ar6000_dbglog_event(AR_SOFTC_T *ar, A_UINT32 dropped,
++ A_INT8 *buffer, A_UINT32 length)
+{
-+ if (source == APP_HB_CHALLENGE) {
-+ /* Report it to the app in case it wants a positive acknowledgement */
-+#ifdef SEND_EVENT_TO_APP
-+ ar6000_send_event_to_app(ar, WMIX_HB_CHALLENGE_RESP_EVENTID,
-+ (A_UINT8 *)&cookie, sizeof(cookie));
-+#endif
-+ } else {
-+ /* This would ignore the replys that come in after their due time */
-+ if (cookie == ar->arHBChallengeResp.seqNum) {
-+ ar->arHBChallengeResp.outstanding = FALSE;
-+ }
++#ifdef REPORT_DEBUG_LOGS_TO_APP
++ #define MAX_WIRELESS_EVENT_SIZE 252
++ /*
++ * Break it up into chunks of MAX_WIRELESS_EVENT_SIZE bytes of messages.
++ * There seems to be a limitation on the length of message that could be
++ * transmitted to the user app via this mechanism.
++ */
++ A_UINT32 send, sent;
++
++ sent = 0;
++ send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
++ MAX_WIRELESS_EVENT_SIZE);
++ while (send) {
++ ar6000_send_event_to_app(ar, WMIX_DBGLOG_EVENTID, &buffer[sent], send);
++ sent += send;
++ send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
++ MAX_WIRELESS_EVENT_SIZE);
+ }
++#else
++ AR_DEBUG_PRINTF("Dropped logs: 0x%x\nDebug info length: %d\n",
++ dropped, length);
++
++ /* Interpret the debug logs */
++ dbglog_parse_debug_logs(buffer, length);
++#endif /* REPORT_DEBUG_LOGS_TO_APP */
+}
+
+
-+void
-+ar6000_reportError_event(AR_SOFTC_T *ar, WMI_TARGET_ERROR_VAL errorVal)
++
++static int __init
++ar6000_init_module(void)
+{
-+ char *errString[] = {
-+ [WMI_TARGET_PM_ERR_FAIL] "WMI_TARGET_PM_ERR_FAIL",
-+ [WMI_TARGET_KEY_NOT_FOUND] "WMI_TARGET_KEY_NOT_FOUND",
-+ [WMI_TARGET_DECRYPTION_ERR] "WMI_TARGET_DECRYPTION_ERR",
-+ [WMI_TARGET_BMISS] "WMI_TARGET_BMISS",
-+ [WMI_PSDISABLE_NODE_JOIN] "WMI_PSDISABLE_NODE_JOIN"
-+ };
++ static int probed = 0;
++ A_STATUS status;
++ HTC_INIT_INFO initInfo;
+
-+ A_PRINTF("AR6000 Error on Target. Error = 0x%x\n", errorVal);
++ A_MEMZERO(&initInfo,sizeof(initInfo));
++ initInfo.AddInstance = ar6000_avail_ev;
++ initInfo.DeleteInstance = ar6000_unavail_ev;
++ initInfo.TargetFailure = ar6000_target_failure;
+
-+ /* One error is reported at a time, and errorval is a bitmask */
-+ if(errorVal & (errorVal - 1))
-+ return;
+
-+ A_PRINTF("AR6000 Error type = ");
-+ switch(errorVal)
++#ifdef DEBUG
++ /* Set the debug flags if specified at load time */
++ if(debugflags != 0)
+ {
-+ case WMI_TARGET_PM_ERR_FAIL:
-+ case WMI_TARGET_KEY_NOT_FOUND:
-+ case WMI_TARGET_DECRYPTION_ERR:
-+ case WMI_TARGET_BMISS:
-+ case WMI_PSDISABLE_NODE_JOIN:
-+ A_PRINTF("%s\n", errString[errorVal]);
-+ break;
-+ default:
-+ A_PRINTF("INVALID\n");
-+ break;
++ g_dbg_flags = debugflags;
+ }
++#endif
+
-+}
++ if (probed) {
++ return -ENODEV;
++ }
++ probed++;
+
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++ memset(&aptcTR, 0, sizeof(APTC_TRAFFIC_RECORD));
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+void
-+ar6000_cac_event(AR_SOFTC_T *ar, A_UINT8 ac, A_UINT8 cacIndication,
-+ A_UINT8 statusCode, A_UINT8 *tspecSuggestion)
-+{
-+ WMM_TSPEC_IE *tspecIe;
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++ ar6000_gpio_init();
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ /*
-+ * This is the TSPEC IE suggestion from AP.
-+ * Suggestion provided by AP under some error
-+ * cases, could be helpful for the host app.
-+ * Check documentation.
-+ */
-+ tspecIe = (WMM_TSPEC_IE *)tspecSuggestion;
++ status = HTCInit(&initInfo);
++ if(status != A_OK)
++ return -ENODEV;
+
-+ /*
-+ * What do we do, if we get TSPEC rejection? One thought
-+ * that comes to mind is implictly delete the pstream...
-+ */
-+ A_PRINTF("AR6000 CAC notification. "
-+ "AC = %d, cacIndication = 0x%x, statusCode = 0x%x\n",
-+ ac, cacIndication, statusCode);
++ return 0;
+}
+
-+#define AR6000_PRINT_BSSID(_pBss) do { \
-+ A_PRINTF("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",\
-+ (_pBss)[0],(_pBss)[1],(_pBss)[2],(_pBss)[3],\
-+ (_pBss)[4],(_pBss)[5]); \
-+} while(0)
-+
-+void
-+ar6000_roam_tbl_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_TBL *pTbl)
++static void __exit
++ar6000_cleanup_module(void)
+{
-+ A_UINT8 i;
++ int i = 0;
++ struct net_device *ar6000_netdev;
+
-+ A_PRINTF("ROAM TABLE NO OF ENTRIES is %d ROAM MODE is %d\n",
-+ pTbl->numEntries, pTbl->roamMode);
-+ for (i= 0; i < pTbl->numEntries; i++) {
-+ A_PRINTF("[%d]bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ", i,
-+ pTbl->bssRoamInfo[i].bssid[0], pTbl->bssRoamInfo[i].bssid[1],
-+ pTbl->bssRoamInfo[i].bssid[2],
-+ pTbl->bssRoamInfo[i].bssid[3],
-+ pTbl->bssRoamInfo[i].bssid[4],
-+ pTbl->bssRoamInfo[i].bssid[5]);
-+ A_PRINTF("RSSI %d RSSIDT %d LAST RSSI %d UTIL %d ROAM_UTIL %d"
-+ " BIAS %d\n",
-+ pTbl->bssRoamInfo[i].rssi,
-+ pTbl->bssRoamInfo[i].rssidt,
-+ pTbl->bssRoamInfo[i].last_rssi,
-+ pTbl->bssRoamInfo[i].util,
-+ pTbl->bssRoamInfo[i].roam_util,
-+ pTbl->bssRoamInfo[i].bias);
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++ /* Delete the Adaptive Power Control timer */
++ if (timer_pending(&aptcTimer)) {
++ del_timer_sync(&aptcTimer);
++ }
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
++
++ for (i=0; i < MAX_AR6000; i++) {
++ if (ar6000_devices[i] != NULL) {
++ ar6000_netdev = ar6000_devices[i];
++ ar6000_devices[i] = NULL;
++ ar6000_destroy(ar6000_netdev, 1);
++ }
+ }
++
++ /* shutting down HTC will cause the HIF layer to detach from the
++ * underlying bus driver which will cause the subsequent deletion of
++ * all HIF and HTC instances */
++ HTCShutDown();
++
++ AR_DEBUG_PRINTF("ar6000_cleanup: success\n");
+}
+
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+void
-+ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters, WMI_GET_WOW_LIST_REPLY *wow_reply)
++aptcTimerHandler(unsigned long arg)
+{
-+ A_UINT8 i,j;
-+
-+ /*Each event now contains exactly one filter, see bug 26613*/
-+ A_PRINTF("WOW pattern %d of %d patterns\n", wow_reply->this_filter_num, wow_reply->num_filters);
-+ A_PRINTF("wow mode = %s host mode = %s\n",
-+ (wow_reply->wow_mode == 0? "disabled":"enabled"),
-+ (wow_reply->host_mode == 1 ? "awake":"asleep"));
-+
++ A_UINT32 numbytes;
++ A_UINT32 throughput;
++ AR_SOFTC_T *ar;
++ A_STATUS status;
+
-+ /*If there are no patterns, the reply will only contain generic
-+ WoW information. Pattern information will exist only if there are
-+ patterns present. Bug 26716*/
++ ar = (AR_SOFTC_T *)arg;
++ A_ASSERT(ar != NULL);
++ A_ASSERT(!timer_pending(&aptcTimer));
+
-+ /* If this event contains pattern information, display it*/
-+ if (wow_reply->this_filter_num) {
-+ i=0;
-+ A_PRINTF("id=%d size=%d offset=%d\n",
-+ wow_reply->wow_filters[i].wow_filter_id,
-+ wow_reply->wow_filters[i].wow_filter_size,
-+ wow_reply->wow_filters[i].wow_filter_offset);
-+ A_PRINTF("wow pattern = ");
-+ for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
-+ A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_pattern[j]);
-+ }
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ A_PRINTF("\nwow mask = ");
-+ for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
-+ A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_mask[j]);
-+ }
-+ A_PRINTF("\n");
-+ }
-+}
++ /* Get the number of bytes transferred */
++ numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
++ aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
+
-+/*
-+ * Report the Roaming related data collected on the target
-+ */
-+void
-+ar6000_display_roam_time(WMI_TARGET_ROAM_TIME *p)
-+{
-+ A_PRINTF("Disconnect Data : BSSID: ");
-+ AR6000_PRINT_BSSID(p->disassoc_bssid);
-+ A_PRINTF(" RSSI %d DISASSOC Time %d NO_TXRX_TIME %d\n",
-+ p->disassoc_bss_rssi,p->disassoc_time,
-+ p->no_txrx_time);
-+ A_PRINTF("Connect Data: BSSID: ");
-+ AR6000_PRINT_BSSID(p->assoc_bssid);
-+ A_PRINTF(" RSSI %d ASSOC Time %d TXRX_TIME %d\n",
-+ p->assoc_bss_rssi,p->assoc_time,
-+ p->allow_txrx_time);
-+ A_PRINTF("Last Data Tx Time (b4 Disassoc) %d "\
-+ "First Data Tx Time (after Assoc) %d\n",
-+ p->last_data_txrx_time, p->first_data_txrx_time);
-+}
-+
-+void
-+ar6000_roam_data_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_DATA *p)
-+{
-+ switch (p->roamDataType) {
-+ case ROAM_DATA_TIME:
-+ ar6000_display_roam_time(&p->u.roamTime);
-+ break;
-+ default:
-+ break;
-+ }
-+}
-+
-+void
-+ar6000_bssInfo_event_rx(AR_SOFTC_T *ar, A_UINT8 *datap, int len)
-+{
-+ struct sk_buff *skb;
-+ WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
-+
-+
-+ if (!ar->arMgmtFilter) {
-+ return;
-+ }
-+ if (((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_BEACON) &&
-+ (bih->frameType != BEACON_FTYPE)) ||
-+ ((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_PROBE_RESP) &&
-+ (bih->frameType != PROBERESP_FTYPE)))
-+ {
-+ return;
++ /* Calculate and decide based on throughput thresholds */
++ throughput = ((numbytes * 8)/APTC_TRAFFIC_SAMPLING_INTERVAL); /* Kbps */
++ if (throughput < APTC_LOWER_THROUGHPUT_THRESHOLD) {
++ /* Enable Sleep and delete the timer */
++ A_ASSERT(ar->arWmiReady == TRUE);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ status = wmi_powermode_cmd(ar->arWmi, REC_POWER);
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ A_ASSERT(status == A_OK);
++ aptcTR.timerScheduled = FALSE;
++ } else {
++ A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
+ }
+
-+ if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
-+
-+ A_NETBUF_PUT(skb, len);
-+ A_MEMCPY(A_NETBUF_DATA(skb), datap, len);
-+ skb->dev = ar->arNetDev;
-+ printk("MAC RAW...\n");
-+// skb->mac.raw = A_NETBUF_DATA(skb);
-+ skb->ip_summed = CHECKSUM_NONE;
-+ skb->pkt_type = PACKET_OTHERHOST;
-+ skb->protocol = __constant_htons(0x0019);
-+ netif_rx(skb);
-+ }
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+}
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+A_UINT32 wmiSendCmdNum;
+
-+A_STATUS
-+ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+ A_STATUS status = A_OK;
-+ struct ar_cookie *cookie = NULL;
-+ int i;
+
-+ /* take lock to protect ar6000_alloc_cookie() */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++/* set HTC block size, assume BMI is already initialized */
++A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar)
++{
++ A_STATUS status;
++ A_UINT32 blocksizes[HTC_MAILBOX_NUM_MAX];
+
+ do {
++ /* get the block sizes */
++ status = HIFConfigureDevice(ar->arHifDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
++ blocksizes, sizeof(blocksizes));
+
-+ AR_DEBUG2_PRINTF("ar_contrstatus = ol_tx: skb=0x%x, len=0x%x, sid=%d\n",
-+ (A_UINT32)osbuf, A_NETBUF_LEN(osbuf), streamID);
-+
-+ if ((streamID == WMI_CONTROL_PRI) && (ar->arWMIControlEpFull)) {
-+ /* control endpoint is full, don't allocate resources, we
-+ * are just going to drop this packet */
-+ cookie = NULL;
-+ AR_DEBUG_PRINTF(" WMI Control EP full, dropping packet : 0x%X, len:%d \n",
-+ (A_UINT32)osbuf, A_NETBUF_LEN(osbuf));
-+ } else {
-+ cookie = ar6000_alloc_cookie(ar);
-+ }
-+
-+ if (cookie == NULL) {
-+ status = A_NO_MEMORY;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF("Failed to get block size info from HIF layer...\n");
+ break;
+ }
++ /* note: we actually get the block size for mailbox 1, for SDIO the block
++ * size on mailbox 0 is artificially set to 1 */
++ /* must be a power of 2 */
++ A_ASSERT((blocksizes[1] & (blocksizes[1] - 1)) == 0);
+
-+ if(logWmiRawMsgs) {
-+ A_PRINTF("WMI cmd send, msgNo %d :", wmiSendCmdNum);
-+ for(i = 0; i < a_netbuf_to_len(osbuf); i++)
-+ A_PRINTF("%x ", ((A_UINT8 *)a_netbuf_to_data(osbuf))[i]);
-+ A_PRINTF("\n");
-+ }
++ /* set the host interest area for the block size */
++ status = BMIWriteMemory(ar->arHifDevice,
++ HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz),
++ (A_UCHAR *)&blocksizes[1],
++ 4);
+
-+ wmiSendCmdNum++;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF("BMIWriteMemory for IO block size failed \n");
++ break;
++ }
+
-+ } while (FALSE);
++ AR_DEBUG_PRINTF("Block Size Set: %d (target address:0x%X)\n",
++ blocksizes[1], HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_io_block_sz));
+
-+ if (cookie != NULL) {
-+ /* got a structure to send it out on */
-+ ar->arTxPending[streamID]++;
++ /* set the host interest area for the mbox ISR yield limit */
++ status = BMIWriteMemory(ar->arHifDevice,
++ HOST_INTEREST_ITEM_ADDRESS(ar, hi_mbox_isr_yield_limit),
++ (A_UCHAR *)&mbox_yield_limit,
++ 4);
+
-+ if (streamID != WMI_CONTROL_PRI) {
-+ ar->arTotalTxDataPending++;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF("BMIWriteMemory for yield limit failed \n");
++ break;
+ }
-+ }
-+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+ if (cookie != NULL) {
-+ cookie->arc_bp[0] = (A_UINT32)osbuf;
-+ cookie->arc_bp[1] = 0;
-+ SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
-+ cookie,
-+ A_NETBUF_DATA(osbuf),
-+ A_NETBUF_LEN(osbuf),
-+ arWMIStream2EndpointID(ar,streamID),
-+ AR6K_CONTROL_PKT_TAG);
-+ /* this interface is asynchronous, if there is an error, cleanup will happen in the
-+ * TX completion callback */
-+ HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
-+ status = A_OK;
-+ }
++ } while (FALSE);
+
+ return status;
+}
+
-+/* indicate tx activity or inactivity on a WMI stream */
-+void ar6000_indicate_tx_activity(void *devt, A_UINT8 TrafficClass, A_BOOL Active)
++static void free_raw_buffers(AR_SOFTC_T *ar)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+ WMI_PRI_STREAM_ID streamid;
++ int i, j;
+
-+ if (ar->arWmiEnabled) {
-+ streamid = wmi_get_stream_id(ar->arWmi, TrafficClass);
-+ } else {
-+ /* for mbox ping testing, the traffic class is mapped directly as a stream ID,
-+ * see handling of AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE in ioctl.c */
-+ streamid = (WMI_PRI_STREAM_ID)TrafficClass;
++ for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
++ for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++)
++ kfree(ar->raw_htc_read_buffer[i][j]);
++ for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++)
++ kfree(ar->raw_htc_write_buffer[i][j]);
+ }
-+
-+ /* notify HTC, this may cause credit distribution changes */
-+
-+ HTCIndicateActivityChange(ar->arHtcTarget,
-+ arWMIStream2EndpointID(ar,streamid),
-+ Active);
-+
+}
+
-+module_init(ar6000_init_module);
-+module_exit(ar6000_cleanup_module);
-+
-+/* Init cookie queue */
-+static void
-+ar6000_cookie_init(AR_SOFTC_T *ar)
++static int alloc_raw_buffers(AR_SOFTC_T *ar)
+{
-+ A_UINT32 i;
-+
-+ ar->arCookieList = NULL;
-+ A_MEMZERO(s_ar_cookie_mem, sizeof(s_ar_cookie_mem));
++ int i, j;
++ raw_htc_buffer *b;
+
-+ for (i = 0; i < MAX_COOKIE_NUM; i++) {
-+ ar6000_free_cookie(ar, &s_ar_cookie_mem[i]);
++ for (i = 0; i != HTC_RAW_STREAM_NUM_MAX; i++) {
++ for (j = 0; j != RAW_HTC_READ_BUFFERS_NUM; j++) {
++ b = kzalloc(sizeof(*b), GFP_KERNEL);
++ if (!b)
++ return -ENOMEM;
++ ar->raw_htc_read_buffer[i][j] = b;
++ }
++ for (j = 0; j != RAW_HTC_WRITE_BUFFERS_NUM; j++) {
++ b = kzalloc(sizeof(*b), GFP_KERNEL);
++ if (!b)
++ return -ENOMEM;
++ ar->raw_htc_write_buffer[i][j] = b;
++ }
+ }
++ return 0;
+}
+
-+/* cleanup cookie queue */
-+static void
-+ar6000_cookie_cleanup(AR_SOFTC_T *ar)
-+{
-+ /* It is gone .... */
-+ ar->arCookieList = NULL;
-+}
-+
-+/* Init cookie queue */
++static const struct net_device_ops ar6000_netdev_ops = {
++ .ndo_init = &ar6000_init,
++ .ndo_open = &ar6000_open,
++ .ndo_stop = &ar6000_close,
++ .ndo_start_xmit = &ar6000_data_tx,
++ .ndo_get_stats = &ar6000_get_stats,
++ .ndo_do_ioctl = &ar6000_ioctl,
++};
++/*
++ * HTC Event handlers
++ */
+static void
-+ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie)
++ar6000_avail_ev(HTC_HANDLE HTCHandle)
+{
-+ /* Insert first */
-+ A_ASSERT(ar != NULL);
-+ A_ASSERT(cookie != NULL);
-+ cookie->arc_list_next = ar->arCookieList;
-+ ar->arCookieList = cookie;
-+}
++ int i;
++ struct net_device *dev;
++ AR_SOFTC_T *ar;
++ int device_index = 0;
+
-+/* cleanup cookie queue */
-+static struct ar_cookie *
-+ar6000_alloc_cookie(AR_SOFTC_T *ar)
-+{
-+ struct ar_cookie *cookie;
++ AR_DEBUG_PRINTF("ar6000_available\n");
+
-+ cookie = ar->arCookieList;
-+ if(cookie != NULL)
-+ {
-+ ar->arCookieList = cookie->arc_list_next;
++ for (i=0; i < MAX_AR6000; i++) {
++ if (ar6000_devices[i] == NULL) {
++ break;
++ }
+ }
+
-+ return cookie;
-+}
-+
-+#ifdef SEND_EVENT_TO_APP
-+/*
-+ * This function is used to send event which come from taget to
-+ * the application. The buf which send to application is include
-+ * the event ID and event content.
-+ */
-+#define EVENT_ID_LEN 2
-+void ar6000_send_event_to_app(AR_SOFTC_T *ar, A_UINT16 eventId,
-+ A_UINT8 *datap, int len)
-+{
++ if (i == MAX_AR6000) {
++ AR_DEBUG_PRINTF("ar6000_available: max devices reached\n");
++ return;
++ }
+
-+#if (WIRELESS_EXT >= 15)
++ /* Save this. It gives a bit better readability especially since */
++ /* we use another local "i" variable below. */
++ device_index = i;
+
-+/* note: IWEVCUSTOM only exists in wireless extensions after version 15 */
++ A_ASSERT(HTCHandle != NULL);
+
-+ char *buf;
-+ A_UINT16 size;
-+ union iwreq_data wrqu;
++ dev = alloc_etherdev(sizeof(AR_SOFTC_T));
++ if (dev == NULL) {
++ AR_DEBUG_PRINTF("ar6000_available: can't alloc etherdev\n");
++ return;
++ }
+
-+ size = len + EVENT_ID_LEN;
++ ether_setup(dev);
+
-+ if (size > IW_CUSTOM_MAX) {
-+ AR_DEBUG_PRINTF("WMI event ID : 0x%4.4X, len = %d too big for IWEVCUSTOM (max=%d) \n",
-+ eventId, size, IW_CUSTOM_MAX);
++ if (netdev_priv(dev) == NULL) {
++ printk(KERN_CRIT "ar6000_available: Could not allocate memory\n");
+ return;
+ }
+
-+ buf = A_MALLOC_NOWAIT(size);
-+ A_MEMZERO(buf, size);
-+ A_MEMCPY(buf, &eventId, EVENT_ID_LEN);
-+ A_MEMCPY(buf+EVENT_ID_LEN, datap, len);
++ A_MEMZERO(netdev_priv(dev), sizeof(AR_SOFTC_T));
+
-+ //AR_DEBUG_PRINTF("event ID = %d,len = %d\n",*(A_UINT16*)buf, size);
-+ A_MEMZERO(&wrqu, sizeof(wrqu));
-+ wrqu.data.length = size;
-+ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++ ar = (AR_SOFTC_T *)netdev_priv(dev);
++ ar->arNetDev = dev;
++ ar->arHtcTarget = HTCHandle;
++ ar->arHifDevice = HTCGetHifDevice(HTCHandle);
++ ar->arWlanState = WLAN_ENABLED;
++ ar->arRadioSwitch = WLAN_ENABLED;
++ ar->arDeviceIndex = device_index;
+
-+ A_FREE(buf);
-+#endif
++ A_INIT_TIMER(&ar->arHBChallengeResp.timer, ar6000_detect_error, dev);
++ ar->arHBChallengeResp.seqNum = 0;
++ ar->arHBChallengeResp.outstanding = FALSE;
++ ar->arHBChallengeResp.missCnt = 0;
++ ar->arHBChallengeResp.frequency = AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT;
++ ar->arHBChallengeResp.missThres = AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT;
+
++ ar6000_init_control_info(ar);
++ init_waitqueue_head(&arEvent);
++ sema_init(&ar->arSem, 1);
+
-+}
-+#endif
++ if (alloc_raw_buffers(ar)) {
++ free_raw_buffers(ar);
++ /*
++ * @@@ Clean up our own mess, but for anything else, cheerfully mimick
++ * the beautiful error non-handling of the rest of this function.
++ */
++ return;
++ }
+
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++ A_INIT_TIMER(&aptcTimer, aptcTimerHandler, ar);
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+void
-+ar6000_tx_retry_err_event(void *devt)
-+{
-+ AR_DEBUG2_PRINTF("Tx retries reach maximum!\n");
-+}
++ /*
++ * If requested, perform some magic which requires no cooperation from
++ * the Target. It causes the Target to ignore flash and execute to the
++ * OS from ROM.
++ *
++ * This is intended to support recovery from a corrupted flash on Targets
++ * that support flash.
++ */
++ if (skipflash)
++ {
++ ar6000_reset_device_skipflash(ar->arHifDevice);
++ }
+
-+void
-+ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, A_UINT8 snr)
-+{
-+ AR_DEBUG2_PRINTF("snr threshold range %d, snr %d\n", newThreshold, snr);
-+}
++ BMIInit();
++ {
++ struct bmi_target_info targ_info;
+
-+void
-+ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL newThreshold, A_UINT8 lq)
-+{
-+ AR_DEBUG2_PRINTF("lq threshold range %d, lq %d\n", newThreshold, lq);
-+}
++ if (BMIGetTargetInfo(ar->arHifDevice, &targ_info) != A_OK) {
++ return;
++ }
+
++ ar->arVersion.target_ver = targ_info.target_ver;
++ ar->arTargetType = targ_info.target_type;
++ }
+
++ if (enableuartprint) {
++ A_UINT32 param;
++ param = 1;
++ if (BMIWriteMemory(ar->arHifDevice,
++ HOST_INTEREST_ITEM_ADDRESS(ar, hi_serial_enable),
++ (A_UCHAR *)¶m,
++ 4)!= A_OK)
++ {
++ AR_DEBUG_PRINTF("BMIWriteMemory for enableuartprint failed \n");
++ return ;
++ }
++ AR_DEBUG_PRINTF("Serial console prints enabled\n");
++ }
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++ if(testmode) {
++ ar->arTargetMode = AR6000_TCMD_MODE;
++ }else {
++ ar->arTargetMode = AR6000_WLAN_MODE;
++ }
++#endif
++ if (enabletimerwar) {
++ A_UINT32 param;
+
-+A_UINT32
-+a_copy_to_user(void *to, const void *from, A_UINT32 n)
-+{
-+ return(copy_to_user(to, from, n));
-+}
++ if (BMIReadMemory(ar->arHifDevice,
++ HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
++ (A_UCHAR *)¶m,
++ 4)!= A_OK)
++ {
++ AR_DEBUG_PRINTF("BMIReadMemory for enabletimerwar failed \n");
++ return;
++ }
+
-+A_UINT32
-+a_copy_from_user(void *to, const void *from, A_UINT32 n)
-+{
-+ return(copy_from_user(to, from, n));
-+}
++ param |= HI_OPTION_TIMER_WAR;
+
++ if (BMIWriteMemory(ar->arHifDevice,
++ HOST_INTEREST_ITEM_ADDRESS(ar, hi_option_flag),
++ (A_UCHAR *)¶m,
++ 4) != A_OK)
++ {
++ AR_DEBUG_PRINTF("BMIWriteMemory for enabletimerwar failed \n");
++ return;
++ }
++ AR_DEBUG_PRINTF("Timer WAR enabled\n");
++ }
+
-+A_STATUS
-+ar6000_get_driver_cfg(struct net_device *dev,
-+ A_UINT16 cfgParam,
-+ void *result)
-+{
+
-+ A_STATUS ret = 0;
++ /* since BMIInit is called in the driver layer, we have to set the block
++ * size here for the target */
+
-+ switch(cfgParam)
-+ {
-+ case AR6000_DRIVER_CFG_GET_WLANNODECACHING:
-+ *((A_UINT32 *)result) = wlanNodeCaching;
-+ break;
-+ case AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS:
-+ *((A_UINT32 *)result) = logWmiRawMsgs;
-+ break;
-+ default:
-+ ret = EINVAL;
-+ break;
++ if (A_FAILED(ar6000_SetHTCBlockSize(ar))) {
++ return;
+ }
+
-+ return ret;
-+}
++ spin_lock_init(&ar->arLock);
+
-+void
-+ar6000_keepalive_rx(void *devt, A_UINT8 configured)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
++ dev->netdev_ops = &ar6000_netdev_ops;
++ dev->watchdog_timeo = AR6000_TX_TIMEOUT;
++ ar6000_ioctl_iwsetup(&ath_iw_handler_def);
++ dev->wireless_handlers = &ath_iw_handler_def;
++ ath_iw_handler_def.get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
+
-+ ar->arKeepaliveConfigured = configured;
-+ wake_up(&arEvent);
-+}
++ /*
++ * We need the OS to provide us with more headroom in order to
++ * perform dix to 802.3, WMI header encap, and the HTC header
++ */
++ dev->hard_header_len = ETH_HLEN + sizeof(ATH_LLC_SNAP_HDR) +
++ sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN;
+
-+void
-+ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID, WMI_PMKID *pmkidList)
-+{
-+ A_UINT8 i, j;
++ /* This runs the init function */
++ SET_NETDEV_DEV(dev, HIFGetOSDevice(ar->arHifDevice));
++ if (register_netdev(dev)) {
++ AR_DEBUG_PRINTF("ar6000_avail: register_netdev failed\n");
++ ar6000_destroy(dev, 0);
++ return;
++ }
+
-+ A_PRINTF("Number of Cached PMKIDs is %d\n", numPMKID);
++ HTCSetInstance(ar->arHtcTarget, ar);
+
-+ for (i = 0; i < numPMKID; i++) {
-+ A_PRINTF("\nPMKID %d ", i);
-+ for (j = 0; j < WMI_PMKID_LEN; j++) {
-+ A_PRINTF("%2.2x", pmkidList->pmkid[j]);
-+ }
-+ pmkidList++;
-+ }
-+}
++ /* We only register the device in the global list if we succeed. */
++ /* If the device is in the global list, it will be destroyed */
++ /* when the module is unloaded. */
++ ar6000_devices[device_index] = dev;
+
-+#ifdef USER_KEYS
-+static A_STATUS
++ AR_DEBUG_PRINTF("ar6000_avail: name=%s htcTarget=0x%x, dev=0x%x (%d), ar=0x%x\n",
++ dev->name, (A_UINT32)HTCHandle, (A_UINT32)dev, device_index,
++ (A_UINT32)ar);
++}
+
-+ar6000_reinstall_keys(AR_SOFTC_T *ar, A_UINT8 key_op_ctrl)
++static void ar6000_target_failure(void *Instance, A_STATUS Status)
+{
-+ A_STATUS status = A_OK;
-+ struct ieee80211req_key *uik = &ar->user_saved_keys.ucast_ik;
-+ struct ieee80211req_key *bik = &ar->user_saved_keys.bcast_ik;
-+ CRYPTO_TYPE keyType = ar->user_saved_keys.keyType;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
++ WMI_TARGET_ERROR_REPORT_EVENT errEvent;
++ static A_BOOL sip = FALSE;
+
-+ if (IEEE80211_CIPHER_CCKM_KRK != uik->ik_type) {
-+ if (NONE_CRYPT == keyType) {
-+ goto _reinstall_keys_out;
++ if (Status != A_OK) {
++ if (timer_pending(&ar->arHBChallengeResp.timer)) {
++ A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
+ }
+
-+ if (uik->ik_keylen) {
-+ status = wmi_addKey_cmd(ar->arWmi, uik->ik_keyix,
-+ ar->user_saved_keys.keyType, PAIRWISE_USAGE,
-+ uik->ik_keylen, (A_UINT8 *)&uik->ik_keyrsc,
-+ uik->ik_keydata, key_op_ctrl, SYNC_BEFORE_WMIFLAG);
++ /* try dumping target assertion information (if any) */
++ ar6000_dump_target_assert_info(ar->arHifDevice,ar->arTargetType);
++
++ /*
++ * Fetch the logs from the target via the diagnostic
++ * window.
++ */
++ ar6000_dbglog_get_debug_logs(ar);
++
++ /* Report the error only once */
++ if (!sip) {
++ sip = TRUE;
++ errEvent.errorVal = WMI_TARGET_COM_ERR |
++ WMI_TARGET_FATAL_ERR;
++#ifdef SEND_EVENT_TO_APP
++ ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
++ (A_UINT8 *)&errEvent,
++ sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
++#endif
+ }
++ }
++}
+
-+ } else {
-+ status = wmi_add_krk_cmd(ar->arWmi, uik->ik_keydata);
++static void
++ar6000_unavail_ev(void *Instance)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
++ /* NULL out it's entry in the global list */
++ ar6000_devices[ar->arDeviceIndex] = NULL;
++ ar6000_destroy(ar->arNetDev, 1);
++}
++
++/*
++ * We need to differentiate between the surprise and planned removal of the
++ * device because of the following consideration:
++ * - In case of surprise removal, the hcd already frees up the pending
++ * for the device and hence there is no need to unregister the function
++ * driver inorder to get these requests. For planned removal, the function
++ * driver has to explictly unregister itself to have the hcd return all the
++ * pending requests before the data structures for the devices are freed up.
++ * Note that as per the current implementation, the function driver will
++ * end up releasing all the devices since there is no API to selectively
++ * release a particular device.
++ * - Certain commands issued to the target can be skipped for surprise
++ * removal since they will anyway not go through.
++ */
++static void
++ar6000_destroy(struct net_device *dev, unsigned int unregister)
++{
++ AR_SOFTC_T *ar;
++
++ AR_DEBUG_PRINTF("+ar6000_destroy \n");
++
++ if((dev == NULL) || ((ar = netdev_priv(dev)) == NULL))
++ {
++ AR_DEBUG_PRINTF("%s(): Failed to get device structure.\n", __func__);
++ return;
+ }
+
-+ if (IEEE80211_CIPHER_CCKM_KRK != bik->ik_type) {
-+ if (NONE_CRYPT == keyType) {
-+ goto _reinstall_keys_out;
-+ }
++ /* Clear the tx counters */
++ memset(tx_attempt, 0, sizeof(tx_attempt));
++ memset(tx_post, 0, sizeof(tx_post));
++ memset(tx_complete, 0, sizeof(tx_complete));
+
-+ if (bik->ik_keylen) {
-+ status = wmi_addKey_cmd(ar->arWmi, bik->ik_keyix,
-+ ar->user_saved_keys.keyType, GROUP_USAGE,
-+ bik->ik_keylen, (A_UINT8 *)&bik->ik_keyrsc,
-+ bik->ik_keydata, key_op_ctrl, NO_SYNC_WMIFLAG);
-+ }
++ /* Free up the device data structure */
++ if (unregister) {
++ unregister_netdev(dev);
+ } else {
-+ status = wmi_add_krk_cmd(ar->arWmi, bik->ik_keydata);
++ ar6000_close(dev);
++ ar6000_cleanup(dev);
+ }
+
-+_reinstall_keys_out:
-+ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
-+ ar->user_key_ctrl = 0;
++ free_raw_buffers(ar);
+
-+ return status;
++#ifndef free_netdev
++ kfree(dev);
++#else
++ free_netdev(dev);
++#endif
++
++ AR_DEBUG_PRINTF("-ar6000_destroy \n");
+}
-+#endif /* USER_KEYS */
+
++static void ar6000_detect_error(unsigned long ptr)
++{
++ struct net_device *dev = (struct net_device *)ptr;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_TARGET_ERROR_REPORT_EVENT errEvent;
+
-+void
-+ar6000_dset_open_req(
-+ void *context,
-+ A_UINT32 id,
-+ A_UINT32 targHandle,
-+ A_UINT32 targReplyFn,
-+ A_UINT32 targReplyArg)
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++
++ if (ar->arHBChallengeResp.outstanding) {
++ ar->arHBChallengeResp.missCnt++;
++ } else {
++ ar->arHBChallengeResp.missCnt = 0;
++ }
++
++ if (ar->arHBChallengeResp.missCnt > ar->arHBChallengeResp.missThres) {
++ /* Send Error Detect event to the application layer and do not reschedule the error detection module timer */
++ ar->arHBChallengeResp.missCnt = 0;
++ ar->arHBChallengeResp.seqNum = 0;
++ errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++#ifdef SEND_EVENT_TO_APP
++ ar6000_send_event_to_app(ar, WMI_ERROR_REPORT_EVENTID,
++ (A_UINT8 *)&errEvent,
++ sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
++#endif
++ return;
++ }
++
++ /* Generate the sequence number for the next challenge */
++ ar->arHBChallengeResp.seqNum++;
++ ar->arHBChallengeResp.outstanding = TRUE;
++
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++
++ /* Send the challenge on the control channel */
++ if (wmi_get_challenge_resp_cmd(ar->arWmi, ar->arHBChallengeResp.seqNum, DRV_HB_CHALLENGE) != A_OK) {
++ AR_DEBUG_PRINTF("Unable to send heart beat challenge\n");
++ }
++
++
++ /* Reschedule the timer for the next challenge */
++ A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
++}
++
++void ar6000_init_profile_info(AR_SOFTC_T *ar)
+{
++ ar->arSsidLen = 0;
++ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
++ ar->arNetworkType = INFRA_NETWORK;
++ ar->arDot11AuthMode = OPEN_AUTH;
++ ar->arAuthMode = NONE_AUTH;
++ ar->arPairwiseCrypto = NONE_CRYPT;
++ ar->arPairwiseCryptoLen = 0;
++ ar->arGroupCrypto = NONE_CRYPT;
++ ar->arGroupCryptoLen = 0;
++ A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
++ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
++ A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
++ ar->arBssChannel = 0;
+}
+
-+void
-+ar6000_dset_close(
-+ void *context,
-+ A_UINT32 access_cookie)
++static void
++ar6000_init_control_info(AR_SOFTC_T *ar)
+{
-+ return;
++ ar->arWmiEnabled = FALSE;
++ ar6000_init_profile_info(ar);
++ ar->arDefTxKeyIndex = 0;
++ A_MEMZERO(ar->arWepKeyList, sizeof(ar->arWepKeyList));
++ ar->arChannelHint = 0;
++ ar->arListenInterval = MAX_LISTEN_INTERVAL;
++ ar->arVersion.host_ver = AR6K_SW_VERSION;
++ ar->arRssi = 0;
++ ar->arTxPwr = 0;
++ ar->arTxPwrSet = FALSE;
++ ar->arSkipScan = 0;
++ ar->arBeaconInterval = 0;
++ ar->arBitRate = 0;
++ ar->arMaxRetries = 0;
++ ar->arWmmEnabled = TRUE;
+}
+
-+void
-+ar6000_dset_data_req(
-+ void *context,
-+ A_UINT32 accessCookie,
-+ A_UINT32 offset,
-+ A_UINT32 length,
-+ A_UINT32 targBuf,
-+ A_UINT32 targReplyFn,
-+ A_UINT32 targReplyArg)
++static int
++ar6000_open(struct net_device *dev)
+{
++ /* Wake up the queues */
++ netif_start_queue(dev);
++
++ return 0;
+}
-diff --git a/drivers/ar6000/ar6000/ar6000_drv.h b/drivers/ar6000/ar6000/ar6000_drv.h
-new file mode 100644
-index 0000000..3230d32
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_drv.h
-@@ -0,0 +1,361 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
+
-+#ifndef _AR6000_H_
-+#define _AR6000_H_
++static int
++ar6000_close(struct net_device *dev)
++{
++ /* Stop the transmit queues */
++ netif_stop_queue(dev);
++ return 0;
++}
+
-+#include <linux/version.h>
++static int
++ar6000_cleanup(struct net_device *dev)
++{
++ AR_SOFTC_T *ar = netdev_priv(dev);
+
++ /* Stop the transmit queues */
++ netif_stop_queue(dev);
+
-+#include <generated/autoconf.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/spinlock.h>
-+#include <linux/skbuff.h>
-+#include <linux/if_ether.h>
-+#include <linux/netdevice.h>
-+#include <linux/etherdevice.h>
-+#include <net/iw_handler.h>
-+#include <linux/if_arp.h>
-+#include <linux/ip.h>
-+#include <linux/semaphore.h>
-+#include <linux/wireless.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <asm/io.h>
++ /* Disable the target and the interrupts associated with it */
++ if (ar->arWmiReady == TRUE)
++ {
++ if (!bypasswmi)
++ {
++ if (ar->arConnected == TRUE || ar->arConnectPending == TRUE)
++ {
++ AR_DEBUG_PRINTF("%s(): Disconnect\n", __func__);
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar6000_init_profile_info(ar);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ wmi_disconnect_cmd(ar->arWmi);
++ }
+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "htc_api.h"
-+#include "wmi.h"
-+#include "a_drv.h"
-+#include "bmi.h"
-+#include <ieee80211.h>
-+#include <ieee80211_ioctl.h>
-+#include <wlan_api.h>
-+#include <wmi_api.h>
-+#include "gpio_api.h"
-+#include "gpio.h"
-+#include <host_version.h>
-+#include <linux/rtnetlink.h>
-+#include <linux/init.h>
-+#include <linux/moduleparam.h>
-+#include "AR6Khwreg.h"
-+#include "ar6000_api.h"
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+#include <testcmd.h>
++ ar6000_dbglog_get_debug_logs(ar);
++ ar->arWmiReady = FALSE;
++ ar->arConnected = FALSE;
++ ar->arConnectPending = FALSE;
++ wmi_shutdown(ar->arWmi);
++ ar->arWmiEnabled = FALSE;
++ ar->arWmi = NULL;
++ ar->arWlanState = WLAN_ENABLED;
++#ifdef USER_KEYS
++ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
++ ar->user_key_ctrl = 0;
+#endif
++ }
+
-+#include "targaddrs.h"
-+#include "dbglog_api.h"
-+#include "ar6000_diag.h"
-+#include "common_drv.h"
++ AR_DEBUG_PRINTF("%s(): WMI stopped\n", __func__);
++ }
++ else
++ {
++ AR_DEBUG_PRINTF("%s(): WMI not ready 0x%08x 0x%08x\n",
++ __func__, (unsigned int) ar, (unsigned int) ar->arWmi);
+
-+#ifndef __dev_put
-+#define __dev_put(dev) dev_put(dev)
-+#endif
++ /* Shut down WMI if we have started it */
++ if(ar->arWmiEnabled == TRUE)
++ {
++ AR_DEBUG_PRINTF("%s(): Shut down WMI\n", __func__);
++ wmi_shutdown(ar->arWmi);
++ ar->arWmiEnabled = FALSE;
++ ar->arWmi = NULL;
++ }
++ }
+
-+#ifdef USER_KEYS
++ /* stop HTC */
++ HTCStop(ar->arHtcTarget);
+
-+#define USER_SAVEDKEYS_STAT_INIT 0
-+#define USER_SAVEDKEYS_STAT_RUN 1
++ /* set the instance to NULL so we do not get called back on remove incase we
++ * we're explicity destroyed by module unload */
++ HTCSetInstance(ar->arHtcTarget, NULL);
+
-+// TODO this needs to move into the AR_SOFTC struct
-+struct USER_SAVEDKEYS {
-+ struct ieee80211req_key ucast_ik;
-+ struct ieee80211req_key bcast_ik;
-+ CRYPTO_TYPE keyType;
-+ A_BOOL keyOk;
-+};
-+#endif
++ if (resetok) {
++ /* try to reset the device if we can
++ * The driver may have been configure NOT to reset the target during
++ * a debug session */
++ AR_DEBUG_PRINTF(" Attempting to reset target on instance destroy.... \n");
++ ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
++ } else {
++ AR_DEBUG_PRINTF(" Host does not want target reset. \n");
++ }
+
-+#define DBG_INFO 0x00000001
-+#define DBG_ERROR 0x00000002
-+#define DBG_WARNING 0x00000004
-+#define DBG_SDIO 0x00000008
-+#define DBG_HIF 0x00000010
-+#define DBG_HTC 0x00000020
-+#define DBG_WMI 0x00000040
-+#define DBG_WMI2 0x00000080
-+#define DBG_DRIVER 0x00000100
++ /* Done with cookies */
++ ar6000_cookie_cleanup(ar);
+
-+#define DBG_DEFAULTS (DBG_ERROR|DBG_WARNING)
++ /* Cleanup BMI */
++ BMIInit();
+
++ return 0;
++}
+
-+#ifdef DEBUG
-+#define AR_DEBUG_PRINTF(args...) if (debugdriver) A_PRINTF(args);
-+#define AR_DEBUG2_PRINTF(args...) if (debugdriver >= 2) A_PRINTF(args);
-+extern int debugdriver;
-+#else
-+#define AR_DEBUG_PRINTF(args...)
-+#define AR_DEBUG2_PRINTF(args...)
-+#endif
++/* connect to a service */
++static A_STATUS ar6000_connectservice(AR_SOFTC_T *ar,
++ HTC_SERVICE_CONNECT_REQ *pConnect,
++ WMI_PRI_STREAM_ID WmiStreamID,
++ char *pDesc)
++{
++ A_STATUS status;
++ HTC_SERVICE_CONNECT_RESP response;
+
-+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++ do {
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++ A_MEMZERO(&response,sizeof(response));
+
-+#define MAX_AR6000 1
-+#define AR6000_MAX_RX_BUFFERS 16
-+#define AR6000_BUFFER_SIZE 1664
-+#define AR6000_TX_TIMEOUT 10
-+#define AR6000_ETH_ADDR_LEN 6
-+#define AR6000_MAX_ENDPOINTS 4
-+#define MAX_NODE_NUM 15
-+#define MAX_COOKIE_NUM 150
-+#define AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT 1
-+#define AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT 1
++ status = HTCConnectService(ar->arHtcTarget,
++ pConnect,
++ &response);
+
-+enum {
-+ DRV_HB_CHALLENGE = 0,
-+ APP_HB_CHALLENGE
-+};
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(" Failed to connect to %s service status:%d \n", pDesc, status);
++ break;
++ }
+
-+/* HTC RAW streams */
-+typedef enum _HTC_RAW_STREAM_ID {
-+ HTC_RAW_STREAM_NOT_MAPPED = -1,
-+ HTC_RAW_STREAM_0 = 0,
-+ HTC_RAW_STREAM_1 = 1,
-+ HTC_RAW_STREAM_2 = 2,
-+ HTC_RAW_STREAM_3 = 3,
-+ HTC_RAW_STREAM_NUM_MAX
-+} HTC_RAW_STREAM_ID;
++ if (WmiStreamID == WMI_NOT_MAPPED) {
++ /* done */
++ break;
++ }
+
-+#define RAW_HTC_READ_BUFFERS_NUM 4
-+#define RAW_HTC_WRITE_BUFFERS_NUM 4
++ /* set endpoint mapping for the WMI stream in the driver layer */
++ arSetWMIStream2EndpointIDMap(ar,WmiStreamID,response.Endpoint);
+
-+typedef struct {
-+ int currPtr;
-+ int length;
-+ unsigned char data[AR6000_BUFFER_SIZE];
-+ HTC_PACKET HTCPacket;
-+} raw_htc_buffer;
++ } while (FALSE);
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/*
-+ * add TCMD_MODE besides wmi and bypasswmi
-+ * in TCMD_MODE, only few TCMD releated wmi commands
-+ * counld be hanlder
-+ */
-+enum {
-+ AR6000_WMI_MODE = 0,
-+ AR6000_BYPASS_MODE,
-+ AR6000_TCMD_MODE,
-+ AR6000_WLAN_MODE
-+};
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
++ return status;
++}
+
-+struct ar_wep_key {
-+ A_UINT8 arKeyIndex;
-+ A_UINT8 arKeyLen;
-+ A_UINT8 arKey[64];
-+} ;
++static void ar6000_TxDataCleanup(AR_SOFTC_T *ar)
++{
++ /* flush all the data (non-control) streams
++ * we only flush packets that are tagged as data, we leave any control packets that
++ * were in the TX queues alone */
++ HTCFlushEndpoint(ar->arHtcTarget,
++ arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI),
++ AR6K_DATA_PKT_TAG);
++ HTCFlushEndpoint(ar->arHtcTarget,
++ arWMIStream2EndpointID(ar,WMI_LOW_PRI),
++ AR6K_DATA_PKT_TAG);
++ HTCFlushEndpoint(ar->arHtcTarget,
++ arWMIStream2EndpointID(ar,WMI_HIGH_PRI),
++ AR6K_DATA_PKT_TAG);
++ HTCFlushEndpoint(ar->arHtcTarget,
++ arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI),
++ AR6K_DATA_PKT_TAG);
++}
+
-+struct ar_node_mapping {
-+ A_UINT8 macAddress[6];
-+ A_UINT8 epId;
-+ A_UINT8 txPending;
-+};
++/* This function does one time initialization for the lifetime of the device */
++int ar6000_init(struct net_device *dev)
++{
++ AR_SOFTC_T *ar;
++ A_STATUS status;
++ A_INT32 timeleft;
+
-+struct ar_cookie {
-+ A_UINT32 arc_bp[2]; /* Must be first field */
-+ HTC_PACKET HtcPkt; /* HTC packet wrapper */
-+ struct ar_cookie *arc_list_next;
-+};
++ if((ar = netdev_priv(dev)) == NULL)
++ {
++ return(-EIO);
++ }
+
-+struct ar_hb_chlng_resp {
-+ A_TIMER timer;
-+ A_UINT32 frequency;
-+ A_UINT32 seqNum;
-+ A_BOOL outstanding;
-+ A_UINT8 missCnt;
-+ A_UINT8 missThres;
-+};
++ /* Do we need to finish the BMI phase */
++ if(BMIDone(ar->arHifDevice) != A_OK)
++ {
++ return -EIO;
++ }
+
-+typedef struct ar6_softc {
-+ struct net_device *arNetDev; /* net_device pointer */
-+ void *arWmi;
-+ int arTxPending[WMI_PRI_MAX_COUNT];
-+ int arTotalTxDataPending;
-+ A_UINT8 arNumDataEndPts;
-+ A_BOOL arWmiEnabled;
-+ A_BOOL arWmiReady;
-+ A_BOOL arConnected;
-+ A_BOOL arRadioSwitch;
-+ HTC_HANDLE arHtcTarget;
-+ void *arHifDevice;
-+ spinlock_t arLock;
-+ struct semaphore arSem;
-+ int arRxBuffers[WMI_PRI_MAX_COUNT];
-+ int arSsidLen;
-+ u_char arSsid[32];
-+ A_UINT8 arNetworkType;
-+ A_UINT8 arDot11AuthMode;
-+ A_UINT8 arAuthMode;
-+ A_UINT8 arPairwiseCrypto;
-+ A_UINT8 arPairwiseCryptoLen;
-+ A_UINT8 arGroupCrypto;
-+ A_UINT8 arGroupCryptoLen;
-+ A_UINT8 arDefTxKeyIndex;
-+ struct ar_wep_key arWepKeyList[WMI_MAX_KEY_INDEX + 1];
-+ A_UINT8 arBssid[6];
-+ A_UINT8 arReqBssid[6];
-+ A_UINT16 arChannelHint;
-+ A_UINT16 arBssChannel;
-+ A_UINT16 arListenInterval;
-+ struct ar6000_version arVersion;
-+ A_UINT32 arTargetType;
-+ A_INT8 arRssi;
-+ A_UINT8 arTxPwr;
-+ A_BOOL arTxPwrSet;
-+ A_INT32 arBitRate;
-+ struct net_device_stats arNetStats;
-+ struct iw_statistics arIwStats;
-+ A_INT8 arNumChannels;
-+ A_UINT16 arChannelList[32];
-+ A_UINT32 arRegCode;
-+ A_BOOL statsUpdatePending;
-+ TARGET_STATS arTargetStats;
-+ A_INT8 arMaxRetries;
-+ A_UINT8 arPhyCapability;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+ A_UINT8 tcmdRxReport;
-+ A_UINT32 tcmdRxTotalPkt;
-+ A_INT32 tcmdRxRssi;
-+ A_UINT32 tcmdPm;
-+ A_UINT32 arTargetMode;
-+#endif
-+ AR6000_WLAN_STATE arWlanState;
-+ struct ar_node_mapping arNodeMap[MAX_NODE_NUM];
-+ A_UINT8 arIbssPsEnable;
-+ A_UINT8 arNodeNum;
-+ A_UINT8 arNexEpId;
-+ struct ar_cookie *arCookieList;
-+ A_UINT16 arRateMask;
-+ A_UINT8 arSkipScan;
-+ A_UINT16 arBeaconInterval;
-+ A_BOOL arConnectPending;
-+ A_BOOL arWmmEnabled;
-+ struct ar_hb_chlng_resp arHBChallengeResp;
-+ A_UINT8 arKeepaliveConfigured;
-+ A_UINT32 arMgmtFilter;
-+ HTC_ENDPOINT_ID arWmi2EpMapping[WMI_PRI_MAX_COUNT];
-+ WMI_PRI_STREAM_ID arEp2WmiMapping[ENDPOINT_MAX];
-+#ifdef HTC_RAW_INTERFACE
-+ HTC_ENDPOINT_ID arRaw2EpMapping[HTC_RAW_STREAM_NUM_MAX];
-+ HTC_RAW_STREAM_ID arEp2RawMapping[ENDPOINT_MAX];
-+ struct semaphore raw_htc_read_sem[HTC_RAW_STREAM_NUM_MAX];
-+ struct semaphore raw_htc_write_sem[HTC_RAW_STREAM_NUM_MAX];
-+ wait_queue_head_t raw_htc_read_queue[HTC_RAW_STREAM_NUM_MAX];
-+ wait_queue_head_t raw_htc_write_queue[HTC_RAW_STREAM_NUM_MAX];
-+ raw_htc_buffer *raw_htc_read_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_READ_BUFFERS_NUM];
-+ raw_htc_buffer *raw_htc_write_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_WRITE_BUFFERS_NUM];
-+ A_BOOL write_buffer_available[HTC_RAW_STREAM_NUM_MAX];
-+ A_BOOL read_buffer_available[HTC_RAW_STREAM_NUM_MAX];
-+#endif
-+ A_BOOL arRawIfInit;
-+ int arDeviceIndex;
-+ COMMON_CREDIT_STATE_INFO arCreditStateInfo;
-+ A_BOOL arWMIControlEpFull;
-+ A_BOOL dbgLogFetchInProgress;
-+ A_UCHAR log_buffer[DBGLOG_HOST_LOG_BUFFER_SIZE];
-+ A_UINT32 log_cnt;
-+ A_UINT32 dbglog_init_done;
-+ A_UINT32 arConnectCtrlFlags;
-+ A_UINT32 scan_complete;
-+#ifdef USER_KEYS
-+ A_INT32 user_savedkeys_stat;
-+ A_UINT32 user_key_ctrl;
-+ struct USER_SAVEDKEYS user_saved_keys;
++ if (!bypasswmi)
++ {
++#if 0 /* TBDXXX */
++ if (ar->arVersion.host_ver != ar->arVersion.target_ver) {
++ A_PRINTF("WARNING: Host version 0x%x does not match Target "
++ " version 0x%x!\n",
++ ar->arVersion.host_ver, ar->arVersion.target_ver);
++ }
+#endif
-+} AR_SOFTC_T;
+
++ /* Indicate that WMI is enabled (although not ready yet) */
++ ar->arWmiEnabled = TRUE;
++ if ((ar->arWmi = wmi_init((void *) ar)) == NULL)
++ {
++ AR_DEBUG_PRINTF("%s() Failed to initialize WMI.\n", __func__);
++ return(-EIO);
++ }
+
-+#define arWMIStream2EndpointID(ar,wmi) (ar)->arWmi2EpMapping[(wmi)]
-+#define arSetWMIStream2EndpointIDMap(ar,wmi,ep) \
-+{ (ar)->arWmi2EpMapping[(wmi)] = (ep); \
-+ (ar)->arEp2WmiMapping[(ep)] = (wmi); }
-+#define arEndpoint2WMIStreamID(ar,ep) (ar)->arEp2WmiMapping[(ep)]
-+
-+#define arRawIfEnabled(ar) (ar)->arRawIfInit
-+#define arRawStream2EndpointID(ar,raw) (ar)->arRaw2EpMapping[(raw)]
-+#define arSetRawStream2EndpointIDMap(ar,raw,ep) \
-+{ (ar)->arRaw2EpMapping[(raw)] = (ep); \
-+ (ar)->arEp2RawMapping[(ep)] = (raw); }
-+#define arEndpoint2RawStreamID(ar,ep) (ar)->arEp2RawMapping[(ep)]
-+
-+struct ar_giwscan_param {
-+ char *current_ev;
-+ char *end_buf;
-+ A_BOOL firstPass;
-+};
-+
-+#define AR6000_STAT_INC(ar, stat) (ar->arNetStats.stat++)
-+
-+#define AR6000_SPIN_LOCK(lock, param) do { \
-+ if (irqs_disabled()) { \
-+ AR_DEBUG_PRINTF("IRQs disabled:AR6000_LOCK\n"); \
-+ } \
-+ spin_lock_bh(lock); \
-+} while (0)
-+
-+#define AR6000_SPIN_UNLOCK(lock, param) do { \
-+ if (irqs_disabled()) { \
-+ AR_DEBUG_PRINTF("IRQs disabled: AR6000_UNLOCK\n"); \
-+ } \
-+ spin_unlock_bh(lock); \
-+} while (0)
++ AR_DEBUG_PRINTF("%s() Got WMI @ 0x%08x.\n", __func__,
++ (unsigned int) ar->arWmi);
++ }
+
-+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-+int ar6000_ioctl_dispatcher(struct net_device *dev, struct ifreq *rq, int cmd);
-+void ar6000_ioctl_iwsetup(struct iw_handler_def *def);
-+void ar6000_gpio_init(void);
-+void ar6000_init_profile_info(AR_SOFTC_T *ar);
-+void ar6000_install_static_wep_keys(AR_SOFTC_T *ar);
-+int ar6000_init(struct net_device *dev);
-+int ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar);
-+A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar);
++ do {
++ HTC_SERVICE_CONNECT_REQ connect;
+
-+#ifdef HTC_RAW_INTERFACE
++ /* the reason we have to wait for the target here is that the driver layer
++ * has to init BMI in order to set the host block size,
++ */
++ status = HTCWaitTarget(ar->arHtcTarget);
+
-+#ifndef __user
-+#define __user
-+#endif
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+int ar6000_htc_raw_open(AR_SOFTC_T *ar);
-+int ar6000_htc_raw_close(AR_SOFTC_T *ar);
-+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar,
-+ HTC_RAW_STREAM_ID StreamID,
-+ char __user *buffer, size_t count);
-+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar,
-+ HTC_RAW_STREAM_ID StreamID,
-+ char __user *buffer, size_t count);
++ A_MEMZERO(&connect,sizeof(connect));
++ /* meta data is unused for now */
++ connect.pMetaData = NULL;
++ connect.MetaDataLength = 0;
++ /* these fields are the same for all service endpoints */
++ connect.EpCallbacks.pContext = ar;
++ connect.EpCallbacks.EpTxComplete = ar6000_tx_complete;
++ connect.EpCallbacks.EpRecv = ar6000_rx;
++ connect.EpCallbacks.EpRecvRefill = ar6000_rx_refill;
++ connect.EpCallbacks.EpSendFull = ar6000_tx_queue_full;
++ connect.EpCallbacks.EpSendAvail = ar6000_tx_queue_avail;
++ /* set the max queue depth so that our ar6000_tx_queue_full handler gets called.
++ * Linux has the peculiarity of not providing flow control between the
++ * NIC and the network stack. There is no API to indicate that a TX packet
++ * was sent which could provide some back pressure to the network stack.
++ * Under linux you would have to wait till the network stack consumed all sk_buffs
++ * before any back-flow kicked in. Which isn't very friendly.
++ * So we have to manage this ourselves */
++ connect.MaxSendQueueDepth = 32;
+
-+#endif /* HTC_RAW_INTERFACE */
++ /* connect to control service */
++ connect.ServiceID = WMI_CONTROL_SVC;
++ status = ar6000_connectservice(ar,
++ &connect,
++ WMI_CONTROL_PRI,
++ "WMI CONTROL");
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#ifdef __cplusplus
-+}
-+#endif
++ /* for the remaining data services set the connection flag to reduce dribbling,
++ * if configured to do so */
++ if (reduce_credit_dribble) {
++ connect.ConnectionFlags |= HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE;
++ /* the credit dribble trigger threshold is (reduce_credit_dribble - 1) for a value
++ * of 0-3 */
++ connect.ConnectionFlags &= ~HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
++ connect.ConnectionFlags |=
++ ((A_UINT16)reduce_credit_dribble - 1) & HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
++ }
++ /* connect to best-effort service */
++ connect.ServiceID = WMI_DATA_BE_SVC;
+
-+#endif /* _AR6000_H_ */
-diff --git a/drivers/ar6000/ar6000/ar6000_raw_if.c b/drivers/ar6000/ar6000/ar6000_raw_if.c
-new file mode 100644
-index 0000000..4443bb2
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6000_raw_if.c
-@@ -0,0 +1,440 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ status = ar6000_connectservice(ar,
++ &connect,
++ WMI_BEST_EFFORT_PRI,
++ "WMI DATA BE");
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#include "ar6000_drv.h"
++ /* connect to back-ground
++ * map this to WMI LOW_PRI */
++ connect.ServiceID = WMI_DATA_BK_SVC;
++ status = ar6000_connectservice(ar,
++ &connect,
++ WMI_LOW_PRI,
++ "WMI DATA BK");
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#ifdef HTC_RAW_INTERFACE
++ /* connect to Video service, map this to
++ * to HI PRI */
++ connect.ServiceID = WMI_DATA_VI_SVC;
++ status = ar6000_connectservice(ar,
++ &connect,
++ WMI_HIGH_PRI,
++ "WMI DATA VI");
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+static void
-+ar6000_htc_raw_read_cb(void *Context, HTC_PACKET *pPacket)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+ raw_htc_buffer *busy;
-+ HTC_RAW_STREAM_ID streamID;
++ /* connect to VO service, this is currently not
++ * mapped to a WMI priority stream due to historical reasons.
++ * WMI originally defined 3 priorities over 3 mailboxes
++ * We can change this when WMI is reworked so that priorities are not
++ * dependent on mailboxes */
++ connect.ServiceID = WMI_DATA_VO_SVC;
++ status = ar6000_connectservice(ar,
++ &connect,
++ WMI_HIGHEST_PRI,
++ "WMI DATA VO");
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+ busy = (raw_htc_buffer *)pPacket->pPktContext;
-+ A_ASSERT(busy != NULL);
++ A_ASSERT(arWMIStream2EndpointID(ar,WMI_CONTROL_PRI) != 0);
++ A_ASSERT(arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI) != 0);
++ A_ASSERT(arWMIStream2EndpointID(ar,WMI_LOW_PRI) != 0);
++ A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGH_PRI) != 0);
++ A_ASSERT(arWMIStream2EndpointID(ar,WMI_HIGHEST_PRI) != 0);
++ } while (FALSE);
+
-+ if (pPacket->Status == A_ECANCELED) {
-+ /*
-+ * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+ * (probably due to a shutdown)
-+ */
-+ return;
++ if (A_FAILED(status)) {
++ return (-EIO);
+ }
+
-+ streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
-+ A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
-+
-+#ifdef CF
-+ if (down_trylock(&ar->raw_htc_read_sem[streamID])) {
-+#else
-+ if (down_interruptible(&ar->raw_htc_read_sem[streamID])) {
-+#endif /* CF */
-+ AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
-+ }
++ /*
++ * give our connected endpoints some buffers
++ */
++ ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_CONTROL_PRI));
+
-+ A_ASSERT((pPacket->Status != A_OK) ||
-+ (pPacket->pBuffer == (busy->data + HTC_HEADER_LEN)));
++ ar6000_rx_refill(ar, arWMIStream2EndpointID(ar,WMI_BEST_EFFORT_PRI));
+
-+ busy->length = pPacket->ActualLength + HTC_HEADER_LEN;
-+ busy->currPtr = HTC_HEADER_LEN;
-+ ar->read_buffer_available[streamID] = TRUE;
-+ //AR_DEBUG_PRINTF("raw read cb: 0x%X 0x%X \n", busy->currPtr,busy->length);
-+ up(&ar->raw_htc_read_sem[streamID]);
++ /*
++ * We will post the receive buffers only for SPE testing and so we are
++ * making it conditional on the 'bypasswmi' flag.
++ */
++ if (bypasswmi) {
++ ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_LOW_PRI));
++ ar6000_rx_refill(ar,arWMIStream2EndpointID(ar,WMI_HIGH_PRI));
++ }
+
-+ /* Signal the waiting process */
-+ AR_DEBUG2_PRINTF("Waking up the StreamID(%d) read process\n", streamID);
-+ wake_up_interruptible(&ar->raw_htc_read_queue[streamID]);
-+}
++ /* setup credit distribution */
++ ar6000_setup_credit_dist(ar->arHtcTarget, &ar->arCreditStateInfo);
+
-+static void
-+ar6000_htc_raw_write_cb(void *Context, HTC_PACKET *pPacket)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
-+ raw_htc_buffer *free;
-+ HTC_RAW_STREAM_ID streamID;
++ /* Since cookies are used for HTC transports, they should be */
++ /* initialized prior to enabling HTC. */
++ ar6000_cookie_init(ar);
+
-+ free = (raw_htc_buffer *)pPacket->pPktContext;
-+ A_ASSERT(free != NULL);
++ /* start HTC */
++ status = HTCStart(ar->arHtcTarget);
+
-+ if (pPacket->Status == A_ECANCELED) {
-+ /*
-+ * HTC provides A_ECANCELED status when it doesn't want to be refilled
-+ * (probably due to a shutdown)
-+ */
-+ return;
++ if (status != A_OK) {
++ if (ar->arWmiEnabled == TRUE) {
++ wmi_shutdown(ar->arWmi);
++ ar->arWmiEnabled = FALSE;
++ ar->arWmi = NULL;
++ }
++ ar6000_cookie_cleanup(ar);
++ return -EIO;
+ }
+
-+ streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
-+ A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
++ if (!bypasswmi) {
++ /* Wait for Wmi event to be ready */
++ timeleft = wait_event_interruptible_timeout(arEvent,
++ (ar->arWmiReady == TRUE), wmitimeout * HZ);
+
-+#ifdef CF
-+ if (down_trylock(&ar->raw_htc_write_sem[streamID])) {
++ if(!timeleft || signal_pending(current))
++ {
++ AR_DEBUG_PRINTF("WMI is not ready or wait was interrupted\n");
++#if defined(DWSIM) /* TBDXXX */
++ AR_DEBUG_PRINTF(".....but proceed anyway.\n");
+#else
-+ if (down_interruptible(&ar->raw_htc_write_sem[streamID])) {
++ return -EIO;
+#endif
-+ AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
-+ }
++ }
+
-+ A_ASSERT(pPacket->pBuffer == (free->data + HTC_HEADER_LEN));
++ AR_DEBUG_PRINTF("%s() WMI is ready\n", __func__);
+
-+ free->length = 0;
-+ ar->write_buffer_available[streamID] = TRUE;
-+ up(&ar->raw_htc_write_sem[streamID]);
++ /* Communicate the wmi protocol verision to the target */
++ if ((ar6000_set_host_app_area(ar)) != A_OK) {
++ AR_DEBUG_PRINTF("Unable to set the host app area\n");
++ }
++ }
+
-+ /* Signal the waiting process */
-+ AR_DEBUG2_PRINTF("Waking up the StreamID(%d) write process\n", streamID);
-+ wake_up_interruptible(&ar->raw_htc_write_queue[streamID]);
++ ar->arNumDataEndPts = 1;
++
++ return(0);
+}
+
-+/* connect to a service */
-+static A_STATUS ar6000_connect_raw_service(AR_SOFTC_T *ar,
-+ HTC_RAW_STREAM_ID StreamID)
-+{
-+ A_STATUS status;
-+ HTC_SERVICE_CONNECT_RESP response;
-+ A_UINT8 streamNo;
-+ HTC_SERVICE_CONNECT_REQ connect;
+
-+ do {
++void
++ar6000_bitrate_rx(void *devt, A_INT32 rateKbps)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
+
-+ A_MEMZERO(&connect,sizeof(connect));
-+ /* pass the stream ID as meta data to the RAW streams service */
-+ streamNo = (A_UINT8)StreamID;
-+ connect.pMetaData = &streamNo;
-+ connect.MetaDataLength = sizeof(A_UINT8);
-+ /* these fields are the same for all endpoints */
-+ connect.EpCallbacks.pContext = ar;
-+ connect.EpCallbacks.EpTxComplete = ar6000_htc_raw_write_cb;
-+ connect.EpCallbacks.EpRecv = ar6000_htc_raw_read_cb;
-+ /* simple interface, we don't need these optional callbacks */
-+ connect.EpCallbacks.EpRecvRefill = NULL;
-+ connect.EpCallbacks.EpSendFull = NULL;
-+ connect.EpCallbacks.EpSendAvail = NULL;
-+ connect.MaxSendQueueDepth = RAW_HTC_WRITE_BUFFERS_NUM;
++ ar->arBitRate = rateKbps;
++ wake_up(&arEvent);
++}
+
-+ /* connect to the raw streams service, we may be able to get 1 or more
-+ * connections, depending on WHAT is running on the target */
-+ connect.ServiceID = HTC_RAW_STREAMS_SVC;
++void
++ar6000_ratemask_rx(void *devt, A_UINT16 ratemask)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
+
-+ A_MEMZERO(&response,sizeof(response));
++ ar->arRateMask = ratemask;
++ wake_up(&arEvent);
++}
+
-+ /* try to connect to the raw stream, it is okay if this fails with
-+ * status HTC_SERVICE_NO_MORE_EP */
-+ status = HTCConnectService(ar->arHtcTarget,
-+ &connect,
-+ &response);
++void
++ar6000_txPwr_rx(void *devt, A_UINT8 txPwr)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
+
-+ if (A_FAILED(status)) {
-+ if (response.ConnectRespCode == HTC_SERVICE_NO_MORE_EP) {
-+ AR_DEBUG_PRINTF("HTC RAW , No more streams allowed \n");
-+ status = A_OK;
-+ }
-+ break;
-+ }
++ ar->arTxPwr = txPwr;
++ wake_up(&arEvent);
++}
+
-+ /* set endpoint mapping for the RAW HTC streams */
-+ arSetRawStream2EndpointIDMap(ar,StreamID,response.Endpoint);
+
-+ AR_DEBUG_PRINTF("HTC RAW : stream ID: %d, endpoint: %d\n",
-+ StreamID, arRawStream2EndpointID(ar,StreamID));
++void
++ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
+
-+ } while (FALSE);
++ A_MEMCPY(ar->arChannelList, chanList, numChan * sizeof (A_UINT16));
++ ar->arNumChannels = numChan;
+
-+ return status;
++ wake_up(&arEvent);
+}
+
-+int ar6000_htc_raw_open(AR_SOFTC_T *ar)
++A_UINT8
++ar6000_ibss_map_epid(struct sk_buff *skb, struct net_device *dev, A_UINT32 * mapNo)
+{
-+ A_STATUS status;
-+ int streamID, endPt, count2;
-+ raw_htc_buffer *buffer;
-+ HTC_SERVICE_ID servicepriority;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_UINT8 *datap;
++ ATH_MAC_HDR *macHdr;
++ A_UINT32 i, eptMap;
+
-+ A_ASSERT(ar->arHtcTarget != NULL);
++ (*mapNo) = 0;
++ datap = A_NETBUF_DATA(skb);
++ macHdr = (ATH_MAC_HDR *)(datap + sizeof(WMI_DATA_HDR));
++ if (IEEE80211_IS_MULTICAST(macHdr->dstMac)) {
++ return ENDPOINT_2;
++ }
+
-+ /* wait for target */
-+ status = HTCWaitTarget(ar->arHtcTarget);
++ eptMap = -1;
++ for (i = 0; i < ar->arNodeNum; i ++) {
++ if (IEEE80211_ADDR_EQ(macHdr->dstMac, ar->arNodeMap[i].macAddress)) {
++ (*mapNo) = i + 1;
++ ar->arNodeMap[i].txPending ++;
++ return ar->arNodeMap[i].epId;
++ }
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF("HTCWaitTarget failed (%d)\n", status);
-+ return -ENODEV;
++ if ((eptMap == -1) && !ar->arNodeMap[i].txPending) {
++ eptMap = i;
++ }
+ }
+
-+ for (endPt = 0; endPt < ENDPOINT_MAX; endPt++) {
-+ ar->arEp2RawMapping[endPt] = HTC_RAW_STREAM_NOT_MAPPED;
++ if (eptMap == -1) {
++ eptMap = ar->arNodeNum;
++ ar->arNodeNum ++;
++ A_ASSERT(ar->arNodeNum <= MAX_NODE_NUM);
+ }
+
-+ for (streamID = HTC_RAW_STREAM_0; streamID < HTC_RAW_STREAM_NUM_MAX; streamID++) {
-+ /* Initialize the data structures */
-+ init_MUTEX(&ar->raw_htc_read_sem[streamID]);
-+ init_MUTEX(&ar->raw_htc_write_sem[streamID]);
-+ init_waitqueue_head(&ar->raw_htc_read_queue[streamID]);
-+ init_waitqueue_head(&ar->raw_htc_write_queue[streamID]);
++ A_MEMCPY(ar->arNodeMap[eptMap].macAddress, macHdr->dstMac, IEEE80211_ADDR_LEN);
+
-+ /* try to connect to the raw service */
-+ status = ar6000_connect_raw_service(ar,streamID);
++ for (i = ENDPOINT_2; i <= ENDPOINT_5; i ++) {
++ if (!ar->arTxPending[i]) {
++ ar->arNodeMap[eptMap].epId = i;
++ break;
++ }
++ // No free endpoint is available, start redistribution on the inuse endpoints.
++ if (i == ENDPOINT_5) {
++ ar->arNodeMap[eptMap].epId = ar->arNexEpId;
++ ar->arNexEpId ++;
++ if (ar->arNexEpId > ENDPOINT_5) {
++ ar->arNexEpId = ENDPOINT_2;
++ }
++ }
++ }
+
-+ if (A_FAILED(status)) {
++ (*mapNo) = eptMap + 1;
++ ar->arNodeMap[eptMap].txPending ++;
++
++ return ar->arNodeMap[eptMap].epId;
++}
++
++#ifdef DEBUG
++static void ar6000_dump_skb(struct sk_buff *skb)
++{
++ u_char *ch;
++ for (ch = A_NETBUF_DATA(skb);
++ (A_UINT32)ch < ((A_UINT32)A_NETBUF_DATA(skb) +
++ A_NETBUF_LEN(skb)); ch++)
++ {
++ AR_DEBUG_PRINTF("%2.2x ", *ch);
++ }
++ AR_DEBUG_PRINTF("\n");
++}
++#endif
++
++static int
++ar6000_data_tx(struct sk_buff *skb, struct net_device *dev)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_PRI_STREAM_ID streamID = WMI_NOT_MAPPED;
++ A_UINT32 mapNo = 0;
++ int len;
++ struct ar_cookie *cookie;
++ A_BOOL checkAdHocPsMapping = FALSE;
++
++#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,13)
++ skb->list = NULL;
++#endif
++
++ AR_DEBUG2_PRINTF("ar6000_data_tx start - skb=0x%x, data=0x%x, len=0x%x\n",
++ (A_UINT32)skb, (A_UINT32)A_NETBUF_DATA(skb),
++ A_NETBUF_LEN(skb));
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++ /* TCMD doesnt support any data, free the buf and return */
++ if(ar->arTargetMode == AR6000_TCMD_MODE) {
++ A_NETBUF_FREE(skb);
++ return 0;
++ }
++#endif
++ do {
++
++ if (ar->arWmiReady == FALSE && bypasswmi == 0) {
+ break;
+ }
+
-+ if (arRawStream2EndpointID(ar,streamID) == 0) {
++#ifdef BLOCK_TX_PATH_FLAG
++ if (blocktx) {
+ break;
+ }
++#endif /* BLOCK_TX_PATH_FLAG */
+
-+ for (count2 = 0; count2 < RAW_HTC_READ_BUFFERS_NUM; count2 ++) {
-+ /* Initialize the receive buffers */
-+ buffer = ar->raw_htc_write_buffer[streamID][count2];
-+ memset(buffer, 0, sizeof(raw_htc_buffer));
-+ buffer = ar->raw_htc_read_buffer[streamID][count2];
-+ memset(buffer, 0, sizeof(raw_htc_buffer));
++ if (ar->arWmiEnabled) {
++ if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len) {
++ struct sk_buff *newbuf;
++ /*
++ * We really should have gotten enough headroom but sometimes
++ * we still get packets with not enough headroom. Copy the packet.
++ */
++ len = A_NETBUF_LEN(skb);
++ newbuf = A_NETBUF_ALLOC(len);
++ if (newbuf == NULL) {
++ break;
++ }
++ A_NETBUF_PUT(newbuf, len);
++ A_MEMCPY(A_NETBUF_DATA(newbuf), A_NETBUF_DATA(skb), len);
++ A_NETBUF_FREE(skb);
++ skb = newbuf;
++ /* fall through and assemble header */
++ }
+
-+ SET_HTC_PACKET_INFO_RX_REFILL(&buffer->HTCPacket,
-+ buffer,
-+ buffer->data,
-+ AR6000_BUFFER_SIZE,
-+ arRawStream2EndpointID(ar,streamID));
++ if (wmi_dix_2_dot3(ar->arWmi, skb) != A_OK) {
++ AR_DEBUG_PRINTF("ar6000_data_tx - wmi_dix_2_dot3 failed\n");
++ break;
++ }
+
-+ /* Queue buffers to HTC for receive */
-+ if ((status = HTCAddReceivePkt(ar->arHtcTarget, &buffer->HTCPacket)) != A_OK)
-+ {
-+ BMIInit();
-+ return -EIO;
++ if (wmi_data_hdr_add(ar->arWmi, skb, DATA_MSGTYPE) != A_OK) {
++ AR_DEBUG_PRINTF("ar6000_data_tx - wmi_data_hdr_add failed\n");
++ break;
+ }
-+ }
+
-+ for (count2 = 0; count2 < RAW_HTC_WRITE_BUFFERS_NUM; count2 ++) {
-+ /* Initialize the receive buffers */
-+ buffer = ar->raw_htc_write_buffer[streamID][count2];
-+ memset(buffer, 0, sizeof(raw_htc_buffer));
++ if ((ar->arNetworkType == ADHOC_NETWORK) &&
++ ar->arIbssPsEnable && ar->arConnected) {
++ /* flag to check adhoc mapping once we take the lock below: */
++ checkAdHocPsMapping = TRUE;
++
++ } else {
++ /* get the stream mapping */
++ if (ar->arWmmEnabled) {
++ streamID = wmi_get_stream_id(ar->arWmi,
++ wmi_implicit_create_pstream(ar->arWmi, skb, UPLINK_TRAFFIC, UNDEFINED_PRI));
++ } else {
++ streamID = WMI_BEST_EFFORT_PRI;
++ }
++ }
++
++ } else {
++ struct iphdr *ipHdr;
++ /*
++ * the endpoint is directly based on the TOS field in the IP
++ * header **** only for testing ******
++ */
++ ipHdr = A_NETBUF_DATA(skb) + sizeof(ATH_MAC_HDR);
++ /* here we map the TOS field to an endpoint number, this is for
++ * the endpointping test application */
++ streamID = IP_TOS_TO_WMI_PRI(ipHdr->tos);
+ }
+
-+ ar->read_buffer_available[streamID] = FALSE;
-+ ar->write_buffer_available[streamID] = TRUE;
-+ }
++ } while (FALSE);
+
-+ if (A_FAILED(status)) {
-+ return -EIO;
++ /* did we succeed ? */
++ if ((streamID == WMI_NOT_MAPPED) && !checkAdHocPsMapping) {
++ /* cleanup and exit */
++ A_NETBUF_FREE(skb);
++ AR6000_STAT_INC(ar, tx_dropped);
++ AR6000_STAT_INC(ar, tx_aborted_errors);
++ return 0;
+ }
+
-+ AR_DEBUG_PRINTF("HTC RAW, number of streams the target supports: %d \n", streamID);
++ cookie = NULL;
+
-+ servicepriority = HTC_RAW_STREAMS_SVC; /* only 1 */
++ /* take the lock to protect driver data */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ /* set callbacks and priority list */
-+ HTCSetCreditDistribution(ar->arHtcTarget,
-+ ar,
-+ NULL, /* use default */
-+ NULL, /* use default */
-+ &servicepriority,
-+ 1);
++ do {
+
-+ /* Start the HTC component */
-+ if ((status = HTCStart(ar->arHtcTarget)) != A_OK) {
-+ BMIInit();
-+ return -EIO;
-+ }
++ if (checkAdHocPsMapping) {
++ streamID = ar6000_ibss_map_epid(skb, dev, &mapNo);
++ }
+
-+ (ar)->arRawIfInit = TRUE;
++ A_ASSERT(streamID != WMI_NOT_MAPPED);
+
-+ return 0;
-+}
++ /* validate that the endpoint is connected */
++ if (arWMIStream2EndpointID(ar,streamID) == 0) {
++ AR_DEBUG_PRINTF("Stream %d is NOT mapped!\n",streamID);
++ break;
++ }
++ /* allocate resource for this packet */
++ cookie = ar6000_alloc_cookie(ar);
+
-+int ar6000_htc_raw_close(AR_SOFTC_T *ar)
-+{
-+ A_PRINTF("ar6000_htc_raw_close called \n");
-+ HTCStop(ar->arHtcTarget);
++ if (cookie != NULL) {
++ /* update counts while the lock is held */
++ ar->arTxPending[streamID]++;
++ ar->arTotalTxDataPending++;
++ }
+
-+ /* reset the device */
-+ ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
-+ /* Initialize the BMI component */
-+ BMIInit();
++ } while (FALSE);
+
-+ return 0;
-+}
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+raw_htc_buffer *
-+get_filled_buffer(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID)
-+{
-+ int count;
-+ raw_htc_buffer *busy;
++ if (cookie != NULL) {
++ cookie->arc_bp[0] = (A_UINT32)skb;
++ cookie->arc_bp[1] = mapNo;
++ SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
++ cookie,
++ A_NETBUF_DATA(skb),
++ A_NETBUF_LEN(skb),
++ arWMIStream2EndpointID(ar,streamID),
++ AR6K_DATA_PKT_TAG);
+
-+ /* Check for data */
-+ for (count = 0; count < RAW_HTC_READ_BUFFERS_NUM; count ++) {
-+ busy = ar->raw_htc_read_buffer[StreamID][count];
-+ if (busy->length) {
-+ break;
++#ifdef DEBUG
++ if (debugdriver >= 3) {
++ ar6000_dump_skb(skb);
+ }
-+ }
-+ if (busy->length) {
-+ ar->read_buffer_available[StreamID] = TRUE;
++#endif
++ /* HTC interface is asynchronous, if this fails, cleanup will happen in
++ * the ar6000_tx_complete callback */
++ HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+ } else {
-+ ar->read_buffer_available[StreamID] = FALSE;
++ /* no packet to send, cleanup */
++ A_NETBUF_FREE(skb);
++ AR6000_STAT_INC(ar, tx_dropped);
++ AR6000_STAT_INC(ar, tx_aborted_errors);
+ }
+
-+ return busy;
++ return 0;
+}
+
-+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
-+ char __user *buffer, size_t length)
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++static void
++tvsub(register struct timeval *out, register struct timeval *in)
+{
-+ int readPtr;
-+ raw_htc_buffer *busy;
-+
-+ if (arRawStream2EndpointID(ar,StreamID) == 0) {
-+ AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
-+ return -EFAULT;
++ if((out->tv_usec -= in->tv_usec) < 0) {
++ out->tv_sec--;
++ out->tv_usec += 1000000;
+ }
++ out->tv_sec -= in->tv_sec;
++}
+
-+ if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
-+ return -ERESTARTSYS;
-+ }
++void
++applyAPTCHeuristics(AR_SOFTC_T *ar)
++{
++ A_UINT32 duration;
++ A_UINT32 numbytes;
++ A_UINT32 throughput;
++ struct timeval ts;
++ A_STATUS status;
+
-+ busy = get_filled_buffer(ar,StreamID);
-+ while (!ar->read_buffer_available[StreamID]) {
-+ up(&ar->raw_htc_read_sem[StreamID]);
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ /* Wait for the data */
-+ AR_DEBUG2_PRINTF("Sleeping StreamID(%d) read process\n", StreamID);
-+ if (wait_event_interruptible(ar->raw_htc_read_queue[StreamID],
-+ ar->read_buffer_available[StreamID]))
-+ {
-+ return -EINTR;
-+ }
-+ if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
-+ return -ERESTARTSYS;
++ if ((enableAPTCHeuristics) && (!aptcTR.timerScheduled)) {
++ do_gettimeofday(&ts);
++ tvsub(&ts, &aptcTR.samplingTS);
++ duration = ts.tv_sec * 1000 + ts.tv_usec / 1000; /* ms */
++ numbytes = aptcTR.bytesTransmitted + aptcTR.bytesReceived;
++
++ if (duration > APTC_TRAFFIC_SAMPLING_INTERVAL) {
++ /* Initialize the time stamp and byte count */
++ aptcTR.bytesTransmitted = aptcTR.bytesReceived = 0;
++ do_gettimeofday(&aptcTR.samplingTS);
++
++ /* Calculate and decide based on throughput thresholds */
++ throughput = ((numbytes * 8) / duration);
++ if (throughput > APTC_UPPER_THROUGHPUT_THRESHOLD) {
++ /* Disable Sleep and schedule a timer */
++ A_ASSERT(ar->arWmiReady == TRUE);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ status = wmi_powermode_cmd(ar->arWmi, MAX_PERF_POWER);
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ A_TIMEOUT_MS(&aptcTimer, APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
++ aptcTR.timerScheduled = TRUE;
++ }
+ }
-+ busy = get_filled_buffer(ar,StreamID);
+ }
+
-+ /* Read the data */
-+ readPtr = busy->currPtr;
-+ if (length > busy->length - HTC_HEADER_LEN) {
-+ length = busy->length - HTC_HEADER_LEN;
-+ }
-+ if (copy_to_user(buffer, &busy->data[readPtr], length)) {
-+ up(&ar->raw_htc_read_sem[StreamID]);
-+ return -EFAULT;
-+ }
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++}
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+ busy->currPtr += length;
++static void
++ar6000_tx_queue_full(void *Context, HTC_ENDPOINT_ID Endpoint)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *) Context;
+
-+ //AR_DEBUG_PRINTF("raw read ioctl: currPTR : 0x%X 0x%X \n", busy->currPtr,busy->length);
++ if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
++ if (!bypasswmi) {
++ /* under normal WMI if this is getting full, then something is running rampant
++ * the host should not be exhausting the WMI queue with too many commands
++ * the only exception to this is during testing using endpointping */
+
-+ if (busy->currPtr == busy->length)
-+ {
-+ busy->currPtr = 0;
-+ busy->length = 0;
-+ HTC_PACKET_RESET_RX(&busy->HTCPacket);
-+ //AR_DEBUG_PRINTF("raw read ioctl: ep for packet:%d \n", busy->HTCPacket.Endpoint);
-+ HTCAddReceivePkt(ar->arHtcTarget, &busy->HTCPacket);
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ /* set flag to handle subsequent messages */
++ ar->arWMIControlEpFull = TRUE;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ AR_DEBUG_PRINTF("WMI Control Endpoint is FULL!!! \n");
++ }
++ } else {
++ /* one of the data endpoints queues is getting full..need to stop network stack
++ * the queue will resume after credits received */
++ netif_stop_queue(ar->arNetDev);
+ }
-+ ar->read_buffer_available[StreamID] = FALSE;
-+ up(&ar->raw_htc_read_sem[StreamID]);
-+
-+ return length;
+}
+
-+static raw_htc_buffer *
-+get_free_buffer(AR_SOFTC_T *ar, HTC_ENDPOINT_ID StreamID)
++static void
++ar6000_tx_queue_avail(void *Context, HTC_ENDPOINT_ID Endpoint)
+{
-+ int count;
-+ raw_htc_buffer *free;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
+
-+ free = NULL;
-+ for (count = 0; count < RAW_HTC_WRITE_BUFFERS_NUM; count ++) {
-+ free = ar->raw_htc_write_buffer[StreamID][count];
-+ if (free->length == 0) {
-+ break;
-+ }
-+ }
-+ if (!free->length) {
-+ ar->write_buffer_available[StreamID] = TRUE;
++ if (Endpoint == arWMIStream2EndpointID(ar,WMI_CONTROL_PRI)) {
++ /* FIXME: what do for it? */
+ } else {
-+ ar->write_buffer_available[StreamID] = FALSE;
++ /* Wake up interface, rescheduling prevented. */
++ if (ar->arConnected == TRUE || bypasswmi)
++ netif_wake_queue(ar->arNetDev);
+ }
-+
-+ return free;
+}
+
-+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
-+ char __user *buffer, size_t length)
++static void
++ar6000_tx_complete(void *Context, HTC_PACKET *pPacket)
+{
-+ int writePtr;
-+ raw_htc_buffer *free;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
++ void *cookie = (void *)pPacket->pPktContext;
++ struct sk_buff *skb = NULL;
++ A_UINT32 mapNo = 0;
++ A_STATUS status;
++ struct ar_cookie * ar_cookie;
++ WMI_PRI_STREAM_ID streamID;
++ A_BOOL wakeEvent = FALSE;
+
-+ if (arRawStream2EndpointID(ar,StreamID) == 0) {
-+ AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
-+ return -EFAULT;
-+ }
++ status = pPacket->Status;
++ ar_cookie = (struct ar_cookie *)cookie;
++ skb = (struct sk_buff *)ar_cookie->arc_bp[0];
++ streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
++ mapNo = ar_cookie->arc_bp[1];
+
-+ if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
-+ return -ERESTARTSYS;
++ A_ASSERT(skb);
++ A_ASSERT(pPacket->pBuffer == A_NETBUF_DATA(skb));
++
++ if (A_SUCCESS(status)) {
++ A_ASSERT(pPacket->ActualLength == A_NETBUF_LEN(skb));
+ }
+
-+ /* Search for a free buffer */
-+ free = get_free_buffer(ar,StreamID);
++ AR_DEBUG2_PRINTF("ar6000_tx_complete skb=0x%x data=0x%x len=0x%x sid=%d ",
++ (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
++ pPacket->ActualLength,
++ streamID);
+
-+ /* Check if there is space to write else wait */
-+ while (!ar->write_buffer_available[StreamID]) {
-+ up(&ar->raw_htc_write_sem[StreamID]);
++ /* lock the driver as we update internal state */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ /* Wait for buffer to become free */
-+ AR_DEBUG2_PRINTF("Sleeping StreamID(%d) write process\n", StreamID);
-+ if (wait_event_interruptible(ar->raw_htc_write_queue[StreamID],
-+ ar->write_buffer_available[StreamID]))
-+ {
-+ return -EINTR;
++ ar->arTxPending[streamID]--;
++
++ if ((streamID != WMI_CONTROL_PRI) || bypasswmi) {
++ ar->arTotalTxDataPending--;
++ }
++
++ if (streamID == WMI_CONTROL_PRI)
++ {
++ if (ar->arWMIControlEpFull) {
++ /* since this packet completed, the WMI EP is no longer full */
++ ar->arWMIControlEpFull = FALSE;
+ }
-+ if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
-+ return -ERESTARTSYS;
++
++ if (ar->arTxPending[streamID] == 0) {
++ wakeEvent = TRUE;
+ }
-+ free = get_free_buffer(ar,StreamID);
+ }
+
-+ /* Send the data */
-+ writePtr = HTC_HEADER_LEN;
-+ if (length > (AR6000_BUFFER_SIZE - HTC_HEADER_LEN)) {
-+ length = AR6000_BUFFER_SIZE - HTC_HEADER_LEN;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF("%s() -TX ERROR, status: 0x%x\n", __func__,
++ status);
++ AR6000_STAT_INC(ar, tx_errors);
++ } else {
++ AR_DEBUG2_PRINTF("OK\n");
++ AR6000_STAT_INC(ar, tx_packets);
++ ar->arNetStats.tx_bytes += A_NETBUF_LEN(skb);
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++ aptcTR.bytesTransmitted += a_netbuf_to_len(skb);
++ applyAPTCHeuristics(ar);
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+ }
+
-+ if (copy_from_user(&free->data[writePtr], buffer, length)) {
-+ up(&ar->raw_htc_read_sem[StreamID]);
-+ return -EFAULT;
++ // TODO this needs to be looked at
++ if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable
++ && (streamID != WMI_CONTROL_PRI) && mapNo)
++ {
++ mapNo --;
++ ar->arNodeMap[mapNo].txPending --;
++
++ if (!ar->arNodeMap[mapNo].txPending && (mapNo == (ar->arNodeNum - 1))) {
++ A_UINT32 i;
++ for (i = ar->arNodeNum; i > 0; i --) {
++ if (!ar->arNodeMap[i - 1].txPending) {
++ A_MEMZERO(&ar->arNodeMap[i - 1], sizeof(struct ar_node_mapping));
++ ar->arNodeNum --;
++ } else {
++ break;
++ }
++ }
++ }
+ }
+
-+ free->length = length;
++ /* Freeing a cookie should not be contingent on either of */
++ /* these flags, just if we have a cookie or not. */
++ /* Can we even get here without a cookie? Fix later. */
++ if (ar->arWmiReady == TRUE || (bypasswmi))
++ {
++ ar6000_free_cookie(ar, cookie);
++ }
+
-+ SET_HTC_PACKET_INFO_TX(&free->HTCPacket,
-+ free,
-+ &free->data[writePtr],
-+ length,
-+ arRawStream2EndpointID(ar,StreamID),
-+ AR6K_DATA_PKT_TAG);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+ HTCSendPkt(ar->arHtcTarget,&free->HTCPacket);
++ /* lock is released, we can freely call other kernel APIs */
+
-+ ar->write_buffer_available[StreamID] = FALSE;
-+ up(&ar->raw_htc_write_sem[StreamID]);
++ /* this indirectly frees the HTC_PACKET */
++ A_NETBUF_FREE(skb);
+
-+ return length;
++ if (wakeEvent) {
++ wake_up(&arEvent);
++ }
+}
-+#endif /* HTC_RAW_INTERFACE */
-diff --git a/drivers/ar6000/ar6000/ar6xapi_linux.h b/drivers/ar6000/ar6000/ar6xapi_linux.h
-new file mode 100644
-index 0000000..b8e6e09
---- /dev/null
-+++ b/drivers/ar6000/ar6000/ar6xapi_linux.h
-@@ -0,0 +1,128 @@
-+#ifndef _AR6XAPI_LINUX_H
-+#define _AR6XAPI_LINUX_H
++
+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * Receive event handler. This is called by HTC when a packet is received
+ */
++int pktcount;
++static void
++ar6000_rx(void *Context, HTC_PACKET *pPacket)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
++ struct sk_buff *skb = (struct sk_buff *)pPacket->pPktContext;
++ int minHdrLen;
++ A_STATUS status = pPacket->Status;
++ WMI_PRI_STREAM_ID streamID = arEndpoint2WMIStreamID(ar,pPacket->Endpoint);
++ HTC_ENDPOINT_ID ept = pPacket->Endpoint;
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++ A_ASSERT((status != A_OK) || (pPacket->pBuffer == (A_NETBUF_DATA(skb) + HTC_HEADER_LEN)));
+
-+struct ar6_softc;
++ AR_DEBUG2_PRINTF("ar6000_rx ar=0x%x sid=%d, skb=0x%x, data=0x%x, len=0x%x ",
++ (A_UINT32)ar, streamID, (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
++ pPacket->ActualLength);
++ if (status != A_OK) {
++ AR_DEBUG2_PRINTF("ERR\n");
++ } else {
++ AR_DEBUG2_PRINTF("OK\n");
++ }
+
-+void ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap);
-+A_UINT8 ar6000_iptos_to_userPriority(A_UINT8 *pkt);
-+A_STATUS ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID);
-+void ar6000_connect_event(struct ar6_softc *ar, A_UINT16 channel,
-+ A_UINT8 *bssid, A_UINT16 listenInterval,
-+ A_UINT16 beaconInterval, NETWORK_TYPE networkType,
-+ A_UINT8 beaconIeLen, A_UINT8 assocReqLen,
-+ A_UINT8 assocRespLen,A_UINT8 *assocInfo);
-+void ar6000_disconnect_event(struct ar6_softc *ar, A_UINT8 reason,
-+ A_UINT8 *bssid, A_UINT8 assocRespLen,
-+ A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus);
-+void ar6000_tkip_micerr_event(struct ar6_softc *ar, A_UINT8 keyid,
-+ A_BOOL ismcast);
-+void ar6000_bitrate_rx(void *devt, A_INT32 rateKbps);
-+void ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList);
-+void ar6000_regDomain_event(struct ar6_softc *ar, A_UINT32 regCode);
-+void ar6000_txPwr_rx(void *devt, A_UINT8 txPwr);
-+void ar6000_keepalive_rx(void *devt, A_UINT8 configured);
-+void ar6000_neighborReport_event(struct ar6_softc *ar, int numAps,
-+ WMI_NEIGHBOR_INFO *info);
-+void ar6000_set_numdataendpts(struct ar6_softc *ar, A_UINT32 num);
-+void ar6000_scanComplete_event(struct ar6_softc *ar, A_STATUS status);
-+void ar6000_targetStats_event(struct ar6_softc *ar, WMI_TARGET_STATS *pStats);
-+void ar6000_rssiThreshold_event(struct ar6_softc *ar,
-+ WMI_RSSI_THRESHOLD_VAL newThreshold,
-+ A_INT16 rssi);
-+void ar6000_reportError_event(struct ar6_softc *, WMI_TARGET_ERROR_VAL errorVal);
-+void ar6000_cac_event(struct ar6_softc *ar, A_UINT8 ac, A_UINT8 cac_indication,
-+ A_UINT8 statusCode, A_UINT8 *tspecSuggestion);
-+void ar6000_hbChallengeResp_event(struct ar6_softc *, A_UINT32 cookie, A_UINT32 source);
-+void
-+ar6000_roam_tbl_event(struct ar6_softc *ar, WMI_TARGET_ROAM_TBL *pTbl);
++ /* take lock to protect buffer counts
++ * and adaptive power throughput state */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+void
-+ar6000_roam_data_event(struct ar6_softc *ar, WMI_TARGET_ROAM_DATA *p);
++ ar->arRxBuffers[streamID]--;
+
-+void
-+ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters,
-+ WMI_GET_WOW_LIST_REPLY *wow_reply);
++ if (A_SUCCESS(status)) {
++ AR6000_STAT_INC(ar, rx_packets);
++ ar->arNetStats.rx_bytes += pPacket->ActualLength;
++#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
++ aptcTR.bytesReceived += a_netbuf_to_len(skb);
++ applyAPTCHeuristics(ar);
++#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
-+void ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID,
-+ WMI_PMKID *pmkidList);
++ A_NETBUF_PUT(skb, pPacket->ActualLength + HTC_HEADER_LEN);
++ A_NETBUF_PULL(skb, HTC_HEADER_LEN);
+
-+void ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values);
-+void ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value);
-+void ar6000_gpio_ack_rx(void);
++#ifdef DEBUG
++ if (debugdriver >= 2) {
++ ar6000_dump_skb(skb);
++ }
++#endif /* DEBUG */
++ }
+
-+void ar6000_dbglog_init_done(struct ar6_softc *ar);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+#ifdef SEND_EVENT_TO_APP
-+void ar6000_send_event_to_app(struct ar6_softc *ar, A_UINT16 eventId, A_UINT8 *datap, int len);
-+#endif
++ if (status != A_OK) {
++ AR6000_STAT_INC(ar, rx_errors);
++ A_NETBUF_FREE(skb);
++ } else if (ar->arWmiEnabled == TRUE) {
++ if (streamID == WMI_CONTROL_PRI) {
++ /*
++ * this is a wmi control msg
++ */
++ wmi_control_rx(ar->arWmi, skb);
++ } else {
++ WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
++ if (WMI_DATA_HDR_IS_MSG_TYPE(dhdr, CNTL_MSGTYPE)) {
++ /*
++ * this is a wmi control msg
++ */
++ /* strip off WMI hdr */
++ wmi_data_hdr_remove(ar->arWmi, skb);
++ wmi_control_rx(ar->arWmi, skb);
++ } else {
++ /*
++ * this is a wmi data packet
++ */
++ minHdrLen = sizeof (WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) +
++ sizeof(ATH_LLC_SNAP_HDR);
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+void ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len);
++ if ((pPacket->ActualLength < minHdrLen) ||
++ (pPacket->ActualLength > AR6000_BUFFER_SIZE))
++ {
++ /*
++ * packet is too short or too long
++ */
++ AR_DEBUG_PRINTF("TOO SHORT or TOO LONG\n");
++ AR6000_STAT_INC(ar, rx_errors);
++ AR6000_STAT_INC(ar, rx_length_errors);
++ A_NETBUF_FREE(skb);
++ } else {
++ if (ar->arWmmEnabled) {
++ wmi_implicit_create_pstream(ar->arWmi, skb,
++ DNLINK_TRAFFIC, UNDEFINED_PRI);
++ }
++#if 0
++ /* Access RSSI values here */
++ AR_DEBUG_PRINTF("RSSI %d\n",
++ ((WMI_DATA_HDR *) A_NETBUF_DATA(skb))->rssi);
+#endif
++ wmi_data_hdr_remove(ar->arWmi, skb);
++ wmi_dot3_2_dix(ar->arWmi, skb);
+
-+void ar6000_tx_retry_err_event(void *devt);
-+
-+void ar6000_snrThresholdEvent_rx(void *devt,
-+ WMI_SNR_THRESHOLD_VAL newThreshold,
-+ A_UINT8 snr);
-+
-+void ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL range, A_UINT8 lqVal);
-+
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
++ /*
++ * extra push and memcpy, for eth_type_trans() of 2.4 kernel
++ * will pull out hard_header_len bytes of the skb.
++ */
++ A_NETBUF_PUSH(skb, sizeof(WMI_DATA_HDR) + sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN);
++ A_MEMCPY(A_NETBUF_DATA(skb), A_NETBUF_DATA(skb) + sizeof(WMI_DATA_HDR) +
++ sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN, sizeof(ATH_MAC_HDR));
++#endif
++ if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
++ {
++ skb->dev = ar->arNetDev;
++ skb->protocol = eth_type_trans(skb, ar->arNetDev);
++ netif_rx(skb);
++ }
++ else
++ {
++ A_NETBUF_FREE(skb);
++ }
++ }
++ }
++ }
++ } else {
++ if ((ar->arNetDev->flags & IFF_UP) == IFF_UP)
++ {
++ skb->dev = ar->arNetDev;
++ skb->protocol = eth_type_trans(skb, ar->arNetDev);
++ netif_rx(skb);
++ }
++ else
++ {
++ A_NETBUF_FREE(skb);
++ }
++ }
+
-+void ar6000_ratemask_rx(void *devt, A_UINT16 ratemask);
++ if (status != A_ECANCELED) {
++ /*
++ * HTC provides A_ECANCELED status when it doesn't want to be refilled
++ * (probably due to a shutdown)
++ */
++ ar6000_rx_refill(Context, ept);
++ }
+
-+A_STATUS ar6000_get_driver_cfg(struct net_device *dev,
-+ A_UINT16 cfgParam,
-+ void *result);
-+void ar6000_bssInfo_event_rx(struct ar6_softc *ar, A_UINT8 *data, int len);
+
-+void ar6000_dbglog_event(struct ar6_softc *ar, A_UINT32 dropped,
-+ A_INT8 *buffer, A_UINT32 length);
++}
+
-+int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
++static void
++ar6000_rx_refill(void *Context, HTC_ENDPOINT_ID Endpoint)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
++ void *osBuf;
++ int RxBuffers;
++ int buffersToRefill;
++ HTC_PACKET *pPacket;
++ WMI_PRI_STREAM_ID streamId = arEndpoint2WMIStreamID(ar,Endpoint);
+
-+void ar6000_indicate_tx_activity(void *devt, A_UINT8 trafficClass, A_BOOL Active);
++ buffersToRefill = (int)AR6000_MAX_RX_BUFFERS -
++ (int)ar->arRxBuffers[streamId];
+
-+void ar6000_dset_open_req(void *devt,
-+ A_UINT32 id,
-+ A_UINT32 targ_handle,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg);
-+void ar6000_dset_close(void *devt, A_UINT32 access_cookie);
-+void ar6000_dset_data_req(void *devt,
-+ A_UINT32 access_cookie,
-+ A_UINT32 offset,
-+ A_UINT32 length,
-+ A_UINT32 targ_buf,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg);
++ if (buffersToRefill <= 0) {
++ /* fast return, nothing to fill */
++ return;
++ }
+
++ AR_DEBUG2_PRINTF("ar6000_rx_refill: providing htc with %d buffers at eid=%d\n",
++ buffersToRefill, Endpoint);
+
++ for (RxBuffers = 0; RxBuffers < buffersToRefill; RxBuffers++) {
++ osBuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE);
++ if (NULL == osBuf) {
++ break;
++ }
++ /* the HTC packet wrapper is at the head of the reserved area
++ * in the skb */
++ pPacket = (HTC_PACKET *)(A_NETBUF_HEAD(osBuf));
++ /* set re-fill info */
++ SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_BUFFER_SIZE,Endpoint);
++ /* add this packet */
++ HTCAddReceivePkt(ar->arHtcTarget, pPacket);
++ }
+
-+#ifdef __cplusplus
++ /* update count */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar->arRxBuffers[streamId] += RxBuffers;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+}
-+#endif
+
-+#endif
-diff --git a/drivers/ar6000/ar6000/athdrv_linux.h b/drivers/ar6000/ar6000/athdrv_linux.h
-new file mode 100644
-index 0000000..9c3e449
---- /dev/null
-+++ b/drivers/ar6000/ar6000/athdrv_linux.h
-@@ -0,0 +1,993 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++static struct net_device_stats *
++ar6000_get_stats(struct net_device *dev)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ return &ar->arNetStats;
++}
+
-+#ifndef _ATHDRV_LINUX_H
-+#define _ATHDRV_LINUX_H
++static struct iw_statistics *
++ar6000_get_iwstats(struct net_device * dev)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ TARGET_STATS *pStats = &ar->arTargetStats;
++ struct iw_statistics * pIwStats = &ar->arIwStats;
+
-+#ifdef __cplusplus
-+extern "C" {
++ if ((ar->arWmiReady == FALSE)
++ /*
++ * The in_atomic function is used to determine if the scheduling is
++ * allowed in the current context or not. This was introduced in 2.6
++ * From what I have read on the differences between 2.4 and 2.6, the
++ * 2.4 kernel did not support preemption and so this check might not
++ * be required for 2.4 kernels.
++ */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
++ || (in_atomic())
+#endif
++ )
++ {
++ pIwStats->status = 0;
++ pIwStats->qual.qual = 0;
++ pIwStats->qual.level =0;
++ pIwStats->qual.noise = 0;
++ pIwStats->discard.code =0;
++ pIwStats->discard.retries=0;
++ pIwStats->miss.beacon =0;
++ return pIwStats;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ pIwStats->status = 0;
++ return pIwStats;
++ }
+
+
-+/*
-+ * There are two types of ioctl's here: Standard ioctls and
-+ * eXtended ioctls. All extended ioctls (XIOCTL) are multiplexed
-+ * off of the single ioctl command, AR6000_IOCTL_EXTENDED. The
-+ * arguments for every XIOCTL starts with a 32-bit command word
-+ * that is used to select which extended ioctl is in use. After
-+ * the command word are command-specific arguments.
-+ */
++ ar->statsUpdatePending = TRUE;
+
-+/* Linux standard Wireless Extensions, private ioctl interfaces */
-+#define IEEE80211_IOCTL_SETPARAM (SIOCIWFIRSTPRIV+0)
-+#define IEEE80211_IOCTL_GETPARAM (SIOCIWFIRSTPRIV+1)
-+#define IEEE80211_IOCTL_SETKEY (SIOCIWFIRSTPRIV+2)
-+#define IEEE80211_IOCTL_SETWMMPARAMS (SIOCIWFIRSTPRIV+3)
-+#define IEEE80211_IOCTL_DELKEY (SIOCIWFIRSTPRIV+4)
-+#define IEEE80211_IOCTL_GETWMMPARAMS (SIOCIWFIRSTPRIV+5)
-+#define IEEE80211_IOCTL_SETOPTIE (SIOCIWFIRSTPRIV+6)
-+#define IEEE80211_IOCTL_SETMLME (SIOCIWFIRSTPRIV+7)
-+//#define IEEE80211_IOCTL_GETOPTIE (SIOCIWFIRSTPRIV+7)
-+#define IEEE80211_IOCTL_ADDPMKID (SIOCIWFIRSTPRIV+8)
-+//#define IEEE80211_IOCTL_SETAUTHALG (SIOCIWFIRSTPRIV+10)
-+#define IEEE80211_IOCTL_LASTONE (SIOCIWFIRSTPRIV+9)
++ if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ pIwStats->status = 0;
++ return pIwStats;
++ }
+
++ wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
+
++ if (signal_pending(current)) {
++ AR_DEBUG_PRINTF("ar6000 : WMI get stats timeout \n");
++ up(&ar->arSem);
++ pIwStats->status = 0;
++ return pIwStats;
++ }
++ pIwStats->status = 1 ;
++ pIwStats->qual.qual = pStats->cs_aveBeacon_rssi;
++ pIwStats->qual.level =pStats->cs_aveBeacon_rssi + 161; /* noise is -95 dBm */
++ pIwStats->qual.noise = pStats->noise_floor_calibation;
++ pIwStats->discard.code = pStats->rx_decrypt_err;
++ pIwStats->discard.retries = pStats->tx_retry_cnt;
++ pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
++ up(&ar->arSem);
++ return pIwStats;
++}
+
-+/* ====WMI Ioctls==== */
-+/*
-+ *
-+ * Many ioctls simply provide WMI services to application code:
-+ * an application makes such an ioctl call with a set of arguments
-+ * that are packaged into the corresponding WMI message, and sent
-+ * to the Target.
-+ */
++void
++ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
++ struct net_device *dev = ar->arNetDev;
+
-+#define AR6000_IOCTL_WMI_GETREV (SIOCIWFIRSTPRIV+10)
-+/*
-+ * arguments:
-+ * ar6000_version *revision
-+ */
++ ar->arWmiReady = TRUE;
++ wake_up(&arEvent);
++ A_MEMCPY(dev->dev_addr, datap, AR6000_ETH_ADDR_LEN);
++ AR_DEBUG_PRINTF("mac address = %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
++ dev->dev_addr[0], dev->dev_addr[1],
++ dev->dev_addr[2], dev->dev_addr[3],
++ dev->dev_addr[4], dev->dev_addr[5]);
+
-+#define AR6000_IOCTL_WMI_SETPWR (SIOCIWFIRSTPRIV+11)
-+/*
-+ * arguments:
-+ * WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
-+ * uses: WMI_SET_POWER_MODE_CMDID
-+ */
++ ar->arPhyCapability = phyCap;
++}
+
-+#define AR6000_IOCTL_WMI_SETSCAN (SIOCIWFIRSTPRIV+12)
-+/*
-+ * arguments:
-+ * WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
-+ * uses: WMI_SET_SCAN_PARAMS_CMDID
-+ */
++A_UINT8
++ar6000_iptos_to_userPriority(A_UINT8 *pkt)
++{
++ struct iphdr *ipHdr = (struct iphdr *)pkt;
++ A_UINT8 userPriority;
+
-+#define AR6000_IOCTL_WMI_SETLISTENINT (SIOCIWFIRSTPRIV+13)
-+/*
-+ * arguments:
-+ * UINT32 listenInterval
-+ * uses: WMI_SET_LISTEN_INT_CMDID
-+ */
++ /*
++ * IP Tos format :
++ * (Refer Pg 57 WMM-test-plan-v1.2)
++ * IP-TOS - 8bits
++ * : DSCP(6-bits) ECN(2-bits)
++ * : DSCP - P2 P1 P0 X X X
++ * where (P2 P1 P0) form 802.1D
++ */
++ userPriority = ipHdr->tos >> 5;
++ return (userPriority & 0x7);
++}
+
-+#define AR6000_IOCTL_WMI_SETBSSFILTER (SIOCIWFIRSTPRIV+14)
-+/*
-+ * arguments:
-+ * WMI_BSS_FILTER filter (see include/wmi.h)
-+ * uses: WMI_SET_BSS_FILTER_CMDID
-+ */
++void
++ar6000_connect_event(AR_SOFTC_T *ar, A_UINT16 channel, A_UINT8 *bssid,
++ A_UINT16 listenInterval, A_UINT16 beaconInterval,
++ NETWORK_TYPE networkType, A_UINT8 beaconIeLen,
++ A_UINT8 assocReqLen, A_UINT8 assocRespLen,
++ A_UINT8 *assocInfo)
++{
++ union iwreq_data wrqu;
++ int i, beacon_ie_pos, assoc_resp_ie_pos, assoc_req_ie_pos;
++ static const char *tag1 = "ASSOCINFO(ReqIEs=";
++ static const char *tag2 = "ASSOCRESPIE=";
++ static const char *beaconIetag = "BEACONIE=";
++ char buf[WMI_CONTROL_MSG_MAX_LEN * 2 + sizeof(tag1)];
++ char *pos;
++ A_UINT8 key_op_ctrl;
+
-+#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS (SIOCIWFIRSTPRIV+16)
-+/*
-+ * arguments:
-+ * WMI_CHANNEL_PARAMS_CMD chParams
-+ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
-+ */
++ A_MEMCPY(ar->arBssid, bssid, sizeof(ar->arBssid));
++ ar->arBssChannel = channel;
+
-+#define AR6000_IOCTL_WMI_SET_PROBEDSSID (SIOCIWFIRSTPRIV+17)
-+/*
-+ * arguments:
-+ * WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
-+ * uses: WMI_SETPROBED_SSID_CMDID
-+ */
++ A_PRINTF("AR6000 connected event on freq %d ", channel);
++ A_PRINTF("with bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
++ " listenInterval=%d, beaconInterval = %d, beaconIeLen = %d assocReqLen=%d"
++ " assocRespLen =%d\n",
++ bssid[0], bssid[1], bssid[2],
++ bssid[3], bssid[4], bssid[5],
++ listenInterval, beaconInterval,
++ beaconIeLen, assocReqLen, assocRespLen);
++ if (networkType & ADHOC_NETWORK) {
++ if (networkType & ADHOC_CREATOR) {
++ A_PRINTF("Network: Adhoc (Creator)\n");
++ } else {
++ A_PRINTF("Network: Adhoc (Joiner)\n");
++ }
++ } else {
++ A_PRINTF("Network: Infrastructure\n");
++ }
+
-+#define AR6000_IOCTL_WMI_SET_PMPARAMS (SIOCIWFIRSTPRIV+18)
-+/*
-+ * arguments:
-+ * WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
-+ * uses: WMI_SET_POWER_PARAMS_CMDID
-+ */
++ if (beaconIeLen && (sizeof(buf) > (9 + beaconIeLen * 2))) {
++ AR_DEBUG_PRINTF("\nBeaconIEs= ");
+
-+#define AR6000_IOCTL_WMI_SET_BADAP (SIOCIWFIRSTPRIV+19)
-+/*
-+ * arguments:
-+ * WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
-+ * uses: WMI_ADD_BAD_AP_CMDID
-+ */
++ beacon_ie_pos = 0;
++ A_MEMZERO(buf, sizeof(buf));
++ sprintf(buf, "%s", beaconIetag);
++ pos = buf + 9;
++ for (i = beacon_ie_pos; i < beacon_ie_pos + beaconIeLen; i++) {
++ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
++ sprintf(pos, "%2.2x", assocInfo[i]);
++ pos += 2;
++ }
++ AR_DEBUG_PRINTF("\n");
+
-+#define AR6000_IOCTL_WMI_GET_QOS_QUEUE (SIOCIWFIRSTPRIV+20)
-+/*
-+ * arguments:
-+ * ar6000_queuereq queueRequest (see below)
-+ */
-+
-+#define AR6000_IOCTL_WMI_CREATE_QOS (SIOCIWFIRSTPRIV+21)
-+/*
-+ * arguments:
-+ * WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
-+ * uses: WMI_CREATE_PSTREAM_CMDID
-+ */
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ wrqu.data.length = strlen(buf);
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++ }
+
-+#define AR6000_IOCTL_WMI_DELETE_QOS (SIOCIWFIRSTPRIV+22)
-+/*
-+ * arguments:
-+ * WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
-+ * uses: WMI_DELETE_PSTREAM_CMDID
-+ */
++ if (assocRespLen && (sizeof(buf) > (12 + (assocRespLen * 2))))
++ {
++ assoc_resp_ie_pos = beaconIeLen + assocReqLen +
++ sizeof(A_UINT16) + /* capinfo*/
++ sizeof(A_UINT16) + /* status Code */
++ sizeof(A_UINT16) ; /* associd */
++ A_MEMZERO(buf, sizeof(buf));
++ sprintf(buf, "%s", tag2);
++ pos = buf + 12;
++ AR_DEBUG_PRINTF("\nAssocRespIEs= ");
++ /*
++ * The Association Response Frame w.o. the WLAN header is delivered to
++ * the host, so skip over to the IEs
++ */
++ for (i = assoc_resp_ie_pos; i < assoc_resp_ie_pos + assocRespLen - 6; i++)
++ {
++ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
++ sprintf(pos, "%2.2x", assocInfo[i]);
++ pos += 2;
++ }
++ AR_DEBUG_PRINTF("\n");
+
-+#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD (SIOCIWFIRSTPRIV+23)
-+/*
-+ * arguments:
-+ * WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
-+ */
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ wrqu.data.length = strlen(buf);
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++ }
+
-+#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
-+/*
-+ * arguments:
-+ * WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
-+ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
-+ */
++ if (assocReqLen && (sizeof(buf) > (17 + (assocReqLen * 2)))) {
++ /*
++ * assoc Request includes capability and listen interval. Skip these.
++ */
++ assoc_req_ie_pos = beaconIeLen +
++ sizeof(A_UINT16) + /* capinfo*/
++ sizeof(A_UINT16); /* listen interval */
+
-+#define AR6000_IOCTL_WMI_GET_TARGET_STATS (SIOCIWFIRSTPRIV+25)
-+/*
-+ * arguments:
-+ * TARGET_STATS *targetStats (see below)
-+ * uses: WMI_GET_STATISTICS_CMDID
-+ */
++ A_MEMZERO(buf, sizeof(buf));
++ sprintf(buf, "%s", tag1);
++ pos = buf + 17;
++ AR_DEBUG_PRINTF("AssocReqIEs= ");
++ for (i = assoc_req_ie_pos; i < assoc_req_ie_pos + assocReqLen - 4; i++) {
++ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
++ sprintf(pos, "%2.2x", assocInfo[i]);
++ pos += 2;;
++ }
++ AR_DEBUG_PRINTF("\n");
+
-+#define AR6000_IOCTL_WMI_SET_ASSOC_INFO (SIOCIWFIRSTPRIV+26)
-+/*
-+ * arguments:
-+ * WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
-+ * uses: WMI_SET_ASSOC_INFO_CMDID
-+ */
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ wrqu.data.length = strlen(buf);
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++ }
+
-+#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS (SIOCIWFIRSTPRIV+27)
-+/*
-+ * arguments:
-+ * WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
-+ * uses: WMI_SET_ACCESS_PARAMS_CMDID
-+ */
++#ifdef USER_KEYS
++ if (ar->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
++ ar->user_saved_keys.keyOk == TRUE)
++ {
+
-+#define AR6000_IOCTL_WMI_SET_BMISS_TIME (SIOCIWFIRSTPRIV+28)
-+/*
-+ * arguments:
-+ * UINT32 beaconMissTime
-+ * uses: WMI_SET_BMISS_TIME_CMDID
-+ */
++ key_op_ctrl = KEY_OP_VALID_MASK & ~KEY_OP_INIT_TSC;
++ if (ar->user_key_ctrl & AR6000_USER_SETKEYS_RSC_UNCHANGED) {
++ key_op_ctrl &= ~KEY_OP_INIT_RSC;
++ } else {
++ key_op_ctrl |= KEY_OP_INIT_RSC;
++ }
++ ar6000_reinstall_keys(ar, key_op_ctrl);
++ }
++#endif /* USER_KEYS */
+
-+#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT (SIOCIWFIRSTPRIV+29)
-+/*
-+ * arguments:
-+ * WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
-+ * uses: WMI_SET_DISC_TIMEOUT_CMDID
-+ */
++ /* flush data queues */
++ ar6000_TxDataCleanup(ar);
+
-+#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS (SIOCIWFIRSTPRIV+30)
-+/*
-+ * arguments:
-+ * WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
-+ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
-+ */
++ netif_start_queue(ar->arNetDev);
+
-+/*
-+ * There is a very small space available for driver-private
-+ * wireless ioctls. In order to circumvent this limitation,
-+ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
-+ * single AR6000_IOCTL_EXTENDED ioctl.
-+ */
-+#define AR6000_IOCTL_EXTENDED (SIOCIWFIRSTPRIV+31)
++ if ((OPEN_AUTH == ar->arDot11AuthMode) &&
++ (NONE_AUTH == ar->arAuthMode) &&
++ (WEP_CRYPT == ar->arPairwiseCrypto))
++ {
++ if (!ar->arConnected) {
++ ar6000_install_static_wep_keys(ar);
++ }
++ }
+
++ ar->arConnected = TRUE;
++ ar->arConnectPending = FALSE;
+
-+/* ====BMI Extended Ioctls==== */
++ reconnect_flag = 0;
+
-+#define AR6000_XIOCTL_BMI_DONE 1
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
-+ * uses: BMI_DONE
-+ */
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ A_MEMCPY(wrqu.addr.sa_data, bssid, IEEE80211_ADDR_LEN);
++ wrqu.addr.sa_family = ARPHRD_ETHER;
++ wireless_send_event(ar->arNetDev, SIOCGIWAP, &wrqu, NULL);
++ if ((ar->arNetworkType == ADHOC_NETWORK) && ar->arIbssPsEnable) {
++ A_MEMZERO(ar->arNodeMap, sizeof(ar->arNodeMap));
++ ar->arNodeNum = 0;
++ ar->arNexEpId = ENDPOINT_2;
++ }
+
-+#define AR6000_XIOCTL_BMI_READ_MEMORY 2
-+/*
-+ * arguments:
-+ * union {
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
-+ * UINT32 address
-+ * UINT32 length
-+ * }
-+ * char results[length]
-+ * }
-+ * uses: BMI_READ_MEMORY
-+ */
++}
+
-+#define AR6000_XIOCTL_BMI_WRITE_MEMORY 3
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
-+ * UINT32 address
-+ * UINT32 length
-+ * char data[length]
-+ * uses: BMI_WRITE_MEMORY
-+ */
++void ar6000_set_numdataendpts(AR_SOFTC_T *ar, A_UINT32 num)
++{
++ A_ASSERT(num <= (HTC_MAILBOX_NUM_MAX - 1));
++ ar->arNumDataEndPts = num;
++}
+
-+#define AR6000_XIOCTL_BMI_EXECUTE 4
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
-+ * UINT32 TargetAddress
-+ * UINT32 parameter
-+ * uses: BMI_EXECUTE
-+ */
++void
++ar6000_disconnect_event(AR_SOFTC_T *ar, A_UINT8 reason, A_UINT8 *bssid,
++ A_UINT8 assocRespLen, A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus)
++{
++ A_UINT8 i;
+
-+#define AR6000_XIOCTL_BMI_SET_APP_START 5
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
-+ * UINT32 TargetAddress
-+ * uses: BMI_SET_APP_START
-+ */
++ A_PRINTF("AR6000 disconnected");
++ if (bssid[0] || bssid[1] || bssid[2] || bssid[3] || bssid[4] || bssid[5]) {
++ A_PRINTF(" from %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
++ bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
++ }
++ A_PRINTF("\n");
+
-+#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER 6
-+/*
-+ * arguments:
-+ * union {
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
-+ * UINT32 TargetAddress, 32-bit aligned
-+ * }
-+ * UINT32 result
-+ * }
-+ * uses: BMI_READ_SOC_REGISTER
-+ */
++ AR_DEBUG_PRINTF("\nDisconnect Reason is %d", reason);
++ AR_DEBUG_PRINTF("\nProtocol Reason/Status Code is %d", protocolReasonStatus);
++ AR_DEBUG_PRINTF("\nAssocResp Frame = %s",
++ assocRespLen ? " " : "NULL");
++ for (i = 0; i < assocRespLen; i++) {
++ if (!(i % 0x10)) {
++ AR_DEBUG_PRINTF("\n");
++ }
++ AR_DEBUG_PRINTF("%2.2x ", assocInfo[i]);
++ }
++ AR_DEBUG_PRINTF("\n");
++ /*
++ * If the event is due to disconnect cmd from the host, only they the target
++ * would stop trying to connect. Under any other condition, target would
++ * keep trying to connect.
++ *
++ */
++ if( reason == DISCONNECT_CMD)
++ {
++ ar->arConnectPending = FALSE;
++ } else {
++ ar->arConnectPending = TRUE;
++ if (((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x11)) ||
++ ((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x0) && (reconnect_flag == 1))) {
++ ar->arConnected = TRUE;
++ return;
++ }
++ }
++ ar->arConnected = FALSE;
+
-+#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER 7
-+/*
-+ * arguments:
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
-+ * UINT32 TargetAddress, 32-bit aligned
-+ * UINT32 newValue
-+ * }
-+ * uses: BMI_WRITE_SOC_REGISTER
-+ */
++ if( (reason != CSERV_DISCONNECT) || (reconnect_flag != 1) ) {
++ reconnect_flag = 0;
++ }
+
-+#define AR6000_XIOCTL_BMI_TEST 8
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
-+ * UINT32 address
-+ * UINT32 length
-+ * UINT32 count
-+ */
++#ifdef USER_KEYS
++ if (reason != CSERV_DISCONNECT)
++ {
++ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
++ ar->user_key_ctrl = 0;
++ }
++#endif /* USER_KEYS */
+
++ netif_stop_queue(ar->arNetDev);
++ A_MEMZERO(ar->arBssid, sizeof(ar->arBssid));
++ ar->arBssChannel = 0;
++ ar->arBeaconInterval = 0;
+
++ ar6000_TxDataCleanup(ar);
++}
+
-+/* Historical Host-side DataSet support */
-+#define AR6000_XIOCTL_UNUSED9 9
-+#define AR6000_XIOCTL_UNUSED10 10
-+#define AR6000_XIOCTL_UNUSED11 11
++void
++ar6000_regDomain_event(AR_SOFTC_T *ar, A_UINT32 regCode)
++{
++ A_PRINTF("AR6000 Reg Code = 0x%x\n", regCode);
++ ar->arRegCode = regCode;
++}
+
-+/* ====Misc Extended Ioctls==== */
++void
++ar6000_neighborReport_event(AR_SOFTC_T *ar, int numAps, WMI_NEIGHBOR_INFO *info)
++{
++ static const char *tag = "PRE-AUTH";
++ char buf[128];
++ union iwreq_data wrqu;
++ int i;
+
-+#define AR6000_XIOCTL_FORCE_TARGET_RESET 12
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
-+ */
++ AR_DEBUG_PRINTF("AR6000 Neighbor Report Event\n");
++ for (i=0; i < numAps; info++, i++) {
++ AR_DEBUG_PRINTF("bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
++ info->bssid[0], info->bssid[1], info->bssid[2],
++ info->bssid[3], info->bssid[4], info->bssid[5]);
++ if (info->bssFlags & WMI_PREAUTH_CAPABLE_BSS) {
++ AR_DEBUG_PRINTF("preauth-cap");
++ }
++ if (info->bssFlags & WMI_PMKID_VALID_BSS) {
++ AR_DEBUG_PRINTF(" pmkid-valid\n");
++ continue; /* we skip bss if the pmkid is already valid */
++ }
++ AR_DEBUG_PRINTF("\n");
++ snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
++ tag,
++ info->bssid[0], info->bssid[1], info->bssid[2],
++ info->bssid[3], info->bssid[4], info->bssid[5],
++ i, info->bssFlags);
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ wrqu.data.length = strlen(buf);
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++ }
++}
+
++void
++ar6000_tkip_micerr_event(AR_SOFTC_T *ar, A_UINT8 keyid, A_BOOL ismcast)
++{
++ static const char *tag = "MLME-MICHAELMICFAILURE.indication";
++ char buf[128];
++ union iwreq_data wrqu;
+
-+#ifdef HTC_RAW_INTERFACE
-+/* HTC Raw Interface Ioctls */
-+#define AR6000_XIOCTL_HTC_RAW_OPEN 13
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
-+ */
++ A_PRINTF("AR6000 TKIP MIC error received for keyid %d %scast\n",
++ keyid, ismcast ? "multi": "uni");
++ snprintf(buf, sizeof(buf), "%s(keyid=%d %scat)", tag, keyid,
++ ismcast ? "multi" : "uni");
++ memset(&wrqu, 0, sizeof(wrqu));
++ wrqu.data.length = strlen(buf);
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
++}
+
-+#define AR6000_XIOCTL_HTC_RAW_CLOSE 14
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
-+ */
++void
++ar6000_scanComplete_event(AR_SOFTC_T *ar, A_STATUS status)
++{
++ AR_DEBUG_PRINTF("AR6000 scan complete: %d\n", status);
+
-+#define AR6000_XIOCTL_HTC_RAW_READ 15
-+/*
-+ * arguments:
-+ * union {
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
-+ * UINT32 mailboxID
-+ * UINT32 length
-+ * }
-+ * results[length]
-+ * }
-+ */
++ ar->scan_complete = 1;
++ wake_up_interruptible(&ar6000_scan_queue);
++}
+
-+#define AR6000_XIOCTL_HTC_RAW_WRITE 16
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
-+ * UINT32 mailboxID
-+ * UINT32 length
-+ * char buffer[length]
-+ */
-+#endif /* HTC_RAW_INTERFACE */
++void
++ar6000_targetStats_event(AR_SOFTC_T *ar, WMI_TARGET_STATS *pTarget)
++{
++ TARGET_STATS *pStats = &ar->arTargetStats;
++ A_UINT8 ac;
+
-+#define AR6000_XIOCTL_CHECK_TARGET_READY 17
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
-+ */
++ /*A_PRINTF("AR6000 updating target stats\n");*/
++ pStats->tx_packets += pTarget->txrxStats.tx_stats.tx_packets;
++ pStats->tx_bytes += pTarget->txrxStats.tx_stats.tx_bytes;
++ pStats->tx_unicast_pkts += pTarget->txrxStats.tx_stats.tx_unicast_pkts;
++ pStats->tx_unicast_bytes += pTarget->txrxStats.tx_stats.tx_unicast_bytes;
++ pStats->tx_multicast_pkts += pTarget->txrxStats.tx_stats.tx_multicast_pkts;
++ pStats->tx_multicast_bytes += pTarget->txrxStats.tx_stats.tx_multicast_bytes;
++ pStats->tx_broadcast_pkts += pTarget->txrxStats.tx_stats.tx_broadcast_pkts;
++ pStats->tx_broadcast_bytes += pTarget->txrxStats.tx_stats.tx_broadcast_bytes;
++ pStats->tx_rts_success_cnt += pTarget->txrxStats.tx_stats.tx_rts_success_cnt;
++ for(ac = 0; ac < WMM_NUM_AC; ac++)
++ pStats->tx_packet_per_ac[ac] += pTarget->txrxStats.tx_stats.tx_packet_per_ac[ac];
++ pStats->tx_errors += pTarget->txrxStats.tx_stats.tx_errors;
++ pStats->tx_failed_cnt += pTarget->txrxStats.tx_stats.tx_failed_cnt;
++ pStats->tx_retry_cnt += pTarget->txrxStats.tx_stats.tx_retry_cnt;
++ pStats->tx_rts_fail_cnt += pTarget->txrxStats.tx_stats.tx_rts_fail_cnt;
++ pStats->tx_unicast_rate = wmi_get_rate(pTarget->txrxStats.tx_stats.tx_unicast_rate);
+
++ pStats->rx_packets += pTarget->txrxStats.rx_stats.rx_packets;
++ pStats->rx_bytes += pTarget->txrxStats.rx_stats.rx_bytes;
++ pStats->rx_unicast_pkts += pTarget->txrxStats.rx_stats.rx_unicast_pkts;
++ pStats->rx_unicast_bytes += pTarget->txrxStats.rx_stats.rx_unicast_bytes;
++ pStats->rx_multicast_pkts += pTarget->txrxStats.rx_stats.rx_multicast_pkts;
++ pStats->rx_multicast_bytes += pTarget->txrxStats.rx_stats.rx_multicast_bytes;
++ pStats->rx_broadcast_pkts += pTarget->txrxStats.rx_stats.rx_broadcast_pkts;
++ pStats->rx_broadcast_bytes += pTarget->txrxStats.rx_stats.rx_broadcast_bytes;
++ pStats->rx_fragment_pkt += pTarget->txrxStats.rx_stats.rx_fragment_pkt;
++ pStats->rx_errors += pTarget->txrxStats.rx_stats.rx_errors;
++ pStats->rx_crcerr += pTarget->txrxStats.rx_stats.rx_crcerr;
++ pStats->rx_key_cache_miss += pTarget->txrxStats.rx_stats.rx_key_cache_miss;
++ pStats->rx_decrypt_err += pTarget->txrxStats.rx_stats.rx_decrypt_err;
++ pStats->rx_duplicate_frames += pTarget->txrxStats.rx_stats.rx_duplicate_frames;
++ pStats->rx_unicast_rate = wmi_get_rate(pTarget->txrxStats.rx_stats.rx_unicast_rate);
+
+
-+/* ====GPIO (General Purpose I/O) Extended Ioctls==== */
++ pStats->tkip_local_mic_failure
++ += pTarget->txrxStats.tkipCcmpStats.tkip_local_mic_failure;
++ pStats->tkip_counter_measures_invoked
++ += pTarget->txrxStats.tkipCcmpStats.tkip_counter_measures_invoked;
++ pStats->tkip_replays += pTarget->txrxStats.tkipCcmpStats.tkip_replays;
++ pStats->tkip_format_errors += pTarget->txrxStats.tkipCcmpStats.tkip_format_errors;
++ pStats->ccmp_format_errors += pTarget->txrxStats.tkipCcmpStats.ccmp_format_errors;
++ pStats->ccmp_replays += pTarget->txrxStats.tkipCcmpStats.ccmp_replays;
+
-+#define AR6000_XIOCTL_GPIO_OUTPUT_SET 18
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
-+ * ar6000_gpio_output_set_cmd_s (see below)
-+ * uses: WMIX_GPIO_OUTPUT_SET_CMDID
-+ */
+
-+#define AR6000_XIOCTL_GPIO_INPUT_GET 19
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
-+ * uses: WMIX_GPIO_INPUT_GET_CMDID
-+ */
++ pStats->power_save_failure_cnt += pTarget->pmStats.power_save_failure_cnt;
++ pStats->noise_floor_calibation = pTarget->noise_floor_calibation;
+
-+#define AR6000_XIOCTL_GPIO_REGISTER_SET 20
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
-+ * ar6000_gpio_register_cmd_s (see below)
-+ * uses: WMIX_GPIO_REGISTER_SET_CMDID
-+ */
++ pStats->cs_bmiss_cnt += pTarget->cservStats.cs_bmiss_cnt;
++ pStats->cs_lowRssi_cnt += pTarget->cservStats.cs_lowRssi_cnt;
++ pStats->cs_connect_cnt += pTarget->cservStats.cs_connect_cnt;
++ pStats->cs_disconnect_cnt += pTarget->cservStats.cs_disconnect_cnt;
++ pStats->cs_aveBeacon_snr = pTarget->cservStats.cs_aveBeacon_snr;
++ pStats->cs_aveBeacon_rssi = pTarget->cservStats.cs_aveBeacon_rssi;
++ pStats->cs_lastRoam_msec = pTarget->cservStats.cs_lastRoam_msec;
++ pStats->cs_snr = pTarget->cservStats.cs_snr;
++ pStats->cs_rssi = pTarget->cservStats.cs_rssi;
+
-+#define AR6000_XIOCTL_GPIO_REGISTER_GET 21
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
-+ * ar6000_gpio_register_cmd_s (see below)
-+ * uses: WMIX_GPIO_REGISTER_GET_CMDID
-+ */
++ pStats->lq_val = pTarget->lqVal;
+
-+#define AR6000_XIOCTL_GPIO_INTR_ACK 22
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
-+ * ar6000_cpio_intr_ack_cmd_s (see below)
-+ * uses: WMIX_GPIO_INTR_ACK_CMDID
-+ */
++ pStats->wow_num_pkts_dropped += pTarget->wowStats.wow_num_pkts_dropped;
++ pStats->wow_num_host_pkt_wakeups += pTarget->wowStats.wow_num_host_pkt_wakeups;
++ pStats->wow_num_host_event_wakeups += pTarget->wowStats.wow_num_host_event_wakeups;
++ pStats->wow_num_events_discarded += pTarget->wowStats.wow_num_events_discarded;
+
-+#define AR6000_XIOCTL_GPIO_INTR_WAIT 23
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
-+ */
++ ar->statsUpdatePending = FALSE;
++ wake_up(&arEvent);
++}
+
++void
++ar6000_rssiThreshold_event(AR_SOFTC_T *ar, WMI_RSSI_THRESHOLD_VAL newThreshold, A_INT16 rssi)
++{
++ USER_RSSI_THOLD userRssiThold;
+
++ userRssiThold.tag = rssi_map[newThreshold].tag;
++ userRssiThold.rssi = rssi;
++ AR_DEBUG2_PRINTF("rssi Threshold range = %d tag = %d rssi = %d\n", newThreshold, userRssiThold.tag, rssi);
++#ifdef SEND_EVENT_TO_APP
++ ar6000_send_event_to_app(ar, WMI_RSSI_THRESHOLD_EVENTID,(A_UINT8 *)&userRssiThold, sizeof(USER_RSSI_THOLD));
++#endif
++}
+
-+/* ====more wireless commands==== */
+
-+#define AR6000_XIOCTL_SET_ADHOC_BSSID 24
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
-+ * WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
-+ */
++void
++ar6000_hbChallengeResp_event(AR_SOFTC_T *ar, A_UINT32 cookie, A_UINT32 source)
++{
++ if (source == APP_HB_CHALLENGE) {
++ /* Report it to the app in case it wants a positive acknowledgement */
++#ifdef SEND_EVENT_TO_APP
++ ar6000_send_event_to_app(ar, WMIX_HB_CHALLENGE_RESP_EVENTID,
++ (A_UINT8 *)&cookie, sizeof(cookie));
++#endif
++ } else {
++ /* This would ignore the replys that come in after their due time */
++ if (cookie == ar->arHBChallengeResp.seqNum) {
++ ar->arHBChallengeResp.outstanding = FALSE;
++ }
++ }
++}
+
-+#define AR6000_XIOCTL_SET_OPT_MODE 25
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
-+ * WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
-+ * uses: WMI_SET_OPT_MODE_CMDID
-+ */
+
-+#define AR6000_XIOCTL_OPT_SEND_FRAME 26
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
-+ * WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
-+ * uses: WMI_OPT_TX_FRAME_CMDID
-+ */
++void
++ar6000_reportError_event(AR_SOFTC_T *ar, WMI_TARGET_ERROR_VAL errorVal)
++{
++ char *errString[] = {
++ [WMI_TARGET_PM_ERR_FAIL] "WMI_TARGET_PM_ERR_FAIL",
++ [WMI_TARGET_KEY_NOT_FOUND] "WMI_TARGET_KEY_NOT_FOUND",
++ [WMI_TARGET_DECRYPTION_ERR] "WMI_TARGET_DECRYPTION_ERR",
++ [WMI_TARGET_BMISS] "WMI_TARGET_BMISS",
++ [WMI_PSDISABLE_NODE_JOIN] "WMI_PSDISABLE_NODE_JOIN"
++ };
+
-+#define AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL 27
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL)
-+ * WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
-+ * uses: WMI_SET_BEACON_INT_CMDID
-+ */
++ A_PRINTF("AR6000 Error on Target. Error = 0x%x\n", errorVal);
+
++ /* One error is reported at a time, and errorval is a bitmask */
++ if(errorVal & (errorVal - 1))
++ return;
+
-+#define IEEE80211_IOCTL_SETAUTHALG 28
++ A_PRINTF("AR6000 Error type = ");
++ switch(errorVal)
++ {
++ case WMI_TARGET_PM_ERR_FAIL:
++ case WMI_TARGET_KEY_NOT_FOUND:
++ case WMI_TARGET_DECRYPTION_ERR:
++ case WMI_TARGET_BMISS:
++ case WMI_PSDISABLE_NODE_JOIN:
++ A_PRINTF("%s\n", errString[errorVal]);
++ break;
++ default:
++ A_PRINTF("INVALID\n");
++ break;
++ }
+
++}
+
-+#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE 29
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
-+ * WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
-+ * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
-+ */
+
++void
++ar6000_cac_event(AR_SOFTC_T *ar, A_UINT8 ac, A_UINT8 cacIndication,
++ A_UINT8 statusCode, A_UINT8 *tspecSuggestion)
++{
++ WMM_TSPEC_IE *tspecIe;
+
-+#define AR6000_XIOCTL_SET_MAX_SP 30
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
-+ * WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
-+ * uses: WMI_SET_MAX_SP_LEN_CMDID
-+ */
++ /*
++ * This is the TSPEC IE suggestion from AP.
++ * Suggestion provided by AP under some error
++ * cases, could be helpful for the host app.
++ * Check documentation.
++ */
++ tspecIe = (WMM_TSPEC_IE *)tspecSuggestion;
+
-+#define AR6000_XIOCTL_WMI_GET_ROAM_TBL 31
++ /*
++ * What do we do, if we get TSPEC rejection? One thought
++ * that comes to mind is implictly delete the pstream...
++ */
++ A_PRINTF("AR6000 CAC notification. "
++ "AC = %d, cacIndication = 0x%x, statusCode = 0x%x\n",
++ ac, cacIndication, statusCode);
++}
+
-+#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL 32
++#define AR6000_PRINT_BSSID(_pBss) do { \
++ A_PRINTF("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",\
++ (_pBss)[0],(_pBss)[1],(_pBss)[2],(_pBss)[3],\
++ (_pBss)[4],(_pBss)[5]); \
++} while(0)
+
-+#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS 33
++void
++ar6000_roam_tbl_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_TBL *pTbl)
++{
++ A_UINT8 i;
+
++ A_PRINTF("ROAM TABLE NO OF ENTRIES is %d ROAM MODE is %d\n",
++ pTbl->numEntries, pTbl->roamMode);
++ for (i= 0; i < pTbl->numEntries; i++) {
++ A_PRINTF("[%d]bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ", i,
++ pTbl->bssRoamInfo[i].bssid[0], pTbl->bssRoamInfo[i].bssid[1],
++ pTbl->bssRoamInfo[i].bssid[2],
++ pTbl->bssRoamInfo[i].bssid[3],
++ pTbl->bssRoamInfo[i].bssid[4],
++ pTbl->bssRoamInfo[i].bssid[5]);
++ A_PRINTF("RSSI %d RSSIDT %d LAST RSSI %d UTIL %d ROAM_UTIL %d"
++ " BIAS %d\n",
++ pTbl->bssRoamInfo[i].rssi,
++ pTbl->bssRoamInfo[i].rssidt,
++ pTbl->bssRoamInfo[i].last_rssi,
++ pTbl->bssRoamInfo[i].util,
++ pTbl->bssRoamInfo[i].roam_util,
++ pTbl->bssRoamInfo[i].bias);
++ }
++}
+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
-+ * WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
-+ * WMI_SET_POWERSAVE_TIMERS_CMDID
-+ */
++void
++ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters, WMI_GET_WOW_LIST_REPLY *wow_reply)
++{
++ A_UINT8 i,j;
+
-+#define AR6000_XIOCTRL_WMI_GET_POWER_MODE 34
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
-+ */
++ /*Each event now contains exactly one filter, see bug 26613*/
++ A_PRINTF("WOW pattern %d of %d patterns\n", wow_reply->this_filter_num, wow_reply->num_filters);
++ A_PRINTF("wow mode = %s host mode = %s\n",
++ (wow_reply->wow_mode == 0? "disabled":"enabled"),
++ (wow_reply->host_mode == 1 ? "awake":"asleep"));
+
-+#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE 35
-+typedef enum {
-+ WLAN_DISABLED,
-+ WLAN_ENABLED
-+} AR6000_WLAN_STATE;
-+/*
-+ * arguments:
-+ * enable/disable
-+ */
+
-+#define AR6000_XIOCTL_WMI_GET_ROAM_DATA 36
++ /*If there are no patterns, the reply will only contain generic
++ WoW information. Pattern information will exist only if there are
++ patterns present. Bug 26716*/
+
-+#define AR6000_XIOCTL_WMI_SETRETRYLIMITS 37
-+/*
-+ * arguments:
-+ * WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
-+ * uses: WMI_SET_RETRY_LIMITS_CMDID
-+ */
++ /* If this event contains pattern information, display it*/
++ if (wow_reply->this_filter_num) {
++ i=0;
++ A_PRINTF("id=%d size=%d offset=%d\n",
++ wow_reply->wow_filters[i].wow_filter_id,
++ wow_reply->wow_filters[i].wow_filter_size,
++ wow_reply->wow_filters[i].wow_filter_offset);
++ A_PRINTF("wow pattern = ");
++ for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
++ A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_pattern[j]);
++ }
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/* ====extended commands for radio test ==== */
++ A_PRINTF("\nwow mask = ");
++ for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
++ A_PRINTF("%2.2x",wow_reply->wow_filters[i].wow_filter_mask[j]);
++ }
++ A_PRINTF("\n");
++ }
++}
+
-+#define AR6000_XIOCTL_TCMD_CONT_TX 38
+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
-+ * WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_CONT_TX_CMDID
++ * Report the Roaming related data collected on the target
+ */
++void
++ar6000_display_roam_time(WMI_TARGET_ROAM_TIME *p)
++{
++ A_PRINTF("Disconnect Data : BSSID: ");
++ AR6000_PRINT_BSSID(p->disassoc_bssid);
++ A_PRINTF(" RSSI %d DISASSOC Time %d NO_TXRX_TIME %d\n",
++ p->disassoc_bss_rssi,p->disassoc_time,
++ p->no_txrx_time);
++ A_PRINTF("Connect Data: BSSID: ");
++ AR6000_PRINT_BSSID(p->assoc_bssid);
++ A_PRINTF(" RSSI %d ASSOC Time %d TXRX_TIME %d\n",
++ p->assoc_bss_rssi,p->assoc_time,
++ p->allow_txrx_time);
++ A_PRINTF("Last Data Tx Time (b4 Disassoc) %d "\
++ "First Data Tx Time (after Assoc) %d\n",
++ p->last_data_txrx_time, p->first_data_txrx_time);
++}
+
-+#define AR6000_XIOCTL_TCMD_CONT_RX 39
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
-+ * WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_CONT_RX_CMDID
-+ */
++void
++ar6000_roam_data_event(AR_SOFTC_T *ar, WMI_TARGET_ROAM_DATA *p)
++{
++ switch (p->roamDataType) {
++ case ROAM_DATA_TIME:
++ ar6000_display_roam_time(&p->u.roamTime);
++ break;
++ default:
++ break;
++ }
++}
+
-+#define AR6000_XIOCTL_TCMD_PM 40
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
-+ * WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
-+ * uses: WMI_TCMD_PM_CMDID
-+ */
++void
++ar6000_bssInfo_event_rx(AR_SOFTC_T *ar, A_UINT8 *datap, int len)
++{
++ struct sk_buff *skb;
++ WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
+
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
-+#define AR6000_XIOCTL_WMI_STARTSCAN 41
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
-+ * UINT8 scanType
-+ * UINT8 scanConnected
-+ * A_BOOL forceFgScan
-+ * uses: WMI_START_SCAN_CMDID
-+ */
++ if (!ar->arMgmtFilter) {
++ return;
++ }
++ if (((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_BEACON) &&
++ (bih->frameType != BEACON_FTYPE)) ||
++ ((ar->arMgmtFilter & IEEE80211_FILTER_TYPE_PROBE_RESP) &&
++ (bih->frameType != PROBERESP_FTYPE)))
++ {
++ return;
++ }
+
-+#define AR6000_XIOCTL_WMI_SETFIXRATES 42
++ if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
+
-+#define AR6000_XIOCTL_WMI_GETFIXRATES 43
++ A_NETBUF_PUT(skb, len);
++ A_MEMCPY(A_NETBUF_DATA(skb), datap, len);
++ skb->dev = ar->arNetDev;
++ printk("MAC RAW...\n");
++// skb->mac.raw = A_NETBUF_DATA(skb);
++ skb->ip_summed = CHECKSUM_NONE;
++ skb->pkt_type = PACKET_OTHERHOST;
++ skb->protocol = __constant_htons(0x0019);
++ netif_rx(skb);
++ }
++}
+
++A_UINT32 wmiSendCmdNum;
+
-+#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD 44
-+/*
-+ * arguments:
-+ * WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
-+ */
++A_STATUS
++ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
++ A_STATUS status = A_OK;
++ struct ar_cookie *cookie = NULL;
++ int i;
+
-+#define AR6000_XIOCTL_WMI_CLR_RSSISNR 45
-+/*
-+ * arguments:
-+ * WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_CLR_RSSISNR_CMDID
-+ */
++ /* take lock to protect ar6000_alloc_cookie() */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD 46
-+/*
-+ * arguments:
-+ * WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
-+ * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
-+ */
++ do {
+
-+#define AR6000_XIOCTL_WMI_SET_RTS 47
-+/*
-+ * arguments:
-+ * WMI_SET_RTS_MODE_CMD (see include/wmi.h)
-+ * uses: WMI_SET_RTS_MODE_CMDID
-+ */
++ AR_DEBUG2_PRINTF("ar_contrstatus = ol_tx: skb=0x%x, len=0x%x, sid=%d\n",
++ (A_UINT32)osbuf, A_NETBUF_LEN(osbuf), streamID);
+
-+#define AR6000_XIOCTL_WMI_SET_LPREAMBLE 48
++ if ((streamID == WMI_CONTROL_PRI) && (ar->arWMIControlEpFull)) {
++ /* control endpoint is full, don't allocate resources, we
++ * are just going to drop this packet */
++ cookie = NULL;
++ AR_DEBUG_PRINTF(" WMI Control EP full, dropping packet : 0x%X, len:%d \n",
++ (A_UINT32)osbuf, A_NETBUF_LEN(osbuf));
++ } else {
++ cookie = ar6000_alloc_cookie(ar);
++ }
+
-+#define AR6000_XIOCTL_WMI_SET_AUTHMODE 49
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
-+ * UINT8 mode
-+ * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
-+ */
++ if (cookie == NULL) {
++ status = A_NO_MEMORY;
++ break;
++ }
+
-+#define AR6000_XIOCTL_WMI_SET_REASSOCMODE 50
++ if(logWmiRawMsgs) {
++ A_PRINTF("WMI cmd send, msgNo %d :", wmiSendCmdNum);
++ for(i = 0; i < a_netbuf_to_len(osbuf); i++)
++ A_PRINTF("%x ", ((A_UINT8 *)a_netbuf_to_data(osbuf))[i]);
++ A_PRINTF("\n");
++ }
+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
-+ * UINT8 mode
-+ * uses: WMI_SET_WMM_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_WMM 51
++ wmiSendCmdNum++;
+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
-+ * UINT32 frequency
-+ * UINT8 threshold
-+ */
-+#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS 52
++ } while (FALSE);
+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
-+ * UINT32 cookie
-+ */
-+#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP 53
++ if (cookie != NULL) {
++ /* got a structure to send it out on */
++ ar->arTxPending[streamID]++;
+
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
-+ * UINT32 regDomain
-+ */
-+#define AR6000_XIOCTL_WMI_GET_RD 54
++ if (streamID != WMI_CONTROL_PRI) {
++ ar->arTotalTxDataPending++;
++ }
++ }
+
-+#define AR6000_XIOCTL_DIAG_READ 55
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
-+#define AR6000_XIOCTL_DIAG_WRITE 56
++ if (cookie != NULL) {
++ cookie->arc_bp[0] = (A_UINT32)osbuf;
++ cookie->arc_bp[1] = 0;
++ SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
++ cookie,
++ A_NETBUF_DATA(osbuf),
++ A_NETBUF_LEN(osbuf),
++ arWMIStream2EndpointID(ar,streamID),
++ AR6K_CONTROL_PKT_TAG);
++ /* this interface is asynchronous, if there is an error, cleanup will happen in the
++ * TX completion callback */
++ HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
++ status = A_OK;
++ }
+
-+/*
-+ * arguments cmd (AR6000_XIOCTL_SET_TXOP)
-+ * WMI_TXOP_CFG txopEnable
-+ */
-+#define AR6000_XIOCTL_WMI_SET_TXOP 57
++ return status;
++}
+
-+#ifdef USER_KEYS
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
-+ * UINT32 keyOpCtrl
-+ * uses AR6000_USER_SETKEYS_INFO
-+ */
-+#define AR6000_XIOCTL_USER_SETKEYS 58
-+#endif /* USER_KEYS */
++/* indicate tx activity or inactivity on a WMI stream */
++void ar6000_indicate_tx_activity(void *devt, A_UINT8 TrafficClass, A_BOOL Active)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
++ WMI_PRI_STREAM_ID streamid;
+
-+#define AR6000_XIOCTL_WMI_SET_KEEPALIVE 59
-+/*
-+ * arguments:
-+ * UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
-+ * UINT8 keepaliveInterval
-+ * uses: WMI_SET_KEEPALIVE_CMDID
-+ */
++ if (ar->arWmiEnabled) {
++ streamid = wmi_get_stream_id(ar->arWmi, TrafficClass);
++ } else {
++ /* for mbox ping testing, the traffic class is mapped directly as a stream ID,
++ * see handling of AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE in ioctl.c */
++ streamid = (WMI_PRI_STREAM_ID)TrafficClass;
++ }
+
-+#define AR6000_XIOCTL_WMI_GET_KEEPALIVE 60
-+/*
-+ * arguments:
-+ * UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
-+ * UINT8 keepaliveInterval
-+ * A_BOOL configured
-+ * uses: WMI_GET_KEEPALIVE_CMDID
-+ */
++ /* notify HTC, this may cause credit distribution changes */
+
-+/* ====ROM Patching Extended Ioctls==== */
++ HTCIndicateActivityChange(ar->arHtcTarget,
++ arWMIStream2EndpointID(ar,streamid),
++ Active);
+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL 61
-+/*
-+ * arguments:
-+ * union {
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
-+ * UINT32 ROM Address
-+ * UINT32 RAM Address
-+ * UINT32 number of bytes
-+ * UINT32 activate? (0 or 1)
-+ * }
-+ * A_UINT32 resulting rompatch ID
-+ * }
-+ * uses: BMI_ROMPATCH_INSTALL
-+ */
++}
+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL 62
-+/*
-+ * arguments:
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
-+ * UINT32 rompatch ID
-+ * }
-+ * uses: BMI_ROMPATCH_UNINSTALL
-+ */
++module_init(ar6000_init_module);
++module_exit(ar6000_cleanup_module);
+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE 63
-+/*
-+ * arguments:
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
-+ * UINT32 rompatch count
-+ * UINT32 rompatch IDs[rompatch count]
-+ * }
-+ * uses: BMI_ROMPATCH_ACTIVATE
-+ */
++/* Init cookie queue */
++static void
++ar6000_cookie_init(AR_SOFTC_T *ar)
++{
++ A_UINT32 i;
+
-+#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE 64
-+/*
-+ * arguments:
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
-+ * UINT32 rompatch count
-+ * UINT32 rompatch IDs[rompatch count]
-+ * }
-+ * uses: BMI_ROMPATCH_DEACTIVATE
-+ */
++ ar->arCookieList = NULL;
++ A_MEMZERO(s_ar_cookie_mem, sizeof(s_ar_cookie_mem));
+
-+#define AR6000_XIOCTL_WMI_SET_APPIE 65
-+/*
-+ * arguments:
-+ * struct {
-+ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
-+ * UINT32 app_frmtype;
-+ * UINT32 app_buflen;
-+ * UINT8 app_buf[];
-+ * }
-+ */
-+#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER 66
-+/*
-+ * arguments:
-+ * A_UINT32 filter_type;
-+ */
-+
-+#define AR6000_XIOCTL_DBGLOG_CFG_MODULE 67
-+
-+#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS 68
-+
-+#define AR6000_XIOCTL_WMI_SET_WSC_STATUS 70
-+/*
-+ * arguments:
-+ * A_UINT32 wsc_status;
-+ * (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
-+ */
-+
-+/*
-+ * arguments:
-+ * struct {
-+ * A_UINT8 streamType;
-+ * A_UINT8 status;
-+ * }
-+ * uses: WMI_SET_BT_STATUS_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_BT_STATUS 71
++ for (i = 0; i < MAX_COOKIE_NUM; i++) {
++ ar6000_free_cookie(ar, &s_ar_cookie_mem[i]);
++ }
++}
+
-+/*
-+ * arguments:
-+ * struct {
-+ * A_UINT8 paramType;
-+ * union {
-+ * A_UINT8 noSCOPkts;
-+ * BT_PARAMS_A2DP a2dpParams;
-+ * BT_COEX_REGS regs;
-+ * };
-+ * }
-+ * uses: WMI_SET_BT_PARAM_CMDID
-+ */
-+#define AR6000_XIOCTL_WMI_SET_BT_PARAMS 72
++/* cleanup cookie queue */
++static void
++ar6000_cookie_cleanup(AR_SOFTC_T *ar)
++{
++ /* It is gone .... */
++ ar->arCookieList = NULL;
++}
+
-+#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE 73
-+#define AR6000_XIOCTL_WMI_SET_WOW_MODE 74
-+#define AR6000_XIOCTL_WMI_GET_WOW_LIST 75
-+#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN 76
-+#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN 77
++/* Init cookie queue */
++static void
++ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie)
++{
++ /* Insert first */
++ A_ASSERT(ar != NULL);
++ A_ASSERT(cookie != NULL);
++ cookie->arc_list_next = ar->arCookieList;
++ ar->arCookieList = cookie;
++}
+
++/* cleanup cookie queue */
++static struct ar_cookie *
++ar6000_alloc_cookie(AR_SOFTC_T *ar)
++{
++ struct ar_cookie *cookie;
+
++ cookie = ar->arCookieList;
++ if(cookie != NULL)
++ {
++ ar->arCookieList = cookie->arc_list_next;
++ }
+
-+#define AR6000_XIOCTL_TARGET_INFO 78
-+/*
-+ * arguments:
-+ * UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
-+ * A_UINT32 TargetVersion (returned)
-+ * A_UINT32 TargetType (returned)
-+ * (See also bmi_msg.h target_ver and target_type)
-+ */
++ return cookie;
++}
+
-+#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE 79
++#ifdef SEND_EVENT_TO_APP
+/*
-+ * arguments:
-+ * none
++ * This function is used to send event which come from taget to
++ * the application. The buf which send to application is include
++ * the event ID and event content.
+ */
++#define EVENT_ID_LEN 2
++void ar6000_send_event_to_app(AR_SOFTC_T *ar, A_UINT16 eventId,
++ A_UINT8 *datap, int len)
++{
+
-+#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE 80
-+/*
-+ * This ioctl is used to emulate traffic activity
-+ * timeouts. Activity/inactivity will trigger the driver
-+ * to re-balance credits.
-+ *
-+ * arguments:
-+ * ar6000_traffic_activity_change
-+ */
++#if (WIRELESS_EXT >= 15)
+
-+#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS 81
-+/*
-+ * This ioctl is used to set the connect control flags
-+ *
-+ * arguments:
-+ * A_UINT32 connectCtrlFlags
-+ */
++/* note: IWEVCUSTOM only exists in wireless extensions after version 15 */
+
-+#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS 82
-+/*
-+ * This IOCTL sets any Authentication,Key Management and Protection
-+ * related parameters. This is used along with the information set in
-+ * Connect Command.
-+ * Currently this enables Multiple PMKIDs to an AP.
-+ *
-+ * arguments:
-+ * struct {
-+ * A_UINT32 akmpInfo;
-+ * }
-+ * uses: WMI_SET_AKMP_PARAMS_CMD
-+ */
++ char *buf;
++ A_UINT16 size;
++ union iwreq_data wrqu;
+
-+#define AR6000_XIOCTL_WMI_GET_PMKID_LIST 83
++ size = len + EVENT_ID_LEN;
+
-+#define AR6000_XIOCTL_WMI_SET_PMKID_LIST 84
-+/*
-+ * This IOCTL is used to set a list of PMKIDs. This list of
-+ * PMKIDs is used in the [Re]AssocReq Frame. This list is used
-+ * only if the MultiPMKID option is enabled via the
-+ * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS IOCTL.
-+ *
-+ * arguments:
-+ * struct {
-+ * A_UINT32 numPMKID;
-+ * WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
-+ * }
-+ * uses: WMI_SET_PMKIDLIST_CMD
-+ */
++ if (size > IW_CUSTOM_MAX) {
++ AR_DEBUG_PRINTF("WMI event ID : 0x%4.4X, len = %d too big for IWEVCUSTOM (max=%d) \n",
++ eventId, size, IW_CUSTOM_MAX);
++ return;
++ }
+
-+/* Historical DSETPATCH support for INI patches */
-+#define AR6000_XIOCTL_UNUSED90 90
++ buf = A_MALLOC_NOWAIT(size);
++ A_MEMZERO(buf, size);
++ A_MEMCPY(buf, &eventId, EVENT_ID_LEN);
++ A_MEMCPY(buf+EVENT_ID_LEN, datap, len);
+
++ //AR_DEBUG_PRINTF("event ID = %d,len = %d\n",*(A_UINT16*)buf, size);
++ A_MEMZERO(&wrqu, sizeof(wrqu));
++ wrqu.data.length = size;
++ wireless_send_event(ar->arNetDev, IWEVCUSTOM, &wrqu, buf);
+
++ A_FREE(buf);
++#endif
+
-+/* used by AR6000_IOCTL_WMI_GETREV */
-+struct ar6000_version {
-+ A_UINT32 host_ver;
-+ A_UINT32 target_ver;
-+};
+
-+/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
-+struct ar6000_queuereq {
-+ A_UINT8 trafficClass;
-+ A_UINT16 activeTsids;
-+};
++}
++#endif
+
-+/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
-+typedef struct targetStats_t {
-+ A_UINT64 tx_packets;
-+ A_UINT64 tx_bytes;
-+ A_UINT64 tx_unicast_pkts;
-+ A_UINT64 tx_unicast_bytes;
-+ A_UINT64 tx_multicast_pkts;
-+ A_UINT64 tx_multicast_bytes;
-+ A_UINT64 tx_broadcast_pkts;
-+ A_UINT64 tx_broadcast_bytes;
-+ A_UINT64 tx_rts_success_cnt;
-+ A_UINT64 tx_packet_per_ac[4];
+
-+ A_UINT64 tx_errors;
-+ A_UINT64 tx_failed_cnt;
-+ A_UINT64 tx_retry_cnt;
-+ A_UINT64 tx_rts_fail_cnt;
-+ A_INT32 tx_unicast_rate;
-+ A_UINT64 rx_packets;
-+ A_UINT64 rx_bytes;
-+ A_UINT64 rx_unicast_pkts;
-+ A_UINT64 rx_unicast_bytes;
-+ A_UINT64 rx_multicast_pkts;
-+ A_UINT64 rx_multicast_bytes;
-+ A_UINT64 rx_broadcast_pkts;
-+ A_UINT64 rx_broadcast_bytes;
-+ A_UINT64 rx_fragment_pkt;
++void
++ar6000_tx_retry_err_event(void *devt)
++{
++ AR_DEBUG2_PRINTF("Tx retries reach maximum!\n");
++}
+
-+ A_UINT64 rx_errors;
-+ A_UINT64 rx_crcerr;
-+ A_UINT64 rx_key_cache_miss;
-+ A_UINT64 rx_decrypt_err;
-+ A_UINT64 rx_duplicate_frames;
-+ A_INT32 rx_unicast_rate;
++void
++ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, A_UINT8 snr)
++{
++ AR_DEBUG2_PRINTF("snr threshold range %d, snr %d\n", newThreshold, snr);
++}
+
-+ A_UINT64 tkip_local_mic_failure;
-+ A_UINT64 tkip_counter_measures_invoked;
-+ A_UINT64 tkip_replays;
-+ A_UINT64 tkip_format_errors;
-+ A_UINT64 ccmp_format_errors;
-+ A_UINT64 ccmp_replays;
++void
++ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL newThreshold, A_UINT8 lq)
++{
++ AR_DEBUG2_PRINTF("lq threshold range %d, lq %d\n", newThreshold, lq);
++}
+
-+ A_UINT64 power_save_failure_cnt;
-+ A_INT16 noise_floor_calibation;
+
-+ A_UINT64 cs_bmiss_cnt;
-+ A_UINT64 cs_lowRssi_cnt;
-+ A_UINT64 cs_connect_cnt;
-+ A_UINT64 cs_disconnect_cnt;
-+ A_UINT8 cs_aveBeacon_snr;
-+ A_INT16 cs_aveBeacon_rssi;
-+ A_UINT8 cs_lastRoam_msec;
-+ A_UINT8 cs_snr;
-+ A_INT16 cs_rssi;
+
-+ A_UINT32 lq_val;
++A_UINT32
++a_copy_to_user(void *to, const void *from, A_UINT32 n)
++{
++ return(copy_to_user(to, from, n));
++}
+
-+ A_UINT32 wow_num_pkts_dropped;
-+ A_UINT8 wow_num_host_pkt_wakeups;
-+ A_UINT8 wow_num_host_event_wakeups;
-+ A_UINT16 wow_num_events_discarded;
++A_UINT32
++a_copy_from_user(void *to, const void *from, A_UINT32 n)
++{
++ return(copy_from_user(to, from, n));
++}
+
-+}TARGET_STATS;
+
-+typedef struct targetStats_cmd_t {
-+ TARGET_STATS targetStats;
-+ int clearStats;
-+} TARGET_STATS_CMD;
++A_STATUS
++ar6000_get_driver_cfg(struct net_device *dev,
++ A_UINT16 cfgParam,
++ void *result)
++{
+
-+/* used by AR6000_XIOCTL_USER_SETKEYS */
++ A_STATUS ret = 0;
+
-+/*
-+ * Setting this bit to 1 doesnot initialize the RSC on the firmware
-+ */
-+#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL 1
-+#define AR6000_USER_SETKEYS_RSC_UNCHANGED 0x00000002
++ switch(cfgParam)
++ {
++ case AR6000_DRIVER_CFG_GET_WLANNODECACHING:
++ *((A_UINT32 *)result) = wlanNodeCaching;
++ break;
++ case AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS:
++ *((A_UINT32 *)result) = logWmiRawMsgs;
++ break;
++ default:
++ ret = EINVAL;
++ break;
++ }
+
-+typedef struct {
-+ A_UINT32 keyOpCtrl; /* Bit Map of Key Mgmt Ctrl Flags */
-+} AR6000_USER_SETKEYS_INFO;
++ return ret;
++}
+
++void
++ar6000_keepalive_rx(void *devt, A_UINT8 configured)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
+
-+/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
-+struct ar6000_gpio_output_set_cmd_s {
-+ A_UINT32 set_mask;
-+ A_UINT32 clear_mask;
-+ A_UINT32 enable_mask;
-+ A_UINT32 disable_mask;
-+};
++ ar->arKeepaliveConfigured = configured;
++ wake_up(&arEvent);
++}
+
-+/*
-+ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
-+ */
-+struct ar6000_gpio_register_cmd_s {
-+ A_UINT32 gpioreg_id;
-+ A_UINT32 value;
-+};
++void
++ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID, WMI_PMKID *pmkidList)
++{
++ A_UINT8 i, j;
+
-+/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
-+struct ar6000_gpio_intr_ack_cmd_s {
-+ A_UINT32 ack_mask;
-+};
++ A_PRINTF("Number of Cached PMKIDs is %d\n", numPMKID);
+
-+/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
-+struct ar6000_gpio_intr_wait_cmd_s {
-+ A_UINT32 intr_mask;
-+ A_UINT32 input_values;
-+};
++ for (i = 0; i < numPMKID; i++) {
++ A_PRINTF("\nPMKID %d ", i);
++ for (j = 0; j < WMI_PMKID_LEN; j++) {
++ A_PRINTF("%2.2x", pmkidList->pmkid[j]);
++ }
++ pmkidList++;
++ }
++}
+
-+/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
-+typedef struct ar6000_dbglog_module_config_s {
-+ A_UINT32 valid;
-+ A_UINT16 mmask;
-+ A_UINT16 tsr;
-+ A_BOOL rep;
-+ A_UINT16 size;
-+} DBGLOG_MODULE_CONFIG;
++#ifdef USER_KEYS
++static A_STATUS
+
-+typedef struct user_rssi_thold_t {
-+ A_INT16 tag;
-+ A_INT16 rssi;
-+} USER_RSSI_THOLD;
++ar6000_reinstall_keys(AR_SOFTC_T *ar, A_UINT8 key_op_ctrl)
++{
++ A_STATUS status = A_OK;
++ struct ieee80211req_key *uik = &ar->user_saved_keys.ucast_ik;
++ struct ieee80211req_key *bik = &ar->user_saved_keys.bcast_ik;
++ CRYPTO_TYPE keyType = ar->user_saved_keys.keyType;
+
-+typedef struct user_rssi_params_t {
-+ A_UINT8 weight;
-+ A_UINT32 pollTime;
-+ USER_RSSI_THOLD tholds[12];
-+} USER_RSSI_PARAMS;
++ if (IEEE80211_CIPHER_CCKM_KRK != uik->ik_type) {
++ if (NONE_CRYPT == keyType) {
++ goto _reinstall_keys_out;
++ }
+
-+/*
-+ * Host driver may have some config parameters. Typically, these
-+ * config params are one time config parameters. These could
-+ * correspond to any of the underlying modules. Host driver exposes
-+ * an api for the underlying modules to get this config.
-+ */
-+#define AR6000_DRIVER_CFG_BASE 0x8000
++ if (uik->ik_keylen) {
++ status = wmi_addKey_cmd(ar->arWmi, uik->ik_keyix,
++ ar->user_saved_keys.keyType, PAIRWISE_USAGE,
++ uik->ik_keylen, (A_UINT8 *)&uik->ik_keyrsc,
++ uik->ik_keydata, key_op_ctrl, SYNC_BEFORE_WMIFLAG);
++ }
+
-+/* Should driver perform wlan node caching? */
-+#define AR6000_DRIVER_CFG_GET_WLANNODECACHING 0x8001
-+/*Should we log raw WMI msgs */
-+#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS 0x8002
++ } else {
++ status = wmi_add_krk_cmd(ar->arWmi, uik->ik_keydata);
++ }
+
-+/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
-+struct ar6000_diag_window_cmd_s {
-+ unsigned int addr;
-+ unsigned int value;
-+};
++ if (IEEE80211_CIPHER_CCKM_KRK != bik->ik_type) {
++ if (NONE_CRYPT == keyType) {
++ goto _reinstall_keys_out;
++ }
+
++ if (bik->ik_keylen) {
++ status = wmi_addKey_cmd(ar->arWmi, bik->ik_keyix,
++ ar->user_saved_keys.keyType, GROUP_USAGE,
++ bik->ik_keylen, (A_UINT8 *)&bik->ik_keyrsc,
++ bik->ik_keydata, key_op_ctrl, NO_SYNC_WMIFLAG);
++ }
++ } else {
++ status = wmi_add_krk_cmd(ar->arWmi, bik->ik_keydata);
++ }
+
-+struct ar6000_traffic_activity_change {
-+ A_UINT32 StreamID; /* stream ID to indicate activity change */
-+ A_UINT32 Active; /* active (1) or inactive (0) */
-+};
++_reinstall_keys_out:
++ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
++ ar->user_key_ctrl = 0;
+
-+#ifdef __cplusplus
++ return status;
+}
-+#endif
-+#endif
-diff --git a/drivers/ar6000/ar6000/athtypes_linux.h b/drivers/ar6000/ar6000/athtypes_linux.h
-new file mode 100644
-index 0000000..3e91de3
---- /dev/null
-+++ b/drivers/ar6000/ar6000/athtypes_linux.h
-@@ -0,0 +1,47 @@
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/athtypes_linux.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+
-+#ifndef _ATHTYPES_LINUX_H_
-+#define _ATHTYPES_LINUX_H_
-+
-+#ifdef __KERNEL__
-+#include <linux/types.h>
-+#endif
-+
-+typedef int8_t A_INT8;
-+typedef int16_t A_INT16;
-+typedef int32_t A_INT32;
-+typedef int64_t A_INT64;
++#endif /* USER_KEYS */
+
-+typedef u_int8_t A_UINT8;
-+typedef u_int16_t A_UINT16;
-+typedef u_int32_t A_UINT32;
-+typedef u_int64_t A_UINT64;
+
-+typedef int A_BOOL;
-+typedef char A_CHAR;
-+typedef unsigned char A_UCHAR;
-+typedef unsigned long A_ATH_TIMER;
++void
++ar6000_dset_open_req(
++ void *context,
++ A_UINT32 id,
++ A_UINT32 targHandle,
++ A_UINT32 targReplyFn,
++ A_UINT32 targReplyArg)
++{
++}
+
++void
++ar6000_dset_close(
++ void *context,
++ A_UINT32 access_cookie)
++{
++ return;
++}
+
-+#endif /* _ATHTYPES_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/config_linux.h b/drivers/ar6000/ar6000/config_linux.h
++void
++ar6000_dset_data_req(
++ void *context,
++ A_UINT32 accessCookie,
++ A_UINT32 offset,
++ A_UINT32 length,
++ A_UINT32 targBuf,
++ A_UINT32 targReplyFn,
++ A_UINT32 targReplyArg)
++{
++}
+diff --git a/drivers/ar6000/ar6000/ar6000_drv.h b/drivers/ar6000/ar6000/ar6000_drv.h
new file mode 100644
-index 0000000..11a691d
+index 0000000..3230d32
--- /dev/null
-+++ b/drivers/ar6000/ar6000/config_linux.h
-@@ -0,0 +1,44 @@
++++ b/drivers/ar6000/ar6000/ar6000_drv.h
+@@ -0,0 +1,361 @@
+/*
++ *
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ */
+
-+#ifndef _CONFIG_LINUX_H_
-+#define _CONFIG_LINUX_H_
++#ifndef _AR6000_H_
++#define _AR6000_H_
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++#include <linux/version.h>
+
-+/*
-+ * Host-side GPIO support is optional.
-+ * If run-time access to GPIO pins is not required, then
-+ * this should be changed to #undef.
-+ */
-+#define CONFIG_HOST_GPIO_SUPPORT
+
-+/*
-+ * Host side Test Command support
-+ */
-+#define CONFIG_HOST_TCMD_SUPPORT
++#include <generated/autoconf.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/spinlock.h>
++#include <linux/skbuff.h>
++#include <linux/if_ether.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <net/iw_handler.h>
++#include <linux/if_arp.h>
++#include <linux/ip.h>
++#include <linux/semaphore.h>
++#include <linux/wireless.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <asm/io.h>
+
-+#define USE_4BYTE_REGISTER_ACCESS
++#include <a_config.h>
++#include <athdefs.h>
++#include "a_types.h"
++#include "a_osapi.h"
++#include "htc_api.h"
++#include "wmi.h"
++#include "a_drv.h"
++#include "bmi.h"
++#include <ieee80211.h>
++#include <ieee80211_ioctl.h>
++#include <wlan_api.h>
++#include <wmi_api.h>
++#include "gpio_api.h"
++#include "gpio.h"
++#include <host_version.h>
++#include <linux/rtnetlink.h>
++#include <linux/init.h>
++#include <linux/moduleparam.h>
++#include "AR6Khwreg.h"
++#include "ar6000_api.h"
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++#include <testcmd.h>
++#endif
+
-+#ifdef __cplusplus
-+}
++#include "targaddrs.h"
++#include "dbglog_api.h"
++#include "ar6000_diag.h"
++#include "common_drv.h"
++
++#ifndef __dev_put
++#define __dev_put(dev) dev_put(dev)
+#endif
+
++#ifdef USER_KEYS
++
++#define USER_SAVEDKEYS_STAT_INIT 0
++#define USER_SAVEDKEYS_STAT_RUN 1
++
++// TODO this needs to move into the AR_SOFTC struct
++struct USER_SAVEDKEYS {
++ struct ieee80211req_key ucast_ik;
++ struct ieee80211req_key bcast_ik;
++ CRYPTO_TYPE keyType;
++ A_BOOL keyOk;
++};
+#endif
-diff --git a/drivers/ar6000/ar6000/debug_linux.h b/drivers/ar6000/ar6000/debug_linux.h
-new file mode 100644
-index 0000000..c74e1df
---- /dev/null
-+++ b/drivers/ar6000/ar6000/debug_linux.h
-@@ -0,0 +1,86 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
+
-+#ifndef _DEBUG_LINUX_H_
-+#define _DEBUG_LINUX_H_
++#define DBG_INFO 0x00000001
++#define DBG_ERROR 0x00000002
++#define DBG_WARNING 0x00000004
++#define DBG_SDIO 0x00000008
++#define DBG_HIF 0x00000010
++#define DBG_HTC 0x00000020
++#define DBG_WMI 0x00000040
++#define DBG_WMI2 0x00000080
++#define DBG_DRIVER 0x00000100
+
+#define DBG_DEFAULTS (DBG_ERROR|DBG_WARNING)
+
-+extern A_UINT32 g_dbg_flags;
+
-+#define DBGFMT "%s() : "
-+#define DBGARG __func__
-+#define DBGFN A_PRINTF
++#ifdef DEBUG
++#define AR_DEBUG_PRINTF(args...) if (debugdriver) A_PRINTF(args);
++#define AR_DEBUG2_PRINTF(args...) if (debugdriver >= 2) A_PRINTF(args);
++extern int debugdriver;
++#else
++#define AR_DEBUG_PRINTF(args...)
++#define AR_DEBUG2_PRINTF(args...)
++#endif
++
++A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#define MAX_AR6000 1
++#define AR6000_MAX_RX_BUFFERS 16
++#define AR6000_BUFFER_SIZE 1664
++#define AR6000_TX_TIMEOUT 10
++#define AR6000_ETH_ADDR_LEN 6
++#define AR6000_MAX_ENDPOINTS 4
++#define MAX_NODE_NUM 15
++#define MAX_COOKIE_NUM 150
++#define AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT 1
++#define AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT 1
+
-+/* ------- Debug related stuff ------- */
+enum {
-+ ATH_DEBUG_SEND = 0x0001,
-+ ATH_DEBUG_RECV = 0x0002,
-+ ATH_DEBUG_SYNC = 0x0004,
-+ ATH_DEBUG_DUMP = 0x0008,
-+ ATH_DEBUG_IRQ = 0x0010,
-+ ATH_DEBUG_TRC = 0x0020,
-+ ATH_DEBUG_WARN = 0x0040,
-+ ATH_DEBUG_ERR = 0x0080,
-+ ATH_LOG_INF = 0x0100,
-+ ATH_DEBUG_BMI = 0x0110,
-+ ATH_DEBUG_WMI = 0x0120,
-+ ATH_DEBUG_HIF = 0x0140,
-+ ATH_DEBUG_HTC = 0x0180,
-+ ATH_DEBUG_WLAN = 0x1000,
-+ ATH_LOG_ERR = 0x1010,
-+ ATH_DEBUG_ANY = 0xFFFF,
++ DRV_HB_CHALLENGE = 0,
++ APP_HB_CHALLENGE
+};
+
-+#ifdef DEBUG
++/* HTC RAW streams */
++typedef enum _HTC_RAW_STREAM_ID {
++ HTC_RAW_STREAM_NOT_MAPPED = -1,
++ HTC_RAW_STREAM_0 = 0,
++ HTC_RAW_STREAM_1 = 1,
++ HTC_RAW_STREAM_2 = 2,
++ HTC_RAW_STREAM_3 = 3,
++ HTC_RAW_STREAM_NUM_MAX
++} HTC_RAW_STREAM_ID;
+
-+#define A_DPRINTF(f, a) \
-+ if(g_dbg_flags & (f)) \
-+ { \
-+ DBGFN a ; \
-+ }
++#define RAW_HTC_READ_BUFFERS_NUM 4
++#define RAW_HTC_WRITE_BUFFERS_NUM 4
+
++typedef struct {
++ int currPtr;
++ int length;
++ unsigned char data[AR6000_BUFFER_SIZE];
++ HTC_PACKET HTCPacket;
++} raw_htc_buffer;
+
-+// TODO FIX usage of A_PRINTF!
-+#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc) do { \
-+ if (debughtc & ATH_DEBUG_DUMP) { \
-+ DebugDumpBytes(buffer, length,desc); \
-+ } \
-+} while(0)
-+#define PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(flags, args) do { \
-+ if (debughtc & (flags)) { \
-+ A_PRINTF(KERN_ALERT PRINTX_ARG args); \
-+ } \
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++/*
++ * add TCMD_MODE besides wmi and bypasswmi
++ * in TCMD_MODE, only few TCMD releated wmi commands
++ * counld be hanlder
++ */
++enum {
++ AR6000_WMI_MODE = 0,
++ AR6000_BYPASS_MODE,
++ AR6000_TCMD_MODE,
++ AR6000_WLAN_MODE
++};
++#endif /* CONFIG_HOST_TCMD_SUPPORT */
++
++struct ar_wep_key {
++ A_UINT8 arKeyIndex;
++ A_UINT8 arKeyLen;
++ A_UINT8 arKey[64];
++} ;
++
++struct ar_node_mapping {
++ A_UINT8 macAddress[6];
++ A_UINT8 epId;
++ A_UINT8 txPending;
++};
++
++struct ar_cookie {
++ A_UINT32 arc_bp[2]; /* Must be first field */
++ HTC_PACKET HtcPkt; /* HTC packet wrapper */
++ struct ar_cookie *arc_list_next;
++};
++
++struct ar_hb_chlng_resp {
++ A_TIMER timer;
++ A_UINT32 frequency;
++ A_UINT32 seqNum;
++ A_BOOL outstanding;
++ A_UINT8 missCnt;
++ A_UINT8 missThres;
++};
++
++typedef struct ar6_softc {
++ struct net_device *arNetDev; /* net_device pointer */
++ void *arWmi;
++ int arTxPending[WMI_PRI_MAX_COUNT];
++ int arTotalTxDataPending;
++ A_UINT8 arNumDataEndPts;
++ A_BOOL arWmiEnabled;
++ A_BOOL arWmiReady;
++ A_BOOL arConnected;
++ A_BOOL arRadioSwitch;
++ HTC_HANDLE arHtcTarget;
++ void *arHifDevice;
++ spinlock_t arLock;
++ struct semaphore arSem;
++ int arRxBuffers[WMI_PRI_MAX_COUNT];
++ int arSsidLen;
++ u_char arSsid[32];
++ A_UINT8 arNetworkType;
++ A_UINT8 arDot11AuthMode;
++ A_UINT8 arAuthMode;
++ A_UINT8 arPairwiseCrypto;
++ A_UINT8 arPairwiseCryptoLen;
++ A_UINT8 arGroupCrypto;
++ A_UINT8 arGroupCryptoLen;
++ A_UINT8 arDefTxKeyIndex;
++ struct ar_wep_key arWepKeyList[WMI_MAX_KEY_INDEX + 1];
++ A_UINT8 arBssid[6];
++ A_UINT8 arReqBssid[6];
++ A_UINT16 arChannelHint;
++ A_UINT16 arBssChannel;
++ A_UINT16 arListenInterval;
++ struct ar6000_version arVersion;
++ A_UINT32 arTargetType;
++ A_INT8 arRssi;
++ A_UINT8 arTxPwr;
++ A_BOOL arTxPwrSet;
++ A_INT32 arBitRate;
++ struct net_device_stats arNetStats;
++ struct iw_statistics arIwStats;
++ A_INT8 arNumChannels;
++ A_UINT16 arChannelList[32];
++ A_UINT32 arRegCode;
++ A_BOOL statsUpdatePending;
++ TARGET_STATS arTargetStats;
++ A_INT8 arMaxRetries;
++ A_UINT8 arPhyCapability;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++ A_UINT8 tcmdRxReport;
++ A_UINT32 tcmdRxTotalPkt;
++ A_INT32 tcmdRxRssi;
++ A_UINT32 tcmdPm;
++ A_UINT32 arTargetMode;
++#endif
++ AR6000_WLAN_STATE arWlanState;
++ struct ar_node_mapping arNodeMap[MAX_NODE_NUM];
++ A_UINT8 arIbssPsEnable;
++ A_UINT8 arNodeNum;
++ A_UINT8 arNexEpId;
++ struct ar_cookie *arCookieList;
++ A_UINT16 arRateMask;
++ A_UINT8 arSkipScan;
++ A_UINT16 arBeaconInterval;
++ A_BOOL arConnectPending;
++ A_BOOL arWmmEnabled;
++ struct ar_hb_chlng_resp arHBChallengeResp;
++ A_UINT8 arKeepaliveConfigured;
++ A_UINT32 arMgmtFilter;
++ HTC_ENDPOINT_ID arWmi2EpMapping[WMI_PRI_MAX_COUNT];
++ WMI_PRI_STREAM_ID arEp2WmiMapping[ENDPOINT_MAX];
++#ifdef HTC_RAW_INTERFACE
++ HTC_ENDPOINT_ID arRaw2EpMapping[HTC_RAW_STREAM_NUM_MAX];
++ HTC_RAW_STREAM_ID arEp2RawMapping[ENDPOINT_MAX];
++ struct semaphore raw_htc_read_sem[HTC_RAW_STREAM_NUM_MAX];
++ struct semaphore raw_htc_write_sem[HTC_RAW_STREAM_NUM_MAX];
++ wait_queue_head_t raw_htc_read_queue[HTC_RAW_STREAM_NUM_MAX];
++ wait_queue_head_t raw_htc_write_queue[HTC_RAW_STREAM_NUM_MAX];
++ raw_htc_buffer *raw_htc_read_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_READ_BUFFERS_NUM];
++ raw_htc_buffer *raw_htc_write_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_WRITE_BUFFERS_NUM];
++ A_BOOL write_buffer_available[HTC_RAW_STREAM_NUM_MAX];
++ A_BOOL read_buffer_available[HTC_RAW_STREAM_NUM_MAX];
++#endif
++ A_BOOL arRawIfInit;
++ int arDeviceIndex;
++ COMMON_CREDIT_STATE_INFO arCreditStateInfo;
++ A_BOOL arWMIControlEpFull;
++ A_BOOL dbgLogFetchInProgress;
++ A_UCHAR log_buffer[DBGLOG_HOST_LOG_BUFFER_SIZE];
++ A_UINT32 log_cnt;
++ A_UINT32 dbglog_init_done;
++ A_UINT32 arConnectCtrlFlags;
++ A_UINT32 scan_complete;
++#ifdef USER_KEYS
++ A_INT32 user_savedkeys_stat;
++ A_UINT32 user_key_ctrl;
++ struct USER_SAVEDKEYS user_saved_keys;
++#endif
++} AR_SOFTC_T;
++
++
++#define arWMIStream2EndpointID(ar,wmi) (ar)->arWmi2EpMapping[(wmi)]
++#define arSetWMIStream2EndpointIDMap(ar,wmi,ep) \
++{ (ar)->arWmi2EpMapping[(wmi)] = (ep); \
++ (ar)->arEp2WmiMapping[(ep)] = (wmi); }
++#define arEndpoint2WMIStreamID(ar,ep) (ar)->arEp2WmiMapping[(ep)]
++
++#define arRawIfEnabled(ar) (ar)->arRawIfInit
++#define arRawStream2EndpointID(ar,raw) (ar)->arRaw2EpMapping[(raw)]
++#define arSetRawStream2EndpointIDMap(ar,raw,ep) \
++{ (ar)->arRaw2EpMapping[(raw)] = (ep); \
++ (ar)->arEp2RawMapping[(ep)] = (raw); }
++#define arEndpoint2RawStreamID(ar,ep) (ar)->arEp2RawMapping[(ep)]
++
++struct ar_giwscan_param {
++ char *current_ev;
++ char *end_buf;
++ A_BOOL firstPass;
++};
++
++#define AR6000_STAT_INC(ar, stat) (ar->arNetStats.stat++)
++
++#define AR6000_SPIN_LOCK(lock, param) do { \
++ if (irqs_disabled()) { \
++ AR_DEBUG_PRINTF("IRQs disabled:AR6000_LOCK\n"); \
++ } \
++ spin_lock_bh(lock); \
+} while (0)
-+#define AR_DEBUG_ASSERT(test) do { \
-+ if (!(test)) { \
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test)); \
-+ } \
-+} while(0)
-+extern int debughtc;
-+#else
-+#define AR_DEBUG_PRINTF(flags, args)
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
-+#define AR_DEBUG_ASSERT(test)
-+#define AR_DEBUG_LVL_CHECK(lvl) 0
-+#define A_DPRINTF(f, a)
++
++#define AR6000_SPIN_UNLOCK(lock, param) do { \
++ if (irqs_disabled()) { \
++ AR_DEBUG_PRINTF("IRQs disabled: AR6000_UNLOCK\n"); \
++ } \
++ spin_unlock_bh(lock); \
++} while (0)
++
++int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
++int ar6000_ioctl_dispatcher(struct net_device *dev, struct ifreq *rq, int cmd);
++void ar6000_ioctl_iwsetup(struct iw_handler_def *def);
++void ar6000_gpio_init(void);
++void ar6000_init_profile_info(AR_SOFTC_T *ar);
++void ar6000_install_static_wep_keys(AR_SOFTC_T *ar);
++int ar6000_init(struct net_device *dev);
++int ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar);
++A_STATUS ar6000_SetHTCBlockSize(AR_SOFTC_T *ar);
++
++#ifdef HTC_RAW_INTERFACE
++
++#ifndef __user
++#define __user
+#endif
+
-+#endif /* _DEBUG_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/ioctl.c b/drivers/ar6000/ar6000/ioctl.c
++int ar6000_htc_raw_open(AR_SOFTC_T *ar);
++int ar6000_htc_raw_close(AR_SOFTC_T *ar);
++ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar,
++ HTC_RAW_STREAM_ID StreamID,
++ char __user *buffer, size_t count);
++ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar,
++ HTC_RAW_STREAM_ID StreamID,
++ char __user *buffer, size_t count);
++
++#endif /* HTC_RAW_INTERFACE */
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _AR6000_H_ */
+diff --git a/drivers/ar6000/ar6000/ar6000_raw_if.c b/drivers/ar6000/ar6000/ar6000_raw_if.c
new file mode 100644
-index 0000000..04aa911
+index 0000000..4443bb2
--- /dev/null
-+++ b/drivers/ar6000/ar6000/ioctl.c
-@@ -0,0 +1,2532 @@
++++ b/drivers/ar6000/ar6000/ar6000_raw_if.c
+@@ -0,0 +1,440 @@
+/*
+ *
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+
+#include "ar6000_drv.h"
+
-+static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-+static A_UINT8 null_mac[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
-+extern USER_RSSI_THOLD rssi_map[12];
-+extern unsigned int wmitimeout;
-+extern A_WAITQUEUE_HEAD arEvent;
-+extern int tspecCompliance;
-+extern int bypasswmi;
++#ifdef HTC_RAW_INTERFACE
+
-+static int
-+ar6000_ioctl_get_roam_tbl(struct net_device *dev, struct ifreq *rq)
++static void
++ar6000_htc_raw_read_cb(void *Context, HTC_PACKET *pPacket)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
++ raw_htc_buffer *busy;
++ HTC_RAW_STREAM_ID streamID;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ busy = (raw_htc_buffer *)pPacket->pPktContext;
++ A_ASSERT(busy != NULL);
+
-+ if(wmi_get_roam_tbl_cmd(ar->arWmi) != A_OK) {
-+ return -EIO;
++ if (pPacket->Status == A_ECANCELED) {
++ /*
++ * HTC provides A_ECANCELED status when it doesn't want to be refilled
++ * (probably due to a shutdown)
++ */
++ return;
+ }
+
-+ return 0;
-+}
-+
-+static int
-+ar6000_ioctl_get_roam_data(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
++ A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
++#ifdef CF
++ if (down_trylock(&ar->raw_htc_read_sem[streamID])) {
++#else
++ if (down_interruptible(&ar->raw_htc_read_sem[streamID])) {
++#endif /* CF */
++ AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
+ }
+
++ A_ASSERT((pPacket->Status != A_OK) ||
++ (pPacket->pBuffer == (busy->data + HTC_HEADER_LEN)));
+
-+ /* currently assume only roam times are required */
-+ if(wmi_get_roam_data_cmd(ar->arWmi, ROAM_DATA_TIME) != A_OK) {
-+ return -EIO;
-+ }
-+
++ busy->length = pPacket->ActualLength + HTC_HEADER_LEN;
++ busy->currPtr = HTC_HEADER_LEN;
++ ar->read_buffer_available[streamID] = TRUE;
++ //AR_DEBUG_PRINTF("raw read cb: 0x%X 0x%X \n", busy->currPtr,busy->length);
++ up(&ar->raw_htc_read_sem[streamID]);
+
-+ return 0;
++ /* Signal the waiting process */
++ AR_DEBUG2_PRINTF("Waking up the StreamID(%d) read process\n", streamID);
++ wake_up_interruptible(&ar->raw_htc_read_queue[streamID]);
+}
+
-+static int
-+ar6000_ioctl_set_roam_ctrl(struct net_device *dev, char *userdata)
++static void
++ar6000_htc_raw_write_cb(void *Context, HTC_PACKET *pPacket)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_ROAM_CTRL_CMD cmd;
-+ A_UINT8 size = sizeof(cmd);
-+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)Context;
++ raw_htc_buffer *free;
++ HTC_RAW_STREAM_ID streamID;
+
++ free = (raw_htc_buffer *)pPacket->pPktContext;
++ A_ASSERT(free != NULL);
+
-+ if (copy_from_user(&cmd, userdata, size)) {
-+ return -EFAULT;
++ if (pPacket->Status == A_ECANCELED) {
++ /*
++ * HTC provides A_ECANCELED status when it doesn't want to be refilled
++ * (probably due to a shutdown)
++ */
++ return;
+ }
+
-+ if (cmd.roamCtrlType == WMI_SET_HOST_BIAS) {
-+ if (cmd.info.bssBiasInfo.numBss > 1) {
-+ size += (cmd.info.bssBiasInfo.numBss - 1) * sizeof(WMI_BSS_BIAS);
-+ }
-+ }
++ streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
++ A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+
-+ if (copy_from_user(&cmd, userdata, size)) {
-+ return -EFAULT;
++#ifdef CF
++ if (down_trylock(&ar->raw_htc_write_sem[streamID])) {
++#else
++ if (down_interruptible(&ar->raw_htc_write_sem[streamID])) {
++#endif
++ AR_DEBUG2_PRINTF("Unable to down the semaphore\n");
+ }
+
-+ if(wmi_set_roam_ctrl_cmd(ar->arWmi, &cmd, size) != A_OK) {
-+ return -EIO;
-+ }
++ A_ASSERT(pPacket->pBuffer == (free->data + HTC_HEADER_LEN));
+
-+ return 0;
-+}
++ free->length = 0;
++ ar->write_buffer_available[streamID] = TRUE;
++ up(&ar->raw_htc_write_sem[streamID]);
+
-+static int
-+ar6000_ioctl_set_powersave_timers(struct net_device *dev, char *userdata)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_POWERSAVE_TIMERS_POLICY_CMD cmd;
-+ A_UINT8 size = sizeof(cmd);
++ /* Signal the waiting process */
++ AR_DEBUG2_PRINTF("Waking up the StreamID(%d) write process\n", streamID);
++ wake_up_interruptible(&ar->raw_htc_write_queue[streamID]);
++}
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++/* connect to a service */
++static A_STATUS ar6000_connect_raw_service(AR_SOFTC_T *ar,
++ HTC_RAW_STREAM_ID StreamID)
++{
++ A_STATUS status;
++ HTC_SERVICE_CONNECT_RESP response;
++ A_UINT8 streamNo;
++ HTC_SERVICE_CONNECT_REQ connect;
+
-+ if (copy_from_user(&cmd, userdata, size)) {
-+ return -EFAULT;
-+ }
++ do {
+
-+ if (copy_from_user(&cmd, userdata, size)) {
-+ return -EFAULT;
-+ }
++ A_MEMZERO(&connect,sizeof(connect));
++ /* pass the stream ID as meta data to the RAW streams service */
++ streamNo = (A_UINT8)StreamID;
++ connect.pMetaData = &streamNo;
++ connect.MetaDataLength = sizeof(A_UINT8);
++ /* these fields are the same for all endpoints */
++ connect.EpCallbacks.pContext = ar;
++ connect.EpCallbacks.EpTxComplete = ar6000_htc_raw_write_cb;
++ connect.EpCallbacks.EpRecv = ar6000_htc_raw_read_cb;
++ /* simple interface, we don't need these optional callbacks */
++ connect.EpCallbacks.EpRecvRefill = NULL;
++ connect.EpCallbacks.EpSendFull = NULL;
++ connect.EpCallbacks.EpSendAvail = NULL;
++ connect.MaxSendQueueDepth = RAW_HTC_WRITE_BUFFERS_NUM;
+
-+ if(wmi_set_powersave_timers_cmd(ar->arWmi, &cmd, size) != A_OK) {
-+ return -EIO;
-+ }
++ /* connect to the raw streams service, we may be able to get 1 or more
++ * connections, depending on WHAT is running on the target */
++ connect.ServiceID = HTC_RAW_STREAMS_SVC;
+
-+ return 0;
-+}
++ A_MEMZERO(&response,sizeof(response));
+
-+static int
-+ar6000_ioctl_set_wmm(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_WMM_CMD cmd;
-+ A_STATUS ret;
++ /* try to connect to the raw stream, it is okay if this fails with
++ * status HTC_SERVICE_NO_MORE_EP */
++ status = HTCConnectService(ar->arHtcTarget,
++ &connect,
++ &response);
+
-+ if ((dev->flags & IFF_UP) != IFF_UP) {
-+ return -EIO;
-+ }
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ if (A_FAILED(status)) {
++ if (response.ConnectRespCode == HTC_SERVICE_NO_MORE_EP) {
++ AR_DEBUG_PRINTF("HTC RAW , No more streams allowed \n");
++ status = A_OK;
++ }
++ break;
++ }
+
-+ if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-+ sizeof(cmd)))
-+ {
-+ return -EFAULT;
-+ }
++ /* set endpoint mapping for the RAW HTC streams */
++ arSetRawStream2EndpointIDMap(ar,StreamID,response.Endpoint);
+
-+ if (cmd.status == WMI_WMM_ENABLED) {
-+ ar->arWmmEnabled = TRUE;
-+ } else {
-+ ar->arWmmEnabled = FALSE;
-+ }
++ AR_DEBUG_PRINTF("HTC RAW : stream ID: %d, endpoint: %d\n",
++ StreamID, arRawStream2EndpointID(ar,StreamID));
+
-+ ret = wmi_set_wmm_cmd(ar->arWmi, cmd.status);
++ } while (FALSE);
+
-+ switch (ret) {
-+ case A_OK:
-+ return 0;
-+ case A_EBUSY :
-+ return -EBUSY;
-+ case A_NO_MEMORY:
-+ return -ENOMEM;
-+ case A_EINVAL:
-+ default:
-+ return -EFAULT;
-+ }
++ return status;
+}
+
-+static int
-+ar6000_ioctl_set_txop(struct net_device *dev, struct ifreq *rq)
++int ar6000_htc_raw_open(AR_SOFTC_T *ar)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_WMM_TXOP_CMD cmd;
-+ A_STATUS ret;
-+
-+ if ((dev->flags & IFF_UP) != IFF_UP) {
-+ return -EIO;
-+ }
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ A_STATUS status;
++ int streamID, endPt, count2;
++ raw_htc_buffer *buffer;
++ HTC_SERVICE_ID servicepriority;
+
-+ if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
-+ sizeof(cmd)))
-+ {
-+ return -EFAULT;
-+ }
++ A_ASSERT(ar->arHtcTarget != NULL);
+
-+ ret = wmi_set_wmm_txop(ar->arWmi, cmd.txopEnable);
++ /* wait for target */
++ status = HTCWaitTarget(ar->arHtcTarget);
+
-+ switch (ret) {
-+ case A_OK:
-+ return 0;
-+ case A_EBUSY :
-+ return -EBUSY;
-+ case A_NO_MEMORY:
-+ return -ENOMEM;
-+ case A_EINVAL:
-+ default:
-+ return -EFAULT;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF("HTCWaitTarget failed (%d)\n", status);
++ return -ENODEV;
+ }
-+}
-+
-+static int
-+ar6000_ioctl_get_rd(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_STATUS ret = 0;
+
-+ if ((dev->flags & IFF_UP) != IFF_UP || ar->arWmiReady == FALSE) {
-+ return -EIO;
++ for (endPt = 0; endPt < ENDPOINT_MAX; endPt++) {
++ ar->arEp2RawMapping[endPt] = HTC_RAW_STREAM_NOT_MAPPED;
+ }
+
-+ if(copy_to_user((char *)((unsigned int*)rq->ifr_data + 1),
-+ &ar->arRegCode, sizeof(ar->arRegCode)))
-+ ret = -EFAULT;
++ for (streamID = HTC_RAW_STREAM_0; streamID < HTC_RAW_STREAM_NUM_MAX; streamID++) {
++ /* Initialize the data structures */
++ init_MUTEX(&ar->raw_htc_read_sem[streamID]);
++ init_MUTEX(&ar->raw_htc_write_sem[streamID]);
++ init_waitqueue_head(&ar->raw_htc_read_queue[streamID]);
++ init_waitqueue_head(&ar->raw_htc_write_queue[streamID]);
+
-+ return ret;
-+}
++ /* try to connect to the raw service */
++ status = ar6000_connect_raw_service(ar,streamID);
+
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+/* Get power mode command */
-+static int
-+ar6000_ioctl_get_power_mode(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_POWER_MODE_CMD power_mode;
-+ int ret = 0;
++ if (arRawStream2EndpointID(ar,streamID) == 0) {
++ break;
++ }
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ for (count2 = 0; count2 < RAW_HTC_READ_BUFFERS_NUM; count2 ++) {
++ /* Initialize the receive buffers */
++ buffer = ar->raw_htc_write_buffer[streamID][count2];
++ memset(buffer, 0, sizeof(raw_htc_buffer));
++ buffer = ar->raw_htc_read_buffer[streamID][count2];
++ memset(buffer, 0, sizeof(raw_htc_buffer));
+
-+ power_mode.powerMode = wmi_get_power_mode_cmd(ar->arWmi);
-+ if (copy_to_user(rq->ifr_data, &power_mode, sizeof(WMI_POWER_MODE_CMD))) {
-+ ret = -EFAULT;
-+ }
++ SET_HTC_PACKET_INFO_RX_REFILL(&buffer->HTCPacket,
++ buffer,
++ buffer->data,
++ AR6000_BUFFER_SIZE,
++ arRawStream2EndpointID(ar,streamID));
+
-+ return ret;
-+}
++ /* Queue buffers to HTC for receive */
++ if ((status = HTCAddReceivePkt(ar->arHtcTarget, &buffer->HTCPacket)) != A_OK)
++ {
++ BMIInit();
++ return -EIO;
++ }
++ }
+
++ for (count2 = 0; count2 < RAW_HTC_WRITE_BUFFERS_NUM; count2 ++) {
++ /* Initialize the receive buffers */
++ buffer = ar->raw_htc_write_buffer[streamID][count2];
++ memset(buffer, 0, sizeof(raw_htc_buffer));
++ }
+
-+static int
-+ar6000_ioctl_set_channelParams(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_CHANNEL_PARAMS_CMD cmd, *cmdp;
-+ int ret = 0;
++ ar->read_buffer_available[streamID] = FALSE;
++ ar->write_buffer_available[streamID] = TRUE;
++ }
+
-+ if (ar->arWmiReady == FALSE) {
++ if (A_FAILED(status)) {
+ return -EIO;
+ }
+
++ AR_DEBUG_PRINTF("HTC RAW, number of streams the target supports: %d \n", streamID);
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
-+
-+ if (cmd.numChannels > 1) {
-+ cmdp = A_MALLOC(130);
-+ if (copy_from_user(cmdp, rq->ifr_data,
-+ sizeof (*cmdp) +
-+ ((cmd.numChannels - 1) * sizeof(A_UINT16))))
-+ {
-+ kfree(cmdp);
-+ return -EFAULT;
-+ }
-+ } else {
-+ cmdp = &cmd;
-+ }
++ servicepriority = HTC_RAW_STREAMS_SVC; /* only 1 */
+
-+ if ((ar->arPhyCapability == WMI_11G_CAPABILITY) &&
-+ ((cmdp->phyMode == WMI_11A_MODE) || (cmdp->phyMode == WMI_11AG_MODE)))
-+ {
-+ ret = -EINVAL;
-+ }
++ /* set callbacks and priority list */
++ HTCSetCreditDistribution(ar->arHtcTarget,
++ ar,
++ NULL, /* use default */
++ NULL, /* use default */
++ &servicepriority,
++ 1);
+
-+ if (!ret &&
-+ (wmi_set_channelParams_cmd(ar->arWmi, cmdp->scanParam, cmdp->phyMode,
-+ cmdp->numChannels, cmdp->channelList)
-+ != A_OK))
-+ {
-+ ret = -EIO;
++ /* Start the HTC component */
++ if ((status = HTCStart(ar->arHtcTarget)) != A_OK) {
++ BMIInit();
++ return -EIO;
+ }
+
-+ if (cmd.numChannels > 1) {
-+ kfree(cmdp);
-+ }
++ (ar)->arRawIfInit = TRUE;
+
-+ return ret;
++ return 0;
+}
+
-+static int
-+ar6000_ioctl_set_snr_threshold(struct net_device *dev, struct ifreq *rq)
++int ar6000_htc_raw_close(AR_SOFTC_T *ar)
+{
++ A_PRINTF("ar6000_htc_raw_close called \n");
++ HTCStop(ar->arHtcTarget);
+
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
-+ int ret = 0;
++ /* reset the device */
++ ar6000_reset_device(ar->arHifDevice, ar->arTargetType);
++ /* Initialize the BMI component */
++ BMIInit();
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ return 0;
++}
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++raw_htc_buffer *
++get_filled_buffer(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID)
++{
++ int count;
++ raw_htc_buffer *busy;
+
-+ if( wmi_set_snr_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+ ret = -EIO;
++ /* Check for data */
++ for (count = 0; count < RAW_HTC_READ_BUFFERS_NUM; count ++) {
++ busy = ar->raw_htc_read_buffer[StreamID][count];
++ if (busy->length) {
++ break;
++ }
++ }
++ if (busy->length) {
++ ar->read_buffer_available[StreamID] = TRUE;
++ } else {
++ ar->read_buffer_available[StreamID] = FALSE;
+ }
+
-+ return ret;
++ return busy;
+}
+
-+static int
-+ar6000_ioctl_set_rssi_threshold(struct net_device *dev, struct ifreq *rq)
++ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
++ char __user *buffer, size_t length)
+{
-+#define SWAP_THOLD(thold1, thold2) do { \
-+ USER_RSSI_THOLD tmpThold; \
-+ tmpThold.tag = thold1.tag; \
-+ tmpThold.rssi = thold1.rssi; \
-+ thold1.tag = thold2.tag; \
-+ thold1.rssi = thold2.rssi; \
-+ thold2.tag = tmpThold.tag; \
-+ thold2.rssi = tmpThold.rssi; \
-+} while (0)
-+
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
-+ USER_RSSI_PARAMS rssiParams;
-+ A_INT32 i, j;
-+
-+ int ret = 0;
++ int readPtr;
++ raw_htc_buffer *busy;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
++ if (arRawStream2EndpointID(ar,StreamID) == 0) {
++ AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
++ return -EFAULT;
+ }
+
-+ if (copy_from_user((char *)&rssiParams, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(USER_RSSI_PARAMS))) {
-+ return -EFAULT;
++ if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
++ return -ERESTARTSYS;
+ }
-+ cmd.weight = rssiParams.weight;
-+ cmd.pollTime = rssiParams.pollTime;
+
-+ A_MEMCPY(rssi_map, &rssiParams.tholds, sizeof(rssi_map));
-+ /*
-+ * only 6 elements, so use bubble sorting, in ascending order
-+ */
-+ for (i = 5; i > 0; i--) {
-+ for (j = 0; j < i; j++) { /* above tholds */
-+ if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
-+ SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
-+ } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
-+ return EFAULT;
-+ }
++ busy = get_filled_buffer(ar,StreamID);
++ while (!ar->read_buffer_available[StreamID]) {
++ up(&ar->raw_htc_read_sem[StreamID]);
++
++ /* Wait for the data */
++ AR_DEBUG2_PRINTF("Sleeping StreamID(%d) read process\n", StreamID);
++ if (wait_event_interruptible(ar->raw_htc_read_queue[StreamID],
++ ar->read_buffer_available[StreamID]))
++ {
++ return -EINTR;
+ }
-+ }
-+ for (i = 11; i > 6; i--) {
-+ for (j = 6; j < i; j++) { /* below tholds */
-+ if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
-+ SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
-+ } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
-+ return EFAULT;
-+ }
++ if (down_interruptible(&ar->raw_htc_read_sem[StreamID])) {
++ return -ERESTARTSYS;
+ }
++ busy = get_filled_buffer(ar,StreamID);
+ }
+
-+#ifdef DEBUG
-+ for (i = 0; i < 12; i++) {
-+ AR_DEBUG2_PRINTF("thold[%d].tag: %d, thold[%d].rssi: %d \n",
-+ i, rssi_map[i].tag, i, rssi_map[i].rssi);
++ /* Read the data */
++ readPtr = busy->currPtr;
++ if (length > busy->length - HTC_HEADER_LEN) {
++ length = busy->length - HTC_HEADER_LEN;
++ }
++ if (copy_to_user(buffer, &busy->data[readPtr], length)) {
++ up(&ar->raw_htc_read_sem[StreamID]);
++ return -EFAULT;
+ }
-+#endif
-+ cmd.thresholdAbove1_Val = rssi_map[0].rssi;
-+ cmd.thresholdAbove2_Val = rssi_map[1].rssi;
-+ cmd.thresholdAbove3_Val = rssi_map[2].rssi;
-+ cmd.thresholdAbove4_Val = rssi_map[3].rssi;
-+ cmd.thresholdAbove5_Val = rssi_map[4].rssi;
-+ cmd.thresholdAbove6_Val = rssi_map[5].rssi;
-+ cmd.thresholdBelow1_Val = rssi_map[6].rssi;
-+ cmd.thresholdBelow2_Val = rssi_map[7].rssi;
-+ cmd.thresholdBelow3_Val = rssi_map[8].rssi;
-+ cmd.thresholdBelow4_Val = rssi_map[9].rssi;
-+ cmd.thresholdBelow5_Val = rssi_map[10].rssi;
-+ cmd.thresholdBelow6_Val = rssi_map[11].rssi;
+
-+ if( wmi_set_rssi_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+ ret = -EIO;
++ busy->currPtr += length;
++
++ //AR_DEBUG_PRINTF("raw read ioctl: currPTR : 0x%X 0x%X \n", busy->currPtr,busy->length);
++
++ if (busy->currPtr == busy->length)
++ {
++ busy->currPtr = 0;
++ busy->length = 0;
++ HTC_PACKET_RESET_RX(&busy->HTCPacket);
++ //AR_DEBUG_PRINTF("raw read ioctl: ep for packet:%d \n", busy->HTCPacket.Endpoint);
++ HTCAddReceivePkt(ar->arHtcTarget, &busy->HTCPacket);
+ }
++ ar->read_buffer_available[StreamID] = FALSE;
++ up(&ar->raw_htc_read_sem[StreamID]);
+
-+ return ret;
++ return length;
+}
+
-+static int
-+ar6000_ioctl_set_lq_threshold(struct net_device *dev, struct ifreq *rq)
++static raw_htc_buffer *
++get_free_buffer(AR_SOFTC_T *ar, HTC_ENDPOINT_ID StreamID)
+{
++ int count;
++ raw_htc_buffer *free;
+
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_LQ_THRESHOLD_PARAMS_CMD cmd;
-+ int ret = 0;
-+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+
-+ if (copy_from_user(&cmd, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(cmd))) {
-+ return -EFAULT;
++ free = NULL;
++ for (count = 0; count < RAW_HTC_WRITE_BUFFERS_NUM; count ++) {
++ free = ar->raw_htc_write_buffer[StreamID][count];
++ if (free->length == 0) {
++ break;
++ }
+ }
-+
-+ if( wmi_set_lq_threshold_params(ar->arWmi, &cmd) != A_OK ) {
-+ ret = -EIO;
++ if (!free->length) {
++ ar->write_buffer_available[StreamID] = TRUE;
++ } else {
++ ar->write_buffer_available[StreamID] = FALSE;
+ }
+
-+ return ret;
++ return free;
+}
+
-+
-+static int
-+ar6000_ioctl_set_probedSsid(struct net_device *dev, struct ifreq *rq)
++ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
++ char __user *buffer, size_t length)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_PROBED_SSID_CMD cmd;
-+ int ret = 0;
-+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ int writePtr;
++ raw_htc_buffer *free;
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ if (arRawStream2EndpointID(ar,StreamID) == 0) {
++ AR_DEBUG_PRINTF("StreamID(%d) not connected! \n", StreamID);
+ return -EFAULT;
+ }
+
-+ if (wmi_probedSsid_cmd(ar->arWmi, cmd.entryIndex, cmd.flag, cmd.ssidLength,
-+ cmd.ssid) != A_OK)
-+ {
-+ ret = -EIO;
++ if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
++ return -ERESTARTSYS;
+ }
+
-+ return ret;
-+}
++ /* Search for a free buffer */
++ free = get_free_buffer(ar,StreamID);
+
-+static int
-+ar6000_ioctl_set_badAp(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_ADD_BAD_AP_CMD cmd;
-+ int ret = 0;
++ /* Check if there is space to write else wait */
++ while (!ar->write_buffer_available[StreamID]) {
++ up(&ar->raw_htc_write_sem[StreamID]);
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
++ /* Wait for buffer to become free */
++ AR_DEBUG2_PRINTF("Sleeping StreamID(%d) write process\n", StreamID);
++ if (wait_event_interruptible(ar->raw_htc_write_queue[StreamID],
++ ar->write_buffer_available[StreamID]))
++ {
++ return -EINTR;
++ }
++ if (down_interruptible(&ar->raw_htc_write_sem[StreamID])) {
++ return -ERESTARTSYS;
++ }
++ free = get_free_buffer(ar,StreamID);
+ }
+
++ /* Send the data */
++ writePtr = HTC_HEADER_LEN;
++ if (length > (AR6000_BUFFER_SIZE - HTC_HEADER_LEN)) {
++ length = AR6000_BUFFER_SIZE - HTC_HEADER_LEN;
++ }
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ if (copy_from_user(&free->data[writePtr], buffer, length)) {
++ up(&ar->raw_htc_read_sem[StreamID]);
+ return -EFAULT;
+ }
+
-+ if (cmd.badApIndex > WMI_MAX_BAD_AP_INDEX) {
-+ return -EIO;
-+ }
++ free->length = length;
+
-+ if (A_MEMCMP(cmd.bssid, null_mac, AR6000_ETH_ADDR_LEN) == 0) {
-+ /*
-+ * This is a delete badAP.
-+ */
-+ if (wmi_deleteBadAp_cmd(ar->arWmi, cmd.badApIndex) != A_OK) {
-+ ret = -EIO;
-+ }
-+ } else {
-+ if (wmi_addBadAp_cmd(ar->arWmi, cmd.badApIndex, cmd.bssid) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
++ SET_HTC_PACKET_INFO_TX(&free->HTCPacket,
++ free,
++ &free->data[writePtr],
++ length,
++ arRawStream2EndpointID(ar,StreamID),
++ AR6K_DATA_PKT_TAG);
+
-+ return ret;
-+}
++ HTCSendPkt(ar->arHtcTarget,&free->HTCPacket);
+
-+static int
-+ar6000_ioctl_create_qos(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_CREATE_PSTREAM_CMD cmd;
-+ A_STATUS ret;
++ ar->write_buffer_available[StreamID] = FALSE;
++ up(&ar->raw_htc_write_sem[StreamID]);
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ return length;
++}
++#endif /* HTC_RAW_INTERFACE */
+diff --git a/drivers/ar6000/ar6000/ar6xapi_linux.h b/drivers/ar6000/ar6000/ar6xapi_linux.h
+new file mode 100644
+index 0000000..b8e6e09
+--- /dev/null
++++ b/drivers/ar6000/ar6000/ar6xapi_linux.h
+@@ -0,0 +1,128 @@
++#ifndef _AR6XAPI_LINUX_H
++#define _AR6XAPI_LINUX_H
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++struct ar6_softc;
+
-+ ret = wmi_verify_tspec_params(&cmd, tspecCompliance);
-+ if (ret == A_OK)
-+ ret = wmi_create_pstream_cmd(ar->arWmi, &cmd);
++void ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap);
++A_UINT8 ar6000_iptos_to_userPriority(A_UINT8 *pkt);
++A_STATUS ar6000_control_tx(void *devt, void *osbuf, WMI_PRI_STREAM_ID streamID);
++void ar6000_connect_event(struct ar6_softc *ar, A_UINT16 channel,
++ A_UINT8 *bssid, A_UINT16 listenInterval,
++ A_UINT16 beaconInterval, NETWORK_TYPE networkType,
++ A_UINT8 beaconIeLen, A_UINT8 assocReqLen,
++ A_UINT8 assocRespLen,A_UINT8 *assocInfo);
++void ar6000_disconnect_event(struct ar6_softc *ar, A_UINT8 reason,
++ A_UINT8 *bssid, A_UINT8 assocRespLen,
++ A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus);
++void ar6000_tkip_micerr_event(struct ar6_softc *ar, A_UINT8 keyid,
++ A_BOOL ismcast);
++void ar6000_bitrate_rx(void *devt, A_INT32 rateKbps);
++void ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList);
++void ar6000_regDomain_event(struct ar6_softc *ar, A_UINT32 regCode);
++void ar6000_txPwr_rx(void *devt, A_UINT8 txPwr);
++void ar6000_keepalive_rx(void *devt, A_UINT8 configured);
++void ar6000_neighborReport_event(struct ar6_softc *ar, int numAps,
++ WMI_NEIGHBOR_INFO *info);
++void ar6000_set_numdataendpts(struct ar6_softc *ar, A_UINT32 num);
++void ar6000_scanComplete_event(struct ar6_softc *ar, A_STATUS status);
++void ar6000_targetStats_event(struct ar6_softc *ar, WMI_TARGET_STATS *pStats);
++void ar6000_rssiThreshold_event(struct ar6_softc *ar,
++ WMI_RSSI_THRESHOLD_VAL newThreshold,
++ A_INT16 rssi);
++void ar6000_reportError_event(struct ar6_softc *, WMI_TARGET_ERROR_VAL errorVal);
++void ar6000_cac_event(struct ar6_softc *ar, A_UINT8 ac, A_UINT8 cac_indication,
++ A_UINT8 statusCode, A_UINT8 *tspecSuggestion);
++void ar6000_hbChallengeResp_event(struct ar6_softc *, A_UINT32 cookie, A_UINT32 source);
++void
++ar6000_roam_tbl_event(struct ar6_softc *ar, WMI_TARGET_ROAM_TBL *pTbl);
+
-+ switch (ret) {
-+ case A_OK:
-+ return 0;
-+ case A_EBUSY :
-+ return -EBUSY;
-+ case A_NO_MEMORY:
-+ return -ENOMEM;
-+ case A_EINVAL:
-+ default:
-+ return -EFAULT;
-+ }
-+}
++void
++ar6000_roam_data_event(struct ar6_softc *ar, WMI_TARGET_ROAM_DATA *p);
+
-+static int
-+ar6000_ioctl_delete_qos(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_DELETE_PSTREAM_CMD cmd;
-+ int ret = 0;
++void
++ar6000_wow_list_event(struct ar6_softc *ar, A_UINT8 num_filters,
++ WMI_GET_WOW_LIST_REPLY *wow_reply);
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++void ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID,
++ WMI_PMKID *pmkidList);
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++void ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values);
++void ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value);
++void ar6000_gpio_ack_rx(void);
+
-+ ret = wmi_delete_pstream_cmd(ar->arWmi, cmd.trafficClass, cmd.tsid);
++void ar6000_dbglog_init_done(struct ar6_softc *ar);
+
-+ switch (ret) {
-+ case A_OK:
-+ return 0;
-+ case A_EBUSY :
-+ return -EBUSY;
-+ case A_NO_MEMORY:
-+ return -ENOMEM;
-+ case A_EINVAL:
-+ default:
-+ return -EFAULT;
-+ }
-+}
++#ifdef SEND_EVENT_TO_APP
++void ar6000_send_event_to_app(struct ar6_softc *ar, A_UINT16 eventId, A_UINT8 *datap, int len);
++#endif
+
-+static int
-+ar6000_ioctl_get_qos_queue(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ar6000_queuereq qreq;
-+ int ret = 0;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++void ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len);
++#endif
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++void ar6000_tx_retry_err_event(void *devt);
+
-+ if( copy_from_user(&qreq, rq->ifr_data,
-+ sizeof(struct ar6000_queuereq)))
-+ return -EFAULT;
++void ar6000_snrThresholdEvent_rx(void *devt,
++ WMI_SNR_THRESHOLD_VAL newThreshold,
++ A_UINT8 snr);
+
-+ qreq.activeTsids = wmi_get_mapped_qos_queue(ar->arWmi, qreq.trafficClass);
++void ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL range, A_UINT8 lqVal);
+
-+ if (copy_to_user(rq->ifr_data, &qreq,
-+ sizeof(struct ar6000_queuereq)))
-+ {
-+ ret = -EFAULT;
-+ }
+
-+ return ret;
-+}
++void ar6000_ratemask_rx(void *devt, A_UINT16 ratemask);
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+static A_STATUS
-+ar6000_ioctl_tcmd_get_rx_report(struct net_device *dev,
-+ struct ifreq *rq, A_UINT8 *data, A_UINT32 len)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_UINT32 buf[2];
-+ int ret = 0;
++A_STATUS ar6000_get_driver_cfg(struct net_device *dev,
++ A_UINT16 cfgParam,
++ void *result);
++void ar6000_bssInfo_event_rx(struct ar6_softc *ar, A_UINT8 *data, int len);
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++void ar6000_dbglog_event(struct ar6_softc *ar, A_UINT32 dropped,
++ A_INT8 *buffer, A_UINT32 length);
+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ ar->tcmdRxReport = 0;
-+ if (wmi_test_cmd(ar->arWmi, data, len) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
+
-+ wait_event_interruptible_timeout(arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
++void ar6000_indicate_tx_activity(void *devt, A_UINT8 trafficClass, A_BOOL Active);
+
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
++void ar6000_dset_open_req(void *devt,
++ A_UINT32 id,
++ A_UINT32 targ_handle,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg);
++void ar6000_dset_close(void *devt, A_UINT32 access_cookie);
++void ar6000_dset_data_req(void *devt,
++ A_UINT32 access_cookie,
++ A_UINT32 offset,
++ A_UINT32 length,
++ A_UINT32 targ_buf,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg);
+
-+ buf[0] = ar->tcmdRxTotalPkt;
-+ buf[1] = ar->tcmdRxRssi;
-+ if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
-+ ret = -EFAULT;
-+ }
+
-+ up(&ar->arSem);
+
-+ return ret;
++#ifdef __cplusplus
+}
++#endif
+
-+void
-+ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
-+ TCMD_CONT_RX * rx_rep = (TCMD_CONT_RX *)results;
++#endif
+diff --git a/drivers/ar6000/ar6000/athdrv_linux.h b/drivers/ar6000/ar6000/athdrv_linux.h
+new file mode 100644
+index 0000000..9c3e449
+--- /dev/null
++++ b/drivers/ar6000/ar6000/athdrv_linux.h
+@@ -0,0 +1,993 @@
++/*
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ ar->tcmdRxTotalPkt = rx_rep->u.report.totalPkt;
-+ ar->tcmdRxRssi = rx_rep->u.report.rssiInDBm;
-+ ar->tcmdRxReport = 1;
++#ifndef _ATHDRV_LINUX_H
++#define _ATHDRV_LINUX_H
+
-+ wake_up(&arEvent);
-+}
-+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+static int
-+ar6000_ioctl_set_error_report_bitmask(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_TARGET_ERROR_REPORT_BITMASK cmd;
-+ int ret = 0;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++/*
++ * There are two types of ioctl's here: Standard ioctls and
++ * eXtended ioctls. All extended ioctls (XIOCTL) are multiplexed
++ * off of the single ioctl command, AR6000_IOCTL_EXTENDED. The
++ * arguments for every XIOCTL starts with a 32-bit command word
++ * that is used to select which extended ioctl is in use. After
++ * the command word are command-specific arguments.
++ */
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++/* Linux standard Wireless Extensions, private ioctl interfaces */
++#define IEEE80211_IOCTL_SETPARAM (SIOCIWFIRSTPRIV+0)
++#define IEEE80211_IOCTL_GETPARAM (SIOCIWFIRSTPRIV+1)
++#define IEEE80211_IOCTL_SETKEY (SIOCIWFIRSTPRIV+2)
++#define IEEE80211_IOCTL_SETWMMPARAMS (SIOCIWFIRSTPRIV+3)
++#define IEEE80211_IOCTL_DELKEY (SIOCIWFIRSTPRIV+4)
++#define IEEE80211_IOCTL_GETWMMPARAMS (SIOCIWFIRSTPRIV+5)
++#define IEEE80211_IOCTL_SETOPTIE (SIOCIWFIRSTPRIV+6)
++#define IEEE80211_IOCTL_SETMLME (SIOCIWFIRSTPRIV+7)
++//#define IEEE80211_IOCTL_GETOPTIE (SIOCIWFIRSTPRIV+7)
++#define IEEE80211_IOCTL_ADDPMKID (SIOCIWFIRSTPRIV+8)
++//#define IEEE80211_IOCTL_SETAUTHALG (SIOCIWFIRSTPRIV+10)
++#define IEEE80211_IOCTL_LASTONE (SIOCIWFIRSTPRIV+9)
+
-+ ret = wmi_set_error_report_bitmask(ar->arWmi, cmd.bitmask);
+
-+ return (ret==0 ? ret : -EINVAL);
-+}
+
-+static int
-+ar6000_clear_target_stats(struct net_device *dev)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ TARGET_STATS *pStats = &ar->arTargetStats;
-+ int ret = 0;
++/* ====WMI Ioctls==== */
++/*
++ *
++ * Many ioctls simply provide WMI services to application code:
++ * an application makes such an ioctl call with a set of arguments
++ * that are packaged into the corresponding WMI message, and sent
++ * to the Target.
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ A_MEMZERO(pStats, sizeof(TARGET_STATS));
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ return ret;
-+}
++#define AR6000_IOCTL_WMI_GETREV (SIOCIWFIRSTPRIV+10)
++/*
++ * arguments:
++ * ar6000_version *revision
++ */
+
-+static int
-+ar6000_ioctl_get_target_stats(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ TARGET_STATS_CMD cmd;
-+ TARGET_STATS *pStats = &ar->arTargetStats;
-+ int ret = 0;
++#define AR6000_IOCTL_WMI_SETPWR (SIOCIWFIRSTPRIV+11)
++/*
++ * arguments:
++ * WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
++ * uses: WMI_SET_POWER_MODE_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
++#define AR6000_IOCTL_WMI_SETSCAN (SIOCIWFIRSTPRIV+12)
++/*
++ * arguments:
++ * WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
++ * uses: WMI_SET_SCAN_PARAMS_CMDID
++ */
+
-+ ar->statsUpdatePending = TRUE;
++#define AR6000_IOCTL_WMI_SETLISTENINT (SIOCIWFIRSTPRIV+13)
++/*
++ * arguments:
++ * UINT32 listenInterval
++ * uses: WMI_SET_LISTEN_INT_CMDID
++ */
+
-+ if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++#define AR6000_IOCTL_WMI_SETBSSFILTER (SIOCIWFIRSTPRIV+14)
++/*
++ * arguments:
++ * WMI_BSS_FILTER filter (see include/wmi.h)
++ * uses: WMI_SET_BSS_FILTER_CMDID
++ */
+
-+ wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
++#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS (SIOCIWFIRSTPRIV+16)
++/*
++ * arguments:
++ * WMI_CHANNEL_PARAMS_CMD chParams
++ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
++ */
+
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
++#define AR6000_IOCTL_WMI_SET_PROBEDSSID (SIOCIWFIRSTPRIV+17)
++/*
++ * arguments:
++ * WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
++ * uses: WMI_SETPROBED_SSID_CMDID
++ */
+
-+ if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
-+ ret = -EFAULT;
-+ }
++#define AR6000_IOCTL_WMI_SET_PMPARAMS (SIOCIWFIRSTPRIV+18)
++/*
++ * arguments:
++ * WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
++ * uses: WMI_SET_POWER_PARAMS_CMDID
++ */
+
-+ if (cmd.clearStats == 1) {
-+ ret = ar6000_clear_target_stats(dev);
-+ }
++#define AR6000_IOCTL_WMI_SET_BADAP (SIOCIWFIRSTPRIV+19)
++/*
++ * arguments:
++ * WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
++ * uses: WMI_ADD_BAD_AP_CMDID
++ */
+
-+ up(&ar->arSem);
++#define AR6000_IOCTL_WMI_GET_QOS_QUEUE (SIOCIWFIRSTPRIV+20)
++/*
++ * arguments:
++ * ar6000_queuereq queueRequest (see below)
++ */
+
-+ return ret;
-+}
++#define AR6000_IOCTL_WMI_CREATE_QOS (SIOCIWFIRSTPRIV+21)
++/*
++ * arguments:
++ * WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
++ * uses: WMI_CREATE_PSTREAM_CMDID
++ */
+
-+static int
-+ar6000_ioctl_set_access_params(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_ACCESS_PARAMS_CMD cmd;
-+ int ret = 0;
++#define AR6000_IOCTL_WMI_DELETE_QOS (SIOCIWFIRSTPRIV+22)
++/*
++ * arguments:
++ * WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
++ * uses: WMI_DELETE_PSTREAM_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD (SIOCIWFIRSTPRIV+23)
++/*
++ * arguments:
++ * WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
++ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
++ */
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
++/*
++ * arguments:
++ * WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
++ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
++ */
+
-+ if (wmi_set_access_params_cmd(ar->arWmi, cmd.txop, cmd.eCWmin, cmd.eCWmax,
-+ cmd.aifsn) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
++#define AR6000_IOCTL_WMI_GET_TARGET_STATS (SIOCIWFIRSTPRIV+25)
++/*
++ * arguments:
++ * TARGET_STATS *targetStats (see below)
++ * uses: WMI_GET_STATISTICS_CMDID
++ */
+
-+ return (ret);
-+}
++#define AR6000_IOCTL_WMI_SET_ASSOC_INFO (SIOCIWFIRSTPRIV+26)
++/*
++ * arguments:
++ * WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
++ * uses: WMI_SET_ASSOC_INFO_CMDID
++ */
+
-+static int
-+ar6000_ioctl_set_disconnect_timeout(struct net_device *dev, struct ifreq *rq)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_DISC_TIMEOUT_CMD cmd;
-+ int ret = 0;
++#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS (SIOCIWFIRSTPRIV+27)
++/*
++ * arguments:
++ * WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
++ * uses: WMI_SET_ACCESS_PARAMS_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++#define AR6000_IOCTL_WMI_SET_BMISS_TIME (SIOCIWFIRSTPRIV+28)
++/*
++ * arguments:
++ * UINT32 beaconMissTime
++ * uses: WMI_SET_BMISS_TIME_CMDID
++ */
+
-+ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT (SIOCIWFIRSTPRIV+29)
++/*
++ * arguments:
++ * WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
++ * uses: WMI_SET_DISC_TIMEOUT_CMDID
++ */
+
-+ if (wmi_disctimeout_cmd(ar->arWmi, cmd.disconnectTimeout) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
++#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS (SIOCIWFIRSTPRIV+30)
++/*
++ * arguments:
++ * WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
++ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
++ */
+
-+ return (ret);
-+}
++/*
++ * There is a very small space available for driver-private
++ * wireless ioctls. In order to circumvent this limitation,
++ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
++ * single AR6000_IOCTL_EXTENDED ioctl.
++ */
++#define AR6000_IOCTL_EXTENDED (SIOCIWFIRSTPRIV+31)
+
-+static int
-+ar6000_xioctl_set_voice_pkt_size(struct net_device *dev, char * userdata)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_VOICE_PKT_SIZE_CMD cmd;
-+ int ret = 0;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++/* ====BMI Extended Ioctls==== */
+
-+ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_BMI_DONE 1
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
++ * uses: BMI_DONE
++ */
+
-+ if (wmi_set_voice_pkt_size_cmd(ar->arWmi, cmd.voicePktSize) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
++#define AR6000_XIOCTL_BMI_READ_MEMORY 2
++/*
++ * arguments:
++ * union {
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
++ * UINT32 address
++ * UINT32 length
++ * }
++ * char results[length]
++ * }
++ * uses: BMI_READ_MEMORY
++ */
+
++#define AR6000_XIOCTL_BMI_WRITE_MEMORY 3
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
++ * UINT32 address
++ * UINT32 length
++ * char data[length]
++ * uses: BMI_WRITE_MEMORY
++ */
+
-+ return (ret);
-+}
++#define AR6000_XIOCTL_BMI_EXECUTE 4
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
++ * UINT32 TargetAddress
++ * UINT32 parameter
++ * uses: BMI_EXECUTE
++ */
+
-+static int
-+ar6000_xioctl_set_max_sp_len(struct net_device *dev, char * userdata)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_MAX_SP_LEN_CMD cmd;
-+ int ret = 0;
++#define AR6000_XIOCTL_BMI_SET_APP_START 5
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
++ * UINT32 TargetAddress
++ * uses: BMI_SET_APP_START
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER 6
++/*
++ * arguments:
++ * union {
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
++ * UINT32 TargetAddress, 32-bit aligned
++ * }
++ * UINT32 result
++ * }
++ * uses: BMI_READ_SOC_REGISTER
++ */
+
-+ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER 7
++/*
++ * arguments:
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
++ * UINT32 TargetAddress, 32-bit aligned
++ * UINT32 newValue
++ * }
++ * uses: BMI_WRITE_SOC_REGISTER
++ */
+
-+ if (wmi_set_max_sp_len_cmd(ar->arWmi, cmd.maxSPLen) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
++#define AR6000_XIOCTL_BMI_TEST 8
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
++ * UINT32 address
++ * UINT32 length
++ * UINT32 count
++ */
+
-+ return (ret);
-+}
+
+
-+static int
-+ar6000_xioctl_set_bt_status_cmd(struct net_device *dev, char * userdata)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_BT_STATUS_CMD cmd;
-+ int ret = 0;
++/* Historical Host-side DataSet support */
++#define AR6000_XIOCTL_UNUSED9 9
++#define AR6000_XIOCTL_UNUSED10 10
++#define AR6000_XIOCTL_UNUSED11 11
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++/* ====Misc Extended Ioctls==== */
+
-+ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_FORCE_TARGET_RESET 12
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
++ */
+
-+ if (wmi_set_bt_status_cmd(ar->arWmi, cmd.streamType, cmd.status) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
+
-+ return (ret);
-+}
++#ifdef HTC_RAW_INTERFACE
++/* HTC Raw Interface Ioctls */
++#define AR6000_XIOCTL_HTC_RAW_OPEN 13
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
++ */
+
-+static int
-+ar6000_xioctl_set_bt_params_cmd(struct net_device *dev, char * userdata)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_SET_BT_PARAMS_CMD cmd;
-+ int ret = 0;
++#define AR6000_XIOCTL_HTC_RAW_CLOSE 14
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++#define AR6000_XIOCTL_HTC_RAW_READ 15
++/*
++ * arguments:
++ * union {
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
++ * UINT32 mailboxID
++ * UINT32 length
++ * }
++ * results[length]
++ * }
++ */
+
-+ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_HTC_RAW_WRITE 16
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
++ * UINT32 mailboxID
++ * UINT32 length
++ * char buffer[length]
++ */
++#endif /* HTC_RAW_INTERFACE */
+
-+ if (wmi_set_bt_params_cmd(ar->arWmi, &cmd) == A_OK)
-+ {
-+ ret = 0;
-+ } else {
-+ ret = -EINVAL;
-+ }
++#define AR6000_XIOCTL_CHECK_TARGET_READY 17
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
++ */
+
-+ return (ret);
-+}
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+struct ar6000_gpio_intr_wait_cmd_s gpio_intr_results;
-+/* gpio_reg_results and gpio_data_available are protected by arSem */
-+static struct ar6000_gpio_register_cmd_s gpio_reg_results;
-+static A_BOOL gpio_data_available; /* Requested GPIO data available */
-+static A_BOOL gpio_intr_available; /* GPIO interrupt info available */
-+static A_BOOL gpio_ack_received; /* GPIO ack was received */
+
-+/* Host-side initialization for General Purpose I/O support */
-+void ar6000_gpio_init(void)
-+{
-+ gpio_intr_available = FALSE;
-+ gpio_data_available = FALSE;
-+ gpio_ack_received = FALSE;
-+}
++/* ====GPIO (General Purpose I/O) Extended Ioctls==== */
+
++#define AR6000_XIOCTL_GPIO_OUTPUT_SET 18
+/*
-+ * Called when a GPIO interrupt is received from the Target.
-+ * intr_values shows which GPIO pins have interrupted.
-+ * input_values shows a recent value of GPIO pins.
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
++ * ar6000_gpio_output_set_cmd_s (see below)
++ * uses: WMIX_GPIO_OUTPUT_SET_CMDID
+ */
-+void
-+ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values)
-+{
-+ gpio_intr_results.intr_mask = intr_mask;
-+ gpio_intr_results.input_values = input_values;
-+ *((volatile A_BOOL *)&gpio_intr_available) = TRUE;
-+ wake_up(&arEvent);
-+}
+
++#define AR6000_XIOCTL_GPIO_INPUT_GET 19
+/*
-+ * This is called when a response is received from the Target
-+ * for a previous or ar6000_gpio_input_get or ar6000_gpio_register_get
-+ * call.
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
++ * uses: WMIX_GPIO_INPUT_GET_CMDID
+ */
-+void
-+ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value)
-+{
-+ gpio_reg_results.gpioreg_id = reg_id;
-+ gpio_reg_results.value = value;
-+ *((volatile A_BOOL *)&gpio_data_available) = TRUE;
-+ wake_up(&arEvent);
-+}
+
++#define AR6000_XIOCTL_GPIO_REGISTER_SET 20
+/*
-+ * This is called when an acknowledgement is received from the Target
-+ * for a previous or ar6000_gpio_output_set or ar6000_gpio_register_set
-+ * call.
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
++ * ar6000_gpio_register_cmd_s (see below)
++ * uses: WMIX_GPIO_REGISTER_SET_CMDID
+ */
-+void
-+ar6000_gpio_ack_rx(void)
-+{
-+ gpio_ack_received = TRUE;
-+ wake_up(&arEvent);
-+}
-+
-+A_STATUS
-+ar6000_gpio_output_set(struct net_device *dev,
-+ A_UINT32 set_mask,
-+ A_UINT32 clear_mask,
-+ A_UINT32 enable_mask,
-+ A_UINT32 disable_mask)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ gpio_ack_received = FALSE;
-+ return wmi_gpio_output_set(ar->arWmi,
-+ set_mask, clear_mask, enable_mask, disable_mask);
-+}
++#define AR6000_XIOCTL_GPIO_REGISTER_GET 21
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
++ * ar6000_gpio_register_cmd_s (see below)
++ * uses: WMIX_GPIO_REGISTER_GET_CMDID
++ */
+
-+static A_STATUS
-+ar6000_gpio_input_get(struct net_device *dev)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++#define AR6000_XIOCTL_GPIO_INTR_ACK 22
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
++ * ar6000_cpio_intr_ack_cmd_s (see below)
++ * uses: WMIX_GPIO_INTR_ACK_CMDID
++ */
+
-+ *((volatile A_BOOL *)&gpio_data_available) = FALSE;
-+ return wmi_gpio_input_get(ar->arWmi);
-+}
++#define AR6000_XIOCTL_GPIO_INTR_WAIT 23
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
++ */
+
-+static A_STATUS
-+ar6000_gpio_register_set(struct net_device *dev,
-+ A_UINT32 gpioreg_id,
-+ A_UINT32 value)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ gpio_ack_received = FALSE;
-+ return wmi_gpio_register_set(ar->arWmi, gpioreg_id, value);
-+}
+
-+static A_STATUS
-+ar6000_gpio_register_get(struct net_device *dev,
-+ A_UINT32 gpioreg_id)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++/* ====more wireless commands==== */
+
-+ *((volatile A_BOOL *)&gpio_data_available) = FALSE;
-+ return wmi_gpio_register_get(ar->arWmi, gpioreg_id);
-+}
++#define AR6000_XIOCTL_SET_ADHOC_BSSID 24
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
++ * WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
++ */
+
-+static A_STATUS
-+ar6000_gpio_intr_ack(struct net_device *dev,
-+ A_UINT32 ack_mask)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++#define AR6000_XIOCTL_SET_OPT_MODE 25
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
++ * WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
++ * uses: WMI_SET_OPT_MODE_CMDID
++ */
+
-+ gpio_intr_available = FALSE;
-+ return wmi_gpio_intr_ack(ar->arWmi, ack_mask);
-+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
++#define AR6000_XIOCTL_OPT_SEND_FRAME 26
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
++ * WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
++ * uses: WMI_OPT_TX_FRAME_CMDID
++ */
+
-+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ HIF_DEVICE *hifDevice = ar->arHifDevice;
-+ int ret, param, param2;
-+ unsigned int address = 0;
-+ unsigned int length = 0;
-+ unsigned char *buffer;
-+ char *userdata;
-+ A_UINT32 connectCtrlFlags;
++#define AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL 27
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL)
++ * WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
++ * uses: WMI_SET_BEACON_INT_CMDID
++ */
+
+
-+ static WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
-+ WMI_SHORTSCANRATIO_DEFAULT,
-+ DEFAULT_SCAN_CTRL_FLAGS,
-+ 0};
-+ WMI_SET_AKMP_PARAMS_CMD akmpParams;
-+ WMI_SET_PMKID_LIST_CMD pmkidInfo;
++#define IEEE80211_IOCTL_SETAUTHALG 28
+
-+ if (cmd == AR6000_IOCTL_EXTENDED)
-+ {
-+ /*
-+ * This allows for many more wireless ioctls than would otherwise
-+ * be available. Applications embed the actual ioctl command in
-+ * the first word of the parameter block, and use the command
-+ * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
-+ */
-+ get_user(cmd, (int *)rq->ifr_data);
-+ userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
-+ }
-+ else
-+ {
-+ userdata = (char *)rq->ifr_data;
-+ }
+
-+ if ((ar->arWlanState == WLAN_DISABLED) &&
-+ ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
-+ (cmd != AR6000_XIOCTL_DIAG_READ) &&
-+ (cmd != AR6000_XIOCTL_DIAG_WRITE)))
-+ {
-+ return -EIO;
-+ }
++#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE 29
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
++ * WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
++ * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
++ */
+
-+ ret = 0;
-+ switch(cmd)
-+ {
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+ case AR6000_XIOCTL_TCMD_CONT_TX:
-+ {
-+ TCMD_CONT_TX txCmd;
+
-+ if (ar->tcmdPm == TCMD_PM_SLEEP) {
-+ A_PRINTF("Can NOT send tx tcmd when target is asleep! \n");
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_SET_MAX_SP 30
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
++ * WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
++ * uses: WMI_SET_MAX_SP_LEN_CMDID
++ */
+
-+ if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX)))
-+ return -EFAULT;
-+ wmi_test_cmd(ar->arWmi,(A_UINT8 *)&txCmd, sizeof(TCMD_CONT_TX));
-+ }
-+ break;
-+ case AR6000_XIOCTL_TCMD_CONT_RX:
-+ {
-+ TCMD_CONT_RX rxCmd;
++#define AR6000_XIOCTL_WMI_GET_ROAM_TBL 31
+
-+ if (ar->tcmdPm == TCMD_PM_SLEEP) {
-+ A_PRINTF("Can NOT send rx tcmd when target is asleep! \n");
-+ return -EFAULT;
-+ }
-+ if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX)))
-+ return -EFAULT;
-+ switch(rxCmd.act)
-+ {
-+ case TCMD_CONT_RX_PROMIS:
-+ case TCMD_CONT_RX_FILTER:
-+ case TCMD_CONT_RX_SETMAC:
-+ wmi_test_cmd(ar->arWmi,(A_UINT8 *)&rxCmd,
-+ sizeof(TCMD_CONT_RX));
-+ break;
-+ case TCMD_CONT_RX_REPORT:
-+ ar6000_ioctl_tcmd_get_rx_report(dev, rq,
-+ (A_UINT8 *)&rxCmd, sizeof(TCMD_CONT_RX));
-+ break;
-+ default:
-+ A_PRINTF("Unknown Cont Rx mode: %d\n",rxCmd.act);
-+ return -EINVAL;
-+ }
-+ }
-+ break;
-+ case AR6000_XIOCTL_TCMD_PM:
-+ {
-+ TCMD_PM pmCmd;
++#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL 32
+
-+ if(copy_from_user(&pmCmd, userdata, sizeof(TCMD_PM)))
-+ return -EFAULT;
-+ ar->tcmdPm = pmCmd.mode;
-+ wmi_test_cmd(ar->arWmi, (A_UINT8*)&pmCmd, sizeof(TCMD_PM));
-+ }
-+ break;
-+#endif /* CONFIG_HOST_TCMD_SUPPORT */
++#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS 33
+
-+ case AR6000_XIOCTL_BMI_DONE:
-+ ret = BMIDone(hifDevice);
-+ break;
+
-+ case AR6000_XIOCTL_BMI_READ_MEMORY:
-+ get_user(address, (unsigned int *)userdata);
-+ get_user(length, (unsigned int *)userdata + 1);
-+ AR_DEBUG_PRINTF("Read Memory (address: 0x%x, length: %d)\n",
-+ address, length);
-+ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+ A_MEMZERO(buffer, length);
-+ ret = BMIReadMemory(hifDevice, address, buffer, length);
-+ if (copy_to_user(rq->ifr_data, buffer, length)) {
-+ ret = -EFAULT;
-+ }
-+ A_FREE(buffer);
-+ } else {
-+ ret = -ENOMEM;
-+ }
-+ break;
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
++ * WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
++ * WMI_SET_POWERSAVE_TIMERS_CMDID
++ */
+
-+ case AR6000_XIOCTL_BMI_WRITE_MEMORY:
-+ get_user(address, (unsigned int *)userdata);
-+ get_user(length, (unsigned int *)userdata + 1);
-+ AR_DEBUG_PRINTF("Write Memory (address: 0x%x, length: %d)\n",
-+ address, length);
-+ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+ A_MEMZERO(buffer, length);
-+ if (copy_from_user(buffer, &userdata[sizeof(address) +
-+ sizeof(length)], length))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = BMIWriteMemory(hifDevice, address, buffer, length);
-+ }
-+ A_FREE(buffer);
-+ } else {
-+ ret = -ENOMEM;
-+ }
-+ break;
++#define AR6000_XIOCTRL_WMI_GET_POWER_MODE 34
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
++ */
+
-+ case AR6000_XIOCTL_BMI_TEST:
-+ AR_DEBUG_PRINTF("No longer supported\n");
-+ ret = -EOPNOTSUPP;
-+ break;
++#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE 35
++typedef enum {
++ WLAN_DISABLED,
++ WLAN_ENABLED
++} AR6000_WLAN_STATE;
++/*
++ * arguments:
++ * enable/disable
++ */
+
-+ case AR6000_XIOCTL_BMI_EXECUTE:
-+ get_user(address, (unsigned int *)userdata);
-+ get_user(param, (unsigned int *)userdata + 1);
-+ AR_DEBUG_PRINTF("Execute (address: 0x%x, param: %d)\n",
-+ address, param);
-+ ret = BMIExecute(hifDevice, address, ¶m);
-+ put_user(param, (unsigned int *)rq->ifr_data); /* return value */
-+ break;
++#define AR6000_XIOCTL_WMI_GET_ROAM_DATA 36
+
-+ case AR6000_XIOCTL_BMI_SET_APP_START:
-+ get_user(address, (unsigned int *)userdata);
-+ AR_DEBUG_PRINTF("Set App Start (address: 0x%x)\n", address);
-+ ret = BMISetAppStart(hifDevice, address);
-+ break;
++#define AR6000_XIOCTL_WMI_SETRETRYLIMITS 37
++/*
++ * arguments:
++ * WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
++ * uses: WMI_SET_RETRY_LIMITS_CMDID
++ */
+
-+ case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
-+ get_user(address, (unsigned int *)userdata);
-+ ret = BMIReadSOCRegister(hifDevice, address, ¶m);
-+ put_user(param, (unsigned int *)rq->ifr_data); /* return value */
-+ break;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++/* ====extended commands for radio test ==== */
+
-+ case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
-+ get_user(address, (unsigned int *)userdata);
-+ get_user(param, (unsigned int *)userdata + 1);
-+ ret = BMIWriteSOCRegister(hifDevice, address, param);
-+ break;
++#define AR6000_XIOCTL_TCMD_CONT_TX 38
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
++ * WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
++ * uses: WMI_TCMD_CONT_TX_CMDID
++ */
+
-+#ifdef HTC_RAW_INTERFACE
-+ case AR6000_XIOCTL_HTC_RAW_OPEN:
-+ ret = A_OK;
-+ if (!arRawIfEnabled(ar)) {
-+ /* make sure block size is set in case the target was reset since last
-+ * BMI phase (i.e. flashup downloads) */
-+ ret = ar6000_SetHTCBlockSize(ar);
-+ if (A_FAILED(ret)) {
-+ break;
-+ }
-+ /* Terminate the BMI phase */
-+ ret = BMIDone(hifDevice);
-+ if (ret == A_OK) {
-+ ret = ar6000_htc_raw_open(ar);
-+ }
-+ }
-+ break;
++#define AR6000_XIOCTL_TCMD_CONT_RX 39
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
++ * WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
++ * uses: WMI_TCMD_CONT_RX_CMDID
++ */
+
-+ case AR6000_XIOCTL_HTC_RAW_CLOSE:
-+ if (arRawIfEnabled(ar)) {
-+ ret = ar6000_htc_raw_close(ar);
-+ arRawIfEnabled(ar) = FALSE;
-+ } else {
-+ ret = A_ERROR;
-+ }
-+ break;
++#define AR6000_XIOCTL_TCMD_PM 40
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
++ * WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
++ * uses: WMI_TCMD_PM_CMDID
++ */
+
-+ case AR6000_XIOCTL_HTC_RAW_READ:
-+ if (arRawIfEnabled(ar)) {
-+ unsigned int streamID;
-+ get_user(streamID, (unsigned int *)userdata);
-+ get_user(length, (unsigned int *)userdata + 1);
-+ buffer = rq->ifr_data + sizeof(length);
-+ ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
-+ buffer, length);
-+ put_user(ret, (unsigned int *)rq->ifr_data);
-+ } else {
-+ ret = A_ERROR;
-+ }
-+ break;
++#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
-+ case AR6000_XIOCTL_HTC_RAW_WRITE:
-+ if (arRawIfEnabled(ar)) {
-+ unsigned int streamID;
-+ get_user(streamID, (unsigned int *)userdata);
-+ get_user(length, (unsigned int *)userdata + 1);
-+ buffer = userdata + sizeof(streamID) + sizeof(length);
-+ ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
-+ buffer, length);
-+ put_user(ret, (unsigned int *)rq->ifr_data);
-+ } else {
-+ ret = A_ERROR;
-+ }
-+ break;
-+#endif /* HTC_RAW_INTERFACE */
++#define AR6000_XIOCTL_WMI_STARTSCAN 41
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
++ * UINT8 scanType
++ * UINT8 scanConnected
++ * A_BOOL forceFgScan
++ * uses: WMI_START_SCAN_CMDID
++ */
+
-+ case AR6000_IOCTL_WMI_GETREV:
-+ {
-+ if (copy_to_user(rq->ifr_data, &ar->arVersion,
-+ sizeof(ar->arVersion)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SETPWR:
-+ {
-+ WMI_POWER_MODE_CMD pwrModeCmd;
++#define AR6000_XIOCTL_WMI_SETFIXRATES 42
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&pwrModeCmd, userdata,
-+ sizeof(pwrModeCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_powermode_cmd(ar->arWmi, pwrModeCmd.powerMode)
-+ != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS:
-+ {
-+ WMI_IBSS_PM_CAPS_CMD ibssPmCaps;
++#define AR6000_XIOCTL_WMI_GETFIXRATES 43
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&ibssPmCaps, userdata,
-+ sizeof(ibssPmCaps)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_ibsspmcaps_cmd(ar->arWmi, ibssPmCaps.power_saving, ibssPmCaps.ttl,
-+ ibssPmCaps.atim_windows, ibssPmCaps.timeout_value) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar->arIbssPsEnable = ibssPmCaps.power_saving;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_PMPARAMS:
-+ {
-+ WMI_POWER_PARAMS_CMD pmParams;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&pmParams, userdata,
-+ sizeof(pmParams)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_pmparams_cmd(ar->arWmi, pmParams.idle_period,
-+ pmParams.pspoll_number,
-+ pmParams.dtim_policy) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SETSCAN:
-+ {
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&scParams, userdata,
-+ sizeof(scParams)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (CAN_SCAN_IN_CONNECT(scParams.scanCtrlFlags)) {
-+ ar->arSkipScan = FALSE;
-+ } else {
-+ ar->arSkipScan = TRUE;
-+ }
++#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD 44
++/*
++ * arguments:
++ * WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
++ * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
++ */
+
-+ if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
-+ scParams.fg_end_period,
-+ scParams.bg_period,
-+ scParams.minact_chdwell_time,
-+ scParams.maxact_chdwell_time,
-+ scParams.pas_chdwell_time,
-+ scParams.shortScanRatio,
-+ scParams.scanCtrlFlags,
-+ scParams.max_dfsch_act_time) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SETLISTENINT:
-+ {
-+ WMI_LISTEN_INT_CMD listenCmd;
++#define AR6000_XIOCTL_WMI_CLR_RSSISNR 45
++/*
++ * arguments:
++ * WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
++ * uses: WMI_CLR_RSSISNR_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&listenCmd, userdata,
-+ sizeof(listenCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_listeninterval_cmd(ar->arWmi, listenCmd.listenInterval, listenCmd.numBeacons) != A_OK) {
-+ ret = -EIO;
-+ } else {
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar->arListenInterval = param;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ }
++#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD 46
++/*
++ * arguments:
++ * WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
++ * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
++ */
+
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_BMISS_TIME:
-+ {
-+ WMI_BMISS_TIME_CMD bmissCmd;
++#define AR6000_XIOCTL_WMI_SET_RTS 47
++/*
++ * arguments:
++ * WMI_SET_RTS_MODE_CMD (see include/wmi.h)
++ * uses: WMI_SET_RTS_MODE_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&bmissCmd, userdata,
-+ sizeof(bmissCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_bmisstime_cmd(ar->arWmi, bmissCmd.bmissTime, bmissCmd.numBeacons) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SETBSSFILTER:
-+ {
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else {
++#define AR6000_XIOCTL_WMI_SET_LPREAMBLE 48
+
-+ get_user(param, (unsigned char *)userdata);
-+ get_user(param2, (unsigned int *)(userdata + 1));
-+ printk("SETBSSFILTER: filter 0x%x, mask: 0x%x\n", param, param2);
-+ if (wmi_bssfilter_cmd(ar->arWmi, param, param2) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
-+ {
-+ ret = ar6000_ioctl_set_snr_threshold(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
-+ {
-+ ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_CLR_RSSISNR:
-+ {
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ }
-+ ret = wmi_clr_rssi_snr(ar->arWmi);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_LQTHRESHOLD:
-+ {
-+ ret = ar6000_ioctl_set_lq_threshold(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_LPREAMBLE:
-+ {
-+ WMI_SET_LPREAMBLE_CMD setLpreambleCmd;
++#define AR6000_XIOCTL_WMI_SET_AUTHMODE 49
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
++ * UINT8 mode
++ * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setLpreambleCmd, userdata,
-+ sizeof(setLpreambleCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_lpreamble_cmd(ar->arWmi, setLpreambleCmd.status)
-+ != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
++#define AR6000_XIOCTL_WMI_SET_REASSOCMODE 50
+
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_RTS:
-+ {
-+ WMI_SET_RTS_CMD rtsCmd;
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
++ * UINT8 mode
++ * uses: WMI_SET_WMM_CMDID
++ */
++#define AR6000_XIOCTL_WMI_SET_WMM 51
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&rtsCmd, userdata,
-+ sizeof(rtsCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_rts_cmd(ar->arWmi, rtsCmd.threshold)
-+ != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
++ * UINT32 frequency
++ * UINT8 threshold
++ */
++#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS 52
+
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_WMM:
-+ {
-+ ret = ar6000_ioctl_set_wmm(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_TXOP:
-+ {
-+ ret = ar6000_ioctl_set_txop(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_GET_RD:
-+ {
-+ ret = ar6000_ioctl_get_rd(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_CHANNELPARAMS:
-+ {
-+ ret = ar6000_ioctl_set_channelParams(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_PROBEDSSID:
-+ {
-+ ret = ar6000_ioctl_set_probedSsid(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_BADAP:
-+ {
-+ ret = ar6000_ioctl_set_badAp(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_CREATE_QOS:
-+ {
-+ ret = ar6000_ioctl_create_qos(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_DELETE_QOS:
-+ {
-+ ret = ar6000_ioctl_delete_qos(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_GET_QOS_QUEUE:
-+ {
-+ ret = ar6000_ioctl_get_qos_queue(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_GET_TARGET_STATS:
-+ {
-+ ret = ar6000_ioctl_get_target_stats(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK:
-+ {
-+ ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
-+ {
-+ WMI_SET_ASSOC_INFO_CMD cmd;
-+ A_UINT8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
++ * UINT32 cookie
++ */
++#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP 53
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else {
-+ get_user(cmd.ieType, userdata);
-+ if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
-+ ret = -EIO;
-+ } else {
-+ get_user(cmd.bufferSize, userdata + 1);
-+ if (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) {
-+ ret = -EFAULT;
-+ break;
-+ }
-+ if (copy_from_user(assocInfo, userdata + 2,
-+ cmd.bufferSize))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
-+ cmd.bufferSize,
-+ assocInfo) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
-+ {
-+ ret = ar6000_ioctl_set_access_params(dev, rq);
-+ break;
-+ }
-+ case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
-+ {
-+ ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
-+ break;
-+ }
-+ case AR6000_XIOCTL_FORCE_TARGET_RESET:
-+ {
-+ if (ar->arHtcTarget)
-+ {
-+// HTCForceReset(htcTarget);
-+ }
-+ else
-+ {
-+ AR_DEBUG_PRINTF("ar6000_ioctl cannot attempt reset.\n");
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_TARGET_INFO:
-+ case AR6000_XIOCTL_CHECK_TARGET_READY: /* backwards compatibility */
-+ {
-+ /* If we made it to here, then the Target exists and is ready. */
-+
-+ if (cmd == AR6000_XIOCTL_TARGET_INFO) {
-+ if (copy_to_user((A_UINT32 *)rq->ifr_data, &ar->arVersion.target_ver,
-+ sizeof(ar->arVersion.target_ver)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ if (copy_to_user(((A_UINT32 *)rq->ifr_data)+1, &ar->arTargetType,
-+ sizeof(ar->arTargetType)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS:
-+ {
-+ WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD hbparam;
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
++ * UINT32 regDomain
++ */
++#define AR6000_XIOCTL_WMI_GET_RD 54
+
-+ if (copy_from_user(&hbparam, userdata, sizeof(hbparam)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ /* Start a cyclic timer with the parameters provided. */
-+ if (hbparam.frequency) {
-+ ar->arHBChallengeResp.frequency = hbparam.frequency;
-+ }
-+ if (hbparam.threshold) {
-+ ar->arHBChallengeResp.missThres = hbparam.threshold;
-+ }
++#define AR6000_XIOCTL_DIAG_READ 55
+
-+ /* Delete the pending timer and start a new one */
-+ if (timer_pending(&ar->arHBChallengeResp.timer)) {
-+ A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
-+ }
-+ A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP:
-+ {
-+ A_UINT32 cookie;
++#define AR6000_XIOCTL_DIAG_WRITE 56
+
-+ if (copy_from_user(&cookie, userdata, sizeof(cookie))) {
-+ return -EFAULT;
-+ }
++/*
++ * arguments cmd (AR6000_XIOCTL_SET_TXOP)
++ * WMI_TXOP_CFG txopEnable
++ */
++#define AR6000_XIOCTL_WMI_SET_TXOP 57
+
-+ /* Send the challenge on the control channel */
-+ if (wmi_get_challenge_resp_cmd(ar->arWmi, cookie, APP_HB_CHALLENGE) != A_OK) {
-+ return -EIO;
-+ }
-+ break;
-+ }
+#ifdef USER_KEYS
-+ case AR6000_XIOCTL_USER_SETKEYS:
-+ {
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
++ * UINT32 keyOpCtrl
++ * uses AR6000_USER_SETKEYS_INFO
++ */
++#define AR6000_XIOCTL_USER_SETKEYS 58
++#endif /* USER_KEYS */
+
-+ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_RUN;
++#define AR6000_XIOCTL_WMI_SET_KEEPALIVE 59
++/*
++ * arguments:
++ * UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
++ * UINT8 keepaliveInterval
++ * uses: WMI_SET_KEEPALIVE_CMDID
++ */
+
-+ if (copy_from_user(&ar->user_key_ctrl, userdata,
-+ sizeof(ar->user_key_ctrl)))
-+ {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_WMI_GET_KEEPALIVE 60
++/*
++ * arguments:
++ * UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
++ * UINT8 keepaliveInterval
++ * A_BOOL configured
++ * uses: WMI_GET_KEEPALIVE_CMDID
++ */
+
-+ A_PRINTF("ar6000 USER set key %x\n", ar->user_key_ctrl);
-+ break;
-+ }
-+#endif /* USER_KEYS */
++/* ====ROM Patching Extended Ioctls==== */
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+ case AR6000_XIOCTL_GPIO_OUTPUT_SET:
-+ {
-+ struct ar6000_gpio_output_set_cmd_s gpio_output_set_cmd;
++#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL 61
++/*
++ * arguments:
++ * union {
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
++ * UINT32 ROM Address
++ * UINT32 RAM Address
++ * UINT32 number of bytes
++ * UINT32 activate? (0 or 1)
++ * }
++ * A_UINT32 resulting rompatch ID
++ * }
++ * uses: BMI_ROMPATCH_INSTALL
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
++#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL 62
++/*
++ * arguments:
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
++ * UINT32 rompatch ID
++ * }
++ * uses: BMI_ROMPATCH_UNINSTALL
++ */
+
-+ if (copy_from_user(&gpio_output_set_cmd, userdata,
-+ sizeof(gpio_output_set_cmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = ar6000_gpio_output_set(dev,
-+ gpio_output_set_cmd.set_mask,
-+ gpio_output_set_cmd.clear_mask,
-+ gpio_output_set_cmd.enable_mask,
-+ gpio_output_set_cmd.disable_mask);
-+ if (ret != A_OK) {
-+ ret = EIO;
-+ }
-+ }
-+ up(&ar->arSem);
-+ break;
-+ }
-+ case AR6000_XIOCTL_GPIO_INPUT_GET:
-+ {
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
++#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE 63
++/*
++ * arguments:
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
++ * UINT32 rompatch count
++ * UINT32 rompatch IDs[rompatch count]
++ * }
++ * uses: BMI_ROMPATCH_ACTIVATE
++ */
+
-+ ret = ar6000_gpio_input_get(dev);
-+ if (ret != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE 64
++/*
++ * arguments:
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
++ * UINT32 rompatch count
++ * UINT32 rompatch IDs[rompatch count]
++ * }
++ * uses: BMI_ROMPATCH_DEACTIVATE
++ */
+
-+ /* Wait for Target to respond. */
-+ wait_event_interruptible(arEvent, gpio_data_available);
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ } else {
-+ A_ASSERT(gpio_reg_results.gpioreg_id == GPIO_ID_NONE);
++#define AR6000_XIOCTL_WMI_SET_APPIE 65
++/*
++ * arguments:
++ * struct {
++ * UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
++ * UINT32 app_frmtype;
++ * UINT32 app_buflen;
++ * UINT8 app_buf[];
++ * }
++ */
++#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER 66
++/*
++ * arguments:
++ * A_UINT32 filter_type;
++ */
+
-+ if (copy_to_user(userdata, &gpio_reg_results.value,
-+ sizeof(gpio_reg_results.value)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ }
-+ up(&ar->arSem);
-+ break;
-+ }
-+ case AR6000_XIOCTL_GPIO_REGISTER_SET:
-+ {
-+ struct ar6000_gpio_register_cmd_s gpio_register_cmd;
++#define AR6000_XIOCTL_DBGLOG_CFG_MODULE 67
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
++#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS 68
+
-+ if (copy_from_user(&gpio_register_cmd, userdata,
-+ sizeof(gpio_register_cmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = ar6000_gpio_register_set(dev,
-+ gpio_register_cmd.gpioreg_id,
-+ gpio_register_cmd.value);
-+ if (ret != A_OK) {
-+ ret = EIO;
-+ }
++#define AR6000_XIOCTL_WMI_SET_WSC_STATUS 70
++/*
++ * arguments:
++ * A_UINT32 wsc_status;
++ * (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
++ */
+
-+ /* Wait for acknowledgement from Target */
-+ wait_event_interruptible(arEvent, gpio_ack_received);
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
-+ }
-+ up(&ar->arSem);
-+ break;
-+ }
-+ case AR6000_XIOCTL_GPIO_REGISTER_GET:
-+ {
-+ struct ar6000_gpio_register_cmd_s gpio_register_cmd;
++/*
++ * arguments:
++ * struct {
++ * A_UINT8 streamType;
++ * A_UINT8 status;
++ * }
++ * uses: WMI_SET_BT_STATUS_CMDID
++ */
++#define AR6000_XIOCTL_WMI_SET_BT_STATUS 71
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
++/*
++ * arguments:
++ * struct {
++ * A_UINT8 paramType;
++ * union {
++ * A_UINT8 noSCOPkts;
++ * BT_PARAMS_A2DP a2dpParams;
++ * BT_COEX_REGS regs;
++ * };
++ * }
++ * uses: WMI_SET_BT_PARAM_CMDID
++ */
++#define AR6000_XIOCTL_WMI_SET_BT_PARAMS 72
+
-+ if (copy_from_user(&gpio_register_cmd, userdata,
-+ sizeof(gpio_register_cmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = ar6000_gpio_register_get(dev, gpio_register_cmd.gpioreg_id);
-+ if (ret != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE 73
++#define AR6000_XIOCTL_WMI_SET_WOW_MODE 74
++#define AR6000_XIOCTL_WMI_GET_WOW_LIST 75
++#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN 76
++#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN 77
+
-+ /* Wait for Target to respond. */
-+ wait_event_interruptible(arEvent, gpio_data_available);
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ } else {
-+ A_ASSERT(gpio_register_cmd.gpioreg_id == gpio_reg_results.gpioreg_id);
-+ if (copy_to_user(userdata, &gpio_reg_results,
-+ sizeof(gpio_reg_results)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ }
-+ }
-+ up(&ar->arSem);
-+ break;
-+ }
-+ case AR6000_XIOCTL_GPIO_INTR_ACK:
-+ {
-+ struct ar6000_gpio_intr_ack_cmd_s gpio_intr_ack_cmd;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
+
-+ if (copy_from_user(&gpio_intr_ack_cmd, userdata,
-+ sizeof(gpio_intr_ack_cmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = ar6000_gpio_intr_ack(dev, gpio_intr_ack_cmd.ack_mask);
-+ if (ret != A_OK) {
-+ ret = EIO;
-+ }
-+ }
-+ up(&ar->arSem);
-+ break;
-+ }
-+ case AR6000_XIOCTL_GPIO_INTR_WAIT:
-+ {
-+ /* Wait for Target to report an interrupt. */
-+ dev_hold(dev);
-+ rtnl_unlock();
-+ wait_event_interruptible(arEvent, gpio_intr_available);
-+ rtnl_lock();
-+ __dev_put(dev);
++#define AR6000_XIOCTL_TARGET_INFO 78
++/*
++ * arguments:
++ * UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
++ * A_UINT32 TargetVersion (returned)
++ * A_UINT32 TargetType (returned)
++ * (See also bmi_msg.h target_ver and target_type)
++ */
+
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ } else {
-+ if (copy_to_user(userdata, &gpio_intr_results,
-+ sizeof(gpio_intr_results)))
-+ {
-+ ret = -EFAULT;
-+ }
-+ }
-+ break;
-+ }
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
++#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE 79
++/*
++ * arguments:
++ * none
++ */
+
-+ case AR6000_XIOCTL_DBGLOG_CFG_MODULE:
-+ {
-+ struct ar6000_dbglog_module_config_s config;
++#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE 80
++/*
++ * This ioctl is used to emulate traffic activity
++ * timeouts. Activity/inactivity will trigger the driver
++ * to re-balance credits.
++ *
++ * arguments:
++ * ar6000_traffic_activity_change
++ */
+
-+ if (copy_from_user(&config, userdata, sizeof(config))) {
-+ return -EFAULT;
-+ }
++#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS 81
++/*
++ * This ioctl is used to set the connect control flags
++ *
++ * arguments:
++ * A_UINT32 connectCtrlFlags
++ */
+
-+ /* Send the challenge on the control channel */
-+ if (wmi_config_debug_module_cmd(ar->arWmi, config.mmask,
-+ config.tsr, config.rep,
-+ config.size, config.valid) != A_OK)
-+ {
-+ return -EIO;
-+ }
-+ break;
-+ }
++#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS 82
++/*
++ * This IOCTL sets any Authentication,Key Management and Protection
++ * related parameters. This is used along with the information set in
++ * Connect Command.
++ * Currently this enables Multiple PMKIDs to an AP.
++ *
++ * arguments:
++ * struct {
++ * A_UINT32 akmpInfo;
++ * }
++ * uses: WMI_SET_AKMP_PARAMS_CMD
++ */
+
-+ case AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS:
-+ {
-+ /* Send the challenge on the control channel */
-+ if (ar6000_dbglog_get_debug_logs(ar) != A_OK)
-+ {
-+ return -EIO;
-+ }
-+ break;
-+ }
++#define AR6000_XIOCTL_WMI_GET_PMKID_LIST 83
+
-+ case AR6000_XIOCTL_SET_ADHOC_BSSID:
-+ {
-+ WMI_SET_ADHOC_BSSID_CMD adhocBssid;
++#define AR6000_XIOCTL_WMI_SET_PMKID_LIST 84
++/*
++ * This IOCTL is used to set a list of PMKIDs. This list of
++ * PMKIDs is used in the [Re]AssocReq Frame. This list is used
++ * only if the MultiPMKID option is enabled via the
++ * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS IOCTL.
++ *
++ * arguments:
++ * struct {
++ * A_UINT32 numPMKID;
++ * WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
++ * }
++ * uses: WMI_SET_PMKIDLIST_CMD
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&adhocBssid, userdata,
-+ sizeof(adhocBssid)))
-+ {
-+ ret = -EFAULT;
-+ } else if (A_MEMCMP(adhocBssid.bssid, bcast_mac,
-+ AR6000_ETH_ADDR_LEN) == 0)
-+ {
-+ ret = -EFAULT;
-+ } else {
++/* Historical DSETPATCH support for INI patches */
++#define AR6000_XIOCTL_UNUSED90 90
+
-+ A_MEMCPY(ar->arReqBssid, adhocBssid.bssid, sizeof(ar->arReqBssid));
-+ }
-+ break;
-+ }
+
-+ case AR6000_XIOCTL_SET_OPT_MODE:
-+ {
-+ WMI_SET_OPT_MODE_CMD optModeCmd;
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&optModeCmd, userdata,
-+ sizeof(optModeCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else if (ar->arConnected && optModeCmd.optMode == SPECIAL_ON) {
-+ ret = -EFAULT;
++/* used by AR6000_IOCTL_WMI_GETREV */
++struct ar6000_version {
++ A_UINT32 host_ver;
++ A_UINT32 target_ver;
++};
+
-+ } else if (wmi_set_opt_mode_cmd(ar->arWmi, optModeCmd.optMode)
-+ != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ break;
-+ }
++/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
++struct ar6000_queuereq {
++ A_UINT8 trafficClass;
++ A_UINT16 activeTsids;
++};
+
-+ case AR6000_XIOCTL_OPT_SEND_FRAME:
-+ {
-+ WMI_OPT_TX_FRAME_CMD optTxFrmCmd;
-+ A_UINT8 data[MAX_OPT_DATA_LEN];
++/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
++typedef struct targetStats_t {
++ A_UINT64 tx_packets;
++ A_UINT64 tx_bytes;
++ A_UINT64 tx_unicast_pkts;
++ A_UINT64 tx_unicast_bytes;
++ A_UINT64 tx_multicast_pkts;
++ A_UINT64 tx_multicast_bytes;
++ A_UINT64 tx_broadcast_pkts;
++ A_UINT64 tx_broadcast_bytes;
++ A_UINT64 tx_rts_success_cnt;
++ A_UINT64 tx_packet_per_ac[4];
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&optTxFrmCmd, userdata,
-+ sizeof(optTxFrmCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else if (copy_from_user(data,
-+ userdata+sizeof(WMI_OPT_TX_FRAME_CMD)-1,
-+ optTxFrmCmd.optIEDataLen))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ret = wmi_opt_tx_frame_cmd(ar->arWmi,
-+ optTxFrmCmd.frmType,
-+ optTxFrmCmd.dstAddr,
-+ optTxFrmCmd.bssid,
-+ optTxFrmCmd.optIEDataLen,
-+ data);
-+ }
-+
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SETRETRYLIMITS:
-+ {
-+ WMI_SET_RETRY_LIMITS_CMD setRetryParams;
-+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setRetryParams, userdata,
-+ sizeof(setRetryParams)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_retry_limits_cmd(ar->arWmi, setRetryParams.frameType,
-+ setRetryParams.trafficClass,
-+ setRetryParams.maxRetries,
-+ setRetryParams.enableNotify) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar->arMaxRetries = setRetryParams.maxRetries;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ }
-+ break;
-+ }
++ A_UINT64 tx_errors;
++ A_UINT64 tx_failed_cnt;
++ A_UINT64 tx_retry_cnt;
++ A_UINT64 tx_rts_fail_cnt;
++ A_INT32 tx_unicast_rate;
++ A_UINT64 rx_packets;
++ A_UINT64 rx_bytes;
++ A_UINT64 rx_unicast_pkts;
++ A_UINT64 rx_unicast_bytes;
++ A_UINT64 rx_multicast_pkts;
++ A_UINT64 rx_multicast_bytes;
++ A_UINT64 rx_broadcast_pkts;
++ A_UINT64 rx_broadcast_bytes;
++ A_UINT64 rx_fragment_pkt;
+
-+ case AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL:
-+ {
-+ WMI_BEACON_INT_CMD bIntvlCmd;
++ A_UINT64 rx_errors;
++ A_UINT64 rx_crcerr;
++ A_UINT64 rx_key_cache_miss;
++ A_UINT64 rx_decrypt_err;
++ A_UINT64 rx_duplicate_frames;
++ A_INT32 rx_unicast_rate;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&bIntvlCmd, userdata,
-+ sizeof(bIntvlCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else if (wmi_set_adhoc_bconIntvl_cmd(ar->arWmi, bIntvlCmd.beaconInterval)
-+ != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ break;
-+ }
-+ case IEEE80211_IOCTL_SETAUTHALG:
-+ {
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ieee80211req_authalg req;
++ A_UINT64 tkip_local_mic_failure;
++ A_UINT64 tkip_counter_measures_invoked;
++ A_UINT64 tkip_replays;
++ A_UINT64 tkip_format_errors;
++ A_UINT64 ccmp_format_errors;
++ A_UINT64 ccmp_replays;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&req, userdata,
-+ sizeof(struct ieee80211req_authalg)))
-+ {
-+ ret = -EFAULT;
-+ } else if (req.auth_alg == AUTH_ALG_OPEN_SYSTEM) {
-+ ar->arDot11AuthMode = OPEN_AUTH;
-+ ar->arPairwiseCrypto = NONE_CRYPT;
-+ ar->arGroupCrypto = NONE_CRYPT;
-+ } else if (req.auth_alg == AUTH_ALG_LEAP) {
-+ ar->arDot11AuthMode = LEAP_AUTH;
-+ } else {
-+ ret = -EIO;
-+ }
-+ break;
-+ }
++ A_UINT64 power_save_failure_cnt;
++ A_INT16 noise_floor_calibation;
+
-+ case AR6000_XIOCTL_SET_VOICE_PKT_SIZE:
-+ ret = ar6000_xioctl_set_voice_pkt_size(dev, userdata);
-+ break;
++ A_UINT64 cs_bmiss_cnt;
++ A_UINT64 cs_lowRssi_cnt;
++ A_UINT64 cs_connect_cnt;
++ A_UINT64 cs_disconnect_cnt;
++ A_UINT8 cs_aveBeacon_snr;
++ A_INT16 cs_aveBeacon_rssi;
++ A_UINT8 cs_lastRoam_msec;
++ A_UINT8 cs_snr;
++ A_INT16 cs_rssi;
+
-+ case AR6000_XIOCTL_SET_MAX_SP:
-+ ret = ar6000_xioctl_set_max_sp_len(dev, userdata);
-+ break;
++ A_UINT32 lq_val;
+
-+ case AR6000_XIOCTL_WMI_GET_ROAM_TBL:
-+ ret = ar6000_ioctl_get_roam_tbl(dev, rq);
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_ROAM_CTRL:
-+ ret = ar6000_ioctl_set_roam_ctrl(dev, userdata);
-+ break;
-+ case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
-+ ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
-+ break;
-+ case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
-+ ret = ar6000_ioctl_get_power_mode(dev, rq);
-+ break;
-+ case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
-+ get_user(ar->arWlanState, (unsigned int *)userdata);
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ break;
-+ }
++ A_UINT32 wow_num_pkts_dropped;
++ A_UINT8 wow_num_host_pkt_wakeups;
++ A_UINT8 wow_num_host_event_wakeups;
++ A_UINT16 wow_num_events_discarded;
+
-+ if (ar->arWlanState == WLAN_ENABLED) {
-+ /* Enable foreground scanning */
-+ if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
-+ scParams.fg_end_period,
-+ scParams.bg_period,
-+ scParams.minact_chdwell_time,
-+ scParams.maxact_chdwell_time,
-+ scParams.pas_chdwell_time,
-+ scParams.shortScanRatio,
-+ scParams.scanCtrlFlags,
-+ scParams.max_dfsch_act_time) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ if (ar->arSsidLen) {
-+ ar->arConnectPending = TRUE;
-+ if (wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
-+ ar->arDot11AuthMode, ar->arAuthMode,
-+ ar->arPairwiseCrypto,
-+ ar->arPairwiseCryptoLen,
-+ ar->arGroupCrypto, ar->arGroupCryptoLen,
-+ ar->arSsidLen, ar->arSsid,
-+ ar->arReqBssid, ar->arChannelHint,
-+ ar->arConnectCtrlFlags) != A_OK)
-+ {
-+ ret = -EIO;
-+ ar->arConnectPending = FALSE;
-+ }
-+ }
-+ } else {
-+ /* Disconnect from the AP and disable foreground scanning */
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ if (ar->arConnected == TRUE || ar->arConnectPending == TRUE) {
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ wmi_disconnect_cmd(ar->arWmi);
-+ } else {
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ }
++}TARGET_STATS;
+
-+ if (wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0, 0, 0, 0, 0, 0, 0xFF, 0) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
-+ ret = ar6000_ioctl_get_roam_data(dev, rq);
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_BT_STATUS:
-+ ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_BT_PARAMS:
-+ ret = ar6000_xioctl_set_bt_params_cmd(dev, userdata);
-+ break;
-+ case AR6000_XIOCTL_WMI_STARTSCAN:
-+ {
-+ WMI_START_SCAN_CMD setStartScanCmd;
++typedef struct targetStats_cmd_t {
++ TARGET_STATS targetStats;
++ int clearStats;
++} TARGET_STATS_CMD;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setStartScanCmd, userdata,
-+ sizeof(setStartScanCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_startscan_cmd(ar->arWmi, setStartScanCmd.scanType,
-+ setStartScanCmd.forceFgScan,
-+ setStartScanCmd.isLegacy,
-+ setStartScanCmd.homeDwellTime,
-+ setStartScanCmd.forceScanInterval) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SETFIXRATES:
-+ {
-+ WMI_FIX_RATES_CMD setFixRatesCmd;
-+ A_STATUS returnStatus;
++/* used by AR6000_XIOCTL_USER_SETKEYS */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setFixRatesCmd, userdata,
-+ sizeof(setFixRatesCmd)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ returnStatus = wmi_set_fixrates_cmd(ar->arWmi, setFixRatesCmd.fixRateMask);
-+ if (returnStatus == A_EINVAL)
-+ {
-+ ret = -EINVAL;
-+ }
-+ else if(returnStatus != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
++/*
++ * Setting this bit to 1 doesnot initialize the RSC on the firmware
++ */
++#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL 1
++#define AR6000_USER_SETKEYS_RSC_UNCHANGED 0x00000002
+
-+ case AR6000_XIOCTL_WMI_GETFIXRATES:
-+ {
-+ WMI_FIX_RATES_CMD getFixRatesCmd;
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ int ret = 0;
++typedef struct {
++ A_UINT32 keyOpCtrl; /* Bit Map of Key Mgmt Ctrl Flags */
++} AR6000_USER_SETKEYS_INFO;
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ /* Used copy_from_user/copy_to_user to access user space data */
-+ if (copy_from_user(&getFixRatesCmd, userdata, sizeof(getFixRatesCmd))) {
-+ ret = -EFAULT;
-+ } else {
-+ ar->arRateMask = 0xFFFF;
++/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
++struct ar6000_gpio_output_set_cmd_s {
++ A_UINT32 set_mask;
++ A_UINT32 clear_mask;
++ A_UINT32 enable_mask;
++ A_UINT32 disable_mask;
++};
+
-+ if (wmi_get_ratemask_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++/*
++ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
++ */
++struct ar6000_gpio_register_cmd_s {
++ A_UINT32 gpioreg_id;
++ A_UINT32 value;
++};
+
-+ wait_event_interruptible_timeout(arEvent, ar->arRateMask != 0xFFFF, wmitimeout * HZ);
++/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
++struct ar6000_gpio_intr_ack_cmd_s {
++ A_UINT32 ack_mask;
++};
+
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
++/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
++struct ar6000_gpio_intr_wait_cmd_s {
++ A_UINT32 intr_mask;
++ A_UINT32 input_values;
++};
+
-+ if (!ret) {
-+ getFixRatesCmd.fixRateMask = ar->arRateMask;
-+ }
++/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
++typedef struct ar6000_dbglog_module_config_s {
++ A_UINT32 valid;
++ A_UINT16 mmask;
++ A_UINT16 tsr;
++ A_BOOL rep;
++ A_UINT16 size;
++} DBGLOG_MODULE_CONFIG;
+
-+ if(copy_to_user(userdata, &getFixRatesCmd, sizeof(getFixRatesCmd))) {
-+ ret = -EFAULT;
-+ }
++typedef struct user_rssi_thold_t {
++ A_INT16 tag;
++ A_INT16 rssi;
++} USER_RSSI_THOLD;
+
-+ up(&ar->arSem);
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_AUTHMODE:
-+ {
-+ WMI_SET_AUTH_MODE_CMD setAuthMode;
++typedef struct user_rssi_params_t {
++ A_UINT8 weight;
++ A_UINT32 pollTime;
++ USER_RSSI_THOLD tholds[12];
++} USER_RSSI_PARAMS;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setAuthMode, userdata,
-+ sizeof(setAuthMode)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_authmode_cmd(ar->arWmi, setAuthMode.mode) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_REASSOCMODE:
-+ {
-+ WMI_SET_REASSOC_MODE_CMD setReassocMode;
++/*
++ * Host driver may have some config parameters. Typically, these
++ * config params are one time config parameters. These could
++ * correspond to any of the underlying modules. Host driver exposes
++ * an api for the underlying modules to get this config.
++ */
++#define AR6000_DRIVER_CFG_BASE 0x8000
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setReassocMode, userdata,
-+ sizeof(setReassocMode)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_reassocmode_cmd(ar->arWmi, setReassocMode.mode) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_DIAG_READ:
-+ {
-+ A_UINT32 addr, data;
-+ get_user(addr, (unsigned int *)userdata);
-+ if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
-+ ret = -EIO;
-+ }
-+ put_user(data, (unsigned int *)userdata + 1);
-+ break;
-+ }
-+ case AR6000_XIOCTL_DIAG_WRITE:
-+ {
-+ A_UINT32 addr, data;
-+ get_user(addr, (unsigned int *)userdata);
-+ get_user(data, (unsigned int *)userdata + 1);
-+ if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
-+ ret = -EIO;
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
-+ {
-+ WMI_SET_KEEPALIVE_CMD setKeepAlive;
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ } else if (copy_from_user(&setKeepAlive, userdata,
-+ sizeof(setKeepAlive))){
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_keepalive_cmd(ar->arWmi, setKeepAlive.keepaliveInterval) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_GET_KEEPALIVE:
-+ {
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_GET_KEEPALIVE_CMD getKeepAlive;
-+ int ret = 0;
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ if (copy_from_user(&getKeepAlive, userdata,sizeof(getKeepAlive))) {
-+ ret = -EFAULT;
-+ } else {
-+ getKeepAlive.keepaliveInterval = wmi_get_keepalive_cmd(ar->arWmi);
-+ ar->arKeepaliveConfigured = 0xFF;
-+ if (wmi_get_keepalive_configured(ar->arWmi) != A_OK){
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
-+ wait_event_interruptible_timeout(arEvent, ar->arKeepaliveConfigured != 0xFF, wmitimeout * HZ);
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
++/* Should driver perform wlan node caching? */
++#define AR6000_DRIVER_CFG_GET_WLANNODECACHING 0x8001
++/*Should we log raw WMI msgs */
++#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS 0x8002
+
-+ if (!ret) {
-+ getKeepAlive.configured = ar->arKeepaliveConfigured;
-+ }
-+ if (copy_to_user(userdata, &getKeepAlive, sizeof(getKeepAlive))) {
-+ ret = -EFAULT;
-+ }
-+ up(&ar->arSem);
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_APPIE:
-+ {
-+ WMI_SET_APPIE_CMD appIEcmd;
-+ A_UINT8 appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
-+ A_UINT32 fType,ieLen;
++/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
++struct ar6000_diag_window_cmd_s {
++ unsigned int addr;
++ unsigned int value;
++};
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ get_user(fType, (A_UINT32 *)userdata);
-+ appIEcmd.mgmtFrmType = fType;
-+ if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
-+ ret = -EIO;
-+ } else {
-+ get_user(ieLen, (A_UINT32 *)(userdata + 4));
-+ appIEcmd.ieLen = ieLen;
-+ if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
-+ ret = -EIO;
-+ break;
-+ }
-+ if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_appie_cmd(ar->arWmi, appIEcmd.mgmtFrmType,
-+ appIEcmd.ieLen, appIeInfo) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER:
-+ {
-+ WMI_BSS_FILTER_CMD cmd;
-+ A_UINT32 filterType;
+
-+ if (copy_from_user(&filterType, userdata, sizeof(A_UINT32)))
-+ {
-+ return -EFAULT;
-+ }
-+ if (filterType & (IEEE80211_FILTER_TYPE_BEACON |
-+ IEEE80211_FILTER_TYPE_PROBE_RESP))
-+ {
-+ cmd.bssFilter = ALL_BSS_FILTER;
-+ } else {
-+ cmd.bssFilter = NONE_BSS_FILTER;
-+ }
-+ if (wmi_bssfilter_cmd(ar->arWmi, cmd.bssFilter, 0) != A_OK) {
-+ ret = -EIO;
-+ }
++struct ar6000_traffic_activity_change {
++ A_UINT32 StreamID; /* stream ID to indicate activity change */
++ A_UINT32 Active; /* active (1) or inactive (0) */
++};
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ ar->arMgmtFilter = filterType;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_WSC_STATUS:
-+ {
-+ A_UINT32 wsc_status;
-+
-+ if (copy_from_user(&wsc_status, userdata, sizeof(A_UINT32)))
-+ {
-+ return -EFAULT;
-+ }
-+ if (wmi_set_wsc_status_cmd(ar->arWmi, wsc_status) != A_OK) {
-+ ret = -EIO;
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
-+ {
-+ A_UINT32 ROM_addr;
-+ A_UINT32 RAM_addr;
-+ A_UINT32 nbytes;
-+ A_UINT32 do_activate;
-+ A_UINT32 rompatch_id;
-+
-+ get_user(ROM_addr, (A_UINT32 *)userdata);
-+ get_user(RAM_addr, (A_UINT32 *)userdata + 1);
-+ get_user(nbytes, (A_UINT32 *)userdata + 2);
-+ get_user(do_activate, (A_UINT32 *)userdata + 3);
-+ AR_DEBUG_PRINTF("Install rompatch from ROM: 0x%x to RAM: 0x%x length: %d\n",
-+ ROM_addr, RAM_addr, nbytes);
-+ ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
-+ nbytes, do_activate, &rompatch_id);
-+ if (ret == A_OK) {
-+ put_user(rompatch_id, (unsigned int *)rq->ifr_data); /* return value */
-+ }
-+ break;
-+ }
-+
-+ case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
-+ {
-+ A_UINT32 rompatch_id;
++#ifdef __cplusplus
++}
++#endif
++#endif
+diff --git a/drivers/ar6000/ar6000/athtypes_linux.h b/drivers/ar6000/ar6000/athtypes_linux.h
+new file mode 100644
+index 0000000..3e91de3
+--- /dev/null
++++ b/drivers/ar6000/ar6000/athtypes_linux.h
+@@ -0,0 +1,47 @@
++/*
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/athtypes_linux.h#1 $
++ *
++ * This file contains the definitions of the basic atheros data types.
++ * It is used to map the data types in atheros files to a platform specific
++ * type.
++ *
++ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ get_user(rompatch_id, (A_UINT32 *)userdata);
-+ AR_DEBUG_PRINTF("UNinstall rompatch_id %d\n", rompatch_id);
-+ ret = BMIrompatchUninstall(hifDevice, rompatch_id);
-+ break;
-+ }
++#ifndef _ATHTYPES_LINUX_H_
++#define _ATHTYPES_LINUX_H_
+
-+ case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
-+ case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
-+ {
-+ A_UINT32 rompatch_count;
++#ifdef __KERNEL__
++#include <linux/types.h>
++#endif
+
-+ get_user(rompatch_count, (A_UINT32 *)userdata);
-+ AR_DEBUG_PRINTF("Change rompatch activation count=%d\n", rompatch_count);
-+ length = sizeof(A_UINT32) * rompatch_count;
-+ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
-+ A_MEMZERO(buffer, length);
-+ if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
-+ ret = BMIrompatchActivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
-+ } else {
-+ ret = BMIrompatchDeactivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
-+ }
-+ }
-+ A_FREE(buffer);
-+ } else {
-+ ret = -ENOMEM;
-+ }
++typedef int8_t A_INT8;
++typedef int16_t A_INT16;
++typedef int32_t A_INT32;
++typedef int64_t A_INT64;
+
-+ break;
-+ }
++typedef u_int8_t A_UINT8;
++typedef u_int16_t A_UINT16;
++typedef u_int32_t A_UINT32;
++typedef u_int64_t A_UINT64;
+
-+ case AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE:
-+ {
-+ WMI_SET_HOST_SLEEP_MODE_CMD setHostSleepMode;
++typedef int A_BOOL;
++typedef char A_CHAR;
++typedef unsigned char A_UCHAR;
++typedef unsigned long A_ATH_TIMER;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setHostSleepMode, userdata,
-+ sizeof(setHostSleepMode)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_host_sleep_mode_cmd(ar->arWmi,
-+ &setHostSleepMode) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_SET_WOW_MODE:
-+ {
-+ WMI_SET_WOW_MODE_CMD setWowMode;
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&setWowMode, userdata,
-+ sizeof(setWowMode)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_wow_mode_cmd(ar->arWmi,
-+ &setWowMode) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_GET_WOW_LIST:
-+ {
-+ WMI_GET_WOW_LIST_CMD getWowList;
++#endif /* _ATHTYPES_LINUX_H_ */
+diff --git a/drivers/ar6000/ar6000/config_linux.h b/drivers/ar6000/ar6000/config_linux.h
+new file mode 100644
+index 0000000..11a691d
+--- /dev/null
++++ b/drivers/ar6000/ar6000/config_linux.h
+@@ -0,0 +1,44 @@
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&getWowList, userdata,
-+ sizeof(getWowList)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_get_wow_list_cmd(ar->arWmi,
-+ &getWowList) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_ADD_WOW_PATTERN:
-+ {
-+#define WOW_PATTERN_SIZE 64
-+#define WOW_MASK_SIZE 64
++#ifndef _CONFIG_LINUX_H_
++#define _CONFIG_LINUX_H_
+
-+ WMI_ADD_WOW_PATTERN_CMD cmd;
-+ A_UINT8 mask_data[WOW_PATTERN_SIZE]={0};
-+ A_UINT8 pattern_data[WOW_PATTERN_SIZE]={0};
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else {
++/*
++ * Host-side GPIO support is optional.
++ * If run-time access to GPIO pins is not required, then
++ * this should be changed to #undef.
++ */
++#define CONFIG_HOST_GPIO_SUPPORT
+
-+ if(copy_from_user(&cmd, userdata,
-+ sizeof(WMI_ADD_WOW_PATTERN_CMD)))
-+ return -EFAULT;
-+ if (copy_from_user(pattern_data,
-+ userdata + 3,
-+ cmd.filter_size)){
-+ ret = -EFAULT;
-+ break;
-+ }
-+ if (copy_from_user(mask_data,
-+ (userdata + 3 + cmd.filter_size),
-+ cmd.filter_size)){
-+ ret = -EFAULT;
-+ break;
-+ } else {
-+ if (wmi_add_wow_pattern_cmd(ar->arWmi,
-+ &cmd, pattern_data, mask_data, cmd.filter_size) != A_OK){
-+ ret = -EIO;
-+ }
-+ }
-+ }
-+#undef WOW_PATTERN_SIZE
-+#undef WOW_MASK_SIZE
-+ break;
-+ }
-+ case AR6000_XIOCTL_WMI_DEL_WOW_PATTERN:
-+ {
-+ WMI_DEL_WOW_PATTERN_CMD delWowPattern;
++/*
++ * Host side Test Command support
++ */
++#define CONFIG_HOST_TCMD_SUPPORT
+
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&delWowPattern, userdata,
-+ sizeof(delWowPattern)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_del_wow_pattern_cmd(ar->arWmi,
-+ &delWowPattern) != A_OK)
-+ {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ }
-+ case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
-+ if (ar->arHtcTarget != NULL) {
-+ HTCDumpCreditStates(ar->arHtcTarget);
-+ }
-+ break;
-+ case AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE:
-+ if (ar->arHtcTarget != NULL) {
-+ struct ar6000_traffic_activity_change data;
++#define USE_4BYTE_REGISTER_ACCESS
+
-+ if (copy_from_user(&data, userdata, sizeof(data)))
-+ {
-+ return -EFAULT;
-+ }
-+ /* note, this is used for testing (mbox ping testing), indicate activity
-+ * change using the stream ID as the traffic class */
-+ ar6000_indicate_tx_activity(ar,
-+ (A_UINT8)data.StreamID,
-+ data.Active ? TRUE : FALSE);
-+ }
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS:
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&connectCtrlFlags, userdata,
-+ sizeof(connectCtrlFlags)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ ar->arConnectCtrlFlags = connectCtrlFlags;
-+ }
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_AKMP_PARAMS:
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else if (copy_from_user(&akmpParams, userdata,
-+ sizeof(WMI_SET_AKMP_PARAMS_CMD)))
-+ {
-+ ret = -EFAULT;
-+ } else {
-+ if (wmi_set_akmp_params_cmd(ar->arWmi, &akmpParams) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ case AR6000_XIOCTL_WMI_SET_PMKID_LIST:
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else {
-+ if (copy_from_user(&pmkidInfo.numPMKID, userdata,
-+ sizeof(pmkidInfo.numPMKID)))
-+ {
-+ ret = -EFAULT;
-+ break;
-+ }
-+ if (copy_from_user(&pmkidInfo.pmkidList,
-+ userdata + sizeof(pmkidInfo.numPMKID),
-+ pmkidInfo.numPMKID * sizeof(WMI_PMKID)))
-+ {
-+ ret = -EFAULT;
-+ break;
-+ }
-+ if (wmi_set_pmkid_list_cmd(ar->arWmi, &pmkidInfo) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ case AR6000_XIOCTL_WMI_GET_PMKID_LIST:
-+ if (ar->arWmiReady == FALSE) {
-+ ret = -EIO;
-+ } else {
-+ if (wmi_get_pmkid_list_cmd(ar->arWmi) != A_OK) {
-+ ret = -EIO;
-+ }
-+ }
-+ break;
-+ default:
-+ ret = -EOPNOTSUPP;
-+ }
-+ return ret;
++#ifdef __cplusplus
+}
++#endif
+
-diff --git a/drivers/ar6000/ar6000/netbuf.c b/drivers/ar6000/ar6000/netbuf.c
++#endif
+diff --git a/drivers/ar6000/ar6000/debug_linux.h b/drivers/ar6000/ar6000/debug_linux.h
new file mode 100644
-index 0000000..97b273b
+index 0000000..c74e1df
--- /dev/null
-+++ b/drivers/ar6000/ar6000/netbuf.c
-@@ -0,0 +1,225 @@
-+
++++ b/drivers/ar6000/ar6000/debug_linux.h
+@@ -0,0 +1,86 @@
+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ *
+ */
-+#include <linux/kernel.h>
-+#include <linux/skbuff.h>
-+#include <a_config.h>
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "htc_packet.h"
+
-+#define AR6000_DATA_OFFSET 64
++#ifndef _DEBUG_LINUX_H_
++#define _DEBUG_LINUX_H_
+
-+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt)
-+{
-+ skb_queue_tail((struct sk_buff_head *) q, (struct sk_buff *) pkt);
-+}
++#define DBG_DEFAULTS (DBG_ERROR|DBG_WARNING)
+
-+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt)
-+{
-+ skb_queue_head((struct sk_buff_head *) q, (struct sk_buff *) pkt);
-+}
++extern A_UINT32 g_dbg_flags;
+
-+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q)
-+{
-+ return((void *) skb_dequeue((struct sk_buff_head *) q));
-+}
++#define DBGFMT "%s() : "
++#define DBGARG __func__
++#define DBGFN A_PRINTF
+
-+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q)
-+{
-+ return(skb_queue_len((struct sk_buff_head *) q));
-+}
++/* ------- Debug related stuff ------- */
++enum {
++ ATH_DEBUG_SEND = 0x0001,
++ ATH_DEBUG_RECV = 0x0002,
++ ATH_DEBUG_SYNC = 0x0004,
++ ATH_DEBUG_DUMP = 0x0008,
++ ATH_DEBUG_IRQ = 0x0010,
++ ATH_DEBUG_TRC = 0x0020,
++ ATH_DEBUG_WARN = 0x0040,
++ ATH_DEBUG_ERR = 0x0080,
++ ATH_LOG_INF = 0x0100,
++ ATH_DEBUG_BMI = 0x0110,
++ ATH_DEBUG_WMI = 0x0120,
++ ATH_DEBUG_HIF = 0x0140,
++ ATH_DEBUG_HTC = 0x0180,
++ ATH_DEBUG_WLAN = 0x1000,
++ ATH_LOG_ERR = 0x1010,
++ ATH_DEBUG_ANY = 0xFFFF,
++};
+
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q)
-+{
-+ return(skb_queue_empty((struct sk_buff_head *) q));
-+}
++#ifdef DEBUG
+
-+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q)
-+{
-+ skb_queue_head_init((struct sk_buff_head *) q);
-+}
++#define A_DPRINTF(f, a) \
++ if(g_dbg_flags & (f)) \
++ { \
++ DBGFN a ; \
++ }
+
-+void *
-+a_netbuf_alloc(int size)
-+{
-+ struct sk_buff *skb;
-+ skb = dev_alloc_skb(AR6000_DATA_OFFSET + sizeof(HTC_PACKET) + size);
-+ skb_reserve(skb, AR6000_DATA_OFFSET + sizeof(HTC_PACKET));
-+ return ((void *)skb);
-+}
+
++// TODO FIX usage of A_PRINTF!
++#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
++#define AR_DEBUG_PRINTBUF(buffer, length, desc) do { \
++ if (debughtc & ATH_DEBUG_DUMP) { \
++ DebugDumpBytes(buffer, length,desc); \
++ } \
++} while(0)
++#define PRINTX_ARG(arg...) arg
++#define AR_DEBUG_PRINTF(flags, args) do { \
++ if (debughtc & (flags)) { \
++ A_PRINTF(KERN_ALERT PRINTX_ARG args); \
++ } \
++} while (0)
++#define AR_DEBUG_ASSERT(test) do { \
++ if (!(test)) { \
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test)); \
++ } \
++} while(0)
++extern int debughtc;
++#else
++#define AR_DEBUG_PRINTF(flags, args)
++#define AR_DEBUG_PRINTBUF(buffer, length, desc)
++#define AR_DEBUG_ASSERT(test)
++#define AR_DEBUG_LVL_CHECK(lvl) 0
++#define A_DPRINTF(f, a)
++#endif
++
++#endif /* _DEBUG_LINUX_H_ */
+diff --git a/drivers/ar6000/ar6000/ioctl.c b/drivers/ar6000/ar6000/ioctl.c
+new file mode 100644
+index 0000000..04aa911
+--- /dev/null
++++ b/drivers/ar6000/ar6000/ioctl.c
+@@ -0,0 +1,2532 @@
+/*
-+ * Allocate an SKB w.o. any encapsulation requirement.
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
-+void *
-+a_netbuf_alloc_raw(int size)
-+{
-+ struct sk_buff *skb;
+
-+ skb = dev_alloc_skb(size);
++#include "ar6000_drv.h"
+
-+ return ((void *)skb);
-+}
++static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
++static A_UINT8 null_mac[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
++extern USER_RSSI_THOLD rssi_map[12];
++extern unsigned int wmitimeout;
++extern A_WAITQUEUE_HEAD arEvent;
++extern int tspecCompliance;
++extern int bypasswmi;
+
-+void
-+a_netbuf_free(void *bufPtr)
++static int
++ar6000_ioctl_get_roam_tbl(struct net_device *dev, struct ifreq *rq)
+{
-+ struct sk_buff *skb = (struct sk_buff *)bufPtr;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ dev_kfree_skb(skb);
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+A_UINT32
-+a_netbuf_to_len(void *bufPtr)
-+{
-+ return (((struct sk_buff *)bufPtr)->len);
-+}
++ if(wmi_get_roam_tbl_cmd(ar->arWmi) != A_OK) {
++ return -EIO;
++ }
+
-+void *
-+a_netbuf_to_data(void *bufPtr)
-+{
-+ return (((struct sk_buff *)bufPtr)->data);
++ return 0;
+}
+
-+/*
-+ * Add len # of bytes to the beginning of the network buffer
-+ * pointed to by bufPtr
-+ */
-+A_STATUS
-+a_netbuf_push(void *bufPtr, A_INT32 len)
++static int
++ar6000_ioctl_get_roam_data(struct net_device *dev, struct ifreq *rq)
+{
-+ skb_push((struct sk_buff *)bufPtr, len);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ return A_OK;
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+/*
-+ * Add len # of bytes to the beginning of the network buffer
-+ * pointed to by bufPtr and also fill with data
-+ */
-+A_STATUS
-+a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len)
-+{
-+ skb_push((struct sk_buff *) bufPtr, len);
-+ A_MEMCPY(((struct sk_buff *)bufPtr)->data, srcPtr, len);
+
-+ return A_OK;
-+}
++ /* currently assume only roam times are required */
++ if(wmi_get_roam_data_cmd(ar->arWmi, ROAM_DATA_TIME) != A_OK) {
++ return -EIO;
++ }
+
-+/*
-+ * Add len # of bytes to the end of the network buffer
-+ * pointed to by bufPtr
-+ */
-+A_STATUS
-+a_netbuf_put(void *bufPtr, A_INT32 len)
-+{
-+ skb_put((struct sk_buff *)bufPtr, len);
+
-+ return A_OK;
++ return 0;
+}
+
-+/*
-+ * Add len # of bytes to the end of the network buffer
-+ * pointed to by bufPtr and also fill with data
-+ */
-+A_STATUS
-+a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len)
++static int
++ar6000_ioctl_set_roam_ctrl(struct net_device *dev, char *userdata)
+{
-+ char *start = ((struct sk_buff *)bufPtr)->data +
-+ ((struct sk_buff *)bufPtr)->len;
-+ skb_put((struct sk_buff *)bufPtr, len);
-+ A_MEMCPY(start, srcPtr, len);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SET_ROAM_CTRL_CMD cmd;
++ A_UINT8 size = sizeof(cmd);
+
-+ return A_OK;
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
+
-+/*
-+ * Trim the network buffer pointed to by bufPtr to len # of bytes
-+ */
-+A_STATUS
-+a_netbuf_setlen(void *bufPtr, A_INT32 len)
-+{
-+ skb_trim((struct sk_buff *)bufPtr, len);
++ if (copy_from_user(&cmd, userdata, size)) {
++ return -EFAULT;
++ }
+
-+ return A_OK;
-+}
++ if (cmd.roamCtrlType == WMI_SET_HOST_BIAS) {
++ if (cmd.info.bssBiasInfo.numBss > 1) {
++ size += (cmd.info.bssBiasInfo.numBss - 1) * sizeof(WMI_BSS_BIAS);
++ }
++ }
+
-+/*
-+ * Chop of len # of bytes from the end of the buffer.
-+ */
-+A_STATUS
-+a_netbuf_trim(void *bufPtr, A_INT32 len)
-+{
-+ skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
++ if (copy_from_user(&cmd, userdata, size)) {
++ return -EFAULT;
++ }
+
-+ return A_OK;
++ if(wmi_set_roam_ctrl_cmd(ar->arWmi, &cmd, size) != A_OK) {
++ return -EIO;
++ }
++
++ return 0;
+}
+
-+/*
-+ * Chop of len # of bytes from the end of the buffer and return the data.
-+ */
-+A_STATUS
-+a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len)
++static int
++ar6000_ioctl_set_powersave_timers(struct net_device *dev, char *userdata)
+{
-+ char *start = ((struct sk_buff *)bufPtr)->data +
-+ (((struct sk_buff *)bufPtr)->len - len);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_POWERSAVE_TIMERS_POLICY_CMD cmd;
++ A_UINT8 size = sizeof(cmd);
+
-+ A_MEMCPY(dstPtr, start, len);
-+ skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ return A_OK;
-+}
++ if (copy_from_user(&cmd, userdata, size)) {
++ return -EFAULT;
++ }
+
++ if (copy_from_user(&cmd, userdata, size)) {
++ return -EFAULT;
++ }
+
-+/*
-+ * Returns the number of bytes available to a a_netbuf_push()
-+ */
-+A_INT32
-+a_netbuf_headroom(void *bufPtr)
-+{
-+ return (skb_headroom((struct sk_buff *)bufPtr));
++ if(wmi_set_powersave_timers_cmd(ar->arWmi, &cmd, size) != A_OK) {
++ return -EIO;
++ }
++
++ return 0;
+}
+
-+/*
-+ * Removes specified number of bytes from the beginning of the buffer
-+ */
-+A_STATUS
-+a_netbuf_pull(void *bufPtr, A_INT32 len)
++static int
++ar6000_ioctl_set_wmm(struct net_device *dev, struct ifreq *rq)
+{
-+ skb_pull((struct sk_buff *)bufPtr, len);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SET_WMM_CMD cmd;
++ A_STATUS ret;
+
-+ return A_OK;
++ if ((dev->flags & IFF_UP) != IFF_UP) {
++ return -EIO;
++ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++
++ if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
++ sizeof(cmd)))
++ {
++ return -EFAULT;
++ }
++
++ if (cmd.status == WMI_WMM_ENABLED) {
++ ar->arWmmEnabled = TRUE;
++ } else {
++ ar->arWmmEnabled = FALSE;
++ }
++
++ ret = wmi_set_wmm_cmd(ar->arWmi, cmd.status);
++
++ switch (ret) {
++ case A_OK:
++ return 0;
++ case A_EBUSY :
++ return -EBUSY;
++ case A_NO_MEMORY:
++ return -ENOMEM;
++ case A_EINVAL:
++ default:
++ return -EFAULT;
++ }
+}
+
-+/*
-+ * Removes specified number of bytes from the beginning of the buffer
-+ * and return the data
-+ */
-+A_STATUS
-+a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len)
++static int
++ar6000_ioctl_set_txop(struct net_device *dev, struct ifreq *rq)
+{
-+ A_MEMCPY(dstPtr, ((struct sk_buff *)bufPtr)->data, len);
-+ skb_pull((struct sk_buff *)bufPtr, len);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SET_WMM_TXOP_CMD cmd;
++ A_STATUS ret;
+
-+ return A_OK;
++ if ((dev->flags & IFF_UP) != IFF_UP) {
++ return -EIO;
++ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++
++ if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
++ sizeof(cmd)))
++ {
++ return -EFAULT;
++ }
++
++ ret = wmi_set_wmm_txop(ar->arWmi, cmd.txopEnable);
++
++ switch (ret) {
++ case A_OK:
++ return 0;
++ case A_EBUSY :
++ return -EBUSY;
++ case A_NO_MEMORY:
++ return -ENOMEM;
++ case A_EINVAL:
++ default:
++ return -EFAULT;
++ }
+}
+
-diff --git a/drivers/ar6000/ar6000/osapi_linux.h b/drivers/ar6000/ar6000/osapi_linux.h
-new file mode 100644
-index 0000000..5b64212
---- /dev/null
-+++ b/drivers/ar6000/ar6000/osapi_linux.h
-@@ -0,0 +1,319 @@
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/osapi_linux.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++static int
++ar6000_ioctl_get_rd(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_STATUS ret = 0;
+
-+#ifndef _OSAPI_LINUX_H_
-+#define _OSAPI_LINUX_H_
++ if ((dev->flags & IFF_UP) != IFF_UP || ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+#ifdef __KERNEL__
++ if(copy_to_user((char *)((unsigned int*)rq->ifr_data + 1),
++ &ar->arRegCode, sizeof(ar->arRegCode)))
++ ret = -EFAULT;
+
-+#include <linux/version.h>
-+#include <linux/types.h>
-+#include <linux/kernel.h>
-+#include <linux/string.h>
-+#include <linux/skbuff.h>
-+#include <linux/netdevice.h>
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-+#include <linux/jiffies.h>
-+#endif
-+#include <linux/timer.h>
-+#include <linux/delay.h>
-+#include <linux/wait.h>
-+#ifdef KERNEL_2_4
-+#include <asm/arch/irq.h>
-+#include <asm/irq.h>
-+#endif
++ return ret;
++}
+
-+#ifdef __GNUC__
-+#define __ATTRIB_PACK __attribute__ ((packed))
-+#define __ATTRIB_PRINTF __attribute__ ((format (printf, 1, 2)))
-+#define __ATTRIB_NORETURN __attribute__ ((noreturn))
-+#ifndef INLINE
-+#define INLINE __inline__
-+#endif
-+#else /* Not GCC */
-+#define __ATTRIB_PACK
-+#define __ATTRIB_PRINTF
-+#define __ATTRIB_NORETURN
-+#ifndef INLINE
-+#define INLINE __inline
-+#endif
-+#endif /* End __GNUC__ */
+
-+#define PREPACK
-+#define POSTPACK __ATTRIB_PACK
++/* Get power mode command */
++static int
++ar6000_ioctl_get_power_mode(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_POWER_MODE_CMD power_mode;
++ int ret = 0;
+
-+/*
-+ * Endianes macros
-+ */
-+#define A_BE2CPU8(x) ntohb(x)
-+#define A_BE2CPU16(x) ntohs(x)
-+#define A_BE2CPU32(x) ntohl(x)
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+#define A_LE2CPU8(x) (x)
-+#define A_LE2CPU16(x) (x)
-+#define A_LE2CPU32(x) (x)
++ power_mode.powerMode = wmi_get_power_mode_cmd(ar->arWmi);
++ if (copy_to_user(rq->ifr_data, &power_mode, sizeof(WMI_POWER_MODE_CMD))) {
++ ret = -EFAULT;
++ }
+
-+#define A_CPU2BE8(x) htonb(x)
-+#define A_CPU2BE16(x) htons(x)
-+#define A_CPU2BE32(x) htonl(x)
++ return ret;
++}
+
-+#define A_MEMCPY(dst, src, len) memcpy((A_UINT8 *)(dst), (src), (len))
-+#define A_MEMZERO(addr, len) memset(addr, 0, len)
-+#define A_MEMCMP(addr1, addr2, len) memcmp((addr1), (addr2), (len))
-+#define A_MALLOC(size) kmalloc((size), GFP_KERNEL)
-+#define A_MALLOC_NOWAIT(size) kmalloc((size), GFP_ATOMIC)
-+#define A_FREE(addr) kfree(addr)
-+#define A_PRINTF(args...) printk(args)
+
-+/* Mutual Exclusion */
-+typedef spinlock_t A_MUTEX_T;
-+#define A_MUTEX_INIT(mutex) spin_lock_init(mutex)
-+#define A_MUTEX_LOCK(mutex) spin_lock_bh(mutex)
-+#define A_MUTEX_UNLOCK(mutex) spin_unlock_bh(mutex)
-+#define A_IS_MUTEX_VALID(mutex) TRUE /* okay to return true, since A_MUTEX_DELETE does nothing */
-+#define A_MUTEX_DELETE(mutex) /* spin locks are not kernel resources so nothing to free.. */
++static int
++ar6000_ioctl_set_channelParams(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_CHANNEL_PARAMS_CMD cmd, *cmdp;
++ int ret = 0;
+
-+/* Get current time in ms adding a constant offset (in ms) */
-+#define A_GET_MS(offset) \
-+ (jiffies + ((offset) / 1000) * HZ)
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+/*
-+ * Timer Functions
-+ */
-+#define A_MDELAY(msecs) mdelay(msecs)
-+typedef struct timer_list A_TIMER;
+
-+#define A_INIT_TIMER(pTimer, pFunction, pArg) do { \
-+ init_timer(pTimer); \
-+ (pTimer)->function = (pFunction); \
-+ (pTimer)->data = (unsigned long)(pArg); \
-+} while (0)
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+/*
-+ * Start a Timer that elapses after 'periodMSec' milli-seconds
-+ * Support is provided for a one-shot timer. The 'repeatFlag' is
-+ * ignored.
-+ */
-+#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do { \
-+ if (repeatFlag) { \
-+ printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__); \
-+ panic("Timer Repeat"); \
-+ } \
-+ mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000); \
-+} while (0)
++ if (cmd.numChannels > 1) {
++ cmdp = A_MALLOC(130);
++ if (copy_from_user(cmdp, rq->ifr_data,
++ sizeof (*cmdp) +
++ ((cmd.numChannels - 1) * sizeof(A_UINT16))))
++ {
++ kfree(cmdp);
++ return -EFAULT;
++ }
++ } else {
++ cmdp = &cmd;
++ }
+
-+/*
-+ * Cancel the Timer.
-+ */
-+#define A_UNTIMEOUT(pTimer) do { \
-+ del_timer((pTimer)); \
-+} while (0)
++ if ((ar->arPhyCapability == WMI_11G_CAPABILITY) &&
++ ((cmdp->phyMode == WMI_11A_MODE) || (cmdp->phyMode == WMI_11AG_MODE)))
++ {
++ ret = -EINVAL;
++ }
+
-+#define A_DELETE_TIMER(pTimer) do { \
-+} while (0)
++ if (!ret &&
++ (wmi_set_channelParams_cmd(ar->arWmi, cmdp->scanParam, cmdp->phyMode,
++ cmdp->numChannels, cmdp->channelList)
++ != A_OK))
++ {
++ ret = -EIO;
++ }
+
-+/*
-+ * Wait Queue related functions
-+ */
-+typedef wait_queue_head_t A_WAITQUEUE_HEAD;
-+#define A_INIT_WAITQUEUE_HEAD(head) init_waitqueue_head(head)
-+#ifndef wait_event_interruptible_timeout
-+#define __wait_event_interruptible_timeout(wq, condition, ret) \
-+do { \
-+ wait_queue_t __wait; \
-+ init_waitqueue_entry(&__wait, current); \
-+ \
-+ add_wait_queue(&wq, &__wait); \
-+ for (;;) { \
-+ set_current_state(TASK_INTERRUPTIBLE); \
-+ if (condition) \
-+ break; \
-+ if (!signal_pending(current)) { \
-+ ret = schedule_timeout(ret); \
-+ if (!ret) \
-+ break; \
-+ continue; \
-+ } \
-+ ret = -ERESTARTSYS; \
-+ break; \
-+ } \
-+ current->state = TASK_RUNNING; \
-+ remove_wait_queue(&wq, &__wait); \
-+} while (0)
++ if (cmd.numChannels > 1) {
++ kfree(cmdp);
++ }
+
-+#define wait_event_interruptible_timeout(wq, condition, timeout) \
-+({ \
-+ long __ret = timeout; \
-+ if (!(condition)) \
-+ __wait_event_interruptible_timeout(wq, condition, __ret); \
-+ __ret; \
-+})
-+#endif /* wait_event_interruptible_timeout */
++ return ret;
++}
+
-+#define A_WAIT_EVENT_INTERRUPTIBLE_TIMEOUT(head, condition, timeout) do { \
-+ wait_event_interruptible_timeout(head, condition, timeout); \
-+} while (0)
++static int
++ar6000_ioctl_set_snr_threshold(struct net_device *dev, struct ifreq *rq)
++{
+
-+#define A_WAKE_UP(head) wake_up(head)
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
++ int ret = 0;
+
-+#ifdef DEBUG
-+#define A_ASSERT(expr) \
-+ if (!(expr)) { \
-+ printk(KERN_ALERT "\n" __FILE__ ":%d: Assertion " #expr " failed!\n",__LINE__); \
-+ panic(#expr); \
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
+
-+#else
-+#define A_ASSERT(expr)
-+#endif /* DEBUG */
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+/*
-+ * Initialization of the network buffer subsystem
-+ */
-+#define A_NETBUF_INIT()
++ if( wmi_set_snr_threshold_params(ar->arWmi, &cmd) != A_OK ) {
++ ret = -EIO;
++ }
+
-+/*
-+ * Network buffer queue support
-+ */
-+typedef struct sk_buff_head A_NETBUF_QUEUE_T;
++ return ret;
++}
+
-+#define A_NETBUF_QUEUE_INIT(q) \
-+ a_netbuf_queue_init(q)
++static int
++ar6000_ioctl_set_rssi_threshold(struct net_device *dev, struct ifreq *rq)
++{
++#define SWAP_THOLD(thold1, thold2) do { \
++ USER_RSSI_THOLD tmpThold; \
++ tmpThold.tag = thold1.tag; \
++ tmpThold.rssi = thold1.rssi; \
++ thold1.tag = thold2.tag; \
++ thold1.rssi = thold2.rssi; \
++ thold2.tag = tmpThold.tag; \
++ thold2.rssi = tmpThold.rssi; \
++} while (0)
+
-+#define A_NETBUF_ENQUEUE(q, pkt) \
-+ a_netbuf_enqueue((q), (pkt))
-+#define A_NETBUF_PREQUEUE(q, pkt) \
-+ a_netbuf_prequeue((q), (pkt))
-+#define A_NETBUF_DEQUEUE(q) \
-+ (a_netbuf_dequeue(q))
-+#define A_NETBUF_QUEUE_SIZE(q) \
-+ a_netbuf_queue_size(q)
-+#define A_NETBUF_QUEUE_EMPTY(q) \
-+ a_netbuf_queue_empty(q)
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
++ USER_RSSI_PARAMS rssiParams;
++ A_INT32 i, j;
+
-+/*
-+ * Network buffer support
-+ */
-+#define A_NETBUF_ALLOC(size) \
-+ a_netbuf_alloc(size)
-+#define A_NETBUF_ALLOC_RAW(size) \
-+ a_netbuf_alloc_raw(size)
-+#define A_NETBUF_FREE(bufPtr) \
-+ a_netbuf_free(bufPtr)
-+#define A_NETBUF_DATA(bufPtr) \
-+ a_netbuf_to_data(bufPtr)
-+#define A_NETBUF_LEN(bufPtr) \
-+ a_netbuf_to_len(bufPtr)
-+#define A_NETBUF_PUSH(bufPtr, len) \
-+ a_netbuf_push(bufPtr, len)
-+#define A_NETBUF_PUT(bufPtr, len) \
-+ a_netbuf_put(bufPtr, len)
-+#define A_NETBUF_TRIM(bufPtr,len) \
-+ a_netbuf_trim(bufPtr, len)
-+#define A_NETBUF_PULL(bufPtr, len) \
-+ a_netbuf_pull(bufPtr, len)
-+#define A_NETBUF_HEADROOM(bufPtr)\
-+ a_netbuf_headroom(bufPtr)
-+#define A_NETBUF_SETLEN(bufPtr,len) \
-+ a_netbuf_setlen(bufPtr, len)
++ int ret = 0;
+
-+/* Add data to end of a buffer */
-+#define A_NETBUF_PUT_DATA(bufPtr, srcPtr, len) \
-+ a_netbuf_put_data(bufPtr, srcPtr, len)
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+/* Add data to start of the buffer */
-+#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr, len) \
-+ a_netbuf_push_data(bufPtr, srcPtr, len)
++ if (copy_from_user((char *)&rssiParams, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(USER_RSSI_PARAMS))) {
++ return -EFAULT;
++ }
++ cmd.weight = rssiParams.weight;
++ cmd.pollTime = rssiParams.pollTime;
+
-+/* Remove data at start of the buffer */
-+#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
-+ a_netbuf_pull_data(bufPtr, dstPtr, len)
++ A_MEMCPY(rssi_map, &rssiParams.tholds, sizeof(rssi_map));
++ /*
++ * only 6 elements, so use bubble sorting, in ascending order
++ */
++ for (i = 5; i > 0; i--) {
++ for (j = 0; j < i; j++) { /* above tholds */
++ if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
++ SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
++ } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
++ return EFAULT;
++ }
++ }
++ }
++ for (i = 11; i > 6; i--) {
++ for (j = 6; j < i; j++) { /* below tholds */
++ if (rssi_map[j+1].rssi < rssi_map[j].rssi) {
++ SWAP_THOLD(rssi_map[j+1], rssi_map[j]);
++ } else if (rssi_map[j+1].rssi == rssi_map[j].rssi) {
++ return EFAULT;
++ }
++ }
++ }
+
-+/* Remove data from the end of the buffer */
-+#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
-+ a_netbuf_trim_data(bufPtr, dstPtr, len)
++#ifdef DEBUG
++ for (i = 0; i < 12; i++) {
++ AR_DEBUG2_PRINTF("thold[%d].tag: %d, thold[%d].rssi: %d \n",
++ i, rssi_map[i].tag, i, rssi_map[i].rssi);
++ }
++#endif
++ cmd.thresholdAbove1_Val = rssi_map[0].rssi;
++ cmd.thresholdAbove2_Val = rssi_map[1].rssi;
++ cmd.thresholdAbove3_Val = rssi_map[2].rssi;
++ cmd.thresholdAbove4_Val = rssi_map[3].rssi;
++ cmd.thresholdAbove5_Val = rssi_map[4].rssi;
++ cmd.thresholdAbove6_Val = rssi_map[5].rssi;
++ cmd.thresholdBelow1_Val = rssi_map[6].rssi;
++ cmd.thresholdBelow2_Val = rssi_map[7].rssi;
++ cmd.thresholdBelow3_Val = rssi_map[8].rssi;
++ cmd.thresholdBelow4_Val = rssi_map[9].rssi;
++ cmd.thresholdBelow5_Val = rssi_map[10].rssi;
++ cmd.thresholdBelow6_Val = rssi_map[11].rssi;
+
-+/* View data as "size" contiguous bytes of type "t" */
-+#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
-+ (t )( ((struct skbuf *)(bufPtr))->data)
++ if( wmi_set_rssi_threshold_params(ar->arWmi, &cmd) != A_OK ) {
++ ret = -EIO;
++ }
+
-+/* return the beginning of the headroom for the buffer */
-+#define A_NETBUF_HEAD(bufPtr) \
-+ ((((struct sk_buff *)(bufPtr))->head))
++ return ret;
++}
+
-+/*
-+ * OS specific network buffer access routines
-+ */
-+void *a_netbuf_alloc(int size);
-+void *a_netbuf_alloc_raw(int size);
-+void a_netbuf_free(void *bufPtr);
-+void *a_netbuf_to_data(void *bufPtr);
-+A_UINT32 a_netbuf_to_len(void *bufPtr);
-+A_STATUS a_netbuf_push(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len);
-+A_STATUS a_netbuf_put(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len);
-+A_STATUS a_netbuf_pull(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len);
-+A_STATUS a_netbuf_trim(void *bufPtr, A_INT32 len);
-+A_STATUS a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len);
-+A_STATUS a_netbuf_setlen(void *bufPtr, A_INT32 len);
-+A_INT32 a_netbuf_headroom(void *bufPtr);
-+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
-+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
-+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
-+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
-+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
++static int
++ar6000_ioctl_set_lq_threshold(struct net_device *dev, struct ifreq *rq)
++{
+
-+/*
-+ * Kernel v.s User space functions
-+ */
-+A_UINT32 a_copy_to_user(void *to, const void *from, A_UINT32 n);
-+A_UINT32 a_copy_from_user(void *to, const void *from, A_UINT32 n);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_LQ_THRESHOLD_PARAMS_CMD cmd;
++ int ret = 0;
+
-+#else /* __KERNEL__ */
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+#ifdef __GNUC__
-+#define __ATTRIB_PACK __attribute__ ((packed))
-+#define __ATTRIB_PRINTF __attribute__ ((format (printf, 1, 2)))
-+#define __ATTRIB_NORETURN __attribute__ ((noreturn))
-+#ifndef INLINE
-+#define INLINE __inline__
-+#endif
-+#else /* Not GCC */
-+#define __ATTRIB_PACK
-+#define __ATTRIB_PRINTF
-+#define __ATTRIB_NORETURN
-+#ifndef INLINE
-+#define INLINE __inline
-+#endif
-+#endif /* End __GNUC__ */
++ if (copy_from_user(&cmd, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+#define PREPACK
-+#define POSTPACK __ATTRIB_PACK
++ if( wmi_set_lq_threshold_params(ar->arWmi, &cmd) != A_OK ) {
++ ret = -EIO;
++ }
+
-+#endif /* __KERNEL__ */
++ return ret;
++}
+
-+#endif /* _OSAPI_LINUX_H_ */
-diff --git a/drivers/ar6000/ar6000/wireless_ext.c b/drivers/ar6000/ar6000/wireless_ext.c
-new file mode 100644
-index 0000000..af78ae0
---- /dev/null
-+++ b/drivers/ar6000/ar6000/wireless_ext.c
-@@ -0,0 +1,1979 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
+
-+#include "ar6000_drv.h"
++static int
++ar6000_ioctl_set_probedSsid(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_PROBED_SSID_CMD cmd;
++ int ret = 0;
+
-+static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-+static void ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi);
-+extern unsigned int wmitimeout;
-+extern A_WAITQUEUE_HEAD arEvent;
-+extern wait_queue_head_t ar6000_scan_queue;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+/*
-+ * Encode a WPA or RSN information element as a custom
-+ * element using the hostap format.
-+ */
-+static u_int
-+encode_ie(void *buf, size_t bufsize,
-+ const u_int8_t *ie, size_t ielen,
-+ const char *leader, size_t leader_len)
-+{
-+ u_int8_t *p;
-+ int i;
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+ if (bufsize < leader_len)
-+ return 0;
-+ p = buf;
-+ memcpy(p, leader, leader_len);
-+ bufsize -= leader_len;
-+ p += leader_len;
-+ for (i = 0; i < ielen && bufsize > 2; i++)
-+ p += sprintf(p, "%02x", ie[i]);
-+ return (i == ielen ? p - (u_int8_t *)buf : 0);
++ if (wmi_probedSsid_cmd(ar->arWmi, cmd.entryIndex, cmd.flag, cmd.ssidLength,
++ cmd.ssid) != A_OK)
++ {
++ ret = -EIO;
++ }
++
++ return ret;
+}
+
-+void
-+ar6000_scan_node(void *arg, bss_t *ni)
++static int
++ar6000_ioctl_set_badAp(struct net_device *dev, struct ifreq *rq)
+{
-+ struct iw_event iwe;
-+#if WIRELESS_EXT > 14
-+ char buf[64*2 + 30];
-+#endif
-+ struct ar_giwscan_param *param;
-+ A_CHAR *current_ev;
-+ A_CHAR *end_buf;
-+ struct ieee80211_common_ie *cie;
-+ struct iw_request_info info;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_ADD_BAD_AP_CMD cmd;
++ int ret = 0;
+
-+ info.cmd = 0;
-+ info.flags = 0;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ param = (struct ar_giwscan_param *)arg;
+
-+ if (param->current_ev >= param->end_buf) {
-+ return;
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
+ }
-+ if ((param->firstPass == TRUE) &&
-+ ((ni->ni_cie.ie_wpa == NULL) && (ni->ni_cie.ie_rsn == NULL))) {
-+ /*
-+ * Only forward wpa bss's in first pass
-+ */
-+ return;
++
++ if (cmd.badApIndex > WMI_MAX_BAD_AP_INDEX) {
++ return -EIO;
+ }
+
-+ if ((param->firstPass == FALSE) &&
-+ ((ni->ni_cie.ie_wpa != NULL) || (ni->ni_cie.ie_rsn != NULL))) {
++ if (A_MEMCMP(cmd.bssid, null_mac, AR6000_ETH_ADDR_LEN) == 0) {
+ /*
-+ * Only forward non-wpa bss's in 2nd pass
++ * This is a delete badAP.
+ */
-+ return;
++ if (wmi_deleteBadAp_cmd(ar->arWmi, cmd.badApIndex) != A_OK) {
++ ret = -EIO;
++ }
++ } else {
++ if (wmi_addBadAp_cmd(ar->arWmi, cmd.badApIndex, cmd.bssid) != A_OK) {
++ ret = -EIO;
++ }
+ }
+
-+ current_ev = param->current_ev;
-+ end_buf = param->end_buf;
-+
-+ cie = &ni->ni_cie;
-+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = SIOCGIWAP;
-+ iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-+ A_MEMCPY(iwe.u.ap_addr.sa_data, ni->ni_macaddr, 6);
-+ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+ IW_EV_ADDR_LEN);
++ return ret;
++}
+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = SIOCGIWESSID;
-+ iwe.u.data.flags = 1;
-+ iwe.u.data.length = cie->ie_ssid[1];
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+ &cie->ie_ssid[2]);
++static int
++ar6000_ioctl_create_qos(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_CREATE_PSTREAM_CMD cmd;
++ A_STATUS ret;
+
-+ if (cie->ie_capInfo & (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) {
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = SIOCGIWMODE;
-+ iwe.u.mode = cie->ie_capInfo & IEEE80211_CAPINFO_ESS ?
-+ IW_MODE_MASTER : IW_MODE_ADHOC;
-+ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+ IW_EV_UINT_LEN);
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = SIOCGIWFREQ;
-+ iwe.u.freq.m = cie->ie_chan * 100000;
-+ iwe.u.freq.e = 1;
-+ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+ IW_EV_FREQ_LEN);
-+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVQUAL;
-+ ar6000_set_quality(&iwe.u.qual, ni->ni_snr);
-+ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
-+ IW_EV_QUAL_LEN);
+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = SIOCGIWENCODE;
-+ if (cie->ie_capInfo & IEEE80211_CAPINFO_PRIVACY) {
-+ iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-+ } else {
-+ iwe.u.data.flags = IW_ENCODE_DISABLED;
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
+ }
-+ iwe.u.data.length = 0;
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, "");
-+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVCUSTOM;
-+ snprintf(buf, sizeof(buf), "bcn_int=%d", cie->ie_beaconInt);
-+ iwe.u.data.length = strlen(buf);
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, buf);
-+
-+ if (cie->ie_wpa != NULL) {
-+ static const char wpa_leader[] = "wpa_ie=";
+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVCUSTOM;
-+ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wpa,
-+ cie->ie_wpa[1]+2,
-+ wpa_leader, sizeof(wpa_leader)-1);
++ ret = wmi_verify_tspec_params(&cmd, tspecCompliance);
++ if (ret == A_OK)
++ ret = wmi_create_pstream_cmd(ar->arWmi, &cmd);
+
-+ if (iwe.u.data.length != 0) {
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+ buf);
-+ }
++ switch (ret) {
++ case A_OK:
++ return 0;
++ case A_EBUSY :
++ return -EBUSY;
++ case A_NO_MEMORY:
++ return -ENOMEM;
++ case A_EINVAL:
++ default:
++ return -EFAULT;
+ }
++}
+
-+ if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
-+ static const char rsn_leader[] = "rsn_ie=";
-+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVCUSTOM;
-+ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_rsn,
-+ cie->ie_rsn[1]+2,
-+ rsn_leader, sizeof(rsn_leader)-1);
++static int
++ar6000_ioctl_delete_qos(struct net_device *dev, struct ifreq *rq)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_DELETE_PSTREAM_CMD cmd;
++ int ret = 0;
+
-+ if (iwe.u.data.length != 0) {
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+ buf);
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
+
-+ if (cie->ie_wmm != NULL) {
-+ static const char wmm_leader[] = "wmm_ie=";
-+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVCUSTOM;
-+ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wmm,
-+ cie->ie_wmm[1]+2,
-+ wmm_leader, sizeof(wmm_leader)-1);
-+ if (iwe.u.data.length != 0) {
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+ buf);
-+ }
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
+ }
+
-+ if (cie->ie_ath != NULL) {
-+ static const char ath_leader[] = "ath_ie=";
++ ret = wmi_delete_pstream_cmd(ar->arWmi, cmd.trafficClass, cmd.tsid);
+
-+ A_MEMZERO(&iwe, sizeof(iwe));
-+ iwe.cmd = IWEVCUSTOM;
-+ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_ath,
-+ cie->ie_ath[1]+2,
-+ ath_leader, sizeof(ath_leader)-1);
-+ if (iwe.u.data.length != 0) {
-+ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
-+ buf);
-+ }
++ switch (ret) {
++ case A_OK:
++ return 0;
++ case A_EBUSY :
++ return -EBUSY;
++ case A_NO_MEMORY:
++ return -ENOMEM;
++ case A_EINVAL:
++ default:
++ return -EFAULT;
+ }
-+
-+ param->current_ev = current_ev;
+}
+
-+int
-+ar6000_ioctl_giwscan(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *extra)
++static int
++ar6000_ioctl_get_qos_queue(struct net_device *dev, struct ifreq *rq)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ar_giwscan_param param;
-+ int i;
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ struct ar6000_queuereq qreq;
++ int ret = 0;
+
+ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ param.current_ev = extra;
-+ param.end_buf = extra + IW_SCAN_MAX_DATA;
-+ param.firstPass = TRUE;
++ if( copy_from_user(&qreq, rq->ifr_data,
++ sizeof(struct ar6000_queuereq)))
++ return -EFAULT;
+
-+ /*
-+ * Do two passes to insure WPA scan candidates
-+ * are sorted to the front. This is a hack to deal with
-+ * the wireless extensions capping scan results at
-+ * IW_SCAN_MAX_DATA bytes. In densely populated environments
-+ * it's easy to overflow this buffer (especially with WPA/RSN
-+ * information elements). Note this sorting hack does not
-+ * guarantee we won't overflow anyway.
-+ */
-+ for (i = 0; i < 2; i++) {
-+ /*
-+ * Translate data to WE format.
-+ */
-+ wmi_iterate_nodes(ar->arWmi, ar6000_scan_node, ¶m);
-+ param.firstPass = FALSE;
-+ if (param.current_ev >= param.end_buf) {
-+ data->length = param.current_ev - extra;
-+ return -E2BIG;
-+ }
++ qreq.activeTsids = wmi_get_mapped_qos_queue(ar->arWmi, qreq.trafficClass);
++
++ if (copy_to_user(rq->ifr_data, &qreq,
++ sizeof(struct ar6000_queuereq)))
++ {
++ ret = -EFAULT;
+ }
+
-+ data->length = param.current_ev - extra;
-+ return 0;
++ return ret;
+}
+
-+extern int reconnect_flag;
-+/* SIOCSIWESSID */
-+static int
-+ar6000_ioctl_siwessid(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *ssid)
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++static A_STATUS
++ar6000_ioctl_tcmd_get_rx_report(struct net_device *dev,
++ struct ifreq *rq, A_UINT8 *data, A_UINT32 len)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_STATUS status;
-+ A_UINT8 arNetworkType;
++ A_UINT32 buf[2];
++ int ret = 0;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
++ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ if (ar->arWmiReady == FALSE) {
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ ar->tcmdRxReport = 0;
++ if (wmi_test_cmd(ar->arWmi, data, len) != A_OK) {
++ up(&ar->arSem);
+ return -EIO;
+ }
+
-+ /*
-+ * iwconfig passes a string with length excluding any trailing NUL.
-+ * FIXME: we should be able to set an ESSID of 32 bytes, yet things fall
-+ * over badly if we do. So we limit the ESSID to 31 bytes.
-+ */
-+ if (data->flags && (!data->length || data->length >= sizeof(ar->arSsid))) {
-+ /*
-+ * ssid is invalid
-+ */
-+ return -EINVAL;
-+ }
-+ /* Added for bug 25178, return an IOCTL error instead of target returning
-+ Illegal parameter error when either the BSSID or channel is missing
-+ and we cannot scan during connect.
-+ */
-+ if (data->flags) {
-+ if (ar->arSkipScan == TRUE &&
-+ (ar->arChannelHint == 0 ||
-+ (!ar->arReqBssid[0] && !ar->arReqBssid[1] && !ar->arReqBssid[2] &&
-+ !ar->arReqBssid[3] && !ar->arReqBssid[4] && !ar->arReqBssid[5])))
-+ {
-+ return -EINVAL;
-+ }
-+ }
-+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+
-+ if (ar->arTxPending[WMI_CONTROL_PRI]) {
-+ /*
-+ * sleep until the command queue drains
-+ */
-+ wait_event_interruptible_timeout(arEvent,
-+ ar->arTxPending[WMI_CONTROL_PRI] == 0, wmitimeout * HZ);
-+ if (signal_pending(current)) {
-+ return -EINTR;
-+ }
-+ }
-+
-+ if (!data->flags) {
-+ arNetworkType = ar->arNetworkType;
-+ ar6000_init_profile_info(ar);
-+ ar->arNetworkType = arNetworkType;
++ wait_event_interruptible_timeout(arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
++
++ if (signal_pending(current)) {
++ ret = -EINTR;
+ }
+
-+ /*
-+ * The original logic here prevented a disconnect if issuing an "essid off"
-+ * if no ESSID was set, presumably to prevent sending multiple disconnects
-+ * to the WMI.
-+ *
-+ * Unfortunately, this also meant that no disconnect was sent when we were
-+ * already connected, but the profile has been changed since (which also
-+ * clears the ESSID as a reminder that the WMI needs updating.)
-+ *
-+ * The "1 ||" makes sure we always disconnect or reconnect. The WMI doesn't
-+ * seem to mind being sent multiple disconnects.
-+ */
-+ if (1 || (ar->arSsidLen) || (!data->flags))
-+ {
-+ if ((!data->flags) ||
-+ (A_MEMCMP(ar->arSsid, ssid, ar->arSsidLen) != 0) ||
-+ (ar->arSsidLen != (data->length)))
-+ {
-+ /*
-+ * SSID set previously or essid off has been issued.
-+ *
-+ * Disconnect Command is issued in two cases after wmi is ready
-+ * (1) ssid is different from the previous setting
-+ * (2) essid off has been issued
-+ *
-+ */
-+ if (ar->arWmiReady == TRUE) {
-+ reconnect_flag = 0;
-+ status = wmi_disconnect_cmd(ar->arWmi);
-+ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+ ar->arSsidLen = 0;
-+ if (ar->arSkipScan == FALSE) {
-+ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+ }
-+ if (!data->flags) {
-+ up(&ar->arSem);
-+ return 0;
-+ }
-+ } else {
-+ up(&ar->arSem);
-+ }
-+ }
-+ else
-+ {
-+ /*
-+ * SSID is same, so we assume profile hasn't changed.
-+ * If the interface is up and wmi is ready, we issue
-+ * a reconnect cmd. Issue a reconnect only we are already
-+ * connected.
-+ */
-+ if((ar->arConnected == TRUE) && (ar->arWmiReady == TRUE))
-+ {
-+ reconnect_flag = TRUE;
-+ status = wmi_reconnect_cmd(ar->arWmi,ar->arReqBssid,
-+ ar->arChannelHint);
-+ up(&ar->arSem);
-+ if (status != A_OK) {
-+ return -EIO;
-+ }
-+ return 0;
-+ }
-+ else{
-+ /*
-+ * Dont return if connect is pending.
-+ */
-+ if(!(ar->arConnectPending)) {
-+ up(&ar->arSem);
-+ return 0;
-+ }
-+ }
-+ }
++ buf[0] = ar->tcmdRxTotalPkt;
++ buf[1] = ar->tcmdRxRssi;
++ if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
++ ret = -EFAULT;
+ }
+
-+ ar->arSsidLen = data->length;
-+ A_MEMCPY(ar->arSsid, ssid, ar->arSsidLen);
++ up(&ar->arSem);
+
-+ /* The ssid length check prevents second "essid off" from the user,
-+ to be treated as a connect cmd. The second "essid off" is ignored.
-+ */
-+ if((ar->arWmiReady == TRUE) && (ar->arSsidLen > 0) )
-+ {
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
-+ if (SHARED_AUTH == ar->arDot11AuthMode) {
-+ ar6000_install_static_wep_keys(ar);
-+ }
-+ AR_DEBUG_PRINTF("Connect called with authmode %d dot11 auth %d"\
-+ " PW crypto %d PW crypto Len %d GRP crypto %d"\
-+ " GRP crypto Len %d\n",
-+ ar->arAuthMode, ar->arDot11AuthMode,
-+ ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
-+ ar->arGroupCrypto, ar->arGroupCryptoLen);
-+ reconnect_flag = 0;
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+ status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
-+ ar->arDot11AuthMode, ar->arAuthMode,
-+ ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
-+ ar->arGroupCrypto,ar->arGroupCryptoLen,
-+ ar->arSsidLen, ar->arSsid,
-+ ar->arReqBssid, ar->arChannelHint,
-+ ar->arConnectCtrlFlags);
++ return ret;
++}
+
++void
++ar6000_tcmd_rx_report_event(void *devt, A_UINT8 * results, int len)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)devt;
++ TCMD_CONT_RX * rx_rep = (TCMD_CONT_RX *)results;
+
-+ up(&ar->arSem);
++ ar->tcmdRxTotalPkt = rx_rep->u.report.totalPkt;
++ ar->tcmdRxRssi = rx_rep->u.report.rssiInDBm;
++ ar->tcmdRxReport = 1;
+
-+ if (status != A_OK) {
-+ return -EIO;
-+ }
-+ ar->arConnectPending = TRUE;
-+ }else{
-+ up(&ar->arSem);
-+ }
-+ return 0;
++ wake_up(&arEvent);
+}
++#endif /* CONFIG_HOST_TCMD_SUPPORT*/
+
-+/* SIOCGIWESSID */
+static int
-+ar6000_ioctl_giwessid(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *essid)
++ar6000_ioctl_set_error_report_bitmask(struct net_device *dev, struct ifreq *rq)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_TARGET_ERROR_REPORT_BITMASK cmd;
++ int ret = 0;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
++ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ data->flags = 1;
-+ data->length = ar->arSsidLen;
-+ A_MEMCPY(essid, ar->arSsid, ar->arSsidLen);
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+ return 0;
-+}
++ ret = wmi_set_error_report_bitmask(ar->arWmi, cmd.bitmask);
+
++ return (ret==0 ? ret : -EINVAL);
++}
+
-+void ar6000_install_static_wep_keys(AR_SOFTC_T *ar)
++static int
++ar6000_clear_target_stats(struct net_device *dev)
+{
-+ A_UINT8 index;
-+ A_UINT8 keyUsage;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ TARGET_STATS *pStats = &ar->arTargetStats;
++ int ret = 0;
+
-+ for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
-+ if (ar->arWepKeyList[index].arKeyLen) {
-+ keyUsage = GROUP_USAGE;
-+ if (index == ar->arDefTxKeyIndex) {
-+ keyUsage |= TX_USAGE;
-+ }
-+ wmi_addKey_cmd(ar->arWmi,
-+ index,
-+ WEP_CRYPT,
-+ keyUsage,
-+ ar->arWepKeyList[index].arKeyLen,
-+ NULL,
-+ ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL,
-+ NO_SYNC_WMIFLAG);
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ A_MEMZERO(pStats, sizeof(TARGET_STATS));
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ return ret;
+}
+
-+int
-+ar6000_ioctl_delkey(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
-+{
-+ return 0;
-+}
-+
-+int
-+ar6000_ioctl_setmlme(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
++static int
++ar6000_ioctl_get_target_stats(struct net_device *dev, struct ifreq *rq)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ieee80211req_mlme *mlme = (struct ieee80211req_mlme *)extra;
++ TARGET_STATS_CMD cmd;
++ TARGET_STATS *pStats = &ar->arTargetStats;
++ int ret = 0;
+
-+ if ((ar->arWmiReady == FALSE) || (ar->arConnected != TRUE))
-+ return -EIO;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+ switch (mlme->im_op) {
-+ case IEEE80211_MLME_DISASSOC:
-+ case IEEE80211_MLME_DEAUTH:
-+ /* Not Supported */
-+ break;
-+ default:
-+ break;
++ ar->statsUpdatePending = TRUE;
++
++ if(wmi_get_stats_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
+ }
-+ return 0;
-+}
+
++ wait_event_interruptible_timeout(arEvent, ar->statsUpdatePending == FALSE, wmitimeout * HZ);
+
-+int
-+ar6000_ioctl_setwmmparams(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
-+{
-+ return -EIO; /* for now */
-+}
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
+
-+int
-+ar6000_ioctl_getwmmparams(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
-+{
-+ return -EIO; /* for now */
-+}
++ if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
++ ret = -EFAULT;
++ }
+
-+int ar6000_ioctl_setoptie(struct net_device *dev, struct iw_request_info *info,
-+ struct iw_point *data, char *extra)
-+{
-+ /* The target generates the WPA/RSN IE */
-+ return 0;
++ if (cmd.clearStats == 1) {
++ ret = ar6000_clear_target_stats(dev);
++ }
++
++ up(&ar->arSem);
++
++ return ret;
+}
+
-+int
-+ar6000_ioctl_setauthalg(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
++static int
++ar6000_ioctl_set_access_params(struct net_device *dev, struct ifreq *rq)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ieee80211req_authalg *req = (struct ieee80211req_authalg *)extra;
++ WMI_SET_ACCESS_PARAMS_CMD cmd;
+ int ret = 0;
+
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+ if (req->auth_alg == AUTH_ALG_OPEN_SYSTEM) {
-+ ar->arDot11AuthMode = OPEN_AUTH;
-+ } else if (req->auth_alg == AUTH_ALG_LEAP) {
-+ ar->arDot11AuthMode = LEAP_AUTH;
-+ ar->arPairwiseCrypto = WEP_CRYPT;
-+ ar->arGroupCrypto = WEP_CRYPT;
++ if (wmi_set_access_params_cmd(ar->arWmi, cmd.txop, cmd.eCWmin, cmd.eCWmax,
++ cmd.aifsn) == A_OK)
++ {
++ ret = 0;
+ } else {
-+ ret = -EIO;
++ ret = -EINVAL;
+ }
+
-+ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
-+
-+ return ret;
++ return (ret);
+}
++
+static int
-+ar6000_ioctl_addpmkid(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
++ar6000_ioctl_set_disconnect_timeout(struct net_device *dev, struct ifreq *rq)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ieee80211req_addpmkid *req = (struct ieee80211req_addpmkid *)extra;
-+ A_STATUS status;
++ WMI_DISC_TIMEOUT_CMD cmd;
++ int ret = 0;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
++ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ AR_DEBUG_PRINTF("Add pmkid for %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x en=%d\n",
-+ req->pi_bssid[0], req->pi_bssid[1], req->pi_bssid[2],
-+ req->pi_bssid[3], req->pi_bssid[4], req->pi_bssid[5],
-+ req->pi_enable);
-+
-+ status = wmi_setPmkid_cmd(ar->arWmi, req->pi_bssid, req->pi_pmkid,
-+ req->pi_enable);
++ if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
++ return -EFAULT;
++ }
+
-+ if (status != A_OK) {
-+ return -EIO;
++ if (wmi_disctimeout_cmd(ar->arWmi, cmd.disconnectTimeout) == A_OK)
++ {
++ ret = 0;
++ } else {
++ ret = -EINVAL;
+ }
+
-+ return 0;
++ return (ret);
+}
+
-+/*
-+ * SIOCSIWRATE
-+ */
-+int
-+ar6000_ioctl_siwrate(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++static int
++ar6000_xioctl_set_voice_pkt_size(struct net_device *dev, char * userdata)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_UINT32 kbps;
++ WMI_SET_VOICE_PKT_SIZE_CMD cmd;
++ int ret = 0;
+
-+ if (rrq->fixed) {
-+ kbps = rrq->value / 1000; /* rrq->value is in bps */
-+ } else {
-+ kbps = -1; /* -1 indicates auto rate */
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
-+ if(kbps != -1 && wmi_validate_bitrate(ar->arWmi, kbps) == A_EINVAL)
-+ {
-+ AR_DEBUG_PRINTF("BitRate is not Valid %d\n", kbps);
-+ return -EINVAL;
++
++ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
++ return -EFAULT;
+ }
-+ ar->arBitRate = kbps;
-+ if(ar->arWmiReady == TRUE)
++
++ if (wmi_set_voice_pkt_size_cmd(ar->arWmi, cmd.voicePktSize) == A_OK)
+ {
-+ if (wmi_set_bitrate_cmd(ar->arWmi, kbps) != A_OK) {
-+ return -EINVAL;
-+ }
++ ret = 0;
++ } else {
++ ret = -EINVAL;
+ }
-+ return 0;
++
++
++ return (ret);
+}
+
-+/*
-+ * SIOCGIWRATE
-+ */
-+int
-+ar6000_ioctl_giwrate(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++static int
++ar6000_xioctl_set_max_sp_len(struct net_device *dev, char * userdata)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SET_MAX_SP_LEN_CMD cmd;
+ int ret = 0;
+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ if(ar->arWmiReady == TRUE)
-+ {
-+ ar->arBitRate = 0xFFFF;
-+ if (wmi_get_bitrate_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
-+ wait_event_interruptible_timeout(arEvent, ar->arBitRate != 0xFFFF, wmitimeout * HZ);
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
+ }
-+ /* If the interface is down or wmi is not ready or the target is not
-+ connected - return the value stored in the device structure */
-+ if (!ret) {
-+ if (ar->arBitRate == -1) {
-+ rrq->fixed = TRUE;
-+ rrq->value = 0;
-+ } else {
-+ rrq->value = ar->arBitRate * 1000;
-+ }
++
++ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
++ return -EFAULT;
+ }
+
-+ up(&ar->arSem);
++ if (wmi_set_max_sp_len_cmd(ar->arWmi, cmd.maxSPLen) == A_OK)
++ {
++ ret = 0;
++ } else {
++ ret = -EINVAL;
++ }
+
-+ return ret;
++ return (ret);
+}
+
-+/*
-+ * SIOCSIWTXPOW
-+ */
++
+static int
-+ar6000_ioctl_siwtxpow(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++ar6000_xioctl_set_bt_status_cmd(struct net_device *dev, char * userdata)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_UINT8 dbM;
++ WMI_SET_BT_STATUS_CMD cmd;
++ int ret = 0;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
++ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ if (ar->arRadioSwitch == WLAN_ENABLED
-+ && rrq->disabled) {
-+ if (wmi_switch_radio(ar->arWmi, WLAN_DISABLED) < 0)
-+ return -EIO;
-+ ar->arRadioSwitch = WLAN_DISABLED;
-+ } else if (ar->arRadioSwitch == WLAN_DISABLED
-+ && !rrq->disabled) {
-+ if (wmi_switch_radio(ar->arWmi, WLAN_ENABLED) < 0)
-+ return -EIO;
-+ ar->arRadioSwitch = WLAN_ENABLED;
++ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
++ return -EFAULT;
+ }
+
-+ if (rrq->fixed) {
-+ if (rrq->flags != IW_TXPOW_DBM) {
-+ return -EOPNOTSUPP;
-+ }
-+ ar->arTxPwr= dbM = rrq->value;
-+ ar->arTxPwrSet = TRUE;
-+ } else {
-+ ar->arTxPwr = dbM = 0;
-+ ar->arTxPwrSet = FALSE;
-+ }
-+ if(ar->arWmiReady == TRUE)
++ if (wmi_set_bt_status_cmd(ar->arWmi, cmd.streamType, cmd.status) == A_OK)
+ {
-+ AR_DEBUG_PRINTF("Set tx pwr cmd %d dbM\n", dbM);
-+ wmi_set_txPwr_cmd(ar->arWmi, dbM);
++ ret = 0;
++ } else {
++ ret = -EINVAL;
+ }
-+ return 0;
++
++ return (ret);
+}
+
-+/*
-+ * SIOCGIWTXPOW
-+ */
-+int
-+ar6000_ioctl_giwtxpow(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++static int
++ar6000_xioctl_set_bt_params_cmd(struct net_device *dev, char * userdata)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_SET_BT_PARAMS_CMD cmd;
+ int ret = 0;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
++ if (ar->arWmiReady == FALSE) {
+ return -EIO;
+ }
+
-+ if (ar->arRadioSwitch == WLAN_DISABLED) {
-+ rrq->disabled = 1;
-+ return 0;
++ if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
++ return -EFAULT;
+ }
+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ if((ar->arWmiReady == TRUE) && (ar->arConnected == TRUE))
++ if (wmi_set_bt_params_cmd(ar->arWmi, &cmd) == A_OK)
+ {
-+ ar->arTxPwr = 0;
++ ret = 0;
++ } else {
++ ret = -EINVAL;
++ }
+
-+ if (wmi_get_txPwr_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++ return (ret);
++}
+
-+ wait_event_interruptible_timeout(arEvent, ar->arTxPwr != 0, wmitimeout * HZ);
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++struct ar6000_gpio_intr_wait_cmd_s gpio_intr_results;
++/* gpio_reg_results and gpio_data_available are protected by arSem */
++static struct ar6000_gpio_register_cmd_s gpio_reg_results;
++static A_BOOL gpio_data_available; /* Requested GPIO data available */
++static A_BOOL gpio_intr_available; /* GPIO interrupt info available */
++static A_BOOL gpio_ack_received; /* GPIO ack was received */
+
-+ if (signal_pending(current)) {
-+ ret = -EINTR;
-+ }
-+ }
-+ /* If the interace is down or wmi is not ready or target is not connected
-+ then return value stored in the device structure */
-+
-+ if (!ret) {
-+ if (ar->arTxPwrSet == TRUE) {
-+ rrq->fixed = TRUE;
-+ }
-+ rrq->value = ar->arTxPwr;
-+ rrq->flags = IW_TXPOW_DBM;
-+ }
-+
-+ up(&ar->arSem);
-+
-+ return ret;
++/* Host-side initialization for General Purpose I/O support */
++void ar6000_gpio_init(void)
++{
++ gpio_intr_available = FALSE;
++ gpio_data_available = FALSE;
++ gpio_ack_received = FALSE;
+}
+
+/*
-+ * SIOCSIWRETRY
-+ * since iwconfig only provides us with one max retry value, we use it
-+ * to apply to data frames of the BE traffic class.
++ * Called when a GPIO interrupt is received from the Target.
++ * intr_values shows which GPIO pins have interrupted.
++ * input_values shows a recent value of GPIO pins.
+ */
-+static int
-+ar6000_ioctl_siwretry(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++void
++ar6000_gpio_intr_rx(A_UINT32 intr_mask, A_UINT32 input_values)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
-+
-+ if (rrq->disabled) {
-+ return -EOPNOTSUPP;
-+ }
-+
-+ if ((rrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT) {
-+ return -EOPNOTSUPP;
-+ }
-+
-+ if ( !(rrq->value >= WMI_MIN_RETRIES) || !(rrq->value <= WMI_MAX_RETRIES)) {
-+ return - EINVAL;
-+ }
-+ if(ar->arWmiReady == TRUE)
-+ {
-+ if (wmi_set_retry_limits_cmd(ar->arWmi, DATA_FRAMETYPE, WMM_AC_BE,
-+ rrq->value, 0) != A_OK){
-+ return -EINVAL;
-+ }
-+ }
-+ ar->arMaxRetries = rrq->value;
-+ return 0;
++ gpio_intr_results.intr_mask = intr_mask;
++ gpio_intr_results.input_values = input_values;
++ *((volatile A_BOOL *)&gpio_intr_available) = TRUE;
++ wake_up(&arEvent);
+}
+
+/*
-+ * SIOCGIWRETRY
++ * This is called when a response is received from the Target
++ * for a previous or ar6000_gpio_input_get or ar6000_gpio_register_get
++ * call.
+ */
-+static int
-+ar6000_ioctl_giwretry(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *rrq, char *extra)
++void
++ar6000_gpio_data_rx(A_UINT32 reg_id, A_UINT32 value)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
-+
-+ rrq->disabled = 0;
-+ switch (rrq->flags & IW_RETRY_TYPE) {
-+ case IW_RETRY_LIFETIME:
-+ return -EOPNOTSUPP;
-+ break;
-+ case IW_RETRY_LIMIT:
-+ rrq->flags = IW_RETRY_LIMIT;
-+ switch (rrq->flags & IW_RETRY_MODIFIER) {
-+ case IW_RETRY_MIN:
-+ rrq->flags |= IW_RETRY_MIN;
-+ rrq->value = WMI_MIN_RETRIES;
-+ break;
-+ case IW_RETRY_MAX:
-+ rrq->flags |= IW_RETRY_MAX;
-+ rrq->value = ar->arMaxRetries;
-+ break;
-+ }
-+ break;
-+ }
-+ return 0;
++ gpio_reg_results.gpioreg_id = reg_id;
++ gpio_reg_results.value = value;
++ *((volatile A_BOOL *)&gpio_data_available) = TRUE;
++ wake_up(&arEvent);
+}
+
+/*
-+ * SIOCSIWENCODE
++ * This is called when an acknowledgement is received from the Target
++ * for a previous or ar6000_gpio_output_set or ar6000_gpio_register_set
++ * call.
+ */
-+static int
-+ar6000_ioctl_siwencode(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *erq, char *keybuf)
++void
++ar6000_gpio_ack_rx(void)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ int index;
-+ A_INT32 auth = ar->arDot11AuthMode;
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
-+
-+ index = erq->flags & IW_ENCODE_INDEX;
-+
-+ if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
-+ ((index - 1) > WMI_MAX_KEY_INDEX)))
-+ {
-+ return -EIO;
-+ }
-+
-+ if (erq->flags & IW_ENCODE_DISABLED) {
-+ /*
-+ * Encryption disabled
-+ */
-+ if (index) {
-+ /*
-+ * If key index was specified then clear the specified key
-+ */
-+ index--;
-+ A_MEMZERO(ar->arWepKeyList[index].arKey,
-+ sizeof(ar->arWepKeyList[index].arKey));
-+ ar->arWepKeyList[index].arKeyLen = 0;
-+ }
-+ ar->arDot11AuthMode = OPEN_AUTH;
-+ ar->arPairwiseCrypto = NONE_CRYPT;
-+ ar->arGroupCrypto = NONE_CRYPT;
-+ ar->arAuthMode = NONE_AUTH;
-+ } else {
-+ /*
-+ * Enabling WEP encryption
-+ */
-+ if (index) {
-+ index--; /* keyindex is off base 1 in iwconfig */
-+ }
-+
-+ if (erq->flags & IW_ENCODE_OPEN) {
-+ auth = OPEN_AUTH;
-+ } else if (erq->flags & IW_ENCODE_RESTRICTED) {
-+ auth = SHARED_AUTH;
-+ }
-+
-+ if (erq->length) {
-+ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(erq->length)) {
-+ return -EIO;
-+ }
-+
-+ A_MEMZERO(ar->arWepKeyList[index].arKey,
-+ sizeof(ar->arWepKeyList[index].arKey));
-+ A_MEMCPY(ar->arWepKeyList[index].arKey, keybuf, erq->length);
-+ ar->arWepKeyList[index].arKeyLen = erq->length;
-+ } else {
-+ if (ar->arWepKeyList[index].arKeyLen == 0) {
-+ return -EIO;
-+ }
-+ ar->arDefTxKeyIndex = index;
-+ }
-+
-+ ar->arPairwiseCrypto = WEP_CRYPT;
-+ ar->arGroupCrypto = WEP_CRYPT;
-+ ar->arDot11AuthMode = auth;
-+ ar->arAuthMode = NONE_AUTH;
-+ }
-+
-+ /*
-+ * profile has changed. Erase ssid to signal change
-+ */
-+ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+ ar->arSsidLen = 0;
-+
-+ return 0;
++ gpio_ack_received = TRUE;
++ wake_up(&arEvent);
+}
+
-+static int
-+ar6000_ioctl_giwencode(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *erq, char *key)
++A_STATUS
++ar6000_gpio_output_set(struct net_device *dev,
++ A_UINT32 set_mask,
++ A_UINT32 clear_mask,
++ A_UINT32 enable_mask,
++ A_UINT32 disable_mask)
+{
+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ A_UINT8 keyIndex;
-+ struct ar_wep_key *wk;
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
-+
-+ if (ar->arPairwiseCrypto == NONE_CRYPT) {
-+ erq->length = 0;
-+ erq->flags = IW_ENCODE_DISABLED;
-+ } else {
-+ /* get the keyIndex */
-+ keyIndex = erq->flags & IW_ENCODE_INDEX;
-+ if (0 == keyIndex) {
-+ keyIndex = ar->arDefTxKeyIndex;
-+ } else if ((keyIndex - 1 < WMI_MIN_KEY_INDEX) ||
-+ (keyIndex - 1 > WMI_MAX_KEY_INDEX))
-+ {
-+ keyIndex = WMI_MIN_KEY_INDEX;
-+ } else {
-+ keyIndex--;
-+ }
-+ erq->flags = keyIndex + 1;
-+ erq->flags |= IW_ENCODE_ENABLED;
-+ wk = &ar->arWepKeyList[keyIndex];
-+ if (erq->length > wk->arKeyLen) {
-+ erq->length = wk->arKeyLen;
-+ }
-+ if (wk->arKeyLen) {
-+ A_MEMCPY(key, wk->arKey, erq->length);
-+ }
-+ if (ar->arDot11AuthMode == OPEN_AUTH) {
-+ erq->flags |= IW_ENCODE_OPEN;
-+ } else if (ar->arDot11AuthMode == SHARED_AUTH) {
-+ erq->flags |= IW_ENCODE_RESTRICTED;
-+ }
-+ }
+
-+ return 0;
++ gpio_ack_received = FALSE;
++ return wmi_gpio_output_set(ar->arWmi,
++ set_mask, clear_mask, enable_mask, disable_mask);
+}
+
-+static int ar6000_ioctl_siwpower(struct net_device *dev,
-+ struct iw_request_info *info,
-+ union iwreq_data *wrqu, char *extra)
++static A_STATUS
++ar6000_gpio_input_get(struct net_device *dev)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ WMI_POWER_MODE power_mode;
-+
-+ if (wrqu->power.disabled)
-+ power_mode = MAX_PERF_POWER;
-+ else
-+ power_mode = REC_POWER;
-+
-+ if (wmi_powermode_cmd(ar->arWmi, power_mode) < 0)
-+ return -EIO;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ return 0;
++ *((volatile A_BOOL *)&gpio_data_available) = FALSE;
++ return wmi_gpio_input_get(ar->arWmi);
+}
+
-+static int ar6000_ioctl_giwpower(struct net_device *dev,
-+ struct iw_request_info *info,
-+ union iwreq_data *wrqu, char *extra)
++static A_STATUS
++ar6000_gpio_register_set(struct net_device *dev,
++ A_UINT32 gpioreg_id,
++ A_UINT32 value)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+
-+ /*
-+ * FIXME:
-+ * https://docs.openmoko.org/trac/ticket/2267
-+ * When starting wpa_supplicant the kernel oopses.
-+ * The following condition avoids the oops.
-+ * Remove this comment to bless this solution.
-+ */
-+ if (ar->arWlanState == WLAN_DISABLED || ar->arWmiReady == FALSE)
-+ return -EIO;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ return wmi_get_power_mode_cmd(ar->arWmi);
++ gpio_ack_received = FALSE;
++ return wmi_gpio_register_set(ar->arWmi, gpioreg_id, value);
+}
+
-+static int ar6000_ioctl_siwgenie(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *dwrq,
-+ char *extra)
++static A_STATUS
++ar6000_gpio_register_get(struct net_device *dev,
++ A_UINT32 gpioreg_id)
+{
-+ /* The target does that for us */
-+ return 0;
-+}
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+static int ar6000_ioctl_giwgenie(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *dwrq,
-+ char *extra)
-+{
-+ return 0;
++ *((volatile A_BOOL *)&gpio_data_available) = FALSE;
++ return wmi_gpio_register_get(ar->arWmi, gpioreg_id);
+}
+
-+static int ar6000_ioctl_siwauth(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *param,
-+ char *extra)
++static A_STATUS
++ar6000_gpio_intr_ack(struct net_device *dev,
++ A_UINT32 ack_mask)
+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ int reset = 0;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ switch (param->flags & IW_AUTH_INDEX) {
-+ case IW_AUTH_WPA_VERSION:
-+ if (param->value & IW_AUTH_WPA_VERSION_DISABLED) {
-+ ar->arAuthMode = NONE_AUTH;
-+ }
-+ if (param->value & IW_AUTH_WPA_VERSION_WPA) {
-+ ar->arAuthMode = WPA_AUTH;
-+ }
-+ if (param->value & IW_AUTH_WPA_VERSION_WPA2) {
-+ ar->arAuthMode = WPA2_AUTH;
-+ }
++ gpio_intr_available = FALSE;
++ return wmi_gpio_intr_ack(ar->arWmi, ack_mask);
++}
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ reset = 1;
-+ break;
-+ case IW_AUTH_CIPHER_PAIRWISE:
-+ if (param->value & IW_AUTH_CIPHER_NONE) {
-+ ar->arPairwiseCrypto = NONE_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_WEP40) {
-+ ar->arPairwiseCrypto = WEP_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_TKIP) {
-+ ar->arPairwiseCrypto = TKIP_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_CCMP) {
-+ ar->arPairwiseCrypto = AES_CRYPT;
-+ }
++int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ HIF_DEVICE *hifDevice = ar->arHifDevice;
++ int ret, param, param2;
++ unsigned int address = 0;
++ unsigned int length = 0;
++ unsigned char *buffer;
++ char *userdata;
++ A_UINT32 connectCtrlFlags;
+
-+ reset = 1;
-+ break;
-+ case IW_AUTH_CIPHER_GROUP:
-+ if (param->value & IW_AUTH_CIPHER_NONE) {
-+ ar->arGroupCrypto = NONE_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_WEP40) {
-+ ar->arGroupCrypto = WEP_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_TKIP) {
-+ ar->arGroupCrypto = TKIP_CRYPT;
-+ }
-+ if (param->value & IW_AUTH_CIPHER_CCMP) {
-+ ar->arGroupCrypto = AES_CRYPT;
-+ }
+
-+ reset = 1;
-+ break;
-+ case IW_AUTH_KEY_MGMT:
-+ if (param->value & IW_AUTH_KEY_MGMT_PSK) {
-+ if (ar->arAuthMode == WPA_AUTH) {
-+ ar->arAuthMode = WPA_PSK_AUTH;
-+ } else if (ar->arAuthMode == WPA2_AUTH) {
-+ ar->arAuthMode = WPA2_PSK_AUTH;
-+ }
++ static WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
++ WMI_SHORTSCANRATIO_DEFAULT,
++ DEFAULT_SCAN_CTRL_FLAGS,
++ 0};
++ WMI_SET_AKMP_PARAMS_CMD akmpParams;
++ WMI_SET_PMKID_LIST_CMD pmkidInfo;
+
-+ reset = 1;
-+ }
-+ break;
++ if (cmd == AR6000_IOCTL_EXTENDED)
++ {
++ /*
++ * This allows for many more wireless ioctls than would otherwise
++ * be available. Applications embed the actual ioctl command in
++ * the first word of the parameter block, and use the command
++ * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
++ */
++ get_user(cmd, (int *)rq->ifr_data);
++ userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
++ }
++ else
++ {
++ userdata = (char *)rq->ifr_data;
++ }
+
-+ case IW_AUTH_TKIP_COUNTERMEASURES:
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
-+ wmi_set_tkip_countermeasures_cmd(ar->arWmi, param->value);
-+ break;
++ if ((ar->arWlanState == WLAN_DISABLED) &&
++ ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
++ (cmd != AR6000_XIOCTL_DIAG_READ) &&
++ (cmd != AR6000_XIOCTL_DIAG_WRITE)))
++ {
++ return -EIO;
++ }
+
-+ case IW_AUTH_DROP_UNENCRYPTED:
-+ break;
++ ret = 0;
++ switch(cmd)
++ {
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++ case AR6000_XIOCTL_TCMD_CONT_TX:
++ {
++ TCMD_CONT_TX txCmd;
+
-+ case IW_AUTH_80211_AUTH_ALG:
-+ if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
-+ ar->arDot11AuthMode = OPEN_AUTH;
-+ }
-+ if (param->value & IW_AUTH_ALG_SHARED_KEY) {
-+ ar->arDot11AuthMode = SHARED_AUTH;
-+ }
-+ if (param->value & IW_AUTH_ALG_LEAP) {
-+ ar->arDot11AuthMode = LEAP_AUTH;
-+ ar->arPairwiseCrypto = WEP_CRYPT;
-+ ar->arGroupCrypto = WEP_CRYPT;
-+ }
++ if (ar->tcmdPm == TCMD_PM_SLEEP) {
++ A_PRINTF("Can NOT send tx tcmd when target is asleep! \n");
++ return -EFAULT;
++ }
+
-+ reset = 1;
-+ break;
++ if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX)))
++ return -EFAULT;
++ wmi_test_cmd(ar->arWmi,(A_UINT8 *)&txCmd, sizeof(TCMD_CONT_TX));
++ }
++ break;
++ case AR6000_XIOCTL_TCMD_CONT_RX:
++ {
++ TCMD_CONT_RX rxCmd;
+
-+ case IW_AUTH_WPA_ENABLED:
-+ reset = 1;
-+ break;
++ if (ar->tcmdPm == TCMD_PM_SLEEP) {
++ A_PRINTF("Can NOT send rx tcmd when target is asleep! \n");
++ return -EFAULT;
++ }
++ if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX)))
++ return -EFAULT;
++ switch(rxCmd.act)
++ {
++ case TCMD_CONT_RX_PROMIS:
++ case TCMD_CONT_RX_FILTER:
++ case TCMD_CONT_RX_SETMAC:
++ wmi_test_cmd(ar->arWmi,(A_UINT8 *)&rxCmd,
++ sizeof(TCMD_CONT_RX));
++ break;
++ case TCMD_CONT_RX_REPORT:
++ ar6000_ioctl_tcmd_get_rx_report(dev, rq,
++ (A_UINT8 *)&rxCmd, sizeof(TCMD_CONT_RX));
++ break;
++ default:
++ A_PRINTF("Unknown Cont Rx mode: %d\n",rxCmd.act);
++ return -EINVAL;
++ }
++ }
++ break;
++ case AR6000_XIOCTL_TCMD_PM:
++ {
++ TCMD_PM pmCmd;
+
-+ case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-+ break;
++ if(copy_from_user(&pmCmd, userdata, sizeof(TCMD_PM)))
++ return -EFAULT;
++ ar->tcmdPm = pmCmd.mode;
++ wmi_test_cmd(ar->arWmi, (A_UINT8*)&pmCmd, sizeof(TCMD_PM));
++ }
++ break;
++#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
-+ case IW_AUTH_PRIVACY_INVOKED:
-+ break;
++ case AR6000_XIOCTL_BMI_DONE:
++ ret = BMIDone(hifDevice);
++ break;
+
-+ default:
-+ printk("%s(): Unknown flag 0x%x\n", __FUNCTION__, param->flags);
-+ return -EOPNOTSUPP;
-+ }
++ case AR6000_XIOCTL_BMI_READ_MEMORY:
++ get_user(address, (unsigned int *)userdata);
++ get_user(length, (unsigned int *)userdata + 1);
++ AR_DEBUG_PRINTF("Read Memory (address: 0x%x, length: %d)\n",
++ address, length);
++ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
++ A_MEMZERO(buffer, length);
++ ret = BMIReadMemory(hifDevice, address, buffer, length);
++ if (copy_to_user(rq->ifr_data, buffer, length)) {
++ ret = -EFAULT;
++ }
++ A_FREE(buffer);
++ } else {
++ ret = -ENOMEM;
++ }
++ break;
+
-+ if (reset) {
-+ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+ ar->arSsidLen = 0;
-+ }
-+
-+ return 0;
-+}
-+
-+static int ar6000_ioctl_giwauth(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *dwrq,
-+ char *extra)
-+{
-+ return 0;
-+}
-+
-+static int ar6000_ioctl_siwencodeext(struct net_device *dev,
-+ struct iw_request_info *info,
-+ union iwreq_data *wrqu,
-+ char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct iw_point *encoding = &wrqu->encoding;
-+ struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-+ int alg = ext->alg, idx;
-+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
-+
-+ /* Determine and validate the key index */
-+ idx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-+ if (idx) {
-+ if (idx < 0 || idx > 3)
-+ return -EINVAL;
-+ }
-+
-+ if ((alg == IW_ENCODE_ALG_TKIP) || (alg == IW_ENCODE_ALG_CCMP)) {
-+ struct ieee80211req_key ik;
-+ KEY_USAGE key_usage;
-+ CRYPTO_TYPE key_type = NONE_CRYPT;
-+ int status;
-+
-+ ar->user_saved_keys.keyOk = FALSE;
-+
-+ if (alg == IW_ENCODE_ALG_TKIP) {
-+ key_type = TKIP_CRYPT;
-+ ik.ik_type = IEEE80211_CIPHER_TKIP;
-+ } else {
-+ key_type = AES_CRYPT;
-+ ik.ik_type = IEEE80211_CIPHER_AES_CCM;
-+ }
-+
-+ ik.ik_keyix = idx;
-+ ik.ik_keylen = ext->key_len;
-+ ik.ik_flags = IEEE80211_KEY_RECV;
-+ if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
-+ ik.ik_flags |= IEEE80211_KEY_XMIT
-+ | IEEE80211_KEY_DEFAULT;
-+ }
-+
-+ if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-+ memcpy(&ik.ik_keyrsc, ext->rx_seq, 8);
-+ }
-+
-+ memcpy(ik.ik_keydata, ext->key, ext->key_len);
-+
-+ ar->user_saved_keys.keyType = key_type;
-+ if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
-+ key_usage = GROUP_USAGE;
-+ memset(ik.ik_macaddr, 0, ETH_ALEN);
-+ memcpy(&ar->user_saved_keys.bcast_ik, &ik,
-+ sizeof(struct ieee80211req_key));
-+ } else {
-+ key_usage = PAIRWISE_USAGE;
-+ memcpy(ik.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
-+ memcpy(&ar->user_saved_keys.ucast_ik, &ik,
-+ sizeof(struct ieee80211req_key));
-+ }
-+
-+ status = wmi_addKey_cmd(ar->arWmi, ik.ik_keyix, key_type,
-+ key_usage, ik.ik_keylen,
-+ (A_UINT8 *)&ik.ik_keyrsc,
-+ ik.ik_keydata,
-+ KEY_OP_INIT_VAL, SYNC_BEFORE_WMIFLAG);
-+
-+ if (status < 0)
-+ return -EIO;
-+
-+ ar->user_saved_keys.keyOk = TRUE;
-+
-+ return 0;
-+
-+ } else {
-+ /* WEP falls back to SIWENCODE */
-+ return -EOPNOTSUPP;
-+ }
-+
-+ return 0;
-+}
++ case AR6000_XIOCTL_BMI_WRITE_MEMORY:
++ get_user(address, (unsigned int *)userdata);
++ get_user(length, (unsigned int *)userdata + 1);
++ AR_DEBUG_PRINTF("Write Memory (address: 0x%x, length: %d)\n",
++ address, length);
++ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
++ A_MEMZERO(buffer, length);
++ if (copy_from_user(buffer, &userdata[sizeof(address) +
++ sizeof(length)], length))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = BMIWriteMemory(hifDevice, address, buffer, length);
++ }
++ A_FREE(buffer);
++ } else {
++ ret = -ENOMEM;
++ }
++ break;
+
++ case AR6000_XIOCTL_BMI_TEST:
++ AR_DEBUG_PRINTF("No longer supported\n");
++ ret = -EOPNOTSUPP;
++ break;
+
-+static int ar6000_ioctl_giwencodeext(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *dwrq,
-+ char *extra)
-+{
-+ return 0;
-+}
++ case AR6000_XIOCTL_BMI_EXECUTE:
++ get_user(address, (unsigned int *)userdata);
++ get_user(param, (unsigned int *)userdata + 1);
++ AR_DEBUG_PRINTF("Execute (address: 0x%x, param: %d)\n",
++ address, param);
++ ret = BMIExecute(hifDevice, address, ¶m);
++ put_user(param, (unsigned int *)rq->ifr_data); /* return value */
++ break;
+
++ case AR6000_XIOCTL_BMI_SET_APP_START:
++ get_user(address, (unsigned int *)userdata);
++ AR_DEBUG_PRINTF("Set App Start (address: 0x%x)\n", address);
++ ret = BMISetAppStart(hifDevice, address);
++ break;
+
-+static int
-+ar6000_ioctl_setparam(struct net_device *dev,
-+ struct iw_request_info *info,
-+ void *erq, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ int *i = (int *)extra;
-+ int param = i[0];
-+ int value = i[1];
-+ int ret = 0;
-+ A_BOOL profChanged = FALSE;
++ case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
++ get_user(address, (unsigned int *)userdata);
++ ret = BMIReadSOCRegister(hifDevice, address, ¶m);
++ put_user(param, (unsigned int *)rq->ifr_data); /* return value */
++ break;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
++ get_user(address, (unsigned int *)userdata);
++ get_user(param, (unsigned int *)userdata + 1);
++ ret = BMIWriteSOCRegister(hifDevice, address, param);
++ break;
+
-+ switch (param) {
-+ case IEEE80211_PARAM_WPA:
-+ switch (value) {
-+ case WPA_MODE_WPA1:
-+ ar->arAuthMode = WPA_AUTH;
-+ profChanged = TRUE;
-+ break;
-+ case WPA_MODE_WPA2:
-+ ar->arAuthMode = WPA2_AUTH;
-+ profChanged = TRUE;
-+ break;
-+ case WPA_MODE_NONE:
-+ ar->arAuthMode = NONE_AUTH;
-+ profChanged = TRUE;
++#ifdef HTC_RAW_INTERFACE
++ case AR6000_XIOCTL_HTC_RAW_OPEN:
++ ret = A_OK;
++ if (!arRawIfEnabled(ar)) {
++ /* make sure block size is set in case the target was reset since last
++ * BMI phase (i.e. flashup downloads) */
++ ret = ar6000_SetHTCBlockSize(ar);
++ if (A_FAILED(ret)) {
+ break;
-+ default:
-+ printk("IEEE80211_PARAM_WPA: Unknown value %d\n", value);
++ }
++ /* Terminate the BMI phase */
++ ret = BMIDone(hifDevice);
++ if (ret == A_OK) {
++ ret = ar6000_htc_raw_open(ar);
++ }
+ }
+ break;
-+ case IEEE80211_PARAM_AUTHMODE:
-+ switch(value) {
-+ case IEEE80211_AUTH_WPA_PSK:
-+ if (WPA_AUTH == ar->arAuthMode) {
-+ ar->arAuthMode = WPA_PSK_AUTH;
-+ profChanged = TRUE;
-+ } else if (WPA2_AUTH == ar->arAuthMode) {
-+ ar->arAuthMode = WPA2_PSK_AUTH;
-+ profChanged = TRUE;
-+ } else {
-+ AR_DEBUG_PRINTF("Error - Setting PSK mode when WPA "\
-+ "param was set to %d\n",
-+ ar->arAuthMode);
-+ ret = -1;
-+ }
-+ break;
-+ case IEEE80211_AUTH_WPA_CCKM:
-+ if (WPA2_AUTH == ar->arAuthMode) {
-+ ar->arAuthMode = WPA2_AUTH_CCKM;
-+ } else {
-+ ar->arAuthMode = WPA_AUTH_CCKM;
-+ }
-+ break;
-+ default:
-+ break;
++
++ case AR6000_XIOCTL_HTC_RAW_CLOSE:
++ if (arRawIfEnabled(ar)) {
++ ret = ar6000_htc_raw_close(ar);
++ arRawIfEnabled(ar) = FALSE;
++ } else {
++ ret = A_ERROR;
+ }
+ break;
-+ case IEEE80211_PARAM_UCASTCIPHER:
-+ switch (value) {
-+ case IEEE80211_CIPHER_AES_CCM:
-+ ar->arPairwiseCrypto = AES_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_TKIP:
-+ ar->arPairwiseCrypto = TKIP_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_WEP:
-+ ar->arPairwiseCrypto = WEP_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_NONE:
-+ ar->arPairwiseCrypto = NONE_CRYPT;
-+ profChanged = TRUE;
-+ break;
++
++ case AR6000_XIOCTL_HTC_RAW_READ:
++ if (arRawIfEnabled(ar)) {
++ unsigned int streamID;
++ get_user(streamID, (unsigned int *)userdata);
++ get_user(length, (unsigned int *)userdata + 1);
++ buffer = rq->ifr_data + sizeof(length);
++ ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
++ buffer, length);
++ put_user(ret, (unsigned int *)rq->ifr_data);
++ } else {
++ ret = A_ERROR;
+ }
+ break;
-+ case IEEE80211_PARAM_UCASTKEYLEN:
-+ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
-+ ret = -EIO;
++
++ case AR6000_XIOCTL_HTC_RAW_WRITE:
++ if (arRawIfEnabled(ar)) {
++ unsigned int streamID;
++ get_user(streamID, (unsigned int *)userdata);
++ get_user(length, (unsigned int *)userdata + 1);
++ buffer = userdata + sizeof(streamID) + sizeof(length);
++ ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
++ buffer, length);
++ put_user(ret, (unsigned int *)rq->ifr_data);
+ } else {
-+ ar->arPairwiseCryptoLen = value;
++ ret = A_ERROR;
+ }
+ break;
-+ case IEEE80211_PARAM_MCASTCIPHER:
-+ switch (value) {
-+ case IEEE80211_CIPHER_AES_CCM:
-+ ar->arGroupCrypto = AES_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_TKIP:
-+ ar->arGroupCrypto = TKIP_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_WEP:
-+ ar->arGroupCrypto = WEP_CRYPT;
-+ profChanged = TRUE;
-+ break;
-+ case IEEE80211_CIPHER_NONE:
-+ ar->arGroupCrypto = NONE_CRYPT;
-+ profChanged = TRUE;
-+ break;
++#endif /* HTC_RAW_INTERFACE */
++
++ case AR6000_IOCTL_WMI_GETREV:
++ {
++ if (copy_to_user(rq->ifr_data, &ar->arVersion,
++ sizeof(ar->arVersion)))
++ {
++ ret = -EFAULT;
+ }
+ break;
-+ case IEEE80211_PARAM_MCASTKEYLEN:
-+ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
++ }
++ case AR6000_IOCTL_WMI_SETPWR:
++ {
++ WMI_POWER_MODE_CMD pwrModeCmd;
++
++ if (ar->arWmiReady == FALSE) {
+ ret = -EIO;
++ } else if (copy_from_user(&pwrModeCmd, userdata,
++ sizeof(pwrModeCmd)))
++ {
++ ret = -EFAULT;
+ } else {
-+ ar->arGroupCryptoLen = value;
++ if (wmi_powermode_cmd(ar->arWmi, pwrModeCmd.powerMode)
++ != A_OK)
++ {
++ ret = -EIO;
++ }
+ }
+ break;
-+ case IEEE80211_PARAM_COUNTERMEASURES:
++ }
++ case AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS:
++ {
++ WMI_IBSS_PM_CAPS_CMD ibssPmCaps;
++
+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
++ ret = -EIO;
++ } else if (copy_from_user(&ibssPmCaps, userdata,
++ sizeof(ibssPmCaps)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_ibsspmcaps_cmd(ar->arWmi, ibssPmCaps.power_saving, ibssPmCaps.ttl,
++ ibssPmCaps.atim_windows, ibssPmCaps.timeout_value) != A_OK)
++ {
++ ret = -EIO;
++ }
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar->arIbssPsEnable = ibssPmCaps.power_saving;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+ }
-+ wmi_set_tkip_countermeasures_cmd(ar->arWmi, value);
+ break;
-+ default:
-+ break;
-+ }
-+
-+ if (profChanged == TRUE) {
-+ /*
-+ * profile has changed. Erase ssid to signal change
-+ */
-+ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
-+ ar->arSsidLen = 0;
-+ }
-+
-+ return ret;
-+}
++ }
++ case AR6000_IOCTL_WMI_SET_PMPARAMS:
++ {
++ WMI_POWER_PARAMS_CMD pmParams;
+
-+int
-+ar6000_ioctl_getparam(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
-+{
-+ return -EIO; /* for now */
-+}
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&pmParams, userdata,
++ sizeof(pmParams)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_pmparams_cmd(ar->arWmi, pmParams.idle_period,
++ pmParams.pspoll_number,
++ pmParams.dtim_policy) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_IOCTL_WMI_SETSCAN:
++ {
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&scParams, userdata,
++ sizeof(scParams)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (CAN_SCAN_IN_CONNECT(scParams.scanCtrlFlags)) {
++ ar->arSkipScan = FALSE;
++ } else {
++ ar->arSkipScan = TRUE;
++ }
+
-+int
-+ar6000_ioctl_setkey(struct net_device *dev, struct iw_request_info *info,
-+ void *w, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct ieee80211req_key *ik = (struct ieee80211req_key *)extra;
-+ KEY_USAGE keyUsage;
-+ A_STATUS status;
-+ CRYPTO_TYPE keyType = NONE_CRYPT;
++ if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
++ scParams.fg_end_period,
++ scParams.bg_period,
++ scParams.minact_chdwell_time,
++ scParams.maxact_chdwell_time,
++ scParams.pas_chdwell_time,
++ scParams.shortScanRatio,
++ scParams.scanCtrlFlags,
++ scParams.max_dfsch_act_time) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_IOCTL_WMI_SETLISTENINT:
++ {
++ WMI_LISTEN_INT_CMD listenCmd;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&listenCmd, userdata,
++ sizeof(listenCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_listeninterval_cmd(ar->arWmi, listenCmd.listenInterval, listenCmd.numBeacons) != A_OK) {
++ ret = -EIO;
++ } else {
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar->arListenInterval = param;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ }
+
-+ ar->user_saved_keys.keyOk = FALSE;
++ }
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_BMISS_TIME:
++ {
++ WMI_BMISS_TIME_CMD bmissCmd;
+
-+ if ( 0 == memcmp(ik->ik_macaddr, "\x00\x00\x00\x00\x00\x00",
-+ IEEE80211_ADDR_LEN)) {
-+ keyUsage = GROUP_USAGE;
-+ A_MEMCPY(&ar->user_saved_keys.bcast_ik, ik,
-+ sizeof(struct ieee80211req_key));
-+ } else {
-+ keyUsage = PAIRWISE_USAGE;
-+ A_MEMCPY(&ar->user_saved_keys.ucast_ik, ik,
-+ sizeof(struct ieee80211req_key));
-+ }
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&bmissCmd, userdata,
++ sizeof(bmissCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_bmisstime_cmd(ar->arWmi, bmissCmd.bmissTime, bmissCmd.numBeacons) != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_IOCTL_WMI_SETBSSFILTER:
++ {
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else {
+
-+ switch (ik->ik_type) {
-+ case IEEE80211_CIPHER_WEP:
-+ keyType = WEP_CRYPT;
++ get_user(param, (unsigned char *)userdata);
++ get_user(param2, (unsigned int *)(userdata + 1));
++ printk("SETBSSFILTER: filter 0x%x, mask: 0x%x\n", param, param2);
++ if (wmi_bssfilter_cmd(ar->arWmi, param, param2) != A_OK) {
++ ret = -EIO;
++ }
++ }
+ break;
-+ case IEEE80211_CIPHER_TKIP:
-+ keyType = TKIP_CRYPT;
++ }
++ case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
++ {
++ ret = ar6000_ioctl_set_snr_threshold(dev, rq);
+ break;
-+ case IEEE80211_CIPHER_AES_CCM:
-+ keyType = AES_CRYPT;
++ }
++ case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
++ {
++ ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
+ break;
-+ default:
++ }
++ case AR6000_XIOCTL_WMI_CLR_RSSISNR:
++ {
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ }
++ ret = wmi_clr_rssi_snr(ar->arWmi);
+ break;
-+ }
-+ ar->user_saved_keys.keyType = keyType;
-+
-+ if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
-+ if (NONE_CRYPT == keyType) {
-+ return -EIO;
+ }
-+
-+ status = wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, keyType, keyUsage,
-+ ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
-+ ik->ik_keydata, KEY_OP_INIT_VAL,
-+ SYNC_BEFORE_WMIFLAG);
-+
-+ if (status != A_OK) {
-+ return -EIO;
++ case AR6000_XIOCTL_WMI_SET_LQTHRESHOLD:
++ {
++ ret = ar6000_ioctl_set_lq_threshold(dev, rq);
++ break;
+ }
-+ } else {
-+ status = wmi_add_krk_cmd(ar->arWmi, ik->ik_keydata);
-+ }
++ case AR6000_XIOCTL_WMI_SET_LPREAMBLE:
++ {
++ WMI_SET_LPREAMBLE_CMD setLpreambleCmd;
+
-+ ar->user_saved_keys.keyOk = TRUE;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setLpreambleCmd, userdata,
++ sizeof(setLpreambleCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_lpreamble_cmd(ar->arWmi, setLpreambleCmd.status)
++ != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
+
-+ return 0;
-+}
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_RTS:
++ {
++ WMI_SET_RTS_CMD rtsCmd;
+
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&rtsCmd, userdata,
++ sizeof(rtsCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_rts_cmd(ar->arWmi, rtsCmd.threshold)
++ != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
+
-+/*
-+ * SIOCGIWNAME
-+ */
-+int
-+ar6000_ioctl_giwname(struct net_device *dev,
-+ struct iw_request_info *info,
-+ char *name, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_WMM:
++ {
++ ret = ar6000_ioctl_set_wmm(dev, rq);
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_TXOP:
++ {
++ ret = ar6000_ioctl_set_txop(dev, rq);
++ break;
++ }
++ case AR6000_XIOCTL_WMI_GET_RD:
++ {
++ ret = ar6000_ioctl_get_rd(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_CHANNELPARAMS:
++ {
++ ret = ar6000_ioctl_set_channelParams(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_PROBEDSSID:
++ {
++ ret = ar6000_ioctl_set_probedSsid(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_BADAP:
++ {
++ ret = ar6000_ioctl_set_badAp(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_CREATE_QOS:
++ {
++ ret = ar6000_ioctl_create_qos(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_DELETE_QOS:
++ {
++ ret = ar6000_ioctl_delete_qos(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_GET_QOS_QUEUE:
++ {
++ ret = ar6000_ioctl_get_qos_queue(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_GET_TARGET_STATS:
++ {
++ ret = ar6000_ioctl_get_target_stats(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK:
++ {
++ ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
++ {
++ WMI_SET_ASSOC_INFO_CMD cmd;
++ A_UINT8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else {
++ get_user(cmd.ieType, userdata);
++ if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
++ ret = -EIO;
++ } else {
++ get_user(cmd.bufferSize, userdata + 1);
++ if (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) {
++ ret = -EFAULT;
++ break;
++ }
++ if (copy_from_user(assocInfo, userdata + 2,
++ cmd.bufferSize))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_associnfo_cmd(ar->arWmi, cmd.ieType,
++ cmd.bufferSize,
++ assocInfo) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ }
++ }
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
++ {
++ ret = ar6000_ioctl_set_access_params(dev, rq);
++ break;
++ }
++ case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
++ {
++ ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
++ break;
++ }
++ case AR6000_XIOCTL_FORCE_TARGET_RESET:
++ {
++ if (ar->arHtcTarget)
++ {
++// HTCForceReset(htcTarget);
++ }
++ else
++ {
++ AR_DEBUG_PRINTF("ar6000_ioctl cannot attempt reset.\n");
++ }
++ break;
++ }
++ case AR6000_XIOCTL_TARGET_INFO:
++ case AR6000_XIOCTL_CHECK_TARGET_READY: /* backwards compatibility */
++ {
++ /* If we made it to here, then the Target exists and is ready. */
+
-+ switch (ar->arPhyCapability) {
-+ case (WMI_11A_CAPABILITY):
-+ strncpy(name, "AR6000 802.11a", IFNAMSIZ);
-+ break;
-+ case (WMI_11G_CAPABILITY):
-+ strncpy(name, "AR6000 802.11g", IFNAMSIZ);
-+ break;
-+ case (WMI_11AG_CAPABILITY):
-+ strncpy(name, "AR6000 802.11ag", IFNAMSIZ);
-+ break;
-+ default:
-+ strncpy(name, "AR6000 802.11", IFNAMSIZ);
-+ break;
-+ }
++ if (cmd == AR6000_XIOCTL_TARGET_INFO) {
++ if (copy_to_user((A_UINT32 *)rq->ifr_data, &ar->arVersion.target_ver,
++ sizeof(ar->arVersion.target_ver)))
++ {
++ ret = -EFAULT;
++ }
++ if (copy_to_user(((A_UINT32 *)rq->ifr_data)+1, &ar->arTargetType,
++ sizeof(ar->arTargetType)))
++ {
++ ret = -EFAULT;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS:
++ {
++ WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD hbparam;
+
-+ return 0;
-+}
++ if (copy_from_user(&hbparam, userdata, sizeof(hbparam)))
++ {
++ ret = -EFAULT;
++ } else {
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ /* Start a cyclic timer with the parameters provided. */
++ if (hbparam.frequency) {
++ ar->arHBChallengeResp.frequency = hbparam.frequency;
++ }
++ if (hbparam.threshold) {
++ ar->arHBChallengeResp.missThres = hbparam.threshold;
++ }
+
-+/*
-+ * SIOCSIWFREQ
-+ */
-+int
-+ar6000_ioctl_siwfreq(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_freq *freq, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ /* Delete the pending timer and start a new one */
++ if (timer_pending(&ar->arHBChallengeResp.timer)) {
++ A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
++ }
++ A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP:
++ {
++ A_UINT32 cookie;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ if (copy_from_user(&cookie, userdata, sizeof(cookie))) {
++ return -EFAULT;
++ }
+
-+ /*
-+ * We support limiting the channels via wmiconfig.
-+ *
-+ * We use this command to configure the channel hint for the connect cmd
-+ * so it is possible the target will end up connecting to a different
-+ * channel.
-+ */
-+ if (freq->e > 1) {
-+ return -EINVAL;
-+ } else if (freq->e == 1) {
-+ ar->arChannelHint = freq->m / 100000;
-+ } else {
-+ ar->arChannelHint = wlan_ieee2freq(freq->m);
-+ }
++ /* Send the challenge on the control channel */
++ if (wmi_get_challenge_resp_cmd(ar->arWmi, cookie, APP_HB_CHALLENGE) != A_OK) {
++ return -EIO;
++ }
++ break;
++ }
++#ifdef USER_KEYS
++ case AR6000_XIOCTL_USER_SETKEYS:
++ {
+
-+ A_PRINTF("channel hint set to %d\n", ar->arChannelHint);
-+ return 0;
-+}
++ ar->user_savedkeys_stat = USER_SAVEDKEYS_STAT_RUN;
+
-+/*
-+ * SIOCGIWFREQ
-+ */
-+int
-+ar6000_ioctl_giwfreq(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_freq *freq, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ if (copy_from_user(&ar->user_key_ctrl, userdata,
++ sizeof(ar->user_key_ctrl)))
++ {
++ return -EFAULT;
++ }
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ A_PRINTF("ar6000 USER set key %x\n", ar->user_key_ctrl);
++ break;
++ }
++#endif /* USER_KEYS */
+
-+ if (ar->arConnected != TRUE) {
-+ return -EINVAL;
-+ }
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++ case AR6000_XIOCTL_GPIO_OUTPUT_SET:
++ {
++ struct ar6000_gpio_output_set_cmd_s gpio_output_set_cmd;
+
-+ freq->m = ar->arBssChannel * 100000;
-+ freq->e = 1;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+ return 0;
-+}
++ if (copy_from_user(&gpio_output_set_cmd, userdata,
++ sizeof(gpio_output_set_cmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = ar6000_gpio_output_set(dev,
++ gpio_output_set_cmd.set_mask,
++ gpio_output_set_cmd.clear_mask,
++ gpio_output_set_cmd.enable_mask,
++ gpio_output_set_cmd.disable_mask);
++ if (ret != A_OK) {
++ ret = EIO;
++ }
++ }
++ up(&ar->arSem);
++ break;
++ }
++ case AR6000_XIOCTL_GPIO_INPUT_GET:
++ {
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+/*
-+ * SIOCSIWMODE
-+ */
-+int
-+ar6000_ioctl_siwmode(struct net_device *dev,
-+ struct iw_request_info *info,
-+ __u32 *mode, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ ret = ar6000_gpio_input_get(dev);
++ if (ret != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ /* Wait for Target to respond. */
++ wait_event_interruptible(arEvent, gpio_data_available);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ } else {
++ A_ASSERT(gpio_reg_results.gpioreg_id == GPIO_ID_NONE);
+
-+ switch (*mode) {
-+ case IW_MODE_INFRA:
-+ ar->arNetworkType = INFRA_NETWORK;
-+ break;
-+ case IW_MODE_ADHOC:
-+ ar->arNetworkType = ADHOC_NETWORK;
-+ break;
-+ default:
-+ return -EINVAL;
-+ }
++ if (copy_to_user(userdata, &gpio_reg_results.value,
++ sizeof(gpio_reg_results.value)))
++ {
++ ret = -EFAULT;
++ }
++ }
++ up(&ar->arSem);
++ break;
++ }
++ case AR6000_XIOCTL_GPIO_REGISTER_SET:
++ {
++ struct ar6000_gpio_register_cmd_s gpio_register_cmd;
+
-+ return 0;
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+/*
-+ * SIOCGIWMODE
-+ */
-+int
-+ar6000_ioctl_giwmode(struct net_device *dev,
-+ struct iw_request_info *info,
-+ __u32 *mode, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ if (copy_from_user(&gpio_register_cmd, userdata,
++ sizeof(gpio_register_cmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = ar6000_gpio_register_set(dev,
++ gpio_register_cmd.gpioreg_id,
++ gpio_register_cmd.value);
++ if (ret != A_OK) {
++ ret = EIO;
++ }
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ /* Wait for acknowledgement from Target */
++ wait_event_interruptible(arEvent, gpio_ack_received);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
++ }
++ up(&ar->arSem);
++ break;
++ }
++ case AR6000_XIOCTL_GPIO_REGISTER_GET:
++ {
++ struct ar6000_gpio_register_cmd_s gpio_register_cmd;
+
-+ switch (ar->arNetworkType) {
-+ case INFRA_NETWORK:
-+ *mode = IW_MODE_INFRA;
-+ break;
-+ case ADHOC_NETWORK:
-+ *mode = IW_MODE_ADHOC;
-+ break;
-+ default:
-+ return -EIO;
-+ }
-+ return 0;
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+/*
-+ * SIOCSIWSENS
-+ */
-+int
-+ar6000_ioctl_siwsens(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *sens, char *extra)
-+{
-+ return 0;
-+}
++ if (copy_from_user(&gpio_register_cmd, userdata,
++ sizeof(gpio_register_cmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = ar6000_gpio_register_get(dev, gpio_register_cmd.gpioreg_id);
++ if (ret != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
+
-+/*
-+ * SIOCGIWSENS
-+ */
-+int
-+ar6000_ioctl_giwsens(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_param *sens, char *extra)
-+{
-+ sens->value = 0;
-+ sens->fixed = 1;
++ /* Wait for Target to respond. */
++ wait_event_interruptible(arEvent, gpio_data_available);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ } else {
++ A_ASSERT(gpio_register_cmd.gpioreg_id == gpio_reg_results.gpioreg_id);
++ if (copy_to_user(userdata, &gpio_reg_results,
++ sizeof(gpio_reg_results)))
++ {
++ ret = -EFAULT;
++ }
++ }
++ }
++ up(&ar->arSem);
++ break;
++ }
++ case AR6000_XIOCTL_GPIO_INTR_ACK:
++ {
++ struct ar6000_gpio_intr_ack_cmd_s gpio_intr_ack_cmd;
+
-+ return 0;
-+}
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
+
-+/*
-+ * SIOCGIWRANGE
-+ */
-+int
-+ar6000_ioctl_giwrange(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ struct iw_range *range = (struct iw_range *) extra;
-+ int i, ret = 0;
-+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ if (copy_from_user(&gpio_intr_ack_cmd, userdata,
++ sizeof(gpio_intr_ack_cmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = ar6000_gpio_intr_ack(dev, gpio_intr_ack_cmd.ack_mask);
++ if (ret != A_OK) {
++ ret = EIO;
++ }
++ }
++ up(&ar->arSem);
++ break;
++ }
++ case AR6000_XIOCTL_GPIO_INTR_WAIT:
++ {
++ /* Wait for Target to report an interrupt. */
++ dev_hold(dev);
++ rtnl_unlock();
++ wait_event_interruptible(arEvent, gpio_intr_available);
++ rtnl_lock();
++ __dev_put(dev);
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ } else {
++ if (copy_to_user(userdata, &gpio_intr_results,
++ sizeof(gpio_intr_results)))
++ {
++ ret = -EFAULT;
++ }
++ }
++ break;
++ }
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ if (down_interruptible(&ar->arSem)) {
-+ return -ERESTARTSYS;
-+ }
-+ ar->arNumChannels = -1;
-+ A_MEMZERO(ar->arChannelList, sizeof (ar->arChannelList));
++ case AR6000_XIOCTL_DBGLOG_CFG_MODULE:
++ {
++ struct ar6000_dbglog_module_config_s config;
+
-+ if (wmi_get_channelList_cmd(ar->arWmi) != A_OK) {
-+ up(&ar->arSem);
-+ return -EIO;
-+ }
++ if (copy_from_user(&config, userdata, sizeof(config))) {
++ return -EFAULT;
++ }
+
-+ wait_event_interruptible_timeout(arEvent, ar->arNumChannels != -1, wmitimeout * HZ);
++ /* Send the challenge on the control channel */
++ if (wmi_config_debug_module_cmd(ar->arWmi, config.mmask,
++ config.tsr, config.rep,
++ config.size, config.valid) != A_OK)
++ {
++ return -EIO;
++ }
++ break;
++ }
+
-+ if (signal_pending(current)) {
-+ up(&ar->arSem);
-+ return -EINTR;
-+ }
++ case AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS:
++ {
++ /* Send the challenge on the control channel */
++ if (ar6000_dbglog_get_debug_logs(ar) != A_OK)
++ {
++ return -EIO;
++ }
++ break;
++ }
+
-+ data->length = sizeof(struct iw_range);
-+ A_MEMZERO(range, sizeof(struct iw_range));
++ case AR6000_XIOCTL_SET_ADHOC_BSSID:
++ {
++ WMI_SET_ADHOC_BSSID_CMD adhocBssid;
+
-+ range->txpower_capa = IW_TXPOW_DBM;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&adhocBssid, userdata,
++ sizeof(adhocBssid)))
++ {
++ ret = -EFAULT;
++ } else if (A_MEMCMP(adhocBssid.bssid, bcast_mac,
++ AR6000_ETH_ADDR_LEN) == 0)
++ {
++ ret = -EFAULT;
++ } else {
+
-+ range->min_pmp = 1 * 1024;
-+ range->max_pmp = 65535 * 1024;
-+ range->min_pmt = 1 * 1024;
-+ range->max_pmt = 1000 * 1024;
-+ range->pmp_flags = IW_POWER_PERIOD;
-+ range->pmt_flags = IW_POWER_TIMEOUT;
-+ range->pm_capa = 0;
++ A_MEMCPY(ar->arReqBssid, adhocBssid.bssid, sizeof(ar->arReqBssid));
++ }
++ break;
++ }
+
-+ range->we_version_compiled = WIRELESS_EXT;
-+ range->we_version_source = 13;
++ case AR6000_XIOCTL_SET_OPT_MODE:
++ {
++ WMI_SET_OPT_MODE_CMD optModeCmd;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ range->retry_capa = IW_RETRY_LIMIT;
-+ range->retry_flags = IW_RETRY_LIMIT;
-+ range->min_retry = 0;
-+ range->max_retry = 255;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&optModeCmd, userdata,
++ sizeof(optModeCmd)))
++ {
++ ret = -EFAULT;
++ } else if (ar->arConnected && optModeCmd.optMode == SPECIAL_ON) {
++ ret = -EFAULT;
+
-+ range->num_frequency = range->num_channels = ar->arNumChannels;
-+ for (i = 0; i < ar->arNumChannels; i++) {
-+ range->freq[i].i = wlan_freq2ieee(ar->arChannelList[i]);
-+ range->freq[i].m = ar->arChannelList[i] * 100000;
-+ range->freq[i].e = 1;
-+ /*
-+ * Linux supports max of 32 channels, bail out once you
-+ * reach the max.
-+ */
-+ if (i == IW_MAX_FREQUENCIES) {
++ } else if (wmi_set_opt_mode_cmd(ar->arWmi, optModeCmd.optMode)
++ != A_OK)
++ {
++ ret = -EIO;
++ }
+ break;
+ }
-+ }
-+
-+ /* Max quality is max field value minus noise floor */
-+ range->max_qual.qual = 0xff - 161;
-+
-+ /*
-+ * In order to use dBm measurements, 'level' must be lower
-+ * than any possible measurement (see iw_print_stats() in
-+ * wireless tools). It's unclear how this is meant to be
-+ * done, but setting zero in these values forces dBm and
-+ * the actual numbers are not used.
-+ */
-+ range->max_qual.level = 0;
-+ range->max_qual.noise = 0;
+
-+ range->sensitivity = 3;
++ case AR6000_XIOCTL_OPT_SEND_FRAME:
++ {
++ WMI_OPT_TX_FRAME_CMD optTxFrmCmd;
++ A_UINT8 data[MAX_OPT_DATA_LEN];
+
-+ range->max_encoding_tokens = 4;
-+ /* XXX query driver to find out supported key sizes */
-+ range->num_encoding_sizes = 3;
-+ range->encoding_size[0] = 5; /* 40-bit */
-+ range->encoding_size[1] = 13; /* 104-bit */
-+ range->encoding_size[2] = 16; /* 128-bit */
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&optTxFrmCmd, userdata,
++ sizeof(optTxFrmCmd)))
++ {
++ ret = -EFAULT;
++ } else if (copy_from_user(data,
++ userdata+sizeof(WMI_OPT_TX_FRAME_CMD)-1,
++ optTxFrmCmd.optIEDataLen))
++ {
++ ret = -EFAULT;
++ } else {
++ ret = wmi_opt_tx_frame_cmd(ar->arWmi,
++ optTxFrmCmd.frmType,
++ optTxFrmCmd.dstAddr,
++ optTxFrmCmd.bssid,
++ optTxFrmCmd.optIEDataLen,
++ data);
++ }
+
-+ range->num_bitrates = 0;
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SETRETRYLIMITS:
++ {
++ WMI_SET_RETRY_LIMITS_CMD setRetryParams;
+
-+ /* estimated maximum TCP throughput values (bps) */
-+ range->throughput = 22000000;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setRetryParams, userdata,
++ sizeof(setRetryParams)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_retry_limits_cmd(ar->arWmi, setRetryParams.frameType,
++ setRetryParams.trafficClass,
++ setRetryParams.maxRetries,
++ setRetryParams.enableNotify) != A_OK)
++ {
++ ret = -EIO;
++ }
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar->arMaxRetries = setRetryParams.maxRetries;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ }
++ break;
++ }
+
-+ range->min_rts = 0;
-+ range->max_rts = 2347;
-+ range->min_frag = 256;
-+ range->max_frag = 2346;
++ case AR6000_XIOCTL_SET_ADHOC_BEACON_INTVAL:
++ {
++ WMI_BEACON_INT_CMD bIntvlCmd;
+
-+ up(&ar->arSem);
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&bIntvlCmd, userdata,
++ sizeof(bIntvlCmd)))
++ {
++ ret = -EFAULT;
++ } else if (wmi_set_adhoc_bconIntvl_cmd(ar->arWmi, bIntvlCmd.beaconInterval)
++ != A_OK)
++ {
++ ret = -EIO;
++ }
++ break;
++ }
++ case IEEE80211_IOCTL_SETAUTHALG:
++ {
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ieee80211req_authalg req;
+
-+ return ret;
-+}
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&req, userdata,
++ sizeof(struct ieee80211req_authalg)))
++ {
++ ret = -EFAULT;
++ } else if (req.auth_alg == AUTH_ALG_OPEN_SYSTEM) {
++ ar->arDot11AuthMode = OPEN_AUTH;
++ ar->arPairwiseCrypto = NONE_CRYPT;
++ ar->arGroupCrypto = NONE_CRYPT;
++ } else if (req.auth_alg == AUTH_ALG_LEAP) {
++ ar->arDot11AuthMode = LEAP_AUTH;
++ } else {
++ ret = -EIO;
++ }
++ break;
++ }
+
++ case AR6000_XIOCTL_SET_VOICE_PKT_SIZE:
++ ret = ar6000_xioctl_set_voice_pkt_size(dev, userdata);
++ break;
+
-+/*
-+ * SIOCSIWAP
-+ * This ioctl is used to set the desired bssid for the connect command.
-+ */
-+int
-+ar6000_ioctl_siwap(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct sockaddr *ap_addr, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ case AR6000_XIOCTL_SET_MAX_SP:
++ ret = ar6000_xioctl_set_max_sp_len(dev, userdata);
++ break;
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ case AR6000_XIOCTL_WMI_GET_ROAM_TBL:
++ ret = ar6000_ioctl_get_roam_tbl(dev, rq);
++ break;
++ case AR6000_XIOCTL_WMI_SET_ROAM_CTRL:
++ ret = ar6000_ioctl_set_roam_ctrl(dev, userdata);
++ break;
++ case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
++ ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
++ break;
++ case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
++ ret = ar6000_ioctl_get_power_mode(dev, rq);
++ break;
++ case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
++ get_user(ar->arWlanState, (unsigned int *)userdata);
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ break;
++ }
+
-+ if (ap_addr->sa_family != ARPHRD_ETHER) {
-+ return -EIO;
-+ }
++ if (ar->arWlanState == WLAN_ENABLED) {
++ /* Enable foreground scanning */
++ if (wmi_scanparams_cmd(ar->arWmi, scParams.fg_start_period,
++ scParams.fg_end_period,
++ scParams.bg_period,
++ scParams.minact_chdwell_time,
++ scParams.maxact_chdwell_time,
++ scParams.pas_chdwell_time,
++ scParams.shortScanRatio,
++ scParams.scanCtrlFlags,
++ scParams.max_dfsch_act_time) != A_OK)
++ {
++ ret = -EIO;
++ }
++ if (ar->arSsidLen) {
++ ar->arConnectPending = TRUE;
++ if (wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
++ ar->arDot11AuthMode, ar->arAuthMode,
++ ar->arPairwiseCrypto,
++ ar->arPairwiseCryptoLen,
++ ar->arGroupCrypto, ar->arGroupCryptoLen,
++ ar->arSsidLen, ar->arSsid,
++ ar->arReqBssid, ar->arChannelHint,
++ ar->arConnectCtrlFlags) != A_OK)
++ {
++ ret = -EIO;
++ ar->arConnectPending = FALSE;
++ }
++ }
++ } else {
++ /* Disconnect from the AP and disable foreground scanning */
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ if (ar->arConnected == TRUE || ar->arConnectPending == TRUE) {
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ wmi_disconnect_cmd(ar->arWmi);
++ } else {
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ }
+
-+ if (A_MEMCMP(&ap_addr->sa_data, bcast_mac, AR6000_ETH_ADDR_LEN) == 0) {
-+ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
-+ } else {
-+ A_MEMCPY(ar->arReqBssid, &ap_addr->sa_data, sizeof(ar->arReqBssid));
-+ }
++ if (wmi_scanparams_cmd(ar->arWmi, 0xFFFF, 0, 0, 0, 0, 0, 0, 0xFF, 0) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
++ ret = ar6000_ioctl_get_roam_data(dev, rq);
++ break;
++ case AR6000_XIOCTL_WMI_SET_BT_STATUS:
++ ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
++ break;
++ case AR6000_XIOCTL_WMI_SET_BT_PARAMS:
++ ret = ar6000_xioctl_set_bt_params_cmd(dev, userdata);
++ break;
++ case AR6000_XIOCTL_WMI_STARTSCAN:
++ {
++ WMI_START_SCAN_CMD setStartScanCmd;
+
-+ return 0;
-+}
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setStartScanCmd, userdata,
++ sizeof(setStartScanCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_startscan_cmd(ar->arWmi, setStartScanCmd.scanType,
++ setStartScanCmd.forceFgScan,
++ setStartScanCmd.isLegacy,
++ setStartScanCmd.homeDwellTime,
++ setStartScanCmd.forceScanInterval) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SETFIXRATES:
++ {
++ WMI_FIX_RATES_CMD setFixRatesCmd;
++ A_STATUS returnStatus;
+
-+/*
-+ * SIOCGIWAP
-+ */
-+int
-+ar6000_ioctl_giwap(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct sockaddr *ap_addr, char *extra)
-+{
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setFixRatesCmd, userdata,
++ sizeof(setFixRatesCmd)))
++ {
++ ret = -EFAULT;
++ } else {
++ returnStatus = wmi_set_fixrates_cmd(ar->arWmi, setFixRatesCmd.fixRateMask);
++ if (returnStatus == A_EINVAL)
++ {
++ ret = -EINVAL;
++ }
++ else if(returnStatus != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ case AR6000_XIOCTL_WMI_GETFIXRATES:
++ {
++ WMI_FIX_RATES_CMD getFixRatesCmd;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int ret = 0;
+
-+ if (ar->arConnected != TRUE) {
-+ return -EINVAL;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ A_MEMCPY(&ap_addr->sa_data, ar->arBssid, sizeof(ar->arBssid));
-+ ap_addr->sa_family = ARPHRD_ETHER;
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ /* Used copy_from_user/copy_to_user to access user space data */
++ if (copy_from_user(&getFixRatesCmd, userdata, sizeof(getFixRatesCmd))) {
++ ret = -EFAULT;
++ } else {
++ ar->arRateMask = 0xFFFF;
+
-+ return 0;
-+}
++ if (wmi_get_ratemask_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
+
-+/*
-+ * SIOCGIWAPLIST
-+ */
-+int
-+ar6000_ioctl_iwaplist(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *extra)
-+{
-+ return -EIO; /* for now */
-+}
++ wait_event_interruptible_timeout(arEvent, ar->arRateMask != 0xFFFF, wmitimeout * HZ);
+
-+/*
-+ * SIOCSIWSCAN
-+ */
-+int
-+ar6000_ioctl_siwscan(struct net_device *dev,
-+ struct iw_request_info *info,
-+ struct iw_point *data, char *extra)
-+{
-+#define ACT_DWELLTIME_DEFAULT 105
-+#define HOME_TXDRAIN_TIME 100
-+#define SCAN_INT HOME_TXDRAIN_TIME + ACT_DWELLTIME_DEFAULT
-+ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
-+ int ret = 0;
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
+
-+ if (ar->arWmiReady == FALSE) {
-+ return -EIO;
-+ }
++ if (!ret) {
++ getFixRatesCmd.fixRateMask = ar->arRateMask;
++ }
+
-+ if (ar->arWlanState == WLAN_DISABLED) {
-+ return -EIO;
-+ }
++ if(copy_to_user(userdata, &getFixRatesCmd, sizeof(getFixRatesCmd))) {
++ ret = -EFAULT;
++ }
+
-+ /* We ask for everything from the target */
-+ if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
-+ printk("Couldn't set filtering\n");
-+ ret = -EIO;
-+ }
++ up(&ar->arSem);
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_AUTHMODE:
++ {
++ WMI_SET_AUTH_MODE_CMD setAuthMode;
+
-+ if (wmi_startscan_cmd(ar->arWmi, WMI_LONG_SCAN, FALSE, FALSE, \
-+ HOME_TXDRAIN_TIME, SCAN_INT) != A_OK) {
-+ ret = -EIO;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setAuthMode, userdata,
++ sizeof(setAuthMode)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_authmode_cmd(ar->arWmi, setAuthMode.mode) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_REASSOCMODE:
++ {
++ WMI_SET_REASSOC_MODE_CMD setReassocMode;
+
-+ ar->scan_complete = 0;
-+ wait_event_interruptible_timeout(ar6000_scan_queue, ar->scan_complete,
-+ 5 * HZ);
-+
-+ if (wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0) != A_OK) {
-+ printk("Couldn't set filtering\n");
-+ ret = -EIO;
-+ }
-+
-+ return ret;
-+#undef ACT_DWELLTIME_DEFAULT
-+#undef HOME_TXDRAIN_TIME
-+#undef SCAN_INT
-+}
-+
-+
-+/*
-+ * Units are in db above the noise floor. That means the
-+ * rssi values reported in the tx/rx descriptors in the
-+ * driver are the SNR expressed in db.
-+ *
-+ * If you assume that the noise floor is -95, which is an
-+ * excellent assumption 99.5 % of the time, then you can
-+ * derive the absolute signal level (i.e. -95 + rssi).
-+ * There are some other slight factors to take into account
-+ * depending on whether the rssi measurement is from 11b,
-+ * 11g, or 11a. These differences are at most 2db and
-+ * can be documented.
-+ *
-+ * NB: various calculations are based on the orinoco/wavelan
-+ * drivers for compatibility
-+ */
-+static void
-+ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi)
-+{
-+ if (rssi < 0) {
-+ iq->qual = 0;
-+ } else {
-+ iq->qual = rssi;
-+ }
-+
-+ /* NB: max is 94 because noise is hardcoded to 161 */
-+ if (iq->qual > 94)
-+ iq->qual = 94;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setReassocMode, userdata,
++ sizeof(setReassocMode)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_reassocmode_cmd(ar->arWmi, setReassocMode.mode) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_DIAG_READ:
++ {
++ A_UINT32 addr, data;
++ get_user(addr, (unsigned int *)userdata);
++ if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
++ ret = -EIO;
++ }
++ put_user(data, (unsigned int *)userdata + 1);
++ break;
++ }
++ case AR6000_XIOCTL_DIAG_WRITE:
++ {
++ A_UINT32 addr, data;
++ get_user(addr, (unsigned int *)userdata);
++ get_user(data, (unsigned int *)userdata + 1);
++ if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
++ ret = -EIO;
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
++ {
++ WMI_SET_KEEPALIVE_CMD setKeepAlive;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ } else if (copy_from_user(&setKeepAlive, userdata,
++ sizeof(setKeepAlive))){
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_keepalive_cmd(ar->arWmi, setKeepAlive.keepaliveInterval) != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_GET_KEEPALIVE:
++ {
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_GET_KEEPALIVE_CMD getKeepAlive;
++ int ret = 0;
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ if (copy_from_user(&getKeepAlive, userdata,sizeof(getKeepAlive))) {
++ ret = -EFAULT;
++ } else {
++ getKeepAlive.keepaliveInterval = wmi_get_keepalive_cmd(ar->arWmi);
++ ar->arKeepaliveConfigured = 0xFF;
++ if (wmi_get_keepalive_configured(ar->arWmi) != A_OK){
++ up(&ar->arSem);
++ return -EIO;
++ }
++ wait_event_interruptible_timeout(arEvent, ar->arKeepaliveConfigured != 0xFF, wmitimeout * HZ);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
+
-+ iq->noise = 161; /* -95dBm */
-+ iq->level = iq->noise + iq->qual;
-+ iq->updated = 7;
-+}
++ if (!ret) {
++ getKeepAlive.configured = ar->arKeepaliveConfigured;
++ }
++ if (copy_to_user(userdata, &getKeepAlive, sizeof(getKeepAlive))) {
++ ret = -EFAULT;
++ }
++ up(&ar->arSem);
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_APPIE:
++ {
++ WMI_SET_APPIE_CMD appIEcmd;
++ A_UINT8 appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
++ A_UINT32 fType,ieLen;
+
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ get_user(fType, (A_UINT32 *)userdata);
++ appIEcmd.mgmtFrmType = fType;
++ if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
++ ret = -EIO;
++ } else {
++ get_user(ieLen, (A_UINT32 *)(userdata + 4));
++ appIEcmd.ieLen = ieLen;
++ if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
++ ret = -EIO;
++ break;
++ }
++ if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_appie_cmd(ar->arWmi, appIEcmd.mgmtFrmType,
++ appIEcmd.ieLen, appIeInfo) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER:
++ {
++ WMI_BSS_FILTER_CMD cmd;
++ A_UINT32 filterType;
+
-+/* Structures to export the Wireless Handlers */
-+static const iw_handler ath_handlers[] = {
-+ (iw_handler) NULL, /* SIOCSIWCOMMIT */
-+ (iw_handler) ar6000_ioctl_giwname, /* SIOCGIWNAME */
-+ (iw_handler) NULL, /* SIOCSIWNWID */
-+ (iw_handler) NULL, /* SIOCGIWNWID */
-+ (iw_handler) ar6000_ioctl_siwfreq, /* SIOCSIWFREQ */
-+ (iw_handler) ar6000_ioctl_giwfreq, /* SIOCGIWFREQ */
-+ (iw_handler) ar6000_ioctl_siwmode, /* SIOCSIWMODE */
-+ (iw_handler) ar6000_ioctl_giwmode, /* SIOCGIWMODE */
-+ (iw_handler) ar6000_ioctl_siwsens, /* SIOCSIWSENS */
-+ (iw_handler) ar6000_ioctl_giwsens, /* SIOCGIWSENS */
-+ (iw_handler) NULL /* not _used */, /* SIOCSIWRANGE */
-+ (iw_handler) ar6000_ioctl_giwrange, /* SIOCGIWRANGE */
-+ (iw_handler) NULL /* not used */, /* SIOCSIWPRIV */
-+ (iw_handler) NULL /* kernel code */, /* SIOCGIWPRIV */
-+ (iw_handler) NULL /* not used */, /* SIOCSIWSTATS */
-+ (iw_handler) NULL /* kernel code */, /* SIOCGIWSTATS */
-+ (iw_handler) NULL, /* SIOCSIWSPY */
-+ (iw_handler) NULL, /* SIOCGIWSPY */
-+ (iw_handler) NULL, /* SIOCSIWTHRSPY */
-+ (iw_handler) NULL, /* SIOCGIWTHRSPY */
-+ (iw_handler) ar6000_ioctl_siwap, /* SIOCSIWAP */
-+ (iw_handler) ar6000_ioctl_giwap, /* SIOCGIWAP */
-+ (iw_handler) NULL, /* -- hole -- */
-+ (iw_handler) ar6000_ioctl_iwaplist, /* SIOCGIWAPLIST */
-+ (iw_handler) ar6000_ioctl_siwscan, /* SIOCSIWSCAN */
-+ (iw_handler) ar6000_ioctl_giwscan, /* SIOCGIWSCAN */
-+ (iw_handler) ar6000_ioctl_siwessid, /* SIOCSIWESSID */
-+ (iw_handler) ar6000_ioctl_giwessid, /* SIOCGIWESSID */
-+ (iw_handler) NULL, /* SIOCSIWNICKN */
-+ (iw_handler) NULL, /* SIOCGIWNICKN */
-+ (iw_handler) NULL, /* -- hole -- */
-+ (iw_handler) NULL, /* -- hole -- */
-+ (iw_handler) ar6000_ioctl_siwrate, /* SIOCSIWRATE */
-+ (iw_handler) ar6000_ioctl_giwrate, /* SIOCGIWRATE */
-+ (iw_handler) NULL, /* SIOCSIWRTS */
-+ (iw_handler) NULL, /* SIOCGIWRTS */
-+ (iw_handler) NULL, /* SIOCSIWFRAG */
-+ (iw_handler) NULL, /* SIOCGIWFRAG */
-+ (iw_handler) ar6000_ioctl_siwtxpow, /* SIOCSIWTXPOW */
-+ (iw_handler) ar6000_ioctl_giwtxpow, /* SIOCGIWTXPOW */
-+ (iw_handler) ar6000_ioctl_siwretry, /* SIOCSIWRETRY */
-+ (iw_handler) ar6000_ioctl_giwretry, /* SIOCGIWRETRY */
-+ (iw_handler) ar6000_ioctl_siwencode, /* SIOCSIWENCODE */
-+ (iw_handler) ar6000_ioctl_giwencode, /* SIOCGIWENCODE */
-+ (iw_handler) ar6000_ioctl_siwpower, /* SIOCSIWPOWER */
-+ (iw_handler) ar6000_ioctl_giwpower, /* SIOCGIWPOWER */
-+ (iw_handler) NULL, /* -- hole -- */
-+ (iw_handler) NULL, /* -- hole -- */
-+ (iw_handler) ar6000_ioctl_siwgenie, /* SIOCSIWGENIE */
-+ (iw_handler) ar6000_ioctl_giwgenie, /* SIOCGIWGENIE */
-+ (iw_handler) ar6000_ioctl_siwauth, /* SIOCSIWAUTH */
-+ (iw_handler) ar6000_ioctl_giwauth, /* SIOCGIWAUTH */
-+ (iw_handler) ar6000_ioctl_siwencodeext,/* SIOCSIWENCODEEXT */
-+ (iw_handler) ar6000_ioctl_giwencodeext,/* SIOCGIWENCODEEXT */
-+ (iw_handler) NULL, /* SIOCSIWPMKSA */
-+};
++ if (copy_from_user(&filterType, userdata, sizeof(A_UINT32)))
++ {
++ return -EFAULT;
++ }
++ if (filterType & (IEEE80211_FILTER_TYPE_BEACON |
++ IEEE80211_FILTER_TYPE_PROBE_RESP))
++ {
++ cmd.bssFilter = ALL_BSS_FILTER;
++ } else {
++ cmd.bssFilter = NONE_BSS_FILTER;
++ }
++ if (wmi_bssfilter_cmd(ar->arWmi, cmd.bssFilter, 0) != A_OK) {
++ ret = -EIO;
++ }
+
-+static const iw_handler ath_priv_handlers[] = {
-+ (iw_handler) ar6000_ioctl_setparam, /* SIOCWFIRSTPRIV+0 */
-+ (iw_handler) ar6000_ioctl_getparam, /* SIOCWFIRSTPRIV+1 */
-+ (iw_handler) ar6000_ioctl_setkey, /* SIOCWFIRSTPRIV+2 */
-+ (iw_handler) ar6000_ioctl_setwmmparams, /* SIOCWFIRSTPRIV+3 */
-+ (iw_handler) ar6000_ioctl_delkey, /* SIOCWFIRSTPRIV+4 */
-+ (iw_handler) ar6000_ioctl_getwmmparams, /* SIOCWFIRSTPRIV+5 */
-+ (iw_handler) ar6000_ioctl_setoptie, /* SIOCWFIRSTPRIV+6 */
-+ (iw_handler) ar6000_ioctl_setmlme, /* SIOCWFIRSTPRIV+7 */
-+ (iw_handler) ar6000_ioctl_addpmkid, /* SIOCWFIRSTPRIV+8 */
-+};
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ ar->arMgmtFilter = filterType;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_WSC_STATUS:
++ {
++ A_UINT32 wsc_status;
+
-+#define IW_PRIV_TYPE_KEY \
-+ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_key))
-+#define IW_PRIV_TYPE_DELKEY \
-+ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_del_key))
-+#define IW_PRIV_TYPE_MLME \
-+ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_mlme))
-+#define IW_PRIV_TYPE_ADDPMKID \
-+ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_addpmkid))
++ if (copy_from_user(&wsc_status, userdata, sizeof(A_UINT32)))
++ {
++ return -EFAULT;
++ }
++ if (wmi_set_wsc_status_cmd(ar->arWmi, wsc_status) != A_OK) {
++ ret = -EIO;
++ }
++ break;
++ }
++ case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
++ {
++ A_UINT32 ROM_addr;
++ A_UINT32 RAM_addr;
++ A_UINT32 nbytes;
++ A_UINT32 do_activate;
++ A_UINT32 rompatch_id;
+
-+static const struct iw_priv_args ar6000_priv_args[] = {
-+ { IEEE80211_IOCTL_SETKEY,
-+ IW_PRIV_TYPE_KEY | IW_PRIV_SIZE_FIXED, 0, "setkey"},
-+ { IEEE80211_IOCTL_DELKEY,
-+ IW_PRIV_TYPE_DELKEY | IW_PRIV_SIZE_FIXED, 0, "delkey"},
-+ { IEEE80211_IOCTL_SETPARAM,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "setparam"},
-+ { IEEE80211_IOCTL_GETPARAM,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getparam"},
-+ { IEEE80211_IOCTL_SETWMMPARAMS,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, 0, "setwmmparams"},
-+ { IEEE80211_IOCTL_GETWMMPARAMS,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3,
-+ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getwmmparams"},
-+ { IEEE80211_IOCTL_SETOPTIE,
-+ IW_PRIV_TYPE_BYTE, 0, "setie"},
-+ { IEEE80211_IOCTL_SETMLME,
-+ IW_PRIV_TYPE_MLME, 0, "setmlme"},
-+ { IEEE80211_IOCTL_ADDPMKID,
-+ IW_PRIV_TYPE_ADDPMKID | IW_PRIV_SIZE_FIXED, 0, "addpmkid"},
-+};
++ get_user(ROM_addr, (A_UINT32 *)userdata);
++ get_user(RAM_addr, (A_UINT32 *)userdata + 1);
++ get_user(nbytes, (A_UINT32 *)userdata + 2);
++ get_user(do_activate, (A_UINT32 *)userdata + 3);
++ AR_DEBUG_PRINTF("Install rompatch from ROM: 0x%x to RAM: 0x%x length: %d\n",
++ ROM_addr, RAM_addr, nbytes);
++ ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
++ nbytes, do_activate, &rompatch_id);
++ if (ret == A_OK) {
++ put_user(rompatch_id, (unsigned int *)rq->ifr_data); /* return value */
++ }
++ break;
++ }
+
-+void ar6000_ioctl_iwsetup(struct iw_handler_def *def)
-+{
-+ def->private_args = (struct iw_priv_args *)ar6000_priv_args;
-+ def->num_private_args = ARRAY_SIZE(ar6000_priv_args);
-+}
++ case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
++ {
++ A_UINT32 rompatch_id;
+
-+struct iw_handler_def ath_iw_handler_def = {
-+ .standard = (iw_handler *)ath_handlers,
-+ .num_standard = ARRAY_SIZE(ath_handlers),
-+ .private = (iw_handler *)ath_priv_handlers,
-+ .num_private = ARRAY_SIZE(ath_priv_handlers),
-+};
++ get_user(rompatch_id, (A_UINT32 *)userdata);
++ AR_DEBUG_PRINTF("UNinstall rompatch_id %d\n", rompatch_id);
++ ret = BMIrompatchUninstall(hifDevice, rompatch_id);
++ break;
++ }
+
++ case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
++ case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
++ {
++ A_UINT32 rompatch_count;
+
-diff --git a/drivers/ar6000/bmi/bmi.c b/drivers/ar6000/bmi/bmi.c
-new file mode 100644
-index 0000000..d7b610c
---- /dev/null
-+++ b/drivers/ar6000/bmi/bmi.c
-@@ -0,0 +1,657 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ get_user(rompatch_count, (A_UINT32 *)userdata);
++ AR_DEBUG_PRINTF("Change rompatch activation count=%d\n", rompatch_count);
++ length = sizeof(A_UINT32) * rompatch_count;
++ if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
++ A_MEMZERO(buffer, length);
++ if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
++ {
++ ret = -EFAULT;
++ } else {
++ if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
++ ret = BMIrompatchActivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
++ } else {
++ ret = BMIrompatchDeactivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
++ }
++ }
++ A_FREE(buffer);
++ } else {
++ ret = -ENOMEM;
++ }
+
-+#include "hif.h"
-+#include "bmi.h"
-+#include "htc_api.h"
-+#include "bmi_internal.h"
++ break;
++ }
+
-+/*
-+Although we had envisioned BMI to run on top of HTC, this is not what the
-+final implementation boiled down to on dragon. Its a part of BSP and does
-+not use the HTC protocol either. On the host side, however, we were still
-+living with the original idea. I think the time has come to accept the truth
-+and separate it from HTC which has been carrying BMI's burden all this while.
-+It shall make HTC state machine relatively simpler
-+*/
++ case AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE:
++ {
++ WMI_SET_HOST_SLEEP_MODE_CMD setHostSleepMode;
+
-+/* APIs visible to the driver */
-+void
-+BMIInit(void)
-+{
-+ bmiDone = FALSE;
-+}
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setHostSleepMode, userdata,
++ sizeof(setHostSleepMode)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_host_sleep_mode_cmd(ar->arWmi,
++ &setHostSleepMode) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_SET_WOW_MODE:
++ {
++ WMI_SET_WOW_MODE_CMD setWowMode;
+
-+A_STATUS
-+BMIDone(HIF_DEVICE *device)
-+{
-+ A_STATUS status;
-+ A_UINT32 cid;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&setWowMode, userdata,
++ sizeof(setWowMode)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_wow_mode_cmd(ar->arWmi,
++ &setWowMode) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_GET_WOW_LIST:
++ {
++ WMI_GET_WOW_LIST_CMD getWowList;
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF (ATH_DEBUG_BMI, ("BMIDone skipped\n"));
-+ return A_OK;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&getWowList, userdata,
++ sizeof(getWowList)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_get_wow_list_cmd(ar->arWmi,
++ &getWowList) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_WMI_ADD_WOW_PATTERN:
++ {
++#define WOW_PATTERN_SIZE 64
++#define WOW_MASK_SIZE 64
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%p)\n", device));
-+ bmiDone = TRUE;
-+ cid = BMI_DONE;
++ WMI_ADD_WOW_PATTERN_CMD cmd;
++ A_UINT8 mask_data[WOW_PATTERN_SIZE]={0};
++ A_UINT8 pattern_data[WOW_PATTERN_SIZE]={0};
+
-+ status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Exit\n"));
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else {
+
-+ return A_OK;
-+}
++ if(copy_from_user(&cmd, userdata,
++ sizeof(WMI_ADD_WOW_PATTERN_CMD)))
++ return -EFAULT;
++ if (copy_from_user(pattern_data,
++ userdata + 3,
++ cmd.filter_size)){
++ ret = -EFAULT;
++ break;
++ }
++ if (copy_from_user(mask_data,
++ (userdata + 3 + cmd.filter_size),
++ cmd.filter_size)){
++ ret = -EFAULT;
++ break;
++ } else {
++ if (wmi_add_wow_pattern_cmd(ar->arWmi,
++ &cmd, pattern_data, mask_data, cmd.filter_size) != A_OK){
++ ret = -EIO;
++ }
++ }
++ }
++#undef WOW_PATTERN_SIZE
++#undef WOW_MASK_SIZE
++ break;
++ }
++ case AR6000_XIOCTL_WMI_DEL_WOW_PATTERN:
++ {
++ WMI_DEL_WOW_PATTERN_CMD delWowPattern;
+
-+A_STATUS
-+BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info)
-+{
-+ A_STATUS status;
-+ A_UINT32 cid;
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&delWowPattern, userdata,
++ sizeof(delWowPattern)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_del_wow_pattern_cmd(ar->arWmi,
++ &delWowPattern) != A_OK)
++ {
++ ret = -EIO;
++ }
++ }
++ break;
++ }
++ case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
++ if (ar->arHtcTarget != NULL) {
++ HTCDumpCreditStates(ar->arHtcTarget);
++ }
++ break;
++ case AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE:
++ if (ar->arHtcTarget != NULL) {
++ struct ar6000_traffic_activity_change data;
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
++ if (copy_from_user(&data, userdata, sizeof(data)))
++ {
++ return -EFAULT;
++ }
++ /* note, this is used for testing (mbox ping testing), indicate activity
++ * change using the stream ID as the traffic class */
++ ar6000_indicate_tx_activity(ar,
++ (A_UINT8)data.StreamID,
++ data.Active ? TRUE : FALSE);
++ }
++ break;
++ case AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS:
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&connectCtrlFlags, userdata,
++ sizeof(connectCtrlFlags)))
++ {
++ ret = -EFAULT;
++ } else {
++ ar->arConnectCtrlFlags = connectCtrlFlags;
++ }
++ break;
++ case AR6000_XIOCTL_WMI_SET_AKMP_PARAMS:
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else if (copy_from_user(&akmpParams, userdata,
++ sizeof(WMI_SET_AKMP_PARAMS_CMD)))
++ {
++ ret = -EFAULT;
++ } else {
++ if (wmi_set_akmp_params_cmd(ar->arWmi, &akmpParams) != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ case AR6000_XIOCTL_WMI_SET_PMKID_LIST:
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else {
++ if (copy_from_user(&pmkidInfo.numPMKID, userdata,
++ sizeof(pmkidInfo.numPMKID)))
++ {
++ ret = -EFAULT;
++ break;
++ }
++ if (copy_from_user(&pmkidInfo.pmkidList,
++ userdata + sizeof(pmkidInfo.numPMKID),
++ pmkidInfo.numPMKID * sizeof(WMI_PMKID)))
++ {
++ ret = -EFAULT;
++ break;
++ }
++ if (wmi_set_pmkid_list_cmd(ar->arWmi, &pmkidInfo) != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ case AR6000_XIOCTL_WMI_GET_PMKID_LIST:
++ if (ar->arWmiReady == FALSE) {
++ ret = -EIO;
++ } else {
++ if (wmi_get_pmkid_list_cmd(ar->arWmi) != A_OK) {
++ ret = -EIO;
++ }
++ }
++ break;
++ default:
++ ret = -EOPNOTSUPP;
+ }
++ return ret;
++}
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%p)\n", device));
-+ cid = BMI_GET_TARGET_INFO;
-+
-+ status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
+diff --git a/drivers/ar6000/ar6000/netbuf.c b/drivers/ar6000/ar6000/netbuf.c
+new file mode 100644
+index 0000000..97b273b
+--- /dev/null
++++ b/drivers/ar6000/ar6000/netbuf.c
+@@ -0,0 +1,225 @@
+
-+ status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_ver,
-+ sizeof(targ_info->target_ver));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Version from the device\n"));
-+ return A_ERROR;
-+ }
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
++#include <linux/kernel.h>
++#include <linux/skbuff.h>
++#include <a_config.h>
++#include "athdefs.h"
++#include "a_types.h"
++#include "a_osapi.h"
++#include "htc_packet.h"
+
-+ if (targ_info->target_ver == TARGET_VERSION_SENTINAL) {
-+ /* Determine how many bytes are in the Target's targ_info */
-+ status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_info_byte_count,
-+ sizeof(targ_info->target_info_byte_count));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info Byte Count from the device\n"));
-+ return A_ERROR;
-+ }
++#define AR6000_DATA_OFFSET 64
+
-+ /*
-+ * The Target's targ_info doesn't match the Host's targ_info.
-+ * We need to do some backwards compatibility work to make this OK.
-+ */
-+ A_ASSERT(targ_info->target_info_byte_count == sizeof(*targ_info));
++void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt)
++{
++ skb_queue_tail((struct sk_buff_head *) q, (struct sk_buff *) pkt);
++}
+
-+ /* Read the remainder of the targ_info */
-+ status = bmiBufferReceive(device,
-+ ((A_UCHAR *)targ_info)+sizeof(targ_info->target_info_byte_count),
-+ sizeof(*targ_info)-sizeof(targ_info->target_info_byte_count));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info (%d bytes) from the device\n",
-+ targ_info->target_info_byte_count));
-+ return A_ERROR;
-+ }
-+ } else {
-+ /*
-+ * Target must be an AR6001 whose firmware does not
-+ * support BMI_GET_TARGET_INFO. Construct the data
-+ * that it would have sent.
-+ */
-+ targ_info->target_info_byte_count = sizeof(targ_info);
-+ targ_info->target_type = TARGET_TYPE_AR6001;
-+ }
++void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt)
++{
++ skb_queue_head((struct sk_buff_head *) q, (struct sk_buff *) pkt);
++}
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
-+ targ_info->target_ver, targ_info->target_type));
-+ printk("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
-+ targ_info->target_ver, targ_info->target_type);
++void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q)
++{
++ return((void *) skb_dequeue((struct sk_buff_head *) q));
++}
+
-+ return A_OK;
++int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q)
++{
++ return(skb_queue_len((struct sk_buff_head *) q));
+}
+
-+A_STATUS
-+BMIReadMemory(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length)
++int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ A_UINT32 remaining, rxlen;
-+ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
-+ memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length));
++ return(skb_queue_empty((struct sk_buff_head *) q));
++}
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q)
++{
++ skb_queue_head_init((struct sk_buff_head *) q);
++}
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Read Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
-+ device, address, length));
++void *
++a_netbuf_alloc(int size)
++{
++ struct sk_buff *skb;
++ skb = dev_alloc_skb(AR6000_DATA_OFFSET + sizeof(HTC_PACKET) + size);
++ skb_reserve(skb, AR6000_DATA_OFFSET + sizeof(HTC_PACKET));
++ return ((void *)skb);
++}
+
-+ cid = BMI_READ_MEMORY;
++/*
++ * Allocate an SKB w.o. any encapsulation requirement.
++ */
++void *
++a_netbuf_alloc_raw(int size)
++{
++ struct sk_buff *skb;
+
-+ remaining = length;
++ skb = dev_alloc_skb(size);
+
-+ while (remaining)
-+ {
-+ rxlen = (remaining < BMI_DATASZ_MAX) ? remaining : BMI_DATASZ_MAX;
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
-+ A_MEMCPY(&data[offset], &rxlen, sizeof(rxlen));
-+ offset += sizeof(length);
++ return ((void *)skb);
++}
+
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
-+ status = bmiBufferReceive(device, data, rxlen);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+ return A_ERROR;
-+ }
-+ A_MEMCPY(&buffer[length - remaining], data, rxlen);
-+ remaining -= rxlen; address += rxlen;
-+ }
++void
++a_netbuf_free(void *bufPtr)
++{
++ struct sk_buff *skb = (struct sk_buff *)bufPtr;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read Memory: Exit\n"));
-+ return A_OK;
++ dev_kfree_skb(skb);
+}
+
-+A_STATUS
-+BMIWriteMemory(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length)
++A_UINT32
++a_netbuf_to_len(void *bufPtr)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ A_UINT32 remaining, txlen;
-+ const A_UINT32 header = sizeof(cid) + sizeof(address) + sizeof(length);
-+ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
-+ memset (&data, 0, header);
-+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++ return (((struct sk_buff *)bufPtr)->len);
++}
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Write Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
-+ device, address, length));
++void *
++a_netbuf_to_data(void *bufPtr)
++{
++ return (((struct sk_buff *)bufPtr)->data);
++}
+
-+ cid = BMI_WRITE_MEMORY;
++/*
++ * Add len # of bytes to the beginning of the network buffer
++ * pointed to by bufPtr
++ */
++A_STATUS
++a_netbuf_push(void *bufPtr, A_INT32 len)
++{
++ skb_push((struct sk_buff *)bufPtr, len);
+
-+ remaining = length;
-+ while (remaining)
-+ {
-+ txlen = (remaining < (BMI_DATASZ_MAX - header)) ?
-+ remaining : (BMI_DATASZ_MAX - header);
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
-+ A_MEMCPY(&data[offset], &txlen, sizeof(txlen));
-+ offset += sizeof(txlen);
-+ A_MEMCPY(&data[offset], &buffer[length - remaining], txlen);
-+ offset += txlen;
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
-+ remaining -= txlen; address += txlen;
-+ }
++ return A_OK;
++}
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Write Memory: Exit\n"));
++/*
++ * Add len # of bytes to the beginning of the network buffer
++ * pointed to by bufPtr and also fill with data
++ */
++A_STATUS
++a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len)
++{
++ skb_push((struct sk_buff *) bufPtr, len);
++ A_MEMCPY(((struct sk_buff *)bufPtr)->data, srcPtr, len);
+
+ return A_OK;
+}
+
++/*
++ * Add len # of bytes to the end of the network buffer
++ * pointed to by bufPtr
++ */
+A_STATUS
-+BMIExecute(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 *param)
++a_netbuf_put(void *bufPtr, A_INT32 len)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(*param)];
-+ memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(*param));
-+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++ skb_put((struct sk_buff *)bufPtr, len);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Execute: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
-+ device, address, *param));
++ return A_OK;
++}
+
-+ cid = BMI_EXECUTE;
++/*
++ * Add len # of bytes to the end of the network buffer
++ * pointed to by bufPtr and also fill with data
++ */
++A_STATUS
++a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len)
++{
++ char *start = ((struct sk_buff *)bufPtr)->data +
++ ((struct sk_buff *)bufPtr)->len;
++ skb_put((struct sk_buff *)bufPtr, len);
++ A_MEMCPY(start, srcPtr, len);
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
-+ A_MEMCPY(&data[offset], param, sizeof(*param));
-+ offset += sizeof(*param);
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++ return A_OK;
++}
+
-+ status = bmiBufferReceive(device, data, sizeof(*param));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+ return A_ERROR;
-+ }
+
-+ A_MEMCPY(param, data, sizeof(*param));
++/*
++ * Trim the network buffer pointed to by bufPtr to len # of bytes
++ */
++A_STATUS
++a_netbuf_setlen(void *bufPtr, A_INT32 len)
++{
++ skb_trim((struct sk_buff *)bufPtr, len);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Execute: Exit (param: %d)\n", *param));
+ return A_OK;
+}
+
++/*
++ * Chop of len # of bytes from the end of the buffer.
++ */
+A_STATUS
-+BMISetAppStart(HIF_DEVICE *device,
-+ A_UINT32 address)
++a_netbuf_trim(void *bufPtr, A_INT32 len)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(address)];
-+ memset (&data, 0, sizeof(cid) + sizeof(address));
-+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Set App Start: Enter (device: 0x%p, address: 0x%x)\n",
-+ device, address));
-+
-+ cid = BMI_SET_APP_START;
-+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++ skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Set App Start: Exit\n"));
+ return A_OK;
+}
+
++/*
++ * Chop of len # of bytes from the end of the buffer and return the data.
++ */
+A_STATUS
-+BMIReadSOCRegister(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 *param)
++a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(address)];
-+ memset (&data, 0, sizeof(cid) + sizeof(address));
-+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++ char *start = ((struct sk_buff *)bufPtr)->data +
++ (((struct sk_buff *)bufPtr)->len - len);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Read SOC Register: Enter (device: 0x%p, address: 0x%x)\n",
-+ device, address));
++ A_MEMCPY(dstPtr, start, len);
++ skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
-+ cid = BMI_READ_SOC_REGISTER;
++ return A_OK;
++}
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
+
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++/*
++ * Returns the number of bytes available to a a_netbuf_push()
++ */
++A_INT32
++a_netbuf_headroom(void *bufPtr)
++{
++ return (skb_headroom((struct sk_buff *)bufPtr));
++}
+
-+ status = bmiBufferReceive(device, data, sizeof(*param));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+ return A_ERROR;
-+ }
-+ A_MEMCPY(param, data, sizeof(*param));
++/*
++ * Removes specified number of bytes from the beginning of the buffer
++ */
++A_STATUS
++a_netbuf_pull(void *bufPtr, A_INT32 len)
++{
++ skb_pull((struct sk_buff *)bufPtr, len);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit (value: %d)\n", *param));
+ return A_OK;
+}
+
++/*
++ * Removes specified number of bytes from the beginning of the buffer
++ * and return the data
++ */
+A_STATUS
-+BMIWriteSOCRegister(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 param)
++a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len)
+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(param)];
++ A_MEMCPY(dstPtr, ((struct sk_buff *)bufPtr)->data, len);
++ skb_pull((struct sk_buff *)bufPtr, len);
+
-+ memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(param));
++ return A_OK;
++}
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
+diff --git a/drivers/ar6000/ar6000/osapi_linux.h b/drivers/ar6000/ar6000/osapi_linux.h
+new file mode 100644
+index 0000000..5b64212
+--- /dev/null
++++ b/drivers/ar6000/ar6000/osapi_linux.h
+@@ -0,0 +1,319 @@
++/*
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/osapi_linux.h#1 $
++ *
++ * This file contains the definitions of the basic atheros data types.
++ * It is used to map the data types in atheros files to a platform specific
++ * type.
++ *
++ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Write SOC Register: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
-+ device, address, param));
++#ifndef _OSAPI_LINUX_H_
++#define _OSAPI_LINUX_H_
+
-+ cid = BMI_WRITE_SOC_REGISTER;
++#ifdef __KERNEL__
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &address, sizeof(address));
-+ offset += sizeof(address);
-+ A_MEMCPY(&data[offset], ¶m, sizeof(param));
-+ offset += sizeof(param);
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++#include <linux/version.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
++#include <linux/jiffies.h>
++#endif
++#include <linux/timer.h>
++#include <linux/delay.h>
++#include <linux/wait.h>
++#ifdef KERNEL_2_4
++#include <asm/arch/irq.h>
++#include <asm/irq.h>
++#endif
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit\n"));
-+ return A_OK;
-+}
++#ifdef __GNUC__
++#define __ATTRIB_PACK __attribute__ ((packed))
++#define __ATTRIB_PRINTF __attribute__ ((format (printf, 1, 2)))
++#define __ATTRIB_NORETURN __attribute__ ((noreturn))
++#ifndef INLINE
++#define INLINE __inline__
++#endif
++#else /* Not GCC */
++#define __ATTRIB_PACK
++#define __ATTRIB_PRINTF
++#define __ATTRIB_NORETURN
++#ifndef INLINE
++#define INLINE __inline
++#endif
++#endif /* End __GNUC__ */
+
-+A_STATUS
-+BMIrompatchInstall(HIF_DEVICE *device,
-+ A_UINT32 ROM_addr,
-+ A_UINT32 RAM_addr,
-+ A_UINT32 nbytes,
-+ A_UINT32 do_activate,
-+ A_UINT32 *rompatch_id)
-+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
-+ sizeof(nbytes) + sizeof(do_activate)];
++#define PREPACK
++#define POSTPACK __ATTRIB_PACK
+
-+ memset (&data, 0, sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
-+ sizeof(nbytes) + sizeof(do_activate));
++/*
++ * Endianes macros
++ */
++#define A_BE2CPU8(x) ntohb(x)
++#define A_BE2CPU16(x) ntohs(x)
++#define A_BE2CPU32(x) ntohl(x)
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++#define A_LE2CPU8(x) (x)
++#define A_LE2CPU16(x) (x)
++#define A_LE2CPU32(x) (x)
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI rompatch Install: Enter (device: 0x%p, ROMaddr: 0x%x, RAMaddr: 0x%x length: %d activate: %d)\n",
-+ device, ROM_addr, RAM_addr, nbytes, do_activate));
++#define A_CPU2BE8(x) htonb(x)
++#define A_CPU2BE16(x) htons(x)
++#define A_CPU2BE32(x) htonl(x)
+
-+ cid = BMI_ROMPATCH_INSTALL;
++#define A_MEMCPY(dst, src, len) memcpy((A_UINT8 *)(dst), (src), (len))
++#define A_MEMZERO(addr, len) memset(addr, 0, len)
++#define A_MEMCMP(addr1, addr2, len) memcmp((addr1), (addr2), (len))
++#define A_MALLOC(size) kmalloc((size), GFP_KERNEL)
++#define A_MALLOC_NOWAIT(size) kmalloc((size), GFP_ATOMIC)
++#define A_FREE(addr) kfree(addr)
++#define A_PRINTF(args...) printk(args)
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &ROM_addr, sizeof(ROM_addr));
-+ offset += sizeof(ROM_addr);
-+ A_MEMCPY(&data[offset], &RAM_addr, sizeof(RAM_addr));
-+ offset += sizeof(RAM_addr);
-+ A_MEMCPY(&data[offset], &nbytes, sizeof(nbytes));
-+ offset += sizeof(nbytes);
-+ A_MEMCPY(&data[offset], &do_activate, sizeof(do_activate));
-+ offset += sizeof(do_activate);
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++/* Mutual Exclusion */
++typedef spinlock_t A_MUTEX_T;
++#define A_MUTEX_INIT(mutex) spin_lock_init(mutex)
++#define A_MUTEX_LOCK(mutex) spin_lock_bh(mutex)
++#define A_MUTEX_UNLOCK(mutex) spin_unlock_bh(mutex)
++#define A_IS_MUTEX_VALID(mutex) TRUE /* okay to return true, since A_MUTEX_DELETE does nothing */
++#define A_MUTEX_DELETE(mutex) /* spin locks are not kernel resources so nothing to free.. */
+
-+ status = bmiBufferReceive(device, (A_UCHAR *)rompatch_id, sizeof(*rompatch_id));
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
-+ return A_ERROR;
-+ }
++/* Get current time in ms adding a constant offset (in ms) */
++#define A_GET_MS(offset) \
++ (jiffies + ((offset) / 1000) * HZ)
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch Install: (rompatch_id=%d)\n", *rompatch_id));
-+ return A_OK;
-+}
++/*
++ * Timer Functions
++ */
++#define A_MDELAY(msecs) mdelay(msecs)
++typedef struct timer_list A_TIMER;
+
-+A_STATUS
-+BMIrompatchUninstall(HIF_DEVICE *device,
-+ A_UINT32 rompatch_id)
-+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[sizeof(cid) + sizeof(rompatch_id)];
-+ memset (&data, 0, sizeof(cid) + sizeof(rompatch_id));
++#define A_INIT_TIMER(pTimer, pFunction, pArg) do { \
++ init_timer(pTimer); \
++ (pTimer)->function = (pFunction); \
++ (pTimer)->data = (unsigned long)(pArg); \
++} while (0)
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
-+ }
++/*
++ * Start a Timer that elapses after 'periodMSec' milli-seconds
++ * Support is provided for a one-shot timer. The 'repeatFlag' is
++ * ignored.
++ */
++#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do { \
++ if (repeatFlag) { \
++ printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__); \
++ panic("Timer Repeat"); \
++ } \
++ mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000); \
++} while (0)
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI rompatch Uninstall: Enter (device: 0x%p, rompatch_id: %d)\n",
-+ device, rompatch_id));
++/*
++ * Cancel the Timer.
++ */
++#define A_UNTIMEOUT(pTimer) do { \
++ del_timer((pTimer)); \
++} while (0)
+
-+ cid = BMI_ROMPATCH_UNINSTALL;
++#define A_DELETE_TIMER(pTimer) do { \
++} while (0)
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &rompatch_id, sizeof(rompatch_id));
-+ offset += sizeof(rompatch_id);
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++/*
++ * Wait Queue related functions
++ */
++typedef wait_queue_head_t A_WAITQUEUE_HEAD;
++#define A_INIT_WAITQUEUE_HEAD(head) init_waitqueue_head(head)
++#ifndef wait_event_interruptible_timeout
++#define __wait_event_interruptible_timeout(wq, condition, ret) \
++do { \
++ wait_queue_t __wait; \
++ init_waitqueue_entry(&__wait, current); \
++ \
++ add_wait_queue(&wq, &__wait); \
++ for (;;) { \
++ set_current_state(TASK_INTERRUPTIBLE); \
++ if (condition) \
++ break; \
++ if (!signal_pending(current)) { \
++ ret = schedule_timeout(ret); \
++ if (!ret) \
++ break; \
++ continue; \
++ } \
++ ret = -ERESTARTSYS; \
++ break; \
++ } \
++ current->state = TASK_RUNNING; \
++ remove_wait_queue(&wq, &__wait); \
++} while (0)
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch UNinstall: (rompatch_id=0x%x)\n", rompatch_id));
-+ return A_OK;
-+}
++#define wait_event_interruptible_timeout(wq, condition, timeout) \
++({ \
++ long __ret = timeout; \
++ if (!(condition)) \
++ __wait_event_interruptible_timeout(wq, condition, __ret); \
++ __ret; \
++})
++#endif /* wait_event_interruptible_timeout */
+
-+static A_STATUS
-+_BMIrompatchChangeActivation(HIF_DEVICE *device,
-+ A_UINT32 rompatch_count,
-+ A_UINT32 *rompatch_list,
-+ A_UINT32 do_activate)
-+{
-+ A_UINT32 cid;
-+ A_STATUS status;
-+ A_UINT32 offset;
-+ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count)];
-+ A_UINT32 length;
++#define A_WAIT_EVENT_INTERRUPTIBLE_TIMEOUT(head, condition, timeout) do { \
++ wait_event_interruptible_timeout(head, condition, timeout); \
++} while (0)
+
-+ memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count));
++#define A_WAKE_UP(head) wake_up(head)
+
-+ if (bmiDone) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
-+ return A_ERROR;
++#ifdef DEBUG
++#define A_ASSERT(expr) \
++ if (!(expr)) { \
++ printk(KERN_ALERT "\n" __FILE__ ":%d: Assertion " #expr " failed!\n",__LINE__); \
++ panic(#expr); \
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
-+ ("BMI Change rompatch Activation: Enter (device: 0x%p, count: %d)\n",
-+ device, rompatch_count));
++#else
++#define A_ASSERT(expr)
++#endif /* DEBUG */
+
-+ cid = do_activate ? BMI_ROMPATCH_ACTIVATE : BMI_ROMPATCH_DEACTIVATE;
++/*
++ * Initialization of the network buffer subsystem
++ */
++#define A_NETBUF_INIT()
+
-+ offset = 0;
-+ A_MEMCPY(&data[offset], &cid, sizeof(cid));
-+ offset += sizeof(cid);
-+ A_MEMCPY(&data[offset], &rompatch_count, sizeof(rompatch_count));
-+ offset += sizeof(rompatch_count);
-+ length = rompatch_count * sizeof(*rompatch_list);
-+ A_MEMCPY(&data[offset], rompatch_list, length);
-+ offset += length;
-+ status = bmiBufferSend(device, data, offset);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
-+ return A_ERROR;
-+ }
++/*
++ * Network buffer queue support
++ */
++typedef struct sk_buff_head A_NETBUF_QUEUE_T;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Change rompatch Activation: Exit\n"));
++#define A_NETBUF_QUEUE_INIT(q) \
++ a_netbuf_queue_init(q)
+
-+ return A_OK;
-+}
++#define A_NETBUF_ENQUEUE(q, pkt) \
++ a_netbuf_enqueue((q), (pkt))
++#define A_NETBUF_PREQUEUE(q, pkt) \
++ a_netbuf_prequeue((q), (pkt))
++#define A_NETBUF_DEQUEUE(q) \
++ (a_netbuf_dequeue(q))
++#define A_NETBUF_QUEUE_SIZE(q) \
++ a_netbuf_queue_size(q)
++#define A_NETBUF_QUEUE_EMPTY(q) \
++ a_netbuf_queue_empty(q)
+
-+A_STATUS
-+BMIrompatchActivate(HIF_DEVICE *device,
-+ A_UINT32 rompatch_count,
-+ A_UINT32 *rompatch_list)
-+{
-+ return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 1);
-+}
++/*
++ * Network buffer support
++ */
++#define A_NETBUF_ALLOC(size) \
++ a_netbuf_alloc(size)
++#define A_NETBUF_ALLOC_RAW(size) \
++ a_netbuf_alloc_raw(size)
++#define A_NETBUF_FREE(bufPtr) \
++ a_netbuf_free(bufPtr)
++#define A_NETBUF_DATA(bufPtr) \
++ a_netbuf_to_data(bufPtr)
++#define A_NETBUF_LEN(bufPtr) \
++ a_netbuf_to_len(bufPtr)
++#define A_NETBUF_PUSH(bufPtr, len) \
++ a_netbuf_push(bufPtr, len)
++#define A_NETBUF_PUT(bufPtr, len) \
++ a_netbuf_put(bufPtr, len)
++#define A_NETBUF_TRIM(bufPtr,len) \
++ a_netbuf_trim(bufPtr, len)
++#define A_NETBUF_PULL(bufPtr, len) \
++ a_netbuf_pull(bufPtr, len)
++#define A_NETBUF_HEADROOM(bufPtr)\
++ a_netbuf_headroom(bufPtr)
++#define A_NETBUF_SETLEN(bufPtr,len) \
++ a_netbuf_setlen(bufPtr, len)
+
-+A_STATUS
-+BMIrompatchDeactivate(HIF_DEVICE *device,
-+ A_UINT32 rompatch_count,
-+ A_UINT32 *rompatch_list)
-+{
-+ return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 0);
-+}
++/* Add data to end of a buffer */
++#define A_NETBUF_PUT_DATA(bufPtr, srcPtr, len) \
++ a_netbuf_put_data(bufPtr, srcPtr, len)
+
-+/* BMI Access routines */
-+A_STATUS
-+bmiBufferSend(HIF_DEVICE *device,
-+ A_UCHAR *buffer,
-+ A_UINT32 length)
-+{
-+ A_STATUS status;
-+ A_UINT32 timeout;
-+ A_UINT32 address;
-+ static A_UINT32 cmdCredits;
-+ A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
++/* Add data to start of the buffer */
++#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr, len) \
++ a_netbuf_push_data(bufPtr, srcPtr, len)
+
-+ HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
-+ &mboxAddress, sizeof(mboxAddress));
++/* Remove data at start of the buffer */
++#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
++ a_netbuf_pull_data(bufPtr, dstPtr, len)
+
-+ cmdCredits = 0;
-+ timeout = BMI_COMMUNICATION_TIMEOUT;
++/* Remove data from the end of the buffer */
++#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
++ a_netbuf_trim_data(bufPtr, dstPtr, len)
+
-+ while(timeout-- && !cmdCredits) {
-+ /* Read the counter register to get the command credits */
-+ address = COUNT_DEC_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 4;
-+ /* hit the credit counter with a 4-byte access, the first byte read will hit the counter and cause
-+ * a decrement, while the remaining 3 bytes has no effect. The rationale behind this is to
-+ * make all HIF accesses 4-byte aligned */
-+ status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, 4,
-+ HIF_RD_SYNC_BYTE_INC, NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to decrement the command credit count register\n"));
-+ return A_ERROR;
-+ }
-+ /* the counter is only 8=bits, ignore anything in the upper 3 bytes */
-+ cmdCredits &= 0xFF;
-+ }
++/* View data as "size" contiguous bytes of type "t" */
++#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
++ (t )( ((struct skbuf *)(bufPtr))->data)
+
-+ if (cmdCredits) {
-+ address = mboxAddress[ENDPOINT1];
-+ status = HIFReadWrite(device, address, buffer, length,
-+ HIF_WR_SYNC_BYTE_INC, NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to send the BMI data to the device\n"));
-+ return A_ERROR;
-+ }
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout\n"));
-+ return A_ERROR;
-+ }
++/* return the beginning of the headroom for the buffer */
++#define A_NETBUF_HEAD(bufPtr) \
++ ((((struct sk_buff *)(bufPtr))->head))
+
-+ return status;
-+}
++/*
++ * OS specific network buffer access routines
++ */
++void *a_netbuf_alloc(int size);
++void *a_netbuf_alloc_raw(int size);
++void a_netbuf_free(void *bufPtr);
++void *a_netbuf_to_data(void *bufPtr);
++A_UINT32 a_netbuf_to_len(void *bufPtr);
++A_STATUS a_netbuf_push(void *bufPtr, A_INT32 len);
++A_STATUS a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len);
++A_STATUS a_netbuf_put(void *bufPtr, A_INT32 len);
++A_STATUS a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len);
++A_STATUS a_netbuf_pull(void *bufPtr, A_INT32 len);
++A_STATUS a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len);
++A_STATUS a_netbuf_trim(void *bufPtr, A_INT32 len);
++A_STATUS a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len);
++A_STATUS a_netbuf_setlen(void *bufPtr, A_INT32 len);
++A_INT32 a_netbuf_headroom(void *bufPtr);
++void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
++void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
++void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
++int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
++int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
++int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
++void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
+
-+A_STATUS
-+bmiBufferReceive(HIF_DEVICE *device,
-+ A_UCHAR *buffer,
-+ A_UINT32 length)
-+{
-+ A_STATUS status;
-+ A_UINT32 address;
-+ A_UINT32 timeout;
-+ static A_UINT32 cmdCredits;
-+ A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
++/*
++ * Kernel v.s User space functions
++ */
++A_UINT32 a_copy_to_user(void *to, const void *from, A_UINT32 n);
++A_UINT32 a_copy_from_user(void *to, const void *from, A_UINT32 n);
+
-+ HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
-+ &mboxAddress, sizeof(mboxAddress));
++#else /* __KERNEL__ */
+
-+ cmdCredits = 0;
-+ timeout = BMI_COMMUNICATION_TIMEOUT;
-+ while(timeout-- && !cmdCredits) {
-+ /* Read the counter register to get the command credits */
-+ address = COUNT_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 1;
-+ /* read the counter using a 4-byte read. Since the counter is NOT auto-decrementing,
-+ * we can read this counter multiple times using a non-incrementing address mode.
-+ * The rationale here is to make all HIF accesses a multiple of 4 bytes */
-+ status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, sizeof(cmdCredits),
-+ HIF_RD_SYNC_BYTE_FIX, NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the command credit count register\n"));
-+ return A_ERROR;
-+ }
-+ /* we did a 4-byte read to the same count register so mask off upper bytes */
-+ cmdCredits &= 0xFF;
-+ status = A_ERROR;
-+ }
++#ifdef __GNUC__
++#define __ATTRIB_PACK __attribute__ ((packed))
++#define __ATTRIB_PRINTF __attribute__ ((format (printf, 1, 2)))
++#define __ATTRIB_NORETURN __attribute__ ((noreturn))
++#ifndef INLINE
++#define INLINE __inline__
++#endif
++#else /* Not GCC */
++#define __ATTRIB_PACK
++#define __ATTRIB_PRINTF
++#define __ATTRIB_NORETURN
++#ifndef INLINE
++#define INLINE __inline
++#endif
++#endif /* End __GNUC__ */
+
-+ if (cmdCredits) {
-+ address = mboxAddress[ENDPOINT1];
-+ status = HIFReadWrite(device, address, buffer, length,
-+ HIF_RD_SYNC_BYTE_INC, NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the BMI data from the device\n"));
-+ return A_ERROR;
-+ }
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Communication timeout\n"));
-+ return A_ERROR;
-+ }
++#define PREPACK
++#define POSTPACK __ATTRIB_PACK
+
-+ return status;
-+}
-diff --git a/drivers/ar6000/bmi/bmi_internal.h b/drivers/ar6000/bmi/bmi_internal.h
++#endif /* __KERNEL__ */
++
++#endif /* _OSAPI_LINUX_H_ */
+diff --git a/drivers/ar6000/ar6000/wireless_ext.c b/drivers/ar6000/ar6000/wireless_ext.c
new file mode 100644
-index 0000000..1e21354
+index 0000000..af78ae0
--- /dev/null
-+++ b/drivers/ar6000/bmi/bmi_internal.h
-@@ -0,0 +1,45 @@
-+#ifndef BMI_INTERNAL_H
-+#define BMI_INTERNAL_H
++++ b/drivers/ar6000/ar6000/wireless_ext.c
+@@ -0,0 +1,1979 @@
+/*
+ *
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ *
+ */
+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "AR6Khwreg.h"
-+#include "bmi_msg.h"
-+
-+#define BMI_COMMUNICATION_TIMEOUT 100000
-+
-+/* ------ Global Variable Declarations ------- */
-+A_BOOL bmiDone;
-+
-+A_STATUS
-+bmiBufferSend(HIF_DEVICE *device,
-+ A_UCHAR *buffer,
-+ A_UINT32 length);
++#include "ar6000_drv.h"
+
-+A_STATUS
-+bmiBufferReceive(HIF_DEVICE *device,
-+ A_UCHAR *buffer,
-+ A_UINT32 length);
++static A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
++static void ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi);
++extern unsigned int wmitimeout;
++extern A_WAITQUEUE_HEAD arEvent;
++extern wait_queue_head_t ar6000_scan_queue;
+
-+#endif
-diff --git a/drivers/ar6000/hif/hif.c b/drivers/ar6000/hif/hif.c
-new file mode 100644
-index 0000000..d04486c
---- /dev/null
-+++ b/drivers/ar6000/hif/hif.c
-@@ -0,0 +1,824 @@
+/*
-+ * @file: hif.c
-+ *
-+ * @abstract: HIF layer reference implementation for Atheros SDIO stack
-+ *
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * Encode a WPA or RSN information element as a custom
++ * element using the hostap format.
+ */
++static u_int
++encode_ie(void *buf, size_t bufsize,
++ const u_int8_t *ie, size_t ielen,
++ const char *leader, size_t leader_len)
++{
++ u_int8_t *p;
++ int i;
+
-+#include "hif_internal.h"
++ if (bufsize < leader_len)
++ return 0;
++ p = buf;
++ memcpy(p, leader, leader_len);
++ bufsize -= leader_len;
++ p += leader_len;
++ for (i = 0; i < ielen && bufsize > 2; i++)
++ p += sprintf(p, "%02x", ie[i]);
++ return (i == ielen ? p - (u_int8_t *)buf : 0);
++}
+
-+/* ------ Static Variables ------ */
++void
++ar6000_scan_node(void *arg, bss_t *ni)
++{
++ struct iw_event iwe;
++#if WIRELESS_EXT > 14
++ char buf[64*2 + 30];
++#endif
++ struct ar_giwscan_param *param;
++ A_CHAR *current_ev;
++ A_CHAR *end_buf;
++ struct ieee80211_common_ie *cie;
++ struct iw_request_info info;
+
-+/* ------ Global Variable Declarations ------- */
-+SD_PNP_INFO Ids[] = {
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xB,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xA,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x9,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x8,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x0,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x1,
-+ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
-+ .SDIO_FunctionClass = FUNCTION_CLASS,
-+ .SDIO_FunctionNo = 1
-+ },
-+ {
-+ } //list is null termintaed
-+};
++ info.cmd = 0;
++ info.flags = 0;
+
-+TARGET_FUNCTION_CONTEXT FunctionContext = {
-+ .function.Version = CT_SDIO_STACK_VERSION_CODE,
-+ .function.pName = "sdio_wlan",
-+ .function.MaxDevices = 1,
-+ .function.NumDevices = 0,
-+ .function.pIds = Ids,
-+ .function.pProbe = hifDeviceInserted,
-+ .function.pRemove = hifDeviceRemoved,
-+ .function.pSuspend = NULL,
-+ .function.pResume = NULL,
-+ .function.pWake = NULL,
-+ .function.pContext = &FunctionContext,
-+};
++ param = (struct ar_giwscan_param *)arg;
+
-+HIF_DEVICE hifDevice[HIF_MAX_DEVICES];
-+HTC_CALLBACKS htcCallbacks;
-+BUS_REQUEST busRequest[BUS_REQUEST_MAX_NUM];
-+static BUS_REQUEST *s_busRequestFreeQueue = NULL;
-+OS_CRITICALSECTION lock;
-+extern A_UINT32 onebitmode;
-+extern A_UINT32 busspeedlow;
++ if (param->current_ev >= param->end_buf) {
++ return;
++ }
++ if ((param->firstPass == TRUE) &&
++ ((ni->ni_cie.ie_wpa == NULL) && (ni->ni_cie.ie_rsn == NULL))) {
++ /*
++ * Only forward wpa bss's in first pass
++ */
++ return;
++ }
+
-+#ifdef DEBUG
-+extern A_UINT32 debughif;
-+#define ATH_DEBUG_ERROR 1
-+#define ATH_DEBUG_WARN 2
-+#define ATH_DEBUG_TRACE 3
-+#define _AR_DEBUG_PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(lvl, args)\
-+ {if (lvl <= debughif)\
-+ A_PRINTF(KERN_ALERT _AR_DEBUG_PRINTX_ARG args);\
++ if ((param->firstPass == FALSE) &&
++ ((ni->ni_cie.ie_wpa != NULL) || (ni->ni_cie.ie_rsn != NULL))) {
++ /*
++ * Only forward non-wpa bss's in 2nd pass
++ */
++ return;
+ }
-+#else
-+#define AR_DEBUG_PRINTF(lvl, args)
-+#endif
+
-+static BUS_REQUEST *hifAllocateBusRequest(void);
-+static void hifFreeBusRequest(BUS_REQUEST *busrequest);
-+static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper);
-+static void ResetAllCards(void);
++ current_ev = param->current_ev;
++ end_buf = param->end_buf;
+
-+/* ------ Functions ------ */
-+int HIFInit(HTC_CALLBACKS *callbacks)
-+{
-+ SDIO_STATUS status;
-+ DBG_ASSERT(callbacks != NULL);
++ cie = &ni->ni_cie;
+
-+ /* Store the callback and event handlers */
-+ htcCallbacks.deviceInsertedHandler = callbacks->deviceInsertedHandler;
-+ htcCallbacks.deviceRemovedHandler = callbacks->deviceRemovedHandler;
-+ htcCallbacks.deviceSuspendHandler = callbacks->deviceSuspendHandler;
-+ htcCallbacks.deviceResumeHandler = callbacks->deviceResumeHandler;
-+ htcCallbacks.deviceWakeupHandler = callbacks->deviceWakeupHandler;
-+ htcCallbacks.rwCompletionHandler = callbacks->rwCompletionHandler;
-+ htcCallbacks.dsrHandler = callbacks->dsrHandler;
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = SIOCGIWAP;
++ iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
++ A_MEMCPY(iwe.u.ap_addr.sa_data, ni->ni_macaddr, 6);
++ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
++ IW_EV_ADDR_LEN);
+
-+ CriticalSectionInit(&lock);
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = SIOCGIWESSID;
++ iwe.u.data.flags = 1;
++ iwe.u.data.length = cie->ie_ssid[1];
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
++ &cie->ie_ssid[2]);
+
-+ /* Register with bus driver core */
-+ status = SDIO_RegisterFunction(&FunctionContext.function);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
++ if (cie->ie_capInfo & (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) {
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = SIOCGIWMODE;
++ iwe.u.mode = cie->ie_capInfo & IEEE80211_CAPINFO_ESS ?
++ IW_MODE_MASTER : IW_MODE_ADHOC;
++ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
++ IW_EV_UINT_LEN);
++ }
+
-+ return(0);
-+}
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = SIOCGIWFREQ;
++ iwe.u.freq.m = cie->ie_chan * 100000;
++ iwe.u.freq.e = 1;
++ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
++ IW_EV_FREQ_LEN);
+
-+A_STATUS
-+HIFReadWrite(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length,
-+ A_UINT32 request,
-+ void *context)
-+{
-+ A_UINT8 rw;
-+ A_UINT8 mode;
-+ A_UINT8 funcNo;
-+ A_UINT8 opcode;
-+ A_UINT16 count;
-+ SDREQUEST *sdrequest;
-+ SDIO_STATUS sdiostatus;
-+ BUS_REQUEST *busrequest;
-+ A_STATUS status = A_OK;
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVQUAL;
++ ar6000_set_quality(&iwe.u.qual, ni->ni_snr);
++ current_ev = iwe_stream_add_event(&info, current_ev, end_buf, &iwe,
++ IW_EV_QUAL_LEN);
+
-+ DBG_ASSERT(device != NULL);
-+ DBG_ASSERT(device->handle != NULL);
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = SIOCGIWENCODE;
++ if (cie->ie_capInfo & IEEE80211_CAPINFO_PRIVACY) {
++ iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
++ } else {
++ iwe.u.data.flags = IW_ENCODE_DISABLED;
++ }
++ iwe.u.data.length = 0;
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, "");
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVCUSTOM;
++ snprintf(buf, sizeof(buf), "bcn_int=%d", cie->ie_beaconInt);
++ iwe.u.data.length = strlen(buf);
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe, buf);
+
-+ do {
-+ busrequest = hifAllocateBusRequest();
-+ if (busrequest == NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF Unable to allocate bus request\n"));
-+ status = A_NO_RESOURCE;
-+ break;
-+ }
++ if (cie->ie_wpa != NULL) {
++ static const char wpa_leader[] = "wpa_ie=";
+
-+ sdrequest = busrequest->request;
-+ busrequest->context = context;
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVCUSTOM;
++ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wpa,
++ cie->ie_wpa[1]+2,
++ wpa_leader, sizeof(wpa_leader)-1);
+
-+ sdrequest->pDataBuffer = buffer;
-+ if (request & HIF_SYNCHRONOUS) {
-+ sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS;
-+ sdrequest->pCompleteContext = NULL;
-+ sdrequest->pCompletion = NULL;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Synchronous\n"));
-+ } else if (request & HIF_ASYNCHRONOUS) {
-+ sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS |
-+ SDREQ_FLAGS_TRANS_ASYNC;
-+ sdrequest->pCompleteContext = busrequest;
-+ sdrequest->pCompletion = hifRWCompletionHandler;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Asynchronous\n"));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Invalid execution mode: 0x%08x\n", request));
-+ status = A_EINVAL;
-+ break;
++ if (iwe.u.data.length != 0) {
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
++ buf);
+ }
++ }
+
-+ if (request & HIF_EXTENDED_IO) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Command type: CMD53\n"));
-+ sdrequest->Command = CMD53;
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Invalid command type: 0x%08x\n", request));
-+ status = A_EINVAL;
-+ break;
-+ }
++ if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
++ static const char rsn_leader[] = "rsn_ie=";
+
-+ if (request & HIF_BLOCK_BASIS) {
-+ mode = CMD53_BLOCK_BASIS;
-+ sdrequest->BlockLen = HIF_MBOX_BLOCK_SIZE;
-+ sdrequest->BlockCount = length / HIF_MBOX_BLOCK_SIZE;
-+ count = sdrequest->BlockCount;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Block mode (BlockLen: %d, BlockCount: %d)\n",
-+ sdrequest->BlockLen, sdrequest->BlockCount));
-+ } else if (request & HIF_BYTE_BASIS) {
-+ mode = CMD53_BYTE_BASIS;
-+ sdrequest->BlockLen = length;
-+ sdrequest->BlockCount = 1;
-+ count = sdrequest->BlockLen;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Byte mode (BlockLen: %d, BlockCount: %d)\n",
-+ sdrequest->BlockLen, sdrequest->BlockCount));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Invalid data mode: 0x%08x\n", request));
-+ status = A_EINVAL;
-+ break;
-+ }
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVCUSTOM;
++ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_rsn,
++ cie->ie_rsn[1]+2,
++ rsn_leader, sizeof(rsn_leader)-1);
+
-+#if 0
-+ /* useful for checking register accesses */
-+ if (length & 0x3) {
-+ A_PRINTF(KERN_ALERT"HIF (%s) is not a multiple of 4 bytes, addr:0x%X, len:%d\n",
-+ request & HIF_WRITE ? "write":"read", address, length);
++ if (iwe.u.data.length != 0) {
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
++ buf);
+ }
-+#endif
-+
-+ if ((address >= HIF_MBOX_START_ADDR(0)) &&
-+ (address <= HIF_MBOX_END_ADDR(3)))
-+ {
++ }
+
-+ DBG_ASSERT(length <= HIF_MBOX_WIDTH);
++ if (cie->ie_wmm != NULL) {
++ static const char wmm_leader[] = "wmm_ie=";
+
-+ /*
-+ * Mailbox write. Adjust the address so that the last byte
-+ * falls on the EOM address.
-+ */
-+ address += (HIF_MBOX_WIDTH - length);
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVCUSTOM;
++ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wmm,
++ cie->ie_wmm[1]+2,
++ wmm_leader, sizeof(wmm_leader)-1);
++ if (iwe.u.data.length != 0) {
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
++ buf);
+ }
++ }
+
++ if (cie->ie_ath != NULL) {
++ static const char ath_leader[] = "ath_ie=";
+
-+
-+ if (request & HIF_WRITE) {
-+ rw = CMD53_WRITE;
-+ sdrequest->Flags |= SDREQ_FLAGS_DATA_WRITE;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Write\n"));
-+ } else if (request & HIF_READ) {
-+ rw = CMD53_READ;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Read\n"));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Invalid direction: 0x%08x\n", request));
-+ status = A_EINVAL;
-+ break;
++ A_MEMZERO(&iwe, sizeof(iwe));
++ iwe.cmd = IWEVCUSTOM;
++ iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_ath,
++ cie->ie_ath[1]+2,
++ ath_leader, sizeof(ath_leader)-1);
++ if (iwe.u.data.length != 0) {
++ current_ev = iwe_stream_add_point(&info, current_ev, end_buf, &iwe,
++ buf);
+ }
++ }
+
-+ if (request & HIF_FIXED_ADDRESS) {
-+ opcode = CMD53_FIXED_ADDRESS;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Fixed\n"));
-+ } else if (request & HIF_INCREMENTAL_ADDRESS) {
-+ opcode = CMD53_INCR_ADDRESS;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Incremental\n"));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Invalid address mode: 0x%08x\n", request));
-+ status = A_EINVAL;
-+ break;
-+ }
++ param->current_ev = current_ev;
++}
+
-+ funcNo = SDDEVICE_GET_SDIO_FUNCNO(device->handle);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Function number: %d\n", funcNo));
-+ SDIO_SET_CMD53_ARG(sdrequest->Argument, rw, funcNo,
-+ mode, opcode, address, count);
++int
++ar6000_ioctl_giwscan(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ar_giwscan_param param;
++ int i;
+
-+ /* Send the command out */
-+ sdiostatus = SDDEVICE_CALL_REQUEST_FUNC(device->handle, sdrequest);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ if (!SDIO_SUCCESS(sdiostatus)) {
-+ status = A_ERROR;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ } while (FALSE);
++ param.current_ev = extra;
++ param.end_buf = extra + IW_SCAN_MAX_DATA;
++ param.firstPass = TRUE;
+
-+ if (A_FAILED(status) || (request & HIF_SYNCHRONOUS)) {
-+ if (busrequest != NULL) {
-+ hifFreeBusRequest(busrequest);
++ /*
++ * Do two passes to insure WPA scan candidates
++ * are sorted to the front. This is a hack to deal with
++ * the wireless extensions capping scan results at
++ * IW_SCAN_MAX_DATA bytes. In densely populated environments
++ * it's easy to overflow this buffer (especially with WPA/RSN
++ * information elements). Note this sorting hack does not
++ * guarantee we won't overflow anyway.
++ */
++ for (i = 0; i < 2; i++) {
++ /*
++ * Translate data to WE format.
++ */
++ wmi_iterate_nodes(ar->arWmi, ar6000_scan_node, ¶m);
++ param.firstPass = FALSE;
++ if (param.current_ev >= param.end_buf) {
++ data->length = param.current_ev - extra;
++ return -E2BIG;
+ }
+ }
+
-+ if (A_FAILED(status) && (request & HIF_ASYNCHRONOUS)) {
-+ /* call back async handler on failure */
-+ htcCallbacks.rwCompletionHandler(context, status);
-+ }
-+
-+ return status;
++ data->length = param.current_ev - extra;
++ return 0;
+}
+
-+A_STATUS
-+HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
-+ void *config, A_UINT32 configLen)
++extern int reconnect_flag;
++/* SIOCSIWESSID */
++static int
++ar6000_ioctl_siwessid(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *ssid)
+{
-+ A_UINT32 count;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_STATUS status;
++ A_UINT8 arNetworkType;
+
-+ switch(opcode) {
-+ case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
-+ ((A_UINT32 *)config)[0] = HIF_MBOX0_BLOCK_SIZE;
-+ ((A_UINT32 *)config)[1] = HIF_MBOX1_BLOCK_SIZE;
-+ ((A_UINT32 *)config)[2] = HIF_MBOX2_BLOCK_SIZE;
-+ ((A_UINT32 *)config)[3] = HIF_MBOX3_BLOCK_SIZE;
-+ break;
-+
-+ case HIF_DEVICE_GET_MBOX_ADDR:
-+ for (count = 0; count < 4; count ++) {
-+ ((A_UINT32 *)config)[count] = HIF_MBOX_START_ADDR(count);
-+ }
-+ break;
-+ case HIF_DEVICE_GET_IRQ_PROC_MODE:
-+ /* the SDIO stack allows the interrupts to be processed either way, ASYNC or SYNC */
-+ *((HIF_DEVICE_IRQ_PROCESSING_MODE *)config) = HIF_DEVICE_IRQ_ASYNC_SYNC;
-+ break;
-+ default:
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
-+ ("Unsupported configuration opcode: %d\n", opcode));
-+ return A_ERROR;
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
+ }
+
-+ return A_OK;
-+}
-+
-+void
-+HIFShutDownDevice(HIF_DEVICE *device)
-+{
-+ A_UINT8 data;
-+ A_UINT32 count;
-+ SDIO_STATUS status;
-+ SDCONFIG_BUS_MODE_DATA busSettings;
-+ SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
-+
-+ if (device != NULL) {
-+ DBG_ASSERT(device->handle != NULL);
-+
-+ /* Remove the allocated current if any */
-+ status = SDLIB_IssueConfig(device->handle,
-+ SDCONFIG_FUNC_FREE_SLOT_CURRENT, NULL, 0);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+ /* Disable the card */
-+ fData.EnableFlags = SDCONFIG_DISABLE_FUNC;
-+ fData.TimeOut = 1;
-+ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ENABLE_DISABLE,
-+ &fData, sizeof(fData));
-+ DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+ /* Perform a soft I/O reset */
-+ data = SDIO_IO_RESET;
-+ status = SDLIB_IssueCMD52(device->handle, 0, SDIO_IO_ABORT_REG,
-+ &data, 1, 1);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
++ /*
++ * iwconfig passes a string with length excluding any trailing NUL.
++ * FIXME: we should be able to set an ESSID of 32 bytes, yet things fall
++ * over badly if we do. So we limit the ESSID to 31 bytes.
++ */
++ if (data->flags && (!data->length || data->length >= sizeof(ar->arSsid))) {
+ /*
-+ * WAR - Codetelligence driver does not seem to shutdown correctly in 1
-+ * bit mode. By default it configures the HC in the 4 bit. Its later in
-+ * our driver that we switch to 1 bit mode. If we try to shutdown, the
-+ * driver hangs so we revert to 4 bit mode, to be transparent to the
-+ * underlying bus driver.
++ * ssid is invalid
+ */
-+ if (onebitmode) {
-+ ZERO_OBJECT(busSettings);
-+ busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(device->handle);
-+ SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
-+ SDCONFIG_BUS_WIDTH_4_BIT);
-+
-+ /* Issue config request to change the bus width to 4 bit */
-+ status = SDLIB_IssueConfig(device->handle, SDCONFIG_BUS_MODE_CTRL,
-+ &busSettings,
-+ sizeof(SDCONFIG_BUS_MODE_DATA));
-+ DBG_ASSERT(SDIO_SUCCESS(status));
-+ }
-+
-+ /* Free the bus requests */
-+ for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-+ SDDeviceFreeRequest(device->handle, busRequest[count].request);
-+ }
-+ /* Clean up the queue */
-+ s_busRequestFreeQueue = NULL;
-+ } else {
-+ /* since we are unloading the driver anyways, reset all cards in case the SDIO card
-+ * is externally powered and we are unloading the SDIO stack. This avoids the problem when
-+ * the SDIO stack is reloaded and attempts are made to re-enumerate a card that is already
-+ * enumerated */
-+ ResetAllCards();
-+ /* Unregister with bus driver core */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Unregistering with the bus driver\n"));
-+ status = SDIO_UnregisterFunction(&FunctionContext.function);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
-+ }
-+}
-+
-+void
-+hifRWCompletionHandler(SDREQUEST *request)
-+{
-+ A_STATUS status;
-+ void *context;
-+ BUS_REQUEST *busrequest;
-+
-+ if (SDIO_SUCCESS(request->Status)) {
-+ status = A_OK;
-+ } else {
-+ status = A_ERROR;
++ return -EINVAL;
+ }
-+
-+ DBG_ASSERT(status == A_OK);
-+ busrequest = (BUS_REQUEST *) request->pCompleteContext;
-+ context = (void *) busrequest->context;
-+ /* free the request before calling the callback, in case the
-+ * callback submits another request, this guarantees that
-+ * there is at least 1 free request available everytime the callback
-+ * is invoked */
-+ hifFreeBusRequest(busrequest);
-+ htcCallbacks.rwCompletionHandler(context, status);
-+}
-+
-+void
-+hifIRQHandler(void *context)
-+{
-+ A_STATUS status;
-+ HIF_DEVICE *device;
-+
-+ device = (HIF_DEVICE *)context;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
-+ status = htcCallbacks.dsrHandler(device->htc_handle);
-+ DBG_ASSERT(status == A_OK);
-+}
-+
-+BOOL
-+hifDeviceInserted(SDFUNCTION *function, SDDEVICE *handle)
-+{
-+ BOOL enabled;
-+ A_UINT8 data;
-+ A_UINT32 count;
-+ HIF_DEVICE *device;
-+ SDIO_STATUS status;
-+ A_UINT16 maxBlocks;
-+ A_UINT16 maxBlockSize;
-+ SDCONFIG_BUS_MODE_DATA busSettings;
-+ SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
-+ TARGET_FUNCTION_CONTEXT *functionContext;
-+ SDCONFIG_FUNC_SLOT_CURRENT_DATA slotCurrent;
-+ SD_BUSCLOCK_RATE currentBusClock;
-+
-+ DBG_ASSERT(function != NULL);
-+ DBG_ASSERT(handle != NULL);
-+
-+ device = addHifDevice(handle);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
-+ functionContext = (TARGET_FUNCTION_CONTEXT *)function->pContext;
-+
-+ /*
-+ * Issue commands to get the manufacturer ID and stuff and compare it
-+ * against the rev Id derived from the ID registered during the
-+ * initialization process. Report the device only in the case there
-+ * is a match. In the case od SDIO, the bus driver has already queried
-+ * these details so we just need to use their data structures to get the
-+ * relevant values. Infact, the driver has already matched it against
-+ * the Ids that we registered with it so we dont need to the step here.
++ /* Added for bug 25178, return an IOCTL error instead of target returning
++ Illegal parameter error when either the BSSID or channel is missing
++ and we cannot scan during connect.
+ */
-+
-+ /* Configure the SDIO Bus Width */
-+ if (onebitmode) {
-+ data = SDIO_BUS_WIDTH_1_BIT;
-+ status = SDLIB_IssueCMD52(handle, 0, SDIO_BUS_IF_REG, &data, 1, 1);
-+ if (!SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Unable to set the bus width to 1 bit\n"));
-+ return FALSE;
++ if (data->flags) {
++ if (ar->arSkipScan == TRUE &&
++ (ar->arChannelHint == 0 ||
++ (!ar->arReqBssid[0] && !ar->arReqBssid[1] && !ar->arReqBssid[2] &&
++ !ar->arReqBssid[3] && !ar->arReqBssid[4] && !ar->arReqBssid[5])))
++ {
++ return -EINVAL;
+ }
+ }
+
-+ /* Get current bus flags */
-+ ZERO_OBJECT(busSettings);
-+
-+ busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(handle);
-+ if (onebitmode) {
-+ SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
-+ SDCONFIG_BUS_WIDTH_1_BIT);
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
+ }
+
-+ /* get the current operating clock, the bus driver sets us up based
-+ * on what our CIS reports and what the host controller can handle
-+ * we can use this to determine whether we want to drop our clock rate
-+ * down */
-+ currentBusClock = SDDEVICE_GET_OPER_CLOCK(handle);
-+ busSettings.ClockRate = currentBusClock;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("HIF currently running at: %d \n",currentBusClock));
-+
-+ /* see if HIF wants to run at a lower clock speed, we may already be
-+ * at that lower clock speed */
-+ if (currentBusClock > (SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow)) {
-+ busSettings.ClockRate = SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
-+ ("HIF overriding clock to %d \n",busSettings.ClockRate));
++ if (ar->arTxPending[WMI_CONTROL_PRI]) {
++ /*
++ * sleep until the command queue drains
++ */
++ wait_event_interruptible_timeout(arEvent,
++ ar->arTxPending[WMI_CONTROL_PRI] == 0, wmitimeout * HZ);
++ if (signal_pending(current)) {
++ return -EINTR;
++ }
+ }
+
-+ /* Issue config request to override clock rate */
-+ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_CHANGE_BUS_MODE, &busSettings,
-+ sizeof(SDCONFIG_BUS_MODE_DATA));
-+ if (!SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Unable to configure the host clock\n"));
-+ return FALSE;
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Configured clock: %d, Maximum clock: %d\n",
-+ busSettings.ActualClockRate,
-+ SDDEVICE_GET_MAX_CLOCK(handle)));
++ if (!data->flags) {
++ arNetworkType = ar->arNetworkType;
++ ar6000_init_profile_info(ar);
++ ar->arNetworkType = arNetworkType;
+ }
+
+ /*
-+ * Check if the target supports block mode. This result of this check
-+ * can be used to implement the HIFReadWrite API.
++ * The original logic here prevented a disconnect if issuing an "essid off"
++ * if no ESSID was set, presumably to prevent sending multiple disconnects
++ * to the WMI.
++ *
++ * Unfortunately, this also meant that no disconnect was sent when we were
++ * already connected, but the profile has been changed since (which also
++ * clears the ESSID as a reminder that the WMI needs updating.)
++ *
++ * The "1 ||" makes sure we always disconnect or reconnect. The WMI doesn't
++ * seem to mind being sent multiple disconnects.
+ */
-+ if (SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle)) {
-+ /* Limit block size to operational block limit or card function
-+ capability */
-+ maxBlockSize = min(SDDEVICE_GET_OPER_BLOCK_LEN(handle),
-+ SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle));
-+
-+ /* check if the card support multi-block transfers */
-+ if (!(SDDEVICE_GET_SDIOCARD_CAPS(handle) & SDIO_CAPS_MULTI_BLOCK)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Byte basis only\n"));
-+
-+ /* Limit block size to max byte basis */
-+ maxBlockSize = min(maxBlockSize,
-+ (A_UINT16)SDIO_MAX_LENGTH_BYTE_BASIS);
-+ maxBlocks = 1;
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Multi-block capable\n"));
-+ maxBlocks = SDDEVICE_GET_OPER_BLOCKS(handle);
-+ status = SDLIB_SetFunctionBlockSize(handle, HIF_MBOX_BLOCK_SIZE);
-+ if (!SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Failed to set block size. Err:%d\n", status));
-+ return FALSE;
++ if (1 || (ar->arSsidLen) || (!data->flags))
++ {
++ if ((!data->flags) ||
++ (A_MEMCMP(ar->arSsid, ssid, ar->arSsidLen) != 0) ||
++ (ar->arSsidLen != (data->length)))
++ {
++ /*
++ * SSID set previously or essid off has been issued.
++ *
++ * Disconnect Command is issued in two cases after wmi is ready
++ * (1) ssid is different from the previous setting
++ * (2) essid off has been issued
++ *
++ */
++ if (ar->arWmiReady == TRUE) {
++ reconnect_flag = 0;
++ status = wmi_disconnect_cmd(ar->arWmi);
++ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
++ ar->arSsidLen = 0;
++ if (ar->arSkipScan == FALSE) {
++ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
++ }
++ if (!data->flags) {
++ up(&ar->arSem);
++ return 0;
++ }
++ } else {
++ up(&ar->arSem);
+ }
+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Bytes Per Block: %d bytes, Block Count:%d \n",
-+ maxBlockSize, maxBlocks));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Function does not support Block Mode!\n"));
-+ return FALSE;
-+ }
-+
-+ /* Allocate the slot current */
-+ status = SDLIB_GetDefaultOpCurrent(handle, &slotCurrent.SlotCurrent);
-+ if (SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Allocating Slot current: %d mA\n",
-+ slotCurrent.SlotCurrent));
-+ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ALLOC_SLOT_CURRENT,
-+ &slotCurrent, sizeof(slotCurrent));
-+ if (!SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Failed to allocate slot current %d\n", status));
-+ return FALSE;
++ else
++ {
++ /*
++ * SSID is same, so we assume profile hasn't changed.
++ * If the interface is up and wmi is ready, we issue
++ * a reconnect cmd. Issue a reconnect only we are already
++ * connected.
++ */
++ if((ar->arConnected == TRUE) && (ar->arWmiReady == TRUE))
++ {
++ reconnect_flag = TRUE;
++ status = wmi_reconnect_cmd(ar->arWmi,ar->arReqBssid,
++ ar->arChannelHint);
++ up(&ar->arSem);
++ if (status != A_OK) {
++ return -EIO;
++ }
++ return 0;
++ }
++ else{
++ /*
++ * Dont return if connect is pending.
++ */
++ if(!(ar->arConnectPending)) {
++ up(&ar->arSem);
++ return 0;
++ }
++ }
+ }
+ }
+
-+ /* Enable the dragon function */
-+ count = 0;
-+ enabled = FALSE;
-+ fData.TimeOut = 1;
-+ fData.EnableFlags = SDCONFIG_ENABLE_FUNC;
-+ while ((count++ < SDWLAN_ENABLE_DISABLE_TIMEOUT) && !enabled)
++ ar->arSsidLen = data->length;
++ A_MEMCPY(ar->arSsid, ssid, ar->arSsidLen);
++
++ /* The ssid length check prevents second "essid off" from the user,
++ to be treated as a connect cmd. The second "essid off" is ignored.
++ */
++ if((ar->arWmiReady == TRUE) && (ar->arSsidLen > 0) )
+ {
-+ /* Enable dragon */
-+ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ENABLE_DISABLE,
-+ &fData, sizeof(fData));
-+ if (!SDIO_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Attempting to enable the card again\n"));
-+ continue;
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
++ if (SHARED_AUTH == ar->arDot11AuthMode) {
++ ar6000_install_static_wep_keys(ar);
+ }
++ AR_DEBUG_PRINTF("Connect called with authmode %d dot11 auth %d"\
++ " PW crypto %d PW crypto Len %d GRP crypto %d"\
++ " GRP crypto Len %d\n",
++ ar->arAuthMode, ar->arDot11AuthMode,
++ ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
++ ar->arGroupCrypto, ar->arGroupCryptoLen);
++ reconnect_flag = 0;
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++ status = wmi_connect_cmd(ar->arWmi, ar->arNetworkType,
++ ar->arDot11AuthMode, ar->arAuthMode,
++ ar->arPairwiseCrypto, ar->arPairwiseCryptoLen,
++ ar->arGroupCrypto,ar->arGroupCryptoLen,
++ ar->arSsidLen, ar->arSsid,
++ ar->arReqBssid, ar->arChannelHint,
++ ar->arConnectCtrlFlags);
+
-+ /* Mark the status as enabled */
-+ enabled = TRUE;
-+ }
+
-+ /* Check if we were succesful in enabling the target */
-+ if (!enabled) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
-+ ("Failed to communicate with the target\n"));
-+ return FALSE;
-+ }
++ up(&ar->arSem);
+
-+ /* Allocate the bus requests to be used later */
-+ A_MEMZERO(busRequest, sizeof(busRequest));
-+ for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
-+ if ((busRequest[count].request = SDDeviceAllocRequest(handle)) == NULL){
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Unable to allocate memory\n"));
-+ /* TODO: Free the memory that has already been allocated */
-+ return FALSE;
++ if (status != A_OK) {
++ return -EIO;
+ }
-+ hifFreeBusRequest(&busRequest[count]);
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("0x%08x = busRequest[%d].request = 0x%08x\n",
-+ (unsigned int) &busRequest[count], count,
-+ (unsigned int) busRequest[count].request));
++ ar->arConnectPending = TRUE;
++ }else{
++ up(&ar->arSem);
+ }
++ return 0;
++}
+
-+ /* Schedule a worker to handle device inserted, this is a temporary workaround
-+ * to fix a deadlock if the device fails to intialize in the insertion handler
-+ * The failure causes the instance to shutdown the HIF layer and unregister the
-+ * function driver within the busdriver probe context which can deadlock
-+ *
-+ * NOTE: we cannot use the default work queue because that would block
-+ * SD bus request processing for all synchronous I/O. We must use a kernel
-+ * thread that is creating using the helper library.
-+ * */
++/* SIOCGIWESSID */
++static int
++ar6000_ioctl_giwessid(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *essid)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ if (SDIO_SUCCESS(SDLIB_OSCreateHelper(&device->insert_helper,
-+ insert_helper_func,
-+ device))) {
-+ device->helper_started = TRUE;
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
+ }
+
-+ return TRUE;
++ data->flags = 1;
++ data->length = ar->arSsidLen;
++ A_MEMCPY(essid, ar->arSsid, ar->arSsidLen);
++
++ return 0;
+}
+
-+static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper)
-+{
+
-+ /*
-+ * Adding a wait of around a second before we issue the very first
-+ * command to dragon. During the process of loading/unloading the
-+ * driver repeatedly it was observed that we get a data timeout
-+ * while accessing function 1 registers in the chip. The theory at
-+ * this point is that some initialization delay in dragon is
-+ * causing the SDIO state in dragon core to be not ready even after
-+ * the ready bit indicates that function 1 is ready. Accomodating
-+ * for this behavior by adding some delay in the driver before it
-+ * issues the first command after switching on dragon. Need to
-+ * investigate this a bit more - TODO
-+ */
++void ar6000_install_static_wep_keys(AR_SOFTC_T *ar)
++{
++ A_UINT8 index;
++ A_UINT8 keyUsage;
+
-+ A_MDELAY(1000);
-+ /* Inform HTC */
-+ if ((htcCallbacks.deviceInsertedHandler(SD_GET_OS_HELPER_CONTEXT(pHelper))) != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device rejected\n"));
++ for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
++ if (ar->arWepKeyList[index].arKeyLen) {
++ keyUsage = GROUP_USAGE;
++ if (index == ar->arDefTxKeyIndex) {
++ keyUsage |= TX_USAGE;
++ }
++ wmi_addKey_cmd(ar->arWmi,
++ index,
++ WEP_CRYPT,
++ keyUsage,
++ ar->arWepKeyList[index].arKeyLen,
++ NULL,
++ ar->arWepKeyList[index].arKey, KEY_OP_INIT_VAL,
++ NO_SYNC_WMIFLAG);
++ }
+ }
++}
+
++int
++ar6000_ioctl_delkey(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
++{
+ return 0;
+}
+
-+void
-+HIFAckInterrupt(HIF_DEVICE *device)
++int
++ar6000_ioctl_setmlme(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
+{
-+ SDIO_STATUS status;
-+ DBG_ASSERT(device != NULL);
-+ DBG_ASSERT(device->handle != NULL);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ieee80211req_mlme *mlme = (struct ieee80211req_mlme *)extra;
+
-+ /* Acknowledge our function IRQ */
-+ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ACK_IRQ,
-+ NULL, 0);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
++ if ((ar->arWmiReady == FALSE) || (ar->arConnected != TRUE))
++ return -EIO;
++
++ switch (mlme->im_op) {
++ case IEEE80211_MLME_DISASSOC:
++ case IEEE80211_MLME_DEAUTH:
++ /* Not Supported */
++ break;
++ default:
++ break;
++ }
++ return 0;
+}
+
-+void
-+HIFUnMaskInterrupt(HIF_DEVICE *device)
-+{
-+ SDIO_STATUS status;
+
-+ DBG_ASSERT(device != NULL);
-+ DBG_ASSERT(device->handle != NULL);
-+
-+ /* Register the IRQ Handler */
-+ SDDEVICE_SET_IRQ_HANDLER(device->handle, hifIRQHandler, device);
-+
-+ /* Unmask our function IRQ */
-+ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_UNMASK_IRQ,
-+ NULL, 0);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
++int
++ar6000_ioctl_setwmmparams(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
++{
++ return -EIO; /* for now */
+}
+
-+void HIFMaskInterrupt(HIF_DEVICE *device)
++int
++ar6000_ioctl_getwmmparams(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
+{
-+ SDIO_STATUS status;
-+ DBG_ASSERT(device != NULL);
-+ DBG_ASSERT(device->handle != NULL);
-+
-+ /* Mask our function IRQ */
-+ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_MASK_IRQ,
-+ NULL, 0);
-+ DBG_ASSERT(SDIO_SUCCESS(status));
-+
-+ /* Unregister the IRQ Handler */
-+ SDDEVICE_SET_IRQ_HANDLER(device->handle, NULL, NULL);
++ return -EIO; /* for now */
+}
+
-+static BUS_REQUEST *hifAllocateBusRequest(void)
++int ar6000_ioctl_setoptie(struct net_device *dev, struct iw_request_info *info,
++ struct iw_point *data, char *extra)
+{
-+ BUS_REQUEST *busrequest;
-+
-+ /* Acquire lock */
-+ CriticalSectionAcquire(&lock);
-+
-+ /* Remove first in list */
-+ if((busrequest = s_busRequestFreeQueue) != NULL)
-+ {
-+ s_busRequestFreeQueue = busrequest->next;
-+ }
-+
-+ /* Release lock */
-+ CriticalSectionRelease(&lock);
-+
-+ return busrequest;
++ /* The target generates the WPA/RSN IE */
++ return 0;
+}
+
-+static void
-+hifFreeBusRequest(BUS_REQUEST *busrequest)
++int
++ar6000_ioctl_setauthalg(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
+{
-+ DBG_ASSERT(busrequest != NULL);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ieee80211req_authalg *req = (struct ieee80211req_authalg *)extra;
++ int ret = 0;
+
-+ /* Acquire lock */
-+ CriticalSectionAcquire(&lock);
+
-+ /* Insert first in list */
-+ busrequest->next = s_busRequestFreeQueue;
-+ s_busRequestFreeQueue = busrequest;
++ AR6000_SPIN_LOCK(&ar->arLock, 0);
+
-+ /* Release lock */
-+ CriticalSectionRelease(&lock);
-+}
++ if (req->auth_alg == AUTH_ALG_OPEN_SYSTEM) {
++ ar->arDot11AuthMode = OPEN_AUTH;
++ } else if (req->auth_alg == AUTH_ALG_LEAP) {
++ ar->arDot11AuthMode = LEAP_AUTH;
++ ar->arPairwiseCrypto = WEP_CRYPT;
++ ar->arGroupCrypto = WEP_CRYPT;
++ } else {
++ ret = -EIO;
++ }
+
-+void
-+hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *handle)
++ AR6000_SPIN_UNLOCK(&ar->arLock, 0);
++
++ return ret;
++}
++static int
++ar6000_ioctl_addpmkid(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
+{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ieee80211req_addpmkid *req = (struct ieee80211req_addpmkid *)extra;
+ A_STATUS status;
-+ HIF_DEVICE *device;
-+ DBG_ASSERT(function != NULL);
-+ DBG_ASSERT(handle != NULL);
+
-+ device = getHifDevice(handle);
-+ status = htcCallbacks.deviceRemovedHandler(device->htc_handle, A_OK);
-+
-+ /* cleanup the helper thread */
-+ if (device->helper_started) {
-+ SDLIB_OSDeleteHelper(&device->insert_helper);
-+ device->helper_started = FALSE;
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
+ }
+
-+ delHifDevice(handle);
-+ DBG_ASSERT(status == A_OK);
-+}
++ AR_DEBUG_PRINTF("Add pmkid for %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x en=%d\n",
++ req->pi_bssid[0], req->pi_bssid[1], req->pi_bssid[2],
++ req->pi_bssid[3], req->pi_bssid[4], req->pi_bssid[5],
++ req->pi_enable);
+
-+HIF_DEVICE *
-+addHifDevice(SDDEVICE *handle)
-+{
-+ DBG_ASSERT(handle != NULL);
-+ hifDevice[0].handle = handle;
-+ return &hifDevice[0];
-+}
++ status = wmi_setPmkid_cmd(ar->arWmi, req->pi_bssid, req->pi_pmkid,
++ req->pi_enable);
+
-+HIF_DEVICE *
-+getHifDevice(SDDEVICE *handle)
-+{
-+ DBG_ASSERT(handle != NULL);
-+ return &hifDevice[0];
-+}
++ if (status != A_OK) {
++ return -EIO;
++ }
+
-+void
-+delHifDevice(SDDEVICE *handle)
-+{
-+ DBG_ASSERT(handle != NULL);
-+ hifDevice[0].handle = NULL;
++ return 0;
+}
+
-+struct device*
-+HIFGetOSDevice(HIF_DEVICE *device)
++/*
++ * SIOCSIWRATE
++ */
++int
++ar6000_ioctl_siwrate(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
+{
-+ return &device->handle->Device->dev;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_UINT32 kbps;
++
++ if (rrq->fixed) {
++ kbps = rrq->value / 1000; /* rrq->value is in bps */
++ } else {
++ kbps = -1; /* -1 indicates auto rate */
++ }
++ if(kbps != -1 && wmi_validate_bitrate(ar->arWmi, kbps) == A_EINVAL)
++ {
++ AR_DEBUG_PRINTF("BitRate is not Valid %d\n", kbps);
++ return -EINVAL;
++ }
++ ar->arBitRate = kbps;
++ if(ar->arWmiReady == TRUE)
++ {
++ if (wmi_set_bitrate_cmd(ar->arWmi, kbps) != A_OK) {
++ return -EINVAL;
++ }
++ }
++ return 0;
+}
+
-+static void ResetAllCards(void)
++/*
++ * SIOCGIWRATE
++ */
++int
++ar6000_ioctl_giwrate(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
+{
-+ UINT8 data;
-+ SDIO_STATUS status;
-+ int i;
-+
-+ data = SDIO_IO_RESET;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int ret = 0;
+
-+ /* set the I/O CARD reset bit:
-+ * NOTE: we are exploiting a "feature" of the SDIO core that resets the core when you
-+ * set the RES bit in the SDIO_IO_ABORT register. This bit however "normally" resets the
-+ * I/O functions leaving the SDIO core in the same state (as per SDIO spec).
-+ * In this design, this reset can be used to reset the SDIO core itself */
-+ for (i = 0; i < HIF_MAX_DEVICES; i++) {
-+ if (hifDevice[i].handle != NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
-+ ("Issuing I/O Card reset for instance: %d \n",i));
-+ /* set the I/O Card reset bit */
-+ status = SDLIB_IssueCMD52(hifDevice[i].handle,
-+ 0, /* function 0 space */
-+ SDIO_IO_ABORT_REG,
-+ &data,
-+ 1, /* 1 byte */
-+ TRUE); /* write */
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ if(ar->arWmiReady == TRUE)
++ {
++ ar->arBitRate = 0xFFFF;
++ if (wmi_get_bitrate_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
++ wait_event_interruptible_timeout(arEvent, ar->arBitRate != 0xFFFF, wmitimeout * HZ);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
++ }
++ /* If the interface is down or wmi is not ready or the target is not
++ connected - return the value stored in the device structure */
++ if (!ret) {
++ if (ar->arBitRate == -1) {
++ rrq->fixed = TRUE;
++ rrq->value = 0;
++ } else {
++ rrq->value = ar->arBitRate * 1000;
+ }
+ }
+
++ up(&ar->arSem);
++
++ return ret;
+}
+
-+void HIFSetHandle(void *hif_handle, void *handle)
++/*
++ * SIOCSIWTXPOW
++ */
++static int
++ar6000_ioctl_siwtxpow(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
+{
-+ HIF_DEVICE *device = (HIF_DEVICE *) hif_handle;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_UINT8 dbM;
+
-+ device->htc_handle = handle;
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ return;
++ if (ar->arRadioSwitch == WLAN_ENABLED
++ && rrq->disabled) {
++ if (wmi_switch_radio(ar->arWmi, WLAN_DISABLED) < 0)
++ return -EIO;
++ ar->arRadioSwitch = WLAN_DISABLED;
++ } else if (ar->arRadioSwitch == WLAN_DISABLED
++ && !rrq->disabled) {
++ if (wmi_switch_radio(ar->arWmi, WLAN_ENABLED) < 0)
++ return -EIO;
++ ar->arRadioSwitch = WLAN_ENABLED;
++ }
++
++ if (rrq->fixed) {
++ if (rrq->flags != IW_TXPOW_DBM) {
++ return -EOPNOTSUPP;
++ }
++ ar->arTxPwr= dbM = rrq->value;
++ ar->arTxPwrSet = TRUE;
++ } else {
++ ar->arTxPwr = dbM = 0;
++ ar->arTxPwrSet = FALSE;
++ }
++ if(ar->arWmiReady == TRUE)
++ {
++ AR_DEBUG_PRINTF("Set tx pwr cmd %d dbM\n", dbM);
++ wmi_set_txPwr_cmd(ar->arWmi, dbM);
++ }
++ return 0;
+}
-diff --git a/drivers/ar6000/hif/hif2.c b/drivers/ar6000/hif/hif2.c
-new file mode 100644
-index 0000000..386d96e
---- /dev/null
-+++ b/drivers/ar6000/hif/hif2.c
-@@ -0,0 +1,768 @@
++
+/*
-+ * hif2.c - HIF layer re-implementation for the Linux SDIO stack
-+ *
-+ * Copyright (C) 2008, 2009 by OpenMoko, Inc.
-+ * Written by Werner Almesberger <werner@openmoko.org>
-+ * All Rights Reserved
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Based on:
-+ *
-+ * @abstract: HIF layer reference implementation for Atheros SDIO stack
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
++ * SIOCGIWTXPOW
+ */
++int
++ar6000_ioctl_giwtxpow(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int ret = 0;
+
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+#include <linux/kernel.h>
-+#include <linux/kthread.h>
-+#include <linux/list.h>
-+#include <linux/wait.h>
-+#include <linux/spinlock.h>
-+#include <linux/mutex.h>
-+#include <linux/sched.h>
-+#include <linux/mmc/sdio_func.h>
-+#include <linux/mmc/sdio.h>
-+#include <linux/mmc/sdio_ids.h>
-+
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "hif.h"
-+
-+
-+/* @@@ Hack - this wants cleaning up */
++ if (ar->arRadioSwitch == WLAN_DISABLED) {
++ rrq->disabled = 1;
++ return 0;
++ }
+
-+#ifdef CONFIG_MACH_NEO1973_GTA02
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ if((ar->arWmiReady == TRUE) && (ar->arConnected == TRUE))
++ {
++ ar->arTxPwr = 0;
+
-+#include <mach/gta02-pm-wlan.h>
++ if (wmi_get_txPwr_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
+
-+#else /* CONFIG_MACH_NEO1973_GTA02 */
++ wait_event_interruptible_timeout(arEvent, ar->arTxPwr != 0, wmitimeout * HZ);
+
-+#define gta02_wlan_query_rfkill_lock() 1
-+#define gta02_wlan_set_rfkill_cb(cb, hif) ((void) cb)
-+#define gta02_wlan_query_rfkill_unlock()
-+#define gta02_wlan_clear_rfkill_cb()
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ }
++ }
++ /* If the interace is down or wmi is not ready or target is not connected
++ then return value stored in the device structure */
+
-+#endif /* !CONFIG_MACH_NEO1973_GTA02 */
++ if (!ret) {
++ if (ar->arTxPwrSet == TRUE) {
++ rrq->fixed = TRUE;
++ }
++ rrq->value = ar->arTxPwr;
++ rrq->flags = IW_TXPOW_DBM;
++ }
+
++ up(&ar->arSem);
+
-+/*
-+ * KNOWN BUGS:
-+ *
-+ * - HIF_DEVICE_IRQ_ASYNC_SYNC doesn't work yet (gets MMC errors)
-+ * - latency can reach hundreds of ms, probably because of scheduling delays
-+ * - packets go through about three queues before finally hitting the network
-+ */
++ return ret;
++}
+
+/*
-+ * Differences from Atheros' HIFs:
-+ *
-+ * - synchronous and asynchronous requests may get reordered with respect to
-+ * each other, e.g., if HIFReadWrite returns for an asynchronous request and
-+ * then HIFReadWrite is called for a synchronous request, the synchronous
-+ * request may be executed before the asynchronous request.
-+ *
-+ * - request queue locking seems unnecessarily complex in the Atheros HIFs.
-+ *
-+ * - Atheros mask interrupts by calling sdio_claim_irq/sdio_release_irq, which
-+ * can cause quite a bit of overhead. This HIF has its own light-weight
-+ * interrupt masking.
-+ *
-+ * - Atheros call deviceInsertedHandler from a thread spawned off the probe or
-+ * device insertion function. The original explanation for the Atheros SDIO
-+ * stack said that this is done because a delay is needed to let the chip
-+ * complete initialization. There is indeed a one second delay in the thread.
-+ *
-+ * The Atheros Linux SDIO HIF removes the delay and only retains the thread.
-+ * Experimentally removing the thread didn't show any conflicts, so let's get
-+ * rid of it for good.
-+ *
-+ * - The Atheros SDIO stack with Samuel's driver sets SDIO_CCCR_POWER in
-+ * SDIO_POWER_EMPC. Atheros' Linux SDIO code apparently doesn't. We don't
-+ * either, and this seems to work fine.
-+ * @@@ Need to check this with Atheros.
++ * SIOCSIWRETRY
++ * since iwconfig only provides us with one max retry value, we use it
++ * to apply to data frames of the BE traffic class.
+ */
++static int
++ar6000_ioctl_siwretry(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+#define MBOXES 4
-+
-+#define HIF_MBOX_BLOCK_SIZE 128
-+#define HIF_MBOX_BASE_ADDR 0x800
-+#define HIF_MBOX_WIDTH 0x800
-+#define HIF_MBOX_START_ADDR(mbox) \
-+ (HIF_MBOX_BASE_ADDR+(mbox)*HIF_MBOX_WIDTH)
-+
-+
-+struct hif_device {
-+ void *htc_handle;
-+ struct sdio_func *func;
++ if (rrq->disabled) {
++ return -EOPNOTSUPP;
++ }
+
-+ /*
-+ * @@@ our sweet little bit of bogosity - the mechanism that lets us
-+ * use the SDIO stack from softirqs. This really wants to use skbs.
-+ */
-+ struct list_head queue;
-+ spinlock_t queue_lock;
-+ struct task_struct *io_task;
-+ wait_queue_head_t wait;
++ if ((rrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT) {
++ return -EOPNOTSUPP;
++ }
+
-+ /*
-+ * activate_lock protects "active" and the activation/deactivation
-+ * process itself.
-+ *
-+ * Relation to other locks: The SDIO function can be claimed while
-+ * activate_lock is being held, but trying to acquire activate_lock
-+ * while having ownership of the SDIO function could cause a deadlock.
-+ */
-+ int active;
-+ struct mutex activate_lock;
-+};
++ if ( !(rrq->value >= WMI_MIN_RETRIES) || !(rrq->value <= WMI_MAX_RETRIES)) {
++ return - EINVAL;
++ }
++ if(ar->arWmiReady == TRUE)
++ {
++ if (wmi_set_retry_limits_cmd(ar->arWmi, DATA_FRAMETYPE, WMM_AC_BE,
++ rrq->value, 0) != A_OK){
++ return -EINVAL;
++ }
++ }
++ ar->arMaxRetries = rrq->value;
++ return 0;
++}
+
-+struct hif_request {
-+ struct list_head list;
-+ struct sdio_func *func;
-+ int (*read)(struct sdio_func *func,
-+ void *dst, unsigned int addr, int count);
-+ int (*write)(struct sdio_func *func,
-+ unsigned int addr, void *src, int count);
-+ void *buf;
-+ unsigned long addr;
-+ int len;
-+ A_STATUS (*completion)(void *context, A_STATUS status);
-+ void *context;
-+};
++/*
++ * SIOCGIWRETRY
++ */
++static int
++ar6000_ioctl_giwretry(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *rrq, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+static HTC_CALLBACKS htcCallbacks;
++ rrq->disabled = 0;
++ switch (rrq->flags & IW_RETRY_TYPE) {
++ case IW_RETRY_LIFETIME:
++ return -EOPNOTSUPP;
++ break;
++ case IW_RETRY_LIMIT:
++ rrq->flags = IW_RETRY_LIMIT;
++ switch (rrq->flags & IW_RETRY_MODIFIER) {
++ case IW_RETRY_MIN:
++ rrq->flags |= IW_RETRY_MIN;
++ rrq->value = WMI_MIN_RETRIES;
++ break;
++ case IW_RETRY_MAX:
++ rrq->flags |= IW_RETRY_MAX;
++ rrq->value = ar->arMaxRetries;
++ break;
++ }
++ break;
++ }
++ return 0;
++}
+
+/*
-+ * shutdown_lock prevents recursion through HIFShutDownDevice
++ * SIOCSIWENCODE
+ */
-+static DEFINE_MUTEX(shutdown_lock);
-+
++static int
++ar6000_ioctl_siwencode(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *erq, char *keybuf)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int index;
++ A_INT32 auth = ar->arDot11AuthMode;
+
-+/* ----- Request processing ------------------------------------------------ */
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
++ index = erq->flags & IW_ENCODE_INDEX;
+
-+static A_STATUS process_request(struct hif_request *req)
-+{
-+ int ret;
-+ A_STATUS status;
++ if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
++ ((index - 1) > WMI_MAX_KEY_INDEX)))
++ {
++ return -EIO;
++ }
+
-+ dev_dbg(&req->func->dev, "process_request(req %p)\n", req);
-+ sdio_claim_host(req->func);
-+ if (req->read) {
-+ ret = req->read(req->func, req->buf, req->addr, req->len);
-+ } else {
-+ ret = req->write(req->func, req->addr, req->buf, req->len);
-+ }
-+ sdio_release_host(req->func);
-+ status = ret ? A_ERROR : A_OK;
-+ if (req->completion)
-+ req->completion(req->context, status);
-+ kfree(req);
-+ return status;
-+}
++ if (erq->flags & IW_ENCODE_DISABLED) {
++ /*
++ * Encryption disabled
++ */
++ if (index) {
++ /*
++ * If key index was specified then clear the specified key
++ */
++ index--;
++ A_MEMZERO(ar->arWepKeyList[index].arKey,
++ sizeof(ar->arWepKeyList[index].arKey));
++ ar->arWepKeyList[index].arKeyLen = 0;
++ }
++ ar->arDot11AuthMode = OPEN_AUTH;
++ ar->arPairwiseCrypto = NONE_CRYPT;
++ ar->arGroupCrypto = NONE_CRYPT;
++ ar->arAuthMode = NONE_AUTH;
++ } else {
++ /*
++ * Enabling WEP encryption
++ */
++ if (index) {
++ index--; /* keyindex is off base 1 in iwconfig */
++ }
+
++ if (erq->flags & IW_ENCODE_OPEN) {
++ auth = OPEN_AUTH;
++ } else if (erq->flags & IW_ENCODE_RESTRICTED) {
++ auth = SHARED_AUTH;
++ }
+
-+static void enqueue_request(struct hif_device *hif, struct hif_request *req)
-+{
-+ unsigned long flags;
++ if (erq->length) {
++ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(erq->length)) {
++ return -EIO;
++ }
+
-+ dev_dbg(&req->func->dev, "enqueue_request(req %p)\n", req);
-+ spin_lock_irqsave(&hif->queue_lock, flags);
-+ list_add_tail(&req->list, &hif->queue);
-+ spin_unlock_irqrestore(&hif->queue_lock, flags);
-+ wake_up(&hif->wait);
-+}
++ A_MEMZERO(ar->arWepKeyList[index].arKey,
++ sizeof(ar->arWepKeyList[index].arKey));
++ A_MEMCPY(ar->arWepKeyList[index].arKey, keybuf, erq->length);
++ ar->arWepKeyList[index].arKeyLen = erq->length;
++ } else {
++ if (ar->arWepKeyList[index].arKeyLen == 0) {
++ return -EIO;
++ }
++ ar->arDefTxKeyIndex = index;
++ }
+
++ ar->arPairwiseCrypto = WEP_CRYPT;
++ ar->arGroupCrypto = WEP_CRYPT;
++ ar->arDot11AuthMode = auth;
++ ar->arAuthMode = NONE_AUTH;
++ }
+
-+static struct hif_request *dequeue_request(struct hif_device *hif)
-+{
-+ struct hif_request *req;
-+ unsigned long flags;
++ /*
++ * profile has changed. Erase ssid to signal change
++ */
++ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
++ ar->arSsidLen = 0;
+
-+ spin_lock_irqsave(&hif->queue_lock, flags);
-+ if (list_empty(&hif->queue))
-+ req = NULL;
-+ else {
-+ req = list_first_entry(&hif->queue,
-+ struct hif_request, list);
-+ list_del(&req->list);
-+ }
-+ spin_unlock_irqrestore(&hif->queue_lock, flags);
-+ return req;
++ return 0;
+}
+
-+
-+static void wait_queue_empty(struct hif_device *hif)
++static int
++ar6000_ioctl_giwencode(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *erq, char *key)
+{
-+ unsigned long flags;
-+ int empty;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ A_UINT8 keyIndex;
++ struct ar_wep_key *wk;
+
-+ while (1) {
-+ spin_lock_irqsave(&hif->queue_lock, flags);
-+ empty = list_empty(&hif->queue);
-+ spin_unlock_irqrestore(&hif->queue_lock, flags);
-+ if (empty)
-+ break;
-+ else
-+ yield();
-+ }
-+}
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
++
++ if (ar->arPairwiseCrypto == NONE_CRYPT) {
++ erq->length = 0;
++ erq->flags = IW_ENCODE_DISABLED;
++ } else {
++ /* get the keyIndex */
++ keyIndex = erq->flags & IW_ENCODE_INDEX;
++ if (0 == keyIndex) {
++ keyIndex = ar->arDefTxKeyIndex;
++ } else if ((keyIndex - 1 < WMI_MIN_KEY_INDEX) ||
++ (keyIndex - 1 > WMI_MAX_KEY_INDEX))
++ {
++ keyIndex = WMI_MIN_KEY_INDEX;
++ } else {
++ keyIndex--;
++ }
++ erq->flags = keyIndex + 1;
++ erq->flags |= IW_ENCODE_ENABLED;
++ wk = &ar->arWepKeyList[keyIndex];
++ if (erq->length > wk->arKeyLen) {
++ erq->length = wk->arKeyLen;
++ }
++ if (wk->arKeyLen) {
++ A_MEMCPY(key, wk->arKey, erq->length);
++ }
++ if (ar->arDot11AuthMode == OPEN_AUTH) {
++ erq->flags |= IW_ENCODE_OPEN;
++ } else if (ar->arDot11AuthMode == SHARED_AUTH) {
++ erq->flags |= IW_ENCODE_RESTRICTED;
++ }
++ }
+
++ return 0;
++}
+
-+static int io(void *data)
++static int ar6000_ioctl_siwpower(struct net_device *dev,
++ struct iw_request_info *info,
++ union iwreq_data *wrqu, char *extra)
+{
-+ struct hif_device *hif = data;
-+ struct sched_param param = { .sched_priority = 2 };
-+ /* one priority level slower than ksdioirqd (which is at 1) */
-+ DEFINE_WAIT(wait);
-+ struct hif_request *req;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ WMI_POWER_MODE power_mode;
+
-+ sched_setscheduler(current, SCHED_FIFO, ¶m);
++ if (wrqu->power.disabled)
++ power_mode = MAX_PERF_POWER;
++ else
++ power_mode = REC_POWER;
+
-+ while (1) {
-+ while (1) {
-+ /*
-+ * Since we never use signals here, one might think
-+ * that this ought to be TASK_UNINTERRUPTIBLE. However,
-+ * such a task would increase the load average and,
-+ * worse, it would trigger the softlockup check.
-+ */
-+ prepare_to_wait(&hif->wait, &wait, TASK_INTERRUPTIBLE);
-+ if (kthread_should_stop()) {
-+ finish_wait(&hif->wait, &wait);
-+ return 0;
-+ }
-+ req = dequeue_request(hif);
-+ if (req)
-+ break;
-+ schedule();
-+ }
-+ finish_wait(&hif->wait, &wait);
++ if (wmi_powermode_cmd(ar->arWmi, power_mode) < 0)
++ return -EIO;
+
-+ (void) process_request(req);
-+ }
+ return 0;
+}
+
-+
-+A_STATUS HIFReadWrite(HIF_DEVICE *hif, A_UINT32 address, A_UCHAR *buffer,
-+ A_UINT32 length, A_UINT32 request, void *context)
++static int ar6000_ioctl_giwpower(struct net_device *dev,
++ struct iw_request_info *info,
++ union iwreq_data *wrqu, char *extra)
+{
-+ struct device *dev = HIFGetOSDevice(hif);
-+ struct hif_request *req;
-+
-+ dev_dbg(dev, "HIFReadWrite(device %p, address 0x%x, buffer %p, "
-+ "length %d, request 0x%x, context %p)\n",
-+ hif, address, buffer, length, request, context);
-+
-+ BUG_ON(!(request & (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)));
-+ BUG_ON(!(request & (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)));
-+ BUG_ON(!(request & (HIF_READ | HIF_WRITE)));
-+ BUG_ON(!(request & HIF_EXTENDED_IO));
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ if (address >= HIF_MBOX_START_ADDR(0) &&
-+ address < HIF_MBOX_START_ADDR(MBOXES+1)) {
-+ BUG_ON(length > HIF_MBOX_WIDTH);
-+ /* Adjust the address so that the last byte falls on the EOM
-+ address. */
-+ address += HIF_MBOX_WIDTH-length;
-+ }
++ /*
++ * FIXME:
++ * https://docs.openmoko.org/trac/ticket/2267
++ * When starting wpa_supplicant the kernel oopses.
++ * The following condition avoids the oops.
++ * Remove this comment to bless this solution.
++ */
++ if (ar->arWlanState == WLAN_DISABLED || ar->arWmiReady == FALSE)
++ return -EIO;
+
-+ req = kzalloc(sizeof(*req), GFP_ATOMIC);
-+ if (!req) {
-+ if (request & HIF_ASYNCHRONOUS)
-+ htcCallbacks.rwCompletionHandler(context, A_ERROR);
-+ return A_ERROR;
-+ }
++ return wmi_get_power_mode_cmd(ar->arWmi);
++}
+
-+ req->func = hif->func;
-+ req->addr = address;
-+ req->buf = buffer;
-+ req->len = length;
++static int ar6000_ioctl_siwgenie(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *dwrq,
++ char *extra)
++{
++ /* The target does that for us */
++ return 0;
++}
+
-+ if (request & HIF_READ) {
-+ if (request & HIF_FIXED_ADDRESS)
-+ req->read = sdio_readsb;
-+ else
-+ req->read = sdio_memcpy_fromio;
-+ } else {
-+ if (request & HIF_FIXED_ADDRESS)
-+ req->write = sdio_writesb;
-+ else
-+ req->write = sdio_memcpy_toio;
-+ }
++static int ar6000_ioctl_giwgenie(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *dwrq,
++ char *extra)
++{
++ return 0;
++}
+
-+ if (!(request & HIF_ASYNCHRONOUS))
-+ return process_request(req);
++static int ar6000_ioctl_siwauth(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *param,
++ char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int reset = 0;
+
-+ req->completion = htcCallbacks.rwCompletionHandler;
-+ req->context = context;
-+ enqueue_request(hif, req);
++ switch (param->flags & IW_AUTH_INDEX) {
++ case IW_AUTH_WPA_VERSION:
++ if (param->value & IW_AUTH_WPA_VERSION_DISABLED) {
++ ar->arAuthMode = NONE_AUTH;
++ }
++ if (param->value & IW_AUTH_WPA_VERSION_WPA) {
++ ar->arAuthMode = WPA_AUTH;
++ }
++ if (param->value & IW_AUTH_WPA_VERSION_WPA2) {
++ ar->arAuthMode = WPA2_AUTH;
++ }
+
-+ return A_OK;
-+}
++ reset = 1;
++ break;
++ case IW_AUTH_CIPHER_PAIRWISE:
++ if (param->value & IW_AUTH_CIPHER_NONE) {
++ ar->arPairwiseCrypto = NONE_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_WEP40) {
++ ar->arPairwiseCrypto = WEP_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_TKIP) {
++ ar->arPairwiseCrypto = TKIP_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_CCMP) {
++ ar->arPairwiseCrypto = AES_CRYPT;
++ }
+
++ reset = 1;
++ break;
++ case IW_AUTH_CIPHER_GROUP:
++ if (param->value & IW_AUTH_CIPHER_NONE) {
++ ar->arGroupCrypto = NONE_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_WEP40) {
++ ar->arGroupCrypto = WEP_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_TKIP) {
++ ar->arGroupCrypto = TKIP_CRYPT;
++ }
++ if (param->value & IW_AUTH_CIPHER_CCMP) {
++ ar->arGroupCrypto = AES_CRYPT;
++ }
+
-+/* ----- Interrupt handling ------------------------------------------------ */
++ reset = 1;
++ break;
++ case IW_AUTH_KEY_MGMT:
++ if (param->value & IW_AUTH_KEY_MGMT_PSK) {
++ if (ar->arAuthMode == WPA_AUTH) {
++ ar->arAuthMode = WPA_PSK_AUTH;
++ } else if (ar->arAuthMode == WPA2_AUTH) {
++ ar->arAuthMode = WPA2_PSK_AUTH;
++ }
+
-+/*
-+ * Volatile ought to be good enough to make gcc do the right thing on S3C24xx.
-+ * No need to use atomic or put barriers, keeping the code more readable.
-+ *
-+ * Warning: this story changes if going SMP/SMT.
-+ */
++ reset = 1;
++ }
++ break;
+
-+static volatile int masked = 1;
-+static volatile int pending;
-+static volatile int in_interrupt;
++ case IW_AUTH_TKIP_COUNTERMEASURES:
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ wmi_set_tkip_countermeasures_cmd(ar->arWmi, param->value);
++ break;
+
++ case IW_AUTH_DROP_UNENCRYPTED:
++ break;
+
-+static void ar6000_do_irq(struct sdio_func *func)
-+{
-+ HIF_DEVICE *hif = sdio_get_drvdata(func);
-+ struct device *dev = HIFGetOSDevice(hif);
-+ A_STATUS status;
++ case IW_AUTH_80211_AUTH_ALG:
++ if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
++ ar->arDot11AuthMode = OPEN_AUTH;
++ }
++ if (param->value & IW_AUTH_ALG_SHARED_KEY) {
++ ar->arDot11AuthMode = SHARED_AUTH;
++ }
++ if (param->value & IW_AUTH_ALG_LEAP) {
++ ar->arDot11AuthMode = LEAP_AUTH;
++ ar->arPairwiseCrypto = WEP_CRYPT;
++ ar->arGroupCrypto = WEP_CRYPT;
++ }
+
-+ dev_dbg(dev, "ar6000_do_irq -> %p\n", htcCallbacks.dsrHandler);
++ reset = 1;
++ break;
+
-+ status = htcCallbacks.dsrHandler(hif->htc_handle);
-+ BUG_ON(status != A_OK);
-+}
++ case IW_AUTH_WPA_ENABLED:
++ reset = 1;
++ break;
+
++ case IW_AUTH_RX_UNENCRYPTED_EAPOL:
++ break;
+
-+static void sdio_ar6000_irq(struct sdio_func *func)
-+{
-+ HIF_DEVICE *hif = sdio_get_drvdata(func);
-+ struct device *dev = HIFGetOSDevice(hif);
++ case IW_AUTH_PRIVACY_INVOKED:
++ break;
+
-+ dev_dbg(dev, "sdio_ar6000_irq\n");
++ default:
++ printk("%s(): Unknown flag 0x%x\n", __FUNCTION__, param->flags);
++ return -EOPNOTSUPP;
++ }
+
-+ in_interrupt = 1;
-+ if (masked) {
-+ in_interrupt = 0;
-+ pending++;
-+ return;
++ if (reset) {
++ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
++ ar->arSsidLen = 0;
+ }
-+ /*
-+ * @@@ This is ugly. If we don't drop the lock, we'll deadlock when
-+ * the handler tries to do SDIO. So there are four choices:
-+ *
-+ * 1) Break the call chain by calling the callback from a workqueue.
-+ * Ugh.
-+ * 2) Make process_request aware that we already have the lock.
-+ * 3) Drop the lock. Which is ugly but should be safe as long as we're
-+ * making sure the device doesn't go away.
-+ * 4) Change the AR6k driver such that it only issues asynchronous
-+ * quests when called from an interrupt.
-+ *
-+ * Solution 2) is probably the best for now. Will try it later.
-+ */
-+ sdio_release_host(func);
-+ ar6000_do_irq(func);
-+ sdio_claim_host(func);
-+ in_interrupt = 0;
-+}
+
++ return 0;
++}
+
-+void HIFAckInterrupt(HIF_DEVICE *hif)
++static int ar6000_ioctl_giwauth(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *dwrq,
++ char *extra)
+{
-+ struct device *dev = HIFGetOSDevice(hif);
-+
-+ dev_dbg(dev, "HIFAckInterrupt\n");
-+ /* do nothing */
++ return 0;
+}
+
-+
-+void HIFUnMaskInterrupt(HIF_DEVICE *hif)
++static int ar6000_ioctl_siwencodeext(struct net_device *dev,
++ struct iw_request_info *info,
++ union iwreq_data *wrqu,
++ char *extra)
+{
-+ struct device *dev = HIFGetOSDevice(hif);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct iw_point *encoding = &wrqu->encoding;
++ struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
++ int alg = ext->alg, idx;
+
-+ dev_dbg(dev, "HIFUnMaskInterrupt\n");
-+ do {
-+ masked = 1;
-+ if (pending) {
-+ pending = 0;
-+ ar6000_do_irq(hif->func);
-+ /* We may take an interrupt before unmasking and thus
-+ get it pending. In this case, we just loop back. */
-+ }
-+ masked = 0;
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
+ }
-+ while (pending);
-+}
-+
+
-+void HIFMaskInterrupt(HIF_DEVICE *hif)
-+{
-+ struct device *dev = HIFGetOSDevice(hif);
-+
-+ dev_dbg(dev, "HIFMaskInterrupt\n");
-+ /*
-+ * Since sdio_ar6000_irq can also be called from a process context, we
-+ * may conceivably end up racing with it. Thus, we need to wait until
-+ * we can be sure that no concurrent interrupt processing is going on
-+ * before we return.
-+ *
-+ * Note: this may be a bit on the paranoid side - the callers may
-+ * actually be nice enough to disable scheduling. Check later.
-+ */
-+ masked = 1;
-+ while (in_interrupt)
-+ yield();
-+}
++ /* Determine and validate the key index */
++ idx = (encoding->flags & IW_ENCODE_INDEX) - 1;
++ if (idx) {
++ if (idx < 0 || idx > 3)
++ return -EINVAL;
++ }
+
++ if ((alg == IW_ENCODE_ALG_TKIP) || (alg == IW_ENCODE_ALG_CCMP)) {
++ struct ieee80211req_key ik;
++ KEY_USAGE key_usage;
++ CRYPTO_TYPE key_type = NONE_CRYPT;
++ int status;
+
-+/* ----- HIF API glue functions -------------------------------------------- */
++ ar->user_saved_keys.keyOk = FALSE;
+
++ if (alg == IW_ENCODE_ALG_TKIP) {
++ key_type = TKIP_CRYPT;
++ ik.ik_type = IEEE80211_CIPHER_TKIP;
++ } else {
++ key_type = AES_CRYPT;
++ ik.ik_type = IEEE80211_CIPHER_AES_CCM;
++ }
+
-+struct device *HIFGetOSDevice(HIF_DEVICE *hif)
-+{
-+ return &hif->func->dev;
-+}
++ ik.ik_keyix = idx;
++ ik.ik_keylen = ext->key_len;
++ ik.ik_flags = IEEE80211_KEY_RECV;
++ if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
++ ik.ik_flags |= IEEE80211_KEY_XMIT
++ | IEEE80211_KEY_DEFAULT;
++ }
+
++ if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
++ memcpy(&ik.ik_keyrsc, ext->rx_seq, 8);
++ }
+
-+void HIFSetHandle(void *hif_handle, void *handle)
-+{
-+ HIF_DEVICE *hif = (HIF_DEVICE *) hif_handle;
-+
-+ hif->htc_handle = handle;
-+}
++ memcpy(ik.ik_keydata, ext->key, ext->key_len);
+
++ ar->user_saved_keys.keyType = key_type;
++ if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
++ key_usage = GROUP_USAGE;
++ memset(ik.ik_macaddr, 0, ETH_ALEN);
++ memcpy(&ar->user_saved_keys.bcast_ik, &ik,
++ sizeof(struct ieee80211req_key));
++ } else {
++ key_usage = PAIRWISE_USAGE;
++ memcpy(ik.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
++ memcpy(&ar->user_saved_keys.ucast_ik, &ik,
++ sizeof(struct ieee80211req_key));
++ }
+
-+/* ----- Device configuration (HIF side) ----------------------------------- */
++ status = wmi_addKey_cmd(ar->arWmi, ik.ik_keyix, key_type,
++ key_usage, ik.ik_keylen,
++ (A_UINT8 *)&ik.ik_keyrsc,
++ ik.ik_keydata,
++ KEY_OP_INIT_VAL, SYNC_BEFORE_WMIFLAG);
+
++ if (status < 0)
++ return -EIO;
+
-+A_STATUS HIFConfigureDevice(HIF_DEVICE *hif,
-+ HIF_DEVICE_CONFIG_OPCODE opcode, void *config, A_UINT32 configLen)
-+{
-+ struct device *dev = HIFGetOSDevice(hif);
-+ HIF_DEVICE_IRQ_PROCESSING_MODE *ipm_cfg = config;
-+ A_UINT32 *mbs_cfg = config;
-+ int i;
++ ar->user_saved_keys.keyOk = TRUE;
+
-+ dev_dbg(dev, "HIFConfigureDevice\n");
++ return 0;
+
-+ switch (opcode) {
-+ case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
-+ for (i = 0; i != MBOXES; i++)
-+ mbs_cfg[i] = HIF_MBOX_BLOCK_SIZE;
-+ break;
-+ case HIF_DEVICE_GET_MBOX_ADDR:
-+ for (i = 0; i != MBOXES; i++)
-+ mbs_cfg[i] = HIF_MBOX_START_ADDR(i);
-+ break;
-+ case HIF_DEVICE_GET_IRQ_PROC_MODE:
-+ *ipm_cfg = HIF_DEVICE_IRQ_SYNC_ONLY;
-+// *ipm_cfg = HIF_DEVICE_IRQ_ASYNC_SYNC;
-+ break;
-+ default:
-+ return A_ERROR;
++ } else {
++ /* WEP falls back to SIWENCODE */
++ return -EOPNOTSUPP;
+ }
-+ return A_OK;
-+}
-+
+
-+/* ----- Device probe and removal (Linux side) ----------------------------- */
++ return 0;
++}
+
+
-+static int ar6000_do_activate(struct hif_device *hif)
++static int ar6000_ioctl_giwencodeext(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *dwrq,
++ char *extra)
+{
-+ struct sdio_func *func = hif->func;
-+ struct device *dev = &func->dev;
-+ int ret;
++ return 0;
++}
+
-+ dev_dbg(dev, "ar6000_do_activate\n");
+
-+ sdio_claim_host(func);
-+ sdio_enable_func(func);
++static int
++ar6000_ioctl_setparam(struct net_device *dev,
++ struct iw_request_info *info,
++ void *erq, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int *i = (int *)extra;
++ int param = i[0];
++ int value = i[1];
++ int ret = 0;
++ A_BOOL profChanged = FALSE;
+
-+ INIT_LIST_HEAD(&hif->queue);
-+ init_waitqueue_head(&hif->wait);
-+ spin_lock_init(&hif->queue_lock);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ ret = sdio_set_block_size(func, HIF_MBOX_BLOCK_SIZE);
-+ if (ret < 0) {
-+ dev_err(dev, "sdio_set_block_size returns %d\n", ret);
-+ goto out_enabled;
-+ }
-+ ret = sdio_claim_irq(func, sdio_ar6000_irq);
-+ if (ret) {
-+ dev_err(dev, "sdio_claim_irq returns %d\n", ret);
-+ goto out_enabled;
-+ }
-+ /* Set SDIO_BUS_CD_DISABLE in SDIO_CCCR_IF ? */
-+#if 0
-+ sdio_f0_writeb(func, SDIO_CCCR_CAP_E4MI, SDIO_CCCR_CAPS, &ret);
-+ if (ret) {
-+ dev_err(dev, "sdio_f0_writeb(SDIO_CCCR_CAPS) returns %d\n",
-+ ret);
-+ goto out_got_irq;
-+ }
-+#else
-+ if (0) /* avoid warning */
-+ goto out_got_irq;
-+#endif
++ switch (param) {
++ case IEEE80211_PARAM_WPA:
++ switch (value) {
++ case WPA_MODE_WPA1:
++ ar->arAuthMode = WPA_AUTH;
++ profChanged = TRUE;
++ break;
++ case WPA_MODE_WPA2:
++ ar->arAuthMode = WPA2_AUTH;
++ profChanged = TRUE;
++ break;
++ case WPA_MODE_NONE:
++ ar->arAuthMode = NONE_AUTH;
++ profChanged = TRUE;
++ break;
++ default:
++ printk("IEEE80211_PARAM_WPA: Unknown value %d\n", value);
++ }
++ break;
++ case IEEE80211_PARAM_AUTHMODE:
++ switch(value) {
++ case IEEE80211_AUTH_WPA_PSK:
++ if (WPA_AUTH == ar->arAuthMode) {
++ ar->arAuthMode = WPA_PSK_AUTH;
++ profChanged = TRUE;
++ } else if (WPA2_AUTH == ar->arAuthMode) {
++ ar->arAuthMode = WPA2_PSK_AUTH;
++ profChanged = TRUE;
++ } else {
++ AR_DEBUG_PRINTF("Error - Setting PSK mode when WPA "\
++ "param was set to %d\n",
++ ar->arAuthMode);
++ ret = -1;
++ }
++ break;
++ case IEEE80211_AUTH_WPA_CCKM:
++ if (WPA2_AUTH == ar->arAuthMode) {
++ ar->arAuthMode = WPA2_AUTH_CCKM;
++ } else {
++ ar->arAuthMode = WPA_AUTH_CCKM;
++ }
++ break;
++ default:
++ break;
++ }
++ break;
++ case IEEE80211_PARAM_UCASTCIPHER:
++ switch (value) {
++ case IEEE80211_CIPHER_AES_CCM:
++ ar->arPairwiseCrypto = AES_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_TKIP:
++ ar->arPairwiseCrypto = TKIP_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_WEP:
++ ar->arPairwiseCrypto = WEP_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_NONE:
++ ar->arPairwiseCrypto = NONE_CRYPT;
++ profChanged = TRUE;
++ break;
++ }
++ break;
++ case IEEE80211_PARAM_UCASTKEYLEN:
++ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
++ ret = -EIO;
++ } else {
++ ar->arPairwiseCryptoLen = value;
++ }
++ break;
++ case IEEE80211_PARAM_MCASTCIPHER:
++ switch (value) {
++ case IEEE80211_CIPHER_AES_CCM:
++ ar->arGroupCrypto = AES_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_TKIP:
++ ar->arGroupCrypto = TKIP_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_WEP:
++ ar->arGroupCrypto = WEP_CRYPT;
++ profChanged = TRUE;
++ break;
++ case IEEE80211_CIPHER_NONE:
++ ar->arGroupCrypto = NONE_CRYPT;
++ profChanged = TRUE;
++ break;
++ }
++ break;
++ case IEEE80211_PARAM_MCASTKEYLEN:
++ if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
++ ret = -EIO;
++ } else {
++ ar->arGroupCryptoLen = value;
++ }
++ break;
++ case IEEE80211_PARAM_COUNTERMEASURES:
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
++ wmi_set_tkip_countermeasures_cmd(ar->arWmi, value);
++ break;
++ default:
++ break;
++ }
+
-+ sdio_release_host(func);
++ if (profChanged == TRUE) {
++ /*
++ * profile has changed. Erase ssid to signal change
++ */
++ A_MEMZERO(ar->arSsid, sizeof(ar->arSsid));
++ ar->arSsidLen = 0;
++ }
+
-+ hif->io_task = kthread_run(io, hif, "ar6000_io");
-+ ret = IS_ERR(hif->io_task);
-+ if (ret) {
-+ dev_err(dev, "kthread_run(ar6000_io): %d\n", ret);
-+ goto out_func_ready;
-+ }
++ return ret;
++}
+
-+ ret = htcCallbacks.deviceInsertedHandler(hif);
-+ if (ret == A_OK)
-+ return 0;
++int
++ar6000_ioctl_getparam(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
++{
++ return -EIO; /* for now */
++}
+
-+ dev_err(dev, "deviceInsertedHandler: %d\n", ret);
++int
++ar6000_ioctl_setkey(struct net_device *dev, struct iw_request_info *info,
++ void *w, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct ieee80211req_key *ik = (struct ieee80211req_key *)extra;
++ KEY_USAGE keyUsage;
++ A_STATUS status;
++ CRYPTO_TYPE keyType = NONE_CRYPT;
+
-+ ret = kthread_stop(hif->io_task);
-+ if (ret)
-+ dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+out_func_ready:
-+ sdio_claim_host(func);
++ ar->user_saved_keys.keyOk = FALSE;
+
-+out_got_irq:
-+ sdio_release_irq(func);
++ if ( 0 == memcmp(ik->ik_macaddr, "\x00\x00\x00\x00\x00\x00",
++ IEEE80211_ADDR_LEN)) {
++ keyUsage = GROUP_USAGE;
++ A_MEMCPY(&ar->user_saved_keys.bcast_ik, ik,
++ sizeof(struct ieee80211req_key));
++ } else {
++ keyUsage = PAIRWISE_USAGE;
++ A_MEMCPY(&ar->user_saved_keys.ucast_ik, ik,
++ sizeof(struct ieee80211req_key));
++ }
+
-+out_enabled:
-+ sdio_disable_func(func);
-+ sdio_release_host(func);
++ switch (ik->ik_type) {
++ case IEEE80211_CIPHER_WEP:
++ keyType = WEP_CRYPT;
++ break;
++ case IEEE80211_CIPHER_TKIP:
++ keyType = TKIP_CRYPT;
++ break;
++ case IEEE80211_CIPHER_AES_CCM:
++ keyType = AES_CRYPT;
++ break;
++ default:
++ break;
++ }
++ ar->user_saved_keys.keyType = keyType;
+
-+ return ret;
-+}
++ if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
++ if (NONE_CRYPT == keyType) {
++ return -EIO;
++ }
+
++ status = wmi_addKey_cmd(ar->arWmi, ik->ik_keyix, keyType, keyUsage,
++ ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
++ ik->ik_keydata, KEY_OP_INIT_VAL,
++ SYNC_BEFORE_WMIFLAG);
+
-+static void ar6000_do_deactivate(struct hif_device *hif)
-+{
-+ struct sdio_func *func = hif->func;
-+ struct device *dev = &func->dev;
-+ int ret;
++ if (status != A_OK) {
++ return -EIO;
++ }
++ } else {
++ status = wmi_add_krk_cmd(ar->arWmi, ik->ik_keydata);
++ }
+
-+ dev_dbg(dev, "ar6000_do_deactivate\n");
-+ if (!hif->active)
-+ return;
++ ar->user_saved_keys.keyOk = TRUE;
+
-+ if (mutex_trylock(&shutdown_lock)) {
-+ /*
-+ * Funny, Atheros' HIF does this call, but this just puts us in
-+ * a recursion through HTCShutDown/HIFShutDown if unloading the
-+ * module.
-+ *
-+ * However, we need it for suspend/resume. See the comment at
-+ * HIFShutDown, below.
-+ */
-+ ret = htcCallbacks.deviceRemovedHandler(hif->htc_handle, A_OK);
-+ if (ret != A_OK)
-+ dev_err(dev, "deviceRemovedHandler: %d\n", ret);
-+ mutex_unlock(&shutdown_lock);
-+ }
-+ wait_queue_empty(hif);
-+ ret = kthread_stop(hif->io_task);
-+ if (ret)
-+ dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
-+ sdio_claim_host(func);
-+ sdio_release_irq(func);
-+ sdio_disable_func(func);
-+ sdio_release_host(func);
++ return 0;
+}
+
+
-+static int ar6000_activate(struct hif_device *hif)
++/*
++ * SIOCGIWNAME
++ */
++int
++ar6000_ioctl_giwname(struct net_device *dev,
++ struct iw_request_info *info,
++ char *name, char *extra)
+{
-+ int ret = 0;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ dev_dbg(&hif->func->dev, "ar6000_activate\n");
-+ mutex_lock(&hif->activate_lock);
-+ if (!hif->active) {
-+ ret = ar6000_do_activate(hif);
-+ if (ret) {
-+ printk(KERN_ERR "%s: Failed to activate %d\n",
-+ __func__, ret);
-+ goto out;
-+ }
-+ hif->active = 1;
-+ }
-+out:
-+ mutex_unlock(&hif->activate_lock);
-+ return ret;
-+}
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
++ switch (ar->arPhyCapability) {
++ case (WMI_11A_CAPABILITY):
++ strncpy(name, "AR6000 802.11a", IFNAMSIZ);
++ break;
++ case (WMI_11G_CAPABILITY):
++ strncpy(name, "AR6000 802.11g", IFNAMSIZ);
++ break;
++ case (WMI_11AG_CAPABILITY):
++ strncpy(name, "AR6000 802.11ag", IFNAMSIZ);
++ break;
++ default:
++ strncpy(name, "AR6000 802.11", IFNAMSIZ);
++ break;
++ }
+
-+static void ar6000_deactivate(struct hif_device *hif)
-+{
-+ dev_dbg(&hif->func->dev, "ar6000_deactivate\n");
-+ mutex_lock(&hif->activate_lock);
-+ if (hif->active) {
-+ ar6000_do_deactivate(hif);
-+ hif->active = 0;
-+ }
-+ mutex_unlock(&hif->activate_lock);
++ return 0;
+}
+
-+
-+static int ar6000_rfkill_cb(void *data, int on)
++/*
++ * SIOCSIWFREQ
++ */
++int
++ar6000_ioctl_siwfreq(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_freq *freq, char *extra)
+{
-+ struct hif_device *hif = data;
-+ struct sdio_func *func = hif->func;
-+ struct device *dev = &func->dev;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ dev_dbg(dev, "ar6000_rfkill_cb: on %d\n", on);
-+ if (on)
-+ return ar6000_activate(hif);
-+ ar6000_deactivate(hif);
-+ return 0;
-+}
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
++
++ /*
++ * We support limiting the channels via wmiconfig.
++ *
++ * We use this command to configure the channel hint for the connect cmd
++ * so it is possible the target will end up connecting to a different
++ * channel.
++ */
++ if (freq->e > 1) {
++ return -EINVAL;
++ } else if (freq->e == 1) {
++ ar->arChannelHint = freq->m / 100000;
++ } else {
++ ar->arChannelHint = wlan_ieee2freq(freq->m);
++ }
+
++ A_PRINTF("channel hint set to %d\n", ar->arChannelHint);
++ return 0;
++}
+
-+static int sdio_ar6000_probe(struct sdio_func *func,
-+ const struct sdio_device_id *id)
++/*
++ * SIOCGIWFREQ
++ */
++int
++ar6000_ioctl_giwfreq(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_freq *freq, char *extra)
+{
-+ struct device *dev = &func->dev;
-+ struct hif_device *hif;
-+ int ret = 0;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ dev_dbg(dev, "sdio_ar6000_probe\n");
-+ BUG_ON(!htcCallbacks.deviceInsertedHandler);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ hif = kzalloc(sizeof(*hif), GFP_KERNEL);
-+ if (!hif)
-+ return -ENOMEM;
++ if (ar->arConnected != TRUE) {
++ return -EINVAL;
++ }
+
-+ sdio_set_drvdata(func, hif);
-+ hif->func = func;
-+ mutex_init(&hif->activate_lock);
-+ hif->active = 0;
++ freq->m = ar->arBssChannel * 100000;
++ freq->e = 1;
+
-+ if (gta02_wlan_query_rfkill_lock())
-+ ret = ar6000_activate(hif);
-+ if (!ret) {
-+ gta02_wlan_set_rfkill_cb(ar6000_rfkill_cb, hif);
-+ return 0;
-+ }
-+ gta02_wlan_query_rfkill_unlock();
-+ sdio_set_drvdata(func, NULL);
-+ kfree(hif);
-+ return ret;
++ return 0;
+}
+
-+
-+static void sdio_ar6000_remove(struct sdio_func *func)
++/*
++ * SIOCSIWMODE
++ */
++int
++ar6000_ioctl_siwmode(struct net_device *dev,
++ struct iw_request_info *info,
++ __u32 *mode, char *extra)
+{
-+ struct device *dev = &func->dev;
-+ HIF_DEVICE *hif = sdio_get_drvdata(func);
-+
-+ dev_dbg(dev, "sdio_ar6000_remove\n");
-+ gta02_wlan_clear_rfkill_cb();
-+ ar6000_deactivate(hif);
-+ sdio_set_drvdata(func, NULL);
-+ kfree(hif);
-+}
-+
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+/* ----- Device registration/unregistration (called by HIF) ---------------- */
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
++ switch (*mode) {
++ case IW_MODE_INFRA:
++ ar->arNetworkType = INFRA_NETWORK;
++ break;
++ case IW_MODE_ADHOC:
++ ar->arNetworkType = ADHOC_NETWORK;
++ break;
++ default:
++ return -EINVAL;
++ }
+
-+#define ATHEROS_SDIO_DEVICE(id, offset) \
-+ SDIO_DEVICE(SDIO_VENDOR_ID_ATHEROS, SDIO_DEVICE_ID_ATHEROS_##id | (offset))
++ return 0;
++}
+
-+static const struct sdio_device_id sdio_ar6000_ids[] = {
-+ { ATHEROS_SDIO_DEVICE(AR6002, 0) },
-+ { ATHEROS_SDIO_DEVICE(AR6002, 0x1) },
-+ { ATHEROS_SDIO_DEVICE(AR6001, 0x8) },
-+ { ATHEROS_SDIO_DEVICE(AR6001, 0x9) },
-+ { ATHEROS_SDIO_DEVICE(AR6001, 0xa) },
-+ { ATHEROS_SDIO_DEVICE(AR6001, 0xb) },
-+ { /* end: all zeroes */ },
-+};
-+
-+MODULE_DEVICE_TABLE(sdio, sdio_ar6000_ids);
-+
-+
-+static struct sdio_driver sdio_ar6000_driver = {
-+ .probe = sdio_ar6000_probe,
-+ .remove = sdio_ar6000_remove,
-+ .name = "sdio_ar6000",
-+ .id_table = sdio_ar6000_ids,
-+};
-+
-+
-+int HIFInit(HTC_CALLBACKS *callbacks)
++/*
++ * SIOCGIWMODE
++ */
++int
++ar6000_ioctl_giwmode(struct net_device *dev,
++ struct iw_request_info *info,
++ __u32 *mode, char *extra)
+{
-+ int ret;
-+
-+ BUG_ON(!callbacks);
-+
-+ printk(KERN_DEBUG "HIFInit\n");
-+ htcCallbacks = *callbacks;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ ret = sdio_register_driver(&sdio_ar6000_driver);
-+ if (ret) {
-+ printk(KERN_ERR
-+ "sdio_register_driver(sdio_ar6000_driver): %d\n", ret);
-+ return A_ERROR;
-+ }
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ return 0;
++ switch (ar->arNetworkType) {
++ case INFRA_NETWORK:
++ *mode = IW_MODE_INFRA;
++ break;
++ case ADHOC_NETWORK:
++ *mode = IW_MODE_ADHOC;
++ break;
++ default:
++ return -EIO;
++ }
++ return 0;
+}
+
-+
+/*
-+ * We have four possible call chains here:
-+ *
-+ * System shutdown/reboot:
-+ *
-+ * kernel_restart_prepare ...> device_shutdown ... > s3cmci_shutdown ->
-+ * mmc_remove_host ..> sdio_bus_remove -> sdio_ar6000_remove ->
-+ * ar6000_deactivate -> ar6000_do_deactivate ->
-+ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ * This is roughly the same sequence as suspend, described below.
-+ *
-+ * Module removal:
-+ *
-+ * sys_delete_module -> ar6000_cleanup_module -> HTCShutDown ->
-+ * HIFShutDownDevice -> sdio_unregister_driver ...> sdio_bus_remove ->
-+ * sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate
-+ *
-+ * In this case, HIFShutDownDevice must call sdio_unregister_driver to
-+ * notify the driver about its removal. ar6000_do_deactivate must not call
-+ * deviceRemovedHandler, because that would loop back into HIFShutDownDevice.
-+ *
-+ * Suspend:
-+ *
-+ * device_suspend ...> s3cmci_suspend ...> sdio_bus_remove ->
-+ * sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate ->
-+ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ * We must call deviceRemovedHandler to inform the ar6k stack that the device
-+ * has been removed. Since HTCTargetRemovedHandler calls back into
-+ * HIFShutDownDevice, we must also prevent the call to
-+ * sdio_unregister_driver, or we'd end up recursing into the SDIO stack,
-+ * eventually deadlocking somewhere.
-+ *
-+ * rfkill:
-+ *
-+ * rfkill_state_store -> rfkill_toggle_radio -> gta02_wlan_toggle_radio ->
-+ * ar6000_rfkill_cb -> ar6000_deactivate -> ar6000_do_deactivate ->
-+ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
-+ *
-+ * This is similar to suspend - only the entry point changes.
++ * SIOCSIWSENS
+ */
-+
-+void HIFShutDownDevice(HIF_DEVICE *hif)
++int
++ar6000_ioctl_siwsens(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *sens, char *extra)
+{
-+ /* Beware, HTCShutDown calls us with hif == NULL ! */
-+ if (mutex_trylock(&shutdown_lock)) {
-+ sdio_unregister_driver(&sdio_ar6000_driver);
-+ mutex_unlock(&shutdown_lock);
-+ }
++ return 0;
+}
-diff --git a/drivers/ar6000/hif/hif_internal.h b/drivers/ar6000/hif/hif_internal.h
-new file mode 100644
-index 0000000..d8fc101
---- /dev/null
-+++ b/drivers/ar6000/hif/hif_internal.h
-@@ -0,0 +1,102 @@
++
+/*
-+ * @file: hif_internal.h
-+ *
-+ * @abstract: internal header file for hif layer
-+ *
-+ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * SIOCGIWSENS
+ */
++int
++ar6000_ioctl_giwsens(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_param *sens, char *extra)
++{
++ sens->value = 0;
++ sens->fixed = 1;
+
-+#include <linux/sdio/ctsystem.h>
-+#include <linux/sdio/sdio_busdriver.h>
-+#include <linux/sdio/_sdio_defs.h>
-+#include <linux/sdio/sdio_lib.h>
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "hif.h"
-+
-+#define MANUFACTURER_ID_AR6001_BASE 0x100
-+#define MANUFACTURER_ID_AR6002_BASE 0x200
-+#define FUNCTION_CLASS 0x0
-+#define MANUFACTURER_CODE 0x271
++ return 0;
++}
+
-+#define BUS_REQUEST_MAX_NUM 64
++/*
++ * SIOCGIWRANGE
++ */
++int
++ar6000_ioctl_giwrange(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *extra)
++{
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ struct iw_range *range = (struct iw_range *) extra;
++ int i, ret = 0;
+
-+#define SDIO_CLOCK_FREQUENCY_DEFAULT 25000000
-+#define SDWLAN_ENABLE_DISABLE_TIMEOUT 20
-+#define FLAGS_CARD_ENAB 0x02
-+#define FLAGS_CARD_IRQ_UNMSK 0x04
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+#define HIF_MBOX_BLOCK_SIZE 128
-+#define HIF_MBOX_BASE_ADDR 0x800
-+#define HIF_MBOX_WIDTH 0x800
-+#define HIF_MBOX0_BLOCK_SIZE 1
-+#define HIF_MBOX1_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
-+#define HIF_MBOX2_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
-+#define HIF_MBOX3_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+#define HIF_MBOX_START_ADDR(mbox) \
-+ HIF_MBOX_BASE_ADDR + mbox * HIF_MBOX_WIDTH
++ if (down_interruptible(&ar->arSem)) {
++ return -ERESTARTSYS;
++ }
++ ar->arNumChannels = -1;
++ A_MEMZERO(ar->arChannelList, sizeof (ar->arChannelList));
+
-+#define HIF_MBOX_END_ADDR(mbox) \
-+ HIF_MBOX_START_ADDR(mbox) + HIF_MBOX_WIDTH - 1
++ if (wmi_get_channelList_cmd(ar->arWmi) != A_OK) {
++ up(&ar->arSem);
++ return -EIO;
++ }
+
-+struct hif_device {
-+ SDDEVICE *handle;
-+ void *htc_handle;
-+ OSKERNEL_HELPER insert_helper;
-+ BOOL helper_started;
-+};
++ wait_event_interruptible_timeout(arEvent, ar->arNumChannels != -1, wmitimeout * HZ);
+
-+typedef struct target_function_context {
-+ SDFUNCTION function; /* function description of the bus driver */
-+ OS_SEMAPHORE instanceSem; /* instance lock. Unused */
-+ SDLIST instanceList; /* list of instances. Unused */
-+} TARGET_FUNCTION_CONTEXT;
++ if (signal_pending(current)) {
++ up(&ar->arSem);
++ return -EINTR;
++ }
+
-+typedef struct bus_request {
-+ struct bus_request *next;
-+ SDREQUEST *request;
-+ void *context;
-+} BUS_REQUEST;
++ data->length = sizeof(struct iw_range);
++ A_MEMZERO(range, sizeof(struct iw_range));
+
-+BOOL
-+hifDeviceInserted(SDFUNCTION *function, SDDEVICE *device);
++ range->txpower_capa = IW_TXPOW_DBM;
+
-+void
-+hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *device);
++ range->min_pmp = 1 * 1024;
++ range->max_pmp = 65535 * 1024;
++ range->min_pmt = 1 * 1024;
++ range->max_pmt = 1000 * 1024;
++ range->pmp_flags = IW_POWER_PERIOD;
++ range->pmt_flags = IW_POWER_TIMEOUT;
++ range->pm_capa = 0;
+
-+SDREQUEST *
-+hifAllocateDeviceRequest(SDDEVICE *device);
++ range->we_version_compiled = WIRELESS_EXT;
++ range->we_version_source = 13;
+
-+void
-+hifFreeDeviceRequest(SDREQUEST *request);
++ range->retry_capa = IW_RETRY_LIMIT;
++ range->retry_flags = IW_RETRY_LIMIT;
++ range->min_retry = 0;
++ range->max_retry = 255;
+
-+void
-+hifRWCompletionHandler(SDREQUEST *request);
++ range->num_frequency = range->num_channels = ar->arNumChannels;
++ for (i = 0; i < ar->arNumChannels; i++) {
++ range->freq[i].i = wlan_freq2ieee(ar->arChannelList[i]);
++ range->freq[i].m = ar->arChannelList[i] * 100000;
++ range->freq[i].e = 1;
++ /*
++ * Linux supports max of 32 channels, bail out once you
++ * reach the max.
++ */
++ if (i == IW_MAX_FREQUENCIES) {
++ break;
++ }
++ }
+
-+void
-+hifIRQHandler(void *context);
++ /* Max quality is max field value minus noise floor */
++ range->max_qual.qual = 0xff - 161;
+
-+HIF_DEVICE *
-+addHifDevice(SDDEVICE *handle);
++ /*
++ * In order to use dBm measurements, 'level' must be lower
++ * than any possible measurement (see iw_print_stats() in
++ * wireless tools). It's unclear how this is meant to be
++ * done, but setting zero in these values forces dBm and
++ * the actual numbers are not used.
++ */
++ range->max_qual.level = 0;
++ range->max_qual.noise = 0;
+
-+HIF_DEVICE *
-+getHifDevice(SDDEVICE *handle);
++ range->sensitivity = 3;
+
-+void
-+delHifDevice(SDDEVICE *handle);
-diff --git a/drivers/ar6000/htc/ar6k.c b/drivers/ar6000/htc/ar6k.c
-new file mode 100644
-index 0000000..72472ab
---- /dev/null
-+++ b/drivers/ar6000/htc/ar6k.c
-@@ -0,0 +1,991 @@
-+/*
-+ * AR6K device layer that handles register level I/O
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "hif.h"
-+#include "htc_packet.h"
-+#include "ar6k.h"
++ range->max_encoding_tokens = 4;
++ /* XXX query driver to find out supported key sizes */
++ range->num_encoding_sizes = 3;
++ range->encoding_size[0] = 5; /* 40-bit */
++ range->encoding_size[1] = 13; /* 104-bit */
++ range->encoding_size[2] = 16; /* 128-bit */
+
-+#define MAILBOX_FOR_BLOCK_SIZE 1
++ range->num_bitrates = 0;
+
-+extern A_UINT32 resetok;
++ /* estimated maximum TCP throughput values (bps) */
++ range->throughput = 22000000;
+
-+static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev);
-+static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev);
++ range->min_rts = 0;
++ range->max_rts = 2347;
++ range->min_frag = 256;
++ range->max_frag = 2346;
+
-+#define LOCK_AR6K(p) A_MUTEX_LOCK(&(p)->Lock);
-+#define UNLOCK_AR6K(p) A_MUTEX_UNLOCK(&(p)->Lock);
++ up(&ar->arSem);
+
-+void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket)
-+{
-+ LOCK_AR6K(pDev);
-+ HTC_PACKET_ENQUEUE(&pDev->RegisterIOList,pPacket);
-+ UNLOCK_AR6K(pDev);
++ return ret;
+}
+
-+HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev)
++
++/*
++ * SIOCSIWAP
++ * This ioctl is used to set the desired bssid for the connect command.
++ */
++int
++ar6000_ioctl_siwap(struct net_device *dev,
++ struct iw_request_info *info,
++ struct sockaddr *ap_addr, char *extra)
+{
-+ HTC_PACKET *pPacket;
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ LOCK_AR6K(pDev);
-+ pPacket = HTC_PACKET_DEQUEUE(&pDev->RegisterIOList);
-+ UNLOCK_AR6K(pDev);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ return pPacket;
++ if (ap_addr->sa_family != ARPHRD_ETHER) {
++ return -EIO;
++ }
++
++ if (A_MEMCMP(&ap_addr->sa_data, bcast_mac, AR6000_ETH_ADDR_LEN) == 0) {
++ A_MEMZERO(ar->arReqBssid, sizeof(ar->arReqBssid));
++ } else {
++ A_MEMCPY(ar->arReqBssid, &ap_addr->sa_data, sizeof(ar->arReqBssid));
++ }
++
++ return 0;
+}
+
-+A_STATUS DevSetup(AR6K_DEVICE *pDev)
++/*
++ * SIOCGIWAP
++ */
++int
++ar6000_ioctl_giwap(struct net_device *dev,
++ struct iw_request_info *info,
++ struct sockaddr *ap_addr, char *extra)
+{
-+ A_UINT32 mailboxaddrs[AR6K_MAILBOXES];
-+ A_UINT32 blocksizes[AR6K_MAILBOXES];
-+ A_STATUS status = A_OK;
-+ int i;
-+
-+ AR_DEBUG_ASSERT(AR6K_IRQ_PROC_REGS_SIZE == 16);
-+ AR_DEBUG_ASSERT(AR6K_IRQ_ENABLE_REGS_SIZE == 4);
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
+
-+ do {
-+ /* give a handle to HIF for this target */
-+ HIFSetHandle(pDev->HIFDevice, (void *)pDev);
-+ /* initialize our free list of IO packets */
-+ INIT_HTC_PACKET_QUEUE(&pDev->RegisterIOList);
-+ A_MUTEX_INIT(&pDev->Lock);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ /* get the addresses for all 4 mailboxes */
-+ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
-+ mailboxaddrs, sizeof(mailboxaddrs));
++ if (ar->arConnected != TRUE) {
++ return -EINVAL;
++ }
+
-+ if (status != A_OK) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ A_MEMCPY(&ap_addr->sa_data, ar->arBssid, sizeof(ar->arBssid));
++ ap_addr->sa_family = ARPHRD_ETHER;
+
-+ /* carve up register I/O packets (these are for ASYNC register I/O ) */
-+ for (i = 0; i < AR6K_MAX_REG_IO_BUFFERS; i++) {
-+ HTC_PACKET *pIOPacket;
-+ pIOPacket = &pDev->RegIOBuffers[i].HtcPacket;
-+ SET_HTC_PACKET_INFO_RX_REFILL(pIOPacket,
-+ pDev,
-+ pDev->RegIOBuffers[i].Buffer,
-+ AR6K_REG_IO_BUFFER_SIZE,
-+ 0); /* don't care */
-+ AR6KFreeIOPacket(pDev,pIOPacket);
-+ }
++ return 0;
++}
+
-+ /* get the address of the mailbox we are using */
-+ pDev->MailboxAddress = mailboxaddrs[HTC_MAILBOX];
++/*
++ * SIOCGIWAPLIST
++ */
++int
++ar6000_ioctl_iwaplist(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *extra)
++{
++ return -EIO; /* for now */
++}
+
-+ /* get the block sizes */
-+ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+ blocksizes, sizeof(blocksizes));
++/*
++ * SIOCSIWSCAN
++ */
++int
++ar6000_ioctl_siwscan(struct net_device *dev,
++ struct iw_request_info *info,
++ struct iw_point *data, char *extra)
++{
++#define ACT_DWELLTIME_DEFAULT 105
++#define HOME_TXDRAIN_TIME 100
++#define SCAN_INT HOME_TXDRAIN_TIME + ACT_DWELLTIME_DEFAULT
++ AR_SOFTC_T *ar = (AR_SOFTC_T *)netdev_priv(dev);
++ int ret = 0;
+
-+ if (status != A_OK) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ if (ar->arWmiReady == FALSE) {
++ return -EIO;
++ }
+
-+ /* note: we actually get the block size of a mailbox other than 0, for SDIO the block
-+ * size on mailbox 0 is artificially set to 1. So we use the block size that is set
-+ * for the other 3 mailboxes */
-+ pDev->BlockSize = blocksizes[MAILBOX_FOR_BLOCK_SIZE];
-+ /* must be a power of 2 */
-+ AR_DEBUG_ASSERT((pDev->BlockSize & (pDev->BlockSize - 1)) == 0);
++ if (ar->arWlanState == WLAN_DISABLED) {
++ return -EIO;
++ }
+
-+ /* assemble mask, used for padding to a block */
-+ pDev->BlockMask = pDev->BlockSize - 1;
++ /* We ask for everything from the target */
++ if (wmi_bssfilter_cmd(ar->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
++ printk("Couldn't set filtering\n");
++ ret = -EIO;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("BlockSize: %d, MailboxAddress:0x%X \n",
-+ pDev->BlockSize, pDev->MailboxAddress));
++ if (wmi_startscan_cmd(ar->arWmi, WMI_LONG_SCAN, FALSE, FALSE, \
++ HOME_TXDRAIN_TIME, SCAN_INT) != A_OK) {
++ ret = -EIO;
++ }
+
-+ pDev->GetPendingEventsFunc = NULL;
-+ /* see if the HIF layer implements the get pending events function */
-+ HIFConfigureDevice(pDev->HIFDevice,
-+ HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
-+ &pDev->GetPendingEventsFunc,
-+ sizeof(pDev->GetPendingEventsFunc));
++ ar->scan_complete = 0;
++ wait_event_interruptible_timeout(ar6000_scan_queue, ar->scan_complete,
++ 5 * HZ);
+
-+ /* assume we can process HIF interrupt events asynchronously */
-+ pDev->HifIRQProcessingMode = HIF_DEVICE_IRQ_ASYNC_SYNC;
++ if (wmi_bssfilter_cmd(ar->arWmi, NONE_BSS_FILTER, 0) != A_OK) {
++ printk("Couldn't set filtering\n");
++ ret = -EIO;
++ }
+
-+ /* see if the HIF layer overrides this assumption */
-+ HIFConfigureDevice(pDev->HIFDevice,
-+ HIF_DEVICE_GET_IRQ_PROC_MODE,
-+ &pDev->HifIRQProcessingMode,
-+ sizeof(pDev->HifIRQProcessingMode));
++ return ret;
++#undef ACT_DWELLTIME_DEFAULT
++#undef HOME_TXDRAIN_TIME
++#undef SCAN_INT
++}
+
-+ switch (pDev->HifIRQProcessingMode) {
-+ case HIF_DEVICE_IRQ_SYNC_ONLY:
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is SYNC ONLY\n"));
-+ break;
-+ case HIF_DEVICE_IRQ_ASYNC_SYNC:
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is ASYNC and SYNC\n"));
-+ break;
-+ default:
-+ AR_DEBUG_ASSERT(FALSE);
-+ }
+
-+ pDev->HifMaskUmaskRecvEvent = NULL;
-+
-+ /* see if the HIF layer implements the mask/unmask recv events function */
-+ HIFConfigureDevice(pDev->HIFDevice,
-+ HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
-+ &pDev->HifMaskUmaskRecvEvent,
-+ sizeof(pDev->HifMaskUmaskRecvEvent));
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF special overrides : 0x%X , 0x%X\n",
-+ (A_UINT32)pDev->GetPendingEventsFunc, (A_UINT32)pDev->HifMaskUmaskRecvEvent));
-+
-+ status = DevDisableInterrupts(pDev);
-+
-+ } while (FALSE);
-+
-+ if (A_FAILED(status)) {
-+ /* make sure handle is cleared */
-+ HIFSetHandle(pDev->HIFDevice, NULL);
++/*
++ * Units are in db above the noise floor. That means the
++ * rssi values reported in the tx/rx descriptors in the
++ * driver are the SNR expressed in db.
++ *
++ * If you assume that the noise floor is -95, which is an
++ * excellent assumption 99.5 % of the time, then you can
++ * derive the absolute signal level (i.e. -95 + rssi).
++ * There are some other slight factors to take into account
++ * depending on whether the rssi measurement is from 11b,
++ * 11g, or 11a. These differences are at most 2db and
++ * can be documented.
++ *
++ * NB: various calculations are based on the orinoco/wavelan
++ * drivers for compatibility
++ */
++static void
++ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi)
++{
++ if (rssi < 0) {
++ iq->qual = 0;
++ } else {
++ iq->qual = rssi;
+ }
+
-+ return status;
++ /* NB: max is 94 because noise is hardcoded to 161 */
++ if (iq->qual > 94)
++ iq->qual = 94;
+
++ iq->noise = 161; /* -95dBm */
++ iq->level = iq->noise + iq->qual;
++ iq->updated = 7;
+}
+
-+static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev)
-+{
-+ A_STATUS status;
-+ AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+ LOCK_AR6K(pDev);
-+
-+ /* Enable all the interrupts except for the dragon interrupt */
-+ pDev->IrqEnableRegisters.int_status_enable = INT_STATUS_ENABLE_ERROR_SET(0x01) |
-+ INT_STATUS_ENABLE_CPU_SET(0x01) |
-+ INT_STATUS_ENABLE_COUNTER_SET(0x01);
+
-+ if (NULL == pDev->GetPendingEventsFunc) {
-+ pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+ } else {
-+ /* The HIF layer provided us with a pending events function which means that
-+ * the detection of pending mbox messages is handled in the HIF layer.
-+ * This is the case for the SPI2 interface.
-+ * In the normal case we enable MBOX interrupts, for the case
-+ * with HIFs that offer this mechanism, we keep these interrupts
-+ * masked */
-+ pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+ }
++/* Structures to export the Wireless Handlers */
++static const iw_handler ath_handlers[] = {
++ (iw_handler) NULL, /* SIOCSIWCOMMIT */
++ (iw_handler) ar6000_ioctl_giwname, /* SIOCGIWNAME */
++ (iw_handler) NULL, /* SIOCSIWNWID */
++ (iw_handler) NULL, /* SIOCGIWNWID */
++ (iw_handler) ar6000_ioctl_siwfreq, /* SIOCSIWFREQ */
++ (iw_handler) ar6000_ioctl_giwfreq, /* SIOCGIWFREQ */
++ (iw_handler) ar6000_ioctl_siwmode, /* SIOCSIWMODE */
++ (iw_handler) ar6000_ioctl_giwmode, /* SIOCGIWMODE */
++ (iw_handler) ar6000_ioctl_siwsens, /* SIOCSIWSENS */
++ (iw_handler) ar6000_ioctl_giwsens, /* SIOCGIWSENS */
++ (iw_handler) NULL /* not _used */, /* SIOCSIWRANGE */
++ (iw_handler) ar6000_ioctl_giwrange, /* SIOCGIWRANGE */
++ (iw_handler) NULL /* not used */, /* SIOCSIWPRIV */
++ (iw_handler) NULL /* kernel code */, /* SIOCGIWPRIV */
++ (iw_handler) NULL /* not used */, /* SIOCSIWSTATS */
++ (iw_handler) NULL /* kernel code */, /* SIOCGIWSTATS */
++ (iw_handler) NULL, /* SIOCSIWSPY */
++ (iw_handler) NULL, /* SIOCGIWSPY */
++ (iw_handler) NULL, /* SIOCSIWTHRSPY */
++ (iw_handler) NULL, /* SIOCGIWTHRSPY */
++ (iw_handler) ar6000_ioctl_siwap, /* SIOCSIWAP */
++ (iw_handler) ar6000_ioctl_giwap, /* SIOCGIWAP */
++ (iw_handler) NULL, /* -- hole -- */
++ (iw_handler) ar6000_ioctl_iwaplist, /* SIOCGIWAPLIST */
++ (iw_handler) ar6000_ioctl_siwscan, /* SIOCSIWSCAN */
++ (iw_handler) ar6000_ioctl_giwscan, /* SIOCGIWSCAN */
++ (iw_handler) ar6000_ioctl_siwessid, /* SIOCSIWESSID */
++ (iw_handler) ar6000_ioctl_giwessid, /* SIOCGIWESSID */
++ (iw_handler) NULL, /* SIOCSIWNICKN */
++ (iw_handler) NULL, /* SIOCGIWNICKN */
++ (iw_handler) NULL, /* -- hole -- */
++ (iw_handler) NULL, /* -- hole -- */
++ (iw_handler) ar6000_ioctl_siwrate, /* SIOCSIWRATE */
++ (iw_handler) ar6000_ioctl_giwrate, /* SIOCGIWRATE */
++ (iw_handler) NULL, /* SIOCSIWRTS */
++ (iw_handler) NULL, /* SIOCGIWRTS */
++ (iw_handler) NULL, /* SIOCSIWFRAG */
++ (iw_handler) NULL, /* SIOCGIWFRAG */
++ (iw_handler) ar6000_ioctl_siwtxpow, /* SIOCSIWTXPOW */
++ (iw_handler) ar6000_ioctl_giwtxpow, /* SIOCGIWTXPOW */
++ (iw_handler) ar6000_ioctl_siwretry, /* SIOCSIWRETRY */
++ (iw_handler) ar6000_ioctl_giwretry, /* SIOCGIWRETRY */
++ (iw_handler) ar6000_ioctl_siwencode, /* SIOCSIWENCODE */
++ (iw_handler) ar6000_ioctl_giwencode, /* SIOCGIWENCODE */
++ (iw_handler) ar6000_ioctl_siwpower, /* SIOCSIWPOWER */
++ (iw_handler) ar6000_ioctl_giwpower, /* SIOCGIWPOWER */
++ (iw_handler) NULL, /* -- hole -- */
++ (iw_handler) NULL, /* -- hole -- */
++ (iw_handler) ar6000_ioctl_siwgenie, /* SIOCSIWGENIE */
++ (iw_handler) ar6000_ioctl_giwgenie, /* SIOCGIWGENIE */
++ (iw_handler) ar6000_ioctl_siwauth, /* SIOCSIWAUTH */
++ (iw_handler) ar6000_ioctl_giwauth, /* SIOCGIWAUTH */
++ (iw_handler) ar6000_ioctl_siwencodeext,/* SIOCSIWENCODEEXT */
++ (iw_handler) ar6000_ioctl_giwencodeext,/* SIOCGIWENCODEEXT */
++ (iw_handler) NULL, /* SIOCSIWPMKSA */
++};
+
++static const iw_handler ath_priv_handlers[] = {
++ (iw_handler) ar6000_ioctl_setparam, /* SIOCWFIRSTPRIV+0 */
++ (iw_handler) ar6000_ioctl_getparam, /* SIOCWFIRSTPRIV+1 */
++ (iw_handler) ar6000_ioctl_setkey, /* SIOCWFIRSTPRIV+2 */
++ (iw_handler) ar6000_ioctl_setwmmparams, /* SIOCWFIRSTPRIV+3 */
++ (iw_handler) ar6000_ioctl_delkey, /* SIOCWFIRSTPRIV+4 */
++ (iw_handler) ar6000_ioctl_getwmmparams, /* SIOCWFIRSTPRIV+5 */
++ (iw_handler) ar6000_ioctl_setoptie, /* SIOCWFIRSTPRIV+6 */
++ (iw_handler) ar6000_ioctl_setmlme, /* SIOCWFIRSTPRIV+7 */
++ (iw_handler) ar6000_ioctl_addpmkid, /* SIOCWFIRSTPRIV+8 */
++};
+
-+ /* Set up the CPU Interrupt Status Register */
-+ pDev->IrqEnableRegisters.cpu_int_status_enable = CPU_INT_STATUS_ENABLE_BIT_SET(0x00);
++#define IW_PRIV_TYPE_KEY \
++ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_key))
++#define IW_PRIV_TYPE_DELKEY \
++ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_del_key))
++#define IW_PRIV_TYPE_MLME \
++ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_mlme))
++#define IW_PRIV_TYPE_ADDPMKID \
++ (IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_addpmkid))
+
-+ /* Set up the Error Interrupt Status Register */
-+ pDev->IrqEnableRegisters.error_status_enable =
-+ ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(0x01) |
-+ ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(0x01);
++static const struct iw_priv_args ar6000_priv_args[] = {
++ { IEEE80211_IOCTL_SETKEY,
++ IW_PRIV_TYPE_KEY | IW_PRIV_SIZE_FIXED, 0, "setkey"},
++ { IEEE80211_IOCTL_DELKEY,
++ IW_PRIV_TYPE_DELKEY | IW_PRIV_SIZE_FIXED, 0, "delkey"},
++ { IEEE80211_IOCTL_SETPARAM,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "setparam"},
++ { IEEE80211_IOCTL_GETPARAM,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getparam"},
++ { IEEE80211_IOCTL_SETWMMPARAMS,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 4, 0, "setwmmparams"},
++ { IEEE80211_IOCTL_GETWMMPARAMS,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3,
++ IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "getwmmparams"},
++ { IEEE80211_IOCTL_SETOPTIE,
++ IW_PRIV_TYPE_BYTE, 0, "setie"},
++ { IEEE80211_IOCTL_SETMLME,
++ IW_PRIV_TYPE_MLME, 0, "setmlme"},
++ { IEEE80211_IOCTL_ADDPMKID,
++ IW_PRIV_TYPE_ADDPMKID | IW_PRIV_SIZE_FIXED, 0, "addpmkid"},
++};
+
-+ /* Set up the Counter Interrupt Status Register (only for debug interrupt to catch fatal errors) */
-+ pDev->IrqEnableRegisters.counter_int_status_enable =
-+ COUNTER_INT_STATUS_ENABLE_BIT_SET(AR6K_TARGET_DEBUG_INTR_MASK);
++void ar6000_ioctl_iwsetup(struct iw_handler_def *def)
++{
++ def->private_args = (struct iw_priv_args *)ar6000_priv_args;
++ def->num_private_args = ARRAY_SIZE(ar6000_priv_args);
++}
+
-+ /* copy into our temp area */
-+ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
++struct iw_handler_def ath_iw_handler_def = {
++ .standard = (iw_handler *)ath_handlers,
++ .num_standard = ARRAY_SIZE(ath_handlers),
++ .private = (iw_handler *)ath_priv_handlers,
++ .num_private = ARRAY_SIZE(ath_priv_handlers),
++};
+
-+ UNLOCK_AR6K(pDev);
+
-+ /* always synchronous */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ INT_STATUS_ENABLE_ADDRESS,
-+ ®s.int_status_enable,
-+ AR6K_IRQ_ENABLE_REGS_SIZE,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
+diff --git a/drivers/ar6000/bmi/bmi.c b/drivers/ar6000/bmi/bmi.c
+new file mode 100644
+index 0000000..d7b610c
+--- /dev/null
++++ b/drivers/ar6000/bmi/bmi.c
+@@ -0,0 +1,657 @@
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ if (status != A_OK) {
-+ /* Can't write it for some reason */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("Failed to update interrupt control registers err: %d\n", status));
++#include "hif.h"
++#include "bmi.h"
++#include "htc_api.h"
++#include "bmi_internal.h"
+
-+ }
++/*
++Although we had envisioned BMI to run on top of HTC, this is not what the
++final implementation boiled down to on dragon. Its a part of BSP and does
++not use the HTC protocol either. On the host side, however, we were still
++living with the original idea. I think the time has come to accept the truth
++and separate it from HTC which has been carrying BMI's burden all this while.
++It shall make HTC state machine relatively simpler
++*/
+
-+ return status;
++/* APIs visible to the driver */
++void
++BMIInit(void)
++{
++ bmiDone = FALSE;
+}
+
-+static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev)
++A_STATUS
++BMIDone(HIF_DEVICE *device)
+{
-+ AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+ LOCK_AR6K(pDev);
-+ /* Disable all interrupts */
-+ pDev->IrqEnableRegisters.int_status_enable = 0;
-+ pDev->IrqEnableRegisters.cpu_int_status_enable = 0;
-+ pDev->IrqEnableRegisters.error_status_enable = 0;
-+ pDev->IrqEnableRegisters.counter_int_status_enable = 0;
-+ /* copy into our temp area */
-+ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
++ A_STATUS status;
++ A_UINT32 cid;
+
-+ UNLOCK_AR6K(pDev);
++ if (bmiDone) {
++ AR_DEBUG_PRINTF (ATH_DEBUG_BMI, ("BMIDone skipped\n"));
++ return A_OK;
++ }
+
-+ /* always synchronous */
-+ return HIFReadWrite(pDev->HIFDevice,
-+ INT_STATUS_ENABLE_ADDRESS,
-+ ®s.int_status_enable,
-+ AR6K_IRQ_ENABLE_REGS_SIZE,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
-+}
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Enter (device: 0x%p)\n", device));
++ bmiDone = TRUE;
++ cid = BMI_DONE;
+
-+/* enable device interrupts */
-+A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev)
-+{
-+ /* Unmask the host controller interrupts */
-+ HIFUnMaskInterrupt(pDev->HIFDevice);
++ status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
++ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Done: Exit\n"));
+
-+ return DevEnableInterrupts(pDev);
++ return A_OK;
+}
+
-+/* disable all device interrupts */
-+A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev)
++A_STATUS
++BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info)
+{
+ A_STATUS status;
++ A_UINT32 cid;
+
-+ status = DevDisableInterrupts(pDev);
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+ if (A_SUCCESS(status)) {
-+ /* Disable the interrupt at the HIF layer */
-+ HIFMaskInterrupt(pDev->HIFDevice);
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Enter (device: 0x%p)\n", device));
++ cid = BMI_GET_TARGET_INFO;
++
++ status = bmiBufferSend(device, (A_UCHAR *)&cid, sizeof(cid));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
+
-+ return status;
-+}
++ status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_ver,
++ sizeof(targ_info->target_ver));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Version from the device\n"));
++ return A_ERROR;
++ }
+
-+/* callback when our fetch to enable/disable completes */
-+static void DevDoEnableDisableRecvAsyncHandler(void *Context, HTC_PACKET *pPacket)
-+{
-+ AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
++ if (targ_info->target_ver == TARGET_VERSION_SENTINAL) {
++ /* Determine how many bytes are in the Target's targ_info */
++ status = bmiBufferReceive(device, (A_UCHAR *)&targ_info->target_info_byte_count,
++ sizeof(targ_info->target_info_byte_count));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info Byte Count from the device\n"));
++ return A_ERROR;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDoEnableDisableRecvAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
++ /*
++ * The Target's targ_info doesn't match the Host's targ_info.
++ * We need to do some backwards compatibility work to make this OK.
++ */
++ A_ASSERT(targ_info->target_info_byte_count == sizeof(*targ_info));
+
-+ if (A_FAILED(pPacket->Status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" Failed to disable receiver, status:%d \n", pPacket->Status));
++ /* Read the remainder of the targ_info */
++ status = bmiBufferReceive(device,
++ ((A_UCHAR *)targ_info)+sizeof(targ_info->target_info_byte_count),
++ sizeof(*targ_info)-sizeof(targ_info->target_info_byte_count));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read Target Info (%d bytes) from the device\n",
++ targ_info->target_info_byte_count));
++ return A_ERROR;
++ }
++ } else {
++ /*
++ * Target must be an AR6001 whose firmware does not
++ * support BMI_GET_TARGET_INFO. Construct the data
++ * that it would have sent.
++ */
++ targ_info->target_info_byte_count = sizeof(targ_info);
++ targ_info->target_type = TARGET_TYPE_AR6001;
+ }
-+ /* free this IO packet */
-+ AR6KFreeIOPacket(pDev,pPacket);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDoEnableDisableRecvAsyncHandler \n"));
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
++ targ_info->target_ver, targ_info->target_type));
++ printk("BMI Get Target Info: Exit (ver: 0x%x type: 0x%x)\n",
++ targ_info->target_ver, targ_info->target_type);
++
++ return A_OK;
+}
+
-+/* disable packet reception (used in case the host runs out of buffers)
-+ * this is the "override" method when the HIF reports another methods to
-+ * disable recv events */
-+static A_STATUS DevDoEnableDisableRecvOverride(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
++A_STATUS
++BMIReadMemory(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length)
+{
-+ A_STATUS status = A_OK;
-+ HTC_PACKET *pIOPacket = NULL;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("DevDoEnableDisableRecvOverride: Enable:%d Mode:%d\n",
-+ EnableRecv,AsyncMode));
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ A_UINT32 remaining, rxlen;
++ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
++ memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length));
+
-+ do {
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+ if (AsyncMode) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Read Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
++ device, address, length));
+
-+ pIOPacket = AR6KAllocIOPacket(pDev);
++ cid = BMI_READ_MEMORY;
+
-+ if (NULL == pIOPacket) {
-+ status = A_NO_MEMORY;
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ remaining = length;
+
-+ /* stick in our completion routine when the I/O operation completes */
-+ pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
-+ pIOPacket->pContext = pDev;
++ while (remaining)
++ {
++ rxlen = (remaining < BMI_DATASZ_MAX) ? remaining : BMI_DATASZ_MAX;
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
++ A_MEMCPY(&data[offset], &rxlen, sizeof(rxlen));
++ offset += sizeof(length);
+
-+ /* call the HIF layer override and do this asynchronously */
-+ status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
-+ EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
-+ pIOPacket);
-+ break;
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
-+
-+ /* if we get here we are doing it synchronously */
-+ status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
-+ EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
-+ NULL);
-+
-+ } while (FALSE);
-+
-+ if (A_FAILED(status) && (pIOPacket != NULL)) {
-+ AR6KFreeIOPacket(pDev,pIOPacket);
++ status = bmiBufferReceive(device, data, rxlen);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
++ return A_ERROR;
++ }
++ A_MEMCPY(&buffer[length - remaining], data, rxlen);
++ remaining -= rxlen; address += rxlen;
+ }
+
-+ return status;
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read Memory: Exit\n"));
++ return A_OK;
+}
+
-+/* disable packet reception (used in case the host runs out of buffers)
-+ * this is the "normal" method using the interrupt enable registers through
-+ * the host I/F */
-+static A_STATUS DevDoEnableDisableRecvNormal(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
++A_STATUS
++BMIWriteMemory(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length)
+{
-+ A_STATUS status = A_OK;
-+ HTC_PACKET *pIOPacket = NULL;
-+ AR6K_IRQ_ENABLE_REGISTERS regs;
-+
-+ /* take the lock to protect interrupt enable shadows */
-+ LOCK_AR6K(pDev);
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ A_UINT32 remaining, txlen;
++ const A_UINT32 header = sizeof(cid) + sizeof(address) + sizeof(length);
++ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(address) + sizeof(length)];
++ memset (&data, 0, header);
+
-+ if (EnableRecv) {
-+ pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
-+ } else {
-+ pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
+ }
+
-+ /* copy into our temp area */
-+ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
-+ UNLOCK_AR6K(pDev);
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Write Memory: Enter (device: 0x%p, address: 0x%x, length: %d)\n",
++ device, address, length));
+
-+ do {
++ cid = BMI_WRITE_MEMORY;
+
-+ if (AsyncMode) {
++ remaining = length;
++ while (remaining)
++ {
++ txlen = (remaining < (BMI_DATASZ_MAX - header)) ?
++ remaining : (BMI_DATASZ_MAX - header);
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
++ A_MEMCPY(&data[offset], &txlen, sizeof(txlen));
++ offset += sizeof(txlen);
++ A_MEMCPY(&data[offset], &buffer[length - remaining], txlen);
++ offset += txlen;
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
++ }
++ remaining -= txlen; address += txlen;
++ }
+
-+ pIOPacket = AR6KAllocIOPacket(pDev);
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Write Memory: Exit\n"));
+
-+ if (NULL == pIOPacket) {
-+ status = A_NO_MEMORY;
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ return A_OK;
++}
+
-+ /* copy values to write to our async I/O buffer */
-+ A_MEMCPY(pIOPacket->pBuffer,®s,AR6K_IRQ_ENABLE_REGS_SIZE);
-+
-+ /* stick in our completion routine when the I/O operation completes */
-+ pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
-+ pIOPacket->pContext = pDev;
-+
-+ /* write it out asynchronously */
-+ HIFReadWrite(pDev->HIFDevice,
-+ INT_STATUS_ENABLE_ADDRESS,
-+ pIOPacket->pBuffer,
-+ AR6K_IRQ_ENABLE_REGS_SIZE,
-+ HIF_WR_ASYNC_BYTE_INC,
-+ pIOPacket);
-+ break;
-+ }
++A_STATUS
++BMIExecute(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 *param)
++{
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(*param)];
++ memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(*param));
+
-+ /* if we get here we are doing it synchronously */
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ INT_STATUS_ENABLE_ADDRESS,
-+ ®s.int_status_enable,
-+ AR6K_IRQ_ENABLE_REGS_SIZE,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Execute: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
++ device, address, *param));
+
-+ } while (FALSE);
++ cid = BMI_EXECUTE;
+
-+ if (A_FAILED(status) && (pIOPacket != NULL)) {
-+ AR6KFreeIOPacket(pDev,pIOPacket);
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
++ A_MEMCPY(&data[offset], param, sizeof(*param));
++ offset += sizeof(*param);
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
+
-+ return status;
-+}
++ status = bmiBufferReceive(device, data, sizeof(*param));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
++ return A_ERROR;
++ }
+
++ A_MEMCPY(param, data, sizeof(*param));
+
-+A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
-+{
-+ if (NULL == pDev->HifMaskUmaskRecvEvent) {
-+ return DevDoEnableDisableRecvNormal(pDev,FALSE,AsyncMode);
-+ } else {
-+ return DevDoEnableDisableRecvOverride(pDev,FALSE,AsyncMode);
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Execute: Exit (param: %d)\n", *param));
++ return A_OK;
+}
+
-+A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
++A_STATUS
++BMISetAppStart(HIF_DEVICE *device,
++ A_UINT32 address)
+{
-+ if (NULL == pDev->HifMaskUmaskRecvEvent) {
-+ return DevDoEnableDisableRecvNormal(pDev,TRUE,AsyncMode);
-+ } else {
-+ return DevDoEnableDisableRecvOverride(pDev,TRUE,AsyncMode);
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(address)];
++ memset (&data, 0, sizeof(cid) + sizeof(address));
++
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
+ }
-+}
+
-+void DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS *pIrqProcRegs,
-+ AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs)
-+{
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Set App Start: Enter (device: 0x%p, address: 0x%x)\n",
++ device, address));
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("\n<------- Register Table -------->\n"));
++ cid = BMI_SET_APP_START;
+
-+ if (pIrqProcRegs != NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Int Status: 0x%x\n",pIrqProcRegs->host_int_status));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("CPU Int Status: 0x%x\n",pIrqProcRegs->cpu_int_status));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Error Int Status: 0x%x\n",pIrqProcRegs->error_int_status));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Counter Int Status: 0x%x\n",pIrqProcRegs->counter_int_status));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Mbox Frame: 0x%x\n",pIrqProcRegs->mbox_frame));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Rx Lookahead Valid: 0x%x\n",pIrqProcRegs->rx_lookahead_valid));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Rx Lookahead 0: 0x%x\n",pIrqProcRegs->rx_lookahead[0]));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Rx Lookahead 1: 0x%x\n",pIrqProcRegs->rx_lookahead[1]));
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
+
-+ if (pIrqEnableRegs != NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Int Status Enable: 0x%x\n",pIrqEnableRegs->int_status_enable));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
-+ ("Counter Int Status Enable: 0x%x\n",pIrqEnableRegs->counter_int_status_enable));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("<------------------------------->\n"));
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Set App Start: Exit\n"));
++ return A_OK;
+}
+
++A_STATUS
++BMIReadSOCRegister(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 *param)
++{
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(address)];
++ memset (&data, 0, sizeof(cid) + sizeof(address));
+
-+#ifdef MBOXHW_UNIT_TEST
-+
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+/* This is a mailbox hardware unit test that must be called in a schedulable context
-+ * This test is very simple, it will send a list of buffers with a counting pattern
-+ * and the target will invert the data and send the message back
-+ *
-+ * the unit test has the following constraints:
-+ *
-+ * The target has at least 8 buffers of 256 bytes each. The host will send
-+ * the following pattern of buffers in rapid succession :
-+ *
-+ * 1 buffer - 128 bytes
-+ * 1 buffer - 256 bytes
-+ * 1 buffer - 512 bytes
-+ * 1 buffer - 1024 bytes
-+ *
-+ * The host will send the buffers to one mailbox and wait for buffers to be reflected
-+ * back from the same mailbox. The target sends the buffers FIFO order.
-+ * Once the final buffer has been received for a mailbox, the next mailbox is tested.
-+ *
-+ *
-+ * Note: To simplifythe test , we assume that the chosen buffer sizes
-+ * will fall on a nice block pad
-+ *
-+ * It is expected that higher-order tests will be written to stress the mailboxes using
-+ * a message-based protocol (with some performance timming) that can create more
-+ * randomness in the packets sent over mailboxes.
-+ *
-+ * */
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Read SOC Register: Enter (device: 0x%p, address: 0x%x)\n",
++ device, address));
+
-+#define A_ROUND_UP_PWR2(x, align) (((int) (x) + ((align)-1)) & ~((align)-1))
++ cid = BMI_READ_SOC_REGISTER;
+
-+#define BUFFER_BLOCK_PAD 128
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
+
-+#if 0
-+#define BUFFER1 128
-+#define BUFFER2 256
-+#define BUFFER3 512
-+#define BUFFER4 1024
-+#endif
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
++ }
+
-+#if 1
-+#define BUFFER1 80
-+#define BUFFER2 200
-+#define BUFFER3 444
-+#define BUFFER4 800
-+#endif
++ status = bmiBufferReceive(device, data, sizeof(*param));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
++ return A_ERROR;
++ }
++ A_MEMCPY(param, data, sizeof(*param));
+
-+#define TOTAL_BYTES (A_ROUND_UP_PWR2(BUFFER1,BUFFER_BLOCK_PAD) + \
-+ A_ROUND_UP_PWR2(BUFFER2,BUFFER_BLOCK_PAD) + \
-+ A_ROUND_UP_PWR2(BUFFER3,BUFFER_BLOCK_PAD) + \
-+ A_ROUND_UP_PWR2(BUFFER4,BUFFER_BLOCK_PAD) )
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit (value: %d)\n", *param));
++ return A_OK;
++}
+
-+#define TEST_BYTES (BUFFER1 + BUFFER2 + BUFFER3 + BUFFER4)
++A_STATUS
++BMIWriteSOCRegister(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 param)
++{
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(address) + sizeof(param)];
+
-+#define TEST_CREDITS_RECV_TIMEOUT 100
++ memset (&data, 0, sizeof(cid) + sizeof(address) + sizeof(param));
+
-+static A_UINT8 g_Buffer[TOTAL_BYTES];
-+static A_UINT32 g_MailboxAddrs[AR6K_MAILBOXES];
-+static A_UINT32 g_BlockSizes[AR6K_MAILBOXES];
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+#define BUFFER_PROC_LIST_DEPTH 4
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Write SOC Register: Enter (device: 0x%p, address: 0x%x, param: %d)\n",
++ device, address, param));
+
-+typedef struct _BUFFER_PROC_LIST{
-+ A_UINT8 *pBuffer;
-+ A_UINT32 length;
-+}BUFFER_PROC_LIST;
++ cid = BMI_WRITE_SOC_REGISTER;
+
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &address, sizeof(address));
++ offset += sizeof(address);
++ A_MEMCPY(&data[offset], ¶m, sizeof(param));
++ offset += sizeof(param);
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
++ }
+
-+#define PUSH_BUFF_PROC_ENTRY(pList,len,pCurrpos) \
-+{ \
-+ (pList)->pBuffer = (pCurrpos); \
-+ (pList)->length = (len); \
-+ (pCurrpos) += (len); \
-+ (pList)++; \
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Read SOC Register: Exit\n"));
++ return A_OK;
+}
+
-+/* a simple and crude way to send different "message" sizes */
-+static void AssembleBufferList(BUFFER_PROC_LIST *pList)
++A_STATUS
++BMIrompatchInstall(HIF_DEVICE *device,
++ A_UINT32 ROM_addr,
++ A_UINT32 RAM_addr,
++ A_UINT32 nbytes,
++ A_UINT32 do_activate,
++ A_UINT32 *rompatch_id)
+{
-+ A_UINT8 *pBuffer = g_Buffer;
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
++ sizeof(nbytes) + sizeof(do_activate)];
+
-+#if BUFFER_PROC_LIST_DEPTH < 4
-+#error "Buffer processing list depth is not deep enough!!"
-+#endif
++ memset (&data, 0, sizeof(cid) + sizeof(ROM_addr) + sizeof(RAM_addr) +
++ sizeof(nbytes) + sizeof(do_activate));
+
-+ PUSH_BUFF_PROC_ENTRY(pList,BUFFER1,pBuffer);
-+ PUSH_BUFF_PROC_ENTRY(pList,BUFFER2,pBuffer);
-+ PUSH_BUFF_PROC_ENTRY(pList,BUFFER3,pBuffer);
-+ PUSH_BUFF_PROC_ENTRY(pList,BUFFER4,pBuffer);
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+}
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI rompatch Install: Enter (device: 0x%p, ROMaddr: 0x%x, RAMaddr: 0x%x length: %d activate: %d)\n",
++ device, ROM_addr, RAM_addr, nbytes, do_activate));
+
-+#define FILL_ZERO TRUE
-+#define FILL_COUNTING FALSE
-+static void InitBuffers(A_BOOL Zero)
-+{
-+ A_UINT16 *pBuffer16 = (A_UINT16 *)g_Buffer;
-+ int i;
++ cid = BMI_ROMPATCH_INSTALL;
+
-+ /* fill buffer with 16 bit counting pattern or zeros */
-+ for (i = 0; i < (TOTAL_BYTES / 2) ; i++) {
-+ if (!Zero) {
-+ pBuffer16[i] = (A_UINT16)i;
-+ } else {
-+ pBuffer16[i] = 0;
-+ }
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &ROM_addr, sizeof(ROM_addr));
++ offset += sizeof(ROM_addr);
++ A_MEMCPY(&data[offset], &RAM_addr, sizeof(RAM_addr));
++ offset += sizeof(RAM_addr);
++ A_MEMCPY(&data[offset], &nbytes, sizeof(nbytes));
++ offset += sizeof(nbytes);
++ A_MEMCPY(&data[offset], &do_activate, sizeof(do_activate));
++ offset += sizeof(do_activate);
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
-+}
-+
+
-+static A_BOOL CheckOneBuffer(A_UINT16 *pBuffer16, int Length)
-+{
-+ int i;
-+ A_UINT16 startCount;
-+ A_BOOL success = TRUE;
-+
-+ /* get the starting count */
-+ startCount = pBuffer16[0];
-+ /* invert it, this is the expected value */
-+ startCount = ~startCount;
-+ /* scan the buffer and verify */
-+ for (i = 0; i < (Length / 2) ; i++,startCount++) {
-+ /* target will invert all the data */
-+ if ((A_UINT16)pBuffer16[i] != (A_UINT16)~startCount) {
-+ success = FALSE;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Data Got:0x%X, Expecting:0x%X (offset:%d, total:%d) \n",
-+ pBuffer16[i], ((A_UINT16)~startCount), i, Length));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("0x%X 0x%X 0x%X 0x%X \n",
-+ pBuffer16[i], pBuffer16[i + 1], pBuffer16[i + 2],pBuffer16[i+3]));
-+ break;
-+ }
++ status = bmiBufferReceive(device, (A_UCHAR *)rompatch_id, sizeof(*rompatch_id));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read from the device\n"));
++ return A_ERROR;
+ }
+
-+ return success;
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch Install: (rompatch_id=%d)\n", *rompatch_id));
++ return A_OK;
+}
+
-+static A_BOOL CheckBuffers(void)
++A_STATUS
++BMIrompatchUninstall(HIF_DEVICE *device,
++ A_UINT32 rompatch_id)
+{
-+ int i;
-+ A_BOOL success = TRUE;
-+ BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
-+
-+ /* assemble the list */
-+ AssembleBufferList(checkList);
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[sizeof(cid) + sizeof(rompatch_id)];
++ memset (&data, 0, sizeof(cid) + sizeof(rompatch_id));
+
-+ /* scan the buffers and verify */
-+ for (i = 0; i < BUFFER_PROC_LIST_DEPTH ; i++) {
-+ success = CheckOneBuffer((A_UINT16 *)checkList[i].pBuffer, checkList[i].length);
-+ if (!success) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer : 0x%X, Length:%d failed verify \n",
-+ (A_UINT32)checkList[i].pBuffer, checkList[i].length));
-+ break;
-+ }
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
+ }
+
-+ return success;
-+}
-+
-+ /* find the end marker for the last buffer we will be sending */
-+static A_UINT16 GetEndMarker(void)
-+{
-+ A_UINT8 *pBuffer;
-+ BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI rompatch Uninstall: Enter (device: 0x%p, rompatch_id: %d)\n",
++ device, rompatch_id));
+
-+ /* fill up buffers with the normal counting pattern */
-+ InitBuffers(FILL_COUNTING);
++ cid = BMI_ROMPATCH_UNINSTALL;
+
-+ /* assemble the list we will be sending down */
-+ AssembleBufferList(checkList);
-+ /* point to the last 2 bytes of the last buffer */
-+ pBuffer = &(checkList[BUFFER_PROC_LIST_DEPTH - 1].pBuffer[(checkList[BUFFER_PROC_LIST_DEPTH - 1].length) - 2]);
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &rompatch_id, sizeof(rompatch_id));
++ offset += sizeof(rompatch_id);
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
++ }
+
-+ /* the last count in the last buffer is the marker */
-+ return (A_UINT16)pBuffer[0] | ((A_UINT16)pBuffer[1] << 8);
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI rompatch UNinstall: (rompatch_id=0x%x)\n", rompatch_id));
++ return A_OK;
+}
+
-+#define ATH_PRINT_OUT_ZONE ATH_DEBUG_ERR
-+
-+/* send the ordered buffers to the target */
-+static A_STATUS SendBuffers(AR6K_DEVICE *pDev, int mbox)
++static A_STATUS
++_BMIrompatchChangeActivation(HIF_DEVICE *device,
++ A_UINT32 rompatch_count,
++ A_UINT32 *rompatch_list,
++ A_UINT32 do_activate)
+{
-+ A_STATUS status = A_OK;
-+ A_UINT32 request = HIF_WR_SYNC_BLOCK_INC;
-+ BUFFER_PROC_LIST sendList[BUFFER_PROC_LIST_DEPTH];
-+ int i;
-+ int totalBytes = 0;
-+ int paddedLength;
-+ int totalwPadding = 0;
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sending buffers on mailbox : %d \n",mbox));
++ A_UINT32 cid;
++ A_STATUS status;
++ A_UINT32 offset;
++ static A_UCHAR data[BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count)];
++ A_UINT32 length;
+
-+ /* fill buffer with counting pattern */
-+ InitBuffers(FILL_COUNTING);
++ memset (&data, 0, BMI_DATASZ_MAX + sizeof(cid) + sizeof(rompatch_count));
+
-+ /* assemble the order in which we send */
-+ AssembleBufferList(sendList);
++ if (bmiDone) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Command disallowed\n"));
++ return A_ERROR;
++ }
+
-+ for (i = 0; i < BUFFER_PROC_LIST_DEPTH; i++) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI,
++ ("BMI Change rompatch Activation: Enter (device: 0x%p, count: %d)\n",
++ device, rompatch_count));
+
-+ /* we are doing block transfers, so we need to pad everything to a block size */
-+ paddedLength = (sendList[i].length + (g_BlockSizes[mbox] - 1)) &
-+ (~(g_BlockSizes[mbox] - 1));
++ cid = do_activate ? BMI_ROMPATCH_ACTIVATE : BMI_ROMPATCH_DEACTIVATE;
+
-+ /* send each buffer synchronously */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ g_MailboxAddrs[mbox],
-+ sendList[i].pBuffer,
-+ paddedLength,
-+ request,
-+ NULL);
-+ if (status != A_OK) {
-+ break;
-+ }
-+ totalBytes += sendList[i].length;
-+ totalwPadding += paddedLength;
++ offset = 0;
++ A_MEMCPY(&data[offset], &cid, sizeof(cid));
++ offset += sizeof(cid);
++ A_MEMCPY(&data[offset], &rompatch_count, sizeof(rompatch_count));
++ offset += sizeof(rompatch_count);
++ length = rompatch_count * sizeof(*rompatch_list);
++ A_MEMCPY(&data[offset], rompatch_list, length);
++ offset += length;
++ status = bmiBufferSend(device, data, offset);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to write to the device\n"));
++ return A_ERROR;
+ }
+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sent %d bytes (%d padded bytes) to mailbox : %d \n",totalBytes,totalwPadding,mbox));
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Change rompatch Activation: Exit\n"));
+
-+ return status;
++ return A_OK;
+}
+
-+/* poll the mailbox credit counter until we get a credit or timeout */
-+static A_STATUS GetCredits(AR6K_DEVICE *pDev, int mbox, int *pCredits)
++A_STATUS
++BMIrompatchActivate(HIF_DEVICE *device,
++ A_UINT32 rompatch_count,
++ A_UINT32 *rompatch_list)
+{
-+ A_STATUS status = A_OK;
-+ int timeout = TEST_CREDITS_RECV_TIMEOUT;
-+ A_UINT8 credits = 0;
-+ A_UINT32 address;
++ return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 1);
++}
+
-+ while (TRUE) {
++A_STATUS
++BMIrompatchDeactivate(HIF_DEVICE *device,
++ A_UINT32 rompatch_count,
++ A_UINT32 *rompatch_list)
++{
++ return _BMIrompatchChangeActivation(device, rompatch_count, rompatch_list, 0);
++}
+
-+ /* Read the counter register to get credits, this auto-decrements */
-+ address = COUNT_DEC_ADDRESS + (AR6K_MAILBOXES + mbox) * 4;
-+ status = HIFReadWrite(pDev->HIFDevice, address, &credits, sizeof(credits),
-+ HIF_RD_SYNC_BYTE_FIX, NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("Unable to decrement the command credit count register (mbox=%d)\n",mbox));
-+ status = A_ERROR;
-+ break;
-+ }
-+
-+ if (credits) {
-+ break;
-+ }
-+
-+ timeout--;
-+
-+ if (timeout <= 0) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" Timeout reading credit registers (mbox=%d, address:0x%X) \n",mbox,address));
-+ status = A_ERROR;
-+ break;
-+ }
-+
-+ /* delay a little, target may not be ready */
-+ msleep(1000);
-+
-+ }
-+
-+ if (status == A_OK) {
-+ *pCredits = credits;
-+ }
-+
-+ return status;
-+}
-+
-+
-+/* wait for the buffers to come back */
-+static A_STATUS RecvBuffers(AR6K_DEVICE *pDev, int mbox)
++/* BMI Access routines */
++A_STATUS
++bmiBufferSend(HIF_DEVICE *device,
++ A_UCHAR *buffer,
++ A_UINT32 length)
+{
-+ A_STATUS status = A_OK;
-+ A_UINT32 request = HIF_RD_SYNC_BLOCK_INC;
-+ BUFFER_PROC_LIST recvList[BUFFER_PROC_LIST_DEPTH];
-+ int curBuffer;
-+ int credits;
-+ int i;
-+ int totalBytes = 0;
-+ int paddedLength;
-+ int totalwPadding = 0;
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for buffers on mailbox : %d \n",mbox));
-+
-+ /* zero the buffers */
-+ InitBuffers(FILL_ZERO);
-+
-+ /* assemble the order in which we should receive */
-+ AssembleBufferList(recvList);
-+
-+ curBuffer = 0;
++ A_STATUS status;
++ A_UINT32 timeout;
++ A_UINT32 address;
++ static A_UINT32 cmdCredits;
++ A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
+
-+ while (curBuffer < BUFFER_PROC_LIST_DEPTH) {
++ HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
++ &mboxAddress, sizeof(mboxAddress));
+
-+ /* get number of buffers that have been completed, this blocks
-+ * until we get at least 1 credit or it times out */
-+ status = GetCredits(pDev, mbox, &credits);
++ cmdCredits = 0;
++ timeout = BMI_COMMUNICATION_TIMEOUT;
+
++ while(timeout-- && !cmdCredits) {
++ /* Read the counter register to get the command credits */
++ address = COUNT_DEC_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 4;
++ /* hit the credit counter with a 4-byte access, the first byte read will hit the counter and cause
++ * a decrement, while the remaining 3 bytes has no effect. The rationale behind this is to
++ * make all HIF accesses 4-byte aligned */
++ status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, 4,
++ HIF_RD_SYNC_BYTE_INC, NULL);
+ if (status != A_OK) {
-+ break;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got %d messages on mailbox : %d \n",credits, mbox));
-+
-+ /* get all the buffers that are sitting on the queue */
-+ for (i = 0; i < credits; i++) {
-+ AR_DEBUG_ASSERT(curBuffer < BUFFER_PROC_LIST_DEPTH);
-+ /* recv the current buffer synchronously, the buffers should come back in
-+ * order... with padding applied by the target */
-+ paddedLength = (recvList[curBuffer].length + (g_BlockSizes[mbox] - 1)) &
-+ (~(g_BlockSizes[mbox] - 1));
-+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ g_MailboxAddrs[mbox],
-+ recvList[curBuffer].pBuffer,
-+ paddedLength,
-+ request,
-+ NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to read %d bytes on mailbox:%d : address:0x%X \n",
-+ recvList[curBuffer].length, mbox, g_MailboxAddrs[mbox]));
-+ break;
-+ }
-+
-+ totalwPadding += paddedLength;
-+ totalBytes += recvList[curBuffer].length;
-+ curBuffer++;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to decrement the command credit count register\n"));
++ return A_ERROR;
+ }
++ /* the counter is only 8=bits, ignore anything in the upper 3 bytes */
++ cmdCredits &= 0xFF;
++ }
+
++ if (cmdCredits) {
++ address = mboxAddress[ENDPOINT1];
++ status = HIFReadWrite(device, address, buffer, length,
++ HIF_WR_SYNC_BYTE_INC, NULL);
+ if (status != A_OK) {
-+ break;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to send the BMI data to the device\n"));
++ return A_ERROR;
+ }
-+ /* go back and get some more */
-+ credits = 0;
-+ }
-+
-+ if (totalBytes != TEST_BYTES) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got all buffers on mbox:%d total recv :%d (w/Padding : %d) \n",
-+ mbox, totalBytes, totalwPadding));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI Communication timeout\n"));
++ return A_ERROR;
+ }
+
+ return status;
-+
-+
+}
+
-+static A_STATUS DoOneMboxHWTest(AR6K_DEVICE *pDev, int mbox)
++A_STATUS
++bmiBufferReceive(HIF_DEVICE *device,
++ A_UCHAR *buffer,
++ A_UINT32 length)
+{
+ A_STATUS status;
++ A_UINT32 address;
++ A_UINT32 timeout;
++ static A_UINT32 cmdCredits;
++ A_UINT32 mboxAddress[HTC_MAILBOX_NUM_MAX];
+
-+ do {
-+ /* send out buffers */
-+ status = SendBuffers(pDev,mbox);
++ HIFConfigureDevice(device, HIF_DEVICE_GET_MBOX_ADDR,
++ &mboxAddress, sizeof(mboxAddress));
+
++ cmdCredits = 0;
++ timeout = BMI_COMMUNICATION_TIMEOUT;
++ while(timeout-- && !cmdCredits) {
++ /* Read the counter register to get the command credits */
++ address = COUNT_ADDRESS + (HTC_MAILBOX_NUM_MAX + ENDPOINT1) * 1;
++ /* read the counter using a 4-byte read. Since the counter is NOT auto-decrementing,
++ * we can read this counter multiple times using a non-incrementing address mode.
++ * The rationale here is to make all HIF accesses a multiple of 4 bytes */
++ status = HIFReadWrite(device, address, (A_UINT8 *)&cmdCredits, sizeof(cmdCredits),
++ HIF_RD_SYNC_BYTE_FIX, NULL);
+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Sending buffers Failed : %d mbox:%d\n",status,mbox));
-+ break;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the command credit count register\n"));
++ return A_ERROR;
+ }
++ /* we did a 4-byte read to the same count register so mask off upper bytes */
++ cmdCredits &= 0xFF;
++ status = A_ERROR;
++ }
+
-+ /* go get them, this will block */
-+ status = RecvBuffers(pDev, mbox);
-+
++ if (cmdCredits) {
++ address = mboxAddress[ENDPOINT1];
++ status = HIFReadWrite(device, address, buffer, length,
++ HIF_RD_SYNC_BYTE_INC, NULL);
+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Recv buffers Failed : %d mbox:%d\n",status,mbox));
-+ break;
-+ }
-+
-+ /* check the returned data patterns */
-+ if (!CheckBuffers()) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer Verify Failed : mbox:%d\n",mbox));
-+ status = A_ERROR;
-+ break;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to read the BMI data from the device\n"));
++ return A_ERROR;
+ }
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" Send/Recv success! mailbox : %d \n",mbox));
-+
-+ } while (FALSE);
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_BMI, ("BMI Communication timeout\n"));
++ return A_ERROR;
++ }
+
+ return status;
+}
+diff --git a/drivers/ar6000/bmi/bmi_internal.h b/drivers/ar6000/bmi/bmi_internal.h
+new file mode 100644
+index 0000000..1e21354
+--- /dev/null
++++ b/drivers/ar6000/bmi/bmi_internal.h
+@@ -0,0 +1,45 @@
++#ifndef BMI_INTERNAL_H
++#define BMI_INTERNAL_H
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+/* here is where the test starts */
-+A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev)
-+{
-+ int i;
-+ A_STATUS status;
-+ int credits = 0;
-+ A_UINT8 params[4];
-+ int numBufs;
-+ int bufferSize;
-+ A_UINT16 temp;
-+
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest START - \n"));
-+
-+ do {
-+ /* get the addresses for all 4 mailboxes */
-+ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
-+ g_MailboxAddrs, sizeof(g_MailboxAddrs));
-+
-+ if (status != A_OK) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
-+
-+ /* get the block sizes */
-+ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+ g_BlockSizes, sizeof(g_BlockSizes));
-+
-+ if (status != A_OK) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
-+
-+ /* note, the HIF layer usually reports mbox 0 to have a block size of
-+ * 1, but our test wants to run in block-mode for all mailboxes, so we treat all mailboxes
-+ * the same. */
-+ g_BlockSizes[0] = g_BlockSizes[1];
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Block Size to use: %d \n",g_BlockSizes[0]));
-+
-+ if (g_BlockSizes[1] > BUFFER_BLOCK_PAD) {
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("%d Block size is too large for buffer pad %d\n",
-+ g_BlockSizes[1], BUFFER_BLOCK_PAD));
-+ break;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for target.... \n"));
-+
-+ /* the target lets us know it is ready by giving us 1 credit on
-+ * mailbox 0 */
-+ status = GetCredits(pDev, 0, &credits);
-+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait for target ready \n"));
-+ break;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Target is ready ...\n"));
-+
-+ /* read the first 4 scratch registers */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ SCRATCH_ADDRESS,
-+ params,
-+ 4,
-+ HIF_RD_SYNC_BYTE_INC,
-+ NULL);
-+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait get parameters \n"));
-+ break;
-+ }
-+
-+ numBufs = params[0];
-+ bufferSize = (int)(((A_UINT16)params[2] << 8) | (A_UINT16)params[1]);
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE,
-+ ("Target parameters: bufs per mailbox:%d, buffer size:%d bytes (total space: %d, minimum required space (w/padding): %d) \n",
-+ numBufs, bufferSize, (numBufs * bufferSize), TOTAL_BYTES));
-+
-+ if ((numBufs * bufferSize) < TOTAL_BYTES) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Not Enough buffer space to run test! need:%d, got:%d \n",
-+ TOTAL_BYTES, (numBufs*bufferSize)));
-+ status = A_ERROR;
-+ break;
-+ }
-+
-+ temp = GetEndMarker();
-+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ SCRATCH_ADDRESS + 4,
-+ (A_UINT8 *)&temp,
-+ 2,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
-+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write end marker \n"));
-+ break;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("End Marker: 0x%X \n",temp));
-+
-+ temp = (A_UINT16)g_BlockSizes[1];
-+ /* convert to a mask */
-+ temp = temp - 1;
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ SCRATCH_ADDRESS + 6,
-+ (A_UINT8 *)&temp,
-+ 2,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "a_osapi.h"
++#include "a_debug.h"
++#include "AR6Khwreg.h"
++#include "bmi_msg.h"
+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write block mask \n"));
-+ break;
-+ }
++#define BMI_COMMUNICATION_TIMEOUT 100000
+
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Set Block Mask: 0x%X \n",temp));
++/* ------ Global Variable Declarations ------- */
++A_BOOL bmiDone;
+
-+ /* execute the test on each mailbox */
-+ for (i = 0; i < AR6K_MAILBOXES; i++) {
-+ status = DoOneMboxHWTest(pDev, i);
-+ if (status != A_OK) {
-+ break;
-+ }
-+ }
++A_STATUS
++bmiBufferSend(HIF_DEVICE *device,
++ A_UCHAR *buffer,
++ A_UINT32 length);
+
-+ } while (FALSE);
++A_STATUS
++bmiBufferReceive(HIF_DEVICE *device,
++ A_UCHAR *buffer,
++ A_UINT32 length);
+
-+ if (status == A_OK) {
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - SUCCESS! - \n"));
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - FAILED! - \n"));
-+ }
-+ /* don't let HTC_Start continue, the target is actually not running any HTC code */
-+ return A_ERROR;
-+}
+#endif
-+
-+
-+
-diff --git a/drivers/ar6000/htc/ar6k.h b/drivers/ar6000/htc/ar6k.h
+diff --git a/drivers/ar6000/hif/hif.c b/drivers/ar6000/hif/hif.c
new file mode 100644
-index 0000000..301ab34
+index 0000000..d04486c
--- /dev/null
-+++ b/drivers/ar6000/htc/ar6k.h
-@@ -0,0 +1,191 @@
++++ b/drivers/ar6000/hif/hif.c
+@@ -0,0 +1,824 @@
+/*
++ * @file: hif.c
+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
++ * @abstract: HIF layer reference implementation for Atheros SDIO stack
++ *
++ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ *
+ */
+
-+#ifndef AR6K_H_
-+#define AR6K_H_
-+
-+#define AR6K_MAILBOXES 4
-+
-+/* HTC runs over mailbox 0 */
-+#define HTC_MAILBOX 0
++#include "hif_internal.h"
+
-+#define AR6K_TARGET_DEBUG_INTR_MASK 0x01
++/* ------ Static Variables ------ */
+
-+#define OTHER_INTS_ENABLED (INT_STATUS_ENABLE_ERROR_MASK | \
-+ INT_STATUS_ENABLE_CPU_MASK | \
-+ INT_STATUS_ENABLE_COUNTER_MASK)
++/* ------ Global Variable Declarations ------- */
++SD_PNP_INFO Ids[] = {
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xB,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0xA,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x9,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6001_BASE | 0x8,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x0,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ .SDIO_ManufacturerID = MANUFACTURER_ID_AR6002_BASE | 0x1,
++ .SDIO_ManufacturerCode = MANUFACTURER_CODE,
++ .SDIO_FunctionClass = FUNCTION_CLASS,
++ .SDIO_FunctionNo = 1
++ },
++ {
++ } //list is null termintaed
++};
+
-+//#define MBOXHW_UNIT_TEST 1
++TARGET_FUNCTION_CONTEXT FunctionContext = {
++ .function.Version = CT_SDIO_STACK_VERSION_CODE,
++ .function.pName = "sdio_wlan",
++ .function.MaxDevices = 1,
++ .function.NumDevices = 0,
++ .function.pIds = Ids,
++ .function.pProbe = hifDeviceInserted,
++ .function.pRemove = hifDeviceRemoved,
++ .function.pSuspend = NULL,
++ .function.pResume = NULL,
++ .function.pWake = NULL,
++ .function.pContext = &FunctionContext,
++};
+
-+#include "athstartpack.h"
-+typedef PREPACK struct _AR6K_IRQ_PROC_REGISTERS {
-+ A_UINT8 host_int_status;
-+ A_UINT8 cpu_int_status;
-+ A_UINT8 error_int_status;
-+ A_UINT8 counter_int_status;
-+ A_UINT8 mbox_frame;
-+ A_UINT8 rx_lookahead_valid;
-+ A_UINT8 hole[2];
-+ A_UINT32 rx_lookahead[2];
-+} POSTPACK AR6K_IRQ_PROC_REGISTERS;
++HIF_DEVICE hifDevice[HIF_MAX_DEVICES];
++HTC_CALLBACKS htcCallbacks;
++BUS_REQUEST busRequest[BUS_REQUEST_MAX_NUM];
++static BUS_REQUEST *s_busRequestFreeQueue = NULL;
++OS_CRITICALSECTION lock;
++extern A_UINT32 onebitmode;
++extern A_UINT32 busspeedlow;
+
-+#define AR6K_IRQ_PROC_REGS_SIZE sizeof(AR6K_IRQ_PROC_REGISTERS)
++#ifdef DEBUG
++extern A_UINT32 debughif;
++#define ATH_DEBUG_ERROR 1
++#define ATH_DEBUG_WARN 2
++#define ATH_DEBUG_TRACE 3
++#define _AR_DEBUG_PRINTX_ARG(arg...) arg
++#define AR_DEBUG_PRINTF(lvl, args)\
++ {if (lvl <= debughif)\
++ A_PRINTF(KERN_ALERT _AR_DEBUG_PRINTX_ARG args);\
++ }
++#else
++#define AR_DEBUG_PRINTF(lvl, args)
++#endif
+
++static BUS_REQUEST *hifAllocateBusRequest(void);
++static void hifFreeBusRequest(BUS_REQUEST *busrequest);
++static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper);
++static void ResetAllCards(void);
+
++/* ------ Functions ------ */
++int HIFInit(HTC_CALLBACKS *callbacks)
++{
++ SDIO_STATUS status;
++ DBG_ASSERT(callbacks != NULL);
+
-+typedef PREPACK struct _AR6K_IRQ_ENABLE_REGISTERS {
-+ A_UINT8 int_status_enable;
-+ A_UINT8 cpu_int_status_enable;
-+ A_UINT8 error_status_enable;
-+ A_UINT8 counter_int_status_enable;
-+} POSTPACK AR6K_IRQ_ENABLE_REGISTERS;
++ /* Store the callback and event handlers */
++ htcCallbacks.deviceInsertedHandler = callbacks->deviceInsertedHandler;
++ htcCallbacks.deviceRemovedHandler = callbacks->deviceRemovedHandler;
++ htcCallbacks.deviceSuspendHandler = callbacks->deviceSuspendHandler;
++ htcCallbacks.deviceResumeHandler = callbacks->deviceResumeHandler;
++ htcCallbacks.deviceWakeupHandler = callbacks->deviceWakeupHandler;
++ htcCallbacks.rwCompletionHandler = callbacks->rwCompletionHandler;
++ htcCallbacks.dsrHandler = callbacks->dsrHandler;
+
-+#include "athendpack.h"
++ CriticalSectionInit(&lock);
+
-+#define AR6K_IRQ_ENABLE_REGS_SIZE sizeof(AR6K_IRQ_ENABLE_REGISTERS)
++ /* Register with bus driver core */
++ status = SDIO_RegisterFunction(&FunctionContext.function);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+
-+#define AR6K_REG_IO_BUFFER_SIZE 32
-+#define AR6K_MAX_REG_IO_BUFFERS 8
++ return(0);
++}
+
-+/* buffers for ASYNC I/O */
-+typedef struct AR6K_ASYNC_REG_IO_BUFFER {
-+ HTC_PACKET HtcPacket; /* we use an HTC packet as a wrapper for our async register-based I/O */
-+ A_UINT8 Buffer[AR6K_REG_IO_BUFFER_SIZE];
-+} AR6K_ASYNC_REG_IO_BUFFER;
++A_STATUS
++HIFReadWrite(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length,
++ A_UINT32 request,
++ void *context)
++{
++ A_UINT8 rw;
++ A_UINT8 mode;
++ A_UINT8 funcNo;
++ A_UINT8 opcode;
++ A_UINT16 count;
++ SDREQUEST *sdrequest;
++ SDIO_STATUS sdiostatus;
++ BUS_REQUEST *busrequest;
++ A_STATUS status = A_OK;
+
-+typedef struct _AR6K_DEVICE {
-+ A_MUTEX_T Lock;
-+ AR6K_IRQ_PROC_REGISTERS IrqProcRegisters;
-+ AR6K_IRQ_ENABLE_REGISTERS IrqEnableRegisters;
-+ void *HIFDevice;
-+ A_UINT32 BlockSize;
-+ A_UINT32 BlockMask;
-+ A_UINT32 MailboxAddress;
-+ HIF_PENDING_EVENTS_FUNC GetPendingEventsFunc;
-+ void *HTCContext;
-+ HTC_PACKET_QUEUE RegisterIOList;
-+ AR6K_ASYNC_REG_IO_BUFFER RegIOBuffers[AR6K_MAX_REG_IO_BUFFERS];
-+ void (*TargetFailureCallback)(void *Context);
-+ A_STATUS (*MessagePendingCallback)(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
-+ HIF_DEVICE_IRQ_PROCESSING_MODE HifIRQProcessingMode;
-+ HIF_MASK_UNMASK_RECV_EVENT HifMaskUmaskRecvEvent;
-+} AR6K_DEVICE;
++ DBG_ASSERT(device != NULL);
++ DBG_ASSERT(device->handle != NULL);
+
-+#define IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(pDev) ((pDev)->HifIRQProcessingMode != HIF_DEVICE_IRQ_SYNC_ONLY)
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
+
-+A_STATUS DevSetup(AR6K_DEVICE *pDev);
-+A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev);
-+A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev);
-+A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
-+ A_UINT32 *pLookAhead,
-+ int TimeoutMS);
-+A_STATUS DevRWCompletionHandler(void *context, A_STATUS status);
-+A_STATUS DevDsrHandler(void *context);
-+A_STATUS DevCheckPendingRecvMsgsAsync(void *context);
-+void DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS *pIrqProcRegs,
-+ AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs);
++ do {
++ busrequest = hifAllocateBusRequest();
++ if (busrequest == NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("HIF Unable to allocate bus request\n"));
++ status = A_NO_RESOURCE;
++ break;
++ }
+
-+#define DEV_STOP_RECV_ASYNC TRUE
-+#define DEV_STOP_RECV_SYNC FALSE
-+#define DEV_ENABLE_RECV_ASYNC TRUE
-+#define DEV_ENABLE_RECV_SYNC FALSE
-+A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
-+A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
++ sdrequest = busrequest->request;
++ busrequest->context = context;
+
-+static INLINE A_STATUS DevSendPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 SendLength) {
-+ A_UINT32 paddedLength;
-+ A_BOOL sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
-+ A_STATUS status;
++ sdrequest->pDataBuffer = buffer;
++ if (request & HIF_SYNCHRONOUS) {
++ sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS;
++ sdrequest->pCompleteContext = NULL;
++ sdrequest->pCompletion = NULL;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Synchronous\n"));
++ } else if (request & HIF_ASYNCHRONOUS) {
++ sdrequest->Flags = SDREQ_FLAGS_RESP_SDIO_R5 | SDREQ_FLAGS_DATA_TRANS |
++ SDREQ_FLAGS_TRANS_ASYNC;
++ sdrequest->pCompleteContext = busrequest;
++ sdrequest->pCompletion = hifRWCompletionHandler;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Execution mode: Asynchronous\n"));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Invalid execution mode: 0x%08x\n", request));
++ status = A_EINVAL;
++ break;
++ }
+
-+ /* adjust the length to be a multiple of block size if appropriate */
-+ paddedLength = (SendLength + (pDev->BlockMask)) &
-+ (~(pDev->BlockMask));
-+#if 0 // BufferLength may not be set in , fix this...
-+ if (paddedLength > pPacket->BufferLength) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ if (pPacket->Completion != NULL) {
-+ COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
++ if (request & HIF_EXTENDED_IO) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Command type: CMD53\n"));
++ sdrequest->Command = CMD53;
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Invalid command type: 0x%08x\n", request));
++ status = A_EINVAL;
++ break;
+ }
-+ return A_EINVAL;
-+ }
-+#endif
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+ ("DevSendPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
-+ paddedLength,
-+ pDev->MailboxAddress,
-+ sync ? "SYNC" : "ASYNC"));
+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ pDev->MailboxAddress,
-+ pPacket->pBuffer,
-+ paddedLength, /* the padded length */
-+ sync ? HIF_WR_SYNC_BLOCK_INC : HIF_WR_ASYNC_BLOCK_INC,
-+ sync ? NULL : pPacket); /* pass the packet as the context to the HIF request */
++ if (request & HIF_BLOCK_BASIS) {
++ mode = CMD53_BLOCK_BASIS;
++ sdrequest->BlockLen = HIF_MBOX_BLOCK_SIZE;
++ sdrequest->BlockCount = length / HIF_MBOX_BLOCK_SIZE;
++ count = sdrequest->BlockCount;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Block mode (BlockLen: %d, BlockCount: %d)\n",
++ sdrequest->BlockLen, sdrequest->BlockCount));
++ } else if (request & HIF_BYTE_BASIS) {
++ mode = CMD53_BYTE_BASIS;
++ sdrequest->BlockLen = length;
++ sdrequest->BlockCount = 1;
++ count = sdrequest->BlockLen;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Byte mode (BlockLen: %d, BlockCount: %d)\n",
++ sdrequest->BlockLen, sdrequest->BlockCount));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Invalid data mode: 0x%08x\n", request));
++ status = A_EINVAL;
++ break;
++ }
+
-+ if (sync) {
-+ pPacket->Status = status;
-+ }
++#if 0
++ /* useful for checking register accesses */
++ if (length & 0x3) {
++ A_PRINTF(KERN_ALERT"HIF (%s) is not a multiple of 4 bytes, addr:0x%X, len:%d\n",
++ request & HIF_WRITE ? "write":"read", address, length);
++ }
++#endif
+
-+ return status;
-+}
++ if ((address >= HIF_MBOX_START_ADDR(0)) &&
++ (address <= HIF_MBOX_END_ADDR(3)))
++ {
+
-+static INLINE A_STATUS DevRecvPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 RecvLength) {
-+ A_UINT32 paddedLength;
-+ A_STATUS status;
-+ A_BOOL sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
++ DBG_ASSERT(length <= HIF_MBOX_WIDTH);
+
-+ /* adjust the length to be a multiple of block size if appropriate */
-+ paddedLength = (RecvLength + (pDev->BlockMask)) &
-+ (~(pDev->BlockMask));
-+ if (paddedLength > pPacket->BufferLength) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("DevRecvPacket, Not enough space for padlen:%d recvlen:%d bufferlen:%d \n",
-+ paddedLength,RecvLength,pPacket->BufferLength));
-+ if (pPacket->Completion != NULL) {
-+ COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
++ /*
++ * Mailbox write. Adjust the address so that the last byte
++ * falls on the EOM address.
++ */
++ address += (HIF_MBOX_WIDTH - length);
+ }
-+ return A_EINVAL;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+ ("DevRecvPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
-+ paddedLength,
-+ pDev->MailboxAddress,
-+ sync ? "SYNC" : "ASYNC"));
+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ pDev->MailboxAddress,
-+ pPacket->pBuffer,
-+ paddedLength,
-+ sync ? HIF_RD_SYNC_BLOCK_INC : HIF_RD_ASYNC_BLOCK_INC,
-+ sync ? NULL : pPacket); /* pass the packet as the context to the HIF request */
+
-+ if (sync) {
-+ pPacket->Status = status;
-+ }
+
-+ return status;
-+}
++ if (request & HIF_WRITE) {
++ rw = CMD53_WRITE;
++ sdrequest->Flags |= SDREQ_FLAGS_DATA_WRITE;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Write\n"));
++ } else if (request & HIF_READ) {
++ rw = CMD53_READ;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Direction: Read\n"));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Invalid direction: 0x%08x\n", request));
++ status = A_EINVAL;
++ break;
++ }
+
-+#ifdef MBOXHW_UNIT_TEST
-+A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev);
-+#endif
++ if (request & HIF_FIXED_ADDRESS) {
++ opcode = CMD53_FIXED_ADDRESS;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Fixed\n"));
++ } else if (request & HIF_INCREMENTAL_ADDRESS) {
++ opcode = CMD53_INCR_ADDRESS;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Address mode: Incremental\n"));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Invalid address mode: 0x%08x\n", request));
++ status = A_EINVAL;
++ break;
++ }
+
-+#endif /*AR6K_H_*/
-diff --git a/drivers/ar6000/htc/ar6k_events.c b/drivers/ar6000/htc/ar6k_events.c
-new file mode 100644
-index 0000000..91b29af
---- /dev/null
-+++ b/drivers/ar6000/htc/ar6k_events.c
-@@ -0,0 +1,638 @@
-+/*
-+ * AR6K Driver layer event handling (i.e. interrupts, message polling)
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "hif.h"
-+#include "htc_packet.h"
-+#include "ar6k.h"
++ funcNo = SDDEVICE_GET_SDIO_FUNCNO(device->handle);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Function number: %d\n", funcNo));
++ SDIO_SET_CMD53_ARG(sdrequest->Argument, rw, funcNo,
++ mode, opcode, address, count);
+
-+extern void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket);
-+extern HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev);
++ /* Send the command out */
++ sdiostatus = SDDEVICE_CALL_REQUEST_FUNC(device->handle, sdrequest);
+
-+static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev);
++ if (!SDIO_SUCCESS(sdiostatus)) {
++ status = A_ERROR;
++ }
+
-+#define DELAY_PER_INTERVAL_MS 10 /* 10 MS delay per polling interval */
++ } while (FALSE);
+
-+/* completion routine for ALL HIF layer async I/O */
-+A_STATUS DevRWCompletionHandler(void *context, A_STATUS status)
-+{
-+ HTC_PACKET *pPacket = (HTC_PACKET *)context;
++ if (A_FAILED(status) || (request & HIF_SYNCHRONOUS)) {
++ if (busrequest != NULL) {
++ hifFreeBusRequest(busrequest);
++ }
++ }
+
-+ COMPLETE_HTC_PACKET(pPacket,status);
++ if (A_FAILED(status) && (request & HIF_ASYNCHRONOUS)) {
++ /* call back async handler on failure */
++ htcCallbacks.rwCompletionHandler(context, status);
++ }
+
-+ return A_OK;
++ return status;
+}
+
-+/* mailbox recv message polling */
-+A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
-+ A_UINT32 *pLookAhead,
-+ int TimeoutMS)
++A_STATUS
++HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
++ void *config, A_UINT32 configLen)
+{
-+ A_STATUS status = A_OK;
-+ int timeout = TimeoutMS/DELAY_PER_INTERVAL_MS;
-+
-+ AR_DEBUG_ASSERT(timeout > 0);
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+DevPollMboxMsgRecv \n"));
-+
-+ while (TRUE) {
-+
-+ if (pDev->GetPendingEventsFunc != NULL)
-+ {
-+
-+ HIF_PENDING_EVENTS_INFO events;
-+
-+ /* the HIF layer uses a special mechanism to get events, do this
-+ * synchronously */
-+ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+ &events,
-+ NULL);
-+ if (A_FAILED(status))
-+ {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to get pending events \n"));
-+ break;
-+ }
++ A_UINT32 count;
+
-+ if (events.Events & HIF_RECV_MSG_AVAIL)
-+ {
-+ /* there is a message available, the lookahead should be valid now */
-+ *pLookAhead = events.LookAhead;
++ switch(opcode) {
++ case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
++ ((A_UINT32 *)config)[0] = HIF_MBOX0_BLOCK_SIZE;
++ ((A_UINT32 *)config)[1] = HIF_MBOX1_BLOCK_SIZE;
++ ((A_UINT32 *)config)[2] = HIF_MBOX2_BLOCK_SIZE;
++ ((A_UINT32 *)config)[3] = HIF_MBOX3_BLOCK_SIZE;
++ break;
+
-+ break;
++ case HIF_DEVICE_GET_MBOX_ADDR:
++ for (count = 0; count < 4; count ++) {
++ ((A_UINT32 *)config)[count] = HIF_MBOX_START_ADDR(count);
+ }
-+ }
-+ else
-+ {
++ break;
++ case HIF_DEVICE_GET_IRQ_PROC_MODE:
++ /* the SDIO stack allows the interrupts to be processed either way, ASYNC or SYNC */
++ *((HIF_DEVICE_IRQ_PROCESSING_MODE *)config) = HIF_DEVICE_IRQ_ASYNC_SYNC;
++ break;
++ default:
++ AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
++ ("Unsupported configuration opcode: %d\n", opcode));
++ return A_ERROR;
++ }
+
-+ /* this is the standard HIF way.... */
-+ /* load the register table */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ HOST_INT_STATUS_ADDRESS,
-+ (A_UINT8 *)&pDev->IrqProcRegisters,
-+ AR6K_IRQ_PROC_REGS_SIZE,
-+ HIF_RD_SYNC_BYTE_INC,
-+ NULL);
++ return A_OK;
++}
+
-+ if (A_FAILED(status))
-+ {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to read register table \n"));
-+ break;
-+ }
++void
++HIFShutDownDevice(HIF_DEVICE *device)
++{
++ A_UINT8 data;
++ A_UINT32 count;
++ SDIO_STATUS status;
++ SDCONFIG_BUS_MODE_DATA busSettings;
++ SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
+
-+ /* check for MBOX data and valid lookahead */
-+ if (pDev->IrqProcRegisters.host_int_status & (1 << HTC_MAILBOX))
-+ {
-+ if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX))
-+ {
-+ /* mailbox has a message and the look ahead is valid */
-+ *pLookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
-+ break;
-+ }
-+ }
++ if (device != NULL) {
++ DBG_ASSERT(device->handle != NULL);
+
-+ }
++ /* Remove the allocated current if any */
++ status = SDLIB_IssueConfig(device->handle,
++ SDCONFIG_FUNC_FREE_SLOT_CURRENT, NULL, 0);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+
-+ timeout--;
++ /* Disable the card */
++ fData.EnableFlags = SDCONFIG_DISABLE_FUNC;
++ fData.TimeOut = 1;
++ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ENABLE_DISABLE,
++ &fData, sizeof(fData));
++ DBG_ASSERT(SDIO_SUCCESS(status));
+
-+ if (timeout <= 0)
-+ {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Timeout waiting for recv message \n"));
-+ status = A_ERROR;
++ /* Perform a soft I/O reset */
++ data = SDIO_IO_RESET;
++ status = SDLIB_IssueCMD52(device->handle, 0, SDIO_IO_ABORT_REG,
++ &data, 1, 1);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+
-+ /* check if the target asserted */
-+ if ( pDev->IrqProcRegisters.counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
-+ /* target signaled an assert, process this pending interrupt
-+ * this will call the target failure handler */
-+ DevServiceDebugInterrupt(pDev);
-+ }
++ /*
++ * WAR - Codetelligence driver does not seem to shutdown correctly in 1
++ * bit mode. By default it configures the HC in the 4 bit. Its later in
++ * our driver that we switch to 1 bit mode. If we try to shutdown, the
++ * driver hangs so we revert to 4 bit mode, to be transparent to the
++ * underlying bus driver.
++ */
++ if (onebitmode) {
++ ZERO_OBJECT(busSettings);
++ busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(device->handle);
++ SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
++ SDCONFIG_BUS_WIDTH_4_BIT);
+
-+ break;
++ /* Issue config request to change the bus width to 4 bit */
++ status = SDLIB_IssueConfig(device->handle, SDCONFIG_BUS_MODE_CTRL,
++ &busSettings,
++ sizeof(SDCONFIG_BUS_MODE_DATA));
++ DBG_ASSERT(SDIO_SUCCESS(status));
+ }
+
-+ /* delay a little */
-+ msleep(DELAY_PER_INTERVAL_MS);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" Retry Mbox Poll : %d \n",timeout));
++ /* Free the bus requests */
++ for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
++ SDDeviceFreeRequest(device->handle, busRequest[count].request);
++ }
++ /* Clean up the queue */
++ s_busRequestFreeQueue = NULL;
++ } else {
++ /* since we are unloading the driver anyways, reset all cards in case the SDIO card
++ * is externally powered and we are unloading the SDIO stack. This avoids the problem when
++ * the SDIO stack is reloaded and attempts are made to re-enumerate a card that is already
++ * enumerated */
++ ResetAllCards();
++ /* Unregister with bus driver core */
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Unregistering with the bus driver\n"));
++ status = SDIO_UnregisterFunction(&FunctionContext.function);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-DevPollMboxMsgRecv \n"));
-+
-+ return status;
+}
+
-+static A_STATUS DevServiceCPUInterrupt(AR6K_DEVICE *pDev)
++void
++hifRWCompletionHandler(SDREQUEST *request)
+{
+ A_STATUS status;
-+ A_UINT8 cpu_int_status;
-+ A_UINT8 regBuffer[4];
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("CPU Interrupt\n"));
-+ cpu_int_status = pDev->IrqProcRegisters.cpu_int_status &
-+ pDev->IrqEnableRegisters.cpu_int_status_enable;
-+ AR_DEBUG_ASSERT(cpu_int_status);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ ("Valid interrupt source(s) in CPU_INT_STATUS: 0x%x\n",
-+ cpu_int_status));
-+
-+ /* Clear the interrupt */
-+ pDev->IrqProcRegisters.cpu_int_status &= ~cpu_int_status; /* W1C */
-+
-+ /* set up the register transfer buffer to hit the register 4 times , this is done
-+ * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
-+ * restrict bus transfer lengths to be a multiple of 4-bytes */
-+
-+ /* set W1C value to clear the interrupt, this hits the register first */
-+ regBuffer[0] = cpu_int_status;
-+ /* the remaining 4 values are set to zero which have no-effect */
-+ regBuffer[1] = 0;
-+ regBuffer[2] = 0;
-+ regBuffer[3] = 0;
++ void *context;
++ BUS_REQUEST *busrequest;
+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ CPU_INT_STATUS_ADDRESS,
-+ regBuffer,
-+ 4,
-+ HIF_WR_SYNC_BYTE_FIX,
-+ NULL);
++ if (SDIO_SUCCESS(request->Status)) {
++ status = A_OK;
++ } else {
++ status = A_ERROR;
++ }
+
-+ AR_DEBUG_ASSERT(status == A_OK);
-+ return status;
++ DBG_ASSERT(status == A_OK);
++ busrequest = (BUS_REQUEST *) request->pCompleteContext;
++ context = (void *) busrequest->context;
++ /* free the request before calling the callback, in case the
++ * callback submits another request, this guarantees that
++ * there is at least 1 free request available everytime the callback
++ * is invoked */
++ hifFreeBusRequest(busrequest);
++ htcCallbacks.rwCompletionHandler(context, status);
+}
+
-+
-+static A_STATUS DevServiceErrorInterrupt(AR6K_DEVICE *pDev)
++void
++hifIRQHandler(void *context)
+{
+ A_STATUS status;
-+ A_UINT8 error_int_status;
-+ A_UINT8 regBuffer[4];
++ HIF_DEVICE *device;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error Interrupt\n"));
-+ error_int_status = pDev->IrqProcRegisters.error_int_status & 0x0F;
-+ AR_DEBUG_ASSERT(error_int_status);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ ("Valid interrupt source(s) in ERROR_INT_STATUS: 0x%x\n",
-+ error_int_status));
++ device = (HIF_DEVICE *)context;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
++ status = htcCallbacks.dsrHandler(device->htc_handle);
++ DBG_ASSERT(status == A_OK);
++}
+
-+ if (ERROR_INT_STATUS_WAKEUP_GET(error_int_status)) {
-+ /* Wakeup */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error : Wakeup\n"));
-+ }
++BOOL
++hifDeviceInserted(SDFUNCTION *function, SDDEVICE *handle)
++{
++ BOOL enabled;
++ A_UINT8 data;
++ A_UINT32 count;
++ HIF_DEVICE *device;
++ SDIO_STATUS status;
++ A_UINT16 maxBlocks;
++ A_UINT16 maxBlockSize;
++ SDCONFIG_BUS_MODE_DATA busSettings;
++ SDCONFIG_FUNC_ENABLE_DISABLE_DATA fData;
++ TARGET_FUNCTION_CONTEXT *functionContext;
++ SDCONFIG_FUNC_SLOT_CURRENT_DATA slotCurrent;
++ SD_BUSCLOCK_RATE currentBusClock;
+
-+ if (ERROR_INT_STATUS_RX_UNDERFLOW_GET(error_int_status)) {
-+ /* Rx Underflow */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Rx Underflow\n"));
++ DBG_ASSERT(function != NULL);
++ DBG_ASSERT(handle != NULL);
++
++ device = addHifDevice(handle);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device: %p\n", device));
++ functionContext = (TARGET_FUNCTION_CONTEXT *)function->pContext;
++
++ /*
++ * Issue commands to get the manufacturer ID and stuff and compare it
++ * against the rev Id derived from the ID registered during the
++ * initialization process. Report the device only in the case there
++ * is a match. In the case od SDIO, the bus driver has already queried
++ * these details so we just need to use their data structures to get the
++ * relevant values. Infact, the driver has already matched it against
++ * the Ids that we registered with it so we dont need to the step here.
++ */
++
++ /* Configure the SDIO Bus Width */
++ if (onebitmode) {
++ data = SDIO_BUS_WIDTH_1_BIT;
++ status = SDLIB_IssueCMD52(handle, 0, SDIO_BUS_IF_REG, &data, 1, 1);
++ if (!SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Unable to set the bus width to 1 bit\n"));
++ return FALSE;
++ }
+ }
+
-+ if (ERROR_INT_STATUS_TX_OVERFLOW_GET(error_int_status)) {
-+ /* Tx Overflow */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Tx Overflow\n"));
++ /* Get current bus flags */
++ ZERO_OBJECT(busSettings);
++
++ busSettings.BusModeFlags = SDDEVICE_GET_BUSMODE_FLAGS(handle);
++ if (onebitmode) {
++ SDCONFIG_SET_BUS_WIDTH(busSettings.BusModeFlags,
++ SDCONFIG_BUS_WIDTH_1_BIT);
+ }
+
-+ /* Clear the interrupt */
-+ pDev->IrqProcRegisters.error_int_status &= ~error_int_status; /* W1C */
++ /* get the current operating clock, the bus driver sets us up based
++ * on what our CIS reports and what the host controller can handle
++ * we can use this to determine whether we want to drop our clock rate
++ * down */
++ currentBusClock = SDDEVICE_GET_OPER_CLOCK(handle);
++ busSettings.ClockRate = currentBusClock;
+
-+ /* set up the register transfer buffer to hit the register 4 times , this is done
-+ * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
-+ * restrict bus transfer lengths to be a multiple of 4-bytes */
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("HIF currently running at: %d \n",currentBusClock));
+
-+ /* set W1C value to clear the interrupt, this hits the register first */
-+ regBuffer[0] = error_int_status;
-+ /* the remaining 4 values are set to zero which have no-effect */
-+ regBuffer[1] = 0;
-+ regBuffer[2] = 0;
-+ regBuffer[3] = 0;
++ /* see if HIF wants to run at a lower clock speed, we may already be
++ * at that lower clock speed */
++ if (currentBusClock > (SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow)) {
++ busSettings.ClockRate = SDIO_CLOCK_FREQUENCY_DEFAULT >> busspeedlow;
++ AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
++ ("HIF overriding clock to %d \n",busSettings.ClockRate));
++ }
+
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ ERROR_INT_STATUS_ADDRESS,
-+ regBuffer,
-+ 4,
-+ HIF_WR_SYNC_BYTE_FIX,
-+ NULL);
++ /* Issue config request to override clock rate */
++ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_CHANGE_BUS_MODE, &busSettings,
++ sizeof(SDCONFIG_BUS_MODE_DATA));
++ if (!SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Unable to configure the host clock\n"));
++ return FALSE;
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Configured clock: %d, Maximum clock: %d\n",
++ busSettings.ActualClockRate,
++ SDDEVICE_GET_MAX_CLOCK(handle)));
++ }
+
-+ AR_DEBUG_ASSERT(status == A_OK);
-+ return status;
-+}
++ /*
++ * Check if the target supports block mode. This result of this check
++ * can be used to implement the HIFReadWrite API.
++ */
++ if (SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle)) {
++ /* Limit block size to operational block limit or card function
++ capability */
++ maxBlockSize = min(SDDEVICE_GET_OPER_BLOCK_LEN(handle),
++ SDDEVICE_GET_SDIO_FUNC_MAXBLKSIZE(handle));
+
-+static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev)
-+{
-+ A_UINT32 dummy;
-+ A_STATUS status;
++ /* check if the card support multi-block transfers */
++ if (!(SDDEVICE_GET_SDIOCARD_CAPS(handle) & SDIO_CAPS_MULTI_BLOCK)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Byte basis only\n"));
+
-+ /* Send a target failure event to the application */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Target debug interrupt\n"));
++ /* Limit block size to max byte basis */
++ maxBlockSize = min(maxBlockSize,
++ (A_UINT16)SDIO_MAX_LENGTH_BYTE_BASIS);
++ maxBlocks = 1;
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Multi-block capable\n"));
++ maxBlocks = SDDEVICE_GET_OPER_BLOCKS(handle);
++ status = SDLIB_SetFunctionBlockSize(handle, HIF_MBOX_BLOCK_SIZE);
++ if (!SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Failed to set block size. Err:%d\n", status));
++ return FALSE;
++ }
++ }
+
-+ if (pDev->TargetFailureCallback != NULL) {
-+ pDev->TargetFailureCallback(pDev->HTCContext);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Bytes Per Block: %d bytes, Block Count:%d \n",
++ maxBlockSize, maxBlocks));
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Function does not support Block Mode!\n"));
++ return FALSE;
+ }
+
-+ /* clear the interrupt , the debug error interrupt is
-+ * counter 0 */
-+ /* read counter to clear interrupt */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ COUNT_DEC_ADDRESS,
-+ (A_UINT8 *)&dummy,
-+ 4,
-+ HIF_RD_SYNC_BYTE_INC,
-+ NULL);
++ /* Allocate the slot current */
++ status = SDLIB_GetDefaultOpCurrent(handle, &slotCurrent.SlotCurrent);
++ if (SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Allocating Slot current: %d mA\n",
++ slotCurrent.SlotCurrent));
++ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ALLOC_SLOT_CURRENT,
++ &slotCurrent, sizeof(slotCurrent));
++ if (!SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Failed to allocate slot current %d\n", status));
++ return FALSE;
++ }
++ }
+
-+ AR_DEBUG_ASSERT(status == A_OK);
-+ return status;
-+}
++ /* Enable the dragon function */
++ count = 0;
++ enabled = FALSE;
++ fData.TimeOut = 1;
++ fData.EnableFlags = SDCONFIG_ENABLE_FUNC;
++ while ((count++ < SDWLAN_ENABLE_DISABLE_TIMEOUT) && !enabled)
++ {
++ /* Enable dragon */
++ status = SDLIB_IssueConfig(handle, SDCONFIG_FUNC_ENABLE_DISABLE,
++ &fData, sizeof(fData));
++ if (!SDIO_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Attempting to enable the card again\n"));
++ continue;
++ }
+
-+static A_STATUS DevServiceCounterInterrupt(AR6K_DEVICE *pDev)
-+{
-+ A_UINT8 counter_int_status;
++ /* Mark the status as enabled */
++ enabled = TRUE;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Counter Interrupt\n"));
++ /* Check if we were succesful in enabling the target */
++ if (!enabled) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR,
++ ("Failed to communicate with the target\n"));
++ return FALSE;
++ }
+
-+ counter_int_status = pDev->IrqProcRegisters.counter_int_status &
-+ pDev->IrqEnableRegisters.counter_int_status_enable;
++ /* Allocate the bus requests to be used later */
++ A_MEMZERO(busRequest, sizeof(busRequest));
++ for (count = 0; count < BUS_REQUEST_MAX_NUM; count ++) {
++ if ((busRequest[count].request = SDDeviceAllocRequest(handle)) == NULL){
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Unable to allocate memory\n"));
++ /* TODO: Free the memory that has already been allocated */
++ return FALSE;
++ }
++ hifFreeBusRequest(&busRequest[count]);
+
-+ AR_DEBUG_ASSERT(counter_int_status);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ ("Valid interrupt source(s) in COUNTER_INT_STATUS: 0x%x\n",
-+ counter_int_status));
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("0x%08x = busRequest[%d].request = 0x%08x\n",
++ (unsigned int) &busRequest[count], count,
++ (unsigned int) busRequest[count].request));
++ }
+
-+ /* Check if the debug interrupt is pending */
-+ if (counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
-+ return DevServiceDebugInterrupt(pDev);
++ /* Schedule a worker to handle device inserted, this is a temporary workaround
++ * to fix a deadlock if the device fails to intialize in the insertion handler
++ * The failure causes the instance to shutdown the HIF layer and unregister the
++ * function driver within the busdriver probe context which can deadlock
++ *
++ * NOTE: we cannot use the default work queue because that would block
++ * SD bus request processing for all synchronous I/O. We must use a kernel
++ * thread that is creating using the helper library.
++ * */
++
++ if (SDIO_SUCCESS(SDLIB_OSCreateHelper(&device->insert_helper,
++ insert_helper_func,
++ device))) {
++ device->helper_started = TRUE;
+ }
+
-+ return A_OK;
++ return TRUE;
+}
+
-+/* callback when our fetch to get interrupt status registers completes */
-+static void DevGetEventAsyncHandler(void *Context, HTC_PACKET *pPacket)
++static THREAD_RETURN insert_helper_func(POSKERNEL_HELPER pHelper)
+{
-+ AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
-+ A_UINT32 lookAhead = 0;
-+ A_BOOL otherInts = FALSE;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGetEventAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
+
-+ do {
++ /*
++ * Adding a wait of around a second before we issue the very first
++ * command to dragon. During the process of loading/unloading the
++ * driver repeatedly it was observed that we get a data timeout
++ * while accessing function 1 registers in the chip. The theory at
++ * this point is that some initialization delay in dragon is
++ * causing the SDIO state in dragon core to be not ready even after
++ * the ready bit indicates that function 1 is ready. Accomodating
++ * for this behavior by adding some delay in the driver before it
++ * issues the first command after switching on dragon. Need to
++ * investigate this a bit more - TODO
++ */
+
-+ if (A_FAILED(pPacket->Status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" GetEvents I/O request failed, status:%d \n", pPacket->Status));
-+ /* bail out, don't unmask HIF interrupt */
-+ break;
-+ }
++ A_MDELAY(1000);
++ /* Inform HTC */
++ if ((htcCallbacks.deviceInsertedHandler(SD_GET_OS_HELPER_CONTEXT(pHelper))) != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE, ("Device rejected\n"));
++ }
+
-+ if (pDev->GetPendingEventsFunc != NULL) {
-+ /* the HIF layer collected the information for us */
-+ HIF_PENDING_EVENTS_INFO *pEvents = (HIF_PENDING_EVENTS_INFO *)pPacket->pBuffer;
-+ if (pEvents->Events & HIF_RECV_MSG_AVAIL) {
-+ lookAhead = pEvents->LookAhead;
-+ if (0 == lookAhead) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler1, lookAhead is zero! \n"));
-+ }
-+ }
-+ if (pEvents->Events & HIF_OTHER_EVENTS) {
-+ otherInts = TRUE;
-+ }
-+ } else {
-+ /* standard interrupt table handling.... */
-+ AR6K_IRQ_PROC_REGISTERS *pReg = (AR6K_IRQ_PROC_REGISTERS *)pPacket->pBuffer;
-+ A_UINT8 host_int_status;
++ return 0;
++}
+
-+ host_int_status = pReg->host_int_status & pDev->IrqEnableRegisters.int_status_enable;
++void
++HIFAckInterrupt(HIF_DEVICE *device)
++{
++ SDIO_STATUS status;
++ DBG_ASSERT(device != NULL);
++ DBG_ASSERT(device->handle != NULL);
+
-+ if (host_int_status & (1 << HTC_MAILBOX)) {
-+ host_int_status &= ~(1 << HTC_MAILBOX);
-+ if (pReg->rx_lookahead_valid & (1 << HTC_MAILBOX)) {
-+ /* mailbox has a message and the look ahead is valid */
-+ lookAhead = pReg->rx_lookahead[HTC_MAILBOX];
-+ if (0 == lookAhead) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler2, lookAhead is zero! \n"));
-+ }
-+ }
-+ }
++ /* Acknowledge our function IRQ */
++ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_ACK_IRQ,
++ NULL, 0);
++ DBG_ASSERT(SDIO_SUCCESS(status));
++}
+
-+ if (host_int_status) {
-+ /* there are other interrupts to handle */
-+ otherInts = TRUE;
-+ }
-+ }
++void
++HIFUnMaskInterrupt(HIF_DEVICE *device)
++{
++ SDIO_STATUS status;
+
-+ if (otherInts || (lookAhead == 0)) {
-+ /* if there are other interrupts to process, we cannot do this in the async handler so
-+ * ack the interrupt which will cause our sync handler to run again
-+ * if however there are no more messages, we can now ack the interrupt */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ (" Acking interrupt from DevGetEventAsyncHandler (otherints:%d, lookahead:0x%X)\n",
-+ otherInts, lookAhead));
-+ HIFAckInterrupt(pDev->HIFDevice);
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ (" DevGetEventAsyncHandler : detected another message, lookahead :0x%X \n",
-+ lookAhead));
-+ /* lookahead is non-zero and there are no other interrupts to service,
-+ * go get the next message */
-+ pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, NULL);
-+ }
++ DBG_ASSERT(device != NULL);
++ DBG_ASSERT(device->handle != NULL);
+
-+ } while (FALSE);
++ /* Register the IRQ Handler */
++ SDDEVICE_SET_IRQ_HANDLER(device->handle, hifIRQHandler, device);
+
-+ /* free this IO packet */
-+ AR6KFreeIOPacket(pDev,pPacket);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGetEventAsyncHandler \n"));
++ /* Unmask our function IRQ */
++ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_UNMASK_IRQ,
++ NULL, 0);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+}
+
-+/* called by the HTC layer when it wants us to check if the device has any more pending
-+ * recv messages, this starts off a series of async requests to read interrupt registers */
-+A_STATUS DevCheckPendingRecvMsgsAsync(void *context)
++void HIFMaskInterrupt(HIF_DEVICE *device)
+{
-+ AR6K_DEVICE *pDev = (AR6K_DEVICE *)context;
-+ A_STATUS status = A_OK;
-+ HTC_PACKET *pIOPacket;
++ SDIO_STATUS status;
++ DBG_ASSERT(device != NULL);
++ DBG_ASSERT(device->handle != NULL);
+
-+ /* this is called in an ASYNC only context, we may NOT block, sleep or call any apis that can
-+ * cause us to switch contexts */
++ /* Mask our function IRQ */
++ status = SDLIB_IssueConfig(device->handle, SDCONFIG_FUNC_MASK_IRQ,
++ NULL, 0);
++ DBG_ASSERT(SDIO_SUCCESS(status));
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevCheckPendingRecvMsgsAsync: (dev: 0x%X)\n", (A_UINT32)pDev));
++ /* Unregister the IRQ Handler */
++ SDDEVICE_SET_IRQ_HANDLER(device->handle, NULL, NULL);
++}
+
-+ do {
++static BUS_REQUEST *hifAllocateBusRequest(void)
++{
++ BUS_REQUEST *busrequest;
+
-+ if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
-+ /* break the async processing chain right here, no need to continue.
-+ * The DevDsrHandler() will handle things in a loop when things are driven
-+ * synchronously */
-+ break;
-+ }
-+ /* first allocate one of our HTC packets we created for async I/O
-+ * we reuse HTC packet definitions so that we can use the completion mechanism
-+ * in DevRWCompletionHandler() */
-+ pIOPacket = AR6KAllocIOPacket(pDev);
++ /* Acquire lock */
++ CriticalSectionAcquire(&lock);
+
-+ if (NULL == pIOPacket) {
-+ /* there should be only 1 asynchronous request out at a time to read these registers
-+ * so this should actually never happen */
-+ status = A_NO_MEMORY;
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ /* Remove first in list */
++ if((busrequest = s_busRequestFreeQueue) != NULL)
++ {
++ s_busRequestFreeQueue = busrequest->next;
++ }
+
-+ /* stick in our completion routine when the I/O operation completes */
-+ pIOPacket->Completion = DevGetEventAsyncHandler;
-+ pIOPacket->pContext = pDev;
++ /* Release lock */
++ CriticalSectionRelease(&lock);
+
-+ if (pDev->GetPendingEventsFunc) {
-+ /* HIF layer has it's own mechanism, pass the IO to it.. */
-+ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+ (HIF_PENDING_EVENTS_INFO *)pIOPacket->pBuffer,
-+ pIOPacket);
++ return busrequest;
++}
+
-+ } else {
-+ /* standard way, read the interrupt register table asynchronously again */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ HOST_INT_STATUS_ADDRESS,
-+ pIOPacket->pBuffer,
-+ AR6K_IRQ_PROC_REGS_SIZE,
-+ HIF_RD_ASYNC_BYTE_INC,
-+ pIOPacket);
-+ }
++static void
++hifFreeBusRequest(BUS_REQUEST *busrequest)
++{
++ DBG_ASSERT(busrequest != NULL);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Async IO issued to get interrupt status...\n"));
-+ } while (FALSE);
++ /* Acquire lock */
++ CriticalSectionAcquire(&lock);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevCheckPendingRecvMsgsAsync \n"));
++ /* Insert first in list */
++ busrequest->next = s_busRequestFreeQueue;
++ s_busRequestFreeQueue = busrequest;
+
-+ return status;
++ /* Release lock */
++ CriticalSectionRelease(&lock);
+}
+
-+/* process pending interrupts synchronously */
-+static A_STATUS ProcessPendingIRQs(AR6K_DEVICE *pDev, A_BOOL *pDone, A_BOOL *pASyncProcessing)
++void
++hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *handle)
+{
-+ A_STATUS status = A_OK;
-+ A_UINT8 host_int_status = 0;
-+ A_UINT32 lookAhead = 0;
++ A_STATUS status;
++ HIF_DEVICE *device;
++ DBG_ASSERT(function != NULL);
++ DBG_ASSERT(handle != NULL);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+ProcessPendingIRQs: (dev: 0x%X)\n", (A_UINT32)pDev));
++ device = getHifDevice(handle);
++ status = htcCallbacks.deviceRemovedHandler(device->htc_handle, A_OK);
+
-+ /*** NOTE: the HIF implementation guarantees that the context of this call allows
-+ * us to perform SYNCHRONOUS I/O, that is we can block, sleep or call any API that
-+ * can block or switch thread/task ontexts.
-+ * This is a fully schedulable context.
-+ * */
-+ do {
++ /* cleanup the helper thread */
++ if (device->helper_started) {
++ SDLIB_OSDeleteHelper(&device->insert_helper);
++ device->helper_started = FALSE;
++ }
+
-+ if (pDev->GetPendingEventsFunc != NULL) {
-+ HIF_PENDING_EVENTS_INFO events;
++ delHifDevice(handle);
++ DBG_ASSERT(status == A_OK);
++}
+
-+ /* the HIF layer uses a special mechanism to get events
-+ * get this synchronously */
-+ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
-+ &events,
-+ NULL);
++HIF_DEVICE *
++addHifDevice(SDDEVICE *handle)
++{
++ DBG_ASSERT(handle != NULL);
++ hifDevice[0].handle = handle;
++ return &hifDevice[0];
++}
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++HIF_DEVICE *
++getHifDevice(SDDEVICE *handle)
++{
++ DBG_ASSERT(handle != NULL);
++ return &hifDevice[0];
++}
+
-+ if (events.Events & HIF_RECV_MSG_AVAIL) {
-+ lookAhead = events.LookAhead;
-+ if (0 == lookAhead) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs1 lookAhead is zero! \n"));
-+ }
-+ }
++void
++delHifDevice(SDDEVICE *handle)
++{
++ DBG_ASSERT(handle != NULL);
++ hifDevice[0].handle = NULL;
++}
+
-+ if (!(events.Events & HIF_OTHER_EVENTS) ||
-+ !(pDev->IrqEnableRegisters.int_status_enable & OTHER_INTS_ENABLED)) {
-+ /* no need to read the register table, no other interesting interrupts.
-+ * Some interfaces (like SPI) can shadow interrupt sources without
-+ * requiring the host to do a full table read */
-+ break;
-+ }
++struct device*
++HIFGetOSDevice(HIF_DEVICE *device)
++{
++ return &device->handle->Device->dev;
++}
+
-+ /* otherwise fall through and read the register table */
-+ }
++static void ResetAllCards(void)
++{
++ UINT8 data;
++ SDIO_STATUS status;
++ int i;
+
-+ /*
-+ * Read the first 28 bytes of the HTC register table. This will yield us
-+ * the value of different int status registers and the lookahead
-+ * registers.
-+ * length = sizeof(int_status) + sizeof(cpu_int_status) +
-+ * sizeof(error_int_status) + sizeof(counter_int_status) +
-+ * sizeof(mbox_frame) + sizeof(rx_lookahead_valid) +
-+ * sizeof(hole) + sizeof(rx_lookahead) +
-+ * sizeof(int_status_enable) + sizeof(cpu_int_status_enable) +
-+ * sizeof(error_status_enable) +
-+ * sizeof(counter_int_status_enable);
-+ *
-+ */
-+ status = HIFReadWrite(pDev->HIFDevice,
-+ HOST_INT_STATUS_ADDRESS,
-+ (A_UINT8 *)&pDev->IrqProcRegisters,
-+ AR6K_IRQ_PROC_REGS_SIZE,
-+ HIF_RD_SYNC_BYTE_INC,
-+ NULL);
++ data = SDIO_IO_RESET;
+
-+ if (A_FAILED(status)) {
-+ break;
++ /* set the I/O CARD reset bit:
++ * NOTE: we are exploiting a "feature" of the SDIO core that resets the core when you
++ * set the RES bit in the SDIO_IO_ABORT register. This bit however "normally" resets the
++ * I/O functions leaving the SDIO core in the same state (as per SDIO spec).
++ * In this design, this reset can be used to reset the SDIO core itself */
++ for (i = 0; i < HIF_MAX_DEVICES; i++) {
++ if (hifDevice[i].handle != NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
++ ("Issuing I/O Card reset for instance: %d \n",i));
++ /* set the I/O Card reset bit */
++ status = SDLIB_IssueCMD52(hifDevice[i].handle,
++ 0, /* function 0 space */
++ SDIO_IO_ABORT_REG,
++ &data,
++ 1, /* 1 byte */
++ TRUE); /* write */
+ }
++ }
+
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_IRQ)) {
-+ DevDumpRegisters(&pDev->IrqProcRegisters,
-+ &pDev->IrqEnableRegisters);
-+ }
++}
+
-+ /* Update only those registers that are enabled */
-+ host_int_status = pDev->IrqProcRegisters.host_int_status &
-+ pDev->IrqEnableRegisters.int_status_enable;
++void HIFSetHandle(void *hif_handle, void *handle)
++{
++ HIF_DEVICE *device = (HIF_DEVICE *) hif_handle;
+
-+ if (NULL == pDev->GetPendingEventsFunc) {
-+ /* only look at mailbox status if the HIF layer did not provide this function,
-+ * on some HIF interfaces reading the RX lookahead is not valid to do */
-+ if (host_int_status & (1 << HTC_MAILBOX)) {
-+ /* mask out pending mailbox value, we use "lookAhead" as the real flag for
-+ * mailbox processing below */
-+ host_int_status &= ~(1 << HTC_MAILBOX);
-+ if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX)) {
-+ /* mailbox has a message and the look ahead is valid */
-+ lookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
-+ if (0 == lookAhead) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs2, lookAhead is zero! \n"));
-+ }
-+ }
-+ }
-+ } else {
-+ /* not valid to check if the HIF has another mechanism for reading mailbox pending status*/
-+ host_int_status &= ~(1 << HTC_MAILBOX);
-+ }
++ device->htc_handle = handle;
+
-+ } while (FALSE);
++ return;
++}
+diff --git a/drivers/ar6000/hif/hif2.c b/drivers/ar6000/hif/hif2.c
+new file mode 100644
+index 0000000..386d96e
+--- /dev/null
++++ b/drivers/ar6000/hif/hif2.c
+@@ -0,0 +1,768 @@
++/*
++ * hif2.c - HIF layer re-implementation for the Linux SDIO stack
++ *
++ * Copyright (C) 2008, 2009 by OpenMoko, Inc.
++ * Written by Werner Almesberger <werner@openmoko.org>
++ * All Rights Reserved
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Based on:
++ *
++ * @abstract: HIF layer reference implementation for Atheros SDIO stack
++ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
++ */
+
+
-+ do {
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/list.h>
++#include <linux/wait.h>
++#include <linux/spinlock.h>
++#include <linux/mutex.h>
++#include <linux/sched.h>
++#include <linux/mmc/sdio_func.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/sdio_ids.h>
+
-+ /* did the interrupt status fetches succeed? */
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++#include "athdefs.h"
++#include "a_types.h"
++#include "hif.h"
+
-+ if ((0 == host_int_status) && (0 == lookAhead)) {
-+ /* nothing to process, the caller can use this to break out of a loop */
-+ *pDone = TRUE;
-+ break;
-+ }
+
-+ if (lookAhead != 0) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Pending mailbox message, LookAhead: 0x%X\n",lookAhead));
-+ /* Mailbox Interrupt, the HTC layer may issue async requests to empty the
-+ * mailbox...
-+ * When emptying the recv mailbox we use the async handler above called from the
-+ * completion routine of the callers read request. This can improve performance
-+ * by reducing context switching when we rapidly pull packets */
-+ status = pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, pASyncProcessing);
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+ }
++/* @@@ Hack - this wants cleaning up */
+
-+ /* now handle the rest of them */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
-+ (" Valid interrupt source(s) for OTHER interrupts: 0x%x\n",
-+ host_int_status));
++#ifdef CONFIG_MACH_NEO1973_GTA02
+
-+ if (HOST_INT_STATUS_CPU_GET(host_int_status)) {
-+ /* CPU Interrupt */
-+ status = DevServiceCPUInterrupt(pDev);
-+ if (A_FAILED(status)){
-+ break;
-+ }
-+ }
++#include <mach/gta02-pm-wlan.h>
+
-+ if (HOST_INT_STATUS_ERROR_GET(host_int_status)) {
-+ /* Error Interrupt */
-+ status = DevServiceErrorInterrupt(pDev);
-+ if (A_FAILED(status)){
-+ break;
-+ }
-+ }
++#else /* CONFIG_MACH_NEO1973_GTA02 */
+
-+ if (HOST_INT_STATUS_COUNTER_GET(host_int_status)) {
-+ /* Counter Interrupt */
-+ status = DevServiceCounterInterrupt(pDev);
-+ if (A_FAILED(status)){
-+ break;
-+ }
-+ }
++#define gta02_wlan_query_rfkill_lock() 1
++#define gta02_wlan_set_rfkill_cb(cb, hif) ((void) cb)
++#define gta02_wlan_query_rfkill_unlock()
++#define gta02_wlan_clear_rfkill_cb()
+
-+ } while (FALSE);
++#endif /* !CONFIG_MACH_NEO1973_GTA02 */
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-ProcessPendingIRQs: (done:%d, async:%d) status=%d \n",
-+ *pDone, *pASyncProcessing, status));
+
-+ return status;
-+}
++/*
++ * KNOWN BUGS:
++ *
++ * - HIF_DEVICE_IRQ_ASYNC_SYNC doesn't work yet (gets MMC errors)
++ * - latency can reach hundreds of ms, probably because of scheduling delays
++ * - packets go through about three queues before finally hitting the network
++ */
+
++/*
++ * Differences from Atheros' HIFs:
++ *
++ * - synchronous and asynchronous requests may get reordered with respect to
++ * each other, e.g., if HIFReadWrite returns for an asynchronous request and
++ * then HIFReadWrite is called for a synchronous request, the synchronous
++ * request may be executed before the asynchronous request.
++ *
++ * - request queue locking seems unnecessarily complex in the Atheros HIFs.
++ *
++ * - Atheros mask interrupts by calling sdio_claim_irq/sdio_release_irq, which
++ * can cause quite a bit of overhead. This HIF has its own light-weight
++ * interrupt masking.
++ *
++ * - Atheros call deviceInsertedHandler from a thread spawned off the probe or
++ * device insertion function. The original explanation for the Atheros SDIO
++ * stack said that this is done because a delay is needed to let the chip
++ * complete initialization. There is indeed a one second delay in the thread.
++ *
++ * The Atheros Linux SDIO HIF removes the delay and only retains the thread.
++ * Experimentally removing the thread didn't show any conflicts, so let's get
++ * rid of it for good.
++ *
++ * - The Atheros SDIO stack with Samuel's driver sets SDIO_CCCR_POWER in
++ * SDIO_POWER_EMPC. Atheros' Linux SDIO code apparently doesn't. We don't
++ * either, and this seems to work fine.
++ * @@@ Need to check this with Atheros.
++ */
+
-+/* Synchronousinterrupt handler, this handler kicks off all interrupt processing.*/
-+A_STATUS DevDsrHandler(void *context)
-+{
-+ AR6K_DEVICE *pDev = (AR6K_DEVICE *)context;
-+ A_STATUS status = A_OK;
-+ A_BOOL done = FALSE;
-+ A_BOOL asyncProc = FALSE;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDsrHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
++#define MBOXES 4
+
++#define HIF_MBOX_BLOCK_SIZE 128
++#define HIF_MBOX_BASE_ADDR 0x800
++#define HIF_MBOX_WIDTH 0x800
++#define HIF_MBOX_START_ADDR(mbox) \
++ (HIF_MBOX_BASE_ADDR+(mbox)*HIF_MBOX_WIDTH)
+
-+ while (!done) {
-+ status = ProcessPendingIRQs(pDev, &done, &asyncProc);
-+ if (A_FAILED(status)) {
-+ break;
-+ }
+
-+ if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
-+ /* the HIF layer does not allow async IRQ processing, override the asyncProc flag */
-+ asyncProc = FALSE;
-+ /* this will cause us to re-enter ProcessPendingIRQ() and re-read interrupt status registers.
-+ * this has a nice side effect of blocking us until all async read requests are completed.
-+ * This behavior is required on some HIF implementations that do not allow ASYNC
-+ * processing in interrupt handlers (like Windows CE) */
-+ }
++struct hif_device {
++ void *htc_handle;
++ struct sdio_func *func;
+
-+ if (asyncProc) {
-+ /* the function performed some async I/O for performance, we
-+ need to exit the ISR immediately, the check below will prevent the interrupt from being
-+ Ack'd while we handle it asynchronously */
-+ break;
-+ }
++ /*
++ * @@@ our sweet little bit of bogosity - the mechanism that lets us
++ * use the SDIO stack from softirqs. This really wants to use skbs.
++ */
++ struct list_head queue;
++ spinlock_t queue_lock;
++ struct task_struct *io_task;
++ wait_queue_head_t wait;
+
-+ }
++ /*
++ * activate_lock protects "active" and the activation/deactivation
++ * process itself.
++ *
++ * Relation to other locks: The SDIO function can be claimed while
++ * activate_lock is being held, but trying to acquire activate_lock
++ * while having ownership of the SDIO function could cause a deadlock.
++ */
++ int active;
++ struct mutex activate_lock;
++};
+
-+ if (A_SUCCESS(status) && !asyncProc) {
-+ /* Ack the interrupt only if :
-+ * 1. we did not get any errors in processing interrupts
-+ * 2. there are no outstanding async processing requests */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Acking interrupt from DevDsrHandler \n"));
-+ HIFAckInterrupt(pDev->HIFDevice);
-+ }
++struct hif_request {
++ struct list_head list;
++ struct sdio_func *func;
++ int (*read)(struct sdio_func *func,
++ void *dst, unsigned int addr, int count);
++ int (*write)(struct sdio_func *func,
++ unsigned int addr, void *src, int count);
++ void *buf;
++ unsigned long addr;
++ int len;
++ A_STATUS (*completion)(void *context, A_STATUS status);
++ void *context;
++};
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDsrHandler \n"));
-+ return A_OK;
-+}
+
++static HTC_CALLBACKS htcCallbacks;
+
-diff --git a/drivers/ar6000/htc/htc.c b/drivers/ar6000/htc/htc.c
-new file mode 100644
-index 0000000..d52ed94
---- /dev/null
-+++ b/drivers/ar6000/htc/htc.c
-@@ -0,0 +1,508 @@
+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * shutdown_lock prevents recursion through HIFShutDownDevice
+ */
-+
-+#include "htc_internal.h"
++static DEFINE_MUTEX(shutdown_lock);
+
+
-+static HTC_INIT_INFO HTCInitInfo = {NULL,NULL,NULL};
-+static A_BOOL HTCInitialized = FALSE;
++/* ----- Request processing ------------------------------------------------ */
+
-+static A_STATUS HTCTargetInsertedHandler(void *hif_handle);
-+static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status);
-+static void HTCReportFailure(void *Context);
+
-+/* Initializes the HTC layer */
-+A_STATUS HTCInit(HTC_INIT_INFO *pInitInfo)
++static A_STATUS process_request(struct hif_request *req)
+{
-+ HTC_CALLBACKS htcCallbacks;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Enter\n"));
-+ if (HTCInitialized) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
-+ return A_OK;
-+ }
++ int ret;
++ A_STATUS status;
+
-+ A_MEMCPY(&HTCInitInfo,pInitInfo,sizeof(HTC_INIT_INFO));
++ dev_dbg(&req->func->dev, "process_request(req %p)\n", req);
++ sdio_claim_host(req->func);
++ if (req->read) {
++ ret = req->read(req->func, req->buf, req->addr, req->len);
++ } else {
++ ret = req->write(req->func, req->addr, req->buf, req->len);
++ }
++ sdio_release_host(req->func);
++ status = ret ? A_ERROR : A_OK;
++ if (req->completion)
++ req->completion(req->context, status);
++ kfree(req);
++ return status;
++}
+
-+ A_MEMZERO(&htcCallbacks, sizeof(HTC_CALLBACKS));
+
-+ /* setup HIF layer callbacks */
-+ htcCallbacks.deviceInsertedHandler = HTCTargetInsertedHandler;
-+ htcCallbacks.deviceRemovedHandler = HTCTargetRemovedHandler;
-+ /* the device layer handles these */
-+ htcCallbacks.rwCompletionHandler = DevRWCompletionHandler;
-+ htcCallbacks.dsrHandler = DevDsrHandler;
-+ HIFInit(&htcCallbacks);
-+ HTCInitialized = TRUE;
++static void enqueue_request(struct hif_device *hif, struct hif_request *req)
++{
++ unsigned long flags;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
-+ return A_OK;
++ dev_dbg(&req->func->dev, "enqueue_request(req %p)\n", req);
++ spin_lock_irqsave(&hif->queue_lock, flags);
++ list_add_tail(&req->list, &hif->queue);
++ spin_unlock_irqrestore(&hif->queue_lock, flags);
++ wake_up(&hif->wait);
+}
+
-+void HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList)
-+{
-+ LOCK_HTC(target);
-+ HTC_PACKET_ENQUEUE(pList,pPacket);
-+ UNLOCK_HTC(target);
-+}
+
-+HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target, HTC_PACKET_QUEUE *pList)
++static struct hif_request *dequeue_request(struct hif_device *hif)
+{
-+ HTC_PACKET *pPacket;
-+
-+ LOCK_HTC(target);
-+ pPacket = HTC_PACKET_DEQUEUE(pList);
-+ UNLOCK_HTC(target);
++ struct hif_request *req;
++ unsigned long flags;
+
-+ return pPacket;
++ spin_lock_irqsave(&hif->queue_lock, flags);
++ if (list_empty(&hif->queue))
++ req = NULL;
++ else {
++ req = list_first_entry(&hif->queue,
++ struct hif_request, list);
++ list_del(&req->list);
++ }
++ spin_unlock_irqrestore(&hif->queue_lock, flags);
++ return req;
+}
+
-+/* cleanup the HTC instance */
-+static void HTCCleanup(HTC_TARGET *target)
-+{
-+ if (A_IS_MUTEX_VALID(&target->HTCLock)) {
-+ A_MUTEX_DELETE(&target->HTCLock);
-+ }
+
-+ if (A_IS_MUTEX_VALID(&target->HTCRxLock)) {
-+ A_MUTEX_DELETE(&target->HTCRxLock);
-+ }
++static void wait_queue_empty(struct hif_device *hif)
++{
++ unsigned long flags;
++ int empty;
+
-+ if (A_IS_MUTEX_VALID(&target->HTCTxLock)) {
-+ A_MUTEX_DELETE(&target->HTCTxLock);
-+ }
-+ /* free our instance */
-+ A_FREE(target);
++ while (1) {
++ spin_lock_irqsave(&hif->queue_lock, flags);
++ empty = list_empty(&hif->queue);
++ spin_unlock_irqrestore(&hif->queue_lock, flags);
++ if (empty)
++ break;
++ else
++ yield();
++ }
+}
+
-+/* registered target arrival callback from the HIF layer */
-+static A_STATUS HTCTargetInsertedHandler(void *hif_handle)
++
++static int io(void *data)
+{
-+ HTC_TARGET *target = NULL;
-+ A_STATUS status;
-+ int i;
++ struct hif_device *hif = data;
++ struct sched_param param = { .sched_priority = 2 };
++ /* one priority level slower than ksdioirqd (which is at 1) */
++ DEFINE_WAIT(wait);
++ struct hif_request *req;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Enter\n"));
++ sched_setscheduler(current, SCHED_FIFO, ¶m);
+
-+ do {
++ while (1) {
++ while (1) {
++ /*
++ * Since we never use signals here, one might think
++ * that this ought to be TASK_UNINTERRUPTIBLE. However,
++ * such a task would increase the load average and,
++ * worse, it would trigger the softlockup check.
++ */
++ prepare_to_wait(&hif->wait, &wait, TASK_INTERRUPTIBLE);
++ if (kthread_should_stop()) {
++ finish_wait(&hif->wait, &wait);
++ return 0;
++ }
++ req = dequeue_request(hif);
++ if (req)
++ break;
++ schedule();
++ }
++ finish_wait(&hif->wait, &wait);
+
-+ /* allocate target memory */
-+ if ((target = (HTC_TARGET *)A_MALLOC(sizeof(HTC_TARGET))) == NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to allocate memory\n"));
-+ status = A_ERROR;
-+ break;
-+ }
++ (void) process_request(req);
++ }
++ return 0;
++}
+
-+ A_MEMZERO(target, sizeof(HTC_TARGET));
-+ A_MUTEX_INIT(&target->HTCLock);
-+ A_MUTEX_INIT(&target->HTCRxLock);
-+ A_MUTEX_INIT(&target->HTCTxLock);
-+ INIT_HTC_PACKET_QUEUE(&target->ControlBufferTXFreeList);
-+ INIT_HTC_PACKET_QUEUE(&target->ControlBufferRXFreeList);
+
-+ /* give device layer the hif device handle */
-+ target->Device.HIFDevice = hif_handle;
-+ /* give the device layer our context (for event processing)
-+ * the device layer will register it's own context with HIF
-+ * so we need to set this so we can fetch it in the target remove handler */
-+ target->Device.HTCContext = target;
-+ /* set device layer target failure callback */
-+ target->Device.TargetFailureCallback = HTCReportFailure;
-+ /* set device layer recv message pending callback */
-+ target->Device.MessagePendingCallback = HTCRecvMessagePendingHandler;
-+ target->EpWaitingForBuffers = ENDPOINT_MAX;
++A_STATUS HIFReadWrite(HIF_DEVICE *hif, A_UINT32 address, A_UCHAR *buffer,
++ A_UINT32 length, A_UINT32 request, void *context)
++{
++ struct device *dev = HIFGetOSDevice(hif);
++ struct hif_request *req;
+
-+ /* setup device layer */
-+ status = DevSetup(&target->Device);
++ dev_dbg(dev, "HIFReadWrite(device %p, address 0x%x, buffer %p, "
++ "length %d, request 0x%x, context %p)\n",
++ hif, address, buffer, length, request, context);
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ BUG_ON(!(request & (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)));
++ BUG_ON(!(request & (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)));
++ BUG_ON(!(request & (HIF_READ | HIF_WRITE)));
++ BUG_ON(!(request & HIF_EXTENDED_IO));
+
-+ /* carve up buffers/packets for control messages */
-+ for (i = 0; i < NUM_CONTROL_RX_BUFFERS; i++) {
-+ HTC_PACKET *pControlPacket;
-+ pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
-+ SET_HTC_PACKET_INFO_RX_REFILL(pControlPacket,
-+ target,
-+ target->HTCControlBuffers[i].Buffer,
-+ HTC_CONTROL_BUFFER_SIZE,
-+ ENDPOINT_0);
-+ HTC_FREE_CONTROL_RX(target,pControlPacket);
-+ }
++ if (address >= HIF_MBOX_START_ADDR(0) &&
++ address < HIF_MBOX_START_ADDR(MBOXES+1)) {
++ BUG_ON(length > HIF_MBOX_WIDTH);
++ /* Adjust the address so that the last byte falls on the EOM
++ address. */
++ address += HIF_MBOX_WIDTH-length;
++ }
+
-+ for (;i < NUM_CONTROL_BUFFERS;i++) {
-+ HTC_PACKET *pControlPacket;
-+ pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
-+ INIT_HTC_PACKET_INFO(pControlPacket,
-+ target->HTCControlBuffers[i].Buffer,
-+ HTC_CONTROL_BUFFER_SIZE);
-+ HTC_FREE_CONTROL_TX(target,pControlPacket);
-+ }
++ req = kzalloc(sizeof(*req), GFP_ATOMIC);
++ if (!req) {
++ if (request & HIF_ASYNCHRONOUS)
++ htcCallbacks.rwCompletionHandler(context, A_ERROR);
++ return A_ERROR;
++ }
+
-+ } while (FALSE);
++ req->func = hif->func;
++ req->addr = address;
++ req->buf = buffer;
++ req->len = length;
+
-+ if (A_SUCCESS(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" calling AddInstance callback \n"));
-+ /* announce ourselves */
-+ HTCInitInfo.AddInstance((HTC_HANDLE)target);
-+ } else {
-+ if (target != NULL) {
-+ HTCCleanup(target);
-+ }
-+ }
++ if (request & HIF_READ) {
++ if (request & HIF_FIXED_ADDRESS)
++ req->read = sdio_readsb;
++ else
++ req->read = sdio_memcpy_fromio;
++ } else {
++ if (request & HIF_FIXED_ADDRESS)
++ req->write = sdio_writesb;
++ else
++ req->write = sdio_memcpy_toio;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Exit\n"));
++ if (!(request & HIF_ASYNCHRONOUS))
++ return process_request(req);
+
-+ return status;
++ req->completion = htcCallbacks.rwCompletionHandler;
++ req->context = context;
++ enqueue_request(hif, req);
++
++ return A_OK;
+}
+
-+/* registered removal callback from the HIF layer */
-+static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status)
-+{
-+ HTC_TARGET *target;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCTargetRemovedHandler handle:0x%X \n",(A_UINT32)handle));
++/* ----- Interrupt handling ------------------------------------------------ */
+
-+ if (NULL == handle) {
-+ /* this could be NULL in the event that target initialization failed */
-+ return A_OK;
-+ }
++/*
++ * Volatile ought to be good enough to make gcc do the right thing on S3C24xx.
++ * No need to use atomic or put barriers, keeping the code more readable.
++ *
++ * Warning: this story changes if going SMP/SMT.
++ */
+
-+ target = ((AR6K_DEVICE *)handle)->HTCContext;
++static volatile int masked = 1;
++static volatile int pending;
++static volatile int in_interrupt;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" removing target:0x%X instance:0x%X ... \n",
-+ (A_UINT32)target, (A_UINT32)target->pInstanceContext));
+
-+ if (target->pInstanceContext != NULL) {
-+ /* let upper layer know, it needs to call HTCStop() */
-+ HTCInitInfo.DeleteInstance(target->pInstanceContext);
-+ }
++static void ar6000_do_irq(struct sdio_func *func)
++{
++ HIF_DEVICE *hif = sdio_get_drvdata(func);
++ struct device *dev = HIFGetOSDevice(hif);
++ A_STATUS status;
+
-+ HIFShutDownDevice(target->Device.HIFDevice);
++ dev_dbg(dev, "ar6000_do_irq -> %p\n", htcCallbacks.dsrHandler);
+
-+ HTCCleanup(target);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCTargetRemovedHandler \n"));
-+ return A_OK;
++ status = htcCallbacks.dsrHandler(hif->htc_handle);
++ BUG_ON(status != A_OK);
+}
+
-+/* get the low level HIF device for the caller , the caller may wish to do low level
-+ * HIF requests */
-+void *HTCGetHifDevice(HTC_HANDLE HTCHandle)
-+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ return target->Device.HIFDevice;
-+}
+
-+/* set the instance block for this HTC handle, so that on removal, the blob can be
-+ * returned to the caller */
-+void HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance)
++static void sdio_ar6000_irq(struct sdio_func *func)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HIF_DEVICE *hif = sdio_get_drvdata(func);
++ struct device *dev = HIFGetOSDevice(hif);
+
-+ target->pInstanceContext = Instance;
++ dev_dbg(dev, "sdio_ar6000_irq\n");
++
++ in_interrupt = 1;
++ if (masked) {
++ in_interrupt = 0;
++ pending++;
++ return;
++ }
++ /*
++ * @@@ This is ugly. If we don't drop the lock, we'll deadlock when
++ * the handler tries to do SDIO. So there are four choices:
++ *
++ * 1) Break the call chain by calling the callback from a workqueue.
++ * Ugh.
++ * 2) Make process_request aware that we already have the lock.
++ * 3) Drop the lock. Which is ugly but should be safe as long as we're
++ * making sure the device doesn't go away.
++ * 4) Change the AR6k driver such that it only issues asynchronous
++ * quests when called from an interrupt.
++ *
++ * Solution 2) is probably the best for now. Will try it later.
++ */
++ sdio_release_host(func);
++ ar6000_do_irq(func);
++ sdio_claim_host(func);
++ in_interrupt = 0;
+}
+
-+/* wait for the target to arrive (sends HTC Ready message)
-+ * this operation is fully synchronous and the message is polled for */
-+A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
++
++void HIFAckInterrupt(HIF_DEVICE *hif)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ A_STATUS status;
-+ HTC_PACKET *pPacket = NULL;
-+ HTC_READY_MSG *pRdyMsg;
-+ HTC_SERVICE_CONNECT_REQ connect;
-+ HTC_SERVICE_CONNECT_RESP resp;
++ struct device *dev = HIFGetOSDevice(hif);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%X) \n", (A_UINT32)target));
++ dev_dbg(dev, "HIFAckInterrupt\n");
++ /* do nothing */
++}
+
-+ do {
+
-+#ifdef MBOXHW_UNIT_TEST
++void HIFUnMaskInterrupt(HIF_DEVICE *hif)
++{
++ struct device *dev = HIFGetOSDevice(hif);
+
-+ status = DoMboxHWTest(&target->Device);
++ dev_dbg(dev, "HIFUnMaskInterrupt\n");
++ do {
++ masked = 1;
++ if (pending) {
++ pending = 0;
++ ar6000_do_irq(hif->func);
++ /* We may take an interrupt before unmasking and thus
++ get it pending. In this case, we just loop back. */
++ }
++ masked = 0;
++ }
++ while (pending);
++}
+
-+ if (status != A_OK) {
-+ break;
-+ }
+
-+#endif
++void HIFMaskInterrupt(HIF_DEVICE *hif)
++{
++ struct device *dev = HIFGetOSDevice(hif);
+
-+ /* we should be getting 1 control message that the target is ready */
-+ status = HTCWaitforControlMessage(target, &pPacket);
++ dev_dbg(dev, "HIFMaskInterrupt\n");
++ /*
++ * Since sdio_ar6000_irq can also be called from a process context, we
++ * may conceivably end up racing with it. Thus, we need to wait until
++ * we can be sure that no concurrent interrupt processing is going on
++ * before we return.
++ *
++ * Note: this may be a bit on the paranoid side - the callers may
++ * actually be nice enough to disable scheduling. Check later.
++ */
++ masked = 1;
++ while (in_interrupt)
++ yield();
++}
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Target Not Available!!\n"));
-+ break;
-+ }
+
-+ /* we controlled the buffer creation so it has to be properly aligned */
-+ pRdyMsg = (HTC_READY_MSG *)pPacket->pBuffer;
++/* ----- HIF API glue functions -------------------------------------------- */
+
-+ if ((pRdyMsg->MessageID != HTC_MSG_READY_ID) ||
-+ (pPacket->ActualLength < sizeof(HTC_READY_MSG))) {
-+ /* this message is not valid */
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
+
-+ if (pRdyMsg->CreditCount == 0 || pRdyMsg->CreditSize == 0) {
-+ /* this message is not valid */
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
++struct device *HIFGetOSDevice(HIF_DEVICE *hif)
++{
++ return &hif->func->dev;
++}
+
-+ target->TargetCredits = pRdyMsg->CreditCount;
-+ target->TargetCreditSize = pRdyMsg->CreditSize;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" Target Ready: credits: %d credit size: %d\n",
-+ target->TargetCredits, target->TargetCreditSize));
++void HIFSetHandle(void *hif_handle, void *handle)
++{
++ HIF_DEVICE *hif = (HIF_DEVICE *) hif_handle;
+
-+ /* setup our pseudo HTC control endpoint connection */
-+ A_MEMZERO(&connect,sizeof(connect));
-+ A_MEMZERO(&resp,sizeof(resp));
-+ connect.EpCallbacks.pContext = target;
-+ connect.EpCallbacks.EpTxComplete = HTCControlTxComplete;
-+ connect.EpCallbacks.EpRecv = HTCControlRecv;
-+ connect.EpCallbacks.EpRecvRefill = NULL; /* not needed */
-+ connect.EpCallbacks.EpSendFull = NULL; /* not needed */
-+ connect.EpCallbacks.EpSendAvail = NULL; /* not needed */
-+ connect.MaxSendQueueDepth = NUM_CONTROL_BUFFERS;
-+ connect.ServiceID = HTC_CTRL_RSVD_SVC;
++ hif->htc_handle = handle;
++}
+
-+ /* connect fake service */
-+ status = HTCConnectService((HTC_HANDLE)target,
-+ &connect,
-+ &resp);
+
-+ if (!A_FAILED(status)) {
-+ break;
-+ }
++/* ----- Device configuration (HIF side) ----------------------------------- */
+
-+ } while (FALSE);
+
-+ if (pPacket != NULL) {
-+ HTC_FREE_CONTROL_RX(target,pPacket);
-+ }
++A_STATUS HIFConfigureDevice(HIF_DEVICE *hif,
++ HIF_DEVICE_CONFIG_OPCODE opcode, void *config, A_UINT32 configLen)
++{
++ struct device *dev = HIFGetOSDevice(hif);
++ HIF_DEVICE_IRQ_PROCESSING_MODE *ipm_cfg = config;
++ A_UINT32 *mbs_cfg = config;
++ int i;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Exit\n"));
++ dev_dbg(dev, "HIFConfigureDevice\n");
+
-+ return status;
++ switch (opcode) {
++ case HIF_DEVICE_GET_MBOX_BLOCK_SIZE:
++ for (i = 0; i != MBOXES; i++)
++ mbs_cfg[i] = HIF_MBOX_BLOCK_SIZE;
++ break;
++ case HIF_DEVICE_GET_MBOX_ADDR:
++ for (i = 0; i != MBOXES; i++)
++ mbs_cfg[i] = HIF_MBOX_START_ADDR(i);
++ break;
++ case HIF_DEVICE_GET_IRQ_PROC_MODE:
++ *ipm_cfg = HIF_DEVICE_IRQ_SYNC_ONLY;
++// *ipm_cfg = HIF_DEVICE_IRQ_ASYNC_SYNC;
++ break;
++ default:
++ return A_ERROR;
++ }
++ return A_OK;
+}
+
+
++/* ----- Device probe and removal (Linux side) ----------------------------- */
++
+
-+/* Start HTC, enable interrupts and let the target know host has finished setup */
-+A_STATUS HTCStart(HTC_HANDLE HTCHandle)
++static int ar6000_do_activate(struct hif_device *hif)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ HTC_PACKET *pPacket;
-+ A_STATUS status;
++ struct sdio_func *func = hif->func;
++ struct device *dev = &func->dev;
++ int ret;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Enter\n"));
++ dev_dbg(dev, "ar6000_do_activate\n");
+
-+ /* now that we are starting, push control receive buffers into the
-+ * HTC control endpoint */
++ sdio_claim_host(func);
++ sdio_enable_func(func);
+
-+ while (1) {
-+ pPacket = HTC_ALLOC_CONTROL_RX(target);
-+ if (NULL == pPacket) {
-+ break;
-+ }
-+ HTCAddReceivePkt((HTC_HANDLE)target,pPacket);
-+ }
++ INIT_LIST_HEAD(&hif->queue);
++ init_waitqueue_head(&hif->wait);
++ spin_lock_init(&hif->queue_lock);
+
-+ do {
++ ret = sdio_set_block_size(func, HIF_MBOX_BLOCK_SIZE);
++ if (ret < 0) {
++ dev_err(dev, "sdio_set_block_size returns %d\n", ret);
++ goto out_enabled;
++ }
++ ret = sdio_claim_irq(func, sdio_ar6000_irq);
++ if (ret) {
++ dev_err(dev, "sdio_claim_irq returns %d\n", ret);
++ goto out_enabled;
++ }
++ /* Set SDIO_BUS_CD_DISABLE in SDIO_CCCR_IF ? */
++#if 0
++ sdio_f0_writeb(func, SDIO_CCCR_CAP_E4MI, SDIO_CCCR_CAPS, &ret);
++ if (ret) {
++ dev_err(dev, "sdio_f0_writeb(SDIO_CCCR_CAPS) returns %d\n",
++ ret);
++ goto out_got_irq;
++ }
++#else
++ if (0) /* avoid warning */
++ goto out_got_irq;
++#endif
+
-+ AR_DEBUG_ASSERT(target->InitCredits != NULL);
-+ AR_DEBUG_ASSERT(target->EpCreditDistributionListHead != NULL);
-+ AR_DEBUG_ASSERT(target->EpCreditDistributionListHead->pNext != NULL);
++ sdio_release_host(func);
+
-+ /* call init credits callback to do the distribution ,
-+ * NOTE: the first entry in the distribution list is ENDPOINT_0, so
-+ * we pass the start of the list after this one. */
-+ target->InitCredits(target->pCredDistContext,
-+ target->EpCreditDistributionListHead->pNext,
-+ target->TargetCredits);
++ hif->io_task = kthread_run(io, hif, "ar6000_io");
++ ret = IS_ERR(hif->io_task);
++ if (ret) {
++ dev_err(dev, "kthread_run(ar6000_io): %d\n", ret);
++ goto out_func_ready;
++ }
+
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_TRC)) {
-+ DumpCreditDistStates(target);
-+ }
++ ret = htcCallbacks.deviceInsertedHandler(hif);
++ if (ret == A_OK)
++ return 0;
+
-+ /* the caller is done connecting to services, so we can indicate to the
-+ * target that the setup phase is complete */
-+ status = HTCSendSetupComplete(target);
++ dev_err(dev, "deviceInsertedHandler: %d\n", ret);
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ ret = kthread_stop(hif->io_task);
++ if (ret)
++ dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
+
-+ /* unmask interrupts */
-+ status = DevUnmaskInterrupts(&target->Device);
++out_func_ready:
++ sdio_claim_host(func);
+
-+ if (A_FAILED(status)) {
-+ HTCStop(target);
-+ }
++out_got_irq:
++ sdio_release_irq(func);
+
-+ } while (FALSE);
++out_enabled:
++ sdio_disable_func(func);
++ sdio_release_host(func);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Exit\n"));
-+ return status;
++ return ret;
+}
+
+
-+/* stop HTC communications, i.e. stop interrupt reception, and flush all queued buffers */
-+void HTCStop(HTC_HANDLE HTCHandle)
++static void ar6000_do_deactivate(struct hif_device *hif)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCStop \n"));
-+
-+ /* mark that we are shutting down .. */
-+ target->HTCStateFlags |= HTC_STATE_STOPPING;
-+
-+ /* Masking interrupts is a synchronous operation, when this function returns
-+ * all pending HIF I/O has completed, we can safely flush the queues */
-+ DevMaskInterrupts(&target->Device);
++ struct sdio_func *func = hif->func;
++ struct device *dev = &func->dev;
++ int ret;
+
-+ /* flush all send packets */
-+ HTCFlushSendPkts(target);
-+ /* flush all recv buffers */
-+ HTCFlushRecvBuffers(target);
++ dev_dbg(dev, "ar6000_do_deactivate\n");
++ if (!hif->active)
++ return;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCStop \n"));
++ if (mutex_trylock(&shutdown_lock)) {
++ /*
++ * Funny, Atheros' HIF does this call, but this just puts us in
++ * a recursion through HTCShutDown/HIFShutDown if unloading the
++ * module.
++ *
++ * However, we need it for suspend/resume. See the comment at
++ * HIFShutDown, below.
++ */
++ ret = htcCallbacks.deviceRemovedHandler(hif->htc_handle, A_OK);
++ if (ret != A_OK)
++ dev_err(dev, "deviceRemovedHandler: %d\n", ret);
++ mutex_unlock(&shutdown_lock);
++ }
++ wait_queue_empty(hif);
++ ret = kthread_stop(hif->io_task);
++ if (ret)
++ dev_err(dev, "kthread_stop (ar6000_io): %d\n", ret);
++ sdio_claim_host(func);
++ sdio_release_irq(func);
++ sdio_disable_func(func);
++ sdio_release_host(func);
+}
+
-+/* undo what was done in HTCInit() */
-+void HTCShutDown(void)
-+{
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCShutDown: \n"));
-+ HTCInitialized = FALSE;
-+ /* undo HTCInit */
-+ HIFShutDownDevice(NULL);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCShutDown: \n"));
-+}
+
-+void HTCDumpCreditStates(HTC_HANDLE HTCHandle)
++static int ar6000_activate(struct hif_device *hif)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ int ret = 0;
+
-+ LOCK_HTC_TX(target);
++ dev_dbg(&hif->func->dev, "ar6000_activate\n");
++ mutex_lock(&hif->activate_lock);
++ if (!hif->active) {
++ ret = ar6000_do_activate(hif);
++ if (ret) {
++ printk(KERN_ERR "%s: Failed to activate %d\n",
++ __func__, ret);
++ goto out;
++ }
++ hif->active = 1;
++ }
++out:
++ mutex_unlock(&hif->activate_lock);
++ return ret;
++}
+
-+ DumpCreditDistStates(target);
+
-+ UNLOCK_HTC_TX(target);
++static void ar6000_deactivate(struct hif_device *hif)
++{
++ dev_dbg(&hif->func->dev, "ar6000_deactivate\n");
++ mutex_lock(&hif->activate_lock);
++ if (hif->active) {
++ ar6000_do_deactivate(hif);
++ hif->active = 0;
++ }
++ mutex_unlock(&hif->activate_lock);
+}
+
-+/* report a target failure from the device, this is a callback from the device layer
-+ * which uses a mechanism to report errors from the target (i.e. special interrupts) */
-+static void HTCReportFailure(void *Context)
-+{
-+ HTC_TARGET *target = (HTC_TARGET *)Context;
+
-+ target->TargetFailure = TRUE;
++static int ar6000_rfkill_cb(void *data, int on)
++{
++ struct hif_device *hif = data;
++ struct sdio_func *func = hif->func;
++ struct device *dev = &func->dev;
+
-+ if ((target->pInstanceContext != NULL) && (HTCInitInfo.TargetFailure != NULL)) {
-+ /* let upper layer know, it needs to call HTCStop() */
-+ HTCInitInfo.TargetFailure(target->pInstanceContext, A_ERROR);
-+ }
++ dev_dbg(dev, "ar6000_rfkill_cb: on %d\n", on);
++ if (on)
++ return ar6000_activate(hif);
++ ar6000_deactivate(hif);
++ return 0;
+}
+
-+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription)
-+{
-+ A_CHAR stream[60];
-+ A_UINT32 i;
-+ A_UINT16 offset, count;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<---------Dumping %d Bytes : %s ------>\n", length, pDescription));
++static int sdio_ar6000_probe(struct sdio_func *func,
++ const struct sdio_device_id *id)
++{
++ struct device *dev = &func->dev;
++ struct hif_device *hif;
++ int ret = 0;
+
-+ count = 0;
-+ offset = 0;
-+ for(i = 0; i < length; i++) {
-+ sprintf(stream + offset, "%2.2X ", buffer[i]);
-+ count ++;
-+ offset += 3;
++ dev_dbg(dev, "sdio_ar6000_probe\n");
++ BUG_ON(!htcCallbacks.deviceInsertedHandler);
+
-+ if(count == 16) {
-+ count = 0;
-+ offset = 0;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
-+ A_MEMZERO(stream, 60);
-+ }
-+ }
++ hif = kzalloc(sizeof(*hif), GFP_KERNEL);
++ if (!hif)
++ return -ENOMEM;
+
-+ if(offset != 0) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
-+ }
++ sdio_set_drvdata(func, hif);
++ hif->func = func;
++ mutex_init(&hif->activate_lock);
++ hif->active = 0;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<------------------------------------------------->\n"));
++ if (gta02_wlan_query_rfkill_lock())
++ ret = ar6000_activate(hif);
++ if (!ret) {
++ gta02_wlan_set_rfkill_cb(ar6000_rfkill_cb, hif);
++ return 0;
++ }
++ gta02_wlan_query_rfkill_unlock();
++ sdio_set_drvdata(func, NULL);
++ kfree(hif);
++ return ret;
+}
+
-+A_BOOL HTCGetEndpointStatistics(HTC_HANDLE HTCHandle,
-+ HTC_ENDPOINT_ID Endpoint,
-+ HTC_ENDPOINT_STAT_ACTION Action,
-+ HTC_ENDPOINT_STATS *pStats)
++
++static void sdio_ar6000_remove(struct sdio_func *func)
+{
++ struct device *dev = &func->dev;
++ HIF_DEVICE *hif = sdio_get_drvdata(func);
+
-+#ifdef HTC_EP_STAT_PROFILING
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ A_BOOL clearStats = FALSE;
-+ A_BOOL sample = FALSE;
++ dev_dbg(dev, "sdio_ar6000_remove\n");
++ gta02_wlan_clear_rfkill_cb();
++ ar6000_deactivate(hif);
++ sdio_set_drvdata(func, NULL);
++ kfree(hif);
++}
+
-+ switch (Action) {
-+ case HTC_EP_STAT_SAMPLE :
-+ sample = TRUE;
-+ break;
-+ case HTC_EP_STAT_SAMPLE_AND_CLEAR :
-+ sample = TRUE;
-+ clearStats = TRUE;
-+ break;
-+ case HTC_EP_STAT_CLEAR :
-+ clearStats = TRUE;
-+ break;
-+ default:
-+ break;
-+ }
+
-+ A_ASSERT(Endpoint < ENDPOINT_MAX);
++/* ----- Device registration/unregistration (called by HIF) ---------------- */
+
-+ /* lock out TX and RX while we sample and/or clear */
-+ LOCK_HTC_TX(target);
-+ LOCK_HTC_RX(target);
+
-+ if (sample) {
-+ A_ASSERT(pStats != NULL);
-+ /* return the stats to the caller */
-+ A_MEMCPY(pStats, &target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
-+ }
++#define ATHEROS_SDIO_DEVICE(id, offset) \
++ SDIO_DEVICE(SDIO_VENDOR_ID_ATHEROS, SDIO_DEVICE_ID_ATHEROS_##id | (offset))
+
-+ if (clearStats) {
-+ /* reset stats */
-+ A_MEMZERO(&target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
-+ }
++static const struct sdio_device_id sdio_ar6000_ids[] = {
++ { ATHEROS_SDIO_DEVICE(AR6002, 0) },
++ { ATHEROS_SDIO_DEVICE(AR6002, 0x1) },
++ { ATHEROS_SDIO_DEVICE(AR6001, 0x8) },
++ { ATHEROS_SDIO_DEVICE(AR6001, 0x9) },
++ { ATHEROS_SDIO_DEVICE(AR6001, 0xa) },
++ { ATHEROS_SDIO_DEVICE(AR6001, 0xb) },
++ { /* end: all zeroes */ },
++};
+
-+ UNLOCK_HTC_RX(target);
-+ UNLOCK_HTC_TX(target);
++MODULE_DEVICE_TABLE(sdio, sdio_ar6000_ids);
+
-+ return TRUE;
-+#else
-+ return FALSE;
-+#endif
++
++static struct sdio_driver sdio_ar6000_driver = {
++ .probe = sdio_ar6000_probe,
++ .remove = sdio_ar6000_remove,
++ .name = "sdio_ar6000",
++ .id_table = sdio_ar6000_ids,
++};
++
++
++int HIFInit(HTC_CALLBACKS *callbacks)
++{
++ int ret;
++
++ BUG_ON(!callbacks);
++
++ printk(KERN_DEBUG "HIFInit\n");
++ htcCallbacks = *callbacks;
++
++ ret = sdio_register_driver(&sdio_ar6000_driver);
++ if (ret) {
++ printk(KERN_ERR
++ "sdio_register_driver(sdio_ar6000_driver): %d\n", ret);
++ return A_ERROR;
++ }
++
++ return 0;
+}
-diff --git a/drivers/ar6000/htc/htc_debug.h b/drivers/ar6000/htc/htc_debug.h
-new file mode 100644
-index 0000000..08080be
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_debug.h
-@@ -0,0 +1,65 @@
-+#ifndef HTC_DEBUG_H_
-+#define HTC_DEBUG_H_
++
++
+/*
++ * We have four possible call chains here:
+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
++ * System shutdown/reboot:
+ *
++ * kernel_restart_prepare ...> device_shutdown ... > s3cmci_shutdown ->
++ * mmc_remove_host ..> sdio_bus_remove -> sdio_ar6000_remove ->
++ * ar6000_deactivate -> ar6000_do_deactivate ->
++ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
++ * This is roughly the same sequence as suspend, described below.
+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
++ * Module removal:
++ *
++ * sys_delete_module -> ar6000_cleanup_module -> HTCShutDown ->
++ * HIFShutDownDevice -> sdio_unregister_driver ...> sdio_bus_remove ->
++ * sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate
++ *
++ * In this case, HIFShutDownDevice must call sdio_unregister_driver to
++ * notify the driver about its removal. ar6000_do_deactivate must not call
++ * deviceRemovedHandler, because that would loop back into HIFShutDownDevice.
++ *
++ * Suspend:
++ *
++ * device_suspend ...> s3cmci_suspend ...> sdio_bus_remove ->
++ * sdio_ar6000_remove -> ar6000_deactivate -> ar6000_do_deactivate ->
++ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
++ *
++ * We must call deviceRemovedHandler to inform the ar6k stack that the device
++ * has been removed. Since HTCTargetRemovedHandler calls back into
++ * HIFShutDownDevice, we must also prevent the call to
++ * sdio_unregister_driver, or we'd end up recursing into the SDIO stack,
++ * eventually deadlocking somewhere.
+ *
++ * rfkill:
+ *
++ * rfkill_state_store -> rfkill_toggle_radio -> gta02_wlan_toggle_radio ->
++ * ar6000_rfkill_cb -> ar6000_deactivate -> ar6000_do_deactivate ->
++ * deviceRemovedHandler (HTCTargetRemovedHandler) -> HIFShutDownDevice
+ *
++ * This is similar to suspend - only the entry point changes.
+ */
+
-+/* ------- Debug related stuff ------- */
-+enum {
-+ ATH_DEBUG_SEND = 0x0001,
-+ ATH_DEBUG_RECV = 0x0002,
-+ ATH_DEBUG_SYNC = 0x0004,
-+ ATH_DEBUG_DUMP = 0x0008,
-+ ATH_DEBUG_IRQ = 0x0010,
-+ ATH_DEBUG_TRC = 0x0020,
-+ ATH_DEBUG_WARN = 0x0040,
-+ ATH_DEBUG_ERR = 0x0080,
-+ ATH_DEBUG_ANY = 0xFFFF,
-+};
-+
-+#ifdef DEBUG
-+
-+// TODO FIX usage of A_PRINTF!
-+#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc) do { \
-+ if (debughtc & ATH_DEBUG_DUMP) { \
-+ DebugDumpBytes(buffer, length,desc); \
-+ } \
-+} while(0)
-+#define PRINTX_ARG(arg...) arg
-+#define AR_DEBUG_PRINTF(flags, args) do { \
-+ if (debughtc & (flags)) { \
-+ A_PRINTF(KERN_ALERT PRINTX_ARG args); \
-+ } \
-+} while (0)
-+#define AR_DEBUG_ASSERT(test) do { \
-+ if (!(test)) { \
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test)); \
-+ } \
-+} while(0)
-+extern int debughtc;
-+#else
-+#define AR_DEBUG_PRINTF(flags, args)
-+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
-+#define AR_DEBUG_ASSERT(test)
-+#define AR_DEBUG_LVL_CHECK(lvl) 0
-+#endif
-+
-+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
-+
-+#endif /*HTC_DEBUG_H_*/
-diff --git a/drivers/ar6000/htc/htc_internal.h b/drivers/ar6000/htc/htc_internal.h
++void HIFShutDownDevice(HIF_DEVICE *hif)
++{
++ /* Beware, HTCShutDown calls us with hif == NULL ! */
++ if (mutex_trylock(&shutdown_lock)) {
++ sdio_unregister_driver(&sdio_ar6000_driver);
++ mutex_unlock(&shutdown_lock);
++ }
++}
+diff --git a/drivers/ar6000/hif/hif_internal.h b/drivers/ar6000/hif/hif_internal.h
new file mode 100644
-index 0000000..ebb8ac1
+index 0000000..d8fc101
--- /dev/null
-+++ b/drivers/ar6000/htc/htc_internal.h
-@@ -0,0 +1,168 @@
++++ b/drivers/ar6000/hif/hif_internal.h
+@@ -0,0 +1,102 @@
+/*
++ * @file: hif_internal.h
+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
++ * @abstract: internal header file for hif layer
++ *
++ * @notice: Copyright (c) 2004-2006 Atheros Communications Inc.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ *
+ */
+
-+#ifndef _HTC_INTERNAL_H_
-+#define _HTC_INTERNAL_H_
-+
-+/* for debugging, uncomment this to capture the last frame header, on frame header
-+ * processing errors, the last frame header is dump for comparison */
-+//#define HTC_CAPTURE_LAST_FRAME
-+
-+//#define HTC_EP_STAT_PROFILING
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
-+
-+/* Header files */
++#include <linux/sdio/ctsystem.h>
++#include <linux/sdio/sdio_busdriver.h>
++#include <linux/sdio/_sdio_defs.h>
++#include <linux/sdio/sdio_lib.h>
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_types.h"
+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "htc.h"
-+#include "htc_api.h"
-+#include "bmi_msg.h"
+#include "hif.h"
-+#include "ar6k.h"
+
-+/* HTC operational parameters */
-+#define HTC_TARGET_RESPONSE_TIMEOUT 2000 /* in ms */
-+#define HTC_TARGET_DEBUG_INTR_MASK 0x01
-+#define HTC_TARGET_CREDIT_INTR_MASK 0xF0
++#define MANUFACTURER_ID_AR6001_BASE 0x100
++#define MANUFACTURER_ID_AR6002_BASE 0x200
++#define FUNCTION_CLASS 0x0
++#define MANUFACTURER_CODE 0x271
+
-+typedef struct _HTC_ENDPOINT {
-+ HTC_SERVICE_ID ServiceID; /* service ID this endpoint is bound to
-+ non-zero value means this endpoint is in use */
-+ HTC_PACKET_QUEUE TxQueue; /* HTC frame buffer TX queue */
-+ HTC_PACKET_QUEUE RxBuffers; /* HTC frame buffer RX list */
-+ HTC_ENDPOINT_CREDIT_DIST CreditDist; /* credit distribution structure (exposed to driver layer) */
-+ HTC_EP_CALLBACKS EpCallBacks; /* callbacks associated with this endpoint */
-+ int MaxTxQueueDepth; /* max depth of the TX queue before we need to
-+ call driver's full handler */
-+ int CurrentTxQueueDepth; /* current TX queue depth */
-+ int MaxMsgLength; /* max length of endpoint message */
-+#ifdef HTC_EP_STAT_PROFILING
-+ HTC_ENDPOINT_STATS EndPointStats; /* endpoint statistics */
-+#endif
-+} HTC_ENDPOINT;
++#define BUS_REQUEST_MAX_NUM 64
+
-+#ifdef HTC_EP_STAT_PROFILING
-+#define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
-+#else
-+#define INC_HTC_EP_STAT(p,stat,count)
-+#endif
++#define SDIO_CLOCK_FREQUENCY_DEFAULT 25000000
++#define SDWLAN_ENABLE_DISABLE_TIMEOUT 20
++#define FLAGS_CARD_ENAB 0x02
++#define FLAGS_CARD_IRQ_UNMSK 0x04
+
-+#define HTC_SERVICE_TX_PACKET_TAG HTC_TX_PACKET_TAG_INTERNAL
++#define HIF_MBOX_BLOCK_SIZE 128
++#define HIF_MBOX_BASE_ADDR 0x800
++#define HIF_MBOX_WIDTH 0x800
++#define HIF_MBOX0_BLOCK_SIZE 1
++#define HIF_MBOX1_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
++#define HIF_MBOX2_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
++#define HIF_MBOX3_BLOCK_SIZE HIF_MBOX_BLOCK_SIZE
+
-+#define NUM_CONTROL_BUFFERS 8
-+#define NUM_CONTROL_TX_BUFFERS 2
-+#define NUM_CONTROL_RX_BUFFERS (NUM_CONTROL_BUFFERS - NUM_CONTROL_TX_BUFFERS)
++#define HIF_MBOX_START_ADDR(mbox) \
++ HIF_MBOX_BASE_ADDR + mbox * HIF_MBOX_WIDTH
+
-+#define HTC_CONTROL_BUFFER_SIZE (HTC_MAX_CONTROL_MESSAGE_LENGTH + HTC_HDR_LENGTH)
++#define HIF_MBOX_END_ADDR(mbox) \
++ HIF_MBOX_START_ADDR(mbox) + HIF_MBOX_WIDTH - 1
+
-+typedef struct HTC_CONTROL_BUFFER {
-+ HTC_PACKET HtcPacket;
-+ A_UINT8 Buffer[HTC_CONTROL_BUFFER_SIZE];
-+} HTC_CONTROL_BUFFER;
++struct hif_device {
++ SDDEVICE *handle;
++ void *htc_handle;
++ OSKERNEL_HELPER insert_helper;
++ BOOL helper_started;
++};
+
-+/* our HTC target state */
-+typedef struct _HTC_TARGET {
-+ HTC_ENDPOINT EndPoint[ENDPOINT_MAX];
-+ HTC_CONTROL_BUFFER HTCControlBuffers[NUM_CONTROL_BUFFERS];
-+ HTC_ENDPOINT_CREDIT_DIST *EpCreditDistributionListHead;
-+ HTC_PACKET_QUEUE ControlBufferTXFreeList;
-+ HTC_PACKET_QUEUE ControlBufferRXFreeList;
-+ HTC_CREDIT_DIST_CALLBACK DistributeCredits;
-+ HTC_CREDIT_INIT_CALLBACK InitCredits;
-+ void *pCredDistContext;
-+ int TargetCredits;
-+ int TargetCreditSize;
-+ A_MUTEX_T HTCLock;
-+ A_MUTEX_T HTCRxLock;
-+ A_MUTEX_T HTCTxLock;
-+ AR6K_DEVICE Device; /* AR6K - specific state */
-+ A_UINT32 HTCStateFlags;
-+ HTC_ENDPOINT_ID EpWaitingForBuffers;
-+ A_BOOL TargetFailure;
-+ void *pInstanceContext;
-+#define HTC_STATE_WAIT_BUFFERS (1 << 0)
-+#define HTC_STATE_STOPPING (1 << 1)
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+ HTC_FRAME_HDR LastFrameHdr; /* useful for debugging */
-+ A_UINT8 LastTrailer[256];
-+ A_UINT8 LastTrailerLength;
-+#endif
-+} HTC_TARGET;
++typedef struct target_function_context {
++ SDFUNCTION function; /* function description of the bus driver */
++ OS_SEMAPHORE instanceSem; /* instance lock. Unused */
++ SDLIST instanceList; /* list of instances. Unused */
++} TARGET_FUNCTION_CONTEXT;
+
-+#define HTC_STOPPING(t) ((t)->HTCStateFlags & HTC_STATE_STOPPING)
-+#define LOCK_HTC(t) A_MUTEX_LOCK(&(t)->HTCLock);
-+#define UNLOCK_HTC(t) A_MUTEX_UNLOCK(&(t)->HTCLock);
-+#define LOCK_HTC_RX(t) A_MUTEX_LOCK(&(t)->HTCRxLock);
-+#define UNLOCK_HTC_RX(t) A_MUTEX_UNLOCK(&(t)->HTCRxLock);
-+#define LOCK_HTC_TX(t) A_MUTEX_LOCK(&(t)->HTCTxLock);
-+#define UNLOCK_HTC_TX(t) A_MUTEX_UNLOCK(&(t)->HTCTxLock);
++typedef struct bus_request {
++ struct bus_request *next;
++ SDREQUEST *request;
++ void *context;
++} BUS_REQUEST;
+
-+#define GET_HTC_TARGET_FROM_HANDLE(hnd) ((HTC_TARGET *)(hnd))
-+#define HTC_RECYCLE_RX_PKT(target,p) \
-+{ \
-+ HTC_PACKET_RESET_RX(pPacket); \
-+ HTCAddReceivePkt((HTC_HANDLE)(target),(p)); \
-+}
++BOOL
++hifDeviceInserted(SDFUNCTION *function, SDDEVICE *device);
+
-+/* internal HTC functions */
-+void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket);
-+void HTCControlRecv(void *Context, HTC_PACKET *pPacket);
-+A_STATUS HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket);
-+HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target, HTC_PACKET_QUEUE *pList);
-+void HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList);
-+A_STATUS HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 Flags);
-+A_STATUS HTCIssueRecv(HTC_TARGET *target, HTC_PACKET *pPacket);
-+void HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket);
-+A_STATUS HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
-+void HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint);
-+A_STATUS HTCSendSetupComplete(HTC_TARGET *target);
-+void HTCFlushRecvBuffers(HTC_TARGET *target);
-+void HTCFlushSendPkts(HTC_TARGET *target);
-+void DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist);
-+void DumpCreditDistStates(HTC_TARGET *target);
-+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
++void
++hifDeviceRemoved(SDFUNCTION *function, SDDEVICE *device);
+
-+static INLINE HTC_PACKET *HTC_ALLOC_CONTROL_TX(HTC_TARGET *target) {
-+ HTC_PACKET *pPacket = HTCAllocControlBuffer(target,&target->ControlBufferTXFreeList);
-+ if (pPacket != NULL) {
-+ /* set payload pointer area with some headroom */
-+ pPacket->pBuffer = pPacket->pBufferStart + HTC_HDR_LENGTH;
-+ }
-+ return pPacket;
-+}
++SDREQUEST *
++hifAllocateDeviceRequest(SDDEVICE *device);
+
-+#define HTC_FREE_CONTROL_TX(t,p) HTCFreeControlBuffer((t),(p),&(t)->ControlBufferTXFreeList)
-+#define HTC_ALLOC_CONTROL_RX(t) HTCAllocControlBuffer((t),&(t)->ControlBufferRXFreeList)
-+#define HTC_FREE_CONTROL_RX(t,p) \
-+{ \
-+ HTC_PACKET_RESET_RX(p); \
-+ HTCFreeControlBuffer((t),(p),&(t)->ControlBufferRXFreeList); \
-+}
++void
++hifFreeDeviceRequest(SDREQUEST *request);
+
-+#ifdef __cplusplus
-+}
-+#endif
++void
++hifRWCompletionHandler(SDREQUEST *request);
+
-+#endif /* _HTC_INTERNAL_H_ */
-diff --git a/drivers/ar6000/htc/htc_recv.c b/drivers/ar6000/htc/htc_recv.c
++void
++hifIRQHandler(void *context);
++
++HIF_DEVICE *
++addHifDevice(SDDEVICE *handle);
++
++HIF_DEVICE *
++getHifDevice(SDDEVICE *handle);
++
++void
++delHifDevice(SDDEVICE *handle);
+diff --git a/drivers/ar6000/htc/ar6k.c b/drivers/ar6000/htc/ar6k.c
new file mode 100644
-index 0000000..4be2b08
+index 0000000..72472ab
--- /dev/null
-+++ b/drivers/ar6000/htc/htc_recv.c
-@@ -0,0 +1,703 @@
++++ b/drivers/ar6000/htc/ar6k.c
+@@ -0,0 +1,991 @@
+/*
++ * AR6K device layer that handles register level I/O
+ *
+ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ */
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "AR6Khwreg.h"
++#include "a_osapi.h"
++#include "a_debug.h"
++#include "hif.h"
++#include "htc_packet.h"
++#include "ar6k.h"
+
-+#include "htc_internal.h"
++#define MAILBOX_FOR_BLOCK_SIZE 1
+
-+#define HTCIssueRecv(t, p) \
-+ DevRecvPacket(&(t)->Device, \
-+ (p), \
-+ (p)->ActualLength)
++extern A_UINT32 resetok;
+
-+#define DO_RCV_COMPLETION(t,p,e) \
-+{ \
-+ if ((p)->ActualLength > 0) { \
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" completing packet 0x%X (%d bytes) on ep : %d \n", \
-+ (A_UINT32)(p), (p)->ActualLength, (p)->Endpoint)); \
-+ (e)->EpCallBacks.EpRecv((e)->EpCallBacks.pContext, \
-+ (p)); \
-+ } else { \
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" recycling empty packet \n")); \
-+ HTC_RECYCLE_RX_PKT((t), (p)); \
-+ } \
-+}
++static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev);
++static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev);
+
-+#ifdef HTC_EP_STAT_PROFILING
-+#define HTC_RX_STAT_PROFILE(t,ep,lookAhead) \
-+{ \
-+ LOCK_HTC_RX((t)); \
-+ INC_HTC_EP_STAT((ep), RxReceived, 1); \
-+ if ((lookAhead) != 0) { \
-+ INC_HTC_EP_STAT((ep), RxLookAheads, 1); \
-+ } \
-+ UNLOCK_HTC_RX((t)); \
++#define LOCK_AR6K(p) A_MUTEX_LOCK(&(p)->Lock);
++#define UNLOCK_AR6K(p) A_MUTEX_UNLOCK(&(p)->Lock);
++
++void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket)
++{
++ LOCK_AR6K(pDev);
++ HTC_PACKET_ENQUEUE(&pDev->RegisterIOList,pPacket);
++ UNLOCK_AR6K(pDev);
+}
-+#else
-+#define HTC_RX_STAT_PROFILE(t,ep,lookAhead)
-+#endif
+
-+static INLINE A_STATUS HTCProcessTrailer(HTC_TARGET *target,
-+ A_UINT8 *pBuffer,
-+ int Length,
-+ A_UINT32 *pNextLookAhead,
-+ HTC_ENDPOINT_ID FromEndpoint)
++HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev)
+{
-+ HTC_RECORD_HDR *pRecord;
-+ A_UINT8 *pRecordBuf;
-+ HTC_LOOKAHEAD_REPORT *pLookAhead;
-+ A_UINT8 *pOrigBuffer;
-+ int origLength;
-+ A_STATUS status;
++ HTC_PACKET *pPacket;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessTrailer (length:%d) \n", Length));
++ LOCK_AR6K(pDev);
++ pPacket = HTC_PACKET_DEQUEUE(&pDev->RegisterIOList);
++ UNLOCK_AR6K(pDev);
+
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+ AR_DEBUG_PRINTBUF(pBuffer,Length,"Recv Trailer");
-+ }
++ return pPacket;
++}
+
-+ pOrigBuffer = pBuffer;
-+ origLength = Length;
-+ status = A_OK;
++A_STATUS DevSetup(AR6K_DEVICE *pDev)
++{
++ A_UINT32 mailboxaddrs[AR6K_MAILBOXES];
++ A_UINT32 blocksizes[AR6K_MAILBOXES];
++ A_STATUS status = A_OK;
++ int i;
+
-+ while (Length > 0) {
++ AR_DEBUG_ASSERT(AR6K_IRQ_PROC_REGS_SIZE == 16);
++ AR_DEBUG_ASSERT(AR6K_IRQ_ENABLE_REGS_SIZE == 4);
+
-+ if (Length < sizeof(HTC_RECORD_HDR)) {
-+ status = A_EPROTO;
-+ break;
++ do {
++ /* give a handle to HIF for this target */
++ HIFSetHandle(pDev->HIFDevice, (void *)pDev);
++ /* initialize our free list of IO packets */
++ INIT_HTC_PACKET_QUEUE(&pDev->RegisterIOList);
++ A_MUTEX_INIT(&pDev->Lock);
++
++ /* get the addresses for all 4 mailboxes */
++ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
++ mailboxaddrs, sizeof(mailboxaddrs));
++
++ if (status != A_OK) {
++ AR_DEBUG_ASSERT(FALSE);
++ break;
+ }
-+ /* these are byte aligned structs */
-+ pRecord = (HTC_RECORD_HDR *)pBuffer;
-+ Length -= sizeof(HTC_RECORD_HDR);
-+ pBuffer += sizeof(HTC_RECORD_HDR);
+
-+ if (pRecord->Length > Length) {
-+ /* no room left in buffer for record */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" invalid record length: %d (id:%d) buffer has: %d bytes left \n",
-+ pRecord->Length, pRecord->RecordID, Length));
-+ status = A_EPROTO;
++ /* carve up register I/O packets (these are for ASYNC register I/O ) */
++ for (i = 0; i < AR6K_MAX_REG_IO_BUFFERS; i++) {
++ HTC_PACKET *pIOPacket;
++ pIOPacket = &pDev->RegIOBuffers[i].HtcPacket;
++ SET_HTC_PACKET_INFO_RX_REFILL(pIOPacket,
++ pDev,
++ pDev->RegIOBuffers[i].Buffer,
++ AR6K_REG_IO_BUFFER_SIZE,
++ 0); /* don't care */
++ AR6KFreeIOPacket(pDev,pIOPacket);
++ }
++
++ /* get the address of the mailbox we are using */
++ pDev->MailboxAddress = mailboxaddrs[HTC_MAILBOX];
++
++ /* get the block sizes */
++ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
++ blocksizes, sizeof(blocksizes));
++
++ if (status != A_OK) {
++ AR_DEBUG_ASSERT(FALSE);
+ break;
+ }
-+ /* start of record follows the header */
-+ pRecordBuf = pBuffer;
+
-+ switch (pRecord->RecordID) {
-+ case HTC_RECORD_CREDITS:
-+ AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_CREDIT_REPORT));
-+ HTCProcessCreditRpt(target,
-+ (HTC_CREDIT_REPORT *)pRecordBuf,
-+ pRecord->Length / (sizeof(HTC_CREDIT_REPORT)),
-+ FromEndpoint);
-+ break;
-+ case HTC_RECORD_LOOKAHEAD:
-+ AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_LOOKAHEAD_REPORT));
-+ pLookAhead = (HTC_LOOKAHEAD_REPORT *)pRecordBuf;
-+ if ((pLookAhead->PreValid == ((~pLookAhead->PostValid) & 0xFF)) &&
-+ (pNextLookAhead != NULL)) {
++ /* note: we actually get the block size of a mailbox other than 0, for SDIO the block
++ * size on mailbox 0 is artificially set to 1. So we use the block size that is set
++ * for the other 3 mailboxes */
++ pDev->BlockSize = blocksizes[MAILBOX_FOR_BLOCK_SIZE];
++ /* must be a power of 2 */
++ AR_DEBUG_ASSERT((pDev->BlockSize & (pDev->BlockSize - 1)) == 0);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+ (" LookAhead Report Found (pre valid:0x%X, post valid:0x%X) \n",
-+ pLookAhead->PreValid,
-+ pLookAhead->PostValid));
++ /* assemble mask, used for padding to a block */
++ pDev->BlockMask = pDev->BlockSize - 1;
+
-+ /* look ahead bytes are valid, copy them over */
-+ ((A_UINT8 *)pNextLookAhead)[0] = pLookAhead->LookAhead[0];
-+ ((A_UINT8 *)pNextLookAhead)[1] = pLookAhead->LookAhead[1];
-+ ((A_UINT8 *)pNextLookAhead)[2] = pLookAhead->LookAhead[2];
-+ ((A_UINT8 *)pNextLookAhead)[3] = pLookAhead->LookAhead[3];
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("BlockSize: %d, MailboxAddress:0x%X \n",
++ pDev->BlockSize, pDev->MailboxAddress));
+
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+ DebugDumpBytes((A_UINT8 *)pNextLookAhead,4,"Next Look Ahead");
-+ }
-+ }
++ pDev->GetPendingEventsFunc = NULL;
++ /* see if the HIF layer implements the get pending events function */
++ HIFConfigureDevice(pDev->HIFDevice,
++ HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
++ &pDev->GetPendingEventsFunc,
++ sizeof(pDev->GetPendingEventsFunc));
++
++ /* assume we can process HIF interrupt events asynchronously */
++ pDev->HifIRQProcessingMode = HIF_DEVICE_IRQ_ASYNC_SYNC;
++
++ /* see if the HIF layer overrides this assumption */
++ HIFConfigureDevice(pDev->HIFDevice,
++ HIF_DEVICE_GET_IRQ_PROC_MODE,
++ &pDev->HifIRQProcessingMode,
++ sizeof(pDev->HifIRQProcessingMode));
++
++ switch (pDev->HifIRQProcessingMode) {
++ case HIF_DEVICE_IRQ_SYNC_ONLY:
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is SYNC ONLY\n"));
+ break;
-+ default:
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" unhandled record: id:%d length:%d \n",
-+ pRecord->RecordID, pRecord->Length));
++ case HIF_DEVICE_IRQ_ASYNC_SYNC:
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF Interrupt processing is ASYNC and SYNC\n"));
+ break;
++ default:
++ AR_DEBUG_ASSERT(FALSE);
+ }
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ pDev->HifMaskUmaskRecvEvent = NULL;
+
-+ /* advance buffer past this record for next time around */
-+ pBuffer += pRecord->Length;
-+ Length -= pRecord->Length;
-+ }
++ /* see if the HIF layer implements the mask/unmask recv events function */
++ HIFConfigureDevice(pDev->HIFDevice,
++ HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
++ &pDev->HifMaskUmaskRecvEvent,
++ sizeof(pDev->HifMaskUmaskRecvEvent));
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("HIF special overrides : 0x%X , 0x%X\n",
++ (A_UINT32)pDev->GetPendingEventsFunc, (A_UINT32)pDev->HifMaskUmaskRecvEvent));
++
++ status = DevDisableInterrupts(pDev);
++
++ } while (FALSE);
+
+ if (A_FAILED(status)) {
-+ DebugDumpBytes(pOrigBuffer,origLength,"BAD Recv Trailer");
++ /* make sure handle is cleared */
++ HIFSetHandle(pDev->HIFDevice, NULL);
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessTrailer \n"));
+ return status;
+
+}
+
-+/* process a received message (i.e. strip off header, process any trailer data)
-+ * note : locks must be released when this function is called */
-+static A_STATUS HTCProcessRecvHeader(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT32 *pNextLookAhead)
++static A_STATUS DevEnableInterrupts(AR6K_DEVICE *pDev)
+{
-+ A_UINT8 temp;
-+ A_UINT8 *pBuf;
-+ A_STATUS status = A_OK;
-+ A_UINT16 payloadLen;
-+ A_UINT32 lookAhead;
++ A_STATUS status;
++ AR6K_IRQ_ENABLE_REGISTERS regs;
+
-+ pBuf = pPacket->pBuffer;
++ LOCK_AR6K(pDev);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessRecvHeader \n"));
++ /* Enable all the interrupts except for the dragon interrupt */
++ pDev->IrqEnableRegisters.int_status_enable = INT_STATUS_ENABLE_ERROR_SET(0x01) |
++ INT_STATUS_ENABLE_CPU_SET(0x01) |
++ INT_STATUS_ENABLE_COUNTER_SET(0x01);
+
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+ AR_DEBUG_PRINTBUF(pBuf,pPacket->ActualLength,"HTC Recv PKT");
++ if (NULL == pDev->GetPendingEventsFunc) {
++ pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
++ } else {
++ /* The HIF layer provided us with a pending events function which means that
++ * the detection of pending mbox messages is handled in the HIF layer.
++ * This is the case for the SPI2 interface.
++ * In the normal case we enable MBOX interrupts, for the case
++ * with HIFs that offer this mechanism, we keep these interrupts
++ * masked */
++ pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+ }
+
-+ do {
-+ /* note, we cannot assume the alignment of pBuffer, so we use the safe macros to
-+ * retrieve 16 bit fields */
-+ payloadLen = A_GET_UINT16_FIELD(pBuf, HTC_FRAME_HDR, PayloadLen);
-+
-+ ((A_UINT8 *)&lookAhead)[0] = pBuf[0];
-+ ((A_UINT8 *)&lookAhead)[1] = pBuf[1];
-+ ((A_UINT8 *)&lookAhead)[2] = pBuf[2];
-+ ((A_UINT8 *)&lookAhead)[3] = pBuf[3];
-+
-+ if (lookAhead != pPacket->HTCReserved) {
-+ /* somehow the lookahead that gave us the full read length did not
-+ * reflect the actual header in the pending message */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCProcessRecvHeader, lookahead mismatch! \n"));
-+ DebugDumpBytes((A_UINT8 *)&pPacket->HTCReserved,4,"Expected Message LookAhead");
-+ DebugDumpBytes(pBuf,sizeof(HTC_FRAME_HDR),"Current Frame Header");
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+ DebugDumpBytes((A_UINT8 *)&target->LastFrameHdr,sizeof(HTC_FRAME_HDR),"Last Frame Header");
-+ if (target->LastTrailerLength != 0) {
-+ DebugDumpBytes(target->LastTrailer,
-+ target->LastTrailerLength,
-+ "Last trailer");
-+ }
-+#endif
-+ status = A_EPROTO;
-+ break;
-+ }
-+
-+ /* get flags */
-+ temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, Flags);
-+
-+ if (temp & HTC_FLAGS_RECV_TRAILER) {
-+ /* this packet has a trailer */
+
-+ /* extract the trailer length in control byte 0 */
-+ temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, ControlBytes[0]);
++ /* Set up the CPU Interrupt Status Register */
++ pDev->IrqEnableRegisters.cpu_int_status_enable = CPU_INT_STATUS_ENABLE_BIT_SET(0x00);
+
-+ if ((temp < sizeof(HTC_RECORD_HDR)) || (temp > payloadLen)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCProcessRecvHeader, invalid header (payloadlength should be :%d, CB[0] is:%d) \n",
-+ payloadLen, temp));
-+ status = A_EPROTO;
-+ break;
-+ }
++ /* Set up the Error Interrupt Status Register */
++ pDev->IrqEnableRegisters.error_status_enable =
++ ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(0x01) |
++ ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(0x01);
+
-+ /* process trailer data that follows HDR + application payload */
-+ status = HTCProcessTrailer(target,
-+ (pBuf + HTC_HDR_LENGTH + payloadLen - temp),
-+ temp,
-+ pNextLookAhead,
-+ pPacket->Endpoint);
++ /* Set up the Counter Interrupt Status Register (only for debug interrupt to catch fatal errors) */
++ pDev->IrqEnableRegisters.counter_int_status_enable =
++ COUNTER_INT_STATUS_ENABLE_BIT_SET(AR6K_TARGET_DEBUG_INTR_MASK);
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ /* copy into our temp area */
++ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+ A_MEMCPY(target->LastTrailer, (pBuf + HTC_HDR_LENGTH + payloadLen - temp), temp);
-+ target->LastTrailerLength = temp;
-+#endif
-+ /* trim length by trailer bytes */
-+ pPacket->ActualLength -= temp;
-+ }
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+ else {
-+ target->LastTrailerLength = 0;
-+ }
-+#endif
++ UNLOCK_AR6K(pDev);
+
-+ /* if we get to this point, the packet is good */
-+ /* remove header and adjust length */
-+ pPacket->pBuffer += HTC_HDR_LENGTH;
-+ pPacket->ActualLength -= HTC_HDR_LENGTH;
++ /* always synchronous */
++ status = HIFReadWrite(pDev->HIFDevice,
++ INT_STATUS_ENABLE_ADDRESS,
++ ®s.int_status_enable,
++ AR6K_IRQ_ENABLE_REGS_SIZE,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ } while (FALSE);
++ if (status != A_OK) {
++ /* Can't write it for some reason */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("Failed to update interrupt control registers err: %d\n", status));
+
-+ if (A_FAILED(status)) {
-+ /* dump the whole packet */
-+ DebugDumpBytes(pBuf,pPacket->ActualLength,"BAD HTC Recv PKT");
-+ } else {
-+#ifdef HTC_CAPTURE_LAST_FRAME
-+ A_MEMCPY(&target->LastFrameHdr,pBuf,sizeof(HTC_FRAME_HDR));
-+#endif
-+ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
-+ if (pPacket->ActualLength > 0) {
-+ AR_DEBUG_PRINTBUF(pPacket->pBuffer,pPacket->ActualLength,"HTC - Application Msg");
-+ }
-+ }
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessRecvHeader \n"));
+ return status;
+}
+
-+/* asynchronous completion handler for recv packet fetching, when the device layer
-+ * completes a read request, it will call this completion handler */
-+void HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket)
++static A_STATUS DevDisableInterrupts(AR6K_DEVICE *pDev)
+{
-+ HTC_TARGET *target = (HTC_TARGET *)Context;
-+ HTC_ENDPOINT *pEndpoint;
-+ A_UINT32 nextLookAhead = 0;
-+ A_STATUS status;
++ AR6K_IRQ_ENABLE_REGISTERS regs;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCRecvCompleteHandler (status:%d, ep:%d) \n",
-+ pPacket->Status, pPacket->Endpoint));
++ LOCK_AR6K(pDev);
++ /* Disable all interrupts */
++ pDev->IrqEnableRegisters.int_status_enable = 0;
++ pDev->IrqEnableRegisters.cpu_int_status_enable = 0;
++ pDev->IrqEnableRegisters.error_status_enable = 0;
++ pDev->IrqEnableRegisters.counter_int_status_enable = 0;
++ /* copy into our temp area */
++ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
+
-+ AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
-+ pEndpoint = &target->EndPoint[pPacket->Endpoint];
-+ pPacket->Completion = NULL;
++ UNLOCK_AR6K(pDev);
+
-+ /* get completion status */
-+ status = pPacket->Status;
++ /* always synchronous */
++ return HIFReadWrite(pDev->HIFDevice,
++ INT_STATUS_ENABLE_ADDRESS,
++ ®s.int_status_enable,
++ AR6K_IRQ_ENABLE_REGS_SIZE,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
++}
+
-+ do {
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTCRecvCompleteHandler: request failed (status:%d, ep:%d) \n",
-+ pPacket->Status, pPacket->Endpoint));
-+ break;
-+ }
-+ /* process the header for any trailer data */
-+ status = HTCProcessRecvHeader(target,pPacket,&nextLookAhead);
++/* enable device interrupts */
++A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev)
++{
++ /* Unmask the host controller interrupts */
++ HIFUnMaskInterrupt(pDev->HIFDevice);
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+ /* was there a lookahead for the next packet? */
-+ if (nextLookAhead != 0) {
-+ A_STATUS nextStatus;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+ ("HTCRecvCompleteHandler - next look ahead was non-zero : 0x%X \n",
-+ nextLookAhead));
-+ /* we have another packet, get the next packet fetch started (pipelined) before
-+ * we call into the endpoint's callback, this will start another async request */
-+ nextStatus = HTCRecvMessagePendingHandler(target,nextLookAhead,NULL);
-+ if (A_EPROTO == nextStatus) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("Next look ahead from recv header was INVALID\n"));
-+ DebugDumpBytes((A_UINT8 *)&nextLookAhead,
-+ 4,
-+ "BAD lookahead from lookahead report");
-+ }
-+ } else {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+ ("HTCRecvCompleteHandler - rechecking for more messages...\n"));
-+ /* if we did not get anything on the look-ahead,
-+ * call device layer to asynchronously re-check for messages. If we can keep the async
-+ * processing going we get better performance. If there is a pending message we will keep processing
-+ * messages asynchronously which should pipeline things nicely */
-+ DevCheckPendingRecvMsgsAsync(&target->Device);
-+ }
++ return DevEnableInterrupts(pDev);
++}
+
-+ HTC_RX_STAT_PROFILE(target,pEndpoint,nextLookAhead);
-+ DO_RCV_COMPLETION(target,pPacket,pEndpoint);
++/* disable all device interrupts */
++A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev)
++{
++ A_STATUS status;
+
-+ } while (FALSE);
++ status = DevDisableInterrupts(pDev);
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCRecvCompleteHandler , message fetch failed (status = %d) \n",
-+ status));
-+ /* recyle this packet */
-+ HTC_RECYCLE_RX_PKT(target, pPacket);
++ if (A_SUCCESS(status)) {
++ /* Disable the interrupt at the HIF layer */
++ HIFMaskInterrupt(pDev->HIFDevice);
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCRecvCompleteHandler\n"));
++ return status;
+}
+
-+/* synchronously wait for a control message from the target,
-+ * This function is used at initialization time ONLY. At init messages
-+ * on ENDPOINT 0 are expected. */
-+A_STATUS HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket)
++/* callback when our fetch to enable/disable completes */
++static void DevDoEnableDisableRecvAsyncHandler(void *Context, HTC_PACKET *pPacket)
+{
-+ A_STATUS status;
-+ A_UINT32 lookAhead;
-+ HTC_PACKET *pPacket = NULL;
-+ HTC_FRAME_HDR *pHdr;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCWaitforControlMessage \n"));
-+
-+ do {
-+
-+ *ppControlPacket = NULL;
-+
-+ /* call the polling function to see if we have a message */
-+ status = DevPollMboxMsgRecv(&target->Device,
-+ &lookAhead,
-+ HTC_TARGET_RESPONSE_TIMEOUT);
-+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
-+ ("HTCWaitforControlMessage : lookAhead : 0x%X \n", lookAhead));
-+
-+ /* check the lookahead */
-+ pHdr = (HTC_FRAME_HDR *)&lookAhead;
-+
-+ if (pHdr->EndpointID != ENDPOINT_0) {
-+ /* unexpected endpoint number, should be zero */
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
-+
-+ if (A_FAILED(status)) {
-+ /* bad message */
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
++ AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
+
-+ pPacket = HTC_ALLOC_CONTROL_RX(target);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDoEnableDisableRecvAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
+
-+ if (pPacket == NULL) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_NO_MEMORY;
-+ break;
-+ }
++ if (A_FAILED(pPacket->Status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" Failed to disable receiver, status:%d \n", pPacket->Status));
++ }
++ /* free this IO packet */
++ AR6KFreeIOPacket(pDev,pPacket);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDoEnableDisableRecvAsyncHandler \n"));
++}
+
-+ pPacket->HTCReserved = lookAhead;
-+ pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
++/* disable packet reception (used in case the host runs out of buffers)
++ * this is the "override" method when the HIF reports another methods to
++ * disable recv events */
++static A_STATUS DevDoEnableDisableRecvOverride(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
++{
++ A_STATUS status = A_OK;
++ HTC_PACKET *pIOPacket = NULL;
+
-+ if (pPacket->ActualLength > pPacket->BufferLength) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("DevDoEnableDisableRecvOverride: Enable:%d Mode:%d\n",
++ EnableRecv,AsyncMode));
+
-+ /* we want synchronous operation */
-+ pPacket->Completion = NULL;
++ do {
+
-+ /* get the message from the device, this will block */
-+ status = HTCIssueRecv(target, pPacket);
++ if (AsyncMode) {
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ pIOPacket = AR6KAllocIOPacket(pDev);
+
-+ /* process receive header */
-+ status = HTCProcessRecvHeader(target,pPacket,NULL);
++ if (NULL == pIOPacket) {
++ status = A_NO_MEMORY;
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+ pPacket->Status = status;
++ /* stick in our completion routine when the I/O operation completes */
++ pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
++ pIOPacket->pContext = pDev;
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCWaitforControlMessage, HTCProcessRecvHeader failed (status = %d) \n",
-+ status));
++ /* call the HIF layer override and do this asynchronously */
++ status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
++ EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
++ pIOPacket);
+ break;
+ }
+
-+ /* give the caller this control message packet, they are responsible to free */
-+ *ppControlPacket = pPacket;
++ /* if we get here we are doing it synchronously */
++ status = pDev->HifMaskUmaskRecvEvent(pDev->HIFDevice,
++ EnableRecv ? HIF_UNMASK_RECV : HIF_MASK_RECV,
++ NULL);
+
+ } while (FALSE);
+
-+ if (A_FAILED(status)) {
-+ if (pPacket != NULL) {
-+ /* cleanup buffer on error */
-+ HTC_FREE_CONTROL_RX(target,pPacket);
-+ }
++ if (A_FAILED(status) && (pIOPacket != NULL)) {
++ AR6KFreeIOPacket(pDev,pIOPacket);
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCWaitforControlMessage \n"));
-+
+ return status;
+}
+
-+/* callback when device layer or lookahead report parsing detects a pending message */
-+A_STATUS HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc)
++/* disable packet reception (used in case the host runs out of buffers)
++ * this is the "normal" method using the interrupt enable registers through
++ * the host I/F */
++static A_STATUS DevDoEnableDisableRecvNormal(AR6K_DEVICE *pDev, A_BOOL EnableRecv, A_BOOL AsyncMode)
+{
-+ HTC_TARGET *target = (HTC_TARGET *)Context;
-+ A_STATUS status = A_OK;
-+ HTC_PACKET *pPacket = NULL;
-+ HTC_FRAME_HDR *pHdr;
-+ HTC_ENDPOINT *pEndpoint;
-+ A_BOOL asyncProc = FALSE;
++ A_STATUS status = A_OK;
++ HTC_PACKET *pIOPacket = NULL;
++ AR6K_IRQ_ENABLE_REGISTERS regs;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCRecvMessagePendingHandler LookAhead:0x%X \n",LookAhead));
++ /* take the lock to protect interrupt enable shadows */
++ LOCK_AR6K(pDev);
+
-+ if (IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(&target->Device)) {
-+ /* We use async mode to get the packets if the device layer supports it.
-+ * The device layer interfaces with HIF in which HIF may have restrictions on
-+ * how interrupts are processed */
-+ asyncProc = TRUE;
++ if (EnableRecv) {
++ pDev->IrqEnableRegisters.int_status_enable |= INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
++ } else {
++ pDev->IrqEnableRegisters.int_status_enable &= ~INT_STATUS_ENABLE_MBOX_DATA_SET(0x01);
+ }
+
-+ if (pAsyncProc != NULL) {
-+ /* indicate to caller how we decided to process this */
-+ *pAsyncProc = asyncProc;
-+ }
++ /* copy into our temp area */
++ A_MEMCPY(®s,&pDev->IrqEnableRegisters,AR6K_IRQ_ENABLE_REGS_SIZE);
++ UNLOCK_AR6K(pDev);
+
-+ while (TRUE) {
++ do {
+
-+ pHdr = (HTC_FRAME_HDR *)&LookAhead;
++ if (AsyncMode) {
+
-+ if (pHdr->EndpointID >= ENDPOINT_MAX) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Endpoint in look-ahead: %d \n",pHdr->EndpointID));
-+ /* invalid endpoint */
-+ status = A_EPROTO;
-+ break;
-+ }
++ pIOPacket = AR6KAllocIOPacket(pDev);
+
-+ if (pHdr->PayloadLen > HTC_MAX_PAYLOAD_LENGTH) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Payload length %d exceeds max HTC : %d !\n",
-+ pHdr->PayloadLen, HTC_MAX_PAYLOAD_LENGTH));
-+ status = A_EPROTO;
-+ break;
-+ }
++ if (NULL == pIOPacket) {
++ status = A_NO_MEMORY;
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+ pEndpoint = &target->EndPoint[pHdr->EndpointID];
++ /* copy values to write to our async I/O buffer */
++ A_MEMCPY(pIOPacket->pBuffer,®s,AR6K_IRQ_ENABLE_REGS_SIZE);
+
-+ if (0 == pEndpoint->ServiceID) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Endpoint %d is not connected !\n",pHdr->EndpointID));
-+ /* endpoint isn't even connected */
-+ status = A_EPROTO;
++ /* stick in our completion routine when the I/O operation completes */
++ pIOPacket->Completion = DevDoEnableDisableRecvAsyncHandler;
++ pIOPacket->pContext = pDev;
++
++ /* write it out asynchronously */
++ HIFReadWrite(pDev->HIFDevice,
++ INT_STATUS_ENABLE_ADDRESS,
++ pIOPacket->pBuffer,
++ AR6K_IRQ_ENABLE_REGS_SIZE,
++ HIF_WR_ASYNC_BYTE_INC,
++ pIOPacket);
+ break;
+ }
+
-+ /* lock RX to get a buffer */
-+ LOCK_HTC_RX(target);
++ /* if we get here we are doing it synchronously */
+
-+ /* get a packet from the endpoint recv queue */
-+ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
++ status = HIFReadWrite(pDev->HIFDevice,
++ INT_STATUS_ENABLE_ADDRESS,
++ ®s.int_status_enable,
++ AR6K_IRQ_ENABLE_REGS_SIZE,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ if (NULL == pPacket) {
-+ /* check for refill handler */
-+ if (pEndpoint->EpCallBacks.EpRecvRefill != NULL) {
-+ UNLOCK_HTC_RX(target);
-+ /* call the re-fill handler */
-+ pEndpoint->EpCallBacks.EpRecvRefill(pEndpoint->EpCallBacks.pContext,
-+ pHdr->EndpointID);
-+ LOCK_HTC_RX(target);
-+ /* check if we have more buffers */
-+ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
-+ /* fall through */
-+ }
-+ }
++ } while (FALSE);
+
-+ if (NULL == pPacket) {
-+ /* this is not an error, we simply need to mark that we are waiting for buffers.*/
-+ target->HTCStateFlags |= HTC_STATE_WAIT_BUFFERS;
-+ target->EpWaitingForBuffers = pHdr->EndpointID;
-+ status = A_NO_MEMORY;
-+ }
++ if (A_FAILED(status) && (pIOPacket != NULL)) {
++ AR6KFreeIOPacket(pDev,pIOPacket);
++ }
+
-+ UNLOCK_HTC_RX(target);
++ return status;
++}
+
-+ if (A_FAILED(status)) {
-+ /* no buffers */
-+ break;
-+ }
+
-+ AR_DEBUG_ASSERT(pPacket->Endpoint == pHdr->EndpointID);
++A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
++{
++ if (NULL == pDev->HifMaskUmaskRecvEvent) {
++ return DevDoEnableDisableRecvNormal(pDev,FALSE,AsyncMode);
++ } else {
++ return DevDoEnableDisableRecvOverride(pDev,FALSE,AsyncMode);
++ }
++}
+
-+ /* make sure this message can fit in the endpoint buffer */
-+ if ((pHdr->PayloadLen + HTC_HDR_LENGTH) > pPacket->BufferLength) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("Payload Length Error : header reports payload of: %d, endpoint buffer size: %d \n",
-+ pHdr->PayloadLen, pPacket->BufferLength));
-+ status = A_EPROTO;
-+ break;
-+ }
++A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL AsyncMode)
++{
++ if (NULL == pDev->HifMaskUmaskRecvEvent) {
++ return DevDoEnableDisableRecvNormal(pDev,TRUE,AsyncMode);
++ } else {
++ return DevDoEnableDisableRecvOverride(pDev,TRUE,AsyncMode);
++ }
++}
+
-+ pPacket->HTCReserved = LookAhead; /* set expected look ahead */
-+ /* set the amount of data to fetch */
-+ pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
++void DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS *pIrqProcRegs,
++ AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs)
++{
+
-+ if (asyncProc) {
-+ /* we use async mode to get the packet if the device layer supports it
-+ * set our callback and context */
-+ pPacket->Completion = HTCRecvCompleteHandler;
-+ pPacket->pContext = target;
-+ } else {
-+ /* fully synchronous */
-+ pPacket->Completion = NULL;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("\n<------- Register Table -------->\n"));
+
-+ /* go fetch the packet */
-+ status = HTCIssueRecv(target, pPacket);
++ if (pIrqProcRegs != NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Int Status: 0x%x\n",pIrqProcRegs->host_int_status));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("CPU Int Status: 0x%x\n",pIrqProcRegs->cpu_int_status));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Error Int Status: 0x%x\n",pIrqProcRegs->error_int_status));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Counter Int Status: 0x%x\n",pIrqProcRegs->counter_int_status));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Mbox Frame: 0x%x\n",pIrqProcRegs->mbox_frame));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Rx Lookahead Valid: 0x%x\n",pIrqProcRegs->rx_lookahead_valid));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Rx Lookahead 0: 0x%x\n",pIrqProcRegs->rx_lookahead[0]));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Rx Lookahead 1: 0x%x\n",pIrqProcRegs->rx_lookahead[1]));
++ }
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++ if (pIrqEnableRegs != NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Int Status Enable: 0x%x\n",pIrqEnableRegs->int_status_enable));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP,
++ ("Counter Int Status Enable: 0x%x\n",pIrqEnableRegs->counter_int_status_enable));
++ AR_DEBUG_PRINTF(ATH_DEBUG_DUMP, ("<------------------------------->\n"));
++ }
++}
+
-+ if (asyncProc) {
-+ /* we did this asynchronously so we can get out of the loop, the asynch processing
-+ * creates a chain of requests to continue processing pending messages in the
-+ * context of callbacks */
-+ break;
-+ }
+
-+ /* in the sync case, we process the packet, check lookaheads and then repeat */
++#ifdef MBOXHW_UNIT_TEST
+
-+ LookAhead = 0;
-+ status = HTCProcessRecvHeader(target,pPacket,&LookAhead);
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++/* This is a mailbox hardware unit test that must be called in a schedulable context
++ * This test is very simple, it will send a list of buffers with a counting pattern
++ * and the target will invert the data and send the message back
++ *
++ * the unit test has the following constraints:
++ *
++ * The target has at least 8 buffers of 256 bytes each. The host will send
++ * the following pattern of buffers in rapid succession :
++ *
++ * 1 buffer - 128 bytes
++ * 1 buffer - 256 bytes
++ * 1 buffer - 512 bytes
++ * 1 buffer - 1024 bytes
++ *
++ * The host will send the buffers to one mailbox and wait for buffers to be reflected
++ * back from the same mailbox. The target sends the buffers FIFO order.
++ * Once the final buffer has been received for a mailbox, the next mailbox is tested.
++ *
++ *
++ * Note: To simplifythe test , we assume that the chosen buffer sizes
++ * will fall on a nice block pad
++ *
++ * It is expected that higher-order tests will be written to stress the mailboxes using
++ * a message-based protocol (with some performance timming) that can create more
++ * randomness in the packets sent over mailboxes.
++ *
++ * */
+
-+ HTC_RX_STAT_PROFILE(target,pEndpoint,LookAhead);
-+ DO_RCV_COMPLETION(target,pPacket,pEndpoint);
++#define A_ROUND_UP_PWR2(x, align) (((int) (x) + ((align)-1)) & ~((align)-1))
+
-+ pPacket = NULL;
++#define BUFFER_BLOCK_PAD 128
+
-+ if (0 == LookAhead) {
-+ break;
-+ }
++#if 0
++#define BUFFER1 128
++#define BUFFER2 256
++#define BUFFER3 512
++#define BUFFER4 1024
++#endif
+
-+ }
++#if 1
++#define BUFFER1 80
++#define BUFFER2 200
++#define BUFFER3 444
++#define BUFFER4 800
++#endif
+
-+ if (A_NO_MEMORY == status) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" Endpoint :%d has no buffers, blocking receiver to prevent overrun.. \n",
-+ pHdr->EndpointID));
-+ /* try to stop receive at the device layer */
-+ DevStopRecv(&target->Device, asyncProc ? DEV_STOP_RECV_ASYNC : DEV_STOP_RECV_SYNC);
-+ status = A_OK;
-+ } else if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("Failed to get pending message : LookAhead Value: 0x%X (status = %d) \n",
-+ LookAhead, status));
-+ if (pPacket != NULL) {
-+ /* clean up packet on error */
-+ HTC_RECYCLE_RX_PKT(target, pPacket);
-+ }
-+ }
++#define TOTAL_BYTES (A_ROUND_UP_PWR2(BUFFER1,BUFFER_BLOCK_PAD) + \
++ A_ROUND_UP_PWR2(BUFFER2,BUFFER_BLOCK_PAD) + \
++ A_ROUND_UP_PWR2(BUFFER3,BUFFER_BLOCK_PAD) + \
++ A_ROUND_UP_PWR2(BUFFER4,BUFFER_BLOCK_PAD) )
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCRecvMessagePendingHandler \n"));
++#define TEST_BYTES (BUFFER1 + BUFFER2 + BUFFER3 + BUFFER4)
+
-+ return status;
-+}
++#define TEST_CREDITS_RECV_TIMEOUT 100
+
-+/* Makes a buffer available to the HTC module */
-+A_STATUS HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
-+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ HTC_ENDPOINT *pEndpoint;
-+ A_BOOL unblockRecv = FALSE;
-+ A_STATUS status = A_OK;
++static A_UINT8 g_Buffer[TOTAL_BYTES];
++static A_UINT32 g_MailboxAddrs[AR6K_MAILBOXES];
++static A_UINT32 g_BlockSizes[AR6K_MAILBOXES];
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+ ("+- HTCAddReceivePkt: endPointId: %d, buffer: 0x%X, length: %d\n",
-+ pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->BufferLength));
++#define BUFFER_PROC_LIST_DEPTH 4
+
-+ do {
++typedef struct _BUFFER_PROC_LIST{
++ A_UINT8 *pBuffer;
++ A_UINT32 length;
++}BUFFER_PROC_LIST;
+
-+ if (HTC_STOPPING(target)) {
-+ status = A_ECANCELED;
-+ break;
-+ }
+
-+ AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
++#define PUSH_BUFF_PROC_ENTRY(pList,len,pCurrpos) \
++{ \
++ (pList)->pBuffer = (pCurrpos); \
++ (pList)->length = (len); \
++ (pCurrpos) += (len); \
++ (pList)++; \
++}
+
-+ pEndpoint = &target->EndPoint[pPacket->Endpoint];
++/* a simple and crude way to send different "message" sizes */
++static void AssembleBufferList(BUFFER_PROC_LIST *pList)
++{
++ A_UINT8 *pBuffer = g_Buffer;
+
-+ LOCK_HTC_RX(target);
++#if BUFFER_PROC_LIST_DEPTH < 4
++#error "Buffer processing list depth is not deep enough!!"
++#endif
+
-+ /* store receive packet */
-+ HTC_PACKET_ENQUEUE(&pEndpoint->RxBuffers, pPacket);
++ PUSH_BUFF_PROC_ENTRY(pList,BUFFER1,pBuffer);
++ PUSH_BUFF_PROC_ENTRY(pList,BUFFER2,pBuffer);
++ PUSH_BUFF_PROC_ENTRY(pList,BUFFER3,pBuffer);
++ PUSH_BUFF_PROC_ENTRY(pList,BUFFER4,pBuffer);
+
-+ /* check if we are blocked waiting for a new buffer */
-+ if (target->HTCStateFlags & HTC_STATE_WAIT_BUFFERS) {
-+ if (target->EpWaitingForBuffers == pPacket->Endpoint) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" receiver was blocked on ep:%d, unblocking.. \n",
-+ target->EpWaitingForBuffers));
-+ target->HTCStateFlags &= ~HTC_STATE_WAIT_BUFFERS;
-+ target->EpWaitingForBuffers = ENDPOINT_MAX;
-+ unblockRecv = TRUE;
-+ }
-+ }
++}
+
-+ UNLOCK_HTC_RX(target);
++#define FILL_ZERO TRUE
++#define FILL_COUNTING FALSE
++static void InitBuffers(A_BOOL Zero)
++{
++ A_UINT16 *pBuffer16 = (A_UINT16 *)g_Buffer;
++ int i;
+
-+ if (unblockRecv && !HTC_STOPPING(target)) {
-+ /* TODO : implement a buffer threshold count? */
-+ DevEnableRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
++ /* fill buffer with 16 bit counting pattern or zeros */
++ for (i = 0; i < (TOTAL_BYTES / 2) ; i++) {
++ if (!Zero) {
++ pBuffer16[i] = (A_UINT16)i;
++ } else {
++ pBuffer16[i] = 0;
+ }
-+
-+ } while (FALSE);
-+
-+ return status;
++ }
+}
+
-+static void HTCFlushEndpointRX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint)
-+{
-+ HTC_PACKET *pPacket;
+
-+ LOCK_HTC_RX(target);
++static A_BOOL CheckOneBuffer(A_UINT16 *pBuffer16, int Length)
++{
++ int i;
++ A_UINT16 startCount;
++ A_BOOL success = TRUE;
+
-+ while (1) {
-+ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
-+ if (NULL == pPacket) {
++ /* get the starting count */
++ startCount = pBuffer16[0];
++ /* invert it, this is the expected value */
++ startCount = ~startCount;
++ /* scan the buffer and verify */
++ for (i = 0; i < (Length / 2) ; i++,startCount++) {
++ /* target will invert all the data */
++ if ((A_UINT16)pBuffer16[i] != (A_UINT16)~startCount) {
++ success = FALSE;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Invalid Data Got:0x%X, Expecting:0x%X (offset:%d, total:%d) \n",
++ pBuffer16[i], ((A_UINT16)~startCount), i, Length));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("0x%X 0x%X 0x%X 0x%X \n",
++ pBuffer16[i], pBuffer16[i + 1], pBuffer16[i + 2],pBuffer16[i+3]));
+ break;
+ }
-+ UNLOCK_HTC_RX(target);
-+ pPacket->Status = A_ECANCELED;
-+ pPacket->ActualLength = 0;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" Flushing RX packet:0x%X, length:%d, ep:%d \n",
-+ (A_UINT32)pPacket, pPacket->BufferLength, pPacket->Endpoint));
-+ /* give the packet back */
-+ pEndpoint->EpCallBacks.EpRecv(pEndpoint->EpCallBacks.pContext,
-+ pPacket);
-+ LOCK_HTC_RX(target);
+ }
+
-+ UNLOCK_HTC_RX(target);
-+
-+
++ return success;
+}
+
-+void HTCFlushRecvBuffers(HTC_TARGET *target)
++static A_BOOL CheckBuffers(void)
+{
-+ HTC_ENDPOINT *pEndpoint;
-+ int i;
++ int i;
++ A_BOOL success = TRUE;
++ BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
+
-+ /* NOTE: no need to flush endpoint 0, these buffers were
-+ * allocated as part of the HTC struct */
-+ for (i = ENDPOINT_1; i < ENDPOINT_MAX; i++) {
-+ pEndpoint = &target->EndPoint[i];
-+ if (pEndpoint->ServiceID == 0) {
-+ /* not in use.. */
-+ continue;
++ /* assemble the list */
++ AssembleBufferList(checkList);
++
++ /* scan the buffers and verify */
++ for (i = 0; i < BUFFER_PROC_LIST_DEPTH ; i++) {
++ success = CheckOneBuffer((A_UINT16 *)checkList[i].pBuffer, checkList[i].length);
++ if (!success) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer : 0x%X, Length:%d failed verify \n",
++ (A_UINT32)checkList[i].pBuffer, checkList[i].length));
++ break;
+ }
-+ HTCFlushEndpointRX(target,pEndpoint);
+ }
+
-+
++ return success;
+}
+
++ /* find the end marker for the last buffer we will be sending */
++static A_UINT16 GetEndMarker(void)
++{
++ A_UINT8 *pBuffer;
++ BUFFER_PROC_LIST checkList[BUFFER_PROC_LIST_DEPTH];
+
-diff --git a/drivers/ar6000/htc/htc_send.c b/drivers/ar6000/htc/htc_send.c
-new file mode 100644
-index 0000000..cf0dabe
---- /dev/null
-+++ b/drivers/ar6000/htc/htc_send.c
-@@ -0,0 +1,538 @@
-+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ /* fill up buffers with the normal counting pattern */
++ InitBuffers(FILL_COUNTING);
+
-+#include "htc_internal.h"
++ /* assemble the list we will be sending down */
++ AssembleBufferList(checkList);
++ /* point to the last 2 bytes of the last buffer */
++ pBuffer = &(checkList[BUFFER_PROC_LIST_DEPTH - 1].pBuffer[(checkList[BUFFER_PROC_LIST_DEPTH - 1].length) - 2]);
+
-+#define DO_EP_TX_COMPLETION(ep,p) \
-+{ \
-+ (p)->Completion = NULL; \
-+ (ep)->EpCallBacks.EpTxComplete((ep)->EpCallBacks.pContext,(p)); \
++ /* the last count in the last buffer is the marker */
++ return (A_UINT16)pBuffer[0] | ((A_UINT16)pBuffer[1] << 8);
+}
+
++#define ATH_PRINT_OUT_ZONE ATH_DEBUG_ERR
+
-+/* call the distribute credits callback with the distribution */
-+#define DO_DISTRIBUTION(t,reason,description,pList) \
-+{ \
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, \
-+ (" calling distribute function (%s) (dfn:0x%X, ctxt:0x%X, dist:0x%X) \n", \
-+ (description), \
-+ (A_UINT32)(t)->DistributeCredits, \
-+ (A_UINT32)(t)->pCredDistContext, \
-+ (A_UINT32)pList)); \
-+ (t)->DistributeCredits((t)->pCredDistContext, \
-+ (pList), \
-+ (reason)); \
-+}
-+
-+/* our internal send packet completion handler when packets are submited to the AR6K device
-+ * layer */
-+static void HTCSendPktCompletionHandler(void *Context, HTC_PACKET *pPacket)
++/* send the ordered buffers to the target */
++static A_STATUS SendBuffers(AR6K_DEVICE *pDev, int mbox)
+{
-+ HTC_TARGET *target = (HTC_TARGET *)Context;
-+ HTC_ENDPOINT *pEndpoint = &target->EndPoint[pPacket->Endpoint];
++ A_STATUS status = A_OK;
++ A_UINT32 request = HIF_WR_SYNC_BLOCK_INC;
++ BUFFER_PROC_LIST sendList[BUFFER_PROC_LIST_DEPTH];
++ int i;
++ int totalBytes = 0;
++ int paddedLength;
++ int totalwPadding = 0;
+
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sending buffers on mailbox : %d \n",mbox));
+
-+ if (A_FAILED(pPacket->Status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCSendPktCompletionHandler: request failed (status:%d, ep:%d) \n",
-+ pPacket->Status, pPacket->Endpoint));
-+ }
-+ /* first, fixup the head room we allocated */
-+ pPacket->pBuffer += HTC_HDR_LENGTH;
-+ /* do completion */
-+ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
-+}
++ /* fill buffer with counting pattern */
++ InitBuffers(FILL_COUNTING);
+
-+A_STATUS HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 SendFlags)
-+{
-+ A_STATUS status;
-+ A_UINT8 *pHdrBuf;
-+ A_BOOL sync = FALSE;
++ /* assemble the order in which we send */
++ AssembleBufferList(sendList);
+
-+ /* caller always provides headrooom */
-+ pPacket->pBuffer -= HTC_HDR_LENGTH;
-+ pHdrBuf = pPacket->pBuffer;
-+ /* setup frame header */
-+ A_SET_UINT16_FIELD(pHdrBuf,HTC_FRAME_HDR,PayloadLen,(A_UINT16)pPacket->ActualLength);
-+ A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,Flags,SendFlags);
-+ A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,EndpointID, (A_UINT8)pPacket->Endpoint);
++ for (i = 0; i < BUFFER_PROC_LIST_DEPTH; i++) {
+
-+ if (pPacket->Completion == NULL) {
-+ /* mark that this request was synchronously issued */
-+ sync = TRUE;
++ /* we are doing block transfers, so we need to pad everything to a block size */
++ paddedLength = (sendList[i].length + (g_BlockSizes[mbox] - 1)) &
++ (~(g_BlockSizes[mbox] - 1));
++
++ /* send each buffer synchronously */
++ status = HIFReadWrite(pDev->HIFDevice,
++ g_MailboxAddrs[mbox],
++ sendList[i].pBuffer,
++ paddedLength,
++ request,
++ NULL);
++ if (status != A_OK) {
++ break;
++ }
++ totalBytes += sendList[i].length;
++ totalwPadding += paddedLength;
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+ ("+-HTCIssueSend: transmit length : %d (%s) \n",
-+ pPacket->ActualLength + HTC_HDR_LENGTH,
-+ sync ? "SYNC" : "ASYNC" ));
-+
-+ /* send message to device */
-+ status = DevSendPacket(&target->Device,
-+ pPacket,
-+ pPacket->ActualLength + HTC_HDR_LENGTH);
-+
-+ if (sync) {
-+ /* use local sync variable. If this was issued asynchronously, pPacket is no longer
-+ * safe to access. */
-+ pPacket->pBuffer += HTC_HDR_LENGTH;
-+ }
-+
-+ /* if this request was asynchronous, the packet completion routine will be invoked by
-+ * the device layer when the HIF layer completes the request */
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Sent %d bytes (%d padded bytes) to mailbox : %d \n",totalBytes,totalwPadding,mbox));
+
+ return status;
+}
+
-+/* try to send the current packet or a packet at the head of the TX queue,
-+ * if there are no credits, the packet remains in the queue. */
-+static void HTCTrySend(HTC_TARGET *target,
-+ HTC_PACKET *pPacketToSend,
-+ HTC_ENDPOINT_ID ep)
++/* poll the mailbox credit counter until we get a credit or timeout */
++static A_STATUS GetCredits(AR6K_DEVICE *pDev, int mbox, int *pCredits)
+{
-+ HTC_PACKET *pPacket;
-+ HTC_ENDPOINT *pEndpoint;
-+ int creditsRequired;
-+ A_UINT8 sendFlags;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (pPkt:0x%X)\n",(A_UINT32)pPacketToSend));
-+
-+ pEndpoint = &target->EndPoint[ep];
++ A_STATUS status = A_OK;
++ int timeout = TEST_CREDITS_RECV_TIMEOUT;
++ A_UINT8 credits = 0;
++ A_UINT32 address;
+
-+ LOCK_HTC_TX(target);
++ while (TRUE) {
+
-+ if (pPacketToSend != NULL) {
-+ /* caller supplied us a packet to queue to the tail of the HTC TX queue before
-+ * we check the tx queue */
-+ HTC_PACKET_ENQUEUE(&pEndpoint->TxQueue,pPacketToSend);
-+ pEndpoint->CurrentTxQueueDepth++;
-+ }
++ /* Read the counter register to get credits, this auto-decrements */
++ address = COUNT_DEC_ADDRESS + (AR6K_MAILBOXES + mbox) * 4;
++ status = HIFReadWrite(pDev->HIFDevice, address, &credits, sizeof(credits),
++ HIF_RD_SYNC_BYTE_FIX, NULL);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("Unable to decrement the command credit count register (mbox=%d)\n",mbox));
++ status = A_ERROR;
++ break;
++ }
+
-+ /* now drain the TX queue for transmission as long as we have enough
-+ * credits */
++ if (credits) {
++ break;
++ }
+
-+ while (1) {
++ timeout--;
+
-+ if (HTC_QUEUE_EMPTY(&pEndpoint->TxQueue)) {
-+ /* nothing in the queue */
++ if (timeout <= 0) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" Timeout reading credit registers (mbox=%d, address:0x%X) \n",mbox,address));
++ status = A_ERROR;
+ break;
+ }
+
-+ sendFlags = 0;
++ /* delay a little, target may not be ready */
++ msleep(1000);
+
-+ /* get packet at head, but don't remove it */
-+ pPacket = HTC_GET_PKT_AT_HEAD(&pEndpoint->TxQueue);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:0x%X , Queue Depth: %d\n",
-+ (A_UINT32)pPacket, pEndpoint->CurrentTxQueueDepth));
++ }
+
-+ /* figure out how many credits this message requires */
-+ creditsRequired = pPacket->ActualLength + HTC_HDR_LENGTH;
-+ creditsRequired += target->TargetCreditSize - 1;
-+ creditsRequired /= target->TargetCreditSize;
++ if (status == A_OK) {
++ *pCredits = credits;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Creds Required:%d Got:%d\n",
-+ creditsRequired, pEndpoint->CreditDist.TxCredits));
++ return status;
++}
+
-+ if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
+
-+ /* not enough credits */
++/* wait for the buffers to come back */
++static A_STATUS RecvBuffers(AR6K_DEVICE *pDev, int mbox)
++{
++ A_STATUS status = A_OK;
++ A_UINT32 request = HIF_RD_SYNC_BLOCK_INC;
++ BUFFER_PROC_LIST recvList[BUFFER_PROC_LIST_DEPTH];
++ int curBuffer;
++ int credits;
++ int i;
++ int totalBytes = 0;
++ int paddedLength;
++ int totalwPadding = 0;
+
-+ if (pPacket->Endpoint == ENDPOINT_0) {
-+ /* leave it in the queue */
-+ break;
-+ }
-+ /* invoke the registered distribution function only if this is not
-+ * endpoint 0, we let the driver layer provide more credits if it can.
-+ * We pass the credit distribution list starting at the endpoint in question
-+ * */
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for buffers on mailbox : %d \n",mbox));
+
-+ /* set how many credits we need */
-+ pEndpoint->CreditDist.TxCreditsSeek =
-+ creditsRequired - pEndpoint->CreditDist.TxCredits;
-+ DO_DISTRIBUTION(target,
-+ HTC_CREDIT_DIST_SEEK_CREDITS,
-+ "Seek Credits",
-+ &pEndpoint->CreditDist);
++ /* zero the buffers */
++ InitBuffers(FILL_ZERO);
+
-+ pEndpoint->CreditDist.TxCreditsSeek = 0;
++ /* assemble the order in which we should receive */
++ AssembleBufferList(recvList);
+
-+ if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
-+ /* still not enough credits to send, leave packet in the queue */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+ (" Not enough credits for ep %d leaving packet in queue..\n",
-+ pPacket->Endpoint));
-+ break;
-+ }
++ curBuffer = 0;
+
-+ }
++ while (curBuffer < BUFFER_PROC_LIST_DEPTH) {
+
-+ pEndpoint->CreditDist.TxCredits -= creditsRequired;
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditsConsummed, creditsRequired);
++ /* get number of buffers that have been completed, this blocks
++ * until we get at least 1 credit or it times out */
++ status = GetCredits(pDev, mbox, &credits);
+
-+ /* check if we need credits */
-+ if (pEndpoint->CreditDist.TxCredits < pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
-+ sendFlags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditLowIndications, 1);
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Host Needs Credits \n"));
++ if (status != A_OK) {
++ break;
+ }
+
-+ /* now we can fully dequeue */
-+ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->TxQueue);
-+ pEndpoint->CurrentTxQueueDepth--;
-+
-+ INC_HTC_EP_STAT(pEndpoint, TxIssued, 1);
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got %d messages on mailbox : %d \n",credits, mbox));
+
-+ UNLOCK_HTC_TX(target);
++ /* get all the buffers that are sitting on the queue */
++ for (i = 0; i < credits; i++) {
++ AR_DEBUG_ASSERT(curBuffer < BUFFER_PROC_LIST_DEPTH);
++ /* recv the current buffer synchronously, the buffers should come back in
++ * order... with padding applied by the target */
++ paddedLength = (recvList[curBuffer].length + (g_BlockSizes[mbox] - 1)) &
++ (~(g_BlockSizes[mbox] - 1));
+
-+ HTCIssueSend(target, pPacket, sendFlags);
++ status = HIFReadWrite(pDev->HIFDevice,
++ g_MailboxAddrs[mbox],
++ recvList[curBuffer].pBuffer,
++ paddedLength,
++ request,
++ NULL);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to read %d bytes on mailbox:%d : address:0x%X \n",
++ recvList[curBuffer].length, mbox, g_MailboxAddrs[mbox]));
++ break;
++ }
+
-+ LOCK_HTC_TX(target);
++ totalwPadding += paddedLength;
++ totalBytes += recvList[curBuffer].length;
++ curBuffer++;
++ }
+
-+ /* go back and check for more messages */
++ if (status != A_OK) {
++ break;
++ }
++ /* go back and get some more */
++ credits = 0;
+ }
+
-+ if (pEndpoint->CurrentTxQueueDepth >= pEndpoint->MaxTxQueueDepth) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Endpoint %d, TX queue is full, Depth:%d, Max:%d \n",
-+ ep, pEndpoint->CurrentTxQueueDepth, pEndpoint->MaxTxQueueDepth));
-+ UNLOCK_HTC_TX(target);
-+ /* queue is now full, let caller know */
-+ if (pEndpoint->EpCallBacks.EpSendFull != NULL) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Calling driver's send full callback.... \n"));
-+ pEndpoint->EpCallBacks.EpSendFull(pEndpoint->EpCallBacks.pContext, ep);
-+ }
-+ } else {
-+ UNLOCK_HTC_TX(target);
-+ /* queue is now available for new packet, let caller know */
-+ if (pEndpoint->EpCallBacks.EpSendAvail)
-+ pEndpoint->EpCallBacks.EpSendAvail(pEndpoint->EpCallBacks.pContext, ep);
++ if (totalBytes != TEST_BYTES) {
++ AR_DEBUG_ASSERT(FALSE);
++ } else {
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Got all buffers on mbox:%d total recv :%d (w/Padding : %d) \n",
++ mbox, totalBytes, totalwPadding));
+ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend: \n"));
++ return status;
++
++
+}
+
-+/* HTC API - HTCSendPkt */
-+A_STATUS HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
++static A_STATUS DoOneMboxHWTest(AR6K_DEVICE *pDev, int mbox)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ HTC_ENDPOINT *pEndpoint;
-+ HTC_ENDPOINT_ID ep;
-+ A_STATUS status = A_OK;
++ A_STATUS status;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
-+ ("+HTCSendPkt: Enter endPointId: %d, buffer: 0x%X, length: %d \n",
-+ pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->ActualLength));
++ do {
++ /* send out buffers */
++ status = SendBuffers(pDev,mbox);
+
-+ ep = pPacket->Endpoint;
-+ AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
-+ pEndpoint = &target->EndPoint[ep];
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Sending buffers Failed : %d mbox:%d\n",status,mbox));
++ break;
++ }
+
-+ do {
++ /* go get them, this will block */
++ status = RecvBuffers(pDev, mbox);
+
-+ if (HTC_STOPPING(target)) {
-+ status = A_ECANCELED;
-+ pPacket->Status = status;
-+ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Recv buffers Failed : %d mbox:%d\n",status,mbox));
+ break;
+ }
-+ /* everything sent through this interface is asynchronous */
-+ /* fill in HTC completion routines */
-+ pPacket->Completion = HTCSendPktCompletionHandler;
-+ pPacket->pContext = target;
+
-+ HTCTrySend(target, pPacket, ep);
++ /* check the returned data patterns */
++ if (!CheckBuffers()) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Buffer Verify Failed : mbox:%d\n",mbox));
++ status = A_ERROR;
++ break;
++ }
+
-+ } while (FALSE);
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" Send/Recv success! mailbox : %d \n",mbox));
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCSendPkt \n"));
++ } while (FALSE);
+
+ return status;
+}
+
-+
-+/* check TX queues to drain because of credit distribution update */
-+static INLINE void HTCCheckEndpointTxQueues(HTC_TARGET *target)
++/* here is where the test starts */
++A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev)
+{
-+ HTC_ENDPOINT *pEndpoint;
-+ HTC_ENDPOINT_CREDIT_DIST *pDistItem;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCCheckEndpointTxQueues \n"));
-+ pDistItem = target->EpCreditDistributionListHead;
-+
-+ /* run through the credit distribution list to see
-+ * if there are packets queued
-+ * NOTE: no locks need to be taken since the distribution list
-+ * is not dynamic (cannot be re-ordered) and we are not modifying any state */
-+ while (pDistItem != NULL) {
-+ pEndpoint = (HTC_ENDPOINT *)pDistItem->pHTCReserved;
-+
-+ if (pEndpoint->CurrentTxQueueDepth > 0) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Ep %d has %d credits and %d Packets in TX Queue \n",
-+ pDistItem->Endpoint, pEndpoint->CreditDist.TxCredits, pEndpoint->CurrentTxQueueDepth));
-+ /* try to start the stalled queue, this list is ordered by priority.
-+ * Highest priority queue get's processed first, if there are credits available the
-+ * highest priority queue will get a chance to reclaim credits from lower priority
-+ * ones */
-+ HTCTrySend(target, NULL, pDistItem->Endpoint);
-+ }
-+
-+ pDistItem = pDistItem->pNext;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCCheckEndpointTxQueues \n"));
-+}
++ int i;
++ A_STATUS status;
++ int credits = 0;
++ A_UINT8 params[4];
++ int numBufs;
++ int bufferSize;
++ A_UINT16 temp;
+
-+/* process credit reports and call distribution function */
-+void HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint)
-+{
-+ int i;
-+ HTC_ENDPOINT *pEndpoint;
-+ int totalCredits = 0;
-+ A_BOOL doDist = FALSE;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCProcessCreditRpt, Credit Report Entries:%d \n", NumEntries));
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest START - \n"));
+
-+ /* lock out TX while we update credits */
-+ LOCK_HTC_TX(target);
++ do {
++ /* get the addresses for all 4 mailboxes */
++ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_ADDR,
++ g_MailboxAddrs, sizeof(g_MailboxAddrs));
+
-+ for (i = 0; i < NumEntries; i++, pRpt++) {
-+ if (pRpt->EndpointID >= ENDPOINT_MAX) {
++ if (status != A_OK) {
+ AR_DEBUG_ASSERT(FALSE);
+ break;
+ }
+
-+ pEndpoint = &target->EndPoint[pRpt->EndpointID];
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Endpoint %d got %d credits \n",
-+ pRpt->EndpointID, pRpt->Credits));
-+
-+
-+#ifdef HTC_EP_STAT_PROFILING
-+
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditRpts, 1);
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditsReturned, pRpt->Credits);
++ /* get the block sizes */
++ status = HIFConfigureDevice(pDev->HIFDevice, HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
++ g_BlockSizes, sizeof(g_BlockSizes));
+
-+ if (FromEndpoint == pRpt->EndpointID) {
-+ /* this credit report arrived on the same endpoint indicating it arrived in an RX
-+ * packet */
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromRx, pRpt->Credits);
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromRx, 1);
-+ } else if (FromEndpoint == ENDPOINT_0) {
-+ /* this credit arrived on endpoint 0 as a NULL message */
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromEp0, pRpt->Credits);
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromEp0, 1);
-+ } else {
-+ /* arrived on another endpoint */
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromOther, pRpt->Credits);
-+ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromOther, 1);
++ if (status != A_OK) {
++ AR_DEBUG_ASSERT(FALSE);
++ break;
+ }
+
-+#endif
++ /* note, the HIF layer usually reports mbox 0 to have a block size of
++ * 1, but our test wants to run in block-mode for all mailboxes, so we treat all mailboxes
++ * the same. */
++ g_BlockSizes[0] = g_BlockSizes[1];
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Block Size to use: %d \n",g_BlockSizes[0]));
+
-+ if (ENDPOINT_0 == pRpt->EndpointID) {
-+ /* always give endpoint 0 credits back */
-+ pEndpoint->CreditDist.TxCredits += pRpt->Credits;
-+ } else {
-+ /* for all other endpoints, update credits to distribute, the distribution function
-+ * will handle giving out credits back to the endpoints */
-+ pEndpoint->CreditDist.TxCreditsToDist += pRpt->Credits;
-+ /* flag that we have to do the distribution */
-+ doDist = TRUE;
++ if (g_BlockSizes[1] > BUFFER_BLOCK_PAD) {
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("%d Block size is too large for buffer pad %d\n",
++ g_BlockSizes[1], BUFFER_BLOCK_PAD));
++ break;
+ }
+
-+ totalCredits += pRpt->Credits;
-+ }
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Report indicated %d credits to distribute \n", totalCredits));
-+
-+ if (doDist) {
-+ /* this was a credit return based on a completed send operations
-+ * note, this is done with the lock held */
-+ DO_DISTRIBUTION(target,
-+ HTC_CREDIT_DIST_SEND_COMPLETE,
-+ "Send Complete",
-+ target->EpCreditDistributionListHead->pNext);
-+ }
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Waiting for target.... \n"));
+
-+ UNLOCK_HTC_TX(target);
++ /* the target lets us know it is ready by giving us 1 credit on
++ * mailbox 0 */
++ status = GetCredits(pDev, 0, &credits);
+
-+ if (totalCredits) {
-+ HTCCheckEndpointTxQueues(target);
-+ }
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait for target ready \n"));
++ break;
++ }
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCProcessCreditRpt \n"));
-+}
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Target is ready ...\n"));
+
-+/* flush endpoint TX queue */
-+static void HTCFlushEndpointTX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint, HTC_TX_TAG Tag)
-+{
-+ HTC_PACKET *pPacket;
-+ HTC_PACKET_QUEUE discardQueue;
++ /* read the first 4 scratch registers */
++ status = HIFReadWrite(pDev->HIFDevice,
++ SCRATCH_ADDRESS,
++ params,
++ 4,
++ HIF_RD_SYNC_BYTE_INC,
++ NULL);
+
-+ /* initialize the discard queue */
-+ INIT_HTC_PACKET_QUEUE(&discardQueue);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to wait get parameters \n"));
++ break;
++ }
+
-+ LOCK_HTC_TX(target);
++ numBufs = params[0];
++ bufferSize = (int)(((A_UINT16)params[2] << 8) | (A_UINT16)params[1]);
+
-+ /* interate from the front of the TX queue and flush out packets */
-+ ITERATE_OVER_LIST_ALLOW_REMOVE(&pEndpoint->TxQueue, pPacket, HTC_PACKET, ListLink) {
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE,
++ ("Target parameters: bufs per mailbox:%d, buffer size:%d bytes (total space: %d, minimum required space (w/padding): %d) \n",
++ numBufs, bufferSize, (numBufs * bufferSize), TOTAL_BYTES));
+
-+ /* check for removal */
-+ if ((HTC_TX_PACKET_TAG_ALL == Tag) || (Tag == pPacket->PktInfo.AsTx.Tag)) {
-+ /* remove from queue */
-+ HTC_PACKET_REMOVE(pPacket);
-+ /* add it to the discard pile */
-+ HTC_PACKET_ENQUEUE(&discardQueue, pPacket);
-+ pEndpoint->CurrentTxQueueDepth--;
++ if ((numBufs * bufferSize) < TOTAL_BYTES) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Not Enough buffer space to run test! need:%d, got:%d \n",
++ TOTAL_BYTES, (numBufs*bufferSize)));
++ status = A_ERROR;
++ break;
+ }
+
-+ } ITERATE_END;
++ temp = GetEndMarker();
+
-+ UNLOCK_HTC_TX(target);
++ status = HIFReadWrite(pDev->HIFDevice,
++ SCRATCH_ADDRESS + 4,
++ (A_UINT8 *)&temp,
++ 2,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ /* empty the discard queue */
-+ while (1) {
-+ pPacket = HTC_PACKET_DEQUEUE(&discardQueue);
-+ if (NULL == pPacket) {
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write end marker \n"));
+ break;
+ }
-+ pPacket->Status = A_ECANCELED;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" Flushing TX packet:0x%X, length:%d, ep:%d tag:0x%X \n",
-+ (A_UINT32)pPacket, pPacket->ActualLength, pPacket->Endpoint, pPacket->PktInfo.AsTx.Tag));
-+ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
-+ }
+
-+}
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("End Marker: 0x%X \n",temp));
+
-+void DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist)
-+{
-+#ifdef DEBUG
-+ HTC_ENDPOINT *pEndpoint = (HTC_ENDPOINT *)pEPDist->pHTCReserved;
-+#endif
++ temp = (A_UINT16)g_BlockSizes[1];
++ /* convert to a mask */
++ temp = temp - 1;
++ status = HIFReadWrite(pDev->HIFDevice,
++ SCRATCH_ADDRESS + 6,
++ (A_UINT8 *)&temp,
++ 2,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("--- EP : %d ServiceID: 0x%X --------------\n",
-+ pEPDist->Endpoint, pEPDist->ServiceID));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" this:0x%X next:0x%X prev:0x%X\n",
-+ (A_UINT32)pEPDist, (A_UINT32)pEPDist->pNext, (A_UINT32)pEPDist->pPrev));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" DistFlags : 0x%X \n", pEPDist->DistFlags));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsNorm : %d \n", pEPDist->TxCreditsNorm));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsMin : %d \n", pEPDist->TxCreditsMin));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCredits : %d \n", pEPDist->TxCredits));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsAssigned : %d \n", pEPDist->TxCreditsAssigned));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsSeek : %d \n", pEPDist->TxCreditsSeek));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditSize : %d \n", pEPDist->TxCreditSize));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsPerMaxMsg : %d \n", pEPDist->TxCreditsPerMaxMsg));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsToDist : %d \n", pEPDist->TxCreditsToDist));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxQueueDepth : %d \n", pEndpoint->CurrentTxQueueDepth));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("----------------------------------------------------\n"));
-+}
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to write block mask \n"));
++ break;
++ }
+
-+void DumpCreditDistStates(HTC_TARGET *target)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pEPList = target->EpCreditDistributionListHead;
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, ("Set Block Mask: 0x%X \n",temp));
+
-+ while (pEPList != NULL) {
-+ DumpCreditDist(pEPList);
-+ pEPList = pEPList->pNext;
-+ }
++ /* execute the test on each mailbox */
++ for (i = 0; i < AR6K_MAILBOXES; i++) {
++ status = DoOneMboxHWTest(pDev, i);
++ if (status != A_OK) {
++ break;
++ }
++ }
+
-+ if (target->DistributeCredits != NULL) {
-+ DO_DISTRIBUTION(target,
-+ HTC_DUMP_CREDIT_STATE,
-+ "Dump State",
-+ NULL);
++ } while (FALSE);
++
++ if (status == A_OK) {
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - SUCCESS! - \n"));
++ } else {
++ AR_DEBUG_PRINTF(ATH_PRINT_OUT_ZONE, (" DoMboxHWTest DONE - FAILED! - \n"));
+ }
++ /* don't let HTC_Start continue, the target is actually not running any HTC code */
++ return A_ERROR;
+}
++#endif
+
-+/* flush all send packets from all endpoint queues */
-+void HTCFlushSendPkts(HTC_TARGET *target)
-+{
-+ HTC_ENDPOINT *pEndpoint;
-+ int i;
+
-+ DumpCreditDistStates(target);
+
-+ for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
-+ pEndpoint = &target->EndPoint[i];
-+ if (pEndpoint->ServiceID == 0) {
-+ /* not in use.. */
-+ continue;
-+ }
-+ HTCFlushEndpointTX(target,pEndpoint,HTC_TX_PACKET_TAG_ALL);
-+ }
+diff --git a/drivers/ar6000/htc/ar6k.h b/drivers/ar6000/htc/ar6k.h
+new file mode 100644
+index 0000000..301ab34
+--- /dev/null
++++ b/drivers/ar6000/htc/ar6k.h
+@@ -0,0 +1,191 @@
++/*
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+}
++#ifndef AR6K_H_
++#define AR6K_H_
+
-+/* HTC API to flush an endpoint's TX queue*/
-+void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag)
-+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
++#define AR6K_MAILBOXES 4
+
-+ if (pEndpoint->ServiceID == 0) {
++/* HTC runs over mailbox 0 */
++#define HTC_MAILBOX 0
++
++#define AR6K_TARGET_DEBUG_INTR_MASK 0x01
++
++#define OTHER_INTS_ENABLED (INT_STATUS_ENABLE_ERROR_MASK | \
++ INT_STATUS_ENABLE_CPU_MASK | \
++ INT_STATUS_ENABLE_COUNTER_MASK)
++
++//#define MBOXHW_UNIT_TEST 1
++
++#include "athstartpack.h"
++typedef PREPACK struct _AR6K_IRQ_PROC_REGISTERS {
++ A_UINT8 host_int_status;
++ A_UINT8 cpu_int_status;
++ A_UINT8 error_int_status;
++ A_UINT8 counter_int_status;
++ A_UINT8 mbox_frame;
++ A_UINT8 rx_lookahead_valid;
++ A_UINT8 hole[2];
++ A_UINT32 rx_lookahead[2];
++} POSTPACK AR6K_IRQ_PROC_REGISTERS;
++
++#define AR6K_IRQ_PROC_REGS_SIZE sizeof(AR6K_IRQ_PROC_REGISTERS)
++
++
++
++typedef PREPACK struct _AR6K_IRQ_ENABLE_REGISTERS {
++ A_UINT8 int_status_enable;
++ A_UINT8 cpu_int_status_enable;
++ A_UINT8 error_status_enable;
++ A_UINT8 counter_int_status_enable;
++} POSTPACK AR6K_IRQ_ENABLE_REGISTERS;
++
++#include "athendpack.h"
++
++#define AR6K_IRQ_ENABLE_REGS_SIZE sizeof(AR6K_IRQ_ENABLE_REGISTERS)
++
++#define AR6K_REG_IO_BUFFER_SIZE 32
++#define AR6K_MAX_REG_IO_BUFFERS 8
++
++/* buffers for ASYNC I/O */
++typedef struct AR6K_ASYNC_REG_IO_BUFFER {
++ HTC_PACKET HtcPacket; /* we use an HTC packet as a wrapper for our async register-based I/O */
++ A_UINT8 Buffer[AR6K_REG_IO_BUFFER_SIZE];
++} AR6K_ASYNC_REG_IO_BUFFER;
++
++typedef struct _AR6K_DEVICE {
++ A_MUTEX_T Lock;
++ AR6K_IRQ_PROC_REGISTERS IrqProcRegisters;
++ AR6K_IRQ_ENABLE_REGISTERS IrqEnableRegisters;
++ void *HIFDevice;
++ A_UINT32 BlockSize;
++ A_UINT32 BlockMask;
++ A_UINT32 MailboxAddress;
++ HIF_PENDING_EVENTS_FUNC GetPendingEventsFunc;
++ void *HTCContext;
++ HTC_PACKET_QUEUE RegisterIOList;
++ AR6K_ASYNC_REG_IO_BUFFER RegIOBuffers[AR6K_MAX_REG_IO_BUFFERS];
++ void (*TargetFailureCallback)(void *Context);
++ A_STATUS (*MessagePendingCallback)(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
++ HIF_DEVICE_IRQ_PROCESSING_MODE HifIRQProcessingMode;
++ HIF_MASK_UNMASK_RECV_EVENT HifMaskUmaskRecvEvent;
++} AR6K_DEVICE;
++
++#define IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(pDev) ((pDev)->HifIRQProcessingMode != HIF_DEVICE_IRQ_SYNC_ONLY)
++
++A_STATUS DevSetup(AR6K_DEVICE *pDev);
++A_STATUS DevUnmaskInterrupts(AR6K_DEVICE *pDev);
++A_STATUS DevMaskInterrupts(AR6K_DEVICE *pDev);
++A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
++ A_UINT32 *pLookAhead,
++ int TimeoutMS);
++A_STATUS DevRWCompletionHandler(void *context, A_STATUS status);
++A_STATUS DevDsrHandler(void *context);
++A_STATUS DevCheckPendingRecvMsgsAsync(void *context);
++void DevDumpRegisters(AR6K_IRQ_PROC_REGISTERS *pIrqProcRegs,
++ AR6K_IRQ_ENABLE_REGISTERS *pIrqEnableRegs);
++
++#define DEV_STOP_RECV_ASYNC TRUE
++#define DEV_STOP_RECV_SYNC FALSE
++#define DEV_ENABLE_RECV_ASYNC TRUE
++#define DEV_ENABLE_RECV_SYNC FALSE
++A_STATUS DevStopRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
++A_STATUS DevEnableRecv(AR6K_DEVICE *pDev, A_BOOL ASyncMode);
++
++static INLINE A_STATUS DevSendPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 SendLength) {
++ A_UINT32 paddedLength;
++ A_BOOL sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
++ A_STATUS status;
++
++ /* adjust the length to be a multiple of block size if appropriate */
++ paddedLength = (SendLength + (pDev->BlockMask)) &
++ (~(pDev->BlockMask));
++#if 0 // BufferLength may not be set in , fix this...
++ if (paddedLength > pPacket->BufferLength) {
+ AR_DEBUG_ASSERT(FALSE);
-+ /* not in use.. */
-+ return;
++ if (pPacket->Completion != NULL) {
++ COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
++ }
++ return A_EINVAL;
++ }
++#endif
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
++ ("DevSendPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
++ paddedLength,
++ pDev->MailboxAddress,
++ sync ? "SYNC" : "ASYNC"));
++
++ status = HIFReadWrite(pDev->HIFDevice,
++ pDev->MailboxAddress,
++ pPacket->pBuffer,
++ paddedLength, /* the padded length */
++ sync ? HIF_WR_SYNC_BLOCK_INC : HIF_WR_ASYNC_BLOCK_INC,
++ sync ? NULL : pPacket); /* pass the packet as the context to the HIF request */
++
++ if (sync) {
++ pPacket->Status = status;
+ }
+
-+ HTCFlushEndpointTX(target, pEndpoint, Tag);
++ return status;
+}
+
-+/* HTC API to indicate activity to the credit distribution function */
-+void HTCIndicateActivityChange(HTC_HANDLE HTCHandle,
-+ HTC_ENDPOINT_ID Endpoint,
-+ A_BOOL Active)
-+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
-+ A_BOOL doDist = FALSE;
++static INLINE A_STATUS DevRecvPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket, A_UINT32 RecvLength) {
++ A_UINT32 paddedLength;
++ A_STATUS status;
++ A_BOOL sync = (pPacket->Completion == NULL) ? TRUE : FALSE;
+
-+ if (pEndpoint->ServiceID == 0) {
++ /* adjust the length to be a multiple of block size if appropriate */
++ paddedLength = (RecvLength + (pDev->BlockMask)) &
++ (~(pDev->BlockMask));
++ if (paddedLength > pPacket->BufferLength) {
+ AR_DEBUG_ASSERT(FALSE);
-+ /* not in use.. */
-+ return;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("DevRecvPacket, Not enough space for padlen:%d recvlen:%d bufferlen:%d \n",
++ paddedLength,RecvLength,pPacket->BufferLength));
++ if (pPacket->Completion != NULL) {
++ COMPLETE_HTC_PACKET(pPacket,A_EINVAL);
++ }
++ return A_EINVAL;
+ }
+
-+ LOCK_HTC_TX(target);
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
++ ("DevRecvPacket, Padded Length: %d Mbox:0x%X (mode:%s)\n",
++ paddedLength,
++ pDev->MailboxAddress,
++ sync ? "SYNC" : "ASYNC"));
+
-+ if (Active) {
-+ if (!(pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE)) {
-+ /* mark active now */
-+ pEndpoint->CreditDist.DistFlags |= HTC_EP_ACTIVE;
-+ doDist = TRUE;
-+ }
-+ } else {
-+ if (pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE) {
-+ /* mark inactive now */
-+ pEndpoint->CreditDist.DistFlags &= ~HTC_EP_ACTIVE;
-+ doDist = TRUE;
-+ }
-+ }
++ status = HIFReadWrite(pDev->HIFDevice,
++ pDev->MailboxAddress,
++ pPacket->pBuffer,
++ paddedLength,
++ sync ? HIF_RD_SYNC_BLOCK_INC : HIF_RD_ASYNC_BLOCK_INC,
++ sync ? NULL : pPacket); /* pass the packet as the context to the HIF request */
+
-+ if (doDist) {
-+ /* do distribution again based on activity change
-+ * note, this is done with the lock held */
-+ DO_DISTRIBUTION(target,
-+ HTC_CREDIT_DIST_ACTIVITY_CHANGE,
-+ "Activity Change",
-+ target->EpCreditDistributionListHead->pNext);
++ if (sync) {
++ pPacket->Status = status;
+ }
+
-+ UNLOCK_HTC_TX(target);
-+
++ return status;
+}
-diff --git a/drivers/ar6000/htc/htc_services.c b/drivers/ar6000/htc/htc_services.c
++
++#ifdef MBOXHW_UNIT_TEST
++A_STATUS DoMboxHWTest(AR6K_DEVICE *pDev);
++#endif
++
++#endif /*AR6K_H_*/
+diff --git a/drivers/ar6000/htc/ar6k_events.c b/drivers/ar6000/htc/ar6k_events.c
new file mode 100644
-index 0000000..e5d50d1
+index 0000000..91b29af
--- /dev/null
-+++ b/drivers/ar6000/htc/htc_services.c
-@@ -0,0 +1,403 @@
++++ b/drivers/ar6000/htc/ar6k_events.c
+@@ -0,0 +1,638 @@
+/*
++ * AR6K Driver layer event handling (i.e. interrupts, message polling)
+ *
+ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ */
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "AR6Khwreg.h"
++#include "a_osapi.h"
++#include "a_debug.h"
++#include "hif.h"
++#include "htc_packet.h"
++#include "ar6k.h"
+
-+#include "htc_internal.h"
-+
-+void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket)
-+{
-+ /* not implemented
-+ * we do not send control TX frames during normal runtime, only during setup */
-+ AR_DEBUG_ASSERT(FALSE);
-+}
-+
-+ /* callback when a control message arrives on this endpoint */
-+void HTCControlRecv(void *Context, HTC_PACKET *pPacket)
-+{
-+ AR_DEBUG_ASSERT(pPacket->Endpoint == ENDPOINT_0);
-+
-+ /* the only control messages we are expecting are NULL messages (credit resports), which should
-+ * never get here */
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ ("HTCControlRecv, got message with length:%d \n",
-+ pPacket->ActualLength + HTC_HDR_LENGTH));
++extern void AR6KFreeIOPacket(AR6K_DEVICE *pDev, HTC_PACKET *pPacket);
++extern HTC_PACKET *AR6KAllocIOPacket(AR6K_DEVICE *pDev);
+
-+ /* dump header and message */
-+ DebugDumpBytes(pPacket->pBuffer - HTC_HDR_LENGTH,
-+ pPacket->ActualLength + HTC_HDR_LENGTH,
-+ "Unexpected ENDPOINT 0 Message");
++static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev);
+
-+ HTC_RECYCLE_RX_PKT((HTC_TARGET*)Context,pPacket);
-+}
++#define DELAY_PER_INTERVAL_MS 10 /* 10 MS delay per polling interval */
+
-+A_STATUS HTCSendSetupComplete(HTC_TARGET *target)
++/* completion routine for ALL HIF layer async I/O */
++A_STATUS DevRWCompletionHandler(void *context, A_STATUS status)
+{
-+ HTC_PACKET *pSendPacket = NULL;
-+ A_STATUS status;
-+ HTC_SETUP_COMPLETE_MSG *pSetupComplete;
-+
-+ do {
-+ /* allocate a packet to send to the target */
-+ pSendPacket = HTC_ALLOC_CONTROL_TX(target);
-+
-+ if (NULL == pSendPacket) {
-+ status = A_NO_MEMORY;
-+ break;
-+ }
-+
-+ /* assemble setup complete message */
-+ pSetupComplete = (HTC_SETUP_COMPLETE_MSG *)pSendPacket->pBuffer;
-+ A_MEMZERO(pSetupComplete,sizeof(HTC_SETUP_COMPLETE_MSG));
-+ pSetupComplete->MessageID = HTC_MSG_SETUP_COMPLETE_ID;
-+
-+ SET_HTC_PACKET_INFO_TX(pSendPacket,
-+ NULL,
-+ (A_UINT8 *)pSetupComplete,
-+ sizeof(HTC_SETUP_COMPLETE_MSG),
-+ ENDPOINT_0,
-+ HTC_SERVICE_TX_PACKET_TAG);
-+
-+ /* we want synchronous operation */
-+ pSendPacket->Completion = NULL;
-+ /* send the message */
-+ status = HTCIssueSend(target,pSendPacket,0);
-+
-+ } while (FALSE);
++ HTC_PACKET *pPacket = (HTC_PACKET *)context;
+
-+ if (pSendPacket != NULL) {
-+ HTC_FREE_CONTROL_TX(target,pSendPacket);
-+ }
++ COMPLETE_HTC_PACKET(pPacket,status);
+
-+ return status;
++ return A_OK;
+}
+
-+
-+A_STATUS HTCConnectService(HTC_HANDLE HTCHandle,
-+ HTC_SERVICE_CONNECT_REQ *pConnectReq,
-+ HTC_SERVICE_CONNECT_RESP *pConnectResp)
++/* mailbox recv message polling */
++A_STATUS DevPollMboxMsgRecv(AR6K_DEVICE *pDev,
++ A_UINT32 *pLookAhead,
++ int TimeoutMS)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ A_STATUS status = A_OK;
-+ HTC_PACKET *pRecvPacket = NULL;
-+ HTC_PACKET *pSendPacket = NULL;
-+ HTC_CONNECT_SERVICE_RESPONSE_MSG *pResponseMsg;
-+ HTC_CONNECT_SERVICE_MSG *pConnectMsg;
-+ HTC_ENDPOINT_ID assignedEndpoint = ENDPOINT_MAX;
-+ HTC_ENDPOINT *pEndpoint;
-+ int maxMsgSize = 0;
-+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:0x%X SvcID:0x%X \n",
-+ (A_UINT32)target, pConnectReq->ServiceID));
-+
-+ do {
-+
-+ AR_DEBUG_ASSERT(pConnectReq->ServiceID != 0);
++ A_STATUS status = A_OK;
++ int timeout = TimeoutMS/DELAY_PER_INTERVAL_MS;
+
-+ if (HTC_CTRL_RSVD_SVC == pConnectReq->ServiceID) {
-+ /* special case for pseudo control service */
-+ assignedEndpoint = ENDPOINT_0;
-+ maxMsgSize = HTC_MAX_CONTROL_MESSAGE_LENGTH;
-+ } else {
-+ /* allocate a packet to send to the target */
-+ pSendPacket = HTC_ALLOC_CONTROL_TX(target);
++ AR_DEBUG_ASSERT(timeout > 0);
+
-+ if (NULL == pSendPacket) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_NO_MEMORY;
-+ break;
-+ }
-+ /* assemble connect service message */
-+ pConnectMsg = (HTC_CONNECT_SERVICE_MSG *)pSendPacket->pBuffer;
-+ AR_DEBUG_ASSERT(pConnectMsg != NULL);
-+ A_MEMZERO(pConnectMsg,sizeof(HTC_CONNECT_SERVICE_MSG));
-+ pConnectMsg->MessageID = HTC_MSG_CONNECT_SERVICE_ID;
-+ pConnectMsg->ServiceID = pConnectReq->ServiceID;
-+ pConnectMsg->ConnectionFlags = pConnectReq->ConnectionFlags;
-+ /* check caller if it wants to transfer meta data */
-+ if ((pConnectReq->pMetaData != NULL) &&
-+ (pConnectReq->MetaDataLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
-+ /* copy meta data into message buffer (after header ) */
-+ A_MEMCPY((A_UINT8 *)pConnectMsg + sizeof(HTC_CONNECT_SERVICE_MSG),
-+ pConnectReq->pMetaData,
-+ pConnectReq->MetaDataLength);
-+ pConnectMsg->ServiceMetaLength = pConnectReq->MetaDataLength;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+DevPollMboxMsgRecv \n"));
+
-+ SET_HTC_PACKET_INFO_TX(pSendPacket,
-+ NULL,
-+ (A_UINT8 *)pConnectMsg,
-+ sizeof(HTC_CONNECT_SERVICE_MSG) + pConnectMsg->ServiceMetaLength,
-+ ENDPOINT_0,
-+ HTC_SERVICE_TX_PACKET_TAG);
++ while (TRUE) {
+
-+ /* we want synchronous operation */
-+ pSendPacket->Completion = NULL;
++ if (pDev->GetPendingEventsFunc != NULL)
++ {
+
-+ status = HTCIssueSend(target,pSendPacket,0);
++ HIF_PENDING_EVENTS_INFO events;
+
-+ if (A_FAILED(status)) {
-+ break;
++ /* the HIF layer uses a special mechanism to get events, do this
++ * synchronously */
++ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
++ &events,
++ NULL);
++ if (A_FAILED(status))
++ {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to get pending events \n"));
++ break;
+ }
+
-+ /* wait for response */
-+ status = HTCWaitforControlMessage(target, &pRecvPacket);
++ if (events.Events & HIF_RECV_MSG_AVAIL)
++ {
++ /* there is a message available, the lookahead should be valid now */
++ *pLookAhead = events.LookAhead;
+
-+ if (A_FAILED(status)) {
+ break;
+ }
-+ /* we controlled the buffer creation so it has to be properly aligned */
-+ pResponseMsg = (HTC_CONNECT_SERVICE_RESPONSE_MSG *)pRecvPacket->pBuffer;
++ }
++ else
++ {
+
-+ if ((pResponseMsg->MessageID != HTC_MSG_CONNECT_SERVICE_RESPONSE_ID) ||
-+ (pRecvPacket->ActualLength < sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG))) {
-+ /* this message is not valid */
-+ AR_DEBUG_ASSERT(FALSE);
-+ status = A_EPROTO;
-+ break;
-+ }
++ /* this is the standard HIF way.... */
++ /* load the register table */
++ status = HIFReadWrite(pDev->HIFDevice,
++ HOST_INT_STATUS_ADDRESS,
++ (A_UINT8 *)&pDev->IrqProcRegisters,
++ AR6K_IRQ_PROC_REGS_SIZE,
++ HIF_RD_SYNC_BYTE_INC,
++ NULL);
+
-+ pConnectResp->ConnectRespCode = pResponseMsg->Status;
-+ /* check response status */
-+ if (pResponseMsg->Status != HTC_SERVICE_SUCCESS) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-+ (" Target failed service 0x%X connect request (status:%d)\n",
-+ pResponseMsg->ServiceID, pResponseMsg->Status));
-+ status = A_EPROTO;
++ if (A_FAILED(status))
++ {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to read register table \n"));
+ break;
+ }
+
-+ assignedEndpoint = pResponseMsg->EndpointID;
-+ maxMsgSize = pResponseMsg->MaxMsgSize;
-+
-+ if ((pConnectResp->pMetaData != NULL) &&
-+ (pResponseMsg->ServiceMetaLength > 0) &&
-+ (pResponseMsg->ServiceMetaLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
-+ /* caller supplied a buffer and the target responded with data */
-+ int copyLength = min((int)pConnectResp->BufferLength, (int)pResponseMsg->ServiceMetaLength);
-+ /* copy the meta data */
-+ A_MEMCPY(pConnectResp->pMetaData,
-+ ((A_UINT8 *)pResponseMsg) + sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG),
-+ copyLength);
-+ pConnectResp->ActualLength = copyLength;
++ /* check for MBOX data and valid lookahead */
++ if (pDev->IrqProcRegisters.host_int_status & (1 << HTC_MAILBOX))
++ {
++ if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX))
++ {
++ /* mailbox has a message and the look ahead is valid */
++ *pLookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
++ break;
++ }
+ }
+
+ }
+
-+ /* the rest of these are parameter checks so set the error status */
-+ status = A_EPROTO;
-+
-+ if (assignedEndpoint >= ENDPOINT_MAX) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ timeout--;
+
-+ if (0 == maxMsgSize) {
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
++ if (timeout <= 0)
++ {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Timeout waiting for recv message \n"));
++ status = A_ERROR;
+
-+ pEndpoint = &target->EndPoint[assignedEndpoint];
++ /* check if the target asserted */
++ if ( pDev->IrqProcRegisters.counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
++ /* target signaled an assert, process this pending interrupt
++ * this will call the target failure handler */
++ DevServiceDebugInterrupt(pDev);
++ }
+
-+ if (pEndpoint->ServiceID != 0) {
-+ /* endpoint already in use! */
-+ AR_DEBUG_ASSERT(FALSE);
+ break;
+ }
+
-+ /* return assigned endpoint to caller */
-+ pConnectResp->Endpoint = assignedEndpoint;
-+ pConnectResp->MaxMsgLength = maxMsgSize;
-+
-+ /* setup the endpoint */
-+ pEndpoint->ServiceID = pConnectReq->ServiceID; /* this marks the endpoint in use */
-+ pEndpoint->MaxTxQueueDepth = pConnectReq->MaxSendQueueDepth;
-+ pEndpoint->MaxMsgLength = maxMsgSize;
-+ /* copy all the callbacks */
-+ pEndpoint->EpCallBacks = pConnectReq->EpCallbacks;
-+ INIT_HTC_PACKET_QUEUE(&pEndpoint->RxBuffers);
-+ INIT_HTC_PACKET_QUEUE(&pEndpoint->TxQueue);
-+ /* set the credit distribution info for this endpoint, this information is
-+ * passed back to the credit distribution callback function */
-+ pEndpoint->CreditDist.ServiceID = pConnectReq->ServiceID;
-+ pEndpoint->CreditDist.pHTCReserved = pEndpoint;
-+ pEndpoint->CreditDist.Endpoint = assignedEndpoint;
-+ pEndpoint->CreditDist.TxCreditSize = target->TargetCreditSize;
-+ pEndpoint->CreditDist.TxCreditsPerMaxMsg = maxMsgSize / target->TargetCreditSize;
-+
-+ if (0 == pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
-+ pEndpoint->CreditDist.TxCreditsPerMaxMsg = 1;
-+ }
++ /* delay a little */
++ msleep(DELAY_PER_INTERVAL_MS);
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" Retry Mbox Poll : %d \n",timeout));
++ }
+
-+ status = A_OK;
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-DevPollMboxMsgRecv \n"));
+
-+ } while (FALSE);
++ return status;
++}
+
-+ if (pSendPacket != NULL) {
-+ HTC_FREE_CONTROL_TX(target,pSendPacket);
-+ }
++static A_STATUS DevServiceCPUInterrupt(AR6K_DEVICE *pDev)
++{
++ A_STATUS status;
++ A_UINT8 cpu_int_status;
++ A_UINT8 regBuffer[4];
+
-+ if (pRecvPacket != NULL) {
-+ HTC_FREE_CONTROL_RX(target,pRecvPacket);
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("CPU Interrupt\n"));
++ cpu_int_status = pDev->IrqProcRegisters.cpu_int_status &
++ pDev->IrqEnableRegisters.cpu_int_status_enable;
++ AR_DEBUG_ASSERT(cpu_int_status);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ ("Valid interrupt source(s) in CPU_INT_STATUS: 0x%x\n",
++ cpu_int_status));
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCConnectService \n"));
++ /* Clear the interrupt */
++ pDev->IrqProcRegisters.cpu_int_status &= ~cpu_int_status; /* W1C */
++
++ /* set up the register transfer buffer to hit the register 4 times , this is done
++ * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
++ * restrict bus transfer lengths to be a multiple of 4-bytes */
++
++ /* set W1C value to clear the interrupt, this hits the register first */
++ regBuffer[0] = cpu_int_status;
++ /* the remaining 4 values are set to zero which have no-effect */
++ regBuffer[1] = 0;
++ regBuffer[2] = 0;
++ regBuffer[3] = 0;
+
++ status = HIFReadWrite(pDev->HIFDevice,
++ CPU_INT_STATUS_ADDRESS,
++ regBuffer,
++ 4,
++ HIF_WR_SYNC_BYTE_FIX,
++ NULL);
++
++ AR_DEBUG_ASSERT(status == A_OK);
+ return status;
+}
+
-+static void AddToEndpointDistList(HTC_TARGET *target, HTC_ENDPOINT_CREDIT_DIST *pEpDist)
++
++static A_STATUS DevServiceErrorInterrupt(AR6K_DEVICE *pDev)
+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEntry,*pLastEntry;
++ A_STATUS status;
++ A_UINT8 error_int_status;
++ A_UINT8 regBuffer[4];
+
-+ if (NULL == target->EpCreditDistributionListHead) {
-+ target->EpCreditDistributionListHead = pEpDist;
-+ pEpDist->pNext = NULL;
-+ pEpDist->pPrev = NULL;
-+ return;
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error Interrupt\n"));
++ error_int_status = pDev->IrqProcRegisters.error_int_status & 0x0F;
++ AR_DEBUG_ASSERT(error_int_status);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ ("Valid interrupt source(s) in ERROR_INT_STATUS: 0x%x\n",
++ error_int_status));
++
++ if (ERROR_INT_STATUS_WAKEUP_GET(error_int_status)) {
++ /* Wakeup */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Error : Wakeup\n"));
+ }
+
-+ /* queue to the end of the list, this does not have to be very
-+ * fast since this list is built at startup time */
-+ pCurEntry = target->EpCreditDistributionListHead;
++ if (ERROR_INT_STATUS_RX_UNDERFLOW_GET(error_int_status)) {
++ /* Rx Underflow */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Rx Underflow\n"));
++ }
+
-+ while (pCurEntry) {
-+ pLastEntry = pCurEntry;
-+ pCurEntry = pCurEntry->pNext;
++ if (ERROR_INT_STATUS_TX_OVERFLOW_GET(error_int_status)) {
++ /* Tx Overflow */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Error : Tx Overflow\n"));
+ }
+
-+ pLastEntry->pNext = pEpDist;
-+ pEpDist->pPrev = pLastEntry;
-+ pEpDist->pNext = NULL;
-+}
++ /* Clear the interrupt */
++ pDev->IrqProcRegisters.error_int_status &= ~error_int_status; /* W1C */
+
++ /* set up the register transfer buffer to hit the register 4 times , this is done
++ * to make the access 4-byte aligned to mitigate issues with host bus interconnects that
++ * restrict bus transfer lengths to be a multiple of 4-bytes */
+
++ /* set W1C value to clear the interrupt, this hits the register first */
++ regBuffer[0] = error_int_status;
++ /* the remaining 4 values are set to zero which have no-effect */
++ regBuffer[1] = 0;
++ regBuffer[2] = 0;
++ regBuffer[3] = 0;
+
-+/* default credit init callback */
-+static void HTCDefaultCreditInit(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+ int TotalCredits)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+ int totalEps = 0;
-+ int creditsPerEndpoint;
++ status = HIFReadWrite(pDev->HIFDevice,
++ ERROR_INT_STATUS_ADDRESS,
++ regBuffer,
++ 4,
++ HIF_WR_SYNC_BYTE_FIX,
++ NULL);
+
-+ pCurEpDist = pEPList;
-+ /* first run through the list and figure out how many endpoints we are dealing with */
-+ while (pCurEpDist != NULL) {
-+ pCurEpDist = pCurEpDist->pNext;
-+ totalEps++;
-+ }
++ AR_DEBUG_ASSERT(status == A_OK);
++ return status;
++}
+
-+ /* even distribution */
-+ creditsPerEndpoint = TotalCredits/totalEps;
++static A_STATUS DevServiceDebugInterrupt(AR6K_DEVICE *pDev)
++{
++ A_UINT32 dummy;
++ A_STATUS status;
+
-+ pCurEpDist = pEPList;
-+ /* run through the list and set minimum and normal credits and
-+ * provide the endpoint with some credits to start */
-+ while (pCurEpDist != NULL) {
++ /* Send a target failure event to the application */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Target debug interrupt\n"));
+
-+ if (creditsPerEndpoint < pCurEpDist->TxCreditsPerMaxMsg) {
-+ /* too many endpoints and not enough credits */
-+ AR_DEBUG_ASSERT(FALSE);
-+ break;
-+ }
-+ /* our minimum is set for at least 1 max message */
-+ pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
-+ /* this value is ignored by our credit alg, since we do
-+ * not dynamically adjust credits, this is the policy of
-+ * the "default" credit distribution, something simple and easy */
-+ pCurEpDist->TxCreditsNorm = 0xFFFF;
-+ /* give the endpoint minimum credits */
-+ pCurEpDist->TxCredits = creditsPerEndpoint;
-+ pCurEpDist->TxCreditsAssigned = creditsPerEndpoint;
-+ pCurEpDist = pCurEpDist->pNext;
++ if (pDev->TargetFailureCallback != NULL) {
++ pDev->TargetFailureCallback(pDev->HTCContext);
+ }
+
++ /* clear the interrupt , the debug error interrupt is
++ * counter 0 */
++ /* read counter to clear interrupt */
++ status = HIFReadWrite(pDev->HIFDevice,
++ COUNT_DEC_ADDRESS,
++ (A_UINT8 *)&dummy,
++ 4,
++ HIF_RD_SYNC_BYTE_INC,
++ NULL);
++
++ AR_DEBUG_ASSERT(status == A_OK);
++ return status;
+}
+
-+/* default credit distribution callback, NOTE, this callback holds the TX lock */
-+void HTCDefaultCreditDist(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
-+ HTC_CREDIT_DIST_REASON Reason)
++static A_STATUS DevServiceCounterInterrupt(AR6K_DEVICE *pDev)
+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
++ A_UINT8 counter_int_status;
+
-+ if (Reason == HTC_CREDIT_DIST_SEND_COMPLETE) {
-+ pCurEpDist = pEPDistList;
-+ /* simple distribution */
-+ while (pCurEpDist != NULL) {
-+ if (pCurEpDist->TxCreditsToDist > 0) {
-+ /* just give the endpoint back the credits */
-+ pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
-+ pCurEpDist->TxCreditsToDist = 0;
-+ }
-+ pCurEpDist = pCurEpDist->pNext;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ, ("Counter Interrupt\n"));
++
++ counter_int_status = pDev->IrqProcRegisters.counter_int_status &
++ pDev->IrqEnableRegisters.counter_int_status_enable;
++
++ AR_DEBUG_ASSERT(counter_int_status);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ ("Valid interrupt source(s) in COUNTER_INT_STATUS: 0x%x\n",
++ counter_int_status));
++
++ /* Check if the debug interrupt is pending */
++ if (counter_int_status & AR6K_TARGET_DEBUG_INTR_MASK) {
++ return DevServiceDebugInterrupt(pDev);
+ }
+
-+ /* note we do not need to handle the other reason codes as this is a very
-+ * simple distribution scheme, no need to seek for more credits or handle inactivity */
++ return A_OK;
+}
+
-+void HTCSetCreditDistribution(HTC_HANDLE HTCHandle,
-+ void *pCreditDistContext,
-+ HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
-+ HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
-+ HTC_SERVICE_ID ServicePriorityOrder[],
-+ int ListLength)
++/* callback when our fetch to get interrupt status registers completes */
++static void DevGetEventAsyncHandler(void *Context, HTC_PACKET *pPacket)
+{
-+ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
-+ int i;
-+ int ep;
++ AR6K_DEVICE *pDev = (AR6K_DEVICE *)Context;
++ A_UINT32 lookAhead = 0;
++ A_BOOL otherInts = FALSE;
+
-+ if (CreditInitFunc != NULL) {
-+ /* caller has supplied their own distribution functions */
-+ target->InitCredits = CreditInitFunc;
-+ AR_DEBUG_ASSERT(CreditDistFunc != NULL);
-+ target->DistributeCredits = CreditDistFunc;
-+ target->pCredDistContext = pCreditDistContext;
-+ } else {
-+ /* caller wants HTC to do distribution */
-+ /* if caller wants service to handle distributions then
-+ * it must set both of these to NULL! */
-+ AR_DEBUG_ASSERT(CreditDistFunc == NULL);
-+ target->InitCredits = HTCDefaultCreditInit;
-+ target->DistributeCredits = HTCDefaultCreditDist;
-+ target->pCredDistContext = target;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevGetEventAsyncHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
+
-+ /* always add HTC control endpoint first, we only expose the list after the
-+ * first one, this is added for TX queue checking */
-+ AddToEndpointDistList(target, &target->EndPoint[ENDPOINT_0].CreditDist);
++ do {
+
-+ /* build the list of credit distribution structures in priority order
-+ * supplied by the caller, these will follow endpoint 0 */
-+ for (i = 0; i < ListLength; i++) {
-+ /* match services with endpoints and add the endpoints to the distribution list
-+ * in FIFO order */
-+ for (ep = ENDPOINT_1; ep < ENDPOINT_MAX; ep++) {
-+ if (target->EndPoint[ep].ServiceID == ServicePriorityOrder[i]) {
-+ /* queue this one to the list */
-+ AddToEndpointDistList(target, &target->EndPoint[ep].CreditDist);
-+ break;
-+ }
++ if (A_FAILED(pPacket->Status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" GetEvents I/O request failed, status:%d \n", pPacket->Status));
++ /* bail out, don't unmask HIF interrupt */
++ break;
+ }
-+ AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
-+ }
+
-+}
-diff --git a/drivers/ar6000/include/AR6001_regdump.h b/drivers/ar6000/include/AR6001_regdump.h
-new file mode 100644
-index 0000000..c1bcade
---- /dev/null
-+++ b/drivers/ar6000/include/AR6001_regdump.h
-@@ -0,0 +1,100 @@
-+/*
-+ * Copyright (c) 2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
++ if (pDev->GetPendingEventsFunc != NULL) {
++ /* the HIF layer collected the information for us */
++ HIF_PENDING_EVENTS_INFO *pEvents = (HIF_PENDING_EVENTS_INFO *)pPacket->pBuffer;
++ if (pEvents->Events & HIF_RECV_MSG_AVAIL) {
++ lookAhead = pEvents->LookAhead;
++ if (0 == lookAhead) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler1, lookAhead is zero! \n"));
++ }
++ }
++ if (pEvents->Events & HIF_OTHER_EVENTS) {
++ otherInts = TRUE;
++ }
++ } else {
++ /* standard interrupt table handling.... */
++ AR6K_IRQ_PROC_REGISTERS *pReg = (AR6K_IRQ_PROC_REGISTERS *)pPacket->pBuffer;
++ A_UINT8 host_int_status;
+
-+#ifndef __AR6000_REGDUMP_H__
-+#define __AR6000_REGDUMP_H__
++ host_int_status = pReg->host_int_status & pDev->IrqEnableRegisters.int_status_enable;
+
-+#if !defined(__ASSEMBLER__)
-+/*
-+ * Target CPU state at the time of failure is reflected
-+ * in a register dump, which the Host can fetch through
-+ * the diagnostic window.
-+ */
++ if (host_int_status & (1 << HTC_MAILBOX)) {
++ host_int_status &= ~(1 << HTC_MAILBOX);
++ if (pReg->rx_lookahead_valid & (1 << HTC_MAILBOX)) {
++ /* mailbox has a message and the look ahead is valid */
++ lookAhead = pReg->rx_lookahead[HTC_MAILBOX];
++ if (0 == lookAhead) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" DevGetEventAsyncHandler2, lookAhead is zero! \n"));
++ }
++ }
++ }
+
-+struct MIPS_exception_frame_s {
-+ A_UINT32 pc; /* Program Counter */
-+ A_UINT32 at; /* MIPS General Purpose registers */
-+ A_UINT32 v0;
-+ A_UINT32 v1;
-+ A_UINT32 a0;
-+ A_UINT32 a1;
-+ A_UINT32 a2;
-+ A_UINT32 a3;
-+ A_UINT32 t0;
-+ A_UINT32 t1;
-+ A_UINT32 t2;
-+ A_UINT32 t3;
-+ A_UINT32 t4;
-+ A_UINT32 t5;
-+ A_UINT32 t6;
-+ A_UINT32 t7;
-+ A_UINT32 s0;
-+ A_UINT32 s1;
-+ A_UINT32 s2;
-+ A_UINT32 s3;
-+ A_UINT32 s4;
-+ A_UINT32 s5;
-+ A_UINT32 s6;
-+ A_UINT32 s7;
-+ A_UINT32 t8;
-+ A_UINT32 t9;
-+ A_UINT32 k0;
-+ A_UINT32 k1;
-+ A_UINT32 gp;
-+ A_UINT32 sp;
-+ A_UINT32 s8;
-+ A_UINT32 ra;
-+ A_UINT32 cause; /* Selected coprocessor regs */
-+ A_UINT32 status;
-+};
-+typedef struct MIPS_exception_frame_s CPU_exception_frame_t;
++ if (host_int_status) {
++ /* there are other interrupts to handle */
++ otherInts = TRUE;
++ }
++ }
+
-+#endif
++ if (otherInts || (lookAhead == 0)) {
++ /* if there are other interrupts to process, we cannot do this in the async handler so
++ * ack the interrupt which will cause our sync handler to run again
++ * if however there are no more messages, we can now ack the interrupt */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ (" Acking interrupt from DevGetEventAsyncHandler (otherints:%d, lookahead:0x%X)\n",
++ otherInts, lookAhead));
++ HIFAckInterrupt(pDev->HIFDevice);
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ (" DevGetEventAsyncHandler : detected another message, lookahead :0x%X \n",
++ lookAhead));
++ /* lookahead is non-zero and there are no other interrupts to service,
++ * go get the next message */
++ pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, NULL);
++ }
+
-+/*
-+ * Offsets into MIPS_exception_frame structure, for use in assembler code
-+ * MUST MATCH C STRUCTURE ABOVE
-+ */
-+#define RD_pc 0
-+#define RD_at 1
-+#define RD_v0 2
-+#define RD_v1 3
-+#define RD_a0 4
-+#define RD_a1 5
-+#define RD_a2 6
-+#define RD_a3 7
-+#define RD_t0 8
-+#define RD_t1 9
-+#define RD_t2 10
-+#define RD_t3 11
-+#define RD_t4 12
-+#define RD_t5 13
-+#define RD_t6 14
-+#define RD_t7 15
-+#define RD_s0 16
-+#define RD_s1 17
-+#define RD_s2 18
-+#define RD_s3 19
-+#define RD_s4 20
-+#define RD_s5 21
-+#define RD_s6 22
-+#define RD_s7 23
-+#define RD_t8 24
-+#define RD_t9 25
-+#define RD_k0 26
-+#define RD_k1 27
-+#define RD_gp 28
-+#define RD_sp 29
-+#define RD_s8 30
-+#define RD_ra 31
-+#define RD_cause 32
-+#define RD_status 33
++ } while (FALSE);
+
-+#define RD_SIZE (34*4) /* Space for this number of words */
++ /* free this IO packet */
++ AR6KFreeIOPacket(pDev,pPacket);
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevGetEventAsyncHandler \n"));
++}
+
-+#endif /* __AR6000_REGDUMP_H__ */
-diff --git a/drivers/ar6000/include/AR6K_version.h b/drivers/ar6000/include/AR6K_version.h
-new file mode 100644
-index 0000000..d5b2a20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6K_version.h
-@@ -0,0 +1,36 @@
-+#define __VER_MAJOR_ 2
-+#define __VER_MINOR_ 0
-+#define __VER_PATCH_ 0
++/* called by the HTC layer when it wants us to check if the device has any more pending
++ * recv messages, this starts off a series of async requests to read interrupt registers */
++A_STATUS DevCheckPendingRecvMsgsAsync(void *context)
++{
++ AR6K_DEVICE *pDev = (AR6K_DEVICE *)context;
++ A_STATUS status = A_OK;
++ HTC_PACKET *pIOPacket;
+
++ /* this is called in an ASYNC only context, we may NOT block, sleep or call any apis that can
++ * cause us to switch contexts */
+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * The makear6ksdk script (used for release builds) modifies the following line.
-+ */
-+#define __BUILD_NUMBER_ 18
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevCheckPendingRecvMsgsAsync: (dev: 0x%X)\n", (A_UINT32)pDev));
+
++ do {
+
-+/* Format of the version number. */
-+#define VER_MAJOR_BIT_OFFSET 28
-+#define VER_MINOR_BIT_OFFSET 24
-+#define VER_PATCH_BIT_OFFSET 16
-+#define VER_BUILD_NUM_BIT_OFFSET 0
++ if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
++ /* break the async processing chain right here, no need to continue.
++ * The DevDsrHandler() will handle things in a loop when things are driven
++ * synchronously */
++ break;
++ }
++ /* first allocate one of our HTC packets we created for async I/O
++ * we reuse HTC packet definitions so that we can use the completion mechanism
++ * in DevRWCompletionHandler() */
++ pIOPacket = AR6KAllocIOPacket(pDev);
+
++ if (NULL == pIOPacket) {
++ /* there should be only 1 asynchronous request out at a time to read these registers
++ * so this should actually never happen */
++ status = A_NO_MEMORY;
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+/*
-+ * The version has the following format:
-+ * Bits 28-31: Major version
-+ * Bits 24-27: Minor version
-+ * Bits 16-23: Patch version
-+ * Bits 0-15: Build number (automatically generated during build process )
-+ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
-+ *
-+ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
-+ */
-+#define AR6K_SW_VERSION ( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
++ /* stick in our completion routine when the I/O operation completes */
++ pIOPacket->Completion = DevGetEventAsyncHandler;
++ pIOPacket->pContext = pDev;
+
++ if (pDev->GetPendingEventsFunc) {
++ /* HIF layer has it's own mechanism, pass the IO to it.. */
++ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
++ (HIF_PENDING_EVENTS_INFO *)pIOPacket->pBuffer,
++ pIOPacket);
+
-diff --git a/drivers/ar6000/include/AR6K_version.h.NEW b/drivers/ar6000/include/AR6K_version.h.NEW
-new file mode 100644
-index 0000000..d5b2a20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6K_version.h.NEW
-@@ -0,0 +1,36 @@
-+#define __VER_MAJOR_ 2
-+#define __VER_MINOR_ 0
-+#define __VER_PATCH_ 0
++ } else {
++ /* standard way, read the interrupt register table asynchronously again */
++ status = HIFReadWrite(pDev->HIFDevice,
++ HOST_INT_STATUS_ADDRESS,
++ pIOPacket->pBuffer,
++ AR6K_IRQ_PROC_REGS_SIZE,
++ HIF_RD_ASYNC_BYTE_INC,
++ pIOPacket);
++ }
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Async IO issued to get interrupt status...\n"));
++ } while (FALSE);
+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * The makear6ksdk script (used for release builds) modifies the following line.
-+ */
-+#define __BUILD_NUMBER_ 18
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevCheckPendingRecvMsgsAsync \n"));
+
++ return status;
++}
+
-+/* Format of the version number. */
-+#define VER_MAJOR_BIT_OFFSET 28
-+#define VER_MINOR_BIT_OFFSET 24
-+#define VER_PATCH_BIT_OFFSET 16
-+#define VER_BUILD_NUM_BIT_OFFSET 0
++/* process pending interrupts synchronously */
++static A_STATUS ProcessPendingIRQs(AR6K_DEVICE *pDev, A_BOOL *pDone, A_BOOL *pASyncProcessing)
++{
++ A_STATUS status = A_OK;
++ A_UINT8 host_int_status = 0;
++ A_UINT32 lookAhead = 0;
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+ProcessPendingIRQs: (dev: 0x%X)\n", (A_UINT32)pDev));
+
-+/*
-+ * The version has the following format:
-+ * Bits 28-31: Major version
-+ * Bits 24-27: Minor version
-+ * Bits 16-23: Patch version
-+ * Bits 0-15: Build number (automatically generated during build process )
-+ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
-+ *
-+ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
-+ */
-+#define AR6K_SW_VERSION ( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
++ /*** NOTE: the HIF implementation guarantees that the context of this call allows
++ * us to perform SYNCHRONOUS I/O, that is we can block, sleep or call any API that
++ * can block or switch thread/task ontexts.
++ * This is a fully schedulable context.
++ * */
++ do {
+
++ if (pDev->GetPendingEventsFunc != NULL) {
++ HIF_PENDING_EVENTS_INFO events;
+
-diff --git a/drivers/ar6000/include/AR6Khwreg.h b/drivers/ar6000/include/AR6Khwreg.h
-new file mode 100644
-index 0000000..ecfdf20
---- /dev/null
-+++ b/drivers/ar6000/include/AR6Khwreg.h
-@@ -0,0 +1,147 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions for AR6001 registers
-+ * that may be directly manipulated by Host software.
-+ */
++ /* the HIF layer uses a special mechanism to get events
++ * get this synchronously */
++ status = pDev->GetPendingEventsFunc(pDev->HIFDevice,
++ &events,
++ NULL);
+
-+#ifndef __AR6KHWREG_H__
-+#define __AR6KHWREG_H__
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++ if (events.Events & HIF_RECV_MSG_AVAIL) {
++ lookAhead = events.LookAhead;
++ if (0 == lookAhead) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs1 lookAhead is zero! \n"));
++ }
++ }
+
-+/* Host registers */
-+#define HOST_INT_STATUS_ADDRESS 0x00000400
-+#define CPU_INT_STATUS_ADDRESS 0x00000401
-+#define ERROR_INT_STATUS_ADDRESS 0x00000402
-+#define INT_STATUS_ENABLE_ADDRESS 0x00000418
-+#define CPU_INT_STATUS_ENABLE_ADDRESS 0x00000419
-+#define COUNT_ADDRESS 0x00000420
-+#define COUNT_DEC_ADDRESS 0x00000440
-+#define WINDOW_DATA_ADDRESS 0x00000474
-+#define WINDOW_WRITE_ADDR_ADDRESS 0x00000478
-+#define WINDOW_READ_ADDR_ADDRESS 0x0000047c
++ if (!(events.Events & HIF_OTHER_EVENTS) ||
++ !(pDev->IrqEnableRegisters.int_status_enable & OTHER_INTS_ENABLED)) {
++ /* no need to read the register table, no other interesting interrupts.
++ * Some interfaces (like SPI) can shadow interrupt sources without
++ * requiring the host to do a full table read */
++ break;
++ }
+
-+/* Target addresses */
-+#define RESET_CONTROL_ADDRESS 0x0c000000
-+#define MC_REMAP_VALID_ADDRESS 0x0c004080
-+#define MC_REMAP_SIZE_ADDRESS 0x0c004100
-+#define MC_REMAP_COMPARE_ADDRESS 0x0c004180
-+#define MC_REMAP_TARGET_ADDRESS 0x0c004200
-+#define LOCAL_COUNT_ADDRESS 0x0c014080
-+#define LOCAL_SCRATCH_ADDRESS 0x0c0140c0
++ /* otherwise fall through and read the register table */
++ }
+
++ /*
++ * Read the first 28 bytes of the HTC register table. This will yield us
++ * the value of different int status registers and the lookahead
++ * registers.
++ * length = sizeof(int_status) + sizeof(cpu_int_status) +
++ * sizeof(error_int_status) + sizeof(counter_int_status) +
++ * sizeof(mbox_frame) + sizeof(rx_lookahead_valid) +
++ * sizeof(hole) + sizeof(rx_lookahead) +
++ * sizeof(int_status_enable) + sizeof(cpu_int_status_enable) +
++ * sizeof(error_status_enable) +
++ * sizeof(counter_int_status_enable);
++ *
++ */
++ status = HIFReadWrite(pDev->HIFDevice,
++ HOST_INT_STATUS_ADDRESS,
++ (A_UINT8 *)&pDev->IrqProcRegisters,
++ AR6K_IRQ_PROC_REGS_SIZE,
++ HIF_RD_SYNC_BYTE_INC,
++ NULL);
+
-+#define INT_STATUS_ENABLE_ERROR_MSB 7
-+#define INT_STATUS_ENABLE_ERROR_LSB 7
-+#define INT_STATUS_ENABLE_ERROR_MASK 0x00000080
-+#define INT_STATUS_ENABLE_ERROR_GET(x) (((x) & INT_STATUS_ENABLE_ERROR_MASK) >> INT_STATUS_ENABLE_ERROR_LSB)
-+#define INT_STATUS_ENABLE_ERROR_SET(x) (((x) << INT_STATUS_ENABLE_ERROR_LSB) & INT_STATUS_ENABLE_ERROR_MASK)
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#define INT_STATUS_ENABLE_CPU_MSB 6
-+#define INT_STATUS_ENABLE_CPU_LSB 6
-+#define INT_STATUS_ENABLE_CPU_MASK 0x00000040
-+#define INT_STATUS_ENABLE_CPU_GET(x) (((x) & INT_STATUS_ENABLE_CPU_MASK) >> INT_STATUS_ENABLE_CPU_LSB)
-+#define INT_STATUS_ENABLE_CPU_SET(x) (((x) << INT_STATUS_ENABLE_CPU_LSB) & INT_STATUS_ENABLE_CPU_MASK)
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_IRQ)) {
++ DevDumpRegisters(&pDev->IrqProcRegisters,
++ &pDev->IrqEnableRegisters);
++ }
+
-+#define INT_STATUS_ENABLE_COUNTER_MSB 4
-+#define INT_STATUS_ENABLE_COUNTER_LSB 4
-+#define INT_STATUS_ENABLE_COUNTER_MASK 0x00000010
-+#define INT_STATUS_ENABLE_COUNTER_GET(x) (((x) & INT_STATUS_ENABLE_COUNTER_MASK) >> INT_STATUS_ENABLE_COUNTER_LSB)
-+#define INT_STATUS_ENABLE_COUNTER_SET(x) (((x) << INT_STATUS_ENABLE_COUNTER_LSB) & INT_STATUS_ENABLE_COUNTER_MASK)
++ /* Update only those registers that are enabled */
++ host_int_status = pDev->IrqProcRegisters.host_int_status &
++ pDev->IrqEnableRegisters.int_status_enable;
+
-+#define INT_STATUS_ENABLE_MBOX_DATA_MSB 3
-+#define INT_STATUS_ENABLE_MBOX_DATA_LSB 0
-+#define INT_STATUS_ENABLE_MBOX_DATA_MASK 0x0000000f
-+#define INT_STATUS_ENABLE_MBOX_DATA_GET(x) (((x) & INT_STATUS_ENABLE_MBOX_DATA_MASK) >> INT_STATUS_ENABLE_MBOX_DATA_LSB)
-+#define INT_STATUS_ENABLE_MBOX_DATA_SET(x) (((x) << INT_STATUS_ENABLE_MBOX_DATA_LSB) & INT_STATUS_ENABLE_MBOX_DATA_MASK)
++ if (NULL == pDev->GetPendingEventsFunc) {
++ /* only look at mailbox status if the HIF layer did not provide this function,
++ * on some HIF interfaces reading the RX lookahead is not valid to do */
++ if (host_int_status & (1 << HTC_MAILBOX)) {
++ /* mask out pending mailbox value, we use "lookAhead" as the real flag for
++ * mailbox processing below */
++ host_int_status &= ~(1 << HTC_MAILBOX);
++ if (pDev->IrqProcRegisters.rx_lookahead_valid & (1 << HTC_MAILBOX)) {
++ /* mailbox has a message and the look ahead is valid */
++ lookAhead = pDev->IrqProcRegisters.rx_lookahead[HTC_MAILBOX];
++ if (0 == lookAhead) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" ProcessPendingIRQs2, lookAhead is zero! \n"));
++ }
++ }
++ }
++ } else {
++ /* not valid to check if the HIF has another mechanism for reading mailbox pending status*/
++ host_int_status &= ~(1 << HTC_MAILBOX);
++ }
+
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MSB 1
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB 1
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK 0x00000002
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK) >> ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB)
-+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
++ } while (FALSE);
+
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MSB 0
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB 0
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK 0x00000001
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK) >> ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB)
-+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
+
++ do {
+
-+#define CPU_INT_STATUS_ENABLE_BIT_MSB 7
-+#define CPU_INT_STATUS_ENABLE_BIT_LSB 0
-+#define CPU_INT_STATUS_ENABLE_BIT_MASK 0x000000ff
-+#define CPU_INT_STATUS_ENABLE_BIT_GET(x) (((x) & CPU_INT_STATUS_ENABLE_BIT_MASK) >> CPU_INT_STATUS_ENABLE_BIT_LSB)
-+#define CPU_INT_STATUS_ENABLE_BIT_SET(x) (((x) << CPU_INT_STATUS_ENABLE_BIT_LSB) & CPU_INT_STATUS_ENABLE_BIT_MASK)
++ /* did the interrupt status fetches succeed? */
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#define COUNTER_INT_STATUS_ENABLE_BIT_MSB 7
-+#define COUNTER_INT_STATUS_ENABLE_BIT_LSB 0
-+#define COUNTER_INT_STATUS_ENABLE_BIT_MASK 0x000000ff
-+#define COUNTER_INT_STATUS_ENABLE_BIT_GET(x) (((x) & COUNTER_INT_STATUS_ENABLE_BIT_MASK) >> COUNTER_INT_STATUS_ENABLE_BIT_LSB)
-+#define COUNTER_INT_STATUS_ENABLE_BIT_SET(x) (((x) << COUNTER_INT_STATUS_ENABLE_BIT_LSB) & COUNTER_INT_STATUS_ENABLE_BIT_MASK)
++ if ((0 == host_int_status) && (0 == lookAhead)) {
++ /* nothing to process, the caller can use this to break out of a loop */
++ *pDone = TRUE;
++ break;
++ }
+
-+#define ERROR_INT_STATUS_WAKEUP_MSB 2
-+#define ERROR_INT_STATUS_WAKEUP_LSB 2
-+#define ERROR_INT_STATUS_WAKEUP_MASK 0x00000004
-+#define ERROR_INT_STATUS_WAKEUP_GET(x) (((x) & ERROR_INT_STATUS_WAKEUP_MASK) >> ERROR_INT_STATUS_WAKEUP_LSB)
-+#define ERROR_INT_STATUS_WAKEUP_SET(x) (((x) << ERROR_INT_STATUS_WAKEUP_LSB) & ERROR_INT_STATUS_WAKEUP_MASK)
++ if (lookAhead != 0) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("Pending mailbox message, LookAhead: 0x%X\n",lookAhead));
++ /* Mailbox Interrupt, the HTC layer may issue async requests to empty the
++ * mailbox...
++ * When emptying the recv mailbox we use the async handler above called from the
++ * completion routine of the callers read request. This can improve performance
++ * by reducing context switching when we rapidly pull packets */
++ status = pDev->MessagePendingCallback(pDev->HTCContext, lookAhead, pASyncProcessing);
++ if (A_FAILED(status)) {
++ break;
++ }
++ }
+
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_MSB 1
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_LSB 1
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_MASK 0x00000002
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_GET(x) (((x) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK) >> ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
-+#define ERROR_INT_STATUS_RX_UNDERFLOW_SET(x) (((x) << ERROR_INT_STATUS_RX_UNDERFLOW_LSB) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK)
++ /* now handle the rest of them */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,
++ (" Valid interrupt source(s) for OTHER interrupts: 0x%x\n",
++ host_int_status));
+
-+#define ERROR_INT_STATUS_TX_OVERFLOW_MSB 0
-+#define ERROR_INT_STATUS_TX_OVERFLOW_LSB 0
-+#define ERROR_INT_STATUS_TX_OVERFLOW_MASK 0x00000001
-+#define ERROR_INT_STATUS_TX_OVERFLOW_GET(x) (((x) & ERROR_INT_STATUS_TX_OVERFLOW_MASK) >> ERROR_INT_STATUS_TX_OVERFLOW_LSB)
-+#define ERROR_INT_STATUS_TX_OVERFLOW_SET(x) (((x) << ERROR_INT_STATUS_TX_OVERFLOW_LSB) & ERROR_INT_STATUS_TX_OVERFLOW_MASK)
++ if (HOST_INT_STATUS_CPU_GET(host_int_status)) {
++ /* CPU Interrupt */
++ status = DevServiceCPUInterrupt(pDev);
++ if (A_FAILED(status)){
++ break;
++ }
++ }
+
-+#define HOST_INT_STATUS_ERROR_MSB 7
-+#define HOST_INT_STATUS_ERROR_LSB 7
-+#define HOST_INT_STATUS_ERROR_MASK 0x00000080
-+#define HOST_INT_STATUS_ERROR_GET(x) (((x) & HOST_INT_STATUS_ERROR_MASK) >> HOST_INT_STATUS_ERROR_LSB)
-+#define HOST_INT_STATUS_ERROR_SET(x) (((x) << HOST_INT_STATUS_ERROR_LSB) & HOST_INT_STATUS_ERROR_MASK)
++ if (HOST_INT_STATUS_ERROR_GET(host_int_status)) {
++ /* Error Interrupt */
++ status = DevServiceErrorInterrupt(pDev);
++ if (A_FAILED(status)){
++ break;
++ }
++ }
+
-+#define HOST_INT_STATUS_CPU_MSB 6
-+#define HOST_INT_STATUS_CPU_LSB 6
-+#define HOST_INT_STATUS_CPU_MASK 0x00000040
-+#define HOST_INT_STATUS_CPU_GET(x) (((x) & HOST_INT_STATUS_CPU_MASK) >> HOST_INT_STATUS_CPU_LSB)
-+#define HOST_INT_STATUS_CPU_SET(x) (((x) << HOST_INT_STATUS_CPU_LSB) & HOST_INT_STATUS_CPU_MASK)
++ if (HOST_INT_STATUS_COUNTER_GET(host_int_status)) {
++ /* Counter Interrupt */
++ status = DevServiceCounterInterrupt(pDev);
++ if (A_FAILED(status)){
++ break;
++ }
++ }
+
-+#define HOST_INT_STATUS_COUNTER_MSB 4
-+#define HOST_INT_STATUS_COUNTER_LSB 4
-+#define HOST_INT_STATUS_COUNTER_MASK 0x00000010
-+#define HOST_INT_STATUS_COUNTER_GET(x) (((x) & HOST_INT_STATUS_COUNTER_MASK) >> HOST_INT_STATUS_COUNTER_LSB)
-+#define HOST_INT_STATUS_COUNTER_SET(x) (((x) << HOST_INT_STATUS_COUNTER_LSB) & HOST_INT_STATUS_COUNTER_MASK)
++ } while (FALSE);
+
-+#define RESET_CONTROL_WARM_RST_MSB 7
-+#define RESET_CONTROL_WARM_RST_LSB 7
-+#define RESET_CONTROL_WARM_RST_MASK 0x00000080
-+#define RESET_CONTROL_WARM_RST_GET(x) (((x) & RESET_CONTROL_WARM_RST_MASK) >> RESET_CONTROL_WARM_RST_LSB)
-+#define RESET_CONTROL_WARM_RST_SET(x) (((x) << RESET_CONTROL_WARM_RST_LSB) & RESET_CONTROL_WARM_RST_MASK)
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-ProcessPendingIRQs: (done:%d, async:%d) status=%d \n",
++ *pDone, *pASyncProcessing, status));
+
-+#define RESET_CONTROL_COLD_RST_MSB 8
-+#define RESET_CONTROL_COLD_RST_LSB 8
-+#define RESET_CONTROL_COLD_RST_MASK 0x00000100
-+#define RESET_CONTROL_COLD_RST_GET(x) (((x) & RESET_CONTROL_COLD_RST_MASK) >> RESET_CONTROL_COLD_RST_LSB)
-+#define RESET_CONTROL_COLD_RST_SET(x) (((x) << RESET_CONTROL_COLD_RST_LSB) & RESET_CONTROL_COLD_RST_MASK)
++ return status;
++}
+
-+#define RESET_CAUSE_LAST_MSB 2
-+#define RESET_CAUSE_LAST_LSB 0
-+#define RESET_CAUSE_LAST_MASK 0x00000007
-+#define RESET_CAUSE_LAST_GET(x) (((x) & RESET_CAUSE_LAST_MASK) >> RESET_CAUSE_LAST_LSB)
-+#define RESET_CAUSE_LAST_SET(x) (((x) << RESET_CAUSE_LAST_LSB) & RESET_CAUSE_LAST_MASK)
+
-+#ifdef __cplusplus
-+}
-+#endif
++/* Synchronousinterrupt handler, this handler kicks off all interrupt processing.*/
++A_STATUS DevDsrHandler(void *context)
++{
++ AR6K_DEVICE *pDev = (AR6K_DEVICE *)context;
++ A_STATUS status = A_OK;
++ A_BOOL done = FALSE;
++ A_BOOL asyncProc = FALSE;
+
-+#endif /* __AR6KHWREG_H__ */
-diff --git a/drivers/ar6000/include/a_config.h b/drivers/ar6000/include/a_config.h
-new file mode 100644
-index 0000000..627b298
---- /dev/null
-+++ b/drivers/ar6000/include/a_config.h
-@@ -0,0 +1,27 @@
-+#ifndef _A_CONFIG_H_
-+#define _A_CONFIG_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("+DevDsrHandler: (dev: 0x%X)\n", (A_UINT32)pDev));
+
-+/*
-+ * This file contains software configuration options that enables
-+ * specific software "features"
-+ */
-+#include "../ar6000/config_linux.h"
+
-+#endif
-diff --git a/drivers/ar6000/include/a_debug.h b/drivers/ar6000/include/a_debug.h
-new file mode 100644
-index 0000000..4b0b351
---- /dev/null
-+++ b/drivers/ar6000/include/a_debug.h
-@@ -0,0 +1,41 @@
-+#ifndef _A_DEBUG_H_
-+#define _A_DEBUG_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ while (!done) {
++ status = ProcessPendingIRQs(pDev, &done, &asyncProc);
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#include <a_types.h>
-+#include <a_osapi.h>
++ if (HIF_DEVICE_IRQ_SYNC_ONLY == pDev->HifIRQProcessingMode) {
++ /* the HIF layer does not allow async IRQ processing, override the asyncProc flag */
++ asyncProc = FALSE;
++ /* this will cause us to re-enter ProcessPendingIRQ() and re-read interrupt status registers.
++ * this has a nice side effect of blocking us until all async read requests are completed.
++ * This behavior is required on some HIF implementations that do not allow ASYNC
++ * processing in interrupt handlers (like Windows CE) */
++ }
+
-+#define DBG_INFO 0x00000001
-+#define DBG_ERROR 0x00000002
-+#define DBG_WARNING 0x00000004
-+#define DBG_SDIO 0x00000008
-+#define DBG_HIF 0x00000010
-+#define DBG_HTC 0x00000020
-+#define DBG_WMI 0x00000040
-+#define DBG_WMI2 0x00000080
-+#define DBG_DRIVER 0x00000100
++ if (asyncProc) {
++ /* the function performed some async I/O for performance, we
++ need to exit the ISR immediately, the check below will prevent the interrupt from being
++ Ack'd while we handle it asynchronously */
++ break;
++ }
+
-+#define DBG_DEFAULTS (DBG_ERROR|DBG_WARNING)
++ }
+
-+#include "../ar6000/debug_linux.h"
++ if (A_SUCCESS(status) && !asyncProc) {
++ /* Ack the interrupt only if :
++ * 1. we did not get any errors in processing interrupts
++ * 2. there are no outstanding async processing requests */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,(" Acking interrupt from DevDsrHandler \n"));
++ HIFAckInterrupt(pDev->HIFDevice);
++ }
+
-+#endif
-diff --git a/drivers/ar6000/include/a_drv.h b/drivers/ar6000/include/a_drv.h
-new file mode 100644
-index 0000000..07e52d1
---- /dev/null
-+++ b/drivers/ar6000/include/a_drv.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_DRV_H_
-+#define _A_DRV_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_drv.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_IRQ,("-DevDsrHandler \n"));
++ return A_OK;
++}
+
-+#include "../ar6000/athdrv_linux.h"
+
-+#endif /* _ADRV_H_ */
-diff --git a/drivers/ar6000/include/a_drv_api.h b/drivers/ar6000/include/a_drv_api.h
+diff --git a/drivers/ar6000/htc/htc.c b/drivers/ar6000/htc/htc.c
new file mode 100644
-index 0000000..7531726
+index 0000000..d52ed94
--- /dev/null
-+++ b/drivers/ar6000/include/a_drv_api.h
-@@ -0,0 +1,185 @@
-+#ifndef _A_DRV_API_H_
-+#define _A_DRV_API_H_
++++ b/drivers/ar6000/htc/htc.c
+@@ -0,0 +1,508 @@
+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ */
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+/****************************************************************************/
-+/****************************************************************************/
-+/** **/
-+/** WMI related hooks **/
-+/** **/
-+/****************************************************************************/
-+/****************************************************************************/
++#include "htc_internal.h"
+
-+#include <ar6000_api.h>
+
-+#define A_WMI_CHANNELLIST_RX(devt, numChan, chanList) \
-+ ar6000_channelList_rx((devt), (numChan), (chanList))
++static HTC_INIT_INFO HTCInitInfo = {NULL,NULL,NULL};
++static A_BOOL HTCInitialized = FALSE;
+
-+#define A_WMI_SET_NUMDATAENDPTS(devt, num) \
-+ ar6000_set_numdataendpts((devt), (num))
++static A_STATUS HTCTargetInsertedHandler(void *hif_handle);
++static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status);
++static void HTCReportFailure(void *Context);
+
-+#define A_WMI_CONTROL_TX(devt, osbuf, streamID) \
-+ ar6000_control_tx((devt), (osbuf), (streamID))
++/* Initializes the HTC layer */
++A_STATUS HTCInit(HTC_INIT_INFO *pInitInfo)
++{
++ HTC_CALLBACKS htcCallbacks;
+
-+#define A_WMI_TARGETSTATS_EVENT(devt, pStats) \
-+ ar6000_targetStats_event((devt), (pStats))
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Enter\n"));
++ if (HTCInitialized) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
++ return A_OK;
++ }
+
-+#define A_WMI_SCANCOMPLETE_EVENT(devt, status) \
-+ ar6000_scanComplete_event((devt), (status))
++ A_MEMCPY(&HTCInitInfo,pInitInfo,sizeof(HTC_INIT_INFO));
+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
++ A_MEMZERO(&htcCallbacks, sizeof(HTC_CALLBACKS));
+
-+#define A_WMI_DSET_DATA_REQ(devt, access_cookie, offset, length, targ_buf, targ_reply_fn, targ_reply_arg) \
-+ ar6000_dset_data_req((devt), (access_cookie), (offset), (length), (targ_buf), (targ_reply_fn), (targ_reply_arg))
++ /* setup HIF layer callbacks */
++ htcCallbacks.deviceInsertedHandler = HTCTargetInsertedHandler;
++ htcCallbacks.deviceRemovedHandler = HTCTargetRemovedHandler;
++ /* the device layer handles these */
++ htcCallbacks.rwCompletionHandler = DevRWCompletionHandler;
++ htcCallbacks.dsrHandler = DevDsrHandler;
++ HIFInit(&htcCallbacks);
++ HTCInitialized = TRUE;
+
-+#define A_WMI_DSET_CLOSE(devt, access_cookie) \
-+ ar6000_dset_close((devt), (access_cookie))
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCInit: Exit\n"));
++ return A_OK;
++}
+
-+#endif
++void HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList)
++{
++ LOCK_HTC(target);
++ HTC_PACKET_ENQUEUE(pList,pPacket);
++ UNLOCK_HTC(target);
++}
+
-+#define A_WMI_DSET_OPEN_REQ(devt, id, targ_handle, targ_reply_fn, targ_reply_arg) \
-+ ar6000_dset_open_req((devt), (id), (targ_handle), (targ_reply_fn), (targ_reply_arg))
++HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target, HTC_PACKET_QUEUE *pList)
++{
++ HTC_PACKET *pPacket;
+
-+#define A_WMI_CONNECT_EVENT(devt, channel, bssid, listenInterval, beaconInterval, networkType, beaconIeLen, assocReqLen, assocRespLen, assocInfo) \
-+ ar6000_connect_event((devt), (channel), (bssid), (listenInterval), (beaconInterval), (networkType), (beaconIeLen), (assocReqLen), (assocRespLen), (assocInfo))
++ LOCK_HTC(target);
++ pPacket = HTC_PACKET_DEQUEUE(pList);
++ UNLOCK_HTC(target);
+
-+#define A_WMI_REGDOMAIN_EVENT(devt, regCode) \
-+ ar6000_regDomain_event((devt), (regCode))
++ return pPacket;
++}
+
-+#define A_WMI_NEIGHBORREPORT_EVENT(devt, numAps, info) \
-+ ar6000_neighborReport_event((devt), (numAps), (info))
++/* cleanup the HTC instance */
++static void HTCCleanup(HTC_TARGET *target)
++{
++ if (A_IS_MUTEX_VALID(&target->HTCLock)) {
++ A_MUTEX_DELETE(&target->HTCLock);
++ }
+
-+#define A_WMI_DISCONNECT_EVENT(devt, reason, bssid, assocRespLen, assocInfo, protocolReasonStatus) \
-+ ar6000_disconnect_event((devt), (reason), (bssid), (assocRespLen), (assocInfo), (protocolReasonStatus))
++ if (A_IS_MUTEX_VALID(&target->HTCRxLock)) {
++ A_MUTEX_DELETE(&target->HTCRxLock);
++ }
+
-+#define A_WMI_TKIP_MICERR_EVENT(devt, keyid, ismcast) \
-+ ar6000_tkip_micerr_event((devt), (keyid), (ismcast))
++ if (A_IS_MUTEX_VALID(&target->HTCTxLock)) {
++ A_MUTEX_DELETE(&target->HTCTxLock);
++ }
++ /* free our instance */
++ A_FREE(target);
++}
+
-+#define A_WMI_BITRATE_RX(devt, rateKbps) \
-+ ar6000_bitrate_rx((devt), (rateKbps))
++/* registered target arrival callback from the HIF layer */
++static A_STATUS HTCTargetInsertedHandler(void *hif_handle)
++{
++ HTC_TARGET *target = NULL;
++ A_STATUS status;
++ int i;
+
-+#define A_WMI_TXPWR_RX(devt, txPwr) \
-+ ar6000_txPwr_rx((devt), (txPwr))
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Enter\n"));
+
-+#define A_WMI_READY_EVENT(devt, datap, phyCap) \
-+ ar6000_ready_event((devt), (datap), (phyCap))
++ do {
+
-+#define A_WMI_DBGLOG_INIT_DONE(ar) \
-+ ar6000_dbglog_init_done(ar);
++ /* allocate target memory */
++ if ((target = (HTC_TARGET *)A_MALLOC(sizeof(HTC_TARGET))) == NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unable to allocate memory\n"));
++ status = A_ERROR;
++ break;
++ }
+
-+#define A_WMI_RSSI_THRESHOLD_EVENT(devt, newThreshold, rssi) \
-+ ar6000_rssiThreshold_event((devt), (newThreshold), (rssi))
++ A_MEMZERO(target, sizeof(HTC_TARGET));
++ A_MUTEX_INIT(&target->HTCLock);
++ A_MUTEX_INIT(&target->HTCRxLock);
++ A_MUTEX_INIT(&target->HTCTxLock);
++ INIT_HTC_PACKET_QUEUE(&target->ControlBufferTXFreeList);
++ INIT_HTC_PACKET_QUEUE(&target->ControlBufferRXFreeList);
+
-+#define A_WMI_REPORT_ERROR_EVENT(devt, errorVal) \
-+ ar6000_reportError_event((devt), (errorVal))
++ /* give device layer the hif device handle */
++ target->Device.HIFDevice = hif_handle;
++ /* give the device layer our context (for event processing)
++ * the device layer will register it's own context with HIF
++ * so we need to set this so we can fetch it in the target remove handler */
++ target->Device.HTCContext = target;
++ /* set device layer target failure callback */
++ target->Device.TargetFailureCallback = HTCReportFailure;
++ /* set device layer recv message pending callback */
++ target->Device.MessagePendingCallback = HTCRecvMessagePendingHandler;
++ target->EpWaitingForBuffers = ENDPOINT_MAX;
+
-+#define A_WMI_ROAM_TABLE_EVENT(devt, pTbl) \
-+ ar6000_roam_tbl_event((devt), (pTbl))
++ /* setup device layer */
++ status = DevSetup(&target->Device);
+
-+#define A_WMI_ROAM_DATA_EVENT(devt, p) \
-+ ar6000_roam_data_event((devt), (p))
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#define A_WMI_WOW_LIST_EVENT(devt, num_filters, wow_filters) \
-+ ar6000_wow_list_event((devt), (num_filters), (wow_filters))
++ /* carve up buffers/packets for control messages */
++ for (i = 0; i < NUM_CONTROL_RX_BUFFERS; i++) {
++ HTC_PACKET *pControlPacket;
++ pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
++ SET_HTC_PACKET_INFO_RX_REFILL(pControlPacket,
++ target,
++ target->HTCControlBuffers[i].Buffer,
++ HTC_CONTROL_BUFFER_SIZE,
++ ENDPOINT_0);
++ HTC_FREE_CONTROL_RX(target,pControlPacket);
++ }
+
-+#define A_WMI_CAC_EVENT(devt, ac, cac_indication, statusCode, tspecSuggestion) \
-+ ar6000_cac_event((devt), (ac), (cac_indication), (statusCode), (tspecSuggestion))
++ for (;i < NUM_CONTROL_BUFFERS;i++) {
++ HTC_PACKET *pControlPacket;
++ pControlPacket = &target->HTCControlBuffers[i].HtcPacket;
++ INIT_HTC_PACKET_INFO(pControlPacket,
++ target->HTCControlBuffers[i].Buffer,
++ HTC_CONTROL_BUFFER_SIZE);
++ HTC_FREE_CONTROL_TX(target,pControlPacket);
++ }
+
-+#define A_WMI_IPTOS_TO_USERPRIORITY(pkt) \
-+ ar6000_iptos_to_userPriority((pkt))
++ } while (FALSE);
+
-+#define A_WMI_PMKID_LIST_EVENT(devt, num_pmkid, pmkid_list) \
-+ ar6000_pmkid_list_event((devt), (num_pmkid), (pmkid_list))
++ if (A_SUCCESS(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" calling AddInstance callback \n"));
++ /* announce ourselves */
++ HTCInitInfo.AddInstance((HTC_HANDLE)target);
++ } else {
++ if (target != NULL) {
++ HTCCleanup(target);
++ }
++ }
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("htcTargetInserted - Exit\n"));
+
-+#define A_WMI_GPIO_INTR_RX(intr_mask, input_values) \
-+ ar6000_gpio_intr_rx((intr_mask), (input_values))
++ return status;
++}
+
-+#define A_WMI_GPIO_DATA_RX(reg_id, value) \
-+ ar6000_gpio_data_rx((reg_id), (value))
++/* registered removal callback from the HIF layer */
++static A_STATUS HTCTargetRemovedHandler(void *handle, A_STATUS status)
++{
++ HTC_TARGET *target;
+
-+#define A_WMI_GPIO_ACK_RX() \
-+ ar6000_gpio_ack_rx()
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCTargetRemovedHandler handle:0x%X \n",(A_UINT32)handle));
+
-+#endif
++ if (NULL == handle) {
++ /* this could be NULL in the event that target initialization failed */
++ return A_OK;
++ }
+
-+#ifdef SEND_EVENT_TO_APP
++ target = ((AR6K_DEVICE *)handle)->HTCContext;
+
-+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len) \
-+ ar6000_send_event_to_app((ar), (eventId), (datap), (len))
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" removing target:0x%X instance:0x%X ... \n",
++ (A_UINT32)target, (A_UINT32)target->pInstanceContext));
+
-+#else
++ if (target->pInstanceContext != NULL) {
++ /* let upper layer know, it needs to call HTCStop() */
++ HTCInitInfo.DeleteInstance(target->pInstanceContext);
++ }
+
-+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len)
++ HIFShutDownDevice(target->Device.HIFDevice);
+
-+#endif
++ HTCCleanup(target);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCTargetRemovedHandler \n"));
++ return A_OK;
++}
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+#define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
-+ ar6000_tcmd_rx_report_event((devt), (results), (len))
-+#endif
++/* get the low level HIF device for the caller , the caller may wish to do low level
++ * HIF requests */
++void *HTCGetHifDevice(HTC_HANDLE HTCHandle)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ return target->Device.HIFDevice;
++}
+
-+#define A_WMI_HBCHALLENGERESP_EVENT(devt, cookie, source) \
-+ ar6000_hbChallengeResp_event((devt), (cookie), (source))
++/* set the instance block for this HTC handle, so that on removal, the blob can be
++ * returned to the caller */
++void HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
-+#define A_WMI_TX_RETRY_ERR_EVENT(devt) \
-+ ar6000_tx_retry_err_event((devt))
++ target->pInstanceContext = Instance;
++}
+
-+#define A_WMI_SNR_THRESHOLD_EVENT_RX(devt, newThreshold, snr) \
-+ ar6000_snrThresholdEvent_rx((devt), (newThreshold), (snr))
++/* wait for the target to arrive (sends HTC Ready message)
++ * this operation is fully synchronous and the message is polled for */
++A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ A_STATUS status;
++ HTC_PACKET *pPacket = NULL;
++ HTC_READY_MSG *pRdyMsg;
++ HTC_SERVICE_CONNECT_REQ connect;
++ HTC_SERVICE_CONNECT_RESP resp;
+
-+#define A_WMI_LQ_THRESHOLD_EVENT_RX(devt, range, lqVal) \
-+ ar6000_lqThresholdEvent_rx((devt), (range), (lqVal))
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Enter (target:0x%X) \n", (A_UINT32)target));
+
-+#define A_WMI_RATEMASK_RX(devt, ratemask) \
-+ ar6000_ratemask_rx((devt), (ratemask))
++ do {
+
-+#define A_WMI_KEEPALIVE_RX(devt, configured) \
-+ ar6000_keepalive_rx((devt), (configured))
++#ifdef MBOXHW_UNIT_TEST
+
-+#define A_WMI_BSSINFO_EVENT_RX(ar, datp, len) \
-+ ar6000_bssInfo_event_rx((ar), (datap), (len))
++ status = DoMboxHWTest(&target->Device);
+
-+#define A_WMI_DBGLOG_EVENT(ar, dropped, buffer, length) \
-+ ar6000_dbglog_event((ar), (dropped), (buffer), (length));
++ if (status != A_OK) {
++ break;
++ }
+
-+#define A_WMI_STREAM_TX_ACTIVE(devt,trafficClass) \
-+ ar6000_indicate_tx_activity((devt),(trafficClass), TRUE)
++#endif
+
-+#define A_WMI_STREAM_TX_INACTIVE(devt,trafficClass) \
-+ ar6000_indicate_tx_activity((devt),(trafficClass), FALSE)
++ /* we should be getting 1 control message that the target is ready */
++ status = HTCWaitforControlMessage(target, &pPacket);
+
-+/****************************************************************************/
-+/****************************************************************************/
-+/** **/
-+/** HTC related hooks **/
-+/** **/
-+/****************************************************************************/
-+/****************************************************************************/
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" Target Not Available!!\n"));
++ break;
++ }
+
-+#ifdef __cplusplus
-+}
-+#endif
++ /* we controlled the buffer creation so it has to be properly aligned */
++ pRdyMsg = (HTC_READY_MSG *)pPacket->pBuffer;
+
-+#endif
-diff --git a/drivers/ar6000/include/a_osapi.h b/drivers/ar6000/include/a_osapi.h
-new file mode 100644
-index 0000000..7d60867
---- /dev/null
-+++ b/drivers/ar6000/include/a_osapi.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_OSAPI_H_
-+#define _A_OSAPI_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_osapi.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ if ((pRdyMsg->MessageID != HTC_MSG_READY_ID) ||
++ (pPacket->ActualLength < sizeof(HTC_READY_MSG))) {
++ /* this message is not valid */
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
+
-+#include "../ar6000/osapi_linux.h"
++ if (pRdyMsg->CreditCount == 0 || pRdyMsg->CreditSize == 0) {
++ /* this message is not valid */
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
+
-+#endif /* _OSAPI_H_ */
-diff --git a/drivers/ar6000/include/a_types.h b/drivers/ar6000/include/a_types.h
-new file mode 100644
-index 0000000..e2ed090
---- /dev/null
-+++ b/drivers/ar6000/include/a_types.h
-@@ -0,0 +1,28 @@
-+#ifndef _A_TYPES_H_
-+#define _A_TYPES_H_
-+/*
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_types.h#1 $
-+ *
-+ * This file contains the definitions of the basic atheros data types.
-+ * It is used to map the data types in atheros files to a platform specific
-+ * type.
-+ *
-+ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ target->TargetCredits = pRdyMsg->CreditCount;
++ target->TargetCreditSize = pRdyMsg->CreditSize;
+
-+#include "../ar6000/athtypes_linux.h"
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" Target Ready: credits: %d credit size: %d\n",
++ target->TargetCredits, target->TargetCreditSize));
+
-+#endif /* _ATHTYPES_H_ */
-diff --git a/drivers/ar6000/include/ar6000_api.h b/drivers/ar6000/include/ar6000_api.h
-new file mode 100644
-index 0000000..abe5de7
---- /dev/null
-+++ b/drivers/ar6000/include/ar6000_api.h
-@@ -0,0 +1,29 @@
-+#ifndef _AR6000_API_H_
-+#define _AR6000_API_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains the API to access the OS dependent atheros host driver
-+ * by the WMI or WLAN generic modules.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/ar6000_api.h#1 $
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ /* setup our pseudo HTC control endpoint connection */
++ A_MEMZERO(&connect,sizeof(connect));
++ A_MEMZERO(&resp,sizeof(resp));
++ connect.EpCallbacks.pContext = target;
++ connect.EpCallbacks.EpTxComplete = HTCControlTxComplete;
++ connect.EpCallbacks.EpRecv = HTCControlRecv;
++ connect.EpCallbacks.EpRecvRefill = NULL; /* not needed */
++ connect.EpCallbacks.EpSendFull = NULL; /* not needed */
++ connect.EpCallbacks.EpSendAvail = NULL; /* not needed */
++ connect.MaxSendQueueDepth = NUM_CONTROL_BUFFERS;
++ connect.ServiceID = HTC_CTRL_RSVD_SVC;
+
-+#include "../ar6000/ar6xapi_linux.h"
++ /* connect fake service */
++ status = HTCConnectService((HTC_HANDLE)target,
++ &connect,
++ &resp);
+
-+#endif /* _AR6000_API_H */
++ if (!A_FAILED(status)) {
++ break;
++ }
+
-diff --git a/drivers/ar6000/include/ar6000_diag.h b/drivers/ar6000/include/ar6000_diag.h
-new file mode 100644
-index 0000000..2df131d
---- /dev/null
-+++ b/drivers/ar6000/include/ar6000_diag.h
-@@ -0,0 +1,38 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ } while (FALSE);
+
-+#ifndef AR6000_DIAG_H_
-+#define AR6000_DIAG_H_
++ if (pPacket != NULL) {
++ HTC_FREE_CONTROL_RX(target,pPacket);
++ }
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCWaitTarget - Exit\n"));
+
-+A_STATUS
-+ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++ return status;
++}
+
-+A_STATUS
-+ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
-+A_STATUS
-+ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+ A_UCHAR *data, A_UINT32 length);
+
-+A_STATUS
-+ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+ A_UCHAR *data, A_UINT32 length);
++/* Start HTC, enable interrupts and let the target know host has finished setup */
++A_STATUS HTCStart(HTC_HANDLE HTCHandle)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HTC_PACKET *pPacket;
++ A_STATUS status;
+
-+#endif /*AR6000_DIAG_H_*/
-diff --git a/drivers/ar6000/include/athdefs.h b/drivers/ar6000/include/athdefs.h
-new file mode 100644
-index 0000000..c28c871
---- /dev/null
-+++ b/drivers/ar6000/include/athdefs.h
-@@ -0,0 +1,85 @@
-+#ifndef __ATHDEFS_H__
-+#define __ATHDEFS_H__
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Enter\n"));
+
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains definitions that may be used across both
-+ * Host and Target software. Nothing here is module-dependent
-+ * or platform-dependent.
-+ */
++ /* now that we are starting, push control receive buffers into the
++ * HTC control endpoint */
+
-+/*
-+ * Generic error codes that can be used by hw, sta, ap, sim, dk
-+ * and any other environments. Since these are enums, feel free to
-+ * add any more codes that you need.
-+ */
++ while (1) {
++ pPacket = HTC_ALLOC_CONTROL_RX(target);
++ if (NULL == pPacket) {
++ break;
++ }
++ HTCAddReceivePkt((HTC_HANDLE)target,pPacket);
++ }
+
-+typedef enum {
-+ A_ERROR = -1, /* Generic error return */
-+ A_OK = 0, /* success */
-+ /* Following values start at 1 */
-+ A_DEVICE_NOT_FOUND, /* not able to find PCI device */
-+ A_NO_MEMORY, /* not able to allocate memory, not available */
-+ A_MEMORY_NOT_AVAIL, /* memory region is not free for mapping */
-+ A_NO_FREE_DESC, /* no free descriptors available */
-+ A_BAD_ADDRESS, /* address does not match descriptor */
-+ A_WIN_DRIVER_ERROR, /* used in NT_HW version, if problem at init */
-+ A_REGS_NOT_MAPPED, /* registers not correctly mapped */
-+ A_EPERM, /* Not superuser */
-+ A_EACCES, /* Access denied */
-+ A_ENOENT, /* No such entry, search failed, etc. */
-+ A_EEXIST, /* The object already exists (can't create) */
-+ A_EFAULT, /* Bad address fault */
-+ A_EBUSY, /* Object is busy */
-+ A_EINVAL, /* Invalid parameter */
-+ A_EMSGSIZE, /* Inappropriate message buffer length */
-+ A_ECANCELED, /* Operation canceled */
-+ A_ENOTSUP, /* Operation not supported */
-+ A_ECOMM, /* Communication error on send */
-+ A_EPROTO, /* Protocol error */
-+ A_ENODEV, /* No such device */
-+ A_EDEVNOTUP, /* device is not UP */
-+ A_NO_RESOURCE, /* No resources for requested operation */
-+ A_HARDWARE, /* Hardware failure */
-+ A_PENDING, /* Asynchronous routine; will send up results la
-+ter (typically in callback) */
-+ A_EBADCHANNEL, /* The channel cannot be used */
-+ A_DECRYPT_ERROR, /* Decryption error */
-+ A_PHY_ERROR, /* RX PHY error */
-+ A_CONSUMED /* Object was consumed */
-+} A_STATUS;
++ do {
+
-+#define A_SUCCESS(x) (x == A_OK)
-+#define A_FAILED(x) (!A_SUCCESS(x))
++ AR_DEBUG_ASSERT(target->InitCredits != NULL);
++ AR_DEBUG_ASSERT(target->EpCreditDistributionListHead != NULL);
++ AR_DEBUG_ASSERT(target->EpCreditDistributionListHead->pNext != NULL);
+
-+#ifndef TRUE
-+#define TRUE 1
-+#endif
++ /* call init credits callback to do the distribution ,
++ * NOTE: the first entry in the distribution list is ENDPOINT_0, so
++ * we pass the start of the list after this one. */
++ target->InitCredits(target->pCredDistContext,
++ target->EpCreditDistributionListHead->pNext,
++ target->TargetCredits);
+
-+#ifndef FALSE
-+#define FALSE 0
-+#endif
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_TRC)) {
++ DumpCreditDistStates(target);
++ }
+
-+/*
-+ * The following definition is WLAN specific definition
-+ */
-+typedef enum {
-+ MODE_11A = 0, /* 11a Mode */
-+ MODE_11G = 1, /* 11g + 11b Mode */
-+ MODE_11B = 2, /* 11b Mode */
-+ MODE_11GONLY = 3, /* 11g only Mode */
-+ MODE_UNKNOWN = 4,
-+ MODE_MAX = 4
-+} WLAN_PHY_MODE;
++ /* the caller is done connecting to services, so we can indicate to the
++ * target that the setup phase is complete */
++ status = HTCSendSetupComplete(target);
+
-+typedef enum {
-+ WLAN_11A_CAPABILITY = 1,
-+ WLAN_11G_CAPABILITY = 2,
-+ WLAN_11AG_CAPABILITY = 3,
-+}WLAN_CAPABILITY;
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+#endif /* __ATHDEFS_H__ */
-diff --git a/drivers/ar6000/include/athdrv.h b/drivers/ar6000/include/athdrv.h
-new file mode 100644
-index 0000000..19da97e
---- /dev/null
-+++ b/drivers/ar6000/include/athdrv.h
-@@ -0,0 +1,32 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ /* unmask interrupts */
++ status = DevUnmaskInterrupts(&target->Device);
+
-+#ifndef _ATHDRV_H_
-+#define _ATHDRV_H_
++ if (A_FAILED(status)) {
++ HTCStop(target);
++ }
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++ } while (FALSE);
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HTCStart Exit\n"));
++ return status;
++}
+
-+#ifdef __cplusplus
++
++/* stop HTC communications, i.e. stop interrupt reception, and flush all queued buffers */
++void HTCStop(HTC_HANDLE HTCHandle)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCStop \n"));
++
++ /* mark that we are shutting down .. */
++ target->HTCStateFlags |= HTC_STATE_STOPPING;
++
++ /* Masking interrupts is a synchronous operation, when this function returns
++ * all pending HIF I/O has completed, we can safely flush the queues */
++ DevMaskInterrupts(&target->Device);
++
++ /* flush all send packets */
++ HTCFlushSendPkts(target);
++ /* flush all recv buffers */
++ HTCFlushRecvBuffers(target);
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCStop \n"));
+}
-+#endif
+
-+#endif /* _ATHDRV_H_ */
-diff --git a/drivers/ar6000/include/athendpack.h b/drivers/ar6000/include/athendpack.h
-new file mode 100644
-index 0000000..42921ae
---- /dev/null
-+++ b/drivers/ar6000/include/athendpack.h
-@@ -0,0 +1,41 @@
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ * @file: athendpack.h
-+ *
-+ * @abstract: end compiler-specific structure packing
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#ifdef VXWORKS
-+#endif /* VXWORKS */
++/* undo what was done in HTCInit() */
++void HTCShutDown(void)
++{
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCShutDown: \n"));
++ HTCInitialized = FALSE;
++ /* undo HTCInit */
++ HIFShutDownDevice(NULL);
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCShutDown: \n"));
++}
+
-+#ifdef LINUX
-+#endif /* LINUX */
++void HTCDumpCreditStates(HTC_HANDLE HTCHandle)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
+
-+#ifdef QNX
-+#endif /* QNX */
++ LOCK_HTC_TX(target);
+
-+#ifdef INTEGRITY
-+#include "integrity/athendpack_integrity.h"
-+#endif /* INTEGRITY */
++ DumpCreditDistStates(target);
+
-+#ifdef NUCLEUS
-+#endif /* NUCLEUS */
++ UNLOCK_HTC_TX(target);
++}
+
-+#ifdef UNDER_CE
-+#include "../os/wince/include/athendpack_wince.h"
-+#endif /* WINCE */
++/* report a target failure from the device, this is a callback from the device layer
++ * which uses a mechanism to report errors from the target (i.e. special interrupts) */
++static void HTCReportFailure(void *Context)
++{
++ HTC_TARGET *target = (HTC_TARGET *)Context;
+
-diff --git a/drivers/ar6000/include/athstartpack.h b/drivers/ar6000/include/athstartpack.h
++ target->TargetFailure = TRUE;
++
++ if ((target->pInstanceContext != NULL) && (HTCInitInfo.TargetFailure != NULL)) {
++ /* let upper layer know, it needs to call HTCStop() */
++ HTCInitInfo.TargetFailure(target->pInstanceContext, A_ERROR);
++ }
++}
++
++void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription)
++{
++ A_CHAR stream[60];
++ A_UINT32 i;
++ A_UINT16 offset, count;
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<---------Dumping %d Bytes : %s ------>\n", length, pDescription));
++
++ count = 0;
++ offset = 0;
++ for(i = 0; i < length; i++) {
++ sprintf(stream + offset, "%2.2X ", buffer[i]);
++ count ++;
++ offset += 3;
++
++ if(count == 16) {
++ count = 0;
++ offset = 0;
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
++ A_MEMZERO(stream, 60);
++ }
++ }
++
++ if(offset != 0) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("[H]: %s\n", stream));
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("<------------------------------------------------->\n"));
++}
++
++A_BOOL HTCGetEndpointStatistics(HTC_HANDLE HTCHandle,
++ HTC_ENDPOINT_ID Endpoint,
++ HTC_ENDPOINT_STAT_ACTION Action,
++ HTC_ENDPOINT_STATS *pStats)
++{
++
++#ifdef HTC_EP_STAT_PROFILING
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ A_BOOL clearStats = FALSE;
++ A_BOOL sample = FALSE;
++
++ switch (Action) {
++ case HTC_EP_STAT_SAMPLE :
++ sample = TRUE;
++ break;
++ case HTC_EP_STAT_SAMPLE_AND_CLEAR :
++ sample = TRUE;
++ clearStats = TRUE;
++ break;
++ case HTC_EP_STAT_CLEAR :
++ clearStats = TRUE;
++ break;
++ default:
++ break;
++ }
++
++ A_ASSERT(Endpoint < ENDPOINT_MAX);
++
++ /* lock out TX and RX while we sample and/or clear */
++ LOCK_HTC_TX(target);
++ LOCK_HTC_RX(target);
++
++ if (sample) {
++ A_ASSERT(pStats != NULL);
++ /* return the stats to the caller */
++ A_MEMCPY(pStats, &target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
++ }
++
++ if (clearStats) {
++ /* reset stats */
++ A_MEMZERO(&target->EndPoint[Endpoint].EndPointStats, sizeof(HTC_ENDPOINT_STATS));
++ }
++
++ UNLOCK_HTC_RX(target);
++ UNLOCK_HTC_TX(target);
++
++ return TRUE;
++#else
++ return FALSE;
++#endif
++}
+diff --git a/drivers/ar6000/htc/htc_debug.h b/drivers/ar6000/htc/htc_debug.h
new file mode 100644
-index 0000000..6632cc2
+index 0000000..08080be
--- /dev/null
-+++ b/drivers/ar6000/include/athstartpack.h
-@@ -0,0 +1,42 @@
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ * @file: athstartpack.h
-+ *
-+ * @abstract: start compiler-specific structure packing
++++ b/drivers/ar6000/htc/htc_debug.h
+@@ -0,0 +1,65 @@
++#ifndef HTC_DEBUG_H_
++#define HTC_DEBUG_H_
++/*
+ *
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ */
+
-+#ifdef VXWORKS
-+#endif /* VXWORKS */
-+
-+#ifdef LINUX
-+#endif /* LINUX */
-+
-+#ifdef QNX
-+#endif /* QNX */
++/* ------- Debug related stuff ------- */
++enum {
++ ATH_DEBUG_SEND = 0x0001,
++ ATH_DEBUG_RECV = 0x0002,
++ ATH_DEBUG_SYNC = 0x0004,
++ ATH_DEBUG_DUMP = 0x0008,
++ ATH_DEBUG_IRQ = 0x0010,
++ ATH_DEBUG_TRC = 0x0020,
++ ATH_DEBUG_WARN = 0x0040,
++ ATH_DEBUG_ERR = 0x0080,
++ ATH_DEBUG_ANY = 0xFFFF,
++};
+
-+#ifdef INTEGRITY
-+#include "integrity/athstartpack_integrity.h"
-+#endif /* INTEGRITY */
++#ifdef DEBUG
+
-+#ifdef NUCLEUS
-+#endif /* NUCLEUS */
++// TODO FIX usage of A_PRINTF!
++#define AR_DEBUG_LVL_CHECK(lvl) (debughtc & (lvl))
++#define AR_DEBUG_PRINTBUF(buffer, length, desc) do { \
++ if (debughtc & ATH_DEBUG_DUMP) { \
++ DebugDumpBytes(buffer, length,desc); \
++ } \
++} while(0)
++#define PRINTX_ARG(arg...) arg
++#define AR_DEBUG_PRINTF(flags, args) do { \
++ if (debughtc & (flags)) { \
++ A_PRINTF(KERN_ALERT PRINTX_ARG args); \
++ } \
++} while (0)
++#define AR_DEBUG_ASSERT(test) do { \
++ if (!(test)) { \
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#test)); \
++ } \
++} while(0)
++extern int debughtc;
++#else
++#define AR_DEBUG_PRINTF(flags, args)
++#define AR_DEBUG_PRINTBUF(buffer, length, desc)
++#define AR_DEBUG_ASSERT(test)
++#define AR_DEBUG_LVL_CHECK(lvl) 0
++#endif
+
-+#ifdef UNDER_CE
-+#include "../os/wince/include/athstartpack_wince.h"
-+#endif /* WINCE */
++void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
+
-diff --git a/drivers/ar6000/include/bmi.h b/drivers/ar6000/include/bmi.h
++#endif /*HTC_DEBUG_H_*/
+diff --git a/drivers/ar6000/htc/htc_internal.h b/drivers/ar6000/htc/htc_internal.h
new file mode 100644
-index 0000000..2eb7134
+index 0000000..ebb8ac1
--- /dev/null
-+++ b/drivers/ar6000/include/bmi.h
-@@ -0,0 +1,100 @@
-+#ifndef _BMI_H_
-+#define _BMI_H_
++++ b/drivers/ar6000/htc/htc_internal.h
+@@ -0,0 +1,168 @@
+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ *
+ *
-+ * BMI declarations and prototypes
+ */
+
++#ifndef _HTC_INTERNAL_H_
++#define _HTC_INTERNAL_H_
++
++/* for debugging, uncomment this to capture the last frame header, on frame header
++ * processing errors, the last frame header is dump for comparison */
++//#define HTC_CAPTURE_LAST_FRAME
++
++//#define HTC_EP_STAT_PROFILING
++
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_types.h"
-+#include "hif.h"
+#include "a_osapi.h"
++#include "a_debug.h"
++#include "htc.h"
++#include "htc_api.h"
+#include "bmi_msg.h"
++#include "hif.h"
++#include "ar6k.h"
+
-+void
-+BMIInit(void);
++/* HTC operational parameters */
++#define HTC_TARGET_RESPONSE_TIMEOUT 2000 /* in ms */
++#define HTC_TARGET_DEBUG_INTR_MASK 0x01
++#define HTC_TARGET_CREDIT_INTR_MASK 0xF0
+
-+A_STATUS
-+BMIDone(HIF_DEVICE *device);
++typedef struct _HTC_ENDPOINT {
++ HTC_SERVICE_ID ServiceID; /* service ID this endpoint is bound to
++ non-zero value means this endpoint is in use */
++ HTC_PACKET_QUEUE TxQueue; /* HTC frame buffer TX queue */
++ HTC_PACKET_QUEUE RxBuffers; /* HTC frame buffer RX list */
++ HTC_ENDPOINT_CREDIT_DIST CreditDist; /* credit distribution structure (exposed to driver layer) */
++ HTC_EP_CALLBACKS EpCallBacks; /* callbacks associated with this endpoint */
++ int MaxTxQueueDepth; /* max depth of the TX queue before we need to
++ call driver's full handler */
++ int CurrentTxQueueDepth; /* current TX queue depth */
++ int MaxMsgLength; /* max length of endpoint message */
++#ifdef HTC_EP_STAT_PROFILING
++ HTC_ENDPOINT_STATS EndPointStats; /* endpoint statistics */
++#endif
++} HTC_ENDPOINT;
+
-+A_STATUS
-+BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info);
++#ifdef HTC_EP_STAT_PROFILING
++#define INC_HTC_EP_STAT(p,stat,count) (p)->EndPointStats.stat += (count);
++#else
++#define INC_HTC_EP_STAT(p,stat,count)
++#endif
+
-+A_STATUS
-+BMIReadMemory(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length);
++#define HTC_SERVICE_TX_PACKET_TAG HTC_TX_PACKET_TAG_INTERNAL
+
-+A_STATUS
-+BMIWriteMemory(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length);
++#define NUM_CONTROL_BUFFERS 8
++#define NUM_CONTROL_TX_BUFFERS 2
++#define NUM_CONTROL_RX_BUFFERS (NUM_CONTROL_BUFFERS - NUM_CONTROL_TX_BUFFERS)
+
-+A_STATUS
-+BMIExecute(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 *param);
++#define HTC_CONTROL_BUFFER_SIZE (HTC_MAX_CONTROL_MESSAGE_LENGTH + HTC_HDR_LENGTH)
+
-+A_STATUS
-+BMISetAppStart(HIF_DEVICE *device,
-+ A_UINT32 address);
++typedef struct HTC_CONTROL_BUFFER {
++ HTC_PACKET HtcPacket;
++ A_UINT8 Buffer[HTC_CONTROL_BUFFER_SIZE];
++} HTC_CONTROL_BUFFER;
+
-+A_STATUS
-+BMIReadSOCRegister(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 *param);
++/* our HTC target state */
++typedef struct _HTC_TARGET {
++ HTC_ENDPOINT EndPoint[ENDPOINT_MAX];
++ HTC_CONTROL_BUFFER HTCControlBuffers[NUM_CONTROL_BUFFERS];
++ HTC_ENDPOINT_CREDIT_DIST *EpCreditDistributionListHead;
++ HTC_PACKET_QUEUE ControlBufferTXFreeList;
++ HTC_PACKET_QUEUE ControlBufferRXFreeList;
++ HTC_CREDIT_DIST_CALLBACK DistributeCredits;
++ HTC_CREDIT_INIT_CALLBACK InitCredits;
++ void *pCredDistContext;
++ int TargetCredits;
++ int TargetCreditSize;
++ A_MUTEX_T HTCLock;
++ A_MUTEX_T HTCRxLock;
++ A_MUTEX_T HTCTxLock;
++ AR6K_DEVICE Device; /* AR6K - specific state */
++ A_UINT32 HTCStateFlags;
++ HTC_ENDPOINT_ID EpWaitingForBuffers;
++ A_BOOL TargetFailure;
++ void *pInstanceContext;
++#define HTC_STATE_WAIT_BUFFERS (1 << 0)
++#define HTC_STATE_STOPPING (1 << 1)
++#ifdef HTC_CAPTURE_LAST_FRAME
++ HTC_FRAME_HDR LastFrameHdr; /* useful for debugging */
++ A_UINT8 LastTrailer[256];
++ A_UINT8 LastTrailerLength;
++#endif
++} HTC_TARGET;
+
-+A_STATUS
-+BMIWriteSOCRegister(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UINT32 param);
++#define HTC_STOPPING(t) ((t)->HTCStateFlags & HTC_STATE_STOPPING)
++#define LOCK_HTC(t) A_MUTEX_LOCK(&(t)->HTCLock);
++#define UNLOCK_HTC(t) A_MUTEX_UNLOCK(&(t)->HTCLock);
++#define LOCK_HTC_RX(t) A_MUTEX_LOCK(&(t)->HTCRxLock);
++#define UNLOCK_HTC_RX(t) A_MUTEX_UNLOCK(&(t)->HTCRxLock);
++#define LOCK_HTC_TX(t) A_MUTEX_LOCK(&(t)->HTCTxLock);
++#define UNLOCK_HTC_TX(t) A_MUTEX_UNLOCK(&(t)->HTCTxLock);
+
-+A_STATUS
-+BMIrompatchInstall(HIF_DEVICE *device,
-+ A_UINT32 ROM_addr,
-+ A_UINT32 RAM_addr,
-+ A_UINT32 nbytes,
-+ A_UINT32 do_activate,
-+ A_UINT32 *patch_id);
++#define GET_HTC_TARGET_FROM_HANDLE(hnd) ((HTC_TARGET *)(hnd))
++#define HTC_RECYCLE_RX_PKT(target,p) \
++{ \
++ HTC_PACKET_RESET_RX(pPacket); \
++ HTCAddReceivePkt((HTC_HANDLE)(target),(p)); \
++}
+
-+A_STATUS
-+BMIrompatchUninstall(HIF_DEVICE *device,
-+ A_UINT32 rompatch_id);
++/* internal HTC functions */
++void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket);
++void HTCControlRecv(void *Context, HTC_PACKET *pPacket);
++A_STATUS HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket);
++HTC_PACKET *HTCAllocControlBuffer(HTC_TARGET *target, HTC_PACKET_QUEUE *pList);
++void HTCFreeControlBuffer(HTC_TARGET *target, HTC_PACKET *pPacket, HTC_PACKET_QUEUE *pList);
++A_STATUS HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 Flags);
++A_STATUS HTCIssueRecv(HTC_TARGET *target, HTC_PACKET *pPacket);
++void HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket);
++A_STATUS HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc);
++void HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint);
++A_STATUS HTCSendSetupComplete(HTC_TARGET *target);
++void HTCFlushRecvBuffers(HTC_TARGET *target);
++void HTCFlushSendPkts(HTC_TARGET *target);
++void DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist);
++void DumpCreditDistStates(HTC_TARGET *target);
++void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
+
-+A_STATUS
-+BMIrompatchActivate(HIF_DEVICE *device,
-+ A_UINT32 rompatch_count,
-+ A_UINT32 *rompatch_list);
++static INLINE HTC_PACKET *HTC_ALLOC_CONTROL_TX(HTC_TARGET *target) {
++ HTC_PACKET *pPacket = HTCAllocControlBuffer(target,&target->ControlBufferTXFreeList);
++ if (pPacket != NULL) {
++ /* set payload pointer area with some headroom */
++ pPacket->pBuffer = pPacket->pBufferStart + HTC_HDR_LENGTH;
++ }
++ return pPacket;
++}
+
-+A_STATUS
-+BMIrompatchDeactivate(HIF_DEVICE *device,
-+ A_UINT32 rompatch_count,
-+ A_UINT32 *rompatch_list);
++#define HTC_FREE_CONTROL_TX(t,p) HTCFreeControlBuffer((t),(p),&(t)->ControlBufferTXFreeList)
++#define HTC_ALLOC_CONTROL_RX(t) HTCAllocControlBuffer((t),&(t)->ControlBufferRXFreeList)
++#define HTC_FREE_CONTROL_RX(t,p) \
++{ \
++ HTC_PACKET_RESET_RX(p); \
++ HTCFreeControlBuffer((t),(p),&(t)->ControlBufferRXFreeList); \
++}
+
+#ifdef __cplusplus
+}
+#endif
+
-+#endif /* _BMI_H_ */
-diff --git a/drivers/ar6000/include/bmi_msg.h b/drivers/ar6000/include/bmi_msg.h
++#endif /* _HTC_INTERNAL_H_ */
+diff --git a/drivers/ar6000/htc/htc_recv.c b/drivers/ar6000/htc/htc_recv.c
new file mode 100644
-index 0000000..7c91ef4
+index 0000000..4be2b08
--- /dev/null
-+++ b/drivers/ar6000/include/bmi_msg.h
-@@ -0,0 +1,199 @@
-+#ifndef __BMI_MSG_H__
-+#define __BMI_MSG_H__
++++ b/drivers/ar6000/htc/htc_recv.c
+@@ -0,0 +1,703 @@
+/*
+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ */
+
-+/*
-+ * Bootloader Messaging Interface (BMI)
-+ *
-+ * BMI is a very simple messaging interface used during initialization
-+ * to read memory, write memory, execute code, and to define an
-+ * application entry PC.
-+ *
-+ * It is used to download an application to AR6K, to provide
-+ * patches to code that is already resident on AR6K, and generally
-+ * to examine and modify state. The Host has an opportunity to use
-+ * BMI only once during bootup. Once the Host issues a BMI_DONE
-+ * command, this opportunity ends.
-+ *
-+ * The Host writes BMI requests to mailbox0, and reads BMI responses
-+ * from mailbox0. BMI requests all begin with a command
-+ * (see below for specific commands), and are followed by
-+ * command-specific data.
-+ *
-+ * Flow control:
-+ * The Host can only issue a command once the Target gives it a
-+ * "BMI Command Credit", using AR6K Counter #4. As soon as the
-+ * Target has completed a command, it issues another BMI Command
-+ * Credit (so the Host can issue the next command).
-+ *
-+ * BMI handles all required Target-side cache flushing.
-+ */
-+
-+
-+/* Maximum data size used for BMI transfers */
-+#define BMI_DATASZ_MAX 32
-+
-+/* BMI Commands */
++#include "htc_internal.h"
+
-+#define BMI_NO_COMMAND 0
++#define HTCIssueRecv(t, p) \
++ DevRecvPacket(&(t)->Device, \
++ (p), \
++ (p)->ActualLength)
+
-+#define BMI_DONE 1
-+ /*
-+ * Semantics: Host is done using BMI
-+ * Request format:
-+ * A_UINT32 command (BMI_DONE)
-+ * Response format: none
-+ */
++#define DO_RCV_COMPLETION(t,p,e) \
++{ \
++ if ((p)->ActualLength > 0) { \
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" completing packet 0x%X (%d bytes) on ep : %d \n", \
++ (A_UINT32)(p), (p)->ActualLength, (p)->Endpoint)); \
++ (e)->EpCallBacks.EpRecv((e)->EpCallBacks.pContext, \
++ (p)); \
++ } else { \
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" recycling empty packet \n")); \
++ HTC_RECYCLE_RX_PKT((t), (p)); \
++ } \
++}
+
-+#define BMI_READ_MEMORY 2
-+ /*
-+ * Semantics: Host reads AR6K memory
-+ * Request format:
-+ * A_UINT32 command (BMI_READ_MEMORY)
-+ * A_UINT32 address
-+ * A_UINT32 length, at most BMI_DATASZ_MAX
-+ * Response format:
-+ * A_UINT8 data[length]
-+ */
++#ifdef HTC_EP_STAT_PROFILING
++#define HTC_RX_STAT_PROFILE(t,ep,lookAhead) \
++{ \
++ LOCK_HTC_RX((t)); \
++ INC_HTC_EP_STAT((ep), RxReceived, 1); \
++ if ((lookAhead) != 0) { \
++ INC_HTC_EP_STAT((ep), RxLookAheads, 1); \
++ } \
++ UNLOCK_HTC_RX((t)); \
++}
++#else
++#define HTC_RX_STAT_PROFILE(t,ep,lookAhead)
++#endif
+
-+#define BMI_WRITE_MEMORY 3
-+ /*
-+ * Semantics: Host writes AR6K memory
-+ * Request format:
-+ * A_UINT32 command (BMI_WRITE_MEMORY)
-+ * A_UINT32 address
-+ * A_UINT32 length, at most BMI_DATASZ_MAX
-+ * A_UINT8 data[length]
-+ * Response format: none
-+ */
++static INLINE A_STATUS HTCProcessTrailer(HTC_TARGET *target,
++ A_UINT8 *pBuffer,
++ int Length,
++ A_UINT32 *pNextLookAhead,
++ HTC_ENDPOINT_ID FromEndpoint)
++{
++ HTC_RECORD_HDR *pRecord;
++ A_UINT8 *pRecordBuf;
++ HTC_LOOKAHEAD_REPORT *pLookAhead;
++ A_UINT8 *pOrigBuffer;
++ int origLength;
++ A_STATUS status;
+
-+#define BMI_EXECUTE 4
-+ /*
-+ * Semantics: Causes AR6K to execute code
-+ * Request format:
-+ * A_UINT32 command (BMI_EXECUTE)
-+ * A_UINT32 address
-+ * A_UINT32 parameter
-+ * Response format:
-+ * A_UINT32 return value
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessTrailer (length:%d) \n", Length));
+
-+#define BMI_SET_APP_START 5
-+ /*
-+ * Semantics: Set Target application starting address
-+ * Request format:
-+ * A_UINT32 command (BMI_SET_APP_START)
-+ * A_UINT32 address
-+ * Response format: none
-+ */
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
++ AR_DEBUG_PRINTBUF(pBuffer,Length,"Recv Trailer");
++ }
+
-+#define BMI_READ_SOC_REGISTER 6
-+ /*
-+ * Semantics: Read a 32-bit Target SOC register.
-+ * Request format:
-+ * A_UINT32 command (BMI_READ_REGISTER)
-+ * A_UINT32 address
-+ * Response format:
-+ * A_UINT32 value
-+ */
++ pOrigBuffer = pBuffer;
++ origLength = Length;
++ status = A_OK;
+
-+#define BMI_WRITE_SOC_REGISTER 7
-+ /*
-+ * Semantics: Write a 32-bit Target SOC register.
-+ * Request format:
-+ * A_UINT32 command (BMI_WRITE_REGISTER)
-+ * A_UINT32 address
-+ * A_UINT32 value
-+ *
-+ * Response format: none
-+ */
++ while (Length > 0) {
+
-+#define BMI_GET_TARGET_ID 8
-+#define BMI_GET_TARGET_INFO 8
-+ /*
-+ * Semantics: Fetch the 4-byte Target information
-+ * Request format:
-+ * A_UINT32 command (BMI_GET_TARGET_ID/INFO)
-+ * Response format1 (old firmware):
-+ * A_UINT32 TargetVersionID
-+ * Response format2 (newer firmware):
-+ * A_UINT32 TARGET_VERSION_SENTINAL
-+ * struct bmi_target_info;
-+ */
++ if (Length < sizeof(HTC_RECORD_HDR)) {
++ status = A_EPROTO;
++ break;
++ }
++ /* these are byte aligned structs */
++ pRecord = (HTC_RECORD_HDR *)pBuffer;
++ Length -= sizeof(HTC_RECORD_HDR);
++ pBuffer += sizeof(HTC_RECORD_HDR);
+
-+struct bmi_target_info {
-+ A_UINT32 target_info_byte_count; /* size of this structure */
-+ A_UINT32 target_ver; /* Target Version ID */
-+ A_UINT32 target_type; /* Target type */
-+};
-+#define TARGET_VERSION_SENTINAL 0xffffffff
-+#define TARGET_TYPE_AR6001 1
-+#define TARGET_TYPE_AR6002 2
++ if (pRecord->Length > Length) {
++ /* no room left in buffer for record */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" invalid record length: %d (id:%d) buffer has: %d bytes left \n",
++ pRecord->Length, pRecord->RecordID, Length));
++ status = A_EPROTO;
++ break;
++ }
++ /* start of record follows the header */
++ pRecordBuf = pBuffer;
+
++ switch (pRecord->RecordID) {
++ case HTC_RECORD_CREDITS:
++ AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_CREDIT_REPORT));
++ HTCProcessCreditRpt(target,
++ (HTC_CREDIT_REPORT *)pRecordBuf,
++ pRecord->Length / (sizeof(HTC_CREDIT_REPORT)),
++ FromEndpoint);
++ break;
++ case HTC_RECORD_LOOKAHEAD:
++ AR_DEBUG_ASSERT(pRecord->Length >= sizeof(HTC_LOOKAHEAD_REPORT));
++ pLookAhead = (HTC_LOOKAHEAD_REPORT *)pRecordBuf;
++ if ((pLookAhead->PreValid == ((~pLookAhead->PostValid) & 0xFF)) &&
++ (pNextLookAhead != NULL)) {
+
-+#define BMI_ROMPATCH_INSTALL 9
-+ /*
-+ * Semantics: Install a ROM Patch.
-+ * Request format:
-+ * A_UINT32 command (BMI_ROMPATCH_INSTALL)
-+ * A_UINT32 Target ROM Address
-+ * A_UINT32 Target RAM Address
-+ * A_UINT32 Size, in bytes
-+ * A_UINT32 Activate? 1-->activate;
-+ * 0-->install but do not activate
-+ * Response format:
-+ * A_UINT32 PatchID
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
++ (" LookAhead Report Found (pre valid:0x%X, post valid:0x%X) \n",
++ pLookAhead->PreValid,
++ pLookAhead->PostValid));
+
-+#define BMI_ROMPATCH_UNINSTALL 10
-+ /*
-+ * Semantics: Uninstall a previously-installed ROM Patch,
-+ * automatically deactivating, if necessary.
-+ * Request format:
-+ * A_UINT32 command (BMI_ROMPATCH_UNINSTALL)
-+ * A_UINT32 PatchID
-+ *
-+ * Response format: none
-+ */
++ /* look ahead bytes are valid, copy them over */
++ ((A_UINT8 *)pNextLookAhead)[0] = pLookAhead->LookAhead[0];
++ ((A_UINT8 *)pNextLookAhead)[1] = pLookAhead->LookAhead[1];
++ ((A_UINT8 *)pNextLookAhead)[2] = pLookAhead->LookAhead[2];
++ ((A_UINT8 *)pNextLookAhead)[3] = pLookAhead->LookAhead[3];
+
-+#define BMI_ROMPATCH_ACTIVATE 11
-+ /*
-+ * Semantics: Activate a list of previously-installed ROM Patches.
-+ * Request format:
-+ * A_UINT32 command (BMI_ROMPATCH_ACTIVATE)
-+ * A_UINT32 rompatch_count
-+ * A_UINT32 PatchID[rompatch_count]
-+ *
-+ * Response format: none
-+ */
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
++ DebugDumpBytes((A_UINT8 *)pNextLookAhead,4,"Next Look Ahead");
++ }
++ }
++ break;
++ default:
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, (" unhandled record: id:%d length:%d \n",
++ pRecord->RecordID, pRecord->Length));
++ break;
++ }
+
-+#define BMI_ROMPATCH_DEACTIVATE 12
-+ /*
-+ * Semantics: Deactivate a list of active ROM Patches.
-+ * Request format:
-+ * A_UINT32 command (BMI_ROMPATCH_DEACTIVATE)
-+ * A_UINT32 rompatch_count
-+ * A_UINT32 PatchID[rompatch_count]
-+ *
-+ * Response format: none
-+ */
++ if (A_FAILED(status)) {
++ break;
++ }
+
++ /* advance buffer past this record for next time around */
++ pBuffer += pRecord->Length;
++ Length -= pRecord->Length;
++ }
+
-+#endif /* __BMI_MSG_H__ */
-diff --git a/drivers/ar6000/include/common_drv.h b/drivers/ar6000/include/common_drv.h
-new file mode 100644
-index 0000000..1bdc3da
---- /dev/null
-+++ b/drivers/ar6000/include/common_drv.h
-@@ -0,0 +1,61 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ if (A_FAILED(status)) {
++ DebugDumpBytes(pOrigBuffer,origLength,"BAD Recv Trailer");
++ }
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessTrailer \n"));
++ return status;
+
-+#ifndef COMMON_DRV_H_
-+#define COMMON_DRV_H_
++}
+
-+#include "hif.h"
-+#include "htc_packet.h"
++/* process a received message (i.e. strip off header, process any trailer data)
++ * note : locks must be released when this function is called */
++static A_STATUS HTCProcessRecvHeader(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT32 *pNextLookAhead)
++{
++ A_UINT8 temp;
++ A_UINT8 *pBuf;
++ A_STATUS status = A_OK;
++ A_UINT16 payloadLen;
++ A_UINT32 lookAhead;
+
++ pBuf = pPacket->pBuffer;
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCProcessRecvHeader \n"));
+
-+/* structure that is the state information for the default credit distribution callback
-+ * drivers should instantiate (zero-init as well) this structure in their driver instance
-+ * and pass it as a context to the HTC credit distribution functions */
-+typedef struct _COMMON_CREDIT_STATE_INFO {
-+ int TotalAvailableCredits; /* total credits in the system at startup */
-+ int CurrentFreeCredits; /* credits available in the pool that have not been
-+ given out to endpoints */
-+ HTC_ENDPOINT_CREDIT_DIST *pLowestPriEpDist; /* pointer to the lowest priority endpoint dist struct */
-+} COMMON_CREDIT_STATE_INFO;
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
++ AR_DEBUG_PRINTBUF(pBuf,pPacket->ActualLength,"HTC Recv PKT");
++ }
+
++ do {
++ /* note, we cannot assume the alignment of pBuffer, so we use the safe macros to
++ * retrieve 16 bit fields */
++ payloadLen = A_GET_UINT16_FIELD(pBuf, HTC_FRAME_HDR, PayloadLen);
+
-+/* HTC TX packet tagging definitions */
-+#define AR6K_CONTROL_PKT_TAG HTC_TX_PACKET_TAG_USER_DEFINED
-+#define AR6K_DATA_PKT_TAG (AR6K_CONTROL_PKT_TAG + 1)
++ ((A_UINT8 *)&lookAhead)[0] = pBuf[0];
++ ((A_UINT8 *)&lookAhead)[1] = pBuf[1];
++ ((A_UINT8 *)&lookAhead)[2] = pBuf[2];
++ ((A_UINT8 *)&lookAhead)[3] = pBuf[3];
+
-+#ifdef __cplusplus
-+extern "C" {
++ if (lookAhead != pPacket->HTCReserved) {
++ /* somehow the lookahead that gave us the full read length did not
++ * reflect the actual header in the pending message */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCProcessRecvHeader, lookahead mismatch! \n"));
++ DebugDumpBytes((A_UINT8 *)&pPacket->HTCReserved,4,"Expected Message LookAhead");
++ DebugDumpBytes(pBuf,sizeof(HTC_FRAME_HDR),"Current Frame Header");
++#ifdef HTC_CAPTURE_LAST_FRAME
++ DebugDumpBytes((A_UINT8 *)&target->LastFrameHdr,sizeof(HTC_FRAME_HDR),"Last Frame Header");
++ if (target->LastTrailerLength != 0) {
++ DebugDumpBytes(target->LastTrailer,
++ target->LastTrailerLength,
++ "Last trailer");
++ }
+#endif
++ status = A_EPROTO;
++ break;
++ }
+
-+/* OS-independent APIs */
-+A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo);
-+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
-+A_STATUS ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address, A_UCHAR *data, A_UINT32 length);
-+A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
-+void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
-+A_STATUS ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice);
++ /* get flags */
++ temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, Flags);
+
-+#ifdef __cplusplus
-+}
-+#endif
++ if (temp & HTC_FLAGS_RECV_TRAILER) {
++ /* this packet has a trailer */
+
-+#endif /*COMMON_DRV_H_*/
-diff --git a/drivers/ar6000/include/dbglog.h b/drivers/ar6000/include/dbglog.h
-new file mode 100644
-index 0000000..3d1e528
---- /dev/null
-+++ b/drivers/ar6000/include/dbglog.h
-@@ -0,0 +1,107 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions and data structures associated with
-+ * the log based debug mechanism.
-+ *
-+ */
++ /* extract the trailer length in control byte 0 */
++ temp = A_GET_UINT8_FIELD(pBuf, HTC_FRAME_HDR, ControlBytes[0]);
+
-+#ifndef _DBGLOG_H_
-+#define _DBGLOG_H_
++ if ((temp < sizeof(HTC_RECORD_HDR)) || (temp > payloadLen)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCProcessRecvHeader, invalid header (payloadlength should be :%d, CB[0] is:%d) \n",
++ payloadLen, temp));
++ status = A_EPROTO;
++ break;
++ }
+
-+#ifdef __cplusplus
-+extern "C" {
++ /* process trailer data that follows HDR + application payload */
++ status = HTCProcessTrailer(target,
++ (pBuf + HTC_HDR_LENGTH + payloadLen - temp),
++ temp,
++ pNextLookAhead,
++ pPacket->Endpoint);
++
++ if (A_FAILED(status)) {
++ break;
++ }
++
++#ifdef HTC_CAPTURE_LAST_FRAME
++ A_MEMCPY(target->LastTrailer, (pBuf + HTC_HDR_LENGTH + payloadLen - temp), temp);
++ target->LastTrailerLength = temp;
++#endif
++ /* trim length by trailer bytes */
++ pPacket->ActualLength -= temp;
++ }
++#ifdef HTC_CAPTURE_LAST_FRAME
++ else {
++ target->LastTrailerLength = 0;
++ }
+#endif
+
-+#define DBGLOG_TIMESTAMP_OFFSET 0
-+#define DBGLOG_TIMESTAMP_MASK 0x0000FFFF /* Bit 0-15. Contains bit
-+ 8-23 of the LF0 timer */
-+#define DBGLOG_DBGID_OFFSET 16
-+#define DBGLOG_DBGID_MASK 0x03FF0000 /* Bit 16-25 */
-+#define DBGLOG_DBGID_NUM_MAX 256 /* Upper limit is width of mask */
++ /* if we get to this point, the packet is good */
++ /* remove header and adjust length */
++ pPacket->pBuffer += HTC_HDR_LENGTH;
++ pPacket->ActualLength -= HTC_HDR_LENGTH;
+
-+#define DBGLOG_MODULEID_OFFSET 26
-+#define DBGLOG_MODULEID_MASK 0x3C000000 /* Bit 26-29 */
-+#define DBGLOG_MODULEID_NUM_MAX 16 /* Upper limit is width of mask */
++ } while (FALSE);
+
-+/*
-+ * Please ensure that the definition of any new module intrduced is captured
-+ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The
-+ * structure is required for the parser to correctly pick up the values for
-+ * different modules.
-+ */
-+#define DBGLOG_MODULEID_START
-+#define DBGLOG_MODULEID_INF 0
-+#define DBGLOG_MODULEID_WMI 1
-+#define DBGLOG_MODULEID_CSERV 2
-+#define DBGLOG_MODULEID_PM 3
-+#define DBGLOG_MODULEID_TXRX_MGMTBUF 4
-+#define DBGLOG_MODULEID_TXRX_TXBUF 5
-+#define DBGLOG_MODULEID_TXRX_RXBUF 6
-+#define DBGLOG_MODULEID_WOW 7
-+#define DBGLOG_MODULEID_WHAL 8
-+#define DBGLOG_MODULEID_END
++ if (A_FAILED(status)) {
++ /* dump the whole packet */
++ DebugDumpBytes(pBuf,pPacket->ActualLength,"BAD HTC Recv PKT");
++ } else {
++#ifdef HTC_CAPTURE_LAST_FRAME
++ A_MEMCPY(&target->LastFrameHdr,pBuf,sizeof(HTC_FRAME_HDR));
++#endif
++ if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_RECV)) {
++ if (pPacket->ActualLength > 0) {
++ AR_DEBUG_PRINTBUF(pPacket->pBuffer,pPacket->ActualLength,"HTC - Application Msg");
++ }
++ }
++ }
+
-+#define DBGLOG_NUM_ARGS_OFFSET 30
-+#define DBGLOG_NUM_ARGS_MASK 0xC0000000 /* Bit 30-31 */
-+#define DBGLOG_NUM_ARGS_MAX 2 /* Upper limit is width of mask */
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCProcessRecvHeader \n"));
++ return status;
++}
+
-+#define DBGLOG_MODULE_LOG_ENABLE_OFFSET 0
-+#define DBGLOG_MODULE_LOG_ENABLE_MASK 0x0000FFFF
++/* asynchronous completion handler for recv packet fetching, when the device layer
++ * completes a read request, it will call this completion handler */
++void HTCRecvCompleteHandler(void *Context, HTC_PACKET *pPacket)
++{
++ HTC_TARGET *target = (HTC_TARGET *)Context;
++ HTC_ENDPOINT *pEndpoint;
++ A_UINT32 nextLookAhead = 0;
++ A_STATUS status;
+
-+#define DBGLOG_REPORTING_ENABLED_OFFSET 16
-+#define DBGLOG_REPORTING_ENABLED_MASK 0x00010000
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("+HTCRecvCompleteHandler (status:%d, ep:%d) \n",
++ pPacket->Status, pPacket->Endpoint));
+
-+#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
-+#define DBGLOG_TIMESTAMP_RESOLUTION_MASK 0x000E0000
++ AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
++ pEndpoint = &target->EndPoint[pPacket->Endpoint];
++ pPacket->Completion = NULL;
+
-+#define DBGLOG_REPORT_SIZE_OFFSET 20
-+#define DBGLOG_REPORT_SIZE_MASK 0x3FF00000
++ /* get completion status */
++ status = pPacket->Status;
+
-+#define DBGLOG_LOG_BUFFER_SIZE 1500
-+#define DBGLOG_DBGID_DEFINITION_LEN_MAX 64
++ do {
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HTCRecvCompleteHandler: request failed (status:%d, ep:%d) \n",
++ pPacket->Status, pPacket->Endpoint));
++ break;
++ }
++ /* process the header for any trailer data */
++ status = HTCProcessRecvHeader(target,pPacket,&nextLookAhead);
+
-+struct dbglog_buf_s {
-+ struct dbglog_buf_s *next;
-+ A_INT8 *buffer;
-+ A_UINT32 bufsize;
-+ A_UINT32 length;
-+ A_UINT32 count;
-+ A_UINT32 free;
-+};
++ if (A_FAILED(status)) {
++ break;
++ }
++ /* was there a lookahead for the next packet? */
++ if (nextLookAhead != 0) {
++ A_STATUS nextStatus;
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
++ ("HTCRecvCompleteHandler - next look ahead was non-zero : 0x%X \n",
++ nextLookAhead));
++ /* we have another packet, get the next packet fetch started (pipelined) before
++ * we call into the endpoint's callback, this will start another async request */
++ nextStatus = HTCRecvMessagePendingHandler(target,nextLookAhead,NULL);
++ if (A_EPROTO == nextStatus) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("Next look ahead from recv header was INVALID\n"));
++ DebugDumpBytes((A_UINT8 *)&nextLookAhead,
++ 4,
++ "BAD lookahead from lookahead report");
++ }
++ } else {
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
++ ("HTCRecvCompleteHandler - rechecking for more messages...\n"));
++ /* if we did not get anything on the look-ahead,
++ * call device layer to asynchronously re-check for messages. If we can keep the async
++ * processing going we get better performance. If there is a pending message we will keep processing
++ * messages asynchronously which should pipeline things nicely */
++ DevCheckPendingRecvMsgsAsync(&target->Device);
++ }
+
-+struct dbglog_hdr_s {
-+ struct dbglog_buf_s *dbuf;
-+ A_UINT32 dropped;
-+};
++ HTC_RX_STAT_PROFILE(target,pEndpoint,nextLookAhead);
++ DO_RCV_COMPLETION(target,pPacket,pEndpoint);
+
-+struct dbglog_config_s {
-+ A_UINT32 cfgvalid; /* Mask with valid config bits */
-+ union {
-+ /* TODO: Take care of endianness */
-+ struct {
-+ A_UINT32 mmask:16; /* Mask of modules with logging on */
-+ A_UINT32 rep:1; /* Reporting enabled or not */
-+ A_UINT32 tsr:3; /* Time stamp resolution. Def: 1 ms */
-+ A_UINT32 size:10; /* Report size in number of messages */
-+ A_UINT32 reserved:2;
-+ } dbglog_config;
++ } while (FALSE);
+
-+ A_UINT32 value;
-+ } u;
-+};
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCRecvCompleteHandler , message fetch failed (status = %d) \n",
++ status));
++ /* recyle this packet */
++ HTC_RECYCLE_RX_PKT(target, pPacket);
++ }
+
-+#define cfgmmask u.dbglog_config.mmask
-+#define cfgrep u.dbglog_config.rep
-+#define cfgtsr u.dbglog_config.tsr
-+#define cfgsize u.dbglog_config.size
-+#define cfgvalue u.value
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, ("-HTCRecvCompleteHandler\n"));
++}
+
-+#ifdef __cplusplus
++/* synchronously wait for a control message from the target,
++ * This function is used at initialization time ONLY. At init messages
++ * on ENDPOINT 0 are expected. */
++A_STATUS HTCWaitforControlMessage(HTC_TARGET *target, HTC_PACKET **ppControlPacket)
++{
++ A_STATUS status;
++ A_UINT32 lookAhead;
++ HTC_PACKET *pPacket = NULL;
++ HTC_FRAME_HDR *pHdr;
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCWaitforControlMessage \n"));
++
++ do {
++
++ *ppControlPacket = NULL;
++
++ /* call the polling function to see if we have a message */
++ status = DevPollMboxMsgRecv(&target->Device,
++ &lookAhead,
++ HTC_TARGET_RESPONSE_TIMEOUT);
++
++ if (A_FAILED(status)) {
++ break;
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
++ ("HTCWaitforControlMessage : lookAhead : 0x%X \n", lookAhead));
++
++ /* check the lookahead */
++ pHdr = (HTC_FRAME_HDR *)&lookAhead;
++
++ if (pHdr->EndpointID != ENDPOINT_0) {
++ /* unexpected endpoint number, should be zero */
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
++
++ if (A_FAILED(status)) {
++ /* bad message */
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
++
++ pPacket = HTC_ALLOC_CONTROL_RX(target);
++
++ if (pPacket == NULL) {
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_NO_MEMORY;
++ break;
++ }
++
++ pPacket->HTCReserved = lookAhead;
++ pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
++
++ if (pPacket->ActualLength > pPacket->BufferLength) {
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
++
++ /* we want synchronous operation */
++ pPacket->Completion = NULL;
++
++ /* get the message from the device, this will block */
++ status = HTCIssueRecv(target, pPacket);
++
++ if (A_FAILED(status)) {
++ break;
++ }
++
++ /* process receive header */
++ status = HTCProcessRecvHeader(target,pPacket,NULL);
++
++ pPacket->Status = status;
++
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCWaitforControlMessage, HTCProcessRecvHeader failed (status = %d) \n",
++ status));
++ break;
++ }
++
++ /* give the caller this control message packet, they are responsible to free */
++ *ppControlPacket = pPacket;
++
++ } while (FALSE);
++
++ if (A_FAILED(status)) {
++ if (pPacket != NULL) {
++ /* cleanup buffer on error */
++ HTC_FREE_CONTROL_RX(target,pPacket);
++ }
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCWaitforControlMessage \n"));
++
++ return status;
+}
-+#endif
+
-+#endif /* _DBGLOG_H_ */
-diff --git a/drivers/ar6000/include/dbglog_api.h b/drivers/ar6000/include/dbglog_api.h
++/* callback when device layer or lookahead report parsing detects a pending message */
++A_STATUS HTCRecvMessagePendingHandler(void *Context, A_UINT32 LookAhead, A_BOOL *pAsyncProc)
++{
++ HTC_TARGET *target = (HTC_TARGET *)Context;
++ A_STATUS status = A_OK;
++ HTC_PACKET *pPacket = NULL;
++ HTC_FRAME_HDR *pHdr;
++ HTC_ENDPOINT *pEndpoint;
++ A_BOOL asyncProc = FALSE;
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("+HTCRecvMessagePendingHandler LookAhead:0x%X \n",LookAhead));
++
++ if (IS_DEV_IRQ_PROCESSING_ASYNC_ALLOWED(&target->Device)) {
++ /* We use async mode to get the packets if the device layer supports it.
++ * The device layer interfaces with HIF in which HIF may have restrictions on
++ * how interrupts are processed */
++ asyncProc = TRUE;
++ }
++
++ if (pAsyncProc != NULL) {
++ /* indicate to caller how we decided to process this */
++ *pAsyncProc = asyncProc;
++ }
++
++ while (TRUE) {
++
++ pHdr = (HTC_FRAME_HDR *)&LookAhead;
++
++ if (pHdr->EndpointID >= ENDPOINT_MAX) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Endpoint in look-ahead: %d \n",pHdr->EndpointID));
++ /* invalid endpoint */
++ status = A_EPROTO;
++ break;
++ }
++
++ if (pHdr->PayloadLen > HTC_MAX_PAYLOAD_LENGTH) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Payload length %d exceeds max HTC : %d !\n",
++ pHdr->PayloadLen, HTC_MAX_PAYLOAD_LENGTH));
++ status = A_EPROTO;
++ break;
++ }
++
++ pEndpoint = &target->EndPoint[pHdr->EndpointID];
++
++ if (0 == pEndpoint->ServiceID) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Endpoint %d is not connected !\n",pHdr->EndpointID));
++ /* endpoint isn't even connected */
++ status = A_EPROTO;
++ break;
++ }
++
++ /* lock RX to get a buffer */
++ LOCK_HTC_RX(target);
++
++ /* get a packet from the endpoint recv queue */
++ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
++
++ if (NULL == pPacket) {
++ /* check for refill handler */
++ if (pEndpoint->EpCallBacks.EpRecvRefill != NULL) {
++ UNLOCK_HTC_RX(target);
++ /* call the re-fill handler */
++ pEndpoint->EpCallBacks.EpRecvRefill(pEndpoint->EpCallBacks.pContext,
++ pHdr->EndpointID);
++ LOCK_HTC_RX(target);
++ /* check if we have more buffers */
++ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
++ /* fall through */
++ }
++ }
++
++ if (NULL == pPacket) {
++ /* this is not an error, we simply need to mark that we are waiting for buffers.*/
++ target->HTCStateFlags |= HTC_STATE_WAIT_BUFFERS;
++ target->EpWaitingForBuffers = pHdr->EndpointID;
++ status = A_NO_MEMORY;
++ }
++
++ UNLOCK_HTC_RX(target);
++
++ if (A_FAILED(status)) {
++ /* no buffers */
++ break;
++ }
++
++ AR_DEBUG_ASSERT(pPacket->Endpoint == pHdr->EndpointID);
++
++ /* make sure this message can fit in the endpoint buffer */
++ if ((pHdr->PayloadLen + HTC_HDR_LENGTH) > pPacket->BufferLength) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("Payload Length Error : header reports payload of: %d, endpoint buffer size: %d \n",
++ pHdr->PayloadLen, pPacket->BufferLength));
++ status = A_EPROTO;
++ break;
++ }
++
++ pPacket->HTCReserved = LookAhead; /* set expected look ahead */
++ /* set the amount of data to fetch */
++ pPacket->ActualLength = pHdr->PayloadLen + HTC_HDR_LENGTH;
++
++ if (asyncProc) {
++ /* we use async mode to get the packet if the device layer supports it
++ * set our callback and context */
++ pPacket->Completion = HTCRecvCompleteHandler;
++ pPacket->pContext = target;
++ } else {
++ /* fully synchronous */
++ pPacket->Completion = NULL;
++ }
++
++ /* go fetch the packet */
++ status = HTCIssueRecv(target, pPacket);
++
++ if (A_FAILED(status)) {
++ break;
++ }
++
++ if (asyncProc) {
++ /* we did this asynchronously so we can get out of the loop, the asynch processing
++ * creates a chain of requests to continue processing pending messages in the
++ * context of callbacks */
++ break;
++ }
++
++ /* in the sync case, we process the packet, check lookaheads and then repeat */
++
++ LookAhead = 0;
++ status = HTCProcessRecvHeader(target,pPacket,&LookAhead);
++
++ if (A_FAILED(status)) {
++ break;
++ }
++
++ HTC_RX_STAT_PROFILE(target,pEndpoint,LookAhead);
++ DO_RCV_COMPLETION(target,pPacket,pEndpoint);
++
++ pPacket = NULL;
++
++ if (0 == LookAhead) {
++ break;
++ }
++
++ }
++
++ if (A_NO_MEMORY == status) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" Endpoint :%d has no buffers, blocking receiver to prevent overrun.. \n",
++ pHdr->EndpointID));
++ /* try to stop receive at the device layer */
++ DevStopRecv(&target->Device, asyncProc ? DEV_STOP_RECV_ASYNC : DEV_STOP_RECV_SYNC);
++ status = A_OK;
++ } else if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("Failed to get pending message : LookAhead Value: 0x%X (status = %d) \n",
++ LookAhead, status));
++ if (pPacket != NULL) {
++ /* clean up packet on error */
++ HTC_RECYCLE_RX_PKT(target, pPacket);
++ }
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,("-HTCRecvMessagePendingHandler \n"));
++
++ return status;
++}
++
++/* Makes a buffer available to the HTC module */
++A_STATUS HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HTC_ENDPOINT *pEndpoint;
++ A_BOOL unblockRecv = FALSE;
++ A_STATUS status = A_OK;
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
++ ("+- HTCAddReceivePkt: endPointId: %d, buffer: 0x%X, length: %d\n",
++ pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->BufferLength));
++
++ do {
++
++ if (HTC_STOPPING(target)) {
++ status = A_ECANCELED;
++ break;
++ }
++
++ AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
++
++ pEndpoint = &target->EndPoint[pPacket->Endpoint];
++
++ LOCK_HTC_RX(target);
++
++ /* store receive packet */
++ HTC_PACKET_ENQUEUE(&pEndpoint->RxBuffers, pPacket);
++
++ /* check if we are blocked waiting for a new buffer */
++ if (target->HTCStateFlags & HTC_STATE_WAIT_BUFFERS) {
++ if (target->EpWaitingForBuffers == pPacket->Endpoint) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV,(" receiver was blocked on ep:%d, unblocking.. \n",
++ target->EpWaitingForBuffers));
++ target->HTCStateFlags &= ~HTC_STATE_WAIT_BUFFERS;
++ target->EpWaitingForBuffers = ENDPOINT_MAX;
++ unblockRecv = TRUE;
++ }
++ }
++
++ UNLOCK_HTC_RX(target);
++
++ if (unblockRecv && !HTC_STOPPING(target)) {
++ /* TODO : implement a buffer threshold count? */
++ DevEnableRecv(&target->Device,DEV_ENABLE_RECV_SYNC);
++ }
++
++ } while (FALSE);
++
++ return status;
++}
++
++static void HTCFlushEndpointRX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint)
++{
++ HTC_PACKET *pPacket;
++
++ LOCK_HTC_RX(target);
++
++ while (1) {
++ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->RxBuffers);
++ if (NULL == pPacket) {
++ break;
++ }
++ UNLOCK_HTC_RX(target);
++ pPacket->Status = A_ECANCELED;
++ pPacket->ActualLength = 0;
++ AR_DEBUG_PRINTF(ATH_DEBUG_RECV, (" Flushing RX packet:0x%X, length:%d, ep:%d \n",
++ (A_UINT32)pPacket, pPacket->BufferLength, pPacket->Endpoint));
++ /* give the packet back */
++ pEndpoint->EpCallBacks.EpRecv(pEndpoint->EpCallBacks.pContext,
++ pPacket);
++ LOCK_HTC_RX(target);
++ }
++
++ UNLOCK_HTC_RX(target);
++
++
++}
++
++void HTCFlushRecvBuffers(HTC_TARGET *target)
++{
++ HTC_ENDPOINT *pEndpoint;
++ int i;
++
++ /* NOTE: no need to flush endpoint 0, these buffers were
++ * allocated as part of the HTC struct */
++ for (i = ENDPOINT_1; i < ENDPOINT_MAX; i++) {
++ pEndpoint = &target->EndPoint[i];
++ if (pEndpoint->ServiceID == 0) {
++ /* not in use.. */
++ continue;
++ }
++ HTCFlushEndpointRX(target,pEndpoint);
++ }
++
++
++}
++
++
+diff --git a/drivers/ar6000/htc/htc_send.c b/drivers/ar6000/htc/htc_send.c
new file mode 100644
-index 0000000..06c8102
+index 0000000..cf0dabe
--- /dev/null
-+++ b/drivers/ar6000/include/dbglog_api.h
-@@ -0,0 +1,46 @@
-+#ifndef _DBGLOG_API_H_
-+#define _DBGLOG_API_H_
++++ b/drivers/ar6000/htc/htc_send.c
+@@ -0,0 +1,538 @@
+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ *
+ *
-+ * This file contains host side debug primitives.
+ */
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include "dbglog.h"
++#include "htc_internal.h"
+
-+#define DBGLOG_HOST_LOG_BUFFER_SIZE DBGLOG_LOG_BUFFER_SIZE
++#define DO_EP_TX_COMPLETION(ep,p) \
++{ \
++ (p)->Completion = NULL; \
++ (ep)->EpCallBacks.EpTxComplete((ep)->EpCallBacks.pContext,(p)); \
++}
+
-+#define DBGLOG_GET_DBGID(arg) \
-+ ((arg & DBGLOG_DBGID_MASK) >> DBGLOG_DBGID_OFFSET)
+
-+#define DBGLOG_GET_MODULEID(arg) \
-+ ((arg & DBGLOG_MODULEID_MASK) >> DBGLOG_MODULEID_OFFSET)
++/* call the distribute credits callback with the distribution */
++#define DO_DISTRIBUTION(t,reason,description,pList) \
++{ \
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, \
++ (" calling distribute function (%s) (dfn:0x%X, ctxt:0x%X, dist:0x%X) \n", \
++ (description), \
++ (A_UINT32)(t)->DistributeCredits, \
++ (A_UINT32)(t)->pCredDistContext, \
++ (A_UINT32)pList)); \
++ (t)->DistributeCredits((t)->pCredDistContext, \
++ (pList), \
++ (reason)); \
++}
+
-+#define DBGLOG_GET_NUMARGS(arg) \
-+ ((arg & DBGLOG_NUM_ARGS_MASK) >> DBGLOG_NUM_ARGS_OFFSET)
++/* our internal send packet completion handler when packets are submited to the AR6K device
++ * layer */
++static void HTCSendPktCompletionHandler(void *Context, HTC_PACKET *pPacket)
++{
++ HTC_TARGET *target = (HTC_TARGET *)Context;
++ HTC_ENDPOINT *pEndpoint = &target->EndPoint[pPacket->Endpoint];
+
-+#define DBGLOG_GET_TIMESTAMP(arg) \
-+ ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
+
-+#ifdef __cplusplus
++ if (A_FAILED(pPacket->Status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCSendPktCompletionHandler: request failed (status:%d, ep:%d) \n",
++ pPacket->Status, pPacket->Endpoint));
++ }
++ /* first, fixup the head room we allocated */
++ pPacket->pBuffer += HTC_HDR_LENGTH;
++ /* do completion */
++ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
+}
-+#endif
+
-+#endif /* _DBGLOG_API_H_ */
-diff --git a/drivers/ar6000/include/dbglog_id.h b/drivers/ar6000/include/dbglog_id.h
-new file mode 100644
-index 0000000..ce22b16
---- /dev/null
-+++ b/drivers/ar6000/include/dbglog_id.h
-@@ -0,0 +1,307 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ * This file contains the definitions of the debug identifiers for different
-+ * modules.
-+ *
-+ */
++A_STATUS HTCIssueSend(HTC_TARGET *target, HTC_PACKET *pPacket, A_UINT8 SendFlags)
++{
++ A_STATUS status;
++ A_UINT8 *pHdrBuf;
++ A_BOOL sync = FALSE;
+
-+#ifndef _DBGLOG_ID_H_
-+#define _DBGLOG_ID_H_
++ /* caller always provides headrooom */
++ pPacket->pBuffer -= HTC_HDR_LENGTH;
++ pHdrBuf = pPacket->pBuffer;
++ /* setup frame header */
++ A_SET_UINT16_FIELD(pHdrBuf,HTC_FRAME_HDR,PayloadLen,(A_UINT16)pPacket->ActualLength);
++ A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,Flags,SendFlags);
++ A_SET_UINT8_FIELD(pHdrBuf,HTC_FRAME_HDR,EndpointID, (A_UINT8)pPacket->Endpoint);
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
++ if (pPacket->Completion == NULL) {
++ /* mark that this request was synchronously issued */
++ sync = TRUE;
++ }
+
-+/*
-+ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
-+ * Please ensure that the definition of any new debugid introduced is captured
-+ * between the <MODULE>_DBGID_DEFINITION_START and
-+ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the
-+ * parser to correctly pick up the values for different debug identifiers.
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
++ ("+-HTCIssueSend: transmit length : %d (%s) \n",
++ pPacket->ActualLength + HTC_HDR_LENGTH,
++ sync ? "SYNC" : "ASYNC" ));
+
-+/* INF debug identifier definitions */
-+#define INF_DBGID_DEFINITION_START
-+#define INF_ASSERTION_FAILED 1
-+#define INF_TARGET_ID 2
-+#define INF_DBGID_DEFINITION_END
++ /* send message to device */
++ status = DevSendPacket(&target->Device,
++ pPacket,
++ pPacket->ActualLength + HTC_HDR_LENGTH);
+
-+/* WMI debug identifier definitions */
-+#define WMI_DBGID_DEFINITION_START
-+#define WMI_CMD_RX_XTND_PKT_TOO_SHORT 1
-+#define WMI_EXTENDED_CMD_NOT_HANDLED 2
-+#define WMI_CMD_RX_PKT_TOO_SHORT 3
-+#define WMI_CALLING_WMI_EXTENSION_FN 4
-+#define WMI_CMD_NOT_HANDLED 5
-+#define WMI_IN_SYNC 6
-+#define WMI_TARGET_WMI_SYNC_CMD 7
-+#define WMI_SET_SNR_THRESHOLD_PARAMS 8
-+#define WMI_SET_RSSI_THRESHOLD_PARAMS 9
-+#define WMI_SET_LQ_TRESHOLD_PARAMS 10
-+#define WMI_TARGET_CREATE_PSTREAM_CMD 11
-+#define WMI_WI_DTM_INUSE 12
-+#define WMI_TARGET_DELETE_PSTREAM_CMD 13
-+#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD 14
-+#define WMI_TARGET_GET_BIT_RATE_CMD 15
-+#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS 16
-+#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD 17
-+#define WMI_TARGET_GET_TX_PWR_CMD 18
-+#define WMI_FREE_EVBUF_WMIBUF 19
-+#define WMI_FREE_EVBUF_DATABUF 20
-+#define WMI_FREE_EVBUF_BADFLAG 21
-+#define WMI_HTC_RX_ERROR_DATA_PACKET 22
-+#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX 23
-+#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT 24
-+#define WMI_SENDING_READY_EVENT 25
-+#define WMI_SETPOWER_MDOE_TO_MAXPERF 26
-+#define WMI_SETPOWER_MDOE_TO_REC 27
-+#define WMI_BSSINFO_EVENT_FROM 28
-+#define WMI_TARGET_GET_STATS_CMD 29
-+#define WMI_SENDING_SCAN_COMPLETE_EVENT 30
-+#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT 31
-+#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT 32
-+#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT 33
-+#define WMI_SENDING_ERROR_REPORT_EVENT 34
-+#define WMI_SENDING_CAC_EVENT 35
-+#define WMI_TARGET_GET_ROAM_TABLE_CMD 36
-+#define WMI_TARGET_GET_ROAM_DATA_CMD 37
-+#define WMI_SENDING_GPIO_INTR_EVENT 38
-+#define WMI_SENDING_GPIO_ACK_EVENT 39
-+#define WMI_SENDING_GPIO_DATA_EVENT 40
-+#define WMI_CMD_RX 41
-+#define WMI_CMD_RX_XTND 42
-+#define WMI_EVENT_SEND 43
-+#define WMI_EVENT_SEND_XTND 44
-+#define WMI_DBGID_DEFINITION_END
++ if (sync) {
++ /* use local sync variable. If this was issued asynchronously, pPacket is no longer
++ * safe to access. */
++ pPacket->pBuffer += HTC_HDR_LENGTH;
++ }
+
-+/* CSERV debug identifier definitions */
-+#define CSERV_DBGID_DEFINITION_START
-+#define CSERV_BEGIN_SCAN1 1
-+#define CSERV_BEGIN_SCAN2 2
-+#define CSERV_END_SCAN1 3
-+#define CSERV_END_SCAN2 4
-+#define CSERV_CHAN_SCAN_START 5
-+#define CSERV_CHAN_SCAN_STOP 6
-+#define CSERV_CHANNEL_OPPPORTUNITY 7
-+#define CSERV_NC_TIMEOUT 8
-+#define CSERV_BACK_HOME 10
-+#define CSERV_CHMGR_CH_CALLBACK1 11
-+#define CSERV_CHMGR_CH_CALLBACK2 12
-+#define CSERV_CHMGR_CH_CALLBACK3 13
-+#define CSERV_SET_SCAN_PARAMS1 14
-+#define CSERV_SET_SCAN_PARAMS2 15
-+#define CSERV_SET_SCAN_PARAMS3 16
-+#define CSERV_SET_SCAN_PARAMS4 17
-+#define CSERV_ABORT_SCAN 18
-+#define CSERV_NEWSTATE 19
-+#define CSERV_MINCHMGR_OP_END 20
-+#define CSERV_CHMGR_OP_END 21
-+#define CSERV_DISCONNECT_TIMEOUT 22
-+#define CSERV_ROAM_TIMEOUT 23
-+#define CSERV_FORCE_SCAN1 24
-+#define CSERV_FORCE_SCAN2 25
-+#define CSERV_FORCE_SCAN3 26
-+#define CSERV_UTIL_TIMEOUT 27
-+#define CSERV_RSSIPOLLER 28
-+#define CSERV_RETRY_CONNECT_TIMEOUT 29
-+#define CSERV_RSSIINDBMPOLLER 30
-+#define CSERV_BGSCAN_ENABLE 31
-+#define CSERV_BGSCAN_DISABLE 32
-+#define CSERV_WLAN_START_SCAN_CMD1 33
-+#define CSERV_WLAN_START_SCAN_CMD2 34
-+#define CSERV_WLAN_START_SCAN_CMD3 35
-+#define CSERV_START_SCAN_CMD 36
-+#define CSERV_START_FORCE_SCAN 37
-+#define CSERV_NEXT_CHAN 38
-+#define CSERV_SET_REGCODE 39
-+#define CSERV_START_ADHOC 40
-+#define CSERV_ADHOC_AT_HOME 41
-+#define CSERV_OPT_AT_HOME 42
-+#define CSERV_WLAN_CONNECT_CMD 43
-+#define CSERV_WLAN_RECONNECT_CMD 44
-+#define CSERV_WLAN_DISCONNECT_CMD 45
-+#define CSERV_BSS_CHANGE_CHANNEL 46
-+#define CSERV_BEACON_RX 47
-+#define CSERV_KEEPALIVE_CHECK 48
-+#define CSERV_RC_BEGIN_SCAN 49
-+#define CSERV_RC_SCAN_START 50
-+#define CSERV_RC_SCAN_STOP 51
-+#define CSERV_RC_NEXT 52
-+#define CSERV_RC_SCAN_END 53
-+#define CSERV_PROBE_CALLBACK 54
-+#define CSERV_ROAM1 55
-+#define CSERV_ROAM2 56
-+#define CSERV_ROAM3 57
-+#define CSERV_CONNECT_EVENT 58
-+#define CSERV_DISCONNECT_EVENT 59
-+#define CSERV_BMISS_HANDLER1 60
-+#define CSERV_BMISS_HANDLER2 61
-+#define CSERV_BMISS_HANDLER3 62
-+#define CSERV_LOWRSSI_HANDLER 63
-+#define CSERV_WLAN_SET_PMKID_CMD 64
-+#define CSERV_RECONNECT_REQUEST 65
-+#define CSERV_KEYSPLUMBED_EVENT 66
-+#define CSERV_NEW_REG 67
-+#define CSERV_SET_RSSI_THOLD 68
-+#define CSERV_RSSITHRESHOLDCHECK 69
-+#define CSERV_RSSIINDBMTHRESHOLDCHECK 70
-+#define CSERV_WLAN_SET_OPT_CMD1 71
-+#define CSERV_WLAN_SET_OPT_CMD2 72
-+#define CSERV_WLAN_SET_OPT_CMD3 73
-+#define CSERV_WLAN_SET_OPT_CMD4 74
-+#define CSERV_SCAN_CONNECT_STOP 75
-+#define CSERV_BMISS_HANDLER4 76
-+#define CSERV_INITIALIZE_TIMER 77
-+#define CSERV_ARM_TIMER 78
-+#define CSERV_DISARM_TIMER 79
-+#define CSERV_UNINITIALIZE_TIMER 80
-+#define CSERV_DISCONNECT_EVENT2 81
-+#define CSERV_SCAN_CONNECT_START 82
-+#define CSERV_BSSINFO_MEMORY_ALLOC_FAILED 83
-+#define CSERV_SET_SCAN_PARAMS5 84
-+#define CSERV_DBGID_DEFINITION_END
++ /* if this request was asynchronous, the packet completion routine will be invoked by
++ * the device layer when the HIF layer completes the request */
+
-+/* TXRX debug identifier definitions */
-+#define TXRX_TXBUF_DBGID_DEFINITION_START
-+#define TXRX_TXBUF_ALLOCATE_BUF 1
-+#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX 2
-+#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ 3
-+#define TXRX_TXBUF_TXQ_DEPTH 4
-+#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ 5
-+#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ 6
-+#define TXRX_TXBUF_INITIALIZE_TIMER 7
-+#define TXRX_TXBUF_ARM_TIMER 8
-+#define TXRX_TXBUF_DISARM_TIMER 9
-+#define TXRX_TXBUF_UNINITIALIZE_TIMER 10
-+#define TXRX_TXBUF_DBGID_DEFINITION_END
++ return status;
++}
+
-+#define TXRX_RXBUF_DBGID_DEFINITION_START
-+#define TXRX_RXBUF_ALLOCATE_BUF 1
-+#define TXRX_RXBUF_QUEUE_TO_HOST 2
-+#define TXRX_RXBUF_QUEUE_TO_WLAN 3
-+#define TXRX_RXBUF_ZERO_LEN_BUF 4
-+#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN 5
-+#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF 6
-+#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN 7
-+#define TXRX_RXBUF_SEND_TO_RECV_MGMT 8
-+#define TXRX_RXBUF_SEND_TO_IEEE_LAYER 9
-+#define TXRX_RXBUF_DBGID_DEFINITION_END
++/* try to send the current packet or a packet at the head of the TX queue,
++ * if there are no credits, the packet remains in the queue. */
++static void HTCTrySend(HTC_TARGET *target,
++ HTC_PACKET *pPacketToSend,
++ HTC_ENDPOINT_ID ep)
++{
++ HTC_PACKET *pPacket;
++ HTC_ENDPOINT *pEndpoint;
++ int creditsRequired;
++ A_UINT8 sendFlags;
+
-+#define TXRX_MGMTBUF_DBGID_DEFINITION_START
-+#define TXRX_MGMTBUF_ALLOCATE_BUF 1
-+#define TXRX_MGMTBUF_ALLOCATE_SM_BUF 2
-+#define TXRX_MGMTBUF_ALLOCATE_RMBUF 3
-+#define TXRX_MGMTBUF_GET_BUF 4
-+#define TXRX_MGMTBUF_GET_SM_BUF 5
-+#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ 6
-+#define TXRX_MGMTBUF_REAPED_BUF 7
-+#define TXRX_MGMTBUF_REAPED_SM_BUF 8
-+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN 9
-+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN 10
-+#define TXRX_MGMTBUF_ENQUEUE_INTO_SFQ 11
-+#define TXRX_MGMTBUF_DEQUEUE_FROM_SFQ 12
-+#define TXRX_MGMTBUF_PAUSE_TXQ 13
-+#define TXRX_MGMTBUF_RESUME_TXQ 14
-+#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT 15
-+#define TXRX_MGMTBUF_DRAINQ 16
-+#define TXRX_MGMTBUF_INDICATE_Q_DRAINED 17
-+#define TXRX_MGMTBUF_DBGID_DEFINITION_END
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("+HTCTrySend (pPkt:0x%X)\n",(A_UINT32)pPacketToSend));
+
-+/* PM (Power Module) debug identifier definitions */
-+#define PM_DBGID_DEFINITION_START
-+#define PM_INIT 1
-+#define PM_ENABLE 2
-+#define PM_SET_STATE 3
-+#define PM_SET_POWERMODE 4
-+#define PM_CONN_NOTIFY 5
-+#define PM_REF_COUNT_NEGATIVE 6
-+#define PM_APSD_ENABLE 7
-+#define PM_UPDATE_APSD_STATE 8
-+#define PM_CHAN_OP_REQ 9
-+#define PM_SET_MY_BEACON_POLICY 10
-+#define PM_SET_ALL_BEACON_POLICY 11
-+#define PM_SET_PM_PARAMS1 12
-+#define PM_SET_PM_PARAMS2 13
-+#define PM_ADHOC_SET_PM_CAPS_FAIL 14
-+#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID 15
-+#define PM_DBGID_DEFINITION_END
++ pEndpoint = &target->EndPoint[ep];
+
-+/* Wake on Wireless debug identifier definitions */
-+#define WOW_DBGID_DEFINITION_START
-+#define WOW_INIT 1
-+#define WOW_GET_CONFIG_DSET 2
-+#define WOW_NO_CONFIG_DSET 3
-+#define WOW_INVALID_CONFIG_DSET 4
-+#define WOW_USE_DEFAULT_CONFIG 5
-+#define WOW_SETUP_GPIO 6
-+#define WOW_INIT_DONE 7
-+#define WOW_SET_GPIO_PIN 8
-+#define WOW_CLEAR_GPIO_PIN 9
-+#define WOW_SET_WOW_MODE_CMD 10
-+#define WOW_SET_HOST_MODE_CMD 11
-+#define WOW_ADD_WOW_PATTERN_CMD 12
-+#define WOW_NEW_WOW_PATTERN_AT_INDEX 13
-+#define WOW_DEL_WOW_PATTERN_CMD 14
-+#define WOW_LIST_CONTAINS_PATTERNS 15
-+#define WOW_GET_WOW_LIST_CMD 16
-+#define WOW_INVALID_FILTER_ID 17
-+#define WOW_INVALID_FILTER_LISTID 18
-+#define WOW_NO_VALID_FILTER_AT_ID 19
-+#define WOW_NO_VALID_LIST_AT_ID 20
-+#define WOW_NUM_PATTERNS_EXCEEDED 21
-+#define WOW_NUM_LISTS_EXCEEDED 22
-+#define WOW_GET_WOW_STATS 23
-+#define WOW_CLEAR_WOW_STATS 24
-+#define WOW_WAKEUP_HOST 25
-+#define WOW_EVENT_WAKEUP_HOST 26
-+#define WOW_EVENT_DISCARD 27
-+#define WOW_PATTERN_MATCH 28
-+#define WOW_PATTERN_NOT_MATCH 29
-+#define WOW_PATTERN_NOT_MATCH_OFFSET 30
-+#define WOW_DISABLED_HOST_ASLEEP 31
-+#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS 32
-+#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND 33
-+#define WOW_DBGID_DEFINITION_END
++ LOCK_HTC_TX(target);
+
-+/* WHAL debug identifier definitions */
-+#define WHAL_DBGID_DEFINITION_START
-+#define WHAL_ERROR_ANI_CONTROL 1
-+#define WHAL_ERROR_CHIP_TEST1 2
-+#define WHAL_ERROR_CHIP_TEST2 3
-+#define WHAL_ERROR_EEPROM_CHECKSUM 4
-+#define WHAL_ERROR_EEPROM_MACADDR 5
-+#define WHAL_ERROR_INTERRUPT_HIU 6
-+#define WHAL_ERROR_KEYCACHE_RESET 7
-+#define WHAL_ERROR_KEYCACHE_SET 8
-+#define WHAL_ERROR_KEYCACHE_TYPE 9
-+#define WHAL_ERROR_KEYCACHE_TKIPENTRY 10
-+#define WHAL_ERROR_KEYCACHE_WEPLENGTH 11
-+#define WHAL_ERROR_PHY_INVALID_CHANNEL 12
-+#define WHAL_ERROR_POWER_AWAKE 13
-+#define WHAL_ERROR_POWER_SET 14
-+#define WHAL_ERROR_RECV_STOPDMA 15
-+#define WHAL_ERROR_RECV_STOPPCU 16
-+#define WHAL_ERROR_RESET_CHANNF1 17
-+#define WHAL_ERROR_RESET_CHANNF2 18
-+#define WHAL_ERROR_RESET_PM 19
-+#define WHAL_ERROR_RESET_OFFSETCAL 20
-+#define WHAL_ERROR_RESET_RFGRANT 21
-+#define WHAL_ERROR_RESET_RXFRAME 22
-+#define WHAL_ERROR_RESET_STOPDMA 23
-+#define WHAL_ERROR_RESET_RECOVER 24
-+#define WHAL_ERROR_XMIT_COMPUTE 25
-+#define WHAL_ERROR_XMIT_NOQUEUE 26
-+#define WHAL_ERROR_XMIT_ACTIVEQUEUE 27
-+#define WHAL_ERROR_XMIT_BADTYPE 28
-+#define WHAL_DBGID_DEFINITION_END
++ if (pPacketToSend != NULL) {
++ /* caller supplied us a packet to queue to the tail of the HTC TX queue before
++ * we check the tx queue */
++ HTC_PACKET_ENQUEUE(&pEndpoint->TxQueue,pPacketToSend);
++ pEndpoint->CurrentTxQueueDepth++;
++ }
+
-+#ifdef __cplusplus
-+}
-+#endif
++ /* now drain the TX queue for transmission as long as we have enough
++ * credits */
+
-+#endif /* _DBGLOG_ID_H_ */
-diff --git a/drivers/ar6000/include/dl_list.h b/drivers/ar6000/include/dl_list.h
-new file mode 100644
-index 0000000..4b9c581
---- /dev/null
-+++ b/drivers/ar6000/include/dl_list.h
-@@ -0,0 +1,114 @@
-+/*
-+ *
-+ * Double-link list definitions (adapted from Atheros SDIO stack)
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
-+#ifndef __DL_LIST_H___
-+#define __DL_LIST_H___
++ while (1) {
+
-+#define A_CONTAINING_STRUCT(address, struct_type, field_name)\
-+ ((struct_type *)((A_UINT32)(address) - (A_UINT32)(&((struct_type *)0)->field_name)))
++ if (HTC_QUEUE_EMPTY(&pEndpoint->TxQueue)) {
++ /* nothing in the queue */
++ break;
++ }
+
-+/* list functions */
-+/* pointers for the list */
-+typedef struct _DL_LIST {
-+ struct _DL_LIST *pPrev;
-+ struct _DL_LIST *pNext;
-+}DL_LIST, *PDL_LIST;
-+/*
-+ * DL_LIST_INIT , initialize doubly linked list
-+*/
-+#define DL_LIST_INIT(pList)\
-+ {(pList)->pPrev = pList; (pList)->pNext = pList;}
++ sendFlags = 0;
+
-+#define DL_LIST_IS_EMPTY(pList) (((pList)->pPrev == (pList)) && ((pList)->pNext == (pList)))
-+#define DL_LIST_GET_ITEM_AT_HEAD(pList) (pList)->pNext
-+#define DL_LIST_GET_ITEM_AT_TAIL(pList) (pList)->pPrev
-+/*
-+ * ITERATE_OVER_LIST pStart is the list, pTemp is a temp list member
-+ * NOT: do not use this function if the items in the list are deleted inside the
-+ * iteration loop
-+*/
-+#define ITERATE_OVER_LIST(pStart, pTemp) \
-+ for((pTemp) =(pStart)->pNext; pTemp != (pStart); (pTemp) = (pTemp)->pNext)
++ /* get packet at head, but don't remove it */
++ pPacket = HTC_GET_PKT_AT_HEAD(&pEndpoint->TxQueue);
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Got head packet:0x%X , Queue Depth: %d\n",
++ (A_UINT32)pPacket, pEndpoint->CurrentTxQueueDepth));
+
++ /* figure out how many credits this message requires */
++ creditsRequired = pPacket->ActualLength + HTC_HDR_LENGTH;
++ creditsRequired += target->TargetCreditSize - 1;
++ creditsRequired /= target->TargetCreditSize;
+
-+/* safe iterate macro that allows the item to be removed from the list
-+ * the iteration continues to the next item in the list
-+ */
-+#define ITERATE_OVER_LIST_ALLOW_REMOVE(pStart,pItem,st,offset) \
-+{ \
-+ PDL_LIST pTemp; \
-+ pTemp = (pStart)->pNext; \
-+ while (pTemp != (pStart)) { \
-+ (pItem) = A_CONTAINING_STRUCT(pTemp,st,offset); \
-+ pTemp = pTemp->pNext; \
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Creds Required:%d Got:%d\n",
++ creditsRequired, pEndpoint->CreditDist.TxCredits));
+
-+#define ITERATE_END }}
++ if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
+
-+/*
-+ * DL_ListInsertTail - insert pAdd to the end of the list
-+*/
-+static INLINE PDL_LIST DL_ListInsertTail(PDL_LIST pList, PDL_LIST pAdd) {
-+ /* insert at tail */
-+ pAdd->pPrev = pList->pPrev;
-+ pAdd->pNext = pList;
-+ pList->pPrev->pNext = pAdd;
-+ pList->pPrev = pAdd;
-+ return pAdd;
-+}
++ /* not enough credits */
+
-+/*
-+ * DL_ListInsertHead - insert pAdd into the head of the list
-+*/
-+static INLINE PDL_LIST DL_ListInsertHead(PDL_LIST pList, PDL_LIST pAdd) {
-+ /* insert at head */
-+ pAdd->pPrev = pList;
-+ pAdd->pNext = pList->pNext;
-+ pList->pNext->pPrev = pAdd;
-+ pList->pNext = pAdd;
-+ return pAdd;
-+}
++ if (pPacket->Endpoint == ENDPOINT_0) {
++ /* leave it in the queue */
++ break;
++ }
++ /* invoke the registered distribution function only if this is not
++ * endpoint 0, we let the driver layer provide more credits if it can.
++ * We pass the credit distribution list starting at the endpoint in question
++ * */
+
-+#define DL_ListAdd(pList,pItem) DL_ListInsertHead((pList),(pItem))
-+/*
-+ * DL_ListRemove - remove pDel from list
-+*/
-+static INLINE PDL_LIST DL_ListRemove(PDL_LIST pDel) {
-+ pDel->pNext->pPrev = pDel->pPrev;
-+ pDel->pPrev->pNext = pDel->pNext;
-+ /* point back to itself just to be safe, incase remove is called again */
-+ pDel->pNext = pDel;
-+ pDel->pPrev = pDel;
-+ return pDel;
-+}
++ /* set how many credits we need */
++ pEndpoint->CreditDist.TxCreditsSeek =
++ creditsRequired - pEndpoint->CreditDist.TxCredits;
++ DO_DISTRIBUTION(target,
++ HTC_CREDIT_DIST_SEEK_CREDITS,
++ "Seek Credits",
++ &pEndpoint->CreditDist);
+
-+/*
-+ * DL_ListRemoveItemFromHead - get a list item from the head
-+*/
-+static INLINE PDL_LIST DL_ListRemoveItemFromHead(PDL_LIST pList) {
-+ PDL_LIST pItem = NULL;
-+ if (pList->pNext != pList) {
-+ pItem = pList->pNext;
-+ /* remove the first item from head */
-+ DL_ListRemove(pItem);
-+ }
-+ return pItem;
-+}
++ pEndpoint->CreditDist.TxCreditsSeek = 0;
+
-+#endif /* __DL_LIST_H___ */
-diff --git a/drivers/ar6000/include/dset_api.h b/drivers/ar6000/include/dset_api.h
-new file mode 100644
-index 0000000..de5cc6a
---- /dev/null
-+++ b/drivers/ar6000/include/dset_api.h
-@@ -0,0 +1,63 @@
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/dset_api.h#1 $
-+ *
-+ * Host-side DataSet API.
-+ *
-+ */
++ if (pEndpoint->CreditDist.TxCredits < creditsRequired) {
++ /* still not enough credits to send, leave packet in the queue */
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
++ (" Not enough credits for ep %d leaving packet in queue..\n",
++ pPacket->Endpoint));
++ break;
++ }
+
-+#ifndef _DSET_API_H_
-+#define _DSET_API_H_
++ }
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
++ pEndpoint->CreditDist.TxCredits -= creditsRequired;
++ INC_HTC_EP_STAT(pEndpoint, TxCreditsConsummed, creditsRequired);
+
-+/*
-+ * Host-side DataSet support is optional, and is not
-+ * currently required for correct operation. To disable
-+ * Host-side DataSet support, set this to 0.
-+ */
-+#ifndef CONFIG_HOST_DSET_SUPPORT
-+#define CONFIG_HOST_DSET_SUPPORT 1
-+#endif
++ /* check if we need credits */
++ if (pEndpoint->CreditDist.TxCredits < pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
++ sendFlags |= HTC_FLAGS_NEED_CREDIT_UPDATE;
++ INC_HTC_EP_STAT(pEndpoint, TxCreditLowIndications, 1);
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,(" Host Needs Credits \n"));
++ }
+
-+/* Called to send a DataSet Open Reply back to the Target. */
-+A_STATUS wmi_dset_open_reply(struct wmi_t *wmip,
-+ A_UINT32 status,
-+ A_UINT32 access_cookie,
-+ A_UINT32 size,
-+ A_UINT32 version,
-+ A_UINT32 targ_handle,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg);
++ /* now we can fully dequeue */
++ pPacket = HTC_PACKET_DEQUEUE(&pEndpoint->TxQueue);
++ pEndpoint->CurrentTxQueueDepth--;
+
-+/* Called to send a DataSet Data Reply back to the Target. */
-+A_STATUS wmi_dset_data_reply(struct wmi_t *wmip,
-+ A_UINT32 status,
-+ A_UINT8 *host_buf,
-+ A_UINT32 length,
-+ A_UINT32 targ_buf,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg);
++ INC_HTC_EP_STAT(pEndpoint, TxIssued, 1);
+
-+#ifdef __cplusplus
++ UNLOCK_HTC_TX(target);
++
++ HTCIssueSend(target, pPacket, sendFlags);
++
++ LOCK_HTC_TX(target);
++
++ /* go back and check for more messages */
++ }
++
++ if (pEndpoint->CurrentTxQueueDepth >= pEndpoint->MaxTxQueueDepth) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Endpoint %d, TX queue is full, Depth:%d, Max:%d \n",
++ ep, pEndpoint->CurrentTxQueueDepth, pEndpoint->MaxTxQueueDepth));
++ UNLOCK_HTC_TX(target);
++ /* queue is now full, let caller know */
++ if (pEndpoint->EpCallBacks.EpSendFull != NULL) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Calling driver's send full callback.... \n"));
++ pEndpoint->EpCallBacks.EpSendFull(pEndpoint->EpCallBacks.pContext, ep);
++ }
++ } else {
++ UNLOCK_HTC_TX(target);
++ /* queue is now available for new packet, let caller know */
++ if (pEndpoint->EpCallBacks.EpSendAvail)
++ pEndpoint->EpCallBacks.EpSendAvail(pEndpoint->EpCallBacks.pContext, ep);
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,("-HTCTrySend: \n"));
+}
-+#endif /* __cplusplus */
+
++/* HTC API - HTCSendPkt */
++A_STATUS HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HTC_ENDPOINT *pEndpoint;
++ HTC_ENDPOINT_ID ep;
++ A_STATUS status = A_OK;
+
-+#endif /* _DSET_API_H_ */
-diff --git a/drivers/ar6000/include/dset_internal.h b/drivers/ar6000/include/dset_internal.h
-new file mode 100644
-index 0000000..f0be380
---- /dev/null
-+++ b/drivers/ar6000/include/dset_internal.h
-@@ -0,0 +1,39 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
++ ("+HTCSendPkt: Enter endPointId: %d, buffer: 0x%X, length: %d \n",
++ pPacket->Endpoint, (A_UINT32)pPacket->pBuffer, pPacket->ActualLength));
+
-+#ifndef __DSET_INTERNAL_H__
-+#define __DSET_INTERNAL_H__
++ ep = pPacket->Endpoint;
++ AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
++ pEndpoint = &target->EndPoint[ep];
+
-+/*
-+ * Internal dset definitions, common for DataSet layer.
-+ */
++ do {
+
-+#define DSET_TYPE_STANDARD 0
-+#define DSET_TYPE_BPATCHED 1
-+#define DSET_TYPE_COMPRESSED 2
++ if (HTC_STOPPING(target)) {
++ status = A_ECANCELED;
++ pPacket->Status = status;
++ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
++ break;
++ }
++ /* everything sent through this interface is asynchronous */
++ /* fill in HTC completion routines */
++ pPacket->Completion = HTCSendPktCompletionHandler;
++ pPacket->pContext = target;
+
-+/* Dataset descriptor */
++ HTCTrySend(target, pPacket, ep);
+
-+typedef struct dset_descriptor_s {
-+ struct dset_descriptor_s *next; /* List link. NULL only at the last
-+ descriptor */
-+ A_UINT16 id; /* Dset ID */
-+ A_UINT16 size; /* Dset size. */
-+ void *DataPtr; /* Pointer to raw data for standard
-+ DataSet or pointer to original
-+ dset_descriptor for patched
-+ DataSet */
-+ A_UINT32 data_type; /* DSET_TYPE_*, above */
++ } while (FALSE);
+
-+ void *AuxPtr; /* Additional data that might
-+ needed for data_type. For
-+ example, pointer to patch
-+ Dataset descriptor for BPatch. */
-+} dset_descriptor_t;
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCSendPkt \n"));
+
-+#endif /* __DSET_INTERNAL_H__ */
-diff --git a/drivers/ar6000/include/dsetid.h b/drivers/ar6000/include/dsetid.h
-new file mode 100644
-index 0000000..85729f8
---- /dev/null
-+++ b/drivers/ar6000/include/dsetid.h
-@@ -0,0 +1,110 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
++ return status;
++}
+
-+#ifndef __DSETID_H__
-+#define __DSETID_H__
+
-+/* Well-known DataSet IDs */
-+#define DSETID_UNUSED 0x00000000
-+#define DSETID_BOARD_DATA 0x00000001 /* Cal and board data */
-+#define DSETID_REGDB 0x00000002 /* Regulatory Database */
-+#define DSETID_POWER_CONTROL 0x00000003 /* TX Pwr Lim & Ant Gain */
-+#define DSETID_USER_CONFIG 0x00000004 /* User Configuration */
++/* check TX queues to drain because of credit distribution update */
++static INLINE void HTCCheckEndpointTxQueues(HTC_TARGET *target)
++{
++ HTC_ENDPOINT *pEndpoint;
++ HTC_ENDPOINT_CREDIT_DIST *pDistItem;
+
-+#define DSETID_ANALOG_CONTROL_DATA_START 0x00000005
-+#define DSETID_ANALOG_CONTROL_DATA_END 0x00000025
-+/*
-+ * Get DSETID for various reference clock speeds.
-+ * For each speed there are three DataSets that correspond
-+ * to the three columns of bank6 data (addr, 11a, 11b/g).
-+ * This macro returns the dsetid of the first of those
-+ * three DataSets.
-+ */
-+#define ANALOG_CONTROL_DATA_DSETID(refclk) \
-+ (DSETID_ANALOG_CONTROL_DATA_START + 3*refclk)
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCCheckEndpointTxQueues \n"));
++ pDistItem = target->EpCreditDistributionListHead;
+
-+/*
-+ * There are TWO STARTUP_PATCH DataSets.
-+ * DSETID_STARTUP_PATCH is historical, and was applied before BMI on
-+ * earlier systems. On AR6002, it is applied after BMI, just like
-+ * DSETID_STARTUP_PATCH2.
-+ */
-+#define DSETID_STARTUP_PATCH 0x00000026
-+#define DSETID_GPIO_CONFIG_PATCH 0x00000027
-+#define DSETID_WLANREGS 0x00000028 /* override wlan regs */
-+#define DSETID_STARTUP_PATCH2 0x00000029
++ /* run through the credit distribution list to see
++ * if there are packets queued
++ * NOTE: no locks need to be taken since the distribution list
++ * is not dynamic (cannot be re-ordered) and we are not modifying any state */
++ while (pDistItem != NULL) {
++ pEndpoint = (HTC_ENDPOINT *)pDistItem->pHTCReserved;
+
-+#define DSETID_WOW_CONFIG 0x00000090 /* WoW Configuration */
++ if (pEndpoint->CurrentTxQueueDepth > 0) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Ep %d has %d credits and %d Packets in TX Queue \n",
++ pDistItem->Endpoint, pEndpoint->CreditDist.TxCredits, pEndpoint->CurrentTxQueueDepth));
++ /* try to start the stalled queue, this list is ordered by priority.
++ * Highest priority queue get's processed first, if there are credits available the
++ * highest priority queue will get a chance to reclaim credits from lower priority
++ * ones */
++ HTCTrySend(target, NULL, pDistItem->Endpoint);
++ }
+
-+/* Add WHAL_INI_DATA_ID to DSETID_INI_DATA for a specific WHAL INI table. */
-+#define DSETID_INI_DATA 0x00000100
-+/* Reserved for WHAL INI Tables: 0x100..0x11f */
-+#define DSETID_INI_DATA_END 0x0000011f
++ pDistItem = pDistItem->pNext;
++ }
+
-+#define DSETID_VENDOR_START 0x00010000 /* Vendor-defined DataSets */
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCCheckEndpointTxQueues \n"));
++}
+
-+#define DSETID_INDEX_END 0xfffffffe /* Reserved to indicate the
-+ end of a memory-based
-+ DataSet Index */
-+#define DSETID_INDEX_FREE 0xffffffff /* An unused index entry */
++/* process credit reports and call distribution function */
++void HTCProcessCreditRpt(HTC_TARGET *target, HTC_CREDIT_REPORT *pRpt, int NumEntries, HTC_ENDPOINT_ID FromEndpoint)
++{
++ int i;
++ HTC_ENDPOINT *pEndpoint;
++ int totalCredits = 0;
++ A_BOOL doDist = FALSE;
+
-+/*
-+ * PATCH DataSet format:
-+ * A list of patches, terminated by a patch with
-+ * address=PATCH_END.
-+ *
-+ * This allows for patches to be stored in flash.
-+ */
-+struct patch_s {
-+ A_UINT32 *address;
-+ A_UINT32 data;
-+};
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("+HTCProcessCreditRpt, Credit Report Entries:%d \n", NumEntries));
+
-+/*
-+ * Skip some patches. Can be used to erase a single patch in a
-+ * patch DataSet without having to re-write the DataSet. May
-+ * also be used to embed information for use by subsequent
-+ * patch code. The "data" in a PATCH_SKIP tells how many
-+ * bytes of length "patch_s" to skip.
-+ */
-+#define PATCH_SKIP ((A_UINT32 *)0x00000000)
++ /* lock out TX while we update credits */
++ LOCK_HTC_TX(target);
+
-+/*
-+ * Execute code at the address specified by "data".
-+ * The address of the patch structure is passed as
-+ * the one parameter.
-+ */
-+#define PATCH_CODE_ABS ((A_UINT32 *)0x00000001)
++ for (i = 0; i < NumEntries; i++, pRpt++) {
++ if (pRpt->EndpointID >= ENDPOINT_MAX) {
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+/*
-+ * Same as PATCH_CODE_ABS, but treat "data" as an
-+ * offset from the start of the patch word.
-+ */
-+#define PATCH_CODE_REL ((A_UINT32 *)0x00000002)
++ pEndpoint = &target->EndPoint[pRpt->EndpointID];
+
-+/* Mark the end of this patch DataSet. */
-+#define PATCH_END ((A_UINT32 *)0xffffffff)
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Endpoint %d got %d credits \n",
++ pRpt->EndpointID, pRpt->Credits));
+
-+/*
-+ * A DataSet which contains a Binary Patch to some other DataSet
-+ * uses the original dsetid with the DSETID_BPATCH_FLAG bit set.
-+ * Such a BPatch DataSet consists of BPatch metadata followed by
-+ * the bdiff bytes. BPatch metadata consists of a single 32-bit
-+ * word that contains the size of the BPatched final image.
-+ *
-+ * To create a suitable bdiff DataSet, use bdiff in host/tools/bdiff
-+ * to create "diffs":
-+ * bdiff -q -O -nooldmd5 -nonewmd5 -d ORIGfile NEWfile diffs
-+ * Then add BPatch metadata to the start of "diffs".
-+ *
-+ * NB: There are some implementation-induced restrictions
-+ * on which DataSets can be BPatched.
-+ */
-+#define DSETID_BPATCH_FLAG 0x80000000
+
-+#endif /* __DSETID_H__ */
-diff --git a/drivers/ar6000/include/gpio.h b/drivers/ar6000/include/gpio.h
-new file mode 100644
-index 0000000..2203c7e
---- /dev/null
-+++ b/drivers/ar6000/include/gpio.h
-@@ -0,0 +1,34 @@
-+/*
-+ * Copyright (c) 2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
++#ifdef HTC_EP_STAT_PROFILING
++
++ INC_HTC_EP_STAT(pEndpoint, TxCreditRpts, 1);
++ INC_HTC_EP_STAT(pEndpoint, TxCreditsReturned, pRpt->Credits);
++
++ if (FromEndpoint == pRpt->EndpointID) {
++ /* this credit report arrived on the same endpoint indicating it arrived in an RX
++ * packet */
++ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromRx, pRpt->Credits);
++ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromRx, 1);
++ } else if (FromEndpoint == ENDPOINT_0) {
++ /* this credit arrived on endpoint 0 as a NULL message */
++ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromEp0, pRpt->Credits);
++ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromEp0, 1);
++ } else {
++ /* arrived on another endpoint */
++ INC_HTC_EP_STAT(pEndpoint, TxCreditsFromOther, pRpt->Credits);
++ INC_HTC_EP_STAT(pEndpoint, TxCreditRptsFromOther, 1);
++ }
+
-+#if defined(AR6001)
-+#define GPIO_PIN_COUNT 18
-+#else
-+#define GPIO_PIN_COUNT 18
+#endif
+
-+/*
-+ * Possible values for WMIX_GPIO_SET_REGISTER_CMDID.
-+ * NB: These match hardware order, so that addresses can
-+ * easily be computed.
-+ */
-+#define GPIO_ID_OUT 0x00000000
-+#define GPIO_ID_OUT_W1TS 0x00000001
-+#define GPIO_ID_OUT_W1TC 0x00000002
-+#define GPIO_ID_ENABLE 0x00000003
-+#define GPIO_ID_ENABLE_W1TS 0x00000004
-+#define GPIO_ID_ENABLE_W1TC 0x00000005
-+#define GPIO_ID_IN 0x00000006
-+#define GPIO_ID_STATUS 0x00000007
-+#define GPIO_ID_STATUS_W1TS 0x00000008
-+#define GPIO_ID_STATUS_W1TC 0x00000009
-+#define GPIO_ID_PIN0 0x0000000a
-+#define GPIO_ID_PIN(n) (GPIO_ID_PIN0+(n))
++ if (ENDPOINT_0 == pRpt->EndpointID) {
++ /* always give endpoint 0 credits back */
++ pEndpoint->CreditDist.TxCredits += pRpt->Credits;
++ } else {
++ /* for all other endpoints, update credits to distribute, the distribution function
++ * will handle giving out credits back to the endpoints */
++ pEndpoint->CreditDist.TxCreditsToDist += pRpt->Credits;
++ /* flag that we have to do the distribution */
++ doDist = TRUE;
++ }
+
-+#define GPIO_LAST_REGISTER_ID GPIO_ID_PIN(17)
-+#define GPIO_ID_NONE 0xffffffff
-diff --git a/drivers/ar6000/include/gpio_api.h b/drivers/ar6000/include/gpio_api.h
++ totalCredits += pRpt->Credits;
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, (" Report indicated %d credits to distribute \n", totalCredits));
++
++ if (doDist) {
++ /* this was a credit return based on a completed send operations
++ * note, this is done with the lock held */
++ DO_DISTRIBUTION(target,
++ HTC_CREDIT_DIST_SEND_COMPLETE,
++ "Send Complete",
++ target->EpCreditDistributionListHead->pNext);
++ }
++
++ UNLOCK_HTC_TX(target);
++
++ if (totalCredits) {
++ HTCCheckEndpointTxQueues(target);
++ }
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_SEND, ("-HTCProcessCreditRpt \n"));
++}
++
++/* flush endpoint TX queue */
++static void HTCFlushEndpointTX(HTC_TARGET *target, HTC_ENDPOINT *pEndpoint, HTC_TX_TAG Tag)
++{
++ HTC_PACKET *pPacket;
++ HTC_PACKET_QUEUE discardQueue;
++
++ /* initialize the discard queue */
++ INIT_HTC_PACKET_QUEUE(&discardQueue);
++
++ LOCK_HTC_TX(target);
++
++ /* interate from the front of the TX queue and flush out packets */
++ ITERATE_OVER_LIST_ALLOW_REMOVE(&pEndpoint->TxQueue, pPacket, HTC_PACKET, ListLink) {
++
++ /* check for removal */
++ if ((HTC_TX_PACKET_TAG_ALL == Tag) || (Tag == pPacket->PktInfo.AsTx.Tag)) {
++ /* remove from queue */
++ HTC_PACKET_REMOVE(pPacket);
++ /* add it to the discard pile */
++ HTC_PACKET_ENQUEUE(&discardQueue, pPacket);
++ pEndpoint->CurrentTxQueueDepth--;
++ }
++
++ } ITERATE_END;
++
++ UNLOCK_HTC_TX(target);
++
++ /* empty the discard queue */
++ while (1) {
++ pPacket = HTC_PACKET_DEQUEUE(&discardQueue);
++ if (NULL == pPacket) {
++ break;
++ }
++ pPacket->Status = A_ECANCELED;
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, (" Flushing TX packet:0x%X, length:%d, ep:%d tag:0x%X \n",
++ (A_UINT32)pPacket, pPacket->ActualLength, pPacket->Endpoint, pPacket->PktInfo.AsTx.Tag));
++ DO_EP_TX_COMPLETION(pEndpoint,pPacket);
++ }
++
++}
++
++void DumpCreditDist(HTC_ENDPOINT_CREDIT_DIST *pEPDist)
++{
++#ifdef DEBUG
++ HTC_ENDPOINT *pEndpoint = (HTC_ENDPOINT *)pEPDist->pHTCReserved;
++#endif
++
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("--- EP : %d ServiceID: 0x%X --------------\n",
++ pEPDist->Endpoint, pEPDist->ServiceID));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" this:0x%X next:0x%X prev:0x%X\n",
++ (A_UINT32)pEPDist, (A_UINT32)pEPDist->pNext, (A_UINT32)pEPDist->pPrev));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" DistFlags : 0x%X \n", pEPDist->DistFlags));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsNorm : %d \n", pEPDist->TxCreditsNorm));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsMin : %d \n", pEPDist->TxCreditsMin));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCredits : %d \n", pEPDist->TxCredits));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsAssigned : %d \n", pEPDist->TxCreditsAssigned));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsSeek : %d \n", pEPDist->TxCreditsSeek));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditSize : %d \n", pEPDist->TxCreditSize));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsPerMaxMsg : %d \n", pEPDist->TxCreditsPerMaxMsg));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxCreditsToDist : %d \n", pEPDist->TxCreditsToDist));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, (" TxQueueDepth : %d \n", pEndpoint->CurrentTxQueueDepth));
++ AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("----------------------------------------------------\n"));
++}
++
++void DumpCreditDistStates(HTC_TARGET *target)
++{
++ HTC_ENDPOINT_CREDIT_DIST *pEPList = target->EpCreditDistributionListHead;
++
++ while (pEPList != NULL) {
++ DumpCreditDist(pEPList);
++ pEPList = pEPList->pNext;
++ }
++
++ if (target->DistributeCredits != NULL) {
++ DO_DISTRIBUTION(target,
++ HTC_DUMP_CREDIT_STATE,
++ "Dump State",
++ NULL);
++ }
++}
++
++/* flush all send packets from all endpoint queues */
++void HTCFlushSendPkts(HTC_TARGET *target)
++{
++ HTC_ENDPOINT *pEndpoint;
++ int i;
++
++ DumpCreditDistStates(target);
++
++ for (i = ENDPOINT_0; i < ENDPOINT_MAX; i++) {
++ pEndpoint = &target->EndPoint[i];
++ if (pEndpoint->ServiceID == 0) {
++ /* not in use.. */
++ continue;
++ }
++ HTCFlushEndpointTX(target,pEndpoint,HTC_TX_PACKET_TAG_ALL);
++ }
++
++}
++
++/* HTC API to flush an endpoint's TX queue*/
++void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
++
++ if (pEndpoint->ServiceID == 0) {
++ AR_DEBUG_ASSERT(FALSE);
++ /* not in use.. */
++ return;
++ }
++
++ HTCFlushEndpointTX(target, pEndpoint, Tag);
++}
++
++/* HTC API to indicate activity to the credit distribution function */
++void HTCIndicateActivityChange(HTC_HANDLE HTCHandle,
++ HTC_ENDPOINT_ID Endpoint,
++ A_BOOL Active)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ HTC_ENDPOINT *pEndpoint = &target->EndPoint[Endpoint];
++ A_BOOL doDist = FALSE;
++
++ if (pEndpoint->ServiceID == 0) {
++ AR_DEBUG_ASSERT(FALSE);
++ /* not in use.. */
++ return;
++ }
++
++ LOCK_HTC_TX(target);
++
++ if (Active) {
++ if (!(pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE)) {
++ /* mark active now */
++ pEndpoint->CreditDist.DistFlags |= HTC_EP_ACTIVE;
++ doDist = TRUE;
++ }
++ } else {
++ if (pEndpoint->CreditDist.DistFlags & HTC_EP_ACTIVE) {
++ /* mark inactive now */
++ pEndpoint->CreditDist.DistFlags &= ~HTC_EP_ACTIVE;
++ doDist = TRUE;
++ }
++ }
++
++ if (doDist) {
++ /* do distribution again based on activity change
++ * note, this is done with the lock held */
++ DO_DISTRIBUTION(target,
++ HTC_CREDIT_DIST_ACTIVITY_CHANGE,
++ "Activity Change",
++ target->EpCreditDistributionListHead->pNext);
++ }
++
++ UNLOCK_HTC_TX(target);
++
++}
+diff --git a/drivers/ar6000/htc/htc_services.c b/drivers/ar6000/htc/htc_services.c
new file mode 100644
-index 0000000..8078aa5
+index 0000000..e5d50d1
--- /dev/null
-+++ b/drivers/ar6000/include/gpio_api.h
-@@ -0,0 +1,57 @@
-+#ifndef _GPIO_API_H_
-+#define _GPIO_API_H_
++++ b/drivers/ar6000/htc/htc_services.c
+@@ -0,0 +1,403 @@
+/*
-+ * Copyright 2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ *
+ */
+
-+/*
-+ * Host-side General Purpose I/O API.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/gpio_api.h#1 $
-+ */
++#include "htc_internal.h"
+
-+/*
-+ * Send a command to the Target in order to change output on GPIO pins.
-+ */
-+A_STATUS wmi_gpio_output_set(struct wmi_t *wmip,
-+ A_UINT32 set_mask,
-+ A_UINT32 clear_mask,
-+ A_UINT32 enable_mask,
-+ A_UINT32 disable_mask);
++void HTCControlTxComplete(void *Context, HTC_PACKET *pPacket)
++{
++ /* not implemented
++ * we do not send control TX frames during normal runtime, only during setup */
++ AR_DEBUG_ASSERT(FALSE);
++}
+
-+/*
-+ * Send a command to the Target requesting input state of GPIO pins.
-+ */
-+A_STATUS wmi_gpio_input_get(struct wmi_t *wmip);
++ /* callback when a control message arrives on this endpoint */
++void HTCControlRecv(void *Context, HTC_PACKET *pPacket)
++{
++ AR_DEBUG_ASSERT(pPacket->Endpoint == ENDPOINT_0);
+
-+/*
-+ * Send a command to the Target to change the value of a GPIO register.
-+ */
-+A_STATUS wmi_gpio_register_set(struct wmi_t *wmip,
-+ A_UINT32 gpioreg_id,
-+ A_UINT32 value);
++ /* the only control messages we are expecting are NULL messages (credit resports), which should
++ * never get here */
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ ("HTCControlRecv, got message with length:%d \n",
++ pPacket->ActualLength + HTC_HDR_LENGTH));
+
-+/*
-+ * Send a command to the Target to fetch the value of a GPIO register.
-+ */
-+A_STATUS wmi_gpio_register_get(struct wmi_t *wmip, A_UINT32 gpioreg_id);
++ /* dump header and message */
++ DebugDumpBytes(pPacket->pBuffer - HTC_HDR_LENGTH,
++ pPacket->ActualLength + HTC_HDR_LENGTH,
++ "Unexpected ENDPOINT 0 Message");
+
-+/*
-+ * Send a command to the Target, acknowledging some GPIO interrupts.
-+ */
-+A_STATUS wmi_gpio_intr_ack(struct wmi_t *wmip, A_UINT32 ack_mask);
++ HTC_RECYCLE_RX_PKT((HTC_TARGET*)Context,pPacket);
++}
+
-+#endif /* _GPIO_API_H_ */
-diff --git a/drivers/ar6000/include/hif.h b/drivers/ar6000/include/hif.h
-new file mode 100644
-index 0000000..846a69f
---- /dev/null
-+++ b/drivers/ar6000/include/hif.h
-@@ -0,0 +1,296 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ * HIF specific declarations and prototypes
-+ */
++A_STATUS HTCSendSetupComplete(HTC_TARGET *target)
++{
++ HTC_PACKET *pSendPacket = NULL;
++ A_STATUS status;
++ HTC_SETUP_COMPLETE_MSG *pSetupComplete;
+
-+#ifndef _HIF_H_
-+#define _HIF_H_
++ do {
++ /* allocate a packet to send to the target */
++ pSendPacket = HTC_ALLOC_CONTROL_TX(target);
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif /* __cplusplus */
++ if (NULL == pSendPacket) {
++ status = A_NO_MEMORY;
++ break;
++ }
+
-+/* Header files */
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
++ /* assemble setup complete message */
++ pSetupComplete = (HTC_SETUP_COMPLETE_MSG *)pSendPacket->pBuffer;
++ A_MEMZERO(pSetupComplete,sizeof(HTC_SETUP_COMPLETE_MSG));
++ pSetupComplete->MessageID = HTC_MSG_SETUP_COMPLETE_ID;
+
-+typedef struct htc_callbacks HTC_CALLBACKS;
-+typedef struct hif_device HIF_DEVICE;
++ SET_HTC_PACKET_INFO_TX(pSendPacket,
++ NULL,
++ (A_UINT8 *)pSetupComplete,
++ sizeof(HTC_SETUP_COMPLETE_MSG),
++ ENDPOINT_0,
++ HTC_SERVICE_TX_PACKET_TAG);
+
-+/*
-+ * direction - Direction of transfer (HIF_READ/HIF_WRITE).
-+ */
-+#define HIF_READ 0x00000001
-+#define HIF_WRITE 0x00000002
-+#define HIF_DIR_MASK (HIF_READ | HIF_WRITE)
++ /* we want synchronous operation */
++ pSendPacket->Completion = NULL;
++ /* send the message */
++ status = HTCIssueSend(target,pSendPacket,0);
+
-+/*
-+ * type - An interface may support different kind of read/write commands.
-+ * The command type is divided into a basic and an extended command
-+ * and can be specified using HIF_BASIC_IO/HIF_EXTENDED_IO.
-+ */
-+#define HIF_BASIC_IO 0x00000004
-+#define HIF_EXTENDED_IO 0x00000008
-+#define HIF_TYPE_MASK (HIF_BASIC_IO | HIF_EXTENDED_IO)
++ } while (FALSE);
+
-+/*
-+ * emode - This indicates the whether the command is to be executed in a
-+ * blocking or non-blocking fashion (HIF_SYNCHRONOUS/
-+ * HIF_ASYNCHRONOUS). The read/write data paths in HTC have been
-+ * implemented using the asynchronous mode allowing the the bus
-+ * driver to indicate the completion of operation through the
-+ * registered callback routine. The requirement primarily comes
-+ * from the contexts these operations get called from (a driver's
-+ * transmit context or the ISR context in case of receive).
-+ * Support for both of these modes is essential.
-+ */
-+#define HIF_SYNCHRONOUS 0x00000010
-+#define HIF_ASYNCHRONOUS 0x00000020
-+#define HIF_EMODE_MASK (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)
++ if (pSendPacket != NULL) {
++ HTC_FREE_CONTROL_TX(target,pSendPacket);
++ }
+
-+/*
-+ * dmode - An interface may support different kinds of commands based on
-+ * the tradeoff between the amount of data it can carry and the
-+ * setup time. Byte and Block modes are supported (HIF_BYTE_BASIS/
-+ * HIF_BLOCK_BASIS). In case of latter, the data is rounded off
-+ * to the nearest block size by padding. The size of the block is
-+ * configurable at compile time using the HIF_BLOCK_SIZE and is
-+ * negotiated with the target during initialization after the
-+ * dragon interrupts are enabled.
-+ */
-+#define HIF_BYTE_BASIS 0x00000040
-+#define HIF_BLOCK_BASIS 0x00000080
-+#define HIF_DMODE_MASK (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)
++ return status;
++}
+
-+/*
-+ * amode - This indicates if the address has to be incremented on dragon
-+ * after every read/write operation (HIF?FIXED_ADDRESS/
-+ * HIF_INCREMENTAL_ADDRESS).
-+ */
-+#define HIF_FIXED_ADDRESS 0x00000100
-+#define HIF_INCREMENTAL_ADDRESS 0x00000200
-+#define HIF_AMODE_MASK (HIF_FIXED_ADDRESS | HIF_INCREMENTAL_ADDRESS)
+
-+#define HIF_WR_ASYNC_BYTE_FIX \
-+ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_WR_ASYNC_BYTE_INC \
-+ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_ASYNC_BLOCK_INC \
-+ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_SYNC_BYTE_FIX \
-+ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_WR_SYNC_BYTE_INC \
-+ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_WR_SYNC_BLOCK_INC \
-+ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BYTE_INC \
-+ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BYTE_FIX \
-+ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BYTE_FIX \
-+ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BLOCK_FIX \
-+ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
-+#define HIF_RD_ASYNC_BYTE_INC \
-+ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_ASYNC_BLOCK_INC \
-+ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
-+#define HIF_RD_SYNC_BLOCK_INC \
-+ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
++A_STATUS HTCConnectService(HTC_HANDLE HTCHandle,
++ HTC_SERVICE_CONNECT_REQ *pConnectReq,
++ HTC_SERVICE_CONNECT_RESP *pConnectResp)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ A_STATUS status = A_OK;
++ HTC_PACKET *pRecvPacket = NULL;
++ HTC_PACKET *pSendPacket = NULL;
++ HTC_CONNECT_SERVICE_RESPONSE_MSG *pResponseMsg;
++ HTC_CONNECT_SERVICE_MSG *pConnectMsg;
++ HTC_ENDPOINT_ID assignedEndpoint = ENDPOINT_MAX;
++ HTC_ENDPOINT *pEndpoint;
++ int maxMsgSize = 0;
+
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCConnectService, target:0x%X SvcID:0x%X \n",
++ (A_UINT32)target, pConnectReq->ServiceID));
+
-+typedef enum {
-+ HIF_DEVICE_POWER_STATE = 0,
-+ HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
-+ HIF_DEVICE_GET_MBOX_ADDR,
-+ HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
-+ HIF_DEVICE_GET_IRQ_PROC_MODE,
-+ HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
-+} HIF_DEVICE_CONFIG_OPCODE;
++ do {
+
-+/*
-+ * HIF CONFIGURE definitions:
-+ *
-+ * HIF_DEVICE_GET_MBOX_BLOCK_SIZE
-+ * input : none
-+ * output : array of 4 A_UINT32s
-+ * notes: block size is returned for each mailbox (4)
-+ *
-+ * HIF_DEVICE_GET_MBOX_ADDR
-+ * input : none
-+ * output : array of 4 A_UINT32
-+ * notes: address is returned for each mailbox (4) in the array
-+ *
-+ * HIF_DEVICE_GET_PENDING_EVENTS_FUNC
-+ * input : none
-+ * output: HIF_PENDING_EVENTS_FUNC function pointer
-+ * notes: this is optional for the HIF layer, if the request is
-+ * not handled then it indicates that the upper layer can use
-+ * the standard device methods to get pending events (IRQs, mailbox messages etc..)
-+ * otherwise it can call the function pointer to check pending events.
-+ *
-+ * HIF_DEVICE_GET_IRQ_PROC_MODE
-+ * input : none
-+ * output : HIF_DEVICE_IRQ_PROCESSING_MODE (interrupt processing mode)
-+ * note: the hif layer interfaces with the underlying OS-specific bus driver. The HIF
-+ * layer can report whether IRQ processing is requires synchronous behavior or
-+ * can be processed using asynchronous bus requests (typically faster).
-+ *
-+ * HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC
-+ * input :
-+ * output : HIF_MASK_UNMASK_RECV_EVENT function pointer
-+ * notes: this is optional for the HIF layer. The HIF layer may require a special mechanism
-+ * to mask receive message events. The upper layer can call this pointer when it needs
-+ * to mask/unmask receive events (in case it runs out of buffers).
-+ *
-+ *
-+ */
++ AR_DEBUG_ASSERT(pConnectReq->ServiceID != 0);
+
-+typedef enum {
-+ HIF_DEVICE_IRQ_SYNC_ONLY, /* for HIF implementations that require the DSR to process all
-+ interrupts before returning */
-+ HIF_DEVICE_IRQ_ASYNC_SYNC, /* for HIF implementations that allow DSR to process interrupts
-+ using ASYNC I/O (that is HIFAckInterrupt can be called at a
-+ later time */
-+} HIF_DEVICE_IRQ_PROCESSING_MODE;
++ if (HTC_CTRL_RSVD_SVC == pConnectReq->ServiceID) {
++ /* special case for pseudo control service */
++ assignedEndpoint = ENDPOINT_0;
++ maxMsgSize = HTC_MAX_CONTROL_MESSAGE_LENGTH;
++ } else {
++ /* allocate a packet to send to the target */
++ pSendPacket = HTC_ALLOC_CONTROL_TX(target);
+
-+#define HIF_MAX_DEVICES 1
++ if (NULL == pSendPacket) {
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_NO_MEMORY;
++ break;
++ }
++ /* assemble connect service message */
++ pConnectMsg = (HTC_CONNECT_SERVICE_MSG *)pSendPacket->pBuffer;
++ AR_DEBUG_ASSERT(pConnectMsg != NULL);
++ A_MEMZERO(pConnectMsg,sizeof(HTC_CONNECT_SERVICE_MSG));
++ pConnectMsg->MessageID = HTC_MSG_CONNECT_SERVICE_ID;
++ pConnectMsg->ServiceID = pConnectReq->ServiceID;
++ pConnectMsg->ConnectionFlags = pConnectReq->ConnectionFlags;
++ /* check caller if it wants to transfer meta data */
++ if ((pConnectReq->pMetaData != NULL) &&
++ (pConnectReq->MetaDataLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
++ /* copy meta data into message buffer (after header ) */
++ A_MEMCPY((A_UINT8 *)pConnectMsg + sizeof(HTC_CONNECT_SERVICE_MSG),
++ pConnectReq->pMetaData,
++ pConnectReq->MetaDataLength);
++ pConnectMsg->ServiceMetaLength = pConnectReq->MetaDataLength;
++ }
+
-+struct htc_callbacks {
-+ A_UCHAR *name;
-+ A_UINT32 id;
-+ A_STATUS (* deviceInsertedHandler)(void *hif_handle);
-+ A_STATUS (* deviceRemovedHandler)(void *htc_handle, A_STATUS status);
-+ A_STATUS (* deviceSuspendHandler)(void *htc_handle);
-+ A_STATUS (* deviceResumeHandler)(void *htc_handle);
-+ A_STATUS (* deviceWakeupHandler)(void *htc_handle);
-+ A_STATUS (* rwCompletionHandler)(void *context, A_STATUS status);
-+ A_STATUS (* dsrHandler)(void *htc_handle);
-+};
++ SET_HTC_PACKET_INFO_TX(pSendPacket,
++ NULL,
++ (A_UINT8 *)pConnectMsg,
++ sizeof(HTC_CONNECT_SERVICE_MSG) + pConnectMsg->ServiceMetaLength,
++ ENDPOINT_0,
++ HTC_SERVICE_TX_PACKET_TAG);
+
++ /* we want synchronous operation */
++ pSendPacket->Completion = NULL;
+
-+#define HIF_OTHER_EVENTS (1 << 0) /* other interrupts (non-Recv) are pending, host
-+ needs to read the register table to figure out what */
-+#define HIF_RECV_MSG_AVAIL (1 << 1) /* pending recv packet */
++ status = HTCIssueSend(target,pSendPacket,0);
+
-+typedef struct _HIF_PENDING_EVENTS_INFO {
-+ A_UINT32 Events;
-+ A_UINT32 LookAhead;
-+} HIF_PENDING_EVENTS_INFO;
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+ /* function to get pending events , some HIF modules use special mechanisms
-+ * to detect packet available and other interrupts */
-+typedef A_STATUS ( *HIF_PENDING_EVENTS_FUNC)(HIF_DEVICE *device,
-+ HIF_PENDING_EVENTS_INFO *pEvents,
-+ void *AsyncContext);
++ /* wait for response */
++ status = HTCWaitforControlMessage(target, &pRecvPacket);
+
-+#define HIF_MASK_RECV TRUE
-+#define HIF_UNMASK_RECV FALSE
-+ /* function to mask recv events */
-+typedef A_STATUS ( *HIF_MASK_UNMASK_RECV_EVENT)(HIF_DEVICE *device,
-+ A_BOOL Mask,
-+ void *AsyncContext);
++ if (A_FAILED(status)) {
++ break;
++ }
++ /* we controlled the buffer creation so it has to be properly aligned */
++ pResponseMsg = (HTC_CONNECT_SERVICE_RESPONSE_MSG *)pRecvPacket->pBuffer;
+
++ if ((pResponseMsg->MessageID != HTC_MSG_CONNECT_SERVICE_RESPONSE_ID) ||
++ (pRecvPacket->ActualLength < sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG))) {
++ /* this message is not valid */
++ AR_DEBUG_ASSERT(FALSE);
++ status = A_EPROTO;
++ break;
++ }
+
-+/*
-+ * This API is used by the HTC layer to initialize the HIF layer and to
-+ * register different callback routines. Support for following events has
-+ * been captured - DSR, Read/Write completion, Device insertion/removal,
-+ * Device suspension/resumption/wakeup. In addition to this, the API is
-+ * also used to register the name and the revision of the chip. The latter
-+ * can be used to verify the revision of the chip read from the device
-+ * before reporting it to HTC.
-+ */
-+int HIFInit(HTC_CALLBACKS *callbacks);
++ pConnectResp->ConnectRespCode = pResponseMsg->Status;
++ /* check response status */
++ if (pResponseMsg->Status != HTC_SERVICE_SUCCESS) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
++ (" Target failed service 0x%X connect request (status:%d)\n",
++ pResponseMsg->ServiceID, pResponseMsg->Status));
++ status = A_EPROTO;
++ break;
++ }
+
-+/*
-+ * This API is used to provide the read/write interface over the specific bus
-+ * interface.
-+ * address - Starting address in the dragon's address space. For mailbox
-+ * writes, it refers to the start of the mbox boundary. It should
-+ * be ensured that the last byte falls on the mailbox's EOM. For
-+ * mailbox reads, it refers to the end of the mbox boundary.
-+ * buffer - Pointer to the buffer containg the data to be transmitted or
-+ * received.
-+ * length - Amount of data to be transmitted or received.
-+ * request - Characterizes the attributes of the command.
-+ */
-+A_STATUS
-+HIFReadWrite(HIF_DEVICE *device,
-+ A_UINT32 address,
-+ A_UCHAR *buffer,
-+ A_UINT32 length,
-+ A_UINT32 request,
-+ void *context);
++ assignedEndpoint = pResponseMsg->EndpointID;
++ maxMsgSize = pResponseMsg->MaxMsgSize;
+
-+/*
-+ * This can be initiated from the unload driver context ie when the HTCShutdown
-+ * routine is called.
-+ */
-+void HIFShutDownDevice(HIF_DEVICE *device);
++ if ((pConnectResp->pMetaData != NULL) &&
++ (pResponseMsg->ServiceMetaLength > 0) &&
++ (pResponseMsg->ServiceMetaLength <= HTC_SERVICE_META_DATA_MAX_LENGTH)) {
++ /* caller supplied a buffer and the target responded with data */
++ int copyLength = min((int)pConnectResp->BufferLength, (int)pResponseMsg->ServiceMetaLength);
++ /* copy the meta data */
++ A_MEMCPY(pConnectResp->pMetaData,
++ ((A_UINT8 *)pResponseMsg) + sizeof(HTC_CONNECT_SERVICE_RESPONSE_MSG),
++ copyLength);
++ pConnectResp->ActualLength = copyLength;
++ }
+
-+/*
-+ * This should translate to an acknowledgment to the bus driver indicating that
-+ * the previous interrupt request has been serviced and the all the relevant
-+ * sources have been cleared. HTC is ready to process more interrupts.
-+ * This should prevent the bus driver from raising an interrupt unless the
-+ * previous one has been serviced and acknowledged using the previous API.
-+ */
-+void HIFAckInterrupt(HIF_DEVICE *device);
++ }
+
-+void HIFMaskInterrupt(HIF_DEVICE *device);
++ /* the rest of these are parameter checks so set the error status */
++ status = A_EPROTO;
+
-+void HIFUnMaskInterrupt(HIF_DEVICE *device);
++ if (assignedEndpoint >= ENDPOINT_MAX) {
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+/*
-+ * This set of functions are to be used by the bus driver to notify
-+ * the HIF module about various events.
-+ * These are not implemented if the bus driver provides an alternative
-+ * way for this notification though callbacks for instance.
-+ */
-+int HIFInsertEventNotify(void);
++ if (0 == maxMsgSize) {
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+int HIFRemoveEventNotify(void);
++ pEndpoint = &target->EndPoint[assignedEndpoint];
+
-+int HIFIRQEventNotify(void);
++ if (pEndpoint->ServiceID != 0) {
++ /* endpoint already in use! */
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
+
-+int HIFRWCompleteEventNotify(void);
++ /* return assigned endpoint to caller */
++ pConnectResp->Endpoint = assignedEndpoint;
++ pConnectResp->MaxMsgLength = maxMsgSize;
+
-+/*
-+ * This function associates a opaque handle with the HIF layer
-+ * to be used in communication with upper layer i.e. HTC.
-+ * This would normaly be a pointer to htc_target data structure.
-+ */
-+void HIFSetHandle(void *hif_handle, void *handle);
++ /* setup the endpoint */
++ pEndpoint->ServiceID = pConnectReq->ServiceID; /* this marks the endpoint in use */
++ pEndpoint->MaxTxQueueDepth = pConnectReq->MaxSendQueueDepth;
++ pEndpoint->MaxMsgLength = maxMsgSize;
++ /* copy all the callbacks */
++ pEndpoint->EpCallBacks = pConnectReq->EpCallbacks;
++ INIT_HTC_PACKET_QUEUE(&pEndpoint->RxBuffers);
++ INIT_HTC_PACKET_QUEUE(&pEndpoint->TxQueue);
++ /* set the credit distribution info for this endpoint, this information is
++ * passed back to the credit distribution callback function */
++ pEndpoint->CreditDist.ServiceID = pConnectReq->ServiceID;
++ pEndpoint->CreditDist.pHTCReserved = pEndpoint;
++ pEndpoint->CreditDist.Endpoint = assignedEndpoint;
++ pEndpoint->CreditDist.TxCreditSize = target->TargetCreditSize;
++ pEndpoint->CreditDist.TxCreditsPerMaxMsg = maxMsgSize / target->TargetCreditSize;
+
-+A_STATUS
-+HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
-+ void *config, A_UINT32 configLen);
++ if (0 == pEndpoint->CreditDist.TxCreditsPerMaxMsg) {
++ pEndpoint->CreditDist.TxCreditsPerMaxMsg = 1;
++ }
+
++ status = A_OK;
+
-+struct device;
-+struct device*
-+HIFGetOSDevice(HIF_DEVICE *device);
++ } while (FALSE);
+
++ if (pSendPacket != NULL) {
++ HTC_FREE_CONTROL_TX(target,pSendPacket);
++ }
+
-+#ifdef __cplusplus
-+}
-+#endif
++ if (pRecvPacket != NULL) {
++ HTC_FREE_CONTROL_RX(target,pRecvPacket);
++ }
+
-+#endif /* _HIF_H_ */
-diff --git a/drivers/ar6000/include/host_version.h b/drivers/ar6000/include/host_version.h
-new file mode 100644
-index 0000000..c090115
---- /dev/null
-+++ b/drivers/ar6000/include/host_version.h
-@@ -0,0 +1,49 @@
-+#ifndef _HOST_VERSION_H_
-+#define _HOST_VERSION_H_
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains version information for the sample host driver for the
-+ * AR6000 chip
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/host_version.h#2 $
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++ AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCConnectService \n"));
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#include <AR6K_version.h>
-+
-+/*
-+ * The version number is made up of major, minor, patch and build
-+ * numbers. These are 16 bit numbers. The build and release script will
-+ * set the build number using a Perforce counter. Here the build number is
-+ * set to 9999 so that builds done without the build-release script are easily
-+ * identifiable.
-+ */
-+
-+#define ATH_SW_VER_MAJOR __VER_MAJOR_
-+#define ATH_SW_VER_MINOR __VER_MINOR_
-+#define ATH_SW_VER_PATCH __VER_PATCH_
-+#define ATH_SW_VER_BUILD 9999
-+
-+#ifdef __cplusplus
++ return status;
+}
-+#endif
-+
-+#endif /* _HOST_VERSION_H_ */
-diff --git a/drivers/ar6000/include/htc.h b/drivers/ar6000/include/htc.h
-new file mode 100644
-index 0000000..152d867
---- /dev/null
-+++ b/drivers/ar6000/include/htc.h
-@@ -0,0 +1,190 @@
-+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
+
++static void AddToEndpointDistList(HTC_TARGET *target, HTC_ENDPOINT_CREDIT_DIST *pEpDist)
++{
++ HTC_ENDPOINT_CREDIT_DIST *pCurEntry,*pLastEntry;
+
-+#ifndef __HTC_H__
-+#define __HTC_H__
++ if (NULL == target->EpCreditDistributionListHead) {
++ target->EpCreditDistributionListHead = pEpDist;
++ pEpDist->pNext = NULL;
++ pEpDist->pPrev = NULL;
++ return;
++ }
+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
++ /* queue to the end of the list, this does not have to be very
++ * fast since this list is built at startup time */
++ pCurEntry = target->EpCreditDistributionListHead;
+
-+#define A_OFFSETOF(type,field) (int)(&(((type *)NULL)->field))
++ while (pCurEntry) {
++ pLastEntry = pCurEntry;
++ pCurEntry = pCurEntry->pNext;
++ }
+
-+#define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
-+ (((A_UINT16)(((A_UINT8 *)(p))[(highbyte)])) << 8 | (A_UINT16)(((A_UINT8 *)(p))[(lowbyte)]))
++ pLastEntry->pNext = pEpDist;
++ pEpDist->pPrev = pLastEntry;
++ pEpDist->pNext = NULL;
++}
+
-+/* alignment independent macros (little-endian) to fetch UINT16s or UINT8s from a
-+ * structure using only the type and field name.
-+ * Use these macros if there is the potential for unaligned buffer accesses. */
-+#define A_GET_UINT16_FIELD(p,type,field) \
-+ ASSEMBLE_UNALIGNED_UINT16(p,\
-+ A_OFFSETOF(type,field) + 1, \
-+ A_OFFSETOF(type,field))
+
-+#define A_SET_UINT16_FIELD(p,type,field,value) \
-+{ \
-+ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (A_UINT8)(value); \
-+ ((A_UINT8 *)(p))[A_OFFSETOF(type,field) + 1] = (A_UINT8)((value) >> 8); \
-+}
+
-+#define A_GET_UINT8_FIELD(p,type,field) \
-+ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)]
++/* default credit init callback */
++static void HTCDefaultCreditInit(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPList,
++ int TotalCredits)
++{
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
++ int totalEps = 0;
++ int creditsPerEndpoint;
+
-+#define A_SET_UINT8_FIELD(p,type,field,value) \
-+ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (value)
++ pCurEpDist = pEPList;
++ /* first run through the list and figure out how many endpoints we are dealing with */
++ while (pCurEpDist != NULL) {
++ pCurEpDist = pCurEpDist->pNext;
++ totalEps++;
++ }
+
-+/****** DANGER DANGER ***************
-+ *
-+ * The frame header length and message formats defined herein were
-+ * selected to accommodate optimal alignment for target processing. This reduces code
-+ * size and improves performance.
-+ *
-+ * Any changes to the header length may alter the alignment and cause exceptions
-+ * on the target. When adding to the message structures insure that fields are
-+ * properly aligned.
-+ *
-+ */
++ /* even distribution */
++ creditsPerEndpoint = TotalCredits/totalEps;
+
-+/* HTC frame header */
-+typedef PREPACK struct _HTC_FRAME_HDR{
-+ /* do not remove or re-arrange these fields, these are minimally required
-+ * to take advantage of 4-byte lookaheads in some hardware implementations */
-+ A_UINT8 EndpointID;
-+ A_UINT8 Flags;
-+ A_UINT16 PayloadLen; /* length of data (including trailer) that follows the header */
++ pCurEpDist = pEPList;
++ /* run through the list and set minimum and normal credits and
++ * provide the endpoint with some credits to start */
++ while (pCurEpDist != NULL) {
+
-+ /***** end of 4-byte lookahead ****/
++ if (creditsPerEndpoint < pCurEpDist->TxCreditsPerMaxMsg) {
++ /* too many endpoints and not enough credits */
++ AR_DEBUG_ASSERT(FALSE);
++ break;
++ }
++ /* our minimum is set for at least 1 max message */
++ pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
++ /* this value is ignored by our credit alg, since we do
++ * not dynamically adjust credits, this is the policy of
++ * the "default" credit distribution, something simple and easy */
++ pCurEpDist->TxCreditsNorm = 0xFFFF;
++ /* give the endpoint minimum credits */
++ pCurEpDist->TxCredits = creditsPerEndpoint;
++ pCurEpDist->TxCreditsAssigned = creditsPerEndpoint;
++ pCurEpDist = pCurEpDist->pNext;
++ }
+
-+ A_UINT8 ControlBytes[2];
++}
+
-+ /* message payload starts after the header */
++/* default credit distribution callback, NOTE, this callback holds the TX lock */
++void HTCDefaultCreditDist(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
++ HTC_CREDIT_DIST_REASON Reason)
++{
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
+
-+} POSTPACK HTC_FRAME_HDR;
++ if (Reason == HTC_CREDIT_DIST_SEND_COMPLETE) {
++ pCurEpDist = pEPDistList;
++ /* simple distribution */
++ while (pCurEpDist != NULL) {
++ if (pCurEpDist->TxCreditsToDist > 0) {
++ /* just give the endpoint back the credits */
++ pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
++ pCurEpDist->TxCreditsToDist = 0;
++ }
++ pCurEpDist = pCurEpDist->pNext;
++ }
++ }
+
-+/* frame header flags */
-+#define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
-+#define HTC_FLAGS_RECV_TRAILER (1 << 1)
++ /* note we do not need to handle the other reason codes as this is a very
++ * simple distribution scheme, no need to seek for more credits or handle inactivity */
++}
+
++void HTCSetCreditDistribution(HTC_HANDLE HTCHandle,
++ void *pCreditDistContext,
++ HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
++ HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
++ HTC_SERVICE_ID ServicePriorityOrder[],
++ int ListLength)
++{
++ HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
++ int i;
++ int ep;
+
-+#define HTC_HDR_LENGTH (sizeof(HTC_FRAME_HDR))
-+#define HTC_MAX_TRAILER_LENGTH 255
-+#define HTC_MAX_PAYLOAD_LENGTH (2048 - sizeof(HTC_FRAME_HDR))
++ if (CreditInitFunc != NULL) {
++ /* caller has supplied their own distribution functions */
++ target->InitCredits = CreditInitFunc;
++ AR_DEBUG_ASSERT(CreditDistFunc != NULL);
++ target->DistributeCredits = CreditDistFunc;
++ target->pCredDistContext = pCreditDistContext;
++ } else {
++ /* caller wants HTC to do distribution */
++ /* if caller wants service to handle distributions then
++ * it must set both of these to NULL! */
++ AR_DEBUG_ASSERT(CreditDistFunc == NULL);
++ target->InitCredits = HTCDefaultCreditInit;
++ target->DistributeCredits = HTCDefaultCreditDist;
++ target->pCredDistContext = target;
++ }
+
-+/* HTC control message IDs */
-+typedef enum {
-+ HTC_MSG_READY_ID = 1,
-+ HTC_MSG_CONNECT_SERVICE_ID = 2,
-+ HTC_MSG_CONNECT_SERVICE_RESPONSE_ID = 3,
-+ HTC_MSG_SETUP_COMPLETE_ID = 4,
-+} HTC_MSG_IDS;
++ /* always add HTC control endpoint first, we only expose the list after the
++ * first one, this is added for TX queue checking */
++ AddToEndpointDistList(target, &target->EndPoint[ENDPOINT_0].CreditDist);
+
-+#define HTC_MAX_CONTROL_MESSAGE_LENGTH 256
++ /* build the list of credit distribution structures in priority order
++ * supplied by the caller, these will follow endpoint 0 */
++ for (i = 0; i < ListLength; i++) {
++ /* match services with endpoints and add the endpoints to the distribution list
++ * in FIFO order */
++ for (ep = ENDPOINT_1; ep < ENDPOINT_MAX; ep++) {
++ if (target->EndPoint[ep].ServiceID == ServicePriorityOrder[i]) {
++ /* queue this one to the list */
++ AddToEndpointDistList(target, &target->EndPoint[ep].CreditDist);
++ break;
++ }
++ }
++ AR_DEBUG_ASSERT(ep < ENDPOINT_MAX);
++ }
+
-+/* base message ID header */
-+typedef PREPACK struct {
-+ A_UINT16 MessageID;
-+} POSTPACK HTC_UNKNOWN_MSG;
++}
+diff --git a/drivers/ar6000/include/AR6001_regdump.h b/drivers/ar6000/include/AR6001_regdump.h
+new file mode 100644
+index 0000000..c1bcade
+--- /dev/null
++++ b/drivers/ar6000/include/AR6001_regdump.h
+@@ -0,0 +1,100 @@
++/*
++ * Copyright (c) 2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ */
+
-+/* HTC ready message
-+ * direction : target-to-host */
-+typedef PREPACK struct {
-+ A_UINT16 MessageID; /* ID */
-+ A_UINT16 CreditCount; /* number of credits the target can offer */
-+ A_UINT16 CreditSize; /* size of each credit */
-+ A_UINT8 MaxEndpoints; /* maximum number of endpoints the target has resources for */
-+ A_UINT8 _Pad1;
-+} POSTPACK HTC_READY_MSG;
++#ifndef __AR6000_REGDUMP_H__
++#define __AR6000_REGDUMP_H__
+
-+#define HTC_SERVICE_META_DATA_MAX_LENGTH 128
++#if !defined(__ASSEMBLER__)
++/*
++ * Target CPU state at the time of failure is reflected
++ * in a register dump, which the Host can fetch through
++ * the diagnostic window.
++ */
+
-+/* connect service
-+ * direction : host-to-target */
-+typedef PREPACK struct {
-+ A_UINT16 MessageID;
-+ A_UINT16 ServiceID; /* service ID of the service to connect to */
-+ A_UINT16 ConnectionFlags; /* connection flags */
++struct MIPS_exception_frame_s {
++ A_UINT32 pc; /* Program Counter */
++ A_UINT32 at; /* MIPS General Purpose registers */
++ A_UINT32 v0;
++ A_UINT32 v1;
++ A_UINT32 a0;
++ A_UINT32 a1;
++ A_UINT32 a2;
++ A_UINT32 a3;
++ A_UINT32 t0;
++ A_UINT32 t1;
++ A_UINT32 t2;
++ A_UINT32 t3;
++ A_UINT32 t4;
++ A_UINT32 t5;
++ A_UINT32 t6;
++ A_UINT32 t7;
++ A_UINT32 s0;
++ A_UINT32 s1;
++ A_UINT32 s2;
++ A_UINT32 s3;
++ A_UINT32 s4;
++ A_UINT32 s5;
++ A_UINT32 s6;
++ A_UINT32 s7;
++ A_UINT32 t8;
++ A_UINT32 t9;
++ A_UINT32 k0;
++ A_UINT32 k1;
++ A_UINT32 gp;
++ A_UINT32 sp;
++ A_UINT32 s8;
++ A_UINT32 ra;
++ A_UINT32 cause; /* Selected coprocessor regs */
++ A_UINT32 status;
++};
++typedef struct MIPS_exception_frame_s CPU_exception_frame_t;
+
-+#define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2) /* reduce credit dribbling when
-+ the host needs credits */
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK (0x3)
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_FOURTH 0x0
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF 0x1
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_THREE_FOURTHS 0x2
-+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_UNITY 0x3
++#endif
+
-+ A_UINT8 ServiceMetaLength; /* length of meta data that follows */
-+ A_UINT8 _Pad1;
++/*
++ * Offsets into MIPS_exception_frame structure, for use in assembler code
++ * MUST MATCH C STRUCTURE ABOVE
++ */
++#define RD_pc 0
++#define RD_at 1
++#define RD_v0 2
++#define RD_v1 3
++#define RD_a0 4
++#define RD_a1 5
++#define RD_a2 6
++#define RD_a3 7
++#define RD_t0 8
++#define RD_t1 9
++#define RD_t2 10
++#define RD_t3 11
++#define RD_t4 12
++#define RD_t5 13
++#define RD_t6 14
++#define RD_t7 15
++#define RD_s0 16
++#define RD_s1 17
++#define RD_s2 18
++#define RD_s3 19
++#define RD_s4 20
++#define RD_s5 21
++#define RD_s6 22
++#define RD_s7 23
++#define RD_t8 24
++#define RD_t9 25
++#define RD_k0 26
++#define RD_k1 27
++#define RD_gp 28
++#define RD_sp 29
++#define RD_s8 30
++#define RD_ra 31
++#define RD_cause 32
++#define RD_status 33
+
-+ /* service-specific meta data starts after the header */
++#define RD_SIZE (34*4) /* Space for this number of words */
+
-+} POSTPACK HTC_CONNECT_SERVICE_MSG;
++#endif /* __AR6000_REGDUMP_H__ */
+diff --git a/drivers/ar6000/include/AR6K_version.h b/drivers/ar6000/include/AR6K_version.h
+new file mode 100644
+index 0000000..d5b2a20
+--- /dev/null
++++ b/drivers/ar6000/include/AR6K_version.h
+@@ -0,0 +1,36 @@
++#define __VER_MAJOR_ 2
++#define __VER_MINOR_ 0
++#define __VER_PATCH_ 0
+
-+/* connect response
-+ * direction : target-to-host */
-+typedef PREPACK struct {
-+ A_UINT16 MessageID;
-+ A_UINT16 ServiceID; /* service ID that the connection request was made */
-+ A_UINT8 Status; /* service connection status */
-+ A_UINT8 EndpointID; /* assigned endpoint ID */
-+ A_UINT16 MaxMsgSize; /* maximum expected message size on this endpoint */
-+ A_UINT8 ServiceMetaLength; /* length of meta data that follows */
-+ A_UINT8 _Pad1;
+
-+ /* service-specific meta data starts after the header */
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * The makear6ksdk script (used for release builds) modifies the following line.
++ */
++#define __BUILD_NUMBER_ 18
+
-+} POSTPACK HTC_CONNECT_SERVICE_RESPONSE_MSG;
+
-+typedef PREPACK struct {
-+ A_UINT16 MessageID;
-+ /* currently, no other fields */
-+} POSTPACK HTC_SETUP_COMPLETE_MSG;
++/* Format of the version number. */
++#define VER_MAJOR_BIT_OFFSET 28
++#define VER_MINOR_BIT_OFFSET 24
++#define VER_PATCH_BIT_OFFSET 16
++#define VER_BUILD_NUM_BIT_OFFSET 0
+
+
-+/* connect response status codes */
-+#define HTC_SERVICE_SUCCESS 0 /* success */
-+#define HTC_SERVICE_NOT_FOUND 1 /* service could not be found */
-+#define HTC_SERVICE_FAILED 2 /* specific service failed the connect */
-+#define HTC_SERVICE_NO_RESOURCES 3 /* no resources (i.e. no more endpoints) */
-+#define HTC_SERVICE_NO_MORE_EP 4 /* specific service is not allowing any more
-+ endpoints */
++/*
++ * The version has the following format:
++ * Bits 28-31: Major version
++ * Bits 24-27: Minor version
++ * Bits 16-23: Patch version
++ * Bits 0-15: Build number (automatically generated during build process )
++ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
++ *
++ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
++ */
++#define AR6K_SW_VERSION ( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
+
-+/* report record IDs */
-+typedef enum {
-+ HTC_RECORD_NULL = 0,
-+ HTC_RECORD_CREDITS = 1,
-+ HTC_RECORD_LOOKAHEAD = 2,
-+} HTC_RPT_IDS;
+
-+typedef PREPACK struct {
-+ A_UINT8 RecordID; /* Record ID */
-+ A_UINT8 Length; /* Length of record */
-+} POSTPACK HTC_RECORD_HDR;
+diff --git a/drivers/ar6000/include/AR6K_version.h.NEW b/drivers/ar6000/include/AR6K_version.h.NEW
+new file mode 100644
+index 0000000..d5b2a20
+--- /dev/null
++++ b/drivers/ar6000/include/AR6K_version.h.NEW
+@@ -0,0 +1,36 @@
++#define __VER_MAJOR_ 2
++#define __VER_MINOR_ 0
++#define __VER_PATCH_ 0
+
-+typedef PREPACK struct {
-+ A_UINT8 EndpointID; /* Endpoint that owns these credits */
-+ A_UINT8 Credits; /* credits to report since last report */
-+} POSTPACK HTC_CREDIT_REPORT;
+
-+typedef PREPACK struct {
-+ A_UINT8 PreValid; /* pre valid guard */
-+ A_UINT8 LookAhead[4]; /* 4 byte lookahead */
-+ A_UINT8 PostValid; /* post valid guard */
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * The makear6ksdk script (used for release builds) modifies the following line.
++ */
++#define __BUILD_NUMBER_ 18
+
-+ /* NOTE: the LookAhead array is guarded by a PreValid and Post Valid guard bytes.
-+ * The PreValid bytes must equal the inverse of the PostValid byte */
+
-+} POSTPACK HTC_LOOKAHEAD_REPORT;
++/* Format of the version number. */
++#define VER_MAJOR_BIT_OFFSET 28
++#define VER_MINOR_BIT_OFFSET 24
++#define VER_PATCH_BIT_OFFSET 16
++#define VER_BUILD_NUM_BIT_OFFSET 0
+
-+#ifndef ATH_TARGET
-+#include "athendpack.h"
-+#endif
+
++/*
++ * The version has the following format:
++ * Bits 28-31: Major version
++ * Bits 24-27: Minor version
++ * Bits 16-23: Patch version
++ * Bits 0-15: Build number (automatically generated during build process )
++ * E.g. Build 1.1.3.7 would be represented as 0x11030007.
++ *
++ * DO NOT split the following macro into multiple lines as this may confuse the build scripts.
++ */
++#define AR6K_SW_VERSION ( ( __VER_MAJOR_ << VER_MAJOR_BIT_OFFSET ) + ( __VER_MINOR_ << VER_MINOR_BIT_OFFSET ) + ( __VER_PATCH_ << VER_PATCH_BIT_OFFSET ) + ( __BUILD_NUMBER_ << VER_BUILD_NUM_BIT_OFFSET ) )
+
-+#endif /* __HTC_H__ */
+
-diff --git a/drivers/ar6000/include/htc_api.h b/drivers/ar6000/include/htc_api.h
+diff --git a/drivers/ar6000/include/AR6Khwreg.h b/drivers/ar6000/include/AR6Khwreg.h
new file mode 100644
-index 0000000..e75692d
+index 0000000..ecfdf20
--- /dev/null
-+++ b/drivers/ar6000/include/htc_api.h
-@@ -0,0 +1,439 @@
++++ b/drivers/ar6000/include/AR6Khwreg.h
+@@ -0,0 +1,147 @@
+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * This file contains the definitions for AR6001 registers
++ * that may be directly manipulated by Host software.
+ */
+
-+#ifndef _HTC_API_H_
-+#define _HTC_API_H_
-+
-+#include <htc.h>
-+#include <htc_services.h>
-+#include "htc_packet.h"
++#ifndef __AR6KHWREG_H__
++#define __AR6KHWREG_H__
+
+#ifdef __cplusplus
+extern "C" {
-+#endif /* __cplusplus */
++#endif
+
-+/* TODO.. for BMI */
-+#define ENDPOINT1 0
-+// TODO -remove me, but we have to fix BMI first
-+#define HTC_MAILBOX_NUM_MAX 4
++/* Host registers */
++#define HOST_INT_STATUS_ADDRESS 0x00000400
++#define CPU_INT_STATUS_ADDRESS 0x00000401
++#define ERROR_INT_STATUS_ADDRESS 0x00000402
++#define INT_STATUS_ENABLE_ADDRESS 0x00000418
++#define CPU_INT_STATUS_ENABLE_ADDRESS 0x00000419
++#define COUNT_ADDRESS 0x00000420
++#define COUNT_DEC_ADDRESS 0x00000440
++#define WINDOW_DATA_ADDRESS 0x00000474
++#define WINDOW_WRITE_ADDR_ADDRESS 0x00000478
++#define WINDOW_READ_ADDR_ADDRESS 0x0000047c
+
++/* Target addresses */
++#define RESET_CONTROL_ADDRESS 0x0c000000
++#define MC_REMAP_VALID_ADDRESS 0x0c004080
++#define MC_REMAP_SIZE_ADDRESS 0x0c004100
++#define MC_REMAP_COMPARE_ADDRESS 0x0c004180
++#define MC_REMAP_TARGET_ADDRESS 0x0c004200
++#define LOCAL_COUNT_ADDRESS 0x0c014080
++#define LOCAL_SCRATCH_ADDRESS 0x0c0140c0
+
-+/* ------ Endpoint IDS ------ */
-+typedef enum
-+{
-+ ENDPOINT_UNUSED = -1,
-+ ENDPOINT_0 = 0,
-+ ENDPOINT_1 = 1,
-+ ENDPOINT_2 = 2,
-+ ENDPOINT_3,
-+ ENDPOINT_4,
-+ ENDPOINT_5,
-+ ENDPOINT_6,
-+ ENDPOINT_7,
-+ ENDPOINT_8,
-+ ENDPOINT_MAX,
-+} HTC_ENDPOINT_ID;
-+
-+/* this is the amount of header room required by users of HTC */
-+#define HTC_HEADER_LEN HTC_HDR_LENGTH
-+
-+typedef void *HTC_HANDLE;
-+
-+typedef A_UINT16 HTC_SERVICE_ID;
-+
-+typedef struct _HTC_INIT_INFO {
-+ void (*AddInstance)(HTC_HANDLE);
-+ void (*DeleteInstance)(void *Instance);
-+ void (*TargetFailure)(void *Instance, A_STATUS Status);
-+} HTC_INIT_INFO;
-+
-+/* per service connection send completion */
-+typedef void (*HTC_EP_SEND_PKT_COMPLETE)(void *,HTC_PACKET *);
-+/* per service connection pkt received */
-+typedef void (*HTC_EP_RECV_PKT)(void *,HTC_PACKET *);
-+
-+/* Optional per service connection receive buffer re-fill callback,
-+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
-+ * to the network stack. The driver never gets the packets back from the OS. For these OSes
-+ * a refill callback can be used to allocate and re-queue buffers into HTC.
-+ *
-+ * On other OSes, the network stack can call into the driver's OS-specifc "return_packet" handler and
-+ * the driver can re-queue these buffers into HTC. In this regard a refill callback is
-+ * unnecessary */
-+typedef void (*HTC_EP_RECV_REFILL)(void *, HTC_ENDPOINT_ID Endpoint);
-+
-+/* Optional per service connection callback when a send queue is full. This can occur if the
-+ * host continues queueing up TX packets faster than credits can arrive
-+ * To prevent the host (on some Oses like Linux) from continuously queueing packets
-+ * and consuming resources, this callback is provided so that that the host
-+ * can disable TX in the subsystem (i.e. network stack)
-+ * Other OSes require a "per-packet" indication_RAW_STREAM_NUM_MAX for each completed TX packet, this
-+ * closed loop mechanism will prevent the network stack from overunning the NIC */
-+typedef void (*HTC_EP_SEND_QUEUE_FULL)(void *, HTC_ENDPOINT_ID Endpoint);
-+/* Optional per service connection callback when a send queue is available for receive new packet. */
-+typedef void (*HTC_EP_SEND_QUEUE_AVAIL)(void *, HTC_ENDPOINT_ID Endpoint);
-+
-+typedef struct _HTC_EP_CALLBACKS {
-+ void *pContext; /* context for each callback */
-+ HTC_EP_SEND_PKT_COMPLETE EpTxComplete; /* tx completion callback for connected endpoint */
-+ HTC_EP_RECV_PKT EpRecv; /* receive callback for connected endpoint */
-+ HTC_EP_RECV_REFILL EpRecvRefill; /* OPTIONAL receive re-fill callback for connected endpoint */
-+ HTC_EP_SEND_QUEUE_FULL EpSendFull; /* OPTIONAL send full callback */
-+ HTC_EP_SEND_QUEUE_AVAIL EpSendAvail; /* OPTIONAL send available callback */
-+} HTC_EP_CALLBACKS;
-+
-+/* service connection information */
-+typedef struct _HTC_SERVICE_CONNECT_REQ {
-+ HTC_SERVICE_ID ServiceID; /* service ID to connect to */
-+ A_UINT16 ConnectionFlags; /* connection flags, see htc protocol definition */
-+ A_UINT8 *pMetaData; /* ptr to optional service-specific meta-data */
-+ A_UINT8 MetaDataLength; /* optional meta data length */
-+ HTC_EP_CALLBACKS EpCallbacks; /* endpoint callbacks */
-+ int MaxSendQueueDepth; /* maximum depth of any send queue */
-+} HTC_SERVICE_CONNECT_REQ;
+
-+/* service connection response information */
-+typedef struct _HTC_SERVICE_CONNECT_RESP {
-+ A_UINT8 *pMetaData; /* caller supplied buffer to optional meta-data */
-+ A_UINT8 BufferLength; /* length of caller supplied buffer */
-+ A_UINT8 ActualLength; /* actual length of meta data */
-+ HTC_ENDPOINT_ID Endpoint; /* endpoint to communicate over */
-+ int MaxMsgLength; /* max length of all messages over this endpoint */
-+ A_UINT8 ConnectRespCode; /* connect response code from target */
-+} HTC_SERVICE_CONNECT_RESP;
++#define INT_STATUS_ENABLE_ERROR_MSB 7
++#define INT_STATUS_ENABLE_ERROR_LSB 7
++#define INT_STATUS_ENABLE_ERROR_MASK 0x00000080
++#define INT_STATUS_ENABLE_ERROR_GET(x) (((x) & INT_STATUS_ENABLE_ERROR_MASK) >> INT_STATUS_ENABLE_ERROR_LSB)
++#define INT_STATUS_ENABLE_ERROR_SET(x) (((x) << INT_STATUS_ENABLE_ERROR_LSB) & INT_STATUS_ENABLE_ERROR_MASK)
+
-+/* endpoint distribution structure */
-+typedef struct _HTC_ENDPOINT_CREDIT_DIST {
-+ struct _HTC_ENDPOINT_CREDIT_DIST *pNext;
-+ struct _HTC_ENDPOINT_CREDIT_DIST *pPrev;
-+ HTC_SERVICE_ID ServiceID; /* Service ID (set by HTC) */
-+ HTC_ENDPOINT_ID Endpoint; /* endpoint for this distribution struct (set by HTC) */
-+ A_UINT32 DistFlags; /* distribution flags, distribution function can
-+ set default activity using SET_EP_ACTIVE() macro */
-+ int TxCreditsNorm; /* credits for normal operation, anything above this
-+ indicates the endpoint is over-subscribed, this field
-+ is only relevant to the credit distribution function */
-+ int TxCreditsMin; /* floor for credit distribution, this field is
-+ only relevant to the credit distribution function */
-+ int TxCreditsAssigned; /* number of credits assigned to this EP, this field
-+ is only relevant to the credit dist function */
-+ int TxCredits; /* current credits available, this field is used by
-+ HTC to determine whether a message can be sent or
-+ must be queued */
-+ int TxCreditsToDist; /* pending credits to distribute on this endpoint, this
-+ is set by HTC when credit reports arrive.
-+ The credit distribution functions sets this to zero
-+ when it distributes the credits */
-+ int TxCreditsSeek; /* this is the number of credits that the current pending TX
-+ packet needs to transmit. This is set by HTC when
-+ and endpoint needs credits in order to transmit */
-+ int TxCreditSize; /* size in bytes of each credit (set by HTC) */
-+ int TxCreditsPerMaxMsg; /* credits required for a maximum sized messages (set by HTC) */
-+ void *pHTCReserved; /* reserved for HTC use */
-+} HTC_ENDPOINT_CREDIT_DIST;
++#define INT_STATUS_ENABLE_CPU_MSB 6
++#define INT_STATUS_ENABLE_CPU_LSB 6
++#define INT_STATUS_ENABLE_CPU_MASK 0x00000040
++#define INT_STATUS_ENABLE_CPU_GET(x) (((x) & INT_STATUS_ENABLE_CPU_MASK) >> INT_STATUS_ENABLE_CPU_LSB)
++#define INT_STATUS_ENABLE_CPU_SET(x) (((x) << INT_STATUS_ENABLE_CPU_LSB) & INT_STATUS_ENABLE_CPU_MASK)
+
-+#define HTC_EP_ACTIVE (1 << 31)
++#define INT_STATUS_ENABLE_COUNTER_MSB 4
++#define INT_STATUS_ENABLE_COUNTER_LSB 4
++#define INT_STATUS_ENABLE_COUNTER_MASK 0x00000010
++#define INT_STATUS_ENABLE_COUNTER_GET(x) (((x) & INT_STATUS_ENABLE_COUNTER_MASK) >> INT_STATUS_ENABLE_COUNTER_LSB)
++#define INT_STATUS_ENABLE_COUNTER_SET(x) (((x) << INT_STATUS_ENABLE_COUNTER_LSB) & INT_STATUS_ENABLE_COUNTER_MASK)
+
-+/* macro to check if an endpoint has gone active, useful for credit
-+ * distributions */
-+#define IS_EP_ACTIVE(epDist) ((epDist)->DistFlags & HTC_EP_ACTIVE)
-+#define SET_EP_ACTIVE(epDist) (epDist)->DistFlags |= HTC_EP_ACTIVE
++#define INT_STATUS_ENABLE_MBOX_DATA_MSB 3
++#define INT_STATUS_ENABLE_MBOX_DATA_LSB 0
++#define INT_STATUS_ENABLE_MBOX_DATA_MASK 0x0000000f
++#define INT_STATUS_ENABLE_MBOX_DATA_GET(x) (((x) & INT_STATUS_ENABLE_MBOX_DATA_MASK) >> INT_STATUS_ENABLE_MBOX_DATA_LSB)
++#define INT_STATUS_ENABLE_MBOX_DATA_SET(x) (((x) << INT_STATUS_ENABLE_MBOX_DATA_LSB) & INT_STATUS_ENABLE_MBOX_DATA_MASK)
+
-+ /* credit distibution code that is passed into the distrbution function,
-+ * there are mandatory and optional codes that must be handled */
-+typedef enum _HTC_CREDIT_DIST_REASON {
-+ HTC_CREDIT_DIST_SEND_COMPLETE = 0, /* credits available as a result of completed
-+ send operations (MANDATORY) resulting in credit reports */
-+ HTC_CREDIT_DIST_ACTIVITY_CHANGE = 1, /* a change in endpoint activity occured (OPTIONAL) */
-+ HTC_CREDIT_DIST_SEEK_CREDITS, /* an endpoint needs to "seek" credits (OPTIONAL) */
-+ HTC_DUMP_CREDIT_STATE /* for debugging, dump any state information that is kept by
-+ the distribution function */
-+} HTC_CREDIT_DIST_REASON;
++#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MSB 1
++#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB 1
++#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK 0x00000002
++#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK) >> ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB)
++#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
+
-+typedef void (*HTC_CREDIT_DIST_CALLBACK)(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+ HTC_CREDIT_DIST_REASON Reason);
++#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MSB 0
++#define ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB 0
++#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK 0x00000001
++#define ERROR_STATUS_ENABLE_TX_OVERFLOW_GET(x) (((x) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK) >> ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB)
++#define ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
+
-+typedef void (*HTC_CREDIT_INIT_CALLBACK)(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+ int TotalCredits);
+
-+ /* endpoint statistics action */
-+typedef enum _HTC_ENDPOINT_STAT_ACTION {
-+ HTC_EP_STAT_SAMPLE = 0, /* only read statistics */
-+ HTC_EP_STAT_SAMPLE_AND_CLEAR = 1, /* sample and immediately clear statistics */
-+ HTC_EP_STAT_CLEAR /* clear only */
-+} HTC_ENDPOINT_STAT_ACTION;
++#define CPU_INT_STATUS_ENABLE_BIT_MSB 7
++#define CPU_INT_STATUS_ENABLE_BIT_LSB 0
++#define CPU_INT_STATUS_ENABLE_BIT_MASK 0x000000ff
++#define CPU_INT_STATUS_ENABLE_BIT_GET(x) (((x) & CPU_INT_STATUS_ENABLE_BIT_MASK) >> CPU_INT_STATUS_ENABLE_BIT_LSB)
++#define CPU_INT_STATUS_ENABLE_BIT_SET(x) (((x) << CPU_INT_STATUS_ENABLE_BIT_LSB) & CPU_INT_STATUS_ENABLE_BIT_MASK)
+
-+ /* endpoint statistics */
-+typedef struct _HTC_ENDPOINT_STATS {
-+ A_UINT32 TxCreditLowIndications; /* number of times the host set the credit-low flag in a send message on
-+ this endpoint */
-+ A_UINT32 TxIssued; /* running count of TX packets issued */
-+ A_UINT32 TxCreditRpts; /* running count of total credit reports received for this endpoint */
-+ A_UINT32 TxCreditRptsFromRx;
-+ A_UINT32 TxCreditRptsFromOther;
-+ A_UINT32 TxCreditRptsFromEp0;
-+ A_UINT32 TxCreditsFromRx; /* count of credits received via Rx packets on this endpoint */
-+ A_UINT32 TxCreditsFromOther; /* count of credits received via another endpoint */
-+ A_UINT32 TxCreditsFromEp0; /* count of credits received via another endpoint */
-+ A_UINT32 TxCreditsConsummed; /* count of consummed credits */
-+ A_UINT32 TxCreditsReturned; /* count of credits returned */
-+ A_UINT32 RxReceived; /* count of RX packets received */
-+ A_UINT32 RxLookAheads; /* count of lookahead records
-+ found in messages received on this endpoint */
-+} HTC_ENDPOINT_STATS;
++#define COUNTER_INT_STATUS_ENABLE_BIT_MSB 7
++#define COUNTER_INT_STATUS_ENABLE_BIT_LSB 0
++#define COUNTER_INT_STATUS_ENABLE_BIT_MASK 0x000000ff
++#define COUNTER_INT_STATUS_ENABLE_BIT_GET(x) (((x) & COUNTER_INT_STATUS_ENABLE_BIT_MASK) >> COUNTER_INT_STATUS_ENABLE_BIT_LSB)
++#define COUNTER_INT_STATUS_ENABLE_BIT_SET(x) (((x) << COUNTER_INT_STATUS_ENABLE_BIT_LSB) & COUNTER_INT_STATUS_ENABLE_BIT_MASK)
+
-+/* ------ Function Prototypes ------ */
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Initialize HTC
-+ @function name: HTCInit
-+ @input: pInfo - initialization information
-+ @output:
-+ @return: A_OK on success
-+ @notes: The caller initializes global HTC state and registers various instance
-+ notification callbacks (see HTC_INIT_INFO).
++#define ERROR_INT_STATUS_WAKEUP_MSB 2
++#define ERROR_INT_STATUS_WAKEUP_LSB 2
++#define ERROR_INT_STATUS_WAKEUP_MASK 0x00000004
++#define ERROR_INT_STATUS_WAKEUP_GET(x) (((x) & ERROR_INT_STATUS_WAKEUP_MASK) >> ERROR_INT_STATUS_WAKEUP_LSB)
++#define ERROR_INT_STATUS_WAKEUP_SET(x) (((x) << ERROR_INT_STATUS_WAKEUP_LSB) & ERROR_INT_STATUS_WAKEUP_MASK)
+
-+ @example:
-+ @see also: HTCShutdown
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCInit(HTC_INIT_INFO *pInfo);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Get the underlying HIF device handle
-+ @function name: HTCGetHifDevice
-+ @input: HTCHandle - handle passed into the AddInstance callback
-+ @output:
-+ @return: opaque HIF device handle usable in HIF API calls.
-+ @notes:
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void *HTCGetHifDevice(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Set the associated instance for the HTC handle
-+ @function name: HTCSetInstance
-+ @input: HTCHandle - handle passed into the AddInstance callback
-+ Instance - caller supplied instance object
-+ @output:
-+ @return:
-+ @notes: Caller must set the instance information for the HTC handle in order to receive
-+ notifications for instance deletion (DeleteInstance callback is called) and for target
-+ failure notification.
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Set credit distribution parameters
-+ @function name: HTCSetCreditDistribution
-+ @input: HTCHandle - HTC handle
-+ pCreditDistCont - caller supplied context to pass into distribution functions
-+ CreditDistFunc - Distribution function callback
-+ CreditDistInit - Credit Distribution initialization callback
-+ ServicePriorityOrder - Array containing list of service IDs, lowest index is highest
-+ priority
-+ ListLength - number of elements in ServicePriorityOrder
-+ @output:
-+ @return:
-+ @notes: The user can set a custom credit distribution function to handle special requirements
-+ for each endpoint. A default credit distribution routine can be used by setting
-+ CreditInitFunc to NULL. The default credit distribution is only provided for simple
-+ "fair" credit distribution without regard to any prioritization.
++#define ERROR_INT_STATUS_RX_UNDERFLOW_MSB 1
++#define ERROR_INT_STATUS_RX_UNDERFLOW_LSB 1
++#define ERROR_INT_STATUS_RX_UNDERFLOW_MASK 0x00000002
++#define ERROR_INT_STATUS_RX_UNDERFLOW_GET(x) (((x) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK) >> ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
++#define ERROR_INT_STATUS_RX_UNDERFLOW_SET(x) (((x) << ERROR_INT_STATUS_RX_UNDERFLOW_LSB) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK)
+
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCSetCreditDistribution(HTC_HANDLE HTCHandle,
-+ void *pCreditDistContext,
-+ HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
-+ HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
-+ HTC_SERVICE_ID ServicePriorityOrder[],
-+ int ListLength);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Wait for the target to indicate the HTC layer is ready
-+ @function name: HTCWaitTarget
-+ @input: HTCHandle - HTC handle
-+ @output:
-+ @return:
-+ @notes: This API blocks until the target responds with an HTC ready message.
-+ The caller should not connect services until the target has indicated it is
-+ ready.
-+ @example:
-+ @see also: HTCConnectService
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Start target service communications
-+ @function name: HTCStart
-+ @input: HTCHandle - HTC handle
-+ @output:
-+ @return:
-+ @notes: This API indicates to the target that the service connection phase is complete
-+ and the target can freely start all connected services. This API should only be
-+ called AFTER all service connections have been made. TCStart will issue a
-+ SETUP_COMPLETE message to the target to indicate that all service connections
-+ have been made and the target can start communicating over the endpoints.
-+ @example:
-+ @see also: HTCConnectService
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCStart(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Add receive packet to HTC
-+ @function name: HTCAddReceivePkt
-+ @input: HTCHandle - HTC handle
-+ pPacket - HTC receive packet to add
-+ @output:
-+ @return: A_OK on success
-+ @notes: user must supply HTC packets for capturing incomming HTC frames. The caller
-+ must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
-+ macro.
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Connect to an HTC service
-+ @function name: HTCConnectService
-+ @input: HTCHandle - HTC handle
-+ pReq - connection details
-+ @output: pResp - connection response
-+ @return:
-+ @notes: Service connections must be performed before HTCStart. User provides callback handlers
-+ for various endpoint events.
-+ @example:
-+ @see also: HTCStart
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCConnectService(HTC_HANDLE HTCHandle,
-+ HTC_SERVICE_CONNECT_REQ *pReq,
-+ HTC_SERVICE_CONNECT_RESP *pResp);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Send an HTC packet
-+ @function name: HTCSendPkt
-+ @input: HTCHandle - HTC handle
-+ pPacket - packet to send
-+ @output:
-+ @return: A_OK
-+ @notes: Caller must initialize packet using SET_HTC_PACKET_INFO_TX() macro.
-+ This interface is fully asynchronous. On error, HTC SendPkt will
-+ call the registered Endpoint callback to cleanup the packet.
-+ @example:
-+ @see also: HTCFlushEndpoint
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_STATUS HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Stop HTC service communications
-+ @function name: HTCStop
-+ @input: HTCHandle - HTC handle
-+ @output:
-+ @return:
-+ @notes: HTC communications is halted. All receive and pending TX packets will
-+ be flushed.
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCStop(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Shutdown HTC
-+ @function name: HTCShutdown
-+ @input:
-+ @output:
-+ @return:
-+ @notes: This cleans up all resources allocated by HTCInit().
-+ @example:
-+ @see also: HTCInit
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCShutDown(void);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Flush pending TX packets
-+ @function name: HTCFlushEndpoint
-+ @input: HTCHandle - HTC handle
-+ Endpoint - Endpoint to flush
-+ Tag - flush tag
-+ @output:
-+ @return:
-+ @notes: The Tag parameter is used to selectively flush packets with matching tags.
-+ The value of 0 forces all packets to be flush regardless of tag.
-+ @example:
-+ @see also: HTCSendPkt
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Dump credit distribution state
-+ @function name: HTCDumpCreditStates
-+ @input: HTCHandle - HTC handle
-+ @output:
-+ @return:
-+ @notes: This dumps all credit distribution information to the debugger
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCDumpCreditStates(HTC_HANDLE HTCHandle);
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Indicate a traffic activity change on an endpoint
-+ @function name: HTCIndicateActivityChange
-+ @input: HTCHandle - HTC handle
-+ Endpoint - endpoint in which activity has changed
-+ Active - TRUE if active, FALSE if it has become inactive
-+ @output:
-+ @return:
-+ @notes: This triggers the registered credit distribution function to
-+ re-adjust credits for active/inactive endpoints.
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+void HTCIndicateActivityChange(HTC_HANDLE HTCHandle,
-+ HTC_ENDPOINT_ID Endpoint,
-+ A_BOOL Active);
++#define ERROR_INT_STATUS_TX_OVERFLOW_MSB 0
++#define ERROR_INT_STATUS_TX_OVERFLOW_LSB 0
++#define ERROR_INT_STATUS_TX_OVERFLOW_MASK 0x00000001
++#define ERROR_INT_STATUS_TX_OVERFLOW_GET(x) (((x) & ERROR_INT_STATUS_TX_OVERFLOW_MASK) >> ERROR_INT_STATUS_TX_OVERFLOW_LSB)
++#define ERROR_INT_STATUS_TX_OVERFLOW_SET(x) (((x) << ERROR_INT_STATUS_TX_OVERFLOW_LSB) & ERROR_INT_STATUS_TX_OVERFLOW_MASK)
+
-+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-+ @desc: Get endpoint statistics
-+ @function name: HTCGetEndpointStatistics
-+ @input: HTCHandle - HTC handle
-+ Endpoint - Endpoint identifier
-+ Action - action to take with statistics
-+ @output:
-+ pStats - statistics that were sampled (can be NULL if Action is HTC_EP_STAT_CLEAR)
++#define HOST_INT_STATUS_ERROR_MSB 7
++#define HOST_INT_STATUS_ERROR_LSB 7
++#define HOST_INT_STATUS_ERROR_MASK 0x00000080
++#define HOST_INT_STATUS_ERROR_GET(x) (((x) & HOST_INT_STATUS_ERROR_MASK) >> HOST_INT_STATUS_ERROR_LSB)
++#define HOST_INT_STATUS_ERROR_SET(x) (((x) << HOST_INT_STATUS_ERROR_LSB) & HOST_INT_STATUS_ERROR_MASK)
+
-+ @return: TRUE if statistics profiling is enabled, otherwise FALSE.
++#define HOST_INT_STATUS_CPU_MSB 6
++#define HOST_INT_STATUS_CPU_LSB 6
++#define HOST_INT_STATUS_CPU_MASK 0x00000040
++#define HOST_INT_STATUS_CPU_GET(x) (((x) & HOST_INT_STATUS_CPU_MASK) >> HOST_INT_STATUS_CPU_LSB)
++#define HOST_INT_STATUS_CPU_SET(x) (((x) << HOST_INT_STATUS_CPU_LSB) & HOST_INT_STATUS_CPU_MASK)
+
-+ @notes: Statistics is a compile-time option and this function may return FALSE
-+ if HTC is not compiled with profiling.
++#define HOST_INT_STATUS_COUNTER_MSB 4
++#define HOST_INT_STATUS_COUNTER_LSB 4
++#define HOST_INT_STATUS_COUNTER_MASK 0x00000010
++#define HOST_INT_STATUS_COUNTER_GET(x) (((x) & HOST_INT_STATUS_COUNTER_MASK) >> HOST_INT_STATUS_COUNTER_LSB)
++#define HOST_INT_STATUS_COUNTER_SET(x) (((x) << HOST_INT_STATUS_COUNTER_LSB) & HOST_INT_STATUS_COUNTER_MASK)
+
-+ The caller can specify the statistic "action" to take when sampling
-+ the statistics. This includes:
++#define RESET_CONTROL_WARM_RST_MSB 7
++#define RESET_CONTROL_WARM_RST_LSB 7
++#define RESET_CONTROL_WARM_RST_MASK 0x00000080
++#define RESET_CONTROL_WARM_RST_GET(x) (((x) & RESET_CONTROL_WARM_RST_MASK) >> RESET_CONTROL_WARM_RST_LSB)
++#define RESET_CONTROL_WARM_RST_SET(x) (((x) << RESET_CONTROL_WARM_RST_LSB) & RESET_CONTROL_WARM_RST_MASK)
+
-+ HTC_EP_STAT_SAMPLE: The pStats structure is filled with the current values.
-+ HTC_EP_STAT_SAMPLE_AND_CLEAR: The structure is filled and the current statistics
-+ are cleared.
-+ HTC_EP_STAT_CLEA : the statistics are cleared, the called can pass a NULL value for
-+ pStats
++#define RESET_CONTROL_COLD_RST_MSB 8
++#define RESET_CONTROL_COLD_RST_LSB 8
++#define RESET_CONTROL_COLD_RST_MASK 0x00000100
++#define RESET_CONTROL_COLD_RST_GET(x) (((x) & RESET_CONTROL_COLD_RST_MASK) >> RESET_CONTROL_COLD_RST_LSB)
++#define RESET_CONTROL_COLD_RST_SET(x) (((x) << RESET_CONTROL_COLD_RST_LSB) & RESET_CONTROL_COLD_RST_MASK)
+
-+ @example:
-+ @see also:
-++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
-+A_BOOL HTCGetEndpointStatistics(HTC_HANDLE HTCHandle,
-+ HTC_ENDPOINT_ID Endpoint,
-+ HTC_ENDPOINT_STAT_ACTION Action,
-+ HTC_ENDPOINT_STATS *pStats);
++#define RESET_CAUSE_LAST_MSB 2
++#define RESET_CAUSE_LAST_LSB 0
++#define RESET_CAUSE_LAST_MASK 0x00000007
++#define RESET_CAUSE_LAST_GET(x) (((x) & RESET_CAUSE_LAST_MASK) >> RESET_CAUSE_LAST_LSB)
++#define RESET_CAUSE_LAST_SET(x) (((x) << RESET_CAUSE_LAST_LSB) & RESET_CAUSE_LAST_MASK)
+
+#ifdef __cplusplus
+}
+#endif
+
-+#endif /* _HTC_API_H_ */
-diff --git a/drivers/ar6000/include/htc_packet.h b/drivers/ar6000/include/htc_packet.h
++#endif /* __AR6KHWREG_H__ */
+diff --git a/drivers/ar6000/include/a_config.h b/drivers/ar6000/include/a_config.h
new file mode 100644
-index 0000000..9ce8718
+index 0000000..627b298
--- /dev/null
-+++ b/drivers/ar6000/include/htc_packet.h
-@@ -0,0 +1,138 @@
++++ b/drivers/ar6000/include/a_config.h
+@@ -0,0 +1,27 @@
++#ifndef _A_CONFIG_H_
++#define _A_CONFIG_H_
+/*
-+ *
-+ * Copyright (c) 2007 Atheros Communications Inc.
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
+ *
+ */
+
-+#ifndef HTC_PACKET_H_
-+#define HTC_PACKET_H_
-+
-+
-+#include "dl_list.h"
-+
-+struct _HTC_PACKET;
-+
-+typedef void (* HTC_PACKET_COMPLETION)(void *,struct _HTC_PACKET *);
-+
-+typedef A_UINT16 HTC_TX_TAG;
-+
-+typedef struct _HTC_TX_PACKET_INFO {
-+ HTC_TX_TAG Tag; /* tag used to selective flush packets */
-+} HTC_TX_PACKET_INFO;
-+
-+#define HTC_TX_PACKET_TAG_ALL 0 /* a tag of zero is reserved and used to flush ALL packets */
-+#define HTC_TX_PACKET_TAG_INTERNAL 1 /* internal tags start here */
-+#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
++/*
++ * This file contains software configuration options that enables
++ * specific software "features"
++ */
++#include "../ar6000/config_linux.h"
+
-+typedef struct _HTC_RX_PACKET_INFO {
-+ A_UINT32 Unused; /* for future use and to make compilers happy */
-+} HTC_RX_PACKET_INFO;
-+
-+/* wrapper around endpoint-specific packets */
-+typedef struct _HTC_PACKET {
-+ DL_LIST ListLink; /* double link */
-+ void *pPktContext; /* caller's per packet specific context */
-+
-+ A_UINT8 *pBufferStart; /* the true buffer start , the caller can
-+ store the real buffer start here. In
-+ receive callbacks, the HTC layer sets pBuffer
-+ to the start of the payload past the header. This
-+ field allows the caller to reset pBuffer when it
-+ recycles receive packets back to HTC */
-+ /*
-+ * Pointer to the start of the buffer. In the transmit
-+ * direction this points to the start of the payload. In the
-+ * receive direction, however, the buffer when queued up
-+ * points to the start of the HTC header but when returned
-+ * to the caller points to the start of the payload
-+ */
-+ A_UINT8 *pBuffer; /* payload start (RX/TX) */
-+ A_UINT32 BufferLength; /* length of buffer */
-+ A_UINT32 ActualLength; /* actual length of payload */
-+ int Endpoint; /* endpoint that this packet was sent/recv'd from */
-+ A_STATUS Status; /* completion status */
-+ union {
-+ HTC_TX_PACKET_INFO AsTx; /* Tx Packet specific info */
-+ HTC_RX_PACKET_INFO AsRx; /* Rx Packet specific info */
-+ } PktInfo;
-+
-+ /* the following fields are for internal HTC use */
-+ HTC_PACKET_COMPLETION Completion; /* completion */
-+ void *pContext; /* HTC private completion context */
-+ A_UINT32 HTCReserved; /* reserved */
-+} HTC_PACKET;
-+
-+
-+
-+#define COMPLETE_HTC_PACKET(p,status) \
-+{ \
-+ (p)->Status = (status); \
-+ (p)->Completion((p)->pContext,(p)); \
-+}
-+
-+#define INIT_HTC_PACKET_INFO(p,b,len) \
-+{ \
-+ (p)->pBufferStart = (b); \
-+ (p)->BufferLength = (len); \
-+}
-+
-+/* macro to set an initial RX packet for refilling HTC */
-+#define SET_HTC_PACKET_INFO_RX_REFILL(p,c,b,len,ep) \
-+{ \
-+ (p)->pPktContext = (c); \
-+ (p)->pBuffer = (b); \
-+ (p)->pBufferStart = (b); \
-+ (p)->BufferLength = (len); \
-+ (p)->Endpoint = (ep); \
-+}
-+
-+/* fast macro to recycle an RX packet that will be re-queued to HTC */
-+#define HTC_PACKET_RESET_RX(p) \
-+ (p)->pBuffer = (p)->pBufferStart
-+
-+/* macro to set packet parameters for TX */
-+#define SET_HTC_PACKET_INFO_TX(p,c,b,len,ep,tag) \
-+{ \
-+ (p)->pPktContext = (c); \
-+ (p)->pBuffer = (b); \
-+ (p)->ActualLength = (len); \
-+ (p)->Endpoint = (ep); \
-+ (p)->PktInfo.AsTx.Tag = (tag); \
-+}
-+
-+/* HTC Packet Queueing Macros */
-+typedef DL_LIST HTC_PACKET_QUEUE;
-+/* initialize queue */
-+#define INIT_HTC_PACKET_QUEUE(pQ) DL_LIST_INIT((pQ))
-+/* enqueue HTC packet to the tail of the queue */
-+#define HTC_PACKET_ENQUEUE(pQ,p) DL_ListInsertTail((pQ),&(p)->ListLink)
-+/* test if a queue is empty */
-+#define HTC_QUEUE_EMPTY(pQ) DL_LIST_IS_EMPTY((pQ))
-+/* get packet at head without removing it */
-+#define HTC_GET_PKT_AT_HEAD(pQ) A_CONTAINING_STRUCT((DL_LIST_GET_ITEM_AT_HEAD(pQ)),HTC_PACKET,ListLink);
-+/* remove a packet from the current list it is linked to */
-+#define HTC_PACKET_REMOVE(p) DL_ListRemove(&(p)->ListLink)
-+
-+/* dequeue an HTC packet from the head of the queue */
-+static INLINE HTC_PACKET *HTC_PACKET_DEQUEUE(HTC_PACKET_QUEUE *queue) {
-+ DL_LIST *pItem = DL_ListRemoveItemFromHead(queue);
-+ if (pItem != NULL) {
-+ return A_CONTAINING_STRUCT(pItem, HTC_PACKET, ListLink);
-+ }
-+ return NULL;
-+}
-+
-+#endif /*HTC_PACKET_H_*/
-diff --git a/drivers/ar6000/include/htc_services.h b/drivers/ar6000/include/htc_services.h
++#endif
+diff --git a/drivers/ar6000/include/a_debug.h b/drivers/ar6000/include/a_debug.h
new file mode 100644
-index 0000000..fc6fc29
+index 0000000..4b0b351
--- /dev/null
-+++ b/drivers/ar6000/include/htc_services.h
-@@ -0,0 +1,37 @@
++++ b/drivers/ar6000/include/a_debug.h
+@@ -0,0 +1,41 @@
++#ifndef _A_DEBUG_H_
++#define _A_DEBUG_H_
+/*
-+ * Copyright (c) 2007 Atheros Communications Inc.
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
+ * All rights reserved.
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
+ *
+ */
+
-+#ifndef __HTC_SERVICES_H__
-+#define __HTC_SERVICES_H__
-+
-+/* Current service IDs */
-+
-+typedef enum {
-+ RSVD_SERVICE_GROUP = 0,
-+ WMI_SERVICE_GROUP = 1,
-+
-+ HTC_TEST_GROUP = 254,
-+ HTC_SERVICE_GROUP_LAST = 255
-+}HTC_SERVICE_GROUP_IDS;
++#include <a_types.h>
++#include <a_osapi.h>
+
-+#define MAKE_SERVICE_ID(group,index) \
-+ (int)(((int)group << 8) | (int)(index))
++#define DBG_INFO 0x00000001
++#define DBG_ERROR 0x00000002
++#define DBG_WARNING 0x00000004
++#define DBG_SDIO 0x00000008
++#define DBG_HIF 0x00000010
++#define DBG_HTC 0x00000020
++#define DBG_WMI 0x00000040
++#define DBG_WMI2 0x00000080
++#define DBG_DRIVER 0x00000100
+
-+/* NOTE: service ID of 0x0000 is reserved and should never be used */
-+#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP,1)
-+#define WMI_CONTROL_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,0)
-+#define WMI_DATA_BE_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,1)
-+#define WMI_DATA_BK_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,2)
-+#define WMI_DATA_VI_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,3)
-+#define WMI_DATA_VO_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,4)
-+#define WMI_MAX_SERVICES 5
++#define DBG_DEFAULTS (DBG_ERROR|DBG_WARNING)
+
-+/* raw stream service (i.e. flash, tcmd, calibration apps) */
-+#define HTC_RAW_STREAMS_SVC MAKE_SERVICE_ID(HTC_TEST_GROUP,0)
++#include "../ar6000/debug_linux.h"
+
-+#endif /*HTC_SERVICES_H_*/
-diff --git a/drivers/ar6000/include/ieee80211.h b/drivers/ar6000/include/ieee80211.h
++#endif
+diff --git a/drivers/ar6000/include/a_drv.h b/drivers/ar6000/include/a_drv.h
new file mode 100644
-index 0000000..7090040
+index 0000000..07e52d1
--- /dev/null
-+++ b/drivers/ar6000/include/ieee80211.h
-@@ -0,0 +1,342 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2006 Atheros Communications, Inc.
++++ b/drivers/ar6000/include/a_drv.h
+@@ -0,0 +1,28 @@
++#ifndef _A_DRV_H_
++#define _A_DRV_H_
++/*
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_drv.h#1 $
++ *
++ * This file contains the definitions of the basic atheros data types.
++ * It is used to map the data types in atheros files to a platform specific
++ * type.
++ *
++ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
+ *
-+ * Wireless Network driver for Atheros AR6001
-+ * All rights reserved.
+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
-+#ifndef _NET80211_IEEE80211_H_
-+#define _NET80211_IEEE80211_H_
+
-+#include "athstartpack.h"
++#include "../ar6000/athdrv_linux.h"
+
++#endif /* _ADRV_H_ */
+diff --git a/drivers/ar6000/include/a_drv_api.h b/drivers/ar6000/include/a_drv_api.h
+new file mode 100644
+index 0000000..7531726
+--- /dev/null
++++ b/drivers/ar6000/include/a_drv_api.h
+@@ -0,0 +1,185 @@
++#ifndef _A_DRV_API_H_
++#define _A_DRV_API_H_
+/*
-+ * 802.11 protocol definitions.
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
+
-+#define IEEE80211_ADDR_LEN 6 /* size of 802.11 address */
-+/* is 802.11 address multicast/broadcast? */
-+#define IEEE80211_IS_MULTICAST(_a) (*(_a) & 0x01)
-+#define IEEE80211_ADDR_EQ(addr1, addr2) \
-+ (A_MEMCMP(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+#define IEEE80211_KEYBUF_SIZE 16
-+#define IEEE80211_MICBUF_SIZE (8+8) /* space for both tx and rx */
++/****************************************************************************/
++/****************************************************************************/
++/** **/
++/** WMI related hooks **/
++/** **/
++/****************************************************************************/
++/****************************************************************************/
+
-+/*
-+ * NB: these values are ordered carefully; there are lots of
-+ * of implications in any reordering. In particular beware
-+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
-+ */
-+#define IEEE80211_CIPHER_WEP 0
-+#define IEEE80211_CIPHER_TKIP 1
-+#define IEEE80211_CIPHER_AES_OCB 2
-+#define IEEE80211_CIPHER_AES_CCM 3
-+#define IEEE80211_CIPHER_CKIP 5
-+#define IEEE80211_CIPHER_CCKM_KRK 6
-+#define IEEE80211_CIPHER_NONE 7 /* pseudo value */
++#include <ar6000_api.h>
+
-+#define IEEE80211_CIPHER_MAX (IEEE80211_CIPHER_NONE+1)
++#define A_WMI_CHANNELLIST_RX(devt, numChan, chanList) \
++ ar6000_channelList_rx((devt), (numChan), (chanList))
+
-+#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
-+ (((len) == 5) || ((len) == 13) || ((len) == 16))
++#define A_WMI_SET_NUMDATAENDPTS(devt, num) \
++ ar6000_set_numdataendpts((devt), (num))
+
++#define A_WMI_CONTROL_TX(devt, osbuf, streamID) \
++ ar6000_control_tx((devt), (osbuf), (streamID))
+
++#define A_WMI_TARGETSTATS_EVENT(devt, pStats) \
++ ar6000_targetStats_event((devt), (pStats))
+
-+/*
-+ * generic definitions for IEEE 802.11 frames
-+ */
-+PREPACK struct ieee80211_frame {
-+ A_UINT8 i_fc[2];
-+ A_UINT8 i_dur[2];
-+ A_UINT8 i_addr1[IEEE80211_ADDR_LEN];
-+ A_UINT8 i_addr2[IEEE80211_ADDR_LEN];
-+ A_UINT8 i_addr3[IEEE80211_ADDR_LEN];
-+ A_UINT8 i_seq[2];
-+ /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
-+ /* see below */
-+} POSTPACK;
++#define A_WMI_SCANCOMPLETE_EVENT(devt, status) \
++ ar6000_scanComplete_event((devt), (status))
+
-+#define IEEE80211_FC0_VERSION_MASK 0x03
-+#define IEEE80211_FC0_VERSION_SHIFT 0
-+#define IEEE80211_FC0_VERSION_0 0x00
-+#define IEEE80211_FC0_TYPE_MASK 0x0c
-+#define IEEE80211_FC0_TYPE_SHIFT 2
-+#define IEEE80211_FC0_TYPE_MGT 0x00
-+#define IEEE80211_FC0_TYPE_CTL 0x04
-+#define IEEE80211_FC0_TYPE_DATA 0x08
++#ifdef CONFIG_HOST_DSET_SUPPORT
+
-+#define IEEE80211_FC0_SUBTYPE_MASK 0xf0
-+#define IEEE80211_FC0_SUBTYPE_SHIFT 4
-+/* for TYPE_MGT */
-+#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ 0x00
-+#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP 0x10
-+#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ 0x20
-+#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP 0x30
-+#define IEEE80211_FC0_SUBTYPE_PROBE_REQ 0x40
-+#define IEEE80211_FC0_SUBTYPE_PROBE_RESP 0x50
-+#define IEEE80211_FC0_SUBTYPE_BEACON 0x80
-+#define IEEE80211_FC0_SUBTYPE_ATIM 0x90
-+#define IEEE80211_FC0_SUBTYPE_DISASSOC 0xa0
-+#define IEEE80211_FC0_SUBTYPE_AUTH 0xb0
-+#define IEEE80211_FC0_SUBTYPE_DEAUTH 0xc0
-+/* for TYPE_CTL */
-+#define IEEE80211_FC0_SUBTYPE_PS_POLL 0xa0
-+#define IEEE80211_FC0_SUBTYPE_RTS 0xb0
-+#define IEEE80211_FC0_SUBTYPE_CTS 0xc0
-+#define IEEE80211_FC0_SUBTYPE_ACK 0xd0
-+#define IEEE80211_FC0_SUBTYPE_CF_END 0xe0
-+#define IEEE80211_FC0_SUBTYPE_CF_END_ACK 0xf0
-+/* for TYPE_DATA (bit combination) */
-+#define IEEE80211_FC0_SUBTYPE_DATA 0x00
-+#define IEEE80211_FC0_SUBTYPE_CF_ACK 0x10
-+#define IEEE80211_FC0_SUBTYPE_CF_POLL 0x20
-+#define IEEE80211_FC0_SUBTYPE_CF_ACPL 0x30
-+#define IEEE80211_FC0_SUBTYPE_NODATA 0x40
-+#define IEEE80211_FC0_SUBTYPE_CFACK 0x50
-+#define IEEE80211_FC0_SUBTYPE_CFPOLL 0x60
-+#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
-+#define IEEE80211_FC0_SUBTYPE_QOS 0x80
-+#define IEEE80211_FC0_SUBTYPE_QOS_NULL 0xc0
++#define A_WMI_DSET_DATA_REQ(devt, access_cookie, offset, length, targ_buf, targ_reply_fn, targ_reply_arg) \
++ ar6000_dset_data_req((devt), (access_cookie), (offset), (length), (targ_buf), (targ_reply_fn), (targ_reply_arg))
+
-+#define IEEE80211_FC1_DIR_MASK 0x03
-+#define IEEE80211_FC1_DIR_NODS 0x00 /* STA->STA */
-+#define IEEE80211_FC1_DIR_TODS 0x01 /* STA->AP */
-+#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
-+#define IEEE80211_FC1_DIR_DSTODS 0x03 /* AP ->AP */
++#define A_WMI_DSET_CLOSE(devt, access_cookie) \
++ ar6000_dset_close((devt), (access_cookie))
+
-+#define IEEE80211_FC1_MORE_FRAG 0x04
-+#define IEEE80211_FC1_RETRY 0x08
-+#define IEEE80211_FC1_PWR_MGT 0x10
-+#define IEEE80211_FC1_MORE_DATA 0x20
-+#define IEEE80211_FC1_WEP 0x40
-+#define IEEE80211_FC1_ORDER 0x80
++#endif
+
-+#define IEEE80211_SEQ_FRAG_MASK 0x000f
-+#define IEEE80211_SEQ_FRAG_SHIFT 0
-+#define IEEE80211_SEQ_SEQ_MASK 0xfff0
-+#define IEEE80211_SEQ_SEQ_SHIFT 4
++#define A_WMI_DSET_OPEN_REQ(devt, id, targ_handle, targ_reply_fn, targ_reply_arg) \
++ ar6000_dset_open_req((devt), (id), (targ_handle), (targ_reply_fn), (targ_reply_arg))
+
-+#define IEEE80211_NWID_LEN 32
++#define A_WMI_CONNECT_EVENT(devt, channel, bssid, listenInterval, beaconInterval, networkType, beaconIeLen, assocReqLen, assocRespLen, assocInfo) \
++ ar6000_connect_event((devt), (channel), (bssid), (listenInterval), (beaconInterval), (networkType), (beaconIeLen), (assocReqLen), (assocRespLen), (assocInfo))
+
-+/*
-+ * 802.11 rate set.
-+ */
-+#define IEEE80211_RATE_SIZE 8 /* 802.11 standard */
-+#define IEEE80211_RATE_MAXSIZE 15 /* max rates we'll handle */
++#define A_WMI_REGDOMAIN_EVENT(devt, regCode) \
++ ar6000_regDomain_event((devt), (regCode))
+
-+#define WMM_NUM_AC 4 /* 4 AC categories */
++#define A_WMI_NEIGHBORREPORT_EVENT(devt, numAps, info) \
++ ar6000_neighborReport_event((devt), (numAps), (info))
+
-+#define WMM_PARAM_ACI_M 0x60 /* Mask for ACI field */
-+#define WMM_PARAM_ACI_S 5 /* Shift for ACI field */
-+#define WMM_PARAM_ACM_M 0x10 /* Mask for ACM bit */
-+#define WMM_PARAM_ACM_S 4 /* Shift for ACM bit */
-+#define WMM_PARAM_AIFSN_M 0x0f /* Mask for aifsn field */
-+#define WMM_PARAM_LOGCWMIN_M 0x0f /* Mask for CwMin field (in log) */
-+#define WMM_PARAM_LOGCWMAX_M 0xf0 /* Mask for CwMax field (in log) */
-+#define WMM_PARAM_LOGCWMAX_S 4 /* Shift for CwMax field */
++#define A_WMI_DISCONNECT_EVENT(devt, reason, bssid, assocRespLen, assocInfo, protocolReasonStatus) \
++ ar6000_disconnect_event((devt), (reason), (bssid), (assocRespLen), (assocInfo), (protocolReasonStatus))
+
-+#define WMM_AC_TO_TID(_ac) ( \
-+ ((_ac) == WMM_AC_VO) ? 6 : \
-+ ((_ac) == WMM_AC_VI) ? 5 : \
-+ ((_ac) == WMM_AC_BK) ? 1 : \
-+ 0)
++#define A_WMI_TKIP_MICERR_EVENT(devt, keyid, ismcast) \
++ ar6000_tkip_micerr_event((devt), (keyid), (ismcast))
+
-+#define TID_TO_WMM_AC(_tid) ( \
-+ ((_tid) < 1) ? WMM_AC_BE : \
-+ ((_tid) < 3) ? WMM_AC_BK : \
-+ ((_tid) < 6) ? WMM_AC_VI : \
-+ WMM_AC_VO)
-+/*
-+ * Management information element payloads.
-+ */
++#define A_WMI_BITRATE_RX(devt, rateKbps) \
++ ar6000_bitrate_rx((devt), (rateKbps))
+
-+enum {
-+ IEEE80211_ELEMID_SSID = 0,
-+ IEEE80211_ELEMID_RATES = 1,
-+ IEEE80211_ELEMID_FHPARMS = 2,
-+ IEEE80211_ELEMID_DSPARMS = 3,
-+ IEEE80211_ELEMID_CFPARMS = 4,
-+ IEEE80211_ELEMID_TIM = 5,
-+ IEEE80211_ELEMID_IBSSPARMS = 6,
-+ IEEE80211_ELEMID_COUNTRY = 7,
-+ IEEE80211_ELEMID_CHALLENGE = 16,
-+ /* 17-31 reserved for challenge text extension */
-+ IEEE80211_ELEMID_PWRCNSTR = 32,
-+ IEEE80211_ELEMID_PWRCAP = 33,
-+ IEEE80211_ELEMID_TPCREQ = 34,
-+ IEEE80211_ELEMID_TPCREP = 35,
-+ IEEE80211_ELEMID_SUPPCHAN = 36,
-+ IEEE80211_ELEMID_CHANSWITCH = 37,
-+ IEEE80211_ELEMID_MEASREQ = 38,
-+ IEEE80211_ELEMID_MEASREP = 39,
-+ IEEE80211_ELEMID_QUIET = 40,
-+ IEEE80211_ELEMID_IBSSDFS = 41,
-+ IEEE80211_ELEMID_ERP = 42,
-+ IEEE80211_ELEMID_RSN = 48,
-+ IEEE80211_ELEMID_XRATES = 50,
-+ IEEE80211_ELEMID_TPC = 150,
-+ IEEE80211_ELEMID_CCKM = 156,
-+ IEEE80211_ELEMID_VENDOR = 221, /* vendor private */
-+};
++#define A_WMI_TXPWR_RX(devt, txPwr) \
++ ar6000_txPwr_rx((devt), (txPwr))
+
-+#define ATH_OUI 0x7f0300 /* Atheros OUI */
-+#define ATH_OUI_TYPE 0x01
-+#define ATH_OUI_SUBTYPE 0x01
-+#define ATH_OUI_VERSION 0x00
++#define A_WMI_READY_EVENT(devt, datap, phyCap) \
++ ar6000_ready_event((devt), (datap), (phyCap))
+
-+#define WPA_OUI 0xf25000
-+#define WPA_OUI_TYPE 0x01
-+#define WPA_VERSION 1 /* current supported version */
++#define A_WMI_DBGLOG_INIT_DONE(ar) \
++ ar6000_dbglog_init_done(ar);
+
-+#define WPA_CSE_NULL 0x00
-+#define WPA_CSE_WEP40 0x01
-+#define WPA_CSE_TKIP 0x02
-+#define WPA_CSE_CCMP 0x04
-+#define WPA_CSE_WEP104 0x05
++#define A_WMI_RSSI_THRESHOLD_EVENT(devt, newThreshold, rssi) \
++ ar6000_rssiThreshold_event((devt), (newThreshold), (rssi))
+
-+#define WPA_ASE_NONE 0x00
-+#define WPA_ASE_8021X_UNSPEC 0x01
-+#define WPA_ASE_8021X_PSK 0x02
++#define A_WMI_REPORT_ERROR_EVENT(devt, errorVal) \
++ ar6000_reportError_event((devt), (errorVal))
+
-+#define RSN_OUI 0xac0f00
-+#define RSN_VERSION 1 /* current supported version */
++#define A_WMI_ROAM_TABLE_EVENT(devt, pTbl) \
++ ar6000_roam_tbl_event((devt), (pTbl))
+
-+#define RSN_CSE_NULL 0x00
-+#define RSN_CSE_WEP40 0x01
-+#define RSN_CSE_TKIP 0x02
-+#define RSN_CSE_WRAP 0x03
-+#define RSN_CSE_CCMP 0x04
-+#define RSN_CSE_WEP104 0x05
++#define A_WMI_ROAM_DATA_EVENT(devt, p) \
++ ar6000_roam_data_event((devt), (p))
+
-+#define RSN_ASE_NONE 0x00
-+#define RSN_ASE_8021X_UNSPEC 0x01
-+#define RSN_ASE_8021X_PSK 0x02
++#define A_WMI_WOW_LIST_EVENT(devt, num_filters, wow_filters) \
++ ar6000_wow_list_event((devt), (num_filters), (wow_filters))
+
-+#define RSN_CAP_PREAUTH 0x01
++#define A_WMI_CAC_EVENT(devt, ac, cac_indication, statusCode, tspecSuggestion) \
++ ar6000_cac_event((devt), (ac), (cac_indication), (statusCode), (tspecSuggestion))
+
-+#define WMM_OUI 0xf25000
-+#define WMM_OUI_TYPE 0x02
-+#define WMM_INFO_OUI_SUBTYPE 0x00
-+#define WMM_PARAM_OUI_SUBTYPE 0x01
-+#define WMM_VERSION 1
++#define A_WMI_IPTOS_TO_USERPRIORITY(pkt) \
++ ar6000_iptos_to_userPriority((pkt))
+
-+/* WMM stream classes */
-+#define WMM_NUM_AC 4
-+#define WMM_AC_BE 0 /* best effort */
-+#define WMM_AC_BK 1 /* background */
-+#define WMM_AC_VI 2 /* video */
-+#define WMM_AC_VO 3 /* voice */
++#define A_WMI_PMKID_LIST_EVENT(devt, num_pmkid, pmkid_list) \
++ ar6000_pmkid_list_event((devt), (num_pmkid), (pmkid_list))
+
-+/* TSPEC related */
-+#define ACTION_CATEGORY_CODE_TSPEC 17
-+#define ACTION_CODE_TSPEC_ADDTS 0
-+#define ACTION_CODE_TSPEC_ADDTS_RESP 1
-+#define ACTION_CODE_TSPEC_DELTS 2
++#ifdef CONFIG_HOST_GPIO_SUPPORT
+
-+typedef enum {
-+ TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
-+ TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
-+ TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
-+ TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
-+ TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
-+ TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
-+ TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
-+ TSPEC_STATUS_CODE_DELTS_SENT = 0x30,
-+ TSPEC_STATUS_CODE_DELTS_RECV = 0x31,
-+} TSPEC_STATUS_CODE;
++#define A_WMI_GPIO_INTR_RX(intr_mask, input_values) \
++ ar6000_gpio_intr_rx((intr_mask), (input_values))
+
-+/*
-+ * WMM/802.11e Tspec Element
-+ */
-+typedef PREPACK struct wmm_tspec_ie_t {
-+ A_UINT8 elementId;
-+ A_UINT8 len;
-+ A_UINT8 oui[3];
-+ A_UINT8 ouiType;
-+ A_UINT8 ouiSubType;
-+ A_UINT8 version;
-+ A_UINT16 tsInfo_info;
-+ A_UINT8 tsInfo_reserved;
-+ A_UINT16 nominalMSDU;
-+ A_UINT16 maxMSDU;
-+ A_UINT32 minServiceInt;
-+ A_UINT32 maxServiceInt;
-+ A_UINT32 inactivityInt;
-+ A_UINT32 suspensionInt;
-+ A_UINT32 serviceStartTime;
-+ A_UINT32 minDataRate;
-+ A_UINT32 meanDataRate;
-+ A_UINT32 peakDataRate;
-+ A_UINT32 maxBurstSize;
-+ A_UINT32 delayBound;
-+ A_UINT32 minPhyRate;
-+ A_UINT16 sba;
-+ A_UINT16 mediumTime;
-+} POSTPACK WMM_TSPEC_IE;
-+
-+
-+/*
-+ * BEACON management packets
-+ *
-+ * octet timestamp[8]
-+ * octet beacon interval[2]
-+ * octet capability information[2]
-+ * information element
-+ * octet elemid
-+ * octet length
-+ * octet information[length]
-+ */
-+
-+#define IEEE80211_BEACON_INTERVAL(beacon) \
-+ ((beacon)[8] | ((beacon)[9] << 8))
-+#define IEEE80211_BEACON_CAPABILITY(beacon) \
-+ ((beacon)[10] | ((beacon)[11] << 8))
++#define A_WMI_GPIO_DATA_RX(reg_id, value) \
++ ar6000_gpio_data_rx((reg_id), (value))
+
-+#define IEEE80211_CAPINFO_ESS 0x0001
-+#define IEEE80211_CAPINFO_IBSS 0x0002
-+#define IEEE80211_CAPINFO_CF_POLLABLE 0x0004
-+#define IEEE80211_CAPINFO_CF_POLLREQ 0x0008
-+#define IEEE80211_CAPINFO_PRIVACY 0x0010
-+#define IEEE80211_CAPINFO_SHORT_PREAMBLE 0x0020
-+#define IEEE80211_CAPINFO_PBCC 0x0040
-+#define IEEE80211_CAPINFO_CHNL_AGILITY 0x0080
-+/* bits 8-9 are reserved */
-+#define IEEE80211_CAPINFO_SHORT_SLOTTIME 0x0400
-+#define IEEE80211_CAPINFO_APSD 0x0800
-+/* bit 12 is reserved */
-+#define IEEE80211_CAPINFO_DSSSOFDM 0x2000
-+/* bits 14-15 are reserved */
++#define A_WMI_GPIO_ACK_RX() \
++ ar6000_gpio_ack_rx()
+
-+/*
-+ * Authentication Modes
-+ */
++#endif
+
-+enum ieee80211_authmode {
-+ IEEE80211_AUTH_NONE = 0,
-+ IEEE80211_AUTH_OPEN = 1,
-+ IEEE80211_AUTH_SHARED = 2,
-+ IEEE80211_AUTH_8021X = 3,
-+ IEEE80211_AUTH_AUTO = 4, /* auto-select/accept */
-+ /* NB: these are used only for ioctls */
-+ IEEE80211_AUTH_WPA = 5, /* WPA/RSN w/ 802.1x */
-+ IEEE80211_AUTH_WPA_PSK = 6, /* WPA/RSN w/ PSK */
-+ IEEE80211_AUTH_WPA_CCKM = 7, /* WPA/RSN IE w/ CCKM */
-+};
++#ifdef SEND_EVENT_TO_APP
+
-+#include "athendpack.h"
++#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len) \
++ ar6000_send_event_to_app((ar), (eventId), (datap), (len))
+
-+#endif /* _NET80211_IEEE80211_H_ */
-diff --git a/drivers/ar6000/include/ieee80211_ioctl.h b/drivers/ar6000/include/ieee80211_ioctl.h
-new file mode 100644
-index 0000000..dab6747
---- /dev/null
-+++ b/drivers/ar6000/include/ieee80211_ioctl.h
-@@ -0,0 +1,163 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/ieee80211_ioctl.h#1 $
-+ */
++#else
+
-+#ifndef _IEEE80211_IOCTL_H_
-+#define _IEEE80211_IOCTL_H_
++#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len)
+
-+#ifdef __cplusplus
-+extern "C" {
+#endif
+
-+/*
-+ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
-+ */
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++#define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
++ ar6000_tcmd_rx_report_event((devt), (results), (len))
++#endif
+
-+/*
-+ * WPA/RSN get/set key request. Specify the key/cipher
-+ * type and whether the key is to be used for sending and/or
-+ * receiving. The key index should be set only when working
-+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
-+ * Otherwise a unicast/pairwise key is specified by the bssid
-+ * (on a station) or mac address (on an ap). They key length
-+ * must include any MIC key data; otherwise it should be no
-+ more than IEEE80211_KEYBUF_SIZE.
-+ */
-+struct ieee80211req_key {
-+ u_int8_t ik_type; /* key/cipher type */
-+ u_int8_t ik_pad;
-+ u_int16_t ik_keyix; /* key index */
-+ u_int8_t ik_keylen; /* key length in bytes */
-+ u_int8_t ik_flags;
-+#define IEEE80211_KEY_XMIT 0x01
-+#define IEEE80211_KEY_RECV 0x02
-+#define IEEE80211_KEY_DEFAULT 0x80 /* default xmit key */
-+ u_int8_t ik_macaddr[IEEE80211_ADDR_LEN];
-+ u_int64_t ik_keyrsc; /* key receive sequence counter */
-+ u_int64_t ik_keytsc; /* key transmit sequence counter */
-+ u_int8_t ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
-+};
-+/*
-+ * Delete a key either by index or address. Set the index
-+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
-+ */
-+struct ieee80211req_del_key {
-+ u_int8_t idk_keyix; /* key index */
-+ u_int8_t idk_macaddr[IEEE80211_ADDR_LEN];
-+};
-+/*
-+ * MLME state manipulation request. IEEE80211_MLME_ASSOC
-+ * only makes sense when operating as a station. The other
-+ * requests can be used when operating as a station or an
-+ * ap (to effect a station).
-+ */
-+struct ieee80211req_mlme {
-+ u_int8_t im_op; /* operation to perform */
-+#define IEEE80211_MLME_ASSOC 1 /* associate station */
-+#define IEEE80211_MLME_DISASSOC 2 /* disassociate station */
-+#define IEEE80211_MLME_DEAUTH 3 /* deauthenticate station */
-+#define IEEE80211_MLME_AUTHORIZE 4 /* authorize station */
-+#define IEEE80211_MLME_UNAUTHORIZE 5 /* unauthorize station */
-+ u_int16_t im_reason; /* 802.11 reason code */
-+ u_int8_t im_macaddr[IEEE80211_ADDR_LEN];
-+};
++#define A_WMI_HBCHALLENGERESP_EVENT(devt, cookie, source) \
++ ar6000_hbChallengeResp_event((devt), (cookie), (source))
+
-+struct ieee80211req_addpmkid {
-+ u_int8_t pi_bssid[IEEE80211_ADDR_LEN];
-+ u_int8_t pi_enable;
-+ u_int8_t pi_pmkid[16];
-+};
++#define A_WMI_TX_RETRY_ERR_EVENT(devt) \
++ ar6000_tx_retry_err_event((devt))
+
-+#define AUTH_ALG_OPEN_SYSTEM 0x01
-+#define AUTH_ALG_SHARED_KEY 0x02
-+#define AUTH_ALG_LEAP 0x04
++#define A_WMI_SNR_THRESHOLD_EVENT_RX(devt, newThreshold, snr) \
++ ar6000_snrThresholdEvent_rx((devt), (newThreshold), (snr))
+
-+struct ieee80211req_authalg {
-+ u_int8_t auth_alg;
-+};
++#define A_WMI_LQ_THRESHOLD_EVENT_RX(devt, range, lqVal) \
++ ar6000_lqThresholdEvent_rx((devt), (range), (lqVal))
+
-+/*
-+ * Request to add an IE to a Management Frame
-+ */
-+enum{
-+ IEEE80211_APPIE_FRAME_BEACON = 0,
-+ IEEE80211_APPIE_FRAME_PROBE_REQ = 1,
-+ IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
-+ IEEE80211_APPIE_FRAME_ASSOC_REQ = 3,
-+ IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
-+ IEEE80211_APPIE_NUM_OF_FRAME = 5
-+};
++#define A_WMI_RATEMASK_RX(devt, ratemask) \
++ ar6000_ratemask_rx((devt), (ratemask))
+
-+/*
-+ * The Maximum length of the IE that can be added to a Management frame
-+ */
-+#define IEEE80211_APPIE_FRAME_MAX_LEN 78
++#define A_WMI_KEEPALIVE_RX(devt, configured) \
++ ar6000_keepalive_rx((devt), (configured))
+
-+struct ieee80211req_getset_appiebuf {
-+ u_int32_t app_frmtype; /* management frame type for which buffer is added */
-+ u_int32_t app_buflen; /*application supplied buffer length */
-+ u_int8_t app_buf[];
-+};
++#define A_WMI_BSSINFO_EVENT_RX(ar, datp, len) \
++ ar6000_bssInfo_event_rx((ar), (datap), (len))
+
-+/*
-+ * The following definitions are used by an application to set filter
-+ * for receiving management frames
-+ */
-+enum {
-+ IEEE80211_FILTER_TYPE_BEACON = 0x1,
-+ IEEE80211_FILTER_TYPE_PROBE_REQ = 0x2,
-+ IEEE80211_FILTER_TYPE_PROBE_RESP = 0x4,
-+ IEEE80211_FILTER_TYPE_ASSOC_REQ = 0x8,
-+ IEEE80211_FILTER_TYPE_ASSOC_RESP = 0x10,
-+ IEEE80211_FILTER_TYPE_AUTH = 0x20,
-+ IEEE80211_FILTER_TYPE_DEAUTH = 0x40,
-+ IEEE80211_FILTER_TYPE_DISASSOC = 0x80,
-+ IEEE80211_FILTER_TYPE_ALL = 0xFF /* used to check the valid filter bits */
-+};
++#define A_WMI_DBGLOG_EVENT(ar, dropped, buffer, length) \
++ ar6000_dbglog_event((ar), (dropped), (buffer), (length));
+
-+struct ieee80211req_set_filter {
-+ u_int32_t app_filterype; /* management frame filter type */
-+};
++#define A_WMI_STREAM_TX_ACTIVE(devt,trafficClass) \
++ ar6000_indicate_tx_activity((devt),(trafficClass), TRUE)
+
-+enum {
-+ IEEE80211_PARAM_AUTHMODE = 3, /* Authentication Mode */
-+ IEEE80211_PARAM_MCASTCIPHER = 5,
-+ IEEE80211_PARAM_MCASTKEYLEN = 6, /* multicast key length */
-+ IEEE80211_PARAM_UCASTCIPHER = 8,
-+ IEEE80211_PARAM_UCASTKEYLEN = 9, /* unicast key length */
-+ IEEE80211_PARAM_WPA = 10, /* WPA mode (0,1,2) */
-+ IEEE80211_PARAM_ROAMING = 12, /* roaming mode */
-+ IEEE80211_PARAM_PRIVACY = 13, /* privacy invoked */
-+ IEEE80211_PARAM_COUNTERMEASURES = 14, /* WPA/TKIP countermeasures */
-+ IEEE80211_PARAM_DROPUNENCRYPTED = 15, /* discard unencrypted frames */
-+};
++#define A_WMI_STREAM_TX_INACTIVE(devt,trafficClass) \
++ ar6000_indicate_tx_activity((devt),(trafficClass), FALSE)
+
-+/*
-+ * Values for IEEE80211_PARAM_WPA
-+ */
-+#define WPA_MODE_WPA1 1
-+#define WPA_MODE_WPA2 2
-+#define WPA_MODE_AUTO 3
-+#define WPA_MODE_NONE 4
++/****************************************************************************/
++/****************************************************************************/
++/** **/
++/** HTC related hooks **/
++/** **/
++/****************************************************************************/
++/****************************************************************************/
+
+#ifdef __cplusplus
+}
+#endif
+
-+#endif /* _IEEE80211_IOCTL_H_ */
-diff --git a/drivers/ar6000/include/ieee80211_node.h b/drivers/ar6000/include/ieee80211_node.h
++#endif
+diff --git a/drivers/ar6000/include/a_osapi.h b/drivers/ar6000/include/a_osapi.h
new file mode 100644
-index 0000000..46b613c
+index 0000000..7d60867
--- /dev/null
-+++ b/drivers/ar6000/include/ieee80211_node.h
-@@ -0,0 +1,77 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2006 Atheros Communications, Inc.
++++ b/drivers/ar6000/include/a_osapi.h
+@@ -0,0 +1,28 @@
++#ifndef _A_OSAPI_H_
++#define _A_OSAPI_H_
++/*
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_osapi.h#1 $
+ *
-+ * Wireless Network driver for Atheros AR6001
-+ * All rights reserved.
++ * This file contains the definitions of the basic atheros data types.
++ * It is used to map the data types in atheros files to a platform specific
++ * type.
++ *
++ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
-+ */
-+#ifndef _IEEE80211_NODE_H_
-+#define _IEEE80211_NODE_H_
-+
-+/*
-+ * Node locking definitions.
-+ */
-+#define IEEE80211_NODE_LOCK_INIT(_nt) A_MUTEX_INIT(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_DESTROY(_nt)
-+#define IEEE80211_NODE_LOCK(_nt) A_MUTEX_LOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_UNLOCK(_nt) A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_BH(_nt) A_MUTEX_LOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_UNLOCK_BH(_nt) A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
-+#define IEEE80211_NODE_LOCK_ASSERT(_nt)
-+
-+/*
-+ * Node reference counting definitions.
+ *
-+ * ieee80211_node_initref initialize the reference count to 1
-+ * ieee80211_node_incref add a reference
-+ * ieee80211_node_decref remove a reference
-+ * ieee80211_node_dectestref remove a reference and return 1 if this
-+ * is the last reference, otherwise 0
-+ * ieee80211_node_refcnt reference count for printing (only)
+ */
-+#define ieee80211_node_initref(_ni) ((_ni)->ni_refcnt = 1)
-+#define ieee80211_node_incref(_ni) ((_ni)->ni_refcnt++)
-+#define ieee80211_node_decref(_ni) ((_ni)->ni_refcnt--)
-+#define ieee80211_node_dectestref(_ni) (((_ni)->ni_refcnt--) == 0)
-+#define ieee80211_node_refcnt(_ni) ((_ni)->ni_refcnt)
+
-+#define IEEE80211_NODE_HASHSIZE 32
-+/* simple hash is enough for variation of macaddr */
-+#define IEEE80211_NODE_HASH(addr) \
-+ (((const A_UINT8 *)(addr))[IEEE80211_ADDR_LEN - 1] % \
-+ IEEE80211_NODE_HASHSIZE)
++#include "../ar6000/osapi_linux.h"
+
++#endif /* _OSAPI_H_ */
+diff --git a/drivers/ar6000/include/a_types.h b/drivers/ar6000/include/a_types.h
+new file mode 100644
+index 0000000..e2ed090
+--- /dev/null
++++ b/drivers/ar6000/include/a_types.h
+@@ -0,0 +1,28 @@
++#ifndef _A_TYPES_H_
++#define _A_TYPES_H_
+/*
-+ * Table of ieee80211_node instances. Each ieee80211com
-+ * has at least one for holding the scan candidates.
-+ * When operating as an access point or in ibss mode there
-+ * is a second table for associated stations or neighbors.
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/a_types.h#1 $
++ *
++ * This file contains the definitions of the basic atheros data types.
++ * It is used to map the data types in atheros files to a platform specific
++ * type.
++ *
++ * Copyright 2003-2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
-+struct ieee80211_node_table {
-+ void *nt_wmip; /* back reference */
-+ A_MUTEX_T nt_nodelock; /* on node table */
-+ struct bss *nt_node_first; /* information of all nodes */
-+ struct bss *nt_node_last; /* information of all nodes */
-+ struct bss *nt_hash[IEEE80211_NODE_HASHSIZE];
-+ const char *nt_name; /* for debugging */
-+ A_UINT32 nt_scangen; /* gen# for timeout scan */
-+ A_TIMER nt_inact_timer;
-+ A_UINT8 isTimerArmed; /* is the node timer armed */
-+};
+
-+#define WLAN_NODE_INACT_TIMEOUT_MSEC 10000
++#include "../ar6000/athtypes_linux.h"
+
-+#endif /* _IEEE80211_NODE_H_ */
-diff --git a/drivers/ar6000/include/ini_dset.h b/drivers/ar6000/include/ini_dset.h
++#endif /* _ATHTYPES_H_ */
+diff --git a/drivers/ar6000/include/ar6000_api.h b/drivers/ar6000/include/ar6000_api.h
new file mode 100644
-index 0000000..410f2b5
+index 0000000..abe5de7
--- /dev/null
-+++ b/drivers/ar6000/include/ini_dset.h
-@@ -0,0 +1,40 @@
++++ b/drivers/ar6000/include/ar6000_api.h
+@@ -0,0 +1,29 @@
++#ifndef _AR6000_API_H_
++#define _AR6000_API_H_
+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
+ * All rights reserved.
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * This file contains the API to access the OS dependent atheros host driver
++ * by the WMI or WLAN generic modules.
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/ar6000_api.h#1 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
+ *
-+ */
-+#ifndef _INI_DSET_H_
-+#define _INI_DSET_H_
-+
-+/*
-+ * Each of these represents a WHAL INI table, which consists
-+ * of an "address column" followed by 1 or more "value columns".
+ *
-+ * Software uses the base WHAL_INI_DATA_ID+column to access a
-+ * DataSet that holds a particular column of data.
+ */
-+typedef enum {
-+ WHAL_INI_DATA_ID_NULL =0,
-+ WHAL_INI_DATA_ID_MODE_SPECIFIC =1, /* 2,3 */
-+ WHAL_INI_DATA_ID_COMMON =4, /* 5 */
-+ WHAL_INI_DATA_ID_BB_RFGAIN =6, /* 7,8 */
-+ WHAL_INI_DATA_ID_ANALOG_BANK1 =9, /* 10 */
-+ WHAL_INI_DATA_ID_ANALOG_BANK2 =11, /* 12 */
-+ WHAL_INI_DATA_ID_ANALOG_BANK3 =13, /* 14, 15 */
-+ WHAL_INI_DATA_ID_ANALOG_BANK6 =16, /* 17, 18 */
-+ WHAL_INI_DATA_ID_ANALOG_BANK7 =19, /* 20 */
-+ WHAL_INI_DATA_ID_MODE_OVERRIDES =21, /* 22,23 */
-+ WHAL_INI_DATA_ID_COMMON_OVERRIDES =24, /* 25 */
+
-+ WHAL_INI_DATA_ID_MAX =25
-+} WHAL_INI_DATA_ID;
++#include "../ar6000/ar6xapi_linux.h"
+
-+typedef PREPACK struct {
-+ A_UINT16 freqIndex; // 1 - A mode 2 - B or G mode 0 - common
-+ A_UINT16 offset;
-+ A_UINT32 newValue;
-+} POSTPACK INI_DSET_REG_OVERRIDE;
++#endif /* _AR6000_API_H */
+
-+#endif
-diff --git a/drivers/ar6000/include/regDb.h b/drivers/ar6000/include/regDb.h
+diff --git a/drivers/ar6000/include/ar6000_diag.h b/drivers/ar6000/include/ar6000_diag.h
new file mode 100644
-index 0000000..b3f665f
+index 0000000..2df131d
--- /dev/null
-+++ b/drivers/ar6000/include/regDb.h
-@@ -0,0 +1,19 @@
++++ b/drivers/ar6000/include/ar6000_diag.h
+@@ -0,0 +1,38 @@
+/*
-+ * Copyright (c) 2005 Atheros Communications, Inc.
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
+ *
-+ * This module contains the header files for regulatory module,
-+ * which include the DB schema and DB values.
-+ * $Id:
+ */
+
-+#ifndef __REG_DB_H__
-+#define __REG_DB_H__
++#ifndef AR6000_DIAG_H_
++#define AR6000_DIAG_H_
+
-+#include "./regulatory/reg_dbschema.h"
-+#include "./regulatory/reg_dbvalues.h"
+
-+#endif /* __REG_DB_H__ */
-diff --git a/drivers/ar6000/include/regdump.h b/drivers/ar6000/include/regdump.h
++A_STATUS
++ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++
++A_STATUS
++ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++
++A_STATUS
++ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
++ A_UCHAR *data, A_UINT32 length);
++
++A_STATUS
++ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
++ A_UCHAR *data, A_UINT32 length);
++
++#endif /*AR6000_DIAG_H_*/
+diff --git a/drivers/ar6000/include/athdefs.h b/drivers/ar6000/include/athdefs.h
new file mode 100644
-index 0000000..0106825
+index 0000000..c28c871
--- /dev/null
-+++ b/drivers/ar6000/include/regdump.h
-@@ -0,0 +1,33 @@
-+#ifndef __REGDUMP_H__
-+#define __REGDUMP_H__
++++ b/drivers/ar6000/include/athdefs.h
+@@ -0,0 +1,85 @@
++#ifndef __ATHDEFS_H__
++#define __ATHDEFS_H__
++
+/*
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * $ATH_LICENSE_HOSTSDK0_C$
+ *
++ * This file contains definitions that may be used across both
++ * Host and Target software. Nothing here is module-dependent
++ * or platform-dependent.
+ */
-+#if defined(AR6001)
-+#include "AR6001/AR6001_regdump.h"
-+#endif
-+#if defined(AR6002)
-+#include "AR6002/AR6002_regdump.h"
-+#endif
+
-+#if !defined(__ASSEMBLER__)
+/*
-+ * Target CPU state at the time of failure is reflected
-+ * in a register dump, which the Host can fetch through
-+ * the diagnostic window.
++ * Generic error codes that can be used by hw, sta, ap, sim, dk
++ * and any other environments. Since these are enums, feel free to
++ * add any more codes that you need.
+ */
-+struct register_dump_s {
-+ A_UINT32 target_id; /* Target ID */
-+ A_UINT32 assline; /* Line number (if assertion failure) */
-+ A_UINT32 pc; /* Program Counter at time of exception */
-+ A_UINT32 badvaddr; /* Virtual address causing exception */
-+ CPU_exception_frame_t exc_frame; /* CPU-specific exception info */
+
-+ /* Could copy top of stack here, too.... */
-+};
-+#endif /* __ASSEMBLER__ */
-+#endif /* __REGDUMP_H__ */
-diff --git a/drivers/ar6000/include/targaddrs.h b/drivers/ar6000/include/targaddrs.h
-new file mode 100644
-index 0000000..da2a650
---- /dev/null
-+++ b/drivers/ar6000/include/targaddrs.h
-@@ -0,0 +1,158 @@
-+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
-+ *
-+ */
++typedef enum {
++ A_ERROR = -1, /* Generic error return */
++ A_OK = 0, /* success */
++ /* Following values start at 1 */
++ A_DEVICE_NOT_FOUND, /* not able to find PCI device */
++ A_NO_MEMORY, /* not able to allocate memory, not available */
++ A_MEMORY_NOT_AVAIL, /* memory region is not free for mapping */
++ A_NO_FREE_DESC, /* no free descriptors available */
++ A_BAD_ADDRESS, /* address does not match descriptor */
++ A_WIN_DRIVER_ERROR, /* used in NT_HW version, if problem at init */
++ A_REGS_NOT_MAPPED, /* registers not correctly mapped */
++ A_EPERM, /* Not superuser */
++ A_EACCES, /* Access denied */
++ A_ENOENT, /* No such entry, search failed, etc. */
++ A_EEXIST, /* The object already exists (can't create) */
++ A_EFAULT, /* Bad address fault */
++ A_EBUSY, /* Object is busy */
++ A_EINVAL, /* Invalid parameter */
++ A_EMSGSIZE, /* Inappropriate message buffer length */
++ A_ECANCELED, /* Operation canceled */
++ A_ENOTSUP, /* Operation not supported */
++ A_ECOMM, /* Communication error on send */
++ A_EPROTO, /* Protocol error */
++ A_ENODEV, /* No such device */
++ A_EDEVNOTUP, /* device is not UP */
++ A_NO_RESOURCE, /* No resources for requested operation */
++ A_HARDWARE, /* Hardware failure */
++ A_PENDING, /* Asynchronous routine; will send up results la
++ter (typically in callback) */
++ A_EBADCHANNEL, /* The channel cannot be used */
++ A_DECRYPT_ERROR, /* Decryption error */
++ A_PHY_ERROR, /* RX PHY error */
++ A_CONSUMED /* Object was consumed */
++} A_STATUS;
+
-+#ifndef __TARGADDRS_H__
-+#define __TARGADDRS_H__
-+#if defined(AR6001)
-+#include "AR6001/addrs.h"
-+#endif
-+#if defined(AR6002)
-+#include "AR6002/addrs.h"
++#define A_SUCCESS(x) (x == A_OK)
++#define A_FAILED(x) (!A_SUCCESS(x))
++
++#ifndef TRUE
++#define TRUE 1
+#endif
+
-+/*
-+ * AR6K option bits, to enable/disable various features.
-+ * By default, all option bits are 0.
-+ * These bits can be set in LOCAL_SCRATCH register 0.
-+ */
-+#define AR6K_OPTION_BMI_DISABLE 0x01 /* Disable BMI comm with Host */
-+#define AR6K_OPTION_SERIAL_ENABLE 0x02 /* Enable serial port msgs */
-+#define AR6K_OPTION_WDT_DISABLE 0x04 /* WatchDog Timer override */
-+#define AR6K_OPTION_SLEEP_DISABLE 0x08 /* Disable system sleep */
-+#define AR6K_OPTION_STOP_BOOT 0x10 /* Stop boot processes (for ATE) */
-+#define AR6K_OPTION_ENABLE_NOANI 0x20 /* Operate without ANI */
-+#define AR6K_OPTION_DSET_DISABLE 0x40 /* Ignore DataSets */
-+#define AR6K_OPTION_IGNORE_FLASH 0x80 /* Ignore flash during bootup */
++#ifndef FALSE
++#define FALSE 0
++#endif
+
+/*
-+ * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
-+ * host_interest structure. It must match the address of the _host_interest
-+ * symbol (see linker script).
-+ *
-+ * Host Interest is shared between Host and Target in order to coordinate
-+ * between the two, and is intended to remain constant (with additions only
-+ * at the end) across software releases.
++ * The following definition is WLAN specific definition
+ */
-+#define AR6001_HOST_INTEREST_ADDRESS 0x80000600
-+#define AR6002_HOST_INTEREST_ADDRESS 0x00500400
-+
-+#define HOST_INTEREST_MAX_SIZE 0x100
++typedef enum {
++ MODE_11A = 0, /* 11a Mode */
++ MODE_11G = 1, /* 11g + 11b Mode */
++ MODE_11B = 2, /* 11b Mode */
++ MODE_11GONLY = 3, /* 11g only Mode */
++ MODE_UNKNOWN = 4,
++ MODE_MAX = 4
++} WLAN_PHY_MODE;
+
-+#if !defined(__ASSEMBLER__)
-+struct register_dump_s;
-+struct dbglog_hdr_s;
++typedef enum {
++ WLAN_11A_CAPABILITY = 1,
++ WLAN_11G_CAPABILITY = 2,
++ WLAN_11AG_CAPABILITY = 3,
++}WLAN_CAPABILITY;
+
++#endif /* __ATHDEFS_H__ */
+diff --git a/drivers/ar6000/include/athdrv.h b/drivers/ar6000/include/athdrv.h
+new file mode 100644
+index 0000000..19da97e
+--- /dev/null
++++ b/drivers/ar6000/include/athdrv.h
+@@ -0,0 +1,32 @@
+/*
-+ * These are items that the Host may need to access
-+ * via BMI or via the Diagnostic Window. The position
-+ * of items in this structure must remain constant
-+ * across firmware revisions!
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
+ *
-+ * Types for each item must be fixed size across
-+ * target and host platforms.
+ *
-+ * More items may be added at the end.
+ */
-+struct host_interest_s {
-+ /*
-+ * Pointer to application-defined area, if any.
-+ * Set by Target application during startup.
-+ */
-+ A_UINT32 hi_app_host_interest; /* 0x00 */
-+
-+ /* Pointer to register dump area, valid after Target crash. */
-+ A_UINT32 hi_failure_state; /* 0x04 */
-+
-+ /* Pointer to debug logging header */
-+ A_UINT32 hi_dbglog_hdr; /* 0x08 */
-+
-+ /* Indicates whether or not flash is present on Target.
-+ * NB: flash_is_present indicator is here not just
-+ * because it might be of interest to the Host; but
-+ * also because it's set early on by Target's startup
-+ * asm code and we need it to have a special RAM address
-+ * so that it doesn't get reinitialized with the rest
-+ * of data.
-+ */
-+ A_UINT32 hi_flash_is_present; /* 0x0c */
-+
-+ /*
-+ * General-purpose flag bits, similar to AR6000_OPTION_* flags.
-+ * Can be used by application rather than by OS.
-+ */
-+ A_UINT32 hi_option_flag; /* 0x10 */
-+
-+ /*
-+ * Boolean that determines whether or not to
-+ * display messages on the serial port.
-+ */
-+ A_UINT32 hi_serial_enable; /* 0x14 */
-+
-+ /* Start address of Flash DataSet index, if any */
-+ A_UINT32 hi_dset_list_head; /* 0x18 */
-+
-+ /* Override Target application start address */
-+ A_UINT32 hi_app_start; /* 0x1c */
-+
-+ /* Clock and voltage tuning */
-+ A_UINT32 hi_skip_clock_init; /* 0x20 */
-+ A_UINT32 hi_core_clock_setting; /* 0x24 */
-+ A_UINT32 hi_cpu_clock_setting; /* 0x28 */
-+ A_UINT32 hi_system_sleep_setting; /* 0x2c */
-+ A_UINT32 hi_xtal_control_setting; /* 0x30 */
-+ A_UINT32 hi_pll_ctrl_setting_24ghz; /* 0x34 */
-+ A_UINT32 hi_pll_ctrl_setting_5ghz; /* 0x38 */
-+ A_UINT32 hi_ref_voltage_trim_setting; /* 0x3c */
-+ A_UINT32 hi_clock_info; /* 0x40 */
-+
-+ /*
-+ * Flash configuration overrides, used only
-+ * when firmware is not executing from flash.
-+ * (When using flash, modify the global variables
-+ * with equivalent names.)
-+ */
-+ A_UINT32 hi_bank0_addr_value; /* 0x44 */
-+ A_UINT32 hi_bank0_read_value; /* 0x48 */
-+ A_UINT32 hi_bank0_write_value; /* 0x4c */
-+ A_UINT32 hi_bank0_config_value; /* 0x50 */
-+
-+ /* Pointer to Board Data */
-+ A_UINT32 hi_board_data; /* 0x54 */
-+ A_UINT32 hi_board_data_initialized; /* 0x58 */
-+
-+ A_UINT32 hi_dset_RAM_index_table; /* 0x5c */
-+
-+ A_UINT32 hi_desired_baud_rate; /* 0x60 */
-+ A_UINT32 hi_dbglog_config; /* 0x64 */
-+ A_UINT32 hi_end_RAM_reserve_sz; /* 0x68 */
-+ A_UINT32 hi_mbox_io_block_sz; /* 0x6c */
-+
-+ A_UINT32 hi_num_bpatch_streams; /* 0x70 */
-+ A_UINT32 hi_mbox_isr_yield_limit; /* 0x74 */
+
-+ A_UINT32 hi_refclk_hz; /* 0x78 */
-+};
-+
-+/* Bits defined in hi_option_flag */
-+#define HI_OPTION_TIMER_WAR 1 /* not really used */
-+
-+/*
-+ * Intended for use by Host software, this macro returns the Target RAM
-+ * address of any item in the host_interest structure.
-+ * Example: target_addr = AR6001_HOST_INTEREST_ITEM_ADDRESS(hi_board_data);
-+ */
-+#define AR6001_HOST_INTEREST_ITEM_ADDRESS(item) \
-+ ((A_UINT32)&((((struct host_interest_s *)(AR6001_HOST_INTEREST_ADDRESS))->item)))
++#ifndef _ATHDRV_H_
++#define _ATHDRV_H_
+
-+#define AR6002_HOST_INTEREST_ITEM_ADDRESS(item) \
-+ ((A_UINT32)&((((struct host_interest_s *)(AR6002_HOST_INTEREST_ADDRESS))->item)))
++#ifdef __cplusplus
++extern "C" {
++#endif
+
+
-+#endif /* !__ASSEMBLER__ */
++#ifdef __cplusplus
++}
++#endif
+
-+#endif /* __TARGADDRS_H__ */
-diff --git a/drivers/ar6000/include/testcmd.h b/drivers/ar6000/include/testcmd.h
++#endif /* _ATHDRV_H_ */
+diff --git a/drivers/ar6000/include/athendpack.h b/drivers/ar6000/include/athendpack.h
new file mode 100644
-index 0000000..737533a
+index 0000000..42921ae
--- /dev/null
-+++ b/drivers/ar6000/include/testcmd.h
-@@ -0,0 +1,144 @@
-+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
++++ b/drivers/ar6000/include/athendpack.h
+@@ -0,0 +1,41 @@
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ * @file: athendpack.h
++ *
++ * @abstract: end compiler-specific structure packing
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
+ *
+ */
++#ifdef VXWORKS
++#endif /* VXWORKS */
+
-+#ifndef TESTCMD_H_
-+#define TESTCMD_H_
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+typedef enum {
-+ ZEROES_PATTERN = 0,
-+ ONES_PATTERN,
-+ REPEATING_10,
-+ PN7_PATTERN,
-+ PN9_PATTERN,
-+ PN15_PATTERN
-+}TX_DATA_PATTERN;
-+
-+/* Continous tx
-+ mode : TCMD_CONT_TX_OFF - Disabling continous tx
-+ TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
-+ TCMD_CONT_TX_FRAME- Enable continuous modulated tx
-+ freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
-+dataRate: 0 - 1 Mbps
-+ 1 - 2 Mbps
-+ 2 - 5.5 Mbps
-+ 3 - 11 Mbps
-+ 4 - 6 Mbps
-+ 5 - 9 Mbps
-+ 6 - 12 Mbps
-+ 7 - 18 Mbps
-+ 8 - 24 Mbps
-+ 9 - 36 Mbps
-+ 10 - 28 Mbps
-+ 11 - 54 Mbps
-+ txPwr: Tx power in dBm[5 -11] for unmod Tx, [5-14] for mod Tx
-+antenna: 1 - one antenna
-+ 2 - two antenna
-+Note : Enable/disable continuous tx test cmd works only when target is awake.
-+*/
-+
-+typedef enum {
-+ TCMD_CONT_TX_OFF = 0,
-+ TCMD_CONT_TX_SINE,
-+ TCMD_CONT_TX_FRAME,
-+ TCMD_CONT_TX_TX99,
-+ TCMD_CONT_TX_TX100
-+} TCMD_CONT_TX_MODE;
++#ifdef LINUX
++#endif /* LINUX */
+
-+typedef PREPACK struct {
-+ A_UINT32 testCmdId;
-+ A_UINT32 mode;
-+ A_UINT32 freq;
-+ A_UINT32 dataRate;
-+ A_INT32 txPwr;
-+ A_UINT32 antenna;
-+ A_UINT32 enANI;
-+ A_UINT32 scramblerOff;
-+ A_UINT32 aifsn;
-+ A_UINT16 pktSz;
-+ A_UINT16 txPattern;
-+} POSTPACK TCMD_CONT_TX;
++#ifdef QNX
++#endif /* QNX */
+
-+#define TCMD_TXPATTERN_ZERONE 0x1
-+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE 0x2
++#ifdef INTEGRITY
++#include "integrity/athendpack_integrity.h"
++#endif /* INTEGRITY */
+
-+/* Continuous Rx
-+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
-+ TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
-+ address equal specified
-+ mac address (set via act =3)
-+ TCMD_CONT_RX_REPORT off mode (disable cont rx mode and get the
-+ report from the last cont
-+ Rx test)
++#ifdef NUCLEUS
++#endif /* NUCLEUS */
+
-+ TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
-+ target. This Overrides
-+ the default MAC address.)
++#ifdef UNDER_CE
++#include "../os/wince/include/athendpack_wince.h"
++#endif /* WINCE */
+
-+*/
-+typedef enum {
-+ TCMD_CONT_RX_PROMIS =0,
-+ TCMD_CONT_RX_FILTER,
-+ TCMD_CONT_RX_REPORT,
-+ TCMD_CONT_RX_SETMAC
-+} TCMD_CONT_RX_ACT;
+diff --git a/drivers/ar6000/include/athstartpack.h b/drivers/ar6000/include/athstartpack.h
+new file mode 100644
+index 0000000..6632cc2
+--- /dev/null
++++ b/drivers/ar6000/include/athstartpack.h
+@@ -0,0 +1,42 @@
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ * @file: athstartpack.h
++ *
++ * @abstract: start compiler-specific structure packing
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+typedef PREPACK struct {
-+ A_UINT32 testCmdId;
-+ A_UINT32 act;
-+ A_UINT32 enANI;
-+ PREPACK union {
-+ struct PREPACK TCMD_CONT_RX_PARA {
-+ A_UINT32 freq;
-+ A_UINT32 antenna;
-+ } POSTPACK para;
-+ struct PREPACK TCMD_CONT_RX_REPORT {
-+ A_UINT32 totalPkt;
-+ A_INT32 rssiInDBm;
-+ } POSTPACK report;
-+ struct PREPACK TCMD_CONT_RX_MAC {
-+ A_UCHAR addr[ATH_MAC_LEN];
-+ } POSTPACK mac;
-+ } POSTPACK u;
-+} POSTPACK TCMD_CONT_RX;
++#ifdef VXWORKS
++#endif /* VXWORKS */
+
-+/* Force sleep/wake test cmd
-+ mode: TCMD_PM_WAKEUP - Wakeup the target
-+ TCMD_PM_SLEEP - Force the target to sleep.
-+ */
-+typedef enum {
-+ TCMD_PM_WAKEUP = 1, /* be consistent with target */
-+ TCMD_PM_SLEEP
-+} TCMD_PM_MODE;
++#ifdef LINUX
++#endif /* LINUX */
+
-+typedef PREPACK struct {
-+ A_UINT32 testCmdId;
-+ A_UINT32 mode;
-+} POSTPACK TCMD_PM;
++#ifdef QNX
++#endif /* QNX */
+
-+typedef enum{
-+ TCMD_CONT_TX_ID,
-+ TCMD_CONT_RX_ID,
-+ TCMD_PM_ID
-+ } TCMD_ID;
++#ifdef INTEGRITY
++#include "integrity/athstartpack_integrity.h"
++#endif /* INTEGRITY */
+
-+typedef PREPACK union {
-+ TCMD_CONT_TX contTx;
-+ TCMD_CONT_RX contRx;
-+ TCMD_PM pm ;
-+} POSTPACK TEST_CMD;
++#ifdef NUCLEUS
++#endif /* NUCLEUS */
+
-+#ifdef __cplusplus
-+}
-+#endif
++#ifdef UNDER_CE
++#include "../os/wince/include/athstartpack_wince.h"
++#endif /* WINCE */
+
-+#endif /* TESTCMD_H_ */
-diff --git a/drivers/ar6000/include/wlan_api.h b/drivers/ar6000/include/wlan_api.h
+diff --git a/drivers/ar6000/include/bmi.h b/drivers/ar6000/include/bmi.h
new file mode 100644
-index 0000000..aabca4b
+index 0000000..2eb7134
--- /dev/null
-+++ b/drivers/ar6000/include/wlan_api.h
-@@ -0,0 +1,101 @@
-+#ifndef _HOST_WLAN_API_H_
-+#define _HOST_WLAN_API_H_
++++ b/drivers/ar6000/include/bmi.h
+@@ -0,0 +1,100 @@
++#ifndef _BMI_H_
++#define _BMI_H_
+/*
+ * Copyright (c) 2004-2005 Atheros Communications Inc.
+ * All rights reserved.
+ *
-+ * This file contains the API for the host wlan module
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wlan_api.h#1 $
-+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ *
+ *
+ *
++ * BMI declarations and prototypes
+ */
+
+#ifdef __cplusplus
+extern "C" {
-+#endif
++#endif /* __cplusplus */
+
-+struct ieee80211_node_table;
-+struct ieee80211_frame;
++/* Header files */
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "hif.h"
++#include "a_osapi.h"
++#include "bmi_msg.h"
+
-+struct ieee80211_common_ie {
-+ A_UINT16 ie_chan;
-+ A_UINT8 *ie_tstamp;
-+ A_UINT8 *ie_ssid;
-+ A_UINT8 *ie_rates;
-+ A_UINT8 *ie_xrates;
-+ A_UINT8 *ie_country;
-+ A_UINT8 *ie_wpa;
-+ A_UINT8 *ie_rsn;
-+ A_UINT8 *ie_wmm;
-+ A_UINT8 *ie_ath;
-+ A_UINT16 ie_capInfo;
-+ A_UINT16 ie_beaconInt;
-+ A_UINT8 *ie_tim;
-+ A_UINT8 *ie_chswitch;
-+ A_UINT8 ie_erp;
-+ A_UINT8 *ie_wsc;
-+};
++void
++BMIInit(void);
+
-+typedef struct bss {
-+ A_UINT8 ni_macaddr[6];
-+ A_UINT8 ni_snr;
-+ A_INT16 ni_rssi;
-+ struct bss *ni_list_next;
-+ struct bss *ni_list_prev;
-+ struct bss *ni_hash_next;
-+ struct bss *ni_hash_prev;
-+ struct ieee80211_common_ie ni_cie;
-+ A_UINT8 *ni_buf;
-+ struct ieee80211_node_table *ni_table;
-+ A_UINT32 ni_refcnt;
-+ int ni_scangen;
-+ A_UINT32 ni_tstamp;
-+} bss_t;
++A_STATUS
++BMIDone(HIF_DEVICE *device);
+
-+typedef void wlan_node_iter_func(void *arg, bss_t *);
++A_STATUS
++BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info);
+
-+bss_t *wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size);
-+void wlan_node_free(bss_t *ni);
-+void wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
-+ const A_UINT8 *macaddr);
-+bss_t *wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr);
-+void wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni);
-+void wlan_free_allnodes(struct ieee80211_node_table *nt);
-+void wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
-+ void *arg);
++A_STATUS
++BMIReadMemory(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length);
+
-+void wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt);
-+void wlan_node_table_reset(struct ieee80211_node_table *nt);
-+void wlan_node_table_cleanup(struct ieee80211_node_table *nt);
++A_STATUS
++BMIWriteMemory(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length);
+
-+A_STATUS wlan_parse_beacon(A_UINT8 *buf, int framelen,
-+ struct ieee80211_common_ie *cie);
++A_STATUS
++BMIExecute(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 *param);
+
-+A_UINT16 wlan_ieee2freq(int chan);
-+A_UINT32 wlan_freq2ieee(A_UINT16 freq);
++A_STATUS
++BMISetAppStart(HIF_DEVICE *device,
++ A_UINT32 address);
+
++A_STATUS
++BMIReadSOCRegister(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 *param);
+
-+bss_t *
-+wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
-+ A_UINT32 ssidLength, A_BOOL bIsWPA2);
++A_STATUS
++BMIWriteSOCRegister(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UINT32 param);
+
-+void
-+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni);
++A_STATUS
++BMIrompatchInstall(HIF_DEVICE *device,
++ A_UINT32 ROM_addr,
++ A_UINT32 RAM_addr,
++ A_UINT32 nbytes,
++ A_UINT32 do_activate,
++ A_UINT32 *patch_id);
++
++A_STATUS
++BMIrompatchUninstall(HIF_DEVICE *device,
++ A_UINT32 rompatch_id);
++
++A_STATUS
++BMIrompatchActivate(HIF_DEVICE *device,
++ A_UINT32 rompatch_count,
++ A_UINT32 *rompatch_list);
++
++A_STATUS
++BMIrompatchDeactivate(HIF_DEVICE *device,
++ A_UINT32 rompatch_count,
++ A_UINT32 *rompatch_list);
+
+#ifdef __cplusplus
+}
+#endif
+
-+#endif /* _HOST_WLAN_API_H_ */
-diff --git a/drivers/ar6000/include/wlan_dset.h b/drivers/ar6000/include/wlan_dset.h
++#endif /* _BMI_H_ */
+diff --git a/drivers/ar6000/include/bmi_msg.h b/drivers/ar6000/include/bmi_msg.h
new file mode 100644
-index 0000000..8a876d6
+index 0000000..7c91ef4
--- /dev/null
-+++ b/drivers/ar6000/include/wlan_dset.h
-@@ -0,0 +1,20 @@
++++ b/drivers/ar6000/include/bmi_msg.h
+@@ -0,0 +1,199 @@
++#ifndef __BMI_MSG_H__
++#define __BMI_MSG_H__
+/*
-+ * Copyright (c) 2007 Atheros Communications, Inc.
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
+ *
+ */
+
-+#ifndef __WLAN_DSET_H__
-+#define __WKAN_DSET_H__
-+
-+typedef PREPACK struct wow_config_dset {
-+
-+ A_UINT8 valid_dset;
-+ A_UINT8 gpio_enable;
-+ A_UINT16 gpio_pin;
-+} POSTPACK WOW_CONFIG_DSET;
-+
-+#endif
-diff --git a/drivers/ar6000/include/wmi.h b/drivers/ar6000/include/wmi.h
-new file mode 100644
-index 0000000..045acd4
---- /dev/null
-+++ b/drivers/ar6000/include/wmi.h
-@@ -0,0 +1,1743 @@
+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
++ * Bootloader Messaging Interface (BMI)
+ *
++ * BMI is a very simple messaging interface used during initialization
++ * to read memory, write memory, execute code, and to define an
++ * application entry PC.
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * It is used to download an application to AR6K, to provide
++ * patches to code that is already resident on AR6K, and generally
++ * to examine and modify state. The Host has an opportunity to use
++ * BMI only once during bootup. Once the Host issues a BMI_DONE
++ * command, this opportunity ends.
+ *
-+ * This file contains the definitions of the WMI protocol specified in the
-+ * Wireless Module Interface (WMI). It includes definitions of all the
-+ * commands and events. Commands are messages from the host to the WM.
-+ * Events and Replies are messages from the WM to the host.
++ * The Host writes BMI requests to mailbox0, and reads BMI responses
++ * from mailbox0. BMI requests all begin with a command
++ * (see below for specific commands), and are followed by
++ * command-specific data.
+ *
-+ * Ownership of correctness in regards to WMI commands
-+ * belongs to the host driver and the WM is not required to validate
-+ * parameters for value, proper range, or any other checking.
++ * Flow control:
++ * The Host can only issue a command once the Target gives it a
++ * "BMI Command Credit", using AR6K Counter #4. As soon as the
++ * Target has completed a command, it issues another BMI Command
++ * Credit (so the Host can issue the next command).
+ *
++ * BMI handles all required Target-side cache flushing.
+ */
+
-+#ifndef _WMI_H_
-+#define _WMI_H_
-+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
-+
-+#include "wmix.h"
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
-+#define WMI_PROTOCOL_VERSION 0x0002
-+#define WMI_PROTOCOL_REVISION 0x0000
+
-+#define ATH_MAC_LEN 6 /* length of mac in bytes */
-+#define WMI_CMD_MAX_LEN 100
-+#define WMI_CONTROL_MSG_MAX_LEN 256
-+#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
-+#define IS_ETHERTYPE(_typeOrLen) ((_typeOrLen) >= 0x0600)
-+#define RFC1042OUI {0x00, 0x00, 0x00}
++/* Maximum data size used for BMI transfers */
++#define BMI_DATASZ_MAX 32
+
-+#define IP_ETHERTYPE 0x0800
++/* BMI Commands */
+
-+#define WMI_IMPLICIT_PSTREAM 0xFF
-+#define WMI_MAX_THINSTREAM 15
++#define BMI_NO_COMMAND 0
+
-+struct host_app_area_s {
-+ A_UINT32 wmi_protocol_ver;
-+};
++#define BMI_DONE 1
++ /*
++ * Semantics: Host is done using BMI
++ * Request format:
++ * A_UINT32 command (BMI_DONE)
++ * Response format: none
++ */
+
-+/*
-+ * Data Path
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 dstMac[ATH_MAC_LEN];
-+ A_UINT8 srcMac[ATH_MAC_LEN];
-+ A_UINT16 typeOrLen;
-+} POSTPACK ATH_MAC_HDR;
++#define BMI_READ_MEMORY 2
++ /*
++ * Semantics: Host reads AR6K memory
++ * Request format:
++ * A_UINT32 command (BMI_READ_MEMORY)
++ * A_UINT32 address
++ * A_UINT32 length, at most BMI_DATASZ_MAX
++ * Response format:
++ * A_UINT8 data[length]
++ */
+
-+typedef PREPACK struct {
-+ A_UINT8 dsap;
-+ A_UINT8 ssap;
-+ A_UINT8 cntl;
-+ A_UINT8 orgCode[3];
-+ A_UINT16 etherType;
-+} POSTPACK ATH_LLC_SNAP_HDR;
++#define BMI_WRITE_MEMORY 3
++ /*
++ * Semantics: Host writes AR6K memory
++ * Request format:
++ * A_UINT32 command (BMI_WRITE_MEMORY)
++ * A_UINT32 address
++ * A_UINT32 length, at most BMI_DATASZ_MAX
++ * A_UINT8 data[length]
++ * Response format: none
++ */
+
-+typedef enum {
-+ DATA_MSGTYPE = 0x0,
-+ CNTL_MSGTYPE,
-+ SYNC_MSGTYPE
-+} WMI_MSG_TYPE;
++#define BMI_EXECUTE 4
++ /*
++ * Semantics: Causes AR6K to execute code
++ * Request format:
++ * A_UINT32 command (BMI_EXECUTE)
++ * A_UINT32 address
++ * A_UINT32 parameter
++ * Response format:
++ * A_UINT32 return value
++ */
+
++#define BMI_SET_APP_START 5
++ /*
++ * Semantics: Set Target application starting address
++ * Request format:
++ * A_UINT32 command (BMI_SET_APP_START)
++ * A_UINT32 address
++ * Response format: none
++ */
+
-+typedef PREPACK struct {
-+ A_INT8 rssi;
-+ A_UINT8 info; /* WMI_MSG_TYPE in lower 2 bits - b1b0 */
-+ /* UP in next 3 bits - b4b3b2 */
-+#define WMI_DATA_HDR_MSG_TYPE_MASK 0x03
-+#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
-+#define WMI_DATA_HDR_UP_MASK 0x07
-+#define WMI_DATA_HDR_UP_SHIFT 2
-+#define WMI_DATA_HDR_IS_MSG_TYPE(h, t) (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
-+} POSTPACK WMI_DATA_HDR;
++#define BMI_READ_SOC_REGISTER 6
++ /*
++ * Semantics: Read a 32-bit Target SOC register.
++ * Request format:
++ * A_UINT32 command (BMI_READ_REGISTER)
++ * A_UINT32 address
++ * Response format:
++ * A_UINT32 value
++ */
+
++#define BMI_WRITE_SOC_REGISTER 7
++ /*
++ * Semantics: Write a 32-bit Target SOC register.
++ * Request format:
++ * A_UINT32 command (BMI_WRITE_REGISTER)
++ * A_UINT32 address
++ * A_UINT32 value
++ *
++ * Response format: none
++ */
+
-+#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
-+#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
++#define BMI_GET_TARGET_ID 8
++#define BMI_GET_TARGET_INFO 8
++ /*
++ * Semantics: Fetch the 4-byte Target information
++ * Request format:
++ * A_UINT32 command (BMI_GET_TARGET_ID/INFO)
++ * Response format1 (old firmware):
++ * A_UINT32 TargetVersionID
++ * Response format2 (newer firmware):
++ * A_UINT32 TARGET_VERSION_SENTINAL
++ * struct bmi_target_info;
++ */
+
-+/*
-+ * Control Path
-+ */
-+typedef PREPACK struct {
-+ A_UINT16 commandId;
-+} POSTPACK WMI_CMD_HDR; /* used for commands and events */
++struct bmi_target_info {
++ A_UINT32 target_info_byte_count; /* size of this structure */
++ A_UINT32 target_ver; /* Target Version ID */
++ A_UINT32 target_type; /* Target type */
++};
++#define TARGET_VERSION_SENTINAL 0xffffffff
++#define TARGET_TYPE_AR6001 1
++#define TARGET_TYPE_AR6002 2
+
-+/*
-+ * List of Commnands
-+ */
-+typedef enum {
-+ WMI_CONNECT_CMDID = 0x0001,
-+ WMI_RECONNECT_CMDID,
-+ WMI_DISCONNECT_CMDID,
-+ WMI_SYNCHRONIZE_CMDID,
-+ WMI_CREATE_PSTREAM_CMDID,
-+ WMI_DELETE_PSTREAM_CMDID,
-+ WMI_START_SCAN_CMDID,
-+ WMI_SET_SCAN_PARAMS_CMDID,
-+ WMI_SET_BSS_FILTER_CMDID,
-+ WMI_SET_PROBED_SSID_CMDID,
-+ WMI_SET_LISTEN_INT_CMDID,
-+ WMI_SET_BMISS_TIME_CMDID,
-+ WMI_SET_DISC_TIMEOUT_CMDID,
-+ WMI_GET_CHANNEL_LIST_CMDID,
-+ WMI_SET_BEACON_INT_CMDID,
-+ WMI_GET_STATISTICS_CMDID,
-+ WMI_SET_CHANNEL_PARAMS_CMDID,
-+ WMI_SET_POWER_MODE_CMDID,
-+ WMI_SET_IBSS_PM_CAPS_CMDID,
-+ WMI_SET_POWER_PARAMS_CMDID,
-+ WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
-+ WMI_ADD_CIPHER_KEY_CMDID,
-+ WMI_DELETE_CIPHER_KEY_CMDID,
-+ WMI_ADD_KRK_CMDID,
-+ WMI_DELETE_KRK_CMDID,
-+ WMI_SET_PMKID_CMDID,
-+ WMI_SET_TX_PWR_CMDID,
-+ WMI_GET_TX_PWR_CMDID,
-+ WMI_SET_ASSOC_INFO_CMDID,
-+ WMI_ADD_BAD_AP_CMDID,
-+ WMI_DELETE_BAD_AP_CMDID,
-+ WMI_SET_TKIP_COUNTERMEASURES_CMDID,
-+ WMI_RSSI_THRESHOLD_PARAMS_CMDID,
-+ WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
-+ WMI_SET_ACCESS_PARAMS_CMDID,
-+ WMI_SET_RETRY_LIMITS_CMDID,
-+ WMI_SET_OPT_MODE_CMDID,
-+ WMI_OPT_TX_FRAME_CMDID,
-+ WMI_SET_VOICE_PKT_SIZE_CMDID,
-+ WMI_SET_MAX_SP_LEN_CMDID,
-+ WMI_SET_ROAM_CTRL_CMDID,
-+ WMI_GET_ROAM_TBL_CMDID,
-+ WMI_GET_ROAM_DATA_CMDID,
-+ WMI_ENABLE_RM_CMDID,
-+ WMI_SET_MAX_OFFHOME_DURATION_CMDID,
-+ WMI_EXTENSION_CMDID, /* Non-wireless extensions */
-+ WMI_SNR_THRESHOLD_PARAMS_CMDID,
-+ WMI_LQ_THRESHOLD_PARAMS_CMDID,
-+ WMI_SET_LPREAMBLE_CMDID,
-+ WMI_SET_RTS_CMDID,
-+ WMI_CLR_RSSI_SNR_CMDID,
-+ WMI_SET_FIXRATES_CMDID,
-+ WMI_GET_FIXRATES_CMDID,
-+ WMI_SET_AUTH_MODE_CMDID,
-+ WMI_SET_REASSOC_MODE_CMDID,
-+ WMI_SET_WMM_CMDID,
-+ WMI_SET_WMM_TXOP_CMDID,
-+ WMI_TEST_CMDID,
-+ WMI_SET_BT_STATUS_CMDID,
-+ WMI_SET_BT_PARAMS_CMDID,
+
-+ WMI_SET_KEEPALIVE_CMDID,
-+ WMI_GET_KEEPALIVE_CMDID,
-+ WMI_SET_APPIE_CMDID,
-+ WMI_GET_APPIE_CMDID,
-+ WMI_SET_WSC_STATUS_CMDID,
++#define BMI_ROMPATCH_INSTALL 9
++ /*
++ * Semantics: Install a ROM Patch.
++ * Request format:
++ * A_UINT32 command (BMI_ROMPATCH_INSTALL)
++ * A_UINT32 Target ROM Address
++ * A_UINT32 Target RAM Address
++ * A_UINT32 Size, in bytes
++ * A_UINT32 Activate? 1-->activate;
++ * 0-->install but do not activate
++ * Response format:
++ * A_UINT32 PatchID
++ */
+
-+ /* Wake on Wireless */
-+ WMI_SET_HOST_SLEEP_MODE_CMDID,
-+ WMI_SET_WOW_MODE_CMDID,
-+ WMI_GET_WOW_LIST_CMDID,
-+ WMI_ADD_WOW_PATTERN_CMDID,
-+ WMI_DEL_WOW_PATTERN_CMDID,
-+ WMI_SET_MAC_ADDRESS_CMDID,
-+ WMI_SET_AKMP_PARAMS_CMDID,
-+ WMI_SET_PMKID_LIST_CMDID,
-+ WMI_GET_PMKID_LIST_CMDID,
++#define BMI_ROMPATCH_UNINSTALL 10
++ /*
++ * Semantics: Uninstall a previously-installed ROM Patch,
++ * automatically deactivating, if necessary.
++ * Request format:
++ * A_UINT32 command (BMI_ROMPATCH_UNINSTALL)
++ * A_UINT32 PatchID
++ *
++ * Response format: none
++ */
+
-+ /*
-+ * Developer commands starts at 0xF000
-+ */
-+ WMI_SET_BITRATE_CMDID = 0xF000,
-+ WMI_GET_BITRATE_CMDID,
-+ WMI_SET_WHALPARAM_CMDID,
++#define BMI_ROMPATCH_ACTIVATE 11
++ /*
++ * Semantics: Activate a list of previously-installed ROM Patches.
++ * Request format:
++ * A_UINT32 command (BMI_ROMPATCH_ACTIVATE)
++ * A_UINT32 rompatch_count
++ * A_UINT32 PatchID[rompatch_count]
++ *
++ * Response format: none
++ */
+
-+} WMI_COMMAND_ID;
++#define BMI_ROMPATCH_DEACTIVATE 12
++ /*
++ * Semantics: Deactivate a list of active ROM Patches.
++ * Request format:
++ * A_UINT32 command (BMI_ROMPATCH_DEACTIVATE)
++ * A_UINT32 rompatch_count
++ * A_UINT32 PatchID[rompatch_count]
++ *
++ * Response format: none
++ */
+
-+/*
-+ * Frame Types
-+ */
-+typedef enum {
-+ WMI_FRAME_BEACON = 0,
-+ WMI_FRAME_PROBE_REQ,
-+ WMI_FRAME_PROBE_RESP,
-+ WMI_FRAME_ASSOC_REQ,
-+ WMI_FRAME_ASSOC_RESP,
-+ WMI_NUM_MGMT_FRAME
-+} WMI_MGMT_FRAME_TYPE;
+
++#endif /* __BMI_MSG_H__ */
+diff --git a/drivers/ar6000/include/common_drv.h b/drivers/ar6000/include/common_drv.h
+new file mode 100644
+index 0000000..1bdc3da
+--- /dev/null
++++ b/drivers/ar6000/include/common_drv.h
+@@ -0,0 +1,61 @@
+/*
-+ * Connect Command
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
-+typedef enum {
-+ INFRA_NETWORK = 0x01,
-+ ADHOC_NETWORK = 0x02,
-+ ADHOC_CREATOR = 0x04,
-+} NETWORK_TYPE;
+
-+typedef enum {
-+ OPEN_AUTH = 0x01,
-+ SHARED_AUTH = 0x02,
-+ LEAP_AUTH = 0x04, /* different from IEEE_AUTH_MODE definitions */
-+} DOT11_AUTH_MODE;
+
-+typedef enum {
-+ NONE_AUTH = 0x01,
-+ WPA_AUTH = 0x02,
-+ WPA_PSK_AUTH = 0x03,
-+ WPA2_AUTH = 0x04,
-+ WPA2_PSK_AUTH = 0x05,
-+ WPA_AUTH_CCKM = 0x06,
-+ WPA2_AUTH_CCKM = 0x07,
-+} AUTH_MODE;
++#ifndef COMMON_DRV_H_
++#define COMMON_DRV_H_
+
-+typedef enum {
-+ NONE_CRYPT = 0x01,
-+ WEP_CRYPT = 0x02,
-+ TKIP_CRYPT = 0x03,
-+ AES_CRYPT = 0x04,
-+} CRYPTO_TYPE;
++#include "hif.h"
++#include "htc_packet.h"
+
-+#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
-+#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
+
-+#define WMI_MIN_KEY_INDEX 0
-+#define WMI_MAX_KEY_INDEX 3
+
-+#define WMI_MAX_KEY_LEN 32
++/* structure that is the state information for the default credit distribution callback
++ * drivers should instantiate (zero-init as well) this structure in their driver instance
++ * and pass it as a context to the HTC credit distribution functions */
++typedef struct _COMMON_CREDIT_STATE_INFO {
++ int TotalAvailableCredits; /* total credits in the system at startup */
++ int CurrentFreeCredits; /* credits available in the pool that have not been
++ given out to endpoints */
++ HTC_ENDPOINT_CREDIT_DIST *pLowestPriEpDist; /* pointer to the lowest priority endpoint dist struct */
++} COMMON_CREDIT_STATE_INFO;
+
-+#define WMI_MAX_SSID_LEN 32
+
-+typedef enum {
-+ CONNECT_ASSOC_POLICY_USER = 0x0001,
-+ CONNECT_SEND_REASSOC = 0x0002,
-+ CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
-+ CONNECT_PROFILE_MATCH_DONE = 0x0008,
-+ CONNECT_IGNORE_AAC_BEACON = 0x0010,
-+ CONNECT_CSA_FOLLOW_BSS = 0x0020,
-+} WMI_CONNECT_CTRL_FLAGS_BITS;
-+
-+#define DEFAULT_CONNECT_CTRL_FLAGS (CONNECT_CSA_FOLLOW_BSS)
-+
-+typedef PREPACK struct {
-+ A_UINT8 networkType;
-+ A_UINT8 dot11AuthMode;
-+ A_UINT8 authMode;
-+ A_UINT8 pairwiseCryptoType;
-+ A_UINT8 pairwiseCryptoLen;
-+ A_UINT8 groupCryptoType;
-+ A_UINT8 groupCryptoLen;
-+ A_UINT8 ssidLength;
-+ A_UCHAR ssid[WMI_MAX_SSID_LEN];
-+ A_UINT16 channel;
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT32 ctrl_flags;
-+} POSTPACK WMI_CONNECT_CMD;
-+
-+/*
-+ * WMI_RECONNECT_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT16 channel; /* hint */
-+ A_UINT8 bssid[ATH_MAC_LEN]; /* mandatory if set */
-+} POSTPACK WMI_RECONNECT_CMD;
-+
-+/*
-+ * WMI_ADD_CIPHER_KEY_CMDID
-+ */
-+typedef enum {
-+ PAIRWISE_USAGE = 0x00,
-+ GROUP_USAGE = 0x01,
-+ TX_USAGE = 0x02, /* default Tx Key - Static WEP only */
-+} KEY_USAGE;
-+
-+/*
-+ * Bit Flag
-+ * Bit 0 - Initialise TSC - default is Initialize
-+ */
-+#define KEY_OP_INIT_TSC 0x01
-+#define KEY_OP_INIT_RSC 0x02
-+
-+#define KEY_OP_INIT_VAL 0x03 /* Default Initialise the TSC & RSC */
-+#define KEY_OP_VALID_MASK 0x03
-+
-+typedef PREPACK struct {
-+ A_UINT8 keyIndex;
-+ A_UINT8 keyType;
-+ A_UINT8 keyUsage; /* KEY_USAGE */
-+ A_UINT8 keyLength;
-+ A_UINT8 keyRSC[8]; /* key replay sequence counter */
-+ A_UINT8 key[WMI_MAX_KEY_LEN];
-+ A_UINT8 key_op_ctrl; /* Additional Key Control information */
-+} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
-+
-+/*
-+ * WMI_DELETE_CIPHER_KEY_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 keyIndex;
-+} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
++/* HTC TX packet tagging definitions */
++#define AR6K_CONTROL_PKT_TAG HTC_TX_PACKET_TAG_USER_DEFINED
++#define AR6K_DATA_PKT_TAG (AR6K_CONTROL_PKT_TAG + 1)
+
-+#define WMI_KRK_LEN 16
-+/*
-+ * WMI_ADD_KRK_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 krk[WMI_KRK_LEN];
-+} POSTPACK WMI_ADD_KRK_CMD;
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+/*
-+ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
-+ */
-+typedef enum {
-+ WMI_TKIP_CM_DISABLE = 0x0,
-+ WMI_TKIP_CM_ENABLE = 0x1,
-+} WMI_TKIP_CM_CONTROL;
++/* OS-independent APIs */
++A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo);
++A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
++A_STATUS ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address, A_UCHAR *data, A_UINT32 length);
++A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
++void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
++A_STATUS ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice);
+
-+typedef PREPACK struct {
-+ A_UINT8 cm_en; /* WMI_TKIP_CM_CONTROL */
-+} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
++#ifdef __cplusplus
++}
++#endif
+
++#endif /*COMMON_DRV_H_*/
+diff --git a/drivers/ar6000/include/dbglog.h b/drivers/ar6000/include/dbglog.h
+new file mode 100644
+index 0000000..3d1e528
+--- /dev/null
++++ b/drivers/ar6000/include/dbglog.h
+@@ -0,0 +1,107 @@
+/*
-+ * WMI_SET_PMKID_CMDID
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * This file contains the definitions and data structures associated with
++ * the log based debug mechanism.
++ *
+ */
+
-+#define WMI_PMKID_LEN 16
-+
-+typedef enum {
-+ PMKID_DISABLE = 0,
-+ PMKID_ENABLE = 1,
-+} PMKID_ENABLE_FLG;
++#ifndef _DBGLOG_H_
++#define _DBGLOG_H_
+
-+typedef PREPACK struct {
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT8 enable; /* PMKID_ENABLE_FLG */
-+ A_UINT8 pmkid[WMI_PMKID_LEN];
-+} POSTPACK WMI_SET_PMKID_CMD;
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+/*
-+ * WMI_START_SCAN_CMD
-+ */
-+typedef enum {
-+ WMI_LONG_SCAN = 0,
-+ WMI_SHORT_SCAN = 1,
-+} WMI_SCAN_TYPE;
++#define DBGLOG_TIMESTAMP_OFFSET 0
++#define DBGLOG_TIMESTAMP_MASK 0x0000FFFF /* Bit 0-15. Contains bit
++ 8-23 of the LF0 timer */
++#define DBGLOG_DBGID_OFFSET 16
++#define DBGLOG_DBGID_MASK 0x03FF0000 /* Bit 16-25 */
++#define DBGLOG_DBGID_NUM_MAX 256 /* Upper limit is width of mask */
+
-+typedef PREPACK struct {
-+ A_BOOL forceFgScan;
-+ A_BOOL isLegacy; /* For Legacy Cisco AP compatibility */
-+ A_UINT32 homeDwellTime; /* Maximum duration in the home channel(milliseconds) */
-+ A_UINT32 forceScanInterval; /* Time interval between scans (milliseconds)*/
-+ A_UINT8 scanType; /* WMI_SCAN_TYPE */
-+} POSTPACK WMI_START_SCAN_CMD;
++#define DBGLOG_MODULEID_OFFSET 26
++#define DBGLOG_MODULEID_MASK 0x3C000000 /* Bit 26-29 */
++#define DBGLOG_MODULEID_NUM_MAX 16 /* Upper limit is width of mask */
+
+/*
-+ * WMI_SET_SCAN_PARAMS_CMDID
++ * Please ensure that the definition of any new module intrduced is captured
++ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The
++ * structure is required for the parser to correctly pick up the values for
++ * different modules.
+ */
-+#define WMI_SHORTSCANRATIO_DEFAULT 3
-+typedef enum {
-+ CONNECT_SCAN_CTRL_FLAGS = 0x01, /* set if can scan in the Connect cmd */
-+ SCAN_CONNECTED_CTRL_FLAGS = 0x02, /* set if scan for the SSID it is */
-+ /* already connected to */
-+ ACTIVE_SCAN_CTRL_FLAGS = 0x04, /* set if enable active scan */
-+ ROAM_SCAN_CTRL_FLAGS = 0x08, /* set if enable roam scan when bmiss and lowrssi */
-+ REPORT_BSSINFO_CTRL_FLAGS = 0x10, /* set if follows customer BSSINFO reporting rule */
-+ ENABLE_AUTO_CTRL_FLAGS = 0x20, /* if disabled, target doesn't
-+ scan after a disconnect event */
-+ ENABLE_SCAN_ABORT_EVENT = 0x40 /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
-+
-+} WMI_SCAN_CTRL_FLAGS_BITS;
++#define DBGLOG_MODULEID_START
++#define DBGLOG_MODULEID_INF 0
++#define DBGLOG_MODULEID_WMI 1
++#define DBGLOG_MODULEID_CSERV 2
++#define DBGLOG_MODULEID_PM 3
++#define DBGLOG_MODULEID_TXRX_MGMTBUF 4
++#define DBGLOG_MODULEID_TXRX_TXBUF 5
++#define DBGLOG_MODULEID_TXRX_RXBUF 6
++#define DBGLOG_MODULEID_WOW 7
++#define DBGLOG_MODULEID_WHAL 8
++#define DBGLOG_MODULEID_END
+
-+#define CAN_SCAN_IN_CONNECT(flags) (flags & CONNECT_SCAN_CTRL_FLAGS)
-+#define CAN_SCAN_CONNECTED(flags) (flags & SCAN_CONNECTED_CTRL_FLAGS)
-+#define ENABLE_ACTIVE_SCAN(flags) (flags & ACTIVE_SCAN_CTRL_FLAGS)
-+#define ENABLE_ROAM_SCAN(flags) (flags & ROAM_SCAN_CTRL_FLAGS)
-+#define CONFIG_REPORT_BSSINFO(flags) (flags & REPORT_BSSINFO_CTRL_FLAGS)
-+#define IS_AUTO_SCAN_ENABLED(flags) (flags & ENABLE_AUTO_CTRL_FLAGS)
-+#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
++#define DBGLOG_NUM_ARGS_OFFSET 30
++#define DBGLOG_NUM_ARGS_MASK 0xC0000000 /* Bit 30-31 */
++#define DBGLOG_NUM_ARGS_MAX 2 /* Upper limit is width of mask */
+
-+#define DEFAULT_SCAN_CTRL_FLAGS (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
++#define DBGLOG_MODULE_LOG_ENABLE_OFFSET 0
++#define DBGLOG_MODULE_LOG_ENABLE_MASK 0x0000FFFF
+
++#define DBGLOG_REPORTING_ENABLED_OFFSET 16
++#define DBGLOG_REPORTING_ENABLED_MASK 0x00010000
+
-+typedef PREPACK struct {
-+ A_UINT16 fg_start_period; /* seconds */
-+ A_UINT16 fg_end_period; /* seconds */
-+ A_UINT16 bg_period; /* seconds */
-+ A_UINT16 maxact_chdwell_time; /* msec */
-+ A_UINT16 pas_chdwell_time; /* msec */
-+ A_UINT8 shortScanRatio; /* how many shorts scan for one long */
-+ A_UINT8 scanCtrlFlags;
-+ A_UINT16 minact_chdwell_time; /* msec */
-+ A_UINT32 max_dfsch_act_time; /* msecs */
-+} POSTPACK WMI_SCAN_PARAMS_CMD;
++#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
++#define DBGLOG_TIMESTAMP_RESOLUTION_MASK 0x000E0000
+
-+/*
-+ * WMI_SET_BSS_FILTER_CMDID
-+ */
-+typedef enum {
-+ NONE_BSS_FILTER = 0x0, /* no beacons forwarded */
-+ ALL_BSS_FILTER, /* all beacons forwarded */
-+ PROFILE_FILTER, /* only beacons matching profile */
-+ ALL_BUT_PROFILE_FILTER, /* all but beacons matching profile */
-+ CURRENT_BSS_FILTER, /* only beacons matching current BSS */
-+ ALL_BUT_BSS_FILTER, /* all but beacons matching BSS */
-+ PROBED_SSID_FILTER, /* beacons matching probed ssid */
-+ LAST_BSS_FILTER, /* marker only */
-+} WMI_BSS_FILTER;
++#define DBGLOG_REPORT_SIZE_OFFSET 20
++#define DBGLOG_REPORT_SIZE_MASK 0x3FF00000
+
-+typedef PREPACK struct {
-+ A_UINT8 bssFilter; /* see WMI_BSS_FILTER */
-+ A_UINT32 ieMask;
-+} POSTPACK WMI_BSS_FILTER_CMD;
++#define DBGLOG_LOG_BUFFER_SIZE 1500
++#define DBGLOG_DBGID_DEFINITION_LEN_MAX 64
+
-+/*
-+ * WMI_SET_PROBED_SSID_CMDID
-+ */
-+#define MAX_PROBED_SSID_INDEX 5
++struct dbglog_buf_s {
++ struct dbglog_buf_s *next;
++ A_INT8 *buffer;
++ A_UINT32 bufsize;
++ A_UINT32 length;
++ A_UINT32 count;
++ A_UINT32 free;
++};
+
-+typedef enum {
-+ DISABLE_SSID_FLAG = 0, /* disables entry */
-+ SPECIFIC_SSID_FLAG = 0x01, /* probes specified ssid */
-+ ANY_SSID_FLAG = 0x02, /* probes for any ssid */
-+} WMI_SSID_FLAG;
++struct dbglog_hdr_s {
++ struct dbglog_buf_s *dbuf;
++ A_UINT32 dropped;
++};
+
-+typedef PREPACK struct {
-+ A_UINT8 entryIndex; /* 0 to MAX_PROBED_SSID_INDEX */
-+ A_UINT8 flag; /* WMI_SSID_FLG */
-+ A_UINT8 ssidLength;
-+ A_UINT8 ssid[32];
-+} POSTPACK WMI_PROBED_SSID_CMD;
++struct dbglog_config_s {
++ A_UINT32 cfgvalid; /* Mask with valid config bits */
++ union {
++ /* TODO: Take care of endianness */
++ struct {
++ A_UINT32 mmask:16; /* Mask of modules with logging on */
++ A_UINT32 rep:1; /* Reporting enabled or not */
++ A_UINT32 tsr:3; /* Time stamp resolution. Def: 1 ms */
++ A_UINT32 size:10; /* Report size in number of messages */
++ A_UINT32 reserved:2;
++ } dbglog_config;
+
-+/*
-+ * WMI_SET_LISTEN_INT_CMDID
-+ * The Listen interval is between 15 and 3000 TUs
-+ */
-+#define MIN_LISTEN_INTERVAL 15
-+#define MAX_LISTEN_INTERVAL 5000
-+#define MIN_LISTEN_BEACONS 1
-+#define MAX_LISTEN_BEACONS 50
++ A_UINT32 value;
++ } u;
++};
+
-+typedef PREPACK struct {
-+ A_UINT16 listenInterval;
-+ A_UINT16 numBeacons;
-+} POSTPACK WMI_LISTEN_INT_CMD;
++#define cfgmmask u.dbglog_config.mmask
++#define cfgrep u.dbglog_config.rep
++#define cfgtsr u.dbglog_config.tsr
++#define cfgsize u.dbglog_config.size
++#define cfgvalue u.value
+
-+/*
-+ * WMI_SET_BEACON_INT_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT16 beaconInterval;
-+} POSTPACK WMI_BEACON_INT_CMD;
++#ifdef __cplusplus
++}
++#endif
+
++#endif /* _DBGLOG_H_ */
+diff --git a/drivers/ar6000/include/dbglog_api.h b/drivers/ar6000/include/dbglog_api.h
+new file mode 100644
+index 0000000..06c8102
+--- /dev/null
++++ b/drivers/ar6000/include/dbglog_api.h
+@@ -0,0 +1,46 @@
++#ifndef _DBGLOG_API_H_
++#define _DBGLOG_API_H_
+/*
-+ * WMI_SET_BMISS_TIME_CMDID
-+ * valid values are between 1000 and 5000 TUs
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ * This file contains host side debug primitives.
+ */
+
-+#define MIN_BMISS_TIME 1000
-+#define MAX_BMISS_TIME 5000
-+#define MIN_BMISS_BEACONS 1
-+#define MAX_BMISS_BEACONS 50
-+
-+typedef PREPACK struct {
-+ A_UINT16 bmissTime;
-+ A_UINT16 numBeacons;
-+} POSTPACK WMI_BMISS_TIME_CMD;
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+/*
-+ * WMI_SET_POWER_MODE_CMDID
-+ */
-+typedef enum {
-+ REC_POWER = 0x01,
-+ MAX_PERF_POWER,
-+} WMI_POWER_MODE;
++#include "dbglog.h"
+
-+typedef PREPACK struct {
-+ A_UINT8 powerMode; /* WMI_POWER_MODE */
-+} POSTPACK WMI_POWER_MODE_CMD;
++#define DBGLOG_HOST_LOG_BUFFER_SIZE DBGLOG_LOG_BUFFER_SIZE
+
-+/*
-+ * WMI_SET_POWER_PARAMS_CMDID
-+ */
-+typedef enum {
-+ IGNORE_DTIM = 0x01,
-+ NORMAL_DTIM = 0x02,
-+ STICK_DTIM = 0x03,
-+} WMI_DTIM_POLICY;
++#define DBGLOG_GET_DBGID(arg) \
++ ((arg & DBGLOG_DBGID_MASK) >> DBGLOG_DBGID_OFFSET)
+
-+typedef PREPACK struct {
-+ A_UINT16 idle_period; /* msec */
-+ A_UINT16 pspoll_number;
-+ A_UINT16 dtim_policy;
-+} POSTPACK WMI_POWER_PARAMS_CMD;
++#define DBGLOG_GET_MODULEID(arg) \
++ ((arg & DBGLOG_MODULEID_MASK) >> DBGLOG_MODULEID_OFFSET)
+
-+typedef PREPACK struct {
-+ A_UINT8 power_saving;
-+ A_UINT8 ttl; /* number of beacon periods */
-+ A_UINT16 atim_windows; /* msec */
-+ A_UINT16 timeout_value; /* msec */
-+} POSTPACK WMI_IBSS_PM_CAPS_CMD;
++#define DBGLOG_GET_NUMARGS(arg) \
++ ((arg & DBGLOG_NUM_ARGS_MASK) >> DBGLOG_NUM_ARGS_OFFSET)
+
-+/*
-+ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
-+ */
-+typedef enum {
-+ IGNORE_TIM_ALL_QUEUES_APSD = 0,
-+ PROCESS_TIM_ALL_QUEUES_APSD = 1,
-+ IGNORE_TIM_SIMULATED_APSD = 2,
-+ PROCESS_TIM_SIMULATED_APSD = 3,
-+} APSD_TIM_POLICY;
++#define DBGLOG_GET_TIMESTAMP(arg) \
++ ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
+
-+typedef PREPACK struct {
-+ A_UINT16 psPollTimeout; /* msec */
-+ A_UINT16 triggerTimeout; /* msec */
-+ A_UINT32 apsdTimPolicy; /* TIM behavior with ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
-+ A_UINT32 simulatedAPSDTimPolicy; /* TIM behavior with simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
-+} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
++#ifdef __cplusplus
++}
++#endif
+
++#endif /* _DBGLOG_API_H_ */
+diff --git a/drivers/ar6000/include/dbglog_id.h b/drivers/ar6000/include/dbglog_id.h
+new file mode 100644
+index 0000000..ce22b16
+--- /dev/null
++++ b/drivers/ar6000/include/dbglog_id.h
+@@ -0,0 +1,307 @@
+/*
-+ * WMI_SET_VOICE_PKT_SIZE_CMDID
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * This file contains the definitions of the debug identifiers for different
++ * modules.
++ *
+ */
-+typedef PREPACK struct {
-+ A_UINT16 voicePktSize;
-+} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
+
-+/*
-+ * WMI_SET_MAX_SP_LEN_CMDID
-+ */
-+typedef enum {
-+ DELIVER_ALL_PKT = 0x0,
-+ DELIVER_2_PKT = 0x1,
-+ DELIVER_4_PKT = 0x2,
-+ DELIVER_6_PKT = 0x3,
-+} APSD_SP_LEN_TYPE;
++#ifndef _DBGLOG_ID_H_
++#define _DBGLOG_ID_H_
+
-+typedef PREPACK struct {
-+ A_UINT8 maxSPLen;
-+} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
++#ifdef __cplusplus
++extern "C" {
++#endif
+
+/*
-+ * WMI_SET_DISC_TIMEOUT_CMDID
++ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
++ * Please ensure that the definition of any new debugid introduced is captured
++ * between the <MODULE>_DBGID_DEFINITION_START and
++ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the
++ * parser to correctly pick up the values for different debug identifiers.
+ */
-+typedef PREPACK struct {
-+ A_UINT8 disconnectTimeout; /* seconds */
-+} POSTPACK WMI_DISC_TIMEOUT_CMD;
-+
-+typedef enum {
-+ UPLINK_TRAFFIC = 0,
-+ DNLINK_TRAFFIC = 1,
-+ BIDIR_TRAFFIC = 2,
-+} DIR_TYPE;
+
-+typedef enum {
-+ DISABLE_FOR_THIS_AC = 0,
-+ ENABLE_FOR_THIS_AC = 1,
-+ ENABLE_FOR_ALL_AC = 2,
-+} VOICEPS_CAP_TYPE;
++/* INF debug identifier definitions */
++#define INF_DBGID_DEFINITION_START
++#define INF_ASSERTION_FAILED 1
++#define INF_TARGET_ID 2
++#define INF_DBGID_DEFINITION_END
+
-+typedef enum {
-+ TRAFFIC_TYPE_APERIODIC = 0,
-+ TRAFFIC_TYPE_PERIODIC = 1,
-+}TRAFFIC_TYPE;
++/* WMI debug identifier definitions */
++#define WMI_DBGID_DEFINITION_START
++#define WMI_CMD_RX_XTND_PKT_TOO_SHORT 1
++#define WMI_EXTENDED_CMD_NOT_HANDLED 2
++#define WMI_CMD_RX_PKT_TOO_SHORT 3
++#define WMI_CALLING_WMI_EXTENSION_FN 4
++#define WMI_CMD_NOT_HANDLED 5
++#define WMI_IN_SYNC 6
++#define WMI_TARGET_WMI_SYNC_CMD 7
++#define WMI_SET_SNR_THRESHOLD_PARAMS 8
++#define WMI_SET_RSSI_THRESHOLD_PARAMS 9
++#define WMI_SET_LQ_TRESHOLD_PARAMS 10
++#define WMI_TARGET_CREATE_PSTREAM_CMD 11
++#define WMI_WI_DTM_INUSE 12
++#define WMI_TARGET_DELETE_PSTREAM_CMD 13
++#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD 14
++#define WMI_TARGET_GET_BIT_RATE_CMD 15
++#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS 16
++#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD 17
++#define WMI_TARGET_GET_TX_PWR_CMD 18
++#define WMI_FREE_EVBUF_WMIBUF 19
++#define WMI_FREE_EVBUF_DATABUF 20
++#define WMI_FREE_EVBUF_BADFLAG 21
++#define WMI_HTC_RX_ERROR_DATA_PACKET 22
++#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX 23
++#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT 24
++#define WMI_SENDING_READY_EVENT 25
++#define WMI_SETPOWER_MDOE_TO_MAXPERF 26
++#define WMI_SETPOWER_MDOE_TO_REC 27
++#define WMI_BSSINFO_EVENT_FROM 28
++#define WMI_TARGET_GET_STATS_CMD 29
++#define WMI_SENDING_SCAN_COMPLETE_EVENT 30
++#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT 31
++#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT 32
++#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT 33
++#define WMI_SENDING_ERROR_REPORT_EVENT 34
++#define WMI_SENDING_CAC_EVENT 35
++#define WMI_TARGET_GET_ROAM_TABLE_CMD 36
++#define WMI_TARGET_GET_ROAM_DATA_CMD 37
++#define WMI_SENDING_GPIO_INTR_EVENT 38
++#define WMI_SENDING_GPIO_ACK_EVENT 39
++#define WMI_SENDING_GPIO_DATA_EVENT 40
++#define WMI_CMD_RX 41
++#define WMI_CMD_RX_XTND 42
++#define WMI_EVENT_SEND 43
++#define WMI_EVENT_SEND_XTND 44
++#define WMI_DBGID_DEFINITION_END
+
-+/*
-+ * WMI_CREATE_PSTREAM_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 minServiceInt; /* in milli-sec */
-+ A_UINT32 maxServiceInt; /* in milli-sec */
-+ A_UINT32 inactivityInt; /* in milli-sec */
-+ A_UINT32 suspensionInt; /* in milli-sec */
-+ A_UINT32 serviceStartTime;
-+ A_UINT32 minDataRate; /* in bps */
-+ A_UINT32 meanDataRate; /* in bps */
-+ A_UINT32 peakDataRate; /* in bps */
-+ A_UINT32 maxBurstSize;
-+ A_UINT32 delayBound;
-+ A_UINT32 minPhyRate; /* in bps */
-+ A_UINT32 sba;
-+ A_UINT32 mediumTime;
-+ A_UINT16 nominalMSDU; /* in octects */
-+ A_UINT16 maxMSDU; /* in octects */
-+ A_UINT8 trafficClass;
-+ A_UINT8 trafficType; /* TRAFFIC_TYPE */
-+ A_UINT8 trafficDirection; /* TRAFFIC_DIR */
-+ A_UINT8 voicePSCapability; /* VOICEPS_CAP_TYPE */
-+ A_UINT8 tsid;
-+ A_UINT8 userPriority; /* 802.1D user priority */
-+} POSTPACK WMI_CREATE_PSTREAM_CMD;
++/* CSERV debug identifier definitions */
++#define CSERV_DBGID_DEFINITION_START
++#define CSERV_BEGIN_SCAN1 1
++#define CSERV_BEGIN_SCAN2 2
++#define CSERV_END_SCAN1 3
++#define CSERV_END_SCAN2 4
++#define CSERV_CHAN_SCAN_START 5
++#define CSERV_CHAN_SCAN_STOP 6
++#define CSERV_CHANNEL_OPPPORTUNITY 7
++#define CSERV_NC_TIMEOUT 8
++#define CSERV_BACK_HOME 10
++#define CSERV_CHMGR_CH_CALLBACK1 11
++#define CSERV_CHMGR_CH_CALLBACK2 12
++#define CSERV_CHMGR_CH_CALLBACK3 13
++#define CSERV_SET_SCAN_PARAMS1 14
++#define CSERV_SET_SCAN_PARAMS2 15
++#define CSERV_SET_SCAN_PARAMS3 16
++#define CSERV_SET_SCAN_PARAMS4 17
++#define CSERV_ABORT_SCAN 18
++#define CSERV_NEWSTATE 19
++#define CSERV_MINCHMGR_OP_END 20
++#define CSERV_CHMGR_OP_END 21
++#define CSERV_DISCONNECT_TIMEOUT 22
++#define CSERV_ROAM_TIMEOUT 23
++#define CSERV_FORCE_SCAN1 24
++#define CSERV_FORCE_SCAN2 25
++#define CSERV_FORCE_SCAN3 26
++#define CSERV_UTIL_TIMEOUT 27
++#define CSERV_RSSIPOLLER 28
++#define CSERV_RETRY_CONNECT_TIMEOUT 29
++#define CSERV_RSSIINDBMPOLLER 30
++#define CSERV_BGSCAN_ENABLE 31
++#define CSERV_BGSCAN_DISABLE 32
++#define CSERV_WLAN_START_SCAN_CMD1 33
++#define CSERV_WLAN_START_SCAN_CMD2 34
++#define CSERV_WLAN_START_SCAN_CMD3 35
++#define CSERV_START_SCAN_CMD 36
++#define CSERV_START_FORCE_SCAN 37
++#define CSERV_NEXT_CHAN 38
++#define CSERV_SET_REGCODE 39
++#define CSERV_START_ADHOC 40
++#define CSERV_ADHOC_AT_HOME 41
++#define CSERV_OPT_AT_HOME 42
++#define CSERV_WLAN_CONNECT_CMD 43
++#define CSERV_WLAN_RECONNECT_CMD 44
++#define CSERV_WLAN_DISCONNECT_CMD 45
++#define CSERV_BSS_CHANGE_CHANNEL 46
++#define CSERV_BEACON_RX 47
++#define CSERV_KEEPALIVE_CHECK 48
++#define CSERV_RC_BEGIN_SCAN 49
++#define CSERV_RC_SCAN_START 50
++#define CSERV_RC_SCAN_STOP 51
++#define CSERV_RC_NEXT 52
++#define CSERV_RC_SCAN_END 53
++#define CSERV_PROBE_CALLBACK 54
++#define CSERV_ROAM1 55
++#define CSERV_ROAM2 56
++#define CSERV_ROAM3 57
++#define CSERV_CONNECT_EVENT 58
++#define CSERV_DISCONNECT_EVENT 59
++#define CSERV_BMISS_HANDLER1 60
++#define CSERV_BMISS_HANDLER2 61
++#define CSERV_BMISS_HANDLER3 62
++#define CSERV_LOWRSSI_HANDLER 63
++#define CSERV_WLAN_SET_PMKID_CMD 64
++#define CSERV_RECONNECT_REQUEST 65
++#define CSERV_KEYSPLUMBED_EVENT 66
++#define CSERV_NEW_REG 67
++#define CSERV_SET_RSSI_THOLD 68
++#define CSERV_RSSITHRESHOLDCHECK 69
++#define CSERV_RSSIINDBMTHRESHOLDCHECK 70
++#define CSERV_WLAN_SET_OPT_CMD1 71
++#define CSERV_WLAN_SET_OPT_CMD2 72
++#define CSERV_WLAN_SET_OPT_CMD3 73
++#define CSERV_WLAN_SET_OPT_CMD4 74
++#define CSERV_SCAN_CONNECT_STOP 75
++#define CSERV_BMISS_HANDLER4 76
++#define CSERV_INITIALIZE_TIMER 77
++#define CSERV_ARM_TIMER 78
++#define CSERV_DISARM_TIMER 79
++#define CSERV_UNINITIALIZE_TIMER 80
++#define CSERV_DISCONNECT_EVENT2 81
++#define CSERV_SCAN_CONNECT_START 82
++#define CSERV_BSSINFO_MEMORY_ALLOC_FAILED 83
++#define CSERV_SET_SCAN_PARAMS5 84
++#define CSERV_DBGID_DEFINITION_END
+
-+/*
-+ * WMI_DELETE_PSTREAM_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 trafficClass;
-+ A_UINT8 tsid;
-+} POSTPACK WMI_DELETE_PSTREAM_CMD;
++/* TXRX debug identifier definitions */
++#define TXRX_TXBUF_DBGID_DEFINITION_START
++#define TXRX_TXBUF_ALLOCATE_BUF 1
++#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX 2
++#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ 3
++#define TXRX_TXBUF_TXQ_DEPTH 4
++#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ 5
++#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ 6
++#define TXRX_TXBUF_INITIALIZE_TIMER 7
++#define TXRX_TXBUF_ARM_TIMER 8
++#define TXRX_TXBUF_DISARM_TIMER 9
++#define TXRX_TXBUF_UNINITIALIZE_TIMER 10
++#define TXRX_TXBUF_DBGID_DEFINITION_END
+
-+/*
-+ * WMI_SET_CHANNEL_PARAMS_CMDID
-+ */
-+typedef enum {
-+ WMI_11A_MODE = 0x1,
-+ WMI_11G_MODE = 0x2,
-+ WMI_11AG_MODE = 0x3,
-+ WMI_11B_MODE = 0x4,
-+ WMI_11GONLY_MODE = 0x5,
-+} WMI_PHY_MODE;
++#define TXRX_RXBUF_DBGID_DEFINITION_START
++#define TXRX_RXBUF_ALLOCATE_BUF 1
++#define TXRX_RXBUF_QUEUE_TO_HOST 2
++#define TXRX_RXBUF_QUEUE_TO_WLAN 3
++#define TXRX_RXBUF_ZERO_LEN_BUF 4
++#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN 5
++#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF 6
++#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN 7
++#define TXRX_RXBUF_SEND_TO_RECV_MGMT 8
++#define TXRX_RXBUF_SEND_TO_IEEE_LAYER 9
++#define TXRX_RXBUF_DBGID_DEFINITION_END
+
-+#define WMI_MAX_CHANNELS 32
++#define TXRX_MGMTBUF_DBGID_DEFINITION_START
++#define TXRX_MGMTBUF_ALLOCATE_BUF 1
++#define TXRX_MGMTBUF_ALLOCATE_SM_BUF 2
++#define TXRX_MGMTBUF_ALLOCATE_RMBUF 3
++#define TXRX_MGMTBUF_GET_BUF 4
++#define TXRX_MGMTBUF_GET_SM_BUF 5
++#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ 6
++#define TXRX_MGMTBUF_REAPED_BUF 7
++#define TXRX_MGMTBUF_REAPED_SM_BUF 8
++#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN 9
++#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN 10
++#define TXRX_MGMTBUF_ENQUEUE_INTO_SFQ 11
++#define TXRX_MGMTBUF_DEQUEUE_FROM_SFQ 12
++#define TXRX_MGMTBUF_PAUSE_TXQ 13
++#define TXRX_MGMTBUF_RESUME_TXQ 14
++#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT 15
++#define TXRX_MGMTBUF_DRAINQ 16
++#define TXRX_MGMTBUF_INDICATE_Q_DRAINED 17
++#define TXRX_MGMTBUF_DBGID_DEFINITION_END
+
-+typedef PREPACK struct {
-+ A_UINT8 reserved1;
-+ A_UINT8 scanParam; /* set if enable scan */
-+ A_UINT8 phyMode; /* see WMI_PHY_MODE */
-+ A_UINT8 numChannels; /* how many channels follow */
-+ A_UINT16 channelList[1]; /* channels in Mhz */
-+} POSTPACK WMI_CHANNEL_PARAMS_CMD;
++/* PM (Power Module) debug identifier definitions */
++#define PM_DBGID_DEFINITION_START
++#define PM_INIT 1
++#define PM_ENABLE 2
++#define PM_SET_STATE 3
++#define PM_SET_POWERMODE 4
++#define PM_CONN_NOTIFY 5
++#define PM_REF_COUNT_NEGATIVE 6
++#define PM_APSD_ENABLE 7
++#define PM_UPDATE_APSD_STATE 8
++#define PM_CHAN_OP_REQ 9
++#define PM_SET_MY_BEACON_POLICY 10
++#define PM_SET_ALL_BEACON_POLICY 11
++#define PM_SET_PM_PARAMS1 12
++#define PM_SET_PM_PARAMS2 13
++#define PM_ADHOC_SET_PM_CAPS_FAIL 14
++#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID 15
++#define PM_DBGID_DEFINITION_END
+
++/* Wake on Wireless debug identifier definitions */
++#define WOW_DBGID_DEFINITION_START
++#define WOW_INIT 1
++#define WOW_GET_CONFIG_DSET 2
++#define WOW_NO_CONFIG_DSET 3
++#define WOW_INVALID_CONFIG_DSET 4
++#define WOW_USE_DEFAULT_CONFIG 5
++#define WOW_SETUP_GPIO 6
++#define WOW_INIT_DONE 7
++#define WOW_SET_GPIO_PIN 8
++#define WOW_CLEAR_GPIO_PIN 9
++#define WOW_SET_WOW_MODE_CMD 10
++#define WOW_SET_HOST_MODE_CMD 11
++#define WOW_ADD_WOW_PATTERN_CMD 12
++#define WOW_NEW_WOW_PATTERN_AT_INDEX 13
++#define WOW_DEL_WOW_PATTERN_CMD 14
++#define WOW_LIST_CONTAINS_PATTERNS 15
++#define WOW_GET_WOW_LIST_CMD 16
++#define WOW_INVALID_FILTER_ID 17
++#define WOW_INVALID_FILTER_LISTID 18
++#define WOW_NO_VALID_FILTER_AT_ID 19
++#define WOW_NO_VALID_LIST_AT_ID 20
++#define WOW_NUM_PATTERNS_EXCEEDED 21
++#define WOW_NUM_LISTS_EXCEEDED 22
++#define WOW_GET_WOW_STATS 23
++#define WOW_CLEAR_WOW_STATS 24
++#define WOW_WAKEUP_HOST 25
++#define WOW_EVENT_WAKEUP_HOST 26
++#define WOW_EVENT_DISCARD 27
++#define WOW_PATTERN_MATCH 28
++#define WOW_PATTERN_NOT_MATCH 29
++#define WOW_PATTERN_NOT_MATCH_OFFSET 30
++#define WOW_DISABLED_HOST_ASLEEP 31
++#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS 32
++#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND 33
++#define WOW_DBGID_DEFINITION_END
+
-+/*
-+ * WMI_RSSI_THRESHOLD_PARAMS_CMDID
-+ * Setting the polltime to 0 would disable polling.
-+ * Threshold values are in the ascending order, and should agree to:
-+ * (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
-+ * < highThreshold_upperVal)
-+ */
++/* WHAL debug identifier definitions */
++#define WHAL_DBGID_DEFINITION_START
++#define WHAL_ERROR_ANI_CONTROL 1
++#define WHAL_ERROR_CHIP_TEST1 2
++#define WHAL_ERROR_CHIP_TEST2 3
++#define WHAL_ERROR_EEPROM_CHECKSUM 4
++#define WHAL_ERROR_EEPROM_MACADDR 5
++#define WHAL_ERROR_INTERRUPT_HIU 6
++#define WHAL_ERROR_KEYCACHE_RESET 7
++#define WHAL_ERROR_KEYCACHE_SET 8
++#define WHAL_ERROR_KEYCACHE_TYPE 9
++#define WHAL_ERROR_KEYCACHE_TKIPENTRY 10
++#define WHAL_ERROR_KEYCACHE_WEPLENGTH 11
++#define WHAL_ERROR_PHY_INVALID_CHANNEL 12
++#define WHAL_ERROR_POWER_AWAKE 13
++#define WHAL_ERROR_POWER_SET 14
++#define WHAL_ERROR_RECV_STOPDMA 15
++#define WHAL_ERROR_RECV_STOPPCU 16
++#define WHAL_ERROR_RESET_CHANNF1 17
++#define WHAL_ERROR_RESET_CHANNF2 18
++#define WHAL_ERROR_RESET_PM 19
++#define WHAL_ERROR_RESET_OFFSETCAL 20
++#define WHAL_ERROR_RESET_RFGRANT 21
++#define WHAL_ERROR_RESET_RXFRAME 22
++#define WHAL_ERROR_RESET_STOPDMA 23
++#define WHAL_ERROR_RESET_RECOVER 24
++#define WHAL_ERROR_XMIT_COMPUTE 25
++#define WHAL_ERROR_XMIT_NOQUEUE 26
++#define WHAL_ERROR_XMIT_ACTIVEQUEUE 27
++#define WHAL_ERROR_XMIT_BADTYPE 28
++#define WHAL_DBGID_DEFINITION_END
+
-+typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
-+ A_UINT32 pollTime; /* Polling time as a factor of LI */
-+ A_INT16 thresholdAbove1_Val; /* lowest of upper */
-+ A_INT16 thresholdAbove2_Val;
-+ A_INT16 thresholdAbove3_Val;
-+ A_INT16 thresholdAbove4_Val;
-+ A_INT16 thresholdAbove5_Val;
-+ A_INT16 thresholdAbove6_Val; /* highest of upper */
-+ A_INT16 thresholdBelow1_Val; /* lowest of bellow */
-+ A_INT16 thresholdBelow2_Val;
-+ A_INT16 thresholdBelow3_Val;
-+ A_INT16 thresholdBelow4_Val;
-+ A_INT16 thresholdBelow5_Val;
-+ A_INT16 thresholdBelow6_Val; /* highest of bellow */
-+ A_UINT8 weight; /* "alpha" */
-+ A_UINT8 reserved[3];
-+} POSTPACK WMI_RSSI_THRESHOLD_PARAMS_CMD;
++#ifdef __cplusplus
++}
++#endif
+
++#endif /* _DBGLOG_ID_H_ */
+diff --git a/drivers/ar6000/include/dl_list.h b/drivers/ar6000/include/dl_list.h
+new file mode 100644
+index 0000000..4b9c581
+--- /dev/null
++++ b/drivers/ar6000/include/dl_list.h
+@@ -0,0 +1,114 @@
+/*
-+ * WMI_SNR_THRESHOLD_PARAMS_CMDID
-+ * Setting the polltime to 0 would disable polling.
++ *
++ * Double-link list definitions (adapted from Atheros SDIO stack)
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
++#ifndef __DL_LIST_H___
++#define __DL_LIST_H___
+
-+typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
-+ A_UINT32 pollTime; /* Polling time as a factor of LI */
-+ A_UINT8 weight; /* "alpha" */
-+ A_UINT8 thresholdAbove1_Val; /* lowest of uppper*/
-+ A_UINT8 thresholdAbove2_Val;
-+ A_UINT8 thresholdAbove3_Val;
-+ A_UINT8 thresholdAbove4_Val; /* highest of upper */
-+ A_UINT8 thresholdBelow1_Val; /* lowest of bellow */
-+ A_UINT8 thresholdBelow2_Val;
-+ A_UINT8 thresholdBelow3_Val;
-+ A_UINT8 thresholdBelow4_Val; /* highest of bellow */
-+ A_UINT8 reserved[3];
-+} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
++#define A_CONTAINING_STRUCT(address, struct_type, field_name)\
++ ((struct_type *)((A_UINT32)(address) - (A_UINT32)(&((struct_type *)0)->field_name)))
+
++/* list functions */
++/* pointers for the list */
++typedef struct _DL_LIST {
++ struct _DL_LIST *pPrev;
++ struct _DL_LIST *pNext;
++}DL_LIST, *PDL_LIST;
+/*
-+ * WMI_LQ_THRESHOLD_PARAMS_CMDID
-+ */
-+typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
-+ A_UINT8 enable;
-+ A_UINT8 thresholdAbove1_Val;
-+ A_UINT8 thresholdAbove2_Val;
-+ A_UINT8 thresholdAbove3_Val;
-+ A_UINT8 thresholdAbove4_Val;
-+ A_UINT8 thresholdBelow1_Val;
-+ A_UINT8 thresholdBelow2_Val;
-+ A_UINT8 thresholdBelow3_Val;
-+ A_UINT8 thresholdBelow4_Val;
-+ A_UINT8 reserved[3];
-+} POSTPACK WMI_LQ_THRESHOLD_PARAMS_CMD;
-+
-+typedef enum {
-+ WMI_LPREAMBLE_DISABLED = 0,
-+ WMI_LPREAMBLE_ENABLED
-+} WMI_LPREAMBLE_STATUS;
++ * DL_LIST_INIT , initialize doubly linked list
++*/
++#define DL_LIST_INIT(pList)\
++ {(pList)->pPrev = pList; (pList)->pNext = pList;}
+
-+typedef PREPACK struct {
-+ A_UINT8 status;
-+}POSTPACK WMI_SET_LPREAMBLE_CMD;
++#define DL_LIST_IS_EMPTY(pList) (((pList)->pPrev == (pList)) && ((pList)->pNext == (pList)))
++#define DL_LIST_GET_ITEM_AT_HEAD(pList) (pList)->pNext
++#define DL_LIST_GET_ITEM_AT_TAIL(pList) (pList)->pPrev
++/*
++ * ITERATE_OVER_LIST pStart is the list, pTemp is a temp list member
++ * NOT: do not use this function if the items in the list are deleted inside the
++ * iteration loop
++*/
++#define ITERATE_OVER_LIST(pStart, pTemp) \
++ for((pTemp) =(pStart)->pNext; pTemp != (pStart); (pTemp) = (pTemp)->pNext)
+
-+typedef PREPACK struct {
-+ A_UINT16 threshold;
-+}POSTPACK WMI_SET_RTS_CMD;
+
-+/*
-+ * WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
-+ * Sets the error reporting event bitmask in target. Target clears it
-+ * upon an error. Subsequent errors are counted, but not reported
-+ * via event, unless the bitmask is set again.
++/* safe iterate macro that allows the item to be removed from the list
++ * the iteration continues to the next item in the list
+ */
-+typedef PREPACK struct {
-+ A_UINT32 bitmask;
-+} POSTPACK WMI_TARGET_ERROR_REPORT_BITMASK;
++#define ITERATE_OVER_LIST_ALLOW_REMOVE(pStart,pItem,st,offset) \
++{ \
++ PDL_LIST pTemp; \
++ pTemp = (pStart)->pNext; \
++ while (pTemp != (pStart)) { \
++ (pItem) = A_CONTAINING_STRUCT(pTemp,st,offset); \
++ pTemp = pTemp->pNext; \
+
-+/*
-+ * WMI_SET_TX_PWR_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 dbM; /* in dbM units */
-+} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
++#define ITERATE_END }}
+
+/*
-+ * WMI_SET_ASSOC_INFO_CMDID
-+ *
-+ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
-+ * A 3rd one, the CCX version IE can also be set from the host.
-+ */
-+#define WMI_MAX_ASSOC_INFO_TYPE 2
-+#define WMI_CCX_VER_IE 2 /* ieType to set CCX Version IE */
-+
-+#define WMI_MAX_ASSOC_INFO_LEN 240
++ * DL_ListInsertTail - insert pAdd to the end of the list
++*/
++static INLINE PDL_LIST DL_ListInsertTail(PDL_LIST pList, PDL_LIST pAdd) {
++ /* insert at tail */
++ pAdd->pPrev = pList->pPrev;
++ pAdd->pNext = pList;
++ pList->pPrev->pNext = pAdd;
++ pList->pPrev = pAdd;
++ return pAdd;
++}
+
-+typedef PREPACK struct {
-+ A_UINT8 ieType;
-+ A_UINT8 bufferSize;
-+ A_UINT8 assocInfo[1]; /* up to WMI_MAX_ASSOC_INFO_LEN */
-+} POSTPACK WMI_SET_ASSOC_INFO_CMD;
++/*
++ * DL_ListInsertHead - insert pAdd into the head of the list
++*/
++static INLINE PDL_LIST DL_ListInsertHead(PDL_LIST pList, PDL_LIST pAdd) {
++ /* insert at head */
++ pAdd->pPrev = pList;
++ pAdd->pNext = pList->pNext;
++ pList->pNext->pPrev = pAdd;
++ pList->pNext = pAdd;
++ return pAdd;
++}
+
++#define DL_ListAdd(pList,pItem) DL_ListInsertHead((pList),(pItem))
++/*
++ * DL_ListRemove - remove pDel from list
++*/
++static INLINE PDL_LIST DL_ListRemove(PDL_LIST pDel) {
++ pDel->pNext->pPrev = pDel->pPrev;
++ pDel->pPrev->pNext = pDel->pNext;
++ /* point back to itself just to be safe, incase remove is called again */
++ pDel->pNext = pDel;
++ pDel->pPrev = pDel;
++ return pDel;
++}
+
+/*
-+ * WMI_GET_TX_PWR_CMDID does not take any parameters
-+ */
++ * DL_ListRemoveItemFromHead - get a list item from the head
++*/
++static INLINE PDL_LIST DL_ListRemoveItemFromHead(PDL_LIST pList) {
++ PDL_LIST pItem = NULL;
++ if (pList->pNext != pList) {
++ pItem = pList->pNext;
++ /* remove the first item from head */
++ DL_ListRemove(pItem);
++ }
++ return pItem;
++}
+
++#endif /* __DL_LIST_H___ */
+diff --git a/drivers/ar6000/include/dset_api.h b/drivers/ar6000/include/dset_api.h
+new file mode 100644
+index 0000000..de5cc6a
+--- /dev/null
++++ b/drivers/ar6000/include/dset_api.h
+@@ -0,0 +1,63 @@
+/*
-+ * WMI_ADD_BAD_AP_CMDID
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/dset_api.h#1 $
++ *
++ * Host-side DataSet API.
++ *
+ */
-+#define WMI_MAX_BAD_AP_INDEX 1
+
-+typedef PREPACK struct {
-+ A_UINT8 badApIndex; /* 0 to WMI_MAX_BAD_AP_INDEX */
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_ADD_BAD_AP_CMD;
++#ifndef _DSET_API_H_
++#define _DSET_API_H_
+
-+/*
-+ * WMI_DELETE_BAD_AP_CMDID
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 badApIndex; /* 0 to WMI_MAX_BAD_AP_INDEX */
-+} POSTPACK WMI_DELETE_BAD_AP_CMD;
++#ifdef __cplusplus
++extern "C" {
++#endif /* __cplusplus */
+
+/*
-+ * WMI_SET_ACCESS_PARAMS_CMDID
++ * Host-side DataSet support is optional, and is not
++ * currently required for correct operation. To disable
++ * Host-side DataSet support, set this to 0.
+ */
-+#define WMI_DEFAULT_TXOP_ACPARAM 0 /* implies one MSDU */
-+#define WMI_DEFAULT_ECWMIN_ACPARAM 4 /* corresponds to CWmin of 15 */
-+#define WMI_DEFAULT_ECWMAX_ACPARAM 10 /* corresponds to CWmax of 1023 */
-+#define WMI_MAX_CW_ACPARAM 15 /* maximum eCWmin or eCWmax */
-+#define WMI_DEFAULT_AIFSN_ACPARAM 2
-+#define WMI_MAX_AIFSN_ACPARAM 15
-+typedef PREPACK struct {
-+ A_UINT16 txop; /* in units of 32 usec */
-+ A_UINT8 eCWmin;
-+ A_UINT8 eCWmax;
-+ A_UINT8 aifsn;
-+} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
++#ifndef CONFIG_HOST_DSET_SUPPORT
++#define CONFIG_HOST_DSET_SUPPORT 1
++#endif
+
++/* Called to send a DataSet Open Reply back to the Target. */
++A_STATUS wmi_dset_open_reply(struct wmi_t *wmip,
++ A_UINT32 status,
++ A_UINT32 access_cookie,
++ A_UINT32 size,
++ A_UINT32 version,
++ A_UINT32 targ_handle,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg);
+
-+/*
-+ * WMI_SET_RETRY_LIMITS_CMDID
-+ *
-+ * This command is used to customize the number of retries the
-+ * wlan device will perform on a given frame.
-+ */
-+#define WMI_MIN_RETRIES 2
-+#define WMI_MAX_RETRIES 13
-+typedef enum {
-+ MGMT_FRAMETYPE = 0,
-+ CONTROL_FRAMETYPE = 1,
-+ DATA_FRAMETYPE = 2
-+} WMI_FRAMETYPE;
++/* Called to send a DataSet Data Reply back to the Target. */
++A_STATUS wmi_dset_data_reply(struct wmi_t *wmip,
++ A_UINT32 status,
++ A_UINT8 *host_buf,
++ A_UINT32 length,
++ A_UINT32 targ_buf,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg);
++
++#ifdef __cplusplus
++}
++#endif /* __cplusplus */
+
-+typedef PREPACK struct {
-+ A_UINT8 frameType; /* WMI_FRAMETYPE */
-+ A_UINT8 trafficClass; /* applies only to DATA_FRAMETYPE */
-+ A_UINT8 maxRetries;
-+ A_UINT8 enableNotify;
-+} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
+
++#endif /* _DSET_API_H_ */
+diff --git a/drivers/ar6000/include/dset_internal.h b/drivers/ar6000/include/dset_internal.h
+new file mode 100644
+index 0000000..f0be380
+--- /dev/null
++++ b/drivers/ar6000/include/dset_internal.h
+@@ -0,0 +1,39 @@
+/*
-+ * WMI_SET_ROAM_CTRL_CMDID
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
-+ * This command is used to influence the Roaming behaviour
-+ * Set the host biases of the BSSs before setting the roam mode as bias
-+ * based.
+ */
+
++#ifndef __DSET_INTERNAL_H__
++#define __DSET_INTERNAL_H__
++
+/*
-+ * Different types of Roam Control
++ * Internal dset definitions, common for DataSet layer.
+ */
+
-+typedef enum {
-+ WMI_FORCE_ROAM = 1, /* Roam to the specified BSSID */
-+ WMI_SET_ROAM_MODE = 2, /* default ,progd bias, no roam */
-+ WMI_SET_HOST_BIAS = 3, /* Set the Host Bias */
-+ WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
-+} WMI_ROAM_CTRL_TYPE;
++#define DSET_TYPE_STANDARD 0
++#define DSET_TYPE_BPATCHED 1
++#define DSET_TYPE_COMPRESSED 2
+
-+#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
-+#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
++/* Dataset descriptor */
+
-+/*
-+ * ROAM MODES
-+ */
++typedef struct dset_descriptor_s {
++ struct dset_descriptor_s *next; /* List link. NULL only at the last
++ descriptor */
++ A_UINT16 id; /* Dset ID */
++ A_UINT16 size; /* Dset size. */
++ void *DataPtr; /* Pointer to raw data for standard
++ DataSet or pointer to original
++ dset_descriptor for patched
++ DataSet */
++ A_UINT32 data_type; /* DSET_TYPE_*, above */
+
-+typedef enum {
-+ WMI_DEFAULT_ROAM_MODE = 1, /* RSSI based ROAM */
-+ WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
-+ WMI_LOCK_BSS_MODE = 3 /* Lock to the Current BSS - no Roam */
-+} WMI_ROAM_MODE;
++ void *AuxPtr; /* Additional data that might
++ needed for data_type. For
++ example, pointer to patch
++ Dataset descriptor for BPatch. */
++} dset_descriptor_t;
+
++#endif /* __DSET_INTERNAL_H__ */
+diff --git a/drivers/ar6000/include/dsetid.h b/drivers/ar6000/include/dsetid.h
+new file mode 100644
+index 0000000..85729f8
+--- /dev/null
++++ b/drivers/ar6000/include/dsetid.h
+@@ -0,0 +1,110 @@
+/*
-+ * BSS HOST BIAS INFO
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
+ */
+
-+typedef PREPACK struct {
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_INT8 bias;
-+} POSTPACK WMI_BSS_BIAS;
-+
-+typedef PREPACK struct {
-+ A_UINT8 numBss;
-+ WMI_BSS_BIAS bssBias[1];
-+} POSTPACK WMI_BSS_BIAS_INFO;
-+
-+typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
-+ A_UINT16 lowrssi_scan_period;
-+ A_INT16 lowrssi_scan_threshold;
-+ A_INT16 lowrssi_roam_threshold;
-+ A_UINT8 roam_rssi_floor;
-+ A_UINT8 reserved[1]; /* For alignment */
-+} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
++#ifndef __DSETID_H__
++#define __DSETID_H__
+
-+typedef PREPACK struct {
-+ PREPACK union {
-+ A_UINT8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
-+ A_UINT8 roamMode; /* WMI_SET_ROAM_MODE */
-+ WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
-+ WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
-+ } POSTPACK info;
-+ A_UINT8 roamCtrlType ;
-+} POSTPACK WMI_SET_ROAM_CTRL_CMD;
++/* Well-known DataSet IDs */
++#define DSETID_UNUSED 0x00000000
++#define DSETID_BOARD_DATA 0x00000001 /* Cal and board data */
++#define DSETID_REGDB 0x00000002 /* Regulatory Database */
++#define DSETID_POWER_CONTROL 0x00000003 /* TX Pwr Lim & Ant Gain */
++#define DSETID_USER_CONFIG 0x00000004 /* User Configuration */
+
++#define DSETID_ANALOG_CONTROL_DATA_START 0x00000005
++#define DSETID_ANALOG_CONTROL_DATA_END 0x00000025
+/*
-+ * WMI_ENABLE_RM_CMDID
++ * Get DSETID for various reference clock speeds.
++ * For each speed there are three DataSets that correspond
++ * to the three columns of bank6 data (addr, 11a, 11b/g).
++ * This macro returns the dsetid of the first of those
++ * three DataSets.
+ */
-+typedef PREPACK struct {
-+ A_BOOL enable_radio_measurements;
-+} POSTPACK WMI_ENABLE_RM_CMD;
++#define ANALOG_CONTROL_DATA_DSETID(refclk) \
++ (DSETID_ANALOG_CONTROL_DATA_START + 3*refclk)
+
+/*
-+ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
++ * There are TWO STARTUP_PATCH DataSets.
++ * DSETID_STARTUP_PATCH is historical, and was applied before BMI on
++ * earlier systems. On AR6002, it is applied after BMI, just like
++ * DSETID_STARTUP_PATCH2.
+ */
-+typedef PREPACK struct {
-+ A_UINT8 max_offhome_duration;
-+} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
-+
-+typedef PREPACK struct {
-+ A_UINT32 frequency;
-+ A_UINT8 threshold;
-+} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
-+
-+typedef enum {
-+ BT_STREAM_UNDEF = 0,
-+ BT_STREAM_SCO, /* SCO stream */
-+ BT_STREAM_A2DP, /* A2DP stream */
-+ BT_STREAM_MAX
-+} BT_STREAM_TYPE;
-+
-+typedef enum {
-+ BT_PARAM_SCO = 1, /* SCO stream parameters */
-+ BT_PARAM_A2DP, /* A2DP stream parameters */
-+ BT_PARAM_MISC, /* miscellaneous parameters */
-+ BT_PARAM_REGS, /* co-existence register parameters */
-+ BT_PARAM_MAX
-+} BT_PARAM_TYPE;
-+
-+typedef enum {
-+ BT_STATUS_UNDEF = 0,
-+ BT_STATUS_START,
-+ BT_STATUS_STOP,
-+ BT_STATUS_RESUME,
-+ BT_STATUS_SUSPEND,
-+ BT_STATUS_MAX
-+} BT_STREAM_STATUS;
-+
-+typedef PREPACK struct {
-+ A_UINT8 streamType;
-+ A_UINT8 status;
-+} POSTPACK WMI_SET_BT_STATUS_CMD;
-+
-+typedef PREPACK struct {
-+ A_UINT8 noSCOPkts;
-+ A_UINT8 pspollTimeout;
-+ A_UINT8 stompbt;
-+} POSTPACK BT_PARAMS_SCO;
++#define DSETID_STARTUP_PATCH 0x00000026
++#define DSETID_GPIO_CONFIG_PATCH 0x00000027
++#define DSETID_WLANREGS 0x00000028 /* override wlan regs */
++#define DSETID_STARTUP_PATCH2 0x00000029
+
-+typedef PREPACK struct {
-+ A_UINT32 period;
-+ A_UINT32 dutycycle;
-+ A_UINT8 stompbt;
-+} POSTPACK BT_PARAMS_A2DP;
++#define DSETID_WOW_CONFIG 0x00000090 /* WoW Configuration */
+
-+typedef PREPACK struct {
-+ A_UINT32 mode;
-+ A_UINT32 scoWghts;
-+ A_UINT32 a2dpWghts;
-+ A_UINT32 genWghts;
-+ A_UINT32 mode2;
-+ A_UINT8 setVal;
-+} POSTPACK BT_COEX_REGS;
++/* Add WHAL_INI_DATA_ID to DSETID_INI_DATA for a specific WHAL INI table. */
++#define DSETID_INI_DATA 0x00000100
++/* Reserved for WHAL INI Tables: 0x100..0x11f */
++#define DSETID_INI_DATA_END 0x0000011f
+
-+typedef enum {
-+ WLAN_PROTECT_POLICY = 1,
-+ WLAN_COEX_CTRL_FLAGS
-+} BT_PARAMS_MISC_TYPE;
++#define DSETID_VENDOR_START 0x00010000 /* Vendor-defined DataSets */
+
-+typedef enum {
-+ WLAN_PROTECT_PER_STREAM = 0x01, /* default */
-+ WLAN_PROTECT_ANY_TX = 0x02
-+} WLAN_PROTECT_FLAGS;
++#define DSETID_INDEX_END 0xfffffffe /* Reserved to indicate the
++ end of a memory-based
++ DataSet Index */
++#define DSETID_INDEX_FREE 0xffffffff /* An unused index entry */
+
++/*
++ * PATCH DataSet format:
++ * A list of patches, terminated by a patch with
++ * address=PATCH_END.
++ *
++ * This allows for patches to be stored in flash.
++ */
++struct patch_s {
++ A_UINT32 *address;
++ A_UINT32 data;
++};
+
-+#define WLAN_DISABLE_COEX_IN_DISCONNECT 0x01 /* default */
-+#define WLAN_KEEP_COEX_IN_DISCONNECT 0x02
-+#define WLAN_STOMPBT_IN_DISCONNECT 0x04
++/*
++ * Skip some patches. Can be used to erase a single patch in a
++ * patch DataSet without having to re-write the DataSet. May
++ * also be used to embed information for use by subsequent
++ * patch code. The "data" in a PATCH_SKIP tells how many
++ * bytes of length "patch_s" to skip.
++ */
++#define PATCH_SKIP ((A_UINT32 *)0x00000000)
+
-+#define WLAN_DISABLE_COEX_IN_ROAM 0x10 /* default */
-+#define WLAN_KEEP_COEX_IN_ROAM 0x20
-+#define WLAN_STOMPBT_IN_ROAM 0x40
++/*
++ * Execute code at the address specified by "data".
++ * The address of the patch structure is passed as
++ * the one parameter.
++ */
++#define PATCH_CODE_ABS ((A_UINT32 *)0x00000001)
+
-+#define WLAN_DISABLE_COEX_IN_SCAN 0x100 /* default */
-+#define WLAN_KEEP_COEX_IN_SCAN 0x200
-+#define WLAN_STOMPBT_IN_SCAN 0x400
++/*
++ * Same as PATCH_CODE_ABS, but treat "data" as an
++ * offset from the start of the patch word.
++ */
++#define PATCH_CODE_REL ((A_UINT32 *)0x00000002)
+
-+#define WLAN_DISABLE_COEX_BT_OFF 0x1000 /* default */
-+#define WLAN_KEEP_COEX_BT_OFF 0x2000
-+#define WLAN_STOMPBT_BT_OFF 0x4000
++/* Mark the end of this patch DataSet. */
++#define PATCH_END ((A_UINT32 *)0xffffffff)
+
-+typedef PREPACK struct {
-+ A_UINT32 period;
-+ A_UINT32 dutycycle;
-+ A_UINT8 stompbt;
-+ A_UINT8 policy;
-+} POSTPACK WLAN_PROTECT_POLICY_TYPE;
++/*
++ * A DataSet which contains a Binary Patch to some other DataSet
++ * uses the original dsetid with the DSETID_BPATCH_FLAG bit set.
++ * Such a BPatch DataSet consists of BPatch metadata followed by
++ * the bdiff bytes. BPatch metadata consists of a single 32-bit
++ * word that contains the size of the BPatched final image.
++ *
++ * To create a suitable bdiff DataSet, use bdiff in host/tools/bdiff
++ * to create "diffs":
++ * bdiff -q -O -nooldmd5 -nonewmd5 -d ORIGfile NEWfile diffs
++ * Then add BPatch metadata to the start of "diffs".
++ *
++ * NB: There are some implementation-induced restrictions
++ * on which DataSets can be BPatched.
++ */
++#define DSETID_BPATCH_FLAG 0x80000000
+
-+typedef PREPACK struct {
-+ PREPACK union {
-+ WLAN_PROTECT_POLICY_TYPE protectParams;
-+ A_UINT16 wlanCtrlFlags;
-+ } POSTPACK info;
-+ A_UINT8 paramType;
-+} POSTPACK BT_PARAMS_MISC;
++#endif /* __DSETID_H__ */
+diff --git a/drivers/ar6000/include/gpio.h b/drivers/ar6000/include/gpio.h
+new file mode 100644
+index 0000000..2203c7e
+--- /dev/null
++++ b/drivers/ar6000/include/gpio.h
+@@ -0,0 +1,34 @@
++/*
++ * Copyright (c) 2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ */
+
-+typedef PREPACK struct {
-+ PREPACK union {
-+ BT_PARAMS_SCO scoParams;
-+ BT_PARAMS_A2DP a2dpParams;
-+ BT_PARAMS_MISC miscParams;
-+ BT_COEX_REGS regs;
-+ } POSTPACK info;
-+ A_UINT8 paramType;
-+} POSTPACK WMI_SET_BT_PARAMS_CMD;
++#if defined(AR6001)
++#define GPIO_PIN_COUNT 18
++#else
++#define GPIO_PIN_COUNT 18
++#endif
+
+/*
-+ * Command Replies
++ * Possible values for WMIX_GPIO_SET_REGISTER_CMDID.
++ * NB: These match hardware order, so that addresses can
++ * easily be computed.
+ */
++#define GPIO_ID_OUT 0x00000000
++#define GPIO_ID_OUT_W1TS 0x00000001
++#define GPIO_ID_OUT_W1TC 0x00000002
++#define GPIO_ID_ENABLE 0x00000003
++#define GPIO_ID_ENABLE_W1TS 0x00000004
++#define GPIO_ID_ENABLE_W1TC 0x00000005
++#define GPIO_ID_IN 0x00000006
++#define GPIO_ID_STATUS 0x00000007
++#define GPIO_ID_STATUS_W1TS 0x00000008
++#define GPIO_ID_STATUS_W1TC 0x00000009
++#define GPIO_ID_PIN0 0x0000000a
++#define GPIO_ID_PIN(n) (GPIO_ID_PIN0+(n))
+
++#define GPIO_LAST_REGISTER_ID GPIO_ID_PIN(17)
++#define GPIO_ID_NONE 0xffffffff
+diff --git a/drivers/ar6000/include/gpio_api.h b/drivers/ar6000/include/gpio_api.h
+new file mode 100644
+index 0000000..8078aa5
+--- /dev/null
++++ b/drivers/ar6000/include/gpio_api.h
+@@ -0,0 +1,57 @@
++#ifndef _GPIO_API_H_
++#define _GPIO_API_H_
+/*
-+ * WMI_GET_CHANNEL_LIST_CMDID reply
++ * Copyright 2005 Atheros Communications, Inc., All Rights Reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
+ */
-+typedef PREPACK struct {
-+ A_UINT8 reserved1;
-+ A_UINT8 numChannels; /* number of channels in reply */
-+ A_UINT16 channelList[1]; /* channel in Mhz */
-+} POSTPACK WMI_CHANNEL_LIST_REPLY;
-+
-+typedef enum {
-+ A_SUCCEEDED = A_OK,
-+ A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
-+ A_SUCCEEDED_MODIFY_STREAM=251,
-+ A_FAILED_INVALID_STREAM = 252,
-+ A_FAILED_MAX_THINSTREAMS = 253,
-+ A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
-+} PSTREAM_REPLY_STATUS;
+
+/*
-+ * List of Events (target to host)
++ * Host-side General Purpose I/O API.
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/gpio_api.h#1 $
+ */
-+typedef enum {
-+ WMI_READY_EVENTID = 0x1001,
-+ WMI_CONNECT_EVENTID,
-+ WMI_DISCONNECT_EVENTID,
-+ WMI_BSSINFO_EVENTID,
-+ WMI_CMDERROR_EVENTID,
-+ WMI_REGDOMAIN_EVENTID,
-+ WMI_PSTREAM_TIMEOUT_EVENTID,
-+ WMI_NEIGHBOR_REPORT_EVENTID,
-+ WMI_TKIP_MICERR_EVENTID,
-+ WMI_SCAN_COMPLETE_EVENTID,
-+ WMI_REPORT_STATISTICS_EVENTID,
-+ WMI_RSSI_THRESHOLD_EVENTID,
-+ WMI_ERROR_REPORT_EVENTID,
-+ WMI_OPT_RX_FRAME_EVENTID,
-+ WMI_REPORT_ROAM_TBL_EVENTID,
-+ WMI_EXTENSION_EVENTID,
-+ WMI_CAC_EVENTID,
-+ WMI_SNR_THRESHOLD_EVENTID,
-+ WMI_LQ_THRESHOLD_EVENTID,
-+ WMI_TX_RETRY_ERR_EVENTID,
-+ WMI_REPORT_ROAM_DATA_EVENTID,
-+ WMI_TEST_EVENTID,
-+ WMI_APLIST_EVENTID,
-+ WMI_GET_WOW_LIST_EVENTID,
-+ WMI_GET_PMKID_LIST_EVENTID
-+} WMI_EVENT_ID;
-+
-+typedef enum {
-+ WMI_11A_CAPABILITY = 1,
-+ WMI_11G_CAPABILITY = 2,
-+ WMI_11AG_CAPABILITY = 3,
-+} WMI_PHY_CAPABILITY;
+
-+typedef PREPACK struct {
-+ A_UINT8 macaddr[ATH_MAC_LEN];
-+ A_UINT8 phyCapability; /* WMI_PHY_CAPABILITY */
-+} POSTPACK WMI_READY_EVENT;
++/*
++ * Send a command to the Target in order to change output on GPIO pins.
++ */
++A_STATUS wmi_gpio_output_set(struct wmi_t *wmip,
++ A_UINT32 set_mask,
++ A_UINT32 clear_mask,
++ A_UINT32 enable_mask,
++ A_UINT32 disable_mask);
+
+/*
-+ * Connect Event
++ * Send a command to the Target requesting input state of GPIO pins.
+ */
-+typedef PREPACK struct {
-+ A_UINT16 channel;
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT16 listenInterval;
-+ A_UINT16 beaconInterval;
-+ A_UINT32 networkType;
-+ A_UINT8 beaconIeLen;
-+ A_UINT8 assocReqLen;
-+ A_UINT8 assocRespLen;
-+ A_UINT8 assocInfo[1];
-+} POSTPACK WMI_CONNECT_EVENT;
++A_STATUS wmi_gpio_input_get(struct wmi_t *wmip);
+
+/*
-+ * Disconnect Event
++ * Send a command to the Target to change the value of a GPIO register.
+ */
-+typedef enum {
-+ NO_NETWORK_AVAIL = 0x01,
-+ LOST_LINK = 0x02, /* bmiss */
-+ DISCONNECT_CMD = 0x03,
-+ BSS_DISCONNECTED = 0x04,
-+ AUTH_FAILED = 0x05,
-+ ASSOC_FAILED = 0x06,
-+ NO_RESOURCES_AVAIL = 0x07,
-+ CSERV_DISCONNECT = 0x08,
-+ INVALID_PROFILE = 0x0a,
-+ DOT11H_CHANNEL_SWITCH = 0x0b,
-+} WMI_DISCONNECT_REASON;
++A_STATUS wmi_gpio_register_set(struct wmi_t *wmip,
++ A_UINT32 gpioreg_id,
++ A_UINT32 value);
+
-+typedef PREPACK struct {
-+ A_UINT16 protocolReasonStatus; /* reason code, see 802.11 spec. */
-+ A_UINT8 bssid[ATH_MAC_LEN]; /* set if known */
-+ A_UINT8 disconnectReason ; /* see WMI_DISCONNECT_REASON */
-+ A_UINT8 assocRespLen;
-+ A_UINT8 assocInfo[1];
-+} POSTPACK WMI_DISCONNECT_EVENT;
++/*
++ * Send a command to the Target to fetch the value of a GPIO register.
++ */
++A_STATUS wmi_gpio_register_get(struct wmi_t *wmip, A_UINT32 gpioreg_id);
+
+/*
-+ * BSS Info Event.
-+ * Mechanism used to inform host of the presence and characteristic of
-+ * wireless networks present. Consists of bss info header followed by
-+ * the beacon or probe-response frame body. The 802.11 header is not included.
++ * Send a command to the Target, acknowledging some GPIO interrupts.
+ */
-+typedef enum {
-+ BEACON_FTYPE = 0x1,
-+ PROBERESP_FTYPE,
-+ ACTION_MGMT_FTYPE,
-+} WMI_BI_FTYPE;
-+
-+enum {
-+ BSS_ELEMID_CHANSWITCH = 0x01,
-+ BSS_ELEMID_ATHEROS = 0x02,
-+};
-+
-+typedef PREPACK struct {
-+ A_UINT16 channel;
-+ A_UINT8 frameType; /* see WMI_BI_FTYPE */
-+ A_UINT8 snr;
-+ A_INT16 rssi;
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT32 ieMask;
-+} POSTPACK WMI_BSS_INFO_HDR;
-+
-+/*
-+ * Command Error Event
-+ */
-+typedef enum {
-+ INVALID_PARAM = 0x01,
-+ ILLEGAL_STATE = 0x02,
-+ INTERNAL_ERROR = 0x03,
-+} WMI_ERROR_CODE;
-+
-+typedef PREPACK struct {
-+ A_UINT16 commandId;
-+ A_UINT8 errorCode;
-+} POSTPACK WMI_CMD_ERROR_EVENT;
++A_STATUS wmi_gpio_intr_ack(struct wmi_t *wmip, A_UINT32 ack_mask);
+
++#endif /* _GPIO_API_H_ */
+diff --git a/drivers/ar6000/include/hif.h b/drivers/ar6000/include/hif.h
+new file mode 100644
+index 0000000..846a69f
+--- /dev/null
++++ b/drivers/ar6000/include/hif.h
+@@ -0,0 +1,296 @@
+/*
-+ * New Regulatory Domain Event
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ * HIF specific declarations and prototypes
+ */
-+typedef PREPACK struct {
-+ A_UINT32 regDomain;
-+} POSTPACK WMI_REG_DOMAIN_EVENT;
+
-+typedef PREPACK struct {
-+ A_UINT8 trafficClass;
-+} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
++#ifndef _HIF_H_
++#define _HIF_H_
+
-+/*
-+ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
-+ * the host of BSS's it has found that matches the current profile.
-+ * It can be used by the host to cache PMKs and/to initiate pre-authentication
-+ * if the BSS supports it. The first bssid is always the current associated
-+ * BSS.
-+ * The bssid and bssFlags information repeats according to the number
-+ * or APs reported.
-+ */
-+typedef enum {
-+ WMI_DEFAULT_BSS_FLAGS = 0x00,
-+ WMI_PREAUTH_CAPABLE_BSS = 0x01,
-+ WMI_PMKID_VALID_BSS = 0x02,
-+} WMI_BSS_FLAGS;
++#ifdef __cplusplus
++extern "C" {
++#endif /* __cplusplus */
+
-+typedef PREPACK struct {
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT8 bssFlags; /* see WMI_BSS_FLAGS */
-+} POSTPACK WMI_NEIGHBOR_INFO;
++/* Header files */
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "a_osapi.h"
+
-+typedef PREPACK struct {
-+ A_INT8 numberOfAps;
-+ WMI_NEIGHBOR_INFO neighbor[1];
-+} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
++typedef struct htc_callbacks HTC_CALLBACKS;
++typedef struct hif_device HIF_DEVICE;
+
+/*
-+ * TKIP MIC Error Event
++ * direction - Direction of transfer (HIF_READ/HIF_WRITE).
+ */
-+typedef PREPACK struct {
-+ A_UINT8 keyid;
-+ A_UINT8 ismcast;
-+} POSTPACK WMI_TKIP_MICERR_EVENT;
++#define HIF_READ 0x00000001
++#define HIF_WRITE 0x00000002
++#define HIF_DIR_MASK (HIF_READ | HIF_WRITE)
+
+/*
-+ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
++ * type - An interface may support different kind of read/write commands.
++ * The command type is divided into a basic and an extended command
++ * and can be specified using HIF_BASIC_IO/HIF_EXTENDED_IO.
+ */
-+typedef PREPACK struct {
-+ A_STATUS status;
-+} POSTPACK WMI_SCAN_COMPLETE_EVENT;
-+
-+#define MAX_OPT_DATA_LEN 1400
++#define HIF_BASIC_IO 0x00000004
++#define HIF_EXTENDED_IO 0x00000008
++#define HIF_TYPE_MASK (HIF_BASIC_IO | HIF_EXTENDED_IO)
+
+/*
-+ * WMI_SET_ADHOC_BSSID_CMDID
++ * emode - This indicates the whether the command is to be executed in a
++ * blocking or non-blocking fashion (HIF_SYNCHRONOUS/
++ * HIF_ASYNCHRONOUS). The read/write data paths in HTC have been
++ * implemented using the asynchronous mode allowing the the bus
++ * driver to indicate the completion of operation through the
++ * registered callback routine. The requirement primarily comes
++ * from the contexts these operations get called from (a driver's
++ * transmit context or the ISR context in case of receive).
++ * Support for both of these modes is essential.
+ */
-+typedef PREPACK struct {
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
++#define HIF_SYNCHRONOUS 0x00000010
++#define HIF_ASYNCHRONOUS 0x00000020
++#define HIF_EMODE_MASK (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)
+
+/*
-+ * WMI_SET_OPT_MODE_CMDID
++ * dmode - An interface may support different kinds of commands based on
++ * the tradeoff between the amount of data it can carry and the
++ * setup time. Byte and Block modes are supported (HIF_BYTE_BASIS/
++ * HIF_BLOCK_BASIS). In case of latter, the data is rounded off
++ * to the nearest block size by padding. The size of the block is
++ * configurable at compile time using the HIF_BLOCK_SIZE and is
++ * negotiated with the target during initialization after the
++ * dragon interrupts are enabled.
+ */
-+typedef enum {
-+ SPECIAL_OFF,
-+ SPECIAL_ON,
-+} OPT_MODE_TYPE;
-+
-+typedef PREPACK struct {
-+ A_UINT8 optMode;
-+} POSTPACK WMI_SET_OPT_MODE_CMD;
++#define HIF_BYTE_BASIS 0x00000040
++#define HIF_BLOCK_BASIS 0x00000080
++#define HIF_DMODE_MASK (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)
+
+/*
-+ * WMI_TX_OPT_FRAME_CMDID
++ * amode - This indicates if the address has to be incremented on dragon
++ * after every read/write operation (HIF?FIXED_ADDRESS/
++ * HIF_INCREMENTAL_ADDRESS).
+ */
-+typedef enum {
-+ OPT_PROBE_REQ = 0x01,
-+ OPT_PROBE_RESP = 0x02,
-+ OPT_CPPP_START = 0x03,
-+ OPT_CPPP_STOP = 0x04,
-+} WMI_OPT_FTYPE;
++#define HIF_FIXED_ADDRESS 0x00000100
++#define HIF_INCREMENTAL_ADDRESS 0x00000200
++#define HIF_AMODE_MASK (HIF_FIXED_ADDRESS | HIF_INCREMENTAL_ADDRESS)
+
-+typedef PREPACK struct {
-+ A_UINT16 optIEDataLen;
-+ A_UINT8 frmType;
-+ A_UINT8 dstAddr[ATH_MAC_LEN];
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT8 reserved; /* For alignment */
-+ A_UINT8 optIEData[1];
-+} POSTPACK WMI_OPT_TX_FRAME_CMD;
++#define HIF_WR_ASYNC_BYTE_FIX \
++ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
++#define HIF_WR_ASYNC_BYTE_INC \
++ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_WR_ASYNC_BLOCK_INC \
++ (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_WR_SYNC_BYTE_FIX \
++ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
++#define HIF_WR_SYNC_BYTE_INC \
++ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_WR_SYNC_BLOCK_INC \
++ (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_RD_SYNC_BYTE_INC \
++ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_RD_SYNC_BYTE_FIX \
++ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
++#define HIF_RD_ASYNC_BYTE_FIX \
++ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
++#define HIF_RD_ASYNC_BLOCK_FIX \
++ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
++#define HIF_RD_ASYNC_BYTE_INC \
++ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_RD_ASYNC_BLOCK_INC \
++ (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
++#define HIF_RD_SYNC_BLOCK_INC \
++ (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+
-+/*
-+ * Special frame receive Event.
-+ * Mechanism used to inform host of the receiption of the special frames.
-+ * Consists of special frame info header followed by special frame body.
-+ * The 802.11 header is not included.
-+ */
-+typedef PREPACK struct {
-+ A_UINT16 channel;
-+ A_UINT8 frameType; /* see WMI_OPT_FTYPE */
-+ A_INT8 snr;
-+ A_UINT8 srcAddr[ATH_MAC_LEN];
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+} POSTPACK WMI_OPT_RX_INFO_HDR;
++
++typedef enum {
++ HIF_DEVICE_POWER_STATE = 0,
++ HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
++ HIF_DEVICE_GET_MBOX_ADDR,
++ HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
++ HIF_DEVICE_GET_IRQ_PROC_MODE,
++ HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
++} HIF_DEVICE_CONFIG_OPCODE;
+
+/*
-+ * Reporting statistics.
++ * HIF CONFIGURE definitions:
++ *
++ * HIF_DEVICE_GET_MBOX_BLOCK_SIZE
++ * input : none
++ * output : array of 4 A_UINT32s
++ * notes: block size is returned for each mailbox (4)
++ *
++ * HIF_DEVICE_GET_MBOX_ADDR
++ * input : none
++ * output : array of 4 A_UINT32
++ * notes: address is returned for each mailbox (4) in the array
++ *
++ * HIF_DEVICE_GET_PENDING_EVENTS_FUNC
++ * input : none
++ * output: HIF_PENDING_EVENTS_FUNC function pointer
++ * notes: this is optional for the HIF layer, if the request is
++ * not handled then it indicates that the upper layer can use
++ * the standard device methods to get pending events (IRQs, mailbox messages etc..)
++ * otherwise it can call the function pointer to check pending events.
++ *
++ * HIF_DEVICE_GET_IRQ_PROC_MODE
++ * input : none
++ * output : HIF_DEVICE_IRQ_PROCESSING_MODE (interrupt processing mode)
++ * note: the hif layer interfaces with the underlying OS-specific bus driver. The HIF
++ * layer can report whether IRQ processing is requires synchronous behavior or
++ * can be processed using asynchronous bus requests (typically faster).
++ *
++ * HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC
++ * input :
++ * output : HIF_MASK_UNMASK_RECV_EVENT function pointer
++ * notes: this is optional for the HIF layer. The HIF layer may require a special mechanism
++ * to mask receive message events. The upper layer can call this pointer when it needs
++ * to mask/unmask receive events (in case it runs out of buffers).
++ *
++ *
+ */
-+typedef PREPACK struct {
-+ A_UINT32 tx_packets;
-+ A_UINT32 tx_bytes;
-+ A_UINT32 tx_unicast_pkts;
-+ A_UINT32 tx_unicast_bytes;
-+ A_UINT32 tx_multicast_pkts;
-+ A_UINT32 tx_multicast_bytes;
-+ A_UINT32 tx_broadcast_pkts;
-+ A_UINT32 tx_broadcast_bytes;
-+ A_UINT32 tx_rts_success_cnt;
-+ A_UINT32 tx_packet_per_ac[4];
-+ A_UINT32 tx_errors_per_ac[4];
+
-+ A_UINT32 tx_errors;
-+ A_UINT32 tx_failed_cnt;
-+ A_UINT32 tx_retry_cnt;
-+ A_UINT32 tx_rts_fail_cnt;
-+ A_INT32 tx_unicast_rate;
-+}POSTPACK tx_stats_t;
++typedef enum {
++ HIF_DEVICE_IRQ_SYNC_ONLY, /* for HIF implementations that require the DSR to process all
++ interrupts before returning */
++ HIF_DEVICE_IRQ_ASYNC_SYNC, /* for HIF implementations that allow DSR to process interrupts
++ using ASYNC I/O (that is HIFAckInterrupt can be called at a
++ later time */
++} HIF_DEVICE_IRQ_PROCESSING_MODE;
+
-+typedef PREPACK struct {
-+ A_UINT32 rx_packets;
-+ A_UINT32 rx_bytes;
-+ A_UINT32 rx_unicast_pkts;
-+ A_UINT32 rx_unicast_bytes;
-+ A_UINT32 rx_multicast_pkts;
-+ A_UINT32 rx_multicast_bytes;
-+ A_UINT32 rx_broadcast_pkts;
-+ A_UINT32 rx_broadcast_bytes;
-+ A_UINT32 rx_fragment_pkt;
++#define HIF_MAX_DEVICES 1
+
-+ A_UINT32 rx_errors;
-+ A_UINT32 rx_crcerr;
-+ A_UINT32 rx_key_cache_miss;
-+ A_UINT32 rx_decrypt_err;
-+ A_UINT32 rx_duplicate_frames;
-+ A_INT32 rx_unicast_rate;
-+}POSTPACK rx_stats_t;
++struct htc_callbacks {
++ A_UCHAR *name;
++ A_UINT32 id;
++ A_STATUS (* deviceInsertedHandler)(void *hif_handle);
++ A_STATUS (* deviceRemovedHandler)(void *htc_handle, A_STATUS status);
++ A_STATUS (* deviceSuspendHandler)(void *htc_handle);
++ A_STATUS (* deviceResumeHandler)(void *htc_handle);
++ A_STATUS (* deviceWakeupHandler)(void *htc_handle);
++ A_STATUS (* rwCompletionHandler)(void *context, A_STATUS status);
++ A_STATUS (* dsrHandler)(void *htc_handle);
++};
+
-+typedef PREPACK struct {
-+ A_UINT32 tkip_local_mic_failure;
-+ A_UINT32 tkip_counter_measures_invoked;
-+ A_UINT32 tkip_replays;
-+ A_UINT32 tkip_format_errors;
-+ A_UINT32 ccmp_format_errors;
-+ A_UINT32 ccmp_replays;
-+}POSTPACK tkip_ccmp_stats_t;
+
-+typedef PREPACK struct {
-+ A_UINT32 power_save_failure_cnt;
-+}POSTPACK pm_stats_t;
++#define HIF_OTHER_EVENTS (1 << 0) /* other interrupts (non-Recv) are pending, host
++ needs to read the register table to figure out what */
++#define HIF_RECV_MSG_AVAIL (1 << 1) /* pending recv packet */
+
-+typedef PREPACK struct {
-+ A_UINT32 cs_bmiss_cnt;
-+ A_UINT32 cs_lowRssi_cnt;
-+ A_UINT16 cs_connect_cnt;
-+ A_UINT16 cs_disconnect_cnt;
-+ A_INT16 cs_aveBeacon_rssi;
-+ A_UINT16 cs_roam_count;
-+ A_UINT16 cs_rssi;
-+ A_UINT8 cs_snr;
-+ A_UINT8 cs_aveBeacon_snr;
-+ A_UINT8 cs_lastRoam_msec;
-+} POSTPACK cserv_stats_t;
++typedef struct _HIF_PENDING_EVENTS_INFO {
++ A_UINT32 Events;
++ A_UINT32 LookAhead;
++} HIF_PENDING_EVENTS_INFO;
+
-+typedef PREPACK struct {
-+ tx_stats_t tx_stats;
-+ rx_stats_t rx_stats;
-+ tkip_ccmp_stats_t tkipCcmpStats;
-+}POSTPACK wlan_net_stats_t;
++ /* function to get pending events , some HIF modules use special mechanisms
++ * to detect packet available and other interrupts */
++typedef A_STATUS ( *HIF_PENDING_EVENTS_FUNC)(HIF_DEVICE *device,
++ HIF_PENDING_EVENTS_INFO *pEvents,
++ void *AsyncContext);
+
-+typedef PREPACK struct {
-+ A_UINT32 wow_num_pkts_dropped;
-+ A_UINT16 wow_num_events_discarded;
-+ A_UINT8 wow_num_host_pkt_wakeups;
-+ A_UINT8 wow_num_host_event_wakeups;
-+} POSTPACK wlan_wow_stats_t;
++#define HIF_MASK_RECV TRUE
++#define HIF_UNMASK_RECV FALSE
++ /* function to mask recv events */
++typedef A_STATUS ( *HIF_MASK_UNMASK_RECV_EVENT)(HIF_DEVICE *device,
++ A_BOOL Mask,
++ void *AsyncContext);
+
-+typedef PREPACK struct {
-+ A_UINT32 lqVal;
-+ A_INT32 noise_floor_calibation;
-+ pm_stats_t pmStats;
-+ wlan_net_stats_t txrxStats;
-+ wlan_wow_stats_t wowStats;
-+ cserv_stats_t cservStats;
-+} POSTPACK WMI_TARGET_STATS;
+
+/*
-+ * WMI_RSSI_THRESHOLD_EVENTID.
-+ * Indicate the RSSI events to host. Events are indicated when we breach a
-+ * thresold value.
++ * This API is used by the HTC layer to initialize the HIF layer and to
++ * register different callback routines. Support for following events has
++ * been captured - DSR, Read/Write completion, Device insertion/removal,
++ * Device suspension/resumption/wakeup. In addition to this, the API is
++ * also used to register the name and the revision of the chip. The latter
++ * can be used to verify the revision of the chip read from the device
++ * before reporting it to HTC.
+ */
-+typedef enum{
-+ WMI_RSSI_THRESHOLD1_ABOVE = 0,
-+ WMI_RSSI_THRESHOLD2_ABOVE,
-+ WMI_RSSI_THRESHOLD3_ABOVE,
-+ WMI_RSSI_THRESHOLD4_ABOVE,
-+ WMI_RSSI_THRESHOLD5_ABOVE,
-+ WMI_RSSI_THRESHOLD6_ABOVE,
-+ WMI_RSSI_THRESHOLD1_BELOW,
-+ WMI_RSSI_THRESHOLD2_BELOW,
-+ WMI_RSSI_THRESHOLD3_BELOW,
-+ WMI_RSSI_THRESHOLD4_BELOW,
-+ WMI_RSSI_THRESHOLD5_BELOW,
-+ WMI_RSSI_THRESHOLD6_BELOW
-+}WMI_RSSI_THRESHOLD_VAL;
-+
-+typedef PREPACK struct {
-+ A_INT16 rssi;
-+ A_UINT8 range;
-+}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
++int HIFInit(HTC_CALLBACKS *callbacks);
+
+/*
-+ * WMI_ERROR_REPORT_EVENTID
++ * This API is used to provide the read/write interface over the specific bus
++ * interface.
++ * address - Starting address in the dragon's address space. For mailbox
++ * writes, it refers to the start of the mbox boundary. It should
++ * be ensured that the last byte falls on the mailbox's EOM. For
++ * mailbox reads, it refers to the end of the mbox boundary.
++ * buffer - Pointer to the buffer containg the data to be transmitted or
++ * received.
++ * length - Amount of data to be transmitted or received.
++ * request - Characterizes the attributes of the command.
+ */
-+typedef enum{
-+ WMI_TARGET_PM_ERR_FAIL = 0x00000001,
-+ WMI_TARGET_KEY_NOT_FOUND = 0x00000002,
-+ WMI_TARGET_DECRYPTION_ERR = 0x00000004,
-+ WMI_TARGET_BMISS = 0x00000008,
-+ WMI_PSDISABLE_NODE_JOIN = 0x00000010,
-+ WMI_TARGET_COM_ERR = 0x00000020,
-+ WMI_TARGET_FATAL_ERR = 0x00000040
-+} WMI_TARGET_ERROR_VAL;
-+
-+typedef PREPACK struct {
-+ A_UINT32 errorVal;
-+}POSTPACK WMI_TARGET_ERROR_REPORT_EVENT;
++A_STATUS
++HIFReadWrite(HIF_DEVICE *device,
++ A_UINT32 address,
++ A_UCHAR *buffer,
++ A_UINT32 length,
++ A_UINT32 request,
++ void *context);
+
-+typedef PREPACK struct {
-+ A_UINT8 retrys;
-+}POSTPACK WMI_TX_RETRY_ERR_EVENT;
++/*
++ * This can be initiated from the unload driver context ie when the HTCShutdown
++ * routine is called.
++ */
++void HIFShutDownDevice(HIF_DEVICE *device);
+
-+typedef enum{
-+ WMI_SNR_THRESHOLD1_ABOVE = 1,
-+ WMI_SNR_THRESHOLD1_BELOW,
-+ WMI_SNR_THRESHOLD2_ABOVE,
-+ WMI_SNR_THRESHOLD2_BELOW,
-+ WMI_SNR_THRESHOLD3_ABOVE,
-+ WMI_SNR_THRESHOLD3_BELOW,
-+ WMI_SNR_THRESHOLD4_ABOVE,
-+ WMI_SNR_THRESHOLD4_BELOW
-+} WMI_SNR_THRESHOLD_VAL;
++/*
++ * This should translate to an acknowledgment to the bus driver indicating that
++ * the previous interrupt request has been serviced and the all the relevant
++ * sources have been cleared. HTC is ready to process more interrupts.
++ * This should prevent the bus driver from raising an interrupt unless the
++ * previous one has been serviced and acknowledged using the previous API.
++ */
++void HIFAckInterrupt(HIF_DEVICE *device);
+
-+typedef PREPACK struct {
-+ A_UINT8 range; /* WMI_SNR_THRESHOLD_VAL */
-+ A_UINT8 snr;
-+}POSTPACK WMI_SNR_THRESHOLD_EVENT;
++void HIFMaskInterrupt(HIF_DEVICE *device);
+
-+typedef enum{
-+ WMI_LQ_THRESHOLD1_ABOVE = 1,
-+ WMI_LQ_THRESHOLD1_BELOW,
-+ WMI_LQ_THRESHOLD2_ABOVE,
-+ WMI_LQ_THRESHOLD2_BELOW,
-+ WMI_LQ_THRESHOLD3_ABOVE,
-+ WMI_LQ_THRESHOLD3_BELOW,
-+ WMI_LQ_THRESHOLD4_ABOVE,
-+ WMI_LQ_THRESHOLD4_BELOW
-+} WMI_LQ_THRESHOLD_VAL;
++void HIFUnMaskInterrupt(HIF_DEVICE *device);
+
-+typedef PREPACK struct {
-+ A_INT32 lq;
-+ A_UINT8 range; /* WMI_LQ_THRESHOLD_VAL */
-+}POSTPACK WMI_LQ_THRESHOLD_EVENT;
+/*
-+ * WMI_REPORT_ROAM_TBL_EVENTID
++ * This set of functions are to be used by the bus driver to notify
++ * the HIF module about various events.
++ * These are not implemented if the bus driver provides an alternative
++ * way for this notification though callbacks for instance.
+ */
-+#define MAX_ROAM_TBL_CAND 5
++int HIFInsertEventNotify(void);
+
-+typedef PREPACK struct {
-+ A_INT32 roam_util;
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_INT8 rssi;
-+ A_INT8 rssidt;
-+ A_INT8 last_rssi;
-+ A_INT8 util;
-+ A_INT8 bias;
-+ A_UINT8 reserved; /* For alignment */
-+} POSTPACK WMI_BSS_ROAM_INFO;
++int HIFRemoveEventNotify(void);
+
++int HIFIRQEventNotify(void);
+
-+typedef PREPACK struct {
-+ A_UINT16 roamMode;
-+ A_UINT16 numEntries;
-+ WMI_BSS_ROAM_INFO bssRoamInfo[1];
-+} POSTPACK WMI_TARGET_ROAM_TBL;
++int HIFRWCompleteEventNotify(void);
+
+/*
-+ * WMI_CAC_EVENTID
++ * This function associates a opaque handle with the HIF layer
++ * to be used in communication with upper layer i.e. HTC.
++ * This would normaly be a pointer to htc_target data structure.
+ */
-+typedef enum {
-+ CAC_INDICATION_ADMISSION = 0x00,
-+ CAC_INDICATION_ADMISSION_RESP = 0x01,
-+ CAC_INDICATION_DELETE = 0x02,
-+ CAC_INDICATION_NO_RESP = 0x03,
-+}CAC_INDICATION;
-+
-+#define WMM_TSPEC_IE_LEN 63
++void HIFSetHandle(void *hif_handle, void *handle);
+
-+typedef PREPACK struct {
-+ A_UINT8 ac;
-+ A_UINT8 cac_indication;
-+ A_UINT8 statusCode;
-+ A_UINT8 tspecSuggestion[WMM_TSPEC_IE_LEN];
-+}POSTPACK WMI_CAC_EVENT;
-+
-+/*
-+ * WMI_APLIST_EVENTID
-+ */
-+
-+typedef enum {
-+ APLIST_VER1 = 1,
-+} APLIST_VER;
++A_STATUS
++HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
++ void *config, A_UINT32 configLen);
+
-+typedef PREPACK struct {
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT16 channel;
-+} POSTPACK WMI_AP_INFO_V1;
+
-+typedef PREPACK union {
-+ WMI_AP_INFO_V1 apInfoV1;
-+} POSTPACK WMI_AP_INFO;
++struct device;
++struct device*
++HIFGetOSDevice(HIF_DEVICE *device);
+
-+typedef PREPACK struct {
-+ A_UINT8 apListVer;
-+ A_UINT8 numAP;
-+ WMI_AP_INFO apList[1];
-+} POSTPACK WMI_APLIST_EVENT;
+
-+/*
-+ * developer commands
-+ */
++#ifdef __cplusplus
++}
++#endif
+
++#endif /* _HIF_H_ */
+diff --git a/drivers/ar6000/include/host_version.h b/drivers/ar6000/include/host_version.h
+new file mode 100644
+index 0000000..c090115
+--- /dev/null
++++ b/drivers/ar6000/include/host_version.h
+@@ -0,0 +1,49 @@
++#ifndef _HOST_VERSION_H_
++#define _HOST_VERSION_H_
+/*
-+ * WMI_SET_BITRATE_CMDID
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This file contains version information for the sample host driver for the
++ * AR6000 chip
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/host_version.h#2 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
+ *
-+ * Get bit rate cmd uses same definition as set bit rate cmd
+ */
-+typedef enum {
-+ RATE_AUTO = -1,
-+ RATE_1Mb = 0,
-+ RATE_2Mb = 1,
-+ RATE_5_5Mb = 2,
-+ RATE_11Mb = 3,
-+ RATE_6Mb = 4,
-+ RATE_9Mb = 5,
-+ RATE_12Mb = 6,
-+ RATE_18Mb = 7,
-+ RATE_24Mb = 8,
-+ RATE_36Mb = 9,
-+ RATE_48Mb = 10,
-+ RATE_54Mb = 11,
-+} WMI_BIT_RATE;
+
-+typedef PREPACK struct {
-+ A_INT8 rateIndex; /* see WMI_BIT_RATE */
-+} POSTPACK WMI_BIT_RATE_CMD, WMI_BIT_RATE_REPLY;
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++#include <AR6K_version.h>
+
+/*
-+ * WMI_SET_FIXRATES_CMDID
-+ *
-+ * Get fix rates cmd uses same definition as set fix rates cmd
++ * The version number is made up of major, minor, patch and build
++ * numbers. These are 16 bit numbers. The build and release script will
++ * set the build number using a Perforce counter. Here the build number is
++ * set to 9999 so that builds done without the build-release script are easily
++ * identifiable.
+ */
-+typedef enum {
-+ FIX_RATE_1Mb = 0x1,
-+ FIX_RATE_2Mb = 0x2,
-+ FIX_RATE_5_5Mb = 0x4,
-+ FIX_RATE_11Mb = 0x8,
-+ FIX_RATE_6Mb = 0x10,
-+ FIX_RATE_9Mb = 0x20,
-+ FIX_RATE_12Mb = 0x40,
-+ FIX_RATE_18Mb = 0x80,
-+ FIX_RATE_24Mb = 0x100,
-+ FIX_RATE_36Mb = 0x200,
-+ FIX_RATE_48Mb = 0x400,
-+ FIX_RATE_54Mb = 0x800,
-+} WMI_FIX_RATES_MASK;
+
-+typedef PREPACK struct {
-+ A_UINT16 fixRateMask; /* see WMI_BIT_RATE */
-+} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
++#define ATH_SW_VER_MAJOR __VER_MAJOR_
++#define ATH_SW_VER_MINOR __VER_MINOR_
++#define ATH_SW_VER_PATCH __VER_PATCH_
++#define ATH_SW_VER_BUILD 9999
++
++#ifdef __cplusplus
++}
++#endif
+
++#endif /* _HOST_VERSION_H_ */
+diff --git a/drivers/ar6000/include/htc.h b/drivers/ar6000/include/htc.h
+new file mode 100644
+index 0000000..152d867
+--- /dev/null
++++ b/drivers/ar6000/include/htc.h
+@@ -0,0 +1,190 @@
+/*
-+ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
-+ * Set authentication mode
+ */
-+typedef enum {
-+ RECONN_DO_AUTH = 0x00,
-+ RECONN_NOT_AUTH = 0x01
-+} WMI_AUTH_MODE;
+
-+typedef PREPACK struct {
-+ A_UINT8 mode;
-+} POSTPACK WMI_SET_AUTH_MODE_CMD;
+
-+/*
-+ * WMI_SET_REASSOC_MODE_CMDID
-+ *
-+ * Set authentication mode
-+ */
-+typedef enum {
-+ REASSOC_DO_DISASSOC = 0x00,
-+ REASSOC_DONOT_DISASSOC = 0x01
-+} WMI_REASSOC_MODE;
++#ifndef __HTC_H__
++#define __HTC_H__
+
-+typedef PREPACK struct {
-+ A_UINT8 mode;
-+}POSTPACK WMI_SET_REASSOC_MODE_CMD;
++#ifndef ATH_TARGET
++#include "athstartpack.h"
++#endif
+
-+typedef enum {
-+ ROAM_DATA_TIME = 1, /* Get The Roam Time Data */
-+} ROAM_DATA_TYPE;
++#define A_OFFSETOF(type,field) (int)(&(((type *)NULL)->field))
+
-+typedef PREPACK struct {
-+ A_UINT32 disassoc_time;
-+ A_UINT32 no_txrx_time;
-+ A_UINT32 assoc_time;
-+ A_UINT32 allow_txrx_time;
-+ A_UINT32 last_data_txrx_time;
-+ A_UINT32 first_data_txrx_time;
-+ A_UINT8 disassoc_bssid[ATH_MAC_LEN];
-+ A_INT8 disassoc_bss_rssi;
-+ A_UINT8 assoc_bssid[ATH_MAC_LEN];
-+ A_INT8 assoc_bss_rssi;
-+} POSTPACK WMI_TARGET_ROAM_TIME;
++#define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
++ (((A_UINT16)(((A_UINT8 *)(p))[(highbyte)])) << 8 | (A_UINT16)(((A_UINT8 *)(p))[(lowbyte)]))
+
-+typedef PREPACK struct {
-+ PREPACK union {
-+ WMI_TARGET_ROAM_TIME roamTime;
-+ } POSTPACK u;
-+ A_UINT8 roamDataType ;
-+} POSTPACK WMI_TARGET_ROAM_DATA;
++/* alignment independent macros (little-endian) to fetch UINT16s or UINT8s from a
++ * structure using only the type and field name.
++ * Use these macros if there is the potential for unaligned buffer accesses. */
++#define A_GET_UINT16_FIELD(p,type,field) \
++ ASSEMBLE_UNALIGNED_UINT16(p,\
++ A_OFFSETOF(type,field) + 1, \
++ A_OFFSETOF(type,field))
+
-+typedef enum {
-+ WMI_WMM_DISABLED = 0,
-+ WMI_WMM_ENABLED
-+} WMI_WMM_STATUS;
++#define A_SET_UINT16_FIELD(p,type,field,value) \
++{ \
++ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (A_UINT8)(value); \
++ ((A_UINT8 *)(p))[A_OFFSETOF(type,field) + 1] = (A_UINT8)((value) >> 8); \
++}
+
-+typedef PREPACK struct {
-+ A_UINT8 status;
-+}POSTPACK WMI_SET_WMM_CMD;
++#define A_GET_UINT8_FIELD(p,type,field) \
++ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)]
+
-+typedef enum {
-+ WMI_TXOP_DISABLED = 0,
-+ WMI_TXOP_ENABLED
-+} WMI_TXOP_CFG;
++#define A_SET_UINT8_FIELD(p,type,field,value) \
++ ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (value)
+
-+typedef PREPACK struct {
-+ A_UINT8 txopEnable;
-+}POSTPACK WMI_SET_WMM_TXOP_CMD;
++/****** DANGER DANGER ***************
++ *
++ * The frame header length and message formats defined herein were
++ * selected to accommodate optimal alignment for target processing. This reduces code
++ * size and improves performance.
++ *
++ * Any changes to the header length may alter the alignment and cause exceptions
++ * on the target. When adding to the message structures insure that fields are
++ * properly aligned.
++ *
++ */
+
-+typedef PREPACK struct {
-+ A_UINT8 keepaliveInterval;
-+} POSTPACK WMI_SET_KEEPALIVE_CMD;
++/* HTC frame header */
++typedef PREPACK struct _HTC_FRAME_HDR{
++ /* do not remove or re-arrange these fields, these are minimally required
++ * to take advantage of 4-byte lookaheads in some hardware implementations */
++ A_UINT8 EndpointID;
++ A_UINT8 Flags;
++ A_UINT16 PayloadLen; /* length of data (including trailer) that follows the header */
+
-+typedef PREPACK struct {
-+ A_BOOL configured;
-+ A_UINT8 keepaliveInterval;
-+} POSTPACK WMI_GET_KEEPALIVE_CMD;
++ /***** end of 4-byte lookahead ****/
+
-+/*
-+ * Add Application specified IE to a management frame
-+ */
-+#define WMI_MAX_IE_LEN 78
++ A_UINT8 ControlBytes[2];
+
-+typedef PREPACK struct {
-+ A_UINT8 mgmtFrmType; /* one of WMI_MGMT_FRAME_TYPE */
-+ A_UINT8 ieLen; /* Length of the IE that should be added to the MGMT frame */
-+ A_UINT8 ieInfo[1];
-+} POSTPACK WMI_SET_APPIE_CMD;
++ /* message payload starts after the header */
+
-+/*
-+ * Notify the WSC registration status to the target
-+ */
-+#define WSC_REG_ACTIVE 1
-+#define WSC_REG_INACTIVE 0
-+/* Generic Hal Interface for setting hal paramters. */
-+/* Add new Set HAL Param cmdIds here for newer params */
++} POSTPACK HTC_FRAME_HDR;
++
++/* frame header flags */
++#define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
++#define HTC_FLAGS_RECV_TRAILER (1 << 1)
++
++
++#define HTC_HDR_LENGTH (sizeof(HTC_FRAME_HDR))
++#define HTC_MAX_TRAILER_LENGTH 255
++#define HTC_MAX_PAYLOAD_LENGTH (2048 - sizeof(HTC_FRAME_HDR))
++
++/* HTC control message IDs */
+typedef enum {
-+ WHAL_SETCABTO_CMDID = 1,
-+}WHAL_CMDID;
++ HTC_MSG_READY_ID = 1,
++ HTC_MSG_CONNECT_SERVICE_ID = 2,
++ HTC_MSG_CONNECT_SERVICE_RESPONSE_ID = 3,
++ HTC_MSG_SETUP_COMPLETE_ID = 4,
++} HTC_MSG_IDS;
+
-+typedef PREPACK struct {
-+ A_UINT8 cabTimeOut;
-+} POSTPACK WHAL_SETCABTO_PARAM;
++#define HTC_MAX_CONTROL_MESSAGE_LENGTH 256
+
++/* base message ID header */
+typedef PREPACK struct {
-+ A_UINT8 whalCmdId;
-+ A_UINT8 data[1];
-+} POSTPACK WHAL_PARAMCMD;
++ A_UINT16 MessageID;
++} POSTPACK HTC_UNKNOWN_MSG;
+
++/* HTC ready message
++ * direction : target-to-host */
++typedef PREPACK struct {
++ A_UINT16 MessageID; /* ID */
++ A_UINT16 CreditCount; /* number of credits the target can offer */
++ A_UINT16 CreditSize; /* size of each credit */
++ A_UINT8 MaxEndpoints; /* maximum number of endpoints the target has resources for */
++ A_UINT8 _Pad1;
++} POSTPACK HTC_READY_MSG;
+
-+#define WOW_MAX_FILTER_LISTS 1 /*4*/
-+#define WOW_MAX_FILTERS_PER_LIST 4
-+#define WOW_PATTERN_SIZE 64
-+#define WOW_MASK_SIZE 64
++#define HTC_SERVICE_META_DATA_MAX_LENGTH 128
+
++/* connect service
++ * direction : host-to-target */
+typedef PREPACK struct {
-+ A_UINT8 wow_valid_filter;
-+ A_UINT8 wow_filter_id;
-+ A_UINT8 wow_filter_size;
-+ A_UINT8 wow_filter_offset;
-+ A_UINT8 wow_filter_mask[WOW_MASK_SIZE];
-+ A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE];
-+} POSTPACK WOW_FILTER;
++ A_UINT16 MessageID;
++ A_UINT16 ServiceID; /* service ID of the service to connect to */
++ A_UINT16 ConnectionFlags; /* connection flags */
+
++#define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2) /* reduce credit dribbling when
++ the host needs credits */
++#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK (0x3)
++#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_FOURTH 0x0
++#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF 0x1
++#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_THREE_FOURTHS 0x2
++#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_UNITY 0x3
+
-+typedef PREPACK struct {
-+ A_UINT8 wow_valid_list;
-+ A_UINT8 wow_list_id;
-+ A_UINT8 wow_num_filters;
-+ A_UINT8 wow_total_list_size;
-+ WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
-+} POSTPACK WOW_FILTER_LIST;
++ A_UINT8 ServiceMetaLength; /* length of meta data that follows */
++ A_UINT8 _Pad1;
+
-+typedef PREPACK struct {
-+ A_BOOL awake;
-+ A_BOOL asleep;
-+} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
++ /* service-specific meta data starts after the header */
+
-+typedef PREPACK struct {
-+ A_BOOL enable_wow;
-+} POSTPACK WMI_SET_WOW_MODE_CMD;
++} POSTPACK HTC_CONNECT_SERVICE_MSG;
+
++/* connect response
++ * direction : target-to-host */
+typedef PREPACK struct {
-+ A_UINT8 filter_list_id;
-+} POSTPACK WMI_GET_WOW_LIST_CMD;
++ A_UINT16 MessageID;
++ A_UINT16 ServiceID; /* service ID that the connection request was made */
++ A_UINT8 Status; /* service connection status */
++ A_UINT8 EndpointID; /* assigned endpoint ID */
++ A_UINT16 MaxMsgSize; /* maximum expected message size on this endpoint */
++ A_UINT8 ServiceMetaLength; /* length of meta data that follows */
++ A_UINT8 _Pad1;
+
-+/*
-+ * WMI_GET_WOW_LIST_CMD reply
-+ */
-+typedef PREPACK struct {
-+ A_UINT8 num_filters; /* number of patterns in reply */
-+ A_UINT8 this_filter_num; /* this is filter # x of total num_filters */
-+ A_UINT8 wow_mode;
-+ A_UINT8 host_mode;
-+ WOW_FILTER wow_filters[1];
-+} POSTPACK WMI_GET_WOW_LIST_REPLY;
++ /* service-specific meta data starts after the header */
+
-+typedef PREPACK struct {
-+ A_UINT8 filter_list_id;
-+ A_UINT8 filter_size;
-+ A_UINT8 filter_offset;
-+ A_UINT8 filter[1];
-+} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
++} POSTPACK HTC_CONNECT_SERVICE_RESPONSE_MSG;
+
+typedef PREPACK struct {
-+ A_UINT16 filter_list_id;
-+ A_UINT16 filter_id;
-+} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
++ A_UINT16 MessageID;
++ /* currently, no other fields */
++} POSTPACK HTC_SETUP_COMPLETE_MSG;
+
-+typedef PREPACK struct {
-+ A_UINT8 macaddr[ATH_MAC_LEN];
-+} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
+
-+/*
-+ * WMI_SET_AKMP_PARAMS_CMD
-+ */
++/* connect response status codes */
++#define HTC_SERVICE_SUCCESS 0 /* success */
++#define HTC_SERVICE_NOT_FOUND 1 /* service could not be found */
++#define HTC_SERVICE_FAILED 2 /* specific service failed the connect */
++#define HTC_SERVICE_NO_RESOURCES 3 /* no resources (i.e. no more endpoints) */
++#define HTC_SERVICE_NO_MORE_EP 4 /* specific service is not allowing any more
++ endpoints */
+
-+#define WMI_AKMP_MULTI_PMKID_EN 0x000001
++/* report record IDs */
++typedef enum {
++ HTC_RECORD_NULL = 0,
++ HTC_RECORD_CREDITS = 1,
++ HTC_RECORD_LOOKAHEAD = 2,
++} HTC_RPT_IDS;
+
+typedef PREPACK struct {
-+ A_UINT32 akmpInfo;
-+} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
++ A_UINT8 RecordID; /* Record ID */
++ A_UINT8 Length; /* Length of record */
++} POSTPACK HTC_RECORD_HDR;
+
+typedef PREPACK struct {
-+ A_UINT8 pmkid[WMI_PMKID_LEN];
-+} POSTPACK WMI_PMKID;
-+
-+/*
-+ * WMI_SET_PMKID_LIST_CMD
-+ */
-+#define WMI_MAX_PMKID_CACHE 8
++ A_UINT8 EndpointID; /* Endpoint that owns these credits */
++ A_UINT8 Credits; /* credits to report since last report */
++} POSTPACK HTC_CREDIT_REPORT;
+
+typedef PREPACK struct {
-+ A_UINT32 numPMKID;
-+ WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
-+} POSTPACK WMI_SET_PMKID_LIST_CMD;
++ A_UINT8 PreValid; /* pre valid guard */
++ A_UINT8 LookAhead[4]; /* 4 byte lookahead */
++ A_UINT8 PostValid; /* post valid guard */
+
-+/*
-+ * WMI_GET_PMKID_LIST_CMD Reply
-+ * Following the Number of PMKIDs is the list of PMKIDs
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 numPMKID;
-+ WMI_PMKID pmkidList[1];
-+} POSTPACK WMI_PMKID_LIST_REPLY;
++ /* NOTE: the LookAhead array is guarded by a PreValid and Post Valid guard bytes.
++ * The PreValid bytes must equal the inverse of the PostValid byte */
+
-+/* index used for priority streams */
-+typedef enum {
-+ WMI_NOT_MAPPED = -1,
-+ WMI_CONTROL_PRI = 0,
-+ WMI_BEST_EFFORT_PRI = 1,
-+ WMI_LOW_PRI = 2,
-+ WMI_HIGH_PRI = 3,
-+ WMI_HIGHEST_PRI,
-+ WMI_PRI_MAX_COUNT
-+} WMI_PRI_STREAM_ID;
++} POSTPACK HTC_LOOKAHEAD_REPORT;
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
-+#ifdef __cplusplus
-+}
-+#endif
+
-+#endif /* _WMI_H_ */
-diff --git a/drivers/ar6000/include/wmi_api.h b/drivers/ar6000/include/wmi_api.h
++#endif /* __HTC_H__ */
++
+diff --git a/drivers/ar6000/include/htc_api.h b/drivers/ar6000/include/htc_api.h
new file mode 100644
-index 0000000..267edfd
+index 0000000..e75692d
--- /dev/null
-+++ b/drivers/ar6000/include/wmi_api.h
-@@ -0,0 +1,260 @@
-+#ifndef _WMI_API_H_
-+#define _WMI_API_H_
++++ b/drivers/ar6000/include/htc_api.h
+@@ -0,0 +1,439 @@
+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains the definitions for the Wireless Module Interface (WMI).
+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wmi_api.h#2 $
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ *
+ */
+
++#ifndef _HTC_API_H_
++#define _HTC_API_H_
++
++#include <htc.h>
++#include <htc_services.h>
++#include "htc_packet.h"
++
+#ifdef __cplusplus
+extern "C" {
-+#endif
++#endif /* __cplusplus */
+
-+/*
-+ * IP QoS Field definitions according to 802.1p
-+ */
-+#define BEST_EFFORT_PRI 0
-+#define BACKGROUND_PRI 1
-+#define EXCELLENT_EFFORT_PRI 3
-+#define CONTROLLED_LOAD_PRI 4
-+#define VIDEO_PRI 5
-+#define VOICE_PRI 6
-+#define NETWORK_CONTROL_PRI 7
-+#define MAX_NUM_PRI 8
++/* TODO.. for BMI */
++#define ENDPOINT1 0
++// TODO -remove me, but we have to fix BMI first
++#define HTC_MAILBOX_NUM_MAX 4
+
-+#define UNDEFINED_PRI (0xff)
+
-+/* simple mapping of IP TOS field to a WMI priority stream
-+ * this mapping was taken from the original linux driver implementation
-+ * The operation maps the following
-+ *
-+ * */
-+#define IP_TOS_TO_WMI_PRI(tos) \
-+ ((WMI_PRI_STREAM_ID)(((tos) >> 1) & 0x03))
++/* ------ Endpoint IDS ------ */
++typedef enum
++{
++ ENDPOINT_UNUSED = -1,
++ ENDPOINT_0 = 0,
++ ENDPOINT_1 = 1,
++ ENDPOINT_2 = 2,
++ ENDPOINT_3,
++ ENDPOINT_4,
++ ENDPOINT_5,
++ ENDPOINT_6,
++ ENDPOINT_7,
++ ENDPOINT_8,
++ ENDPOINT_MAX,
++} HTC_ENDPOINT_ID;
+
-+#define WMI_IMPLICIT_PSTREAM_INACTIVITY_INT 5000 /* 5 seconds */
++/* this is the amount of header room required by users of HTC */
++#define HTC_HEADER_LEN HTC_HDR_LENGTH
+
++typedef void *HTC_HANDLE;
+
-+struct wmi_t;
++typedef A_UINT16 HTC_SERVICE_ID;
+
-+void *wmi_init(void *devt);
++typedef struct _HTC_INIT_INFO {
++ void (*AddInstance)(HTC_HANDLE);
++ void (*DeleteInstance)(void *Instance);
++ void (*TargetFailure)(void *Instance, A_STATUS Status);
++} HTC_INIT_INFO;
+
-+void wmi_qos_state_init(struct wmi_t *wmip);
-+void wmi_shutdown(struct wmi_t *wmip);
-+A_UINT16 wmi_get_mapped_qos_queue(struct wmi_t *, A_UINT8);
-+A_STATUS wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType);
-+A_STATUS wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf);
-+A_STATUS wmi_syncpoint(struct wmi_t *wmip);
-+A_STATUS wmi_syncpoint_reset(struct wmi_t *wmip);
-+WMI_PRI_STREAM_ID wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass);
-+A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up);
++/* per service connection send completion */
++typedef void (*HTC_EP_SEND_PKT_COMPLETE)(void *,HTC_PACKET *);
++/* per service connection pkt received */
++typedef void (*HTC_EP_RECV_PKT)(void *,HTC_PACKET *);
+
-+A_STATUS wmi_control_rx(struct wmi_t *wmip, void *osbuf);
-+void wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg);
-+void wmi_free_allnodes(struct wmi_t *wmip);
-+bss_t *wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr);
++/* Optional per service connection receive buffer re-fill callback,
++ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
++ * to the network stack. The driver never gets the packets back from the OS. For these OSes
++ * a refill callback can be used to allocate and re-queue buffers into HTC.
++ *
++ * On other OSes, the network stack can call into the driver's OS-specifc "return_packet" handler and
++ * the driver can re-queue these buffers into HTC. In this regard a refill callback is
++ * unnecessary */
++typedef void (*HTC_EP_RECV_REFILL)(void *, HTC_ENDPOINT_ID Endpoint);
+
++/* Optional per service connection callback when a send queue is full. This can occur if the
++ * host continues queueing up TX packets faster than credits can arrive
++ * To prevent the host (on some Oses like Linux) from continuously queueing packets
++ * and consuming resources, this callback is provided so that that the host
++ * can disable TX in the subsystem (i.e. network stack)
++ * Other OSes require a "per-packet" indication_RAW_STREAM_NUM_MAX for each completed TX packet, this
++ * closed loop mechanism will prevent the network stack from overunning the NIC */
++typedef void (*HTC_EP_SEND_QUEUE_FULL)(void *, HTC_ENDPOINT_ID Endpoint);
++/* Optional per service connection callback when a send queue is available for receive new packet. */
++typedef void (*HTC_EP_SEND_QUEUE_AVAIL)(void *, HTC_ENDPOINT_ID Endpoint);
+
-+typedef enum {
-+ NO_SYNC_WMIFLAG = 0,
-+ SYNC_BEFORE_WMIFLAG, /* transmit all queued data before cmd */
-+ SYNC_AFTER_WMIFLAG, /* any new data waits until cmd execs */
-+ SYNC_BOTH_WMIFLAG,
-+ END_WMIFLAG /* end marker */
-+} WMI_SYNC_FLAG;
++typedef struct _HTC_EP_CALLBACKS {
++ void *pContext; /* context for each callback */
++ HTC_EP_SEND_PKT_COMPLETE EpTxComplete; /* tx completion callback for connected endpoint */
++ HTC_EP_RECV_PKT EpRecv; /* receive callback for connected endpoint */
++ HTC_EP_RECV_REFILL EpRecvRefill; /* OPTIONAL receive re-fill callback for connected endpoint */
++ HTC_EP_SEND_QUEUE_FULL EpSendFull; /* OPTIONAL send full callback */
++ HTC_EP_SEND_QUEUE_AVAIL EpSendAvail; /* OPTIONAL send available callback */
++} HTC_EP_CALLBACKS;
+
-+A_STATUS wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+ WMI_SYNC_FLAG flag);
-+A_STATUS wmi_connect_cmd(struct wmi_t *wmip,
-+ NETWORK_TYPE netType,
-+ DOT11_AUTH_MODE dot11AuthMode,
-+ AUTH_MODE authMode,
-+ CRYPTO_TYPE pairwiseCrypto,
-+ A_UINT8 pairwiseCryptoLen,
-+ CRYPTO_TYPE groupCrypto,
-+ A_UINT8 groupCryptoLen,
-+ int ssidLength,
-+ A_UCHAR *ssid,
-+ A_UINT8 *bssid,
-+ A_UINT16 channel,
-+ A_UINT32 ctrl_flags);
-+A_STATUS wmi_reconnect_cmd(struct wmi_t *wmip,
-+ A_UINT8 *bssid,
-+ A_UINT16 channel);
-+A_STATUS wmi_disconnect_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_getrev_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
-+ A_BOOL forceFgScan, A_BOOL isLegacy,
-+ A_UINT32 homeDwellTime, A_UINT32 forceScanInterval);
-+A_STATUS wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
-+ A_UINT16 fg_end_sec, A_UINT16 bg_sec,
-+ A_UINT16 minact_chdw_msec,
-+ A_UINT16 maxact_chdw_msec, A_UINT16 pas_chdw_msec,
-+ A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
-+ A_UINT32 max_dfsch_act_time);
-+A_STATUS wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask);
-+A_STATUS wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
-+ A_UINT8 ssidLength, A_UCHAR *ssid);
-+A_STATUS wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons);
-+A_STATUS wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmisstime, A_UINT16 bmissbeacons);
-+A_STATUS wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
-+ A_UINT8 ieLen, A_UINT8 *ieInfo);
-+A_STATUS wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode);
-+A_STATUS wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
-+ A_UINT16 atim_windows, A_UINT16 timeout_value);
-+A_STATUS wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
-+ A_UINT16 psPollNum, A_UINT16 dtimPolicy);
-+A_STATUS wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout);
-+A_STATUS wmi_sync_cmd(struct wmi_t *wmip, A_UINT8 syncNumber);
-+A_STATUS wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *pstream);
-+A_STATUS wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 streamID);
-+A_STATUS wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate);
-+A_STATUS wmi_get_bitrate_cmd(struct wmi_t *wmip);
-+A_INT8 wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate);
-+A_STATUS wmi_get_regDomain_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_get_channelList_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
-+ WMI_PHY_MODE mode, A_INT8 numChan,
-+ A_UINT16 *channelList);
++/* service connection information */
++typedef struct _HTC_SERVICE_CONNECT_REQ {
++ HTC_SERVICE_ID ServiceID; /* service ID to connect to */
++ A_UINT16 ConnectionFlags; /* connection flags, see htc protocol definition */
++ A_UINT8 *pMetaData; /* ptr to optional service-specific meta-data */
++ A_UINT8 MetaDataLength; /* optional meta data length */
++ HTC_EP_CALLBACKS EpCallbacks; /* endpoint callbacks */
++ int MaxSendQueueDepth; /* maximum depth of any send queue */
++} HTC_SERVICE_CONNECT_REQ;
+
-+A_STATUS wmi_set_snr_threshold_params(struct wmi_t *wmip,
-+ WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
-+A_STATUS wmi_set_rssi_threshold_params(struct wmi_t *wmip,
-+ WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
-+A_STATUS wmi_clr_rssi_snr(struct wmi_t *wmip);
-+A_STATUS wmi_set_lq_threshold_params(struct wmi_t *wmip,
-+ WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd);
-+A_STATUS wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold);
-+A_STATUS wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status);
++/* service connection response information */
++typedef struct _HTC_SERVICE_CONNECT_RESP {
++ A_UINT8 *pMetaData; /* caller supplied buffer to optional meta-data */
++ A_UINT8 BufferLength; /* length of caller supplied buffer */
++ A_UINT8 ActualLength; /* actual length of meta data */
++ HTC_ENDPOINT_ID Endpoint; /* endpoint to communicate over */
++ int MaxMsgLength; /* max length of all messages over this endpoint */
++ A_UINT8 ConnectRespCode; /* connect response code from target */
++} HTC_SERVICE_CONNECT_RESP;
+
-+A_STATUS wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 bitmask);
++/* endpoint distribution structure */
++typedef struct _HTC_ENDPOINT_CREDIT_DIST {
++ struct _HTC_ENDPOINT_CREDIT_DIST *pNext;
++ struct _HTC_ENDPOINT_CREDIT_DIST *pPrev;
++ HTC_SERVICE_ID ServiceID; /* Service ID (set by HTC) */
++ HTC_ENDPOINT_ID Endpoint; /* endpoint for this distribution struct (set by HTC) */
++ A_UINT32 DistFlags; /* distribution flags, distribution function can
++ set default activity using SET_EP_ACTIVE() macro */
++ int TxCreditsNorm; /* credits for normal operation, anything above this
++ indicates the endpoint is over-subscribed, this field
++ is only relevant to the credit distribution function */
++ int TxCreditsMin; /* floor for credit distribution, this field is
++ only relevant to the credit distribution function */
++ int TxCreditsAssigned; /* number of credits assigned to this EP, this field
++ is only relevant to the credit dist function */
++ int TxCredits; /* current credits available, this field is used by
++ HTC to determine whether a message can be sent or
++ must be queued */
++ int TxCreditsToDist; /* pending credits to distribute on this endpoint, this
++ is set by HTC when credit reports arrive.
++ The credit distribution functions sets this to zero
++ when it distributes the credits */
++ int TxCreditsSeek; /* this is the number of credits that the current pending TX
++ packet needs to transmit. This is set by HTC when
++ and endpoint needs credits in order to transmit */
++ int TxCreditSize; /* size in bytes of each credit (set by HTC) */
++ int TxCreditsPerMaxMsg; /* credits required for a maximum sized messages (set by HTC) */
++ void *pHTCReserved; /* reserved for HTC use */
++} HTC_ENDPOINT_CREDIT_DIST;
+
-+A_STATUS wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie,
-+ A_UINT32 source);
-+A_STATUS wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
-+ A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
-+ A_UINT32 valid);
-+A_STATUS wmi_get_stats_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex,
-+ CRYPTO_TYPE keyType, A_UINT8 keyUsage,
-+ A_UINT8 keyLength,A_UINT8 *keyRSC,
-+ A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
-+ WMI_SYNC_FLAG sync_flag);
-+A_STATUS wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk);
-+A_STATUS wmi_delete_krk_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex);
-+A_STATUS wmi_set_akmp_params_cmd(struct wmi_t *wmip,
-+ WMI_SET_AKMP_PARAMS_CMD *akmpParams);
-+A_STATUS wmi_get_pmkid_list_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
-+ WMI_SET_PMKID_LIST_CMD *pmkInfo);
-+A_STATUS wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM);
-+A_STATUS wmi_get_txPwr_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on);
-+A_STATUS wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid);
-+A_STATUS wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex);
-+A_STATUS wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en);
-+A_STATUS wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
-+ A_BOOL set);
-+A_STATUS wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop,
-+ A_UINT8 eCWmin, A_UINT8 eCWmax,
-+ A_UINT8 aifsn);
-+A_STATUS wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
-+ A_UINT8 trafficClass, A_UINT8 maxRetries,
-+ A_UINT8 enableNotify);
++#define HTC_EP_ACTIVE (1 << 31)
+
-+void wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid);
++/* macro to check if an endpoint has gone active, useful for credit
++ * distributions */
++#define IS_EP_ACTIVE(epDist) ((epDist)->DistFlags & HTC_EP_ACTIVE)
++#define SET_EP_ACTIVE(epDist) (epDist)->DistFlags |= HTC_EP_ACTIVE
+
-+A_STATUS wmi_get_roam_tbl_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType);
-+A_STATUS wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
-+ A_UINT8 size);
-+A_STATUS wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
-+ WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
-+ A_UINT8 size);
++ /* credit distibution code that is passed into the distrbution function,
++ * there are mandatory and optional codes that must be handled */
++typedef enum _HTC_CREDIT_DIST_REASON {
++ HTC_CREDIT_DIST_SEND_COMPLETE = 0, /* credits available as a result of completed
++ send operations (MANDATORY) resulting in credit reports */
++ HTC_CREDIT_DIST_ACTIVITY_CHANGE = 1, /* a change in endpoint activity occured (OPTIONAL) */
++ HTC_CREDIT_DIST_SEEK_CREDITS, /* an endpoint needs to "seek" credits (OPTIONAL) */
++ HTC_DUMP_CREDIT_STATE /* for debugging, dump any state information that is kept by
++ the distribution function */
++} HTC_CREDIT_DIST_REASON;
+
-+A_STATUS wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode);
-+A_STATUS wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
-+ A_UINT8 frmType,
-+ A_UINT8 *dstMacAddr,
-+ A_UINT8 *bssid,
-+ A_UINT16 optIEDataLen,
-+ A_UINT8 *optIEData);
++typedef void (*HTC_CREDIT_DIST_CALLBACK)(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPList,
++ HTC_CREDIT_DIST_REASON Reason);
+
-+A_STATUS wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl);
-+A_STATUS wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize);
-+A_STATUS wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSpLen);
-+A_UINT8 convert_userPriority_to_trafficClass(A_UINT8 userPriority);
-+A_UINT8 wmi_get_power_mode_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance);
++typedef void (*HTC_CREDIT_INIT_CALLBACK)(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPList,
++ int TotalCredits);
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+A_STATUS wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32 len);
-+#endif
++ /* endpoint statistics action */
++typedef enum _HTC_ENDPOINT_STAT_ACTION {
++ HTC_EP_STAT_SAMPLE = 0, /* only read statistics */
++ HTC_EP_STAT_SAMPLE_AND_CLEAR = 1, /* sample and immediately clear statistics */
++ HTC_EP_STAT_CLEAR /* clear only */
++} HTC_ENDPOINT_STAT_ACTION;
+
-+A_STATUS wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status);
-+A_STATUS wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd);
++ /* endpoint statistics */
++typedef struct _HTC_ENDPOINT_STATS {
++ A_UINT32 TxCreditLowIndications; /* number of times the host set the credit-low flag in a send message on
++ this endpoint */
++ A_UINT32 TxIssued; /* running count of TX packets issued */
++ A_UINT32 TxCreditRpts; /* running count of total credit reports received for this endpoint */
++ A_UINT32 TxCreditRptsFromRx;
++ A_UINT32 TxCreditRptsFromOther;
++ A_UINT32 TxCreditRptsFromEp0;
++ A_UINT32 TxCreditsFromRx; /* count of credits received via Rx packets on this endpoint */
++ A_UINT32 TxCreditsFromOther; /* count of credits received via another endpoint */
++ A_UINT32 TxCreditsFromEp0; /* count of credits received via another endpoint */
++ A_UINT32 TxCreditsConsummed; /* count of consummed credits */
++ A_UINT32 TxCreditsReturned; /* count of credits returned */
++ A_UINT32 RxReceived; /* count of RX packets received */
++ A_UINT32 RxLookAheads; /* count of lookahead records
++ found in messages received on this endpoint */
++} HTC_ENDPOINT_STATS;
+
++/* ------ Function Prototypes ------ */
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Initialize HTC
++ @function name: HTCInit
++ @input: pInfo - initialization information
++ @output:
++ @return: A_OK on success
++ @notes: The caller initializes global HTC state and registers various instance
++ notification callbacks (see HTC_INIT_INFO).
+
-+/*
-+ * This function is used to configure the fix rates mask to the target.
-+ */
-+A_STATUS wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask);
-+A_STATUS wmi_get_ratemask_cmd(struct wmi_t *wmip);
++ @example:
++ @see also: HTCShutdown
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCInit(HTC_INIT_INFO *pInfo);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Get the underlying HIF device handle
++ @function name: HTCGetHifDevice
++ @input: HTCHandle - handle passed into the AddInstance callback
++ @output:
++ @return: opaque HIF device handle usable in HIF API calls.
++ @notes:
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void *HTCGetHifDevice(HTC_HANDLE HTCHandle);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Set the associated instance for the HTC handle
++ @function name: HTCSetInstance
++ @input: HTCHandle - handle passed into the AddInstance callback
++ Instance - caller supplied instance object
++ @output:
++ @return:
++ @notes: Caller must set the instance information for the HTC handle in order to receive
++ notifications for instance deletion (DeleteInstance callback is called) and for target
++ failure notification.
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCSetInstance(HTC_HANDLE HTCHandle, void *Instance);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Set credit distribution parameters
++ @function name: HTCSetCreditDistribution
++ @input: HTCHandle - HTC handle
++ pCreditDistCont - caller supplied context to pass into distribution functions
++ CreditDistFunc - Distribution function callback
++ CreditDistInit - Credit Distribution initialization callback
++ ServicePriorityOrder - Array containing list of service IDs, lowest index is highest
++ priority
++ ListLength - number of elements in ServicePriorityOrder
++ @output:
++ @return:
++ @notes: The user can set a custom credit distribution function to handle special requirements
++ for each endpoint. A default credit distribution routine can be used by setting
++ CreditInitFunc to NULL. The default credit distribution is only provided for simple
++ "fair" credit distribution without regard to any prioritization.
+
-+A_STATUS wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCSetCreditDistribution(HTC_HANDLE HTCHandle,
++ void *pCreditDistContext,
++ HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
++ HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
++ HTC_SERVICE_ID ServicePriorityOrder[],
++ int ListLength);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Wait for the target to indicate the HTC layer is ready
++ @function name: HTCWaitTarget
++ @input: HTCHandle - HTC handle
++ @output:
++ @return:
++ @notes: This API blocks until the target responds with an HTC ready message.
++ The caller should not connect services until the target has indicated it is
++ ready.
++ @example:
++ @see also: HTCConnectService
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCWaitTarget(HTC_HANDLE HTCHandle);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Start target service communications
++ @function name: HTCStart
++ @input: HTCHandle - HTC handle
++ @output:
++ @return:
++ @notes: This API indicates to the target that the service connection phase is complete
++ and the target can freely start all connected services. This API should only be
++ called AFTER all service connections have been made. TCStart will issue a
++ SETUP_COMPLETE message to the target to indicate that all service connections
++ have been made and the target can start communicating over the endpoints.
++ @example:
++ @see also: HTCConnectService
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCStart(HTC_HANDLE HTCHandle);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Add receive packet to HTC
++ @function name: HTCAddReceivePkt
++ @input: HTCHandle - HTC handle
++ pPacket - HTC receive packet to add
++ @output:
++ @return: A_OK on success
++ @notes: user must supply HTC packets for capturing incomming HTC frames. The caller
++ must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
++ macro.
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Connect to an HTC service
++ @function name: HTCConnectService
++ @input: HTCHandle - HTC handle
++ pReq - connection details
++ @output: pResp - connection response
++ @return:
++ @notes: Service connections must be performed before HTCStart. User provides callback handlers
++ for various endpoint events.
++ @example:
++ @see also: HTCStart
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCConnectService(HTC_HANDLE HTCHandle,
++ HTC_SERVICE_CONNECT_REQ *pReq,
++ HTC_SERVICE_CONNECT_RESP *pResp);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Send an HTC packet
++ @function name: HTCSendPkt
++ @input: HTCHandle - HTC handle
++ pPacket - packet to send
++ @output:
++ @return: A_OK
++ @notes: Caller must initialize packet using SET_HTC_PACKET_INFO_TX() macro.
++ This interface is fully asynchronous. On error, HTC SendPkt will
++ call the registered Endpoint callback to cleanup the packet.
++ @example:
++ @see also: HTCFlushEndpoint
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_STATUS HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Stop HTC service communications
++ @function name: HTCStop
++ @input: HTCHandle - HTC handle
++ @output:
++ @return:
++ @notes: HTC communications is halted. All receive and pending TX packets will
++ be flushed.
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCStop(HTC_HANDLE HTCHandle);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Shutdown HTC
++ @function name: HTCShutdown
++ @input:
++ @output:
++ @return:
++ @notes: This cleans up all resources allocated by HTCInit().
++ @example:
++ @see also: HTCInit
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCShutDown(void);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Flush pending TX packets
++ @function name: HTCFlushEndpoint
++ @input: HTCHandle - HTC handle
++ Endpoint - Endpoint to flush
++ Tag - flush tag
++ @output:
++ @return:
++ @notes: The Tag parameter is used to selectively flush packets with matching tags.
++ The value of 0 forces all packets to be flush regardless of tag.
++ @example:
++ @see also: HTCSendPkt
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Dump credit distribution state
++ @function name: HTCDumpCreditStates
++ @input: HTCHandle - HTC handle
++ @output:
++ @return:
++ @notes: This dumps all credit distribution information to the debugger
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCDumpCreditStates(HTC_HANDLE HTCHandle);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Indicate a traffic activity change on an endpoint
++ @function name: HTCIndicateActivityChange
++ @input: HTCHandle - HTC handle
++ Endpoint - endpoint in which activity has changed
++ Active - TRUE if active, FALSE if it has become inactive
++ @output:
++ @return:
++ @notes: This triggers the registered credit distribution function to
++ re-adjust credits for active/inactive endpoints.
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++void HTCIndicateActivityChange(HTC_HANDLE HTCHandle,
++ HTC_ENDPOINT_ID Endpoint,
++ A_BOOL Active);
+
-+A_STATUS wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
++/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++ @desc: Get endpoint statistics
++ @function name: HTCGetEndpointStatistics
++ @input: HTCHandle - HTC handle
++ Endpoint - Endpoint identifier
++ Action - action to take with statistics
++ @output:
++ pStats - statistics that were sampled (can be NULL if Action is HTC_EP_STAT_CLEAR)
+
-+A_STATUS wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status);
-+A_STATUS wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG txEnable);
++ @return: TRUE if statistics profiling is enabled, otherwise FALSE.
+
-+A_STATUS wmi_get_keepalive_configured(struct wmi_t *wmip);
-+A_UINT8 wmi_get_keepalive_cmd(struct wmi_t *wmip);
-+A_STATUS wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval);
++ @notes: Statistics is a compile-time option and this function may return FALSE
++ if HTC is not compiled with profiling.
+
-+A_STATUS wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType,
-+ A_UINT8 ieLen,A_UINT8 *ieInfo);
++ The caller can specify the statistic "action" to take when sampling
++ the statistics. This includes:
+
-+A_STATUS wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen);
-+A_INT32 wmi_get_rate(A_INT8 rateindex);
++ HTC_EP_STAT_SAMPLE: The pStats structure is filled with the current values.
++ HTC_EP_STAT_SAMPLE_AND_CLEAR: The structure is filled and the current statistics
++ are cleared.
++ HTC_EP_STAT_CLEA : the statistics are cleared, the called can pass a NULL value for
++ pStats
+
-+/*Wake on Wireless WMI commands*/
-+A_STATUS wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip, WMI_SET_HOST_SLEEP_MODE_CMD *cmd);
-+A_STATUS wmi_set_wow_mode_cmd(struct wmi_t *wmip, WMI_SET_WOW_MODE_CMD *cmd);
-+A_STATUS wmi_get_wow_list_cmd(struct wmi_t *wmip, WMI_GET_WOW_LIST_CMD *cmd);
-+A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
-+ WMI_ADD_WOW_PATTERN_CMD *cmd, A_UINT8* pattern, A_UINT8* mask, A_UINT8 pattern_size);
-+A_STATUS wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
-+ WMI_DEL_WOW_PATTERN_CMD *cmd);
-+A_STATUS wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status);
-+
-+bss_t *
-+wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
-+ A_UINT32 ssidLength, A_BOOL bIsWPA2);
++ @example:
++ @see also:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
++A_BOOL HTCGetEndpointStatistics(HTC_HANDLE HTCHandle,
++ HTC_ENDPOINT_ID Endpoint,
++ HTC_ENDPOINT_STAT_ACTION Action,
++ HTC_ENDPOINT_STATS *pStats);
+
-+void
-+wmi_node_return (struct wmi_t *wmip, bss_t *bss);
+#ifdef __cplusplus
+}
+#endif
+
-+#endif /* _WMI_API_H_ */
-diff --git a/drivers/ar6000/include/wmix.h b/drivers/ar6000/include/wmix.h
++#endif /* _HTC_API_H_ */
+diff --git a/drivers/ar6000/include/htc_packet.h b/drivers/ar6000/include/htc_packet.h
new file mode 100644
-index 0000000..8f12b5e
+index 0000000..9ce8718
--- /dev/null
-+++ b/drivers/ar6000/include/wmix.h
-@@ -0,0 +1,233 @@
++++ b/drivers/ar6000/include/htc_packet.h
+@@ -0,0 +1,138 @@
+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ *
++ * Copyright (c) 2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ *
-+ * $ATH_LICENSE_HOSTSDK0_C$
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
+ *
-+ * This file contains extensions of the WMI protocol specified in the
-+ * Wireless Module Interface (WMI). It includes definitions of all
-+ * extended commands and events. Extensions include useful commands
-+ * that are not directly related to wireless activities. They may
-+ * be hardware-specific, and they might not be supported on all
-+ * implementations.
+ *
-+ * Extended WMIX commands are encapsulated in a WMI message with
-+ * cmd=WMI_EXTENSION_CMD.
+ *
+ */
+
-+#ifndef _WMIX_H_
-+#define _WMIX_H_
++#ifndef HTC_PACKET_H_
++#define HTC_PACKET_H_
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
+
-+#ifndef ATH_TARGET
-+#include "athstartpack.h"
-+#endif
++#include "dl_list.h"
+
-+#include "dbglog.h"
++struct _HTC_PACKET;
+
-+/*
-+ * Extended WMI commands are those that are needed during wireless
-+ * operation, but which are not really wireless commands. This allows,
-+ * for instance, platform-specific commands. Extended WMI commands are
-+ * embedded in a WMI command message with WMI_COMMAND_ID=WMI_EXTENSION_CMDID.
-+ * Extended WMI events are similarly embedded in a WMI event message with
-+ * WMI_EVENT_ID=WMI_EXTENSION_EVENTID.
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 commandId;
-+} POSTPACK WMIX_CMD_HDR;
++typedef void (* HTC_PACKET_COMPLETION)(void *,struct _HTC_PACKET *);
+
-+typedef enum {
-+ WMIX_DSETOPEN_REPLY_CMDID = 0x2001,
-+ WMIX_DSETDATA_REPLY_CMDID,
-+ WMIX_GPIO_OUTPUT_SET_CMDID,
-+ WMIX_GPIO_INPUT_GET_CMDID,
-+ WMIX_GPIO_REGISTER_SET_CMDID,
-+ WMIX_GPIO_REGISTER_GET_CMDID,
-+ WMIX_GPIO_INTR_ACK_CMDID,
-+ WMIX_HB_CHALLENGE_RESP_CMDID,
-+ WMIX_DBGLOG_CFG_MODULE_CMDID,
-+} WMIX_COMMAND_ID;
++typedef A_UINT16 HTC_TX_TAG;
+
-+typedef enum {
-+ WMIX_DSETOPENREQ_EVENTID = 0x3001,
-+ WMIX_DSETCLOSE_EVENTID,
-+ WMIX_DSETDATAREQ_EVENTID,
-+ WMIX_GPIO_INTR_EVENTID,
-+ WMIX_GPIO_DATA_EVENTID,
-+ WMIX_GPIO_ACK_EVENTID,
-+ WMIX_HB_CHALLENGE_RESP_EVENTID,
-+ WMIX_DBGLOG_EVENTID,
-+} WMIX_EVENT_ID;
++typedef struct _HTC_TX_PACKET_INFO {
++ HTC_TX_TAG Tag; /* tag used to selective flush packets */
++} HTC_TX_PACKET_INFO;
+
-+/*
-+ * =============DataSet support=================
-+ */
++#define HTC_TX_PACKET_TAG_ALL 0 /* a tag of zero is reserved and used to flush ALL packets */
++#define HTC_TX_PACKET_TAG_INTERNAL 1 /* internal tags start here */
++#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
+
-+/*
-+ * WMIX_DSETOPENREQ_EVENTID
-+ * DataSet Open Request Event
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 dset_id;
-+ A_UINT32 targ_dset_handle; /* echo'ed, not used by Host, */
-+ A_UINT32 targ_reply_fn; /* echo'ed, not used by Host, */
-+ A_UINT32 targ_reply_arg; /* echo'ed, not used by Host, */
-+} POSTPACK WMIX_DSETOPENREQ_EVENT;
++typedef struct _HTC_RX_PACKET_INFO {
++ A_UINT32 Unused; /* for future use and to make compilers happy */
++} HTC_RX_PACKET_INFO;
+
-+/*
-+ * WMIX_DSETCLOSE_EVENTID
-+ * DataSet Close Event
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 access_cookie;
-+} POSTPACK WMIX_DSETCLOSE_EVENT;
++/* wrapper around endpoint-specific packets */
++typedef struct _HTC_PACKET {
++ DL_LIST ListLink; /* double link */
++ void *pPktContext; /* caller's per packet specific context */
+
-+/*
-+ * WMIX_DSETDATAREQ_EVENTID
-+ * DataSet Data Request Event
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 access_cookie;
-+ A_UINT32 offset;
-+ A_UINT32 length;
-+ A_UINT32 targ_buf; /* echo'ed, not used by Host, */
-+ A_UINT32 targ_reply_fn; /* echo'ed, not used by Host, */
-+ A_UINT32 targ_reply_arg; /* echo'ed, not used by Host, */
-+} POSTPACK WMIX_DSETDATAREQ_EVENT;
++ A_UINT8 *pBufferStart; /* the true buffer start , the caller can
++ store the real buffer start here. In
++ receive callbacks, the HTC layer sets pBuffer
++ to the start of the payload past the header. This
++ field allows the caller to reset pBuffer when it
++ recycles receive packets back to HTC */
++ /*
++ * Pointer to the start of the buffer. In the transmit
++ * direction this points to the start of the payload. In the
++ * receive direction, however, the buffer when queued up
++ * points to the start of the HTC header but when returned
++ * to the caller points to the start of the payload
++ */
++ A_UINT8 *pBuffer; /* payload start (RX/TX) */
++ A_UINT32 BufferLength; /* length of buffer */
++ A_UINT32 ActualLength; /* actual length of payload */
++ int Endpoint; /* endpoint that this packet was sent/recv'd from */
++ A_STATUS Status; /* completion status */
++ union {
++ HTC_TX_PACKET_INFO AsTx; /* Tx Packet specific info */
++ HTC_RX_PACKET_INFO AsRx; /* Rx Packet specific info */
++ } PktInfo;
+
-+typedef PREPACK struct {
-+ A_UINT32 status;
-+ A_UINT32 targ_dset_handle;
-+ A_UINT32 targ_reply_fn;
-+ A_UINT32 targ_reply_arg;
-+ A_UINT32 access_cookie;
-+ A_UINT32 size;
-+ A_UINT32 version;
-+} POSTPACK WMIX_DSETOPEN_REPLY_CMD;
++ /* the following fields are for internal HTC use */
++ HTC_PACKET_COMPLETION Completion; /* completion */
++ void *pContext; /* HTC private completion context */
++ A_UINT32 HTCReserved; /* reserved */
++} HTC_PACKET;
+
-+typedef PREPACK struct {
-+ A_UINT32 status;
-+ A_UINT32 targ_buf;
-+ A_UINT32 targ_reply_fn;
-+ A_UINT32 targ_reply_arg;
-+ A_UINT32 length;
-+ A_UINT8 buf[1];
-+} POSTPACK WMIX_DSETDATA_REPLY_CMD;
+
+
-+/*
-+ * =============GPIO support=================
-+ * All masks are 18-bit masks with bit N operating on GPIO pin N.
-+ */
++#define COMPLETE_HTC_PACKET(p,status) \
++{ \
++ (p)->Status = (status); \
++ (p)->Completion((p)->pContext,(p)); \
++}
+
-+#include "gpio.h"
++#define INIT_HTC_PACKET_INFO(p,b,len) \
++{ \
++ (p)->pBufferStart = (b); \
++ (p)->BufferLength = (len); \
++}
+
-+/*
-+ * Set GPIO pin output state.
-+ * In order for output to be driven, a pin must be enabled for output.
-+ * This can be done during initialization through the GPIO Configuration
-+ * DataSet, or during operation with the enable_mask.
-+ *
-+ * If a request is made to simultaneously set/clear or set/disable or
-+ * clear/disable or disable/enable, results are undefined.
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 set_mask; /* pins to set */
-+ A_UINT32 clear_mask; /* pins to clear */
-+ A_UINT32 enable_mask; /* pins to enable for output */
-+ A_UINT32 disable_mask; /* pins to disable/tristate */
-+} POSTPACK WMIX_GPIO_OUTPUT_SET_CMD;
++/* macro to set an initial RX packet for refilling HTC */
++#define SET_HTC_PACKET_INFO_RX_REFILL(p,c,b,len,ep) \
++{ \
++ (p)->pPktContext = (c); \
++ (p)->pBuffer = (b); \
++ (p)->pBufferStart = (b); \
++ (p)->BufferLength = (len); \
++ (p)->Endpoint = (ep); \
++}
+
-+/*
-+ * Set a GPIO register. For debug/exceptional cases.
-+ * Values for gpioreg_id are GPIO_REGISTER_IDs, defined in a
-+ * platform-dependent header.
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 gpioreg_id; /* GPIO register ID */
-+ A_UINT32 value; /* value to write */
-+} POSTPACK WMIX_GPIO_REGISTER_SET_CMD;
++/* fast macro to recycle an RX packet that will be re-queued to HTC */
++#define HTC_PACKET_RESET_RX(p) \
++ (p)->pBuffer = (p)->pBufferStart
+
-+/* Get a GPIO register. For debug/exceptional cases. */
-+typedef PREPACK struct {
-+ A_UINT32 gpioreg_id; /* GPIO register to read */
-+} POSTPACK WMIX_GPIO_REGISTER_GET_CMD;
++/* macro to set packet parameters for TX */
++#define SET_HTC_PACKET_INFO_TX(p,c,b,len,ep,tag) \
++{ \
++ (p)->pPktContext = (c); \
++ (p)->pBuffer = (b); \
++ (p)->ActualLength = (len); \
++ (p)->Endpoint = (ep); \
++ (p)->PktInfo.AsTx.Tag = (tag); \
++}
+
-+/*
-+ * Host acknowledges and re-arms GPIO interrupts. A single
-+ * message should be used to acknowledge all interrupts that
-+ * were delivered in an earlier WMIX_GPIO_INTR_EVENT message.
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 ack_mask; /* interrupts to acknowledge */
-+} POSTPACK WMIX_GPIO_INTR_ACK_CMD;
++/* HTC Packet Queueing Macros */
++typedef DL_LIST HTC_PACKET_QUEUE;
++/* initialize queue */
++#define INIT_HTC_PACKET_QUEUE(pQ) DL_LIST_INIT((pQ))
++/* enqueue HTC packet to the tail of the queue */
++#define HTC_PACKET_ENQUEUE(pQ,p) DL_ListInsertTail((pQ),&(p)->ListLink)
++/* test if a queue is empty */
++#define HTC_QUEUE_EMPTY(pQ) DL_LIST_IS_EMPTY((pQ))
++/* get packet at head without removing it */
++#define HTC_GET_PKT_AT_HEAD(pQ) A_CONTAINING_STRUCT((DL_LIST_GET_ITEM_AT_HEAD(pQ)),HTC_PACKET,ListLink);
++/* remove a packet from the current list it is linked to */
++#define HTC_PACKET_REMOVE(p) DL_ListRemove(&(p)->ListLink)
+
-+/*
-+ * Target informs Host of GPIO interrupts that have ocurred since the
-+ * last WMIX_GIPO_INTR_ACK_CMD was received. Additional information --
-+ * the current GPIO input values is provided -- in order to support
-+ * use of a GPIO interrupt as a Data Valid signal for other GPIO pins.
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 intr_mask; /* pending GPIO interrupts */
-+ A_UINT32 input_values; /* recent GPIO input values */
-+} POSTPACK WMIX_GPIO_INTR_EVENT;
++/* dequeue an HTC packet from the head of the queue */
++static INLINE HTC_PACKET *HTC_PACKET_DEQUEUE(HTC_PACKET_QUEUE *queue) {
++ DL_LIST *pItem = DL_ListRemoveItemFromHead(queue);
++ if (pItem != NULL) {
++ return A_CONTAINING_STRUCT(pItem, HTC_PACKET, ListLink);
++ }
++ return NULL;
++}
+
++#endif /*HTC_PACKET_H_*/
+diff --git a/drivers/ar6000/include/htc_services.h b/drivers/ar6000/include/htc_services.h
+new file mode 100644
+index 0000000..fc6fc29
+--- /dev/null
++++ b/drivers/ar6000/include/htc_services.h
+@@ -0,0 +1,37 @@
+/*
-+ * Target responds to Host's earlier WMIX_GPIO_INPUT_GET_CMDID request
-+ * using a GPIO_DATA_EVENT with
-+ * value set to the mask of GPIO pin inputs and
-+ * reg_id set to GPIO_ID_NONE
++ * Copyright (c) 2007 Atheros Communications Inc.
++ * All rights reserved.
+ *
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
-+ * Target responds to Hosts's earlier WMIX_GPIO_REGISTER_GET_CMDID request
-+ * using a GPIO_DATA_EVENT with
-+ * value set to the value of the requested register and
-+ * reg_id identifying the register (reflects the original request)
-+ * NB: reg_id supports the future possibility of unsolicited
-+ * WMIX_GPIO_DATA_EVENTs (for polling GPIO input), and it may
-+ * simplify Host GPIO support.
+ */
-+typedef PREPACK struct {
-+ A_UINT32 value;
-+ A_UINT32 reg_id;
-+} POSTPACK WMIX_GPIO_DATA_EVENT;
+
-+/*
-+ * =============Error Detection support=================
-+ */
++#ifndef __HTC_SERVICES_H__
++#define __HTC_SERVICES_H__
+
-+/*
-+ * WMIX_HB_CHALLENGE_RESP_CMDID
-+ * Heartbeat Challenge Response command
-+ */
-+typedef PREPACK struct {
-+ A_UINT32 cookie;
-+ A_UINT32 source;
-+} POSTPACK WMIX_HB_CHALLENGE_RESP_CMD;
++/* Current service IDs */
+
-+/*
-+ * WMIX_HB_CHALLENGE_RESP_EVENTID
-+ * Heartbeat Challenge Response Event
-+ */
-+#define WMIX_HB_CHALLENGE_RESP_EVENT WMIX_HB_CHALLENGE_RESP_CMD
++typedef enum {
++ RSVD_SERVICE_GROUP = 0,
++ WMI_SERVICE_GROUP = 1,
+
-+typedef PREPACK struct {
-+ struct dbglog_config_s config;
-+} POSTPACK WMIX_DBGLOG_CFG_MODULE_CMD;
++ HTC_TEST_GROUP = 254,
++ HTC_SERVICE_GROUP_LAST = 255
++}HTC_SERVICE_GROUP_IDS;
+
-+#ifndef ATH_TARGET
-+#include "athendpack.h"
-+#endif
++#define MAKE_SERVICE_ID(group,index) \
++ (int)(((int)group << 8) | (int)(index))
+
-+#ifdef __cplusplus
-+}
-+#endif
++/* NOTE: service ID of 0x0000 is reserved and should never be used */
++#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP,1)
++#define WMI_CONTROL_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,0)
++#define WMI_DATA_BE_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,1)
++#define WMI_DATA_BK_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,2)
++#define WMI_DATA_VI_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,3)
++#define WMI_DATA_VO_SVC MAKE_SERVICE_ID(WMI_SERVICE_GROUP,4)
++#define WMI_MAX_SERVICES 5
+
-+#endif /* _WMIX_H_ */
-diff --git a/drivers/ar6000/miscdrv/common_drv.c b/drivers/ar6000/miscdrv/common_drv.c
++/* raw stream service (i.e. flash, tcmd, calibration apps) */
++#define HTC_RAW_STREAMS_SVC MAKE_SERVICE_ID(HTC_TEST_GROUP,0)
++
++#endif /*HTC_SERVICES_H_*/
+diff --git a/drivers/ar6000/include/ieee80211.h b/drivers/ar6000/include/ieee80211.h
new file mode 100644
-index 0000000..4f12734
+index 0000000..7090040
--- /dev/null
-+++ b/drivers/ar6000/miscdrv/common_drv.c
-@@ -0,0 +1,467 @@
-+
-+/*
++++ b/drivers/ar6000/include/ieee80211.h
+@@ -0,0 +1,342 @@
++/*-
++ * Copyright (c) 2001 Atsushi Onoe
++ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
++ * Copyright (c) 2006 Atheros Communications, Inc.
+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * Wireless Network driver for Atheros AR6001
+ * All rights reserved.
+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
++#ifndef _NET80211_IEEE80211_H_
++#define _NET80211_IEEE80211_H_
+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "AR6Khwreg.h"
-+#include "targaddrs.h"
-+#include "a_osapi.h"
-+#include "hif.h"
-+#include "htc_api.h"
-+#include "bmi.h"
-+#include "bmi_msg.h"
-+#include "common_drv.h"
-+#include "a_debug.h"
-+#include "targaddrs.h"
-+
-+#define HOST_INTEREST_ITEM_ADDRESS(target, item) \
-+(((TargetType) == TARGET_TYPE_AR6001) ? \
-+ AR6001_HOST_INTEREST_ITEM_ADDRESS(item) : \
-+ AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
++#include "athstartpack.h"
+
++/*
++ * 802.11 protocol definitions.
++ */
+
-+/* Compile the 4BYTE version of the window register setup routine,
-+ * This mitigates host interconnect issues with non-4byte aligned bus requests, some
-+ * interconnects use bus adapters that impose strict limitations.
-+ * Since diag window access is not intended for performance critical operations, the 4byte mode should
-+ * be satisfactory even though it generates 4X the bus activity. */
++#define IEEE80211_ADDR_LEN 6 /* size of 802.11 address */
++/* is 802.11 address multicast/broadcast? */
++#define IEEE80211_IS_MULTICAST(_a) (*(_a) & 0x01)
++#define IEEE80211_ADDR_EQ(addr1, addr2) \
++ (A_MEMCMP(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
+
-+#ifdef USE_4BYTE_REGISTER_ACCESS
++#define IEEE80211_KEYBUF_SIZE 16
++#define IEEE80211_MICBUF_SIZE (8+8) /* space for both tx and rx */
+
-+ /* set the window address register (using 4-byte register access ). */
-+A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
-+{
-+ A_STATUS status;
-+ A_UINT8 addrValue[4];
-+ int i;
++/*
++ * NB: these values are ordered carefully; there are lots of
++ * of implications in any reordering. In particular beware
++ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
++ */
++#define IEEE80211_CIPHER_WEP 0
++#define IEEE80211_CIPHER_TKIP 1
++#define IEEE80211_CIPHER_AES_OCB 2
++#define IEEE80211_CIPHER_AES_CCM 3
++#define IEEE80211_CIPHER_CKIP 5
++#define IEEE80211_CIPHER_CCKM_KRK 6
++#define IEEE80211_CIPHER_NONE 7 /* pseudo value */
+
-+ /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
-+ * last to initiate the access cycle */
++#define IEEE80211_CIPHER_MAX (IEEE80211_CIPHER_NONE+1)
+
-+ for (i = 1; i <= 3; i++) {
-+ /* fill the buffer with the address byte value we want to hit 4 times*/
-+ addrValue[0] = ((A_UINT8 *)&Address)[i];
-+ addrValue[1] = addrValue[0];
-+ addrValue[2] = addrValue[0];
-+ addrValue[3] = addrValue[0];
++#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
++ (((len) == 5) || ((len) == 13) || ((len) == 16))
+
-+ /* hit each byte of the register address with a 4-byte write operation to the same address,
-+ * this is a harmless operation */
-+ status = HIFReadWrite(hifDevice,
-+ RegisterAddr+i,
-+ addrValue,
-+ 4,
-+ HIF_WR_SYNC_BYTE_FIX,
-+ NULL);
-+ if (status != A_OK) {
-+ break;
-+ }
-+ }
+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
-+ RegisterAddr, Address));
-+ return status;
-+ }
+
-+ /* write the address register again, this time write the whole 4-byte value.
-+ * The effect here is that the LSB write causes the cycle to start, the extra
-+ * 3 byte write to bytes 1,2,3 has no effect since we are writing the same values again */
-+ status = HIFReadWrite(hifDevice,
-+ RegisterAddr,
-+ (A_UCHAR *)(&Address),
-+ 4,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
++/*
++ * generic definitions for IEEE 802.11 frames
++ */
++PREPACK struct ieee80211_frame {
++ A_UINT8 i_fc[2];
++ A_UINT8 i_dur[2];
++ A_UINT8 i_addr1[IEEE80211_ADDR_LEN];
++ A_UINT8 i_addr2[IEEE80211_ADDR_LEN];
++ A_UINT8 i_addr3[IEEE80211_ADDR_LEN];
++ A_UINT8 i_seq[2];
++ /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
++ /* see below */
++} POSTPACK;
+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
-+ RegisterAddr, Address));
-+ return status;
-+ }
-+
-+ return A_OK;
-+
-+
-+
-+}
++#define IEEE80211_FC0_VERSION_MASK 0x03
++#define IEEE80211_FC0_VERSION_SHIFT 0
++#define IEEE80211_FC0_VERSION_0 0x00
++#define IEEE80211_FC0_TYPE_MASK 0x0c
++#define IEEE80211_FC0_TYPE_SHIFT 2
++#define IEEE80211_FC0_TYPE_MGT 0x00
++#define IEEE80211_FC0_TYPE_CTL 0x04
++#define IEEE80211_FC0_TYPE_DATA 0x08
+
++#define IEEE80211_FC0_SUBTYPE_MASK 0xf0
++#define IEEE80211_FC0_SUBTYPE_SHIFT 4
++/* for TYPE_MGT */
++#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ 0x00
++#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP 0x10
++#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ 0x20
++#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP 0x30
++#define IEEE80211_FC0_SUBTYPE_PROBE_REQ 0x40
++#define IEEE80211_FC0_SUBTYPE_PROBE_RESP 0x50
++#define IEEE80211_FC0_SUBTYPE_BEACON 0x80
++#define IEEE80211_FC0_SUBTYPE_ATIM 0x90
++#define IEEE80211_FC0_SUBTYPE_DISASSOC 0xa0
++#define IEEE80211_FC0_SUBTYPE_AUTH 0xb0
++#define IEEE80211_FC0_SUBTYPE_DEAUTH 0xc0
++/* for TYPE_CTL */
++#define IEEE80211_FC0_SUBTYPE_PS_POLL 0xa0
++#define IEEE80211_FC0_SUBTYPE_RTS 0xb0
++#define IEEE80211_FC0_SUBTYPE_CTS 0xc0
++#define IEEE80211_FC0_SUBTYPE_ACK 0xd0
++#define IEEE80211_FC0_SUBTYPE_CF_END 0xe0
++#define IEEE80211_FC0_SUBTYPE_CF_END_ACK 0xf0
++/* for TYPE_DATA (bit combination) */
++#define IEEE80211_FC0_SUBTYPE_DATA 0x00
++#define IEEE80211_FC0_SUBTYPE_CF_ACK 0x10
++#define IEEE80211_FC0_SUBTYPE_CF_POLL 0x20
++#define IEEE80211_FC0_SUBTYPE_CF_ACPL 0x30
++#define IEEE80211_FC0_SUBTYPE_NODATA 0x40
++#define IEEE80211_FC0_SUBTYPE_CFACK 0x50
++#define IEEE80211_FC0_SUBTYPE_CFPOLL 0x60
++#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
++#define IEEE80211_FC0_SUBTYPE_QOS 0x80
++#define IEEE80211_FC0_SUBTYPE_QOS_NULL 0xc0
+
-+#else
++#define IEEE80211_FC1_DIR_MASK 0x03
++#define IEEE80211_FC1_DIR_NODS 0x00 /* STA->STA */
++#define IEEE80211_FC1_DIR_TODS 0x01 /* STA->AP */
++#define IEEE80211_FC1_DIR_FROMDS 0x02 /* AP ->STA */
++#define IEEE80211_FC1_DIR_DSTODS 0x03 /* AP ->AP */
+
-+ /* set the window address register */
-+A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
-+{
-+ A_STATUS status;
++#define IEEE80211_FC1_MORE_FRAG 0x04
++#define IEEE80211_FC1_RETRY 0x08
++#define IEEE80211_FC1_PWR_MGT 0x10
++#define IEEE80211_FC1_MORE_DATA 0x20
++#define IEEE80211_FC1_WEP 0x40
++#define IEEE80211_FC1_ORDER 0x80
+
-+ /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
-+ * last to initiate the access cycle */
-+ status = HIFReadWrite(hifDevice,
-+ RegisterAddr+1, /* write upper 3 bytes */
-+ ((A_UCHAR *)(&Address))+1,
-+ sizeof(A_UINT32)-1,
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
++#define IEEE80211_SEQ_FRAG_MASK 0x000f
++#define IEEE80211_SEQ_FRAG_SHIFT 0
++#define IEEE80211_SEQ_SEQ_MASK 0xfff0
++#define IEEE80211_SEQ_SEQ_SHIFT 4
+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
-+ RegisterAddr, Address));
-+ return status;
-+ }
++#define IEEE80211_NWID_LEN 32
+
-+ /* write the LSB of the register, this initiates the operation */
-+ status = HIFReadWrite(hifDevice,
-+ RegisterAddr,
-+ (A_UCHAR *)(&Address),
-+ sizeof(A_UINT8),
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
++/*
++ * 802.11 rate set.
++ */
++#define IEEE80211_RATE_SIZE 8 /* 802.11 standard */
++#define IEEE80211_RATE_MAXSIZE 15 /* max rates we'll handle */
+
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
-+ RegisterAddr, Address));
-+ return status;
-+ }
++#define WMM_NUM_AC 4 /* 4 AC categories */
+
-+ return A_OK;
-+}
++#define WMM_PARAM_ACI_M 0x60 /* Mask for ACI field */
++#define WMM_PARAM_ACI_S 5 /* Shift for ACI field */
++#define WMM_PARAM_ACM_M 0x10 /* Mask for ACM bit */
++#define WMM_PARAM_ACM_S 4 /* Shift for ACM bit */
++#define WMM_PARAM_AIFSN_M 0x0f /* Mask for aifsn field */
++#define WMM_PARAM_LOGCWMIN_M 0x0f /* Mask for CwMin field (in log) */
++#define WMM_PARAM_LOGCWMAX_M 0xf0 /* Mask for CwMax field (in log) */
++#define WMM_PARAM_LOGCWMAX_S 4 /* Shift for CwMax field */
+
-+#endif
++#define WMM_AC_TO_TID(_ac) ( \
++ ((_ac) == WMM_AC_VO) ? 6 : \
++ ((_ac) == WMM_AC_VI) ? 5 : \
++ ((_ac) == WMM_AC_BK) ? 1 : \
++ 0)
+
++#define TID_TO_WMM_AC(_tid) ( \
++ ((_tid) < 1) ? WMM_AC_BE : \
++ ((_tid) < 3) ? WMM_AC_BK : \
++ ((_tid) < 6) ? WMM_AC_VI : \
++ WMM_AC_VO)
+/*
-+ * Read from the AR6000 through its diagnostic window.
-+ * No cooperation from the Target is required for this.
++ * Management information element payloads.
+ */
-+A_STATUS
-+ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
-+{
-+ A_STATUS status;
+
-+ /* set window register to start read cycle */
-+ status = ar6000_SetAddressWindowRegister(hifDevice,
-+ WINDOW_READ_ADDR_ADDRESS,
-+ *address);
++enum {
++ IEEE80211_ELEMID_SSID = 0,
++ IEEE80211_ELEMID_RATES = 1,
++ IEEE80211_ELEMID_FHPARMS = 2,
++ IEEE80211_ELEMID_DSPARMS = 3,
++ IEEE80211_ELEMID_CFPARMS = 4,
++ IEEE80211_ELEMID_TIM = 5,
++ IEEE80211_ELEMID_IBSSPARMS = 6,
++ IEEE80211_ELEMID_COUNTRY = 7,
++ IEEE80211_ELEMID_CHALLENGE = 16,
++ /* 17-31 reserved for challenge text extension */
++ IEEE80211_ELEMID_PWRCNSTR = 32,
++ IEEE80211_ELEMID_PWRCAP = 33,
++ IEEE80211_ELEMID_TPCREQ = 34,
++ IEEE80211_ELEMID_TPCREP = 35,
++ IEEE80211_ELEMID_SUPPCHAN = 36,
++ IEEE80211_ELEMID_CHANSWITCH = 37,
++ IEEE80211_ELEMID_MEASREQ = 38,
++ IEEE80211_ELEMID_MEASREP = 39,
++ IEEE80211_ELEMID_QUIET = 40,
++ IEEE80211_ELEMID_IBSSDFS = 41,
++ IEEE80211_ELEMID_ERP = 42,
++ IEEE80211_ELEMID_RSN = 48,
++ IEEE80211_ELEMID_XRATES = 50,
++ IEEE80211_ELEMID_TPC = 150,
++ IEEE80211_ELEMID_CCKM = 156,
++ IEEE80211_ELEMID_VENDOR = 221, /* vendor private */
++};
+
-+ if (status != A_OK) {
-+ return status;
-+ }
++#define ATH_OUI 0x7f0300 /* Atheros OUI */
++#define ATH_OUI_TYPE 0x01
++#define ATH_OUI_SUBTYPE 0x01
++#define ATH_OUI_VERSION 0x00
+
-+ /* read the data */
-+ status = HIFReadWrite(hifDevice,
-+ WINDOW_DATA_ADDRESS,
-+ (A_UCHAR *)data,
-+ sizeof(A_UINT32),
-+ HIF_RD_SYNC_BYTE_INC,
-+ NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot read from WINDOW_DATA_ADDRESS\n"));
-+ return status;
-+ }
++#define WPA_OUI 0xf25000
++#define WPA_OUI_TYPE 0x01
++#define WPA_VERSION 1 /* current supported version */
+
-+ return status;
-+}
++#define WPA_CSE_NULL 0x00
++#define WPA_CSE_WEP40 0x01
++#define WPA_CSE_TKIP 0x02
++#define WPA_CSE_CCMP 0x04
++#define WPA_CSE_WEP104 0x05
+
++#define WPA_ASE_NONE 0x00
++#define WPA_ASE_8021X_UNSPEC 0x01
++#define WPA_ASE_8021X_PSK 0x02
+
-+/*
-+ * Write to the AR6000 through its diagnostic window.
-+ * No cooperation from the Target is required for this.
-+ */
-+A_STATUS
-+ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
-+{
-+ A_STATUS status;
++#define RSN_OUI 0xac0f00
++#define RSN_VERSION 1 /* current supported version */
+
-+ /* set write data */
-+ status = HIFReadWrite(hifDevice,
-+ WINDOW_DATA_ADDRESS,
-+ (A_UCHAR *)data,
-+ sizeof(A_UINT32),
-+ HIF_WR_SYNC_BYTE_INC,
-+ NULL);
-+ if (status != A_OK) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to WINDOW_DATA_ADDRESS\n", *data));
-+ return status;
-+ }
++#define RSN_CSE_NULL 0x00
++#define RSN_CSE_WEP40 0x01
++#define RSN_CSE_TKIP 0x02
++#define RSN_CSE_WRAP 0x03
++#define RSN_CSE_CCMP 0x04
++#define RSN_CSE_WEP104 0x05
+
-+ /* set window register, which starts the write cycle */
-+ return ar6000_SetAddressWindowRegister(hifDevice,
-+ WINDOW_WRITE_ADDR_ADDRESS,
-+ *address);
-+}
++#define RSN_ASE_NONE 0x00
++#define RSN_ASE_8021X_UNSPEC 0x01
++#define RSN_ASE_8021X_PSK 0x02
+
-+A_STATUS
-+ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+ A_UCHAR *data, A_UINT32 length)
-+{
-+ A_UINT32 count;
-+ A_STATUS status = A_OK;
++#define RSN_CAP_PREAUTH 0x01
+
-+ for (count = 0; count < length; count += 4, address += 4) {
-+ if ((status = ar6000_ReadRegDiag(hifDevice, &address,
-+ (A_UINT32 *)&data[count])) != A_OK)
-+ {
-+ break;
-+ }
-+ }
++#define WMM_OUI 0xf25000
++#define WMM_OUI_TYPE 0x02
++#define WMM_INFO_OUI_SUBTYPE 0x00
++#define WMM_PARAM_OUI_SUBTYPE 0x01
++#define WMM_VERSION 1
+
-+ return status;
-+}
++/* WMM stream classes */
++#define WMM_NUM_AC 4
++#define WMM_AC_BE 0 /* best effort */
++#define WMM_AC_BK 1 /* background */
++#define WMM_AC_VI 2 /* video */
++#define WMM_AC_VO 3 /* voice */
+
-+A_STATUS
-+ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
-+ A_UCHAR *data, A_UINT32 length)
-+{
-+ A_UINT32 count;
-+ A_STATUS status = A_OK;
++/* TSPEC related */
++#define ACTION_CATEGORY_CODE_TSPEC 17
++#define ACTION_CODE_TSPEC_ADDTS 0
++#define ACTION_CODE_TSPEC_ADDTS_RESP 1
++#define ACTION_CODE_TSPEC_DELTS 2
+
-+ for (count = 0; count < length; count += 4, address += 4) {
-+ if ((status = ar6000_WriteRegDiag(hifDevice, &address,
-+ (A_UINT32 *)&data[count])) != A_OK)
-+ {
-+ break;
-+ }
-+ }
++typedef enum {
++ TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
++ TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
++ TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
++ TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
++ TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
++ TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
++ TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
++ TSPEC_STATUS_CODE_DELTS_SENT = 0x30,
++ TSPEC_STATUS_CODE_DELTS_RECV = 0x31,
++} TSPEC_STATUS_CODE;
+
-+ return status;
-+}
++/*
++ * WMM/802.11e Tspec Element
++ */
++typedef PREPACK struct wmm_tspec_ie_t {
++ A_UINT8 elementId;
++ A_UINT8 len;
++ A_UINT8 oui[3];
++ A_UINT8 ouiType;
++ A_UINT8 ouiSubType;
++ A_UINT8 version;
++ A_UINT16 tsInfo_info;
++ A_UINT8 tsInfo_reserved;
++ A_UINT16 nominalMSDU;
++ A_UINT16 maxMSDU;
++ A_UINT32 minServiceInt;
++ A_UINT32 maxServiceInt;
++ A_UINT32 inactivityInt;
++ A_UINT32 suspensionInt;
++ A_UINT32 serviceStartTime;
++ A_UINT32 minDataRate;
++ A_UINT32 meanDataRate;
++ A_UINT32 peakDataRate;
++ A_UINT32 maxBurstSize;
++ A_UINT32 delayBound;
++ A_UINT32 minPhyRate;
++ A_UINT16 sba;
++ A_UINT16 mediumTime;
++} POSTPACK WMM_TSPEC_IE;
+
-+A_STATUS
-+ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice)
-+{
-+ int i;
-+ struct forceROM_s {
-+ A_UINT32 addr;
-+ A_UINT32 data;
-+ };
-+ struct forceROM_s *ForceROM;
-+ int szForceROM;
-+ A_UINT32 instruction;
+
-+ static struct forceROM_s ForceROM_REV2[] = {
-+ /* NB: This works for old REV2 ROM (old). */
-+ {0x00001ff0, 0x175b0027}, /* jump instruction at 0xa0001ff0 */
-+ {0x00001ff4, 0x00000000}, /* nop instruction at 0xa0001ff4 */
++/*
++ * BEACON management packets
++ *
++ * octet timestamp[8]
++ * octet beacon interval[2]
++ * octet capability information[2]
++ * information element
++ * octet elemid
++ * octet length
++ * octet information[length]
++ */
+
-+ {MC_REMAP_TARGET_ADDRESS, 0x00001ff0}, /* remap to 0xa0001ff0 */
-+ {MC_REMAP_COMPARE_ADDRESS, 0x01000040},/* ...from 0xbfc00040 */
-+ {MC_REMAP_SIZE_ADDRESS, 0x00000000}, /* ...1 cache line */
-+ {MC_REMAP_VALID_ADDRESS, 0x00000001}, /* ...remap is valid */
++#define IEEE80211_BEACON_INTERVAL(beacon) \
++ ((beacon)[8] | ((beacon)[9] << 8))
++#define IEEE80211_BEACON_CAPABILITY(beacon) \
++ ((beacon)[10] | ((beacon)[11] << 8))
+
-+ {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
++#define IEEE80211_CAPINFO_ESS 0x0001
++#define IEEE80211_CAPINFO_IBSS 0x0002
++#define IEEE80211_CAPINFO_CF_POLLABLE 0x0004
++#define IEEE80211_CAPINFO_CF_POLLREQ 0x0008
++#define IEEE80211_CAPINFO_PRIVACY 0x0010
++#define IEEE80211_CAPINFO_SHORT_PREAMBLE 0x0020
++#define IEEE80211_CAPINFO_PBCC 0x0040
++#define IEEE80211_CAPINFO_CHNL_AGILITY 0x0080
++/* bits 8-9 are reserved */
++#define IEEE80211_CAPINFO_SHORT_SLOTTIME 0x0400
++#define IEEE80211_CAPINFO_APSD 0x0800
++/* bit 12 is reserved */
++#define IEEE80211_CAPINFO_DSSSOFDM 0x2000
++/* bits 14-15 are reserved */
+
-+ {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
-+ };
++/*
++ * Authentication Modes
++ */
+
-+ static struct forceROM_s ForceROM_NEW[] = {
-+ /* NB: This works for AR6000 ROM REV3 and beyond. */
-+ {LOCAL_SCRATCH_ADDRESS, AR6K_OPTION_IGNORE_FLASH},
-+ {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
-+ {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
-+ };
++enum ieee80211_authmode {
++ IEEE80211_AUTH_NONE = 0,
++ IEEE80211_AUTH_OPEN = 1,
++ IEEE80211_AUTH_SHARED = 2,
++ IEEE80211_AUTH_8021X = 3,
++ IEEE80211_AUTH_AUTO = 4, /* auto-select/accept */
++ /* NB: these are used only for ioctls */
++ IEEE80211_AUTH_WPA = 5, /* WPA/RSN w/ 802.1x */
++ IEEE80211_AUTH_WPA_PSK = 6, /* WPA/RSN w/ PSK */
++ IEEE80211_AUTH_WPA_CCKM = 7, /* WPA/RSN IE w/ CCKM */
++};
+
-+ /*
-+ * Examine a semi-arbitrary instruction that's different
-+ * in REV2 and other revisions.
-+ * NB: If a Host port does not require simultaneous support
-+ * for multiple revisions of Target ROM, this code can be elided.
-+ */
-+ (void)ar6000_ReadDataDiag(hifDevice, 0x01000040,
-+ (A_UCHAR *)&instruction, 4);
++#include "athendpack.h"
+
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("instruction=0x%x\n", instruction));
++#endif /* _NET80211_IEEE80211_H_ */
+diff --git a/drivers/ar6000/include/ieee80211_ioctl.h b/drivers/ar6000/include/ieee80211_ioctl.h
+new file mode 100644
+index 0000000..dab6747
+--- /dev/null
++++ b/drivers/ar6000/include/ieee80211_ioctl.h
+@@ -0,0 +1,163 @@
++/*
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/os/linux/include/ieee80211_ioctl.h#1 $
++ */
+
-+ if (instruction == 0x3c1aa200) {
-+ /* It's an old ROM */
-+ ForceROM = ForceROM_REV2;
-+ szForceROM = sizeof(ForceROM_REV2)/sizeof(*ForceROM);
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using OLD method\n"));
-+ } else {
-+ ForceROM = ForceROM_NEW;
-+ szForceROM = sizeof(ForceROM_NEW)/sizeof(*ForceROM);
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using NEW method\n"));
-+ }
++#ifndef _IEEE80211_IOCTL_H_
++#define _IEEE80211_IOCTL_H_
+
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Force Target to execute from ROM....\n"));
-+ for (i = 0; i < szForceROM; i++)
-+ {
-+ if (ar6000_WriteRegDiag(hifDevice,
-+ &ForceROM[i].addr,
-+ &ForceROM[i].data) != A_OK)
-+ {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot force Target to execute ROM!\n"));
-+ return A_ERROR;
-+ }
-+ }
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+ msleep(50); /* delay to allow dragon to come to BMI phase */
-+ return A_OK;
-+}
++/*
++ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
++ */
+
-+/* reset device */
-+A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
-+{
++/*
++ * WPA/RSN get/set key request. Specify the key/cipher
++ * type and whether the key is to be used for sending and/or
++ * receiving. The key index should be set only when working
++ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
++ * Otherwise a unicast/pairwise key is specified by the bssid
++ * (on a station) or mac address (on an ap). They key length
++ * must include any MIC key data; otherwise it should be no
++ more than IEEE80211_KEYBUF_SIZE.
++ */
++struct ieee80211req_key {
++ u_int8_t ik_type; /* key/cipher type */
++ u_int8_t ik_pad;
++ u_int16_t ik_keyix; /* key index */
++ u_int8_t ik_keylen; /* key length in bytes */
++ u_int8_t ik_flags;
++#define IEEE80211_KEY_XMIT 0x01
++#define IEEE80211_KEY_RECV 0x02
++#define IEEE80211_KEY_DEFAULT 0x80 /* default xmit key */
++ u_int8_t ik_macaddr[IEEE80211_ADDR_LEN];
++ u_int64_t ik_keyrsc; /* key receive sequence counter */
++ u_int64_t ik_keytsc; /* key transmit sequence counter */
++ u_int8_t ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
++};
++/*
++ * Delete a key either by index or address. Set the index
++ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
++ */
++struct ieee80211req_del_key {
++ u_int8_t idk_keyix; /* key index */
++ u_int8_t idk_macaddr[IEEE80211_ADDR_LEN];
++};
++/*
++ * MLME state manipulation request. IEEE80211_MLME_ASSOC
++ * only makes sense when operating as a station. The other
++ * requests can be used when operating as a station or an
++ * ap (to effect a station).
++ */
++struct ieee80211req_mlme {
++ u_int8_t im_op; /* operation to perform */
++#define IEEE80211_MLME_ASSOC 1 /* associate station */
++#define IEEE80211_MLME_DISASSOC 2 /* disassociate station */
++#define IEEE80211_MLME_DEAUTH 3 /* deauthenticate station */
++#define IEEE80211_MLME_AUTHORIZE 4 /* authorize station */
++#define IEEE80211_MLME_UNAUTHORIZE 5 /* unauthorize station */
++ u_int16_t im_reason; /* 802.11 reason code */
++ u_int8_t im_macaddr[IEEE80211_ADDR_LEN];
++};
+
-+#if !defined(DWSIM)
-+ A_STATUS status = A_OK;
-+ A_UINT32 address;
-+ A_UINT32 data;
++struct ieee80211req_addpmkid {
++ u_int8_t pi_bssid[IEEE80211_ADDR_LEN];
++ u_int8_t pi_enable;
++ u_int8_t pi_pmkid[16];
++};
+
-+ do {
++#define AUTH_ALG_OPEN_SYSTEM 0x01
++#define AUTH_ALG_SHARED_KEY 0x02
++#define AUTH_ALG_LEAP 0x04
+
-+ // address = RESET_CONTROL_ADDRESS;
-+ data = RESET_CONTROL_COLD_RST_MASK;
++struct ieee80211req_authalg {
++ u_int8_t auth_alg;
++};
+
-+ /* Hardcode the address of RESET_CONTROL_ADDRESS based on the target type */
-+ if (TargetType == TARGET_TYPE_AR6001) {
-+ address = 0x0C000000;
-+ } else {
-+ if (TargetType == TARGET_TYPE_AR6002) {
-+ address = 0x00004000;
-+ } else {
-+ A_ASSERT(0);
-+ }
-+ }
-+
-+ status = ar6000_WriteRegDiag(hifDevice, &address, &data);
-+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+
-+ /*
-+ * Read back the RESET CAUSE register to ensure that the cold reset
-+ * went through.
-+ */
-+ msleep(2000); /* 2 second delay to allow things to settle down */
++/*
++ * Request to add an IE to a Management Frame
++ */
++enum{
++ IEEE80211_APPIE_FRAME_BEACON = 0,
++ IEEE80211_APPIE_FRAME_PROBE_REQ = 1,
++ IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
++ IEEE80211_APPIE_FRAME_ASSOC_REQ = 3,
++ IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
++ IEEE80211_APPIE_NUM_OF_FRAME = 5
++};
+
++/*
++ * The Maximum length of the IE that can be added to a Management frame
++ */
++#define IEEE80211_APPIE_FRAME_MAX_LEN 78
+
-+ // address = RESET_CAUSE_ADDRESS;
-+ /* Hardcode the address of RESET_CAUSE_ADDRESS based on the target type */
-+ if (TargetType == TARGET_TYPE_AR6001) {
-+ address = 0x0C0000CC;
-+ } else {
-+ if (TargetType == TARGET_TYPE_AR6002) {
-+ address = 0x000040C0;
-+ } else {
-+ A_ASSERT(0);
-+ }
-+ }
++struct ieee80211req_getset_appiebuf {
++ u_int32_t app_frmtype; /* management frame type for which buffer is added */
++ u_int32_t app_buflen; /*application supplied buffer length */
++ u_int8_t app_buf[];
++};
+
-+ data = 0;
-+ status = ar6000_ReadRegDiag(hifDevice, &address, &data);
++/*
++ * The following definitions are used by an application to set filter
++ * for receiving management frames
++ */
++enum {
++ IEEE80211_FILTER_TYPE_BEACON = 0x1,
++ IEEE80211_FILTER_TYPE_PROBE_REQ = 0x2,
++ IEEE80211_FILTER_TYPE_PROBE_RESP = 0x4,
++ IEEE80211_FILTER_TYPE_ASSOC_REQ = 0x8,
++ IEEE80211_FILTER_TYPE_ASSOC_RESP = 0x10,
++ IEEE80211_FILTER_TYPE_AUTH = 0x20,
++ IEEE80211_FILTER_TYPE_DEAUTH = 0x40,
++ IEEE80211_FILTER_TYPE_DISASSOC = 0x80,
++ IEEE80211_FILTER_TYPE_ALL = 0xFF /* used to check the valid filter bits */
++};
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
++struct ieee80211req_set_filter {
++ u_int32_t app_filterype; /* management frame filter type */
++};
+
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Reset Cause readback: 0x%X \n",data));
-+ data &= RESET_CAUSE_LAST_MASK;
-+ if (data != 2) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Unable to cold reset the target \n"));
-+ }
++enum {
++ IEEE80211_PARAM_AUTHMODE = 3, /* Authentication Mode */
++ IEEE80211_PARAM_MCASTCIPHER = 5,
++ IEEE80211_PARAM_MCASTKEYLEN = 6, /* multicast key length */
++ IEEE80211_PARAM_UCASTCIPHER = 8,
++ IEEE80211_PARAM_UCASTKEYLEN = 9, /* unicast key length */
++ IEEE80211_PARAM_WPA = 10, /* WPA mode (0,1,2) */
++ IEEE80211_PARAM_ROAMING = 12, /* roaming mode */
++ IEEE80211_PARAM_PRIVACY = 13, /* privacy invoked */
++ IEEE80211_PARAM_COUNTERMEASURES = 14, /* WPA/TKIP countermeasures */
++ IEEE80211_PARAM_DROPUNENCRYPTED = 15, /* discard unencrypted frames */
++};
+
-+ } while (FALSE);
++/*
++ * Values for IEEE80211_PARAM_WPA
++ */
++#define WPA_MODE_WPA1 1
++#define WPA_MODE_WPA2 2
++#define WPA_MODE_AUTO 3
++#define WPA_MODE_NONE 4
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Failed to reset target \n"));
-+ }
-+#endif
-+ return A_OK;
++#ifdef __cplusplus
+}
-+
-+#define REG_DUMP_COUNT_AR6001 38 /* WORDs, derived from AR6001_regdump.h */
-+#define REG_DUMP_COUNT_AR6002 32 /* WORDs, derived from AR6002_regdump.h */
-+
-+
-+#if REG_DUMP_COUNT_AR6001 <= REG_DUMP_COUNT_AR6002
-+#define REGISTER_DUMP_LEN_MAX REG_DUMP_COUNT_AR6002
-+#else
-+#define REGISTER_DUMP_LEN_MAX REG_DUMP_COUNT_AR6001
+#endif
+
-+void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
-+{
-+ A_UINT32 address;
-+ A_UINT32 regDumpArea = 0;
-+ A_STATUS status;
-+ A_UINT32 regDumpValues[REGISTER_DUMP_LEN_MAX];
-+ A_UINT32 regDumpCount = 0;
-+ A_UINT32 i;
-+
-+ do {
-+
-+ /* the reg dump pointer is copied to the host interest area */
-+ address = HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_failure_state);
-+
-+ if (TargetType == TARGET_TYPE_AR6001) {
-+ /* for AR6001, this is a fixed location because the ptr is actually stuck in cache,
-+ * this may be fixed in later firmware versions */
-+ address = 0x18a0;
-+ regDumpCount = REG_DUMP_COUNT_AR6001;
-+
-+ } else if (TargetType == TARGET_TYPE_AR6002) {
-+
-+ regDumpCount = REG_DUMP_COUNT_AR6002;
++#endif /* _IEEE80211_IOCTL_H_ */
+diff --git a/drivers/ar6000/include/ieee80211_node.h b/drivers/ar6000/include/ieee80211_node.h
+new file mode 100644
+index 0000000..46b613c
+--- /dev/null
++++ b/drivers/ar6000/include/ieee80211_node.h
+@@ -0,0 +1,77 @@
++/*-
++ * Copyright (c) 2001 Atsushi Onoe
++ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
++ * Copyright (c) 2006 Atheros Communications, Inc.
++ *
++ * Wireless Network driver for Atheros AR6001
++ * All rights reserved.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ */
++#ifndef _IEEE80211_NODE_H_
++#define _IEEE80211_NODE_H_
+
-+ } else {
-+ A_ASSERT(0);
-+ }
++/*
++ * Node locking definitions.
++ */
++#define IEEE80211_NODE_LOCK_INIT(_nt) A_MUTEX_INIT(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_LOCK_DESTROY(_nt)
++#define IEEE80211_NODE_LOCK(_nt) A_MUTEX_LOCK(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_UNLOCK(_nt) A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_LOCK_BH(_nt) A_MUTEX_LOCK(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_UNLOCK_BH(_nt) A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
++#define IEEE80211_NODE_LOCK_ASSERT(_nt)
+
-+ /* read RAM location through diagnostic window */
-+ status = ar6000_ReadRegDiag(hifDevice, &address, ®DumpArea);
++/*
++ * Node reference counting definitions.
++ *
++ * ieee80211_node_initref initialize the reference count to 1
++ * ieee80211_node_incref add a reference
++ * ieee80211_node_decref remove a reference
++ * ieee80211_node_dectestref remove a reference and return 1 if this
++ * is the last reference, otherwise 0
++ * ieee80211_node_refcnt reference count for printing (only)
++ */
++#define ieee80211_node_initref(_ni) ((_ni)->ni_refcnt = 1)
++#define ieee80211_node_incref(_ni) ((_ni)->ni_refcnt++)
++#define ieee80211_node_decref(_ni) ((_ni)->ni_refcnt--)
++#define ieee80211_node_dectestref(_ni) (((_ni)->ni_refcnt--) == 0)
++#define ieee80211_node_refcnt(_ni) ((_ni)->ni_refcnt)
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get ptr to register dump area \n"));
-+ break;
-+ }
++#define IEEE80211_NODE_HASHSIZE 32
++/* simple hash is enough for variation of macaddr */
++#define IEEE80211_NODE_HASH(addr) \
++ (((const A_UINT8 *)(addr))[IEEE80211_ADDR_LEN - 1] % \
++ IEEE80211_NODE_HASHSIZE)
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Location of register dump data: 0x%X \n",regDumpArea));
++/*
++ * Table of ieee80211_node instances. Each ieee80211com
++ * has at least one for holding the scan candidates.
++ * When operating as an access point or in ibss mode there
++ * is a second table for associated stations or neighbors.
++ */
++struct ieee80211_node_table {
++ void *nt_wmip; /* back reference */
++ A_MUTEX_T nt_nodelock; /* on node table */
++ struct bss *nt_node_first; /* information of all nodes */
++ struct bss *nt_node_last; /* information of all nodes */
++ struct bss *nt_hash[IEEE80211_NODE_HASHSIZE];
++ const char *nt_name; /* for debugging */
++ A_UINT32 nt_scangen; /* gen# for timeout scan */
++ A_TIMER nt_inact_timer;
++ A_UINT8 isTimerArmed; /* is the node timer armed */
++};
+
-+ if (regDumpArea == 0) {
-+ /* no reg dump */
-+ break;
-+ }
++#define WLAN_NODE_INACT_TIMEOUT_MSEC 10000
+
-+ if (TargetType == TARGET_TYPE_AR6001) {
-+ regDumpArea &= 0x0FFFFFFF; /* convert to physical address in target memory */
-+ }
++#endif /* _IEEE80211_NODE_H_ */
+diff --git a/drivers/ar6000/include/ini_dset.h b/drivers/ar6000/include/ini_dset.h
+new file mode 100644
+index 0000000..410f2b5
+--- /dev/null
++++ b/drivers/ar6000/include/ini_dset.h
+@@ -0,0 +1,40 @@
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ */
++#ifndef _INI_DSET_H_
++#define _INI_DSET_H_
+
-+ /* fetch register dump data */
-+ status = ar6000_ReadDataDiag(hifDevice,
-+ regDumpArea,
-+ (A_UCHAR *)®DumpValues[0],
-+ regDumpCount * (sizeof(A_UINT32)));
++/*
++ * Each of these represents a WHAL INI table, which consists
++ * of an "address column" followed by 1 or more "value columns".
++ *
++ * Software uses the base WHAL_INI_DATA_ID+column to access a
++ * DataSet that holds a particular column of data.
++ */
++typedef enum {
++ WHAL_INI_DATA_ID_NULL =0,
++ WHAL_INI_DATA_ID_MODE_SPECIFIC =1, /* 2,3 */
++ WHAL_INI_DATA_ID_COMMON =4, /* 5 */
++ WHAL_INI_DATA_ID_BB_RFGAIN =6, /* 7,8 */
++ WHAL_INI_DATA_ID_ANALOG_BANK1 =9, /* 10 */
++ WHAL_INI_DATA_ID_ANALOG_BANK2 =11, /* 12 */
++ WHAL_INI_DATA_ID_ANALOG_BANK3 =13, /* 14, 15 */
++ WHAL_INI_DATA_ID_ANALOG_BANK6 =16, /* 17, 18 */
++ WHAL_INI_DATA_ID_ANALOG_BANK7 =19, /* 20 */
++ WHAL_INI_DATA_ID_MODE_OVERRIDES =21, /* 22,23 */
++ WHAL_INI_DATA_ID_COMMON_OVERRIDES =24, /* 25 */
+
-+ if (A_FAILED(status)) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get register dump \n"));
-+ break;
-+ }
++ WHAL_INI_DATA_ID_MAX =25
++} WHAL_INI_DATA_ID;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Register Dump: \n"));
++typedef PREPACK struct {
++ A_UINT16 freqIndex; // 1 - A mode 2 - B or G mode 0 - common
++ A_UINT16 offset;
++ A_UINT32 newValue;
++} POSTPACK INI_DSET_REG_OVERRIDE;
+
-+ for (i = 0; i < regDumpCount; i++) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" %d : 0x%8.8X \n",i, regDumpValues[i]));
-+ }
++#endif
+diff --git a/drivers/ar6000/include/regDb.h b/drivers/ar6000/include/regDb.h
+new file mode 100644
+index 0000000..b3f665f
+--- /dev/null
++++ b/drivers/ar6000/include/regDb.h
+@@ -0,0 +1,19 @@
++/*
++ * Copyright (c) 2005 Atheros Communications, Inc.
++ * All rights reserved.
++ *
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * This module contains the header files for regulatory module,
++ * which include the DB schema and DB values.
++ * $Id:
++ */
+
-+ } while (FALSE);
++#ifndef __REG_DB_H__
++#define __REG_DB_H__
+
-+}
++#include "./regulatory/reg_dbschema.h"
++#include "./regulatory/reg_dbvalues.h"
+
-diff --git a/drivers/ar6000/miscdrv/credit_dist.c b/drivers/ar6000/miscdrv/credit_dist.c
++#endif /* __REG_DB_H__ */
+diff --git a/drivers/ar6000/include/regdump.h b/drivers/ar6000/include/regdump.h
new file mode 100644
-index 0000000..8d37d62
+index 0000000..0106825
--- /dev/null
-+++ b/drivers/ar6000/miscdrv/credit_dist.c
-@@ -0,0 +1,346 @@
-+
++++ b/drivers/ar6000/include/regdump.h
+@@ -0,0 +1,33 @@
++#ifndef __REGDUMP_H__
++#define __REGDUMP_H__
+/*
-+ *
+ * Copyright (c) 2004-2007 Atheros Communications Inc.
+ * All rights reserved.
+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
+ */
++#if defined(AR6001)
++#include "AR6001/AR6001_regdump.h"
++#endif
++#if defined(AR6002)
++#include "AR6002/AR6002_regdump.h"
++#endif
+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include "a_debug.h"
-+#include "htc_api.h"
-+#include "common_drv.h"
-+
-+/********* CREDIT DISTRIBUTION FUNCTIONS ******************************************/
++#if !defined(__ASSEMBLER__)
++/*
++ * Target CPU state at the time of failure is reflected
++ * in a register dump, which the Host can fetch through
++ * the diagnostic window.
++ */
++struct register_dump_s {
++ A_UINT32 target_id; /* Target ID */
++ A_UINT32 assline; /* Line number (if assertion failure) */
++ A_UINT32 pc; /* Program Counter at time of exception */
++ A_UINT32 badvaddr; /* Virtual address causing exception */
++ CPU_exception_frame_t exc_frame; /* CPU-specific exception info */
+
-+#define NO_VO_SERVICE 1 /* currently WMI only uses 3 data streams, so we leave VO service inactive */
++ /* Could copy top of stack here, too.... */
++};
++#endif /* __ASSEMBLER__ */
++#endif /* __REGDUMP_H__ */
+diff --git a/drivers/ar6000/include/targaddrs.h b/drivers/ar6000/include/targaddrs.h
+new file mode 100644
+index 0000000..da2a650
+--- /dev/null
++++ b/drivers/ar6000/include/targaddrs.h
+@@ -0,0 +1,158 @@
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ */
+
-+#ifdef NO_VO_SERVICE
-+#define DATA_SVCS_USED 3
-+#else
-+#define DATA_SVCS_USED 4
++#ifndef __TARGADDRS_H__
++#define __TARGADDRS_H__
++#if defined(AR6001)
++#include "AR6001/addrs.h"
++#endif
++#if defined(AR6002)
++#include "AR6002/addrs.h"
+#endif
+
-+static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
-+
-+static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
++/*
++ * AR6K option bits, to enable/disable various features.
++ * By default, all option bits are 0.
++ * These bits can be set in LOCAL_SCRATCH register 0.
++ */
++#define AR6K_OPTION_BMI_DISABLE 0x01 /* Disable BMI comm with Host */
++#define AR6K_OPTION_SERIAL_ENABLE 0x02 /* Enable serial port msgs */
++#define AR6K_OPTION_WDT_DISABLE 0x04 /* WatchDog Timer override */
++#define AR6K_OPTION_SLEEP_DISABLE 0x08 /* Disable system sleep */
++#define AR6K_OPTION_STOP_BOOT 0x10 /* Stop boot processes (for ATE) */
++#define AR6K_OPTION_ENABLE_NOANI 0x20 /* Operate without ANI */
++#define AR6K_OPTION_DSET_DISABLE 0x40 /* Ignore DataSets */
++#define AR6K_OPTION_IGNORE_FLASH 0x80 /* Ignore flash during bootup */
+
-+/* reduce an ep's credits back to a set limit */
-+static INLINE void ReduceCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+ HTC_ENDPOINT_CREDIT_DIST *pEpDist,
-+ int Limit)
-+{
-+ int credits;
++/*
++ * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
++ * host_interest structure. It must match the address of the _host_interest
++ * symbol (see linker script).
++ *
++ * Host Interest is shared between Host and Target in order to coordinate
++ * between the two, and is intended to remain constant (with additions only
++ * at the end) across software releases.
++ */
++#define AR6001_HOST_INTEREST_ADDRESS 0x80000600
++#define AR6002_HOST_INTEREST_ADDRESS 0x00500400
+
-+ /* set the new limit */
-+ pEpDist->TxCreditsAssigned = Limit;
++#define HOST_INTEREST_MAX_SIZE 0x100
+
-+ if (pEpDist->TxCredits <= Limit) {
-+ return;
-+ }
++#if !defined(__ASSEMBLER__)
++struct register_dump_s;
++struct dbglog_hdr_s;
+
-+ /* figure out how much to take away */
-+ credits = pEpDist->TxCredits - Limit;
-+ /* take them away */
-+ pEpDist->TxCredits -= credits;
-+ pCredInfo->CurrentFreeCredits += credits;
-+}
++/*
++ * These are items that the Host may need to access
++ * via BMI or via the Diagnostic Window. The position
++ * of items in this structure must remain constant
++ * across firmware revisions!
++ *
++ * Types for each item must be fixed size across
++ * target and host platforms.
++ *
++ * More items may be added at the end.
++ */
++struct host_interest_s {
++ /*
++ * Pointer to application-defined area, if any.
++ * Set by Target application during startup.
++ */
++ A_UINT32 hi_app_host_interest; /* 0x00 */
+
-+/* give an endpoint some credits from the free credit pool */
-+#define GiveCredits(pCredInfo,pEpDist,credits) \
-+{ \
-+ (pEpDist)->TxCredits += (credits); \
-+ (pEpDist)->TxCreditsAssigned += (credits); \
-+ (pCredInfo)->CurrentFreeCredits -= (credits); \
-+}
++ /* Pointer to register dump area, valid after Target crash. */
++ A_UINT32 hi_failure_state; /* 0x04 */
+
++ /* Pointer to debug logging header */
++ A_UINT32 hi_dbglog_hdr; /* 0x08 */
+
-+/* default credit init callback.
-+ * This function is called in the context of HTCStart() to setup initial (application-specific)
-+ * credit distributions */
-+static void ar6000_credit_init(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPList,
-+ int TotalCredits)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+ int count;
-+ COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
++ /* Indicates whether or not flash is present on Target.
++ * NB: flash_is_present indicator is here not just
++ * because it might be of interest to the Host; but
++ * also because it's set early on by Target's startup
++ * asm code and we need it to have a special RAM address
++ * so that it doesn't get reinitialized with the rest
++ * of data.
++ */
++ A_UINT32 hi_flash_is_present; /* 0x0c */
+
-+ pCredInfo->CurrentFreeCredits = TotalCredits;
-+ pCredInfo->TotalAvailableCredits = TotalCredits;
++ /*
++ * General-purpose flag bits, similar to AR6000_OPTION_* flags.
++ * Can be used by application rather than by OS.
++ */
++ A_UINT32 hi_option_flag; /* 0x10 */
+
-+ pCurEpDist = pEPList;
++ /*
++ * Boolean that determines whether or not to
++ * display messages on the serial port.
++ */
++ A_UINT32 hi_serial_enable; /* 0x14 */
+
-+ /* run through the list and initialize */
-+ while (pCurEpDist != NULL) {
++ /* Start address of Flash DataSet index, if any */
++ A_UINT32 hi_dset_list_head; /* 0x18 */
+
-+ /* set minimums for each endpoint */
-+ pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
++ /* Override Target application start address */
++ A_UINT32 hi_app_start; /* 0x1c */
+
-+ if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
-+ /* give control service some credits */
-+ GiveCredits(pCredInfo,pCurEpDist,pCurEpDist->TxCreditsMin);
-+ /* control service is always marked active, it never goes inactive EVER */
-+ SET_EP_ACTIVE(pCurEpDist);
-+ } else if (pCurEpDist->ServiceID == WMI_DATA_BK_SVC) {
-+ /* this is the lowest priority data endpoint, save this off for easy access */
-+ pCredInfo->pLowestPriEpDist = pCurEpDist;
-+ }
++ /* Clock and voltage tuning */
++ A_UINT32 hi_skip_clock_init; /* 0x20 */
++ A_UINT32 hi_core_clock_setting; /* 0x24 */
++ A_UINT32 hi_cpu_clock_setting; /* 0x28 */
++ A_UINT32 hi_system_sleep_setting; /* 0x2c */
++ A_UINT32 hi_xtal_control_setting; /* 0x30 */
++ A_UINT32 hi_pll_ctrl_setting_24ghz; /* 0x34 */
++ A_UINT32 hi_pll_ctrl_setting_5ghz; /* 0x38 */
++ A_UINT32 hi_ref_voltage_trim_setting; /* 0x3c */
++ A_UINT32 hi_clock_info; /* 0x40 */
+
-+ /* Streams have to be created (explicit | implicit)for all kinds
-+ * of traffic. BE endpoints are also inactive in the beginning.
-+ * When BE traffic starts it creates implicit streams that
-+ * redistributes credits.
-+ */
++ /*
++ * Flash configuration overrides, used only
++ * when firmware is not executing from flash.
++ * (When using flash, modify the global variables
++ * with equivalent names.)
++ */
++ A_UINT32 hi_bank0_addr_value; /* 0x44 */
++ A_UINT32 hi_bank0_read_value; /* 0x48 */
++ A_UINT32 hi_bank0_write_value; /* 0x4c */
++ A_UINT32 hi_bank0_config_value; /* 0x50 */
+
-+ /* note, all other endpoints have minimums set but are initially given NO credits.
-+ * Credits will be distributed as traffic activity demands */
-+ pCurEpDist = pCurEpDist->pNext;
-+ }
++ /* Pointer to Board Data */
++ A_UINT32 hi_board_data; /* 0x54 */
++ A_UINT32 hi_board_data_initialized; /* 0x58 */
+
-+ if (pCredInfo->CurrentFreeCredits <= 0) {
-+ AR_DEBUG_PRINTF(ATH_LOG_INF, ("Not enough credits (%d) to do credit distributions \n", TotalCredits));
-+ A_ASSERT(FALSE);
-+ return;
-+ }
++ A_UINT32 hi_dset_RAM_index_table; /* 0x5c */
+
-+ /* reset list */
-+ pCurEpDist = pEPList;
-+ /* now run through the list and set max operating credit limits for everyone */
-+ while (pCurEpDist != NULL) {
-+ if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
-+ /* control service max is just 1 max message */
-+ pCurEpDist->TxCreditsNorm = pCurEpDist->TxCreditsPerMaxMsg;
-+ } else {
-+ /* for the remaining data endpoints, we assume that each TxCreditsPerMaxMsg are
-+ * the same.
-+ * We use a simple calculation here, we take the remaining credits and
-+ * determine how many max messages this can cover and then set each endpoint's
-+ * normal value equal to half this amount.
-+ * */
-+ count = (pCredInfo->CurrentFreeCredits/pCurEpDist->TxCreditsPerMaxMsg) * pCurEpDist->TxCreditsPerMaxMsg;
-+ count = count >> 1;
-+ count = max(count,pCurEpDist->TxCreditsPerMaxMsg);
-+ /* set normal */
-+ pCurEpDist->TxCreditsNorm = count;
++ A_UINT32 hi_desired_baud_rate; /* 0x60 */
++ A_UINT32 hi_dbglog_config; /* 0x64 */
++ A_UINT32 hi_end_RAM_reserve_sz; /* 0x68 */
++ A_UINT32 hi_mbox_io_block_sz; /* 0x6c */
+
-+ }
-+ pCurEpDist = pCurEpDist->pNext;
-+ }
++ A_UINT32 hi_num_bpatch_streams; /* 0x70 */
++ A_UINT32 hi_mbox_isr_yield_limit; /* 0x74 */
+
-+}
++ A_UINT32 hi_refclk_hz; /* 0x78 */
++};
+
++/* Bits defined in hi_option_flag */
++#define HI_OPTION_TIMER_WAR 1 /* not really used */
+
-+/* default credit distribution callback
-+ * This callback is invoked whenever endpoints require credit distributions.
-+ * A lock is held while this function is invoked, this function shall NOT block.
-+ * The pEPDistList is a list of distribution structures in prioritized order as
-+ * defined by the call to the HTCSetCreditDistribution() api.
-+ *
++/*
++ * Intended for use by Host software, this macro returns the Target RAM
++ * address of any item in the host_interest structure.
++ * Example: target_addr = AR6001_HOST_INTEREST_ITEM_ADDRESS(hi_board_data);
+ */
-+static void ar6000_credit_distribute(void *Context,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
-+ HTC_CREDIT_DIST_REASON Reason)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+ COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
-+
-+ switch (Reason) {
-+ case HTC_CREDIT_DIST_SEND_COMPLETE :
-+ pCurEpDist = pEPDistList;
-+ /* we are given the start of the endpoint distribution list.
-+ * There may be one or more endpoints to service.
-+ * Run through the list and distribute credits */
-+ while (pCurEpDist != NULL) {
-+
-+ if (pCurEpDist->TxCreditsToDist > 0) {
-+ /* return the credits back to the endpoint */
-+ pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
-+ /* always zero out when we are done */
-+ pCurEpDist->TxCreditsToDist = 0;
-+
-+ if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsAssigned) {
-+ /* reduce to the assigned limit, previous credit reductions
-+ * could have caused the limit to change */
-+ ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsAssigned);
-+ }
-+
-+ if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsNorm) {
-+ /* oversubscribed endpoints need to reduce back to normal */
-+ ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsNorm);
-+ }
-+ }
++#define AR6001_HOST_INTEREST_ITEM_ADDRESS(item) \
++ ((A_UINT32)&((((struct host_interest_s *)(AR6001_HOST_INTEREST_ADDRESS))->item)))
+
-+ pCurEpDist = pCurEpDist->pNext;
-+ }
++#define AR6002_HOST_INTEREST_ITEM_ADDRESS(item) \
++ ((A_UINT32)&((((struct host_interest_s *)(AR6002_HOST_INTEREST_ADDRESS))->item)))
+
-+ A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
+
-+ break;
++#endif /* !__ASSEMBLER__ */
+
-+ case HTC_CREDIT_DIST_ACTIVITY_CHANGE :
-+ RedistributeCredits(pCredInfo,pEPDistList);
-+ break;
-+ case HTC_CREDIT_DIST_SEEK_CREDITS :
-+ SeekCredits(pCredInfo,pEPDistList);
-+ break;
-+ case HTC_DUMP_CREDIT_STATE :
-+ AR_DEBUG_PRINTF(ATH_LOG_INF, ("Credit Distribution, total : %d, free : %d\n",
-+ pCredInfo->TotalAvailableCredits, pCredInfo->CurrentFreeCredits));
-+ break;
-+ default:
-+ break;
++#endif /* __TARGADDRS_H__ */
+diff --git a/drivers/ar6000/include/testcmd.h b/drivers/ar6000/include/testcmd.h
+new file mode 100644
+index 0000000..737533a
+--- /dev/null
++++ b/drivers/ar6000/include/testcmd.h
+@@ -0,0 +1,144 @@
++/*
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ */
+
-+ }
++#ifndef TESTCMD_H_
++#define TESTCMD_H_
+
-+}
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+/* redistribute credits based on activity change */
-+static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDistList)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist = pEPDistList;
++typedef enum {
++ ZEROES_PATTERN = 0,
++ ONES_PATTERN,
++ REPEATING_10,
++ PN7_PATTERN,
++ PN9_PATTERN,
++ PN15_PATTERN
++}TX_DATA_PATTERN;
+
-+ /* walk through the list and remove credits from inactive endpoints */
-+ while (pCurEpDist != NULL) {
++/* Continous tx
++ mode : TCMD_CONT_TX_OFF - Disabling continous tx
++ TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
++ TCMD_CONT_TX_FRAME- Enable continuous modulated tx
++ freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
++dataRate: 0 - 1 Mbps
++ 1 - 2 Mbps
++ 2 - 5.5 Mbps
++ 3 - 11 Mbps
++ 4 - 6 Mbps
++ 5 - 9 Mbps
++ 6 - 12 Mbps
++ 7 - 18 Mbps
++ 8 - 24 Mbps
++ 9 - 36 Mbps
++ 10 - 28 Mbps
++ 11 - 54 Mbps
++ txPwr: Tx power in dBm[5 -11] for unmod Tx, [5-14] for mod Tx
++antenna: 1 - one antenna
++ 2 - two antenna
++Note : Enable/disable continuous tx test cmd works only when target is awake.
++*/
+
-+ if (pCurEpDist->ServiceID != WMI_CONTROL_SVC) {
-+ if (!IS_EP_ACTIVE(pCurEpDist)) {
-+ /* EP is inactive, reduce credits back to zero */
-+ ReduceCredits(pCredInfo, pCurEpDist, 0);
-+ }
-+ }
++typedef enum {
++ TCMD_CONT_TX_OFF = 0,
++ TCMD_CONT_TX_SINE,
++ TCMD_CONT_TX_FRAME,
++ TCMD_CONT_TX_TX99,
++ TCMD_CONT_TX_TX100
++} TCMD_CONT_TX_MODE;
+
-+ /* NOTE in the active case, we do not need to do anything further,
-+ * when an EP goes active and needs credits, HTC will call into
-+ * our distribution function using a reason code of HTC_CREDIT_DIST_SEEK_CREDITS */
++typedef PREPACK struct {
++ A_UINT32 testCmdId;
++ A_UINT32 mode;
++ A_UINT32 freq;
++ A_UINT32 dataRate;
++ A_INT32 txPwr;
++ A_UINT32 antenna;
++ A_UINT32 enANI;
++ A_UINT32 scramblerOff;
++ A_UINT32 aifsn;
++ A_UINT16 pktSz;
++ A_UINT16 txPattern;
++} POSTPACK TCMD_CONT_TX;
+
-+ pCurEpDist = pCurEpDist->pNext;
-+ }
++#define TCMD_TXPATTERN_ZERONE 0x1
++#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE 0x2
+
-+ A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
++/* Continuous Rx
++ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
++ TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
++ address equal specified
++ mac address (set via act =3)
++ TCMD_CONT_RX_REPORT off mode (disable cont rx mode and get the
++ report from the last cont
++ Rx test)
+
-+}
++ TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
++ target. This Overrides
++ the default MAC address.)
+
-+/* HTC has an endpoint that needs credits, pEPDist is the endpoint in question */
-+static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
-+ HTC_ENDPOINT_CREDIT_DIST *pEPDist)
-+{
-+ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
-+ int credits = 0;
-+ int need;
++*/
++typedef enum {
++ TCMD_CONT_RX_PROMIS =0,
++ TCMD_CONT_RX_FILTER,
++ TCMD_CONT_RX_REPORT,
++ TCMD_CONT_RX_SETMAC
++} TCMD_CONT_RX_ACT;
+
-+ do {
++typedef PREPACK struct {
++ A_UINT32 testCmdId;
++ A_UINT32 act;
++ A_UINT32 enANI;
++ PREPACK union {
++ struct PREPACK TCMD_CONT_RX_PARA {
++ A_UINT32 freq;
++ A_UINT32 antenna;
++ } POSTPACK para;
++ struct PREPACK TCMD_CONT_RX_REPORT {
++ A_UINT32 totalPkt;
++ A_INT32 rssiInDBm;
++ } POSTPACK report;
++ struct PREPACK TCMD_CONT_RX_MAC {
++ A_UCHAR addr[ATH_MAC_LEN];
++ } POSTPACK mac;
++ } POSTPACK u;
++} POSTPACK TCMD_CONT_RX;
+
-+ if (pEPDist->ServiceID == WMI_CONTROL_SVC) {
-+ /* we never oversubscribe on the control service, this is not
-+ * a high performance path and the target never holds onto control
-+ * credits for too long */
-+ break;
-+ }
++/* Force sleep/wake test cmd
++ mode: TCMD_PM_WAKEUP - Wakeup the target
++ TCMD_PM_SLEEP - Force the target to sleep.
++ */
++typedef enum {
++ TCMD_PM_WAKEUP = 1, /* be consistent with target */
++ TCMD_PM_SLEEP
++} TCMD_PM_MODE;
+
-+ /* for all other services, we follow a simple algorithm of
-+ * 1. checking the free pool for credits
-+ * 2. checking lower priority endpoints for credits to take */
++typedef PREPACK struct {
++ A_UINT32 testCmdId;
++ A_UINT32 mode;
++} POSTPACK TCMD_PM;
+
-+ if (pCredInfo->CurrentFreeCredits >= 2 * pEPDist->TxCreditsSeek) {
-+ /* try to give more credits than it needs */
-+ credits = 2 * pEPDist->TxCreditsSeek;
-+ } else {
-+ /* give what we can */
-+ credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
-+ }
++typedef enum{
++ TCMD_CONT_TX_ID,
++ TCMD_CONT_RX_ID,
++ TCMD_PM_ID
++ } TCMD_ID;
+
-+ if (credits >= pEPDist->TxCreditsSeek) {
-+ /* we found some to fullfill the seek request */
-+ break;
-+ }
++typedef PREPACK union {
++ TCMD_CONT_TX contTx;
++ TCMD_CONT_RX contRx;
++ TCMD_PM pm ;
++} POSTPACK TEST_CMD;
+
-+ /* we don't have enough in the free pool, try taking away from lower priority services
-+ *
-+ * The rule for taking away credits:
-+ * 1. Only take from lower priority endpoints
-+ * 2. Only take what is allocated above the minimum (never starve an endpoint completely)
-+ * 3. Only take what you need.
-+ *
-+ * */
++#ifdef __cplusplus
++}
++#endif
+
-+ /* starting at the lowest priority */
-+ pCurEpDist = pCredInfo->pLowestPriEpDist;
++#endif /* TESTCMD_H_ */
+diff --git a/drivers/ar6000/include/wlan_api.h b/drivers/ar6000/include/wlan_api.h
+new file mode 100644
+index 0000000..aabca4b
+--- /dev/null
++++ b/drivers/ar6000/include/wlan_api.h
+@@ -0,0 +1,101 @@
++#ifndef _HOST_WLAN_API_H_
++#define _HOST_WLAN_API_H_
++/*
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This file contains the API for the host wlan module
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wlan_api.h#1 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ /* work backwards until we hit the endpoint again */
-+ while (pCurEpDist != pEPDist) {
-+ /* calculate how many we need so far */
-+ need = pEPDist->TxCreditsSeek - pCredInfo->CurrentFreeCredits;
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+ if ((pCurEpDist->TxCreditsAssigned - need) > pCurEpDist->TxCreditsMin) {
-+ /* the current one has been allocated more than it's minimum and it
-+ * has enough credits assigned above it's minimum to fullfill our need
-+ * try to take away just enough to fullfill our need */
-+ ReduceCredits(pCredInfo,
-+ pCurEpDist,
-+ pCurEpDist->TxCreditsAssigned - need);
++struct ieee80211_node_table;
++struct ieee80211_frame;
+
-+ if (pCredInfo->CurrentFreeCredits >= pEPDist->TxCreditsSeek) {
-+ /* we have enough */
-+ break;
-+ }
-+ }
++struct ieee80211_common_ie {
++ A_UINT16 ie_chan;
++ A_UINT8 *ie_tstamp;
++ A_UINT8 *ie_ssid;
++ A_UINT8 *ie_rates;
++ A_UINT8 *ie_xrates;
++ A_UINT8 *ie_country;
++ A_UINT8 *ie_wpa;
++ A_UINT8 *ie_rsn;
++ A_UINT8 *ie_wmm;
++ A_UINT8 *ie_ath;
++ A_UINT16 ie_capInfo;
++ A_UINT16 ie_beaconInt;
++ A_UINT8 *ie_tim;
++ A_UINT8 *ie_chswitch;
++ A_UINT8 ie_erp;
++ A_UINT8 *ie_wsc;
++};
+
-+ pCurEpDist = pCurEpDist->pPrev;
-+ }
++typedef struct bss {
++ A_UINT8 ni_macaddr[6];
++ A_UINT8 ni_snr;
++ A_INT16 ni_rssi;
++ struct bss *ni_list_next;
++ struct bss *ni_list_prev;
++ struct bss *ni_hash_next;
++ struct bss *ni_hash_prev;
++ struct ieee80211_common_ie ni_cie;
++ A_UINT8 *ni_buf;
++ struct ieee80211_node_table *ni_table;
++ A_UINT32 ni_refcnt;
++ int ni_scangen;
++ A_UINT32 ni_tstamp;
++} bss_t;
+
-+ /* return what we can get */
-+ credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
++typedef void wlan_node_iter_func(void *arg, bss_t *);
+
-+ } while (FALSE);
++bss_t *wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size);
++void wlan_node_free(bss_t *ni);
++void wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
++ const A_UINT8 *macaddr);
++bss_t *wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr);
++void wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni);
++void wlan_free_allnodes(struct ieee80211_node_table *nt);
++void wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
++ void *arg);
+
-+ /* did we find some credits? */
-+ if (credits) {
-+ /* give what we can */
-+ GiveCredits(pCredInfo, pEPDist, credits);
-+ }
++void wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt);
++void wlan_node_table_reset(struct ieee80211_node_table *nt);
++void wlan_node_table_cleanup(struct ieee80211_node_table *nt);
+
-+}
++A_STATUS wlan_parse_beacon(A_UINT8 *buf, int framelen,
++ struct ieee80211_common_ie *cie);
+
-+/* initialize and setup credit distribution */
-+A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo)
-+{
-+ HTC_SERVICE_ID servicepriority[5];
++A_UINT16 wlan_ieee2freq(int chan);
++A_UINT32 wlan_freq2ieee(A_UINT16 freq);
+
-+ A_MEMZERO(pCredInfo,sizeof(COMMON_CREDIT_STATE_INFO));
+
-+ servicepriority[0] = WMI_CONTROL_SVC; /* highest */
-+ servicepriority[1] = WMI_DATA_VO_SVC;
-+ servicepriority[2] = WMI_DATA_VI_SVC;
-+ servicepriority[3] = WMI_DATA_BE_SVC;
-+ servicepriority[4] = WMI_DATA_BK_SVC; /* lowest */
++bss_t *
++wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
++ A_UINT32 ssidLength, A_BOOL bIsWPA2);
+
-+ /* set callbacks and priority list */
-+ HTCSetCreditDistribution(HTCHandle,
-+ pCredInfo,
-+ ar6000_credit_distribute,
-+ ar6000_credit_init,
-+ servicepriority,
-+ 5);
++void
++wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni);
+
-+ return A_OK;
++#ifdef __cplusplus
+}
++#endif
+
-diff --git a/drivers/ar6000/wlan/wlan_node.c b/drivers/ar6000/wlan/wlan_node.c
++#endif /* _HOST_WLAN_API_H_ */
+diff --git a/drivers/ar6000/include/wlan_dset.h b/drivers/ar6000/include/wlan_dset.h
new file mode 100644
-index 0000000..b124845
+index 0000000..8a876d6
--- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_node.c
-@@ -0,0 +1,371 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * Copyright (c) 2004-2005 Atheros Communications
++++ b/drivers/ar6000/include/wlan_dset.h
+@@ -0,0 +1,20 @@
++/*
++ * Copyright (c) 2007 Atheros Communications, Inc.
+ * All rights reserved.
+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote products
-+ * derived from this software without specific prior written permission.
-+ *
-+ * Alternatively, this software may be distributed under the terms of the
-+ * GNU General Public License ("GPL") version 2 as published by the Free
-+ * Software Foundation.
+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ * $ATH_LICENSE_HOSTSDK0_C$
+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_node.c#1 $
+ */
-+/*
-+ * IEEE 802.11 node handling support.
-+ */
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
-+#include <a_debug.h>
-+#include <ieee80211.h>
-+#include <wlan_api.h>
-+#include <ieee80211_node.h>
-+#include <htc_api.h>
-+#include <wmi.h>
-+#include <wmi_api.h>
+
-+static void wlan_node_timeout(A_ATH_TIMER arg);
-+static bss_t * _ieee80211_find_node(struct ieee80211_node_table *nt,
-+ const A_UINT8 *macaddr);
++#ifndef __WLAN_DSET_H__
++#define __WKAN_DSET_H__
+
-+bss_t *
-+wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size)
-+{
-+ bss_t *ni;
++typedef PREPACK struct wow_config_dset {
+
-+ ni = A_MALLOC_NOWAIT(sizeof(bss_t));
++ A_UINT8 valid_dset;
++ A_UINT8 gpio_enable;
++ A_UINT16 gpio_pin;
++} POSTPACK WOW_CONFIG_DSET;
+
-+ if (ni != NULL) {
-+ ni->ni_buf = A_MALLOC_NOWAIT(wh_size);
-+ if (ni->ni_buf == NULL) {
-+ A_FREE(ni);
-+ ni = NULL;
-+ return ni;
-+ }
-+ } else {
-+ return ni;
-+ }
++#endif
+diff --git a/drivers/ar6000/include/wmi.h b/drivers/ar6000/include/wmi.h
+new file mode 100644
+index 0000000..045acd4
+--- /dev/null
++++ b/drivers/ar6000/include/wmi.h
+@@ -0,0 +1,1743 @@
++/*
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * This file contains the definitions of the WMI protocol specified in the
++ * Wireless Module Interface (WMI). It includes definitions of all the
++ * commands and events. Commands are messages from the host to the WM.
++ * Events and Replies are messages from the WM to the host.
++ *
++ * Ownership of correctness in regards to WMI commands
++ * belongs to the host driver and the WM is not required to validate
++ * parameters for value, proper range, or any other checking.
++ *
++ */
+
-+ /* Make sure our lists are clean */
-+ ni->ni_list_next = NULL;
-+ ni->ni_list_prev = NULL;
-+ ni->ni_hash_next = NULL;
-+ ni->ni_hash_prev = NULL;
++#ifndef _WMI_H_
++#define _WMI_H_
+
-+ //
-+ // ni_scangen never initialized before and during suspend/resume of winmobile, customer (LG/SEMCO) identified
-+ // that some junk has been stored in this, due to this scan list didn't properly updated
-+ //
-+ ni->ni_scangen = 0;
++#ifndef ATH_TARGET
++#include "athstartpack.h"
++#endif
+
-+ return ni;
-+}
++#include "wmix.h"
+
-+void
-+wlan_node_free(bss_t *ni)
-+{
-+ if (ni->ni_buf != NULL) {
-+ A_FREE(ni->ni_buf);
-+ }
-+ A_FREE(ni);
-+}
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+void
-+wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
-+ const A_UINT8 *macaddr)
-+{
-+ int hash;
++#define WMI_PROTOCOL_VERSION 0x0002
++#define WMI_PROTOCOL_REVISION 0x0000
+
-+ A_MEMCPY(ni->ni_macaddr, macaddr, IEEE80211_ADDR_LEN);
-+ hash = IEEE80211_NODE_HASH(macaddr);
-+ ieee80211_node_initref(ni); /* mark referenced */
++#define ATH_MAC_LEN 6 /* length of mac in bytes */
++#define WMI_CMD_MAX_LEN 100
++#define WMI_CONTROL_MSG_MAX_LEN 256
++#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
++#define IS_ETHERTYPE(_typeOrLen) ((_typeOrLen) >= 0x0600)
++#define RFC1042OUI {0x00, 0x00, 0x00}
+
-+ ni->ni_tstamp = A_GET_MS(WLAN_NODE_INACT_TIMEOUT_MSEC);
-+ IEEE80211_NODE_LOCK_BH(nt);
++#define IP_ETHERTYPE 0x0800
+
-+ /* Insert at the end of the node list */
-+ ni->ni_list_next = NULL;
-+ ni->ni_list_prev = nt->nt_node_last;
-+ if(nt->nt_node_last != NULL)
-+ {
-+ nt->nt_node_last->ni_list_next = ni;
-+ }
-+ nt->nt_node_last = ni;
-+ if(nt->nt_node_first == NULL)
-+ {
-+ nt->nt_node_first = ni;
-+ }
++#define WMI_IMPLICIT_PSTREAM 0xFF
++#define WMI_MAX_THINSTREAM 15
+
-+ /* Insert into the hash list i.e. the bucket */
-+ if((ni->ni_hash_next = nt->nt_hash[hash]) != NULL)
-+ {
-+ nt->nt_hash[hash]->ni_hash_prev = ni;
-+ }
-+ ni->ni_hash_prev = NULL;
-+ nt->nt_hash[hash] = ni;
++struct host_app_area_s {
++ A_UINT32 wmi_protocol_ver;
++};
+
-+ if (!nt->isTimerArmed) {
-+ A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
-+ nt->isTimerArmed = TRUE;
-+ }
++/*
++ * Data Path
++ */
++typedef PREPACK struct {
++ A_UINT8 dstMac[ATH_MAC_LEN];
++ A_UINT8 srcMac[ATH_MAC_LEN];
++ A_UINT16 typeOrLen;
++} POSTPACK ATH_MAC_HDR;
+
-+ IEEE80211_NODE_UNLOCK_BH(nt);
-+}
++typedef PREPACK struct {
++ A_UINT8 dsap;
++ A_UINT8 ssap;
++ A_UINT8 cntl;
++ A_UINT8 orgCode[3];
++ A_UINT16 etherType;
++} POSTPACK ATH_LLC_SNAP_HDR;
+
-+static bss_t *
-+_ieee80211_find_node(struct ieee80211_node_table *nt,
-+ const A_UINT8 *macaddr)
-+{
-+ bss_t *ni;
-+ int hash;
++typedef enum {
++ DATA_MSGTYPE = 0x0,
++ CNTL_MSGTYPE,
++ SYNC_MSGTYPE
++} WMI_MSG_TYPE;
+
-+ IEEE80211_NODE_LOCK_ASSERT(nt);
+
-+ hash = IEEE80211_NODE_HASH(macaddr);
-+ for(ni = nt->nt_hash[hash]; ni; ni = ni->ni_hash_next) {
-+ if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
-+ ieee80211_node_incref(ni); /* mark referenced */
-+ return ni;
-+ }
-+ }
-+ return NULL;
-+}
++typedef PREPACK struct {
++ A_INT8 rssi;
++ A_UINT8 info; /* WMI_MSG_TYPE in lower 2 bits - b1b0 */
++ /* UP in next 3 bits - b4b3b2 */
++#define WMI_DATA_HDR_MSG_TYPE_MASK 0x03
++#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
++#define WMI_DATA_HDR_UP_MASK 0x07
++#define WMI_DATA_HDR_UP_SHIFT 2
++#define WMI_DATA_HDR_IS_MSG_TYPE(h, t) (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
++} POSTPACK WMI_DATA_HDR;
+
-+bss_t *
-+wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr)
-+{
-+ bss_t *ni;
+
-+ IEEE80211_NODE_LOCK(nt);
-+ ni = _ieee80211_find_node(nt, macaddr);
-+ IEEE80211_NODE_UNLOCK(nt);
-+ return ni;
-+}
++#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
++#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
+
+/*
-+ * Reclaim a node. If this is the last reference count then
-+ * do the normal free work. Otherwise remove it from the node
-+ * table and mark it gone by clearing the back-reference.
++ * Control Path
+ */
-+void
-+wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni)
-+{
-+ IEEE80211_NODE_LOCK(nt);
-+
-+ if(ni->ni_list_prev == NULL)
-+ {
-+ /* First in list so fix the list head */
-+ nt->nt_node_first = ni->ni_list_next;
-+ }
-+ else
-+ {
-+ ni->ni_list_prev->ni_list_next = ni->ni_list_next;
-+ }
-+
-+ if(ni->ni_list_next == NULL)
-+ {
-+ /* Last in list so fix list tail */
-+ nt->nt_node_last = ni->ni_list_prev;
-+ }
-+ else
-+ {
-+ ni->ni_list_next->ni_list_prev = ni->ni_list_prev;
-+ }
-+
-+ if(ni->ni_hash_prev == NULL)
-+ {
-+ /* First in list so fix the list head */
-+ int hash;
-+ hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
-+ nt->nt_hash[hash] = ni->ni_hash_next;
-+ }
-+ else
-+ {
-+ ni->ni_hash_prev->ni_hash_next = ni->ni_hash_next;
-+ }
-+
-+ if(ni->ni_hash_next != NULL)
-+ {
-+ ni->ni_hash_next->ni_hash_prev = ni->ni_hash_prev;
-+ }
-+ wlan_node_free(ni);
-+
-+ IEEE80211_NODE_UNLOCK(nt);
-+}
-+
-+static void
-+wlan_node_dec_free(bss_t *ni)
-+{
-+ if (ieee80211_node_dectestref(ni)) {
-+ wlan_node_free(ni);
-+ }
-+}
++typedef PREPACK struct {
++ A_UINT16 commandId;
++} POSTPACK WMI_CMD_HDR; /* used for commands and events */
+
-+void
-+wlan_free_allnodes(struct ieee80211_node_table *nt)
-+{
-+ bss_t *ni;
++/*
++ * List of Commnands
++ */
++typedef enum {
++ WMI_CONNECT_CMDID = 0x0001,
++ WMI_RECONNECT_CMDID,
++ WMI_DISCONNECT_CMDID,
++ WMI_SYNCHRONIZE_CMDID,
++ WMI_CREATE_PSTREAM_CMDID,
++ WMI_DELETE_PSTREAM_CMDID,
++ WMI_START_SCAN_CMDID,
++ WMI_SET_SCAN_PARAMS_CMDID,
++ WMI_SET_BSS_FILTER_CMDID,
++ WMI_SET_PROBED_SSID_CMDID,
++ WMI_SET_LISTEN_INT_CMDID,
++ WMI_SET_BMISS_TIME_CMDID,
++ WMI_SET_DISC_TIMEOUT_CMDID,
++ WMI_GET_CHANNEL_LIST_CMDID,
++ WMI_SET_BEACON_INT_CMDID,
++ WMI_GET_STATISTICS_CMDID,
++ WMI_SET_CHANNEL_PARAMS_CMDID,
++ WMI_SET_POWER_MODE_CMDID,
++ WMI_SET_IBSS_PM_CAPS_CMDID,
++ WMI_SET_POWER_PARAMS_CMDID,
++ WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
++ WMI_ADD_CIPHER_KEY_CMDID,
++ WMI_DELETE_CIPHER_KEY_CMDID,
++ WMI_ADD_KRK_CMDID,
++ WMI_DELETE_KRK_CMDID,
++ WMI_SET_PMKID_CMDID,
++ WMI_SET_TX_PWR_CMDID,
++ WMI_GET_TX_PWR_CMDID,
++ WMI_SET_ASSOC_INFO_CMDID,
++ WMI_ADD_BAD_AP_CMDID,
++ WMI_DELETE_BAD_AP_CMDID,
++ WMI_SET_TKIP_COUNTERMEASURES_CMDID,
++ WMI_RSSI_THRESHOLD_PARAMS_CMDID,
++ WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
++ WMI_SET_ACCESS_PARAMS_CMDID,
++ WMI_SET_RETRY_LIMITS_CMDID,
++ WMI_SET_OPT_MODE_CMDID,
++ WMI_OPT_TX_FRAME_CMDID,
++ WMI_SET_VOICE_PKT_SIZE_CMDID,
++ WMI_SET_MAX_SP_LEN_CMDID,
++ WMI_SET_ROAM_CTRL_CMDID,
++ WMI_GET_ROAM_TBL_CMDID,
++ WMI_GET_ROAM_DATA_CMDID,
++ WMI_ENABLE_RM_CMDID,
++ WMI_SET_MAX_OFFHOME_DURATION_CMDID,
++ WMI_EXTENSION_CMDID, /* Non-wireless extensions */
++ WMI_SNR_THRESHOLD_PARAMS_CMDID,
++ WMI_LQ_THRESHOLD_PARAMS_CMDID,
++ WMI_SET_LPREAMBLE_CMDID,
++ WMI_SET_RTS_CMDID,
++ WMI_CLR_RSSI_SNR_CMDID,
++ WMI_SET_FIXRATES_CMDID,
++ WMI_GET_FIXRATES_CMDID,
++ WMI_SET_AUTH_MODE_CMDID,
++ WMI_SET_REASSOC_MODE_CMDID,
++ WMI_SET_WMM_CMDID,
++ WMI_SET_WMM_TXOP_CMDID,
++ WMI_TEST_CMDID,
++ WMI_SET_BT_STATUS_CMDID,
++ WMI_SET_BT_PARAMS_CMDID,
+
-+ while ((ni = nt->nt_node_first) != NULL) {
-+ wlan_node_reclaim(nt, ni);
-+ }
-+}
++ WMI_SET_KEEPALIVE_CMDID,
++ WMI_GET_KEEPALIVE_CMDID,
++ WMI_SET_APPIE_CMDID,
++ WMI_GET_APPIE_CMDID,
++ WMI_SET_WSC_STATUS_CMDID,
+
-+void
-+wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
-+ void *arg)
-+{
-+ bss_t *ni;
-+ A_UINT32 gen;
++ /* Wake on Wireless */
++ WMI_SET_HOST_SLEEP_MODE_CMDID,
++ WMI_SET_WOW_MODE_CMDID,
++ WMI_GET_WOW_LIST_CMDID,
++ WMI_ADD_WOW_PATTERN_CMDID,
++ WMI_DEL_WOW_PATTERN_CMDID,
++ WMI_SET_MAC_ADDRESS_CMDID,
++ WMI_SET_AKMP_PARAMS_CMDID,
++ WMI_SET_PMKID_LIST_CMDID,
++ WMI_GET_PMKID_LIST_CMDID,
+
-+ gen = ++nt->nt_scangen;
++ /*
++ * Developer commands starts at 0xF000
++ */
++ WMI_SET_BITRATE_CMDID = 0xF000,
++ WMI_GET_BITRATE_CMDID,
++ WMI_SET_WHALPARAM_CMDID,
+
-+ IEEE80211_NODE_LOCK(nt);
-+ for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
-+ if (ni->ni_scangen != gen) {
-+ ni->ni_scangen = gen;
-+ (void) ieee80211_node_incref(ni);
-+ (*f)(arg, ni);
-+ wlan_node_dec_free(ni);
-+ }
-+ }
-+ IEEE80211_NODE_UNLOCK(nt);
-+}
++} WMI_COMMAND_ID;
+
+/*
-+ * Node table support.
++ * Frame Types
+ */
-+void
-+wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt)
-+{
-+ int i;
++typedef enum {
++ WMI_FRAME_BEACON = 0,
++ WMI_FRAME_PROBE_REQ,
++ WMI_FRAME_PROBE_RESP,
++ WMI_FRAME_ASSOC_REQ,
++ WMI_FRAME_ASSOC_RESP,
++ WMI_NUM_MGMT_FRAME
++} WMI_MGMT_FRAME_TYPE;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WLAN, ("node table = 0x%x\n", (A_UINT32)nt));
-+ IEEE80211_NODE_LOCK_INIT(nt);
++/*
++ * Connect Command
++ */
++typedef enum {
++ INFRA_NETWORK = 0x01,
++ ADHOC_NETWORK = 0x02,
++ ADHOC_CREATOR = 0x04,
++} NETWORK_TYPE;
+
-+ nt->nt_node_first = nt->nt_node_last = NULL;
-+ for(i = 0; i < IEEE80211_NODE_HASHSIZE; i++)
-+ {
-+ nt->nt_hash[i] = NULL;
-+ }
-+ A_INIT_TIMER(&nt->nt_inact_timer, wlan_node_timeout, nt);
-+ nt->isTimerArmed = FALSE;
-+ nt->nt_wmip = wmip;
-+}
++typedef enum {
++ OPEN_AUTH = 0x01,
++ SHARED_AUTH = 0x02,
++ LEAP_AUTH = 0x04, /* different from IEEE_AUTH_MODE definitions */
++} DOT11_AUTH_MODE;
+
-+static void
-+wlan_node_timeout(A_ATH_TIMER arg)
-+{
-+ struct ieee80211_node_table *nt = (struct ieee80211_node_table *)arg;
-+ bss_t *bss, *nextBss;
-+ A_UINT8 myBssid[IEEE80211_ADDR_LEN], reArmTimer = FALSE;
++typedef enum {
++ NONE_AUTH = 0x01,
++ WPA_AUTH = 0x02,
++ WPA_PSK_AUTH = 0x03,
++ WPA2_AUTH = 0x04,
++ WPA2_PSK_AUTH = 0x05,
++ WPA_AUTH_CCKM = 0x06,
++ WPA2_AUTH_CCKM = 0x07,
++} AUTH_MODE;
+
-+ wmi_get_current_bssid(nt->nt_wmip, myBssid);
++typedef enum {
++ NONE_CRYPT = 0x01,
++ WEP_CRYPT = 0x02,
++ TKIP_CRYPT = 0x03,
++ AES_CRYPT = 0x04,
++} CRYPTO_TYPE;
+
-+ bss = nt->nt_node_first;
-+ while (bss != NULL)
-+ {
-+ nextBss = bss->ni_list_next;
-+ if (A_MEMCMP(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
-+ {
++#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
++#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
+
-+ if (bss->ni_tstamp <= A_GET_MS(0))
-+ {
-+ /*
-+ * free up all but the current bss - if set
-+ */
-+ wlan_node_reclaim(nt, bss);
-+ }
-+ else
-+ {
-+ /*
-+ * Re-arm timer, only when we have a bss other than
-+ * current bss AND it is not aged-out.
-+ */
-+ reArmTimer = TRUE;
-+ }
-+ }
-+ bss = nextBss;
-+ }
++#define WMI_MIN_KEY_INDEX 0
++#define WMI_MAX_KEY_INDEX 3
+
-+ if(reArmTimer)
-+ A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
++#define WMI_MAX_KEY_LEN 32
+
-+ nt->isTimerArmed = reArmTimer;
-+}
++#define WMI_MAX_SSID_LEN 32
+
-+void
-+wlan_node_table_cleanup(struct ieee80211_node_table *nt)
-+{
-+ A_UNTIMEOUT(&nt->nt_inact_timer);
-+ A_DELETE_TIMER(&nt->nt_inact_timer);
-+ wlan_free_allnodes(nt);
-+ IEEE80211_NODE_LOCK_DESTROY(nt);
-+}
++typedef enum {
++ CONNECT_ASSOC_POLICY_USER = 0x0001,
++ CONNECT_SEND_REASSOC = 0x0002,
++ CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
++ CONNECT_PROFILE_MATCH_DONE = 0x0008,
++ CONNECT_IGNORE_AAC_BEACON = 0x0010,
++ CONNECT_CSA_FOLLOW_BSS = 0x0020,
++} WMI_CONNECT_CTRL_FLAGS_BITS;
+
-+bss_t *
-+wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
-+ A_UINT32 ssidLength, A_BOOL bIsWPA2)
-+{
-+ bss_t *ni = NULL;
-+ A_UCHAR *pIESsid = NULL;
++#define DEFAULT_CONNECT_CTRL_FLAGS (CONNECT_CSA_FOLLOW_BSS)
+
-+ IEEE80211_NODE_LOCK (nt);
++typedef PREPACK struct {
++ A_UINT8 networkType;
++ A_UINT8 dot11AuthMode;
++ A_UINT8 authMode;
++ A_UINT8 pairwiseCryptoType;
++ A_UINT8 pairwiseCryptoLen;
++ A_UINT8 groupCryptoType;
++ A_UINT8 groupCryptoLen;
++ A_UINT8 ssidLength;
++ A_UCHAR ssid[WMI_MAX_SSID_LEN];
++ A_UINT16 channel;
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT32 ctrl_flags;
++} POSTPACK WMI_CONNECT_CMD;
+
-+ for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
-+ pIESsid = ni->ni_cie.ie_ssid;
-+ if (pIESsid[1] <= 32) {
++/*
++ * WMI_RECONNECT_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT16 channel; /* hint */
++ A_UINT8 bssid[ATH_MAC_LEN]; /* mandatory if set */
++} POSTPACK WMI_RECONNECT_CMD;
+
-+ // Step 1 : Check SSID
-+ if (0x00 == memcmp (pSsid, &pIESsid[2], ssidLength)) {
++/*
++ * WMI_ADD_CIPHER_KEY_CMDID
++ */
++typedef enum {
++ PAIRWISE_USAGE = 0x00,
++ GROUP_USAGE = 0x01,
++ TX_USAGE = 0x02, /* default Tx Key - Static WEP only */
++} KEY_USAGE;
+
-+ // Step 2 : if SSID matches, check WPA or WPA2
-+ if (TRUE == bIsWPA2 && NULL != ni->ni_cie.ie_rsn) {
-+ ieee80211_node_incref (ni); /* mark referenced */
-+ IEEE80211_NODE_UNLOCK (nt);
-+ return ni;
-+ }
-+ if (FALSE == bIsWPA2 && NULL != ni->ni_cie.ie_wpa) {
-+ ieee80211_node_incref(ni); /* mark referenced */
-+ IEEE80211_NODE_UNLOCK (nt);
-+ return ni;
-+ }
-+ }
-+ }
-+ }
++/*
++ * Bit Flag
++ * Bit 0 - Initialise TSC - default is Initialize
++ */
++#define KEY_OP_INIT_TSC 0x01
++#define KEY_OP_INIT_RSC 0x02
+
-+ IEEE80211_NODE_UNLOCK (nt);
++#define KEY_OP_INIT_VAL 0x03 /* Default Initialise the TSC & RSC */
++#define KEY_OP_VALID_MASK 0x03
+
-+ return NULL;
-+}
++typedef PREPACK struct {
++ A_UINT8 keyIndex;
++ A_UINT8 keyType;
++ A_UINT8 keyUsage; /* KEY_USAGE */
++ A_UINT8 keyLength;
++ A_UINT8 keyRSC[8]; /* key replay sequence counter */
++ A_UINT8 key[WMI_MAX_KEY_LEN];
++ A_UINT8 key_op_ctrl; /* Additional Key Control information */
++} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
+
-+void
-+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni)
-+{
-+ IEEE80211_NODE_LOCK (nt);
-+ wlan_node_dec_free (ni);
-+ IEEE80211_NODE_UNLOCK (nt);
-+}
-diff --git a/drivers/ar6000/wlan/wlan_recv_beacon.c b/drivers/ar6000/wlan/wlan_recv_beacon.c
-new file mode 100644
-index 0000000..15beabb
---- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_recv_beacon.c
-@@ -0,0 +1,192 @@
-+/*-
-+ * Copyright (c) 2001 Atsushi Onoe
-+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
-+ * All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. The name of the author may not be used to endorse or promote products
-+ * derived from this software without specific prior written permission.
-+ *
-+ * Alternatively, this software may be distributed under the terms of the
-+ * GNU General Public License ("GPL") version 2 as published by the Free
-+ * Software Foundation.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++/*
++ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
++typedef PREPACK struct {
++ A_UINT8 keyIndex;
++} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
++
++#define WMI_KRK_LEN 16
+/*
-+ * IEEE 802.11 input handling.
++ * WMI_ADD_KRK_CMDID
+ */
++typedef PREPACK struct {
++ A_UINT8 krk[WMI_KRK_LEN];
++} POSTPACK WMI_ADD_KRK_CMD;
+
-+#include "a_config.h"
-+#include "athdefs.h"
-+#include "a_types.h"
-+#include "a_osapi.h"
-+#include <wmi.h>
-+#include <ieee80211.h>
-+#include <wlan_api.h>
++/*
++ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
++ */
++typedef enum {
++ WMI_TKIP_CM_DISABLE = 0x0,
++ WMI_TKIP_CM_ENABLE = 0x1,
++} WMI_TKIP_CM_CONTROL;
+
-+#define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \
-+ if ((_len) < (_minlen)) { \
-+ return A_EINVAL; \
-+ } \
-+} while (0)
++typedef PREPACK struct {
++ A_UINT8 cm_en; /* WMI_TKIP_CM_CONTROL */
++} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
+
-+#define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \
-+ if ((__elem) == NULL) { \
-+ return A_EINVAL; \
-+ } \
-+ if ((__elem)[1] > (__maxlen)) { \
-+ return A_EINVAL; \
-+ } \
-+} while (0)
++/*
++ * WMI_SET_PMKID_CMDID
++ */
+
++#define WMI_PMKID_LEN 16
+
-+/* unaligned little endian access */
-+#define LE_READ_2(p) \
-+ ((A_UINT16) \
-+ ((((A_UINT8 *)(p))[0] ) | (((A_UINT8 *)(p))[1] << 8)))
++typedef enum {
++ PMKID_DISABLE = 0,
++ PMKID_ENABLE = 1,
++} PMKID_ENABLE_FLG;
+
-+#define LE_READ_4(p) \
-+ ((A_UINT32) \
-+ ((((A_UINT8 *)(p))[0] ) | (((A_UINT8 *)(p))[1] << 8) | \
-+ (((A_UINT8 *)(p))[2] << 16) | (((A_UINT8 *)(p))[3] << 24)))
++typedef PREPACK struct {
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT8 enable; /* PMKID_ENABLE_FLG */
++ A_UINT8 pmkid[WMI_PMKID_LEN];
++} POSTPACK WMI_SET_PMKID_CMD;
+
++/*
++ * WMI_START_SCAN_CMD
++ */
++typedef enum {
++ WMI_LONG_SCAN = 0,
++ WMI_SHORT_SCAN = 1,
++} WMI_SCAN_TYPE;
+
-+static int __inline
-+iswpaoui(const A_UINT8 *frm)
-+{
-+ return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
-+}
++typedef PREPACK struct {
++ A_BOOL forceFgScan;
++ A_BOOL isLegacy; /* For Legacy Cisco AP compatibility */
++ A_UINT32 homeDwellTime; /* Maximum duration in the home channel(milliseconds) */
++ A_UINT32 forceScanInterval; /* Time interval between scans (milliseconds)*/
++ A_UINT8 scanType; /* WMI_SCAN_TYPE */
++} POSTPACK WMI_START_SCAN_CMD;
+
-+static int __inline
-+iswmmoui(const A_UINT8 *frm)
-+{
-+ return frm[1] > 3 && LE_READ_4(frm+2) == ((WMM_OUI_TYPE<<24)|WMM_OUI);
-+}
++/*
++ * WMI_SET_SCAN_PARAMS_CMDID
++ */
++#define WMI_SHORTSCANRATIO_DEFAULT 3
++typedef enum {
++ CONNECT_SCAN_CTRL_FLAGS = 0x01, /* set if can scan in the Connect cmd */
++ SCAN_CONNECTED_CTRL_FLAGS = 0x02, /* set if scan for the SSID it is */
++ /* already connected to */
++ ACTIVE_SCAN_CTRL_FLAGS = 0x04, /* set if enable active scan */
++ ROAM_SCAN_CTRL_FLAGS = 0x08, /* set if enable roam scan when bmiss and lowrssi */
++ REPORT_BSSINFO_CTRL_FLAGS = 0x10, /* set if follows customer BSSINFO reporting rule */
++ ENABLE_AUTO_CTRL_FLAGS = 0x20, /* if disabled, target doesn't
++ scan after a disconnect event */
++ ENABLE_SCAN_ABORT_EVENT = 0x40 /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
+
-+static int __inline
-+iswmmparam(const A_UINT8 *frm)
-+{
-+ return frm[1] > 5 && frm[6] == WMM_PARAM_OUI_SUBTYPE;
-+}
++} WMI_SCAN_CTRL_FLAGS_BITS;
+
-+static int __inline
-+iswmminfo(const A_UINT8 *frm)
-+{
-+ return frm[1] > 5 && frm[6] == WMM_INFO_OUI_SUBTYPE;
-+}
++#define CAN_SCAN_IN_CONNECT(flags) (flags & CONNECT_SCAN_CTRL_FLAGS)
++#define CAN_SCAN_CONNECTED(flags) (flags & SCAN_CONNECTED_CTRL_FLAGS)
++#define ENABLE_ACTIVE_SCAN(flags) (flags & ACTIVE_SCAN_CTRL_FLAGS)
++#define ENABLE_ROAM_SCAN(flags) (flags & ROAM_SCAN_CTRL_FLAGS)
++#define CONFIG_REPORT_BSSINFO(flags) (flags & REPORT_BSSINFO_CTRL_FLAGS)
++#define IS_AUTO_SCAN_ENABLED(flags) (flags & ENABLE_AUTO_CTRL_FLAGS)
++#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
+
-+static int __inline
-+isatherosoui(const A_UINT8 *frm)
-+{
-+ return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
-+}
++#define DEFAULT_SCAN_CTRL_FLAGS (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
+
-+static int __inline
-+iswscoui(const A_UINT8 *frm)
-+{
-+ return frm[1] > 3 && LE_READ_4(frm+2) == ((0x04<<24)|WPA_OUI);
-+}
+
-+A_STATUS
-+wlan_parse_beacon(A_UINT8 *buf, int framelen, struct ieee80211_common_ie *cie)
-+{
-+ A_UINT8 *frm, *efrm;
++typedef PREPACK struct {
++ A_UINT16 fg_start_period; /* seconds */
++ A_UINT16 fg_end_period; /* seconds */
++ A_UINT16 bg_period; /* seconds */
++ A_UINT16 maxact_chdwell_time; /* msec */
++ A_UINT16 pas_chdwell_time; /* msec */
++ A_UINT8 shortScanRatio; /* how many shorts scan for one long */
++ A_UINT8 scanCtrlFlags;
++ A_UINT16 minact_chdwell_time; /* msec */
++ A_UINT32 max_dfsch_act_time; /* msecs */
++} POSTPACK WMI_SCAN_PARAMS_CMD;
+
-+ frm = buf;
-+ efrm = (A_UINT8 *) (frm + framelen);
++/*
++ * WMI_SET_BSS_FILTER_CMDID
++ */
++typedef enum {
++ NONE_BSS_FILTER = 0x0, /* no beacons forwarded */
++ ALL_BSS_FILTER, /* all beacons forwarded */
++ PROFILE_FILTER, /* only beacons matching profile */
++ ALL_BUT_PROFILE_FILTER, /* all but beacons matching profile */
++ CURRENT_BSS_FILTER, /* only beacons matching current BSS */
++ ALL_BUT_BSS_FILTER, /* all but beacons matching BSS */
++ PROBED_SSID_FILTER, /* beacons matching probed ssid */
++ LAST_BSS_FILTER, /* marker only */
++} WMI_BSS_FILTER;
+
-+ /*
-+ * beacon/probe response frame format
-+ * [8] time stamp
-+ * [2] beacon interval
-+ * [2] capability information
-+ * [tlv] ssid
-+ * [tlv] supported rates
-+ * [tlv] country information
-+ * [tlv] parameter set (FH/DS)
-+ * [tlv] erp information
-+ * [tlv] extended supported rates
-+ * [tlv] WMM
-+ * [tlv] WPA or RSN
-+ * [tlv] Atheros Advanced Capabilities
-+ */
-+ IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
-+ A_MEMZERO(cie, sizeof(*cie));
++typedef PREPACK struct {
++ A_UINT8 bssFilter; /* see WMI_BSS_FILTER */
++ A_UINT32 ieMask;
++} POSTPACK WMI_BSS_FILTER_CMD;
+
-+ cie->ie_tstamp = frm; frm += 8;
-+ cie->ie_beaconInt = A_LE2CPU16(*(A_UINT16 *)frm); frm += 2;
-+ cie->ie_capInfo = A_LE2CPU16(*(A_UINT16 *)frm); frm += 2;
-+ cie->ie_chan = 0;
++/*
++ * WMI_SET_PROBED_SSID_CMDID
++ */
++#define MAX_PROBED_SSID_INDEX 5
+
-+ while (frm < efrm) {
-+ switch (*frm) {
-+ case IEEE80211_ELEMID_SSID:
-+ cie->ie_ssid = frm;
-+ break;
-+ case IEEE80211_ELEMID_RATES:
-+ cie->ie_rates = frm;
-+ break;
-+ case IEEE80211_ELEMID_COUNTRY:
-+ cie->ie_country = frm;
-+ break;
-+ case IEEE80211_ELEMID_FHPARMS:
-+ break;
-+ case IEEE80211_ELEMID_DSPARMS:
-+ cie->ie_chan = frm[2];
-+ break;
-+ case IEEE80211_ELEMID_TIM:
-+ cie->ie_tim = frm;
-+ break;
-+ case IEEE80211_ELEMID_IBSSPARMS:
-+ break;
-+ case IEEE80211_ELEMID_XRATES:
-+ cie->ie_xrates = frm;
-+ break;
-+ case IEEE80211_ELEMID_ERP:
-+ if (frm[1] != 1) {
-+ //A_PRINTF("Discarding ERP Element - Bad Len\n");
-+ return A_EINVAL;
-+ }
-+ cie->ie_erp = frm[2];
-+ break;
-+ case IEEE80211_ELEMID_RSN:
-+ cie->ie_rsn = frm;
-+ break;
-+ case IEEE80211_ELEMID_VENDOR:
-+ if (iswpaoui(frm)) {
-+ cie->ie_wpa = frm;
-+ } else if (iswmmoui(frm)) {
-+ cie->ie_wmm = frm;
-+ } else if (isatherosoui(frm)) {
-+ cie->ie_ath = frm;
-+ } else if(iswscoui(frm)) {
-+ cie->ie_wsc = frm;
-+ }
-+ break;
-+ default:
-+ break;
-+ }
-+ frm += frm[1] + 2;
-+ }
-+ IEEE80211_VERIFY_ELEMENT(cie->ie_rates, IEEE80211_RATE_MAXSIZE);
-+ IEEE80211_VERIFY_ELEMENT(cie->ie_ssid, IEEE80211_NWID_LEN);
++typedef enum {
++ DISABLE_SSID_FLAG = 0, /* disables entry */
++ SPECIFIC_SSID_FLAG = 0x01, /* probes specified ssid */
++ ANY_SSID_FLAG = 0x02, /* probes for any ssid */
++} WMI_SSID_FLAG;
++
++typedef PREPACK struct {
++ A_UINT8 entryIndex; /* 0 to MAX_PROBED_SSID_INDEX */
++ A_UINT8 flag; /* WMI_SSID_FLG */
++ A_UINT8 ssidLength;
++ A_UINT8 ssid[32];
++} POSTPACK WMI_PROBED_SSID_CMD;
+
-+ return A_OK;
-+}
-diff --git a/drivers/ar6000/wlan/wlan_utils.c b/drivers/ar6000/wlan/wlan_utils.c
-new file mode 100644
-index 0000000..fd5aac9
---- /dev/null
-+++ b/drivers/ar6000/wlan/wlan_utils.c
-@@ -0,0 +1,59 @@
+/*
-+ * Copyright (c) 2004-2005 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This module implements frequently used wlan utilies
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_utils.c#1 $
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * WMI_SET_LISTEN_INT_CMDID
++ * The Listen interval is between 15 and 3000 TUs
+ */
++#define MIN_LISTEN_INTERVAL 15
++#define MAX_LISTEN_INTERVAL 5000
++#define MIN_LISTEN_BEACONS 1
++#define MAX_LISTEN_BEACONS 50
+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
++typedef PREPACK struct {
++ A_UINT16 listenInterval;
++ A_UINT16 numBeacons;
++} POSTPACK WMI_LISTEN_INT_CMD;
+
+/*
-+ * converts ieee channel number to frequency
++ * WMI_SET_BEACON_INT_CMDID
+ */
-+A_UINT16
-+wlan_ieee2freq(int chan)
-+{
-+ if (chan == 14) {
-+ return 2484;
-+ }
-+ if (chan < 14) { /* 0-13 */
-+ return (2407 + (chan*5));
-+ }
-+ if (chan < 27) { /* 15-26 */
-+ return (2512 + ((chan-15)*20));
-+ }
-+ return (5000 + (chan*5));
-+}
++typedef PREPACK struct {
++ A_UINT16 beaconInterval;
++} POSTPACK WMI_BEACON_INT_CMD;
+
+/*
-+ * Converts MHz frequency to IEEE channel number.
++ * WMI_SET_BMISS_TIME_CMDID
++ * valid values are between 1000 and 5000 TUs
+ */
-+A_UINT32
-+wlan_freq2ieee(A_UINT16 freq)
-+{
-+ if (freq == 2484)
-+ return 14;
-+ if (freq < 2484)
-+ return (freq - 2407) / 5;
-+ if (freq < 5000)
-+ return 15 + ((freq - 2512) / 20);
-+ return (freq - 5000) / 5;
-+}
-diff --git a/drivers/ar6000/wmi/wmi.c b/drivers/ar6000/wmi/wmi.c
-new file mode 100644
-index 0000000..d322cf3
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi.c
-@@ -0,0 +1,3954 @@
++
++#define MIN_BMISS_TIME 1000
++#define MAX_BMISS_TIME 5000
++#define MIN_BMISS_BEACONS 1
++#define MAX_BMISS_BEACONS 50
++
++typedef PREPACK struct {
++ A_UINT16 bmissTime;
++ A_UINT16 numBeacons;
++} POSTPACK WMI_BMISS_TIME_CMD;
++
+/*
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This module implements the hardware independent layer of the
-+ * Wireless Module Interface (WMI) protocol.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi.c#3 $
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
++ * WMI_SET_POWER_MODE_CMDID
+ */
++typedef enum {
++ REC_POWER = 0x01,
++ MAX_PERF_POWER,
++} WMI_POWER_MODE;
+
-+#include <a_config.h>
-+#include <athdefs.h>
-+#include <a_types.h>
-+#include <a_osapi.h>
-+#include "htc.h"
-+#include "htc_api.h"
-+#include "wmi.h"
-+#include <ieee80211.h>
-+#include <ieee80211_node.h>
-+#include <wlan_api.h>
-+#include <wmi_api.h>
-+#include "dset_api.h"
-+#include "gpio_api.h"
-+#include "wmi_host.h"
-+#include "a_drv.h"
-+#include "a_drv_api.h"
-+#include "a_debug.h"
-+#include "dbglog_api.h"
++typedef PREPACK struct {
++ A_UINT8 powerMode; /* WMI_POWER_MODE */
++} POSTPACK WMI_POWER_MODE_CMD;
+
-+static A_STATUS wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++/*
++ * WMI_SET_POWER_PARAMS_CMDID
++ */
++typedef enum {
++ IGNORE_DTIM = 0x01,
++ NORMAL_DTIM = 0x02,
++ STICK_DTIM = 0x03,
++} WMI_DTIM_POLICY;
+
-+static A_STATUS wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_sync_point(struct wmi_t *wmip);
-+
-+static A_STATUS wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+
-+static A_STATUS wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+static A_STATUS wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
++typedef PREPACK struct {
++ A_UINT16 idle_period; /* msec */
++ A_UINT16 pspoll_number;
++ A_UINT16 dtim_policy;
++} POSTPACK WMI_POWER_PARAMS_CMD;
+
++typedef PREPACK struct {
++ A_UINT8 power_saving;
++ A_UINT8 ttl; /* number of beacon periods */
++ A_UINT16 atim_windows; /* msec */
++ A_UINT16 timeout_value; /* msec */
++} POSTPACK WMI_IBSS_PM_CAPS_CMD;
+
-+static A_STATUS wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
-+ int len);
-+static A_STATUS
-+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len);
++/*
++ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
++ */
++typedef enum {
++ IGNORE_TIM_ALL_QUEUES_APSD = 0,
++ PROCESS_TIM_ALL_QUEUES_APSD = 1,
++ IGNORE_TIM_SIMULATED_APSD = 2,
++ PROCESS_TIM_SIMULATED_APSD = 3,
++} APSD_TIM_POLICY;
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+static A_STATUS wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+static A_STATUS wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
++typedef PREPACK struct {
++ A_UINT16 psPollTimeout; /* msec */
++ A_UINT16 triggerTimeout; /* msec */
++ A_UINT32 apsdTimPolicy; /* TIM behavior with ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
++ A_UINT32 simulatedAPSDTimPolicy; /* TIM behavior with simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
++} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+static A_STATUS
-+wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
-+#endif
++/*
++ * WMI_SET_VOICE_PKT_SIZE_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT16 voicePktSize;
++} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
+
-+static A_STATUS
-+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++/*
++ * WMI_SET_MAX_SP_LEN_CMDID
++ */
++typedef enum {
++ DELIVER_ALL_PKT = 0x0,
++ DELIVER_2_PKT = 0x1,
++ DELIVER_4_PKT = 0x2,
++ DELIVER_6_PKT = 0x3,
++} APSD_SP_LEN_TYPE;
+
-+static A_STATUS
-+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++typedef PREPACK struct {
++ A_UINT8 maxSPLen;
++} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
+
-+static A_STATUS
-+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++/*
++ * WMI_SET_DISC_TIMEOUT_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 disconnectTimeout; /* seconds */
++} POSTPACK WMI_DISC_TIMEOUT_CMD;
+
-+static A_BOOL
-+wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex);
++typedef enum {
++ UPLINK_TRAFFIC = 0,
++ DNLINK_TRAFFIC = 1,
++ BIDIR_TRAFFIC = 2,
++} DIR_TYPE;
+
-+static A_STATUS
-+wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++typedef enum {
++ DISABLE_FOR_THIS_AC = 0,
++ ENABLE_FOR_THIS_AC = 1,
++ ENABLE_FOR_ALL_AC = 2,
++} VOICEPS_CAP_TYPE;
+
-+static A_STATUS
-+wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++typedef enum {
++ TRAFFIC_TYPE_APERIODIC = 0,
++ TRAFFIC_TYPE_PERIODIC = 1,
++}TRAFFIC_TYPE;
+
-+static A_STATUS wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++/*
++ * WMI_CREATE_PSTREAM_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT32 minServiceInt; /* in milli-sec */
++ A_UINT32 maxServiceInt; /* in milli-sec */
++ A_UINT32 inactivityInt; /* in milli-sec */
++ A_UINT32 suspensionInt; /* in milli-sec */
++ A_UINT32 serviceStartTime;
++ A_UINT32 minDataRate; /* in bps */
++ A_UINT32 meanDataRate; /* in bps */
++ A_UINT32 peakDataRate; /* in bps */
++ A_UINT32 maxBurstSize;
++ A_UINT32 delayBound;
++ A_UINT32 minPhyRate; /* in bps */
++ A_UINT32 sba;
++ A_UINT32 mediumTime;
++ A_UINT16 nominalMSDU; /* in octects */
++ A_UINT16 maxMSDU; /* in octects */
++ A_UINT8 trafficClass;
++ A_UINT8 trafficType; /* TRAFFIC_TYPE */
++ A_UINT8 trafficDirection; /* TRAFFIC_DIR */
++ A_UINT8 voicePSCapability; /* VOICEPS_CAP_TYPE */
++ A_UINT8 tsid;
++ A_UINT8 userPriority; /* 802.1D user priority */
++} POSTPACK WMI_CREATE_PSTREAM_CMD;
+
-+int wps_enable;
-+static const A_INT32 wmi_rateTable[] = {
-+ 1000,
-+ 2000,
-+ 5500,
-+ 11000,
-+ 6000,
-+ 9000,
-+ 12000,
-+ 18000,
-+ 24000,
-+ 36000,
-+ 48000,
-+ 54000,
-+ 0};
++/*
++ * WMI_DELETE_PSTREAM_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 trafficClass;
++ A_UINT8 tsid;
++} POSTPACK WMI_DELETE_PSTREAM_CMD;
+
-+#define MODE_A_SUPPORT_RATE_START 4
-+#define MODE_A_SUPPORT_RATE_STOP 11
++/*
++ * WMI_SET_CHANNEL_PARAMS_CMDID
++ */
++typedef enum {
++ WMI_11A_MODE = 0x1,
++ WMI_11G_MODE = 0x2,
++ WMI_11AG_MODE = 0x3,
++ WMI_11B_MODE = 0x4,
++ WMI_11GONLY_MODE = 0x5,
++} WMI_PHY_MODE;
+
-+#define MODE_GONLY_SUPPORT_RATE_START MODE_A_SUPPORT_RATE_START
-+#define MODE_GONLY_SUPPORT_RATE_STOP MODE_A_SUPPORT_RATE_STOP
++#define WMI_MAX_CHANNELS 32
+
-+#define MODE_B_SUPPORT_RATE_START 0
-+#define MODE_B_SUPPORT_RATE_STOP 3
++typedef PREPACK struct {
++ A_UINT8 reserved1;
++ A_UINT8 scanParam; /* set if enable scan */
++ A_UINT8 phyMode; /* see WMI_PHY_MODE */
++ A_UINT8 numChannels; /* how many channels follow */
++ A_UINT16 channelList[1]; /* channels in Mhz */
++} POSTPACK WMI_CHANNEL_PARAMS_CMD;
+
-+#define MODE_G_SUPPORT_RATE_START 0
-+#define MODE_G_SUPPORT_RATE_STOP 11
+
-+#define MAX_NUMBER_OF_SUPPORT_RATES (MODE_G_SUPPORT_RATE_STOP + 1)
++/*
++ * WMI_RSSI_THRESHOLD_PARAMS_CMDID
++ * Setting the polltime to 0 would disable polling.
++ * Threshold values are in the ascending order, and should agree to:
++ * (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
++ * < highThreshold_upperVal)
++ */
+
-+/* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
-+const A_UINT8 up_to_ac[]= {
-+ WMM_AC_BE,
-+ WMM_AC_BK,
-+ WMM_AC_BK,
-+ WMM_AC_BE,
-+ WMM_AC_VI,
-+ WMM_AC_VI,
-+ WMM_AC_VO,
-+ WMM_AC_VO,
-+ };
++typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
++ A_UINT32 pollTime; /* Polling time as a factor of LI */
++ A_INT16 thresholdAbove1_Val; /* lowest of upper */
++ A_INT16 thresholdAbove2_Val;
++ A_INT16 thresholdAbove3_Val;
++ A_INT16 thresholdAbove4_Val;
++ A_INT16 thresholdAbove5_Val;
++ A_INT16 thresholdAbove6_Val; /* highest of upper */
++ A_INT16 thresholdBelow1_Val; /* lowest of bellow */
++ A_INT16 thresholdBelow2_Val;
++ A_INT16 thresholdBelow3_Val;
++ A_INT16 thresholdBelow4_Val;
++ A_INT16 thresholdBelow5_Val;
++ A_INT16 thresholdBelow6_Val; /* highest of bellow */
++ A_UINT8 weight; /* "alpha" */
++ A_UINT8 reserved[3];
++} POSTPACK WMI_RSSI_THRESHOLD_PARAMS_CMD;
+
-+void *
-+wmi_init(void *devt)
-+{
-+ struct wmi_t *wmip;
++/*
++ * WMI_SNR_THRESHOLD_PARAMS_CMDID
++ * Setting the polltime to 0 would disable polling.
++ */
+
-+ wmip = A_MALLOC(sizeof(struct wmi_t));
-+ if (wmip == NULL) {
-+ return (NULL);
-+ }
-+ A_MEMZERO(wmip, sizeof(*wmip));
-+ A_MUTEX_INIT(&wmip->wmi_lock);
-+ wmip->wmi_devt = devt;
-+ wlan_node_table_init(wmip, &wmip->wmi_scan_table);
-+ wmi_qos_state_init(wmip);
-+ wmip->wmi_powerMode = REC_POWER;
-+ wmip->wmi_phyMode = WMI_11G_MODE;
++typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
++ A_UINT32 pollTime; /* Polling time as a factor of LI */
++ A_UINT8 weight; /* "alpha" */
++ A_UINT8 thresholdAbove1_Val; /* lowest of uppper*/
++ A_UINT8 thresholdAbove2_Val;
++ A_UINT8 thresholdAbove3_Val;
++ A_UINT8 thresholdAbove4_Val; /* highest of upper */
++ A_UINT8 thresholdBelow1_Val; /* lowest of bellow */
++ A_UINT8 thresholdBelow2_Val;
++ A_UINT8 thresholdBelow3_Val;
++ A_UINT8 thresholdBelow4_Val; /* highest of bellow */
++ A_UINT8 reserved[3];
++} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
+
-+ return (wmip);
-+}
++/*
++ * WMI_LQ_THRESHOLD_PARAMS_CMDID
++ */
++typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
++ A_UINT8 enable;
++ A_UINT8 thresholdAbove1_Val;
++ A_UINT8 thresholdAbove2_Val;
++ A_UINT8 thresholdAbove3_Val;
++ A_UINT8 thresholdAbove4_Val;
++ A_UINT8 thresholdBelow1_Val;
++ A_UINT8 thresholdBelow2_Val;
++ A_UINT8 thresholdBelow3_Val;
++ A_UINT8 thresholdBelow4_Val;
++ A_UINT8 reserved[3];
++} POSTPACK WMI_LQ_THRESHOLD_PARAMS_CMD;
+
-+void
-+wmi_qos_state_init(struct wmi_t *wmip)
-+{
-+ A_UINT8 i;
++typedef enum {
++ WMI_LPREAMBLE_DISABLED = 0,
++ WMI_LPREAMBLE_ENABLED
++} WMI_LPREAMBLE_STATUS;
+
-+ if (wmip == NULL) {
-+ return;
-+ }
-+ LOCK_WMI(wmip);
++typedef PREPACK struct {
++ A_UINT8 status;
++}POSTPACK WMI_SET_LPREAMBLE_CMD;
+
-+ /* Initialize QoS States */
-+ wmip->wmi_numQoSStream = 0;
++typedef PREPACK struct {
++ A_UINT16 threshold;
++}POSTPACK WMI_SET_RTS_CMD;
+
-+ wmip->wmi_fatPipeExists = 0;
++/*
++ * WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
++ * Sets the error reporting event bitmask in target. Target clears it
++ * upon an error. Subsequent errors are counted, but not reported
++ * via event, unless the bitmask is set again.
++ */
++typedef PREPACK struct {
++ A_UINT32 bitmask;
++} POSTPACK WMI_TARGET_ERROR_REPORT_BITMASK;
+
-+ for (i=0; i < WMM_NUM_AC; i++) {
-+ wmip->wmi_streamExistsForAC[i]=0;
-+ }
++/*
++ * WMI_SET_TX_PWR_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 dbM; /* in dbM units */
++} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
+
-+ /* Initialize the static Wmi stream Pri to WMM AC mappings Arrays */
-+ WMI_INIT_WMISTREAM_AC_MAP(wmip);
++/*
++ * WMI_SET_ASSOC_INFO_CMDID
++ *
++ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
++ * A 3rd one, the CCX version IE can also be set from the host.
++ */
++#define WMI_MAX_ASSOC_INFO_TYPE 2
++#define WMI_CCX_VER_IE 2 /* ieType to set CCX Version IE */
+
-+ UNLOCK_WMI(wmip);
++#define WMI_MAX_ASSOC_INFO_LEN 240
+
-+ A_WMI_SET_NUMDATAENDPTS(wmip->wmi_devt, 1);
-+}
++typedef PREPACK struct {
++ A_UINT8 ieType;
++ A_UINT8 bufferSize;
++ A_UINT8 assocInfo[1]; /* up to WMI_MAX_ASSOC_INFO_LEN */
++} POSTPACK WMI_SET_ASSOC_INFO_CMD;
+
-+void
-+wmi_shutdown(struct wmi_t *wmip)
-+{
-+ if (wmip != NULL) {
-+ wlan_node_table_cleanup(&wmip->wmi_scan_table);
-+ if (A_IS_MUTEX_VALID(&wmip->wmi_lock)) {
-+ A_MUTEX_DELETE(&wmip->wmi_lock);
-+ }
-+ A_FREE(wmip);
-+ }
-+}
+
+/*
-+ * performs DIX to 802.3 encapsulation for transmit packets.
-+ * uses passed in buffer. Returns buffer or NULL if failed.
-+ * Assumes the entire DIX header is contigous and that there is
-+ * enough room in the buffer for a 802.3 mac header and LLC+SNAP headers.
++ * WMI_GET_TX_PWR_CMDID does not take any parameters
+ */
-+A_STATUS
-+wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf)
-+{
-+ A_UINT8 *datap;
-+ A_UINT16 typeorlen;
-+ ATH_MAC_HDR macHdr;
-+ ATH_LLC_SNAP_HDR *llcHdr;
+
-+ A_ASSERT(osbuf != NULL);
++/*
++ * WMI_ADD_BAD_AP_CMDID
++ */
++#define WMI_MAX_BAD_AP_INDEX 1
+
-+ if (A_NETBUF_HEADROOM(osbuf) <
-+ (sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR)))
-+ {
-+ return A_NO_MEMORY;
-+ }
++typedef PREPACK struct {
++ A_UINT8 badApIndex; /* 0 to WMI_MAX_BAD_AP_INDEX */
++ A_UINT8 bssid[ATH_MAC_LEN];
++} POSTPACK WMI_ADD_BAD_AP_CMD;
+
-+ datap = A_NETBUF_DATA(osbuf);
++/*
++ * WMI_DELETE_BAD_AP_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 badApIndex; /* 0 to WMI_MAX_BAD_AP_INDEX */
++} POSTPACK WMI_DELETE_BAD_AP_CMD;
+
-+ typeorlen = *(A_UINT16 *)(datap + ATH_MAC_LEN + ATH_MAC_LEN);
++/*
++ * WMI_SET_ACCESS_PARAMS_CMDID
++ */
++#define WMI_DEFAULT_TXOP_ACPARAM 0 /* implies one MSDU */
++#define WMI_DEFAULT_ECWMIN_ACPARAM 4 /* corresponds to CWmin of 15 */
++#define WMI_DEFAULT_ECWMAX_ACPARAM 10 /* corresponds to CWmax of 1023 */
++#define WMI_MAX_CW_ACPARAM 15 /* maximum eCWmin or eCWmax */
++#define WMI_DEFAULT_AIFSN_ACPARAM 2
++#define WMI_MAX_AIFSN_ACPARAM 15
++typedef PREPACK struct {
++ A_UINT16 txop; /* in units of 32 usec */
++ A_UINT8 eCWmin;
++ A_UINT8 eCWmax;
++ A_UINT8 aifsn;
++} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
+
-+ if (!IS_ETHERTYPE(A_BE2CPU16(typeorlen))) {
-+ /*
-+ * packet is already in 802.3 format - return success
-+ */
-+ A_DPRINTF(DBG_WMI, (DBGFMT "packet already 802.3\n", DBGARG));
-+ return (A_OK);
-+ }
+
-+ /*
-+ * Save mac fields and length to be inserted later
-+ */
-+ A_MEMCPY(macHdr.dstMac, datap, ATH_MAC_LEN);
-+ A_MEMCPY(macHdr.srcMac, datap + ATH_MAC_LEN, ATH_MAC_LEN);
-+ macHdr.typeOrLen = A_CPU2BE16(A_NETBUF_LEN(osbuf) - sizeof(ATH_MAC_HDR) +
-+ sizeof(ATH_LLC_SNAP_HDR));
++/*
++ * WMI_SET_RETRY_LIMITS_CMDID
++ *
++ * This command is used to customize the number of retries the
++ * wlan device will perform on a given frame.
++ */
++#define WMI_MIN_RETRIES 2
++#define WMI_MAX_RETRIES 13
++typedef enum {
++ MGMT_FRAMETYPE = 0,
++ CONTROL_FRAMETYPE = 1,
++ DATA_FRAMETYPE = 2
++} WMI_FRAMETYPE;
+
-+ /*
-+ * Make room for LLC+SNAP headers
-+ */
-+ if (A_NETBUF_PUSH(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
-+ }
++typedef PREPACK struct {
++ A_UINT8 frameType; /* WMI_FRAMETYPE */
++ A_UINT8 trafficClass; /* applies only to DATA_FRAMETYPE */
++ A_UINT8 maxRetries;
++ A_UINT8 enableNotify;
++} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
+
-+ datap = A_NETBUF_DATA(osbuf);
++/*
++ * WMI_SET_ROAM_CTRL_CMDID
++ *
++ * This command is used to influence the Roaming behaviour
++ * Set the host biases of the BSSs before setting the roam mode as bias
++ * based.
++ */
+
-+ A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
++/*
++ * Different types of Roam Control
++ */
+
-+ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
-+ llcHdr->dsap = 0xAA;
-+ llcHdr->ssap = 0xAA;
-+ llcHdr->cntl = 0x03;
-+ llcHdr->orgCode[0] = 0x0;
-+ llcHdr->orgCode[1] = 0x0;
-+ llcHdr->orgCode[2] = 0x0;
-+ llcHdr->etherType = typeorlen;
++typedef enum {
++ WMI_FORCE_ROAM = 1, /* Roam to the specified BSSID */
++ WMI_SET_ROAM_MODE = 2, /* default ,progd bias, no roam */
++ WMI_SET_HOST_BIAS = 3, /* Set the Host Bias */
++ WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
++} WMI_ROAM_CTRL_TYPE;
+
-+ return (A_OK);
-+}
++#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
++#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
+
+/*
-+ * Adds a WMI data header
-+ * Assumes there is enough room in the buffer to add header.
++ * ROAM MODES
+ */
-+A_STATUS
-+wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType)
-+{
-+ WMI_DATA_HDR *dtHdr;
+
-+ A_ASSERT(osbuf != NULL);
++typedef enum {
++ WMI_DEFAULT_ROAM_MODE = 1, /* RSSI based ROAM */
++ WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
++ WMI_LOCK_BSS_MODE = 3 /* Lock to the Current BSS - no Roam */
++} WMI_ROAM_MODE;
+
-+ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
-+ }
++/*
++ * BSS HOST BIAS INFO
++ */
+
-+ dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
-+ dtHdr->info = msgType;
-+ dtHdr->rssi = 0;
++typedef PREPACK struct {
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_INT8 bias;
++} POSTPACK WMI_BSS_BIAS;
+
-+ return (A_OK);
-+}
++typedef PREPACK struct {
++ A_UINT8 numBss;
++ WMI_BSS_BIAS bssBias[1];
++} POSTPACK WMI_BSS_BIAS_INFO;
+
-+A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up)
-+{
-+ A_UINT8 *datap;
-+ A_UINT8 trafficClass = WMM_AC_BE, userPriority = up;
-+ ATH_LLC_SNAP_HDR *llcHdr;
-+ A_UINT16 ipType = IP_ETHERTYPE;
-+ WMI_DATA_HDR *dtHdr;
-+ WMI_CREATE_PSTREAM_CMD cmd;
-+ A_BOOL streamExists = FALSE;
++typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
++ A_UINT16 lowrssi_scan_period;
++ A_INT16 lowrssi_scan_threshold;
++ A_INT16 lowrssi_roam_threshold;
++ A_UINT8 roam_rssi_floor;
++ A_UINT8 reserved[1]; /* For alignment */
++} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
+
-+ A_ASSERT(osbuf != NULL);
++typedef PREPACK struct {
++ PREPACK union {
++ A_UINT8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
++ A_UINT8 roamMode; /* WMI_SET_ROAM_MODE */
++ WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
++ WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
++ } POSTPACK info;
++ A_UINT8 roamCtrlType ;
++} POSTPACK WMI_SET_ROAM_CTRL_CMD;
+
-+ datap = A_NETBUF_DATA(osbuf);
++/*
++ * WMI_ENABLE_RM_CMDID
++ */
++typedef PREPACK struct {
++ A_BOOL enable_radio_measurements;
++} POSTPACK WMI_ENABLE_RM_CMD;
+
-+ if (up == UNDEFINED_PRI) {
-+ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(WMI_DATA_HDR) +
-+ sizeof(ATH_MAC_HDR));
++/*
++ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 max_offhome_duration;
++} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
+
-+ if (llcHdr->etherType == A_CPU2BE16(ipType)) {
-+ /* Extract the endpoint info from the TOS field in the IP header */
-+ userPriority = A_WMI_IPTOS_TO_USERPRIORITY(((A_UINT8 *)llcHdr) + sizeof(ATH_LLC_SNAP_HDR));
-+ }
-+ }
++typedef PREPACK struct {
++ A_UINT32 frequency;
++ A_UINT8 threshold;
++} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
+
-+ if (userPriority < MAX_NUM_PRI) {
-+ trafficClass = convert_userPriority_to_trafficClass(userPriority);
-+ }
++typedef enum {
++ BT_STREAM_UNDEF = 0,
++ BT_STREAM_SCO, /* SCO stream */
++ BT_STREAM_A2DP, /* A2DP stream */
++ BT_STREAM_MAX
++} BT_STREAM_TYPE;
+
-+ dtHdr = (WMI_DATA_HDR *)datap;
-+ if(dir==UPLINK_TRAFFIC)
-+ dtHdr->info |= (userPriority & WMI_DATA_HDR_UP_MASK) << WMI_DATA_HDR_UP_SHIFT; /* lower 3-bits are 802.1d priority */
++typedef enum {
++ BT_PARAM_SCO = 1, /* SCO stream parameters */
++ BT_PARAM_A2DP, /* A2DP stream parameters */
++ BT_PARAM_MISC, /* miscellaneous parameters */
++ BT_PARAM_REGS, /* co-existence register parameters */
++ BT_PARAM_MAX
++} BT_PARAM_TYPE;
+
-+ LOCK_WMI(wmip);
-+ streamExists = wmip->wmi_fatPipeExists;
-+ UNLOCK_WMI(wmip);
++typedef enum {
++ BT_STATUS_UNDEF = 0,
++ BT_STATUS_START,
++ BT_STATUS_STOP,
++ BT_STATUS_RESUME,
++ BT_STATUS_SUSPEND,
++ BT_STATUS_MAX
++} BT_STREAM_STATUS;
+
-+ if (!(streamExists & (1 << trafficClass))) {
++typedef PREPACK struct {
++ A_UINT8 streamType;
++ A_UINT8 status;
++} POSTPACK WMI_SET_BT_STATUS_CMD;
+
-+ A_MEMZERO(&cmd, sizeof(cmd));
-+ cmd.trafficClass = trafficClass;
-+ cmd.userPriority = userPriority;
-+ cmd.inactivityInt = WMI_IMPLICIT_PSTREAM_INACTIVITY_INT;
-+ /* Implicit streams are created with TSID 0xFF */
-+ cmd.tsid = WMI_IMPLICIT_PSTREAM;
-+ wmi_create_pstream_cmd(wmip, &cmd);
-+ }
++typedef PREPACK struct {
++ A_UINT8 noSCOPkts;
++ A_UINT8 pspollTimeout;
++ A_UINT8 stompbt;
++} POSTPACK BT_PARAMS_SCO;
+
-+ return trafficClass;
-+}
++typedef PREPACK struct {
++ A_UINT32 period;
++ A_UINT32 dutycycle;
++ A_UINT8 stompbt;
++} POSTPACK BT_PARAMS_A2DP;
+
-+WMI_PRI_STREAM_ID
-+wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass)
-+{
-+ return WMI_ACCESSCATEGORY_WMISTREAM(wmip, trafficClass);
-+}
++typedef PREPACK struct {
++ A_UINT32 mode;
++ A_UINT32 scoWghts;
++ A_UINT32 a2dpWghts;
++ A_UINT32 genWghts;
++ A_UINT32 mode2;
++ A_UINT8 setVal;
++} POSTPACK BT_COEX_REGS;
++
++typedef enum {
++ WLAN_PROTECT_POLICY = 1,
++ WLAN_COEX_CTRL_FLAGS
++} BT_PARAMS_MISC_TYPE;
++
++typedef enum {
++ WLAN_PROTECT_PER_STREAM = 0x01, /* default */
++ WLAN_PROTECT_ANY_TX = 0x02
++} WLAN_PROTECT_FLAGS;
++
++
++#define WLAN_DISABLE_COEX_IN_DISCONNECT 0x01 /* default */
++#define WLAN_KEEP_COEX_IN_DISCONNECT 0x02
++#define WLAN_STOMPBT_IN_DISCONNECT 0x04
++
++#define WLAN_DISABLE_COEX_IN_ROAM 0x10 /* default */
++#define WLAN_KEEP_COEX_IN_ROAM 0x20
++#define WLAN_STOMPBT_IN_ROAM 0x40
++
++#define WLAN_DISABLE_COEX_IN_SCAN 0x100 /* default */
++#define WLAN_KEEP_COEX_IN_SCAN 0x200
++#define WLAN_STOMPBT_IN_SCAN 0x400
++
++#define WLAN_DISABLE_COEX_BT_OFF 0x1000 /* default */
++#define WLAN_KEEP_COEX_BT_OFF 0x2000
++#define WLAN_STOMPBT_BT_OFF 0x4000
++
++typedef PREPACK struct {
++ A_UINT32 period;
++ A_UINT32 dutycycle;
++ A_UINT8 stompbt;
++ A_UINT8 policy;
++} POSTPACK WLAN_PROTECT_POLICY_TYPE;
++
++typedef PREPACK struct {
++ PREPACK union {
++ WLAN_PROTECT_POLICY_TYPE protectParams;
++ A_UINT16 wlanCtrlFlags;
++ } POSTPACK info;
++ A_UINT8 paramType;
++} POSTPACK BT_PARAMS_MISC;
++
++typedef PREPACK struct {
++ PREPACK union {
++ BT_PARAMS_SCO scoParams;
++ BT_PARAMS_A2DP a2dpParams;
++ BT_PARAMS_MISC miscParams;
++ BT_COEX_REGS regs;
++ } POSTPACK info;
++ A_UINT8 paramType;
++} POSTPACK WMI_SET_BT_PARAMS_CMD;
+
+/*
-+ * performs 802.3 to DIX encapsulation for received packets.
-+ * Assumes the entire 802.3 header is contigous.
++ * Command Replies
+ */
-+A_STATUS
-+wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf)
-+{
-+ A_UINT8 *datap;
-+ ATH_MAC_HDR macHdr;
-+ ATH_LLC_SNAP_HDR *llcHdr;
+
-+ A_ASSERT(osbuf != NULL);
-+ datap = A_NETBUF_DATA(osbuf);
++/*
++ * WMI_GET_CHANNEL_LIST_CMDID reply
++ */
++typedef PREPACK struct {
++ A_UINT8 reserved1;
++ A_UINT8 numChannels; /* number of channels in reply */
++ A_UINT16 channelList[1]; /* channel in Mhz */
++} POSTPACK WMI_CHANNEL_LIST_REPLY;
+
-+ A_MEMCPY(&macHdr, datap, sizeof(ATH_MAC_HDR));
-+ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
-+ macHdr.typeOrLen = llcHdr->etherType;
++typedef enum {
++ A_SUCCEEDED = A_OK,
++ A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
++ A_SUCCEEDED_MODIFY_STREAM=251,
++ A_FAILED_INVALID_STREAM = 252,
++ A_FAILED_MAX_THINSTREAMS = 253,
++ A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
++} PSTREAM_REPLY_STATUS;
+
-+ if (A_NETBUF_PULL(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
-+ }
++/*
++ * List of Events (target to host)
++ */
++typedef enum {
++ WMI_READY_EVENTID = 0x1001,
++ WMI_CONNECT_EVENTID,
++ WMI_DISCONNECT_EVENTID,
++ WMI_BSSINFO_EVENTID,
++ WMI_CMDERROR_EVENTID,
++ WMI_REGDOMAIN_EVENTID,
++ WMI_PSTREAM_TIMEOUT_EVENTID,
++ WMI_NEIGHBOR_REPORT_EVENTID,
++ WMI_TKIP_MICERR_EVENTID,
++ WMI_SCAN_COMPLETE_EVENTID,
++ WMI_REPORT_STATISTICS_EVENTID,
++ WMI_RSSI_THRESHOLD_EVENTID,
++ WMI_ERROR_REPORT_EVENTID,
++ WMI_OPT_RX_FRAME_EVENTID,
++ WMI_REPORT_ROAM_TBL_EVENTID,
++ WMI_EXTENSION_EVENTID,
++ WMI_CAC_EVENTID,
++ WMI_SNR_THRESHOLD_EVENTID,
++ WMI_LQ_THRESHOLD_EVENTID,
++ WMI_TX_RETRY_ERR_EVENTID,
++ WMI_REPORT_ROAM_DATA_EVENTID,
++ WMI_TEST_EVENTID,
++ WMI_APLIST_EVENTID,
++ WMI_GET_WOW_LIST_EVENTID,
++ WMI_GET_PMKID_LIST_EVENTID
++} WMI_EVENT_ID;
+
-+ datap = A_NETBUF_DATA(osbuf);
++typedef enum {
++ WMI_11A_CAPABILITY = 1,
++ WMI_11G_CAPABILITY = 2,
++ WMI_11AG_CAPABILITY = 3,
++} WMI_PHY_CAPABILITY;
+
-+ A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
++typedef PREPACK struct {
++ A_UINT8 macaddr[ATH_MAC_LEN];
++ A_UINT8 phyCapability; /* WMI_PHY_CAPABILITY */
++} POSTPACK WMI_READY_EVENT;
+
-+ return (A_OK);
-+}
++/*
++ * Connect Event
++ */
++typedef PREPACK struct {
++ A_UINT16 channel;
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT16 listenInterval;
++ A_UINT16 beaconInterval;
++ A_UINT32 networkType;
++ A_UINT8 beaconIeLen;
++ A_UINT8 assocReqLen;
++ A_UINT8 assocRespLen;
++ A_UINT8 assocInfo[1];
++} POSTPACK WMI_CONNECT_EVENT;
+
+/*
-+ * Removes a WMI data header
++ * Disconnect Event
+ */
-+A_STATUS
-+wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf)
-+{
-+ A_ASSERT(osbuf != NULL);
++typedef enum {
++ NO_NETWORK_AVAIL = 0x01,
++ LOST_LINK = 0x02, /* bmiss */
++ DISCONNECT_CMD = 0x03,
++ BSS_DISCONNECTED = 0x04,
++ AUTH_FAILED = 0x05,
++ ASSOC_FAILED = 0x06,
++ NO_RESOURCES_AVAIL = 0x07,
++ CSERV_DISCONNECT = 0x08,
++ INVALID_PROFILE = 0x0a,
++ DOT11H_CHANNEL_SWITCH = 0x0b,
++} WMI_DISCONNECT_REASON;
+
-+ return (A_NETBUF_PULL(osbuf, sizeof(WMI_DATA_HDR)));
-+}
++typedef PREPACK struct {
++ A_UINT16 protocolReasonStatus; /* reason code, see 802.11 spec. */
++ A_UINT8 bssid[ATH_MAC_LEN]; /* set if known */
++ A_UINT8 disconnectReason ; /* see WMI_DISCONNECT_REASON */
++ A_UINT8 assocRespLen;
++ A_UINT8 assocInfo[1];
++} POSTPACK WMI_DISCONNECT_EVENT;
+
-+void
-+wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg)
-+{
-+ wlan_iterate_nodes(&wmip->wmi_scan_table, f, arg);
-+}
++/*
++ * BSS Info Event.
++ * Mechanism used to inform host of the presence and characteristic of
++ * wireless networks present. Consists of bss info header followed by
++ * the beacon or probe-response frame body. The 802.11 header is not included.
++ */
++typedef enum {
++ BEACON_FTYPE = 0x1,
++ PROBERESP_FTYPE,
++ ACTION_MGMT_FTYPE,
++} WMI_BI_FTYPE;
++
++enum {
++ BSS_ELEMID_CHANSWITCH = 0x01,
++ BSS_ELEMID_ATHEROS = 0x02,
++};
++
++typedef PREPACK struct {
++ A_UINT16 channel;
++ A_UINT8 frameType; /* see WMI_BI_FTYPE */
++ A_UINT8 snr;
++ A_INT16 rssi;
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT32 ieMask;
++} POSTPACK WMI_BSS_INFO_HDR;
+
+/*
-+ * WMI Extended Event received from Target.
++ * Command Error Event
+ */
-+A_STATUS
-+wmi_control_rx_xtnd(struct wmi_t *wmip, void *osbuf)
-+{
-+ WMIX_CMD_HDR *cmd;
-+ A_UINT16 id;
-+ A_UINT8 *datap;
-+ A_UINT32 len;
-+ A_STATUS status = A_OK;
++typedef enum {
++ INVALID_PARAM = 0x01,
++ ILLEGAL_STATE = 0x02,
++ INTERNAL_ERROR = 0x03,
++} WMI_ERROR_CODE;
+
-+ if (A_NETBUF_LEN(osbuf) < sizeof(WMIX_CMD_HDR)) {
-+ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
-+ wmip->wmi_stats.cmd_len_err++;
-+ A_NETBUF_FREE(osbuf);
-+ return A_ERROR;
-+ }
++typedef PREPACK struct {
++ A_UINT16 commandId;
++ A_UINT8 errorCode;
++} POSTPACK WMI_CMD_ERROR_EVENT;
+
-+ cmd = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+ id = cmd->commandId;
++/*
++ * New Regulatory Domain Event
++ */
++typedef PREPACK struct {
++ A_UINT32 regDomain;
++} POSTPACK WMI_REG_DOMAIN_EVENT;
+
-+ if (A_NETBUF_PULL(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
-+ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
-+ wmip->wmi_stats.cmd_len_err++;
-+ A_NETBUF_FREE(osbuf);
-+ return A_ERROR;
-+ }
++typedef PREPACK struct {
++ A_UINT8 trafficClass;
++} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
+
-+ datap = A_NETBUF_DATA(osbuf);
-+ len = A_NETBUF_LEN(osbuf);
++/*
++ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
++ * the host of BSS's it has found that matches the current profile.
++ * It can be used by the host to cache PMKs and/to initiate pre-authentication
++ * if the BSS supports it. The first bssid is always the current associated
++ * BSS.
++ * The bssid and bssFlags information repeats according to the number
++ * or APs reported.
++ */
++typedef enum {
++ WMI_DEFAULT_BSS_FLAGS = 0x00,
++ WMI_PREAUTH_CAPABLE_BSS = 0x01,
++ WMI_PMKID_VALID_BSS = 0x02,
++} WMI_BSS_FLAGS;
+
-+ switch (id) {
-+ case (WMIX_DSETOPENREQ_EVENTID):
-+ status = wmi_dset_open_req_rx(wmip, datap, len);
-+ break;
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+ case (WMIX_DSETCLOSE_EVENTID):
-+ status = wmi_dset_close_rx(wmip, datap, len);
-+ break;
-+ case (WMIX_DSETDATAREQ_EVENTID):
-+ status = wmi_dset_data_req_rx(wmip, datap, len);
-+ break;
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+ case (WMIX_GPIO_INTR_EVENTID):
-+ wmi_gpio_intr_rx(wmip, datap, len);
-+ break;
-+ case (WMIX_GPIO_DATA_EVENTID):
-+ wmi_gpio_data_rx(wmip, datap, len);
-+ break;
-+ case (WMIX_GPIO_ACK_EVENTID):
-+ wmi_gpio_ack_rx(wmip, datap, len);
-+ break;
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
-+ case (WMIX_HB_CHALLENGE_RESP_EVENTID):
-+ wmi_hbChallengeResp_rx(wmip, datap, len);
-+ break;
-+ case (WMIX_DBGLOG_EVENTID):
-+ wmi_dbglog_event_rx(wmip, datap, len);
-+ break;
-+ default:
-+ A_DPRINTF(DBG_WMI|DBG_ERROR,
-+ (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
-+ wmip->wmi_stats.cmd_id_err++;
-+ status = A_ERROR;
-+ break;
-+ }
++typedef PREPACK struct {
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT8 bssFlags; /* see WMI_BSS_FLAGS */
++} POSTPACK WMI_NEIGHBOR_INFO;
+
-+ return status;
-+}
++typedef PREPACK struct {
++ A_INT8 numberOfAps;
++ WMI_NEIGHBOR_INFO neighbor[1];
++} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
+
+/*
-+ * Control Path
++ * TKIP MIC Error Event
+ */
-+A_UINT32 cmdRecvNum;
++typedef PREPACK struct {
++ A_UINT8 keyid;
++ A_UINT8 ismcast;
++} POSTPACK WMI_TKIP_MICERR_EVENT;
+
-+A_STATUS
-+wmi_control_rx(struct wmi_t *wmip, void *osbuf)
-+{
-+ WMI_CMD_HDR *cmd;
-+ A_UINT16 id;
-+ A_UINT8 *datap;
-+ A_UINT32 len, i, loggingReq;
-+ A_STATUS status = A_OK;
++/*
++ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
++ */
++typedef PREPACK struct {
++ A_STATUS status;
++} POSTPACK WMI_SCAN_COMPLETE_EVENT;
+
-+ A_ASSERT(osbuf != NULL);
-+ if (A_NETBUF_LEN(osbuf) < sizeof(WMI_CMD_HDR)) {
-+ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
-+ wmip->wmi_stats.cmd_len_err++;
-+ A_NETBUF_FREE(osbuf);
-+ return A_ERROR;
-+ }
++#define MAX_OPT_DATA_LEN 1400
+
-+ cmd = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+ id = cmd->commandId;
++/*
++ * WMI_SET_ADHOC_BSSID_CMDID
++ */
++typedef PREPACK struct {
++ A_UINT8 bssid[ATH_MAC_LEN];
++} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
+
-+ if (A_NETBUF_PULL(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
-+ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
-+ wmip->wmi_stats.cmd_len_err++;
-+ A_NETBUF_FREE(osbuf);
-+ return A_ERROR;
-+ }
++/*
++ * WMI_SET_OPT_MODE_CMDID
++ */
++typedef enum {
++ SPECIAL_OFF,
++ SPECIAL_ON,
++} OPT_MODE_TYPE;
+
-+ datap = A_NETBUF_DATA(osbuf);
-+ len = A_NETBUF_LEN(osbuf);
++typedef PREPACK struct {
++ A_UINT8 optMode;
++} POSTPACK WMI_SET_OPT_MODE_CMD;
+
-+ ar6000_get_driver_cfg(wmip->wmi_devt,
-+ AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS,
-+ &loggingReq);
++/*
++ * WMI_TX_OPT_FRAME_CMDID
++ */
++typedef enum {
++ OPT_PROBE_REQ = 0x01,
++ OPT_PROBE_RESP = 0x02,
++ OPT_CPPP_START = 0x03,
++ OPT_CPPP_STOP = 0x04,
++} WMI_OPT_FTYPE;
+
-+ if(loggingReq) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI %d \n",id));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI recv, MsgNo %d : ", cmdRecvNum));
-+ for(i = 0; i < len; i++)
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("%x ", datap[i]));
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("\n"));
-+ }
++typedef PREPACK struct {
++ A_UINT16 optIEDataLen;
++ A_UINT8 frmType;
++ A_UINT8 dstAddr[ATH_MAC_LEN];
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT8 reserved; /* For alignment */
++ A_UINT8 optIEData[1];
++} POSTPACK WMI_OPT_TX_FRAME_CMD;
+
-+ LOCK_WMI(wmip);
-+ cmdRecvNum++;
-+ UNLOCK_WMI(wmip);
++/*
++ * Special frame receive Event.
++ * Mechanism used to inform host of the receiption of the special frames.
++ * Consists of special frame info header followed by special frame body.
++ * The 802.11 header is not included.
++ */
++typedef PREPACK struct {
++ A_UINT16 channel;
++ A_UINT8 frameType; /* see WMI_OPT_FTYPE */
++ A_INT8 snr;
++ A_UINT8 srcAddr[ATH_MAC_LEN];
++ A_UINT8 bssid[ATH_MAC_LEN];
++} POSTPACK WMI_OPT_RX_INFO_HDR;
+
-+ switch (id) {
-+ case (WMI_GET_BITRATE_CMDID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_BITRATE_CMDID\n", DBGARG));
-+ status = wmi_bitrate_reply_rx(wmip, datap, len);
-+ break;
-+ case (WMI_GET_CHANNEL_LIST_CMDID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_CHANNEL_LIST_CMDID\n", DBGARG));
-+ status = wmi_channelList_reply_rx(wmip, datap, len);
-+ break;
-+ case (WMI_GET_TX_PWR_CMDID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_TX_PWR_CMDID\n", DBGARG));
-+ status = wmi_txPwr_reply_rx(wmip, datap, len);
-+ break;
-+ case (WMI_READY_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_READY_EVENTID\n", DBGARG));
-+ status = wmi_ready_event_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ A_WMI_DBGLOG_INIT_DONE(wmip->wmi_devt);
-+ break;
-+ case (WMI_CONNECT_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CONNECT_EVENTID\n", DBGARG));
-+ status = wmi_connect_event_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_DISCONNECT_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DISCONNECT_EVENTID\n", DBGARG));
-+ status = wmi_disconnect_event_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_TKIP_MICERR_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TKIP_MICERR_EVENTID\n", DBGARG));
-+ status = wmi_tkip_micerr_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_BSSINFO_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BSSINFO_EVENTID\n", DBGARG));
-+ status = wmi_bssInfo_event_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_REGDOMAIN_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REGDOMAIN_EVENTID\n", DBGARG));
-+ status = wmi_regDomain_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_PSTREAM_TIMEOUT_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSTREAM_TIMEOUT_EVENTID\n", DBGARG));
-+ status = wmi_pstream_timeout_event_rx(wmip, datap, len);
-+ /* pstreams are fatpipe abstractions that get implicitly created.
-+ * User apps only deal with thinstreams. creation of a thinstream
-+ * by the user or data traffic flow in an AC triggers implicit
-+ * pstream creation. Do we need to send this event to App..?
-+ * no harm in sending it.
-+ */
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_NEIGHBOR_REPORT_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_NEIGHBOR_REPORT_EVENTID\n", DBGARG));
-+ status = wmi_neighborReport_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_SCAN_COMPLETE_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SCAN_COMPLETE_EVENTID\n", DBGARG));
-+ status = wmi_scanComplete_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_CMDERROR_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CMDERROR_EVENTID\n", DBGARG));
-+ status = wmi_errorEvent_rx(wmip, datap, len);
-+ break;
-+ case (WMI_REPORT_STATISTICS_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_STATISTICS_EVENTID\n", DBGARG));
-+ status = wmi_statsEvent_rx(wmip, datap, len);
-+ break;
-+ case (WMI_RSSI_THRESHOLD_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_RSSI_THRESHOLD_EVENTID\n", DBGARG));
-+ status = wmi_rssiThresholdEvent_rx(wmip, datap, len);
-+ break;
-+ case (WMI_ERROR_REPORT_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_ERROR_REPORT_EVENTID\n", DBGARG));
-+ status = wmi_reportErrorEvent_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_OPT_RX_FRAME_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_OPT_RX_FRAME_EVENTID\n", DBGARG));
-+ status = wmi_opt_frame_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_REPORT_ROAM_TBL_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_TBL_EVENTID\n", DBGARG));
-+ status = wmi_roam_tbl_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_EXTENSION_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_EXTENSION_EVENTID\n", DBGARG));
-+ status = wmi_control_rx_xtnd(wmip, osbuf);
-+ break;
-+ case (WMI_CAC_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CAC_EVENTID\n", DBGARG));
-+ status = wmi_cac_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_REPORT_ROAM_DATA_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_DATA_EVENTID\n", DBGARG));
-+ status = wmi_roam_data_event_rx(wmip, datap, len);
-+ break;
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+ case (WMI_TEST_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TEST_EVENTID\n", DBGARG));
-+ status = wmi_tcmd_test_report_rx(wmip, datap, len);
-+ break;
-+#endif
-+ case (WMI_GET_FIXRATES_CMDID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_FIXRATES_CMDID\n", DBGARG));
-+ status = wmi_ratemask_reply_rx(wmip, datap, len);
-+ break;
-+ case (WMI_TX_RETRY_ERR_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TX_RETRY_ERR_EVENTID\n", DBGARG));
-+ status = wmi_txRetryErrEvent_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_SNR_THRESHOLD_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SNR_THRESHOLD_EVENTID\n", DBGARG));
-+ status = wmi_snrThresholdEvent_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_LQ_THRESHOLD_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_LQ_THRESHOLD_EVENTID\n", DBGARG));
-+ status = wmi_lqThresholdEvent_rx(wmip, datap, len);
-+ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
-+ break;
-+ case (WMI_APLIST_EVENTID):
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Received APLIST Event\n"));
-+ status = wmi_aplistEvent_rx(wmip, datap, len);
-+ break;
-+ case (WMI_GET_KEEPALIVE_CMDID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_KEEPALIVE_CMDID\n", DBGARG));
-+ status = wmi_keepalive_reply_rx(wmip, datap, len);
-+ break;
-+ case (WMI_GET_WOW_LIST_EVENTID):
-+ status = wmi_get_wow_list_event_rx(wmip, datap, len);
-+ break;
-+ case (WMI_GET_PMKID_LIST_EVENTID):
-+ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_PMKID_LIST Event\n", DBGARG));
-+ status = wmi_get_pmkid_list_event_rx(wmip, datap, len);
-+ break;
-+ default:
-+ A_DPRINTF(DBG_WMI|DBG_ERROR,
-+ (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
-+ wmip->wmi_stats.cmd_id_err++;
-+ status = A_ERROR;
-+ break;
-+ }
-+
-+ A_NETBUF_FREE(osbuf);
++/*
++ * Reporting statistics.
++ */
++typedef PREPACK struct {
++ A_UINT32 tx_packets;
++ A_UINT32 tx_bytes;
++ A_UINT32 tx_unicast_pkts;
++ A_UINT32 tx_unicast_bytes;
++ A_UINT32 tx_multicast_pkts;
++ A_UINT32 tx_multicast_bytes;
++ A_UINT32 tx_broadcast_pkts;
++ A_UINT32 tx_broadcast_bytes;
++ A_UINT32 tx_rts_success_cnt;
++ A_UINT32 tx_packet_per_ac[4];
++ A_UINT32 tx_errors_per_ac[4];
+
-+ return status;
-+}
++ A_UINT32 tx_errors;
++ A_UINT32 tx_failed_cnt;
++ A_UINT32 tx_retry_cnt;
++ A_UINT32 tx_rts_fail_cnt;
++ A_INT32 tx_unicast_rate;
++}POSTPACK tx_stats_t;
+
-+static A_STATUS
-+wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_READY_EVENT *ev = (WMI_READY_EVENT *)datap;
++typedef PREPACK struct {
++ A_UINT32 rx_packets;
++ A_UINT32 rx_bytes;
++ A_UINT32 rx_unicast_pkts;
++ A_UINT32 rx_unicast_bytes;
++ A_UINT32 rx_multicast_pkts;
++ A_UINT32 rx_multicast_bytes;
++ A_UINT32 rx_broadcast_pkts;
++ A_UINT32 rx_broadcast_bytes;
++ A_UINT32 rx_fragment_pkt;
+
-+ if (len < sizeof(WMI_READY_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+ wmip->wmi_ready = TRUE;
-+ A_WMI_READY_EVENT(wmip->wmi_devt, ev->macaddr, ev->phyCapability);
++ A_UINT32 rx_errors;
++ A_UINT32 rx_crcerr;
++ A_UINT32 rx_key_cache_miss;
++ A_UINT32 rx_decrypt_err;
++ A_UINT32 rx_duplicate_frames;
++ A_INT32 rx_unicast_rate;
++}POSTPACK rx_stats_t;
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT32 tkip_local_mic_failure;
++ A_UINT32 tkip_counter_measures_invoked;
++ A_UINT32 tkip_replays;
++ A_UINT32 tkip_format_errors;
++ A_UINT32 ccmp_format_errors;
++ A_UINT32 ccmp_replays;
++}POSTPACK tkip_ccmp_stats_t;
+
-+static A_STATUS
-+wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_CONNECT_EVENT *ev;
++typedef PREPACK struct {
++ A_UINT32 power_save_failure_cnt;
++}POSTPACK pm_stats_t;
+
-+ if (len < sizeof(WMI_CONNECT_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ ev = (WMI_CONNECT_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "freq %d bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
-+ DBGARG, ev->channel,
-+ ev->bssid[0], ev->bssid[1], ev->bssid[2],
-+ ev->bssid[3], ev->bssid[4], ev->bssid[5]));
++typedef PREPACK struct {
++ A_UINT32 cs_bmiss_cnt;
++ A_UINT32 cs_lowRssi_cnt;
++ A_UINT16 cs_connect_cnt;
++ A_UINT16 cs_disconnect_cnt;
++ A_INT16 cs_aveBeacon_rssi;
++ A_UINT16 cs_roam_count;
++ A_UINT16 cs_rssi;
++ A_UINT8 cs_snr;
++ A_UINT8 cs_aveBeacon_snr;
++ A_UINT8 cs_lastRoam_msec;
++} POSTPACK cserv_stats_t;
+
-+ A_MEMCPY(wmip->wmi_bssid, ev->bssid, ATH_MAC_LEN);
++typedef PREPACK struct {
++ tx_stats_t tx_stats;
++ rx_stats_t rx_stats;
++ tkip_ccmp_stats_t tkipCcmpStats;
++}POSTPACK wlan_net_stats_t;
+
-+ A_WMI_CONNECT_EVENT(wmip->wmi_devt, ev->channel, ev->bssid,
-+ ev->listenInterval, ev->beaconInterval,
-+ ev->networkType, ev->beaconIeLen,
-+ ev->assocReqLen, ev->assocRespLen,
-+ ev->assocInfo);
++typedef PREPACK struct {
++ A_UINT32 wow_num_pkts_dropped;
++ A_UINT16 wow_num_events_discarded;
++ A_UINT8 wow_num_host_pkt_wakeups;
++ A_UINT8 wow_num_host_event_wakeups;
++} POSTPACK wlan_wow_stats_t;
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT32 lqVal;
++ A_INT32 noise_floor_calibation;
++ pm_stats_t pmStats;
++ wlan_net_stats_t txrxStats;
++ wlan_wow_stats_t wowStats;
++ cserv_stats_t cservStats;
++} POSTPACK WMI_TARGET_STATS;
+
-+static A_STATUS
-+wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_REG_DOMAIN_EVENT *ev;
++/*
++ * WMI_RSSI_THRESHOLD_EVENTID.
++ * Indicate the RSSI events to host. Events are indicated when we breach a
++ * thresold value.
++ */
++typedef enum{
++ WMI_RSSI_THRESHOLD1_ABOVE = 0,
++ WMI_RSSI_THRESHOLD2_ABOVE,
++ WMI_RSSI_THRESHOLD3_ABOVE,
++ WMI_RSSI_THRESHOLD4_ABOVE,
++ WMI_RSSI_THRESHOLD5_ABOVE,
++ WMI_RSSI_THRESHOLD6_ABOVE,
++ WMI_RSSI_THRESHOLD1_BELOW,
++ WMI_RSSI_THRESHOLD2_BELOW,
++ WMI_RSSI_THRESHOLD3_BELOW,
++ WMI_RSSI_THRESHOLD4_BELOW,
++ WMI_RSSI_THRESHOLD5_BELOW,
++ WMI_RSSI_THRESHOLD6_BELOW
++}WMI_RSSI_THRESHOLD_VAL;
+
-+ if (len < sizeof(*ev)) {
-+ return A_EINVAL;
-+ }
-+ ev = (WMI_REG_DOMAIN_EVENT *)datap;
++typedef PREPACK struct {
++ A_INT16 rssi;
++ A_UINT8 range;
++}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
+
-+ A_WMI_REGDOMAIN_EVENT(wmip->wmi_devt, ev->regDomain);
++/*
++ * WMI_ERROR_REPORT_EVENTID
++ */
++typedef enum{
++ WMI_TARGET_PM_ERR_FAIL = 0x00000001,
++ WMI_TARGET_KEY_NOT_FOUND = 0x00000002,
++ WMI_TARGET_DECRYPTION_ERR = 0x00000004,
++ WMI_TARGET_BMISS = 0x00000008,
++ WMI_PSDISABLE_NODE_JOIN = 0x00000010,
++ WMI_TARGET_COM_ERR = 0x00000020,
++ WMI_TARGET_FATAL_ERR = 0x00000040
++} WMI_TARGET_ERROR_VAL;
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT32 errorVal;
++}POSTPACK WMI_TARGET_ERROR_REPORT_EVENT;
+
-+static A_STATUS
-+wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_NEIGHBOR_REPORT_EVENT *ev;
-+ int numAps;
++typedef PREPACK struct {
++ A_UINT8 retrys;
++}POSTPACK WMI_TX_RETRY_ERR_EVENT;
+
-+ if (len < sizeof(*ev)) {
-+ return A_EINVAL;
-+ }
-+ ev = (WMI_NEIGHBOR_REPORT_EVENT *)datap;
-+ numAps = ev->numberOfAps;
++typedef enum{
++ WMI_SNR_THRESHOLD1_ABOVE = 1,
++ WMI_SNR_THRESHOLD1_BELOW,
++ WMI_SNR_THRESHOLD2_ABOVE,
++ WMI_SNR_THRESHOLD2_BELOW,
++ WMI_SNR_THRESHOLD3_ABOVE,
++ WMI_SNR_THRESHOLD3_BELOW,
++ WMI_SNR_THRESHOLD4_ABOVE,
++ WMI_SNR_THRESHOLD4_BELOW
++} WMI_SNR_THRESHOLD_VAL;
+
-+ if (len < (int)(sizeof(*ev) + ((numAps - 1) * sizeof(WMI_NEIGHBOR_INFO)))) {
-+ return A_EINVAL;
-+ }
++typedef PREPACK struct {
++ A_UINT8 range; /* WMI_SNR_THRESHOLD_VAL */
++ A_UINT8 snr;
++}POSTPACK WMI_SNR_THRESHOLD_EVENT;
+
-+ A_WMI_NEIGHBORREPORT_EVENT(wmip->wmi_devt, numAps, ev->neighbor);
++typedef enum{
++ WMI_LQ_THRESHOLD1_ABOVE = 1,
++ WMI_LQ_THRESHOLD1_BELOW,
++ WMI_LQ_THRESHOLD2_ABOVE,
++ WMI_LQ_THRESHOLD2_BELOW,
++ WMI_LQ_THRESHOLD3_ABOVE,
++ WMI_LQ_THRESHOLD3_BELOW,
++ WMI_LQ_THRESHOLD4_ABOVE,
++ WMI_LQ_THRESHOLD4_BELOW
++} WMI_LQ_THRESHOLD_VAL;
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_INT32 lq;
++ A_UINT8 range; /* WMI_LQ_THRESHOLD_VAL */
++}POSTPACK WMI_LQ_THRESHOLD_EVENT;
++/*
++ * WMI_REPORT_ROAM_TBL_EVENTID
++ */
++#define MAX_ROAM_TBL_CAND 5
+
-+static A_STATUS
-+wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_DISCONNECT_EVENT *ev;
++typedef PREPACK struct {
++ A_INT32 roam_util;
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_INT8 rssi;
++ A_INT8 rssidt;
++ A_INT8 last_rssi;
++ A_INT8 util;
++ A_INT8 bias;
++ A_UINT8 reserved; /* For alignment */
++} POSTPACK WMI_BSS_ROAM_INFO;
+
-+ if (len < sizeof(WMI_DISCONNECT_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ ev = (WMI_DISCONNECT_EVENT *)datap;
++typedef PREPACK struct {
++ A_UINT16 roamMode;
++ A_UINT16 numEntries;
++ WMI_BSS_ROAM_INFO bssRoamInfo[1];
++} POSTPACK WMI_TARGET_ROAM_TBL;
+
-+ A_MEMZERO(wmip->wmi_bssid, sizeof(wmip->wmi_bssid));
++/*
++ * WMI_CAC_EVENTID
++ */
++typedef enum {
++ CAC_INDICATION_ADMISSION = 0x00,
++ CAC_INDICATION_ADMISSION_RESP = 0x01,
++ CAC_INDICATION_DELETE = 0x02,
++ CAC_INDICATION_NO_RESP = 0x03,
++}CAC_INDICATION;
+
-+ A_WMI_DISCONNECT_EVENT(wmip->wmi_devt, ev->disconnectReason, ev->bssid,
-+ ev->assocRespLen, ev->assocInfo, ev->protocolReasonStatus);
++#define WMM_TSPEC_IE_LEN 63
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT8 ac;
++ A_UINT8 cac_indication;
++ A_UINT8 statusCode;
++ A_UINT8 tspecSuggestion[WMM_TSPEC_IE_LEN];
++}POSTPACK WMI_CAC_EVENT;
+
-+static A_STATUS
-+wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TKIP_MICERR_EVENT *ev;
++/*
++ * WMI_APLIST_EVENTID
++ */
+
-+ if (len < sizeof(*ev)) {
-+ return A_EINVAL;
-+ }
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++typedef enum {
++ APLIST_VER1 = 1,
++} APLIST_VER;
+
-+ ev = (WMI_TKIP_MICERR_EVENT *)datap;
-+ A_WMI_TKIP_MICERR_EVENT(wmip->wmi_devt, ev->keyid, ev->ismcast);
++typedef PREPACK struct {
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT16 channel;
++} POSTPACK WMI_AP_INFO_V1;
+
-+ return A_OK;
-+}
++typedef PREPACK union {
++ WMI_AP_INFO_V1 apInfoV1;
++} POSTPACK WMI_AP_INFO;
+
-+static A_STATUS
-+wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ bss_t *bss;
-+ WMI_BSS_INFO_HDR *bih;
-+ A_UINT8 *buf;
-+ A_UINT32 nodeCachingAllowed;
++typedef PREPACK struct {
++ A_UINT8 apListVer;
++ A_UINT8 numAP;
++ WMI_AP_INFO apList[1];
++} POSTPACK WMI_APLIST_EVENT;
+
-+ if (len <= sizeof(WMI_BSS_INFO_HDR)) {
-+ return A_EINVAL;
-+ }
++/*
++ * developer commands
++ */
+
-+ A_WMI_BSSINFO_EVENT_RX(wmip->wmi_devt, datap, len);
-+ /* What is driver config for wlan node caching? */
-+ if(ar6000_get_driver_cfg(wmip->wmi_devt,
-+ AR6000_DRIVER_CFG_GET_WLANNODECACHING,
-+ &nodeCachingAllowed) != A_OK) {
-+ return A_EINVAL;
-+ }
++/*
++ * WMI_SET_BITRATE_CMDID
++ *
++ * Get bit rate cmd uses same definition as set bit rate cmd
++ */
++typedef enum {
++ RATE_AUTO = -1,
++ RATE_1Mb = 0,
++ RATE_2Mb = 1,
++ RATE_5_5Mb = 2,
++ RATE_11Mb = 3,
++ RATE_6Mb = 4,
++ RATE_9Mb = 5,
++ RATE_12Mb = 6,
++ RATE_18Mb = 7,
++ RATE_24Mb = 8,
++ RATE_36Mb = 9,
++ RATE_48Mb = 10,
++ RATE_54Mb = 11,
++} WMI_BIT_RATE;
+
-+ if(!nodeCachingAllowed) {
-+ return A_OK;
-+ }
++typedef PREPACK struct {
++ A_INT8 rateIndex; /* see WMI_BIT_RATE */
++} POSTPACK WMI_BIT_RATE_CMD, WMI_BIT_RATE_REPLY;
+
++/*
++ * WMI_SET_FIXRATES_CMDID
++ *
++ * Get fix rates cmd uses same definition as set fix rates cmd
++ */
++typedef enum {
++ FIX_RATE_1Mb = 0x1,
++ FIX_RATE_2Mb = 0x2,
++ FIX_RATE_5_5Mb = 0x4,
++ FIX_RATE_11Mb = 0x8,
++ FIX_RATE_6Mb = 0x10,
++ FIX_RATE_9Mb = 0x20,
++ FIX_RATE_12Mb = 0x40,
++ FIX_RATE_18Mb = 0x80,
++ FIX_RATE_24Mb = 0x100,
++ FIX_RATE_36Mb = 0x200,
++ FIX_RATE_48Mb = 0x400,
++ FIX_RATE_54Mb = 0x800,
++} WMI_FIX_RATES_MASK;
+
-+ bih = (WMI_BSS_INFO_HDR *)datap;
-+ buf = datap + sizeof(WMI_BSS_INFO_HDR);
-+ len -= sizeof(WMI_BSS_INFO_HDR);
++typedef PREPACK struct {
++ A_UINT16 fixRateMask; /* see WMI_BIT_RATE */
++} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
+
-+ A_DPRINTF(DBG_WMI2, (DBGFMT "bssInfo event - ch %u, rssi %02x, "
-+ "bssid \"%02x:%02x:%02x:%02x:%02x:%02x\"\n", DBGARG,
-+ bih->channel, (unsigned char) bih->rssi, bih->bssid[0],
-+ bih->bssid[1], bih->bssid[2], bih->bssid[3], bih->bssid[4],
-+ bih->bssid[5]));
++/*
++ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
++ *
++ * Set authentication mode
++ */
++typedef enum {
++ RECONN_DO_AUTH = 0x00,
++ RECONN_NOT_AUTH = 0x01
++} WMI_AUTH_MODE;
+
-+ if(wps_enable && (bih->frameType == PROBERESP_FTYPE) ) {
-+ printk("%s() A_OK 2\n", __FUNCTION__);
-+ return A_OK;
-+ }
++typedef PREPACK struct {
++ A_UINT8 mode;
++} POSTPACK WMI_SET_AUTH_MODE_CMD;
+
-+ bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
-+ if (bss != NULL) {
-+ /*
-+ * Free up the node. Not the most efficient process given
-+ * we are about to allocate a new node but it is simple and should be
-+ * adequate.
-+ */
-+ wlan_node_reclaim(&wmip->wmi_scan_table, bss);
-+ }
++/*
++ * WMI_SET_REASSOC_MODE_CMDID
++ *
++ * Set authentication mode
++ */
++typedef enum {
++ REASSOC_DO_DISASSOC = 0x00,
++ REASSOC_DONOT_DISASSOC = 0x01
++} WMI_REASSOC_MODE;
+
-+ bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
-+ if (bss == NULL) {
-+ return A_NO_MEMORY;
-+ }
++typedef PREPACK struct {
++ A_UINT8 mode;
++}POSTPACK WMI_SET_REASSOC_MODE_CMD;
+
-+ bss->ni_snr = bih->snr;
-+ bss->ni_rssi = bih->rssi;
-+ A_ASSERT(bss->ni_buf != NULL);
-+ A_MEMCPY(bss->ni_buf, buf, len);
++typedef enum {
++ ROAM_DATA_TIME = 1, /* Get The Roam Time Data */
++} ROAM_DATA_TYPE;
+
-+ if (wlan_parse_beacon(bss->ni_buf, len, &bss->ni_cie) != A_OK) {
-+ wlan_node_free(bss);
-+ return A_EINVAL;
-+ }
++typedef PREPACK struct {
++ A_UINT32 disassoc_time;
++ A_UINT32 no_txrx_time;
++ A_UINT32 assoc_time;
++ A_UINT32 allow_txrx_time;
++ A_UINT32 last_data_txrx_time;
++ A_UINT32 first_data_txrx_time;
++ A_UINT8 disassoc_bssid[ATH_MAC_LEN];
++ A_INT8 disassoc_bss_rssi;
++ A_UINT8 assoc_bssid[ATH_MAC_LEN];
++ A_INT8 assoc_bss_rssi;
++} POSTPACK WMI_TARGET_ROAM_TIME;
+
-+ /*
-+ * Update the frequency in ie_chan, overwriting of channel number
-+ * which is done in wlan_parse_beacon
-+ */
-+ bss->ni_cie.ie_chan = bih->channel;
-+ wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
++typedef PREPACK struct {
++ PREPACK union {
++ WMI_TARGET_ROAM_TIME roamTime;
++ } POSTPACK u;
++ A_UINT8 roamDataType ;
++} POSTPACK WMI_TARGET_ROAM_DATA;
+
-+ return A_OK;
-+}
++typedef enum {
++ WMI_WMM_DISABLED = 0,
++ WMI_WMM_ENABLED
++} WMI_WMM_STATUS;
+
-+static A_STATUS
-+wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ bss_t *bss;
-+ WMI_OPT_RX_INFO_HDR *bih;
-+ A_UINT8 *buf;
++typedef PREPACK struct {
++ A_UINT8 status;
++}POSTPACK WMI_SET_WMM_CMD;
+
-+ if (len <= sizeof(WMI_OPT_RX_INFO_HDR)) {
-+ return A_EINVAL;
-+ }
++typedef enum {
++ WMI_TXOP_DISABLED = 0,
++ WMI_TXOP_ENABLED
++} WMI_TXOP_CFG;
+
-+ bih = (WMI_OPT_RX_INFO_HDR *)datap;
-+ buf = datap + sizeof(WMI_OPT_RX_INFO_HDR);
-+ len -= sizeof(WMI_OPT_RX_INFO_HDR);
++typedef PREPACK struct {
++ A_UINT8 txopEnable;
++}POSTPACK WMI_SET_WMM_TXOP_CMD;
+
-+ A_DPRINTF(DBG_WMI2, (DBGFMT "opt frame event %2.2x:%2.2x\n", DBGARG,
-+ bih->bssid[4], bih->bssid[5]));
++typedef PREPACK struct {
++ A_UINT8 keepaliveInterval;
++} POSTPACK WMI_SET_KEEPALIVE_CMD;
+
-+ bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
-+ if (bss != NULL) {
-+ /*
-+ * Free up the node. Not the most efficient process given
-+ * we are about to allocate a new node but it is simple and should be
-+ * adequate.
-+ */
-+ wlan_node_reclaim(&wmip->wmi_scan_table, bss);
-+ }
++typedef PREPACK struct {
++ A_BOOL configured;
++ A_UINT8 keepaliveInterval;
++} POSTPACK WMI_GET_KEEPALIVE_CMD;
+
-+ bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
-+ if (bss == NULL) {
-+ return A_NO_MEMORY;
-+ }
++/*
++ * Add Application specified IE to a management frame
++ */
++#define WMI_MAX_IE_LEN 78
+
-+ bss->ni_snr = bih->snr;
-+ bss->ni_cie.ie_chan = bih->channel;
-+ A_ASSERT(bss->ni_buf != NULL);
-+ A_MEMCPY(bss->ni_buf, buf, len);
-+ wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
++typedef PREPACK struct {
++ A_UINT8 mgmtFrmType; /* one of WMI_MGMT_FRAME_TYPE */
++ A_UINT8 ieLen; /* Length of the IE that should be added to the MGMT frame */
++ A_UINT8 ieInfo[1];
++} POSTPACK WMI_SET_APPIE_CMD;
+
-+ return A_OK;
-+}
++/*
++ * Notify the WSC registration status to the target
++ */
++#define WSC_REG_ACTIVE 1
++#define WSC_REG_INACTIVE 0
++/* Generic Hal Interface for setting hal paramters. */
++/* Add new Set HAL Param cmdIds here for newer params */
++typedef enum {
++ WHAL_SETCABTO_CMDID = 1,
++}WHAL_CMDID;
+
-+ /* This event indicates inactivity timeout of a fatpipe(pstream)
-+ * at the target
-+ */
-+static A_STATUS
-+wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_PSTREAM_TIMEOUT_EVENT *ev;
++typedef PREPACK struct {
++ A_UINT8 cabTimeOut;
++} POSTPACK WHAL_SETCABTO_PARAM;
+
-+ if (len < sizeof(WMI_PSTREAM_TIMEOUT_EVENT)) {
-+ return A_EINVAL;
-+ }
++typedef PREPACK struct {
++ A_UINT8 whalCmdId;
++ A_UINT8 data[1];
++} POSTPACK WHAL_PARAMCMD;
+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "wmi_pstream_timeout_event_rx\n", DBGARG));
+
-+ ev = (WMI_PSTREAM_TIMEOUT_EVENT *)datap;
++#define WOW_MAX_FILTER_LISTS 1 /*4*/
++#define WOW_MAX_FILTERS_PER_LIST 4
++#define WOW_PATTERN_SIZE 64
++#define WOW_MASK_SIZE 64
+
-+ /* When the pstream (fat pipe == AC) timesout, it means there were no
-+ * thinStreams within this pstream & it got implicitly created due to
-+ * data flow on this AC. We start the inactivity timer only for
-+ * implicitly created pstream. Just reset the host state.
-+ */
-+ /* Set the activeTsids for this AC to 0 */
-+ LOCK_WMI(wmip);
-+ wmip->wmi_streamExistsForAC[ev->trafficClass]=0;
-+ wmip->wmi_fatPipeExists &= ~(1 << ev->trafficClass);
-+ UNLOCK_WMI(wmip);
++typedef PREPACK struct {
++ A_UINT8 wow_valid_filter;
++ A_UINT8 wow_filter_id;
++ A_UINT8 wow_filter_size;
++ A_UINT8 wow_filter_offset;
++ A_UINT8 wow_filter_mask[WOW_MASK_SIZE];
++ A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE];
++} POSTPACK WOW_FILTER;
+
-+ /*Indicate inactivity to driver layer for this fatpipe (pstream)*/
-+ A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, ev->trafficClass);
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT8 wow_valid_list;
++ A_UINT8 wow_list_id;
++ A_UINT8 wow_num_filters;
++ A_UINT8 wow_total_list_size;
++ WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
++} POSTPACK WOW_FILTER_LIST;
+
-+static A_STATUS
-+wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_BIT_RATE_CMD *reply;
-+ A_INT32 rate;
++typedef PREPACK struct {
++ A_BOOL awake;
++ A_BOOL asleep;
++} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
+
-+ if (len < sizeof(WMI_BIT_RATE_CMD)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_BIT_RATE_CMD *)datap;
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - rateindex %d\n", DBGARG, reply->rateIndex));
++typedef PREPACK struct {
++ A_BOOL enable_wow;
++} POSTPACK WMI_SET_WOW_MODE_CMD;
+
-+ if (reply->rateIndex == RATE_AUTO) {
-+ rate = RATE_AUTO;
-+ } else {
-+ rate = wmi_rateTable[(A_UINT32) reply->rateIndex];
-+ }
++typedef PREPACK struct {
++ A_UINT8 filter_list_id;
++} POSTPACK WMI_GET_WOW_LIST_CMD;
+
-+ A_WMI_BITRATE_RX(wmip->wmi_devt, rate);
++/*
++ * WMI_GET_WOW_LIST_CMD reply
++ */
++typedef PREPACK struct {
++ A_UINT8 num_filters; /* number of patterns in reply */
++ A_UINT8 this_filter_num; /* this is filter # x of total num_filters */
++ A_UINT8 wow_mode;
++ A_UINT8 host_mode;
++ WOW_FILTER wow_filters[1];
++} POSTPACK WMI_GET_WOW_LIST_REPLY;
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT8 filter_list_id;
++ A_UINT8 filter_size;
++ A_UINT8 filter_offset;
++ A_UINT8 filter[1];
++} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
+
-+static A_STATUS
-+wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_FIX_RATES_CMD *reply;
++typedef PREPACK struct {
++ A_UINT16 filter_list_id;
++ A_UINT16 filter_id;
++} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
+
-+ if (len < sizeof(WMI_BIT_RATE_CMD)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_FIX_RATES_CMD *)datap;
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - fixed rate mask %x\n", DBGARG, reply->fixRateMask));
++typedef PREPACK struct {
++ A_UINT8 macaddr[ATH_MAC_LEN];
++} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
+
-+ A_WMI_RATEMASK_RX(wmip->wmi_devt, reply->fixRateMask);
++/*
++ * WMI_SET_AKMP_PARAMS_CMD
++ */
+
-+ return A_OK;
-+}
++#define WMI_AKMP_MULTI_PMKID_EN 0x000001
+
-+static A_STATUS
-+wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_CHANNEL_LIST_REPLY *reply;
++typedef PREPACK struct {
++ A_UINT32 akmpInfo;
++} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
+
-+ if (len < sizeof(WMI_CHANNEL_LIST_REPLY)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_CHANNEL_LIST_REPLY *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++typedef PREPACK struct {
++ A_UINT8 pmkid[WMI_PMKID_LEN];
++} POSTPACK WMI_PMKID;
+
-+ A_WMI_CHANNELLIST_RX(wmip->wmi_devt, reply->numChannels,
-+ reply->channelList);
++/*
++ * WMI_SET_PMKID_LIST_CMD
++ */
++#define WMI_MAX_PMKID_CACHE 8
+
-+ return A_OK;
-+}
++typedef PREPACK struct {
++ A_UINT32 numPMKID;
++ WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
++} POSTPACK WMI_SET_PMKID_LIST_CMD;
+
-+static A_STATUS
-+wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TX_PWR_REPLY *reply;
++/*
++ * WMI_GET_PMKID_LIST_CMD Reply
++ * Following the Number of PMKIDs is the list of PMKIDs
++ */
++typedef PREPACK struct {
++ A_UINT32 numPMKID;
++ WMI_PMKID pmkidList[1];
++} POSTPACK WMI_PMKID_LIST_REPLY;
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TX_PWR_REPLY *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/* index used for priority streams */
++typedef enum {
++ WMI_NOT_MAPPED = -1,
++ WMI_CONTROL_PRI = 0,
++ WMI_BEST_EFFORT_PRI = 1,
++ WMI_LOW_PRI = 2,
++ WMI_HIGH_PRI = 3,
++ WMI_HIGHEST_PRI,
++ WMI_PRI_MAX_COUNT
++} WMI_PRI_STREAM_ID;
+
-+ A_WMI_TXPWR_RX(wmip->wmi_devt, reply->dbM);
++#ifndef ATH_TARGET
++#include "athendpack.h"
++#endif
+
-+ return A_OK;
++#ifdef __cplusplus
+}
-+static A_STATUS
-+wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_GET_KEEPALIVE_CMD *reply;
-+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_GET_KEEPALIVE_CMD *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++#endif
+
-+ A_WMI_KEEPALIVE_RX(wmip->wmi_devt, reply->configured);
++#endif /* _WMI_H_ */
+diff --git a/drivers/ar6000/include/wmi_api.h b/drivers/ar6000/include/wmi_api.h
+new file mode 100644
+index 0000000..267edfd
+--- /dev/null
++++ b/drivers/ar6000/include/wmi_api.h
+@@ -0,0 +1,260 @@
++#ifndef _WMI_API_H_
++#define _WMI_API_H_
++/*
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This file contains the definitions for the Wireless Module Interface (WMI).
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/include/wmi_api.h#2 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ return A_OK;
-+}
++#ifdef __cplusplus
++extern "C" {
++#endif
+
++/*
++ * IP QoS Field definitions according to 802.1p
++ */
++#define BEST_EFFORT_PRI 0
++#define BACKGROUND_PRI 1
++#define EXCELLENT_EFFORT_PRI 3
++#define CONTROLLED_LOAD_PRI 4
++#define VIDEO_PRI 5
++#define VOICE_PRI 6
++#define NETWORK_CONTROL_PRI 7
++#define MAX_NUM_PRI 8
+
-+static A_STATUS
-+wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_DSETOPENREQ_EVENT *dsetopenreq;
++#define UNDEFINED_PRI (0xff)
+
-+ if (len < sizeof(WMIX_DSETOPENREQ_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ dsetopenreq = (WMIX_DSETOPENREQ_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - dset_id=0x%x\n", DBGARG, dsetopenreq->dset_id));
-+ A_WMI_DSET_OPEN_REQ(wmip->wmi_devt,
-+ dsetopenreq->dset_id,
-+ dsetopenreq->targ_dset_handle,
-+ dsetopenreq->targ_reply_fn,
-+ dsetopenreq->targ_reply_arg);
++/* simple mapping of IP TOS field to a WMI priority stream
++ * this mapping was taken from the original linux driver implementation
++ * The operation maps the following
++ *
++ * */
++#define IP_TOS_TO_WMI_PRI(tos) \
++ ((WMI_PRI_STREAM_ID)(((tos) >> 1) & 0x03))
+
-+ return A_OK;
-+}
++#define WMI_IMPLICIT_PSTREAM_INACTIVITY_INT 5000 /* 5 seconds */
+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+static A_STATUS
-+wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_DSETCLOSE_EVENT *dsetclose;
+
-+ if (len < sizeof(WMIX_DSETCLOSE_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++struct wmi_t;
+
-+ dsetclose = (WMIX_DSETCLOSE_EVENT *)datap;
-+ A_WMI_DSET_CLOSE(wmip->wmi_devt, dsetclose->access_cookie);
++void *wmi_init(void *devt);
+
-+ return A_OK;
-+}
++void wmi_qos_state_init(struct wmi_t *wmip);
++void wmi_shutdown(struct wmi_t *wmip);
++A_UINT16 wmi_get_mapped_qos_queue(struct wmi_t *, A_UINT8);
++A_STATUS wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf);
++A_STATUS wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType);
++A_STATUS wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf);
++A_STATUS wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf);
++A_STATUS wmi_syncpoint(struct wmi_t *wmip);
++A_STATUS wmi_syncpoint_reset(struct wmi_t *wmip);
++WMI_PRI_STREAM_ID wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass);
++A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up);
+
-+static A_STATUS
-+wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_DSETDATAREQ_EVENT *dsetdatareq;
++A_STATUS wmi_control_rx(struct wmi_t *wmip, void *osbuf);
++void wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg);
++void wmi_free_allnodes(struct wmi_t *wmip);
++bss_t *wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr);
+
-+ if (len < sizeof(WMIX_DSETDATAREQ_EVENT)) {
-+ return A_EINVAL;
-+ }
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ dsetdatareq = (WMIX_DSETDATAREQ_EVENT *)datap;
-+ A_WMI_DSET_DATA_REQ(wmip->wmi_devt,
-+ dsetdatareq->access_cookie,
-+ dsetdatareq->offset,
-+ dsetdatareq->length,
-+ dsetdatareq->targ_buf,
-+ dsetdatareq->targ_reply_fn,
-+ dsetdatareq->targ_reply_arg);
++typedef enum {
++ NO_SYNC_WMIFLAG = 0,
++ SYNC_BEFORE_WMIFLAG, /* transmit all queued data before cmd */
++ SYNC_AFTER_WMIFLAG, /* any new data waits until cmd execs */
++ SYNC_BOTH_WMIFLAG,
++ END_WMIFLAG /* end marker */
++} WMI_SYNC_FLAG;
+
-+ return A_OK;
-+}
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
++A_STATUS wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
++ WMI_SYNC_FLAG flag);
++A_STATUS wmi_connect_cmd(struct wmi_t *wmip,
++ NETWORK_TYPE netType,
++ DOT11_AUTH_MODE dot11AuthMode,
++ AUTH_MODE authMode,
++ CRYPTO_TYPE pairwiseCrypto,
++ A_UINT8 pairwiseCryptoLen,
++ CRYPTO_TYPE groupCrypto,
++ A_UINT8 groupCryptoLen,
++ int ssidLength,
++ A_UCHAR *ssid,
++ A_UINT8 *bssid,
++ A_UINT16 channel,
++ A_UINT32 ctrl_flags);
++A_STATUS wmi_reconnect_cmd(struct wmi_t *wmip,
++ A_UINT8 *bssid,
++ A_UINT16 channel);
++A_STATUS wmi_disconnect_cmd(struct wmi_t *wmip);
++A_STATUS wmi_getrev_cmd(struct wmi_t *wmip);
++A_STATUS wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
++ A_BOOL forceFgScan, A_BOOL isLegacy,
++ A_UINT32 homeDwellTime, A_UINT32 forceScanInterval);
++A_STATUS wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
++ A_UINT16 fg_end_sec, A_UINT16 bg_sec,
++ A_UINT16 minact_chdw_msec,
++ A_UINT16 maxact_chdw_msec, A_UINT16 pas_chdw_msec,
++ A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
++ A_UINT32 max_dfsch_act_time);
++A_STATUS wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask);
++A_STATUS wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
++ A_UINT8 ssidLength, A_UCHAR *ssid);
++A_STATUS wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons);
++A_STATUS wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmisstime, A_UINT16 bmissbeacons);
++A_STATUS wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
++ A_UINT8 ieLen, A_UINT8 *ieInfo);
++A_STATUS wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode);
++A_STATUS wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
++ A_UINT16 atim_windows, A_UINT16 timeout_value);
++A_STATUS wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
++ A_UINT16 psPollNum, A_UINT16 dtimPolicy);
++A_STATUS wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout);
++A_STATUS wmi_sync_cmd(struct wmi_t *wmip, A_UINT8 syncNumber);
++A_STATUS wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *pstream);
++A_STATUS wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 streamID);
++A_STATUS wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate);
++A_STATUS wmi_get_bitrate_cmd(struct wmi_t *wmip);
++A_INT8 wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate);
++A_STATUS wmi_get_regDomain_cmd(struct wmi_t *wmip);
++A_STATUS wmi_get_channelList_cmd(struct wmi_t *wmip);
++A_STATUS wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
++ WMI_PHY_MODE mode, A_INT8 numChan,
++ A_UINT16 *channelList);
+
-+static A_STATUS
-+wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_SCAN_COMPLETE_EVENT *ev;
-+
-+ ev = (WMI_SCAN_COMPLETE_EVENT *)datap;
-+ A_WMI_SCANCOMPLETE_EVENT(wmip->wmi_devt, ev->status);
-+
-+ return A_OK;
-+}
-+
-+/*
-+ * Target is reporting a programming error. This is for
-+ * developer aid only. Target only checks a few common violations
-+ * and it is responsibility of host to do all error checking.
-+ * Behavior of target after wmi error event is undefined.
-+ * A reset is recommended.
-+ */
-+static A_STATUS
-+wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_CMD_ERROR_EVENT *ev;
-+
-+ ev = (WMI_CMD_ERROR_EVENT *)datap;
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Programming Error: cmd=%d ", ev->commandId));
-+ switch (ev->errorCode) {
-+ case (INVALID_PARAM):
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal Parameter\n"));
-+ break;
-+ case (ILLEGAL_STATE):
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal State\n"));
-+ break;
-+ case (INTERNAL_ERROR):
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Internal Error\n"));
-+ break;
-+ }
++A_STATUS wmi_set_snr_threshold_params(struct wmi_t *wmip,
++ WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
++A_STATUS wmi_set_rssi_threshold_params(struct wmi_t *wmip,
++ WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
++A_STATUS wmi_clr_rssi_snr(struct wmi_t *wmip);
++A_STATUS wmi_set_lq_threshold_params(struct wmi_t *wmip,
++ WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd);
++A_STATUS wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold);
++A_STATUS wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status);
+
-+ return A_OK;
-+}
++A_STATUS wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 bitmask);
+
++A_STATUS wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie,
++ A_UINT32 source);
++A_STATUS wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
++ A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
++ A_UINT32 valid);
++A_STATUS wmi_get_stats_cmd(struct wmi_t *wmip);
++A_STATUS wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex,
++ CRYPTO_TYPE keyType, A_UINT8 keyUsage,
++ A_UINT8 keyLength,A_UINT8 *keyRSC,
++ A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
++ WMI_SYNC_FLAG sync_flag);
++A_STATUS wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk);
++A_STATUS wmi_delete_krk_cmd(struct wmi_t *wmip);
++A_STATUS wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex);
++A_STATUS wmi_set_akmp_params_cmd(struct wmi_t *wmip,
++ WMI_SET_AKMP_PARAMS_CMD *akmpParams);
++A_STATUS wmi_get_pmkid_list_cmd(struct wmi_t *wmip);
++A_STATUS wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
++ WMI_SET_PMKID_LIST_CMD *pmkInfo);
++A_STATUS wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM);
++A_STATUS wmi_get_txPwr_cmd(struct wmi_t *wmip);
++A_STATUS wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on);
++A_STATUS wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid);
++A_STATUS wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex);
++A_STATUS wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en);
++A_STATUS wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
++ A_BOOL set);
++A_STATUS wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop,
++ A_UINT8 eCWmin, A_UINT8 eCWmax,
++ A_UINT8 aifsn);
++A_STATUS wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
++ A_UINT8 trafficClass, A_UINT8 maxRetries,
++ A_UINT8 enableNotify);
+
-+static A_STATUS
-+wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TARGET_STATS *reply;
++void wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid);
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TARGET_STATS *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++A_STATUS wmi_get_roam_tbl_cmd(struct wmi_t *wmip);
++A_STATUS wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType);
++A_STATUS wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
++ A_UINT8 size);
++A_STATUS wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
++ WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
++ A_UINT8 size);
+
-+ A_WMI_TARGETSTATS_EVENT(wmip->wmi_devt, reply);
++A_STATUS wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode);
++A_STATUS wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
++ A_UINT8 frmType,
++ A_UINT8 *dstMacAddr,
++ A_UINT8 *bssid,
++ A_UINT16 optIEDataLen,
++ A_UINT8 *optIEData);
+
-+ return A_OK;
-+}
++A_STATUS wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl);
++A_STATUS wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize);
++A_STATUS wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSpLen);
++A_UINT8 convert_userPriority_to_trafficClass(A_UINT8 userPriority);
++A_UINT8 wmi_get_power_mode_cmd(struct wmi_t *wmip);
++A_STATUS wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance);
+
-+static A_STATUS
-+wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_RSSI_THRESHOLD_EVENT *reply;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++A_STATUS wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32 len);
++#endif
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_RSSI_THRESHOLD_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++A_STATUS wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status);
++A_STATUS wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd);
+
-+ A_WMI_RSSI_THRESHOLD_EVENT(wmip->wmi_devt, reply->range, reply->rssi);
+
-+ return A_OK;
-+}
++/*
++ * This function is used to configure the fix rates mask to the target.
++ */
++A_STATUS wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask);
++A_STATUS wmi_get_ratemask_cmd(struct wmi_t *wmip);
+
++A_STATUS wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
+
-+static A_STATUS
-+wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TARGET_ERROR_REPORT_EVENT *reply;
++A_STATUS wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TARGET_ERROR_REPORT_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++A_STATUS wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status);
++A_STATUS wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG txEnable);
+
-+ A_WMI_REPORT_ERROR_EVENT(wmip->wmi_devt, reply->errorVal);
++A_STATUS wmi_get_keepalive_configured(struct wmi_t *wmip);
++A_UINT8 wmi_get_keepalive_cmd(struct wmi_t *wmip);
++A_STATUS wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval);
+
-+ return A_OK;
-+}
++A_STATUS wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType,
++ A_UINT8 ieLen,A_UINT8 *ieInfo);
+
-+static A_STATUS
-+wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_CAC_EVENT *reply;
++A_STATUS wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen);
++A_INT32 wmi_get_rate(A_INT8 rateindex);
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_CAC_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/*Wake on Wireless WMI commands*/
++A_STATUS wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip, WMI_SET_HOST_SLEEP_MODE_CMD *cmd);
++A_STATUS wmi_set_wow_mode_cmd(struct wmi_t *wmip, WMI_SET_WOW_MODE_CMD *cmd);
++A_STATUS wmi_get_wow_list_cmd(struct wmi_t *wmip, WMI_GET_WOW_LIST_CMD *cmd);
++A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
++ WMI_ADD_WOW_PATTERN_CMD *cmd, A_UINT8* pattern, A_UINT8* mask, A_UINT8 pattern_size);
++A_STATUS wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
++ WMI_DEL_WOW_PATTERN_CMD *cmd);
++A_STATUS wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status);
+
-+ A_WMI_CAC_EVENT(wmip->wmi_devt, reply->ac,
-+ reply->cac_indication, reply->statusCode,
-+ reply->tspecSuggestion);
++bss_t *
++wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
++ A_UINT32 ssidLength, A_BOOL bIsWPA2);
+
-+ return A_OK;
++void
++wmi_node_return (struct wmi_t *wmip, bss_t *bss);
++#ifdef __cplusplus
+}
++#endif
+
-+static A_STATUS
-+wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_HB_CHALLENGE_RESP_EVENT *reply;
++#endif /* _WMI_API_H_ */
+diff --git a/drivers/ar6000/include/wmix.h b/drivers/ar6000/include/wmix.h
+new file mode 100644
+index 0000000..8f12b5e
+--- /dev/null
++++ b/drivers/ar6000/include/wmix.h
+@@ -0,0 +1,233 @@
++/*
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * $ATH_LICENSE_HOSTSDK0_C$
++ *
++ * This file contains extensions of the WMI protocol specified in the
++ * Wireless Module Interface (WMI). It includes definitions of all
++ * extended commands and events. Extensions include useful commands
++ * that are not directly related to wireless activities. They may
++ * be hardware-specific, and they might not be supported on all
++ * implementations.
++ *
++ * Extended WMIX commands are encapsulated in a WMI message with
++ * cmd=WMI_EXTENSION_CMD.
++ *
++ */
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMIX_HB_CHALLENGE_RESP_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "wmi: challenge response event\n", DBGARG));
++#ifndef _WMIX_H_
++#define _WMIX_H_
+
-+ A_WMI_HBCHALLENGERESP_EVENT(wmip->wmi_devt, reply->cookie, reply->source);
++#ifdef __cplusplus
++extern "C" {
++#endif
+
-+ return A_OK;
-+}
++#ifndef ATH_TARGET
++#include "athstartpack.h"
++#endif
+
-+static A_STATUS
-+wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TARGET_ROAM_TBL *reply;
++#include "dbglog.h"
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TARGET_ROAM_TBL *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/*
++ * Extended WMI commands are those that are needed during wireless
++ * operation, but which are not really wireless commands. This allows,
++ * for instance, platform-specific commands. Extended WMI commands are
++ * embedded in a WMI command message with WMI_COMMAND_ID=WMI_EXTENSION_CMDID.
++ * Extended WMI events are similarly embedded in a WMI event message with
++ * WMI_EVENT_ID=WMI_EXTENSION_EVENTID.
++ */
++typedef PREPACK struct {
++ A_UINT32 commandId;
++} POSTPACK WMIX_CMD_HDR;
+
-+ A_WMI_ROAM_TABLE_EVENT(wmip->wmi_devt, reply);
++typedef enum {
++ WMIX_DSETOPEN_REPLY_CMDID = 0x2001,
++ WMIX_DSETDATA_REPLY_CMDID,
++ WMIX_GPIO_OUTPUT_SET_CMDID,
++ WMIX_GPIO_INPUT_GET_CMDID,
++ WMIX_GPIO_REGISTER_SET_CMDID,
++ WMIX_GPIO_REGISTER_GET_CMDID,
++ WMIX_GPIO_INTR_ACK_CMDID,
++ WMIX_HB_CHALLENGE_RESP_CMDID,
++ WMIX_DBGLOG_CFG_MODULE_CMDID,
++} WMIX_COMMAND_ID;
+
-+ return A_OK;
-+}
++typedef enum {
++ WMIX_DSETOPENREQ_EVENTID = 0x3001,
++ WMIX_DSETCLOSE_EVENTID,
++ WMIX_DSETDATAREQ_EVENTID,
++ WMIX_GPIO_INTR_EVENTID,
++ WMIX_GPIO_DATA_EVENTID,
++ WMIX_GPIO_ACK_EVENTID,
++ WMIX_HB_CHALLENGE_RESP_EVENTID,
++ WMIX_DBGLOG_EVENTID,
++} WMIX_EVENT_ID;
+
-+static A_STATUS
-+wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TARGET_ROAM_DATA *reply;
++/*
++ * =============DataSet support=================
++ */
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TARGET_ROAM_DATA *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/*
++ * WMIX_DSETOPENREQ_EVENTID
++ * DataSet Open Request Event
++ */
++typedef PREPACK struct {
++ A_UINT32 dset_id;
++ A_UINT32 targ_dset_handle; /* echo'ed, not used by Host, */
++ A_UINT32 targ_reply_fn; /* echo'ed, not used by Host, */
++ A_UINT32 targ_reply_arg; /* echo'ed, not used by Host, */
++} POSTPACK WMIX_DSETOPENREQ_EVENT;
+
-+ A_WMI_ROAM_DATA_EVENT(wmip->wmi_devt, reply);
++/*
++ * WMIX_DSETCLOSE_EVENTID
++ * DataSet Close Event
++ */
++typedef PREPACK struct {
++ A_UINT32 access_cookie;
++} POSTPACK WMIX_DSETCLOSE_EVENT;
+
-+ return A_OK;
-+}
++/*
++ * WMIX_DSETDATAREQ_EVENTID
++ * DataSet Data Request Event
++ */
++typedef PREPACK struct {
++ A_UINT32 access_cookie;
++ A_UINT32 offset;
++ A_UINT32 length;
++ A_UINT32 targ_buf; /* echo'ed, not used by Host, */
++ A_UINT32 targ_reply_fn; /* echo'ed, not used by Host, */
++ A_UINT32 targ_reply_arg; /* echo'ed, not used by Host, */
++} POSTPACK WMIX_DSETDATAREQ_EVENT;
+
-+static A_STATUS
-+wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_TX_RETRY_ERR_EVENT *reply;
++typedef PREPACK struct {
++ A_UINT32 status;
++ A_UINT32 targ_dset_handle;
++ A_UINT32 targ_reply_fn;
++ A_UINT32 targ_reply_arg;
++ A_UINT32 access_cookie;
++ A_UINT32 size;
++ A_UINT32 version;
++} POSTPACK WMIX_DSETOPEN_REPLY_CMD;
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_TX_RETRY_ERR_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++typedef PREPACK struct {
++ A_UINT32 status;
++ A_UINT32 targ_buf;
++ A_UINT32 targ_reply_fn;
++ A_UINT32 targ_reply_arg;
++ A_UINT32 length;
++ A_UINT8 buf[1];
++} POSTPACK WMIX_DSETDATA_REPLY_CMD;
+
-+ A_WMI_TX_RETRY_ERR_EVENT(wmip->wmi_devt);
+
-+ return A_OK;
-+}
++/*
++ * =============GPIO support=================
++ * All masks are 18-bit masks with bit N operating on GPIO pin N.
++ */
+
-+static A_STATUS
-+wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_SNR_THRESHOLD_EVENT *reply;
++#include "gpio.h"
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_SNR_THRESHOLD_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/*
++ * Set GPIO pin output state.
++ * In order for output to be driven, a pin must be enabled for output.
++ * This can be done during initialization through the GPIO Configuration
++ * DataSet, or during operation with the enable_mask.
++ *
++ * If a request is made to simultaneously set/clear or set/disable or
++ * clear/disable or disable/enable, results are undefined.
++ */
++typedef PREPACK struct {
++ A_UINT32 set_mask; /* pins to set */
++ A_UINT32 clear_mask; /* pins to clear */
++ A_UINT32 enable_mask; /* pins to enable for output */
++ A_UINT32 disable_mask; /* pins to disable/tristate */
++} POSTPACK WMIX_GPIO_OUTPUT_SET_CMD;
+
-+ A_WMI_SNR_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->snr);
++/*
++ * Set a GPIO register. For debug/exceptional cases.
++ * Values for gpioreg_id are GPIO_REGISTER_IDs, defined in a
++ * platform-dependent header.
++ */
++typedef PREPACK struct {
++ A_UINT32 gpioreg_id; /* GPIO register ID */
++ A_UINT32 value; /* value to write */
++} POSTPACK WMIX_GPIO_REGISTER_SET_CMD;
+
-+ return A_OK;
-+}
++/* Get a GPIO register. For debug/exceptional cases. */
++typedef PREPACK struct {
++ A_UINT32 gpioreg_id; /* GPIO register to read */
++} POSTPACK WMIX_GPIO_REGISTER_GET_CMD;
+
-+static A_STATUS
-+wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMI_LQ_THRESHOLD_EVENT *reply;
++/*
++ * Host acknowledges and re-arms GPIO interrupts. A single
++ * message should be used to acknowledge all interrupts that
++ * were delivered in an earlier WMIX_GPIO_INTR_EVENT message.
++ */
++typedef PREPACK struct {
++ A_UINT32 ack_mask; /* interrupts to acknowledge */
++} POSTPACK WMIX_GPIO_INTR_ACK_CMD;
+
-+ if (len < sizeof(*reply)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_LQ_THRESHOLD_EVENT *)datap;
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++/*
++ * Target informs Host of GPIO interrupts that have ocurred since the
++ * last WMIX_GIPO_INTR_ACK_CMD was received. Additional information --
++ * the current GPIO input values is provided -- in order to support
++ * use of a GPIO interrupt as a Data Valid signal for other GPIO pins.
++ */
++typedef PREPACK struct {
++ A_UINT32 intr_mask; /* pending GPIO interrupts */
++ A_UINT32 input_values; /* recent GPIO input values */
++} POSTPACK WMIX_GPIO_INTR_EVENT;
+
-+ A_WMI_LQ_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->lq);
++/*
++ * Target responds to Host's earlier WMIX_GPIO_INPUT_GET_CMDID request
++ * using a GPIO_DATA_EVENT with
++ * value set to the mask of GPIO pin inputs and
++ * reg_id set to GPIO_ID_NONE
++ *
++ *
++ * Target responds to Hosts's earlier WMIX_GPIO_REGISTER_GET_CMDID request
++ * using a GPIO_DATA_EVENT with
++ * value set to the value of the requested register and
++ * reg_id identifying the register (reflects the original request)
++ * NB: reg_id supports the future possibility of unsolicited
++ * WMIX_GPIO_DATA_EVENTs (for polling GPIO input), and it may
++ * simplify Host GPIO support.
++ */
++typedef PREPACK struct {
++ A_UINT32 value;
++ A_UINT32 reg_id;
++} POSTPACK WMIX_GPIO_DATA_EVENT;
+
-+ return A_OK;
-+}
++/*
++ * =============Error Detection support=================
++ */
+
-+static A_STATUS
-+wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ A_UINT16 ap_info_entry_size;
-+ WMI_APLIST_EVENT *ev = (WMI_APLIST_EVENT *)datap;
-+ WMI_AP_INFO_V1 *ap_info_v1;
-+ A_UINT8 i;
++/*
++ * WMIX_HB_CHALLENGE_RESP_CMDID
++ * Heartbeat Challenge Response command
++ */
++typedef PREPACK struct {
++ A_UINT32 cookie;
++ A_UINT32 source;
++} POSTPACK WMIX_HB_CHALLENGE_RESP_CMD;
+
-+ if (len < sizeof(WMI_APLIST_EVENT)) {
-+ return A_EINVAL;
-+ }
++/*
++ * WMIX_HB_CHALLENGE_RESP_EVENTID
++ * Heartbeat Challenge Response Event
++ */
++#define WMIX_HB_CHALLENGE_RESP_EVENT WMIX_HB_CHALLENGE_RESP_CMD
+
-+ if (ev->apListVer == APLIST_VER1) {
-+ ap_info_entry_size = sizeof(WMI_AP_INFO_V1);
-+ ap_info_v1 = (WMI_AP_INFO_V1 *)ev->apList;
-+ } else {
-+ return A_EINVAL;
-+ }
++typedef PREPACK struct {
++ struct dbglog_config_s config;
++} POSTPACK WMIX_DBGLOG_CFG_MODULE_CMD;
+
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Number of APs in APLIST Event is %d\n", ev->numAP));
-+ if (len < (int)(sizeof(WMI_APLIST_EVENT) +
-+ (ev->numAP - 1) * ap_info_entry_size))
-+ {
-+ return A_EINVAL;
-+ }
++#ifndef ATH_TARGET
++#include "athendpack.h"
++#endif
+
-+ /*
-+ * AP List Ver1 Contents
-+ */
-+ for (i = 0; i < ev->numAP; i++) {
-+ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("AP#%d BSSID %2.2x %2.2x %2.2x %2.2x %2.2x %2.2x "\
-+ "Channel %d\n", i,
-+ ap_info_v1->bssid[0], ap_info_v1->bssid[1],
-+ ap_info_v1->bssid[2], ap_info_v1->bssid[3],
-+ ap_info_v1->bssid[4], ap_info_v1->bssid[5],
-+ ap_info_v1->channel));
-+ ap_info_v1++;
-+ }
-+ return A_OK;
++#ifdef __cplusplus
+}
++#endif
+
-+static A_STATUS
-+wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ A_UINT32 dropped;
++#endif /* _WMIX_H_ */
+diff --git a/drivers/ar6000/miscdrv/common_drv.c b/drivers/ar6000/miscdrv/common_drv.c
+new file mode 100644
+index 0000000..4f12734
+--- /dev/null
++++ b/drivers/ar6000/miscdrv/common_drv.c
+@@ -0,0 +1,467 @@
+
-+ dropped = *((A_UINT32 *)datap);
-+ datap += sizeof(dropped);
-+ len -= sizeof(dropped);
-+ A_WMI_DBGLOG_EVENT(wmip->wmi_devt, dropped, datap, len);
-+ return A_OK;
-+}
-+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+static A_STATUS
-+wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_GPIO_INTR_EVENT *gpio_intr = (WMIX_GPIO_INTR_EVENT *)datap;
-+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - intrmask=0x%x input=0x%x.\n", DBGARG,
-+ gpio_intr->intr_mask, gpio_intr->input_values));
-+
-+ A_WMI_GPIO_INTR_RX(gpio_intr->intr_mask, gpio_intr->input_values);
-+
-+ return A_OK;
-+}
-+
-+static A_STATUS
-+wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ WMIX_GPIO_DATA_EVENT *gpio_data = (WMIX_GPIO_DATA_EVENT *)datap;
-+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG,
-+ gpio_data->reg_id, gpio_data->value));
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ A_WMI_GPIO_DATA_RX(gpio_data->reg_id, gpio_data->value);
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "AR6Khwreg.h"
++#include "targaddrs.h"
++#include "a_osapi.h"
++#include "hif.h"
++#include "htc_api.h"
++#include "bmi.h"
++#include "bmi_msg.h"
++#include "common_drv.h"
++#include "a_debug.h"
++#include "targaddrs.h"
+
-+ return A_OK;
-+}
++#define HOST_INTEREST_ITEM_ADDRESS(target, item) \
++(((TargetType) == TARGET_TYPE_AR6001) ? \
++ AR6001_HOST_INTEREST_ITEM_ADDRESS(item) : \
++ AR6002_HOST_INTEREST_ITEM_ADDRESS(item))
+
-+static A_STATUS
-+wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
-+{
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_WMI_GPIO_ACK_RX();
++/* Compile the 4BYTE version of the window register setup routine,
++ * This mitigates host interconnect issues with non-4byte aligned bus requests, some
++ * interconnects use bus adapters that impose strict limitations.
++ * Since diag window access is not intended for performance critical operations, the 4byte mode should
++ * be satisfactory even though it generates 4X the bus activity. */
+
-+ return A_OK;
-+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
++#ifdef USE_4BYTE_REGISTER_ACCESS
+
-+/*
-+ * Called to send a wmi command. Command specific data is already built
-+ * on osbuf and current osbuf->data points to it.
-+ */
-+A_STATUS
-+wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+ WMI_SYNC_FLAG syncflag)
++ /* set the window address register (using 4-byte register access ). */
++A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
+{
-+#define IS_LONG_CMD(cmdId) ((cmdId == WMI_OPT_TX_FRAME_CMDID) || (cmdId == WMI_ADD_WOW_PATTERN_CMDID))
-+ WMI_CMD_HDR *cHdr;
-+ WMI_PRI_STREAM_ID streamID = WMI_CONTROL_PRI;
++ A_STATUS status;
++ A_UINT8 addrValue[4];
++ int i;
+
-+ A_ASSERT(osbuf != NULL);
++ /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
++ * last to initiate the access cycle */
+
-+ if (syncflag >= END_WMIFLAG) {
-+ return A_EINVAL;
-+ }
++ for (i = 1; i <= 3; i++) {
++ /* fill the buffer with the address byte value we want to hit 4 times*/
++ addrValue[0] = ((A_UINT8 *)&Address)[i];
++ addrValue[1] = addrValue[0];
++ addrValue[2] = addrValue[0];
++ addrValue[3] = addrValue[0];
+
-+ if ((syncflag == SYNC_BEFORE_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
-+ /*
-+ * We want to make sure all data currently queued is transmitted before
-+ * the cmd execution. Establish a new sync point.
-+ */
-+ wmi_sync_point(wmip);
++ /* hit each byte of the register address with a 4-byte write operation to the same address,
++ * this is a harmless operation */
++ status = HIFReadWrite(hifDevice,
++ RegisterAddr+i,
++ addrValue,
++ 4,
++ HIF_WR_SYNC_BYTE_FIX,
++ NULL);
++ if (status != A_OK) {
++ break;
++ }
+ }
+
-+ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
++ RegisterAddr, Address));
++ return status;
+ }
+
-+ cHdr = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+ cHdr->commandId = cmdId;
-+
-+ /*
-+ * Send cmd, some via control pipe, others via data pipe
-+ */
-+ if (IS_LONG_CMD(cmdId)) {
-+ wmi_data_hdr_add(wmip, osbuf, CNTL_MSGTYPE);
-+ // TODO ... these can now go through the control endpoint via HTC 2.0
-+ streamID = WMI_BEST_EFFORT_PRI;
-+ }
-+ A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID);
++ /* write the address register again, this time write the whole 4-byte value.
++ * The effect here is that the LSB write causes the cycle to start, the extra
++ * 3 byte write to bytes 1,2,3 has no effect since we are writing the same values again */
++ status = HIFReadWrite(hifDevice,
++ RegisterAddr,
++ (A_UCHAR *)(&Address),
++ 4,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ if ((syncflag == SYNC_AFTER_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
-+ /*
-+ * We want to make sure all new data queued waits for the command to
-+ * execute. Establish a new sync point.
-+ */
-+ wmi_sync_point(wmip);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
++ RegisterAddr, Address));
++ return status;
+ }
-+ return (A_OK);
-+#undef IS_LONG_CMD
-+}
+
-+A_STATUS
-+wmi_cmd_send_xtnd(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
-+ WMI_SYNC_FLAG syncflag)
-+{
-+ WMIX_CMD_HDR *cHdr;
++ return A_OK;
+
-+ if (A_NETBUF_PUSH(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
-+ }
+
-+ cHdr = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
-+ cHdr->commandId = cmdId;
+
-+ return wmi_cmd_send(wmip, osbuf, WMI_EXTENSION_CMDID, syncflag);
+}
+
-+A_STATUS
-+wmi_connect_cmd(struct wmi_t *wmip, NETWORK_TYPE netType,
-+ DOT11_AUTH_MODE dot11AuthMode, AUTH_MODE authMode,
-+ CRYPTO_TYPE pairwiseCrypto, A_UINT8 pairwiseCryptoLen,
-+ CRYPTO_TYPE groupCrypto,A_UINT8 groupCryptoLen,
-+ int ssidLength, A_UCHAR *ssid,
-+ A_UINT8 *bssid, A_UINT16 channel, A_UINT32 ctrl_flags)
-+{
-+ void *osbuf;
-+ WMI_CONNECT_CMD *cc;
+
-+ if ((pairwiseCrypto == NONE_CRYPT) && (groupCrypto != NONE_CRYPT)) {
-+ return A_EINVAL;
-+ }
-+ if ((pairwiseCrypto != NONE_CRYPT) && (groupCrypto == NONE_CRYPT)) {
-+ return A_EINVAL;
-+ }
++#else
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(WMI_CONNECT_CMD));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ /* set the window address register */
++A_STATUS ar6000_SetAddressWindowRegister(HIF_DEVICE *hifDevice, A_UINT32 RegisterAddr, A_UINT32 Address)
++{
++ A_STATUS status;
+
-+ A_NETBUF_PUT(osbuf, sizeof(WMI_CONNECT_CMD));
++ /* write bytes 1,2,3 of the register to set the upper address bytes, the LSB is written
++ * last to initiate the access cycle */
++ status = HIFReadWrite(hifDevice,
++ RegisterAddr+1, /* write upper 3 bytes */
++ ((A_UCHAR *)(&Address))+1,
++ sizeof(A_UINT32)-1,
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ cc = (WMI_CONNECT_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cc, sizeof(*cc));
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write initial bytes of 0x%x to window reg: 0x%X \n",
++ RegisterAddr, Address));
++ return status;
++ }
+
-+ A_MEMCPY(cc->ssid, ssid, ssidLength);
-+ cc->ssidLength = ssidLength;
-+ cc->networkType = netType;
-+ cc->dot11AuthMode = dot11AuthMode;
-+ cc->authMode = authMode;
-+ cc->pairwiseCryptoType = pairwiseCrypto;
-+ cc->pairwiseCryptoLen = pairwiseCryptoLen;
-+ cc->groupCryptoType = groupCrypto;
-+ cc->groupCryptoLen = groupCryptoLen;
-+ cc->channel = channel;
-+ cc->ctrl_flags = ctrl_flags;
++ /* write the LSB of the register, this initiates the operation */
++ status = HIFReadWrite(hifDevice,
++ RegisterAddr,
++ (A_UCHAR *)(&Address),
++ sizeof(A_UINT8),
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
+
-+ if (bssid != NULL) {
-+ A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
-+ }
-+ if (wmi_set_keepalive_cmd(wmip, wmip->wmi_keepaliveInterval) != A_OK) {
-+ return(A_ERROR);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to window reg: 0x%X \n",
++ RegisterAddr, Address));
++ return status;
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_CONNECT_CMDID, NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
++#endif
++
++/*
++ * Read from the AR6000 through its diagnostic window.
++ * No cooperation from the Target is required for this.
++ */
+A_STATUS
-+wmi_reconnect_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT16 channel)
++ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
+{
-+ void *osbuf;
-+ WMI_RECONNECT_CMD *cc;
-+
-+ osbuf = A_NETBUF_ALLOC(sizeof(WMI_RECONNECT_CMD));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, sizeof(WMI_RECONNECT_CMD));
++ A_STATUS status;
+
-+ cc = (WMI_RECONNECT_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cc, sizeof(*cc));
++ /* set window register to start read cycle */
++ status = ar6000_SetAddressWindowRegister(hifDevice,
++ WINDOW_READ_ADDR_ADDRESS,
++ *address);
+
-+ cc->channel = channel;
++ if (status != A_OK) {
++ return status;
++ }
+
-+ if (bssid != NULL) {
-+ A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
++ /* read the data */
++ status = HIFReadWrite(hifDevice,
++ WINDOW_DATA_ADDRESS,
++ (A_UCHAR *)data,
++ sizeof(A_UINT32),
++ HIF_RD_SYNC_BYTE_INC,
++ NULL);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot read from WINDOW_DATA_ADDRESS\n"));
++ return status;
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_RECONNECT_CMDID, NO_SYNC_WMIFLAG));
++ return status;
+}
+
++
++/*
++ * Write to the AR6000 through its diagnostic window.
++ * No cooperation from the Target is required for this.
++ */
+A_STATUS
-+wmi_disconnect_cmd(struct wmi_t *wmip)
++ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data)
+{
-+ void *osbuf;
+ A_STATUS status;
+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ /* set write data */
++ status = HIFReadWrite(hifDevice,
++ WINDOW_DATA_ADDRESS,
++ (A_UCHAR *)data,
++ sizeof(A_UINT32),
++ HIF_WR_SYNC_BYTE_INC,
++ NULL);
++ if (status != A_OK) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot write 0x%x to WINDOW_DATA_ADDRESS\n", *data));
++ return status;
+ }
+
-+ /* Bug fix for 24817(elevator bug) - the disconnect command does not
-+ need to do a SYNC before.*/
-+ status = (wmi_cmd_send(wmip, osbuf, WMI_DISCONNECT_CMDID,
-+ NO_SYNC_WMIFLAG));
-+
-+ return status;
++ /* set window register, which starts the write cycle */
++ return ar6000_SetAddressWindowRegister(hifDevice,
++ WINDOW_WRITE_ADDR_ADDRESS,
++ *address);
+}
+
+A_STATUS
-+wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
-+ A_BOOL forceFgScan, A_BOOL isLegacy,
-+ A_UINT32 homeDwellTime, A_UINT32 forceScanInterval)
++ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
++ A_UCHAR *data, A_UINT32 length)
+{
-+ void *osbuf;
-+ WMI_START_SCAN_CMD *sc;
-+
-+ if ((scanType != WMI_LONG_SCAN) && (scanType != WMI_SHORT_SCAN)) {
-+ return A_EINVAL;
-+ }
++ A_UINT32 count;
++ A_STATUS status = A_OK;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*sc));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ for (count = 0; count < length; count += 4, address += 4) {
++ if ((status = ar6000_ReadRegDiag(hifDevice, &address,
++ (A_UINT32 *)&data[count])) != A_OK)
++ {
++ break;
++ }
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*sc));
-+
-+ sc = (WMI_START_SCAN_CMD *)(A_NETBUF_DATA(osbuf));
-+ sc->scanType = scanType;
-+ sc->forceFgScan = forceFgScan;
-+ sc->isLegacy = isLegacy;
-+ sc->homeDwellTime = homeDwellTime;
-+ sc->forceScanInterval = forceScanInterval;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_START_SCAN_CMDID, NO_SYNC_WMIFLAG));
++ return status;
+}
+
+A_STATUS
-+wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
-+ A_UINT16 fg_end_sec, A_UINT16 bg_sec,
-+ A_UINT16 minact_chdw_msec, A_UINT16 maxact_chdw_msec,
-+ A_UINT16 pas_chdw_msec,
-+ A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
-+ A_UINT32 max_dfsch_act_time)
++ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
++ A_UCHAR *data, A_UINT32 length)
+{
-+ void *osbuf;
-+ WMI_SCAN_PARAMS_CMD *sc;
++ A_UINT32 count;
++ A_STATUS status = A_OK;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*sc));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ for (count = 0; count < length; count += 4, address += 4) {
++ if ((status = ar6000_WriteRegDiag(hifDevice, &address,
++ (A_UINT32 *)&data[count])) != A_OK)
++ {
++ break;
++ }
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*sc));
-+
-+ sc = (WMI_SCAN_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(sc, sizeof(*sc));
-+ sc->fg_start_period = fg_start_sec;
-+ sc->fg_end_period = fg_end_sec;
-+ sc->bg_period = bg_sec;
-+ sc->minact_chdwell_time = minact_chdw_msec;
-+ sc->maxact_chdwell_time = maxact_chdw_msec;
-+ sc->pas_chdwell_time = pas_chdw_msec;
-+ sc->shortScanRatio = shScanRatio;
-+ sc->scanCtrlFlags = scanCtrlFlags;
-+ sc->max_dfsch_act_time = max_dfsch_act_time;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_SCAN_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return status;
+}
+
+A_STATUS
-+wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask)
++ar6000_reset_device_skipflash(HIF_DEVICE *hifDevice)
+{
-+ void *osbuf;
-+ WMI_BSS_FILTER_CMD *cmd;
++ int i;
++ struct forceROM_s {
++ A_UINT32 addr;
++ A_UINT32 data;
++ };
++ struct forceROM_s *ForceROM;
++ int szForceROM;
++ A_UINT32 instruction;
+
-+ if (filter >= LAST_BSS_FILTER) {
-+ return A_EINVAL;
-+ }
++ static struct forceROM_s ForceROM_REV2[] = {
++ /* NB: This works for old REV2 ROM (old). */
++ {0x00001ff0, 0x175b0027}, /* jump instruction at 0xa0001ff0 */
++ {0x00001ff4, 0x00000000}, /* nop instruction at 0xa0001ff4 */
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ {MC_REMAP_TARGET_ADDRESS, 0x00001ff0}, /* remap to 0xa0001ff0 */
++ {MC_REMAP_COMPARE_ADDRESS, 0x01000040},/* ...from 0xbfc00040 */
++ {MC_REMAP_SIZE_ADDRESS, 0x00000000}, /* ...1 cache line */
++ {MC_REMAP_VALID_ADDRESS, 0x00000001}, /* ...remap is valid */
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
+
-+ cmd = (WMI_BSS_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->bssFilter = filter;
-+ cmd->ieMask = ieMask;
++ {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
++ };
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BSS_FILTER_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ static struct forceROM_s ForceROM_NEW[] = {
++ /* NB: This works for AR6000 ROM REV3 and beyond. */
++ {LOCAL_SCRATCH_ADDRESS, AR6K_OPTION_IGNORE_FLASH},
++ {LOCAL_COUNT_ADDRESS+0x10, 0}, /* clear BMI credit counter */
++ {RESET_CONTROL_ADDRESS, RESET_CONTROL_WARM_RST_MASK},
++ };
+
-+A_STATUS
-+wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
-+ A_UINT8 ssidLength, A_UCHAR *ssid)
-+{
-+ void *osbuf;
-+ WMI_PROBED_SSID_CMD *cmd;
++ /*
++ * Examine a semi-arbitrary instruction that's different
++ * in REV2 and other revisions.
++ * NB: If a Host port does not require simultaneous support
++ * for multiple revisions of Target ROM, this code can be elided.
++ */
++ (void)ar6000_ReadDataDiag(hifDevice, 0x01000040,
++ (A_UCHAR *)&instruction, 4);
+
-+ if (index > MAX_PROBED_SSID_INDEX) {
-+ return A_EINVAL;
-+ }
-+ if (ssidLength > sizeof(cmd->ssid)) {
-+ return A_EINVAL;
-+ }
-+ if ((flag & (DISABLE_SSID_FLAG | ANY_SSID_FLAG)) && (ssidLength > 0)) {
-+ return A_EINVAL;
-+ }
-+ if ((flag & SPECIFIC_SSID_FLAG) && !ssidLength) {
-+ return A_EINVAL;
-+ }
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("instruction=0x%x\n", instruction));
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (instruction == 0x3c1aa200) {
++ /* It's an old ROM */
++ ForceROM = ForceROM_REV2;
++ szForceROM = sizeof(ForceROM_REV2)/sizeof(*ForceROM);
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using OLD method\n"));
++ } else {
++ ForceROM = ForceROM_NEW;
++ szForceROM = sizeof(ForceROM_NEW)/sizeof(*ForceROM);
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Using NEW method\n"));
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_PROBED_SSID_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->entryIndex = index;
-+ cmd->flag = flag;
-+ cmd->ssidLength = ssidLength;
-+ A_MEMCPY(cmd->ssid, ssid, ssidLength);
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Force Target to execute from ROM....\n"));
++ for (i = 0; i < szForceROM; i++)
++ {
++ if (ar6000_WriteRegDiag(hifDevice,
++ &ForceROM[i].addr,
++ &ForceROM[i].data) != A_OK)
++ {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Cannot force Target to execute ROM!\n"));
++ return A_ERROR;
++ }
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PROBED_SSID_CMDID,
-+ NO_SYNC_WMIFLAG));
++ msleep(50); /* delay to allow dragon to come to BMI phase */
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons)
++/* reset device */
++A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
+{
-+ void *osbuf;
-+ WMI_LISTEN_INT_CMD *cmd;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++#if !defined(DWSIM)
++ A_STATUS status = A_OK;
++ A_UINT32 address;
++ A_UINT32 data;
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_LISTEN_INT_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->listenInterval = listenInterval;
-+ cmd->numBeacons = listenBeacons;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_LISTEN_INT_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ do {
+
-+A_STATUS
-+wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmissTime, A_UINT16 bmissBeacons)
-+{
-+ void *osbuf;
-+ WMI_BMISS_TIME_CMD *cmd;
++ // address = RESET_CONTROL_ADDRESS;
++ data = RESET_CONTROL_COLD_RST_MASK;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ /* Hardcode the address of RESET_CONTROL_ADDRESS based on the target type */
++ if (TargetType == TARGET_TYPE_AR6001) {
++ address = 0x0C000000;
++ } else {
++ if (TargetType == TARGET_TYPE_AR6002) {
++ address = 0x00004000;
++ } else {
++ A_ASSERT(0);
++ }
++ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ status = ar6000_WriteRegDiag(hifDevice, &address, &data);
+
-+ cmd = (WMI_BMISS_TIME_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->bmissTime = bmissTime;
-+ cmd->numBeacons = bmissBeacons;
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BMISS_TIME_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /*
++ * Read back the RESET CAUSE register to ensure that the cold reset
++ * went through.
++ */
++ msleep(2000); /* 2 second delay to allow things to settle down */
+
-+A_STATUS
-+wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
-+ A_UINT8 ieLen, A_UINT8 *ieInfo)
-+{
-+ void *osbuf;
-+ WMI_SET_ASSOC_INFO_CMD *cmd;
-+ A_UINT16 cmdLen;
+
-+ cmdLen = sizeof(*cmd) + ieLen - 1;
-+ osbuf = A_NETBUF_ALLOC(cmdLen);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ // address = RESET_CAUSE_ADDRESS;
++ /* Hardcode the address of RESET_CAUSE_ADDRESS based on the target type */
++ if (TargetType == TARGET_TYPE_AR6001) {
++ address = 0x0C0000CC;
++ } else {
++ if (TargetType == TARGET_TYPE_AR6002) {
++ address = 0x000040C0;
++ } else {
++ A_ASSERT(0);
++ }
++ }
+
-+ A_NETBUF_PUT(osbuf, cmdLen);
++ data = 0;
++ status = ar6000_ReadRegDiag(hifDevice, &address, &data);
+
-+ cmd = (WMI_SET_ASSOC_INFO_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, cmdLen);
-+ cmd->ieType = ieType;
-+ cmd->bufferSize = ieLen;
-+ A_MEMCPY(cmd->assocInfo, ieInfo, ieLen);
++ if (A_FAILED(status)) {
++ break;
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ASSOC_INFO_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Reset Cause readback: 0x%X \n",data));
++ data &= RESET_CAUSE_LAST_MASK;
++ if (data != 2) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Unable to cold reset the target \n"));
++ }
+
-+A_STATUS
-+wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode)
-+{
-+ void *osbuf;
-+ WMI_POWER_MODE_CMD *cmd;
++ } while (FALSE);
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_LOG_ERR, ("Failed to reset target \n"));
+ }
++#endif
++ return A_OK;
++}
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++#define REG_DUMP_COUNT_AR6001 38 /* WORDs, derived from AR6001_regdump.h */
++#define REG_DUMP_COUNT_AR6002 32 /* WORDs, derived from AR6002_regdump.h */
+
-+ cmd = (WMI_POWER_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->powerMode = powerMode;
-+ wmip->wmi_powerMode = powerMode;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_MODE_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++#if REG_DUMP_COUNT_AR6001 <= REG_DUMP_COUNT_AR6002
++#define REGISTER_DUMP_LEN_MAX REG_DUMP_COUNT_AR6002
++#else
++#define REGISTER_DUMP_LEN_MAX REG_DUMP_COUNT_AR6001
++#endif
+
-+A_STATUS
-+wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
-+ A_UINT16 atim_windows, A_UINT16 timeout_value)
++void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType)
+{
-+ void *osbuf;
-+ WMI_IBSS_PM_CAPS_CMD *cmd;
-+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ A_UINT32 address;
++ A_UINT32 regDumpArea = 0;
++ A_STATUS status;
++ A_UINT32 regDumpValues[REGISTER_DUMP_LEN_MAX];
++ A_UINT32 regDumpCount = 0;
++ A_UINT32 i;
+
-+ cmd = (WMI_IBSS_PM_CAPS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->power_saving = pmEnable;
-+ cmd->ttl = ttl;
-+ cmd->atim_windows = atim_windows;
-+ cmd->timeout_value = timeout_value;
++ do {
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_IBSS_PM_CAPS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* the reg dump pointer is copied to the host interest area */
++ address = HOST_INTEREST_ITEM_ADDRESS(TargetType, hi_failure_state);
+
-+A_STATUS
-+wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
-+ A_UINT16 psPollNum, A_UINT16 dtimPolicy)
-+{
-+ void *osbuf;
-+ WMI_POWER_PARAMS_CMD *pm;
++ if (TargetType == TARGET_TYPE_AR6001) {
++ /* for AR6001, this is a fixed location because the ptr is actually stuck in cache,
++ * this may be fixed in later firmware versions */
++ address = 0x18a0;
++ regDumpCount = REG_DUMP_COUNT_AR6001;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*pm));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ } else if (TargetType == TARGET_TYPE_AR6002) {
+
-+ A_NETBUF_PUT(osbuf, sizeof(*pm));
++ regDumpCount = REG_DUMP_COUNT_AR6002;
+
-+ pm = (WMI_POWER_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(pm, sizeof(*pm));
-+ pm->idle_period = idlePeriod;
-+ pm->pspoll_number = psPollNum;
-+ pm->dtim_policy = dtimPolicy;
++ } else {
++ A_ASSERT(0);
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* read RAM location through diagnostic window */
++ status = ar6000_ReadRegDiag(hifDevice, &address, ®DumpArea);
+
-+A_STATUS
-+wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout)
-+{
-+ void *osbuf;
-+ WMI_DISC_TIMEOUT_CMD *cmd;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get ptr to register dump area \n"));
++ break;
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Location of register dump data: 0x%X \n",regDumpArea));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ if (regDumpArea == 0) {
++ /* no reg dump */
++ break;
++ }
+
-+ cmd = (WMI_DISC_TIMEOUT_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->disconnectTimeout = timeout;
++ if (TargetType == TARGET_TYPE_AR6001) {
++ regDumpArea &= 0x0FFFFFFF; /* convert to physical address in target memory */
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_DISC_TIMEOUT_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* fetch register dump data */
++ status = ar6000_ReadDataDiag(hifDevice,
++ regDumpArea,
++ (A_UCHAR *)®DumpValues[0],
++ regDumpCount * (sizeof(A_UINT32)));
+
-+A_STATUS
-+wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex, CRYPTO_TYPE keyType,
-+ A_UINT8 keyUsage, A_UINT8 keyLength, A_UINT8 *keyRSC,
-+ A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
-+ WMI_SYNC_FLAG sync_flag)
-+{
-+ void *osbuf;
-+ WMI_ADD_CIPHER_KEY_CMD *cmd;
++ if (A_FAILED(status)) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Failed to get register dump \n"));
++ break;
++ }
+
-+ if ((keyIndex > WMI_MAX_KEY_INDEX) || (keyLength > WMI_MAX_KEY_LEN) ||
-+ (keyMaterial == NULL))
-+ {
-+ return A_EINVAL;
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: Register Dump: \n"));
+
-+ if ((WEP_CRYPT != keyType) && (NULL == keyRSC)) {
-+ return A_EINVAL;
-+ }
++ for (i = 0; i < regDumpCount; i++) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" %d : 0x%8.8X \n",i, regDumpValues[i]));
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ } while (FALSE);
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++}
+
-+ cmd = (WMI_ADD_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->keyIndex = keyIndex;
-+ cmd->keyType = keyType;
-+ cmd->keyUsage = keyUsage;
-+ cmd->keyLength = keyLength;
-+ A_MEMCPY(cmd->key, keyMaterial, keyLength);
-+ if (NULL != keyRSC) {
-+ A_MEMCPY(cmd->keyRSC, keyRSC, sizeof(cmd->keyRSC));
-+ }
-+ cmd->key_op_ctrl = key_op_ctrl;
+diff --git a/drivers/ar6000/miscdrv/credit_dist.c b/drivers/ar6000/miscdrv/credit_dist.c
+new file mode 100644
+index 0000000..8d37d62
+--- /dev/null
++++ b/drivers/ar6000/miscdrv/credit_dist.c
+@@ -0,0 +1,346 @@
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_CIPHER_KEY_CMDID, sync_flag));
-+}
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+A_STATUS
-+wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk)
-+{
-+ void *osbuf;
-+ WMI_ADD_KRK_CMD *cmd;
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "a_osapi.h"
++#include "a_debug.h"
++#include "htc_api.h"
++#include "common_drv.h"
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++/********* CREDIT DISTRIBUTION FUNCTIONS ******************************************/
+
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++#define NO_VO_SERVICE 1 /* currently WMI only uses 3 data streams, so we leave VO service inactive */
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++#ifdef NO_VO_SERVICE
++#define DATA_SVCS_USED 3
++#else
++#define DATA_SVCS_USED 4
++#endif
+
-+ cmd = (WMI_ADD_KRK_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ A_MEMCPY(cmd->krk, krk, WMI_KRK_LEN);
++static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_KRK_CMDID, NO_SYNC_WMIFLAG));
-+}
++static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDistList);
+
-+A_STATUS
-+wmi_delete_krk_cmd(struct wmi_t *wmip)
++/* reduce an ep's credits back to a set limit */
++static INLINE void ReduceCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
++ HTC_ENDPOINT_CREDIT_DIST *pEpDist,
++ int Limit)
+{
-+ void *osbuf;
++ int credits;
+
-+ osbuf = A_NETBUF_ALLOC(0);
++ /* set the new limit */
++ pEpDist->TxCreditsAssigned = Limit;
+
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (pEpDist->TxCredits <= Limit) {
++ return;
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_KRK_CMDID, NO_SYNC_WMIFLAG));
++ /* figure out how much to take away */
++ credits = pEpDist->TxCredits - Limit;
++ /* take them away */
++ pEpDist->TxCredits -= credits;
++ pCredInfo->CurrentFreeCredits += credits;
+}
+
-+A_STATUS
-+wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex)
-+{
-+ void *osbuf;
-+ WMI_DELETE_CIPHER_KEY_CMD *cmd;
++/* give an endpoint some credits from the free credit pool */
++#define GiveCredits(pCredInfo,pEpDist,credits) \
++{ \
++ (pEpDist)->TxCredits += (credits); \
++ (pEpDist)->TxCreditsAssigned += (credits); \
++ (pCredInfo)->CurrentFreeCredits -= (credits); \
++}
+
-+ if (keyIndex > WMI_MAX_KEY_INDEX) {
-+ return A_EINVAL;
-+ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++/* default credit init callback.
++ * This function is called in the context of HTCStart() to setup initial (application-specific)
++ * credit distributions */
++static void ar6000_credit_init(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPList,
++ int TotalCredits)
++{
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
++ int count;
++ COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ pCredInfo->CurrentFreeCredits = TotalCredits;
++ pCredInfo->TotalAvailableCredits = TotalCredits;
+
-+ cmd = (WMI_DELETE_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->keyIndex = keyIndex;
++ pCurEpDist = pEPList;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_CIPHER_KEY_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* run through the list and initialize */
++ while (pCurEpDist != NULL) {
+
-+A_STATUS
-+wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
-+ A_BOOL set)
-+{
-+ void *osbuf;
-+ WMI_SET_PMKID_CMD *cmd;
++ /* set minimums for each endpoint */
++ pCurEpDist->TxCreditsMin = pCurEpDist->TxCreditsPerMaxMsg;
+
-+ if (bssid == NULL) {
-+ return A_EINVAL;
-+ }
++ if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
++ /* give control service some credits */
++ GiveCredits(pCredInfo,pCurEpDist,pCurEpDist->TxCreditsMin);
++ /* control service is always marked active, it never goes inactive EVER */
++ SET_EP_ACTIVE(pCurEpDist);
++ } else if (pCurEpDist->ServiceID == WMI_DATA_BK_SVC) {
++ /* this is the lowest priority data endpoint, save this off for easy access */
++ pCredInfo->pLowestPriEpDist = pCurEpDist;
++ }
+
-+ if ((set == TRUE) && (pmkId == NULL)) {
-+ return A_EINVAL;
++ /* Streams have to be created (explicit | implicit)for all kinds
++ * of traffic. BE endpoints are also inactive in the beginning.
++ * When BE traffic starts it creates implicit streams that
++ * redistributes credits.
++ */
++
++ /* note, all other endpoints have minimums set but are initially given NO credits.
++ * Credits will be distributed as traffic activity demands */
++ pCurEpDist = pCurEpDist->pNext;
+ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (pCredInfo->CurrentFreeCredits <= 0) {
++ AR_DEBUG_PRINTF(ATH_LOG_INF, ("Not enough credits (%d) to do credit distributions \n", TotalCredits));
++ A_ASSERT(FALSE);
++ return;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ /* reset list */
++ pCurEpDist = pEPList;
++ /* now run through the list and set max operating credit limits for everyone */
++ while (pCurEpDist != NULL) {
++ if (pCurEpDist->ServiceID == WMI_CONTROL_SVC) {
++ /* control service max is just 1 max message */
++ pCurEpDist->TxCreditsNorm = pCurEpDist->TxCreditsPerMaxMsg;
++ } else {
++ /* for the remaining data endpoints, we assume that each TxCreditsPerMaxMsg are
++ * the same.
++ * We use a simple calculation here, we take the remaining credits and
++ * determine how many max messages this can cover and then set each endpoint's
++ * normal value equal to half this amount.
++ * */
++ count = (pCredInfo->CurrentFreeCredits/pCurEpDist->TxCreditsPerMaxMsg) * pCurEpDist->TxCreditsPerMaxMsg;
++ count = count >> 1;
++ count = max(count,pCurEpDist->TxCreditsPerMaxMsg);
++ /* set normal */
++ pCurEpDist->TxCreditsNorm = count;
+
-+ cmd = (WMI_SET_PMKID_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+ if (set == TRUE) {
-+ A_MEMCPY(cmd->pmkid, pmkId, sizeof(cmd->pmkid));
-+ cmd->enable = PMKID_ENABLE;
-+ } else {
-+ A_MEMZERO(cmd->pmkid, sizeof(cmd->pmkid));
-+ cmd->enable = PMKID_DISABLE;
++ }
++ pCurEpDist = pCurEpDist->pNext;
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_CMDID, NO_SYNC_WMIFLAG));
+}
+
-+A_STATUS
-+wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en)
++
++/* default credit distribution callback
++ * This callback is invoked whenever endpoints require credit distributions.
++ * A lock is held while this function is invoked, this function shall NOT block.
++ * The pEPDistList is a list of distribution structures in prioritized order as
++ * defined by the call to the HTCSetCreditDistribution() api.
++ *
++ */
++static void ar6000_credit_distribute(void *Context,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDistList,
++ HTC_CREDIT_DIST_REASON Reason)
+{
-+ void *osbuf;
-+ WMI_SET_TKIP_COUNTERMEASURES_CMD *cmd;
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
++ COMMON_CREDIT_STATE_INFO *pCredInfo = (COMMON_CREDIT_STATE_INFO *)Context;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ switch (Reason) {
++ case HTC_CREDIT_DIST_SEND_COMPLETE :
++ pCurEpDist = pEPDistList;
++ /* we are given the start of the endpoint distribution list.
++ * There may be one or more endpoints to service.
++ * Run through the list and distribute credits */
++ while (pCurEpDist != NULL) {
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ if (pCurEpDist->TxCreditsToDist > 0) {
++ /* return the credits back to the endpoint */
++ pCurEpDist->TxCredits += pCurEpDist->TxCreditsToDist;
++ /* always zero out when we are done */
++ pCurEpDist->TxCreditsToDist = 0;
+
-+ cmd = (WMI_SET_TKIP_COUNTERMEASURES_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->cm_en = (en == TRUE)? WMI_TKIP_CM_ENABLE : WMI_TKIP_CM_DISABLE;
++ if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsAssigned) {
++ /* reduce to the assigned limit, previous credit reductions
++ * could have caused the limit to change */
++ ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsAssigned);
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_TKIP_COUNTERMEASURES_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ if (pCurEpDist->TxCredits > pCurEpDist->TxCreditsNorm) {
++ /* oversubscribed endpoints need to reduce back to normal */
++ ReduceCredits(pCredInfo, pCurEpDist, pCurEpDist->TxCreditsNorm);
++ }
++ }
+
-+A_STATUS
-+wmi_set_akmp_params_cmd(struct wmi_t *wmip,
-+ WMI_SET_AKMP_PARAMS_CMD *akmpParams)
-+{
-+ void *osbuf;
-+ WMI_SET_AKMP_PARAMS_CMD *cmd;
++ pCurEpDist = pCurEpDist->pNext;
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+ cmd = (WMI_SET_AKMP_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->akmpInfo = akmpParams->akmpInfo;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_AKMP_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
-+ WMI_SET_PMKID_LIST_CMD *pmkInfo)
-+{
-+ void *osbuf;
-+ WMI_SET_PMKID_LIST_CMD *cmd;
-+ A_UINT16 cmdLen;
-+ A_UINT8 i;
-+
-+ cmdLen = sizeof(pmkInfo->numPMKID) +
-+ pmkInfo->numPMKID * sizeof(WMI_PMKID);
-+
-+ osbuf = A_NETBUF_ALLOC(cmdLen);
-+
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ break;
+
-+ A_NETBUF_PUT(osbuf, cmdLen);
-+ cmd = (WMI_SET_PMKID_LIST_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->numPMKID = pmkInfo->numPMKID;
++ case HTC_CREDIT_DIST_ACTIVITY_CHANGE :
++ RedistributeCredits(pCredInfo,pEPDistList);
++ break;
++ case HTC_CREDIT_DIST_SEEK_CREDITS :
++ SeekCredits(pCredInfo,pEPDistList);
++ break;
++ case HTC_DUMP_CREDIT_STATE :
++ AR_DEBUG_PRINTF(ATH_LOG_INF, ("Credit Distribution, total : %d, free : %d\n",
++ pCredInfo->TotalAvailableCredits, pCredInfo->CurrentFreeCredits));
++ break;
++ default:
++ break;
+
-+ for (i = 0; i < cmd->numPMKID; i++) {
-+ A_MEMCPY(&cmd->pmkidList[i], &pmkInfo->pmkidList[i],
-+ WMI_PMKID_LEN);
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_LIST_CMDID,
-+ NO_SYNC_WMIFLAG));
+}
+
-+A_STATUS
-+wmi_get_pmkid_list_cmd(struct wmi_t *wmip)
++/* redistribute credits based on activity change */
++static void RedistributeCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDistList)
+{
-+ void *osbuf;
-+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist = pEPDistList;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_PMKID_LIST_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* walk through the list and remove credits from inactive endpoints */
++ while (pCurEpDist != NULL) {
+
-+A_STATUS
-+wmi_dataSync_send(struct wmi_t *wmip, void *osbuf, WMI_PRI_STREAM_ID streamID)
-+{
-+ WMI_DATA_HDR *dtHdr;
++ if (pCurEpDist->ServiceID != WMI_CONTROL_SVC) {
++ if (!IS_EP_ACTIVE(pCurEpDist)) {
++ /* EP is inactive, reduce credits back to zero */
++ ReduceCredits(pCredInfo, pCurEpDist, 0);
++ }
++ }
+
-+ A_ASSERT(streamID != WMI_CONTROL_PRI);
-+ A_ASSERT(osbuf != NULL);
++ /* NOTE in the active case, we do not need to do anything further,
++ * when an EP goes active and needs credits, HTC will call into
++ * our distribution function using a reason code of HTC_CREDIT_DIST_SEEK_CREDITS */
+
-+ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
-+ return A_NO_MEMORY;
++ pCurEpDist = pCurEpDist->pNext;
+ }
+
-+ dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
-+ dtHdr->info =
-+ (SYNC_MSGTYPE & WMI_DATA_HDR_MSG_TYPE_MASK) << WMI_DATA_HDR_MSG_TYPE_SHIFT;
-+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - streamID %d\n", DBGARG, streamID));
++ A_ASSERT(pCredInfo->CurrentFreeCredits <= pCredInfo->TotalAvailableCredits);
+
-+ return (A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID));
+}
+
-+typedef struct _WMI_DATA_SYNC_BUFS {
-+ A_UINT8 trafficClass;
-+ void *osbuf;
-+}WMI_DATA_SYNC_BUFS;
-+
-+static A_STATUS
-+wmi_sync_point(struct wmi_t *wmip)
++/* HTC has an endpoint that needs credits, pEPDist is the endpoint in question */
++static void SeekCredits(COMMON_CREDIT_STATE_INFO *pCredInfo,
++ HTC_ENDPOINT_CREDIT_DIST *pEPDist)
+{
-+ void *cmd_osbuf;
-+ WMI_DATA_SYNC_BUFS dataSyncBufs[WMM_NUM_AC];
-+ A_UINT8 i,numPriStreams=0;
-+ A_STATUS status;
-+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+ memset(dataSyncBufs,0,sizeof(dataSyncBufs));
++ HTC_ENDPOINT_CREDIT_DIST *pCurEpDist;
++ int credits = 0;
++ int need;
+
-+ /* lock out while we walk through the priority list and assemble our local array */
-+ LOCK_WMI(wmip);
++ do {
+
-+ for (i=0; i < WMM_NUM_AC ; i++) {
-+ if (wmip->wmi_fatPipeExists & (1 << i)) {
-+ numPriStreams++;
-+ dataSyncBufs[numPriStreams-1].trafficClass = i;
++ if (pEPDist->ServiceID == WMI_CONTROL_SVC) {
++ /* we never oversubscribe on the control service, this is not
++ * a high performance path and the target never holds onto control
++ * credits for too long */
++ break;
+ }
-+ }
+
-+ UNLOCK_WMI(wmip);
++ /* for all other services, we follow a simple algorithm of
++ * 1. checking the free pool for credits
++ * 2. checking lower priority endpoints for credits to take */
+
-+ /* dataSyncBufs is now filled with entries (starting at index 0) containing valid streamIDs */
++ if (pCredInfo->CurrentFreeCredits >= 2 * pEPDist->TxCreditsSeek) {
++ /* try to give more credits than it needs */
++ credits = 2 * pEPDist->TxCreditsSeek;
++ } else {
++ /* give what we can */
++ credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
++ }
+
-+ do {
-+ /*
-+ * We allocate all network buffers needed so we will be able to
-+ * send all required frames.
-+ */
-+ cmd_osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (cmd_osbuf == NULL) {
-+ status = A_NO_MEMORY;
++ if (credits >= pEPDist->TxCreditsSeek) {
++ /* we found some to fullfill the seek request */
+ break;
-+ }
-+
-+ for (i=0; i < numPriStreams ; i++) {
-+ dataSyncBufs[i].osbuf = A_NETBUF_ALLOC(0);
-+ if (dataSyncBufs[i].osbuf == NULL) {
-+ status = A_NO_MEMORY;
-+ break;
-+ }
-+ } //end for
++ }
+
-+ /*
-+ * Send sync cmd followed by sync data messages on all endpoints being
-+ * used
-+ */
-+ status = wmi_cmd_send(wmip, cmd_osbuf, WMI_SYNCHRONIZE_CMDID,
-+ NO_SYNC_WMIFLAG);
++ /* we don't have enough in the free pool, try taking away from lower priority services
++ *
++ * The rule for taking away credits:
++ * 1. Only take from lower priority endpoints
++ * 2. Only take what is allocated above the minimum (never starve an endpoint completely)
++ * 3. Only take what you need.
++ *
++ * */
+
-+ if (A_FAILED(status)) {
-+ break;
-+ }
-+ /* cmd buffer sent, we no longer own it */
-+ cmd_osbuf = NULL;
++ /* starting at the lowest priority */
++ pCurEpDist = pCredInfo->pLowestPriEpDist;
+
-+ for(i=0; i < numPriStreams; i++) {
-+ A_ASSERT(dataSyncBufs[i].osbuf != NULL);
++ /* work backwards until we hit the endpoint again */
++ while (pCurEpDist != pEPDist) {
++ /* calculate how many we need so far */
++ need = pEPDist->TxCreditsSeek - pCredInfo->CurrentFreeCredits;
+
-+ status = wmi_dataSync_send(wmip, dataSyncBufs[i].osbuf,
-+ WMI_ACCESSCATEGORY_WMISTREAM(wmip,dataSyncBufs[i].trafficClass));
++ if ((pCurEpDist->TxCreditsAssigned - need) > pCurEpDist->TxCreditsMin) {
++ /* the current one has been allocated more than it's minimum and it
++ * has enough credits assigned above it's minimum to fullfill our need
++ * try to take away just enough to fullfill our need */
++ ReduceCredits(pCredInfo,
++ pCurEpDist,
++ pCurEpDist->TxCreditsAssigned - need);
+
-+ if (A_FAILED(status)) {
-+ break;
++ if (pCredInfo->CurrentFreeCredits >= pEPDist->TxCreditsSeek) {
++ /* we have enough */
++ break;
++ }
+ }
-+ /* we don't own this buffer anymore, NULL it out of the array so it
-+ * won't get cleaned up */
-+ dataSyncBufs[i].osbuf = NULL;
-+ } //end for
+
-+ } while(FALSE);
++ pCurEpDist = pCurEpDist->pPrev;
++ }
+
-+ /* free up any resources left over (possibly due to an error) */
++ /* return what we can get */
++ credits = min(pCredInfo->CurrentFreeCredits,pEPDist->TxCreditsSeek);
+
-+ if (cmd_osbuf != NULL) {
-+ A_NETBUF_FREE(cmd_osbuf);
-+ }
++ } while (FALSE);
+
-+ for (i = 0; i < numPriStreams; i++) {
-+ if (dataSyncBufs[i].osbuf != NULL) {
-+ A_NETBUF_FREE(dataSyncBufs[i].osbuf);
-+ }
++ /* did we find some credits? */
++ if (credits) {
++ /* give what we can */
++ GiveCredits(pCredInfo, pEPDist, credits);
+ }
+
-+ return (status);
+}
+
-+A_STATUS
-+wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *params)
++/* initialize and setup credit distribution */
++A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo)
+{
-+ void *osbuf;
-+ WMI_CREATE_PSTREAM_CMD *cmd;
-+ A_UINT16 activeTsids=0;
-+ A_UINT8 fatPipeExistsForAC=0;
++ HTC_SERVICE_ID servicepriority[5];
+
-+ /* Validate all the parameters. */
-+ if( !((params->userPriority < 8) &&
-+ (params->userPriority <= 0x7) &&
-+ (convert_userPriority_to_trafficClass(params->userPriority) == params->trafficClass) &&
-+ (params->trafficDirection == UPLINK_TRAFFIC ||
-+ params->trafficDirection == DNLINK_TRAFFIC ||
-+ params->trafficDirection == BIDIR_TRAFFIC) &&
-+ (params->trafficType == TRAFFIC_TYPE_APERIODIC ||
-+ params->trafficType == TRAFFIC_TYPE_PERIODIC ) &&
-+ (params->voicePSCapability == DISABLE_FOR_THIS_AC ||
-+ params->voicePSCapability == ENABLE_FOR_THIS_AC ||
-+ params->voicePSCapability == ENABLE_FOR_ALL_AC) &&
-+ (params->tsid == WMI_IMPLICIT_PSTREAM || params->tsid <= WMI_MAX_THINSTREAM)) )
-+ {
-+ return A_EINVAL;
-+ }
++ A_MEMZERO(pCredInfo,sizeof(COMMON_CREDIT_STATE_INFO));
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ servicepriority[0] = WMI_CONTROL_SVC; /* highest */
++ servicepriority[1] = WMI_DATA_VO_SVC;
++ servicepriority[2] = WMI_DATA_VI_SVC;
++ servicepriority[3] = WMI_DATA_BE_SVC;
++ servicepriority[4] = WMI_DATA_BK_SVC; /* lowest */
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ /* set callbacks and priority list */
++ HTCSetCreditDistribution(HTCHandle,
++ pCredInfo,
++ ar6000_credit_distribute,
++ ar6000_credit_init,
++ servicepriority,
++ 5);
+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Sending create_pstream_cmd: ac=%d tsid:%d\n", DBGARG,
-+ params->trafficClass, params->tsid));
++ return A_OK;
++}
+
-+ cmd = (WMI_CREATE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ A_MEMCPY(cmd, params, sizeof(*cmd));
+diff --git a/drivers/ar6000/wlan/wlan_node.c b/drivers/ar6000/wlan/wlan_node.c
+new file mode 100644
+index 0000000..b124845
+--- /dev/null
++++ b/drivers/ar6000/wlan/wlan_node.c
+@@ -0,0 +1,371 @@
++/*-
++ * Copyright (c) 2001 Atsushi Onoe
++ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
++ * Copyright (c) 2004-2005 Atheros Communications
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ * notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ * 3. The name of the author may not be used to endorse or promote products
++ * derived from this software without specific prior written permission.
++ *
++ * Alternatively, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2 as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_node.c#1 $
++ */
++/*
++ * IEEE 802.11 node handling support.
++ */
++#include <a_config.h>
++#include <athdefs.h>
++#include <a_types.h>
++#include <a_osapi.h>
++#include <a_debug.h>
++#include <ieee80211.h>
++#include <wlan_api.h>
++#include <ieee80211_node.h>
++#include <htc_api.h>
++#include <wmi.h>
++#include <wmi_api.h>
+
-+ /* this is an implicitly created Fat pipe */
-+ if (params->tsid == WMI_IMPLICIT_PSTREAM) {
-+ LOCK_WMI(wmip);
-+ fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
-+ wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
-+ UNLOCK_WMI(wmip);
++static void wlan_node_timeout(A_ATH_TIMER arg);
++static bss_t * _ieee80211_find_node(struct ieee80211_node_table *nt,
++ const A_UINT8 *macaddr);
++
++bss_t *
++wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size)
++{
++ bss_t *ni;
++
++ ni = A_MALLOC_NOWAIT(sizeof(bss_t));
++
++ if (ni != NULL) {
++ ni->ni_buf = A_MALLOC_NOWAIT(wh_size);
++ if (ni->ni_buf == NULL) {
++ A_FREE(ni);
++ ni = NULL;
++ return ni;
++ }
+ } else {
-+ /* this is an explicitly created thin stream within a fat pipe */
-+ LOCK_WMI(wmip);
-+ fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
-+ activeTsids = wmip->wmi_streamExistsForAC[params->trafficClass];
-+ wmip->wmi_streamExistsForAC[params->trafficClass] |= (1<<params->tsid);
-+ /* if a thinstream becomes active, the fat pipe automatically
-+ * becomes active
-+ */
-+ wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
-+ UNLOCK_WMI(wmip);
++ return ni;
+ }
+
-+ /* Indicate activty change to driver layer only if this is the
-+ * first TSID to get created in this AC explicitly or an implicit
-+ * fat pipe is getting created.
-+ */
-+ if (!fatPipeExistsForAC) {
-+ A_WMI_STREAM_TX_ACTIVE(wmip->wmi_devt, params->trafficClass);
-+ }
++ /* Make sure our lists are clean */
++ ni->ni_list_next = NULL;
++ ni->ni_list_prev = NULL;
++ ni->ni_hash_next = NULL;
++ ni->ni_hash_prev = NULL;
+
-+ /* mike: should be SYNC_BEFORE_WMIFLAG */
-+ return (wmi_cmd_send(wmip, osbuf, WMI_CREATE_PSTREAM_CMDID,
-+ NO_SYNC_WMIFLAG));
++ //
++ // ni_scangen never initialized before and during suspend/resume of winmobile, customer (LG/SEMCO) identified
++ // that some junk has been stored in this, due to this scan list didn't properly updated
++ //
++ ni->ni_scangen = 0;
++
++ return ni;
+}
+
-+A_STATUS
-+wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 tsid)
++void
++wlan_node_free(bss_t *ni)
+{
-+ void *osbuf;
-+ WMI_DELETE_PSTREAM_CMD *cmd;
-+ A_STATUS status;
-+ A_UINT16 activeTsids=0;
-+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (ni->ni_buf != NULL) {
++ A_FREE(ni->ni_buf);
+ }
++ A_FREE(ni);
++}
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_DELETE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
++void
++wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
++ const A_UINT8 *macaddr)
++{
++ int hash;
+
-+ cmd->trafficClass = trafficClass;
-+ cmd->tsid = tsid;
++ A_MEMCPY(ni->ni_macaddr, macaddr, IEEE80211_ADDR_LEN);
++ hash = IEEE80211_NODE_HASH(macaddr);
++ ieee80211_node_initref(ni); /* mark referenced */
+
-+ LOCK_WMI(wmip);
-+ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
-+ UNLOCK_WMI(wmip);
++ ni->ni_tstamp = A_GET_MS(WLAN_NODE_INACT_TIMEOUT_MSEC);
++ IEEE80211_NODE_LOCK_BH(nt);
+
-+ /* Check if the tsid was created & exists */
-+ if (!(activeTsids & (1<<tsid))) {
++ /* Insert at the end of the node list */
++ ni->ni_list_next = NULL;
++ ni->ni_list_prev = nt->nt_node_last;
++ if(nt->nt_node_last != NULL)
++ {
++ nt->nt_node_last->ni_list_next = ni;
++ }
++ nt->nt_node_last = ni;
++ if(nt->nt_node_first == NULL)
++ {
++ nt->nt_node_first = ni;
++ }
+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "TSID %d does'nt exist for trafficClass: %d\n", DBGARG, tsid, trafficClass));
-+ /* TODO: return a more appropriate err code */
-+ return A_ERROR;
++ /* Insert into the hash list i.e. the bucket */
++ if((ni->ni_hash_next = nt->nt_hash[hash]) != NULL)
++ {
++ nt->nt_hash[hash]->ni_hash_prev = ni;
+ }
++ ni->ni_hash_prev = NULL;
++ nt->nt_hash[hash] = ni;
+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Sending delete_pstream_cmd: trafficClass: %d tsid=%d\n", DBGARG, trafficClass, tsid));
++ if (!nt->isTimerArmed) {
++ A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
++ nt->isTimerArmed = TRUE;
++ }
+
-+ status = (wmi_cmd_send(wmip, osbuf, WMI_DELETE_PSTREAM_CMDID,
-+ SYNC_BEFORE_WMIFLAG));
++ IEEE80211_NODE_UNLOCK_BH(nt);
++}
+
-+ LOCK_WMI(wmip);
-+ wmip->wmi_streamExistsForAC[trafficClass] &= ~(1<<tsid);
-+ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
-+ UNLOCK_WMI(wmip);
++static bss_t *
++_ieee80211_find_node(struct ieee80211_node_table *nt,
++ const A_UINT8 *macaddr)
++{
++ bss_t *ni;
++ int hash;
+
++ IEEE80211_NODE_LOCK_ASSERT(nt);
+
-+ /* Indicate stream inactivity to driver layer only if all tsids
-+ * within this AC are deleted.
-+ */
-+ if(!activeTsids) {
-+ A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, trafficClass);
-+ wmip->wmi_fatPipeExists &= ~(1<<trafficClass);
++ hash = IEEE80211_NODE_HASH(macaddr);
++ for(ni = nt->nt_hash[hash]; ni; ni = ni->ni_hash_next) {
++ if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
++ ieee80211_node_incref(ni); /* mark referenced */
++ return ni;
++ }
+ }
++ return NULL;
++}
+
-+ return status;
++bss_t *
++wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr)
++{
++ bss_t *ni;
++
++ IEEE80211_NODE_LOCK(nt);
++ ni = _ieee80211_find_node(nt, macaddr);
++ IEEE80211_NODE_UNLOCK(nt);
++ return ni;
+}
+
+/*
-+ * used to set the bit rate. rate is in Kbps. If rate == -1
-+ * then auto selection is used.
++ * Reclaim a node. If this is the last reference count then
++ * do the normal free work. Otherwise remove it from the node
++ * table and mark it gone by clearing the back-reference.
+ */
-+A_STATUS
-+wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate)
++void
++wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni)
+{
-+ void *osbuf;
-+ WMI_BIT_RATE_CMD *cmd;
-+ A_INT8 index;
++ IEEE80211_NODE_LOCK(nt);
+
-+ if (rate != -1) {
-+ index = wmi_validate_bitrate(wmip, rate);
-+ if(index == A_EINVAL){
-+ return A_EINVAL;
-+ }
-+ } else {
-+ index = -1;
++ if(ni->ni_list_prev == NULL)
++ {
++ /* First in list so fix the list head */
++ nt->nt_node_first = ni->ni_list_next;
++ }
++ else
++ {
++ ni->ni_list_prev->ni_list_next = ni->ni_list_next;
+ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_BIT_RATE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+
-+ cmd->rateIndex = index;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_get_bitrate_cmd(struct wmi_t *wmip)
-+{
-+ void *osbuf;
-+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if(ni->ni_list_next == NULL)
++ {
++ /* Last in list so fix list tail */
++ nt->nt_node_last = ni->ni_list_prev;
+ }
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+/*
-+ * Returns TRUE iff the given rate index is legal in the current PHY mode.
-+ */
-+A_BOOL
-+wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex)
-+{
-+ WMI_PHY_MODE phyMode = wmip->wmi_phyMode;
-+ A_BOOL isValid = TRUE;
-+ switch(phyMode) {
-+ case WMI_11A_MODE:
-+ if ((rateIndex < MODE_A_SUPPORT_RATE_START) || (rateIndex > MODE_A_SUPPORT_RATE_STOP)) {
-+ isValid = FALSE;
-+ }
-+ break;
-+
-+ case WMI_11B_MODE:
-+ if ((rateIndex < MODE_B_SUPPORT_RATE_START) || (rateIndex > MODE_B_SUPPORT_RATE_STOP)) {
-+ isValid = FALSE;
-+ }
-+ break;
-+
-+ case WMI_11GONLY_MODE:
-+ if ((rateIndex < MODE_GONLY_SUPPORT_RATE_START) || (rateIndex > MODE_GONLY_SUPPORT_RATE_STOP)) {
-+ isValid = FALSE;
-+ }
-+ break;
-+
-+ case WMI_11G_MODE:
-+ case WMI_11AG_MODE:
-+ if ((rateIndex < MODE_G_SUPPORT_RATE_START) || (rateIndex > MODE_G_SUPPORT_RATE_STOP)) {
-+ isValid = FALSE;
-+ }
-+ break;
-+
-+ default:
-+ A_ASSERT(FALSE);
-+ break;
++ else
++ {
++ ni->ni_list_next->ni_list_prev = ni->ni_list_prev;
+ }
+
-+ return isValid;
-+}
-+
-+A_INT8
-+wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate)
-+{
-+ A_INT8 i;
-+ if (rate != -1)
++ if(ni->ni_hash_prev == NULL)
+ {
-+ for (i=0;;i++)
-+ {
-+ if (wmi_rateTable[(A_UINT32) i] == 0) {
-+ return A_EINVAL;
-+ }
-+ if (wmi_rateTable[(A_UINT32) i] == rate) {
-+ break;
-+ }
-+ }
++ /* First in list so fix the list head */
++ int hash;
++ hash = IEEE80211_NODE_HASH(ni->ni_macaddr);
++ nt->nt_hash[hash] = ni->ni_hash_next;
+ }
-+ else{
-+ i = -1;
++ else
++ {
++ ni->ni_hash_prev->ni_hash_next = ni->ni_hash_next;
+ }
+
-+ if(wmi_is_bitrate_index_valid(wmip, i) != TRUE) {
-+ return A_EINVAL;
++ if(ni->ni_hash_next != NULL)
++ {
++ ni->ni_hash_next->ni_hash_prev = ni->ni_hash_prev;
+ }
++ wlan_node_free(ni);
+
-+ return i;
++ IEEE80211_NODE_UNLOCK(nt);
+}
+
-+A_STATUS
-+wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask)
++static void
++wlan_node_dec_free(bss_t *ni)
+{
-+ void *osbuf;
-+ WMI_FIX_RATES_CMD *cmd;
-+ A_UINT32 rateIndex;
-+
-+ /* Make sure all rates in the mask are valid in the current PHY mode */
-+ for(rateIndex = 0; rateIndex < MAX_NUMBER_OF_SUPPORT_RATES; rateIndex++) {
-+ if((1 << rateIndex) & (A_UINT32)fixRatesMask) {
-+ if(wmi_is_bitrate_index_valid(wmip, rateIndex) != TRUE) {
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Set Fix Rates command failed: Given rate is illegal in current PHY mode\n", DBGARG));
-+ return A_EINVAL;
-+ }
-+ }
-+ }
-+
-+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (ieee80211_node_dectestref(ni)) {
++ wlan_node_free(ni);
+ }
-+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_FIX_RATES_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+
-+ cmd->fixRateMask = fixRatesMask;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
+}
+
-+A_STATUS
-+wmi_get_ratemask_cmd(struct wmi_t *wmip)
++void
++wlan_free_allnodes(struct ieee80211_node_table *nt)
+{
-+ void *osbuf;
++ bss_t *ni;
+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ while ((ni = nt->nt_node_first) != NULL) {
++ wlan_node_reclaim(nt, ni);
+ }
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
+}
+
-+A_STATUS
-+wmi_get_channelList_cmd(struct wmi_t *wmip)
++void
++wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
++ void *arg)
+{
-+ void *osbuf;
++ bss_t *ni;
++ A_UINT32 gen;
+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ gen = ++nt->nt_scangen;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_CHANNEL_LIST_CMDID,
-+ NO_SYNC_WMIFLAG));
++ IEEE80211_NODE_LOCK(nt);
++ for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
++ if (ni->ni_scangen != gen) {
++ ni->ni_scangen = gen;
++ (void) ieee80211_node_incref(ni);
++ (*f)(arg, ni);
++ wlan_node_dec_free(ni);
++ }
++ }
++ IEEE80211_NODE_UNLOCK(nt);
+}
+
+/*
-+ * used to generate a wmi sey channel Parameters cmd.
-+ * mode should always be specified and corresponds to the phy mode of the
-+ * wlan.
-+ * numChan should alway sbe specified. If zero indicates that all available
-+ * channels should be used.
-+ * channelList is an array of channel frequencies (in Mhz) which the radio
-+ * should limit its operation to. It should be NULL if numChan == 0. Size of
-+ * array should correspond to numChan entries.
++ * Node table support.
+ */
-+A_STATUS
-+wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
-+ WMI_PHY_MODE mode, A_INT8 numChan,
-+ A_UINT16 *channelList)
++void
++wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt)
+{
-+ void *osbuf;
-+ WMI_CHANNEL_PARAMS_CMD *cmd;
-+ A_INT8 size;
-+
-+ size = sizeof (*cmd);
++ int i;
+
-+ if (numChan) {
-+ if (numChan > WMI_MAX_CHANNELS) {
-+ return A_EINVAL;
-+ }
-+ size += sizeof(A_UINT16) * (numChan - 1);
-+ }
++ AR_DEBUG_PRINTF(ATH_DEBUG_WLAN, ("node table = 0x%x\n", (A_UINT32)nt));
++ IEEE80211_NODE_LOCK_INIT(nt);
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ nt->nt_node_first = nt->nt_node_last = NULL;
++ for(i = 0; i < IEEE80211_NODE_HASHSIZE; i++)
++ {
++ nt->nt_hash[i] = NULL;
+ }
-+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_CHANNEL_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+
-+ wmip->wmi_phyMode = mode;
-+ cmd->scanParam = scanParam;
-+ cmd->phyMode = mode;
-+ cmd->numChannels = numChan;
-+ A_MEMCPY(cmd->channelList, channelList, numChan * sizeof(A_UINT16));
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_CHANNEL_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
++ A_INIT_TIMER(&nt->nt_inact_timer, wlan_node_timeout, nt);
++ nt->isTimerArmed = FALSE;
++ nt->nt_wmip = wmip;
+}
+
-+A_STATUS
-+wmi_set_rssi_threshold_params(struct wmi_t *wmip,
-+ WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
++static void
++wlan_node_timeout(A_ATH_TIMER arg)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_RSSI_THRESHOLD_PARAMS_CMD *cmd;
-+ /* These values are in ascending order */
-+ if( rssiCmd->thresholdAbove6_Val <= rssiCmd->thresholdAbove5_Val ||
-+ rssiCmd->thresholdAbove5_Val <= rssiCmd->thresholdAbove4_Val ||
-+ rssiCmd->thresholdAbove4_Val <= rssiCmd->thresholdAbove3_Val ||
-+ rssiCmd->thresholdAbove3_Val <= rssiCmd->thresholdAbove2_Val ||
-+ rssiCmd->thresholdAbove2_Val <= rssiCmd->thresholdAbove1_Val ||
-+ rssiCmd->thresholdBelow6_Val <= rssiCmd->thresholdBelow5_Val ||
-+ rssiCmd->thresholdBelow5_Val <= rssiCmd->thresholdBelow4_Val ||
-+ rssiCmd->thresholdBelow4_Val <= rssiCmd->thresholdBelow3_Val ||
-+ rssiCmd->thresholdBelow3_Val <= rssiCmd->thresholdBelow2_Val ||
-+ rssiCmd->thresholdBelow2_Val <= rssiCmd->thresholdBelow1_Val) {
++ struct ieee80211_node_table *nt = (struct ieee80211_node_table *)arg;
++ bss_t *bss, *nextBss;
++ A_UINT8 myBssid[IEEE80211_ADDR_LEN], reArmTimer = FALSE;
+
-+ return A_EINVAL;
-+ }
++ wmi_get_current_bssid(nt->nt_wmip, myBssid);
+
-+ size = sizeof (*cmd);
++ bss = nt->nt_node_first;
++ while (bss != NULL)
++ {
++ nextBss = bss->ni_list_next;
++ if (A_MEMCMP(myBssid, bss->ni_macaddr, sizeof(myBssid)) != 0)
++ {
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (bss->ni_tstamp <= A_GET_MS(0))
++ {
++ /*
++ * free up all but the current bss - if set
++ */
++ wlan_node_reclaim(nt, bss);
++ }
++ else
++ {
++ /*
++ * Re-arm timer, only when we have a bss other than
++ * current bss AND it is not aged-out.
++ */
++ reArmTimer = TRUE;
++ }
++ }
++ bss = nextBss;
+ }
+
-+ A_NETBUF_PUT(osbuf, size);
++ if(reArmTimer)
++ A_TIMEOUT_MS(&nt->nt_inact_timer, WLAN_NODE_INACT_TIMEOUT_MSEC, 0);
+
-+ cmd = (WMI_RSSI_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, rssiCmd, sizeof(WMI_RSSI_THRESHOLD_PARAMS_CMD));
++ nt->isTimerArmed = reArmTimer;
++}
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_RSSI_THRESHOLD_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
++void
++wlan_node_table_cleanup(struct ieee80211_node_table *nt)
++{
++ A_UNTIMEOUT(&nt->nt_inact_timer);
++ A_DELETE_TIMER(&nt->nt_inact_timer);
++ wlan_free_allnodes(nt);
++ IEEE80211_NODE_LOCK_DESTROY(nt);
+}
+
-+A_STATUS
-+wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip,
-+ WMI_SET_HOST_SLEEP_MODE_CMD *hostModeCmd)
++bss_t *
++wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
++ A_UINT32 ssidLength, A_BOOL bIsWPA2)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_SET_HOST_SLEEP_MODE_CMD *cmd;
++ bss_t *ni = NULL;
++ A_UCHAR *pIESsid = NULL;
+
-+ if( hostModeCmd->awake == hostModeCmd->asleep) {
-+ return A_EINVAL;
-+ }
++ IEEE80211_NODE_LOCK (nt);
+
-+ size = sizeof (*cmd);
++ for (ni = nt->nt_node_first; ni; ni = ni->ni_list_next) {
++ pIESsid = ni->ni_cie.ie_ssid;
++ if (pIESsid[1] <= 32) {
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ // Step 1 : Check SSID
++ if (0x00 == memcmp (pSsid, &pIESsid[2], ssidLength)) {
+
-+ A_NETBUF_PUT(osbuf, size);
++ // Step 2 : if SSID matches, check WPA or WPA2
++ if (TRUE == bIsWPA2 && NULL != ni->ni_cie.ie_rsn) {
++ ieee80211_node_incref (ni); /* mark referenced */
++ IEEE80211_NODE_UNLOCK (nt);
++ return ni;
++ }
++ if (FALSE == bIsWPA2 && NULL != ni->ni_cie.ie_wpa) {
++ ieee80211_node_incref(ni); /* mark referenced */
++ IEEE80211_NODE_UNLOCK (nt);
++ return ni;
++ }
++ }
++ }
++ }
+
-+ cmd = (WMI_SET_HOST_SLEEP_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, hostModeCmd, sizeof(WMI_SET_HOST_SLEEP_MODE_CMD));
++ IEEE80211_NODE_UNLOCK (nt);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_HOST_SLEEP_MODE_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return NULL;
+}
+
-+A_STATUS
-+wmi_set_wow_mode_cmd(struct wmi_t *wmip,
-+ WMI_SET_WOW_MODE_CMD *wowModeCmd)
++void
++wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_SET_WOW_MODE_CMD *cmd;
-+
-+ size = sizeof (*cmd);
-+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_SET_WOW_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, wowModeCmd, sizeof(WMI_SET_WOW_MODE_CMD));
++ IEEE80211_NODE_LOCK (nt);
++ wlan_node_dec_free (ni);
++ IEEE80211_NODE_UNLOCK (nt);
++}
+diff --git a/drivers/ar6000/wlan/wlan_recv_beacon.c b/drivers/ar6000/wlan/wlan_recv_beacon.c
+new file mode 100644
+index 0000000..15beabb
+--- /dev/null
++++ b/drivers/ar6000/wlan/wlan_recv_beacon.c
+@@ -0,0 +1,192 @@
++/*-
++ * Copyright (c) 2001 Atsushi Onoe
++ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ * notice, this list of conditions and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ * 3. The name of the author may not be used to endorse or promote products
++ * derived from this software without specific prior written permission.
++ *
++ * Alternatively, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") version 2 as published by the Free
++ * Software Foundation.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++/*
++ * IEEE 802.11 input handling.
++ */
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WOW_MODE_CMDID,
-+ NO_SYNC_WMIFLAG));
++#include "a_config.h"
++#include "athdefs.h"
++#include "a_types.h"
++#include "a_osapi.h"
++#include <wmi.h>
++#include <ieee80211.h>
++#include <wlan_api.h>
+
-+}
++#define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \
++ if ((_len) < (_minlen)) { \
++ return A_EINVAL; \
++ } \
++} while (0)
+
-+A_STATUS
-+wmi_get_wow_list_cmd(struct wmi_t *wmip,
-+ WMI_GET_WOW_LIST_CMD *wowListCmd)
-+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_GET_WOW_LIST_CMD *cmd;
++#define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \
++ if ((__elem) == NULL) { \
++ return A_EINVAL; \
++ } \
++ if ((__elem)[1] > (__maxlen)) { \
++ return A_EINVAL; \
++ } \
++} while (0)
+
-+ size = sizeof (*cmd);
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++/* unaligned little endian access */
++#define LE_READ_2(p) \
++ ((A_UINT16) \
++ ((((A_UINT8 *)(p))[0] ) | (((A_UINT8 *)(p))[1] << 8)))
+
-+ A_NETBUF_PUT(osbuf, size);
++#define LE_READ_4(p) \
++ ((A_UINT32) \
++ ((((A_UINT8 *)(p))[0] ) | (((A_UINT8 *)(p))[1] << 8) | \
++ (((A_UINT8 *)(p))[2] << 16) | (((A_UINT8 *)(p))[3] << 24)))
+
-+ cmd = (WMI_GET_WOW_LIST_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, wowListCmd, sizeof(WMI_GET_WOW_LIST_CMD));
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_WOW_LIST_CMDID,
-+ NO_SYNC_WMIFLAG));
++static int __inline
++iswpaoui(const A_UINT8 *frm)
++{
++ return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
++}
+
++static int __inline
++iswmmoui(const A_UINT8 *frm)
++{
++ return frm[1] > 3 && LE_READ_4(frm+2) == ((WMM_OUI_TYPE<<24)|WMM_OUI);
+}
+
-+static A_STATUS
-+wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++static int __inline
++iswmmparam(const A_UINT8 *frm)
+{
-+ WMI_GET_WOW_LIST_REPLY *reply;
++ return frm[1] > 5 && frm[6] == WMM_PARAM_OUI_SUBTYPE;
++}
+
-+ if (len < sizeof(WMI_GET_WOW_LIST_REPLY)) {
-+ return A_EINVAL;
-+ }
-+ reply = (WMI_GET_WOW_LIST_REPLY *)datap;
++static int __inline
++iswmminfo(const A_UINT8 *frm)
++{
++ return frm[1] > 5 && frm[6] == WMM_INFO_OUI_SUBTYPE;
++}
+
-+ A_WMI_WOW_LIST_EVENT(wmip->wmi_devt, reply->num_filters,
-+ reply);
++static int __inline
++isatherosoui(const A_UINT8 *frm)
++{
++ return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
++}
+
-+ return A_OK;
++static int __inline
++iswscoui(const A_UINT8 *frm)
++{
++ return frm[1] > 3 && LE_READ_4(frm+2) == ((0x04<<24)|WPA_OUI);
+}
+
-+A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
-+ WMI_ADD_WOW_PATTERN_CMD *addWowCmd,
-+ A_UINT8* pattern, A_UINT8* mask,
-+ A_UINT8 pattern_size)
++A_STATUS
++wlan_parse_beacon(A_UINT8 *buf, int framelen, struct ieee80211_common_ie *cie)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_ADD_WOW_PATTERN_CMD *cmd;
-+ A_UINT8 *filter_mask = NULL;
++ A_UINT8 *frm, *efrm;
+
-+ size = sizeof (*cmd);
++ frm = buf;
++ efrm = (A_UINT8 *) (frm + framelen);
+
-+ size += ((2 * addWowCmd->filter_size)* sizeof(A_UINT8));
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, size);
++ /*
++ * beacon/probe response frame format
++ * [8] time stamp
++ * [2] beacon interval
++ * [2] capability information
++ * [tlv] ssid
++ * [tlv] supported rates
++ * [tlv] country information
++ * [tlv] parameter set (FH/DS)
++ * [tlv] erp information
++ * [tlv] extended supported rates
++ * [tlv] WMM
++ * [tlv] WPA or RSN
++ * [tlv] Atheros Advanced Capabilities
++ */
++ IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
++ A_MEMZERO(cie, sizeof(*cie));
+
-+ cmd = (WMI_ADD_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->filter_list_id = addWowCmd->filter_list_id;
-+ cmd->filter_offset = addWowCmd->filter_offset;
-+ cmd->filter_size = addWowCmd->filter_size;
++ cie->ie_tstamp = frm; frm += 8;
++ cie->ie_beaconInt = A_LE2CPU16(*(A_UINT16 *)frm); frm += 2;
++ cie->ie_capInfo = A_LE2CPU16(*(A_UINT16 *)frm); frm += 2;
++ cie->ie_chan = 0;
+
-+ A_MEMCPY(cmd->filter, pattern, addWowCmd->filter_size);
++ while (frm < efrm) {
++ switch (*frm) {
++ case IEEE80211_ELEMID_SSID:
++ cie->ie_ssid = frm;
++ break;
++ case IEEE80211_ELEMID_RATES:
++ cie->ie_rates = frm;
++ break;
++ case IEEE80211_ELEMID_COUNTRY:
++ cie->ie_country = frm;
++ break;
++ case IEEE80211_ELEMID_FHPARMS:
++ break;
++ case IEEE80211_ELEMID_DSPARMS:
++ cie->ie_chan = frm[2];
++ break;
++ case IEEE80211_ELEMID_TIM:
++ cie->ie_tim = frm;
++ break;
++ case IEEE80211_ELEMID_IBSSPARMS:
++ break;
++ case IEEE80211_ELEMID_XRATES:
++ cie->ie_xrates = frm;
++ break;
++ case IEEE80211_ELEMID_ERP:
++ if (frm[1] != 1) {
++ //A_PRINTF("Discarding ERP Element - Bad Len\n");
++ return A_EINVAL;
++ }
++ cie->ie_erp = frm[2];
++ break;
++ case IEEE80211_ELEMID_RSN:
++ cie->ie_rsn = frm;
++ break;
++ case IEEE80211_ELEMID_VENDOR:
++ if (iswpaoui(frm)) {
++ cie->ie_wpa = frm;
++ } else if (iswmmoui(frm)) {
++ cie->ie_wmm = frm;
++ } else if (isatherosoui(frm)) {
++ cie->ie_ath = frm;
++ } else if(iswscoui(frm)) {
++ cie->ie_wsc = frm;
++ }
++ break;
++ default:
++ break;
++ }
++ frm += frm[1] + 2;
++ }
++ IEEE80211_VERIFY_ELEMENT(cie->ie_rates, IEEE80211_RATE_MAXSIZE);
++ IEEE80211_VERIFY_ELEMENT(cie->ie_ssid, IEEE80211_NWID_LEN);
+
-+ filter_mask = (A_UINT8*)(cmd->filter + cmd->filter_size);
-+ A_MEMCPY(filter_mask, mask, addWowCmd->filter_size);
++ return A_OK;
++}
+diff --git a/drivers/ar6000/wlan/wlan_utils.c b/drivers/ar6000/wlan/wlan_utils.c
+new file mode 100644
+index 0000000..fd5aac9
+--- /dev/null
++++ b/drivers/ar6000/wlan/wlan_utils.c
+@@ -0,0 +1,59 @@
++/*
++ * Copyright (c) 2004-2005 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This module implements frequently used wlan utilies
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/wlan/src/wlan_utils.c#1 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
++#include <a_config.h>
++#include <athdefs.h>
++#include <a_types.h>
++#include <a_osapi.h>
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_WOW_PATTERN_CMDID,
-+ NO_SYNC_WMIFLAG));
++/*
++ * converts ieee channel number to frequency
++ */
++A_UINT16
++wlan_ieee2freq(int chan)
++{
++ if (chan == 14) {
++ return 2484;
++ }
++ if (chan < 14) { /* 0-13 */
++ return (2407 + (chan*5));
++ }
++ if (chan < 27) { /* 15-26 */
++ return (2512 + ((chan-15)*20));
++ }
++ return (5000 + (chan*5));
+}
+
-+A_STATUS
-+wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
-+ WMI_DEL_WOW_PATTERN_CMD *delWowCmd)
++/*
++ * Converts MHz frequency to IEEE channel number.
++ */
++A_UINT32
++wlan_freq2ieee(A_UINT16 freq)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_DEL_WOW_PATTERN_CMD *cmd;
++ if (freq == 2484)
++ return 14;
++ if (freq < 2484)
++ return (freq - 2407) / 5;
++ if (freq < 5000)
++ return 15 + ((freq - 2512) / 20);
++ return (freq - 5000) / 5;
++}
+diff --git a/drivers/ar6000/wmi/wmi.c b/drivers/ar6000/wmi/wmi.c
+new file mode 100644
+index 0000000..d322cf3
+--- /dev/null
++++ b/drivers/ar6000/wmi/wmi.c
+@@ -0,0 +1,3954 @@
++/*
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This module implements the hardware independent layer of the
++ * Wireless Module Interface (WMI) protocol.
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi.c#3 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+ size = sizeof (*cmd);
++#include <a_config.h>
++#include <athdefs.h>
++#include <a_types.h>
++#include <a_osapi.h>
++#include "htc.h"
++#include "htc_api.h"
++#include "wmi.h"
++#include <ieee80211.h>
++#include <ieee80211_node.h>
++#include <wlan_api.h>
++#include <wmi_api.h>
++#include "dset_api.h"
++#include "gpio_api.h"
++#include "wmi_host.h"
++#include "a_drv.h"
++#include "a_drv_api.h"
++#include "a_debug.h"
++#include "dbglog_api.h"
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++static A_STATUS wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ A_NETBUF_PUT(osbuf, size);
++static A_STATUS wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_sync_point(struct wmi_t *wmip);
+
-+ cmd = (WMI_DEL_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, delWowCmd, sizeof(WMI_DEL_WOW_PATTERN_CMD));
++static A_STATUS wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_DEL_WOW_PATTERN_CMDID,
-+ NO_SYNC_WMIFLAG));
++static A_STATUS wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++#ifdef CONFIG_HOST_DSET_SUPPORT
++static A_STATUS wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++#endif /* CONFIG_HOST_DSET_SUPPORT */
+
-+}
+
-+A_STATUS
-+wmi_set_snr_threshold_params(struct wmi_t *wmip,
-+ WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
-+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_SNR_THRESHOLD_PARAMS_CMD *cmd;
-+ /* These values are in ascending order */
-+ if( snrCmd->thresholdAbove4_Val <= snrCmd->thresholdAbove3_Val ||
-+ snrCmd->thresholdAbove3_Val <= snrCmd->thresholdAbove2_Val ||
-+ snrCmd->thresholdAbove2_Val <= snrCmd->thresholdAbove1_Val ||
-+ snrCmd->thresholdBelow4_Val <= snrCmd->thresholdBelow3_Val ||
-+ snrCmd->thresholdBelow3_Val <= snrCmd->thresholdBelow2_Val ||
-+ snrCmd->thresholdBelow2_Val <= snrCmd->thresholdBelow1_Val) {
++static A_STATUS wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap,
++ int len);
++static A_STATUS
++wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len);
+
-+ return A_EINVAL;
-+ }
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++static A_STATUS wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++static A_STATUS wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ size = sizeof (*cmd);
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++static A_STATUS
++wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
++#endif
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++static A_STATUS
++wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ A_NETBUF_PUT(osbuf, size);
++static A_STATUS
++wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ cmd = (WMI_SNR_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, snrCmd, sizeof(WMI_SNR_THRESHOLD_PARAMS_CMD));
++static A_STATUS
++wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SNR_THRESHOLD_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++static A_BOOL
++wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex);
+
-+A_STATUS
-+wmi_clr_rssi_snr(struct wmi_t *wmip)
-+{
-+ void *osbuf;
++static A_STATUS
++wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(int));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++static A_STATUS
++wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_CLR_RSSI_SNR_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++static A_STATUS wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len);
+
-+A_STATUS
-+wmi_set_lq_threshold_params(struct wmi_t *wmip,
-+ WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd)
-+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_LQ_THRESHOLD_PARAMS_CMD *cmd;
-+ /* These values are in ascending order */
-+ if( lqCmd->thresholdAbove4_Val <= lqCmd->thresholdAbove3_Val ||
-+ lqCmd->thresholdAbove3_Val <= lqCmd->thresholdAbove2_Val ||
-+ lqCmd->thresholdAbove2_Val <= lqCmd->thresholdAbove1_Val ||
-+ lqCmd->thresholdBelow4_Val <= lqCmd->thresholdBelow3_Val ||
-+ lqCmd->thresholdBelow3_Val <= lqCmd->thresholdBelow2_Val ||
-+ lqCmd->thresholdBelow2_Val <= lqCmd->thresholdBelow1_Val ) {
++int wps_enable;
++static const A_INT32 wmi_rateTable[] = {
++ 1000,
++ 2000,
++ 5500,
++ 11000,
++ 6000,
++ 9000,
++ 12000,
++ 18000,
++ 24000,
++ 36000,
++ 48000,
++ 54000,
++ 0};
+
-+ return A_EINVAL;
-+ }
++#define MODE_A_SUPPORT_RATE_START 4
++#define MODE_A_SUPPORT_RATE_STOP 11
+
-+ size = sizeof (*cmd);
++#define MODE_GONLY_SUPPORT_RATE_START MODE_A_SUPPORT_RATE_START
++#define MODE_GONLY_SUPPORT_RATE_STOP MODE_A_SUPPORT_RATE_STOP
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++#define MODE_B_SUPPORT_RATE_START 0
++#define MODE_B_SUPPORT_RATE_STOP 3
+
-+ A_NETBUF_PUT(osbuf, size);
++#define MODE_G_SUPPORT_RATE_START 0
++#define MODE_G_SUPPORT_RATE_STOP 11
+
-+ cmd = (WMI_LQ_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+ A_MEMCPY(cmd, lqCmd, sizeof(WMI_LQ_THRESHOLD_PARAMS_CMD));
++#define MAX_NUMBER_OF_SUPPORT_RATES (MODE_G_SUPPORT_RATE_STOP + 1)
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_LQ_THRESHOLD_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++/* 802.1d to AC mapping. Refer pg 57 of WMM-test-plan-v1.2 */
++const A_UINT8 up_to_ac[]= {
++ WMM_AC_BE,
++ WMM_AC_BK,
++ WMM_AC_BK,
++ WMM_AC_BE,
++ WMM_AC_VI,
++ WMM_AC_VI,
++ WMM_AC_VO,
++ WMM_AC_VO,
++ };
+
-+A_STATUS
-+wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 mask)
++void *
++wmi_init(void *devt)
+{
-+ void *osbuf;
-+ A_INT8 size;
-+ WMI_TARGET_ERROR_REPORT_BITMASK *cmd;
-+
-+ size = sizeof (*cmd);
++ struct wmi_t *wmip;
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ wmip = A_MALLOC(sizeof(struct wmi_t));
++ if (wmip == NULL) {
++ return (NULL);
+ }
++ A_MEMZERO(wmip, sizeof(*wmip));
++ A_MUTEX_INIT(&wmip->wmi_lock);
++ wmip->wmi_devt = devt;
++ wlan_node_table_init(wmip, &wmip->wmi_scan_table);
++ wmi_qos_state_init(wmip);
++ wmip->wmi_powerMode = REC_POWER;
++ wmip->wmi_phyMode = WMI_11G_MODE;
+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_TARGET_ERROR_REPORT_BITMASK *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+
-+ cmd->bitmask = mask;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return (wmip);
+}
+
-+A_STATUS
-+wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie, A_UINT32 source)
++void
++wmi_qos_state_init(struct wmi_t *wmip)
+{
-+ void *osbuf;
-+ WMIX_HB_CHALLENGE_RESP_CMD *cmd;
++ A_UINT8 i;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (wmip == NULL) {
++ return;
+ }
++ LOCK_WMI(wmip);
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMIX_HB_CHALLENGE_RESP_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->cookie = cookie;
-+ cmd->source = source;
-+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_HB_CHALLENGE_RESP_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ /* Initialize QoS States */
++ wmip->wmi_numQoSStream = 0;
+
-+A_STATUS
-+wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
-+ A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
-+ A_UINT32 valid)
-+{
-+ void *osbuf;
-+ WMIX_DBGLOG_CFG_MODULE_CMD *cmd;
++ wmip->wmi_fatPipeExists = 0;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ for (i=0; i < WMM_NUM_AC; i++) {
++ wmip->wmi_streamExistsForAC[i]=0;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ /* Initialize the static Wmi stream Pri to WMM AC mappings Arrays */
++ WMI_INIT_WMISTREAM_AC_MAP(wmip);
+
-+ cmd = (WMIX_DBGLOG_CFG_MODULE_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->config.cfgmmask = mmask;
-+ cmd->config.cfgtsr = tsr;
-+ cmd->config.cfgrep = rep;
-+ cmd->config.cfgsize = size;
-+ cmd->config.cfgvalid = valid;
++ UNLOCK_WMI(wmip);
+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DBGLOG_CFG_MODULE_CMDID,
-+ NO_SYNC_WMIFLAG));
++ A_WMI_SET_NUMDATAENDPTS(wmip->wmi_devt, 1);
+}
+
-+A_STATUS
-+wmi_get_stats_cmd(struct wmi_t *wmip)
++void
++wmi_shutdown(struct wmi_t *wmip)
+{
-+ void *osbuf;
-+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (wmip != NULL) {
++ wlan_node_table_cleanup(&wmip->wmi_scan_table);
++ if (A_IS_MUTEX_VALID(&wmip->wmi_lock)) {
++ A_MUTEX_DELETE(&wmip->wmi_lock);
++ }
++ A_FREE(wmip);
+ }
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_STATISTICS_CMDID,
-+ NO_SYNC_WMIFLAG));
+}
+
++/*
++ * performs DIX to 802.3 encapsulation for transmit packets.
++ * uses passed in buffer. Returns buffer or NULL if failed.
++ * Assumes the entire DIX header is contigous and that there is
++ * enough room in the buffer for a 802.3 mac header and LLC+SNAP headers.
++ */
+A_STATUS
-+wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid)
++wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf)
+{
-+ void *osbuf;
-+ WMI_ADD_BAD_AP_CMD *cmd;
++ A_UINT8 *datap;
++ A_UINT16 typeorlen;
++ ATH_MAC_HDR macHdr;
++ ATH_LLC_SNAP_HDR *llcHdr;
+
-+ if ((bssid == NULL) || (apIndex > WMI_MAX_BAD_AP_INDEX)) {
-+ return A_EINVAL;
-+ }
++ A_ASSERT(osbuf != NULL);
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
++ if (A_NETBUF_HEADROOM(osbuf) <
++ (sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR)))
++ {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ datap = A_NETBUF_DATA(osbuf);
+
-+ cmd = (WMI_ADD_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->badApIndex = apIndex;
-+ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_BAD_AP_CMDID, NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex)
-+{
-+ void *osbuf;
-+ WMI_DELETE_BAD_AP_CMD *cmd;
++ typeorlen = *(A_UINT16 *)(datap + ATH_MAC_LEN + ATH_MAC_LEN);
+
-+ if (apIndex > WMI_MAX_BAD_AP_INDEX) {
-+ return A_EINVAL;
++ if (!IS_ETHERTYPE(A_BE2CPU16(typeorlen))) {
++ /*
++ * packet is already in 802.3 format - return success
++ */
++ A_DPRINTF(DBG_WMI, (DBGFMT "packet already 802.3\n", DBGARG));
++ return (A_OK);
+ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
++ /*
++ * Save mac fields and length to be inserted later
++ */
++ A_MEMCPY(macHdr.dstMac, datap, ATH_MAC_LEN);
++ A_MEMCPY(macHdr.srcMac, datap + ATH_MAC_LEN, ATH_MAC_LEN);
++ macHdr.typeOrLen = A_CPU2BE16(A_NETBUF_LEN(osbuf) - sizeof(ATH_MAC_HDR) +
++ sizeof(ATH_LLC_SNAP_HDR));
++
++ /*
++ * Make room for LLC+SNAP headers
++ */
++ if (A_NETBUF_PUSH(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ datap = A_NETBUF_DATA(osbuf);
+
-+ cmd = (WMI_DELETE_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->badApIndex = apIndex;
++ A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_BAD_AP_CMDID,
-+ NO_SYNC_WMIFLAG));
++ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
++ llcHdr->dsap = 0xAA;
++ llcHdr->ssap = 0xAA;
++ llcHdr->cntl = 0x03;
++ llcHdr->orgCode[0] = 0x0;
++ llcHdr->orgCode[1] = 0x0;
++ llcHdr->orgCode[2] = 0x0;
++ llcHdr->etherType = typeorlen;
++
++ return (A_OK);
+}
+
++/*
++ * Adds a WMI data header
++ * Assumes there is enough room in the buffer to add header.
++ */
+A_STATUS
-+wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM)
++wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType)
+{
-+ void *osbuf;
-+ WMI_SET_TX_PWR_CMD *cmd;
++ WMI_DATA_HDR *dtHdr;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
++ A_ASSERT(osbuf != NULL);
++
++ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_TX_PWR_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->dbM = dbM;
++ dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
++ dtHdr->info = msgType;
++ dtHdr->rssi = 0;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
++ return (A_OK);
+}
+
-+A_STATUS
-+wmi_get_txPwr_cmd(struct wmi_t *wmip)
++A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT8 dir, A_UINT8 up)
+{
-+ void *osbuf;
-+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ A_UINT8 *datap;
++ A_UINT8 trafficClass = WMM_AC_BE, userPriority = up;
++ ATH_LLC_SNAP_HDR *llcHdr;
++ A_UINT16 ipType = IP_ETHERTYPE;
++ WMI_DATA_HDR *dtHdr;
++ WMI_CREATE_PSTREAM_CMD cmd;
++ A_BOOL streamExists = FALSE;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
-+}
++ A_ASSERT(osbuf != NULL);
+
-+A_STATUS
-+wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on)
-+{
-+ WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
-+ WMI_SHORTSCANRATIO_DEFAULT,
-+ DEFAULT_SCAN_CTRL_FLAGS,
-+ 0};
++ datap = A_NETBUF_DATA(osbuf);
+
-+ if (on) {
-+ /* Enable foreground scanning */
-+ if (wmi_scanparams_cmd(wmip, scParams.fg_start_period,
-+ scParams.fg_end_period,
-+ scParams.bg_period,
-+ scParams.minact_chdwell_time,
-+ scParams.maxact_chdwell_time,
-+ scParams.pas_chdwell_time,
-+ scParams.shortScanRatio,
-+ scParams.scanCtrlFlags,
-+ scParams.max_dfsch_act_time) != A_OK) {
-+ return -EIO;
-+ }
-+ } else {
-+ wmi_disconnect_cmd(wmip);
-+ if (wmi_scanparams_cmd(wmip, 0xFFFF, 0, 0, 0,
-+ 0, 0, 0, 0xFF, 0) != A_OK) {
-+ return -EIO;
-+ }
-+ }
++ if (up == UNDEFINED_PRI) {
++ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(WMI_DATA_HDR) +
++ sizeof(ATH_MAC_HDR));
+
-+ return A_OK;
-+}
++ if (llcHdr->etherType == A_CPU2BE16(ipType)) {
++ /* Extract the endpoint info from the TOS field in the IP header */
++ userPriority = A_WMI_IPTOS_TO_USERPRIORITY(((A_UINT8 *)llcHdr) + sizeof(ATH_LLC_SNAP_HDR));
++ }
++ }
+
++ if (userPriority < MAX_NUM_PRI) {
++ trafficClass = convert_userPriority_to_trafficClass(userPriority);
++ }
+
-+A_UINT16
-+wmi_get_mapped_qos_queue(struct wmi_t *wmip, A_UINT8 trafficClass)
-+{
-+ A_UINT16 activeTsids=0;
++ dtHdr = (WMI_DATA_HDR *)datap;
++ if(dir==UPLINK_TRAFFIC)
++ dtHdr->info |= (userPriority & WMI_DATA_HDR_UP_MASK) << WMI_DATA_HDR_UP_SHIFT; /* lower 3-bits are 802.1d priority */
+
+ LOCK_WMI(wmip);
-+ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
++ streamExists = wmip->wmi_fatPipeExists;
+ UNLOCK_WMI(wmip);
+
-+ return activeTsids;
-+}
-+
-+A_STATUS
-+wmi_get_roam_tbl_cmd(struct wmi_t *wmip)
-+{
-+ void *osbuf;
++ if (!(streamExists & (1 << trafficClass))) {
+
-+ osbuf = A_NETBUF_ALLOC(0); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ A_MEMZERO(&cmd, sizeof(cmd));
++ cmd.trafficClass = trafficClass;
++ cmd.userPriority = userPriority;
++ cmd.inactivityInt = WMI_IMPLICIT_PSTREAM_INACTIVITY_INT;
++ /* Implicit streams are created with TSID 0xFF */
++ cmd.tsid = WMI_IMPLICIT_PSTREAM;
++ wmi_create_pstream_cmd(wmip, &cmd);
+ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_TBL_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return trafficClass;
+}
+
-+A_STATUS
-+wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType)
++WMI_PRI_STREAM_ID
++wmi_get_stream_id(struct wmi_t *wmip, A_UINT8 trafficClass)
+{
-+ void *osbuf;
-+ A_UINT32 size = sizeof(A_UINT8);
-+ WMI_TARGET_ROAM_DATA *cmd;
-+
-+ osbuf = A_NETBUF_ALLOC(size); /* no payload */
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_TARGET_ROAM_DATA *)(A_NETBUF_DATA(osbuf));
-+ cmd->roamDataType = roamDataType;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_DATA_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return WMI_ACCESSCATEGORY_WMISTREAM(wmip, trafficClass);
+}
+
++/*
++ * performs 802.3 to DIX encapsulation for received packets.
++ * Assumes the entire 802.3 header is contigous.
++ */
+A_STATUS
-+wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
-+ A_UINT8 size)
++wmi_dot3_2_dix(struct wmi_t *wmip, void *osbuf)
+{
-+ void *osbuf;
-+ WMI_SET_ROAM_CTRL_CMD *cmd;
-+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_SET_ROAM_CTRL_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
-+
-+ A_MEMCPY(cmd, p, size);
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ROAM_CTRL_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ A_UINT8 *datap;
++ ATH_MAC_HDR macHdr;
++ ATH_LLC_SNAP_HDR *llcHdr;
+
-+A_STATUS
-+wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
-+ WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
-+ A_UINT8 size)
-+{
-+ void *osbuf;
-+ WMI_POWERSAVE_TIMERS_POLICY_CMD *cmd;
++ A_ASSERT(osbuf != NULL);
++ datap = A_NETBUF_DATA(osbuf);
+
-+ /* These timers can't be zero */
-+ if(!pCmd->psPollTimeout || !pCmd->triggerTimeout ||
-+ !(pCmd->apsdTimPolicy == IGNORE_TIM_ALL_QUEUES_APSD ||
-+ pCmd->apsdTimPolicy == PROCESS_TIM_ALL_QUEUES_APSD) ||
-+ !(pCmd->simulatedAPSDTimPolicy == IGNORE_TIM_SIMULATED_APSD ||
-+ pCmd->simulatedAPSDTimPolicy == PROCESS_TIM_SIMULATED_APSD))
-+ return A_EINVAL;
++ A_MEMCPY(&macHdr, datap, sizeof(ATH_MAC_HDR));
++ llcHdr = (ATH_LLC_SNAP_HDR *)(datap + sizeof(ATH_MAC_HDR));
++ macHdr.typeOrLen = llcHdr->etherType;
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
++ if (A_NETBUF_PULL(osbuf, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, size);
-+
-+ cmd = (WMI_POWERSAVE_TIMERS_POLICY_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, size);
++ datap = A_NETBUF_DATA(osbuf);
+
-+ A_MEMCPY(cmd, pCmd, size);
++ A_MEMCPY(datap, &macHdr, sizeof (ATH_MAC_HDR));
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return (A_OK);
+}
+
-+#ifdef CONFIG_HOST_GPIO_SUPPORT
-+/* Send a command to Target to change GPIO output pins. */
++/*
++ * Removes a WMI data header
++ */
+A_STATUS
-+wmi_gpio_output_set(struct wmi_t *wmip,
-+ A_UINT32 set_mask,
-+ A_UINT32 clear_mask,
-+ A_UINT32 enable_mask,
-+ A_UINT32 disable_mask)
++wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf)
+{
-+ void *osbuf;
-+ WMIX_GPIO_OUTPUT_SET_CMD *output_set;
-+ int size;
-+
-+ size = sizeof(*output_set);
-+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - set=0x%x clear=0x%x enb=0x%x dis=0x%x\n", DBGARG,
-+ set_mask, clear_mask, enable_mask, disable_mask));
-+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+ A_NETBUF_PUT(osbuf, size);
-+ output_set = (WMIX_GPIO_OUTPUT_SET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+ output_set->set_mask = set_mask;
-+ output_set->clear_mask = clear_mask;
-+ output_set->enable_mask = enable_mask;
-+ output_set->disable_mask = disable_mask;
++ A_ASSERT(osbuf != NULL);
+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_OUTPUT_SET_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return (A_NETBUF_PULL(osbuf, sizeof(WMI_DATA_HDR)));
+}
+
-+/* Send a command to the Target requesting state of the GPIO input pins */
-+A_STATUS
-+wmi_gpio_input_get(struct wmi_t *wmip)
++void
++wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg)
+{
-+ void *osbuf;
-+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
-+
-+ osbuf = A_NETBUF_ALLOC(0);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INPUT_GET_CMDID,
-+ NO_SYNC_WMIFLAG));
++ wlan_iterate_nodes(&wmip->wmi_scan_table, f, arg);
+}
+
-+/* Send a command to the Target that changes the value of a GPIO register. */
++/*
++ * WMI Extended Event received from Target.
++ */
+A_STATUS
-+wmi_gpio_register_set(struct wmi_t *wmip,
-+ A_UINT32 gpioreg_id,
-+ A_UINT32 value)
++wmi_control_rx_xtnd(struct wmi_t *wmip, void *osbuf)
+{
-+ void *osbuf;
-+ WMIX_GPIO_REGISTER_SET_CMD *register_set;
-+ int size;
-+
-+ size = sizeof(*register_set);
-+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG, gpioreg_id, value));
++ WMIX_CMD_HDR *cmd;
++ A_UINT16 id;
++ A_UINT8 *datap;
++ A_UINT32 len;
++ A_STATUS status = A_OK;
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (A_NETBUF_LEN(osbuf) < sizeof(WMIX_CMD_HDR)) {
++ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
++ wmip->wmi_stats.cmd_len_err++;
++ A_NETBUF_FREE(osbuf);
++ return A_ERROR;
+ }
-+ A_NETBUF_PUT(osbuf, size);
-+ register_set = (WMIX_GPIO_REGISTER_SET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+ register_set->gpioreg_id = gpioreg_id;
-+ register_set->value = value;
-+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_SET_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target to fetch the value of a GPIO register. */
-+A_STATUS
-+wmi_gpio_register_get(struct wmi_t *wmip,
-+ A_UINT32 gpioreg_id)
-+{
-+ void *osbuf;
-+ WMIX_GPIO_REGISTER_GET_CMD *register_get;
-+ int size;
+
-+ size = sizeof(*register_get);
-+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - reg=%d\n", DBGARG, gpioreg_id));
++ cmd = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
++ id = cmd->commandId;
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (A_NETBUF_PULL(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
++ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
++ wmip->wmi_stats.cmd_len_err++;
++ A_NETBUF_FREE(osbuf);
++ return A_ERROR;
+ }
-+ A_NETBUF_PUT(osbuf, size);
-+ register_get = (WMIX_GPIO_REGISTER_GET_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+ register_get->gpioreg_id = gpioreg_id;
-+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_GET_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
-+
-+/* Send a command to the Target acknowledging some GPIO interrupts. */
-+A_STATUS
-+wmi_gpio_intr_ack(struct wmi_t *wmip,
-+ A_UINT32 ack_mask)
-+{
-+ void *osbuf;
-+ WMIX_GPIO_INTR_ACK_CMD *intr_ack;
-+ int size;
-+
-+ size = sizeof(*intr_ack);
+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter ack_mask=0x%x\n", DBGARG, ack_mask));
++ datap = A_NETBUF_DATA(osbuf);
++ len = A_NETBUF_LEN(osbuf);
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ switch (id) {
++ case (WMIX_DSETOPENREQ_EVENTID):
++ status = wmi_dset_open_req_rx(wmip, datap, len);
++ break;
++#ifdef CONFIG_HOST_DSET_SUPPORT
++ case (WMIX_DSETCLOSE_EVENTID):
++ status = wmi_dset_close_rx(wmip, datap, len);
++ break;
++ case (WMIX_DSETDATAREQ_EVENTID):
++ status = wmi_dset_data_req_rx(wmip, datap, len);
++ break;
++#endif /* CONFIG_HOST_DSET_SUPPORT */
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++ case (WMIX_GPIO_INTR_EVENTID):
++ wmi_gpio_intr_rx(wmip, datap, len);
++ break;
++ case (WMIX_GPIO_DATA_EVENTID):
++ wmi_gpio_data_rx(wmip, datap, len);
++ break;
++ case (WMIX_GPIO_ACK_EVENTID):
++ wmi_gpio_ack_rx(wmip, datap, len);
++ break;
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
++ case (WMIX_HB_CHALLENGE_RESP_EVENTID):
++ wmi_hbChallengeResp_rx(wmip, datap, len);
++ break;
++ case (WMIX_DBGLOG_EVENTID):
++ wmi_dbglog_event_rx(wmip, datap, len);
++ break;
++ default:
++ A_DPRINTF(DBG_WMI|DBG_ERROR,
++ (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
++ wmip->wmi_stats.cmd_id_err++;
++ status = A_ERROR;
++ break;
+ }
-+ A_NETBUF_PUT(osbuf, size);
-+ intr_ack = (WMIX_GPIO_INTR_ACK_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+ intr_ack->ack_mask = ack_mask;
+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INTR_ACK_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return status;
+}
-+#endif /* CONFIG_HOST_GPIO_SUPPORT */
++
++/*
++ * Control Path
++ */
++A_UINT32 cmdRecvNum;
+
+A_STATUS
-+wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop, A_UINT8 eCWmin,
-+ A_UINT8 eCWmax, A_UINT8 aifsn)
++wmi_control_rx(struct wmi_t *wmip, void *osbuf)
+{
-+ void *osbuf;
-+ WMI_SET_ACCESS_PARAMS_CMD *cmd;
-+
-+ if ((eCWmin > WMI_MAX_CW_ACPARAM) || (eCWmax > WMI_MAX_CW_ACPARAM) ||
-+ (aifsn > WMI_MAX_AIFSN_ACPARAM))
-+ {
-+ return A_EINVAL;
-+ }
++ WMI_CMD_HDR *cmd;
++ A_UINT16 id;
++ A_UINT8 *datap;
++ A_UINT32 len, i, loggingReq;
++ A_STATUS status = A_OK;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ A_ASSERT(osbuf != NULL);
++ if (A_NETBUF_LEN(osbuf) < sizeof(WMI_CMD_HDR)) {
++ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 1\n", DBGARG));
++ wmip->wmi_stats.cmd_len_err++;
++ A_NETBUF_FREE(osbuf);
++ return A_ERROR;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_ACCESS_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->txop = txop;
-+ cmd->eCWmin = eCWmin;
-+ cmd->eCWmax = eCWmax;
-+ cmd->aifsn = aifsn;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ACCESS_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
-+ A_UINT8 trafficClass, A_UINT8 maxRetries,
-+ A_UINT8 enableNotify)
-+{
-+ void *osbuf;
-+ WMI_SET_RETRY_LIMITS_CMD *cmd;
++ cmd = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
++ id = cmd->commandId;
+
-+ if ((frameType != MGMT_FRAMETYPE) && (frameType != CONTROL_FRAMETYPE) &&
-+ (frameType != DATA_FRAMETYPE))
-+ {
-+ return A_EINVAL;
++ if (A_NETBUF_PULL(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
++ A_DPRINTF(DBG_WMI, (DBGFMT "bad packet 2\n", DBGARG));
++ wmip->wmi_stats.cmd_len_err++;
++ A_NETBUF_FREE(osbuf);
++ return A_ERROR;
+ }
+
-+ if (maxRetries > WMI_MAX_RETRIES) {
-+ return A_EINVAL;
-+ }
++ datap = A_NETBUF_DATA(osbuf);
++ len = A_NETBUF_LEN(osbuf);
+
-+ if (frameType != DATA_FRAMETYPE) {
-+ trafficClass = 0;
-+ }
++ ar6000_get_driver_cfg(wmip->wmi_devt,
++ AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS,
++ &loggingReq);
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if(loggingReq) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI %d \n",id));
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("WMI recv, MsgNo %d : ", cmdRecvNum));
++ for(i = 0; i < len; i++)
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("%x ", datap[i]));
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("\n"));
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ LOCK_WMI(wmip);
++ cmdRecvNum++;
++ UNLOCK_WMI(wmip);
+
-+ cmd = (WMI_SET_RETRY_LIMITS_CMD *)(A_NETBUF_DATA(osbuf));
-+ cmd->frameType = frameType;
-+ cmd->trafficClass = trafficClass;
-+ cmd->maxRetries = maxRetries;
-+ cmd->enableNotify = enableNotify;
++ switch (id) {
++ case (WMI_GET_BITRATE_CMDID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_BITRATE_CMDID\n", DBGARG));
++ status = wmi_bitrate_reply_rx(wmip, datap, len);
++ break;
++ case (WMI_GET_CHANNEL_LIST_CMDID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_CHANNEL_LIST_CMDID\n", DBGARG));
++ status = wmi_channelList_reply_rx(wmip, datap, len);
++ break;
++ case (WMI_GET_TX_PWR_CMDID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_TX_PWR_CMDID\n", DBGARG));
++ status = wmi_txPwr_reply_rx(wmip, datap, len);
++ break;
++ case (WMI_READY_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_READY_EVENTID\n", DBGARG));
++ status = wmi_ready_event_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ A_WMI_DBGLOG_INIT_DONE(wmip->wmi_devt);
++ break;
++ case (WMI_CONNECT_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CONNECT_EVENTID\n", DBGARG));
++ status = wmi_connect_event_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_DISCONNECT_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_DISCONNECT_EVENTID\n", DBGARG));
++ status = wmi_disconnect_event_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_TKIP_MICERR_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TKIP_MICERR_EVENTID\n", DBGARG));
++ status = wmi_tkip_micerr_event_rx(wmip, datap, len);
++ break;
++ case (WMI_BSSINFO_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_BSSINFO_EVENTID\n", DBGARG));
++ status = wmi_bssInfo_event_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_REGDOMAIN_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REGDOMAIN_EVENTID\n", DBGARG));
++ status = wmi_regDomain_event_rx(wmip, datap, len);
++ break;
++ case (WMI_PSTREAM_TIMEOUT_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_PSTREAM_TIMEOUT_EVENTID\n", DBGARG));
++ status = wmi_pstream_timeout_event_rx(wmip, datap, len);
++ /* pstreams are fatpipe abstractions that get implicitly created.
++ * User apps only deal with thinstreams. creation of a thinstream
++ * by the user or data traffic flow in an AC triggers implicit
++ * pstream creation. Do we need to send this event to App..?
++ * no harm in sending it.
++ */
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_NEIGHBOR_REPORT_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_NEIGHBOR_REPORT_EVENTID\n", DBGARG));
++ status = wmi_neighborReport_event_rx(wmip, datap, len);
++ break;
++ case (WMI_SCAN_COMPLETE_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SCAN_COMPLETE_EVENTID\n", DBGARG));
++ status = wmi_scanComplete_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_CMDERROR_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CMDERROR_EVENTID\n", DBGARG));
++ status = wmi_errorEvent_rx(wmip, datap, len);
++ break;
++ case (WMI_REPORT_STATISTICS_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_STATISTICS_EVENTID\n", DBGARG));
++ status = wmi_statsEvent_rx(wmip, datap, len);
++ break;
++ case (WMI_RSSI_THRESHOLD_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_RSSI_THRESHOLD_EVENTID\n", DBGARG));
++ status = wmi_rssiThresholdEvent_rx(wmip, datap, len);
++ break;
++ case (WMI_ERROR_REPORT_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_ERROR_REPORT_EVENTID\n", DBGARG));
++ status = wmi_reportErrorEvent_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_OPT_RX_FRAME_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_OPT_RX_FRAME_EVENTID\n", DBGARG));
++ status = wmi_opt_frame_event_rx(wmip, datap, len);
++ break;
++ case (WMI_REPORT_ROAM_TBL_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_TBL_EVENTID\n", DBGARG));
++ status = wmi_roam_tbl_event_rx(wmip, datap, len);
++ break;
++ case (WMI_EXTENSION_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_EXTENSION_EVENTID\n", DBGARG));
++ status = wmi_control_rx_xtnd(wmip, osbuf);
++ break;
++ case (WMI_CAC_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_CAC_EVENTID\n", DBGARG));
++ status = wmi_cac_event_rx(wmip, datap, len);
++ break;
++ case (WMI_REPORT_ROAM_DATA_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_REPORT_ROAM_DATA_EVENTID\n", DBGARG));
++ status = wmi_roam_data_event_rx(wmip, datap, len);
++ break;
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++ case (WMI_TEST_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TEST_EVENTID\n", DBGARG));
++ status = wmi_tcmd_test_report_rx(wmip, datap, len);
++ break;
++#endif
++ case (WMI_GET_FIXRATES_CMDID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_FIXRATES_CMDID\n", DBGARG));
++ status = wmi_ratemask_reply_rx(wmip, datap, len);
++ break;
++ case (WMI_TX_RETRY_ERR_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_TX_RETRY_ERR_EVENTID\n", DBGARG));
++ status = wmi_txRetryErrEvent_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_SNR_THRESHOLD_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_SNR_THRESHOLD_EVENTID\n", DBGARG));
++ status = wmi_snrThresholdEvent_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_LQ_THRESHOLD_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_LQ_THRESHOLD_EVENTID\n", DBGARG));
++ status = wmi_lqThresholdEvent_rx(wmip, datap, len);
++ A_WMI_SEND_EVENT_TO_APP(wmip->wmi_devt, id, datap, len);
++ break;
++ case (WMI_APLIST_EVENTID):
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Received APLIST Event\n"));
++ status = wmi_aplistEvent_rx(wmip, datap, len);
++ break;
++ case (WMI_GET_KEEPALIVE_CMDID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_KEEPALIVE_CMDID\n", DBGARG));
++ status = wmi_keepalive_reply_rx(wmip, datap, len);
++ break;
++ case (WMI_GET_WOW_LIST_EVENTID):
++ status = wmi_get_wow_list_event_rx(wmip, datap, len);
++ break;
++ case (WMI_GET_PMKID_LIST_EVENTID):
++ A_DPRINTF(DBG_WMI, (DBGFMT "WMI_GET_PMKID_LIST Event\n", DBGARG));
++ status = wmi_get_pmkid_list_event_rx(wmip, datap, len);
++ break;
++ default:
++ A_DPRINTF(DBG_WMI|DBG_ERROR,
++ (DBGFMT "Unknown id 0x%x\n", DBGARG, id));
++ wmip->wmi_stats.cmd_id_err++;
++ status = A_ERROR;
++ break;
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_RETRY_LIMITS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ A_NETBUF_FREE(osbuf);
+
-+void
-+wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid)
-+{
-+ if (bssid != NULL) {
-+ A_MEMCPY(bssid, wmip->wmi_bssid, ATH_MAC_LEN);
-+ }
++ return status;
+}
+
-+A_STATUS
-+wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode)
++static A_STATUS
++wmi_ready_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_OPT_MODE_CMD *cmd;
++ WMI_READY_EVENT *ev = (WMI_READY_EVENT *)datap;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMI_READY_EVENT)) {
++ return A_EINVAL;
+ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++ wmip->wmi_ready = TRUE;
++ A_WMI_READY_EVENT(wmip->wmi_devt, ev->macaddr, ev->phyCapability);
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_OPT_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->optMode = optMode;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_OPT_MODE_CMDID,
-+ SYNC_BOTH_WMIFLAG));
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
-+ A_UINT8 frmType,
-+ A_UINT8 *dstMacAddr,
-+ A_UINT8 *bssid,
-+ A_UINT16 optIEDataLen,
-+ A_UINT8 *optIEData)
++static A_STATUS
++wmi_connect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_OPT_TX_FRAME_CMD *cmd;
-+ osbuf = A_NETBUF_ALLOC(optIEDataLen + sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ WMI_CONNECT_EVENT *ev;
+
-+ A_NETBUF_PUT(osbuf, (optIEDataLen + sizeof(*cmd)));
++ if (len < sizeof(WMI_CONNECT_EVENT)) {
++ return A_EINVAL;
++ }
++ ev = (WMI_CONNECT_EVENT *)datap;
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "freq %d bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
++ DBGARG, ev->channel,
++ ev->bssid[0], ev->bssid[1], ev->bssid[2],
++ ev->bssid[3], ev->bssid[4], ev->bssid[5]));
+
-+ cmd = (WMI_OPT_TX_FRAME_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, (optIEDataLen + sizeof(*cmd)-1));
++ A_MEMCPY(wmip->wmi_bssid, ev->bssid, ATH_MAC_LEN);
+
-+ cmd->frmType = frmType;
-+ cmd->optIEDataLen = optIEDataLen;
-+ //cmd->optIEData = (A_UINT8 *)((int)cmd + sizeof(*cmd));
-+ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
-+ A_MEMCPY(cmd->dstAddr, dstMacAddr, sizeof(cmd->dstAddr));
-+ A_MEMCPY(&cmd->optIEData[0], optIEData, optIEDataLen);
++ A_WMI_CONNECT_EVENT(wmip->wmi_devt, ev->channel, ev->bssid,
++ ev->listenInterval, ev->beaconInterval,
++ ev->networkType, ev->beaconIeLen,
++ ev->assocReqLen, ev->assocRespLen,
++ ev->assocInfo);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_OPT_TX_FRAME_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl)
++static A_STATUS
++wmi_regDomain_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_BEACON_INT_CMD *cmd;
++ WMI_REG_DOMAIN_EVENT *ev;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(*ev)) {
++ return A_EINVAL;
+ }
++ ev = (WMI_REG_DOMAIN_EVENT *)datap;
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_BEACON_INT_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->beaconInterval = intvl;
++ A_WMI_REGDOMAIN_EVENT(wmip->wmi_devt, ev->regDomain);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BEACON_INT_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+
-+A_STATUS
-+wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize)
++static A_STATUS
++wmi_neighborReport_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_VOICE_PKT_SIZE_CMD *cmd;
++ WMI_NEIGHBOR_REPORT_EVENT *ev;
++ int numAps;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(*ev)) {
++ return A_EINVAL;
+ }
++ ev = (WMI_NEIGHBOR_REPORT_EVENT *)datap;
++ numAps = ev->numberOfAps;
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ if (len < (int)(sizeof(*ev) + ((numAps - 1) * sizeof(WMI_NEIGHBOR_INFO)))) {
++ return A_EINVAL;
++ }
+
-+ cmd = (WMI_SET_VOICE_PKT_SIZE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->voicePktSize = voicePktSize;
++ A_WMI_NEIGHBORREPORT_EVENT(wmip->wmi_devt, numAps, ev->neighbor);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_VOICE_PKT_SIZE_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+
-+A_STATUS
-+wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSPLen)
++static A_STATUS
++wmi_disconnect_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_MAX_SP_LEN_CMD *cmd;
-+
-+ /* maxSPLen is a two-bit value. If user trys to set anything
-+ * other than this, then its invalid
-+ */
-+ if(maxSPLen & ~0x03)
-+ return A_EINVAL;
++ WMI_DISCONNECT_EVENT *ev;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMI_DISCONNECT_EVENT)) {
++ return A_EINVAL;
+ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_MAX_SP_LEN_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->maxSPLen = maxSPLen;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_MAX_SP_LEN_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ ev = (WMI_DISCONNECT_EVENT *)datap;
+
-+A_UINT8
-+convert_userPriority_to_trafficClass(A_UINT8 userPriority)
-+{
-+ return (up_to_ac[userPriority & 0x7]);
-+}
++ A_MEMZERO(wmip->wmi_bssid, sizeof(wmip->wmi_bssid));
+
-+A_UINT8
-+wmi_get_power_mode_cmd(struct wmi_t *wmip)
-+{
-+ return wmip->wmi_powerMode;
-+}
++ A_WMI_DISCONNECT_EVENT(wmip->wmi_devt, ev->disconnectReason, ev->bssid,
++ ev->assocRespLen, ev->assocInfo, ev->protocolReasonStatus);
+
-+A_STATUS
-+wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance)
-+{
+ return A_OK;
+}
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
+static A_STATUS
-+wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++wmi_tkip_micerr_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
++ WMI_TKIP_MICERR_EVENT *ev;
+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++ if (len < sizeof(*ev)) {
++ return A_EINVAL;
++ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_WMI_TCMD_RX_REPORT_EVENT(wmip->wmi_devt, datap, len);
++ ev = (WMI_TKIP_MICERR_EVENT *)datap;
++ A_WMI_TKIP_MICERR_EVENT(wmip->wmi_devt, ev->keyid, ev->ismcast);
+
-+ return A_OK;
++ return A_OK;
+}
+
-+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
-+
-+A_STATUS
-+wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
++static A_STATUS
++wmi_bssInfo_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_AUTH_MODE_CMD *cmd;
++ bss_t *bss;
++ WMI_BSS_INFO_HDR *bih;
++ A_UINT8 *buf;
++ A_UINT32 nodeCachingAllowed;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len <= sizeof(WMI_BSS_INFO_HDR)) {
++ return A_EINVAL;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_AUTH_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->mode = mode;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_AUTH_MODE_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
-+
-+A_STATUS
-+wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
-+{
-+ void *osbuf;
-+ WMI_SET_REASSOC_MODE_CMD *cmd;
++ A_WMI_BSSINFO_EVENT_RX(wmip->wmi_devt, datap, len);
++ /* What is driver config for wlan node caching? */
++ if(ar6000_get_driver_cfg(wmip->wmi_devt,
++ AR6000_DRIVER_CFG_GET_WLANNODECACHING,
++ &nodeCachingAllowed) != A_OK) {
++ return A_EINVAL;
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if(!nodeCachingAllowed) {
++ return A_OK;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ cmd = (WMI_SET_REASSOC_MODE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->mode = mode;
++ bih = (WMI_BSS_INFO_HDR *)datap;
++ buf = datap + sizeof(WMI_BSS_INFO_HDR);
++ len -= sizeof(WMI_BSS_INFO_HDR);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_REASSOC_MODE_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ A_DPRINTF(DBG_WMI2, (DBGFMT "bssInfo event - ch %u, rssi %02x, "
++ "bssid \"%02x:%02x:%02x:%02x:%02x:%02x\"\n", DBGARG,
++ bih->channel, (unsigned char) bih->rssi, bih->bssid[0],
++ bih->bssid[1], bih->bssid[2], bih->bssid[3], bih->bssid[4],
++ bih->bssid[5]));
+
-+A_STATUS
-+wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status)
-+{
-+ void *osbuf;
-+ WMI_SET_LPREAMBLE_CMD *cmd;
++ if(wps_enable && (bih->frameType == PROBERESP_FTYPE) ) {
++ printk("%s() A_OK 2\n", __FUNCTION__);
++ return A_OK;
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
++ bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
++ if (bss != NULL) {
++ /*
++ * Free up the node. Not the most efficient process given
++ * we are about to allocate a new node but it is simple and should be
++ * adequate.
++ */
++ wlan_node_reclaim(&wmip->wmi_scan_table, bss);
++ }
++
++ bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
++ if (bss == NULL) {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ bss->ni_snr = bih->snr;
++ bss->ni_rssi = bih->rssi;
++ A_ASSERT(bss->ni_buf != NULL);
++ A_MEMCPY(bss->ni_buf, buf, len);
+
-+ cmd = (WMI_SET_LPREAMBLE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->status = status;
++ if (wlan_parse_beacon(bss->ni_buf, len, &bss->ni_cie) != A_OK) {
++ wlan_node_free(bss);
++ return A_EINVAL;
++ }
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_LPREAMBLE_CMDID,
-+ NO_SYNC_WMIFLAG));
++ /*
++ * Update the frequency in ie_chan, overwriting of channel number
++ * which is done in wlan_parse_beacon
++ */
++ bss->ni_cie.ie_chan = bih->channel;
++ wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
++
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold)
++static A_STATUS
++wmi_opt_frame_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_RTS_CMD *cmd;
++ bss_t *bss;
++ WMI_OPT_RX_INFO_HDR *bih;
++ A_UINT8 *buf;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len <= sizeof(WMI_OPT_RX_INFO_HDR)) {
++ return A_EINVAL;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_RTS_CMD*)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->threshold = threshold;
++ bih = (WMI_OPT_RX_INFO_HDR *)datap;
++ buf = datap + sizeof(WMI_OPT_RX_INFO_HDR);
++ len -= sizeof(WMI_OPT_RX_INFO_HDR);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_RTS_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ A_DPRINTF(DBG_WMI2, (DBGFMT "opt frame event %2.2x:%2.2x\n", DBGARG,
++ bih->bssid[4], bih->bssid[5]));
+
-+A_STATUS
-+wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status)
-+{
-+ void *osbuf;
-+ WMI_SET_WMM_CMD *cmd;
++ bss = wlan_find_node(&wmip->wmi_scan_table, bih->bssid);
++ if (bss != NULL) {
++ /*
++ * Free up the node. Not the most efficient process given
++ * we are about to allocate a new node but it is simple and should be
++ * adequate.
++ */
++ wlan_node_reclaim(&wmip->wmi_scan_table, bss);
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
++ bss = wlan_node_alloc(&wmip->wmi_scan_table, len);
++ if (bss == NULL) {
+ return A_NO_MEMORY;
+ }
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_WMM_CMD*)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->status = status;
-+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_CMDID,
-+ NO_SYNC_WMIFLAG));
++ bss->ni_snr = bih->snr;
++ bss->ni_cie.ie_chan = bih->channel;
++ A_ASSERT(bss->ni_buf != NULL);
++ A_MEMCPY(bss->ni_buf, buf, len);
++ wlan_setup_node(&wmip->wmi_scan_table, bss, bih->bssid);
+
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG cfg)
++ /* This event indicates inactivity timeout of a fatpipe(pstream)
++ * at the target
++ */
++static A_STATUS
++wmi_pstream_timeout_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_WMM_TXOP_CMD *cmd;
++ WMI_PSTREAM_TIMEOUT_EVENT *ev;
+
-+ if( !((cfg == WMI_TXOP_DISABLED) || (cfg == WMI_TXOP_ENABLED)) )
++ if (len < sizeof(WMI_PSTREAM_TIMEOUT_EVENT)) {
+ return A_EINVAL;
++ }
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "wmi_pstream_timeout_event_rx\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ ev = (WMI_PSTREAM_TIMEOUT_EVENT *)datap;
+
-+ cmd = (WMI_SET_WMM_TXOP_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->txopEnable = cfg;
++ /* When the pstream (fat pipe == AC) timesout, it means there were no
++ * thinStreams within this pstream & it got implicitly created due to
++ * data flow on this AC. We start the inactivity timer only for
++ * implicitly created pstream. Just reset the host state.
++ */
++ /* Set the activeTsids for this AC to 0 */
++ LOCK_WMI(wmip);
++ wmip->wmi_streamExistsForAC[ev->trafficClass]=0;
++ wmip->wmi_fatPipeExists &= ~(1 << ev->trafficClass);
++ UNLOCK_WMI(wmip);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_TXOP_CMDID,
-+ NO_SYNC_WMIFLAG));
++ /*Indicate inactivity to driver layer for this fatpipe (pstream)*/
++ A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, ev->trafficClass);
+
++ return A_OK;
+}
+
-+#ifdef CONFIG_HOST_TCMD_SUPPORT
-+/* WMI layer doesn't need to know the data type of the test cmd.
-+ This would be beneficial for customers like Qualcomm, who might
-+ have different test command requirements from differnt manufacturers
-+ */
-+A_STATUS
-+wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32 len)
++static A_STATUS
++wmi_bitrate_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ char *data;
++ WMI_BIT_RATE_CMD *reply;
++ A_INT32 rate;
+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++ if (len < sizeof(WMI_BIT_RATE_CMD)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_BIT_RATE_CMD *)datap;
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - rateindex %d\n", DBGARG, reply->rateIndex));
+
-+ osbuf= A_NETBUF_ALLOC(len);
-+ if(osbuf == NULL)
-+ {
-+ return A_NO_MEMORY;
++ if (reply->rateIndex == RATE_AUTO) {
++ rate = RATE_AUTO;
++ } else {
++ rate = wmi_rateTable[(A_UINT32) reply->rateIndex];
+ }
-+ A_NETBUF_PUT(osbuf, len);
-+ data = A_NETBUF_DATA(osbuf);
-+ A_MEMCPY(data, buf, len);
+
-+ return(wmi_cmd_send(wmip, osbuf, WMI_TEST_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ A_WMI_BITRATE_RX(wmip->wmi_devt, rate);
+
-+#endif
++ return A_OK;
++}
+
-+A_STATUS
-+wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status)
++static A_STATUS
++wmi_ratemask_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_BT_STATUS_CMD *cmd;
++ WMI_FIX_RATES_CMD *reply;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMI_BIT_RATE_CMD)) {
++ return A_EINVAL;
+ }
++ reply = (WMI_FIX_RATES_CMD *)datap;
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - fixed rate mask %x\n", DBGARG, reply->fixRateMask));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_BT_STATUS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->streamType = streamType;
-+ cmd->status = status;
++ A_WMI_RATEMASK_RX(wmip->wmi_devt, reply->fixRateMask);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_STATUS_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd)
++static A_STATUS
++wmi_channelList_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_BT_PARAMS_CMD* alloc_cmd;
++ WMI_CHANNEL_LIST_REPLY *reply;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMI_CHANNEL_LIST_REPLY)) {
++ return A_EINVAL;
+ }
++ reply = (WMI_CHANNEL_LIST_REPLY *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ alloc_cmd = (WMI_SET_BT_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(alloc_cmd, sizeof(*cmd));
-+ A_MEMCPY(alloc_cmd, cmd, sizeof(*cmd));
++ A_WMI_CHANNELLIST_RX(wmip->wmi_devt, reply->numChannels,
++ reply->channelList);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_PARAMS_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_get_keepalive_configured(struct wmi_t *wmip)
++static A_STATUS
++wmi_txPwr_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_GET_KEEPALIVE_CMD *cmd;
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ WMI_TX_PWR_REPLY *reply;
++
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
+ }
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+ cmd = (WMI_GET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ return (wmi_cmd_send(wmip, osbuf, WMI_GET_KEEPALIVE_CMDID,
-+ NO_SYNC_WMIFLAG));
-+}
++ reply = (WMI_TX_PWR_REPLY *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+A_UINT8
-+wmi_get_keepalive_cmd(struct wmi_t *wmip)
-+{
-+ return wmip->wmi_keepaliveInterval;
-+}
++ A_WMI_TXPWR_RX(wmip->wmi_devt, reply->dbM);
+
-+A_STATUS
-+wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval)
++ return A_OK;
++}
++static A_STATUS
++wmi_keepalive_reply_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_KEEPALIVE_CMD *cmd;
++ WMI_GET_KEEPALIVE_CMD *reply;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
+ }
++ reply = (WMI_GET_KEEPALIVE_CMD *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*cmd));
-+
-+ cmd = (WMI_SET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd->keepaliveInterval = keepaliveInterval;
-+ wmip->wmi_keepaliveInterval = keepaliveInterval;
++ A_WMI_KEEPALIVE_RX(wmip->wmi_devt, reply->configured);
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_KEEPALIVE_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType, A_UINT8 ieLen,
-+ A_UINT8 *ieInfo)
++
++static A_STATUS
++wmi_dset_open_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMI_SET_APPIE_CMD *cmd;
-+ A_UINT16 cmdLen;
++ WMIX_DSETOPENREQ_EVENT *dsetopenreq;
+
-+ if (ieLen > WMI_MAX_IE_LEN) {
-+ return A_ERROR;
-+ }
-+ cmdLen = sizeof(*cmd) + ieLen - 1;
-+ osbuf = A_NETBUF_ALLOC(cmdLen);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMIX_DSETOPENREQ_EVENT)) {
++ return A_EINVAL;
+ }
++ dsetopenreq = (WMIX_DSETOPENREQ_EVENT *)datap;
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - dset_id=0x%x\n", DBGARG, dsetopenreq->dset_id));
++ A_WMI_DSET_OPEN_REQ(wmip->wmi_devt,
++ dsetopenreq->dset_id,
++ dsetopenreq->targ_dset_handle,
++ dsetopenreq->targ_reply_fn,
++ dsetopenreq->targ_reply_arg);
+
-+ A_NETBUF_PUT(osbuf, cmdLen);
++ return A_OK;
++}
+
-+ cmd = (WMI_SET_APPIE_CMD *)(A_NETBUF_DATA(osbuf));
-+ A_MEMZERO(cmd, cmdLen);
++#ifdef CONFIG_HOST_DSET_SUPPORT
++static A_STATUS
++wmi_dset_close_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMIX_DSETCLOSE_EVENT *dsetclose;
+
-+ cmd->mgmtFrmType = mgmtFrmType;
-+ cmd->ieLen = ieLen;
-+ A_MEMCPY(cmd->ieInfo, ieInfo, ieLen);
++ if (len < sizeof(WMIX_DSETCLOSE_EVENT)) {
++ return A_EINVAL;
++ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_APPIE_CMDID, NO_SYNC_WMIFLAG));
++ dsetclose = (WMIX_DSETCLOSE_EVENT *)datap;
++ A_WMI_DSET_CLOSE(wmip->wmi_devt, dsetclose->access_cookie);
++
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen)
++static A_STATUS
++wmi_dset_data_req_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ A_UINT8 *data;
++ WMIX_DSETDATAREQ_EVENT *dsetdatareq;
+
-+ osbuf = A_NETBUF_ALLOC(dataLen);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(WMIX_DSETDATAREQ_EVENT)) {
++ return A_EINVAL;
+ }
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, dataLen);
++ dsetdatareq = (WMIX_DSETDATAREQ_EVENT *)datap;
++ A_WMI_DSET_DATA_REQ(wmip->wmi_devt,
++ dsetdatareq->access_cookie,
++ dsetdatareq->offset,
++ dsetdatareq->length,
++ dsetdatareq->targ_buf,
++ dsetdatareq->targ_reply_fn,
++ dsetdatareq->targ_reply_arg);
+
-+ data = A_NETBUF_DATA(osbuf);
++ return A_OK;
++}
++#endif /* CONFIG_HOST_DSET_SUPPORT */
+
-+ A_MEMCPY(data, cmd, dataLen);
++static A_STATUS
++wmi_scanComplete_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMI_SCAN_COMPLETE_EVENT *ev;
+
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WHALPARAM_CMDID, NO_SYNC_WMIFLAG));
++ ev = (WMI_SCAN_COMPLETE_EVENT *)datap;
++ A_WMI_SCANCOMPLETE_EVENT(wmip->wmi_devt, ev->status);
++
++ return A_OK;
+}
+
-+A_INT32
-+wmi_get_rate(A_INT8 rateindex)
++/*
++ * Target is reporting a programming error. This is for
++ * developer aid only. Target only checks a few common violations
++ * and it is responsibility of host to do all error checking.
++ * Behavior of target after wmi error event is undefined.
++ * A reset is recommended.
++ */
++static A_STATUS
++wmi_errorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ if (rateindex == RATE_AUTO) {
-+ return 0;
-+ } else {
-+ return(wmi_rateTable[(A_UINT32) rateindex]);
++ WMI_CMD_ERROR_EVENT *ev;
++
++ ev = (WMI_CMD_ERROR_EVENT *)datap;
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Programming Error: cmd=%d ", ev->commandId));
++ switch (ev->errorCode) {
++ case (INVALID_PARAM):
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal Parameter\n"));
++ break;
++ case (ILLEGAL_STATE):
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Illegal State\n"));
++ break;
++ case (INTERNAL_ERROR):
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Internal Error\n"));
++ break;
+ }
++
++ return A_OK;
+}
+
-+void
-+wmi_node_return (struct wmi_t *wmip, bss_t *bss)
++
++static A_STATUS
++wmi_statsEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ if (NULL != bss)
-+ {
-+ wlan_node_return (&wmip->wmi_scan_table, bss);
-+ }
++ WMI_TARGET_STATS *reply;
++
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_TARGET_STATS *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++
++ A_WMI_TARGETSTATS_EVENT(wmip->wmi_devt, reply);
++
++ return A_OK;
+}
+
-+bss_t *
-+wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
-+ A_UINT32 ssidLength, A_BOOL bIsWPA2)
++static A_STATUS
++wmi_rssiThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ bss_t *node = NULL;
-+ node = wlan_find_Ssidnode (&wmip->wmi_scan_table, pSsid,
-+ ssidLength, bIsWPA2);
-+ return node;
++ WMI_RSSI_THRESHOLD_EVENT *reply;
++
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_RSSI_THRESHOLD_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++
++ A_WMI_RSSI_THRESHOLD_EVENT(wmip->wmi_devt, reply->range, reply->rssi);
++
++ return A_OK;
+}
+
-+void
-+wmi_free_allnodes(struct wmi_t *wmip)
++
++static A_STATUS
++wmi_reportErrorEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ wlan_free_allnodes(&wmip->wmi_scan_table);
++ WMI_TARGET_ERROR_REPORT_EVENT *reply;
++
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_TARGET_ERROR_REPORT_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++
++ A_WMI_REPORT_ERROR_EVENT(wmip->wmi_devt, reply->errorVal);
++
++ return A_OK;
+}
+
-+bss_t *
-+wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr)
++static A_STATUS
++wmi_cac_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ bss_t *ni=NULL;
-+ ni=wlan_find_node(&wmip->wmi_scan_table,macaddr);
-+ return ni;
++ WMI_CAC_EVENT *reply;
++
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_CAC_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
++
++ A_WMI_CAC_EVENT(wmip->wmi_devt, reply->ac,
++ reply->cac_indication, reply->statusCode,
++ reply->tspecSuggestion);
++
++ return A_OK;
+}
+
-+A_STATUS
-+wmi_dset_open_reply(struct wmi_t *wmip,
-+ A_UINT32 status,
-+ A_UINT32 access_cookie,
-+ A_UINT32 dset_size,
-+ A_UINT32 dset_version,
-+ A_UINT32 targ_handle,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg)
++static A_STATUS
++wmi_hbChallengeResp_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMIX_DSETOPEN_REPLY_CMD *open_reply;
-+
-+ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - wmip=0x%x\n", DBGARG, (int)wmip));
++ WMIX_HB_CHALLENGE_RESP_EVENT *reply;
+
-+ osbuf = A_NETBUF_ALLOC(sizeof(*open_reply));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
+ }
++ reply = (WMIX_HB_CHALLENGE_RESP_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "wmi: challenge response event\n", DBGARG));
+
-+ A_NETBUF_PUT(osbuf, sizeof(*open_reply));
-+ open_reply = (WMIX_DSETOPEN_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
-+
-+ open_reply->status = status;
-+ open_reply->targ_dset_handle = targ_handle;
-+ open_reply->targ_reply_fn = targ_reply_fn;
-+ open_reply->targ_reply_arg = targ_reply_arg;
-+ open_reply->access_cookie = access_cookie;
-+ open_reply->size = dset_size;
-+ open_reply->version = dset_version;
++ A_WMI_HBCHALLENGERESP_EVENT(wmip->wmi_devt, reply->cookie, reply->source);
+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETOPEN_REPLY_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
+static A_STATUS
-+wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len)
++wmi_roam_tbl_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ WMI_PMKID_LIST_REPLY *reply;
-+ A_UINT32 expected_len;
++ WMI_TARGET_ROAM_TBL *reply;
+
-+ if (len < sizeof(WMI_PMKID_LIST_REPLY)) {
++ if (len < sizeof(*reply)) {
+ return A_EINVAL;
+ }
-+ reply = (WMI_PMKID_LIST_REPLY *)datap;
-+ expected_len = sizeof(reply->numPMKID) + reply->numPMKID * WMI_PMKID_LEN;
++ reply = (WMI_TARGET_ROAM_TBL *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ if (len < expected_len) {
++ A_WMI_ROAM_TABLE_EVENT(wmip->wmi_devt, reply);
++
++ return A_OK;
++}
++
++static A_STATUS
++wmi_roam_data_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMI_TARGET_ROAM_DATA *reply;
++
++ if (len < sizeof(*reply)) {
+ return A_EINVAL;
+ }
++ reply = (WMI_TARGET_ROAM_DATA *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_WMI_PMKID_LIST_EVENT(wmip->wmi_devt, reply->numPMKID,
-+ reply->pmkidList);
++ A_WMI_ROAM_DATA_EVENT(wmip->wmi_devt, reply);
+
+ return A_OK;
+}
+
-+#ifdef CONFIG_HOST_DSET_SUPPORT
-+A_STATUS
-+wmi_dset_data_reply(struct wmi_t *wmip,
-+ A_UINT32 status,
-+ A_UINT8 *user_buf,
-+ A_UINT32 length,
-+ A_UINT32 targ_buf,
-+ A_UINT32 targ_reply_fn,
-+ A_UINT32 targ_reply_arg)
++static A_STATUS
++wmi_txRetryErrEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ WMIX_DSETDATA_REPLY_CMD *data_reply;
-+ int size;
++ WMI_TX_RETRY_ERR_EVENT *reply;
+
-+ size = sizeof(*data_reply) + length;
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_TX_RETRY_ERR_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ A_DPRINTF(DBG_WMI,
-+ (DBGFMT "Enter - length=%d status=%d\n", DBGARG, length, status));
++ A_WMI_TX_RETRY_ERR_EVENT(wmip->wmi_devt);
+
-+ osbuf = A_NETBUF_ALLOC(size);
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
-+ }
-+ A_NETBUF_PUT(osbuf, size);
-+ data_reply = (WMIX_DSETDATA_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
++ return A_OK;
++}
+
-+ data_reply->status = status;
-+ data_reply->targ_buf = targ_buf;
-+ data_reply->targ_reply_fn = targ_reply_fn;
-+ data_reply->targ_reply_arg = targ_reply_arg;
-+ data_reply->length = length;
++static A_STATUS
++wmi_snrThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMI_SNR_THRESHOLD_EVENT *reply;
+
-+ if (status == A_OK) {
-+ if (a_copy_from_user(data_reply->buf, user_buf, length)) {
-+ return A_ERROR;
-+ }
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
+ }
++ reply = (WMI_SNR_THRESHOLD_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETDATA_REPLY_CMDID,
-+ NO_SYNC_WMIFLAG));
++ A_WMI_SNR_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->snr);
++
++ return A_OK;
+}
-+#endif /* CONFIG_HOST_DSET_SUPPORT */
+
-+A_STATUS
-+wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status)
++static A_STATUS
++wmi_lqThresholdEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
+{
-+ void *osbuf;
-+ char *cmd;
-+
-+ wps_enable = status;
++ WMI_LQ_THRESHOLD_EVENT *reply;
+
-+ osbuf = a_netbuf_alloc(sizeof(1));
-+ if (osbuf == NULL) {
-+ return A_NO_MEMORY;
++ if (len < sizeof(*reply)) {
++ return A_EINVAL;
+ }
++ reply = (WMI_LQ_THRESHOLD_EVENT *)datap;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ a_netbuf_put(osbuf, sizeof(1));
-+
-+ cmd = (char *)(a_netbuf_to_data(osbuf));
++ A_WMI_LQ_THRESHOLD_EVENT_RX(wmip->wmi_devt, reply->range, reply->lq);
+
-+ A_MEMZERO(cmd, sizeof(*cmd));
-+ cmd[0] = (status?1:0);
-+ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WSC_STATUS_CMDID,
-+ NO_SYNC_WMIFLAG));
++ return A_OK;
+}
+
-diff --git a/drivers/ar6000/wmi/wmi_doc.h b/drivers/ar6000/wmi/wmi_doc.h
-new file mode 100644
-index 0000000..19cd938
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi_doc.h
-@@ -0,0 +1,4421 @@
-+/*
-+ *
-+ * Copyright (c) 2004-2007 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
++static A_STATUS
++wmi_aplistEvent_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ A_UINT16 ap_info_entry_size;
++ WMI_APLIST_EVENT *ev = (WMI_APLIST_EVENT *)datap;
++ WMI_AP_INFO_V1 *ap_info_v1;
++ A_UINT8 i;
+
++ if (len < sizeof(WMI_APLIST_EVENT)) {
++ return A_EINVAL;
++ }
+
-+#if 0
-+Wireless Module Interface (WMI) Documentaion
++ if (ev->apListVer == APLIST_VER1) {
++ ap_info_entry_size = sizeof(WMI_AP_INFO_V1);
++ ap_info_v1 = (WMI_AP_INFO_V1 *)ev->apList;
++ } else {
++ return A_EINVAL;
++ }
+
-+ This section describes the format and the usage model for WMI control and
-+ data messages between the host and the AR6000-based targets. The header
-+ file include/wmi.h contains all command and event manifest constants as
-+ well as structure typedefs for each set of command and reply parameters.
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("Number of APs in APLIST Event is %d\n", ev->numAP));
++ if (len < (int)(sizeof(WMI_APLIST_EVENT) +
++ (ev->numAP - 1) * ap_info_entry_size))
++ {
++ return A_EINVAL;
++ }
+
-+Data Frames
++ /*
++ * AP List Ver1 Contents
++ */
++ for (i = 0; i < ev->numAP; i++) {
++ AR_DEBUG_PRINTF(ATH_DEBUG_WMI, ("AP#%d BSSID %2.2x %2.2x %2.2x %2.2x %2.2x %2.2x "\
++ "Channel %d\n", i,
++ ap_info_v1->bssid[0], ap_info_v1->bssid[1],
++ ap_info_v1->bssid[2], ap_info_v1->bssid[3],
++ ap_info_v1->bssid[4], ap_info_v1->bssid[5],
++ ap_info_v1->channel));
++ ap_info_v1++;
++ }
++ return A_OK;
++}
+
-+ The data payload transmitted and received by the target follows RFC-1042
-+ encapsulation and thus starts with an 802.2-style LLC-SNAP header. The
-+ WLAN module completes 802.11 encapsulation of the payload, including the
-+ MAC header, FCS, and WLAN security related fields. At the interface to the
-+ message transport (HTC), a data frame is encapsulated in a WMI message.
++static A_STATUS
++wmi_dbglog_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ A_UINT32 dropped;
+
-+WMI Message Structure
++ dropped = *((A_UINT32 *)datap);
++ datap += sizeof(dropped);
++ len -= sizeof(dropped);
++ A_WMI_DBGLOG_EVENT(wmip->wmi_devt, dropped, datap, len);
++ return A_OK;
++}
+
-+ The WMI protocol leverages an 802.3-style Ethernet header in communicating
-+ the source and destination information between the host and the AR6000
-+ modules using a 14-byte 802.3 header ahead of the 802.2-style payload. In
-+ addition, the WMI protocol adds a header to all data messages:
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++static A_STATUS
++wmi_gpio_intr_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMIX_GPIO_INTR_EVENT *gpio_intr = (WMIX_GPIO_INTR_EVENT *)datap;
+
-+ {
-+ INT8 rssi
-+ The RSSI of the received packet and its units are shown in db above the
-+ noise floor, and the noise floor is shown in dbm.
-+ UINT8 info
-+ Contains information on message type and user priority. Message type
-+ differentiates between a data packet and a synchronization message.
-+ } WMI_DATA_HDR
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - intrmask=0x%x input=0x%x.\n", DBGARG,
++ gpio_intr->intr_mask, gpio_intr->input_values));
+
-+ User priority contains the 802.1d user priority info from host to target. Host
-+ software translates the host Ethernet format to 802.3 format prior to Tx and
-+ 802.3 format to host format in the Rx direction. The host does not transmit the
-+ FCS that follows the data. MsgType differentiates between a regular data
-+ packet (msgType=0) and a synchronization message (msgType=1).
++ A_WMI_GPIO_INTR_RX(gpio_intr->intr_mask, gpio_intr->input_values);
+
-+Data Endpoints
++ return A_OK;
++}
+
-+ The AR6000 chipset provides several data endpoints to support quality of
-+ service (QoS) and maintains separate queues and separate DMA engines for
-+ each data endpoint. A data endpoint can be bi-directional.
++static A_STATUS
++wmi_gpio_data_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMIX_GPIO_DATA_EVENT *gpio_data = (WMIX_GPIO_DATA_EVENT *)datap;
+
-+ Best effort (BE) class traffic uses the default data endpoint (2). The host can
-+ establish up to two additional data endpoints for other traffic classes. Once
-+ such a data endpoint is established, it sends and receives corresponding QoS
-+ traffic in a manner similar to the default data endpoint.
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG,
++ gpio_data->reg_id, gpio_data->value));
+
-+ If QoS is desired over the interconnect, host software must classify each data
-+ packet and place it on the appropriate data endpoint. The information
-+ required to classify data is generally available in-band as an 802.1p/q style
-+ tag or as the ToS field in the IP header. The information may also be available
-+ out-of-band depending on the host DDI.
++ A_WMI_GPIO_DATA_RX(gpio_data->reg_id, gpio_data->value);
+
-+Connection States
++ return A_OK;
++}
+
-+ Table B-1 describes the AR6000 WLAN connection states:
++static A_STATUS
++wmi_gpio_ack_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ Table B-1. AR6000 Connection States
++ A_WMI_GPIO_ACK_RX();
+
-+Connection State
-+ Description
++ return A_OK;
++}
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+ DISCONNECTED
-+ In this state, the AR6000 device is not connected to a wireless
-+ network. The device is in this state after reset when it sends the
-+ WIRELESS MODULE \93READY\94 EVENT, after it processes a
-+ DISCONNECT command, and when it loses its link with the
-+ access point (AP) that it was connected to. The device signals a
-+ transition to the DISCONNECTED state with a \93DISCONNECT\94
-+ event.
++/*
++ * Called to send a wmi command. Command specific data is already built
++ * on osbuf and current osbuf->data points to it.
++ */
++A_STATUS
++wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
++ WMI_SYNC_FLAG syncflag)
++{
++#define IS_LONG_CMD(cmdId) ((cmdId == WMI_OPT_TX_FRAME_CMDID) || (cmdId == WMI_ADD_WOW_PATTERN_CMDID))
++ WMI_CMD_HDR *cHdr;
++ WMI_PRI_STREAM_ID streamID = WMI_CONTROL_PRI;
+
-+CONNECTED
-+ In this state, the AR6000 device is connected to wireless networks.
-+ The device enters this state after successfully processing a
-+ CONNECT, which establishes a connection with a wireless
-+ network. The device signals a transition to the CONNECTED state
-+ with a \93CONNECT\94 event.
++ A_ASSERT(osbuf != NULL);
+
++ if (syncflag >= END_WMIFLAG) {
++ return A_EINVAL;
++ }
+
-+Message Types
++ if ((syncflag == SYNC_BEFORE_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
++ /*
++ * We want to make sure all data currently queued is transmitted before
++ * the cmd execution. Establish a new sync point.
++ */
++ wmi_sync_point(wmip);
++ }
+
-+ WMI uses commands, replies, and events for the control and configuration of
-+ the AR6000 device. The control protocol is asynchronous. Table B-2 describes
-+ AR6000 message types:
++ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_CMD_HDR)) != A_OK) {
++ return A_NO_MEMORY;
++ }
+
-+Table B-2. AR6000 Message Types
++ cHdr = (WMI_CMD_HDR *)A_NETBUF_DATA(osbuf);
++ cHdr->commandId = cmdId;
+
-+Message Type
-+ Description
++ /*
++ * Send cmd, some via control pipe, others via data pipe
++ */
++ if (IS_LONG_CMD(cmdId)) {
++ wmi_data_hdr_add(wmip, osbuf, CNTL_MSGTYPE);
++ // TODO ... these can now go through the control endpoint via HTC 2.0
++ streamID = WMI_BEST_EFFORT_PRI;
++ }
++ A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID);
+
-+Commands
-+ Control messages that flow from the host to the device
++ if ((syncflag == SYNC_AFTER_WMIFLAG) || (syncflag == SYNC_BOTH_WMIFLAG)) {
++ /*
++ * We want to make sure all new data queued waits for the command to
++ * execute. Establish a new sync point.
++ */
++ wmi_sync_point(wmip);
++ }
++ return (A_OK);
++#undef IS_LONG_CMD
++}
+
-+Replies/Events
-+ Control messages that flow from the device to the host.
++A_STATUS
++wmi_cmd_send_xtnd(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
++ WMI_SYNC_FLAG syncflag)
++{
++ WMIX_CMD_HDR *cHdr;
+
-+ The device issues a reply to some WMI commands, but not to others.
-+ The payload in a reply is command-specific, and some commands do
-+ not trigger a reply message at all. Events are control messages issued
-+ by the device to signal the occurrence of an asynchronous event.
++ if (A_NETBUF_PUSH(osbuf, sizeof(WMIX_CMD_HDR)) != A_OK) {
++ return A_NO_MEMORY;
++ }
+
++ cHdr = (WMIX_CMD_HDR *)A_NETBUF_DATA(osbuf);
++ cHdr->commandId = cmdId;
+
-+WMI Message Format
++ return wmi_cmd_send(wmip, osbuf, WMI_EXTENSION_CMDID, syncflag);
++}
+
-+ All WMI control commands, replies and events use the header format:
++A_STATUS
++wmi_connect_cmd(struct wmi_t *wmip, NETWORK_TYPE netType,
++ DOT11_AUTH_MODE dot11AuthMode, AUTH_MODE authMode,
++ CRYPTO_TYPE pairwiseCrypto, A_UINT8 pairwiseCryptoLen,
++ CRYPTO_TYPE groupCrypto,A_UINT8 groupCryptoLen,
++ int ssidLength, A_UCHAR *ssid,
++ A_UINT8 *bssid, A_UINT16 channel, A_UINT32 ctrl_flags)
++{
++ void *osbuf;
++ WMI_CONNECT_CMD *cc;
+
-+ WMI_CMD_HDR Header Format
-+ {
-+ UINT16 id
-+ This 16-bit constant identifies which WMI command the host is issuing,
-+ which command the target is replying to, or which event has occurred.
-+ WMI_CMD_HDR
-+ }
++ if ((pairwiseCrypto == NONE_CRYPT) && (groupCrypto != NONE_CRYPT)) {
++ return A_EINVAL;
++ }
++ if ((pairwiseCrypto != NONE_CRYPT) && (groupCrypto == NONE_CRYPT)) {
++ return A_EINVAL;
++ }
+
++ osbuf = A_NETBUF_ALLOC(sizeof(WMI_CONNECT_CMD));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ A variable-size command-, reply-, or event-specific payload follows the
-+ header. Over the interconnect, all fields in control messages (including
-+ WMI_CMD_HDR and the command specific payload) use 32-bit little Endian
-+ byte ordering and fields are packed. The AR6000 device always executes
-+ commands in order, and the host may send multiple commands without
-+ waiting for previous commands to complete. A majority of commands are
-+ processed to completion once received. Other commands trigger a longer
-+ duration activity whose completion is signaled to the host through an event.
++ A_NETBUF_PUT(osbuf, sizeof(WMI_CONNECT_CMD));
+
-+Command Restrictions
++ cc = (WMI_CONNECT_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cc, sizeof(*cc));
+
-+ Some commands may only be issued when the AR6000 device is in a certain
-+ state. The host is required to wait for an event signaling a state transition
-+ before such a command can be issued. For example, if a command requires
-+ the device to be in the CONNECTED state, then the host is required to wait
-+ for a \93CONNECT\94 event before it issues that command.
++ A_MEMCPY(cc->ssid, ssid, ssidLength);
++ cc->ssidLength = ssidLength;
++ cc->networkType = netType;
++ cc->dot11AuthMode = dot11AuthMode;
++ cc->authMode = authMode;
++ cc->pairwiseCryptoType = pairwiseCrypto;
++ cc->pairwiseCryptoLen = pairwiseCryptoLen;
++ cc->groupCryptoType = groupCrypto;
++ cc->groupCryptoLen = groupCryptoLen;
++ cc->channel = channel;
++ cc->ctrl_flags = ctrl_flags;
+
-+ The device ignores any commands inappropriate for its current state. If the
-+ command triggers a reply, the device generates an error reply. Otherwise, the
-+ device silently ignores the inappropriate command.
++ if (bssid != NULL) {
++ A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
++ }
++ if (wmi_set_keepalive_cmd(wmip, wmip->wmi_keepaliveInterval) != A_OK) {
++ return(A_ERROR);
++ }
+
-+Command and Data Synchronization
++ return (wmi_cmd_send(wmip, osbuf, WMI_CONNECT_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+ WMI provides a mechanism for a host to advise the device of necessary
-+ synchronization between commands and data. The device implements
-+ synchronization; no implicit synchronization exists between endpoints.
++A_STATUS
++wmi_reconnect_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT16 channel)
++{
++ void *osbuf;
++ WMI_RECONNECT_CMD *cc;
+
-+ The host controls synchronization using the \93SYNCHRONIZE\94 command
-+ over the control channel and synchronization messages over data channels.
-+ The device stops each data channel upon receiving a synchronization message
-+ on that channel, processing all data packets received prior to that message.
-+ After the device receives synchronization messages for each data endpoint
-+ and the \93SYNCHRONIZE\94 command, it resumes all channels.
++ osbuf = A_NETBUF_ALLOC(sizeof(WMI_RECONNECT_CMD));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ When the host must guarantee a command executes before processing new
-+ data packets, it first issues the command, then issues the \93SYNCHRONIZE\94
-+ command and sends synchronization messages on data channels. When the
-+ host must guarantee the device has processed all old data packets before a
-+ processing a new command, it issues a \93SYNCHRONIZE\94 command and
-+ synchronization messages on all data channels, then issues the desired
-+ command.
++ A_NETBUF_PUT(osbuf, sizeof(WMI_RECONNECT_CMD));
+
++ cc = (WMI_RECONNECT_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cc, sizeof(*cc));
+
++ cc->channel = channel;
+
-+WMI Commands
++ if (bssid != NULL) {
++ A_MEMCPY(cc->bssid, bssid, ATH_MAC_LEN);
++ }
+
-+ ADD_BAD_AP
-+ Cause the AR6000 device to avoid a particular AP
-+ ADD_CIPHER_KEY
-+ Add or replace any of the four AR6000 encryption keys
-+ ADD_WOW_PATTERN
-+ Used to add a pattern to the WoW pattern list
-+ CLR_RSSI_SNR
-+ Clear the current calculated RSSI and SNR value
-+ CONNECT_CMD
-+ Request that the AR6000 device establish a wireless connection
-+ with the specified SSID
-+ CREATE_PSTREAM
-+ Create prioritized data endpoint between the host and device
-+ DELETE_BAD_AP
-+ Clear an entry in the bad AP table
-+ DELETE_CIPHER_KEY
-+ Delete a previously added cipher key
-+ DELETE_PSTREAM
-+ Delete a prioritized data endpoint
-+ DELETE_WOW_PATTERN
-+ Remove a pre-specified pattern from the WoW pattern list
-+ EXTENSION
-+ WMI message interface command
-+ GET_BIT_RATE
-+ Retrieve rate most recently used by the AR6000
-+ GET_CHANNEL_LIST
-+ Retrieve list of channels used by the AR6000
-+ GET_FIXRATES
-+ Retrieves the rate-mask set via the SET_FIXRATES command.
-+ GET_PMKID_LIST_CMD
-+ Retrieve the firmware list of PMKIDs
-+ GET_ROAM_DATA
-+ Internal use for data collection; available in special build only
-+ GET_ROAM_TBL
-+ Retrieve the roaming table maintained on the target
-+ GET_TARGET_STATS
-+ Request that the target send the statistics it maintains
-+ GET_TX_PWR
-+ Retrieve the current AR6000 device Tx power levels
-+ GET_WOW_LIST
-+ Retrieve the current list of WoW patterns
-+ LQ_THRESHOLD_PARAMS
-+ Set the link quality thresholds
-+ OPT_TX_FRAME
-+ Send a special frame (special feature)
-+ RECONNECT
-+ Request a reconnection to a BSS
-+ RSSI_THRESHOLD_PARAMS
-+ Configure how the AR6000 device monitors and reports signal
-+ strength (RSSI) of the connected BSS
-+ SCAN_PARAMS
-+ Determine dwell time and changes scanned channels
-+ SET_ACCESS_PARAMS
-+ Set access parameters for the wireless network
-+ SET_ADHOC_BSSID
-+ Set the BSSID for an ad hoc network
-+ SET_AKMP_PARAMS
-+ Set multiPMKID mode
-+ SET_APPIE
-+ Add application-specified IE to a management frame
-+ SET_ASSOC_INFO
-+ Specify the IEs the device should add to association or
-+ reassociation requests
-+ SET_AUTH_MODE
-+ Set 802.11 authentication mode of reconnection
-+ SET_BEACON_INT
-+ Set the beacon interval for an ad hoc network
-+ SET_BIT_RATE
-+ Set the AR6000 to a specific fixed bit rate
-+ SET_BMISS_TIME
-+ Set the beacon miss time
-+ SET_BSS_FILTER
-+ Inform the AR6000 of network types about which it wants to
-+ receive information using a \93BSSINFO\94 event
-+ SET_BT_PARAMS
-+ Set the status of a Bluetooth stream (SCO or A2DP) or set
-+ Bluetooth coexistence register parameters
-+ SET_BT_STATUS
-+ Set the status of a Bluetooth stream (SCO or A2DP)
-+ SET_CHANNEL_PARAMETERS
-+ Configure WLAN channel parameters
-+ SET_DISC_TIMEOUT
-+ Set the amount of time the AR6000 spends attempting to
-+ reestablish a connection
-+ SET_FIXRATES
-+ Set the device to a specific fixed PHY rate (supported subset)
-+ SET_HALPARAM
-+ Internal AR6000 command to set certain hardware parameters
-+ SET_HOST_SLEEP_MODE
-+ Set the host mode to asleep or awake
-+ SET_IBSS_PM_CAPS
-+ Support a non-standard power management scheme for an
-+ ad hoc network
-+ SET_LISTEN_INT
-+ Request a listen interval
-+ SET_LPREAMBLE
-+ Override the short preamble capability of the AR6000 device
-+ SET_MAX_SP_LEN
-+ Set the maximum service period
-+ SET_OPT_MODE
-+ Set the special mode on/off (special feature)
-+ SET_PMKID
-+ Set the pairwise master key ID (PMKID)
-+ SET_PMKID_LIST_CMD
-+ Configure the firmware list of PMKIDs
-+ SET_POWER_MODE
-+ Set guidelines on trade-off between power utilization
-+ SET_POWER_PARAMS
-+ Configure power parameters
-+ SET_POWERSAVE_PARAMS
-+ Set the two AR6000 power save timers
-+ SET_PROBED_SSID
-+ Provide list of SSIDs the device should seek
-+ SET_REASSOC_MODE
-+ Specify whether the disassociated frame should be sent upon
-+ reassociation
-+ SET_RETRY_LIMITS
-+ Limit how many times the device tries to send a frame
-+ SET_ROAM_CTRL
-+ Control roaming behavior
-+ SET_RTS
-+ Determine when RTS should be sent
-+ SET_SCAN_PARAMS
-+ Set the AR6000 scan parameters
-+ SET_TKIP_COUNTERMEASURES
-+ Enable/disable reports of TKIP MIC errors
-+ SET_TX_PWR
-+ Specify the AR6000 device Tx power levels
-+ SET_VOICE_PKT_SIZE
-+ Set voice packet size
-+ SET_WMM
-+ Override the AR6000 WMM capability
-+ SET_WMM_TXOP
-+ Configure TxOP bursting when sending traffic to a WMM-
-+ capable AP
-+ SET_WOW_MODE
-+ Enable/disable WoW mode
-+ SET_WSC_STATUS
-+ Enable/disable profile check in cserv when the WPS protocol
-+ is in progress
-+ SNR_THRESHOLD_PARAMS
-+ Configure how the device monitors and reports SNR of BSS
-+ START_SCAN
-+ Start a long or short channel scan
-+ SYNCHRONIZE
-+ Force a synchronization point between command and data
-+ paths
-+ TARGET_REPORT_ERROR_BITMASK
-+ Control \93ERROR_REPORT\94 events from the AR6000
++ return (wmi_cmd_send(wmip, osbuf, WMI_RECONNECT_CMDID, NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_disconnect_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
++ A_STATUS status;
+
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ /* Bug fix for 24817(elevator bug) - the disconnect command does not
++ need to do a SYNC before.*/
++ status = (wmi_cmd_send(wmip, osbuf, WMI_DISCONNECT_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+Name
-+ ADD_BAD_AP
++ return status;
++}
+
-+Synopsis
-+ The host uses this command to cause the AR6000 to avoid a particular AP. The
-+ AR6000 maintain a table with up to two APs to avoid. An ADD_BAD_AP command
-+ adds or replaces the specified entry in this bad AP table.
++A_STATUS
++wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
++ A_BOOL forceFgScan, A_BOOL isLegacy,
++ A_UINT32 homeDwellTime, A_UINT32 forceScanInterval)
++{
++ void *osbuf;
++ WMI_START_SCAN_CMD *sc;
+
-+ If the AR6000 are currently connected to the AP specified in this command, they
-+ disassociate.
++ if ((scanType != WMI_LONG_SCAN) && (scanType != WMI_SHORT_SCAN)) {
++ return A_EINVAL;
++ }
+
-+Command
-+ wmiconfig eth1 --badap <bssid> <badApIndex>
++ osbuf = A_NETBUF_ALLOC(sizeof(*sc));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ UINT8 badApIndex Index [0...1] that identifies which entry in the
-+ bad AP table to use
++ A_NETBUF_PUT(osbuf, sizeof(*sc));
+
++ sc = (WMI_START_SCAN_CMD *)(A_NETBUF_DATA(osbuf));
++ sc->scanType = scanType;
++ sc->forceFgScan = forceFgScan;
++ sc->isLegacy = isLegacy;
++ sc->homeDwellTime = homeDwellTime;
++ sc->forceScanInterval = forceScanInterval;
+
-+ UINT8 bssid[6] MAC address of the AP to avoid
++ return (wmi_cmd_send(wmip, osbuf, WMI_START_SCAN_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Command Values
-+ badApIndex = 0, 1 Entry in the bad AP table to use
++A_STATUS
++wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
++ A_UINT16 fg_end_sec, A_UINT16 bg_sec,
++ A_UINT16 minact_chdw_msec, A_UINT16 maxact_chdw_msec,
++ A_UINT16 pas_chdw_msec,
++ A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
++ A_UINT32 max_dfsch_act_time)
++{
++ void *osbuf;
++ WMI_SCAN_PARAMS_CMD *sc;
+
-+Reset Value
-+ The bad AP table is cleared
++ osbuf = A_NETBUF_ALLOC(sizeof(*sc));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Restrictions
-+ None
++ A_NETBUF_PUT(osbuf, sizeof(*sc));
+
-+See Also
-+ \93DELETE_BAD_AP\94 on page B-13
++ sc = (WMI_SCAN_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(sc, sizeof(*sc));
++ sc->fg_start_period = fg_start_sec;
++ sc->fg_end_period = fg_end_sec;
++ sc->bg_period = bg_sec;
++ sc->minact_chdwell_time = minact_chdw_msec;
++ sc->maxact_chdwell_time = maxact_chdw_msec;
++ sc->pas_chdwell_time = pas_chdw_msec;
++ sc->shortScanRatio = shScanRatio;
++ sc->scanCtrlFlags = scanCtrlFlags;
++ sc->max_dfsch_act_time = max_dfsch_act_time;
+
-+=====================================================================
-+Name
-+ ADD_CIPHER_KEY
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_SCAN_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ The host uses this command to add/replace any of four encryption keys on the
-+ AR6000. The ADD_CIPHER_KEY command is issued after the CONNECT event
-+ has been received by the host for all dot11Auth modes except for SHARED_AUTH.
-+ When the dot11AuthMode is SHARED_AUTH, then the ADD_CIPHER_KEY
-+ command should be issued before the \93CONNECT\94 command.
++A_STATUS
++wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask)
++{
++ void *osbuf;
++ WMI_BSS_FILTER_CMD *cmd;
+
-+Command
-+ wmiconfig eth1 --cipherkey <keyIndex> <keyType> <keyUsage>
-+ <keyLength> <keyopctrl> <keyRSC> <key>
++ if (filter >= LAST_BSS_FILTER) {
++ return A_EINVAL;
++ }
+
-+Command Parameters
-+ UINT8 keyIndex Index (0...3) of the key to add/replace;
-+ uniquely identifies the key
-+ UINT8 keyType CRYPTO_TYPE
-+ UINT8 keyUsage Specifies usage parameters of the key when
-+ keyType = WEP_CRYPT
-+ UINT8 keyLength Length of the key in bytes
-+ UINT8 keyOpCtrl bit[0] = Initialize TSC (default),
-+ bit[1] = Initialize RSC
-+ UINT8 keyRSC[8] Key replay sequence counter (RSC) initial
-+ value the device should use
-+ UINT8 key[32] Key material used for this connection
-+ Command Values
-+ {
-+ NONE_CRYPT = 1
-+ WEP_CRYPT = 2
-+ TKIP_CRYPT = 3
-+ AES_CRYPT = 4
-+ KEY_OP_INIT_TSC 0x01
-+ KEY_OP_INIT_RSC 0x02
-+ KEY_OP_INIT_VAL 0x03
-+ Default is to Initialize the TSC
-+ KEY_OP_VALID_MASK 0x04
-+ Two operations defined
-+ } CRYPTO_TYPE
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ {
-+ PAIRWISE_USAGE = 0 Set if the key is used for unicast traffic only
-+ GROUP_USAGE = 1 Set if the key is used to receive multicast
-+ traffic (also set for static WEP keys)
-+ TX_USAGE = 2 Set for the GROUP key used to transmit frames
-+ All others are reserved
-+ } KEY_USAGE
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Reset Value
-+ The four available keys are disabled.
++ cmd = (WMI_BSS_FILTER_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->bssFilter = filter;
++ cmd->ieMask = ieMask;
+
-+Restrictions
-+ The cipher should correspond to the encryption mode specified in the \93CONNECT\94
-+ command.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BSS_FILTER_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+See Also
-+ \93DELETE_CIPHER_KEY\94
++A_STATUS
++wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
++ A_UINT8 ssidLength, A_UCHAR *ssid)
++{
++ void *osbuf;
++ WMI_PROBED_SSID_CMD *cmd;
+
-+=====================================================================
++ if (index > MAX_PROBED_SSID_INDEX) {
++ return A_EINVAL;
++ }
++ if (ssidLength > sizeof(cmd->ssid)) {
++ return A_EINVAL;
++ }
++ if ((flag & (DISABLE_SSID_FLAG | ANY_SSID_FLAG)) && (ssidLength > 0)) {
++ return A_EINVAL;
++ }
++ if ((flag & SPECIFIC_SSID_FLAG) && !ssidLength) {
++ return A_EINVAL;
++ }
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ ADD_WOW_PATTERN
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ The host uses this command to add a pattern to the WoW pattern list; used for
-+ pattern-matching for host wakeups by the WoW module. If the host mode is asleep
-+ and WoW is enabled, all packets are matched against the existing WoW patterns. If a
-+ packet matches any of the patterns specified, the target will wake up the host. All
-+ non-matching packets are discarded by the target without being sent up to the host.
++ cmd = (WMI_PROBED_SSID_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->entryIndex = index;
++ cmd->flag = flag;
++ cmd->ssidLength = ssidLength;
++ A_MEMCPY(cmd->ssid, ssid, ssidLength);
+
-+Command
-+ wmiconfig \96addwowpattern <list-id> <filter-size> <filter-offset>
-+ <pattern> <mask>
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PROBED_SSID_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ A_UINT8 filter_list_id ID of the list that is to include the new pattern
-+ A_UINT8 filter_size Size of the new pattern
-+ A_UINT8 filter_offset Offset at which the pattern matching for this
-+ new pattern should begin at
-+ A_UINT8 filter[1] Byte stream that contains both the pattern and
-+ the mask of the new WoW wake-up pattern
++A_STATUS
++wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons)
++{
++ void *osbuf;
++ WMI_LISTEN_INT_CMD *cmd;
+
-+Reply Parameters
-+ None
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Value
-+ None defined (default host mode is awake)
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Restrictions
-+ None
++ cmd = (WMI_LISTEN_INT_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->listenInterval = listenInterval;
++ cmd->numBeacons = listenBeacons;
+
-+See Also
-+ \93DELETE_WOW_PATTERN\94
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_LISTEN_INT_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++A_STATUS
++wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmissTime, A_UINT16 bmissBeacons)
++{
++ void *osbuf;
++ WMI_BMISS_TIME_CMD *cmd;
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ CLR_RSSI_SNR
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
-+ running-average value. This command will clear the history and have a fresh start
-+ for the running-average mechanism.
++ cmd = (WMI_BMISS_TIME_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->bmissTime = bmissTime;
++ cmd->numBeacons = bmissBeacons;
+
-+Command
-+ wmiconfig eth1 --cleanRssiSnr
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BMISS_TIME_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ None
++A_STATUS
++wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
++ A_UINT8 ieLen, A_UINT8 *ieInfo)
++{
++ void *osbuf;
++ WMI_SET_ASSOC_INFO_CMD *cmd;
++ A_UINT16 cmdLen;
+
-+Reply Parameters
-+ None
++ cmdLen = sizeof(*cmd) + ieLen - 1;
++ osbuf = A_NETBUF_ALLOC(cmdLen);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Value
-+ None defined
++ A_NETBUF_PUT(osbuf, cmdLen);
+
-+Restrictions
-+ None
++ cmd = (WMI_SET_ASSOC_INFO_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, cmdLen);
++ cmd->ieType = ieType;
++ cmd->bufferSize = ieLen;
++ A_MEMCPY(cmd->assocInfo, ieInfo, ieLen);
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ASSOC_INFO_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Name
-+ CONNECT_CMD
++A_STATUS
++wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode)
++{
++ void *osbuf;
++ WMI_POWER_MODE_CMD *cmd;
+
-+Synopsis
-+ New connect control information (connectCtrl) is added, with 32 possible modifiers.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ CONNECT_SEND_REASSOC
-+ Valid only for a host-controlled connection to a
-+ particular AP. If this bit is set, a reassociation frame is
-+ sent. If this bit is clear, an association request frame is
-+ sent to the AP.
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ CONNECT_IGNORE_WPAx_GROUP_CIPHER
-+ No group key is issued in the CONNECT command,
-+ so use the group key advertised by the AP. In a target-
-+ initiated roaming situation this allows a STA to roam
-+ between APs that support different multicast ciphers.
++ cmd = (WMI_POWER_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->powerMode = powerMode;
++ wmip->wmi_powerMode = powerMode;
+
-+ CONNECT_PROFILE_MATCH_DONE
-+ In a host-controlled connection case, it is possible that
-+ during connect, firmware may not have the
-+ information for a profile match (e.g, when the AP
-+ supports hidden SSIDs and the device may not
-+ transmit probe requests during connect). By setting
-+ this bit in the connection control information, the
-+ firmware waits for a beacon from the AP with the
-+ BSSID supplied in the CONNECT command. No
-+ additional profile checks are done.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_MODE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ CONNECT_IGNORE_AAC_BEACON
-+ Ignore the Admission Capacity information in the
-+ beacon of the AP
++A_STATUS
++wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
++ A_UINT16 atim_windows, A_UINT16 timeout_value)
++{
++ void *osbuf;
++ WMI_IBSS_PM_CAPS_CMD *cmd;
+
-+ CONNECT_ASSOC_POLICY_USER
-+ When set, the CONNECT_SEND_REASSOC setting
-+ determines if an Assoc or Reassoc is sent to an AP
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig --setconnectctrl <ctrl flags bitmask>
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command Parameters
-+ typedef struct{
-+ A_UINT8 networktype;
-+ A_UINT8 dot11authmode;
-+ A_UINT8 authmode;
-+ A_UINT8 pairwiseCryptoType; /*CRYPTO_TYPE*/
-+ A_UINT8 pairwiseCryptoLen;
-+ A_UINT8 groupCryptoType; /*CRYPTO_TYPE*/
-+ A_UINT8 groupCryptoLen;
-+ A_UINT8 ssidLength;
-+ A_UCHAR ssid[WMI_MAX_SSID_LEN];
-+ A_UINT16 channel;
-+ A_UINT8 bssid[AUTH_MAC_LEN];
-+ A_UINT8 ctrl_flags; /*WMI_CONNECT_CTRL_FLAGS_BITS*/
-+ } WMI_CONNECT_CMD;
++ cmd = (WMI_IBSS_PM_CAPS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->power_saving = pmEnable;
++ cmd->ttl = ttl;
++ cmd->atim_windows = atim_windows;
++ cmd->timeout_value = timeout_value;
+
-+ ctrl flags bitmask
-+ = 0x0001 CONNECT_ASSOC_POLICY_USER
-+ Assoc frames are sent using the policy specified by
-+ the flag
-+ = 0x0002 CONNECT_SEND_REASSOC
-+ Send Reassoc frame while connecting, otherwise send
-+ assoc frames
-+ = 0x0004 CONNECT_IGNORE_WPAx_GROUP_CIPHER
-+ Ignore WPAx group cipher for WPA/WPA2
-+ = 0x0008 CONNECT_PROFILE_MATCH_DONE
-+ Ignore any profile check
-+ = 0x0010 CONNECT_IGNORE_AAC_BEACON
-+ Ignore the admission control information in the
-+ beacon
-+ ... CONNECT_CMD, continued
-+ Command Values
-+ typedef enum {
-+ INFRA_NETWORK = 0x01,
-+ ADHOC_NETWORK = 0x02,
-+ ADHOC_CREATOR = 0x04,
-+ } NETWORK_TYPE;
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_IBSS_PM_CAPS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ typedef enum {
-+ OPEN_AUTH = 0x01,
-+ SHARED_AUTH = 0x02,
-+ LEAP_AUTH = 0x04,
-+ } DOT11_AUTH_MODE;
-+ typedef enum {
-+ NONE_AUTH = 0x01,
-+ WPA_AUTH = 0x02,
-+ WPA_PSK_AUTH = 0x03,
-+ WPA2_AUTH = 0x04,
-+ WPA2_PSK_AUTH = 0x05,
-+ WPA_AUTH_CCKM = 0x06,
-+ WPA2_AUTH_CCKM = 0x07,
-+ } AUTH_MODE;
-+ typedef enum {
-+ NONE_CRYPT = 0x01,
-+ WEP_CRYPT = 0x02,
-+ TKIP_CRYPT = 0x03,
-+ AES_CRYPT = 0x04,
-+ } CRYPTO_TYPE;
-+ typedef enum {
-+ CONNECT_ASSOC_POLICY_USER = 0x0001,
-+ CONNECT_SEND_REASSOC = 0x0002,
-+ CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
-+ CONNECT_PROFILE_MATCH_DONE = 0x0008,
-+ CONNECT_IGNORE_AAC_BEACON = 0x0010,
-+ } WMI_CONNECT_CTRL_FLAGS_BITS;
++A_STATUS
++wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
++ A_UINT16 psPollNum, A_UINT16 dtimPolicy)
++{
++ void *osbuf;
++ WMI_POWER_PARAMS_CMD *pm;
+
-+ pairwiseCryptoLen and groupCryptoLen are valid when the respective
-+ CryptoTypesis WEP_CRYPT, otherwise this value should be 0. This is the length in
-+ bytes.
++ osbuf = A_NETBUF_ALLOC(sizeof(*pm));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Value
-+ None defined
++ A_NETBUF_PUT(osbuf, sizeof(*pm));
+
-+Restrictions
-+ None
++ pm = (WMI_POWER_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(pm, sizeof(*pm));
++ pm->idle_period = idlePeriod;
++ pm->pspoll_number = psPollNum;
++ pm->dtim_policy = dtimPolicy;
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWER_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout)
++{
++ void *osbuf;
++ WMI_DISC_TIMEOUT_CMD *cmd;
+
-+Name
-+ CREATE_PSTREAM
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Synopsis
-+ The host uses this command to create a new prioritized data endpoint between the
-+ host and the AR6000 device that carries a prioritized stream of data. If the AP that the
-+ device connects to requires TSPEC stream establishment, the device requests the
-+ corresponding TSPEC with the AP. The maximum and minimum service interval
-+ ranges from 0 \96 0x7FFFFFFF (ms), where 0 = disabled. The device does not send a
-+ reply event for this command, as it is always assumed the command has succeeded.
-+ An AP admission control response comes to the host via a WMI_CAC_INDICATION
-+ event, once the response for the ADDTS frame comes.
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ Examples of cases where reassociation is generated (when WMM) and cases where
-+ ADDTS is generated (when WMM and enabling ACM) are when:
-+ Changing UAPSD flags in WMM mode, reassociation is generated
-+ Changing the interval of sending auto QoS Null frame in WMM mode;
-+ reassociation is not generated
-+ Issuing a command with same previous parameters in WMM mode and enabling
-+ ACM, an ADDTS request is generated
-+ Changing the interval of a QoS null frame sending in WMM mode and enabling
-+ ACM, an ADDTS request is generated
-+ Issuing the command in disconnected state, reassociation or ADDTS is not
-+ generated but the parameters are available after (re)association
++ cmd = (WMI_DISC_TIMEOUT_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->disconnectTimeout = timeout;
+
-+Command
-+ --createqos <user priority> <direction> <traffic class>
-+<trafficType> <voice PS capability> <min service interval> <max
-+service interval> <inactivity interval> <suspension interval>
-+<service start time> <tsid> <nominal MSDU> <max MSDU> <min data
-+rate> <mean data rate> <peak data rate> <max burst size> <delay
-+bound> <min phy rate> <sba> <medium time> where:
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_DISC_TIMEOUT_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ <user priority>
-+ 802.1D user priority range (0\967)
-+ <direction>
-+ = 0 Tx (uplink) traffic
-+ = 1 Rx (downlink) traffic
-+ = 2 Bi-directional traffic
-+ <traffic class>
-+ = 1 BK
-+ = 2 VI
-+ = 3 VO
-+ <trafficType>
-+ = 0 Aperiodic
-+ = 1 Periodic
-+ <voice PS capability>
-+ Specifies whether the voice power save mechanism
-+ (APSD if AP supports it or legacy/simulated APSD
-+ [using PS-Poll]) should be used
-+ = 0 Disable voice power save for traffic class
-+ = 1 Enable APSD voice power save for traffic class
-+ = 2 Enable voice power save for all traffic classes
-+ <min service interval>
-+ (In ms)
-+ <max service interval>
-+ Inactivity interval (in ms) (0 = Infinite)
-+ <suspension interval>
-+ (In ms)
-+ <service start time>
-+ Service start time
-+ <tsid>
-+ TSID range (0\9615)
-+ <nominal MSDU>
-+ Nominal MAC SDU size
-+ <max MSDU>
-+ Maximum MAC SDU size
-+ <min data rate>
-+ Minimum data rate (in bps)
-+ <mean data rate>
-+ Mean data rate (in bps)
-+ <peak data rate>
-+ Peak data rate (in bps)
-+ <max burst size>
-+ Maximum burst size (in bps)
-+ <delay bound>
-+ Delay bound
-+ <min phy rate>
-+ Minimum PHY rate (in bps)
-+ <sba>
-+ Surplus bandwidth allowance
-+ <medium time>
-+ Medium time in TU of 32-ms periods per sec
-+ ... CREATE_PSTREAM (continued)
++A_STATUS
++wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex, CRYPTO_TYPE keyType,
++ A_UINT8 keyUsage, A_UINT8 keyLength, A_UINT8 *keyRSC,
++ A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl,
++ WMI_SYNC_FLAG sync_flag)
++{
++ void *osbuf;
++ WMI_ADD_CIPHER_KEY_CMD *cmd;
+
-+Command Parameters
-+ UINT8 trafficClass TRAFFIC_CLASS value
-+ UINT8 traffic
-+ Direction
-+ DIR_TYPE value
-+ UINT8 rxQueueNum
-+ AR6000 device mailbox index (2 or 3)
-+ corresponding to the endpoint the host
-+ wishes to use to receive packets for the
-+ prioritized stream
-+ UINT8 trafficType TRAFFIC_TYPE value
-+ UINT8 voicePS
-+Capability
-+ VOICEPS_CAP_TYPE value
-+ UINT8 tsid Traffic stream ID
-+ UINT8 userPriority 802.1D user priority
-+ UINT16 nominalMSDU Nominal MSDU in octets
-+ UINT16 maxMSDU Maximum MSDU in octets
-+ UINT32 minServiceInt Minimum service interval: the min.
-+ period of traffic specified (in ms)
-+ UINT32 maxServiceInt Maximum service interval: the max.
-+ period of traffic specified (in ms)
-+ UINT32 inactivityInt Indicates how many ms an established
-+ stream is inactive before the prioritized
-+ data endpoint is taken down and the
-+ corresponding T-SPEC deleted
-+ UINT32 suspensionInt Suspension interval (in ms)
-+ UINT32 service StartTime Service start time
-+ UINT32 minDataRate Minimum data rate (in bps)
-+ UINT32 meanDataRate Mean data rate (in bps)
-+ UINT32 peakDataRate Peak data rate (in bps)
-+ UINT32 maxBurstSize
-+ UINT32 delayBound
-+ UINT32 minPhyRate Minimum PHY rate for TSPEC (in bps)
-+ UINT32 sba Surplus bandwidth allowance
-+ UINT32 mediumTime Medium TSPEC time (in units of 32 ms)
-+Command Values
-+ {
-+ WMM_AC_BE = 0 Best Effort
-+ WMM_AC_BK = 1 Background
-+ WMM_AC_VI = 2 Video
-+ WMM_AC_VO = 3 Voice
-+ All other values reserved
-+ } TRAFFIC_CLASS
-+ {
-+ UPLINK_TRAFFIC = 0 From the AR6000 device to the AP
-+ DOWNLINK_TRAFFIC = 1 From the AP to the AR6000 device
-+ BIDIR_TRAFFIC = 2 Bi-directional traffic
-+ All other values reserved
-+ } DIR_TYPE
++ if ((keyIndex > WMI_MAX_KEY_INDEX) || (keyLength > WMI_MAX_KEY_LEN) ||
++ (keyMaterial == NULL))
+ {
-+ DISABLE_FOR_THIS_AC = 0
-+ ENABLE_FOR_THIS_AC = 1
-+ ENABLE_FOR_ALL_AC = 2
-+ All other values reserved
-+ } VOICEPS_CAP_TYPE
++ return A_EINVAL;
++ }
+
-+ ... CREATE_PSTREAM (continued)
++ if ((WEP_CRYPT != keyType) && (NULL == keyRSC)) {
++ return A_EINVAL;
++ }
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ VI BE BK Supported, Y/N?
-+ 0 0 0 0 Y
-+ 0 0 0 1 Y
-+ 0 0 1 0 N
-+ 0 0 1 1 N
-+ 0 1 0 0 Y
-+ 0 1 0 1 Y
-+ 0 1 1 0 N
-+ 0 1 1 1 N
-+ 1 0 0 0 Y
-+ 1 0 0 1 Y
-+ 1 0 1 0 N
-+ 1 1 0 0 N
-+ 1 1 0 1 Y
-+ 1 1 0 0 N
-+ 1 1 1 0 N
-+ 1 1 1 1 Y
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Reset Value
-+ No pstream is present after reset; each of the BE, BK, VI,VO pstreams must be created
-+ (either implicitly by data flow or explicitly by user)
++ cmd = (WMI_ADD_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->keyIndex = keyIndex;
++ cmd->keyType = keyType;
++ cmd->keyUsage = keyUsage;
++ cmd->keyLength = keyLength;
++ A_MEMCPY(cmd->key, keyMaterial, keyLength);
++ if (NULL != keyRSC) {
++ A_MEMCPY(cmd->keyRSC, keyRSC, sizeof(cmd->keyRSC));
++ }
++ cmd->key_op_ctrl = key_op_ctrl;
+
-+Restrictions
-+ This command can only be issued when the device is in the CONNECTED state. If
-+ the device receives the command while in DISCONNECTED state, it replies with a
-+ failure indication. At most four prioritized data endpoints can be created, one for
-+ each AC.
++ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_CIPHER_KEY_CMDID, sync_flag));
++}
+
-+See Also
-+ \93DELETE_PSTREAM\94
-+=====================================================================
++A_STATUS
++wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk)
++{
++ void *osbuf;
++ WMI_ADD_KRK_CMD *cmd;
+
-+Name
-+ DELETE_BAD_AP
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
+
-+Synopsis
-+ The host uses this command to clear a particular entry in the bad AP table
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig eth1 --rmAP [--num=<index>] // used to clear a badAP
-+ entry. num is index from 0-3
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command Parameters
-+ UINT8 badApIndex Index [0...n] that identifies the entry in the bad
-+ AP table to delete
++ cmd = (WMI_ADD_KRK_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ A_MEMCPY(cmd->krk, krk, WMI_KRK_LEN);
+
-+Command Values
-+ badApIndex = 0, 1, 2, 3
-+ Entry in the bad AP table
++ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_KRK_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ None defined
++A_STATUS
++wmi_delete_krk_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Restrictions
-+ None
++ osbuf = A_NETBUF_ALLOC(0);
+
-+See Also
-+ \93ADD_BAD_AP\94
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_KRK_CMDID, NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex)
++{
++ void *osbuf;
++ WMI_DELETE_CIPHER_KEY_CMD *cmd;
+
-+Name
-+ DELETE_CIPHER_KEY
++ if (keyIndex > WMI_MAX_KEY_INDEX) {
++ return A_EINVAL;
++ }
+
-+Synopsis
-+ The host uses this command to delete a key that was previously added with the
-+ \93ADD_CIPHER_KEY\94 command.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ TBD
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command Parameters
-+ UINT8 keyIndex Index (0...3) of the key to be deleted
++ cmd = (WMI_DELETE_CIPHER_KEY_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->keyIndex = keyIndex;
+
-+Command Values
-+ keyIndex = 0, 1,2, 3 Key to delete
++ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_CIPHER_KEY_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ None
++A_STATUS
++wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
++ A_BOOL set)
++{
++ void *osbuf;
++ WMI_SET_PMKID_CMD *cmd;
+
-+Restrictions
-+ The host should not delete a key that is currently in use by the AR6000.
++ if (bssid == NULL) {
++ return A_EINVAL;
++ }
+
-+See Also
-+ \93ADD_CIPHER_KEY\94
++ if ((set == TRUE) && (pmkId == NULL)) {
++ return A_EINVAL;
++ }
+
-+=====================================================================
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ DELETE_PSTREAM
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ The host uses this command to delete a prioritized data endpoint created by a
-+ previous \93CREATE_PSTREAM\94 command
++ cmd = (WMI_SET_PMKID_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
++ if (set == TRUE) {
++ A_MEMCPY(cmd->pmkid, pmkId, sizeof(cmd->pmkid));
++ cmd->enable = PMKID_ENABLE;
++ } else {
++ A_MEMZERO(cmd->pmkid, sizeof(cmd->pmkid));
++ cmd->enable = PMKID_DISABLE;
++ }
+
-+Command
-+ --deleteqos <trafficClass> <tsid>, where:
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+ <traffic class>
-+ = 0 BE
-+ = 1 BK
-+ = 2 VI
-+ = 3 VO
-+ <tsid>
-+ The TSpec ID; use the -qosqueue option
-+ to get the active TSpec IDs for each traffic class
++A_STATUS
++wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en)
++{
++ void *osbuf;
++ WMI_SET_TKIP_COUNTERMEASURES_CMD *cmd;
+
-+Command Parameters
-+ A_UINT8 trafficClass Indicate the traffic class of the stream
-+ being deleted
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ {
-+ WMM_AC_BE = 0 Best effort
-+ WMM_AC_BK = 1 Background
-+ WMM_AC_VI = 2 Video
-+ WMM_AC_VO = 3 Voice
-+ } TRAFFIC CLASS
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ 0-15 for TSID
++ cmd = (WMI_SET_TKIP_COUNTERMEASURES_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->cm_en = (en == TRUE)? WMI_TKIP_CM_ENABLE : WMI_TKIP_CM_DISABLE;
+
-+Reply Values
-+ N/A
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_TKIP_COUNTERMEASURES_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Restrictions
-+ This command should only be issued after a \93CREATE_PSTREAM\94 command has
-+ successfully created a prioritized stream
++A_STATUS
++wmi_set_akmp_params_cmd(struct wmi_t *wmip,
++ WMI_SET_AKMP_PARAMS_CMD *akmpParams)
++{
++ void *osbuf;
++ WMI_SET_AKMP_PARAMS_CMD *cmd;
+
-+See Also
-+ \93CREATE_PSTREAM\94
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ cmd = (WMI_SET_AKMP_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->akmpInfo = akmpParams->akmpInfo;
+
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_AKMP_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Name
-+ DELETE_WOW_PATTERN
++A_STATUS
++wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
++ WMI_SET_PMKID_LIST_CMD *pmkInfo)
++{
++ void *osbuf;
++ WMI_SET_PMKID_LIST_CMD *cmd;
++ A_UINT16 cmdLen;
++ A_UINT8 i;
+
-+Synopsis
-+ The host uses this command to remove a pre-specified pattern from the
-+ WoW pattern list.
++ cmdLen = sizeof(pmkInfo->numPMKID) +
++ pmkInfo->numPMKID * sizeof(WMI_PMKID);
+
-+Command
-+ wmiconfig
\96delwowpattern <list-id> <pattern-id>
++ osbuf = A_NETBUF_ALLOC(cmdLen);
+
-+Command Parameters
-+ A_UINT8 filter_list_id ID of the list that contains the WoW filter
-+ pattern to delete
-+ A_UINT8 filter_id ID of the WoW filter pattern to delete
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reply Parameters
-+ None
++ A_NETBUF_PUT(osbuf, cmdLen);
++ cmd = (WMI_SET_PMKID_LIST_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->numPMKID = pmkInfo->numPMKID;
+
++ for (i = 0; i < cmd->numPMKID; i++) {
++ A_MEMCPY(&cmd->pmkidList[i], &pmkInfo->pmkidList[i],
++ WMI_PMKID_LEN);
++ }
+
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_PMKID_LIST_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ None defined
++A_STATUS
++wmi_get_pmkid_list_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Restrictions
-+ None
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+See Also
-+ \93ADD_WOW_PATTERN\94
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_PMKID_LIST_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++A_STATUS
++wmi_dataSync_send(struct wmi_t *wmip, void *osbuf, WMI_PRI_STREAM_ID streamID)
++{
++ WMI_DATA_HDR *dtHdr;
+
++ A_ASSERT(streamID != WMI_CONTROL_PRI);
++ A_ASSERT(osbuf != NULL);
+
-+Name
-+ EXTENSION
++ if (A_NETBUF_PUSH(osbuf, sizeof(WMI_DATA_HDR)) != A_OK) {
++ return A_NO_MEMORY;
++ }
+
-+Synopsis
-+ The WMI message interface is used mostly for wireless control messages to a wireless
-+ module applicable to wireless module management regardless of the target platform
-+ implementation. However, some commands only peripherally related to wireless
-+ management are desired during operation. These wireless extension commands may
-+ be platform-specific or implementation-dependent.
++ dtHdr = (WMI_DATA_HDR *)A_NETBUF_DATA(osbuf);
++ dtHdr->info =
++ (SYNC_MSGTYPE & WMI_DATA_HDR_MSG_TYPE_MASK) << WMI_DATA_HDR_MSG_TYPE_SHIFT;
+
-+Command
-+ N/A
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - streamID %d\n", DBGARG, streamID));
+
-+Command Parameters
-+ Command-specific
++ return (A_WMI_CONTROL_TX(wmip->wmi_devt, osbuf, streamID));
++}
+
-+Command Values
-+ Command-specific
++typedef struct _WMI_DATA_SYNC_BUFS {
++ A_UINT8 trafficClass;
++ void *osbuf;
++}WMI_DATA_SYNC_BUFS;
+
-+Reply Parameters
-+ Command-specific
++static A_STATUS
++wmi_sync_point(struct wmi_t *wmip)
++{
++ void *cmd_osbuf;
++ WMI_DATA_SYNC_BUFS dataSyncBufs[WMM_NUM_AC];
++ A_UINT8 i,numPriStreams=0;
++ A_STATUS status;
+
-+Reset Values
-+ None defined
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+Restrictions
-+ None defined
++ memset(dataSyncBufs,0,sizeof(dataSyncBufs));
+
-+=====================================================================
++ /* lock out while we walk through the priority list and assemble our local array */
++ LOCK_WMI(wmip);
+
++ for (i=0; i < WMM_NUM_AC ; i++) {
++ if (wmip->wmi_fatPipeExists & (1 << i)) {
++ numPriStreams++;
++ dataSyncBufs[numPriStreams-1].trafficClass = i;
++ }
++ }
+
-+Name
-+ GET_BIT_RATE
++ UNLOCK_WMI(wmip);
+
-+Synopsis
-+ Used by the host to obtain the rate most recently used by the AR6000 device
++ /* dataSyncBufs is now filled with entries (starting at index 0) containing valid streamIDs */
+
-+Command
-+ wmiconfig eth1 --getfixrates
++ do {
++ /*
++ * We allocate all network buffers needed so we will be able to
++ * send all required frames.
++ */
++ cmd_osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (cmd_osbuf == NULL) {
++ status = A_NO_MEMORY;
++ break;
++ }
+
-+Command Parameters
-+ None
++ for (i=0; i < numPriStreams ; i++) {
++ dataSyncBufs[i].osbuf = A_NETBUF_ALLOC(0);
++ if (dataSyncBufs[i].osbuf == NULL) {
++ status = A_NO_MEMORY;
++ break;
++ }
++ } //end for
+
++ /*
++ * Send sync cmd followed by sync data messages on all endpoints being
++ * used
++ */
++ status = wmi_cmd_send(wmip, cmd_osbuf, WMI_SYNCHRONIZE_CMDID,
++ NO_SYNC_WMIFLAG);
+
++ if (A_FAILED(status)) {
++ break;
++ }
++ /* cmd buffer sent, we no longer own it */
++ cmd_osbuf = NULL;
+
-+Reply Parameters
-+ INT8
-+ rateIndex
-+ See the \93SET_BIT_RATE\94 command
++ for(i=0; i < numPriStreams; i++) {
++ A_ASSERT(dataSyncBufs[i].osbuf != NULL);
+
-+Reset Values
-+ None
++ status = wmi_dataSync_send(wmip, dataSyncBufs[i].osbuf,
++ WMI_ACCESSCATEGORY_WMISTREAM(wmip,dataSyncBufs[i].trafficClass));
+
-+Restrictions
-+ This command should only be used during development/debug; it is not intended
-+for use in production. It is only valid when the device is in the CONNECTED state
++ if (A_FAILED(status)) {
++ break;
++ }
++ /* we don't own this buffer anymore, NULL it out of the array so it
++ * won't get cleaned up */
++ dataSyncBufs[i].osbuf = NULL;
++ } //end for
+
-+See Also
-+ \93SET_BIT_RATE\94
++ } while(FALSE);
+
-+=====================================================================
++ /* free up any resources left over (possibly due to an error) */
+
++ if (cmd_osbuf != NULL) {
++ A_NETBUF_FREE(cmd_osbuf);
++ }
+
-+Name
-+ GET_CHANNEL_LIST
++ for (i = 0; i < numPriStreams; i++) {
++ if (dataSyncBufs[i].osbuf != NULL) {
++ A_NETBUF_FREE(dataSyncBufs[i].osbuf);
++ }
++ }
+
-+Synopsis
-+ Used by the host uses to retrieve the list of channels that can be used by the device
-+ while in the current wireless mode and in the current regulatory domain.
++ return (status);
++}
+
-+Command
-+ TBD
++A_STATUS
++wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *params)
++{
++ void *osbuf;
++ WMI_CREATE_PSTREAM_CMD *cmd;
++ A_UINT16 activeTsids=0;
++ A_UINT8 fatPipeExistsForAC=0;
+
-+Command Parameters
-+ None
++ /* Validate all the parameters. */
++ if( !((params->userPriority < 8) &&
++ (params->userPriority <= 0x7) &&
++ (convert_userPriority_to_trafficClass(params->userPriority) == params->trafficClass) &&
++ (params->trafficDirection == UPLINK_TRAFFIC ||
++ params->trafficDirection == DNLINK_TRAFFIC ||
++ params->trafficDirection == BIDIR_TRAFFIC) &&
++ (params->trafficType == TRAFFIC_TYPE_APERIODIC ||
++ params->trafficType == TRAFFIC_TYPE_PERIODIC ) &&
++ (params->voicePSCapability == DISABLE_FOR_THIS_AC ||
++ params->voicePSCapability == ENABLE_FOR_THIS_AC ||
++ params->voicePSCapability == ENABLE_FOR_ALL_AC) &&
++ (params->tsid == WMI_IMPLICIT_PSTREAM || params->tsid <= WMI_MAX_THINSTREAM)) )
++ {
++ return A_EINVAL;
++ }
+
-+Reply Parameters
-+ UINT8 reserved Reserved
-+ UINT8 numberOfChannels Number of channels the reply contains
-+ UINT16 channelList[numberOfChannels] Array of channel frequencies (in MHz)
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Values
-+ None defined
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Restrictions
-+ The maximum number of channels that can be reported are 32
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Sending create_pstream_cmd: ac=%d tsid:%d\n", DBGARG,
++ params->trafficClass, params->tsid));
+
-+=====================================================================
++ cmd = (WMI_CREATE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ A_MEMCPY(cmd, params, sizeof(*cmd));
+
++ /* this is an implicitly created Fat pipe */
++ if (params->tsid == WMI_IMPLICIT_PSTREAM) {
++ LOCK_WMI(wmip);
++ fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
++ wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
++ UNLOCK_WMI(wmip);
++ } else {
++ /* this is an explicitly created thin stream within a fat pipe */
++ LOCK_WMI(wmip);
++ fatPipeExistsForAC = (wmip->wmi_fatPipeExists & (1 << params->trafficClass));
++ activeTsids = wmip->wmi_streamExistsForAC[params->trafficClass];
++ wmip->wmi_streamExistsForAC[params->trafficClass] |= (1<<params->tsid);
++ /* if a thinstream becomes active, the fat pipe automatically
++ * becomes active
++ */
++ wmip->wmi_fatPipeExists |= (1<<params->trafficClass);
++ UNLOCK_WMI(wmip);
++ }
+
-+Name
-+ GET_FIXRATES
++ /* Indicate activty change to driver layer only if this is the
++ * first TSID to get created in this AC explicitly or an implicit
++ * fat pipe is getting created.
++ */
++ if (!fatPipeExistsForAC) {
++ A_WMI_STREAM_TX_ACTIVE(wmip->wmi_devt, params->trafficClass);
++ }
+
-+Synopsis
-+ Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
-+ running-average value. This command will clear the history and have a fresh start for
-+ the running-average mechanism.
++ /* mike: should be SYNC_BEFORE_WMIFLAG */
++ return (wmi_cmd_send(wmip, osbuf, WMI_CREATE_PSTREAM_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ This returns rate-mask set via WMI_SET_FIXRATES to retrieve the current fixed rate
-+ that the AR6001 or AR6001 is using. See \93SET_FIXRATES\94.
++A_STATUS
++wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 tsid)
++{
++ void *osbuf;
++ WMI_DELETE_PSTREAM_CMD *cmd;
++ A_STATUS status;
++ A_UINT16 activeTsids=0;
+
-+Command
-+ wmiconfig eth1 --getfixrates
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ A_UINT16 fixRateMask; Note: if this command is used prior to
-+ using WMI_SET_FIXRATES, AR6000
-+ returns 0xffff as fixRateMask, indicating
-+ all the rates are enabled
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Reply Parameters
-+ None
++ cmd = (WMI_DELETE_PSTREAM_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
+
-+Reset Value
-+ None defined
++ cmd->trafficClass = trafficClass;
++ cmd->tsid = tsid;
+
-+Restrictions
-+ None
++ LOCK_WMI(wmip);
++ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
++ UNLOCK_WMI(wmip);
+
-+See Also
-+ \93SET_FIXRATES\94
++ /* Check if the tsid was created & exists */
++ if (!(activeTsids & (1<<tsid))) {
+
-+=====================================================================
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "TSID %d does'nt exist for trafficClass: %d\n", DBGARG, tsid, trafficClass));
++ /* TODO: return a more appropriate err code */
++ return A_ERROR;
++ }
+
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Sending delete_pstream_cmd: trafficClass: %d tsid=%d\n", DBGARG, trafficClass, tsid));
+
++ status = (wmi_cmd_send(wmip, osbuf, WMI_DELETE_PSTREAM_CMDID,
++ SYNC_BEFORE_WMIFLAG));
+
-+Name
-+ GET_PMKID_LIST_CMD
++ LOCK_WMI(wmip);
++ wmip->wmi_streamExistsForAC[trafficClass] &= ~(1<<tsid);
++ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
++ UNLOCK_WMI(wmip);
+
-+Synopsis
-+ Retrieves the list of PMKIDs on the firmware. The
-+ WMI_GET_PMKID_LIST_EVENT is generated by the firmware.
+
-+Command
-+ TBD
++ /* Indicate stream inactivity to driver layer only if all tsids
++ * within this AC are deleted.
++ */
++ if(!activeTsids) {
++ A_WMI_STREAM_TX_INACTIVE(wmip->wmi_devt, trafficClass);
++ wmip->wmi_fatPipeExists &= ~(1<<trafficClass);
++ }
+
-+Command Parameters
++ return status;
++}
+
-+Reset Values
-+ None
++/*
++ * used to set the bit rate. rate is in Kbps. If rate == -1
++ * then auto selection is used.
++ */
++A_STATUS
++wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 rate)
++{
++ void *osbuf;
++ WMI_BIT_RATE_CMD *cmd;
++ A_INT8 index;
+
-+Restrictions
-+ None
++ if (rate != -1) {
++ index = wmi_validate_bitrate(wmip, rate);
++ if(index == A_EINVAL){
++ return A_EINVAL;
++ }
++ } else {
++ index = -1;
++ }
+
-+See Also
-+ SET_PMKID_LIST_CMD GET_PMKID_LIST_EVENT
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
++ cmd = (WMI_BIT_RATE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
+
-+Name
-+ GET_ROAM_TBL
++ cmd->rateIndex = index;
+
-+Synopsis
-+ Retrieve the roaming table maintained on the target. The response is reported
-+ asynchronously through the ROAM_TBL_EVENT.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ wmiconfig --getroamtable <roamctrl> <info>
++A_STATUS
++wmi_get_bitrate_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Command Parameters
-+ A_UINT8 roamCtrlType;
-+ A_UINT16 roamMode
-+ A_UINT16 numEntries
-+ WMI_BSS_ROAM_INFO bssRoamInfo[1]
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reply Value
-+ Reported asynchronously through the ROAM_TBL_EVENT
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_BITRATE_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ None defined
++/*
++ * Returns TRUE iff the given rate index is legal in the current PHY mode.
++ */
++A_BOOL
++wmi_is_bitrate_index_valid(struct wmi_t *wmip, A_UINT32 rateIndex)
++{
++ WMI_PHY_MODE phyMode = wmip->wmi_phyMode;
++ A_BOOL isValid = TRUE;
++ switch(phyMode) {
++ case WMI_11A_MODE:
++ if ((rateIndex < MODE_A_SUPPORT_RATE_START) || (rateIndex > MODE_A_SUPPORT_RATE_STOP)) {
++ isValid = FALSE;
++ }
++ break;
+
-+Restrictions
-+ None
++ case WMI_11B_MODE:
++ if ((rateIndex < MODE_B_SUPPORT_RATE_START) || (rateIndex > MODE_B_SUPPORT_RATE_STOP)) {
++ isValid = FALSE;
++ }
++ break;
+
-+See Also
-+ SET_KEEPALIVE
++ case WMI_11GONLY_MODE:
++ if ((rateIndex < MODE_GONLY_SUPPORT_RATE_START) || (rateIndex > MODE_GONLY_SUPPORT_RATE_STOP)) {
++ isValid = FALSE;
++ }
++ break;
+
-+=====================================================================
++ case WMI_11G_MODE:
++ case WMI_11AG_MODE:
++ if ((rateIndex < MODE_G_SUPPORT_RATE_START) || (rateIndex > MODE_G_SUPPORT_RATE_STOP)) {
++ isValid = FALSE;
++ }
++ break;
+
++ default:
++ A_ASSERT(FALSE);
++ break;
++ }
+
-+Name
-+ GET_TARGET_STATS
++ return isValid;
++}
+
-+Synopsis
-+ The host uses this command to request that the target send the statistics that it
-+ maintains. The statistics obtained from the target are accrued in the host every time
-+ the GET_TARGET_STATS command is issued. The --clearStats option is added to
-+ clear the target statistics maintained in the host.
++A_INT8
++wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate)
++{
++ A_INT8 i;
++ if (rate != -1)
++ {
++ for (i=0;;i++)
++ {
++ if (wmi_rateTable[(A_UINT32) i] == 0) {
++ return A_EINVAL;
++ }
++ if (wmi_rateTable[(A_UINT32) i] == rate) {
++ break;
++ }
++ }
++ }
++ else{
++ i = -1;
++ }
+
-+Command
-+ wmiconfig --getTargetStats --clearStats
++ if(wmi_is_bitrate_index_valid(wmip, i) != TRUE) {
++ return A_EINVAL;
++ }
+
-+Command Parameters
-+ TARGET_STATS targetStats
-+ WMI_TARGET_STATS
-+ UINT8 clearStats
++ return i;
++}
+
++A_STATUS
++wmi_set_fixrates_cmd(struct wmi_t *wmip, A_INT16 fixRatesMask)
++{
++ void *osbuf;
++ WMI_FIX_RATES_CMD *cmd;
++ A_UINT32 rateIndex;
+
-+Reply Value
-+ RSSI return value (0\96100)
++ /* Make sure all rates in the mask are valid in the current PHY mode */
++ for(rateIndex = 0; rateIndex < MAX_NUMBER_OF_SUPPORT_RATES; rateIndex++) {
++ if((1 << rateIndex) & (A_UINT32)fixRatesMask) {
++ if(wmi_is_bitrate_index_valid(wmip, rateIndex) != TRUE) {
++ A_DPRINTF(DBG_WMI, (DBGFMT "Set Fix Rates command failed: Given rate is illegal in current PHY mode\n", DBGARG));
++ return A_EINVAL;
++ }
++ }
++ }
+
-+Reset Values
-+ All statistics are cleared (zeroed)
+
-+Restrictions
-+ The --getTargetStats option must be used; the --clearStats option is also available also
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+=====================================================================
++ cmd = (WMI_FIX_RATES_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
+
-+Name
-+ GET_TX_PWR
++ cmd->fixRateMask = fixRatesMask;
+
-+Synopsis
-+ The host uses this command to retrieve the current Tx power level
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ wmiconfig -i eth1 --getpower
++A_STATUS
++wmi_get_ratemask_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Command Parameters
-+ None
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reply Parameters
-+ UINT16 dbM The current Tx power level specified in dbM
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_FIXRATES_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Reset Values
-+ The maximum permitted by the regulatory domain
++A_STATUS
++wmi_get_channelList_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Restrictions
-+ None
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+See Also
-+ \93SET_TX_PWR\94
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_CHANNEL_LIST_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++/*
++ * used to generate a wmi sey channel Parameters cmd.
++ * mode should always be specified and corresponds to the phy mode of the
++ * wlan.
++ * numChan should alway sbe specified. If zero indicates that all available
++ * channels should be used.
++ * channelList is an array of channel frequencies (in Mhz) which the radio
++ * should limit its operation to. It should be NULL if numChan == 0. Size of
++ * array should correspond to numChan entries.
++ */
++A_STATUS
++wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
++ WMI_PHY_MODE mode, A_INT8 numChan,
++ A_UINT16 *channelList)
++{
++ void *osbuf;
++ WMI_CHANNEL_PARAMS_CMD *cmd;
++ A_INT8 size;
+
++ size = sizeof (*cmd);
+
-+Name
-+ GET_WOW_LIST
++ if (numChan) {
++ if (numChan > WMI_MAX_CHANNELS) {
++ return A_EINVAL;
++ }
++ size += sizeof(A_UINT16) * (numChan - 1);
++ }
+
-+Synopsis
-+ The host uses this command to retrieve the current list of WoW patterns.
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig \96getwowlist <list-id>
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Parameters
-+ A_UINT8 filter_list_id ID of the list of WoW patterns to retrieve
++ cmd = (WMI_CHANNEL_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
+
-+Reply Value(s)
-+ A_UINT16 num_filters Number of WoW patterns contained in the list
-+ A_UINT8 wow_mode Current mode of WoW (enabled or disabled)
-+ A_UINT8 host_mode Current host mode (asleep or awake)
-+ WOW_FILTER wow_filters[1]
-+ Contents of the WoW filter pattern list
-+ (contains mask, pattern, offset and size
-+ information for each of the patterns)
++ wmip->wmi_phyMode = mode;
++ cmd->scanParam = scanParam;
++ cmd->phyMode = mode;
++ cmd->numChannels = numChan;
++ A_MEMCPY(cmd->channelList, channelList, numChan * sizeof(A_UINT16));
+
-+Reset Value
-+ None defined
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_CHANNEL_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Restrictions
-+ None
++A_STATUS
++wmi_set_rssi_threshold_params(struct wmi_t *wmip,
++ WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_RSSI_THRESHOLD_PARAMS_CMD *cmd;
++ /* These values are in ascending order */
++ if( rssiCmd->thresholdAbove6_Val <= rssiCmd->thresholdAbove5_Val ||
++ rssiCmd->thresholdAbove5_Val <= rssiCmd->thresholdAbove4_Val ||
++ rssiCmd->thresholdAbove4_Val <= rssiCmd->thresholdAbove3_Val ||
++ rssiCmd->thresholdAbove3_Val <= rssiCmd->thresholdAbove2_Val ||
++ rssiCmd->thresholdAbove2_Val <= rssiCmd->thresholdAbove1_Val ||
++ rssiCmd->thresholdBelow6_Val <= rssiCmd->thresholdBelow5_Val ||
++ rssiCmd->thresholdBelow5_Val <= rssiCmd->thresholdBelow4_Val ||
++ rssiCmd->thresholdBelow4_Val <= rssiCmd->thresholdBelow3_Val ||
++ rssiCmd->thresholdBelow3_Val <= rssiCmd->thresholdBelow2_Val ||
++ rssiCmd->thresholdBelow2_Val <= rssiCmd->thresholdBelow1_Val) {
+
-+See Also
-+ \93SET_WSC_STATUS\94
++ return A_EINVAL;
++ }
+
-+=====================================================================
++ size = sizeof (*cmd);
+
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ LQ_THRESHOLD_PARAMS
++ A_NETBUF_PUT(osbuf, size);
+
-+Synopsis
-+ Sets Link Quality thresholds, the sampling will happen at every unicast data frame
-+ Tx if a certain threshold is met, and the corresponding event will be sent to the host.
++ cmd = (WMI_RSSI_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, rssiCmd, sizeof(WMI_RSSI_THRESHOLD_PARAMS_CMD));
+
-+Command
-+ --lqThreshold <enable> <upper_threshold_1> ...
-+ <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
++ return (wmi_cmd_send(wmip, osbuf, WMI_RSSI_THRESHOLD_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ <enable> = 0 Disable link quality sampling
-+ = 1 Enable link quality sampling
-+ <upper_threshold_x> Above thresholds (value in [0,100]), in
-+ ascending order
-+ <lower_threshold_x> Below thresholds (value in [0,100]), in
-+ ascending order
++A_STATUS
++wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip,
++ WMI_SET_HOST_SLEEP_MODE_CMD *hostModeCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_SET_HOST_SLEEP_MODE_CMD *cmd;
+
-+Command Values
-+ See command parameters
++ if( hostModeCmd->awake == hostModeCmd->asleep) {
++ return A_EINVAL;
++ }
+
-+Reset Value
-+ None defined
++ size = sizeof (*cmd);
+
-+Restrictions
-+ None
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ A_NETBUF_PUT(osbuf, size);
+
++ cmd = (WMI_SET_HOST_SLEEP_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, hostModeCmd, sizeof(WMI_SET_HOST_SLEEP_MODE_CMD));
+
-+Name
-+ OPT_TX_FRAME
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_HOST_SLEEP_MODE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ Special feature, sends a special frame.
++A_STATUS
++wmi_set_wow_mode_cmd(struct wmi_t *wmip,
++ WMI_SET_WOW_MODE_CMD *wowModeCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_SET_WOW_MODE_CMD *cmd;
+
-+Command
-+ wmiconfig --sendframe <frmType> <dstaddr> <bssid> <optIEDatalen>
-+ <optIEData>
++ size = sizeof (*cmd);
+
-+Command Parameters
-+ {
-+ A_UINT16 optIEDataLen;
-+ A_UINT8 frmType;
-+ A_UINT8 dstAddr[ATH_MAC_LEN];
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT8 optIEData[1];
-+ } WMI_OPT_TX_FRAME_CMD;
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ <frmtype> = 1 Probe request frame
-+ = 2 Probe response frame
-+ = 3 CPPP start
-+ = 4 CPPP stop
++ A_NETBUF_PUT(osbuf, size);
+
-+Reset Value
-+ None defined
++ cmd = (WMI_SET_WOW_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, wowModeCmd, sizeof(WMI_SET_WOW_MODE_CMD));
+
-+Restrictions
-+ Send a special frame only when special mode is on.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WOW_MODE_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+=====================================================================
++}
+
++A_STATUS
++wmi_get_wow_list_cmd(struct wmi_t *wmip,
++ WMI_GET_WOW_LIST_CMD *wowListCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_GET_WOW_LIST_CMD *cmd;
+
-+Name
-+ RECONNECT
++ size = sizeof (*cmd);
+
-+Synopsis
-+ This command requests a reconnection to a BSS to which the AR6000 device was
-+ formerly connected
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ TBD
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Parameters
-+ UINT16 channel Provides a hint as to which channel was
-+ used for a previous connection
-+ UINT8 bssid[6] If set, indicates which BSSID to connect to
++ cmd = (WMI_GET_WOW_LIST_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, wowListCmd, sizeof(WMI_GET_WOW_LIST_CMD));
+
-+Command Values
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_WOW_LIST_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+Reset Values
-+ None
++}
+
-+Restrictions
-+ None
++static A_STATUS
++wmi_get_wow_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
++ WMI_GET_WOW_LIST_REPLY *reply;
+
-+See Also
-+ \93CONNECT_CMD\94
++ if (len < sizeof(WMI_GET_WOW_LIST_REPLY)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_GET_WOW_LIST_REPLY *)datap;
+
-+=====================================================================
++ A_WMI_WOW_LIST_EVENT(wmip->wmi_devt, reply->num_filters,
++ reply);
+
++ return A_OK;
++}
+
-+Name
-+ RSSI_THRESHOLD_PARAMS
++A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
++ WMI_ADD_WOW_PATTERN_CMD *addWowCmd,
++ A_UINT8* pattern, A_UINT8* mask,
++ A_UINT8 pattern_size)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_ADD_WOW_PATTERN_CMD *cmd;
++ A_UINT8 *filter_mask = NULL;
+
-+Synopsis
-+ Configures how the AR6000 device monitors and reports signal strength (RSSI) of the
-+ connected BSS, which is used as a link quality metric. The four RSSI threshold sets (in
-+ dbM) of the host specification divide the signal strength range into six segments.
-+ When signal strength increases or decreases across one of the boundaries, an
-+ RSSI_THRESHOLD event is signaled to the host. The host may then choose to take
-+ action (such as influencing roaming).
++ size = sizeof (*cmd);
+
-+Command
-+ wmiconfig eth1 --rssiThreshold <weight> <pollTime>
-+ <above_threshold_val_1> ... <above_threshold_tag_6>
-+ <above_threshold_val_6>
-+ <below_threshold_tag_1> <below_threshold_val_1> ...
-+ <below_threshold_tag_6> <below_threshold_val_6>
++ size += ((2 * addWowCmd->filter_size)* sizeof(A_UINT8));
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ UINT8 weight Range in [1, 16] used to calculate average RSSI
-+ UINT32 pollTime RSSI (signal strength) sampling frequency in
-+ seconds (if pollTime = 0, single strength
-+ sampling is disabled)
-+ USER_RSS__THOLD tholds[12] Thresholds (6 x 2)
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Values
-+ None defined
++ cmd = (WMI_ADD_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->filter_list_id = addWowCmd->filter_list_id;
++ cmd->filter_offset = addWowCmd->filter_offset;
++ cmd->filter_size = addWowCmd->filter_size;
+
-+Reset Values
-+ pollTime is 0, and sampling is disabled
++ A_MEMCPY(cmd->filter, pattern, addWowCmd->filter_size);
+
-+Restrictions
-+ Can only be issued if the AR6000 device is connected
++ filter_mask = (A_UINT8*)(cmd->filter + cmd->filter_size);
++ A_MEMCPY(filter_mask, mask, addWowCmd->filter_size);
+
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_WOW_PATTERN_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Name
-+ SCAN_PARAMS
++A_STATUS
++wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
++ WMI_DEL_WOW_PATTERN_CMD *delWowCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_DEL_WOW_PATTERN_CMD *cmd;
+
-+Synopsis
-+ The minact parameter determines the minimum active channel dwell time, within
-+ which if the STA receives any beacon, it remains on that channel until the maxact
-+ channel dwell time. If the STA does not receive a beacon within the minact dwell
-+ time, it switches to scan the next channel.
++ size = sizeof (*cmd);
+
-+Command
-+ wmiconfig -scan -minact=<ms> --maxact=<ms>
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ UINT16 maxact Channel dwell time (in ms), default = 0
-+ UINT16 minact Channel dwell time (in ms), default = 105
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Values
-+ See channel parameters
++ cmd = (WMI_DEL_WOW_PATTERN_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, delWowCmd, sizeof(WMI_DEL_WOW_PATTERN_CMD));
+
-+Reset Values
-+ None defined
++ return (wmi_cmd_send(wmip, osbuf, WMI_DEL_WOW_PATTERN_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+Restrictions
-+ The minact value should be greater than 0; maxact should be between 5\9665535 ms
-+ and greater than minact
++}
+
-+=====================================================================
++A_STATUS
++wmi_set_snr_threshold_params(struct wmi_t *wmip,
++ WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_SNR_THRESHOLD_PARAMS_CMD *cmd;
++ /* These values are in ascending order */
++ if( snrCmd->thresholdAbove4_Val <= snrCmd->thresholdAbove3_Val ||
++ snrCmd->thresholdAbove3_Val <= snrCmd->thresholdAbove2_Val ||
++ snrCmd->thresholdAbove2_Val <= snrCmd->thresholdAbove1_Val ||
++ snrCmd->thresholdBelow4_Val <= snrCmd->thresholdBelow3_Val ||
++ snrCmd->thresholdBelow3_Val <= snrCmd->thresholdBelow2_Val ||
++ snrCmd->thresholdBelow2_Val <= snrCmd->thresholdBelow1_Val) {
+
++ return A_EINVAL;
++ }
+
-+Name
-+ SET_ACCESS_PARAMS
++ size = sizeof (*cmd);
+
-+Synopsis
-+ Allows the host to set access parameters for the wireless network. A thorough
-+ understanding of IEEE 802.11 is required to properly manipulate these parameters.
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig eth1 --acparams --txop <limit> --cwmin <0-15>
-+ --cwmax <0-15> --aifsn<0-15>
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Parameters
-+ UINT16 txop The maximum time (expressed in units of
-+ 32 ms) the device can spend transmitting
-+ after acquiring the right to transmit
-+ UINT8 eCWmin Minimum contention window
-+ UINT8 eCWmax Maximum contention window
-+ UINT8 aifsn The arbitration inter-frame space number
++ cmd = (WMI_SNR_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, snrCmd, sizeof(WMI_SNR_THRESHOLD_PARAMS_CMD));
+
-+Command Values
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_SNR_THRESHOLD_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Values
-+ Reasonable defaults that vary, between endpoints (prioritized streams)
++A_STATUS
++wmi_clr_rssi_snr(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Restrictions
-+ None
++ osbuf = A_NETBUF_ALLOC(sizeof(int));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_CLR_RSSI_SNR_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_set_lq_threshold_params(struct wmi_t *wmip,
++ WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_LQ_THRESHOLD_PARAMS_CMD *cmd;
++ /* These values are in ascending order */
++ if( lqCmd->thresholdAbove4_Val <= lqCmd->thresholdAbove3_Val ||
++ lqCmd->thresholdAbove3_Val <= lqCmd->thresholdAbove2_Val ||
++ lqCmd->thresholdAbove2_Val <= lqCmd->thresholdAbove1_Val ||
++ lqCmd->thresholdBelow4_Val <= lqCmd->thresholdBelow3_Val ||
++ lqCmd->thresholdBelow3_Val <= lqCmd->thresholdBelow2_Val ||
++ lqCmd->thresholdBelow2_Val <= lqCmd->thresholdBelow1_Val ) {
+
-+Name
-+ SET_ADHOC_BSSID
++ return A_EINVAL;
++ }
+
-+Synopsis
-+ Allows the host to set the BSSID for an ad hoc network. If a network with this BSSID
-+ is not found, the target creates an ad hoc network with this BSSID after the connect
-+ WMI command is triggered (e.g., by the SIOCSIWESSID IOCTL).
++ size = sizeof (*cmd);
+
-+Command
-+ wmiconfig eth1 --adhocbssid <bssid>
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ A_UINT8 bssid[ATH_MAC_LEN] BSSID is specified in xx:xx:xx:xx:xx:xx format
++ A_NETBUF_PUT(osbuf, size);
+
-+Command Values
-+ None
++ cmd = (WMI_LQ_THRESHOLD_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
++ A_MEMCPY(cmd, lqCmd, sizeof(WMI_LQ_THRESHOLD_PARAMS_CMD));
+
-+Reset Values
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_LQ_THRESHOLD_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Restrictions
-+ None
++A_STATUS
++wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 mask)
++{
++ void *osbuf;
++ A_INT8 size;
++ WMI_TARGET_ERROR_REPORT_BITMASK *cmd;
+
-+=====================================================================
++ size = sizeof (*cmd);
+
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_AKMP_PARAMS
++ A_NETBUF_PUT(osbuf, size);
+
-+Synopsis
-+ Enables or disables multi PMKID mode.
++ cmd = (WMI_TARGET_ERROR_REPORT_BITMASK *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
+
-+Command
-+ wmiconfig eth1 --setakmp --multipmkid=<on/off>
++ cmd->bitmask = mask;
+
-+Command Parameters
-+ typedef struct {
-+ A_UINT32 akmpInfo;
-+ } WMI_SET_AKMP_PARAMS_CMD;
++ return (wmi_cmd_send(wmip, osbuf, WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Values
-+ akmpInfo;
-+ bit[0] = 0
-+ MultiPMKID mode is disabled and PMKIDs that
-+ were set using the WMI_SET_PMKID_CMD are
-+ used in the [Re]AssocRequest frame.
-+ bit[0] = 1
-+ MultiPMKID mode is enabled and PMKIDs issued
-+ by the WMI_SET_PMKID_LIST_CMD are used in
-+ the next [Re]AssocRequest sent to the AP.
++A_STATUS
++wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie, A_UINT32 source)
++{
++ void *osbuf;
++ WMIX_HB_CHALLENGE_RESP_CMD *cmd;
+
-+Reset Values
-+ MultiPMKID mode is disabled
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Restrictions
-+ None
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+=====================================================================
++ cmd = (WMIX_HB_CHALLENGE_RESP_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->cookie = cookie;
++ cmd->source = source;
+
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_HB_CHALLENGE_RESP_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Name
-+ SET_APPIE
++A_STATUS
++wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
++ A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
++ A_UINT32 valid)
++{
++ void *osbuf;
++ WMIX_DBGLOG_CFG_MODULE_CMD *cmd;
+
-+Synopsis
-+ Add an application-specified IE to a management frame. The maximum length is
-+ 76 bytes. Including the length and the element ID, this translates to 78 bytes.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig --setappie <frame> <IE>, where:
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ frame
-+ One of beacon, probe, respon, assoc
++ cmd = (WMIX_DBGLOG_CFG_MODULE_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->config.cfgmmask = mmask;
++ cmd->config.cfgtsr = tsr;
++ cmd->config.cfgrep = rep;
++ cmd->config.cfgsize = size;
++ cmd->config.cfgvalid = valid;
+
-+ IE
-+ A hex string beginning with DD (if = 0, no
-+ IE is sent in the management frame)
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DBGLOG_CFG_MODULE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ mgmtFrmType;
-+ A WMI_MGMT_FRAME_TYPE
++A_STATUS
++wmi_get_stats_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+ ieLen;
-+ Length of the IE to add to the GMT frame
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_STATISTICS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ None defined
++A_STATUS
++wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid)
++{
++ void *osbuf;
++ WMI_ADD_BAD_AP_CMD *cmd;
+
-+Restrictions
-+ Supported only for the probe request and association request management frame
-+types. Also, only one IE can be added per management frame type.
++ if ((bssid == NULL) || (apIndex > WMI_MAX_BAD_AP_INDEX)) {
++ return A_EINVAL;
++ }
+
-+=====================================================================
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Name
-+ SET_ASSOC_INFO
++ cmd = (WMI_ADD_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->badApIndex = apIndex;
++ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
+
-+Synopsis
-+ The host uses this command to specify any information elements (IEs) it wishes the
-+ AR6000 device to add to all future association and reassociation requests. IEs must be
-+ correct and are used as is by the device. IEs specified through this command are
-+ cleared with a DISCONNECT.
++ return (wmi_cmd_send(wmip, osbuf, WMI_ADD_BAD_AP_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ wmiconfig eth1 --setAssocIe <IE>
++A_STATUS
++wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex)
++{
++ void *osbuf;
++ WMI_DELETE_BAD_AP_CMD *cmd;
+
-+Command Parameters
-+ UINT8 ieType Used directly in 802.11 frames
-+ UINT8 bufferSize Size of assocInfo (in bytes) ranging from
-+ 0\96240. If = 0, previously set IEs are cleared.
-+ UINT8 assocInfo[bufferSize] Used directly in 802.11 frames
++ if (apIndex > WMI_MAX_BAD_AP_INDEX) {
++ return A_EINVAL;
++ }
+
-+Command Values
-+ None
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Values
-+ IEs are cleared
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Restrictions
-+ This command can only be issued in the DISCONNECTED state
++ cmd = (WMI_DELETE_BAD_AP_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->badApIndex = apIndex;
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_DELETE_BAD_AP_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM)
++{
++ void *osbuf;
++ WMI_SET_TX_PWR_CMD *cmd;
+
-+Name
-+ SET_AUTHMODE
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Synopsis
-+ Sets the 802.11 authentication mode of reconnection
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command
-+ wmiconfig eth1 --setauthmode <mode>
++ cmd = (WMI_SET_TX_PWR_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->dbM = dbM;
+
-+Command Parameters
-+ UINT8 mode
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+Command Values
-+ mode = 0x00 Proceed with authentication during reconnect
-+ = 0x01 Do not proceed with authentication during reconnect
++A_STATUS
++wmi_get_txPwr_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+Reset Values
-+ Authentication
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Restrictions
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_TX_PWR_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++A_STATUS
++wmi_switch_radio(struct wmi_t *wmip, A_UINT8 on)
++{
++ WMI_SCAN_PARAMS_CMD scParams = {0, 0, 0, 0, 0,
++ WMI_SHORTSCANRATIO_DEFAULT,
++ DEFAULT_SCAN_CTRL_FLAGS,
++ 0};
+
++ if (on) {
++ /* Enable foreground scanning */
++ if (wmi_scanparams_cmd(wmip, scParams.fg_start_period,
++ scParams.fg_end_period,
++ scParams.bg_period,
++ scParams.minact_chdwell_time,
++ scParams.maxact_chdwell_time,
++ scParams.pas_chdwell_time,
++ scParams.shortScanRatio,
++ scParams.scanCtrlFlags,
++ scParams.max_dfsch_act_time) != A_OK) {
++ return -EIO;
++ }
++ } else {
++ wmi_disconnect_cmd(wmip);
++ if (wmi_scanparams_cmd(wmip, 0xFFFF, 0, 0, 0,
++ 0, 0, 0, 0xFF, 0) != A_OK) {
++ return -EIO;
++ }
++ }
+
-+Name
-+ SET_BEACON_INT
++ return A_OK;
++}
+
-+Synopsis
-+ Sets the beacon interval for an ad hoc network. Beacon interval selection may have an
-+ impact on power savings. To some degree, a longer interval reduces power
-+ consumption but also decreases throughput. A thorough understanding of IEEE
-+ 802.11 ad hoc networks is required to use this command effectively.
+
-+Command
-+ wmiconfig eth1 --ibssconintv
++A_UINT16
++wmi_get_mapped_qos_queue(struct wmi_t *wmip, A_UINT8 trafficClass)
++{
++ A_UINT16 activeTsids=0;
+
-+Command Parameters
-+ UINT16 beaconInterval Specifies the beacon interval in TU units (1024 ms)
++ LOCK_WMI(wmip);
++ activeTsids = wmip->wmi_streamExistsForAC[trafficClass];
++ UNLOCK_WMI(wmip);
+
-+Command Values
-+ None
-+
-+Reset Values
-+ The default beacon interval is 100 TUs (102.4 ms)
-+
-+Restrictions
-+ This command can only be issued before the AR6000 device starts an ad hoc network
-+
-+See Also
-+ \93SET_IBSS_PM_CAPS\94
++ return activeTsids;
++}
+
-+=====================================================================
++A_STATUS
++wmi_get_roam_tbl_cmd(struct wmi_t *wmip)
++{
++ void *osbuf;
+
++ osbuf = A_NETBUF_ALLOC(0); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_BIT_RATE
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_TBL_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ The host uses this command to set the AR6000 device to a specific fixed rate.
++A_STATUS
++wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType)
++{
++ void *osbuf;
++ A_UINT32 size = sizeof(A_UINT8);
++ WMI_TARGET_ROAM_DATA *cmd;
+
-+Command
-+ wmiconfig eth1 --setfixrates <rate_0> ... <rate_n>
++ osbuf = A_NETBUF_ALLOC(size); /* no payload */
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ INT8 rateIndex
-+ A WMI_BIT_RATE value
-+ {
-+ RATE_AUTO = -1
-+ RATE_1Mb = 0
-+ RATE_2Mb = 1
-+ RATE_5_5M = 2
-+ RATE_11Mb = 3
-+ RATE_6Mb = 4
-+ RATE_9Mb = 5
-+ RATE_12Mb = 6
-+ RATE_18Mb = 7
-+ RATE_24Mb = 8
-+ RATE_36Mb = 9
-+ RATE_48Mb = 10
-+ RATE_54Mb = 11
-+ } WMI_BIT_RATE
++ A_NETBUF_PUT(osbuf, size);
+
++ cmd = (WMI_TARGET_ROAM_DATA *)(A_NETBUF_DATA(osbuf));
++ cmd->roamDataType = roamDataType;
+
-+Command Values
-+ See command parameters
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_ROAM_DATA_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Values
-+ The dynamic rate is determined by the AR6000 device
++A_STATUS
++wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
++ A_UINT8 size)
++{
++ void *osbuf;
++ WMI_SET_ROAM_CTRL_CMD *cmd;
+
-+Restrictions
-+ This command is intended for use only during development/debug; it is not
-+intended for use in production
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+See Also
-+ \93GET_BIT_RATE\94
++ A_NETBUF_PUT(osbuf, size);
+
-+=====================================================================
++ cmd = (WMI_SET_ROAM_CTRL_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
+
++ A_MEMCPY(cmd, p, size);
+
-+Name
-+ SET_BMISS_TIME
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ROAM_CTRL_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ This command sets the beacon miss (BMISS) time, which the AR6000 hardware use
-+ to recognize missed beacons. When an excessive number (15) of consecutive beacons
-+ are missed, the AR6000 consider switching to a different BSS. The time can be
-+ specified in number of beacons or in TUs.
++A_STATUS
++wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
++ WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
++ A_UINT8 size)
++{
++ void *osbuf;
++ WMI_POWERSAVE_TIMERS_POLICY_CMD *cmd;
+
-+Command(s)
-+ wmiconfig eth1 --setbmissbeacons=<val>
-+ wmiconfig eth1 --setbmisstime=<val>
++ /* These timers can't be zero */
++ if(!pCmd->psPollTimeout || !pCmd->triggerTimeout ||
++ !(pCmd->apsdTimPolicy == IGNORE_TIM_ALL_QUEUES_APSD ||
++ pCmd->apsdTimPolicy == PROCESS_TIM_ALL_QUEUES_APSD) ||
++ !(pCmd->simulatedAPSDTimPolicy == IGNORE_TIM_SIMULATED_APSD ||
++ pCmd->simulatedAPSDTimPolicy == PROCESS_TIM_SIMULATED_APSD))
++ return A_EINVAL;
+
-+Command Parameters
-+ UINT16 bmissTime Specifies the beacon miss time
-+ [1000...5000] in TUs (1024 ms)
-+ UINT16 bmissbeacons Specifies the number of beacons [5...50]
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ None
++ A_NETBUF_PUT(osbuf, size);
+
-+Reset Values
-+ bmissTime is 1500 TUs (1536 ms)
++ cmd = (WMI_POWERSAVE_TIMERS_POLICY_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, size);
+
-+Restrictions
-+ None
++ A_MEMCPY(cmd, pCmd, size);
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++#ifdef CONFIG_HOST_GPIO_SUPPORT
++/* Send a command to Target to change GPIO output pins. */
++A_STATUS
++wmi_gpio_output_set(struct wmi_t *wmip,
++ A_UINT32 set_mask,
++ A_UINT32 clear_mask,
++ A_UINT32 enable_mask,
++ A_UINT32 disable_mask)
++{
++ void *osbuf;
++ WMIX_GPIO_OUTPUT_SET_CMD *output_set;
++ int size;
+
-+Name
-+ SET_BSS_FILTER
++ size = sizeof(*output_set);
+
-+Synopsis
-+ The host uses this to inform the AR6000 device of the types of networks about which
-+ it wants to receive information from the \93BSSINFO\94 event. As the device performs
-+ either foreground or background scans, it applies the filter and sends \93BSSINFO\94
-+ events only for the networks that pass the filter. If any of the bssFilter or the ieMask
-+ filter matches, a BSS Info is sent to the host. The ieMask currently is used as a match
-+ for the IEs in the beacons, probe reponses and channel switch action management
-+ frame. See also \93Scan and Roam\94 on page C-1.
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - set=0x%x clear=0x%x enb=0x%x dis=0x%x\n", DBGARG,
++ set_mask, clear_mask, enable_mask, disable_mask));
+
-+ The BSS filter command has been enhanced to support IE based filtering. The IEs can
-+ be specified as a bitmask through this command using this enum.
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, size);
++ output_set = (WMIX_GPIO_OUTPUT_SET_CMD *)(A_NETBUF_DATA(osbuf));
+
-+Command
-+ wmiconfig eth1 \96filter = <filter> --ieMask 0x<mask>
++ output_set->set_mask = set_mask;
++ output_set->clear_mask = clear_mask;
++ output_set->enable_mask = enable_mask;
++ output_set->disable_mask = disable_mask;
+
-+Command Parameters
-+ UINT8 BssFilter
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_OUTPUT_SET_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ Command Values
-+ typedef struct {
-+ A_UINT8 bssFilter; See WMI_BSS_FILTER
-+ A_UINT32 ieMask;
-+ } __ATTRIB_PACK WMI_BSS_FILTER_CMD;
++/* Send a command to the Target requesting state of the GPIO input pins */
++A_STATUS
++wmi_gpio_input_get(struct wmi_t *wmip)
++{
++ void *osbuf;
+
-+ The ieMask can take this combination of values:
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+ enum {
-+ BSS_ELEMID_CHANSWITCH = 0x01
-+ BSS_ELEMID_ATHEROS = 0x02,
++ osbuf = A_NETBUF_ALLOC(0);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
+ }
+
-+Reply Value
-+ None
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INPUT_GET_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Reset Value
-+ BssFilter = NONE_BSS_FILTER (0)
++/* Send a command to the Target that changes the value of a GPIO register. */
++A_STATUS
++wmi_gpio_register_set(struct wmi_t *wmip,
++ A_UINT32 gpioreg_id,
++ A_UINT32 value)
++{
++ void *osbuf;
++ WMIX_GPIO_REGISTER_SET_CMD *register_set;
++ int size;
+
-+Restrictions
-+ None
++ size = sizeof(*register_set);
+
-+See Also
-+ \93CONNECT_CMD\94
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - reg=%d value=0x%x\n", DBGARG, gpioreg_id, value));
+
-+=====================================================================
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, size);
++ register_set = (WMIX_GPIO_REGISTER_SET_CMD *)(A_NETBUF_DATA(osbuf));
+
++ register_set->gpioreg_id = gpioreg_id;
++ register_set->value = value;
+
-+Name
-+ SET_BT_PARAMS
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_SET_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ This command is used to set the status of a Bluetooth stream or set Bluetooth
-+ coexistence register parameters. The stream may be an SCO or an A2DP stream and
-+ its status can be started/stopped/suspended/resumed.
++/* Send a command to the Target to fetch the value of a GPIO register. */
++A_STATUS
++wmi_gpio_register_get(struct wmi_t *wmip,
++ A_UINT32 gpioreg_id)
++{
++ void *osbuf;
++ WMIX_GPIO_REGISTER_GET_CMD *register_get;
++ int size;
+
-+Command
-+ wmiconfig
\96setBTparams <paramType> <params>
++ size = sizeof(*register_get);
+
-+Command Parameters
-+ struct {
-+ union {
-+ BT_PARAMS_SCO scoParams;
-+ BT_PARAMS_A2DP a2dpParams;
-+ BT_PARAMS_MISC miscParams;
-+ BT_COEX_REGS regs;
-+ } info;
-+ A_UINT8 paramType;
-+ struct {
-+ A_UINT8 noSCOPkts; Number of SCO packets between consecutive PS-POLLs
-+ A_UINT8 pspollTimeout;
-+ A_UINT8 stompbt;
-+ } BT_PARAMS_SCO;
-+ struct {
-+ A2DP BT stream parameters
-+ A_UINT32 period;
-+ A_UINT32 dutycycle;
-+ A_UINT8 stompbt;
-+ } BT_PARAMS_A2DP;
-+ struct {
-+ union {
-+ WLAN_PROTECT_POLICY_TYPE protectParams;
-+ A_UINT16 wlanCtrlFlags;
-+ }info;
-+ A_UINT8 paramType;
-+ } BT_PARAMS_MISC;
-+ struct {
-+ BT coexistence registers values
-+ A_UINT32 mode; Coexistence mode
-+ A_UINT32 scoWghts; WLAN and BT weights
-+ A_UINT32 a2dpWghts;
-+ A_UINT32 genWghts;
-+ A_UINT32 mode2; Coexistence mode2
-+ A_UINT8 setVal;
-+ } BT_COEX_REGS;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - reg=%d\n", DBGARG, gpioreg_id));
+
-+Command Values
-+ None defined
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, size);
++ register_get = (WMIX_GPIO_REGISTER_GET_CMD *)(A_NETBUF_DATA(osbuf));
+
-+Reset Value
-+ None
++ register_get->gpioreg_id = gpioreg_id;
+
-+Restrictions
-+ None
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_REGISTER_GET_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++/* Send a command to the Target acknowledging some GPIO interrupts. */
++A_STATUS
++wmi_gpio_intr_ack(struct wmi_t *wmip,
++ A_UINT32 ack_mask)
++{
++ void *osbuf;
++ WMIX_GPIO_INTR_ACK_CMD *intr_ack;
++ int size;
+
++ size = sizeof(*intr_ack);
+
-+Name
-+ SET_BT_STATUS
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter ack_mask=0x%x\n", DBGARG, ack_mask));
+
-+Synopsis
-+ Sets the status of a Bluetooth stream. The stream may be a SCO or an A2DP stream
-+ and its status can be started/stopped/suspended/resumed.
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, size);
++ intr_ack = (WMIX_GPIO_INTR_ACK_CMD *)(A_NETBUF_DATA(osbuf));
+
-+Command
-+ wmiconfig \96setBTstatus <streamType> <status>
++ intr_ack->ack_mask = ack_mask;
+
-+Command Parameters
-+ {
-+ A_UINT8 streamType; Stream type
-+ A_UINT8 status; Stream status
-+ }WMI_SET_BT_STATUS_CMD;
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_GPIO_INTR_ACK_CMDID,
++ NO_SYNC_WMIFLAG));
++}
++#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
-+Command Values
-+ {
-+ BT_STREAM_UNDEF = 0
-+ BT_STREAM_SCO
-+ SCO stream
-+ BT_STREAM_A2DP
-+ A2DP stream
-+ BT_STREAM_MAX
-+ } BT_STREAM_TYPE;
++A_STATUS
++wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT16 txop, A_UINT8 eCWmin,
++ A_UINT8 eCWmax, A_UINT8 aifsn)
++{
++ void *osbuf;
++ WMI_SET_ACCESS_PARAMS_CMD *cmd;
+
++ if ((eCWmin > WMI_MAX_CW_ACPARAM) || (eCWmax > WMI_MAX_CW_ACPARAM) ||
++ (aifsn > WMI_MAX_AIFSN_ACPARAM))
+ {
-+ BT_STATUS_UNDEF = 0
-+ BT_STATUS_START
-+ BT_STATUS_STOP
-+ BT_STATUS_RESUME
-+ BT_STATUS_SUSPEND
-+ BT_STATUS_MAX
-+ } BT_STREAM_STATUS;
-+
-+Reset Value
-+ None defined
-+
-+Restrictions
-+ None
-+
-+=====================================================================
++ return A_EINVAL;
++ }
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_CHANNEL_PARAMETERS
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ Configures various WLAN parameters related to channels, sets the wireless mode,
-+ and can restrict the AR6000 device to a subset of available channels. The list of
-+ available channels varies depending on the wireless mode and the regulatory
-+ domain. The device never operates on a channel outside of its regulatory domain. The
-+ device starts to scan the list of channels right after this command.
++ cmd = (WMI_SET_ACCESS_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->txop = txop;
++ cmd->eCWmin = eCWmin;
++ cmd->eCWmax = eCWmax;
++ cmd->aifsn = aifsn;
+
-+Command
-+ wmiconfig eth1 --wmode <mode> <list>
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_ACCESS_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ UINT8 phyMode See Values below.
-+ UINT8 numberOfChannels
-+ Number of channels in the channel array that
-+ follows. If = 0, then the device uses all of the
-+ channels permitted by the regulatory domain
-+ and by the specified phyMode.
-+ UINT16 channel[numberOfChannels]
-+ Array listing the subset of channels (expressed
-+ as frequencies in MHz) the host wants the
-+ device to use. Any channel not permitted by
-+ the specified phyMode or by the specified
-+ regulatory domain is ignored by the device.
++A_STATUS
++wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
++ A_UINT8 trafficClass, A_UINT8 maxRetries,
++ A_UINT8 enableNotify)
++{
++ void *osbuf;
++ WMI_SET_RETRY_LIMITS_CMD *cmd;
+
-+Command Values
-+ phyMode = {
-+ Wireless mode
-+ 11a = 0x01
-+ 11g = 0x02
-+ 11ag = 0x03
-+ 11b = 0x04
-+ 11g only = 0x05
-+ }
++ if ((frameType != MGMT_FRAMETYPE) && (frameType != CONTROL_FRAMETYPE) &&
++ (frameType != DATA_FRAMETYPE))
++ {
++ return A_EINVAL;
++ }
+
-+Reset Values
-+ phyMode
-+ 11ag
-+ 802.11a/g modules
-+ 11g
-+ 802.11g module
-+ channels
-+ Defaults to all channels permitted by the
-+ current regulatory domain.
++ if (maxRetries > WMI_MAX_RETRIES) {
++ return A_EINVAL;
++ }
+
-+Restrictions
-+ This command, if issued, should be issued soon after reset and prior to the first
-+ connection. This command should only be issued in the DISCONNECTED state.
++ if (frameType != DATA_FRAMETYPE) {
++ trafficClass = 0;
++ }
+
-+=====================================================================
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Name
-+ SET_DISC_TIMEOUT
++ cmd = (WMI_SET_RETRY_LIMITS_CMD *)(A_NETBUF_DATA(osbuf));
++ cmd->frameType = frameType;
++ cmd->trafficClass = trafficClass;
++ cmd->maxRetries = maxRetries;
++ cmd->enableNotify = enableNotify;
+
-+Synopsis
-+ The host uses this command to configure the amount of time that the AR6000 should
-+ spend when it attempts to reestablish a connection after losing link with its current
-+ BSS. If this time limit is exceeded, the AR6000 send a \93DISCONNECT\94 event. After
-+ sending the \93DISCONNECT\94 event the AR6000 continues to attempt to reestablish a
-+ connection, but they do so at the interval corresponding to a foreground scan as
-+ established by the \93SET_SCAN_PARAMS\94 command.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_RETRY_LIMITS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ A timeout value of 0 indicates that the AR6000 will disable all autonomous roaming,
-+ so that the AR6000 will not perform any scans after sending a \93DISCONNECT\94
-+ event to the host. The state is maintained until a shutdown or host sets different
-+ timeout value from 0.
++void
++wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid)
++{
++ if (bssid != NULL) {
++ A_MEMCPY(bssid, wmip->wmi_bssid, ATH_MAC_LEN);
++ }
++}
+
-+Command
-+ wmiconfig eth1 --disc=<timeout in seconds>
++A_STATUS
++wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode)
++{
++ void *osbuf;
++ WMI_SET_OPT_MODE_CMD *cmd;
+
-+Command Parameters
-+ UINT8 disconnectTimeout
-+ Specifies the time limit (in seconds) after
-+ which a failure to reestablish a connection
-+ results in a \93DISCONNECT\94 event
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ None
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Reset Values
-+ disconnectTimeout is 10 seconds
++ cmd = (WMI_SET_OPT_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->optMode = optMode;
+
-+Restrictions
-+ This command can only be issued while in a DISCONNECTED state
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_OPT_MODE_CMDID,
++ SYNC_BOTH_WMIFLAG));
++}
+
-+=====================================================================
++A_STATUS
++wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
++ A_UINT8 frmType,
++ A_UINT8 *dstMacAddr,
++ A_UINT8 *bssid,
++ A_UINT16 optIEDataLen,
++ A_UINT8 *optIEData)
++{
++ void *osbuf;
++ WMI_OPT_TX_FRAME_CMD *cmd;
++ osbuf = A_NETBUF_ALLOC(optIEDataLen + sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ A_NETBUF_PUT(osbuf, (optIEDataLen + sizeof(*cmd)));
+
-+Name
-+ SET_FIXRATES
++ cmd = (WMI_OPT_TX_FRAME_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, (optIEDataLen + sizeof(*cmd)-1));
+
-+Synopsis
-+ By default, the AR6000 device uses all PHY rates based on mode of operation. If the
-+ host application requires the device to use subset of supported rates, it can set those
-+ rates with this command. In 802.11g mode, the AR6000 device takes the entire
-+ 802.11g basic rate set and the rates specified with this command and uses it as the
-+ supported rate set.
++ cmd->frmType = frmType;
++ cmd->optIEDataLen = optIEDataLen;
++ //cmd->optIEData = (A_UINT8 *)((int)cmd + sizeof(*cmd));
++ A_MEMCPY(cmd->bssid, bssid, sizeof(cmd->bssid));
++ A_MEMCPY(cmd->dstAddr, dstMacAddr, sizeof(cmd->dstAddr));
++ A_MEMCPY(&cmd->optIEData[0], optIEData, optIEDataLen);
+
-+ This rate set is advertised in the probe request and the assoc/re-assoc request as
-+ supported rates. Upon successful association, the device modifies the rate set pool
-+ using the: intersection of AP-supported rates with the union of the 802.11g basic rate
-+ set and rates set using this command. The device picks transmission rates from this
-+ pool based on a rate control algorithm.
++ return (wmi_cmd_send(wmip, osbuf, WMI_OPT_TX_FRAME_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ TBD
++A_STATUS
++wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl)
++{
++ void *osbuf;
++ WMI_BEACON_INT_CMD *cmd;
+
-+Command Parameters
-+ A_UINT16 fixRateMask;
-+ The individual bit is an index for rate table,
-+ and setting the that index to 1 would set that
-+ corresponding rate. E.g., fixRateMask = 9
-+ (1001) sets 1 Mbps and 11 Mbps.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ None
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Reset Value
-+ None defined
++ cmd = (WMI_BEACON_INT_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->beaconInterval = intvl;
+
-+Restrictions
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BEACON_INT_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+See Also
-+ \93GET_FIXRATES\94
+
-+=====================================================================
++A_STATUS
++wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize)
++{
++ void *osbuf;
++ WMI_SET_VOICE_PKT_SIZE_CMD *cmd;
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_WHAL_PARAM
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ An internal AR6000 command that is used to set certain hardware parameters. The
-+ description of this command is in $WORKAREA/include/halapi.h.
++ cmd = (WMI_SET_VOICE_PKT_SIZE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->voicePktSize = voicePktSize;
+
-+Command
-+ TBD
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_VOICE_PKT_SIZE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Parameters
-+ ATH_HAL_SETCABTO_CMDID
-+ Sets the timeout waiting for the multicast
-+ traffic after a DTIM beacon (in TUs).
+
-+Command Values
-+ None
++A_STATUS
++wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSPLen)
++{
++ void *osbuf;
++ WMI_SET_MAX_SP_LEN_CMD *cmd;
+
-+Reset Value
-+ Default = 10 TUs
++ /* maxSPLen is a two-bit value. If user trys to set anything
++ * other than this, then its invalid
++ */
++ if(maxSPLen & ~0x03)
++ return A_EINVAL;
+
-+Restrictions
-+ This command should be executed before issuing a connect command.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+=====================================================================
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
++ cmd = (WMI_SET_MAX_SP_LEN_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->maxSPLen = maxSPLen;
+
-+Name
-+ SET_HOST_SLEEP_MODE
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_MAX_SP_LEN_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Synopsis
-+ The host uses this command to set the host mode to asleep or awake. All packets are
-+ delivered to the host when the host mode is awake. When host mode is asleep, only if
-+ WoW is enabled and the incoming packet matches one of the specified WoW
-+ patterns, will the packet be delivered to the host. The host will also be woken up by
-+ the target for pattern-matching packets and important events.
++A_UINT8
++convert_userPriority_to_trafficClass(A_UINT8 userPriority)
++{
++ return (up_to_ac[userPriority & 0x7]);
++}
+
-+Command
-+ wmiconfig
\96sethostmode=<asleep/awake>
++A_UINT8
++wmi_get_power_mode_cmd(struct wmi_t *wmip)
++{
++ return wmip->wmi_powerMode;
++}
+
-+Command Parameters
-+ A_BOOL awake Set the host mode to awake
-+ A_BOOL asleep Set the host mode to asleep
++A_STATUS
++wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance)
++{
++ return A_OK;
++}
+
-+Command Values
-+ 1 = awake, 0 = asleep
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++static A_STATUS
++wmi_tcmd_test_report_rx(struct wmi_t *wmip, A_UINT8 *datap, int len)
++{
+
-+Reset Value
-+ None defined (default host mode is awake)
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+Restrictions
-+ None
++ A_WMI_TCMD_RX_REPORT_EVENT(wmip->wmi_devt, datap, len);
+
++ return A_OK;
++}
+
-+=====================================================================
++#endif /* CONFIG_HOST_TCMD_SUPPORT*/
+
-+Name
-+ SET_IBSS_PM_CAPS
++A_STATUS
++wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
++{
++ void *osbuf;
++ WMI_SET_AUTH_MODE_CMD *cmd;
+
-+Synopsis
-+ Used to support a non-standard power management scheme for an ad hoc wireless
-+ network consisting of up to eight stations (STAs) that support this form of power
-+ saving (e.g., Atheros-based STAs). A thorough understanding of IEEE 802.11 ad hoc
-+ networks is required to use this command effectively.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command
-+ wmiconfig eth1 --ibsspmcaps --ps=<enable/disable>
-+ --aw=<ATIM Windows in ms>
-+ --ttl=<Time to live in number of beacon periods>
-+ --to=<timeout in ms>
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command Parameters
-+ UINT8 power_saving
-+ = 0
-+ The non-standard power saving scheme is
-+ disabled and maximum throughput (with no
-+ power saving) is obtained.
++ cmd = (WMI_SET_AUTH_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->mode = mode;
+
-+ = 1
-+ Ad hoc power saving scheme is enabled (but
-+ throughput may be decreased)
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_AUTH_MODE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ UINT16 atim_windows
-+ Specifies the length (in ms) of the ad hoc traffic
-+ indication message (ATIM) windows used in an ad
-+ hoc network. All Atheros-based STAs that join the
-+ network use this duration ATIM window.
++A_STATUS
++wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode)
++{
++ void *osbuf;
++ WMI_SET_REASSOC_MODE_CMD *cmd;
+
-+ The duration is communicated between wireless
-+ STAs through an IE in beacons and probe responses.
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+ The host sets atim_windows to control trade-offs
-+ between power use and throughput. The value
-+ chosen should be based on the beacon interval (see
-+ the \93SET_BEACON_INT\94 command) on the
-+ expected number of STAs in the IBSS, and on the
-+ amount of traffic and traffic patterns between STAs.
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ UINT16 timeout_value
-+ Specifies the timeout (in ms). The value is the same
-+ for all ad hoc connections, but tracks separately for
-+ each.
++ cmd = (WMI_SET_REASSOC_MODE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->mode = mode;
+
-+ Applicable only for a beacon period and used to
-+ derive actual timeout values on the Tx and Rx sides.
-+ On the Tx side, the value defines a window during
-+ which the STA accepts the frame(s) from the host for a
-+ particular connection. Until closed, the window
-+ restarts with every frame received from the host. On
-+ the Rx side, indicates the time until which the STA
-+ continues accepting frames from a particular
-+ connection. The value resets with every frame
-+ received. The value can be used to determine the
-+ trade off between throughput and power.
-+ Default = 10 ms
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_REASSOC_MODE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+ UINT8 ttl
-+ Specifies the value in number of beacon periods. The
-+ value is used to set a limit on the time until which a
-+ frame is kept alive in the AR6001 before being
-+ discarded. Default = 5
++A_STATUS
++wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status)
++{
++ void *osbuf;
++ WMI_SET_LPREAMBLE_CMD *cmd;
+
-+Command Values
-+ None
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Values
-+ By default, power_saving is enabled with atim_window = 20 ms
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Restrictions
-+ Can only be issued before the AR6000 starts an ad hoc network
++ cmd = (WMI_SET_LPREAMBLE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->status = status;
+
-+See Also
-+ \93SET_BEACON_INT\94
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_LPREAMBLE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+=====================================================================
++A_STATUS
++wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold)
++{
++ void *osbuf;
++ WMI_SET_RTS_CMD *cmd;
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Name
-+ SET_LISTEN_INT
++ cmd = (WMI_SET_RTS_CMD*)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->threshold = threshold;
+
-+Synopsis
-+ The host uses this command to request a listen interval, which determines how often
-+ the AR6000 device should wake up and listen for traffic. The listen interval can be set
-+ by the TUs or by the number of beacons. The device may not be able to comply with
-+ the request (e.g., if the beacon interval is greater than the requested listen interval, the
-+ device sets the listen interval to the beacon interval). The actual listen interval used
-+ by the device is available in the \93CONNECT\94 event.
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_RTS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ wmiconfig eth1 --listen=<#of TUs, can range from 15 to 3000>
++A_STATUS
++wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status)
++{
++ void *osbuf;
++ WMI_SET_WMM_CMD *cmd;
+
-+ --listenbeacons=<#of beacons, can range from 1 to 50>
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ UINT16 listenInterval
-+ Specifies the listen interval in Kms
-+ (1024 ms), ranging from 100 to 1000
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+ UINT16 listenbeacons
-+ Specifies the listen interval in beacons,
-+ ranging from 1 to 50
++ cmd = (WMI_SET_WMM_CMD*)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->status = status;
+
-+Command Values
-+ None
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+Reset Values
-+ The device sets the listen interval equal to the beacon interval of the AP it associates
-+ to.
++}
+
-+Restrictions
-+ None
++A_STATUS
++wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG cfg)
++{
++ void *osbuf;
++ WMI_SET_WMM_TXOP_CMD *cmd;
+
-+=====================================================================
++ if( !((cfg == WMI_TXOP_DISABLED) || (cfg == WMI_TXOP_ENABLED)) )
++ return A_EINVAL;
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_LPREAMBLE
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Synopsis
-+ Overrides the short preamble capability of the AR6000 device
++ cmd = (WMI_SET_WMM_TXOP_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->txopEnable = cfg;
+
-+Command
-+ TBD
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WMM_TXOP_CMDID,
++ NO_SYNC_WMIFLAG));
+
-+Command Parameters
-+ WMI_LPREAMBLE_DISABLED
-+ The device is short-preamble capable
++}
+
-+ WMI_LPREAMBLE_ENABLED
-+ The device supports only the long-
-+ preamble mode
++#ifdef CONFIG_HOST_TCMD_SUPPORT
++/* WMI layer doesn't need to know the data type of the test cmd.
++ This would be beneficial for customers like Qualcomm, who might
++ have different test command requirements from differnt manufacturers
++ */
++A_STATUS
++wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32 len)
++{
++ void *osbuf;
++ char *data;
+
-+Command Values
-+ None
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter\n", DBGARG));
+
-+Reset Value
-+ None defined
++ osbuf= A_NETBUF_ALLOC(len);
++ if(osbuf == NULL)
++ {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, len);
++ data = A_NETBUF_DATA(osbuf);
++ A_MEMCPY(data, buf, len);
+
-+Restrictions
-+ None
++ return(wmi_cmd_send(wmip, osbuf, WMI_TEST_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++#endif
+
-+=====================================================================
++A_STATUS
++wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status)
++{
++ void *osbuf;
++ WMI_SET_BT_STATUS_CMD *cmd;
+
-+Name
-+ SET_MAX_SP_LEN
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Synopsis
-+ Set the maximum service period; indicates the number of packets the AR6001 can
-+ receive from the AP when triggered
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command
-+ wmiconfig eth1 --setMaxSPLength <maxSPLen>
++ cmd = (WMI_SET_BT_STATUS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->streamType = streamType;
++ cmd->status = status;
+
-+Command Parameters
-+ UINT8 maxSPLen
-+ An APSD_SP_LEN_TYPE value
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_STATUS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command Values
-+ {
-+ DELIVER_ALL_PKT = 0x0
-+ DELIVER_2_PKT = 0x1
-+ DELIVER_4_PKT = 0x2
-+ DELIVER_6_PKT = 0x3
-+ }APSD_SP_LEN_TYPE
++A_STATUS
++wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd)
++{
++ void *osbuf;
++ WMI_SET_BT_PARAMS_CMD* alloc_cmd;
+
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Values
-+ maxSPLen is DELIVER_ALL_PKT
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Restrictions
-+ None
++ alloc_cmd = (WMI_SET_BT_PARAMS_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(alloc_cmd, sizeof(*cmd));
++ A_MEMCPY(alloc_cmd, cmd, sizeof(*cmd));
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_BT_PARAMS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++A_STATUS
++wmi_get_keepalive_configured(struct wmi_t *wmip)
++{
++ void *osbuf;
++ WMI_GET_KEEPALIVE_CMD *cmd;
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
++ cmd = (WMI_GET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ return (wmi_cmd_send(wmip, osbuf, WMI_GET_KEEPALIVE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Name
-+ SET_OPT_MODE
++A_UINT8
++wmi_get_keepalive_cmd(struct wmi_t *wmip)
++{
++ return wmip->wmi_keepaliveInterval;
++}
+
-+Synopsis
-+ Special feature, sets the special mode on/off
++A_STATUS
++wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval)
++{
++ void *osbuf;
++ WMI_SET_KEEPALIVE_CMD *cmd;
+
-+Command
-+ wmiconfig eth1 --mode <mode>
-+ Set the optional mode, where mode is special or off
++ osbuf = A_NETBUF_ALLOC(sizeof(*cmd));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Parameters
-+ enum {
-+ SPECIAL_OFF
-+ SPECIAL_ON
-+ } OPT_MODE_TYPE;
++ A_NETBUF_PUT(osbuf, sizeof(*cmd));
+
-+Command Values
++ cmd = (WMI_SET_KEEPALIVE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd->keepaliveInterval = keepaliveInterval;
++ wmip->wmi_keepaliveInterval = keepaliveInterval;
+
-+Reset Value
-+ Mode = Off
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_KEEPALIVE_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Restrictions
-+ None
-+
-+=====================================================================
++A_STATUS
++wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType, A_UINT8 ieLen,
++ A_UINT8 *ieInfo)
++{
++ void *osbuf;
++ WMI_SET_APPIE_CMD *cmd;
++ A_UINT16 cmdLen;
+
++ if (ieLen > WMI_MAX_IE_LEN) {
++ return A_ERROR;
++ }
++ cmdLen = sizeof(*cmd) + ieLen - 1;
++ osbuf = A_NETBUF_ALLOC(cmdLen);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Name
-+ SET_PMKID
++ A_NETBUF_PUT(osbuf, cmdLen);
+
-+Synopsis
-+ The host uses this command to enable or disable a pairwise master key ID (PMKID)
-+ in the AR6000 PMKID cache. The AR6000 clears its PMKID cache on receipt of a
-+ DISCONNECT command from the host. Individual entries in the cache might be
-+ deleted as the AR6000 detect new APs and decides to remove old ones.
++ cmd = (WMI_SET_APPIE_CMD *)(A_NETBUF_DATA(osbuf));
++ A_MEMZERO(cmd, cmdLen);
+
-+Command
-+ wmiconfig eth1 --setbsspmkid --bssid=<aabbccddeeff>
-+ --bsspmkid=<pmkid>
++ cmd->mgmtFrmType = mgmtFrmType;
++ cmd->ieLen = ieLen;
++ A_MEMCPY(cmd->ieInfo, ieInfo, ieLen);
+
-+Command Parameters
-+ UINT8 bssid[6]
-+ The MAC address of the AP that the
-+ PMKID corresponds to (6 bytes in hex
-+ format)
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_APPIE_CMDID, NO_SYNC_WMIFLAG));
++}
+
-+ UINT8 enable
-+ Either PMKID_DISABLE (0) to disable
-+ the PMKID or PMKID_ENABLE (1) to
-+ enable it (16 bytes in hex format)
++A_STATUS
++wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen)
++{
++ void *osbuf;
++ A_UINT8 *data;
+
-+ UINT8 pmkid[16]
-+ Meaningful only if enable is
-+ PMKID_ENABLE, when it is the PMKID
-+ that the AR6000 should use on the next
-+ reassociation with the specified AP
++ osbuf = A_NETBUF_ALLOC(dataLen);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Command Values
-+ enable
-+ = 0 (disable), 1 (enable)
-+ PKMID enabled/disabled
++ A_NETBUF_PUT(osbuf, dataLen);
+
-+Reset Values
-+ None defined
++ data = A_NETBUF_DATA(osbuf);
+
-+Restrictions
-+ Only supported in infrastructure networks
++ A_MEMCPY(data, cmd, dataLen);
+
-+=====================================================================
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WHALPARAM_CMDID, NO_SYNC_WMIFLAG));
++}
+
++A_INT32
++wmi_get_rate(A_INT8 rateindex)
++{
++ if (rateindex == RATE_AUTO) {
++ return 0;
++ } else {
++ return(wmi_rateTable[(A_UINT32) rateindex]);
++ }
++}
+
-+Name
-+ SET_PMKID_LIST_CMD
++void
++wmi_node_return (struct wmi_t *wmip, bss_t *bss)
++{
++ if (NULL != bss)
++ {
++ wlan_node_return (&wmip->wmi_scan_table, bss);
++ }
++}
+
-+Synopsis
-+ Configures the list of PMKIDs on the firmware.
++bss_t *
++wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
++ A_UINT32 ssidLength, A_BOOL bIsWPA2)
++{
++ bss_t *node = NULL;
++ node = wlan_find_Ssidnode (&wmip->wmi_scan_table, pSsid,
++ ssidLength, bIsWPA2);
++ return node;
++}
+
-+Command
-+ wmiconfig --setpmkidlist --numpmkid=<n> --pmkid=<pmkid_1>
-+ ... --pmkid=<pmkid_n>
++void
++wmi_free_allnodes(struct wmi_t *wmip)
++{
++ wlan_free_allnodes(&wmip->wmi_scan_table);
++}
+
-+ Where n is the number of pmkids (maximum = 8) and pmkid_i is the ith pmkid (16
-+ bytes in hex format)
++bss_t *
++wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr)
++{
++ bss_t *ni=NULL;
++ ni=wlan_find_node(&wmip->wmi_scan_table,macaddr);
++ return ni;
++}
+
-+Command Parameters
-+ {
-+ A_UINT8 pmkid[WMI_PMKID_LEN];
-+ } __ATTRIB_PACK WMI_PMKID;
++A_STATUS
++wmi_dset_open_reply(struct wmi_t *wmip,
++ A_UINT32 status,
++ A_UINT32 access_cookie,
++ A_UINT32 dset_size,
++ A_UINT32 dset_version,
++ A_UINT32 targ_handle,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg)
++{
++ void *osbuf;
++ WMIX_DSETOPEN_REPLY_CMD *open_reply;
+
-+ {
-+ A_UINT32 numPMKID;
-+ WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
-+ } __ATTRIB_PACK WMI_SET_PMKID_LIST_CMD;
++ A_DPRINTF(DBG_WMI, (DBGFMT "Enter - wmip=0x%x\n", DBGARG, (int)wmip));
+
-+Command Values
-+ None
++ osbuf = A_NETBUF_ALLOC(sizeof(*open_reply));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
-+Reset Values
-+ None
++ A_NETBUF_PUT(osbuf, sizeof(*open_reply));
++ open_reply = (WMIX_DSETOPEN_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
+
-+Restrictions
-+ Supported only in infrastructure modes
++ open_reply->status = status;
++ open_reply->targ_dset_handle = targ_handle;
++ open_reply->targ_reply_fn = targ_reply_fn;
++ open_reply->targ_reply_arg = targ_reply_arg;
++ open_reply->access_cookie = access_cookie;
++ open_reply->size = dset_size;
++ open_reply->version = dset_version;
+
-+=====================================================================
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETOPEN_REPLY_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
++static A_STATUS
++wmi_get_pmkid_list_event_rx(struct wmi_t *wmip, A_UINT8 *datap, A_UINT32 len)
++{
++ WMI_PMKID_LIST_REPLY *reply;
++ A_UINT32 expected_len;
+
-+Name
-+ SET_POWER_MODE
++ if (len < sizeof(WMI_PMKID_LIST_REPLY)) {
++ return A_EINVAL;
++ }
++ reply = (WMI_PMKID_LIST_REPLY *)datap;
++ expected_len = sizeof(reply->numPMKID) + reply->numPMKID * WMI_PMKID_LEN;
+
-+Synopsis
-+ The host uses this command to provide the AR6000 device with guidelines on the
-+ desired trade-off between power utilization and performance.
++ if (len < expected_len) {
++ return A_EINVAL;
++ }
+
-+ In normal power mode, the device enters a sleep state if they have nothing to do,
-+ which conserves power but may cost performance as it can take up to 2 ms to
-+ resume operation after leaving sleep state.
++ A_WMI_PMKID_LIST_EVENT(wmip->wmi_devt, reply->numPMKID,
++ reply->pmkidList);
+
-+ In maximum performance mode, the device never enters sleep state, thus no time
-+ is spent waking up, resulting in higher power consumption and better
-+ performance.
++ return A_OK;
++}
+
-+Command
-+ TBD
++#ifdef CONFIG_HOST_DSET_SUPPORT
++A_STATUS
++wmi_dset_data_reply(struct wmi_t *wmip,
++ A_UINT32 status,
++ A_UINT8 *user_buf,
++ A_UINT32 length,
++ A_UINT32 targ_buf,
++ A_UINT32 targ_reply_fn,
++ A_UINT32 targ_reply_arg)
++{
++ void *osbuf;
++ WMIX_DSETDATA_REPLY_CMD *data_reply;
++ int size;
+
-+Command Parameters
-+ UINT8 powerMode
-+ WMI_POWER_MODE value
-+ {
-+ REC_POWER = 1
-+ (Recommended setting) Tries to conserve
-+ power without sacrificing performance
-+ MAX_PERF_POWER = 2
-+ Setting that maximizes performance at
-+ the expense of power
++ size = sizeof(*data_reply) + length;
+
-+ All other values are reserved
-+ } WMI_POWER_MODE
++ A_DPRINTF(DBG_WMI,
++ (DBGFMT "Enter - length=%d status=%d\n", DBGARG, length, status));
+
-+Command Values
-+ See command parameters
++ osbuf = A_NETBUF_ALLOC(size);
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
++ A_NETBUF_PUT(osbuf, size);
++ data_reply = (WMIX_DSETDATA_REPLY_CMD *)(A_NETBUF_DATA(osbuf));
+
-+Reset Values
-+ powerMode is REC_POWER
++ data_reply->status = status;
++ data_reply->targ_buf = targ_buf;
++ data_reply->targ_reply_fn = targ_reply_fn;
++ data_reply->targ_reply_arg = targ_reply_arg;
++ data_reply->length = length;
+
-+Restrictions
-+ This command should only be issued in the DISCONNECTED state for the
-+ infrastructure network.
++ if (status == A_OK) {
++ if (a_copy_from_user(data_reply->buf, user_buf, length)) {
++ return A_ERROR;
++ }
++ }
+
-+ For a PM-disabled ad hoc network, the power mode should remain in
-+ MAX_PERF_POWER.
++ return (wmi_cmd_send_xtnd(wmip, osbuf, WMIX_DSETDATA_REPLY_CMDID,
++ NO_SYNC_WMIFLAG));
++}
++#endif /* CONFIG_HOST_DSET_SUPPORT */
+
-+ For a PM-enabled ad hoc network, the device can have REC_POWER or
-+ MAX_PERF_POWER set, but either way it must follow the power save ad hoc
-+ protocol. The host can change power modes in the CONNECTED state.
++A_STATUS
++wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status)
++{
++ void *osbuf;
++ char *cmd;
+
-+ Host changes to the PS setting when the STA is off the home channel take no effect
-+ and cause a TARGET_PM_FAIL event.
++ wps_enable = status;
+
-+=====================================================================
++ osbuf = a_netbuf_alloc(sizeof(1));
++ if (osbuf == NULL) {
++ return A_NO_MEMORY;
++ }
+
++ a_netbuf_put(osbuf, sizeof(1));
+
-+Name
-+ SET_POWER_PARAMS
++ cmd = (char *)(a_netbuf_to_data(osbuf));
+
-+Synopsis
-+ The host uses this command to configure power parameters
++ A_MEMZERO(cmd, sizeof(*cmd));
++ cmd[0] = (status?1:0);
++ return (wmi_cmd_send(wmip, osbuf, WMI_SET_WSC_STATUS_CMDID,
++ NO_SYNC_WMIFLAG));
++}
+
-+Command
-+ wmiconfig eth1 --pmparams --it=<ms> --np=<number of PS POLL>
-+ --dp=<DTIM policy: ignore/normal/stick>
+diff --git a/drivers/ar6000/wmi/wmi_doc.h b/drivers/ar6000/wmi/wmi_doc.h
+new file mode 100644
+index 0000000..19cd938
+--- /dev/null
++++ b/drivers/ar6000/wmi/wmi_doc.h
+@@ -0,0 +1,4421 @@
++/*
++ *
++ * Copyright (c) 2004-2007 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
+
-+Command Parameters
-+ UINT16 idle_period
-+ Length of time (in ms) the AR6000 device
-+ remains awake after frame Rx/Tx before going
-+ to SLEEP state
+
-+ UINT16 pspoll_number
-+ The number of PowerSavePoll (PS-poll)
-+ messages the device should send before
-+ notifying the AP it is awake
++#if 0
++Wireless Module Interface (WMI) Documentaion
+
-+ UINT16 dtim_policy
-+ A WMI_POWER_PARAMS_CMD value
++ This section describes the format and the usage model for WMI control and
++ data messages between the host and the AR6000-based targets. The header
++ file include/wmi.h contains all command and event manifest constants as
++ well as structure typedefs for each set of command and reply parameters.
+
-+ {
-+ IGNORE_DTIM =1
-+ The device does not listen to any content after
-+ beacon (CAB) traffic
-+ NORMAL_DTIM = 2
-+ DTIM period follows the listen interval (e.g., if
-+ the listen interval is 4 and the DTIM period is 2,
-+ the device wakes up every fourth beacon)
-+ STICK_DTIM = 3
-+ Device attempt to receive all CAB traffic (e.g., if
-+ the DTIM period is 2 and the listen interval is 4,
-+ the device wakes up every second beacon)
-+ } WMI_POWER_PARAMS_CMD
++Data Frames
+
-+Command Parameters
-+ See command parameters
++ The data payload transmitted and received by the target follows RFC-1042
++ encapsulation and thus starts with an 802.2-style LLC-SNAP header. The
++ WLAN module completes 802.11 encapsulation of the payload, including the
++ MAC header, FCS, and WLAN security related fields. At the interface to the
++ message transport (HTC), a data frame is encapsulated in a WMI message.
+
-+Reset Values
-+ idle_period
-+ 200 ms
++WMI Message Structure
+
-+ pspoll_number
-+ = 1
++ The WMI protocol leverages an 802.3-style Ethernet header in communicating
++ the source and destination information between the host and the AR6000
++ modules using a 14-byte 802.3 header ahead of the 802.2-style payload. In
++ addition, the WMI protocol adds a header to all data messages:
+
-+ dtim_policy
-+ = NORMAL_DTIM
++ {
++ INT8 rssi
++ The RSSI of the received packet and its units are shown in db above the
++ noise floor, and the noise floor is shown in dbm.
++ UINT8 info
++ Contains information on message type and user priority. Message type
++ differentiates between a data packet and a synchronization message.
++ } WMI_DATA_HDR
+
-+Restrictions
-+ None
++ User priority contains the 802.1d user priority info from host to target. Host
++ software translates the host Ethernet format to 802.3 format prior to Tx and
++ 802.3 format to host format in the Rx direction. The host does not transmit the
++ FCS that follows the data. MsgType differentiates between a regular data
++ packet (msgType=0) and a synchronization message (msgType=1).
+
-+=====================================================================
++Data Endpoints
+
++ The AR6000 chipset provides several data endpoints to support quality of
++ service (QoS) and maintains separate queues and separate DMA engines for
++ each data endpoint. A data endpoint can be bi-directional.
+
-+Name
-+ SET_POWERSAVE_PARAMS
++ Best effort (BE) class traffic uses the default data endpoint (2). The host can
++ establish up to two additional data endpoints for other traffic classes. Once
++ such a data endpoint is established, it sends and receives corresponding QoS
++ traffic in a manner similar to the default data endpoint.
+
-+Synopsis
-+ Set the two AR6000 power save timers (PS-POLL timer and APSD trigger timer) and
-+ the two ASPD TIM policies
++ If QoS is desired over the interconnect, host software must classify each data
++ packet and place it on the appropriate data endpoint. The information
++ required to classify data is generally available in-band as an 802.1p/q style
++ tag or as the ToS field in the IP header. The information may also be available
++ out-of-band depending on the host DDI.
+
-+Command
-+ wmiconfig eth1--psparams --psPollTimer=<psPollTimeout in ms>
-+ --triggerTimer=<triggerTimeout in ms> --apsdTimPolicy=<ignore/
-+ adhere> --simulatedAPSDTimPolicy=<ignore/adhere>
++Connection States
+
-+Command Parameters
-+ typedef struct {
-+ A_UINT16 psPollTimeout;
-+ Timeout (in ms) after sending PS-POLL; the
-+ AR6000 device sleeps if it does not receive a
-+ data packet from the AP
++ Table B-1 describes the AR6000 WLAN connection states:
+
-+ A_UINT16 triggerTimeout;
-+ Timeout (in ms) after sending a trigger; the
-+ device sleeps if it does not receive any data
-+ or null frame from the AP
++ Table B-1. AR6000 Connection States
+
-+ APSD_TIM_POLICY apsdTimPolicy;
-+ TIM behavior with queue APSD enabled
++Connection State
++ Description
+
-+ APSD_TIM_POLICY simulatedAPSD
++ DISCONNECTED
++ In this state, the AR6000 device is not connected to a wireless
++ network. The device is in this state after reset when it sends the
++ WIRELESS MODULE \93READY\94 EVENT, after it processes a
++ DISCONNECT command, and when it loses its link with the
++ access point (AP) that it was connected to. The device signals a
++ transition to the DISCONNECTED state with a \93DISCONNECT\94
++ event.
+
-+ TimPolicy;
-+ TIM behavior with simulated APSD
-+ enabled
++CONNECTED
++ In this state, the AR6000 device is connected to wireless networks.
++ The device enters this state after successfully processing a
++ CONNECT, which establishes a connection with a wireless
++ network. The device signals a transition to the CONNECTED state
++ with a \93CONNECT\94 event.
+
-+ typedef enum {
-+ IGNORE_TIM_ALL_QUEUES_APSD = 0,
-+ PROCESS_TIM_ALL_QUEUES_APSD = 1,
-+ IGNORE_TIM_SIMULATED_APSD = 2,
-+ POWERSAVE_TIMERS_POLICY = 3,
-+ } APSD_TIM_POLICY;
+
-+Command Values
-+ None
++Message Types
+
-+Reset Values
-+ psPollTimeout is 50 ms; triggerTimeout is 10 ms;
-+ apsdTimPolicy = IGNORE_TIM_ALL_QUEUES_APSD;
-+ simulatedAPSDTimPolicy = POWERSAVE_TIMERS_POLICY
++ WMI uses commands, replies, and events for the control and configuration of
++ the AR6000 device. The control protocol is asynchronous. Table B-2 describes
++ AR6000 message types:
+
-+Restrictions
-+ When this command is used, all parameters must be set; this command does not
-+ allow setting only one parameter.
++Table B-2. AR6000 Message Types
+
-+=====================================================================
++Message Type
++ Description
+
++Commands
++ Control messages that flow from the host to the device
+
-+Name
-+ SET_PROBED_SSID
++Replies/Events
++ Control messages that flow from the device to the host.
+
-+Synopsis
-+ The host uses this command to provide a list of up to MAX_PROBED_SSID_INDEX
-+ (six) SSIDs that the AR6000 device should actively look for. It lists the active SSID
-+ table. By default, the device actively looks for only the SSID specified in the
-+ \93CONNECT_CMD\94 command, and only when the regulatory domain allows active
-+ probing. With this command, specified SSIDs are probed for, even if they are hidden.
++ The device issues a reply to some WMI commands, but not to others.
++ The payload in a reply is command-specific, and some commands do
++ not trigger a reply message at all. Events are control messages issued
++ by the device to signal the occurrence of an asynchronous event.
+
-+Command
-+ wmiconfig eth1 --ssid=<ssid> [--num=<index>]
+
-+Command Parameters
-+ {
-+ A_UINT8 numSsids
-+ A number from 0 to
-+ MAX_PROBED_SSID_INDEX indicating
-+ the active SSID table entry index for this
-+ command (if the specified entry index
-+ already has an SSID, the SSID specified in
-+ this command replaces it)
++WMI Message Format
+
-+ WMI_PROBED_SSID_INFO probedSSID[1]
-+ } WMI_PROBED_SSID_CMD
++ All WMI control commands, replies and events use the header format:
+
-+ {
-+ A_UINT8 flag
-+ WMI_SSID_FLAG indicates the current
-+ entry in the active SSID table
-+ A_UINT8 ssidLength
-+ Length of the specified SSID in bytes.
-+ If = 0, the entry corresponding to the
-+ index is erased
-+ A_UINT8 ssid[32]
-+ SSID string actively probed for when
-+ permitted by the regulatory domain
-+ } WMI_PROBED_SSID_INFO
++ WMI_CMD_HDR Header Format
++ {
++ UINT16 id
++ This 16-bit constant identifies which WMI command the host is issuing,
++ which command the target is replying to, or which event has occurred.
++ WMI_CMD_HDR
++ }
+
-+Command Values
-+ WMI_SSID_FLAG
-+ {
-+ DISABLE_SSID_FLAG = 0
-+ Disables entry
-+ SPECIFIC_SSID_FLAG = 1
-+ Probes specified SSID
-+ ANY_SSID_FLAG = 2
-+ Probes for any SSID
-+ } WMI_SSID_FLAG
+
-+Reset Value
-+ The entries are unused.
-+
-+Restrictions
-+ None
-+
-+=====================================================================
-+
-+
-+Name
-+ SET_REASSOC_MODE
-+
-+Synopsis
-+ Specify whether the disassociated frame should be sent or not upon reassociation.
-+
-+Command
-+ wmiconfig eth1 --setreassocmode <mode>
-+
-+Command Parameters
-+ UINT8 mode
-+
-+Command Values
-+ mode
-+ = 0x00
-+ Send disassoc to a previously connected AP
-+ upon reassociation
-+ = 0x01
-+ Do not send disassoc to previously connected
-+ AP upon reassociation
++ A variable-size command-, reply-, or event-specific payload follows the
++ header. Over the interconnect, all fields in control messages (including
++ WMI_CMD_HDR and the command specific payload) use 32-bit little Endian
++ byte ordering and fields are packed. The AR6000 device always executes
++ commands in order, and the host may send multiple commands without
++ waiting for previous commands to complete. A majority of commands are
++ processed to completion once received. Other commands trigger a longer
++ duration activity whose completion is signaled to the host through an event.
+
-+Reset Values
-+ None defined
++Command Restrictions
+
-+Restrictions
-+ None
++ Some commands may only be issued when the AR6000 device is in a certain
++ state. The host is required to wait for an event signaling a state transition
++ before such a command can be issued. For example, if a command requires
++ the device to be in the CONNECTED state, then the host is required to wait
++ for a \93CONNECT\94 event before it issues that command.
+
++ The device ignores any commands inappropriate for its current state. If the
++ command triggers a reply, the device generates an error reply. Otherwise, the
++ device silently ignores the inappropriate command.
+
-+=====================================================================
++Command and Data Synchronization
+
-+Name
-+ SET_RETRY_LIMITS
++ WMI provides a mechanism for a host to advise the device of necessary
++ synchronization between commands and data. The device implements
++ synchronization; no implicit synchronization exists between endpoints.
+
-+Synopsis
-+ Allows the host to influence the number of times that the AR6000 device should
-+ attempt to send a frame before they give up.
++ The host controls synchronization using the \93SYNCHRONIZE\94 command
++ over the control channel and synchronization messages over data channels.
++ The device stops each data channel upon receiving a synchronization message
++ on that channel, processing all data packets received prior to that message.
++ After the device receives synchronization messages for each data endpoint
++ and the \93SYNCHRONIZE\94 command, it resumes all channels.
+
-+Command
-+ wmiconfig --setretrylimits <frameType> <trafficClass> <maxRetries>
-+ <enableNotify>
++ When the host must guarantee a command executes before processing new
++ data packets, it first issues the command, then issues the \93SYNCHRONIZE\94
++ command and sends synchronization messages on data channels. When the
++ host must guarantee the device has processed all old data packets before a
++ processing a new command, it issues a \93SYNCHRONIZE\94 command and
++ synchronization messages on all data channels, then issues the desired
++ command.
+
-+Command Parameters
-+ {
-+ UINT8 frameType
-+ A WMI_FRAMETYPE specifying
-+ which type of frame is of interest.
-+ UINT8 trafficClass
-+ Specifies a traffic class (see
-+ \93CREATE_PSTREAM\94). This
-+ parameter is only significant when
-+ frameType = DATA_FRAMETYPE.
-+ UINT8 maxRetries
-+ Maximum number of times the
-+ device attempts to retry a frame Tx,
-+ ranging from WMI_MIN_RETRIES
-+ (2) to WMI_MAX_RETRIES (15). If
-+ the special value 0 is used,
-+ maxRetries is set to 15.
-+ A_UINT8 enableNotify
-+ Notify when enabled
-+ } WMI_RETRY_LIMIT_INFO
+
-+ {
-+ A_UINT8 numEntries
-+ WMI_RETRY_LIMIT_INFO retryLimitInfo[1]
-+ } WMI_SET_RETRY_LIMITS_CMD
+
-+Command Values
-+ {
-+ MGMT_FRAMETYPE = 0 Management frame
-+ CONTROL_FRAMETYPE = 1 Control frame
-+ DATA_FRAMETYPE = 2 Data frame
-+ } WMI_FRAMETYPE
++WMI Commands
+
-+Reset Values
-+ Retries are set to 15
++ ADD_BAD_AP
++ Cause the AR6000 device to avoid a particular AP
++ ADD_CIPHER_KEY
++ Add or replace any of the four AR6000 encryption keys
++ ADD_WOW_PATTERN
++ Used to add a pattern to the WoW pattern list
++ CLR_RSSI_SNR
++ Clear the current calculated RSSI and SNR value
++ CONNECT_CMD
++ Request that the AR6000 device establish a wireless connection
++ with the specified SSID
++ CREATE_PSTREAM
++ Create prioritized data endpoint between the host and device
++ DELETE_BAD_AP
++ Clear an entry in the bad AP table
++ DELETE_CIPHER_KEY
++ Delete a previously added cipher key
++ DELETE_PSTREAM
++ Delete a prioritized data endpoint
++ DELETE_WOW_PATTERN
++ Remove a pre-specified pattern from the WoW pattern list
++ EXTENSION
++ WMI message interface command
++ GET_BIT_RATE
++ Retrieve rate most recently used by the AR6000
++ GET_CHANNEL_LIST
++ Retrieve list of channels used by the AR6000
++ GET_FIXRATES
++ Retrieves the rate-mask set via the SET_FIXRATES command.
++ GET_PMKID_LIST_CMD
++ Retrieve the firmware list of PMKIDs
++ GET_ROAM_DATA
++ Internal use for data collection; available in special build only
++ GET_ROAM_TBL
++ Retrieve the roaming table maintained on the target
++ GET_TARGET_STATS
++ Request that the target send the statistics it maintains
++ GET_TX_PWR
++ Retrieve the current AR6000 device Tx power levels
++ GET_WOW_LIST
++ Retrieve the current list of WoW patterns
++ LQ_THRESHOLD_PARAMS
++ Set the link quality thresholds
++ OPT_TX_FRAME
++ Send a special frame (special feature)
++ RECONNECT
++ Request a reconnection to a BSS
++ RSSI_THRESHOLD_PARAMS
++ Configure how the AR6000 device monitors and reports signal
++ strength (RSSI) of the connected BSS
++ SCAN_PARAMS
++ Determine dwell time and changes scanned channels
++ SET_ACCESS_PARAMS
++ Set access parameters for the wireless network
++ SET_ADHOC_BSSID
++ Set the BSSID for an ad hoc network
++ SET_AKMP_PARAMS
++ Set multiPMKID mode
++ SET_APPIE
++ Add application-specified IE to a management frame
++ SET_ASSOC_INFO
++ Specify the IEs the device should add to association or
++ reassociation requests
++ SET_AUTH_MODE
++ Set 802.11 authentication mode of reconnection
++ SET_BEACON_INT
++ Set the beacon interval for an ad hoc network
++ SET_BIT_RATE
++ Set the AR6000 to a specific fixed bit rate
++ SET_BMISS_TIME
++ Set the beacon miss time
++ SET_BSS_FILTER
++ Inform the AR6000 of network types about which it wants to
++ receive information using a \93BSSINFO\94 event
++ SET_BT_PARAMS
++ Set the status of a Bluetooth stream (SCO or A2DP) or set
++ Bluetooth coexistence register parameters
++ SET_BT_STATUS
++ Set the status of a Bluetooth stream (SCO or A2DP)
++ SET_CHANNEL_PARAMETERS
++ Configure WLAN channel parameters
++ SET_DISC_TIMEOUT
++ Set the amount of time the AR6000 spends attempting to
++ reestablish a connection
++ SET_FIXRATES
++ Set the device to a specific fixed PHY rate (supported subset)
++ SET_HALPARAM
++ Internal AR6000 command to set certain hardware parameters
++ SET_HOST_SLEEP_MODE
++ Set the host mode to asleep or awake
++ SET_IBSS_PM_CAPS
++ Support a non-standard power management scheme for an
++ ad hoc network
++ SET_LISTEN_INT
++ Request a listen interval
++ SET_LPREAMBLE
++ Override the short preamble capability of the AR6000 device
++ SET_MAX_SP_LEN
++ Set the maximum service period
++ SET_OPT_MODE
++ Set the special mode on/off (special feature)
++ SET_PMKID
++ Set the pairwise master key ID (PMKID)
++ SET_PMKID_LIST_CMD
++ Configure the firmware list of PMKIDs
++ SET_POWER_MODE
++ Set guidelines on trade-off between power utilization
++ SET_POWER_PARAMS
++ Configure power parameters
++ SET_POWERSAVE_PARAMS
++ Set the two AR6000 power save timers
++ SET_PROBED_SSID
++ Provide list of SSIDs the device should seek
++ SET_REASSOC_MODE
++ Specify whether the disassociated frame should be sent upon
++ reassociation
++ SET_RETRY_LIMITS
++ Limit how many times the device tries to send a frame
++ SET_ROAM_CTRL
++ Control roaming behavior
++ SET_RTS
++ Determine when RTS should be sent
++ SET_SCAN_PARAMS
++ Set the AR6000 scan parameters
++ SET_TKIP_COUNTERMEASURES
++ Enable/disable reports of TKIP MIC errors
++ SET_TX_PWR
++ Specify the AR6000 device Tx power levels
++ SET_VOICE_PKT_SIZE
++ Set voice packet size
++ SET_WMM
++ Override the AR6000 WMM capability
++ SET_WMM_TXOP
++ Configure TxOP bursting when sending traffic to a WMM-
++ capable AP
++ SET_WOW_MODE
++ Enable/disable WoW mode
++ SET_WSC_STATUS
++ Enable/disable profile check in cserv when the WPS protocol
++ is in progress
++ SNR_THRESHOLD_PARAMS
++ Configure how the device monitors and reports SNR of BSS
++ START_SCAN
++ Start a long or short channel scan
++ SYNCHRONIZE
++ Force a synchronization point between command and data
++ paths
++ TARGET_REPORT_ERROR_BITMASK
++ Control \93ERROR_REPORT\94 events from the AR6000
+
-+Restrictions
-+ None
+
-+=====================================================================
+
+
+Name
-+ SET_ROAM_CTRL
++ ADD_BAD_AP
+
+Synopsis
-+ Affects how the AR6000 device selects a BSS. The host uses this command to set and
-+ enable low RSSI scan parameters. The time period of low RSSI background scan is
-+ mentioned in scan period. Low RSSI scan is triggered when the current RSSI
-+ threshold (75% of current RSSI) is equal to or less than scan threshold.
++ The host uses this command to cause the AR6000 to avoid a particular AP. The
++ AR6000 maintain a table with up to two APs to avoid. An ADD_BAD_AP command
++ adds or replaces the specified entry in this bad AP table.
+
-+ Low RSSI roam is triggered when the current RSSI threshold falls below the roam
-+ threshold and roams to a better AP by the end of the scan cycle. During Low RSSI
-+ roam, if the STA finds a new AP with an RSSI greater than roam RSSI to floor, during
-+ scan, it roams immediately to it instead of waiting for the end of the scan cycle. See
-+ also \93Scan and Roam\94 on page C-1.
++ If the AR6000 are currently connected to the AP specified in this command, they
++ disassociate.
+
+Command
-+ wmiconfig --roam <roamctrl> <info>, where info is <scan period>
-+ <scan threshold> <roam threshold> <roam rssi floor>
++ wmiconfig eth1 --badap <bssid> <badApIndex>
+
+Command Parameters
-+ A_UINT8 roamCtrlType;
-+
-+Command Values
-+ WMI_FORCE_ROAM = 1
-+ Roam to the specified BSSID
-+
-+ WMI_SET_ROAM_MODE = 2
-+ Default, progd bias, no roam
-+
-+ WMI_SET_HOST_BIAS = 3
-+ Set the host bias
-+
-+ WMI_SET_LOWRSSI_SCAN_PARAMS = 4
-+ Info parameters
-+
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ WMI_FORCE_ROAM
-+
-+ A_UINT8 roamMode;
-+ WMI_SET_ROAM_MODE
-+
-+ A_UINT8 bssBiasInfo;
-+ WMI_SET_HOST_BIAS
-+
-+ A_UINT16 lowrssi_scan_period;
-+ WMI_SET_LOWRSSI_SCAN_PARAMS
++ UINT8 badApIndex Index [0...1] that identifies which entry in the
++ bad AP table to use
+
-+ A_INT16
-+ lowrssi_scan_threshold;
-+ WMI_SET_LOWRSSI_SCAN_PARAMS
+
-+ A_INT16 lowrssi_roam_threshold;
-+ WMI_SET_LOWRSSI_SCAN_PARAMS
++ UINT8 bssid[6] MAC address of the AP to avoid
+
-+ A_UINT8 roam_rssi_floor;
-+ WMI_SET_LOWRSSI_SCAN_PARAMS
++Command Values
++ badApIndex = 0, 1 Entry in the bad AP table to use
+
+Reset Value
-+ None defined (default lowrssi scan is disabled. Enabled only when scan period is set.)
++ The bad AP table is cleared
+
+Restrictions
+ None
+
-+=====================================================================
-+
++See Also
++ \93DELETE_BAD_AP\94 on page B-13
+
++=====================================================================
+Name
-+ SET_RTS
++ ADD_CIPHER_KEY
+
+Synopsis
-+ Decides when RTS should be sent.
++ The host uses this command to add/replace any of four encryption keys on the
++ AR6000. The ADD_CIPHER_KEY command is issued after the CONNECT event
++ has been received by the host for all dot11Auth modes except for SHARED_AUTH.
++ When the dot11AuthMode is SHARED_AUTH, then the ADD_CIPHER_KEY
++ command should be issued before the \93CONNECT\94 command.
+
+Command
-+ wmiconfig eth1 --setRTS <pkt length threshold>
++ wmiconfig eth1 --cipherkey <keyIndex> <keyType> <keyUsage>
++ <keyLength> <keyopctrl> <keyRSC> <key>
+
+Command Parameters
-+ A_UINT16
-+ threshold;
-+ Command parameter threshold in bytes. An RTS is
-+ sent if the data length is more than this threshold.
-+ The default is to NOT send RTS.
++ UINT8 keyIndex Index (0...3) of the key to add/replace;
++ uniquely identifies the key
++ UINT8 keyType CRYPTO_TYPE
++ UINT8 keyUsage Specifies usage parameters of the key when
++ keyType = WEP_CRYPT
++ UINT8 keyLength Length of the key in bytes
++ UINT8 keyOpCtrl bit[0] = Initialize TSC (default),
++ bit[1] = Initialize RSC
++ UINT8 keyRSC[8] Key replay sequence counter (RSC) initial
++ value the device should use
++ UINT8 key[32] Key material used for this connection
++ Command Values
++ {
++ NONE_CRYPT = 1
++ WEP_CRYPT = 2
++ TKIP_CRYPT = 3
++ AES_CRYPT = 4
++ KEY_OP_INIT_TSC 0x01
++ KEY_OP_INIT_RSC 0x02
++ KEY_OP_INIT_VAL 0x03
++ Default is to Initialize the TSC
++ KEY_OP_VALID_MASK 0x04
++ Two operations defined
++ } CRYPTO_TYPE
+
-+Command Values
-+ None
++ {
++ PAIRWISE_USAGE = 0 Set if the key is used for unicast traffic only
++ GROUP_USAGE = 1 Set if the key is used to receive multicast
++ traffic (also set for static WEP keys)
++ TX_USAGE = 2 Set for the GROUP key used to transmit frames
++ All others are reserved
++ } KEY_USAGE
+
+Reset Value
-+ Not to send RTS.
++ The four available keys are disabled.
+
+Restrictions
-+ None
++ The cipher should correspond to the encryption mode specified in the \93CONNECT\94
++ command.
+
++See Also
++ \93DELETE_CIPHER_KEY\94
+
+=====================================================================
+
++
+Name
-+ SET_SCAN_PARAMS
++ ADD_WOW_PATTERN
+
+Synopsis
-+ The host uses this command to set the AR6000 scan parameters, including the duty
-+ cycle for both foreground and background scanning. Foreground scanning takes
-+ place when the AR6000 device is not connected, and discovers all available wireless
-+ networks to find the best BSS to join. Background scanning takes place when the
-+ device is already connected to a network and scans for potential roaming candidates
-+ and maintains them in order of best to worst. A second priority of background
-+ scanning is to find new wireless networks.
-+
-+ The device initiates a scan when necessary. For example, a foreground scan is always
-+ started on receipt of a \93CONNECT_CMD\94 command or when the device cannot find
-+ a BSS to connect to. Foreground scanning is disabled by default until receipt of a
-+ CONNECT command. Background scanning is enabled by default and occurs every
-+ 60 seconds after the device is connected.
-+
-+ The device implements a binary backoff interval for foreground scanning when it
-+ enters the DISCONNECTED state after losing connectivity with an AP or when a
-+ CONNECT command is received. The first interval is ForegroundScanStartPeriod,
-+ which doubles after each scan until the interval reaches ForegroundScanEndPeriod.
-+ If the host terminates a connection with DISCONNECT, the foreground scan period
-+ is ForegroundScanEndPeriod. All scan intervals are measured from the time a full
-+ scan ends to the time the next full scan starts. The host starts a scan by issuing a
-+ \93START_SCAN\94 command. See also \93Scan and Roam\94 on page C-1.
++ The host uses this command to add a pattern to the WoW pattern list; used for
++ pattern-matching for host wakeups by the WoW module. If the host mode is asleep
++ and WoW is enabled, all packets are matched against the existing WoW patterns. If a
++ packet matches any of the patterns specified, the target will wake up the host. All
++ non-matching packets are discarded by the target without being sent up to the host.
+
+Command
-+ wmiconfig eth1 --scan --fgstart=<sec> --fgend=<sec> --bg=<sec> --
-+ act=<msec> --pas=<msec> --sr=<short scan ratio> --scanctrlflags
-+ <connScan> <scanConnected> <activeScan> <reportBSSINFO>
++ wmiconfig \96addwowpattern <list-id> <filter-size> <filter-offset>
++ <pattern> <mask>
+
+Command Parameters
-+ UINT16 fgStartPeriod
-+ First interval used by the device when it
-+ disconnects from an AP or receives a
-+ CONNECT command, specified in seconds (0\96
-+ 65535). If = 0, the device uses the reset value.
-+ If = 65535, the device disables foreground
-+ scanning.
-+
-+ UINT16 fgEndPeriod
-+ The maximum interval the device waits between
-+ foreground scans specified in seconds (from
-+ ForegroundScanStartPeriod to 65535). If = 0, the
-+ device uses the reset value.
-+
-+ UINT16 bgScanPeriod
-+ The period of background scan specified in
-+ seconds (0\9665535). By default, it is set to the reset
-+ value of 60 seconds. If 0 or 65535 is specified, the
-+ device disables background scanning.
-+
-+ UINT16 maxactChDwellTime
-+ The period of time the device stays on a
-+ particular channel while active scanning. It is
-+ specified in ms (10\9665535). If the special value of
-+ 0 is specified, the device uses the reset value.
-+
-+ UINT16 PasChDwellTime
-+ The period of time the device remains on a
-+ particular channel while passive scanning. It is
-+ specified in ms (10\9665535). If the special value of
-+ 0 is specified, the device uses the reset value.
-+
-+ UINT8 shortScanRatio
-+ Number of short scans to perform for each
-+ long scan.
-+
-+ UINT8 scanCtrlFlasgs
-+
-+ UINT16 minactChDwellTime
-+ Specified in ms
-+
-+ UINT32 maxDFSchActTime
-+ The maximum time a DFS channel can stay
-+ active before being marked passive, specified in
-+ ms.
++ A_UINT8 filter_list_id ID of the list that is to include the new pattern
++ A_UINT8 filter_size Size of the new pattern
++ A_UINT8 filter_offset Offset at which the pattern matching for this
++ new pattern should begin at
++ A_UINT8 filter[1] Byte stream that contains both the pattern and
++ the mask of the new WoW wake-up pattern
+
-+Command Values
++Reply Parameters
+ None
+
-+Reset Values
-+ ForegroundScanStart
-+Period
-+ 1 sec
-+
-+ ForegroundScanEndPeriod
-+ 60 sec
++Reset Value
++ None defined (default host mode is awake)
+
-+ BackgroundScanPeriod
-+ 60 sec
++Restrictions
++ None
+
-+ ActiveChannelDwellTime
-+ 105 ms
++See Also
++ \93DELETE_WOW_PATTERN\94
+
+=====================================================================
+
+
+Name
-+ SET_TKIP_COUNTERMEASURES
++ CLR_RSSI_SNR
+
+Synopsis
-+ The host issues this command to tell the target whether to enable or disable TKIP
-+ countermeasures.
++ Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
++ running-average value. This command will clear the history and have a fresh start
++ for the running-average mechanism.
+
+Command
-+ TBD
++ wmiconfig eth1 --cleanRssiSnr
+
+Command Parameters
-+ UINT8 WMI_TKIP_CM_ENABLE
-+ Enables the countermeasures
-+
-+
-+ UINT8 TKIP_CM_DISABLE
-+ Disables the countermeasures
++ None
+
-+Command Values
++Reply Parameters
+ None
+
-+Reset Values
-+ By default, TKIP MIC reporting is disabled
++Reset Value
++ None defined
+
+Restrictions
+ None
+
+=====================================================================
+
-+
+Name
-+ SET_TX_PWR
++ CONNECT_CMD
+
+Synopsis
-+ The host uses this command to specify the Tx power level of the AR6000. Cannot be
-+ used to exceed the power limit permitted by the regulatory domain. The maximum
-+ output power is limited in the chip to 31.5 dBm; the range is 0 \96 31.5 dbm.
++ New connect control information (connectCtrl) is added, with 32 possible modifiers.
++
++ CONNECT_SEND_REASSOC
++ Valid only for a host-controlled connection to a
++ particular AP. If this bit is set, a reassociation frame is
++ sent. If this bit is clear, an association request frame is
++ sent to the AP.
++
++ CONNECT_IGNORE_WPAx_GROUP_CIPHER
++ No group key is issued in the CONNECT command,
++ so use the group key advertised by the AP. In a target-
++ initiated roaming situation this allows a STA to roam
++ between APs that support different multicast ciphers.
++
++ CONNECT_PROFILE_MATCH_DONE
++ In a host-controlled connection case, it is possible that
++ during connect, firmware may not have the
++ information for a profile match (e.g, when the AP
++ supports hidden SSIDs and the device may not
++ transmit probe requests during connect). By setting
++ this bit in the connection control information, the
++ firmware waits for a beacon from the AP with the
++ BSSID supplied in the CONNECT command. No
++ additional profile checks are done.
++
++ CONNECT_IGNORE_AAC_BEACON
++ Ignore the Admission Capacity information in the
++ beacon of the AP
++
++ CONNECT_ASSOC_POLICY_USER
++ When set, the CONNECT_SEND_REASSOC setting
++ determines if an Assoc or Reassoc is sent to an AP
+
+Command
-+ wmiconfig --power <dbM>
++ wmiconfig --setconnectctrl <ctrl flags bitmask>
+
+Command Parameters
-+ UINT8 dbM
-+ The desired Tx power specified in dbM.
-+ If = 0, the device chooses the maximum
-+ permitted by the regulatory domain.
++ typedef struct{
++ A_UINT8 networktype;
++ A_UINT8 dot11authmode;
++ A_UINT8 authmode;
++ A_UINT8 pairwiseCryptoType; /*CRYPTO_TYPE*/
++ A_UINT8 pairwiseCryptoLen;
++ A_UINT8 groupCryptoType; /*CRYPTO_TYPE*/
++ A_UINT8 groupCryptoLen;
++ A_UINT8 ssidLength;
++ A_UCHAR ssid[WMI_MAX_SSID_LEN];
++ A_UINT16 channel;
++ A_UINT8 bssid[AUTH_MAC_LEN];
++ A_UINT8 ctrl_flags; /*WMI_CONNECT_CTRL_FLAGS_BITS*/
++ } WMI_CONNECT_CMD;
+
-+Command Values
-+ None
++ ctrl flags bitmask
++ = 0x0001 CONNECT_ASSOC_POLICY_USER
++ Assoc frames are sent using the policy specified by
++ the flag
++ = 0x0002 CONNECT_SEND_REASSOC
++ Send Reassoc frame while connecting, otherwise send
++ assoc frames
++ = 0x0004 CONNECT_IGNORE_WPAx_GROUP_CIPHER
++ Ignore WPAx group cipher for WPA/WPA2
++ = 0x0008 CONNECT_PROFILE_MATCH_DONE
++ Ignore any profile check
++ = 0x0010 CONNECT_IGNORE_AAC_BEACON
++ Ignore the admission control information in the
++ beacon
++ ... CONNECT_CMD, continued
++ Command Values
++ typedef enum {
++ INFRA_NETWORK = 0x01,
++ ADHOC_NETWORK = 0x02,
++ ADHOC_CREATOR = 0x04,
++ } NETWORK_TYPE;
+
-+Reset Values
-+ The maximum permitted by the regulatory domain
++ typedef enum {
++ OPEN_AUTH = 0x01,
++ SHARED_AUTH = 0x02,
++ LEAP_AUTH = 0x04,
++ } DOT11_AUTH_MODE;
++ typedef enum {
++ NONE_AUTH = 0x01,
++ WPA_AUTH = 0x02,
++ WPA_PSK_AUTH = 0x03,
++ WPA2_AUTH = 0x04,
++ WPA2_PSK_AUTH = 0x05,
++ WPA_AUTH_CCKM = 0x06,
++ WPA2_AUTH_CCKM = 0x07,
++ } AUTH_MODE;
++ typedef enum {
++ NONE_CRYPT = 0x01,
++ WEP_CRYPT = 0x02,
++ TKIP_CRYPT = 0x03,
++ AES_CRYPT = 0x04,
++ } CRYPTO_TYPE;
++ typedef enum {
++ CONNECT_ASSOC_POLICY_USER = 0x0001,
++ CONNECT_SEND_REASSOC = 0x0002,
++ CONNECT_IGNORE_WPAx_GROUP_CIPHER = 0x0004,
++ CONNECT_PROFILE_MATCH_DONE = 0x0008,
++ CONNECT_IGNORE_AAC_BEACON = 0x0010,
++ } WMI_CONNECT_CTRL_FLAGS_BITS;
+
-+Restrictions
-+ None
++ pairwiseCryptoLen and groupCryptoLen are valid when the respective
++ CryptoTypesis WEP_CRYPT, otherwise this value should be 0. This is the length in
++ bytes.
+
-+See Also
-+ \93GET_TX_PWR\94
++Reset Value
++ None defined
+
++Restrictions
++ None
+
+=====================================================================
+
++
+Name
-+ SET_VOICE_PKT_SIZE
++ CREATE_PSTREAM
+
+Synopsis
-+ If an AP does not support WMM, it has no way to differentiate voice from data.
-+ Because the voice packet is typically small, packet in size less than voicePktSize are
-+ assumed to be voice, otherwise it is treated as data.
++ The host uses this command to create a new prioritized data endpoint between the
++ host and the AR6000 device that carries a prioritized stream of data. If the AP that the
++ device connects to requires TSPEC stream establishment, the device requests the
++ corresponding TSPEC with the AP. The maximum and minimum service interval
++ ranges from 0 \96 0x7FFFFFFF (ms), where 0 = disabled. The device does not send a
++ reply event for this command, as it is always assumed the command has succeeded.
++ An AP admission control response comes to the host via a WMI_CAC_INDICATION
++ event, once the response for the ADDTS frame comes.
++
++ Examples of cases where reassociation is generated (when WMM) and cases where
++ ADDTS is generated (when WMM and enabling ACM) are when:
++ Changing UAPSD flags in WMM mode, reassociation is generated
++ Changing the interval of sending auto QoS Null frame in WMM mode;
++ reassociation is not generated
++ Issuing a command with same previous parameters in WMM mode and enabling
++ ACM, an ADDTS request is generated
++ Changing the interval of a QoS null frame sending in WMM mode and enabling
++ ACM, an ADDTS request is generated
++ Issuing the command in disconnected state, reassociation or ADDTS is not
++ generated but the parameters are available after (re)association
+
+Command
-+ wmiconfig eth1 --setVoicePktSize <size-in-bytes>
++ --createqos <user priority> <direction> <traffic class>
++<trafficType> <voice PS capability> <min service interval> <max
++service interval> <inactivity interval> <suspension interval>
++<service start time> <tsid> <nominal MSDU> <max MSDU> <min data
++rate> <mean data rate> <peak data rate> <max burst size> <delay
++bound> <min phy rate> <sba> <medium time> where:
+
-+Command Parameters
-+ UINT16 voicePktSize
-+ Packet size in octets
++ <user priority>
++ 802.1D user priority range (0\967)
++ <direction>
++ = 0 Tx (uplink) traffic
++ = 1 Rx (downlink) traffic
++ = 2 Bi-directional traffic
++ <traffic class>
++ = 1 BK
++ = 2 VI
++ = 3 VO
++ <trafficType>
++ = 0 Aperiodic
++ = 1 Periodic
++ <voice PS capability>
++ Specifies whether the voice power save mechanism
++ (APSD if AP supports it or legacy/simulated APSD
++ [using PS-Poll]) should be used
++ = 0 Disable voice power save for traffic class
++ = 1 Enable APSD voice power save for traffic class
++ = 2 Enable voice power save for all traffic classes
++ <min service interval>
++ (In ms)
++ <max service interval>
++ Inactivity interval (in ms) (0 = Infinite)
++ <suspension interval>
++ (In ms)
++ <service start time>
++ Service start time
++ <tsid>
++ TSID range (0\9615)
++ <nominal MSDU>
++ Nominal MAC SDU size
++ <max MSDU>
++ Maximum MAC SDU size
++ <min data rate>
++ Minimum data rate (in bps)
++ <mean data rate>
++ Mean data rate (in bps)
++ <peak data rate>
++ Peak data rate (in bps)
++ <max burst size>
++ Maximum burst size (in bps)
++ <delay bound>
++ Delay bound
++ <min phy rate>
++ Minimum PHY rate (in bps)
++ <sba>
++ Surplus bandwidth allowance
++ <medium time>
++ Medium time in TU of 32-ms periods per sec
++ ... CREATE_PSTREAM (continued)
+
++Command Parameters
++ UINT8 trafficClass TRAFFIC_CLASS value
++ UINT8 traffic
++ Direction
++ DIR_TYPE value
++ UINT8 rxQueueNum
++ AR6000 device mailbox index (2 or 3)
++ corresponding to the endpoint the host
++ wishes to use to receive packets for the
++ prioritized stream
++ UINT8 trafficType TRAFFIC_TYPE value
++ UINT8 voicePS
++Capability
++ VOICEPS_CAP_TYPE value
++ UINT8 tsid Traffic stream ID
++ UINT8 userPriority 802.1D user priority
++ UINT16 nominalMSDU Nominal MSDU in octets
++ UINT16 maxMSDU Maximum MSDU in octets
++ UINT32 minServiceInt Minimum service interval: the min.
++ period of traffic specified (in ms)
++ UINT32 maxServiceInt Maximum service interval: the max.
++ period of traffic specified (in ms)
++ UINT32 inactivityInt Indicates how many ms an established
++ stream is inactive before the prioritized
++ data endpoint is taken down and the
++ corresponding T-SPEC deleted
++ UINT32 suspensionInt Suspension interval (in ms)
++ UINT32 service StartTime Service start time
++ UINT32 minDataRate Minimum data rate (in bps)
++ UINT32 meanDataRate Mean data rate (in bps)
++ UINT32 peakDataRate Peak data rate (in bps)
++ UINT32 maxBurstSize
++ UINT32 delayBound
++ UINT32 minPhyRate Minimum PHY rate for TSPEC (in bps)
++ UINT32 sba Surplus bandwidth allowance
++ UINT32 mediumTime Medium TSPEC time (in units of 32 ms)
+Command Values
-+ None
++ {
++ WMM_AC_BE = 0 Best Effort
++ WMM_AC_BK = 1 Background
++ WMM_AC_VI = 2 Video
++ WMM_AC_VO = 3 Voice
++ All other values reserved
++ } TRAFFIC_CLASS
++ {
++ UPLINK_TRAFFIC = 0 From the AR6000 device to the AP
++ DOWNLINK_TRAFFIC = 1 From the AP to the AR6000 device
++ BIDIR_TRAFFIC = 2 Bi-directional traffic
++ All other values reserved
++ } DIR_TYPE
++ {
++ DISABLE_FOR_THIS_AC = 0
++ ENABLE_FOR_THIS_AC = 1
++ ENABLE_FOR_ALL_AC = 2
++ All other values reserved
++ } VOICEPS_CAP_TYPE
+
-+Reset Values
-+ voicePktSize default is 400 bytes
++ ... CREATE_PSTREAM (continued)
+
-+Restrictions
-+ No effect if WMM is unavailable
+
++ VI BE BK Supported, Y/N?
++ 0 0 0 0 Y
++ 0 0 0 1 Y
++ 0 0 1 0 N
++ 0 0 1 1 N
++ 0 1 0 0 Y
++ 0 1 0 1 Y
++ 0 1 1 0 N
++ 0 1 1 1 N
++ 1 0 0 0 Y
++ 1 0 0 1 Y
++ 1 0 1 0 N
++ 1 1 0 0 N
++ 1 1 0 1 Y
++ 1 1 0 0 N
++ 1 1 1 0 N
++ 1 1 1 1 Y
++
++Reset Value
++ No pstream is present after reset; each of the BE, BK, VI,VO pstreams must be created
++ (either implicitly by data flow or explicitly by user)
++
++Restrictions
++ This command can only be issued when the device is in the CONNECTED state. If
++ the device receives the command while in DISCONNECTED state, it replies with a
++ failure indication. At most four prioritized data endpoints can be created, one for
++ each AC.
+
++See Also
++ \93DELETE_PSTREAM\94
+=====================================================================
+
+Name
-+ SET_WMM
++ DELETE_BAD_AP
+
+Synopsis
-+ Overrides the AR6000 device WMM capability
++ The host uses this command to clear a particular entry in the bad AP table
+
+Command
-+ wmiconfig eth1 --setwmm <enable>
++ wmiconfig eth1 --rmAP [--num=<index>] // used to clear a badAP
++ entry. num is index from 0-3
+
+Command Parameters
-+ WMI_WMM_ENABLED
-+ Enables WMM
-+
-+ WMI_WMM_DISABLED
-+ Disables WMM support
++ UINT8 badApIndex Index [0...n] that identifies the entry in the bad
++ AP table to delete
+
+Command Values
-+ 0 = disabled
-+ 1 = enabled
++ badApIndex = 0, 1, 2, 3
++ Entry in the bad AP table
+
+Reset Value
-+ WMM Disabled
++ None defined
+
+Restrictions
+ None
+
++See Also
++ \93ADD_BAD_AP\94
+
+=====================================================================
+
++
+Name
-+ SET_WMM_TXOP
++ DELETE_CIPHER_KEY
+
+Synopsis
-+ Configures TxOP Bursting when sending traffic to a WMM capable AP
++ The host uses this command to delete a key that was previously added with the
++ \93ADD_CIPHER_KEY\94 command.
+
+Command
-+ wmiconfig eth1 --txopbursting <burstEnable>
-+
-+ <burstEnable>
-+ = 0
-+ Disallow TxOp bursting
-+
-+ = 1
-+ Allow TxOp bursting
++ TBD
+
+Command Parameters
-+ txopEnable
-+ = WMI_TXOP_DISABLED
-+ Disabled
-+
-+ = WMI_TXOP_ENABLED
-+ Enabled
++ UINT8 keyIndex Index (0...3) of the key to be deleted
+
+Command Values
-+ txopEnable
-+ = 0 Disabled
-+
-+ = 1 Enabled
++ keyIndex = 0, 1,2, 3 Key to delete
+
+Reset Value
-+ Bursting is off by default
++ None
+
+Restrictions
-+ None
++ The host should not delete a key that is currently in use by the AR6000.
+
-+=====================================================================
++See Also
++ \93ADD_CIPHER_KEY\94
+
++=====================================================================
+
+Name
-+ SET_WOW_MODE
++ DELETE_PSTREAM
+
+Synopsis
-+ The host uses this command to enable or disable the WoW mode. When WoW mode
-+ is enabled and the host is asleep, pattern matching takes place at the target level.
-+ Only packets that match any of the pre-specified WoW filter patterns, will be passed
-+ up to the host. The host will also be woken up by the target. Packets which do not
-+ match any of the WoW patterns are discarded.
++ The host uses this command to delete a prioritized data endpoint created by a
++ previous \93CREATE_PSTREAM\94 command
+
+Command
-+ wmiconfig \96setwowmode <enable/disable>
++ --deleteqos <trafficClass> <tsid>, where:
++
++ <traffic class>
++ = 0 BE
++ = 1 BK
++ = 2 VI
++ = 3 VO
++ <tsid>
++ The TSpec ID; use the -qosqueue option
++ to get the active TSpec IDs for each traffic class
+
+Command Parameters
-+ A_BOOL enable_wow
-+ Enable or disable WoW:
++ A_UINT8 trafficClass Indicate the traffic class of the stream
++ being deleted
+
+Command Values
-+ = 0
-+ Disable WoW
++ {
++ WMM_AC_BE = 0 Best effort
++ WMM_AC_BK = 1 Background
++ WMM_AC_VI = 2 Video
++ WMM_AC_VO = 3 Voice
++ } TRAFFIC CLASS
+
-+ = 1
-+ Enable WoW
++ 0-15 for TSID
+
-+Reset Value
-+ None defined (default WoW mode is disabled).
++Reply Values
++ N/A
+
+Restrictions
-+ None
++ This command should only be issued after a \93CREATE_PSTREAM\94 command has
++ successfully created a prioritized stream
+
+See Also
-+ \93GET_WOW_LIST\94
-+
++ \93CREATE_PSTREAM\94
+
+=====================================================================
+
++
+Name
-+ SET_WSC_STATUS
++ DELETE_WOW_PATTERN
+
+Synopsis
-+ The supplicant uses this command to inform the target about the status of the WSC
-+ registration protocol. During the WSC registration protocol, a flag is set so the target
-+ bypasses some of the checks in the CSERV module. At the end of the registration, this
-+ flag is reset.
++ The host uses this command to remove a pre-specified pattern from the
++ WoW pattern list.
+
+Command
-+ N/A
++ wmiconfig \96delwowpattern <list-id> <pattern-id>
+
+Command Parameters
-+ A_BOOL status
-+ = 1 WSC registration in progress
-+ = 0 WSC protocol not running
++ A_UINT8 filter_list_id ID of the list that contains the WoW filter
++ pattern to delete
++ A_UINT8 filter_id ID of the WoW filter pattern to delete
+
+Reply Parameters
+ None
+
++
++
+Reset Value
-+ None defined (default = 0)
++ None defined
+
+Restrictions
+ None
+
++See Also
++ \93ADD_WOW_PATTERN\94
+
+=====================================================================
+
++
+Name
-+ SNR_THRESHOLD_PARAMS
++ EXTENSION
+
+Synopsis
-+ Configures how the AR6000 device monitors and reports SNR of the connected BSS,
-+ used as a link quality metric.
++ The WMI message interface is used mostly for wireless control messages to a wireless
++ module applicable to wireless module management regardless of the target platform
++ implementation. However, some commands only peripherally related to wireless
++ management are desired during operation. These wireless extension commands may
++ be platform-specific or implementation-dependent.
+
+Command
-+ --snrThreshold <weight> <upper_threshold_1> ...
-+ <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
-+ <pollTimer>
++ N/A
+
+Command Parameters
-+ <weight>
-+ Share with rssiThreshold. Range in [1, 16], used
-+ in the formula to calculate average RSSI
-+
-+ <upper_threshold_x>
-+ Above thresholds expressed in db, in ascending
-+ order
-+
-+ <lower_threshold_x>
-+ Below thresholds expressed in db, in ascending
-+ order
-+
-+ <pollTimer>
-+ The signal strength sampling frequency in
-+ seconds. If polltime = 0, signal strength
-+ sampling is disabled
++ Command-specific
+
+Command Values
-+ None
++ Command-specific
+
-+Reset Value
++Reply Parameters
++ Command-specific
++
++Reset Values
+ None defined
+
+Restrictions
-+ None
++ None defined
+
+=====================================================================
+
+
+Name
-+ START_SCAN
++ GET_BIT_RATE
+
+Synopsis
-+ The host uses this command to start a long or short channel scan. All future scans are
-+ relative to the time the AR6000 device processes this command. The device performs
-+ a channel scan on receipt of this command, even if a scan was already in progress.
-+ The host uses this command when it wishes to refresh its cached database of wireless
-+ networks. The isLegacy field will be removed (0 for now) because it is achieved by
-+ setting CONNECT_PROFILE_MATCH_DONE in the CONNECT command. See also
-+ \93Scan and Roam\94
++ Used by the host to obtain the rate most recently used by the AR6000 device
+
+Command
-+ wmiconfig eth1 --startscan <scan type> <forcefgscan> 0
-+ <homeDwellTime> <forceScanInterval>
++ wmiconfig eth1 --getfixrates
+
+Command Parameters
-+ UINT8 scanType
-+ WMI_SCAN_TYPE
-+
-+Command Values
-+ {
-+ WMI_LONG_SCAN =0x0
-+ Requests a full scan
-+ WMI_SHORT_SCAN =0x1
-+ Requests a short scan
-+ } WMI_SCAN_TYPE
-+
-+ A_BOOL forceFgScan
-+ forceFgScan
-+ = 0
-+ Disable the foreground scan
-+
-+ forceFgScan
-+ = 1
-+ Forces a foreground scan
++ None
+
-+ A_UINT32 homeDwellTime
-+ Maximum duration in the home
-+ channel (in ms)
+
-+ A_UINT32 forceScanInterval
-+ Time interval between scans (in ms)
+
-+ A_UINT32 scanType
-+ WMI_SCAN_TYPE
++Reply Parameters
++ INT8
++ rateIndex
++ See the \93SET_BIT_RATE\94 command
+
-+Reset Value
-+ Disable forcing foreground scan
++Reset Values
++ None
+
+Restrictions
-+ isLegacy field will no longer be supported (pass as 0 for now)
++ This command should only be used during development/debug; it is not intended
++for use in production. It is only valid when the device is in the CONNECTED state
+
++See Also
++ \93SET_BIT_RATE\94
+
+=====================================================================
+
-+Name
-+ SYNCHRONIZE
++
++Name
++ GET_CHANNEL_LIST
+
+Synopsis
-+ The host uses this command to force a synchronization point between the command
-+ and data paths
++ Used by the host uses to retrieve the list of channels that can be used by the device
++ while in the current wireless mode and in the current regulatory domain.
+
+Command
+ TBD
+Command Parameters
+ None
+
-+
-+
-+Command Values
-+ None
-+
-+
++Reply Parameters
++ UINT8 reserved Reserved
++ UINT8 numberOfChannels Number of channels the reply contains
++ UINT16 channelList[numberOfChannels] Array of channel frequencies (in MHz)
+
+Reset Values
-+ None
-+
-+
++ None defined
+
+Restrictions
-+ None
-+
++ The maximum number of channels that can be reported are 32
+
+=====================================================================
+
++
+Name
-+ TARGET_ERROR_REPORT_BITMASK
++ GET_FIXRATES
+
+Synopsis
-+ Allows the host to control \93ERROR_REPORT\94 events from the AR6000 device.
-+
-+ If error reporting is disabled for an error type, a count of errors of that type is
-+ maintained by the device.
-+
-+ If error reporting is enabled for an error type, an \93ERROR_REPORT\94 event is
-+ sent when an error occurs and the error report bit is cleared.
++ Clears the current calculated RSSI and SNR value. RSSI and SNR are reported by
++ running-average value. This command will clear the history and have a fresh start for
++ the running-average mechanism.
+
-+ Error counts for each error type are available through the \93GET_TARGET_STATS\94
-+ command.
++Synopsis
++ This returns rate-mask set via WMI_SET_FIXRATES to retrieve the current fixed rate
++ that the AR6001 or AR6001 is using. See \93SET_FIXRATES\94.
+
+Command
-+ wmiconfig eth1 --setErrorReportingBitmask
++ wmiconfig eth1 --getfixrates
+
+Command Parameters
-+ UINT32 bitmask
-+ Represents the set of
-+ WMI_TARGET_ERROR_VAL error types
-+ enabled for reporting
-+
-+Command Values
-+ {
-+ WMI_TARGET_PM_ERR_FAIL = 0x00000001
-+ Power save fails (only two cases):
-+ Retry out of null function/QoS null
-+ function to associated AP for PS
-+ indication'
-+ Host changes the PS setting when
-+ STA is off home channel
++ A_UINT16 fixRateMask; Note: if this command is used prior to
++ using WMI_SET_FIXRATES, AR6000
++ returns 0xffff as fixRateMask, indicating
++ all the rates are enabled
+
-+ WMI_TARGET_KEY_NOT_FOUND = 0x00000002
-+ No cipher key
-+ WMI_TARGET_DECRYPTION_ERR = 0x00000004
-+ Decryption error
-+ WMI_TARGET_BMISS = 0x00000008
-+ Beacon miss
-+ WMI_PSDISABLE_NODE_JOIN = 0x00000010
-+ A non-PS-enabled STA joined the
-+ PS-enabled network
-+ WMI_TARGET_COM_ERR = 0x00000020
-+ Host/target communication error
-+ WMI_TARGET_FATAL_ERR = 0x00000040
-+ Fatal error
-+ } WMI_TARGET_ERROR_VAL
++Reply Parameters
++ None
+
-+Reset Values
-+ Bitmask is 0, and all error reporting is disabled
++Reset Value
++ None defined
+
+Restrictions
+ None
+
++See Also
++ \93SET_FIXRATES\94
+
+=====================================================================
-+WMI Events
-+
-+Event
-+ Description
-+ Page
-+
-+
-+BSSINFO
-+ Contains information describing BSSs collected during a scan
-+
-+CAC_EVENTID
-+ Indicates signalling events in admission control
+
-+CMDERROR
-+ The AR6000 device encounters an error while attempting to process
-+ a command
+
-+CONNECT
-+ The device has connected to a wireless network
+
-+DISCONNECT
-+ The device lost connectivity with a wireless network
++Name
++ GET_PMKID_LIST_CMD
+
-+ERROR_REPORT
-+ An error has occurred for which the host previously requested
-+ notification with the command
-+ \93TARGET_ERROR_REPORT_BITMASK\94
++Synopsis
++ Retrieves the list of PMKIDs on the firmware. The
++ WMI_GET_PMKID_LIST_EVENT is generated by the firmware.
+
-+EXTENSION
-+ WMI extension event
++Command
++ TBD
+
-+GET_PMKID_LIST_EVENT
-+ Created in response to a \93GET_PMKID_LIST_CMD\94 command
++Command Parameters
+
-+GET_WOW_LIST_EVENT
-+ Response to the wmiconfig \93GET_WOW_LIST\94 command to
-+ retrieve the configured WoW patterns
++Reset Values
++ None
+
-+NEIGHBOR_REPORT
-+ Neighbor APs that match the current profile were detected
++Restrictions
++ None
+
-+OPT_RX_FRAME_EVENT
-+ (Special feature) informs the host of the reception of a special frame
++See Also
++ SET_PMKID_LIST_CMD GET_PMKID_LIST_EVENT
+
-+PSTREAM_TIMEOUT
-+ A prioritized stream has been idle for a specified interval
++=====================================================================
+
-+READY
-+ The AR6000 device is ready to accept commands
+
-+REGDOMAIN
-+ The regulatory domain has changed
++Name
++ GET_ROAM_TBL
+
-+REPORT_ROAM_DATA_EVENT
-+ Reports the roam time calculations made by the device
-+ (generated with a special build)
-+ \97
++Synopsis
++ Retrieve the roaming table maintained on the target. The response is reported
++ asynchronously through the ROAM_TBL_EVENT.
+
-+REPORT_STATISTICS
-+ Reply to a \93GET_TARGET_STATS\94 command
++Command
++ wmiconfig --getroamtable <roamctrl> <info>
+
-+ROAM_TBL_EVENT
-+ Reports the roam table
++Command Parameters
++ A_UINT8 roamCtrlType;
++ A_UINT16 roamMode
++ A_UINT16 numEntries
++ WMI_BSS_ROAM_INFO bssRoamInfo[1]
+
-+RSSI_THRESHOLD
-+ Signal strength from the connected AP has crossed the threshold
-+ defined in the \93RSSI_THRESHOLD_PARAMS\94 command
++Reply Value
++ Reported asynchronously through the ROAM_TBL_EVENT
+
-+SCAN_COMPLETE_EVENT
-+ A scan has completed (added status SCAN_ABORTED in release 2.0)
++Reset Value
++ None defined
+
-+TEST_EVENT
-+ Event generated by the TCMD
++Restrictions
++ None
+
-+TKIP_MICERROR
-+ TKIP MIC errors were detected
++See Also
++ SET_KEEPALIVE
+
+=====================================================================
+
++
+Name
-+ BSSINFO
++ GET_TARGET_STATS
+
+Synopsis
-+ Contains information describing one or more BSSs as collected during a scan.
-+ Information includes the BSSID, SSID, RSSI, network type, channel, supported rates,
-+ and IEs. BSSINFO events are sent only after the device receives a beacon or probe-
-+ response frame that pass the filter specified in the \93SET_BSS_FILTER\94 command.
-+ BSSINFO events consist of a small header followed by a copy of the beacon or probe
-+ response frame. The 802.11 header is not present. For formats of beacon and probe-
-+ response frames please consult the IEEE 802.11 specification.
++ The host uses this command to request that the target send the statistics that it
++ maintains. The statistics obtained from the target are accrued in the host every time
++ the GET_TARGET_STATS command is issued. The --clearStats option is added to
++ clear the target statistics maintained in the host.
+
-+ The beacons or probe responses containing the IE specified by the
-+ WMI_BSS_FILTER_CMD are passed to the host through the
-+ WMI_BSSINFO_EVENT. The event carries a 32-bit bitmask that indicates the IEs that
-+ were detected in the management frame. The frame type field has been extended to
-+ indicate action management frames. This would be helpful to route these frames
-+ through the same event mechanism as used by the beacon processing function.
++Command
++ wmiconfig --getTargetStats --clearStats
+
-+ If the bssFilter in the SET_BSS_FILTER matches, then the ieMask is not relevant
-+ because the BSSINFO event is sent to the host. If the bssFilter doesnot match in the
-+ beacons/probe respones, then the ieMask match dictates whether the BSSINFO
-+ event is sent to the host. In the case of action management frames, the ieMask is the
-+ filter that is applied.
++Command Parameters
++ TARGET_STATS targetStats
++ WMI_TARGET_STATS
++ UINT8 clearStats
+
-+Event ID
-+ 0x1004
+
-+Event Parameters
-+ typedef struct {
-+ A_UINT16 channel;
-+ Specifies the frequency (in MHz) where the
-+ frame was received
-+ A_UINT8 frameType;
-+ A WMI_BI_FTYPE value
-+ A_UINT8 snr;
-+ A_INT16 rssi;
-+ Indicates signal strength
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ A_UINT32 ieMask;
-+ } _ATTRIB_PACK_WMI_BSS_INFO_HDR;
++Reply Value
++ RSSI return value (0\96100)
+
-+ Beacon or Probe Response Frame
++Reset Values
++ All statistics are cleared (zeroed)
++
++Restrictions
++ The --getTargetStats option must be used; the --clearStats option is also available also
+
-+Event Values
-+ {
-+ BEACON_FTYPE = 0x1
-+ Indicates a beacon frame
-+ PROBERESP_FTYPE
-+ Indicates a probe response frame
-+ ACTION_MGMT_FTYPE
-+ } WMI_BI_FTYPE
+
+=====================================================================
+
+Name
-+ CAC_EVENTID
++ GET_TX_PWR
+
+Synopsis
-+ Indicates signalling events in admission control. Events are generated when
-+ admission is accepted, rejected, or deleted by either the host or the AP. If the AP does
-+ not respond to an admission request within a timeout of 500 ms, an event is
-+ generated to the host.
-+
-+Event ID
-+ 0x1011
++ The host uses this command to retrieve the current Tx power level
+
-+Event Parameters
-+ UINT8
-+ ac
-+ Access class pertaining to the
-+signalling
++Command
++ wmiconfig -i eth1 --getpower
+
-+ UINT8 cac_indication
-+ Type of indication; indications are
-+ listed in WMI_CAC_INDICATION
++Command Parameters
++ None
+
-+ UINT8 statusCode
-+ AP response status code for a
-+ request
++Reply Parameters
++ UINT16 dbM The current Tx power level specified in dbM
+
-+ UINT8 tspecSuggestion[63]
-+ Suggested TSPEC from AP
++Reset Values
++ The maximum permitted by the regulatory domain
+
-+Event Values
-+ {
-+ CAC_INDICATION_ADMISSION = 0x00
-+ CAC_INDICATION_ADMISSION_RESP = 0x01
-+ CAC_INDICATION_DELETE = 0x02
-+ CAC_INDICATION_NO_RESP = 0x03
-+ } WMI_CAC_INDICATION
++Restrictions
++ None
+
++See Also
++ \93SET_TX_PWR\94
+
+=====================================================================
+
+
+Name
-+ CMDERROR
++ GET_WOW_LIST
+
+Synopsis
-+ Indicates that the AR6000 device encountered an error while attempting to process a
-+ command. This error is fatal and indicates that the device requires a reset.
++ The host uses this command to retrieve the current list of WoW patterns.
+
-+Event ID
-+ 0x1005
++Command
++ wmiconfig \96getwowlist <list-id>
+
-+Event Parameters
-+ UINT16 commandId
-+ Corresponds to the command which generated
-+ the error
-+ UINT8 errorCode
-+ A WMI_ERROR_CODE value
++Command Parameters
++ A_UINT8 filter_list_id ID of the list of WoW patterns to retrieve
+
-+Event Values
-+ {
-+ INVALID_PARAM = 1
-+ Invalid parameter
-+ ILLEGAL_STATE = 2
-+ Illegal state
-+ INTERNAL_ERROR = 3
-+ Internal Error
-+ All other values reserved
-+ } WMI_ERROR_CODE
++Reply Value(s)
++ A_UINT16 num_filters Number of WoW patterns contained in the list
++ A_UINT8 wow_mode Current mode of WoW (enabled or disabled)
++ A_UINT8 host_mode Current host mode (asleep or awake)
++ WOW_FILTER wow_filters[1]
++ Contents of the WoW filter pattern list
++ (contains mask, pattern, offset and size
++ information for each of the patterns)
++
++Reset Value
++ None defined
++
++Restrictions
++ None
+
++See Also
++ \93SET_WSC_STATUS\94
+
+=====================================================================
+
+
+Name
-+ CONNECT
++ LQ_THRESHOLD_PARAMS
+
+Synopsis
-+ Signals that the AR6000 connected to a wireless network. Connection occurs due to a
-+ \93CONNECT\94 command or roaming to a new AP. For infrastructure networks, shows
-+ that the AR6000 successfully performed 802.11 authentication and AP association.
-+
-+Event ID
-+ 0x1002
-+
-+Event Parameters
-+ UINT16 channel
-+ Channel frequency (in MHz) of the network the
-+ AR6000 are connected to
-+
-+ UINT8 bssid[6]
-+ MAC address of the AP the AR6000 are
-+ connected to or the BSSID of the ad hoc
-+ network
-+
-+ UINT16 listenInterval
-+ Listen interval (in Kms) that the AR6000 are
-+ using
-+
-+ UINT 8 beaconIeLen
-+ Length (in bytes) of the beacon IEs
++ Sets Link Quality thresholds, the sampling will happen at every unicast data frame
++ Tx if a certain threshold is met, and the corresponding event will be sent to the host.
+
-+ UINT8 assocInfo
-+ Pointer to an array containing beacon IEs,
-+ followed first by association request IEs then by
-+ association response IEs
++Command
++ --lqThreshold <enable> <upper_threshold_1> ...
++ <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
+
-+ UINT8 assocReqLen
-+ Length (in bytes) of the assocReqIEs array
++Command Parameters
++ <enable> = 0 Disable link quality sampling
++ = 1 Enable link quality sampling
++ <upper_threshold_x> Above thresholds (value in [0,100]), in
++ ascending order
++ <lower_threshold_x> Below thresholds (value in [0,100]), in
++ ascending order
+
-+ UINT8 assocRespLen
-+ Length (in bytes) of the assocRespIEs array
++Command Values
++ See command parameters
+
-+Event Values
++Reset Value
+ None defined
+
++Restrictions
++ None
++
+=====================================================================
+
+
+Name
-+ DISCONNECT
++ OPT_TX_FRAME
+
+Synopsis
-+ Signals that the AR6000 device lost connectivity with the wireless network.
-+ DISCONENCT is generated when the device fails to complete a \93CONNECT\94
-+ command or as a result of a transition from a connected state to disconnected state.
-+
-+ After sending the \93DISCONNECT\94 event the device continually tries to re-establish
-+ a connection. A LOST_LINK occurs when STA cannot receive beacons within the
-+ specified time for the SET_BMISS_TIME command.
-+
-+Event ID
-+ 0x1003
-+
-+Event Parameters
-+ UINT8 disconnect
-+ Reason
-+ A WMI_DISCONNECT_REASON value
-+
-+ UINT8 bssid[6]
-+ Indicates which BSS the device was connected to
-+
-+ UINT8 assocRespLen
-+ Length of the 802.11 association response frame
-+ that triggered this event, or 0 if not applicable
++ Special feature, sends a special frame.
+
-+ UINT8 assocInfo[assocRespLen]
-+ Copy of the 802.11 association response frame
++Command
++ wmiconfig --sendframe <frmType> <dstaddr> <bssid> <optIEDatalen>
++ <optIEData>
+
-+Event Values
++Command Parameters
+ {
-+ NO_NETWORK_AVAIL =0x01
-+ Indicates that the device was unable to
-+ establish or find the desired network
-+ LOST_LINK =0x02
-+ Indicates the devices is no longer receiving
-+ beacons from the BSS it was previously
-+ connected to
++ A_UINT16 optIEDataLen;
++ A_UINT8 frmType;
++ A_UINT8 dstAddr[ATH_MAC_LEN];
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT8 optIEData[1];
++ } WMI_OPT_TX_FRAME_CMD;
+
-+ DISCONNECT_CMD =0x03
-+ Indicates a \93DISCONNECT\94 command was
-+ processed
-+ BSS_DISCONNECTED =0x04
-+ Indicates the BSS explicitly disconnected the
-+ device. Possible mechanisms include the AP
-+ sending 802.11 management frames
-+ (e.g., disassociate or deauthentication
-+ messages).
-+ AUTH_FAILED =0x05
-+ Indicates that the device failed 802.11
-+ authentication with the BSS
-+ ASSOC_FAILED =0x06
-+ Indicates that the device failed 802.11
-+ association with the BSS
-+ NO_RESOURCES_AVAIL =0x07
-+ Indicates that a connection failed because the
-+ AP had insufficient resources to complete the
-+ connection
-+ CSERV_DISCONNECT =0x08
-+ Indicates that the device\92s connection services
-+ module decided to disconnect from a BSS,
-+ which can happen for a variety of reasons (e.g.,
-+ the host marks the current connected AP as a
-+ bad AP).
-+ INVALID_PROFILE =0x0A
-+ Indicates that an attempt was made to
-+ reconnect to a BSS that no longer matches the
-+ current profile
-+ All other values are reserved
-+ } WMI_DISCONNECT_REASON
++Command Values
++ <frmtype> = 1 Probe request frame
++ = 2 Probe response frame
++ = 3 CPPP start
++ = 4 CPPP stop
+
++Reset Value
++ None defined
++
++Restrictions
++ Send a special frame only when special mode is on.
+
+=====================================================================
+
+
+Name
-+ ERROR_REPORT
++ RECONNECT
+
+Synopsis
-+ Signals that a type of error has occurred for which the host previously requested
-+ notification through the \93TARGET_ERROR_REPORT_BITMASK\94 command.
-+
-+Event ID
-+ 0x100D
-+
-+Event Parameters
-+ UINT32 errorVal
-+ WMI_TARGET_ERROR_VAL value. See
-+ \93TARGET_ERROR_REPORT_BITMASK\94.
++ This command requests a reconnection to a BSS to which the AR6000 device was
++ formerly connected
+
-+Event Values
-+ errorVal
-+ = 0x00000001
-+ Power save fails
++Command
++ TBD
+
-+ = 0x00000002
-+ No cipher key
++Command Parameters
++ UINT16 channel Provides a hint as to which channel was
++ used for a previous connection
++ UINT8 bssid[6] If set, indicates which BSSID to connect to
+
-+ = 0x00000004
-+ Decryption error
++Command Values
++ None
+
-+ = 0x00000008
-+ Beacon miss
++Reset Values
++ None
+
-+ = 0x00000010
-+ A non-power save disabled node has joined
-+ the PS-enabled network
++Restrictions
++ None
+
++See Also
++ \93CONNECT_CMD\94
+
+=====================================================================
+
+
+Name
-+ EXTENSION
++ RSSI_THRESHOLD_PARAMS
+
+Synopsis
-+ The WMI is used mostly for wireless control messages to a wireless module that
-+ apply to wireless module management regardless of the target platform
-+ implementation. However, some events peripherally related to wireless management
-+ are desired during operation. These wireless extension events may be platform-
-+ specific or implementation-dependent. See \93WMI Extension Commands\94
-+
-+
-+Event ID
-+ 0x1010
++ Configures how the AR6000 device monitors and reports signal strength (RSSI) of the
++ connected BSS, which is used as a link quality metric. The four RSSI threshold sets (in
++ dbM) of the host specification divide the signal strength range into six segments.
++ When signal strength increases or decreases across one of the boundaries, an
++ RSSI_THRESHOLD event is signaled to the host. The host may then choose to take
++ action (such as influencing roaming).
+
++Command
++ wmiconfig eth1 --rssiThreshold <weight> <pollTime>
++ <above_threshold_val_1> ... <above_threshold_tag_6>
++ <above_threshold_val_6>
++ <below_threshold_tag_1> <below_threshold_val_1> ...
++ <below_threshold_tag_6> <below_threshold_val_6>
++
++Command Parameters
++ UINT8 weight Range in [1, 16] used to calculate average RSSI
++ UINT32 pollTime RSSI (signal strength) sampling frequency in
++ seconds (if pollTime = 0, single strength
++ sampling is disabled)
++ USER_RSS__THOLD tholds[12] Thresholds (6 x 2)
++
++Command Values
++ None defined
++
++Reset Values
++ pollTime is 0, and sampling is disabled
++
++Restrictions
++ Can only be issued if the AR6000 device is connected
+
-+=====================================================================
+
++=====================================================================
+
+Name
-+ GET_PMKID_LIST_EVENT
++ SCAN_PARAMS
+
+Synopsis
-+ Generated by firmware in response to a \93GET_PMKID_LIST_CMD\94 command.
++ The minact parameter determines the minimum active channel dwell time, within
++ which if the STA receives any beacon, it remains on that channel until the maxact
++ channel dwell time. If the STA does not receive a beacon within the minact dwell
++ time, it switches to scan the next channel.
+
-+Event Parameters
-+ typedef struct {
-+ A_UINT32 numPMKID;
-+ Contains the number of PMKIDs in the reply
-+ WMI_PMKID pmkidList[1];
-+ } __ATTRIB_PACK WMI_PMKID_LIST_REPLY;
++Command
++ wmiconfig -scan -minact=<ms> --maxact=<ms>
+
-+Event Values
-+ None
++Command Parameters
++ UINT16 maxact Channel dwell time (in ms), default = 0
++ UINT16 minact Channel dwell time (in ms), default = 105
++
++Command Values
++ See channel parameters
++
++Reset Values
++ None defined
+
++Restrictions
++ The minact value should be greater than 0; maxact should be between 5\9665535 ms
++ and greater than minact
+
+=====================================================================
+
+
+Name
-+ GET_WOW_LIST_EVENT
++ SET_ACCESS_PARAMS
+
+Synopsis
-+ Response to the wmiconfig \96getwowlist command to retrieve the configured Wake on
-+ Wireless patterns
++ Allows the host to set access parameters for the wireless network. A thorough
++ understanding of IEEE 802.11 is required to properly manipulate these parameters.
+
-+Event ID
-+ 0x10018
++Command
++ wmiconfig eth1 --acparams --txop <limit> --cwmin <0-15>
++ --cwmax <0-15> --aifsn<0-15>
+
-+Event Parameters
-+ {
++Command Parameters
++ UINT16 txop The maximum time (expressed in units of
++ 32 ms) the device can spend transmitting
++ after acquiring the right to transmit
++ UINT8 eCWmin Minimum contention window
++ UINT8 eCWmax Maximum contention window
++ UINT8 aifsn The arbitration inter-frame space number
+
-+ A_UINT8 num_filters
-+ Total number of patterns in the list
-+ A_UINT8 this_filter_num
-+ The filter number
-+ A_UINT8 wow_mode
-+ Shows whether WoW is enabled or disabled
-+ A_UINT8 host_mode
-+ Shows whether the host is asleep or awake
-+ WOW_FILTER wow_filters[1]
-+ List of WoW filters (pattern and mask data bytes)
-+ } WMI_GET_WOW_LIST_REPLY;
++Command Values
++ None
+
-+ {
-+ Each wow_filter_list element shows:
-+ A_UINT8 wow_valid_filter
-+ Whether the filter is valid
-+ A_UINT8 wow_filter_list_id
-+ Filter List ID (23 = default)
-+ A_UINT8 wow_filter_size
-+ Size in bytes of the filter
-+ A_UINT8 wow_filter_offset
-+ Offset of the pattern to search in the data packet
-+ A_UINT8 wow_filter_mask[MASK_SIZE]
-+ The mask to be applied to the pattern
-+ A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE]
-+ The pattern that to match to wake up the host
-+ } WOW_FILTER
++Reset Values
++ Reasonable defaults that vary, between endpoints (prioritized streams)
+
-+Event Values
++Restrictions
+ None
+
+=====================================================================
+
+
-+
+Name
-+ NEIGHBOR_REPORT
++ SET_ADHOC_BSSID
+
+Synopsis
-+ Indicates the existence of neighbor APs that match the current profile. The host uses
-+ this event to populate the PMKID cache on the AR6000 and/or to perform
-+ preauthentication. This event is only generated in infrastructure mode.
-+
-+ A total of numberOfAps pairs of bssid/bssFlags exist, one pair for each AP.
++ Allows the host to set the BSSID for an ad hoc network. If a network with this BSSID
++ is not found, the target creates an ad hoc network with this BSSID after the connect
++ WMI command is triggered (e.g., by the SIOCSIWESSID IOCTL).
+
-+Event ID
-+ 0x1008
++Command
++ wmiconfig eth1 --adhocbssid <bssid>
+
-+Event Parameters
-+ UINT8 numberOfAps
-+ The number of APs reported about in
-+ this event
-+ {
-+ UINT8 bssid[6]
-+ MAC address of a neighbor AP
-+ UINT8 bssFlags
-+ A WMI_BSS_FLAGS value
-+ }[numberOfAps]
++Command Parameters
++ A_UINT8 bssid[ATH_MAC_LEN] BSSID is specified in xx:xx:xx:xx:xx:xx format
+
++Command Values
++ None
+
-+Event Values
-+ {
-+ WMI_DEFAULT_BSS_FLAGS = 0
-+ Logical OR of 1 or more
-+ WMI_BSS_FLAGS
-+ WMI_PREAUTH_CAPABLE_BSS
-+ = 1
-+ Indicates that this AP is capable of
-+ preauthentication
-+ WMI_PMKID_VALID_BSS
-+ = 2
-+ Indicates that the AR6000 have a
-+ valid pairwise master key for this AP
-+ } WMI_BSS_FLAGS
++Reset Values
++ None
+
++Restrictions
++ None
+
+=====================================================================
+
+
-+
+Name
-+ OPT_RX_FRAME_EVENT
++ SET_AKMP_PARAMS
+
+Synopsis
-+ Special feature, informs host of the reception of a special frame.
++ Enables or disables multi PMKID mode.
+
-+Event ID
-+ 0x100E
++Command
++ wmiconfig eth1 --setakmp --multipmkid=<on/off>
+
-+Event Parameters
-+ {
-+ A_UINT16 channel;
-+ A_UINT8 frameType;
-+ A_INT8 snr;
-+ A_UINT8 srcAddr[ATH_MAC_LEN];
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ }WMI_OPT_RX_INFO_HDR
++Command Parameters
++ typedef struct {
++ A_UINT32 akmpInfo;
++ } WMI_SET_AKMP_PARAMS_CMD;
+
-+Event Values
++Command Values
++ akmpInfo;
++ bit[0] = 0
++ MultiPMKID mode is disabled and PMKIDs that
++ were set using the WMI_SET_PMKID_CMD are
++ used in the [Re]AssocRequest frame.
++ bit[0] = 1
++ MultiPMKID mode is enabled and PMKIDs issued
++ by the WMI_SET_PMKID_LIST_CMD are used in
++ the next [Re]AssocRequest sent to the AP.
++
++Reset Values
++ MultiPMKID mode is disabled
++
++Restrictions
+ None
+
+=====================================================================
+
+
-+
+Name
-+ PSTREAM_TIMEOUT
++ SET_APPIE
+
+Synopsis
-+ Indicates that a priority stream that got created as a result of priority-marked data
-+ flow (priority marked in IP TOS) being idle for the default inactivity interval period
-+ (specified in the \93CREATE_PSTREAM\94 command) used for priority streams created
-+ implicitly by the driver. This event is not indicated for user-created priority streams.
-+ User-created priority streams exist until the users delete them explicitly. They do not
-+ timeout due to data inactivity.
++ Add an application-specified IE to a management frame. The maximum length is
++ 76 bytes. Including the length and the element ID, this translates to 78 bytes.
+
-+Event ID
-+ 0x1007
++Command
++ wmiconfig --setappie <frame> <IE>, where:
+
-+Event Parameters
-+ A_UINT8
-+ trafficClass
-+ Indicated the traffic class of priority
-+ stream that timed out
++ frame
++ One of beacon, probe, respon, assoc
+
-+Event Values
-+ {
-+ WMM_AC_BE = 0
-+ Best effort
-+ WMM_AC_BK = 1
-+ Background
-+ WMM_AC_VI = 2
-+ Video
-+ WMM_AC_VO = 3
-+ Voice
-+ } TRAFFIC CLASS
++ IE
++ A hex string beginning with DD (if = 0, no
++ IE is sent in the management frame)
++
++Command Parameters
++ mgmtFrmType;
++ A WMI_MGMT_FRAME_TYPE
++
++ ieLen;
++ Length of the IE to add to the GMT frame
++
++Command Values
++ None
++
++Reset Value
++ None defined
+
++Restrictions
++ Supported only for the probe request and association request management frame
++types. Also, only one IE can be added per management frame type.
+
+=====================================================================
+
++
+Name
-+ READY
++ SET_ASSOC_INFO
+
+Synopsis
-+ Indicates that the AR6000 device is prepared to accept commands. It is sent once after
-+ power on or reset. It also indicates the MAC address of the device.
++ The host uses this command to specify any information elements (IEs) it wishes the
++ AR6000 device to add to all future association and reassociation requests. IEs must be
++ correct and are used as is by the device. IEs specified through this command are
++ cleared with a DISCONNECT.
+
-+Event ID
-+ 0x1001
++Command
++ wmiconfig eth1 --setAssocIe <IE>
+
-+Event Parameters
-+ UINT8 macAddr[6]
-+ Device MAC address
-+ UINT8 phyCapability
-+ A WMI_PHY_CAPABILITY value. Indicates the
-+ capabilities of the device wireless module\92s radio
++Command Parameters
++ UINT8 ieType Used directly in 802.11 frames
++ UINT8 bufferSize Size of assocInfo (in bytes) ranging from
++ 0\96240. If = 0, previously set IEs are cleared.
++ UINT8 assocInfo[bufferSize] Used directly in 802.11 frames
+
-+Event Values
-+ {
-+ WMI_11A_CAPABILITY = 1
-+ WMI_11G_CAPABILITY = 2
-+ WMI_11AG_CAPABILITY = 3
-+ } WMI_PHY_CAPABILITY
++Command Values
++ None
+
++Reset Values
++ IEs are cleared
++
++Restrictions
++ This command can only be issued in the DISCONNECTED state
+
+=====================================================================
+
++
+Name
-+ REGDOMAIN
++ SET_AUTHMODE
+
+Synopsis
-+ Indicates that the regulatory domain has changed. It initially occurs when the
-+ AR6000 device reads the board data information. The regulatory domain can also
-+ change when the device is a world-mode SKU. In this case, the regulatory domain is
-+ based on the country advertised by APs per the IEEE 802.11d specification. A
-+ potential side effect of a regulatory domain change is a change in the list of available
-+ channels. Any channel restrictions that exist as a result of a previous
-+ \93SET_CHANNEL_PARAMETERS\94 command are lifted.
++ Sets the 802.11 authentication mode of reconnection
+
-+Event ID
-+ 0x1006
++Command
++ wmiconfig eth1 --setauthmode <mode>
+
-+Event Parameters
-+ UINT32 regDomain
-+ The range of 0x0000 \96 0x00FF
-+ corresponds to an ISO country code.
++Command Parameters
++ UINT8 mode
+
-+ Other regCodes are reserved for world
-+ mode settings and specific regulatory
-+ domains.
++Command Values
++ mode = 0x00 Proceed with authentication during reconnect
++ = 0x01 Do not proceed with authentication during reconnect
+
-+Event Values
-+ None
++Reset Values
++ Authentication
+
++Restrictions
++ None
+
+=====================================================================
+
+
-+
+Name
-+ REPORT_STATISTICS
++ SET_BEACON_INT
+
+Synopsis
-+ A reply to a \93GET_TARGET_STATS\94 command.
++ Sets the beacon interval for an ad hoc network. Beacon interval selection may have an
++ impact on power savings. To some degree, a longer interval reduces power
++ consumption but also decreases throughput. A thorough understanding of IEEE
++ 802.11 ad hoc networks is required to use this command effectively.
+
-+Event ID
-+ 0x100B
++Command
++ wmiconfig eth1 --ibssconintv
+
-+Event Parameters
-+ When the statistics are sent to the host, the AR6001 clear them so that a new set of
-+ statistics are collected for the next report.
++Command Parameters
++ UINT16 beaconInterval Specifies the beacon interval in TU units (1024 ms)
+
-+ UINT32 tx_packets
-+ UINT32 tx_bytes
-+ UINT32 tx_unicast_pkts
-+ UINT32 tx_unicast_bytes
-+ UINT32 tx_multicast_pkts
-+ UINT32 tx_multicast_bytes
-+ UINT32 tx_broadcast_pkts
-+ UINT32 tx_broadcast_bytes
-+ UINT32 tx_rts_success_cnt
-+ UINT32 tx_packet_per_ac[4]
-+ Tx packets per AC: [0] = BE, [1] = BK,
-+ [2] = VI, [3] = VO
-+ UINT32 tx_errors
-+ Number of packets which failed Tx, due
-+ to all failures
-+ ... REPORT_STATISTICS, continued
-+ UINT32 tx_failed_cnt
-+ Number of data packets that failed Tx
-+ UINT32 tx_retry_cnt
-+ Number of Tx retries for all packets
-+ UINT32 tx_rts_fail_cnt
-+ Number of RTS Tx failed count
-+ UINT32 rx_packets
-+ UINT32 rx_bytes
-+ UINT32 rx_unicast_pkts
-+ UINT32 rx_unicast_bytes
-+ UINT32 rx_multicast_pkts
-+ UINT32 rx_multicast_bytes
-+ UINT32 rx_broadcast_pkts
-+ UINT32 rx_broadcast_bytes
-+ UINT32 rx_fragment_pkt
-+ Number of fragmented packets received
-+ UINT32 rx_errors
-+ Number of Rx errors due to all failures
-+ UINT32 rx_crcerr
-+ Number of Rx errors due to CRC errors
-+ UINT32 rx_key_cache_miss
-+ Number of Rx errors due to a key not
-+ being plumbed
-+ UINT32 rx_decrypt_err
-+ Number of Rx errors due to decryption
-+ failure
-+ UINT32 rx_duplicate_frames
-+ Number of duplicate frames received
-+ UINT32 tkip_local_mic_failure
-+ Number of TKIP MIC errors detected
-+ UINT32 tkip_counter_measures_invoked
-+ Number of times TKIP countermeasures
-+ were invoked
-+ UINT32 tkip_replays
-+ Number of frames that replayed a TKIP
-+ encrypted frame received earlier
-+ UINT32 tkip_format_errors
-+ Number of frames that did not conform
-+ to the TKIP frame format
-+ UINT32 ccmp_format_errors
-+ Number of frames that did not conform
-+ to the CCMP frame format
-+ UINT32 ccmp_replays
-+ Number of frames that replayed a CCMP
-+ encrypted frame received earlier
-+ UINT32 power_save_failure_cnt
-+ Number of failures that occurred when
-+ the AR6001 could not go to sleep
-+ UINT32 cs_bmiss_cnt
-+ Number of BMISS interrupts since
-+ connection
-+ UINT32 cs_lowRssi_cnt
-+ Number of the times the RSSI went below
-+ the low RSSI threshold
-+ UINT16 cs_connect_cnt
-+ Number of connection times
-+ UINT16 cs_disconnect_cnt
-+ Number of disconnection times
-+ UINT8 cs_aveBeacon_rssi
-+ The current averaged value of the RSSI
-+ from the beacons of the connected BSS
-+ UINT8 cs_lastRoam_msec
-+ Time that the last roaming took, in ms.
-+ This time is the difference between
-+ roaming start and actual connection.
++Command Values
++ None
+
-+Event Values
-+ None defined
++Reset Values
++ The default beacon interval is 100 TUs (102.4 ms)
++
++Restrictions
++ This command can only be issued before the AR6000 device starts an ad hoc network
+
++See Also
++ \93SET_IBSS_PM_CAPS\94
+
+=====================================================================
+
++
+Name
-+ ROAM_TBL_EVENT
++ SET_BIT_RATE
+
+Synopsis
-+ Reports the roam table, which contains the current roam mode and this information
-+ for every BSS:
-+
-+Event ID
-+ 0x100F
++ The host uses this command to set the AR6000 device to a specific fixed rate.
+
-+Event Parameters
-+ A_UINT8 bssid[ATH_MAC_LEN];
-+ BSSID
-+ A_UINT8 rssi
-+ Averaged RSSI
-+ A_UINT8 rssidt
-+ Change in RSSI
-+ A_UINT8 last_rssi
-+ Last recorded RSSI
-+ A_UINT8 roam_util
-+ Utility value used in roaming decision
-+ A_UINT8 util
-+ Base utility with the BSS
-+ A_UINT8 bias
-+ Host configured for this BSS
++Command
++ wmiconfig eth1 --setfixrates <rate_0> ... <rate_n>
+
-+Event Values
-+ roamMode
-+ Current roam mode
++Command Parameters
++ INT8 rateIndex
++ A WMI_BIT_RATE value
++ {
++ RATE_AUTO = -1
++ RATE_1Mb = 0
++ RATE_2Mb = 1
++ RATE_5_5M = 2
++ RATE_11Mb = 3
++ RATE_6Mb = 4
++ RATE_9Mb = 5
++ RATE_12Mb = 6
++ RATE_18Mb = 7
++ RATE_24Mb = 8
++ RATE_36Mb = 9
++ RATE_48Mb = 10
++ RATE_54Mb = 11
++ } WMI_BIT_RATE
+
-+ = 1
-+ RSSI based roam
+
-+ = 2
-+ Host bias-based roam
++Command Values
++ See command parameters
+
-+ = 3
-+ Lock to the current BSS
++Reset Values
++ The dynamic rate is determined by the AR6000 device
+
-+ = 4
-+ Autonomous roaming disabled
++Restrictions
++ This command is intended for use only during development/debug; it is not
++intended for use in production
+
++See Also
++ \93GET_BIT_RATE\94
+
+=====================================================================
+
++
+Name
-+ RSSI_THRESHOLD
++ SET_BMISS_TIME
+
+Synopsis
-+ Alerts the host that the signal strength from the connected AP has crossed a
-+ interesting threshold as defined in a previous \93RSSI_THRESHOLD_PARAMS\94
-+ command.
-+
-+Event ID
-+ 0x100C
++ This command sets the beacon miss (BMISS) time, which the AR6000 hardware use
++ to recognize missed beacons. When an excessive number (15) of consecutive beacons
++ are missed, the AR6000 consider switching to a different BSS. The time can be
++ specified in number of beacons or in TUs.
+
-+Event Parameters
-+ UINT8 range
-+ A WMI_RSSI_THRESHOLD_VAL
-+ value, which indicates the range of
-+ the average signal strength
++Command(s)
++ wmiconfig eth1 --setbmissbeacons=<val>
++ wmiconfig eth1 --setbmisstime=<val>
+
-+Event Values
-+ {
-+ WMI_RSSI_LOWTHRESHOLD_BELOW_LOWERVAL = 1
-+ WMI_RSSI_LOWTHRESHOLD_LOWERVAL = 2
-+ WMI_RSSI_LOWTHRESHOLD_UPPERVAL = 3
-+ WMI_RSSI_HIGHTHRESHOLD_LOWERVAL = 4
-+ WMI_RSSI_HIGHTHRESHOLD_HIGHERVAL = 5
-+ } WMI_RSSI_THRESHOLD_VAL
++Command Parameters
++ UINT16 bmissTime Specifies the beacon miss time
++ [1000...5000] in TUs (1024 ms)
++ UINT16 bmissbeacons Specifies the number of beacons [5...50]
++
++Command Values
++ None
++
++Reset Values
++ bmissTime is 1500 TUs (1536 ms)
+
++Restrictions
++ None
+
+=====================================================================
+
++
+Name
-+ SCAN_COMPLETE_EVENT
++ SET_BSS_FILTER
+
+Synopsis
-+ Indicates the scan status. if the Scan was not completed, this event is generated with
-+ the status A_ECANCELED.
-+
-+Event ID
-+ 0x100A
-+
-+Event Parameters
-+ A_UINT8 scanStatus
++ The host uses this to inform the AR6000 device of the types of networks about which
++ it wants to receive information from the \93BSSINFO\94 event. As the device performs
++ either foreground or background scans, it applies the filter and sends \93BSSINFO\94
++ events only for the networks that pass the filter. If any of the bssFilter or the ieMask
++ filter matches, a BSS Info is sent to the host. The ieMask currently is used as a match
++ for the IEs in the beacons, probe reponses and channel switch action management
++ frame. See also \93Scan and Roam\94 on page C-1.
+
-+Event Values
-+ {
-+ #define SCAN_ABORTED 16
-+ #define SCAN_COMPLETED 0
-+ A_UINT8 scanStatus
-+ A_OK or A_ECANCELED
-+ } WMI_SCAN_COMPLETE_EVENT;
++ The BSS filter command has been enhanced to support IE based filtering. The IEs can
++ be specified as a bitmask through this command using this enum.
+
++Command
++ wmiconfig eth1 \96filter = <filter> --ieMask 0x<mask>
+
-+=====================================================================
++Command Parameters
++ UINT8 BssFilter
+
-+Name
-+ TEST_EVENT
++ Command Values
++ typedef struct {
++ A_UINT8 bssFilter; See WMI_BSS_FILTER
++ A_UINT32 ieMask;
++ } __ATTRIB_PACK WMI_BSS_FILTER_CMD;
+
-+Synopsis
-+ The TCMD application uses a single WMI event (WMI_TEST_EVENTID) to
-+ communicate events from target to host. The events are parsed by the TCMD
-+ application and WMI layer is oblivious of it.
++ The ieMask can take this combination of values:
+
-+Event ID
-+ 0x1016
++ enum {
++ BSS_ELEMID_CHANSWITCH = 0x01
++ BSS_ELEMID_ATHEROS = 0x02,
++ }
+
-+Event Parameters
-+ WMI_TEST_EVENTID
++Reply Value
++ None
+
++Reset Value
++ BssFilter = NONE_BSS_FILTER (0)
+
-+Event Values
++Restrictions
+ None
+
++See Also
++ \93CONNECT_CMD\94
+
+=====================================================================
+
+
-+
+Name
-+ TKIP_MICERR
++ SET_BT_PARAMS
+
+Synopsis
-+ Indicates that TKIP MIC errors were detected.
-+
-+Event ID
-+ 0x1009
-+
-+Event Parameters
-+ UINT8 keyid
-+ Indicates the TKIP key ID
-+
-+ UINT8 ismcast
-+ 0 = Unicast
-+ 1 = Multicast
-+
-+Event Values
-+ See event parameters
-+
-+=====================================================================
++ This command is used to set the status of a Bluetooth stream or set Bluetooth
++ coexistence register parameters. The stream may be an SCO or an A2DP stream and
++ its status can be started/stopped/suspended/resumed.
+
-+WMI Extension Commands
++Command
++ wmiconfig
\96setBTparams <paramType> <params>
+
-+The WMI EXTENSION command is used to multiplex a collection of
-+commands that:
++Command Parameters
++ struct {
++ union {
++ BT_PARAMS_SCO scoParams;
++ BT_PARAMS_A2DP a2dpParams;
++ BT_PARAMS_MISC miscParams;
++ BT_COEX_REGS regs;
++ } info;
++ A_UINT8 paramType;
++ struct {
++ A_UINT8 noSCOPkts; Number of SCO packets between consecutive PS-POLLs
++ A_UINT8 pspollTimeout;
++ A_UINT8 stompbt;
++ } BT_PARAMS_SCO;
++ struct {
++ A2DP BT stream parameters
++ A_UINT32 period;
++ A_UINT32 dutycycle;
++ A_UINT8 stompbt;
++ } BT_PARAMS_A2DP;
++ struct {
++ union {
++ WLAN_PROTECT_POLICY_TYPE protectParams;
++ A_UINT16 wlanCtrlFlags;
++ }info;
++ A_UINT8 paramType;
++ } BT_PARAMS_MISC;
++ struct {
++ BT coexistence registers values
++ A_UINT32 mode; Coexistence mode
++ A_UINT32 scoWghts; WLAN and BT weights
++ A_UINT32 a2dpWghts;
++ A_UINT32 genWghts;
++ A_UINT32 mode2; Coexistence mode2
++ A_UINT8 setVal;
++ } BT_COEX_REGS;
+
-+ Are not generic wireless commands
-+ May be implementation-specific
-+ May be target platform-specific
-+ May be optional for a host implementation
++Command Values
++ None defined
+
-+ An extension command is sent to the AR6000 targets like any other WMI
-+command message and uses the WMI_EXTENSION. The first field of the
-+payload for this EXTENSION command is another commandId, sometimes
-+called the subcommandId, which indicates which extension command is
-+being used. A subcommandId-specific payload follows the subcommandId.
++Reset Value
++ None
+
-+All extensions (subcommandIds) are listed in the header file include/wmix.h.
-+See also \93WMI Extension Events\94 on page B-58.
++Restrictions
++ None
+
++=====================================================================
+
-+WMI Extension Commands
+
++Name
++ SET_BT_STATUS
+
-+GPIO_INPUT_GET
-+ Read GPIO pins configured for input
++Synopsis
++ Sets the status of a Bluetooth stream. The stream may be a SCO or an A2DP stream
++ and its status can be started/stopped/suspended/resumed.
+
-+GPIO_INTR_ACK
-+ Acknowledge and re-arm GPIO interrupts reported earlier
++Command
++ wmiconfig \96setBTstatus <streamType> <status>
+
-+GPIO_OUTPUT_SET
-+ Manage output on GPIO pins configured for output
++Command Parameters
++ {
++ A_UINT8 streamType; Stream type
++ A_UINT8 status; Stream status
++ }WMI_SET_BT_STATUS_CMD;
+
-+GPIO_REGISTER_GET
-+ Read an arbitrary GPIO register
++Command Values
++ {
++ BT_STREAM_UNDEF = 0
++ BT_STREAM_SCO
++ SCO stream
++ BT_STREAM_A2DP
++ A2DP stream
++ BT_STREAM_MAX
++ } BT_STREAM_TYPE;
+
-+GPIO_REGISTER_SET
-+ Dynamically change GPIO configuration
++ {
++ BT_STATUS_UNDEF = 0
++ BT_STATUS_START
++ BT_STATUS_STOP
++ BT_STATUS_RESUME
++ BT_STATUS_SUSPEND
++ BT_STATUS_MAX
++ } BT_STREAM_STATUS;
+
-+SET_LQTHRESHOLD
-+ Set link quality thresholds; the sampling happens at every unicast
-+ data frame Tx, if certain thresholds are met, and corresponding
-+ events are sent to the host
++Reset Value
++ None defined
+
++Restrictions
++ None
+
+=====================================================================
+
++
+Name
-+ GPIO_INPUT_GET
++ SET_CHANNEL_PARAMETERS
+
+Synopsis
-+ Allows the host to read GPIO pins that are configured for input. The values read are
-+ returned through a \93GPIO_DATA\94 extension event.
-+
-+NOTE: Support for GPIO is optional.
++ Configures various WLAN parameters related to channels, sets the wireless mode,
++ and can restrict the AR6000 device to a subset of available channels. The list of
++ available channels varies depending on the wireless mode and the regulatory
++ domain. The device never operates on a channel outside of its regulatory domain. The
++ device starts to scan the list of channels right after this command.
+
+Command
-+ N/A
++ wmiconfig eth1 --wmode <mode> <list>
+
+Command Parameters
-+ None
-+
-+
-+
-+Reply Parameters
-+ None
-+
-+
-+Reset Value
-+ None
++ UINT8 phyMode See Values below.
++ UINT8 numberOfChannels
++ Number of channels in the channel array that
++ follows. If = 0, then the device uses all of the
++ channels permitted by the regulatory domain
++ and by the specified phyMode.
++ UINT16 channel[numberOfChannels]
++ Array listing the subset of channels (expressed
++ as frequencies in MHz) the host wants the
++ device to use. Any channel not permitted by
++ the specified phyMode or by the specified
++ regulatory domain is ignored by the device.
+
++Command Values
++ phyMode = {
++ Wireless mode
++ 11a = 0x01
++ 11g = 0x02
++ 11ag = 0x03
++ 11b = 0x04
++ 11g only = 0x05
++ }
+
++Reset Values
++ phyMode
++ 11ag
++ 802.11a/g modules
++ 11g
++ 802.11g module
++ channels
++ Defaults to all channels permitted by the
++ current regulatory domain.
+
+Restrictions
-+ None
++ This command, if issued, should be issued soon after reset and prior to the first
++ connection. This command should only be issued in the DISCONNECTED state.
+
+=====================================================================
+
+
+Name
-+ GPIO_INTR_ACK
++ SET_DISC_TIMEOUT
+
+Synopsis
-+ The host uses this command to acknowledge and to re-arm GPIO interrupts reported
-+ through an earlier \93GPIO_INTR\94 extension event. A single \93GPIO_INTR_ACK\94
-+ command should be used to acknowledge all GPIO interrupts that the host knows to
-+ be outstanding (if pending interrupts are not acknowledged through
-+ \93GPIO_INTR_ACK\94, another \93GPIO_INTR\94 extension event is raised).
++ The host uses this command to configure the amount of time that the AR6000 should
++ spend when it attempts to reestablish a connection after losing link with its current
++ BSS. If this time limit is exceeded, the AR6000 send a \93DISCONNECT\94 event. After
++ sending the \93DISCONNECT\94 event the AR6000 continues to attempt to reestablish a
++ connection, but they do so at the interval corresponding to a foreground scan as
++ established by the \93SET_SCAN_PARAMS\94 command.
+
-+NOTE: Support for GPIO is optional.
++ A timeout value of 0 indicates that the AR6000 will disable all autonomous roaming,
++ so that the AR6000 will not perform any scans after sending a \93DISCONNECT\94
++ event to the host. The state is maintained until a shutdown or host sets different
++ timeout value from 0.
+
+Command
-+ N/A
++ wmiconfig eth1 --disc=<timeout in seconds>
+
+Command Parameters
-+ UINT32 ack_mask
-+ A mask of interrupting GPIO pins (e.g., ack_mask
-+ bit [3] acknowledges an interrupt from the pin GPIO3).
++ UINT8 disconnectTimeout
++ Specifies the time limit (in seconds) after
++ which a failure to reestablish a connection
++ results in a \93DISCONNECT\94 event
+
+Command Values
+ None
+
-+Reset Value
-+ None
++Reset Values
++ disconnectTimeout is 10 seconds
+
+Restrictions
-+ The host should acknowledge only interrupts about which it was notified.
-+
++ This command can only be issued while in a DISCONNECTED state
+
+=====================================================================
+
++
+Name
-+ GPIO_OUTPUT_SET
++ SET_FIXRATES
+
+Synopsis
-+ Manages output on GPIO pins configured for output.
-+
-+ Conflicts between set_mask and clear_mask or enable_mask and disable_mask result
-+ in undefined behavior.
++ By default, the AR6000 device uses all PHY rates based on mode of operation. If the
++ host application requires the device to use subset of supported rates, it can set those
++ rates with this command. In 802.11g mode, the AR6000 device takes the entire
++ 802.11g basic rate set and the rates specified with this command and uses it as the
++ supported rate set.
+
-+NOTE: Support for GPIO is optional.
++ This rate set is advertised in the probe request and the assoc/re-assoc request as
++ supported rates. Upon successful association, the device modifies the rate set pool
++ using the: intersection of AP-supported rates with the union of the 802.11g basic rate
++ set and rates set using this command. The device picks transmission rates from this
++ pool based on a rate control algorithm.
+
+Command
-+ N/A
++ TBD
+
+Command Parameters
-+ UINT32 set_mask
-+ Specifies which pins should drive a 1 out
-+ UINT32 clear_mask
-+ Specifies which pins should drive a 0 out
-+ UINT32 enable_mask
-+ Specifies which pins should be enabled for output
-+ UINT32 disable_mask
-+ Specifies which pins should be disabled for output
++ A_UINT16 fixRateMask;
++ The individual bit is an index for rate table,
++ and setting the that index to 1 would set that
++ corresponding rate. E.g., fixRateMask = 9
++ (1001) sets 1 Mbps and 11 Mbps.
+
+Command Values
+ None
+
-+
+Reset Value
-+ None
-+
++ None defined
+
+Restrictions
+ None
+
-+
++See Also
++ \93GET_FIXRATES\94
+
+=====================================================================
+
+
+Name
-+ GPIO_REGISTER_GET
++ SET_WHAL_PARAM
+
+Synopsis
-+ Allows the host to read an arbitrary GPIO register. It is intended for use during
-+ bringup/debug. The target responds to this command with a \93GPIO_DATA\94 event.
-+
-+NOTE: Support for GPIO is optional.
++ An internal AR6000 command that is used to set certain hardware parameters. The
++ description of this command is in $WORKAREA/include/halapi.h.
+
+Command
-+ N/A
++ TBD
+
+Command Parameters
-+ UINT32
-+ gpioreg_id
-+ Specifies a GPIO register identifier, as defined
-+in include/AR6000/AR6000_gpio.h
++ ATH_HAL_SETCABTO_CMDID
++ Sets the timeout waiting for the multicast
++ traffic after a DTIM beacon (in TUs).
+
-+Reply Parameters
++Command Values
+ None
+
+Reset Value
-+ N/A
++ Default = 10 TUs
+
+Restrictions
-+ None
-+
++ This command should be executed before issuing a connect command.
+
+=====================================================================
+
++
+Name
-+ GPIO_REGISTER_SET
++ SET_HOST_SLEEP_MODE
+
+Synopsis
-+ Allows the host to dynamically change GPIO configuration (usually handled
-+ statically through the GPIO configuration DataSet).
-+
-+NOTE: Support for GPIO is optional.
++ The host uses this command to set the host mode to asleep or awake. All packets are
++ delivered to the host when the host mode is awake. When host mode is asleep, only if
++ WoW is enabled and the incoming packet matches one of the specified WoW
++ patterns, will the packet be delivered to the host. The host will also be woken up by
++ the target for pattern-matching packets and important events.
+
+Command
-+ N/A
++ wmiconfig \96sethostmode=<asleep/awake>
+
+Command Parameters
-+ UINT32 gpioreg_id
-+ Specifies a GPIO register identifier, as defined in
-+ include/AR6000/AR6000_gpio.h
-+ UINT32 value
-+ Specifies a value to write to the specified
-+ GPIO register
++ A_BOOL awake Set the host mode to awake
++ A_BOOL asleep Set the host mode to asleep
+
+Command Values
-+ None
-+
++ 1 = awake, 0 = asleep
+
+Reset Value
-+ Initial hardware configuration is as defined in the AR6001 or AR6002 ROCmTM
-+ Single-Chip MAC/BB/Radio for 2.4/5 GHz Embedded WLAN Applications data sheet. This
-+ configuration is modified by the GPIO Configuration DataSet, if one exists.
++ None defined (default host mode is awake)
+
+Restrictions
+ None
+
+=====================================================================
+
-+
+Name
-+ SET_LQTHRESHOLD
++ SET_IBSS_PM_CAPS
+
+Synopsis
-+ Set link quality thresholds, the sampling happens at every unicast data frame Tx, if
-+ certain threshold is met, corresponding event will be sent to host.
++ Used to support a non-standard power management scheme for an ad hoc wireless
++ network consisting of up to eight stations (STAs) that support this form of power
++ saving (e.g., Atheros-based STAs). A thorough understanding of IEEE 802.11 ad hoc
++ networks is required to use this command effectively.
+
+Command
-+ wmiconfig eth1 --lqThreshold <enable> <upper_threshold_1>...
-+ <upper_threshold_4> <lower_threshold_1>... <lower_threshold_4>
++ wmiconfig eth1 --ibsspmcaps --ps=<enable/disable>
++ --aw=<ATIM Windows in ms>
++ --ttl=<Time to live in number of beacon periods>
++ --to=<timeout in ms>
+
+Command Parameters
-+ A_UINT8 enable;
-+ A_UINT8 thresholdAbove1_Val;
-+ A_UINT8 thresholdAbove2_Val;
-+ A_UINT8 thresholdAbove3_Val;
-+ A_UINT8 thresholdAbove4_Val;
-+ A_UINT8 thresholdBelow1_Val;
-+ A_UINT8 thresholdBelow2_Val;
-+ A_UINT8 thresholdBelow3_Val;
-+ A_UINT8 thresholdBelow4_Val;
-+
-+Command Values
-+ enable
-+ = 0
-+ Disable link quality sampling
++ UINT8 power_saving
++ = 0
++ The non-standard power saving scheme is
++ disabled and maximum throughput (with no
++ power saving) is obtained.
+
+ = 1
-+ Enable link quality sampling
++ Ad hoc power saving scheme is enabled (but
++ throughput may be decreased)
+
++ UINT16 atim_windows
++ Specifies the length (in ms) of the ad hoc traffic
++ indication message (ATIM) windows used in an ad
++ hoc network. All Atheros-based STAs that join the
++ network use this duration ATIM window.
+
-+ thresholdAbove_Val
-+ [1...4]
-+ Above thresholds (value in [0,100]), in ascending
-+ order threshold
++ The duration is communicated between wireless
++ STAs through an IE in beacons and probe responses.
+
-+ Below_Val [1...4] = below thresholds (value
-+ in [0,100]), in ascending order
++ The host sets atim_windows to control trade-offs
++ between power use and throughput. The value
++ chosen should be based on the beacon interval (see
++ the \93SET_BEACON_INT\94 command) on the
++ expected number of STAs in the IBSS, and on the
++ amount of traffic and traffic patterns between STAs.
+
-+Reset Values
++ UINT16 timeout_value
++ Specifies the timeout (in ms). The value is the same
++ for all ad hoc connections, but tracks separately for
++ each.
++
++ Applicable only for a beacon period and used to
++ derive actual timeout values on the Tx and Rx sides.
++ On the Tx side, the value defines a window during
++ which the STA accepts the frame(s) from the host for a
++ particular connection. Until closed, the window
++ restarts with every frame received from the host. On
++ the Rx side, indicates the time until which the STA
++ continues accepting frames from a particular
++ connection. The value resets with every frame
++ received. The value can be used to determine the
++ trade off between throughput and power.
++ Default = 10 ms
++
++ UINT8 ttl
++ Specifies the value in number of beacon periods. The
++ value is used to set a limit on the time until which a
++ frame is kept alive in the AR6001 before being
++ discarded. Default = 5
++
++Command Values
+ None
+
++Reset Values
++ By default, power_saving is enabled with atim_window = 20 ms
++
+Restrictions
-+ None
++ Can only be issued before the AR6000 starts an ad hoc network
+
-+=====================================================================
-+WMI Extension Events
++See Also
++ \93SET_BEACON_INT\94
+
-+The WMI EXTENSION event is used for a collection of events that:
++=====================================================================
+
-+ Are not generic wireless events
-+ May be implementation-specific
-+ May be target platform-specific
-+ May be optional for a host implementation
+
-+ An extension event is sent from the AR6000 device targets to the host just like
-+any other WMI event message, using the WMI_EXTENSION_EVENTID. The
-+first field of the payload for this \93EXTENSION\94 event is another commandId
-+(sometimes called the subcommandId) that indicates which \93EXTENSION\94
-+event is being used. A subcommandId-specific payload follows the
-+subcommandId.
+
-+All extensions (subcommandIds) are listed in the header file include/wmix.h.
-+See also \93WMI Extension Commands\94 on page B-55.
++Name
++ SET_LISTEN_INT
+
++Synopsis
++ The host uses this command to request a listen interval, which determines how often
++ the AR6000 device should wake up and listen for traffic. The listen interval can be set
++ by the TUs or by the number of beacons. The device may not be able to comply with
++ the request (e.g., if the beacon interval is greater than the requested listen interval, the
++ device sets the listen interval to the beacon interval). The actual listen interval used
++ by the device is available in the \93CONNECT\94 event.
+
-+WMI Extension Events
++Command
++ wmiconfig eth1 --listen=<#of TUs, can range from 15 to 3000>
+
++ --listenbeacons=<#of beacons, can range from 1 to 50>
+
-+GPIO_ACK
-+ Acknowledges a host set command has been processed by the device
++Command Parameters
++ UINT16 listenInterval
++ Specifies the listen interval in Kms
++ (1024 ms), ranging from 100 to 1000
+
-+GPIO_DATA
-+ Response to a host\92s request for data
++ UINT16 listenbeacons
++ Specifies the listen interval in beacons,
++ ranging from 1 to 50
+
-+GPIO_INTR
-+ Signals that GPIO interrupts are pending
++Command Values
++ None
++
++Reset Values
++ The device sets the listen interval equal to the beacon interval of the AP it associates
++ to.
+
++Restrictions
++ None
+
+=====================================================================
+
++
+Name
-+ GPIO_ACK
++ SET_LPREAMBLE
+
+Synopsis
-+ Acknowledges that a host set command (either \93GPIO_OUTPUT_SET\94 or
-+ \93GPIO_REGISTER_SET\94) has been processed by the AR6000 device.
++ Overrides the short preamble capability of the AR6000 device
+
-+NOTE: Support for GPIO is optional.
++Command
++ TBD
+
-+Event ID
-+ N/A
++Command Parameters
++ WMI_LPREAMBLE_DISABLED
++ The device is short-preamble capable
+
-+Event Parameters
++ WMI_LPREAMBLE_ENABLED
++ The device supports only the long-
++ preamble mode
++
++Command Values
+ None
+
++Reset Value
++ None defined
+
-+Event Values
++Restrictions
+ None
+
-+=====================================================================
+
++=====================================================================
+
+Name
-+ GPIO_DATA
++ SET_MAX_SP_LEN
+
+Synopsis
-+ The AR6000 device uses this event to respond to the host\92s earlier request for data
-+ (through either a \93GPIO_REGISTER_GET\94 or a \93GPIO_INPUT_GET\94 command).
++ Set the maximum service period; indicates the number of packets the AR6001 can
++ receive from the AP when triggered
+
-+NOTE: Support for GPIO is optional.
++Command
++ wmiconfig eth1 --setMaxSPLength <maxSPLen>
+
-+Event ID
-+ N/A
++Command Parameters
++ UINT8 maxSPLen
++ An APSD_SP_LEN_TYPE value
+
-+Event Parameters
-+ UINT32 value
-+ Holds the data of interest, which is either a register value
-+ (in the case of \93GPIO_REGISTER_GET\94) or a mask of
-+ pin inputs (in the case of \93GPIO_INPUT_GET\94).
-+ UINT32 reg_id
-+ Indicates which register was read (in the case of
-+ \93GPIO_REGISTER_GET\94) or is GPIO_ID_NONE (in the
-+ case of \93GPIO_INPUT_GET\94)
++Command Values
++ {
++ DELIVER_ALL_PKT = 0x0
++ DELIVER_2_PKT = 0x1
++ DELIVER_4_PKT = 0x2
++ DELIVER_6_PKT = 0x3
++ }APSD_SP_LEN_TYPE
+
-+Event Values
-+ None
+
++Reset Values
++ maxSPLen is DELIVER_ALL_PKT
++
++Restrictions
++ None
+
+=====================================================================
+
+
-+
+Name
-+ GPIO_INTR
++ SET_OPT_MODE
+
+Synopsis
-+ The AR6000 device raises this event to signal that GPIO interrupts are pending.
-+ These GPIOs may be interrupts that occurred after the last \93GPIO_INTR_ACK\94
-+ command was issued, or may be GPIO interrupts that the host failed to acknowledge
-+ in the last \93GPIO_INTR_ACK\94. The AR6000 will not raise another GPIO_INTR
-+ event until this event is acknowledged through a \93GPIO_INTR_ACK\94 command.
++ Special feature, sets the special mode on/off
+
-+NOTE: Support for GPIO is optional.
++Command
++ wmiconfig eth1 --mode <mode>
++ Set the optional mode, where mode is special or off
+
-+Event ID
-+ N/A
++Command Parameters
++ enum {
++ SPECIAL_OFF
++ SPECIAL_ON
++ } OPT_MODE_TYPE;
+
-+Event Parameters
-+ UINT32 intr_mask
-+ Indicates which GPIO interrupts are currently pending
++Command Values
+
-+ UINT32 input_values
-+ A recent copy of the GPIO input values, taken at the
-+ time the most recent GPIO interrupt was processed
++Reset Value
++ Mode = Off
+
-+Event Values
++Restrictions
+ None
+
-+
-+
+=====================================================================
-+#endif
-diff --git a/drivers/ar6000/wmi/wmi_host.h b/drivers/ar6000/wmi/wmi_host.h
-new file mode 100644
-index 0000000..57844bc
---- /dev/null
-+++ b/drivers/ar6000/wmi/wmi_host.h
-@@ -0,0 +1,71 @@
-+#ifndef _WMI_HOST_H_
-+#define _WMI_HOST_H_
-+/*
-+ * Copyright (c) 2004-2006 Atheros Communications Inc.
-+ * All rights reserved.
-+ *
-+ * This file contains local definitios for the wmi host module.
-+ *
-+ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi_host.h#1 $
-+ *
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation;
-+ *
-+ * Software distributed under the License is distributed on an "AS
-+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-+ * implied. See the License for the specific language governing
-+ * rights and limitations under the License.
-+ *
-+ *
-+ *
-+ */
+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
+
-+struct wmi_stats {
-+ A_UINT32 cmd_len_err;
-+ A_UINT32 cmd_id_err;
-+};
++Name
++ SET_PMKID
+
-+struct wmi_t {
-+ A_BOOL wmi_ready;
-+ A_BOOL wmi_numQoSStream;
-+ A_UINT8 wmi_wmiStream2AcMapping[WMI_PRI_MAX_COUNT];
-+ WMI_PRI_STREAM_ID wmi_ac2WmiStreamMapping[WMM_NUM_AC];
-+ A_UINT16 wmi_streamExistsForAC[WMM_NUM_AC];
-+ A_UINT8 wmi_fatPipeExists;
-+ void *wmi_devt;
-+ struct wmi_stats wmi_stats;
-+ struct ieee80211_node_table wmi_scan_table;
-+ A_UINT8 wmi_bssid[ATH_MAC_LEN];
-+ A_UINT8 wmi_powerMode;
-+ A_UINT8 wmi_phyMode;
-+ A_UINT8 wmi_keepaliveInterval;
-+ A_MUTEX_T wmi_lock;
-+};
++Synopsis
++ The host uses this command to enable or disable a pairwise master key ID (PMKID)
++ in the AR6000 PMKID cache. The AR6000 clears its PMKID cache on receipt of a
++ DISCONNECT command from the host. Individual entries in the cache might be
++ deleted as the AR6000 detect new APs and decides to remove old ones.
+
-+#define WMI_INIT_WMISTREAM_AC_MAP(w) \
-+{ (w)->wmi_wmiStream2AcMapping[WMI_BEST_EFFORT_PRI] = WMM_AC_BE; \
-+ (w)->wmi_wmiStream2AcMapping[WMI_LOW_PRI] = WMM_AC_BK; \
-+ (w)->wmi_wmiStream2AcMapping[WMI_HIGH_PRI] = WMM_AC_VI; \
-+ (w)->wmi_wmiStream2AcMapping[WMI_HIGHEST_PRI] = WMM_AC_VO; \
-+ (w)->wmi_ac2WmiStreamMapping[WMM_AC_BE] = WMI_BEST_EFFORT_PRI; \
-+ (w)->wmi_ac2WmiStreamMapping[WMM_AC_BK] = WMI_LOW_PRI; \
-+ (w)->wmi_ac2WmiStreamMapping[WMM_AC_VI] = WMI_HIGH_PRI; \
-+ (w)->wmi_ac2WmiStreamMapping[WMM_AC_VO] = WMI_HIGHEST_PRI; }
++Command
++ wmiconfig eth1 --setbsspmkid --bssid=<aabbccddeeff>
++ --bsspmkid=<pmkid>
+
-+#define WMI_WMISTREAM_ACCESSCATEGORY(w,s) (w)->wmi_wmiStream2AcMapping[s]
-+#define WMI_ACCESSCATEGORY_WMISTREAM(w,ac) (w)->wmi_ac2WmiStreamMapping[ac]
++Command Parameters
++ UINT8 bssid[6]
++ The MAC address of the AP that the
++ PMKID corresponds to (6 bytes in hex
++ format)
+
-+#define LOCK_WMI(w) A_MUTEX_LOCK(&(w)->wmi_lock);
-+#define UNLOCK_WMI(w) A_MUTEX_UNLOCK(&(w)->wmi_lock);
++ UINT8 enable
++ Either PMKID_DISABLE (0) to disable
++ the PMKID or PMKID_ENABLE (1) to
++ enable it (16 bytes in hex format)
+
-+#ifdef __cplusplus
-+}
-+#endif
++ UINT8 pmkid[16]
++ Meaningful only if enable is
++ PMKID_ENABLE, when it is the PMKID
++ that the AR6000 should use on the next
++ reassociation with the specified AP
+
-+#endif /* _WMI_HOST_H_ */
-diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
-index fee678f..f1761c2 100644
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -70,6 +70,12 @@ config GPIO_MAX730X
-
- comment "Memory mapped GPIO expanders:"
-
-+config GPIO_GLAMO
-+ tristate "Glamo GPIO support"
-+ depends on MFD_GLAMO
-+ help
-+ Say yes here to support GPIO functionality of the Smedia Glamo.
++Command Values
++ enable
++ = 0 (disable), 1 (enable)
++ PKMID enabled/disabled
+
- config GPIO_IT8761E
- tristate "IT8761E GPIO support"
- depends on GPIOLIB
-@@ -235,6 +241,13 @@ config GPIO_ADP5588
- To compile this driver as a module, choose M here: the module will be
- called adp5588-gpio.
-
-+config GPIO_PCF50633
-+ tristate "GPIO support for NXP PCF50633"
-+ depends on MFD_PCF50633
-+ help
-+ Say yes here if you want to include support GPIO for pins on
-+ the PCF50633 chip.
++Reset Values
++ None defined
+
- comment "PCI GPIO expanders:"
-
- config GPIO_CS5535
-diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
-index 10f3f8d..5be6675 100644
---- a/drivers/gpio/Makefile
-+++ b/drivers/gpio/Makefile
-@@ -6,6 +6,7 @@ obj-$(CONFIG_GPIOLIB) += gpiolib.o
-
- obj-$(CONFIG_GPIO_ADP5520) += adp5520-gpio.o
- obj-$(CONFIG_GPIO_ADP5588) += adp5588-gpio.o
-+obj-$(CONFIG_GPIO_GLAMO) += glamo-gpio.o
- obj-$(CONFIG_GPIO_LANGWELL) += langwell_gpio.o
- obj-$(CONFIG_GPIO_MAX730X) += max730x.o
- obj-$(CONFIG_GPIO_MAX7300) += max7300.o
-@@ -27,4 +28,5 @@ obj-$(CONFIG_GPIO_VR41XX) += vr41xx_giu.o
- obj-$(CONFIG_GPIO_WM831X) += wm831x-gpio.o
- obj-$(CONFIG_GPIO_WM8350) += wm8350-gpiolib.o
- obj-$(CONFIG_GPIO_WM8994) += wm8994-gpio.o
--obj-$(CONFIG_GPIO_SCH) += sch_gpio.o
-\ No newline at end of file
-+obj-$(CONFIG_GPIO_SCH) += sch_gpio.o
-+obj-$(CONFIG_GPIO_PCF50633) += pcf50633-gpio.o
-diff --git a/drivers/gpio/glamo-gpio.c b/drivers/gpio/glamo-gpio.c
-new file mode 100644
-index 0000000..dff60eb
---- /dev/null
-+++ b/drivers/gpio/glamo-gpio.c
-@@ -0,0 +1,284 @@
-+/* Smedia Glamo 336x/337x gpio driver
-+ *
-+ * (C) 2009 Lars-Peter Clausen
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
++Restrictions
++ Only supported in infrastructure networks
+
-+#include <linux/io.h>
-+#include <linux/init.h>
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/platform_device.h>
-+#include <linux/slab.h>
-+#include <linux/spinlock.h>
++=====================================================================
+
-+#include <linux/gpio.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/mfd/glamo-regs.h>
+
-+#define GLAMO_NR_GPIO 21
-+#define GLAMO_NR_GPIO_REGS DIV_ROUND_UP(GLAMO_NR_GPIO, 4)
++Name
++ SET_PMKID_LIST_CMD
+
-+#define GLAMO_GPIO_REG(x) (((x) * 2) + GLAMO_REG_GPIO_GEN1)
++Synopsis
++ Configures the list of PMKIDs on the firmware.
+
-+struct glamo_gpio {
-+ struct glamo_core *glamo;
-+ struct gpio_chip chip;
-+ uint16_t saved_regs[GLAMO_NR_GPIO_REGS];
-+};
++Command
++ wmiconfig --setpmkidlist --numpmkid=<n> --pmkid=<pmkid_1>
++ ... --pmkid=<pmkid_n>
+
-+#define GLAMO_GPIO_REG_GPIO(gpio) GLAMO_GPIO_REG(gpio >> 2)
-+#define GLAMO_GPIO_BIT(gpio, offset) BIT(((gpio) & 0x3) + (offset))
-+#define GLAMO_GPIO_DIRECTION_BIT(gpio) GLAMO_GPIO_BIT(gpio, 0)
-+#define GLAMO_GPIO_OUTPUT_BIT(gpio) GLAMO_GPIO_BIT(gpio, 4)
-+#define GLAMO_GPIO_INPUT_BIT(gpio) GLAMO_GPIO_BIT(gpio, 8)
-+#define GLAMO_GPIO_FUNC_BIT(gpio) GLAMO_GPIO_BIT(gpio, 12)
++ Where n is the number of pmkids (maximum = 8) and pmkid_i is the ith pmkid (16
++ bytes in hex format)
+
++Command Parameters
++ {
++ A_UINT8 pmkid[WMI_PMKID_LEN];
++ } __ATTRIB_PACK WMI_PMKID;
+
-+static inline struct glamo_core *chip_to_glamo(struct gpio_chip *chip)
-+{
-+ return container_of(chip, struct glamo_gpio, chip)->glamo;
-+}
++ {
++ A_UINT32 numPMKID;
++ WMI_PMKID pmkidList[WMI_MAX_PMKID_CACHE];
++ } __ATTRIB_PACK WMI_SET_PMKID_LIST_CMD;
+
-+static void glamo_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
-+ uint16_t tmp;
++Command Values
++ None
+
-+ spin_lock(&glamo->lock);
-+ tmp = readw(glamo->base + reg);
-+ if (value)
-+ tmp |= GLAMO_GPIO_OUTPUT_BIT(offset);
-+ else
-+ tmp &= ~GLAMO_GPIO_OUTPUT_BIT(offset);
-+ writew(tmp, glamo->base + reg);
-+ spin_unlock(&glamo->lock);
-+}
++Reset Values
++ None
+
-+static int glamo_gpio_get(struct gpio_chip *chip, unsigned offset)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ return !!(readw(glamo->base + GLAMO_GPIO_REG_GPIO(offset)) & GLAMO_GPIO_INPUT_BIT(offset));
-+}
++Restrictions
++ Supported only in infrastructure modes
+
-+static int glamo_gpio_request(struct gpio_chip *chip, unsigned offset)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
-+ uint16_t tmp;
++=====================================================================
+
-+ spin_lock(&glamo->lock);
-+ tmp = readw(glamo->base + reg);
-+ if ((tmp & GLAMO_GPIO_FUNC_BIT(offset)) == 0) {
-+ tmp |= GLAMO_GPIO_FUNC_BIT(offset);
-+ writew(tmp, glamo->base + reg);
-+ }
-+ spin_unlock(&glamo->lock);
+
-+ return 0;
-+}
++Name
++ SET_POWER_MODE
+
-+static void glamo_gpio_free(struct gpio_chip *chip, unsigned offset)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
-+ uint16_t tmp;
++Synopsis
++ The host uses this command to provide the AR6000 device with guidelines on the
++ desired trade-off between power utilization and performance.
+
-+ spin_lock(&glamo->lock);
-+ tmp = readw(glamo->base + reg);
-+ if ((tmp & GLAMO_GPIO_FUNC_BIT(offset)) == 1) {
-+ tmp &= ~GLAMO_GPIO_FUNC_BIT(offset);
-+ writew(tmp, glamo->base + reg);
-+ }
-+ spin_unlock(&glamo->lock);
-+}
++ In normal power mode, the device enters a sleep state if they have nothing to do,
++ which conserves power but may cost performance as it can take up to 2 ms to
++ resume operation after leaving sleep state.
+
-+static int glamo_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
-+ int value)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
-+ uint16_t tmp;
++ In maximum performance mode, the device never enters sleep state, thus no time
++ is spent waking up, resulting in higher power consumption and better
++ performance.
+
-+ spin_lock(&glamo->lock);
-+ tmp = readw(glamo->base + reg);
-+ tmp &= ~GLAMO_GPIO_DIRECTION_BIT(offset);
++Command
++ TBD
+
-+ if (value)
-+ tmp |= GLAMO_GPIO_OUTPUT_BIT(offset);
-+ else
-+ tmp &= ~GLAMO_GPIO_OUTPUT_BIT(offset);
++Command Parameters
++ UINT8 powerMode
++ WMI_POWER_MODE value
++ {
++ REC_POWER = 1
++ (Recommended setting) Tries to conserve
++ power without sacrificing performance
++ MAX_PERF_POWER = 2
++ Setting that maximizes performance at
++ the expense of power
+
-+ writew(tmp, glamo->base + reg);
-+ spin_unlock(&glamo->lock);
++ All other values are reserved
++ } WMI_POWER_MODE
+
-+ return 0;
-+}
++Command Values
++ See command parameters
+
-+static int glamo_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
-+{
-+ struct glamo_core *glamo = chip_to_glamo(chip);
-+ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
-+ uint16_t tmp;
++Reset Values
++ powerMode is REC_POWER
+
-+ spin_lock(&glamo->lock);
-+ tmp = readw(glamo->base + reg);
-+ if ((tmp & GLAMO_GPIO_DIRECTION_BIT(offset)) == 0) {
-+ tmp |= GLAMO_GPIO_DIRECTION_BIT(offset);
-+ writew(tmp, glamo->base + reg);
-+ }
-+ spin_unlock(&glamo->lock);
++Restrictions
++ This command should only be issued in the DISCONNECTED state for the
++ infrastructure network.
+
-+ return 0;
-+}
++ For a PM-disabled ad hoc network, the power mode should remain in
++ MAX_PERF_POWER.
+
-+static const struct __devinit gpio_chip glamo_gpio_chip = {
-+ .label = "glamo",
-+ .request = glamo_gpio_request,
-+ .free = glamo_gpio_free,
-+ .direction_input = glamo_gpio_direction_input,
-+ .get = glamo_gpio_get,
-+ .direction_output = glamo_gpio_direction_output,
-+ .set = glamo_gpio_set,
-+ .base = -1,
-+ .ngpio = GLAMO_NR_GPIO,
-+ .can_sleep = 0,
-+ .owner = THIS_MODULE,
-+};
++ For a PM-enabled ad hoc network, the device can have REC_POWER or
++ MAX_PERF_POWER set, but either way it must follow the power save ad hoc
++ protocol. The host can change power modes in the CONNECTED state.
+
-+static int __devinit glamo_gpio_probe(struct platform_device *pdev)
-+{
-+ struct glamo_platform_data *pdata = pdev->dev.parent->platform_data;
-+ struct glamo_gpio *glamo_gpio;
-+ int ret;
++ Host changes to the PS setting when the STA is off the home channel take no effect
++ and cause a TARGET_PM_FAIL event.
+
-+ glamo_gpio = kzalloc(sizeof(*glamo_gpio), GFP_KERNEL);
-+ if (!glamo_gpio)
-+ return -ENOMEM;
++=====================================================================
+
-+ glamo_gpio->glamo = dev_get_drvdata(pdev->dev.parent);
-+ glamo_gpio->chip = glamo_gpio_chip;
-+ glamo_gpio->chip.dev = &pdev->dev;
-+ if (pdata && pdata->gpio_data)
-+ glamo_gpio->chip.base = pdata->gpio_data->base;
+
-+ ret = gpiochip_add(&glamo_gpio->chip);
++Name
++ SET_POWER_PARAMS
+
-+ if (ret) {
-+ dev_err(&pdev->dev, "Could not register gpio chip: %d\n", ret);
-+ goto err;
-+ }
++Synopsis
++ The host uses this command to configure power parameters
+
-+ platform_set_drvdata(pdev, glamo_gpio);
++Command
++ wmiconfig eth1 --pmparams --it=<ms> --np=<number of PS POLL>
++ --dp=<DTIM policy: ignore/normal/stick>
+
-+ if (pdata && pdata->gpio_data && pdata->gpio_data->registered)
-+ pdata->gpio_data->registered(&pdev->dev);
++Command Parameters
++ UINT16 idle_period
++ Length of time (in ms) the AR6000 device
++ remains awake after frame Rx/Tx before going
++ to SLEEP state
+
-+ return 0;
-+err:
-+ kfree(glamo_gpio);
-+ return ret;
-+}
++ UINT16 pspoll_number
++ The number of PowerSavePoll (PS-poll)
++ messages the device should send before
++ notifying the AP it is awake
+
-+static int __devexit glamo_gpio_remove(struct platform_device *pdev)
-+{
-+ struct glamo_gpio *glamo_gpio = platform_get_drvdata(pdev);
-+ int ret;
++ UINT16 dtim_policy
++ A WMI_POWER_PARAMS_CMD value
+
-+ ret = gpiochip_remove(&glamo_gpio->chip);
-+ if (!ret)
-+ goto done;
++ {
++ IGNORE_DTIM =1
++ The device does not listen to any content after
++ beacon (CAB) traffic
++ NORMAL_DTIM = 2
++ DTIM period follows the listen interval (e.g., if
++ the listen interval is 4 and the DTIM period is 2,
++ the device wakes up every fourth beacon)
++ STICK_DTIM = 3
++ Device attempt to receive all CAB traffic (e.g., if
++ the DTIM period is 2 and the listen interval is 4,
++ the device wakes up every second beacon)
++ } WMI_POWER_PARAMS_CMD
+
-+ platform_set_drvdata(pdev, NULL);
-+ kfree(glamo_gpio);
++Command Parameters
++ See command parameters
+
-+done:
-+ return ret;
-+}
++Reset Values
++ idle_period
++ 200 ms
+
-+#ifdef CONFIG_PM
++ pspoll_number
++ = 1
+
-+static int glamo_gpio_suspend(struct device *dev)
-+{
-+ struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
-+ struct glamo_core *glamo = glamo_gpio->glamo;
-+ uint16_t *saved_regs = glamo_gpio->saved_regs;
-+ int i;
++ dtim_policy
++ = NORMAL_DTIM
+
-+ spin_lock(&glamo->lock);
-+ for (i = 0; i < GLAMO_NR_GPIO / 4; ++i)
-+ saved_regs[i] = readw(glamo->base + GLAMO_GPIO_REG(i));
-+ spin_unlock(&glamo->lock);
++Restrictions
++ None
+
-+ return 0;
-+}
++=====================================================================
+
-+static int glamo_gpio_resume(struct device *dev)
-+{
-+ struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
-+ struct glamo_core *glamo = glamo_gpio->glamo;
-+ uint16_t *saved_regs = glamo_gpio->saved_regs;
-+ int i;
+
-+ spin_lock(&glamo->lock);
-+ for (i = 0; i < GLAMO_NR_GPIO_REGS; ++i)
-+ writew(saved_regs[i], glamo->base + GLAMO_GPIO_REG(i));
-+ spin_unlock(&glamo->lock);
-+ return 0;
-+}
++Name
++ SET_POWERSAVE_PARAMS
+
-+static const struct dev_pm_ops glamo_pm_ops = {
-+ .suspend = glamo_gpio_suspend,
-+ .resume = glamo_gpio_resume,
-+ .freeze = glamo_gpio_suspend,
-+ .thaw = glamo_gpio_resume,
-+};
++Synopsis
++ Set the two AR6000 power save timers (PS-POLL timer and APSD trigger timer) and
++ the two ASPD TIM policies
+
-+#define GLAMO_GPIO_PM_OPS (&glamo_pm_ops)
++Command
++ wmiconfig eth1--psparams --psPollTimer=<psPollTimeout in ms>
++ --triggerTimer=<triggerTimeout in ms> --apsdTimPolicy=<ignore/
++ adhere> --simulatedAPSDTimPolicy=<ignore/adhere>
+
-+#else
-+#define GLAMO_GPIO_PM_OPS NULL
-+#endif
++Command Parameters
++ typedef struct {
++ A_UINT16 psPollTimeout;
++ Timeout (in ms) after sending PS-POLL; the
++ AR6000 device sleeps if it does not receive a
++ data packet from the AP
+
-+static struct platform_driver glamo_gpio_driver = {
-+ .driver = {
-+ .name = "glamo-gpio",
-+ .owner = THIS_MODULE,
-+ .pm = GLAMO_GPIO_PM_OPS,
-+ },
-+ .probe = glamo_gpio_probe,
-+ .remove = __devexit_p(glamo_gpio_remove),
-+};
++ A_UINT16 triggerTimeout;
++ Timeout (in ms) after sending a trigger; the
++ device sleeps if it does not receive any data
++ or null frame from the AP
+
-+static int __devinit glamo_gpio_init(void)
-+{
-+ return platform_driver_register(&glamo_gpio_driver);
-+}
-+module_init(glamo_gpio_init);
++ APSD_TIM_POLICY apsdTimPolicy;
++ TIM behavior with queue APSD enabled
+
-+static void __exit glamo_gpio_exit(void)
-+{
-+ platform_driver_unregister(&glamo_gpio_driver);
-+}
-+module_exit(glamo_gpio_exit);
++ APSD_TIM_POLICY simulatedAPSD
+
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("GPIO interface for the Glamo multimedia device");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("platform:glamo-gpio");
-diff --git a/drivers/gpio/pcf50633-gpio.c b/drivers/gpio/pcf50633-gpio.c
-new file mode 100644
-index 0000000..eb044e8
---- /dev/null
-+++ b/drivers/gpio/pcf50633-gpio.c
-@@ -0,0 +1,228 @@
-+/* NXP PCF50633 GPIO Driver
-+ *
-+ * (C) 2006-2008 by Openmoko, Inc.
-+ * Author: Balaji Rao <balajirrao@openmoko.org>
-+ * Copyright 2010, Lars-Peter Clausen <lars@metafoo.de>
-+ * All rights reserved.
-+ *
-+ * Broken down from monstrous PCF50633 driver mainly by
-+ * Harald Welte, Andy Green and Werner Almesberger
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; either version 2 of the License, or (at your
-+ * option) any later version.
-+ *
-+ */
++ TimPolicy;
++ TIM behavior with simulated APSD
++ enabled
+
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/slab.h>
-+#include <linux/platform_device.h>
++ typedef enum {
++ IGNORE_TIM_ALL_QUEUES_APSD = 0,
++ PROCESS_TIM_ALL_QUEUES_APSD = 1,
++ IGNORE_TIM_SIMULATED_APSD = 2,
++ POWERSAVE_TIMERS_POLICY = 3,
++ } APSD_TIM_POLICY;
+
-+#include <linux/mfd/pcf50633/core.h>
-+#include <linux/mfd/pcf50633/gpio.h>
-+#include <linux/gpio.h>
++Command Values
++ None
+
-+#define PCF50633_REG_GPIOCTL 0x13
-+#define PCF50633_REG_GPIOCFG(x) (0x14 + (x))
++Reset Values
++ psPollTimeout is 50 ms; triggerTimeout is 10 ms;
++ apsdTimPolicy = IGNORE_TIM_ALL_QUEUES_APSD;
++ simulatedAPSDTimPolicy = POWERSAVE_TIMERS_POLICY
+
-+enum pcf50633_regulator_id {
-+ PCF50633_REGULATOR_AUTO,
-+ PCF50633_REGULATOR_DOWN1,
-+ PCF50633_REGULATOR_DOWN2,
-+ PCF50633_REGULATOR_LDO1,
-+ PCF50633_REGULATOR_LDO2,
-+ PCF50633_REGULATOR_LDO3,
-+ PCF50633_REGULATOR_LDO4,
-+ PCF50633_REGULATOR_LDO5,
-+ PCF50633_REGULATOR_LDO6,
-+ PCF50633_REGULATOR_HCLDO,
-+ PCF50633_REGULATOR_MEMLDO,
-+};
++Restrictions
++ When this command is used, all parameters must be set; this command does not
++ allow setting only one parameter.
+
-+#define PCF50633_REG_AUTOOUT 0x1a
-+#define PCF50633_REG_DOWN1OUT 0x1e
-+#define PCF50633_REG_DOWN2OUT 0x22
-+#define PCF50633_REG_MEMLDOOUT 0x26
-+#define PCF50633_REG_LDO1OUT 0x2d
-+#define PCF50633_REG_LDO2OUT 0x2f
-+#define PCF50633_REG_LDO3OUT 0x31
-+#define PCF50633_REG_LDO4OUT 0x33
-+#define PCF50633_REG_LDO5OUT 0x35
-+#define PCF50633_REG_LDO6OUT 0x37
-+#define PCF50633_REG_HCLDOOUT 0x39
++=====================================================================
+
-+static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
-+ [PCF50633_REGULATOR_AUTO] = PCF50633_REG_AUTOOUT,
-+ [PCF50633_REGULATOR_DOWN1] = PCF50633_REG_DOWN1OUT,
-+ [PCF50633_REGULATOR_DOWN2] = PCF50633_REG_DOWN2OUT,
-+ [PCF50633_REGULATOR_MEMLDO] = PCF50633_REG_MEMLDOOUT,
-+ [PCF50633_REGULATOR_LDO1] = PCF50633_REG_LDO1OUT,
-+ [PCF50633_REGULATOR_LDO2] = PCF50633_REG_LDO2OUT,
-+ [PCF50633_REGULATOR_LDO3] = PCF50633_REG_LDO3OUT,
-+ [PCF50633_REGULATOR_LDO4] = PCF50633_REG_LDO4OUT,
-+ [PCF50633_REGULATOR_LDO5] = PCF50633_REG_LDO5OUT,
-+ [PCF50633_REGULATOR_LDO6] = PCF50633_REG_LDO6OUT,
-+ [PCF50633_REGULATOR_HCLDO] = PCF50633_REG_HCLDOOUT,
-+};
+
-+struct pcf50633_gpio {
-+ struct pcf50633 *pcf;
-+ struct gpio_chip chip;
-+};
++Name
++ SET_PROBED_SSID
+
-+static inline struct pcf50633 *gpio_chip_to_pcf50633(struct gpio_chip *chip)
-+{
-+ struct pcf50633 *pcf = dev_to_pcf50633(chip->dev->parent);
-+ return pcf;
-+}
++Synopsis
++ The host uses this command to provide a list of up to MAX_PROBED_SSID_INDEX
++ (six) SSIDs that the AR6000 device should actively look for. It lists the active SSID
++ table. By default, the device actively looks for only the SSID specified in the
++ \93CONNECT_CMD\94 command, and only when the regulatory domain allows active
++ probing. With this command, specified SSIDs are probed for, even if they are hidden.
+
-+static void pcf50633_gpio_set_value(struct gpio_chip *chip, unsigned gpio, int value)
-+{
-+ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+ u8 reg;
++Command
++ wmiconfig eth1 --ssid=<ssid> [--num=<index>]
+
-+ reg = PCF50633_REG_GPIOCFG(gpio);
++Command Parameters
++ {
++ A_UINT8 numSsids
++ A number from 0 to
++ MAX_PROBED_SSID_INDEX indicating
++ the active SSID table entry index for this
++ command (if the specified entry index
++ already has an SSID, the SSID specified in
++ this command replaces it)
+
-+ pcf50633_reg_set_bit_mask(pcf, reg, 0x07, value ? 0x7 : 0x0);
-+}
++ WMI_PROBED_SSID_INFO probedSSID[1]
++ } WMI_PROBED_SSID_CMD
+
-+static int pcf50633_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
-+{
-+ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+ return pcf50633_reg_read(pcf, PCF50633_REG_GPIOCFG(gpio)) >> 3;
-+}
++ {
++ A_UINT8 flag
++ WMI_SSID_FLAG indicates the current
++ entry in the active SSID table
++ A_UINT8 ssidLength
++ Length of the specified SSID in bytes.
++ If = 0, the entry corresponding to the
++ index is erased
++ A_UINT8 ssid[32]
++ SSID string actively probed for when
++ permitted by the regulatory domain
++ } WMI_PROBED_SSID_INFO
+
++Command Values
++ WMI_SSID_FLAG
++ {
++ DISABLE_SSID_FLAG = 0
++ Disables entry
++ SPECIFIC_SSID_FLAG = 1
++ Probes specified SSID
++ ANY_SSID_FLAG = 2
++ Probes for any SSID
++ } WMI_SSID_FLAG
+
-+static int pcf50633_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
-+ int value)
-+{
-+ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
-+ int ret;
++Reset Value
++ The entries are unused.
+
-+ ret = pcf50633_gpio_set_config(pcf, pcf->pdata->gpio_base + gpio,
-+ PCF50633_GPIO_CONFIG_OUTPUT);
-+ if (!ret)
-+ pcf50633_gpio_set_value(chip, gpio, value);
++Restrictions
++ None
+
-+ return ret;
-+}
++=====================================================================
+
-+static int pcf50633_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
-+{
-+ return -ENOSYS;
-+}
+
-+int pcf50633_gpio_set_config(struct pcf50633 *pcf, unsigned gpio,
-+ enum pcf50633_gpio_config config)
-+{
-+ u8 reg;
-+ u8 direction;
-+ int ret;
++Name
++ SET_REASSOC_MODE
+
-+ gpio -= pcf->pdata->gpio_base;
++Synopsis
++ Specify whether the disassociated frame should be sent or not upon reassociation.
+
-+ if (gpio < 3) {
-+ direction = (config == PCF50633_GPIO_CONFIG_INPUT) ? (1 << gpio) : 0;
-+ ret = pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_GPIOCTL, (1 << gpio),
-+ direction);
-+ if (ret) {
-+ return ret;
-+ }
-+ } else if (gpio > 3 || config == PCF50633_GPIO_CONFIG_INPUT) {
-+ return -EINVAL;
-+ }
++Command
++ wmiconfig eth1 --setreassocmode <mode>
+
-+ if (config != PCF50633_GPIO_CONFIG_INPUT) {
-+ reg = PCF50633_REG_GPIOCFG(gpio);
-+ ret = pcf50633_reg_set_bit_mask(pcf, reg, 0x0f, config);
-+ }
++Command Parameters
++ UINT8 mode
+
-+ return ret;
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_gpio_set_config);
++Command Values
++ mode
++ = 0x00
++ Send disassoc to a previously connected AP
++ upon reassociation
++ = 0x01
++ Do not send disassoc to previously connected
++ AP upon reassociation
+
-+int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
-+ int gpio, int regulator, int on)
-+{
-+ u8 reg, val, mask;
++Reset Values
++ None defined
+
-+ gpio -= pcf->pdata->gpio_base;
++Restrictions
++ None
+
-+ /* the *ENA register is always one after the *OUT register */
-+ reg = pcf50633_regulator_registers[regulator] + 1;
+
-+ val = !!on << (gpio - PCF50633_GPIO1);
-+ mask = 1 << (gpio - PCF50633_GPIO1);
++=====================================================================
+
-+ return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
++Name
++ SET_RETRY_LIMITS
+
++Synopsis
++ Allows the host to influence the number of times that the AR6000 device should
++ attempt to send a frame before they give up.
+
-+static int __devinit pcf50633_gpio_probe(struct platform_device *pdev)
-+{
-+ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
-+ struct pcf50633_gpio *pcf_gpio;
++Command
++ wmiconfig --setretrylimits <frameType> <trafficClass> <maxRetries>
++ <enableNotify>
+
-+ pcf_gpio = kzalloc(sizeof(*pcf_gpio), GFP_KERNEL);
++Command Parameters
++ {
++ UINT8 frameType
++ A WMI_FRAMETYPE specifying
++ which type of frame is of interest.
++ UINT8 trafficClass
++ Specifies a traffic class (see
++ \93CREATE_PSTREAM\94). This
++ parameter is only significant when
++ frameType = DATA_FRAMETYPE.
++ UINT8 maxRetries
++ Maximum number of times the
++ device attempts to retry a frame Tx,
++ ranging from WMI_MIN_RETRIES
++ (2) to WMI_MAX_RETRIES (15). If
++ the special value 0 is used,
++ maxRetries is set to 15.
++ A_UINT8 enableNotify
++ Notify when enabled
++ } WMI_RETRY_LIMIT_INFO
+
-+ if (!pcf_gpio)
-+ return -ENOMEM;
++ {
++ A_UINT8 numEntries
++ WMI_RETRY_LIMIT_INFO retryLimitInfo[1]
++ } WMI_SET_RETRY_LIMITS_CMD
+
-+ pcf_gpio->pcf = pcf;
++Command Values
++ {
++ MGMT_FRAMETYPE = 0 Management frame
++ CONTROL_FRAMETYPE = 1 Control frame
++ DATA_FRAMETYPE = 2 Data frame
++ } WMI_FRAMETYPE
+
-+ pcf_gpio->chip.direction_input = pcf50633_gpio_direction_input;
-+ pcf_gpio->chip.direction_output = pcf50633_gpio_direction_output;
-+ pcf_gpio->chip.get = pcf50633_gpio_get_value;
-+ pcf_gpio->chip.set = pcf50633_gpio_set_value;
++Reset Values
++ Retries are set to 15
+
-+ pcf_gpio->chip.base = pcf->pdata->gpio_base;
-+ pcf_gpio->chip.ngpio = 4;
-+ pcf_gpio->chip.label = dev_name(pcf->dev);
-+ pcf_gpio->chip.can_sleep = 1;
-+ pcf_gpio->chip.owner = THIS_MODULE;
-+ pcf_gpio->chip.dev = &pdev->dev;
++Restrictions
++ None
+
-+ platform_set_drvdata(pdev, pcf_gpio);
++=====================================================================
+
-+ return gpiochip_add(&pcf_gpio->chip);
-+}
+
-+static int __devexit pcf50633_gpio_remove(struct platform_device *pdev)
-+{
-+ struct pcf50633_gpio *pcf_gpio = platform_get_drvdata(pdev);
++Name
++ SET_ROAM_CTRL
+
-+ gpiochip_remove(&pcf_gpio->chip);
++Synopsis
++ Affects how the AR6000 device selects a BSS. The host uses this command to set and
++ enable low RSSI scan parameters. The time period of low RSSI background scan is
++ mentioned in scan period. Low RSSI scan is triggered when the current RSSI
++ threshold (75% of current RSSI) is equal to or less than scan threshold.
+
-+ platform_set_drvdata(pdev, NULL);
-+ kfree(pcf_gpio);
++ Low RSSI roam is triggered when the current RSSI threshold falls below the roam
++ threshold and roams to a better AP by the end of the scan cycle. During Low RSSI
++ roam, if the STA finds a new AP with an RSSI greater than roam RSSI to floor, during
++ scan, it roams immediately to it instead of waiting for the end of the scan cycle. See
++ also \93Scan and Roam\94 on page C-1.
+
-+ return 0;
-+}
++Command
++ wmiconfig --roam <roamctrl> <info>, where info is <scan period>
++ <scan threshold> <roam threshold> <roam rssi floor>
+
-+static struct platform_driver pcf50633_gpio_driver = {
-+ .probe = pcf50633_gpio_probe,
-+ .remove = __devexit_p(pcf50633_gpio_remove),
-+ .driver = {
-+ .name = "pcf50633-gpio",
-+ .owner = THIS_MODULE,
-+ },
-+};
++Command Parameters
++ A_UINT8 roamCtrlType;
+
-+int __init pcf50633_gpio_init(void)
-+{
-+ return platform_driver_register(&pcf50633_gpio_driver);
-+}
-+module_init(pcf50633_gpio_init);
++Command Values
++ WMI_FORCE_ROAM = 1
++ Roam to the specified BSSID
+
-+void __exit pcf50633_gpio_exit(void)
-+{
-+ platform_driver_unregister(&pcf50633_gpio_driver);
-+}
-+module_exit(pcf50633_gpio_exit);
++ WMI_SET_ROAM_MODE = 2
++ Default, progd bias, no roam
+
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("GPIO driver for the PCF50633");
-+MODULE_LICENSE("GPL");
-diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
-index da3fa8d..ee9c708 100644
---- a/drivers/leds/leds-pwm.c
-+++ b/drivers/leds/leds-pwm.c
-@@ -26,8 +26,8 @@
- struct led_pwm_data {
- struct led_classdev cdev;
- struct pwm_device *pwm;
-- unsigned int active_low;
-- unsigned int period;
-+ struct led_pwm *led;
-+ struct device *parent;
- };
-
- static void led_pwm_set(struct led_classdev *led_cdev,
-@@ -35,8 +35,13 @@ static void led_pwm_set(struct led_classdev *led_cdev,
- {
- struct led_pwm_data *led_dat =
- container_of(led_cdev, struct led_pwm_data, cdev);
-+ struct device *parent = led_dat->parent;
-+ struct led_pwm_platform_data *pdata = parent->platform_data;
- unsigned int max = led_dat->cdev.max_brightness;
-- unsigned int period = led_dat->period;
-+ unsigned int period = led_dat->led->pwm_period_ns;
++ WMI_SET_HOST_BIAS = 3
++ Set the host bias
+
-+ if (pdata->notify)
-+ brightness = pdata->notify(parent, led_dat->led, brightness);
-
- if (brightness == 0) {
- pwm_config(led_dat->pwm, 0, period);
-@@ -76,18 +81,28 @@ static int led_pwm_probe(struct platform_device *pdev)
-
- led_dat->cdev.name = cur_led->name;
- led_dat->cdev.default_trigger = cur_led->default_trigger;
-- led_dat->active_low = cur_led->active_low;
-- led_dat->period = cur_led->pwm_period_ns;
- led_dat->cdev.brightness_set = led_pwm_set;
- led_dat->cdev.brightness = LED_OFF;
- led_dat->cdev.max_brightness = cur_led->max_brightness;
- led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
-
-+ led_dat->led = cur_led;
-+ led_dat->parent = &pdev->dev;
++ WMI_SET_LOWRSSI_SCAN_PARAMS = 4
++ Info parameters
+
- ret = led_classdev_register(&pdev->dev, &led_dat->cdev);
- if (ret < 0) {
- pwm_free(led_dat->pwm);
- goto err;
- }
++ A_UINT8 bssid[ATH_MAC_LEN];
++ WMI_FORCE_ROAM
+
-+ if (pdata->init) {
-+ ret = pdata->init(&pdev->dev, cur_led);
-+ if (ret < 0) {
-+ led_classdev_unregister(&led_dat->cdev);
-+ pwm_free(led_dat->pwm);
-+ goto err;
-+ }
-+ }
- }
-
- platform_set_drvdata(pdev, leds_data);
-@@ -97,6 +112,8 @@ static int led_pwm_probe(struct platform_device *pdev)
- err:
- if (i > 0) {
- for (i = i - 1; i >= 0; i--) {
-+ if (pdata->exit)
-+ pdata->exit(&pdev->dev, &pdata->leds[i]);
- led_classdev_unregister(&leds_data[i].cdev);
- pwm_free(leds_data[i].pwm);
- }
-@@ -116,6 +133,8 @@ static int __devexit led_pwm_remove(struct platform_device *pdev)
- leds_data = platform_get_drvdata(pdev);
-
- for (i = 0; i < pdata->num_leds; i++) {
-+ if (pdata->exit)
-+ pdata->exit(&pdev->dev, &pdata->leds[i]);
- led_classdev_unregister(&leds_data[i].cdev);
- pwm_free(leds_data[i].pwm);
- }
-diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
-index 2a5a0b7..e0d1b7c 100644
---- a/drivers/mfd/Kconfig
-+++ b/drivers/mfd/Kconfig
-@@ -334,13 +334,6 @@ config PCF50633_ADC
- Say yes here if you want to include support for ADC in the
- NXP PCF50633 chip.
-
--config PCF50633_GPIO
-- tristate "Support for NXP PCF50633 GPIO"
-- depends on MFD_PCF50633
-- help
-- Say yes here if you want to include support GPIO for pins on
-- the PCF50633 chip.
--
- config AB3100_CORE
- bool "ST-Ericsson AB3100 Mixed Signal Circuit core functions"
- depends on I2C=y
-@@ -399,6 +392,14 @@ config LPC_SCH
- LPC bridge function of the Intel SCH provides support for
- System Management Bus and General Purpose I/O.
-
-+config MFD_GLAMO
-+ bool "Smedia Glamo 336x/337x support"
-+ select MFD_CORE
-+ help
-+ This enables the core driver for the Smedia Glamo 336x/337x
-+ multi-function device. It includes irq_chip demultiplex as
-+ well as clock / power management and GPIO support.
++ A_UINT8 roamMode;
++ WMI_SET_ROAM_MODE
+
- endmenu
-
- menu "Multimedia Capabilities Port drivers"
-diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
-index 22715ad..da7a930 100644
---- a/drivers/mfd/Makefile
-+++ b/drivers/mfd/Makefile
-@@ -7,6 +7,7 @@ obj-$(CONFIG_MFD_88PM860X) += 88pm860x.o
- obj-$(CONFIG_MFD_SM501) += sm501.o
- obj-$(CONFIG_MFD_ASIC3) += asic3.o tmio_core.o
- obj-$(CONFIG_MFD_SH_MOBILE_SDHI) += sh_mobile_sdhi.o
-+obj-$(CONFIG_MFD_GLAMO) += glamo-core.o
-
- obj-$(CONFIG_HTC_EGPIO) += htc-egpio.o
- obj-$(CONFIG_HTC_PASIC3) += htc-pasic3.o
-@@ -54,12 +55,12 @@ obj-$(CONFIG_PMIC_DA903X) += da903x.o
- max8925-objs := max8925-core.o max8925-i2c.o
- obj-$(CONFIG_MFD_MAX8925) += max8925.o
-
--obj-$(CONFIG_MFD_PCF50633) += pcf50633-core.o
-+pcf50633-objs := pcf50633-core.o pcf50633-irq.o
-+obj-$(CONFIG_MFD_PCF50633) += pcf50633.o
- obj-$(CONFIG_PCF50633_ADC) += pcf50633-adc.o
--obj-$(CONFIG_PCF50633_GPIO) += pcf50633-gpio.o
- obj-$(CONFIG_AB3100_CORE) += ab3100-core.o
- obj-$(CONFIG_AB3100_OTP) += ab3100-otp.o
- obj-$(CONFIG_AB4500_CORE) += ab4500-core.o
- obj-$(CONFIG_MFD_TIMBERDALE) += timberdale.o
- obj-$(CONFIG_PMIC_ADP5520) += adp5520.o
--obj-$(CONFIG_LPC_SCH) += lpc_sch.o
-\ No newline at end of file
-+obj-$(CONFIG_LPC_SCH) += lpc_sch.o
-diff --git a/drivers/mfd/glamo-core.c b/drivers/mfd/glamo-core.c
-new file mode 100644
-index 0000000..8880263
---- /dev/null
-+++ b/drivers/mfd/glamo-core.c
-@@ -0,0 +1,1299 @@
-+/* Smedia Glamo 3362 driver
-+ *
-+ * (C) 2007 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
-+ * All rights reserved.
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-+ * MA 02111-1307 USA
-+ */
++ A_UINT8 bssBiasInfo;
++ WMI_SET_HOST_BIAS
+
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/errno.h>
-+#include <linux/string.h>
-+#include <linux/mm.h>
-+#include <linux/delay.h>
-+#include <linux/init.h>
-+#include <linux/irq.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/platform_device.h>
-+#include <linux/kernel_stat.h>
-+#include <linux/spinlock.h>
-+#include <linux/mfd/core.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-regs.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/io.h>
-+#include <linux/slab.h>
-+#include <linux/debugfs.h>
-+#include <linux/seq_file.h>
-+#include <linux/uaccess.h>
++ A_UINT16 lowrssi_scan_period;
++ WMI_SET_LOWRSSI_SCAN_PARAMS
+
-+#include <linux/pm.h>
++ A_INT16
++ lowrssi_scan_threshold;
++ WMI_SET_LOWRSSI_SCAN_PARAMS
+
-+#define GLAMO_MEM_REFRESH_COUNT 0x100
++ A_INT16 lowrssi_roam_threshold;
++ WMI_SET_LOWRSSI_SCAN_PARAMS
+
-+#define GLAMO_NR_IRQS 9
++ A_UINT8 roam_rssi_floor;
++ WMI_SET_LOWRSSI_SCAN_PARAMS
+
-+#define GLAMO_IRQ_HOSTBUS 0
-+#define GLAMO_IRQ_JPEG 1
-+#define GLAMO_IRQ_MPEG 2
-+#define GLAMO_IRQ_MPROC1 3
-+#define GLAMO_IRQ_MPROC0 4
-+#define GLAMO_IRQ_CMDQUEUE 5
-+#define GLAMO_IRQ_2D 6
-+#define GLAMO_IRQ_MMC 7
-+#define GLAMO_IRQ_RISC 8
++Reset Value
++ None defined (default lowrssi scan is disabled. Enabled only when scan period is set.)
+
-+/*
-+ * Glamo internal settings
-+ *
-+ * We run the memory interface from the faster PLLB on 2.6.28 kernels and
-+ * above. Couple of GTA02 users report trouble with memory bus when they
-+ * upgraded from 2.6.24. So this parameter allows reversion to 2.6.24
-+ * scheme if their Glamo chip needs it.
-+ *
-+ * you can override the faster default on kernel commandline using
-+ *
-+ * glamo3362.slow_memory=1
-+ *
-+ * for example
-+ */
++Restrictions
++ None
+
-+static int slow_memory;
-+module_param(slow_memory, int, 0644);
++=====================================================================
+
-+struct reg_range {
-+ int start;
-+ int count;
-+ char *name;
-+ unsigned dump:1;
-+};
+
-+static const struct reg_range reg_range[] = {
-+ { 0x0000, 0x76, "General", 1 },
-+ { 0x0200, 0x18, "Host Bus", 1 },
-+ { 0x0300, 0x38, "Memory", 1 },
-+/* { 0x0400, 0x100, "Sensor", 0 }, */
-+/* { 0x0500, 0x300, "ISP", 0 }, */
-+/* { 0x0800, 0x400, "JPEG", 0 }, */
-+/* { 0x0c00, 0xcc, "MPEG", 0 }, */
-+ { 0x1100, 0xb2, "LCD 1", 0 },
-+ { 0x1200, 0x64, "LCD 2", 0 },
-+ { 0x1400, 0x42, "MMC", 0 },
-+/* { 0x1500, 0x080, "MPU 0", 0 },
-+ { 0x1580, 0x080, "MPU 1", 0 },
-+ { 0x1600, 0x080, "Cmd Queue", 0 },
-+ { 0x1680, 0x080, "RISC CPU", 0 },*/
-+ { 0x1700, 0x400, "2D Unit", 0 },
-+/* { 0x1b00, 0x900, "3D Unit", 0 }, */
-+};
++Name
++ SET_RTS
+
-+static inline void __reg_write(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t val)
-+{
-+ writew(val, glamo->base + reg);
-+}
++Synopsis
++ Decides when RTS should be sent.
+
-+void glamo_reg_write(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t val)
-+{
-+ spin_lock(&glamo->lock);
-+ __reg_write(glamo, reg, val);
-+ spin_unlock(&glamo->lock);
-+}
-+EXPORT_SYMBOL_GPL(glamo_reg_write);
++Command
++ wmiconfig eth1 --setRTS <pkt length threshold>
+
++Command Parameters
++ A_UINT16
++ threshold;
++ Command parameter threshold in bytes. An RTS is
++ sent if the data length is more than this threshold.
++ The default is to NOT send RTS.
+
-+static inline uint16_t __reg_read(struct glamo_core *glamo,
-+ uint16_t reg)
-+{
-+ return readw(glamo->base + reg);
-+}
++Command Values
++ None
+
-+uint16_t glamo_reg_read(struct glamo_core *glamo, uint16_t reg)
-+{
-+ uint16_t val;
-+ spin_lock(&glamo->lock);
-+ val = __reg_read(glamo, reg);
-+ spin_unlock(&glamo->lock);
++Reset Value
++ Not to send RTS.
+
-+ return val;
-+}
-+EXPORT_SYMBOL_GPL(glamo_reg_read);
++Restrictions
++ None
+
-+static void __reg_set_bit_mask(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t mask,
-+ uint16_t val)
-+{
-+ uint16_t tmp;
+
-+ val &= mask;
++=====================================================================
+
-+ tmp = __reg_read(glamo, reg);
-+ tmp &= ~mask;
-+ tmp |= val;
-+ __reg_write(glamo, reg, tmp);
-+}
++Name
++ SET_SCAN_PARAMS
+
-+static void reg_set_bit_mask(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t mask,
-+ uint16_t val)
-+{
-+ spin_lock(&glamo->lock);
-+ __reg_set_bit_mask(glamo, reg, mask, val);
-+ spin_unlock(&glamo->lock);
-+}
++Synopsis
++ The host uses this command to set the AR6000 scan parameters, including the duty
++ cycle for both foreground and background scanning. Foreground scanning takes
++ place when the AR6000 device is not connected, and discovers all available wireless
++ networks to find the best BSS to join. Background scanning takes place when the
++ device is already connected to a network and scans for potential roaming candidates
++ and maintains them in order of best to worst. A second priority of background
++ scanning is to find new wireless networks.
+
-+static inline void __reg_set_bit(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t bit)
-+{
-+ uint16_t tmp;
-+ tmp = __reg_read(glamo, reg);
-+ tmp |= bit;
-+ __reg_write(glamo, reg, tmp);
-+}
++ The device initiates a scan when necessary. For example, a foreground scan is always
++ started on receipt of a \93CONNECT_CMD\94 command or when the device cannot find
++ a BSS to connect to. Foreground scanning is disabled by default until receipt of a
++ CONNECT command. Background scanning is enabled by default and occurs every
++ 60 seconds after the device is connected.
+
-+static inline void __reg_clear_bit(struct glamo_core *glamo,
-+ uint16_t reg, uint16_t bit)
-+{
-+ uint16_t tmp;
-+ tmp = __reg_read(glamo, reg);
-+ tmp &= ~bit;
-+ __reg_write(glamo, reg, tmp);
-+}
++ The device implements a binary backoff interval for foreground scanning when it
++ enters the DISCONNECTED state after losing connectivity with an AP or when a
++ CONNECT command is received. The first interval is ForegroundScanStartPeriod,
++ which doubles after each scan until the interval reaches ForegroundScanEndPeriod.
++ If the host terminates a connection with DISCONNECT, the foreground scan period
++ is ForegroundScanEndPeriod. All scan intervals are measured from the time a full
++ scan ends to the time the next full scan starts. The host starts a scan by issuing a
++ \93START_SCAN\94 command. See also \93Scan and Roam\94 on page C-1.
+
-+/***********************************************************************
-+ * resources of sibling devices
-+ ***********************************************************************/
++Command
++ wmiconfig eth1 --scan --fgstart=<sec> --fgend=<sec> --bg=<sec> --
++ act=<msec> --pas=<msec> --sr=<short scan ratio> --scanctrlflags
++ <connScan> <scanConnected> <activeScan> <reportBSSINFO>
+
-+static struct resource glamo_fb_resources[] = {
-+ {
-+ .name = "glamo-fb-regs",
-+ .start = GLAMO_REGOFS_LCD,
-+ .end = GLAMO_REGOFS_MMC - 1,
-+ .flags = IORESOURCE_MEM,
-+ }, {
-+ .name = "glamo-fb-mem",
-+ .start = GLAMO_OFFSET_FB,
-+ .end = GLAMO_OFFSET_FB + GLAMO_FB_SIZE - 1,
-+ .flags = IORESOURCE_MEM,
-+ },
-+};
++Command Parameters
++ UINT16 fgStartPeriod
++ First interval used by the device when it
++ disconnects from an AP or receives a
++ CONNECT command, specified in seconds (0\96
++ 65535). If = 0, the device uses the reset value.
++ If = 65535, the device disables foreground
++ scanning.
+
-+static struct resource glamo_mmc_resources[] = {
-+ {
-+ .name = "glamo-mmc-regs",
-+ .start = GLAMO_REGOFS_MMC,
-+ .end = GLAMO_REGOFS_MPROC0 - 1,
-+ .flags = IORESOURCE_MEM
-+ }, {
-+ .name = "glamo-mmc-mem",
-+ .start = GLAMO_OFFSET_FB + GLAMO_FB_SIZE,
-+ .end = GLAMO_OFFSET_FB + GLAMO_FB_SIZE +
-+ GLAMO_MMC_BUFFER_SIZE - 1,
-+ .flags = IORESOURCE_MEM
-+ }, {
-+ .start = GLAMO_IRQ_MMC,
-+ .end = GLAMO_IRQ_MMC,
-+ .flags = IORESOURCE_IRQ,
-+ },
-+};
++ UINT16 fgEndPeriod
++ The maximum interval the device waits between
++ foreground scans specified in seconds (from
++ ForegroundScanStartPeriod to 65535). If = 0, the
++ device uses the reset value.
+
-+enum glamo_cells {
-+ GLAMO_CELL_FB,
-+ GLAMO_CELL_MMC,
-+ GLAMO_CELL_GPIO,
-+};
++ UINT16 bgScanPeriod
++ The period of background scan specified in
++ seconds (0\9665535). By default, it is set to the reset
++ value of 60 seconds. If 0 or 65535 is specified, the
++ device disables background scanning.
+
-+static const struct mfd_cell glamo_cells[] = {
-+ [GLAMO_CELL_FB] = {
-+ .name = "glamo-fb",
-+ .num_resources = ARRAY_SIZE(glamo_fb_resources),
-+ .resources = glamo_fb_resources,
-+ },
-+ [GLAMO_CELL_MMC] = {
-+ .name = "glamo-mci",
-+ .num_resources = ARRAY_SIZE(glamo_mmc_resources),
-+ .resources = glamo_mmc_resources,
-+ },
-+ [GLAMO_CELL_GPIO] = {
-+ .name = "glamo-gpio",
-+ },
-+};
++ UINT16 maxactChDwellTime
++ The period of time the device stays on a
++ particular channel while active scanning. It is
++ specified in ms (10\9665535). If the special value of
++ 0 is specified, the device uses the reset value.
+
-+/***********************************************************************
-+ * IRQ demultiplexer
-+ ***********************************************************************/
-+#define glamo_irq_bit(glamo, x) BIT(x - glamo->irq_base)
++ UINT16 PasChDwellTime
++ The period of time the device remains on a
++ particular channel while passive scanning. It is
++ specified in ms (10\9665535). If the special value of
++ 0 is specified, the device uses the reset value.
+
-+static inline struct glamo_core *irq_to_glamo(unsigned int irq)
-+{
-+ return (struct glamo_core *)get_irq_chip_data(irq);
-+}
++ UINT8 shortScanRatio
++ Number of short scans to perform for each
++ long scan.
+
-+static void glamo_ack_irq(unsigned int irq)
-+{
-+ struct glamo_core *glamo = irq_to_glamo(irq);
-+ /* clear interrupt source */
-+ __reg_write(glamo, GLAMO_REG_IRQ_CLEAR, glamo_irq_bit(glamo, irq));
-+}
++ UINT8 scanCtrlFlasgs
+
-+static void glamo_mask_irq(unsigned int irq)
-+{
-+ struct glamo_core *glamo = irq_to_glamo(irq);
++ UINT16 minactChDwellTime
++ Specified in ms
+
-+ /* clear bit in enable register */
-+ __reg_clear_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, irq));
-+}
++ UINT32 maxDFSchActTime
++ The maximum time a DFS channel can stay
++ active before being marked passive, specified in
++ ms.
+
-+static void glamo_unmask_irq(unsigned int irq)
-+{
-+ struct glamo_core *glamo = irq_to_glamo(irq);
++Command Values
++ None
+
-+ /* set bit in enable register */
-+ __reg_set_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, irq));
-+}
++Reset Values
++ ForegroundScanStart
++Period
++ 1 sec
+
-+static struct irq_chip glamo_irq_chip = {
-+ .name = "glamo",
-+ .ack = glamo_ack_irq,
-+ .mask = glamo_mask_irq,
-+ .unmask = glamo_unmask_irq,
-+};
++ ForegroundScanEndPeriod
++ 60 sec
+
-+static void glamo_irq_demux_handler(unsigned int irq, struct irq_desc *desc)
-+{
-+ struct glamo_core *glamo = get_irq_desc_data(desc);
-+ desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
++ BackgroundScanPeriod
++ 60 sec
+
-+ if (unlikely(desc->status & IRQ_INPROGRESS)) {
-+ desc->status |= (IRQ_PENDING | IRQ_MASKED);
-+ desc->chip->mask(irq);
-+ desc->chip->ack(irq);
-+ return;
-+ }
-+ kstat_incr_irqs_this_cpu(irq, desc);
++ ActiveChannelDwellTime
++ 105 ms
+
-+ desc->chip->ack(irq);
-+ desc->status |= IRQ_INPROGRESS;
++=====================================================================
+
-+ do {
-+ uint16_t irqstatus;
-+ int i;
+
-+ if (unlikely((desc->status &
-+ (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
-+ (IRQ_PENDING | IRQ_MASKED))) {
-+ /* dealing with pending IRQ, unmasking */
-+ desc->chip->unmask(irq);
-+ desc->status &= ~IRQ_MASKED;
-+ }
++Name
++ SET_TKIP_COUNTERMEASURES
+
-+ desc->status &= ~IRQ_PENDING;
++Synopsis
++ The host issues this command to tell the target whether to enable or disable TKIP
++ countermeasures.
+
-+ /* read IRQ status register */
-+ irqstatus = __reg_read(glamo, GLAMO_REG_IRQ_STATUS);
-+ for (i = 0; i < 9; ++i) {
-+ if (irqstatus & BIT(i))
-+ generic_handle_irq(glamo->irq_base + i);
-+ }
++Command
++ TBD
+
-+ } while ((desc->status & (IRQ_PENDING | IRQ_DISABLED)) == IRQ_PENDING);
++Command Parameters
++ UINT8 WMI_TKIP_CM_ENABLE
++ Enables the countermeasures
+
-+ desc->status &= ~IRQ_INPROGRESS;
-+}
+
-+struct glamo_engine_reg_set {
-+ uint16_t reg;
-+ uint16_t mask_suspended;
-+ uint16_t mask_enabled;
-+};
++ UINT8 TKIP_CM_DISABLE
++ Disables the countermeasures
+
-+/*
-+debugfs
-+*/
++Command Values
++ None
+
-+#ifdef CONFIG_DEBUG_FS
-+static ssize_t debugfs_regs_write(struct file *file,
-+ const char __user *user_buf,
-+ size_t count, loff_t *ppos)
-+{
-+ struct glamo_core *glamo = ((struct seq_file *)file->private_data)->private;
-+ char buf[14];
-+ unsigned int reg;
-+ unsigned int val;
-+ int buf_size;
++Reset Values
++ By default, TKIP MIC reporting is disabled
+
-+ buf_size = min(count, sizeof(buf) - 1);
-+ if (copy_from_user(buf, user_buf, buf_size))
-+ return -EFAULT;
-+ if (sscanf(buf, "%x %x", ®, &val) != 2)
-+ return -EFAULT;
++Restrictions
++ None
+
-+ dev_info(&glamo->pdev->dev, "reg %#02x <-- %#04x\n", reg, val);
++=====================================================================
+
-+ glamo_reg_write(glamo, reg, val);
+
-+ return count;
-+}
++Name
++ SET_TX_PWR
+
-+static int glamo_show_regs(struct seq_file *s, void *pos)
-+{
-+ struct glamo_core *glamo = s->private;
-+ int i, n;
-+ const struct reg_range *rr = reg_range;
++Synopsis
++ The host uses this command to specify the Tx power level of the AR6000. Cannot be
++ used to exceed the power limit permitted by the regulatory domain. The maximum
++ output power is limited in the chip to 31.5 dBm; the range is 0 \96 31.5 dbm.
+
-+ spin_lock(&glamo->lock);
-+ for (i = 0; i < ARRAY_SIZE(reg_range); ++i, ++rr) {
-+ if (!rr->dump)
-+ continue;
-+ seq_printf(s, "\n%s\n", rr->name);
-+ for (n = rr->start; n < rr->start + rr->count; n += 2) {
-+ if ((n & 15) == 0)
-+ seq_printf(s, "\n%04X: ", n);
-+ seq_printf(s, "%04x ", __reg_read(glamo, n));
-+ }
-+ seq_printf(s, "\n");
-+ }
-+ spin_unlock(&glamo->lock);
++Command
++ wmiconfig --power <dbM>
+
-+ return 0;
-+}
++Command Parameters
++ UINT8 dbM
++ The desired Tx power specified in dbM.
++ If = 0, the device chooses the maximum
++ permitted by the regulatory domain.
+
-+static int debugfs_open_file(struct inode *inode, struct file *file)
-+{
-+ return single_open(file, glamo_show_regs, inode->i_private);
-+}
++Command Values
++ None
+
-+static const struct file_operations debugfs_regs_ops = {
-+ .open = debugfs_open_file,
-+ .read = seq_read,
-+ .llseek = seq_lseek,
-+ .write = debugfs_regs_write,
-+ .release = single_release,
-+};
++Reset Values
++ The maximum permitted by the regulatory domain
+
-+static void glamo_init_debugfs(struct glamo_core *glamo)
-+{
-+ glamo->debugfs_dir = debugfs_create_dir("glamo3362", NULL);
-+ if (glamo->debugfs_dir)
-+ debugfs_create_file("regs", S_IRUGO | S_IWUSR,
-+ glamo->debugfs_dir,
-+ glamo, &debugfs_regs_ops);
-+ else
-+ dev_warn(&glamo->pdev->dev, "Failed to set up debugfs.\n");
-+}
++Restrictions
++ None
+
-+static void glamo_exit_debugfs(struct glamo_core *glamo)
-+{
-+ if (glamo->debugfs_dir)
-+ debugfs_remove_recursive(glamo->debugfs_dir);
-+}
-+#else
-+static void glamo_init_debugfs(struct glamo_core *glamo)
-+{
-+}
++See Also
++ \93GET_TX_PWR\94
+
-+static void glamo_exit_debugfs(struct glamo_core *glamo)
-+{
-+}
-+#endif
+
-+struct glamo_engine_desc {
-+ const char *name;
-+ uint16_t hostbus;
-+ const struct glamo_engine_reg_set *regs;
-+ int num_regs;
-+};
++=====================================================================
+
-+static const struct glamo_engine_reg_set glamo_lcd_regs[] = {
-+ { GLAMO_REG_CLOCK_LCD,
-+ GLAMO_CLOCK_LCD_EN_M5CLK |
-+ GLAMO_CLOCK_LCD_DG_M5CLK |
-+ GLAMO_CLOCK_LCD_EN_DMCLK,
++Name
++ SET_VOICE_PKT_SIZE
+
-+ GLAMO_CLOCK_LCD_EN_DHCLK |
-+ GLAMO_CLOCK_LCD_EN_DCLK
-+ },
-+ { GLAMO_REG_CLOCK_GEN5_1,
-+ GLAMO_CLOCK_GEN51_EN_DIV_DMCLK,
++Synopsis
++ If an AP does not support WMM, it has no way to differentiate voice from data.
++ Because the voice packet is typically small, packet in size less than voicePktSize are
++ assumed to be voice, otherwise it is treated as data.
+
-+ GLAMO_CLOCK_GEN51_EN_DIV_DHCLK |
-+ GLAMO_CLOCK_GEN51_EN_DIV_DCLK
-+ }
-+};
++Command
++ wmiconfig eth1 --setVoicePktSize <size-in-bytes>
+
-+static const struct glamo_engine_reg_set glamo_mmc_regs[] = {
-+ { GLAMO_REG_CLOCK_MMC,
-+ GLAMO_CLOCK_MMC_EN_M9CLK |
-+ GLAMO_CLOCK_MMC_DG_M9CLK,
++Command Parameters
++ UINT16 voicePktSize
++ Packet size in octets
+
-+ GLAMO_CLOCK_MMC_EN_TCLK |
-+ GLAMO_CLOCK_MMC_DG_TCLK
-+ },
-+ { GLAMO_REG_CLOCK_GEN5_1,
-+ 0,
-+ GLAMO_CLOCK_GEN51_EN_DIV_TCLK
-+ }
-+};
++Command Values
++ None
+
-+static const struct glamo_engine_reg_set glamo_2d_regs[] = {
-+ { GLAMO_REG_CLOCK_2D,
-+ GLAMO_CLOCK_2D_EN_M7CLK |
-+ GLAMO_CLOCK_2D_DG_M7CLK,
++Reset Values
++ voicePktSize default is 400 bytes
+
-+ GLAMO_CLOCK_2D_EN_GCLK |
-+ GLAMO_CLOCK_2D_DG_GCLK
-+ },
-+ { GLAMO_REG_CLOCK_GEN5_1,
-+ 0,
-+ GLAMO_CLOCK_GEN51_EN_DIV_GCLK,
-+ }
-+};
++Restrictions
++ No effect if WMM is unavailable
+
-+static const struct glamo_engine_reg_set glamo_cmdq_regs[] = {
-+ { GLAMO_REG_CLOCK_2D,
-+ GLAMO_CLOCK_2D_EN_M6CLK,
-+ 0
-+ },
-+};
+
-+#define GLAMO_ENGINE(xname, xhostbus, xregs) { \
-+ .name = xname, \
-+ .hostbus = xhostbus, \
-+ .num_regs = ARRAY_SIZE(xregs), \
-+ .regs = xregs, \
-+}
++=====================================================================
+
-+static const struct glamo_engine_desc glamo_engines[] = {
-+ [GLAMO_ENGINE_LCD] = GLAMO_ENGINE("LCD", GLAMO_HOSTBUS2_MMIO_EN_LCD,
-+ glamo_lcd_regs),
-+ [GLAMO_ENGINE_MMC] = GLAMO_ENGINE("MMC", GLAMO_HOSTBUS2_MMIO_EN_MMC,
-+ glamo_mmc_regs),
-+ [GLAMO_ENGINE_2D] = GLAMO_ENGINE("2D", GLAMO_HOSTBUS2_MMIO_EN_2D,
-+ glamo_2d_regs),
-+ [GLAMO_ENGINE_CMDQ] = GLAMO_ENGINE("CMDQ", GLAMO_HOSTBUS2_MMIO_EN_CQ,
-+ glamo_cmdq_regs),
-+};
++Name
++ SET_WMM
+
-+static inline const char *glamo_engine_name(enum glamo_engine engine)
-+{
-+ return glamo_engines[engine].name;
-+}
++Synopsis
++ Overrides the AR6000 device WMM capability
+
-+/***********************************************************************
-+ * 'engine' support
-+ ***********************************************************************/
++Command
++ wmiconfig eth1 --setwmm <enable>
+
-+int __glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int i;
-+ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+ const struct glamo_engine_reg_set *reg;
++Command Parameters
++ WMI_WMM_ENABLED
++ Enables WMM
+
-+ switch (engine) {
-+ case GLAMO_ENGINE_LCD:
-+ case GLAMO_ENGINE_MMC:
-+ case GLAMO_ENGINE_2D:
-+ case GLAMO_ENGINE_CMDQ:
-+ break;
-+ default:
-+ return -EINVAL;
-+ }
++ WMI_WMM_DISABLED
++ Disables WMM support
+
-+ reg = engine_desc->regs;
++Command Values
++ 0 = disabled
++ 1 = enabled
+
-+ __reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+ engine_desc->hostbus);
-+ for (i = engine_desc->num_regs; i; --i, ++reg)
-+ __reg_set_bit(glamo, reg->reg,
-+ reg->mask_suspended | reg->mask_enabled);
++Reset Value
++ WMM Disabled
+
-+ return 0;
-+}
++Restrictions
++ None
+
-+int glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int ret = 0;
+
-+ spin_lock(&glamo->lock);
++=====================================================================
+
-+ if (glamo->engine_state[engine] != GLAMO_ENGINE_ENABLED) {
-+ ret = __glamo_engine_enable(glamo, engine);
-+ if (!ret)
-+ glamo->engine_state[engine] = GLAMO_ENGINE_ENABLED;
-+ }
++Name
++ SET_WMM_TXOP
+
-+ spin_unlock(&glamo->lock);
++Synopsis
++ Configures TxOP Bursting when sending traffic to a WMM capable AP
+
-+ return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_enable);
++Command
++ wmiconfig eth1 --txopbursting <burstEnable>
+
-+int __glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int i;
-+ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+ const struct glamo_engine_reg_set *reg;
++ <burstEnable>
++ = 0
++ Disallow TxOp bursting
+
-+ switch (engine) {
-+ case GLAMO_ENGINE_LCD:
-+ case GLAMO_ENGINE_MMC:
-+ case GLAMO_ENGINE_2D:
-+ case GLAMO_ENGINE_CMDQ:
-+ break;
-+ default:
-+ return -EINVAL;
-+ }
++ = 1
++ Allow TxOp bursting
+
-+ reg = engine_desc->regs;
++Command Parameters
++ txopEnable
++ = WMI_TXOP_DISABLED
++ Disabled
+
-+ __reg_clear_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+ engine_desc->hostbus);
-+ for (i = engine_desc->num_regs; i; --i, ++reg)
-+ __reg_clear_bit(glamo, reg->reg,
-+ reg->mask_suspended | reg->mask_enabled);
++ = WMI_TXOP_ENABLED
++ Enabled
+
-+ return 0;
-+}
-+int glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int ret = 0;
++Command Values
++ txopEnable
++ = 0 Disabled
+
-+ spin_lock(&glamo->lock);
++ = 1 Enabled
+
-+ if (glamo->engine_state[engine] != GLAMO_ENGINE_DISABLED) {
-+ ret = __glamo_engine_disable(glamo, engine);
-+ if (!ret)
-+ glamo->engine_state[engine] = GLAMO_ENGINE_DISABLED;
-+ }
++Reset Value
++ Bursting is off by default
+
-+ spin_unlock(&glamo->lock);
++Restrictions
++ None
+
-+ return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_disable);
++=====================================================================
+
-+int __glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int i;
-+ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
-+ const struct glamo_engine_reg_set *reg;
+
-+ switch (engine) {
-+ case GLAMO_ENGINE_LCD:
-+ case GLAMO_ENGINE_MMC:
-+ case GLAMO_ENGINE_2D:
-+ case GLAMO_ENGINE_CMDQ:
-+ break;
-+ default:
-+ return -EINVAL;
-+ }
++Name
++ SET_WOW_MODE
+
-+ reg = engine_desc->regs;
++Synopsis
++ The host uses this command to enable or disable the WoW mode. When WoW mode
++ is enabled and the host is asleep, pattern matching takes place at the target level.
++ Only packets that match any of the pre-specified WoW filter patterns, will be passed
++ up to the host. The host will also be woken up by the target. Packets which do not
++ match any of the WoW patterns are discarded.
+
-+ __reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
-+ engine_desc->hostbus);
-+ for (i = engine_desc->num_regs; i; --i, ++reg) {
-+ __reg_set_bit(glamo, reg->reg, reg->mask_suspended);
-+ __reg_clear_bit(glamo, reg->reg, reg->mask_enabled);
-+ }
++Command
++ wmiconfig \96setwowmode <enable/disable>
+
-+ return 0;
-+}
++Command Parameters
++ A_BOOL enable_wow
++ Enable or disable WoW:
+
-+int glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ int ret = 0;
++Command Values
++ = 0
++ Disable WoW
+
-+ spin_lock(&glamo->lock);
++ = 1
++ Enable WoW
+
-+ if (glamo->engine_state[engine] != GLAMO_ENGINE_SUSPENDED) {
-+ ret = __glamo_engine_suspend(glamo, engine);
-+ if (!ret)
-+ glamo->engine_state[engine] = GLAMO_ENGINE_SUSPENDED;
-+ }
++Reset Value
++ None defined (default WoW mode is disabled).
+
-+ spin_unlock(&glamo->lock);
++Restrictions
++ None
+
-+ return ret;
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_suspend);
++See Also
++ \93GET_WOW_LIST\94
+
-+static const struct glamo_script reset_regs[] = {
-+ [GLAMO_ENGINE_LCD] = {
-+ GLAMO_REG_CLOCK_LCD, GLAMO_CLOCK_LCD_RESET
-+ },
-+ [GLAMO_ENGINE_MMC] = {
-+ GLAMO_REG_CLOCK_MMC, GLAMO_CLOCK_MMC_RESET
-+ },
-+ [GLAMO_ENGINE_CMDQ] = {
-+ GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_CQ_RESET
-+ },
-+ [GLAMO_ENGINE_2D] = {
-+ GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_RESET
-+ },
-+ [GLAMO_ENGINE_JPEG] = {
-+ GLAMO_REG_CLOCK_JPEG, GLAMO_CLOCK_JPEG_RESET
-+ },
-+};
+
-+void glamo_engine_reset(struct glamo_core *glamo, enum glamo_engine engine)
-+{
-+ uint16_t reg = reset_regs[engine].reg;
-+ uint16_t val = reset_regs[engine].val;
++=====================================================================
+
-+ if (engine >= ARRAY_SIZE(reset_regs)) {
-+ dev_warn(&glamo->pdev->dev, "unknown engine %u ", engine);
-+ return;
-+ }
++Name
++ SET_WSC_STATUS
+
-+ spin_lock(&glamo->lock);
-+ __reg_set_bit(glamo, reg, val);
-+ __reg_clear_bit(glamo, reg, val);
-+ spin_unlock(&glamo->lock);
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_reset);
++Synopsis
++ The supplicant uses this command to inform the target about the status of the WSC
++ registration protocol. During the WSC registration protocol, a flag is set so the target
++ bypasses some of the checks in the CSERV module. At the end of the registration, this
++ flag is reset.
+
-+int glamo_pll_rate(struct glamo_core *glamo,
-+ enum glamo_pll pll)
-+{
-+ uint16_t reg;
-+ unsigned int osci = glamo->pdata->osci_clock_rate;
++Command
++ N/A
+
-+ switch (pll) {
-+ case GLAMO_PLL1:
-+ reg = __reg_read(glamo, GLAMO_REG_PLL_GEN1);
-+ break;
-+ case GLAMO_PLL2:
-+ reg = __reg_read(glamo, GLAMO_REG_PLL_GEN3);
-+ break;
-+ default:
-+ return -EINVAL;
-+ }
++Command Parameters
++ A_BOOL status
++ = 1 WSC registration in progress
++ = 0 WSC protocol not running
+
-+ return (int)osci * (int)reg;
-+}
-+EXPORT_SYMBOL_GPL(glamo_pll_rate);
++Reply Parameters
++ None
+
-+int glamo_engine_reclock(struct glamo_core *glamo,
-+ enum glamo_engine engine,
-+ int hz)
-+{
-+ int pll;
-+ uint16_t reg, mask, div;
++Reset Value
++ None defined (default = 0)
+
-+ if (!hz)
-+ return -EINVAL;
++Restrictions
++ None
+
-+ switch (engine) {
-+ case GLAMO_ENGINE_LCD:
-+ pll = GLAMO_PLL1;
-+ reg = GLAMO_REG_CLOCK_GEN7;
-+ mask = 0xff;
-+ break;
-+ case GLAMO_ENGINE_MMC:
-+ pll = GLAMO_PLL1;
-+ reg = GLAMO_REG_CLOCK_GEN8;
-+ mask = 0xff;
-+ break;
-+ default:
-+ dev_warn(&glamo->pdev->dev,
-+ "reclock of engine 0x%x not supported\n", engine);
-+ return -EINVAL;
-+ break;
-+ }
+
-+ pll = glamo_pll_rate(glamo, pll);
++=====================================================================
+
-+ div = pll / hz;
++Name
++ SNR_THRESHOLD_PARAMS
+
-+ if (div != 0 && pll / div <= hz)
-+ --div;
++Synopsis
++ Configures how the AR6000 device monitors and reports SNR of the connected BSS,
++ used as a link quality metric.
+
-+ if (div > mask)
-+ div = mask;
++Command
++ --snrThreshold <weight> <upper_threshold_1> ...
++ <upper_threshold_4> <lower_threshold_1> ... <lower_threshold_4>
++ <pollTimer>
+
-+ dev_dbg(&glamo->pdev->dev,
-+ "PLL %d, kHZ %d, div %d\n", pll, hz / 1000, div);
++Command Parameters
++ <weight>
++ Share with rssiThreshold. Range in [1, 16], used
++ in the formula to calculate average RSSI
+
-+ reg_set_bit_mask(glamo, reg, mask, div);
-+ mdelay(5); /* wait some time to stabilize */
++ <upper_threshold_x>
++ Above thresholds expressed in db, in ascending
++ order
+
-+ return pll / (div + 1);
-+}
-+EXPORT_SYMBOL_GPL(glamo_engine_reclock);
++ <lower_threshold_x>
++ Below thresholds expressed in db, in ascending
++ order
+
-+/***********************************************************************
-+ * script support
-+ ***********************************************************************/
++ <pollTimer>
++ The signal strength sampling frequency in
++ seconds. If polltime = 0, signal strength
++ sampling is disabled
+
-+#define GLAMO_SCRIPT_END 0xffff
-+#define GLAMO_SCRIPT_WAIT 0xfffe
-+#define GLAMO_SCRIPT_LOCK_PLL 0xfffd
++Command Values
++ None
+
-+/*
-+ * couple of people reported artefacts with 2.6.28 changes, this
-+ * allows reversion to 2.6.24 settings
-+*/
-+static const uint16_t reg_0x200[] = {
-+ 0xe03, /* 0 waits on Async BB R & W, Use PLL 2 for mem bus */
-+ 0xef0, /* 3 waits on Async BB R & W, Use PLL 1 for mem bus */
-+ 0xea0, /* 2 waits on Async BB R & W, Use PLL 1 for mem bus */
-+ 0xe50, /* 1 waits on Async BB R & W, Use PLL 1 for mem bus */
-+ 0xe00, /* 0 waits on Async BB R & W, Use PLL 1 for mem bus */
-+ 0xef3, /* 3 waits on Async BB R & W, Use PLL 2 for mem bus */
-+ 0xea3, /* 2 waits on Async BB R & W, Use PLL 2 for mem bus */
-+ 0xe53, /* 1 waits on Async BB R & W, Use PLL 2 for mem bus */
-+};
-+
-+static int glamo_run_script(struct glamo_core *glamo,
-+ const struct glamo_script *script, int len,
-+ int may_sleep)
-+{
-+ int i;
-+ uint16_t status;
-+ const struct glamo_script *line = script;
-+
-+ for (i = 0; i < len; ++i, ++line) {
-+ switch (line->reg) {
-+ case GLAMO_SCRIPT_END:
-+ return 0;
-+ case GLAMO_SCRIPT_WAIT:
-+ if (may_sleep)
-+ msleep(line->val);
-+ else
-+ mdelay(line->val * 4);
-+ break;
-+ case GLAMO_SCRIPT_LOCK_PLL:
-+ /* spin until PLLs lock */
-+ do {
-+ status = __reg_read(glamo, GLAMO_REG_PLL_GEN5);
-+ } while ((status & 3) != 3);
-+ break;
-+ case 0x200:
-+ __reg_write(glamo, line->reg,
-+ reg_0x200[slow_memory & 0x7]);
-+ break;
-+ default:
-+ __reg_write(glamo, line->reg, line->val);
-+ break;
-+ }
-+ }
++Reset Value
++ None defined
+
-+ return 0;
-+}
++Restrictions
++ None
+
-+static const struct glamo_script glamo_init_script[] = {
-+ { GLAMO_REG_CLOCK_HOST, 0x1000 },
-+ { GLAMO_SCRIPT_WAIT, 2 },
-+ { GLAMO_REG_CLOCK_MEMORY, 0x1000 },
-+ { GLAMO_REG_CLOCK_MEMORY, 0x2000 },
-+ { GLAMO_REG_CLOCK_LCD, 0x1000 },
-+ { GLAMO_REG_CLOCK_MMC, 0x1000 },
-+ { GLAMO_REG_CLOCK_ISP, 0x1000 },
-+ { GLAMO_REG_CLOCK_ISP, 0x3000 },
-+ { GLAMO_REG_CLOCK_JPEG, 0x1000 },
-+ { GLAMO_REG_CLOCK_3D, 0x1000 },
-+ { GLAMO_REG_CLOCK_3D, 0x3000 },
-+ { GLAMO_REG_CLOCK_2D, 0x1000 },
-+ { GLAMO_REG_CLOCK_2D, 0x3000 },
-+ { GLAMO_REG_CLOCK_RISC1, 0x1000 },
-+ { GLAMO_REG_CLOCK_MPEG, 0x1000 },
-+ { GLAMO_REG_CLOCK_MPEG, 0x3000 },
-+ { GLAMO_REG_CLOCK_MPROC, 0x1000 /*0x100f*/ },
-+ { GLAMO_SCRIPT_WAIT, 2 },
-+ { GLAMO_REG_CLOCK_HOST, 0x0000 },
-+ { GLAMO_REG_CLOCK_MEMORY, 0x0000 },
-+ { GLAMO_REG_CLOCK_LCD, 0x0000 },
-+ { GLAMO_REG_CLOCK_MMC, 0x0000 },
-+ { GLAMO_REG_PLL_GEN1, 0x05db }, /* 48MHz */
-+ { GLAMO_REG_PLL_GEN3, 0x0aba }, /* 90MHz */
-+ { GLAMO_SCRIPT_LOCK_PLL, 0 },
-+ /*
-+ * b9 of this register MUST be zero to get any interrupts on INT#
-+ * the other set bits enable all the engine interrupt sources
-+ */
-+ { GLAMO_REG_IRQ_ENABLE, 0x0100 },
-+ { GLAMO_REG_CLOCK_GEN6, 0x2000 },
-+ { GLAMO_REG_CLOCK_GEN7, 0x0101 },
-+ { GLAMO_REG_CLOCK_GEN8, 0x0100 },
-+ { GLAMO_REG_CLOCK_HOST, 0x000d },
-+ /*
-+ * b7..b4 = 0 = no wait states on read or write
-+ * b0 = 1 select PLL2 for Host interface, b1 = enable it
-+ */
-+ { GLAMO_REG_HOSTBUS(1), 0x0e03 /* this is replaced by script parser */ },
-+ { GLAMO_REG_HOSTBUS(2), 0x07ff }, /* TODO: Disable all */
-+ { GLAMO_REG_HOSTBUS(10), 0x0000 },
-+ { GLAMO_REG_HOSTBUS(11), 0x4000 },
-+ { GLAMO_REG_HOSTBUS(12), 0xf00e },
++=====================================================================
+
-+ /* S-Media recommended "set tiling mode to 512 mode for memory access
-+ * more efficiency when 640x480" */
-+ { GLAMO_REG_MEM_TYPE, 0x0c74 }, /* 8MB, 16 word pg wr+rd */
-+ { GLAMO_REG_MEM_GEN, 0xafaf }, /* 63 grants min + max */
+
-+ { GLAMO_REG_MEM_TIMING1, 0x0108 },
-+ { GLAMO_REG_MEM_TIMING2, 0x0010 }, /* Taa = 3 MCLK */
-+ { GLAMO_REG_MEM_TIMING3, 0x0000 },
-+ { GLAMO_REG_MEM_TIMING4, 0x0000 }, /* CE1# delay fall/rise */
-+ { GLAMO_REG_MEM_TIMING5, 0x0000 }, /* UB# LB# */
-+ { GLAMO_REG_MEM_TIMING6, 0x0000 }, /* OE# */
-+ { GLAMO_REG_MEM_TIMING7, 0x0000 }, /* WE# */
-+ { GLAMO_REG_MEM_TIMING8, 0x1002 }, /* MCLK delay, was 0x1000 */
-+ { GLAMO_REG_MEM_TIMING9, 0x6006 },
-+ { GLAMO_REG_MEM_TIMING10, 0x00ff },
-+ { GLAMO_REG_MEM_TIMING11, 0x0001 },
-+ { GLAMO_REG_MEM_POWER1, 0x0020 },
-+ { GLAMO_REG_MEM_POWER2, 0x0000 },
-+ { GLAMO_REG_MEM_DRAM1, 0x0000 },
-+ { GLAMO_SCRIPT_WAIT, 1 },
-+ { GLAMO_REG_MEM_DRAM1, 0xc100 },
-+ { GLAMO_SCRIPT_WAIT, 1 },
-+ { GLAMO_REG_MEM_DRAM1, 0xe100 },
-+ { GLAMO_REG_MEM_DRAM2, 0x01d6 },
-+ { GLAMO_REG_CLOCK_MEMORY, 0x000b },
-+};
++Name
++ START_SCAN
+
-+/* Find out if we can support this version of the Glamo chip */
-+static int __devinit glamo_supported(struct glamo_core *glamo)
-+{
-+ uint16_t dev_id, rev_id;
++Synopsis
++ The host uses this command to start a long or short channel scan. All future scans are
++ relative to the time the AR6000 device processes this command. The device performs
++ a channel scan on receipt of this command, even if a scan was already in progress.
++ The host uses this command when it wishes to refresh its cached database of wireless
++ networks. The isLegacy field will be removed (0 for now) because it is achieved by
++ setting CONNECT_PROFILE_MATCH_DONE in the CONNECT command. See also
++ \93Scan and Roam\94
+
-+ dev_id = __reg_read(glamo, GLAMO_REG_DEVICE_ID);
-+ rev_id = __reg_read(glamo, GLAMO_REG_REVISION_ID);
++Command
++ wmiconfig eth1 --startscan <scan type> <forcefgscan> 0
++ <homeDwellTime> <forceScanInterval>
+
-+ switch (dev_id) {
-+ case 0x3650:
-+ switch (rev_id) {
-+ case GLAMO_CORE_REV_A2:
-+ break;
-+ case GLAMO_CORE_REV_A0:
-+ case GLAMO_CORE_REV_A1:
-+ case GLAMO_CORE_REV_A3:
-+ dev_warn(&glamo->pdev->dev, "untested core revision "
-+ "%04x, your mileage may vary\n", rev_id);
-+ break;
-+ default:
-+ dev_warn(&glamo->pdev->dev, "unknown glamo revision "
-+ "%04x, your mileage may vary\n", rev_id);
-+ }
-+ break;
-+ default:
-+ dev_err(&glamo->pdev->dev, "unsupported Glamo device %04x\n",
-+ dev_id);
-+ return 0;
-+ }
++Command Parameters
++ UINT8 scanType
++ WMI_SCAN_TYPE
+
-+ dev_dbg(&glamo->pdev->dev, "Detected Glamo core %04x Revision %04x "
-+ "(%uHz CPU / %uHz Memory)\n", dev_id, rev_id,
-+ glamo_pll_rate(glamo, GLAMO_PLL1),
-+ glamo_pll_rate(glamo, GLAMO_PLL2));
++Command Values
++ {
++ WMI_LONG_SCAN =0x0
++ Requests a full scan
++ WMI_SHORT_SCAN =0x1
++ Requests a short scan
++ } WMI_SCAN_TYPE
+
-+ return 1;
-+}
++ A_BOOL forceFgScan
++ forceFgScan
++ = 0
++ Disable the foreground scan
+
-+static int __devinit glamo_probe(struct platform_device *pdev)
-+{
-+ int ret = 0, n, irq, irq_base;
-+ struct glamo_core *glamo;
-+ struct resource *mem;
++ forceFgScan
++ = 1
++ Forces a foreground scan
+
-+ glamo = kmalloc(GFP_KERNEL, sizeof(*glamo));
-+ if (!glamo)
-+ return -ENOMEM;
++ A_UINT32 homeDwellTime
++ Maximum duration in the home
++ channel (in ms)
+
-+ for (n = 0; n < __NUM_GLAMO_ENGINES; n++)
-+ glamo->engine_state[n] = GLAMO_ENGINE_DISABLED;
++ A_UINT32 forceScanInterval
++ Time interval between scans (in ms)
+
-+ spin_lock_init(&glamo->lock);
++ A_UINT32 scanType
++ WMI_SCAN_TYPE
+
-+ glamo->pdev = pdev;
-+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-+ glamo->irq = platform_get_irq(pdev, 0);
-+ glamo->irq_base = irq_base = platform_get_irq(pdev, 1);
-+ glamo->pdata = pdev->dev.platform_data;
++Reset Value
++ Disable forcing foreground scan
+
-+ if (glamo->irq < 0) {
-+ ret = glamo->irq;
-+ dev_err(&pdev->dev, "Failed to get platform irq: %d\n", ret);
-+ goto err_free;
-+ }
++Restrictions
++ isLegacy field will no longer be supported (pass as 0 for now)
+
-+ if (irq_base < 0) {
-+ ret = glamo->irq;
-+ dev_err(&pdev->dev, "Failed to get glamo irq base: %d\n", ret);
-+ goto err_free;
-+ }
+
-+ if (!mem) {
-+ dev_err(&pdev->dev, "Failed to get platform memory\n");
-+ ret = -ENOENT;
-+ goto err_free;
-+ }
++=====================================================================
+
-+ if (!glamo->pdata) {
-+ dev_err(&pdev->dev, "Missing platform data\n");
-+ ret = -ENOENT;
-+ goto err_free;
-+ }
++Name
++ SYNCHRONIZE
+
-+ /* only request the generic, hostbus and memory controller registers */
-+ glamo->mem = request_mem_region(mem->start, GLAMO_REGOFS_VIDCAP,
-+ pdev->name);
++Synopsis
++ The host uses this command to force a synchronization point between the command
++ and data paths
+
-+ if (!glamo->mem) {
-+ dev_err(&pdev->dev, "Failed to request io memory region\n");
-+ ret = -ENOENT;
-+ goto err_free;
-+ }
++Command
++ TBD
+
-+ glamo->base = ioremap(glamo->mem->start, resource_size(glamo->mem));
-+ if (!glamo->base) {
-+ dev_err(&pdev->dev, "Failed to ioremap() memory region\n");
-+ goto err_release_mem_region;
-+ }
++Command Parameters
++ None
+
-+ /* confirm it isn't insane version */
-+ if (!glamo_supported(glamo)) {
-+ dev_err(&pdev->dev,
-+ "This version of the Glamo is not supported\n");
-+ goto err_iounmap;
-+ }
+
-+ platform_set_drvdata(pdev, glamo);
+
-+ /* debugfs */
-+ glamo_init_debugfs(glamo);
++Command Values
++ None
+
-+ /* init the chip with canned register set */
-+ glamo_run_script(glamo, glamo_init_script,
-+ ARRAY_SIZE(glamo_init_script), 1);
+
-+ /*
-+ * finally set the mfd interrupts up
-+ */
-+ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+#ifdef CONFIG_ARM
-+ set_irq_flags(irq, IRQF_VALID);
-+#else
-+ set_irq_noprobe(irq);
-+#endif
-+ set_irq_chip_data(irq, glamo);
-+ set_irq_chip_and_handler(irq, &glamo_irq_chip,
-+ handle_level_irq);
-+ }
+
-+ set_irq_type(glamo->irq, IRQ_TYPE_EDGE_FALLING);
-+ set_irq_data(glamo->irq, glamo);
-+ set_irq_chained_handler(glamo->irq, glamo_irq_demux_handler);
++Reset Values
++ None
+
-+ ret = mfd_add_devices(&pdev->dev, pdev->id, glamo_cells,
-+ ARRAY_SIZE(glamo_cells), mem, glamo->irq_base);
+
-+ if (ret) {
-+ dev_err(&pdev->dev, "Failed to add child devices: %d\n", ret);
-+ goto err_free_irqs;
-+ }
+
-+ dev_info(&glamo->pdev->dev, "Glamo core PLL1: %uHz, PLL2: %uHz\n",
-+ glamo_pll_rate(glamo, GLAMO_PLL1),
-+ glamo_pll_rate(glamo, GLAMO_PLL2));
++Restrictions
++ None
+
-+ return 0;
+
-+err_free_irqs:
-+ disable_irq(glamo->irq);
-+ set_irq_chained_handler(glamo->irq, NULL);
-+ set_irq_chip_data(glamo->irq, NULL);
++=====================================================================
+
-+ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+ set_irq_chip(irq, NULL);
-+#ifdef CONFIG_ARM
-+ set_irq_flags(irq, 0);
-+#else
-+ set_irq_probe(irq);
-+#endif
-+ set_irq_chip_data(irq, NULL);
-+ }
-+err_iounmap:
-+ iounmap(glamo->base);
-+err_release_mem_region:
-+ release_mem_region(glamo->mem->start, resource_size(glamo->mem));
-+err_free:
-+ platform_set_drvdata(pdev, NULL);
-+ kfree(glamo);
++Name
++ TARGET_ERROR_REPORT_BITMASK
+
-+ return ret;
-+}
++Synopsis
++ Allows the host to control \93ERROR_REPORT\94 events from the AR6000 device.
+
-+static int __devexit glamo_remove(struct platform_device *pdev)
-+{
-+ struct glamo_core *glamo = platform_get_drvdata(pdev);
-+ int irq;
-+ int irq_base = glamo->irq_base;
++ If error reporting is disabled for an error type, a count of errors of that type is
++ maintained by the device.
+
-+ glamo_exit_debugfs(glamo);
++ If error reporting is enabled for an error type, an \93ERROR_REPORT\94 event is
++ sent when an error occurs and the error report bit is cleared.
+
-+ mfd_remove_devices(&pdev->dev);
++ Error counts for each error type are available through the \93GET_TARGET_STATS\94
++ command.
+
-+ disable_irq(glamo->irq);
-+ set_irq_chained_handler(glamo->irq, NULL);
-+ set_irq_chip_data(glamo->irq, NULL);
++Command
++ wmiconfig eth1 --setErrorReportingBitmask
+
-+ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
-+#ifdef CONFIG_ARM
-+ set_irq_flags(irq, 0);
-+#else
-+ set_irq_noprobe();
-+#endif
-+ set_irq_chip(irq, NULL);
-+ set_irq_chip_data(irq, NULL);
-+ }
++Command Parameters
++ UINT32 bitmask
++ Represents the set of
++ WMI_TARGET_ERROR_VAL error types
++ enabled for reporting
+
-+ platform_set_drvdata(pdev, NULL);
-+ iounmap(glamo->base);
-+ release_mem_region(glamo->mem->start, resource_size(glamo->mem));
-+ kfree(glamo);
++Command Values
++ {
++ WMI_TARGET_PM_ERR_FAIL = 0x00000001
++ Power save fails (only two cases):
++ Retry out of null function/QoS null
++ function to associated AP for PS
++ indication'
++ Host changes the PS setting when
++ STA is off home channel
+
-+ return 0;
-+}
++ WMI_TARGET_KEY_NOT_FOUND = 0x00000002
++ No cipher key
++ WMI_TARGET_DECRYPTION_ERR = 0x00000004
++ Decryption error
++ WMI_TARGET_BMISS = 0x00000008
++ Beacon miss
++ WMI_PSDISABLE_NODE_JOIN = 0x00000010
++ A non-PS-enabled STA joined the
++ PS-enabled network
++ WMI_TARGET_COM_ERR = 0x00000020
++ Host/target communication error
++ WMI_TARGET_FATAL_ERR = 0x00000040
++ Fatal error
++ } WMI_TARGET_ERROR_VAL
+
-+#ifdef CONFIG_PM
-+#if 0
-+static struct glamo_script glamo_resume_script[] = {
++Reset Values
++ Bitmask is 0, and all error reporting is disabled
+
-+ { GLAMO_REG_PLL_GEN1, 0x05db }, /* 48MHz */
-+ { GLAMO_REG_PLL_GEN3, 0x0aba }, /* 90MHz */
-+ { GLAMO_REG_DFT_GEN6, 1 },
-+ { 0xfffe, 100 },
-+ { 0xfffd, 0 },
-+ { 0x200, 0x0e03 },
++Restrictions
++ None
+
-+ /*
-+ * b9 of this register MUST be zero to get any interrupts on INT#
-+ * the other set bits enable all the engine interrupt sources
-+ */
-+ { GLAMO_REG_IRQ_ENABLE, 0x01ff },
-+ { GLAMO_REG_CLOCK_HOST, 0x0018 },
-+ { GLAMO_REG_CLOCK_GEN5_1, 0x18b1 },
+
-+ { GLAMO_REG_MEM_DRAM1, 0x0000 },
-+ { 0xfffe, 1 },
-+ { GLAMO_REG_MEM_DRAM1, 0xc100 },
-+ { 0xfffe, 1 },
-+ { GLAMO_REG_MEM_DRAM1, 0xe100 },
-+ { GLAMO_REG_MEM_DRAM2, 0x01d6 },
-+ { GLAMO_REG_CLOCK_MEMORY, 0x000b },
-+};
-+#endif
++=====================================================================
++WMI Events
+
-+#if 0
-+static void glamo_power(struct glamo_core *glamo)
-+{
-+ unsigned long flags;
++Event
++ Description
++ Page
+
-+ spin_lock_irqsave(&glamo->lock, flags);
+
-+ /*
-+Power management
-+static const REG_VALUE_MASK_TYPE reg_powerOn[] =
-+{
-+ { REG_GEN_DFT6, REG_BIT_ALL, REG_DATA(1u << 0) },
-+ { REG_GEN_PLL3, 0u, REG_DATA(1u << 13) },
-+ { REG_GEN_MEM_CLK, REG_BIT_ALL, REG_BIT_EN_MOCACLK },
-+ { REG_MEM_DRAM2, 0u, REG_BIT_EN_DEEP_POWER_DOWN },
-+ { REG_MEM_DRAM1, 0u, REG_BIT_SELF_REFRESH }
-+};
++BSSINFO
++ Contains information describing BSSs collected during a scan
+
-+static const REG_VALUE_MASK_TYPE reg_powerStandby[] =
-+{
-+ { REG_MEM_DRAM1, REG_BIT_ALL, REG_BIT_SELF_REFRESH },
-+ { REG_GEN_MEM_CLK, 0u, REG_BIT_EN_MOCACLK },
-+ { REG_GEN_PLL3, REG_BIT_ALL, REG_DATA(1u << 13) },
-+ { REG_GEN_DFT5, REG_BIT_ALL, REG_DATA(1u << 0) }
-+};
++CAC_EVENTID
++ Indicates signalling events in admission control
+
-+static const REG_VALUE_MASK_TYPE reg_powerSuspend[] =
-+{
-+ { REG_MEM_DRAM2, REG_BIT_ALL, REG_BIT_EN_DEEP_POWER_DOWN },
-+ { REG_GEN_MEM_CLK, 0u, REG_BIT_EN_MOCACLK },
-+ { REG_GEN_PLL3, REG_BIT_ALL, REG_DATA(1u << 13) },
-+ { REG_GEN_DFT5, REG_BIT_ALL, REG_DATA(1u << 0) }
-+};
-+*/
-+ switch (new_state) {
-+ case GLAMO_POWER_ON:
++CMDERROR
++ The AR6000 device encounters an error while attempting to process
++ a command
+
-+ /*
-+ * glamo state on resume is nondeterministic in some
-+ * fundamental way, it has also been observed that the
-+ * Glamo reset pin can get asserted by, eg, touching it with
-+ * a scope probe. So the only answer is to roll with it and
-+ * force an external reset on the Glamo during resume.
-+ */
++CONNECT
++ The device has connected to a wireless network
+
++DISCONNECT
++ The device lost connectivity with a wireless network
+
-+ break;
++ERROR_REPORT
++ An error has occurred for which the host previously requested
++ notification with the command
++ \93TARGET_ERROR_REPORT_BITMASK\94
+
-+ case GLAMO_POWER_SUSPEND:
++EXTENSION
++ WMI extension event
+
-+ break;
-+ }
-+ spin_unlock_irqrestore(&glamo->lock, flags);
-+}
-+#endif
++GET_PMKID_LIST_EVENT
++ Created in response to a \93GET_PMKID_LIST_CMD\94 command
+
-+static int glamo_suspend(struct device *dev)
-+{
-+ struct glamo_core *glamo = dev_get_drvdata(dev);
-+ int n;
++GET_WOW_LIST_EVENT
++ Response to the wmiconfig \93GET_WOW_LIST\94 command to
++ retrieve the configured WoW patterns
+
-+ spin_lock(&glamo->lock);
++NEIGHBOR_REPORT
++ Neighbor APs that match the current profile were detected
+
-+ glamo->saved_irq_mask = __reg_read(glamo, GLAMO_REG_IRQ_ENABLE);
++OPT_RX_FRAME_EVENT
++ (Special feature) informs the host of the reception of a special frame
+
-+ /* nuke interrupts */
-+ __reg_write(glamo, GLAMO_REG_IRQ_ENABLE, 0x200);
++PSTREAM_TIMEOUT
++ A prioritized stream has been idle for a specified interval
+
-+ /* take down each engine before we kill mem and pll */
-+ for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
-+ if (glamo->engine_state[n] != GLAMO_ENGINE_DISABLED)
-+ __glamo_engine_disable(glamo, n);
-+ }
++READY
++ The AR6000 device is ready to accept commands
+
-+ /* enable self-refresh */
++REGDOMAIN
++ The regulatory domain has changed
+
-+ __reg_write(glamo, GLAMO_REG_MEM_DRAM1,
-+ GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
-+ GLAMO_MEM_DRAM1_EN_GATE_CKE |
-+ GLAMO_MEM_DRAM1_SELF_REFRESH |
-+ GLAMO_MEM_REFRESH_COUNT);
-+ __reg_write(glamo, GLAMO_REG_MEM_DRAM1,
-+ GLAMO_MEM_DRAM1_EN_MODEREG_SET |
-+ GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
-+ GLAMO_MEM_DRAM1_EN_GATE_CKE |
-+ GLAMO_MEM_DRAM1_SELF_REFRESH |
-+ GLAMO_MEM_REFRESH_COUNT);
++REPORT_ROAM_DATA_EVENT
++ Reports the roam time calculations made by the device
++ (generated with a special build)
++ \97
+
-+ /* force RAM into deep powerdown */
-+ __reg_write(glamo, GLAMO_REG_MEM_DRAM2,
-+ GLAMO_MEM_DRAM2_DEEP_PWRDOWN |
-+ (7 << 6) | /* tRC */
-+ (1 << 4) | /* tRP */
-+ (1 << 2) | /* tRCD */
-+ 2); /* CAS latency */
++REPORT_STATISTICS
++ Reply to a \93GET_TARGET_STATS\94 command
+
-+ /* disable clocks to memory */
-+ __reg_write(glamo, GLAMO_REG_CLOCK_MEMORY, 0);
++ROAM_TBL_EVENT
++ Reports the roam table
+
-+ /* all dividers from OSCI */
-+ __reg_set_bit_mask(glamo, GLAMO_REG_CLOCK_GEN5_1, 0x400, 0x400);
++RSSI_THRESHOLD
++ Signal strength from the connected AP has crossed the threshold
++ defined in the \93RSSI_THRESHOLD_PARAMS\94 command
+
-+ /* PLL2 into bypass */
-+ __reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 12, 1 << 12);
++SCAN_COMPLETE_EVENT
++ A scan has completed (added status SCAN_ABORTED in release 2.0)
+
-+ __reg_write(glamo, GLAMO_BASIC_MMC_EN_TCLK_DLYA1, 0x0e00);
++TEST_EVENT
++ Event generated by the TCMD
+
-+ /* kill PLLS 1 then 2 */
-+ __reg_write(glamo, GLAMO_REG_DFT_GEN5, 0x0001);
-+ __reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 13, 1 << 13);
++TKIP_MICERROR
++ TKIP MIC errors were detected
+
-+ spin_unlock(&glamo->lock);
++=====================================================================
+
-+ return 0;
-+}
++Name
++ BSSINFO
+
-+static int glamo_resume(struct device *dev)
-+{
-+ struct glamo_core *glamo = dev_get_drvdata(dev);
-+ int n;
++Synopsis
++ Contains information describing one or more BSSs as collected during a scan.
++ Information includes the BSSID, SSID, RSSI, network type, channel, supported rates,
++ and IEs. BSSINFO events are sent only after the device receives a beacon or probe-
++ response frame that pass the filter specified in the \93SET_BSS_FILTER\94 command.
++ BSSINFO events consist of a small header followed by a copy of the beacon or probe
++ response frame. The 802.11 header is not present. For formats of beacon and probe-
++ response frames please consult the IEEE 802.11 specification.
+
-+ (glamo->pdata->glamo_external_reset)(0);
-+ udelay(10);
-+ (glamo->pdata->glamo_external_reset)(1);
-+ mdelay(5);
++ The beacons or probe responses containing the IE specified by the
++ WMI_BSS_FILTER_CMD are passed to the host through the
++ WMI_BSSINFO_EVENT. The event carries a 32-bit bitmask that indicates the IEs that
++ were detected in the management frame. The frame type field has been extended to
++ indicate action management frames. This would be helpful to route these frames
++ through the same event mechanism as used by the beacon processing function.
+
-+ spin_lock(&glamo->lock);
++ If the bssFilter in the SET_BSS_FILTER matches, then the ieMask is not relevant
++ because the BSSINFO event is sent to the host. If the bssFilter doesnot match in the
++ beacons/probe respones, then the ieMask match dictates whether the BSSINFO
++ event is sent to the host. In the case of action management frames, the ieMask is the
++ filter that is applied.
+
-+ glamo_run_script(glamo, glamo_init_script,
-+ ARRAY_SIZE(glamo_init_script), 0);
++Event ID
++ 0x1004
+
++Event Parameters
++ typedef struct {
++ A_UINT16 channel;
++ Specifies the frequency (in MHz) where the
++ frame was received
++ A_UINT8 frameType;
++ A WMI_BI_FTYPE value
++ A_UINT8 snr;
++ A_INT16 rssi;
++ Indicates signal strength
++ A_UINT8 bssid[ATH_MAC_LEN];
++ A_UINT32 ieMask;
++ } _ATTRIB_PACK_WMI_BSS_INFO_HDR;
+
-+ for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
-+ switch (glamo->engine_state[n]) {
-+ case GLAMO_ENGINE_SUSPENDED:
-+ __glamo_engine_suspend(glamo, n);
-+ break;
-+ case GLAMO_ENGINE_ENABLED:
-+ __glamo_engine_enable(glamo, n);
-+ break;
-+ default:
-+ break;
-+ }
-+ }
++ Beacon or Probe Response Frame
+
-+ __reg_write(glamo, GLAMO_REG_IRQ_ENABLE, glamo->saved_irq_mask);
++Event Values
++ {
++ BEACON_FTYPE = 0x1
++ Indicates a beacon frame
++ PROBERESP_FTYPE
++ Indicates a probe response frame
++ ACTION_MGMT_FTYPE
++ } WMI_BI_FTYPE
+
-+ spin_unlock(&glamo->lock);
++=====================================================================
+
-+ return 0;
-+}
++Name
++ CAC_EVENTID
+
-+static const struct dev_pm_ops glamo_pm_ops = {
-+ .suspend = glamo_suspend,
-+ .resume = glamo_resume,
-+ .poweroff = glamo_suspend,
-+ .restore = glamo_resume,
-+};
++Synopsis
++ Indicates signalling events in admission control. Events are generated when
++ admission is accepted, rejected, or deleted by either the host or the AP. If the AP does
++ not respond to an admission request within a timeout of 500 ms, an event is
++ generated to the host.
+
-+#define GLAMO_PM_OPS (&glamo_pm_ops)
++Event ID
++ 0x1011
+
-+#else
-+#define GLAMO_PM_OPS NULL
-+#endif
++Event Parameters
++ UINT8
++ ac
++ Access class pertaining to the
++signalling
+
-+static struct platform_driver glamo_driver = {
-+ .probe = glamo_probe,
-+ .remove = __devexit_p(glamo_remove),
-+ .driver = {
-+ .name = "glamo3362",
-+ .owner = THIS_MODULE,
-+ .pm = GLAMO_PM_OPS,
-+ },
-+};
++ UINT8 cac_indication
++ Type of indication; indications are
++ listed in WMI_CAC_INDICATION
+
-+static int __devinit glamo_init(void)
-+{
-+ return platform_driver_register(&glamo_driver);
-+}
-+module_init(glamo_init);
++ UINT8 statusCode
++ AP response status code for a
++ request
+
-+static void __exit glamo_exit(void)
-+{
-+ platform_driver_unregister(&glamo_driver);
-+}
-+module_exit(glamo_exit);
++ UINT8 tspecSuggestion[63]
++ Suggested TSPEC from AP
+
-+MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
-+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
-+MODULE_DESCRIPTION("Smedia Glamo 3362 core/resource driver");
-+MODULE_LICENSE("GPL");
-+MODULE_ALIAS("platform:glamo3362");
-diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
-index fe8f922..bf77c8f 100644
---- a/drivers/mfd/pcf50633-adc.c
-+++ b/drivers/mfd/pcf50633-adc.c
-@@ -30,13 +30,13 @@
- struct pcf50633_adc_request {
- int mux;
- int avg;
-- int result;
- void (*callback)(struct pcf50633 *, void *, int);
- void *callback_param;
-+};
-
-- /* Used in case of sync requests */
-+struct pcf50633_adc_sync_request {
-+ int result;
- struct completion completion;
--
- };
-
- #define PCF50633_MAX_ADC_FIFO_DEPTH 8
-@@ -51,11 +51,6 @@ struct pcf50633_adc {
- struct mutex queue_mutex;
- };
-
--static inline struct pcf50633_adc *__to_adc(struct pcf50633 *pcf)
--{
-- return platform_get_drvdata(pcf->adc_pdev);
--}
--
- static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
- {
- channel &= PCF50633_ADCC1_ADCMUX_MASK;
-@@ -71,7 +66,7 @@ static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
-
- static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
- {
-- struct pcf50633_adc *adc = __to_adc(pcf);
-+ struct pcf50633_adc *adc = pcf->adc;
- int head;
-
- head = adc->queue_head;
-@@ -85,7 +80,7 @@ static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
- static int
- adc_enqueue_request(struct pcf50633 *pcf, struct pcf50633_adc_request *req)
- {
-- struct pcf50633_adc *adc = __to_adc(pcf);
-+ struct pcf50633_adc *adc = pcf->adc;
- int head, tail;
-
- mutex_lock(&adc->queue_mutex);
-@@ -109,10 +104,10 @@ adc_enqueue_request(struct pcf50633 *pcf, struct pcf50633_adc_request *req)
- return 0;
- }
-
--static void
--pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param, int result)
-+static void pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param,
-+ int result)
- {
-- struct pcf50633_adc_request *req = param;
-+ struct pcf50633_adc_sync_request *req = param;
-
- req->result = result;
- complete(&req->completion);
-@@ -120,28 +115,19 @@ pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param, int result)
-
- int pcf50633_adc_sync_read(struct pcf50633 *pcf, int mux, int avg)
- {
-- struct pcf50633_adc_request *req;
-- int err;
-+ struct pcf50633_adc_sync_request req;
-+ int ret;
-
-- /* req is freed when the result is ready, in interrupt handler */
-- req = kzalloc(sizeof(*req), GFP_KERNEL);
-- if (!req)
-- return -ENOMEM;
--
-- req->mux = mux;
-- req->avg = avg;
-- req->callback = pcf50633_adc_sync_read_callback;
-- req->callback_param = req;
-+ init_completion(&req.completion);
-
-- init_completion(&req->completion);
-- err = adc_enqueue_request(pcf, req);
-- if (err)
-- return err;
-+ ret = pcf50633_adc_async_read(pcf, mux, avg,
-+ pcf50633_adc_sync_read_callback, &req);
-+ if (ret)
-+ return ret;
-
-- wait_for_completion(&req->completion);
-+ wait_for_completion(&req.completion);
-
-- /* FIXME by this time req might be already freed */
-- return req->result;
-+ return req.result;
- }
- EXPORT_SYMBOL_GPL(pcf50633_adc_sync_read);
-
-@@ -210,13 +196,14 @@ static void pcf50633_adc_irq(int irq, void *data)
-
- static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
- {
-+ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
- struct pcf50633_adc *adc;
-
- adc = kzalloc(sizeof(*adc), GFP_KERNEL);
- if (!adc)
- return -ENOMEM;
-
-- adc->pcf = dev_to_pcf50633(pdev->dev.parent);
-+ adc->pcf = pcf;
- platform_set_drvdata(pdev, adc);
-
- pcf50633_register_irq(adc->pcf, PCF50633_IRQ_ADCRDY,
-@@ -224,6 +211,8 @@ static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
-
- mutex_init(&adc->queue_mutex);
-
-+ pcf->adc = adc;
++Event Values
++ {
++ CAC_INDICATION_ADMISSION = 0x00
++ CAC_INDICATION_ADMISSION_RESP = 0x01
++ CAC_INDICATION_DELETE = 0x02
++ CAC_INDICATION_NO_RESP = 0x03
++ } WMI_CAC_INDICATION
+
- return 0;
- }
-
-@@ -232,6 +221,8 @@ static int __devexit pcf50633_adc_remove(struct platform_device *pdev)
- struct pcf50633_adc *adc = platform_get_drvdata(pdev);
- int i, head;
-
-+ adc->pcf->adc = NULL;
+
- pcf50633_free_irq(adc->pcf, PCF50633_IRQ_ADCRDY);
-
- mutex_lock(&adc->queue_mutex);
-diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
-index 63a614d..aa906ff 100644
---- a/drivers/mfd/pcf50633-core.c
-+++ b/drivers/mfd/pcf50633-core.c
-@@ -21,16 +21,18 @@
- #include <linux/workqueue.h>
- #include <linux/platform_device.h>
- #include <linux/i2c.h>
--#include <linux/irq.h>
- #include <linux/slab.h>
-
-+#include <linux/mfd/core.h>
++=====================================================================
+
- #include <linux/mfd/pcf50633/core.h>
-
--/* Two MBCS registers used during cold start */
--#define PCF50633_REG_MBCS1 0x4b
--#define PCF50633_REG_MBCS2 0x4c
--#define PCF50633_MBCS1_USBPRES 0x01
--#define PCF50633_MBCS1_ADAPTPRES 0x01
-+int pcf50633_irq_init(struct pcf50633 *pcf, int irq);
-+void pcf50633_irq_free(struct pcf50633 *pcf);
-+#ifdef CONFIG_PM
-+int pcf50633_irq_suspend(struct pcf50633 *pcf);
-+int pcf50633_irq_resume(struct pcf50633 *pcf);
-+#endif
-
- static int __pcf50633_read(struct pcf50633 *pcf, u8 reg, int num, u8 *data)
- {
-@@ -215,346 +217,70 @@ static struct attribute_group pcf_attr_group = {
- .attrs = pcf_sysfs_entries,
- };
-
--int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
-- void (*handler) (int, void *), void *data)
--{
-- if (irq < 0 || irq > PCF50633_NUM_IRQ || !handler)
-- return -EINVAL;
--
-- if (WARN_ON(pcf->irq_handler[irq].handler))
-- return -EBUSY;
--
-- mutex_lock(&pcf->lock);
-- pcf->irq_handler[irq].handler = handler;
-- pcf->irq_handler[irq].data = data;
-- mutex_unlock(&pcf->lock);
--
-- return 0;
--}
--EXPORT_SYMBOL_GPL(pcf50633_register_irq);
--
--int pcf50633_free_irq(struct pcf50633 *pcf, int irq)
--{
-- if (irq < 0 || irq > PCF50633_NUM_IRQ)
-- return -EINVAL;
--
-- mutex_lock(&pcf->lock);
-- pcf->irq_handler[irq].handler = NULL;
-- mutex_unlock(&pcf->lock);
--
-- return 0;
--}
--EXPORT_SYMBOL_GPL(pcf50633_free_irq);
--
--static int __pcf50633_irq_mask_set(struct pcf50633 *pcf, int irq, u8 mask)
--{
-- u8 reg, bits, tmp;
-- int ret = 0, idx;
--
-- idx = irq >> 3;
-- reg = PCF50633_REG_INT1M + idx;
-- bits = 1 << (irq & 0x07);
--
-- mutex_lock(&pcf->lock);
--
-- if (mask) {
-- ret = __pcf50633_read(pcf, reg, 1, &tmp);
-- if (ret < 0)
-- goto out;
--
-- tmp |= bits;
--
-- ret = __pcf50633_write(pcf, reg, 1, &tmp);
-- if (ret < 0)
-- goto out;
--
-- pcf->mask_regs[idx] &= ~bits;
-- pcf->mask_regs[idx] |= bits;
-- } else {
-- ret = __pcf50633_read(pcf, reg, 1, &tmp);
-- if (ret < 0)
-- goto out;
--
-- tmp &= ~bits;
--
-- ret = __pcf50633_write(pcf, reg, 1, &tmp);
-- if (ret < 0)
-- goto out;
--
-- pcf->mask_regs[idx] &= ~bits;
-- }
--out:
-- mutex_unlock(&pcf->lock);
--
-- return ret;
--}
--
--int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
--{
-- dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
--
-- return __pcf50633_irq_mask_set(pcf, irq, 1);
--}
--EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
--
--int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
--{
-- dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
--
-- return __pcf50633_irq_mask_set(pcf, irq, 0);
--}
--EXPORT_SYMBOL_GPL(pcf50633_irq_unmask);
--
--int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq)
--{
-- u8 reg, bits;
--
-- reg = irq >> 3;
-- bits = 1 << (irq & 0x07);
--
-- return pcf->mask_regs[reg] & bits;
--}
--EXPORT_SYMBOL_GPL(pcf50633_irq_mask_get);
--
--static void pcf50633_irq_call_handler(struct pcf50633 *pcf, int irq)
--{
-- if (pcf->irq_handler[irq].handler)
-- pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
--}
--
--/* Maximum amount of time ONKEY is held before emergency action is taken */
--#define PCF50633_ONKEY1S_TIMEOUT 8
--
--static void pcf50633_irq_worker(struct work_struct *work)
--{
-- struct pcf50633 *pcf;
-- int ret, i, j;
-- u8 pcf_int[5], chgstat;
--
-- pcf = container_of(work, struct pcf50633, irq_work);
--
-- /* Read the 5 INT regs in one transaction */
-- ret = pcf50633_read_block(pcf, PCF50633_REG_INT1,
-- ARRAY_SIZE(pcf_int), pcf_int);
-- if (ret != ARRAY_SIZE(pcf_int)) {
-- dev_err(pcf->dev, "Error reading INT registers\n");
--
-- /*
-- * If this doesn't ACK the interrupt to the chip, we'll be
-- * called once again as we're level triggered.
-- */
-- goto out;
-- }
--
-- /* defeat 8s death from lowsys on A5 */
-- pcf50633_reg_write(pcf, PCF50633_REG_OOCSHDWN, 0x04);
--
-- /* We immediately read the usb and adapter status. We thus make sure
-- * only of USBINS/USBREM IRQ handlers are called */
-- if (pcf_int[0] & (PCF50633_INT1_USBINS | PCF50633_INT1_USBREM)) {
-- chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
-- if (chgstat & (0x3 << 4))
-- pcf_int[0] &= ~(1 << PCF50633_INT1_USBREM);
-- else
-- pcf_int[0] &= ~(1 << PCF50633_INT1_USBINS);
-- }
--
-- /* Make sure only one of ADPINS or ADPREM is set */
-- if (pcf_int[0] & (PCF50633_INT1_ADPINS | PCF50633_INT1_ADPREM)) {
-- chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
-- if (chgstat & (0x3 << 4))
-- pcf_int[0] &= ~(1 << PCF50633_INT1_ADPREM);
-- else
-- pcf_int[0] &= ~(1 << PCF50633_INT1_ADPINS);
-- }
--
-- dev_dbg(pcf->dev, "INT1=0x%02x INT2=0x%02x INT3=0x%02x "
-- "INT4=0x%02x INT5=0x%02x\n", pcf_int[0],
-- pcf_int[1], pcf_int[2], pcf_int[3], pcf_int[4]);
--
-- /* Some revisions of the chip don't have a 8s standby mode on
-- * ONKEY1S press. We try to manually do it in such cases. */
++
++Name
++ CMDERROR
++
++Synopsis
++ Indicates that the AR6000 device encountered an error while attempting to process a
++ command. This error is fatal and indicates that the device requires a reset.
++
++Event ID
++ 0x1005
++
++Event Parameters
++ UINT16 commandId
++ Corresponds to the command which generated
++ the error
++ UINT8 errorCode
++ A WMI_ERROR_CODE value
++
++Event Values
++ {
++ INVALID_PARAM = 1
++ Invalid parameter
++ ILLEGAL_STATE = 2
++ Illegal state
++ INTERNAL_ERROR = 3
++ Internal Error
++ All other values reserved
++ } WMI_ERROR_CODE
++
++
++=====================================================================
++
++
++Name
++ CONNECT
++
++Synopsis
++ Signals that the AR6000 connected to a wireless network. Connection occurs due to a
++ \93CONNECT\94 command or roaming to a new AP. For infrastructure networks, shows
++ that the AR6000 successfully performed 802.11 authentication and AP association.
++
++Event ID
++ 0x1002
++
++Event Parameters
++ UINT16 channel
++ Channel frequency (in MHz) of the network the
++ AR6000 are connected to
++
++ UINT8 bssid[6]
++ MAC address of the AP the AR6000 are
++ connected to or the BSSID of the ad hoc
++ network
++
++ UINT16 listenInterval
++ Listen interval (in Kms) that the AR6000 are
++ using
++
++ UINT 8 beaconIeLen
++ Length (in bytes) of the beacon IEs
++
++ UINT8 assocInfo
++ Pointer to an array containing beacon IEs,
++ followed first by association request IEs then by
++ association response IEs
++
++ UINT8 assocReqLen
++ Length (in bytes) of the assocReqIEs array
++
++ UINT8 assocRespLen
++ Length (in bytes) of the assocRespIEs array
++
++Event Values
++ None defined
++
++=====================================================================
++
++
++Name
++ DISCONNECT
++
++Synopsis
++ Signals that the AR6000 device lost connectivity with the wireless network.
++ DISCONENCT is generated when the device fails to complete a \93CONNECT\94
++ command or as a result of a transition from a connected state to disconnected state.
++
++ After sending the \93DISCONNECT\94 event the device continually tries to re-establish
++ a connection. A LOST_LINK occurs when STA cannot receive beacons within the
++ specified time for the SET_BMISS_TIME command.
++
++Event ID
++ 0x1003
++
++Event Parameters
++ UINT8 disconnect
++ Reason
++ A WMI_DISCONNECT_REASON value
++
++ UINT8 bssid[6]
++ Indicates which BSS the device was connected to
++
++ UINT8 assocRespLen
++ Length of the 802.11 association response frame
++ that triggered this event, or 0 if not applicable
++
++ UINT8 assocInfo[assocRespLen]
++ Copy of the 802.11 association response frame
++
++Event Values
++ {
++ NO_NETWORK_AVAIL =0x01
++ Indicates that the device was unable to
++ establish or find the desired network
++ LOST_LINK =0x02
++ Indicates the devices is no longer receiving
++ beacons from the BSS it was previously
++ connected to
++
++ DISCONNECT_CMD =0x03
++ Indicates a \93DISCONNECT\94 command was
++ processed
++ BSS_DISCONNECTED =0x04
++ Indicates the BSS explicitly disconnected the
++ device. Possible mechanisms include the AP
++ sending 802.11 management frames
++ (e.g., disassociate or deauthentication
++ messages).
++ AUTH_FAILED =0x05
++ Indicates that the device failed 802.11
++ authentication with the BSS
++ ASSOC_FAILED =0x06
++ Indicates that the device failed 802.11
++ association with the BSS
++ NO_RESOURCES_AVAIL =0x07
++ Indicates that a connection failed because the
++ AP had insufficient resources to complete the
++ connection
++ CSERV_DISCONNECT =0x08
++ Indicates that the device\92s connection services
++ module decided to disconnect from a BSS,
++ which can happen for a variety of reasons (e.g.,
++ the host marks the current connected AP as a
++ bad AP).
++ INVALID_PROFILE =0x0A
++ Indicates that an attempt was made to
++ reconnect to a BSS that no longer matches the
++ current profile
++ All other values are reserved
++ } WMI_DISCONNECT_REASON
++
++
++=====================================================================
++
++
++Name
++ ERROR_REPORT
++
++Synopsis
++ Signals that a type of error has occurred for which the host previously requested
++ notification through the \93TARGET_ERROR_REPORT_BITMASK\94 command.
++
++Event ID
++ 0x100D
++
++Event Parameters
++ UINT32 errorVal
++ WMI_TARGET_ERROR_VAL value. See
++ \93TARGET_ERROR_REPORT_BITMASK\94.
++
++Event Values
++ errorVal
++ = 0x00000001
++ Power save fails
++
++ = 0x00000002
++ No cipher key
++
++ = 0x00000004
++ Decryption error
++
++ = 0x00000008
++ Beacon miss
++
++ = 0x00000010
++ A non-power save disabled node has joined
++ the PS-enabled network
++
++
++=====================================================================
++
++
++Name
++ EXTENSION
++
++Synopsis
++ The WMI is used mostly for wireless control messages to a wireless module that
++ apply to wireless module management regardless of the target platform
++ implementation. However, some events peripherally related to wireless management
++ are desired during operation. These wireless extension events may be platform-
++ specific or implementation-dependent. See \93WMI Extension Commands\94
++
++
++Event ID
++ 0x1010
++
++
++=====================================================================
++
++
++Name
++ GET_PMKID_LIST_EVENT
++
++Synopsis
++ Generated by firmware in response to a \93GET_PMKID_LIST_CMD\94 command.
++
++Event Parameters
++ typedef struct {
++ A_UINT32 numPMKID;
++ Contains the number of PMKIDs in the reply
++ WMI_PMKID pmkidList[1];
++ } __ATTRIB_PACK WMI_PMKID_LIST_REPLY;
++
++Event Values
++ None
++
++
++=====================================================================
++
++
++Name
++ GET_WOW_LIST_EVENT
++
++Synopsis
++ Response to the wmiconfig \96getwowlist command to retrieve the configured Wake on
++ Wireless patterns
++
++Event ID
++ 0x10018
++
++Event Parameters
++ {
++
++ A_UINT8 num_filters
++ Total number of patterns in the list
++ A_UINT8 this_filter_num
++ The filter number
++ A_UINT8 wow_mode
++ Shows whether WoW is enabled or disabled
++ A_UINT8 host_mode
++ Shows whether the host is asleep or awake
++ WOW_FILTER wow_filters[1]
++ List of WoW filters (pattern and mask data bytes)
++ } WMI_GET_WOW_LIST_REPLY;
++
++ {
++ Each wow_filter_list element shows:
++ A_UINT8 wow_valid_filter
++ Whether the filter is valid
++ A_UINT8 wow_filter_list_id
++ Filter List ID (23 = default)
++ A_UINT8 wow_filter_size
++ Size in bytes of the filter
++ A_UINT8 wow_filter_offset
++ Offset of the pattern to search in the data packet
++ A_UINT8 wow_filter_mask[MASK_SIZE]
++ The mask to be applied to the pattern
++ A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE]
++ The pattern that to match to wake up the host
++ } WOW_FILTER
++
++Event Values
++ None
++
++=====================================================================
++
++
++
++Name
++ NEIGHBOR_REPORT
++
++Synopsis
++ Indicates the existence of neighbor APs that match the current profile. The host uses
++ this event to populate the PMKID cache on the AR6000 and/or to perform
++ preauthentication. This event is only generated in infrastructure mode.
++
++ A total of numberOfAps pairs of bssid/bssFlags exist, one pair for each AP.
++
++Event ID
++ 0x1008
++
++Event Parameters
++ UINT8 numberOfAps
++ The number of APs reported about in
++ this event
++ {
++ UINT8 bssid[6]
++ MAC address of a neighbor AP
++ UINT8 bssFlags
++ A WMI_BSS_FLAGS value
++ }[numberOfAps]
++
++
++Event Values
++ {
++ WMI_DEFAULT_BSS_FLAGS = 0
++ Logical OR of 1 or more
++ WMI_BSS_FLAGS
++ WMI_PREAUTH_CAPABLE_BSS
++ = 1
++ Indicates that this AP is capable of
++ preauthentication
++ WMI_PMKID_VALID_BSS
++ = 2
++ Indicates that the AR6000 have a
++ valid pairwise master key for this AP
++ } WMI_BSS_FLAGS
++
++
++=====================================================================
++
++
++
++Name
++ OPT_RX_FRAME_EVENT
++
++Synopsis
++ Special feature, informs host of the reception of a special frame.
++
++Event ID
++ 0x100E
++
++Event Parameters
++ {
++ A_UINT16 channel;
++ A_UINT8 frameType;
++ A_INT8 snr;
++ A_UINT8 srcAddr[ATH_MAC_LEN];
++ A_UINT8 bssid[ATH_MAC_LEN];
++ }WMI_OPT_RX_INFO_HDR
++
++Event Values
++ None
++
++=====================================================================
++
++
++
++Name
++ PSTREAM_TIMEOUT
++
++Synopsis
++ Indicates that a priority stream that got created as a result of priority-marked data
++ flow (priority marked in IP TOS) being idle for the default inactivity interval period
++ (specified in the \93CREATE_PSTREAM\94 command) used for priority streams created
++ implicitly by the driver. This event is not indicated for user-created priority streams.
++ User-created priority streams exist until the users delete them explicitly. They do not
++ timeout due to data inactivity.
++
++Event ID
++ 0x1007
++
++Event Parameters
++ A_UINT8
++ trafficClass
++ Indicated the traffic class of priority
++ stream that timed out
++
++Event Values
++ {
++ WMM_AC_BE = 0
++ Best effort
++ WMM_AC_BK = 1
++ Background
++ WMM_AC_VI = 2
++ Video
++ WMM_AC_VO = 3
++ Voice
++ } TRAFFIC CLASS
++
++
++=====================================================================
++
++Name
++ READY
++
++Synopsis
++ Indicates that the AR6000 device is prepared to accept commands. It is sent once after
++ power on or reset. It also indicates the MAC address of the device.
++
++Event ID
++ 0x1001
++
++Event Parameters
++ UINT8 macAddr[6]
++ Device MAC address
++ UINT8 phyCapability
++ A WMI_PHY_CAPABILITY value. Indicates the
++ capabilities of the device wireless module\92s radio
++
++Event Values
++ {
++ WMI_11A_CAPABILITY = 1
++ WMI_11G_CAPABILITY = 2
++ WMI_11AG_CAPABILITY = 3
++ } WMI_PHY_CAPABILITY
++
++
++=====================================================================
++
++Name
++ REGDOMAIN
++
++Synopsis
++ Indicates that the regulatory domain has changed. It initially occurs when the
++ AR6000 device reads the board data information. The regulatory domain can also
++ change when the device is a world-mode SKU. In this case, the regulatory domain is
++ based on the country advertised by APs per the IEEE 802.11d specification. A
++ potential side effect of a regulatory domain change is a change in the list of available
++ channels. Any channel restrictions that exist as a result of a previous
++ \93SET_CHANNEL_PARAMETERS\94 command are lifted.
++
++Event ID
++ 0x1006
++
++Event Parameters
++ UINT32 regDomain
++ The range of 0x0000 \96 0x00FF
++ corresponds to an ISO country code.
++
++ Other regCodes are reserved for world
++ mode settings and specific regulatory
++ domains.
++
++Event Values
++ None
++
++
++=====================================================================
++
++
++
++Name
++ REPORT_STATISTICS
++
++Synopsis
++ A reply to a \93GET_TARGET_STATS\94 command.
++
++Event ID
++ 0x100B
++
++Event Parameters
++ When the statistics are sent to the host, the AR6001 clear them so that a new set of
++ statistics are collected for the next report.
++
++ UINT32 tx_packets
++ UINT32 tx_bytes
++ UINT32 tx_unicast_pkts
++ UINT32 tx_unicast_bytes
++ UINT32 tx_multicast_pkts
++ UINT32 tx_multicast_bytes
++ UINT32 tx_broadcast_pkts
++ UINT32 tx_broadcast_bytes
++ UINT32 tx_rts_success_cnt
++ UINT32 tx_packet_per_ac[4]
++ Tx packets per AC: [0] = BE, [1] = BK,
++ [2] = VI, [3] = VO
++ UINT32 tx_errors
++ Number of packets which failed Tx, due
++ to all failures
++ ... REPORT_STATISTICS, continued
++ UINT32 tx_failed_cnt
++ Number of data packets that failed Tx
++ UINT32 tx_retry_cnt
++ Number of Tx retries for all packets
++ UINT32 tx_rts_fail_cnt
++ Number of RTS Tx failed count
++ UINT32 rx_packets
++ UINT32 rx_bytes
++ UINT32 rx_unicast_pkts
++ UINT32 rx_unicast_bytes
++ UINT32 rx_multicast_pkts
++ UINT32 rx_multicast_bytes
++ UINT32 rx_broadcast_pkts
++ UINT32 rx_broadcast_bytes
++ UINT32 rx_fragment_pkt
++ Number of fragmented packets received
++ UINT32 rx_errors
++ Number of Rx errors due to all failures
++ UINT32 rx_crcerr
++ Number of Rx errors due to CRC errors
++ UINT32 rx_key_cache_miss
++ Number of Rx errors due to a key not
++ being plumbed
++ UINT32 rx_decrypt_err
++ Number of Rx errors due to decryption
++ failure
++ UINT32 rx_duplicate_frames
++ Number of duplicate frames received
++ UINT32 tkip_local_mic_failure
++ Number of TKIP MIC errors detected
++ UINT32 tkip_counter_measures_invoked
++ Number of times TKIP countermeasures
++ were invoked
++ UINT32 tkip_replays
++ Number of frames that replayed a TKIP
++ encrypted frame received earlier
++ UINT32 tkip_format_errors
++ Number of frames that did not conform
++ to the TKIP frame format
++ UINT32 ccmp_format_errors
++ Number of frames that did not conform
++ to the CCMP frame format
++ UINT32 ccmp_replays
++ Number of frames that replayed a CCMP
++ encrypted frame received earlier
++ UINT32 power_save_failure_cnt
++ Number of failures that occurred when
++ the AR6001 could not go to sleep
++ UINT32 cs_bmiss_cnt
++ Number of BMISS interrupts since
++ connection
++ UINT32 cs_lowRssi_cnt
++ Number of the times the RSSI went below
++ the low RSSI threshold
++ UINT16 cs_connect_cnt
++ Number of connection times
++ UINT16 cs_disconnect_cnt
++ Number of disconnection times
++ UINT8 cs_aveBeacon_rssi
++ The current averaged value of the RSSI
++ from the beacons of the connected BSS
++ UINT8 cs_lastRoam_msec
++ Time that the last roaming took, in ms.
++ This time is the difference between
++ roaming start and actual connection.
++
++Event Values
++ None defined
++
++
++=====================================================================
++
++Name
++ ROAM_TBL_EVENT
++
++Synopsis
++ Reports the roam table, which contains the current roam mode and this information
++ for every BSS:
++
++Event ID
++ 0x100F
++
++Event Parameters
++ A_UINT8 bssid[ATH_MAC_LEN];
++ BSSID
++ A_UINT8 rssi
++ Averaged RSSI
++ A_UINT8 rssidt
++ Change in RSSI
++ A_UINT8 last_rssi
++ Last recorded RSSI
++ A_UINT8 roam_util
++ Utility value used in roaming decision
++ A_UINT8 util
++ Base utility with the BSS
++ A_UINT8 bias
++ Host configured for this BSS
++
++Event Values
++ roamMode
++ Current roam mode
++
++ = 1
++ RSSI based roam
++
++ = 2
++ Host bias-based roam
++
++ = 3
++ Lock to the current BSS
++
++ = 4
++ Autonomous roaming disabled
++
++
++=====================================================================
++
++Name
++ RSSI_THRESHOLD
++
++Synopsis
++ Alerts the host that the signal strength from the connected AP has crossed a
++ interesting threshold as defined in a previous \93RSSI_THRESHOLD_PARAMS\94
++ command.
++
++Event ID
++ 0x100C
++
++Event Parameters
++ UINT8 range
++ A WMI_RSSI_THRESHOLD_VAL
++ value, which indicates the range of
++ the average signal strength
++
++Event Values
++ {
++ WMI_RSSI_LOWTHRESHOLD_BELOW_LOWERVAL = 1
++ WMI_RSSI_LOWTHRESHOLD_LOWERVAL = 2
++ WMI_RSSI_LOWTHRESHOLD_UPPERVAL = 3
++ WMI_RSSI_HIGHTHRESHOLD_LOWERVAL = 4
++ WMI_RSSI_HIGHTHRESHOLD_HIGHERVAL = 5
++ } WMI_RSSI_THRESHOLD_VAL
++
++
++=====================================================================
++
++Name
++ SCAN_COMPLETE_EVENT
++
++Synopsis
++ Indicates the scan status. if the Scan was not completed, this event is generated with
++ the status A_ECANCELED.
++
++Event ID
++ 0x100A
++
++Event Parameters
++ A_UINT8 scanStatus
++
++Event Values
++ {
++ #define SCAN_ABORTED 16
++ #define SCAN_COMPLETED 0
++ A_UINT8 scanStatus
++ A_OK or A_ECANCELED
++ } WMI_SCAN_COMPLETE_EVENT;
++
++
++=====================================================================
++
++Name
++ TEST_EVENT
++
++Synopsis
++ The TCMD application uses a single WMI event (WMI_TEST_EVENTID) to
++ communicate events from target to host. The events are parsed by the TCMD
++ application and WMI layer is oblivious of it.
++
++Event ID
++ 0x1016
++
++Event Parameters
++ WMI_TEST_EVENTID
++
++
++Event Values
++ None
++
++
++=====================================================================
++
++
++
++Name
++ TKIP_MICERR
++
++Synopsis
++ Indicates that TKIP MIC errors were detected.
++
++Event ID
++ 0x1009
++
++Event Parameters
++ UINT8 keyid
++ Indicates the TKIP key ID
++
++ UINT8 ismcast
++ 0 = Unicast
++ 1 = Multicast
++
++Event Values
++ See event parameters
++
++=====================================================================
++
++WMI Extension Commands
++
++The WMI EXTENSION command is used to multiplex a collection of
++commands that:
++
++ Are not generic wireless commands
++ May be implementation-specific
++ May be target platform-specific
++ May be optional for a host implementation
++
++ An extension command is sent to the AR6000 targets like any other WMI
++command message and uses the WMI_EXTENSION. The first field of the
++payload for this EXTENSION command is another commandId, sometimes
++called the subcommandId, which indicates which extension command is
++being used. A subcommandId-specific payload follows the subcommandId.
++
++All extensions (subcommandIds) are listed in the header file include/wmix.h.
++See also \93WMI Extension Events\94 on page B-58.
++
++
++WMI Extension Commands
++
++
++GPIO_INPUT_GET
++ Read GPIO pins configured for input
++
++GPIO_INTR_ACK
++ Acknowledge and re-arm GPIO interrupts reported earlier
++
++GPIO_OUTPUT_SET
++ Manage output on GPIO pins configured for output
++
++GPIO_REGISTER_GET
++ Read an arbitrary GPIO register
++
++GPIO_REGISTER_SET
++ Dynamically change GPIO configuration
++
++SET_LQTHRESHOLD
++ Set link quality thresholds; the sampling happens at every unicast
++ data frame Tx, if certain thresholds are met, and corresponding
++ events are sent to the host
++
++
++=====================================================================
++
++Name
++ GPIO_INPUT_GET
++
++Synopsis
++ Allows the host to read GPIO pins that are configured for input. The values read are
++ returned through a \93GPIO_DATA\94 extension event.
++
++NOTE: Support for GPIO is optional.
++
++Command
++ N/A
++
++Command Parameters
++ None
++
++
++
++Reply Parameters
++ None
++
++
++Reset Value
++ None
++
++
++
++Restrictions
++ None
++
++=====================================================================
++
++
++Name
++ GPIO_INTR_ACK
++
++Synopsis
++ The host uses this command to acknowledge and to re-arm GPIO interrupts reported
++ through an earlier \93GPIO_INTR\94 extension event. A single \93GPIO_INTR_ACK\94
++ command should be used to acknowledge all GPIO interrupts that the host knows to
++ be outstanding (if pending interrupts are not acknowledged through
++ \93GPIO_INTR_ACK\94, another \93GPIO_INTR\94 extension event is raised).
++
++NOTE: Support for GPIO is optional.
++
++Command
++ N/A
++
++Command Parameters
++ UINT32 ack_mask
++ A mask of interrupting GPIO pins (e.g., ack_mask
++ bit [3] acknowledges an interrupt from the pin GPIO3).
++
++Command Values
++ None
++
++Reset Value
++ None
++
++Restrictions
++ The host should acknowledge only interrupts about which it was notified.
++
++
++=====================================================================
++
++Name
++ GPIO_OUTPUT_SET
++
++Synopsis
++ Manages output on GPIO pins configured for output.
++
++ Conflicts between set_mask and clear_mask or enable_mask and disable_mask result
++ in undefined behavior.
++
++NOTE: Support for GPIO is optional.
++
++Command
++ N/A
++
++Command Parameters
++ UINT32 set_mask
++ Specifies which pins should drive a 1 out
++ UINT32 clear_mask
++ Specifies which pins should drive a 0 out
++ UINT32 enable_mask
++ Specifies which pins should be enabled for output
++ UINT32 disable_mask
++ Specifies which pins should be disabled for output
++
++Command Values
++ None
++
++
++Reset Value
++ None
++
++
++Restrictions
++ None
++
++
++
++=====================================================================
++
++
++Name
++ GPIO_REGISTER_GET
++
++Synopsis
++ Allows the host to read an arbitrary GPIO register. It is intended for use during
++ bringup/debug. The target responds to this command with a \93GPIO_DATA\94 event.
++
++NOTE: Support for GPIO is optional.
++
++Command
++ N/A
++
++Command Parameters
++ UINT32
++ gpioreg_id
++ Specifies a GPIO register identifier, as defined
++in include/AR6000/AR6000_gpio.h
++
++Reply Parameters
++ None
++
++Reset Value
++ N/A
++
++Restrictions
++ None
++
++
++=====================================================================
++
++Name
++ GPIO_REGISTER_SET
++
++Synopsis
++ Allows the host to dynamically change GPIO configuration (usually handled
++ statically through the GPIO configuration DataSet).
++
++NOTE: Support for GPIO is optional.
++
++Command
++ N/A
++
++Command Parameters
++ UINT32 gpioreg_id
++ Specifies a GPIO register identifier, as defined in
++ include/AR6000/AR6000_gpio.h
++ UINT32 value
++ Specifies a value to write to the specified
++ GPIO register
++
++Command Values
++ None
++
++
++Reset Value
++ Initial hardware configuration is as defined in the AR6001 or AR6002 ROCmTM
++ Single-Chip MAC/BB/Radio for 2.4/5 GHz Embedded WLAN Applications data sheet. This
++ configuration is modified by the GPIO Configuration DataSet, if one exists.
++
++Restrictions
++ None
++
++
++=====================================================================
++
++
++Name
++ SET_LQTHRESHOLD
++
++Synopsis
++ Set link quality thresholds, the sampling happens at every unicast data frame Tx, if
++ certain threshold is met, corresponding event will be sent to host.
++
++Command
++ wmiconfig eth1 --lqThreshold <enable> <upper_threshold_1>...
++ <upper_threshold_4> <lower_threshold_1>... <lower_threshold_4>
++
++Command Parameters
++ A_UINT8 enable;
++ A_UINT8 thresholdAbove1_Val;
++ A_UINT8 thresholdAbove2_Val;
++ A_UINT8 thresholdAbove3_Val;
++ A_UINT8 thresholdAbove4_Val;
++ A_UINT8 thresholdBelow1_Val;
++ A_UINT8 thresholdBelow2_Val;
++ A_UINT8 thresholdBelow3_Val;
++ A_UINT8 thresholdBelow4_Val;
++
++Command Values
++ enable
++ = 0
++ Disable link quality sampling
++
++ = 1
++ Enable link quality sampling
++
++
++ thresholdAbove_Val
++ [1...4]
++ Above thresholds (value in [0,100]), in ascending
++ order threshold
++
++ Below_Val [1...4] = below thresholds (value
++ in [0,100]), in ascending order
++
++Reset Values
++ None
++
++Restrictions
++ None
++
++=====================================================================
++WMI Extension Events
++
++The WMI EXTENSION event is used for a collection of events that:
++
++ Are not generic wireless events
++ May be implementation-specific
++ May be target platform-specific
++ May be optional for a host implementation
++
++ An extension event is sent from the AR6000 device targets to the host just like
++any other WMI event message, using the WMI_EXTENSION_EVENTID. The
++first field of the payload for this \93EXTENSION\94 event is another commandId
++(sometimes called the subcommandId) that indicates which \93EXTENSION\94
++event is being used. A subcommandId-specific payload follows the
++subcommandId.
++
++All extensions (subcommandIds) are listed in the header file include/wmix.h.
++See also \93WMI Extension Commands\94 on page B-55.
++
++
++WMI Extension Events
++
++
++GPIO_ACK
++ Acknowledges a host set command has been processed by the device
++
++GPIO_DATA
++ Response to a host\92s request for data
++
++GPIO_INTR
++ Signals that GPIO interrupts are pending
++
++
++=====================================================================
++
++Name
++ GPIO_ACK
++
++Synopsis
++ Acknowledges that a host set command (either \93GPIO_OUTPUT_SET\94 or
++ \93GPIO_REGISTER_SET\94) has been processed by the AR6000 device.
++
++NOTE: Support for GPIO is optional.
++
++Event ID
++ N/A
++
++Event Parameters
++ None
++
++
++Event Values
++ None
++
++=====================================================================
++
++
++Name
++ GPIO_DATA
++
++Synopsis
++ The AR6000 device uses this event to respond to the host\92s earlier request for data
++ (through either a \93GPIO_REGISTER_GET\94 or a \93GPIO_INPUT_GET\94 command).
++
++NOTE: Support for GPIO is optional.
++
++Event ID
++ N/A
++
++Event Parameters
++ UINT32 value
++ Holds the data of interest, which is either a register value
++ (in the case of \93GPIO_REGISTER_GET\94) or a mask of
++ pin inputs (in the case of \93GPIO_INPUT_GET\94).
++ UINT32 reg_id
++ Indicates which register was read (in the case of
++ \93GPIO_REGISTER_GET\94) or is GPIO_ID_NONE (in the
++ case of \93GPIO_INPUT_GET\94)
++
++Event Values
++ None
++
++
++=====================================================================
++
++
++
++Name
++ GPIO_INTR
++
++Synopsis
++ The AR6000 device raises this event to signal that GPIO interrupts are pending.
++ These GPIOs may be interrupts that occurred after the last \93GPIO_INTR_ACK\94
++ command was issued, or may be GPIO interrupts that the host failed to acknowledge
++ in the last \93GPIO_INTR_ACK\94. The AR6000 will not raise another GPIO_INTR
++ event until this event is acknowledged through a \93GPIO_INTR_ACK\94 command.
++
++NOTE: Support for GPIO is optional.
++
++Event ID
++ N/A
++
++Event Parameters
++ UINT32 intr_mask
++ Indicates which GPIO interrupts are currently pending
++
++ UINT32 input_values
++ A recent copy of the GPIO input values, taken at the
++ time the most recent GPIO interrupt was processed
++
++Event Values
++ None
++
++
++
++=====================================================================
++#endif
+diff --git a/drivers/ar6000/wmi/wmi_host.h b/drivers/ar6000/wmi/wmi_host.h
+new file mode 100644
+index 0000000..57844bc
+--- /dev/null
++++ b/drivers/ar6000/wmi/wmi_host.h
+@@ -0,0 +1,71 @@
++#ifndef _WMI_HOST_H_
++#define _WMI_HOST_H_
++/*
++ * Copyright (c) 2004-2006 Atheros Communications Inc.
++ * All rights reserved.
++ *
++ * This file contains local definitios for the wmi host module.
++ *
++ * $Id: //depot/sw/releases/olca2.0-GPL/host/wmi/wmi_host.h#1 $
++ *
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation;
++ *
++ * Software distributed under the License is distributed on an "AS
++ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
++ * implied. See the License for the specific language governing
++ * rights and limitations under the License.
++ *
++ *
++ *
++ */
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++struct wmi_stats {
++ A_UINT32 cmd_len_err;
++ A_UINT32 cmd_id_err;
++};
++
++struct wmi_t {
++ A_BOOL wmi_ready;
++ A_BOOL wmi_numQoSStream;
++ A_UINT8 wmi_wmiStream2AcMapping[WMI_PRI_MAX_COUNT];
++ WMI_PRI_STREAM_ID wmi_ac2WmiStreamMapping[WMM_NUM_AC];
++ A_UINT16 wmi_streamExistsForAC[WMM_NUM_AC];
++ A_UINT8 wmi_fatPipeExists;
++ void *wmi_devt;
++ struct wmi_stats wmi_stats;
++ struct ieee80211_node_table wmi_scan_table;
++ A_UINT8 wmi_bssid[ATH_MAC_LEN];
++ A_UINT8 wmi_powerMode;
++ A_UINT8 wmi_phyMode;
++ A_UINT8 wmi_keepaliveInterval;
++ A_MUTEX_T wmi_lock;
++};
++
++#define WMI_INIT_WMISTREAM_AC_MAP(w) \
++{ (w)->wmi_wmiStream2AcMapping[WMI_BEST_EFFORT_PRI] = WMM_AC_BE; \
++ (w)->wmi_wmiStream2AcMapping[WMI_LOW_PRI] = WMM_AC_BK; \
++ (w)->wmi_wmiStream2AcMapping[WMI_HIGH_PRI] = WMM_AC_VI; \
++ (w)->wmi_wmiStream2AcMapping[WMI_HIGHEST_PRI] = WMM_AC_VO; \
++ (w)->wmi_ac2WmiStreamMapping[WMM_AC_BE] = WMI_BEST_EFFORT_PRI; \
++ (w)->wmi_ac2WmiStreamMapping[WMM_AC_BK] = WMI_LOW_PRI; \
++ (w)->wmi_ac2WmiStreamMapping[WMM_AC_VI] = WMI_HIGH_PRI; \
++ (w)->wmi_ac2WmiStreamMapping[WMM_AC_VO] = WMI_HIGHEST_PRI; }
++
++#define WMI_WMISTREAM_ACCESSCATEGORY(w,s) (w)->wmi_wmiStream2AcMapping[s]
++#define WMI_ACCESSCATEGORY_WMISTREAM(w,ac) (w)->wmi_ac2WmiStreamMapping[ac]
++
++#define LOCK_WMI(w) A_MUTEX_LOCK(&(w)->wmi_lock);
++#define UNLOCK_WMI(w) A_MUTEX_UNLOCK(&(w)->wmi_lock);
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif /* _WMI_HOST_H_ */
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index fee678f..f1761c2 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -70,6 +70,12 @@ config GPIO_MAX730X
+
+ comment "Memory mapped GPIO expanders:"
+
++config GPIO_GLAMO
++ tristate "Glamo GPIO support"
++ depends on MFD_GLAMO
++ help
++ Say yes here to support GPIO functionality of the Smedia Glamo.
++
+ config GPIO_IT8761E
+ tristate "IT8761E GPIO support"
+ depends on GPIOLIB
+@@ -235,6 +241,13 @@ config GPIO_ADP5588
+ To compile this driver as a module, choose M here: the module will be
+ called adp5588-gpio.
+
++config GPIO_PCF50633
++ tristate "GPIO support for NXP PCF50633"
++ depends on MFD_PCF50633
++ help
++ Say yes here if you want to include support GPIO for pins on
++ the PCF50633 chip.
++
+ comment "PCI GPIO expanders:"
+
+ config GPIO_CS5535
+diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
+index 10f3f8d..5be6675 100644
+--- a/drivers/gpio/Makefile
++++ b/drivers/gpio/Makefile
+@@ -6,6 +6,7 @@ obj-$(CONFIG_GPIOLIB) += gpiolib.o
+
+ obj-$(CONFIG_GPIO_ADP5520) += adp5520-gpio.o
+ obj-$(CONFIG_GPIO_ADP5588) += adp5588-gpio.o
++obj-$(CONFIG_GPIO_GLAMO) += glamo-gpio.o
+ obj-$(CONFIG_GPIO_LANGWELL) += langwell_gpio.o
+ obj-$(CONFIG_GPIO_MAX730X) += max730x.o
+ obj-$(CONFIG_GPIO_MAX7300) += max7300.o
+@@ -27,4 +28,5 @@ obj-$(CONFIG_GPIO_VR41XX) += vr41xx_giu.o
+ obj-$(CONFIG_GPIO_WM831X) += wm831x-gpio.o
+ obj-$(CONFIG_GPIO_WM8350) += wm8350-gpiolib.o
+ obj-$(CONFIG_GPIO_WM8994) += wm8994-gpio.o
+-obj-$(CONFIG_GPIO_SCH) += sch_gpio.o
+\ No newline at end of file
++obj-$(CONFIG_GPIO_SCH) += sch_gpio.o
++obj-$(CONFIG_GPIO_PCF50633) += pcf50633-gpio.o
+diff --git a/drivers/gpio/glamo-gpio.c b/drivers/gpio/glamo-gpio.c
+new file mode 100644
+index 0000000..dff60eb
+--- /dev/null
++++ b/drivers/gpio/glamo-gpio.c
+@@ -0,0 +1,284 @@
++/* Smedia Glamo 336x/337x gpio driver
++ *
++ * (C) 2009 Lars-Peter Clausen
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
++ * MA 02111-1307 USA
++ */
++
++#include <linux/io.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++
++#include <linux/gpio.h>
++#include <linux/mfd/glamo.h>
++#include <linux/mfd/glamo-core.h>
++#include <linux/mfd/glamo-regs.h>
++
++#define GLAMO_NR_GPIO 21
++#define GLAMO_NR_GPIO_REGS DIV_ROUND_UP(GLAMO_NR_GPIO, 4)
++
++#define GLAMO_GPIO_REG(x) (((x) * 2) + GLAMO_REG_GPIO_GEN1)
++
++struct glamo_gpio {
++ struct glamo_core *glamo;
++ struct gpio_chip chip;
++ uint16_t saved_regs[GLAMO_NR_GPIO_REGS];
++};
++
++#define GLAMO_GPIO_REG_GPIO(gpio) GLAMO_GPIO_REG(gpio >> 2)
++#define GLAMO_GPIO_BIT(gpio, offset) BIT(((gpio) & 0x3) + (offset))
++#define GLAMO_GPIO_DIRECTION_BIT(gpio) GLAMO_GPIO_BIT(gpio, 0)
++#define GLAMO_GPIO_OUTPUT_BIT(gpio) GLAMO_GPIO_BIT(gpio, 4)
++#define GLAMO_GPIO_INPUT_BIT(gpio) GLAMO_GPIO_BIT(gpio, 8)
++#define GLAMO_GPIO_FUNC_BIT(gpio) GLAMO_GPIO_BIT(gpio, 12)
++
++
++static inline struct glamo_core *chip_to_glamo(struct gpio_chip *chip)
++{
++ return container_of(chip, struct glamo_gpio, chip)->glamo;
++}
++
++static void glamo_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
++ uint16_t tmp;
++
++ spin_lock(&glamo->lock);
++ tmp = readw(glamo->base + reg);
++ if (value)
++ tmp |= GLAMO_GPIO_OUTPUT_BIT(offset);
++ else
++ tmp &= ~GLAMO_GPIO_OUTPUT_BIT(offset);
++ writew(tmp, glamo->base + reg);
++ spin_unlock(&glamo->lock);
++}
++
++static int glamo_gpio_get(struct gpio_chip *chip, unsigned offset)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ return !!(readw(glamo->base + GLAMO_GPIO_REG_GPIO(offset)) & GLAMO_GPIO_INPUT_BIT(offset));
++}
++
++static int glamo_gpio_request(struct gpio_chip *chip, unsigned offset)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
++ uint16_t tmp;
++
++ spin_lock(&glamo->lock);
++ tmp = readw(glamo->base + reg);
++ if ((tmp & GLAMO_GPIO_FUNC_BIT(offset)) == 0) {
++ tmp |= GLAMO_GPIO_FUNC_BIT(offset);
++ writew(tmp, glamo->base + reg);
++ }
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static void glamo_gpio_free(struct gpio_chip *chip, unsigned offset)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
++ uint16_t tmp;
++
++ spin_lock(&glamo->lock);
++ tmp = readw(glamo->base + reg);
++ if ((tmp & GLAMO_GPIO_FUNC_BIT(offset)) == 1) {
++ tmp &= ~GLAMO_GPIO_FUNC_BIT(offset);
++ writew(tmp, glamo->base + reg);
++ }
++ spin_unlock(&glamo->lock);
++}
++
++static int glamo_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
++ int value)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
++ uint16_t tmp;
++
++ spin_lock(&glamo->lock);
++ tmp = readw(glamo->base + reg);
++ tmp &= ~GLAMO_GPIO_DIRECTION_BIT(offset);
++
++ if (value)
++ tmp |= GLAMO_GPIO_OUTPUT_BIT(offset);
++ else
++ tmp &= ~GLAMO_GPIO_OUTPUT_BIT(offset);
++
++ writew(tmp, glamo->base + reg);
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static int glamo_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
++{
++ struct glamo_core *glamo = chip_to_glamo(chip);
++ unsigned int reg = GLAMO_GPIO_REG_GPIO(offset);
++ uint16_t tmp;
++
++ spin_lock(&glamo->lock);
++ tmp = readw(glamo->base + reg);
++ if ((tmp & GLAMO_GPIO_DIRECTION_BIT(offset)) == 0) {
++ tmp |= GLAMO_GPIO_DIRECTION_BIT(offset);
++ writew(tmp, glamo->base + reg);
++ }
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static const struct __devinit gpio_chip glamo_gpio_chip = {
++ .label = "glamo",
++ .request = glamo_gpio_request,
++ .free = glamo_gpio_free,
++ .direction_input = glamo_gpio_direction_input,
++ .get = glamo_gpio_get,
++ .direction_output = glamo_gpio_direction_output,
++ .set = glamo_gpio_set,
++ .base = -1,
++ .ngpio = GLAMO_NR_GPIO,
++ .can_sleep = 0,
++ .owner = THIS_MODULE,
++};
++
++static int __devinit glamo_gpio_probe(struct platform_device *pdev)
++{
++ struct glamo_platform_data *pdata = pdev->dev.parent->platform_data;
++ struct glamo_gpio *glamo_gpio;
++ int ret;
++
++ glamo_gpio = kzalloc(sizeof(*glamo_gpio), GFP_KERNEL);
++ if (!glamo_gpio)
++ return -ENOMEM;
++
++ glamo_gpio->glamo = dev_get_drvdata(pdev->dev.parent);
++ glamo_gpio->chip = glamo_gpio_chip;
++ glamo_gpio->chip.dev = &pdev->dev;
++ if (pdata && pdata->gpio_data)
++ glamo_gpio->chip.base = pdata->gpio_data->base;
++
++ ret = gpiochip_add(&glamo_gpio->chip);
++
++ if (ret) {
++ dev_err(&pdev->dev, "Could not register gpio chip: %d\n", ret);
++ goto err;
++ }
++
++ platform_set_drvdata(pdev, glamo_gpio);
++
++ if (pdata && pdata->gpio_data && pdata->gpio_data->registered)
++ pdata->gpio_data->registered(&pdev->dev);
++
++ return 0;
++err:
++ kfree(glamo_gpio);
++ return ret;
++}
++
++static int __devexit glamo_gpio_remove(struct platform_device *pdev)
++{
++ struct glamo_gpio *glamo_gpio = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = gpiochip_remove(&glamo_gpio->chip);
++ if (!ret)
++ goto done;
++
++ platform_set_drvdata(pdev, NULL);
++ kfree(glamo_gpio);
++
++done:
++ return ret;
++}
++
++#ifdef CONFIG_PM
++
++static int glamo_gpio_suspend(struct device *dev)
++{
++ struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
++ struct glamo_core *glamo = glamo_gpio->glamo;
++ uint16_t *saved_regs = glamo_gpio->saved_regs;
++ int i;
++
++ spin_lock(&glamo->lock);
++ for (i = 0; i < GLAMO_NR_GPIO / 4; ++i)
++ saved_regs[i] = readw(glamo->base + GLAMO_GPIO_REG(i));
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static int glamo_gpio_resume(struct device *dev)
++{
++ struct glamo_gpio *glamo_gpio = dev_get_drvdata(dev);
++ struct glamo_core *glamo = glamo_gpio->glamo;
++ uint16_t *saved_regs = glamo_gpio->saved_regs;
++ int i;
++
++ spin_lock(&glamo->lock);
++ for (i = 0; i < GLAMO_NR_GPIO_REGS; ++i)
++ writew(saved_regs[i], glamo->base + GLAMO_GPIO_REG(i));
++ spin_unlock(&glamo->lock);
++ return 0;
++}
++
++static const struct dev_pm_ops glamo_pm_ops = {
++ .suspend = glamo_gpio_suspend,
++ .resume = glamo_gpio_resume,
++ .freeze = glamo_gpio_suspend,
++ .thaw = glamo_gpio_resume,
++};
++
++#define GLAMO_GPIO_PM_OPS (&glamo_pm_ops)
++
++#else
++#define GLAMO_GPIO_PM_OPS NULL
++#endif
++
++static struct platform_driver glamo_gpio_driver = {
++ .driver = {
++ .name = "glamo-gpio",
++ .owner = THIS_MODULE,
++ .pm = GLAMO_GPIO_PM_OPS,
++ },
++ .probe = glamo_gpio_probe,
++ .remove = __devexit_p(glamo_gpio_remove),
++};
++
++static int __devinit glamo_gpio_init(void)
++{
++ return platform_driver_register(&glamo_gpio_driver);
++}
++module_init(glamo_gpio_init);
++
++static void __exit glamo_gpio_exit(void)
++{
++ platform_driver_unregister(&glamo_gpio_driver);
++}
++module_exit(glamo_gpio_exit);
++
++MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
++MODULE_DESCRIPTION("GPIO interface for the Glamo multimedia device");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:glamo-gpio");
+diff --git a/drivers/gpio/pcf50633-gpio.c b/drivers/gpio/pcf50633-gpio.c
+new file mode 100644
+index 0000000..eb044e8
+--- /dev/null
++++ b/drivers/gpio/pcf50633-gpio.c
+@@ -0,0 +1,228 @@
++/* NXP PCF50633 GPIO Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * Copyright 2010, Lars-Peter Clausen <lars@metafoo.de>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50633 driver mainly by
++ * Harald Welte, Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/platform_device.h>
++
++#include <linux/mfd/pcf50633/core.h>
++#include <linux/mfd/pcf50633/gpio.h>
++#include <linux/gpio.h>
++
++#define PCF50633_REG_GPIOCTL 0x13
++#define PCF50633_REG_GPIOCFG(x) (0x14 + (x))
++
++enum pcf50633_regulator_id {
++ PCF50633_REGULATOR_AUTO,
++ PCF50633_REGULATOR_DOWN1,
++ PCF50633_REGULATOR_DOWN2,
++ PCF50633_REGULATOR_LDO1,
++ PCF50633_REGULATOR_LDO2,
++ PCF50633_REGULATOR_LDO3,
++ PCF50633_REGULATOR_LDO4,
++ PCF50633_REGULATOR_LDO5,
++ PCF50633_REGULATOR_LDO6,
++ PCF50633_REGULATOR_HCLDO,
++ PCF50633_REGULATOR_MEMLDO,
++};
++
++#define PCF50633_REG_AUTOOUT 0x1a
++#define PCF50633_REG_DOWN1OUT 0x1e
++#define PCF50633_REG_DOWN2OUT 0x22
++#define PCF50633_REG_MEMLDOOUT 0x26
++#define PCF50633_REG_LDO1OUT 0x2d
++#define PCF50633_REG_LDO2OUT 0x2f
++#define PCF50633_REG_LDO3OUT 0x31
++#define PCF50633_REG_LDO4OUT 0x33
++#define PCF50633_REG_LDO5OUT 0x35
++#define PCF50633_REG_LDO6OUT 0x37
++#define PCF50633_REG_HCLDOOUT 0x39
++
++static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
++ [PCF50633_REGULATOR_AUTO] = PCF50633_REG_AUTOOUT,
++ [PCF50633_REGULATOR_DOWN1] = PCF50633_REG_DOWN1OUT,
++ [PCF50633_REGULATOR_DOWN2] = PCF50633_REG_DOWN2OUT,
++ [PCF50633_REGULATOR_MEMLDO] = PCF50633_REG_MEMLDOOUT,
++ [PCF50633_REGULATOR_LDO1] = PCF50633_REG_LDO1OUT,
++ [PCF50633_REGULATOR_LDO2] = PCF50633_REG_LDO2OUT,
++ [PCF50633_REGULATOR_LDO3] = PCF50633_REG_LDO3OUT,
++ [PCF50633_REGULATOR_LDO4] = PCF50633_REG_LDO4OUT,
++ [PCF50633_REGULATOR_LDO5] = PCF50633_REG_LDO5OUT,
++ [PCF50633_REGULATOR_LDO6] = PCF50633_REG_LDO6OUT,
++ [PCF50633_REGULATOR_HCLDO] = PCF50633_REG_HCLDOOUT,
++};
++
++struct pcf50633_gpio {
++ struct pcf50633 *pcf;
++ struct gpio_chip chip;
++};
++
++static inline struct pcf50633 *gpio_chip_to_pcf50633(struct gpio_chip *chip)
++{
++ struct pcf50633 *pcf = dev_to_pcf50633(chip->dev->parent);
++ return pcf;
++}
++
++static void pcf50633_gpio_set_value(struct gpio_chip *chip, unsigned gpio, int value)
++{
++ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
++ u8 reg;
++
++ reg = PCF50633_REG_GPIOCFG(gpio);
++
++ pcf50633_reg_set_bit_mask(pcf, reg, 0x07, value ? 0x7 : 0x0);
++}
++
++static int pcf50633_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
++{
++ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
++ return pcf50633_reg_read(pcf, PCF50633_REG_GPIOCFG(gpio)) >> 3;
++}
++
++
++static int pcf50633_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
++ int value)
++{
++ struct pcf50633 *pcf = gpio_chip_to_pcf50633(chip);
++ int ret;
++
++ ret = pcf50633_gpio_set_config(pcf, pcf->pdata->gpio_base + gpio,
++ PCF50633_GPIO_CONFIG_OUTPUT);
++ if (!ret)
++ pcf50633_gpio_set_value(chip, gpio, value);
++
++ return ret;
++}
++
++static int pcf50633_gpio_direction_input(struct gpio_chip *chip, unsigned gpio)
++{
++ return -ENOSYS;
++}
++
++int pcf50633_gpio_set_config(struct pcf50633 *pcf, unsigned gpio,
++ enum pcf50633_gpio_config config)
++{
++ u8 reg;
++ u8 direction;
++ int ret;
++
++ gpio -= pcf->pdata->gpio_base;
++
++ if (gpio < 3) {
++ direction = (config == PCF50633_GPIO_CONFIG_INPUT) ? (1 << gpio) : 0;
++ ret = pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_GPIOCTL, (1 << gpio),
++ direction);
++ if (ret) {
++ return ret;
++ }
++ } else if (gpio > 3 || config == PCF50633_GPIO_CONFIG_INPUT) {
++ return -EINVAL;
++ }
++
++ if (config != PCF50633_GPIO_CONFIG_INPUT) {
++ reg = PCF50633_REG_GPIOCFG(gpio);
++ ret = pcf50633_reg_set_bit_mask(pcf, reg, 0x0f, config);
++ }
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50633_gpio_set_config);
++
++int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
++ int gpio, int regulator, int on)
++{
++ u8 reg, val, mask;
++
++ gpio -= pcf->pdata->gpio_base;
++
++ /* the *ENA register is always one after the *OUT register */
++ reg = pcf50633_regulator_registers[regulator] + 1;
++
++ val = !!on << (gpio - PCF50633_GPIO1);
++ mask = 1 << (gpio - PCF50633_GPIO1);
++
++ return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
++}
++EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
++
++
++static int __devinit pcf50633_gpio_probe(struct platform_device *pdev)
++{
++ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
++ struct pcf50633_gpio *pcf_gpio;
++
++ pcf_gpio = kzalloc(sizeof(*pcf_gpio), GFP_KERNEL);
++
++ if (!pcf_gpio)
++ return -ENOMEM;
++
++ pcf_gpio->pcf = pcf;
++
++ pcf_gpio->chip.direction_input = pcf50633_gpio_direction_input;
++ pcf_gpio->chip.direction_output = pcf50633_gpio_direction_output;
++ pcf_gpio->chip.get = pcf50633_gpio_get_value;
++ pcf_gpio->chip.set = pcf50633_gpio_set_value;
++
++ pcf_gpio->chip.base = pcf->pdata->gpio_base;
++ pcf_gpio->chip.ngpio = 4;
++ pcf_gpio->chip.label = dev_name(pcf->dev);
++ pcf_gpio->chip.can_sleep = 1;
++ pcf_gpio->chip.owner = THIS_MODULE;
++ pcf_gpio->chip.dev = &pdev->dev;
++
++ platform_set_drvdata(pdev, pcf_gpio);
++
++ return gpiochip_add(&pcf_gpio->chip);
++}
++
++static int __devexit pcf50633_gpio_remove(struct platform_device *pdev)
++{
++ struct pcf50633_gpio *pcf_gpio = platform_get_drvdata(pdev);
++
++ gpiochip_remove(&pcf_gpio->chip);
++
++ platform_set_drvdata(pdev, NULL);
++ kfree(pcf_gpio);
++
++ return 0;
++}
++
++static struct platform_driver pcf50633_gpio_driver = {
++ .probe = pcf50633_gpio_probe,
++ .remove = __devexit_p(pcf50633_gpio_remove),
++ .driver = {
++ .name = "pcf50633-gpio",
++ .owner = THIS_MODULE,
++ },
++};
++
++int __init pcf50633_gpio_init(void)
++{
++ return platform_driver_register(&pcf50633_gpio_driver);
++}
++module_init(pcf50633_gpio_init);
++
++void __exit pcf50633_gpio_exit(void)
++{
++ platform_driver_unregister(&pcf50633_gpio_driver);
++}
++module_exit(pcf50633_gpio_exit);
++
++MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
++MODULE_DESCRIPTION("GPIO driver for the PCF50633");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
+index 23140a3..c75d165 100644
+--- a/drivers/input/misc/Kconfig
++++ b/drivers/input/misc/Kconfig
+@@ -277,6 +277,13 @@ config INPUT_PCF50633_PMU
+ Say Y to include support for delivering PMU events via input
+ layer on NXP PCF50633.
+
++config INPUT_PCF50606_PMU
++ tristate "PCF50606 PMU events"
++ depends on MFD_PCF50606
++ help
++ Say Y to include support for delivering PMU events via input
++ layer on NXP PCF50606.
++
+ config INPUT_GPIO_ROTARY_ENCODER
+ tristate "Rotary encoders connected to GPIO pins"
+ depends on GPIOLIB && GENERIC_GPIO
+diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
+index 7e95a5d..a70c9cf 100644
+--- a/drivers/input/misc/Makefile
++++ b/drivers/input/misc/Makefile
+@@ -19,6 +19,7 @@ obj-$(CONFIG_INPUT_KEYSPAN_REMOTE) += keyspan_remote.o
+ obj-$(CONFIG_INPUT_M68K_BEEP) += m68kspkr.o
+ obj-$(CONFIG_INPUT_PCAP) += pcap_keys.o
+ obj-$(CONFIG_INPUT_PCF50633_PMU) += pcf50633-input.o
++obj-$(CONFIG_INPUT_PCF50606_PMU) += pcf50606-input.o
+ obj-$(CONFIG_INPUT_PCSPKR) += pcspkr.o
+ obj-$(CONFIG_INPUT_POWERMATE) += powermate.o
+ obj-$(CONFIG_INPUT_RB532_BUTTON) += rb532_button.o
+diff --git a/drivers/input/misc/pcf50606-input.c b/drivers/input/misc/pcf50606-input.c
+new file mode 100644
+index 0000000..ccaf745
+--- /dev/null
++++ b/drivers/input/misc/pcf50606-input.c
+@@ -0,0 +1,139 @@
++/* Philips PCF50606 Input Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte, Matt Hsu, Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/platform_device.h>
++#include <linux/input.h>
++#include <linux/slab.h>
++
++#include <linux/mfd/pcf50606/core.h>
++
++#define PCF50606_OOCS_ONKEY 0x01
++#define PCF50606_OOCS_EXTON 0x02
++
++#define PCF50606_OOCC2_ONKEYDB_NONE 0x00
++#define PCF50606_OOCC2_ONKEYDB_14ms 0x01
++#define PCF50606_OOCC2_ONKEYDB_62ms 0x02
++#define PCF50606_OOCC2_ONKEYDB_500ms 0x03
++#define PCF50606_OOCC2_EXTONDB_NONE 0x00
++#define PCF50606_OOCC2_EXTONDB_14ms 0x04
++#define PCF50606_OOCC2_EXTONDB_62ms 0x08
++#define PCF50606_OOCC2_EXTONDB_500ms 0x0c
++
++#define PCF50606_REG_OOCS 0x01
++
++struct pcf50606_input {
++ struct pcf50606 *pcf;
++ struct input_dev *input_dev;
++};
++
++static void
++pcf50606_input_irq(int irq, void *data)
++{
++ struct pcf50606_input *input;
++ int onkey_released;
++
++ input = data;
++ onkey_released = pcf50606_reg_read(input->pcf, PCF50606_REG_OOCS) &
++ PCF50606_OOCS_ONKEY;
++
++ if (irq == PCF50606_IRQ_ONKEYF && !onkey_released)
++ input_report_key(input->input_dev, KEY_POWER, 1);
++ else if (irq == PCF50606_IRQ_ONKEYR && onkey_released)
++ input_report_key(input->input_dev, KEY_POWER, 0);
++
++ input_sync(input->input_dev);
++}
++
++static int __devinit pcf50606_input_probe(struct platform_device *pdev)
++{
++ struct pcf50606_input *input;
++ struct input_dev *input_dev;
++ int ret;
++
++ input = kzalloc(sizeof(*input), GFP_KERNEL);
++ if (!input)
++ return -ENOMEM;
++
++ input_dev = input_allocate_device();
++ if (!input_dev) {
++ kfree(input);
++ return -ENOMEM;
++ }
++
++ platform_set_drvdata(pdev, input);
++ input->pcf = dev_to_pcf50606(pdev->dev.parent);
++ input->input_dev = input_dev;
++
++ input_dev->name = "PCF50606 PMU events";
++ input_dev->id.bustype = BUS_I2C;
++ input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_PWR);
++ set_bit(KEY_POWER, input_dev->keybit);
++
++ ret = input_register_device(input_dev);
++ if (ret) {
++ input_free_device(input_dev);
++ kfree(input);
++ return ret;
++ }
++ pcf50606_register_irq(input->pcf, PCF50606_IRQ_ONKEYR,
++ pcf50606_input_irq, input);
++ pcf50606_register_irq(input->pcf, PCF50606_IRQ_ONKEYF,
++ pcf50606_input_irq, input);
++
++ return 0;
++}
++
++static int __devexit pcf50606_input_remove(struct platform_device *pdev)
++{
++ struct pcf50606_input *input = platform_get_drvdata(pdev);
++
++ input_unregister_device(input->input_dev);
++ pcf50606_free_irq(input->pcf, PCF50606_IRQ_ONKEYR);
++ pcf50606_free_irq(input->pcf, PCF50606_IRQ_ONKEYF);
++
++ kfree(input);
++
++ return 0;
++}
++
++static struct platform_driver pcf50606_input_driver = {
++ .driver = {
++ .name = "pcf50606-input",
++ },
++ .probe = pcf50606_input_probe,
++ .remove = __devexit_p(pcf50606_input_remove),
++};
++
++static int __init pcf50606_input_init(void)
++{
++ return platform_driver_register(&pcf50606_input_driver);
++}
++module_init(pcf50606_input_init);
++
++static void __exit pcf50606_input_exit(void)
++{
++ platform_driver_unregister(&pcf50606_input_driver);
++}
++module_exit(pcf50606_input_exit);
++
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
++MODULE_DESCRIPTION("PCF50606 input driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:pcf50606-input");
+diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
+index da3fa8d..ee9c708 100644
+--- a/drivers/leds/leds-pwm.c
++++ b/drivers/leds/leds-pwm.c
+@@ -26,8 +26,8 @@
+ struct led_pwm_data {
+ struct led_classdev cdev;
+ struct pwm_device *pwm;
+- unsigned int active_low;
+- unsigned int period;
++ struct led_pwm *led;
++ struct device *parent;
+ };
+
+ static void led_pwm_set(struct led_classdev *led_cdev,
+@@ -35,8 +35,13 @@ static void led_pwm_set(struct led_classdev *led_cdev,
+ {
+ struct led_pwm_data *led_dat =
+ container_of(led_cdev, struct led_pwm_data, cdev);
++ struct device *parent = led_dat->parent;
++ struct led_pwm_platform_data *pdata = parent->platform_data;
+ unsigned int max = led_dat->cdev.max_brightness;
+- unsigned int period = led_dat->period;
++ unsigned int period = led_dat->led->pwm_period_ns;
++
++ if (pdata->notify)
++ brightness = pdata->notify(parent, led_dat->led, brightness);
+
+ if (brightness == 0) {
+ pwm_config(led_dat->pwm, 0, period);
+@@ -76,18 +81,28 @@ static int led_pwm_probe(struct platform_device *pdev)
+
+ led_dat->cdev.name = cur_led->name;
+ led_dat->cdev.default_trigger = cur_led->default_trigger;
+- led_dat->active_low = cur_led->active_low;
+- led_dat->period = cur_led->pwm_period_ns;
+ led_dat->cdev.brightness_set = led_pwm_set;
+ led_dat->cdev.brightness = LED_OFF;
+ led_dat->cdev.max_brightness = cur_led->max_brightness;
+ led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
+
++ led_dat->led = cur_led;
++ led_dat->parent = &pdev->dev;
++
+ ret = led_classdev_register(&pdev->dev, &led_dat->cdev);
+ if (ret < 0) {
+ pwm_free(led_dat->pwm);
+ goto err;
+ }
++
++ if (pdata->init) {
++ ret = pdata->init(&pdev->dev, cur_led);
++ if (ret < 0) {
++ led_classdev_unregister(&led_dat->cdev);
++ pwm_free(led_dat->pwm);
++ goto err;
++ }
++ }
+ }
+
+ platform_set_drvdata(pdev, leds_data);
+@@ -97,6 +112,8 @@ static int led_pwm_probe(struct platform_device *pdev)
+ err:
+ if (i > 0) {
+ for (i = i - 1; i >= 0; i--) {
++ if (pdata->exit)
++ pdata->exit(&pdev->dev, &pdata->leds[i]);
+ led_classdev_unregister(&leds_data[i].cdev);
+ pwm_free(leds_data[i].pwm);
+ }
+@@ -116,6 +133,8 @@ static int __devexit led_pwm_remove(struct platform_device *pdev)
+ leds_data = platform_get_drvdata(pdev);
+
+ for (i = 0; i < pdata->num_leds; i++) {
++ if (pdata->exit)
++ pdata->exit(&pdev->dev, &pdata->leds[i]);
+ led_classdev_unregister(&leds_data[i].cdev);
+ pwm_free(leds_data[i].pwm);
+ }
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 2a5a0b7..cad1ef2 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -334,13 +334,6 @@ config PCF50633_ADC
+ Say yes here if you want to include support for ADC in the
+ NXP PCF50633 chip.
+
+-config PCF50633_GPIO
+- tristate "Support for NXP PCF50633 GPIO"
+- depends on MFD_PCF50633
+- help
+- Say yes here if you want to include support GPIO for pins on
+- the PCF50633 chip.
+-
+ config AB3100_CORE
+ bool "ST-Ericsson AB3100 Mixed Signal Circuit core functions"
+ depends on I2C=y
+@@ -399,6 +392,30 @@ config LPC_SCH
+ LPC bridge function of the Intel SCH provides support for
+ System Management Bus and General Purpose I/O.
+
++config MFD_GLAMO
++ bool "Smedia Glamo 336x/337x support"
++ select MFD_CORE
++ help
++ This enables the core driver for the Smedia Glamo 336x/337x
++ multi-function device. It includes irq_chip demultiplex as
++ well as clock / power management and GPIO support.
++
++config MFD_PCF50606
++ tristate "Support for NXP PCF50606"
++ depends on I2C
++ help
++ Say yes here if you have NXP PCF50606 chip on your board.
++ This core driver provides register access and IRQ handling
++ facilities, and registers devices for the various functions
++ so that function-specific drivers can bind to them.
++
++config PCF50606_ADC
++ tristate "Support for NXP PCF50606 ADC"
++ depends on MFD_PCF50606
++ help
++ Say yes here if you want to include support for ADC in the
++ NXP PCF50606 chip.
++
+ endmenu
+
+ menu "Multimedia Capabilities Port drivers"
+diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
+index 22715ad..51395cf 100644
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -7,6 +7,7 @@ obj-$(CONFIG_MFD_88PM860X) += 88pm860x.o
+ obj-$(CONFIG_MFD_SM501) += sm501.o
+ obj-$(CONFIG_MFD_ASIC3) += asic3.o tmio_core.o
+ obj-$(CONFIG_MFD_SH_MOBILE_SDHI) += sh_mobile_sdhi.o
++obj-$(CONFIG_MFD_GLAMO) += glamo-core.o
+
+ obj-$(CONFIG_HTC_EGPIO) += htc-egpio.o
+ obj-$(CONFIG_HTC_PASIC3) += htc-pasic3.o
+@@ -54,12 +55,14 @@ obj-$(CONFIG_PMIC_DA903X) += da903x.o
+ max8925-objs := max8925-core.o max8925-i2c.o
+ obj-$(CONFIG_MFD_MAX8925) += max8925.o
+
+-obj-$(CONFIG_MFD_PCF50633) += pcf50633-core.o
++pcf50633-objs := pcf50633-core.o pcf50633-irq.o
++obj-$(CONFIG_MFD_PCF50633) += pcf50633.o
+ obj-$(CONFIG_PCF50633_ADC) += pcf50633-adc.o
+-obj-$(CONFIG_PCF50633_GPIO) += pcf50633-gpio.o
+ obj-$(CONFIG_AB3100_CORE) += ab3100-core.o
+ obj-$(CONFIG_AB3100_OTP) += ab3100-otp.o
+ obj-$(CONFIG_AB4500_CORE) += ab4500-core.o
+ obj-$(CONFIG_MFD_TIMBERDALE) += timberdale.o
+ obj-$(CONFIG_PMIC_ADP5520) += adp5520.o
+-obj-$(CONFIG_LPC_SCH) += lpc_sch.o
+\ No newline at end of file
++obj-$(CONFIG_LPC_SCH) += lpc_sch.o
++obj-$(CONFIG_MFD_PCF50606) += pcf50606-core.o
++obj-$(CONFIG_PCF50606_ADC) += pcf50606-adc.o
+diff --git a/drivers/mfd/glamo-core.c b/drivers/mfd/glamo-core.c
+new file mode 100644
+index 0000000..8880263
+--- /dev/null
++++ b/drivers/mfd/glamo-core.c
+@@ -0,0 +1,1299 @@
++/* Smedia Glamo 3362 driver
++ *
++ * (C) 2007 by Openmoko, Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
++ * (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
++ * MA 02111-1307 USA
++ */
++
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/string.h>
++#include <linux/mm.h>
++#include <linux/delay.h>
++#include <linux/init.h>
++#include <linux/irq.h>
++#include <linux/interrupt.h>
++#include <linux/workqueue.h>
++#include <linux/platform_device.h>
++#include <linux/kernel_stat.h>
++#include <linux/spinlock.h>
++#include <linux/mfd/core.h>
++#include <linux/mfd/glamo.h>
++#include <linux/mfd/glamo-regs.h>
++#include <linux/mfd/glamo-core.h>
++#include <linux/io.h>
++#include <linux/slab.h>
++#include <linux/debugfs.h>
++#include <linux/seq_file.h>
++#include <linux/uaccess.h>
++
++#include <linux/pm.h>
++
++#define GLAMO_MEM_REFRESH_COUNT 0x100
++
++#define GLAMO_NR_IRQS 9
++
++#define GLAMO_IRQ_HOSTBUS 0
++#define GLAMO_IRQ_JPEG 1
++#define GLAMO_IRQ_MPEG 2
++#define GLAMO_IRQ_MPROC1 3
++#define GLAMO_IRQ_MPROC0 4
++#define GLAMO_IRQ_CMDQUEUE 5
++#define GLAMO_IRQ_2D 6
++#define GLAMO_IRQ_MMC 7
++#define GLAMO_IRQ_RISC 8
++
++/*
++ * Glamo internal settings
++ *
++ * We run the memory interface from the faster PLLB on 2.6.28 kernels and
++ * above. Couple of GTA02 users report trouble with memory bus when they
++ * upgraded from 2.6.24. So this parameter allows reversion to 2.6.24
++ * scheme if their Glamo chip needs it.
++ *
++ * you can override the faster default on kernel commandline using
++ *
++ * glamo3362.slow_memory=1
++ *
++ * for example
++ */
++
++static int slow_memory;
++module_param(slow_memory, int, 0644);
++
++struct reg_range {
++ int start;
++ int count;
++ char *name;
++ unsigned dump:1;
++};
++
++static const struct reg_range reg_range[] = {
++ { 0x0000, 0x76, "General", 1 },
++ { 0x0200, 0x18, "Host Bus", 1 },
++ { 0x0300, 0x38, "Memory", 1 },
++/* { 0x0400, 0x100, "Sensor", 0 }, */
++/* { 0x0500, 0x300, "ISP", 0 }, */
++/* { 0x0800, 0x400, "JPEG", 0 }, */
++/* { 0x0c00, 0xcc, "MPEG", 0 }, */
++ { 0x1100, 0xb2, "LCD 1", 0 },
++ { 0x1200, 0x64, "LCD 2", 0 },
++ { 0x1400, 0x42, "MMC", 0 },
++/* { 0x1500, 0x080, "MPU 0", 0 },
++ { 0x1580, 0x080, "MPU 1", 0 },
++ { 0x1600, 0x080, "Cmd Queue", 0 },
++ { 0x1680, 0x080, "RISC CPU", 0 },*/
++ { 0x1700, 0x400, "2D Unit", 0 },
++/* { 0x1b00, 0x900, "3D Unit", 0 }, */
++};
++
++static inline void __reg_write(struct glamo_core *glamo,
++ uint16_t reg, uint16_t val)
++{
++ writew(val, glamo->base + reg);
++}
++
++void glamo_reg_write(struct glamo_core *glamo,
++ uint16_t reg, uint16_t val)
++{
++ spin_lock(&glamo->lock);
++ __reg_write(glamo, reg, val);
++ spin_unlock(&glamo->lock);
++}
++EXPORT_SYMBOL_GPL(glamo_reg_write);
++
++
++static inline uint16_t __reg_read(struct glamo_core *glamo,
++ uint16_t reg)
++{
++ return readw(glamo->base + reg);
++}
++
++uint16_t glamo_reg_read(struct glamo_core *glamo, uint16_t reg)
++{
++ uint16_t val;
++ spin_lock(&glamo->lock);
++ val = __reg_read(glamo, reg);
++ spin_unlock(&glamo->lock);
++
++ return val;
++}
++EXPORT_SYMBOL_GPL(glamo_reg_read);
++
++static void __reg_set_bit_mask(struct glamo_core *glamo,
++ uint16_t reg, uint16_t mask,
++ uint16_t val)
++{
++ uint16_t tmp;
++
++ val &= mask;
++
++ tmp = __reg_read(glamo, reg);
++ tmp &= ~mask;
++ tmp |= val;
++ __reg_write(glamo, reg, tmp);
++}
++
++static void reg_set_bit_mask(struct glamo_core *glamo,
++ uint16_t reg, uint16_t mask,
++ uint16_t val)
++{
++ spin_lock(&glamo->lock);
++ __reg_set_bit_mask(glamo, reg, mask, val);
++ spin_unlock(&glamo->lock);
++}
++
++static inline void __reg_set_bit(struct glamo_core *glamo,
++ uint16_t reg, uint16_t bit)
++{
++ uint16_t tmp;
++ tmp = __reg_read(glamo, reg);
++ tmp |= bit;
++ __reg_write(glamo, reg, tmp);
++}
++
++static inline void __reg_clear_bit(struct glamo_core *glamo,
++ uint16_t reg, uint16_t bit)
++{
++ uint16_t tmp;
++ tmp = __reg_read(glamo, reg);
++ tmp &= ~bit;
++ __reg_write(glamo, reg, tmp);
++}
++
++/***********************************************************************
++ * resources of sibling devices
++ ***********************************************************************/
++
++static struct resource glamo_fb_resources[] = {
++ {
++ .name = "glamo-fb-regs",
++ .start = GLAMO_REGOFS_LCD,
++ .end = GLAMO_REGOFS_MMC - 1,
++ .flags = IORESOURCE_MEM,
++ }, {
++ .name = "glamo-fb-mem",
++ .start = GLAMO_OFFSET_FB,
++ .end = GLAMO_OFFSET_FB + GLAMO_FB_SIZE - 1,
++ .flags = IORESOURCE_MEM,
++ },
++};
++
++static struct resource glamo_mmc_resources[] = {
++ {
++ .name = "glamo-mmc-regs",
++ .start = GLAMO_REGOFS_MMC,
++ .end = GLAMO_REGOFS_MPROC0 - 1,
++ .flags = IORESOURCE_MEM
++ }, {
++ .name = "glamo-mmc-mem",
++ .start = GLAMO_OFFSET_FB + GLAMO_FB_SIZE,
++ .end = GLAMO_OFFSET_FB + GLAMO_FB_SIZE +
++ GLAMO_MMC_BUFFER_SIZE - 1,
++ .flags = IORESOURCE_MEM
++ }, {
++ .start = GLAMO_IRQ_MMC,
++ .end = GLAMO_IRQ_MMC,
++ .flags = IORESOURCE_IRQ,
++ },
++};
++
++enum glamo_cells {
++ GLAMO_CELL_FB,
++ GLAMO_CELL_MMC,
++ GLAMO_CELL_GPIO,
++};
++
++static const struct mfd_cell glamo_cells[] = {
++ [GLAMO_CELL_FB] = {
++ .name = "glamo-fb",
++ .num_resources = ARRAY_SIZE(glamo_fb_resources),
++ .resources = glamo_fb_resources,
++ },
++ [GLAMO_CELL_MMC] = {
++ .name = "glamo-mci",
++ .num_resources = ARRAY_SIZE(glamo_mmc_resources),
++ .resources = glamo_mmc_resources,
++ },
++ [GLAMO_CELL_GPIO] = {
++ .name = "glamo-gpio",
++ },
++};
++
++/***********************************************************************
++ * IRQ demultiplexer
++ ***********************************************************************/
++#define glamo_irq_bit(glamo, x) BIT(x - glamo->irq_base)
++
++static inline struct glamo_core *irq_to_glamo(unsigned int irq)
++{
++ return (struct glamo_core *)get_irq_chip_data(irq);
++}
++
++static void glamo_ack_irq(unsigned int irq)
++{
++ struct glamo_core *glamo = irq_to_glamo(irq);
++ /* clear interrupt source */
++ __reg_write(glamo, GLAMO_REG_IRQ_CLEAR, glamo_irq_bit(glamo, irq));
++}
++
++static void glamo_mask_irq(unsigned int irq)
++{
++ struct glamo_core *glamo = irq_to_glamo(irq);
++
++ /* clear bit in enable register */
++ __reg_clear_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, irq));
++}
++
++static void glamo_unmask_irq(unsigned int irq)
++{
++ struct glamo_core *glamo = irq_to_glamo(irq);
++
++ /* set bit in enable register */
++ __reg_set_bit(glamo, GLAMO_REG_IRQ_ENABLE, glamo_irq_bit(glamo, irq));
++}
++
++static struct irq_chip glamo_irq_chip = {
++ .name = "glamo",
++ .ack = glamo_ack_irq,
++ .mask = glamo_mask_irq,
++ .unmask = glamo_unmask_irq,
++};
++
++static void glamo_irq_demux_handler(unsigned int irq, struct irq_desc *desc)
++{
++ struct glamo_core *glamo = get_irq_desc_data(desc);
++ desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
++
++ if (unlikely(desc->status & IRQ_INPROGRESS)) {
++ desc->status |= (IRQ_PENDING | IRQ_MASKED);
++ desc->chip->mask(irq);
++ desc->chip->ack(irq);
++ return;
++ }
++ kstat_incr_irqs_this_cpu(irq, desc);
++
++ desc->chip->ack(irq);
++ desc->status |= IRQ_INPROGRESS;
++
++ do {
++ uint16_t irqstatus;
++ int i;
++
++ if (unlikely((desc->status &
++ (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
++ (IRQ_PENDING | IRQ_MASKED))) {
++ /* dealing with pending IRQ, unmasking */
++ desc->chip->unmask(irq);
++ desc->status &= ~IRQ_MASKED;
++ }
++
++ desc->status &= ~IRQ_PENDING;
++
++ /* read IRQ status register */
++ irqstatus = __reg_read(glamo, GLAMO_REG_IRQ_STATUS);
++ for (i = 0; i < 9; ++i) {
++ if (irqstatus & BIT(i))
++ generic_handle_irq(glamo->irq_base + i);
++ }
++
++ } while ((desc->status & (IRQ_PENDING | IRQ_DISABLED)) == IRQ_PENDING);
++
++ desc->status &= ~IRQ_INPROGRESS;
++}
++
++struct glamo_engine_reg_set {
++ uint16_t reg;
++ uint16_t mask_suspended;
++ uint16_t mask_enabled;
++};
++
++/*
++debugfs
++*/
++
++#ifdef CONFIG_DEBUG_FS
++static ssize_t debugfs_regs_write(struct file *file,
++ const char __user *user_buf,
++ size_t count, loff_t *ppos)
++{
++ struct glamo_core *glamo = ((struct seq_file *)file->private_data)->private;
++ char buf[14];
++ unsigned int reg;
++ unsigned int val;
++ int buf_size;
++
++ buf_size = min(count, sizeof(buf) - 1);
++ if (copy_from_user(buf, user_buf, buf_size))
++ return -EFAULT;
++ if (sscanf(buf, "%x %x", ®, &val) != 2)
++ return -EFAULT;
++
++ dev_info(&glamo->pdev->dev, "reg %#02x <-- %#04x\n", reg, val);
++
++ glamo_reg_write(glamo, reg, val);
++
++ return count;
++}
++
++static int glamo_show_regs(struct seq_file *s, void *pos)
++{
++ struct glamo_core *glamo = s->private;
++ int i, n;
++ const struct reg_range *rr = reg_range;
++
++ spin_lock(&glamo->lock);
++ for (i = 0; i < ARRAY_SIZE(reg_range); ++i, ++rr) {
++ if (!rr->dump)
++ continue;
++ seq_printf(s, "\n%s\n", rr->name);
++ for (n = rr->start; n < rr->start + rr->count; n += 2) {
++ if ((n & 15) == 0)
++ seq_printf(s, "\n%04X: ", n);
++ seq_printf(s, "%04x ", __reg_read(glamo, n));
++ }
++ seq_printf(s, "\n");
++ }
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static int debugfs_open_file(struct inode *inode, struct file *file)
++{
++ return single_open(file, glamo_show_regs, inode->i_private);
++}
++
++static const struct file_operations debugfs_regs_ops = {
++ .open = debugfs_open_file,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .write = debugfs_regs_write,
++ .release = single_release,
++};
++
++static void glamo_init_debugfs(struct glamo_core *glamo)
++{
++ glamo->debugfs_dir = debugfs_create_dir("glamo3362", NULL);
++ if (glamo->debugfs_dir)
++ debugfs_create_file("regs", S_IRUGO | S_IWUSR,
++ glamo->debugfs_dir,
++ glamo, &debugfs_regs_ops);
++ else
++ dev_warn(&glamo->pdev->dev, "Failed to set up debugfs.\n");
++}
++
++static void glamo_exit_debugfs(struct glamo_core *glamo)
++{
++ if (glamo->debugfs_dir)
++ debugfs_remove_recursive(glamo->debugfs_dir);
++}
++#else
++static void glamo_init_debugfs(struct glamo_core *glamo)
++{
++}
++
++static void glamo_exit_debugfs(struct glamo_core *glamo)
++{
++}
++#endif
++
++struct glamo_engine_desc {
++ const char *name;
++ uint16_t hostbus;
++ const struct glamo_engine_reg_set *regs;
++ int num_regs;
++};
++
++static const struct glamo_engine_reg_set glamo_lcd_regs[] = {
++ { GLAMO_REG_CLOCK_LCD,
++ GLAMO_CLOCK_LCD_EN_M5CLK |
++ GLAMO_CLOCK_LCD_DG_M5CLK |
++ GLAMO_CLOCK_LCD_EN_DMCLK,
++
++ GLAMO_CLOCK_LCD_EN_DHCLK |
++ GLAMO_CLOCK_LCD_EN_DCLK
++ },
++ { GLAMO_REG_CLOCK_GEN5_1,
++ GLAMO_CLOCK_GEN51_EN_DIV_DMCLK,
++
++ GLAMO_CLOCK_GEN51_EN_DIV_DHCLK |
++ GLAMO_CLOCK_GEN51_EN_DIV_DCLK
++ }
++};
++
++static const struct glamo_engine_reg_set glamo_mmc_regs[] = {
++ { GLAMO_REG_CLOCK_MMC,
++ GLAMO_CLOCK_MMC_EN_M9CLK |
++ GLAMO_CLOCK_MMC_DG_M9CLK,
++
++ GLAMO_CLOCK_MMC_EN_TCLK |
++ GLAMO_CLOCK_MMC_DG_TCLK
++ },
++ { GLAMO_REG_CLOCK_GEN5_1,
++ 0,
++ GLAMO_CLOCK_GEN51_EN_DIV_TCLK
++ }
++};
++
++static const struct glamo_engine_reg_set glamo_2d_regs[] = {
++ { GLAMO_REG_CLOCK_2D,
++ GLAMO_CLOCK_2D_EN_M7CLK |
++ GLAMO_CLOCK_2D_DG_M7CLK,
++
++ GLAMO_CLOCK_2D_EN_GCLK |
++ GLAMO_CLOCK_2D_DG_GCLK
++ },
++ { GLAMO_REG_CLOCK_GEN5_1,
++ 0,
++ GLAMO_CLOCK_GEN51_EN_DIV_GCLK,
++ }
++};
++
++static const struct glamo_engine_reg_set glamo_cmdq_regs[] = {
++ { GLAMO_REG_CLOCK_2D,
++ GLAMO_CLOCK_2D_EN_M6CLK,
++ 0
++ },
++};
++
++#define GLAMO_ENGINE(xname, xhostbus, xregs) { \
++ .name = xname, \
++ .hostbus = xhostbus, \
++ .num_regs = ARRAY_SIZE(xregs), \
++ .regs = xregs, \
++}
++
++static const struct glamo_engine_desc glamo_engines[] = {
++ [GLAMO_ENGINE_LCD] = GLAMO_ENGINE("LCD", GLAMO_HOSTBUS2_MMIO_EN_LCD,
++ glamo_lcd_regs),
++ [GLAMO_ENGINE_MMC] = GLAMO_ENGINE("MMC", GLAMO_HOSTBUS2_MMIO_EN_MMC,
++ glamo_mmc_regs),
++ [GLAMO_ENGINE_2D] = GLAMO_ENGINE("2D", GLAMO_HOSTBUS2_MMIO_EN_2D,
++ glamo_2d_regs),
++ [GLAMO_ENGINE_CMDQ] = GLAMO_ENGINE("CMDQ", GLAMO_HOSTBUS2_MMIO_EN_CQ,
++ glamo_cmdq_regs),
++};
++
++static inline const char *glamo_engine_name(enum glamo_engine engine)
++{
++ return glamo_engines[engine].name;
++}
++
++/***********************************************************************
++ * 'engine' support
++ ***********************************************************************/
++
++int __glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int i;
++ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
++ const struct glamo_engine_reg_set *reg;
++
++ switch (engine) {
++ case GLAMO_ENGINE_LCD:
++ case GLAMO_ENGINE_MMC:
++ case GLAMO_ENGINE_2D:
++ case GLAMO_ENGINE_CMDQ:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ reg = engine_desc->regs;
++
++ __reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
++ engine_desc->hostbus);
++ for (i = engine_desc->num_regs; i; --i, ++reg)
++ __reg_set_bit(glamo, reg->reg,
++ reg->mask_suspended | reg->mask_enabled);
++
++ return 0;
++}
++
++int glamo_engine_enable(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int ret = 0;
++
++ spin_lock(&glamo->lock);
++
++ if (glamo->engine_state[engine] != GLAMO_ENGINE_ENABLED) {
++ ret = __glamo_engine_enable(glamo, engine);
++ if (!ret)
++ glamo->engine_state[engine] = GLAMO_ENGINE_ENABLED;
++ }
++
++ spin_unlock(&glamo->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(glamo_engine_enable);
++
++int __glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int i;
++ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
++ const struct glamo_engine_reg_set *reg;
++
++ switch (engine) {
++ case GLAMO_ENGINE_LCD:
++ case GLAMO_ENGINE_MMC:
++ case GLAMO_ENGINE_2D:
++ case GLAMO_ENGINE_CMDQ:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ reg = engine_desc->regs;
++
++ __reg_clear_bit(glamo, GLAMO_REG_HOSTBUS(2),
++ engine_desc->hostbus);
++ for (i = engine_desc->num_regs; i; --i, ++reg)
++ __reg_clear_bit(glamo, reg->reg,
++ reg->mask_suspended | reg->mask_enabled);
++
++ return 0;
++}
++int glamo_engine_disable(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int ret = 0;
++
++ spin_lock(&glamo->lock);
++
++ if (glamo->engine_state[engine] != GLAMO_ENGINE_DISABLED) {
++ ret = __glamo_engine_disable(glamo, engine);
++ if (!ret)
++ glamo->engine_state[engine] = GLAMO_ENGINE_DISABLED;
++ }
++
++ spin_unlock(&glamo->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(glamo_engine_disable);
++
++int __glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int i;
++ const struct glamo_engine_desc *engine_desc = &glamo_engines[engine];
++ const struct glamo_engine_reg_set *reg;
++
++ switch (engine) {
++ case GLAMO_ENGINE_LCD:
++ case GLAMO_ENGINE_MMC:
++ case GLAMO_ENGINE_2D:
++ case GLAMO_ENGINE_CMDQ:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ reg = engine_desc->regs;
++
++ __reg_set_bit(glamo, GLAMO_REG_HOSTBUS(2),
++ engine_desc->hostbus);
++ for (i = engine_desc->num_regs; i; --i, ++reg) {
++ __reg_set_bit(glamo, reg->reg, reg->mask_suspended);
++ __reg_clear_bit(glamo, reg->reg, reg->mask_enabled);
++ }
++
++ return 0;
++}
++
++int glamo_engine_suspend(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ int ret = 0;
++
++ spin_lock(&glamo->lock);
++
++ if (glamo->engine_state[engine] != GLAMO_ENGINE_SUSPENDED) {
++ ret = __glamo_engine_suspend(glamo, engine);
++ if (!ret)
++ glamo->engine_state[engine] = GLAMO_ENGINE_SUSPENDED;
++ }
++
++ spin_unlock(&glamo->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(glamo_engine_suspend);
++
++static const struct glamo_script reset_regs[] = {
++ [GLAMO_ENGINE_LCD] = {
++ GLAMO_REG_CLOCK_LCD, GLAMO_CLOCK_LCD_RESET
++ },
++ [GLAMO_ENGINE_MMC] = {
++ GLAMO_REG_CLOCK_MMC, GLAMO_CLOCK_MMC_RESET
++ },
++ [GLAMO_ENGINE_CMDQ] = {
++ GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_CQ_RESET
++ },
++ [GLAMO_ENGINE_2D] = {
++ GLAMO_REG_CLOCK_2D, GLAMO_CLOCK_2D_RESET
++ },
++ [GLAMO_ENGINE_JPEG] = {
++ GLAMO_REG_CLOCK_JPEG, GLAMO_CLOCK_JPEG_RESET
++ },
++};
++
++void glamo_engine_reset(struct glamo_core *glamo, enum glamo_engine engine)
++{
++ uint16_t reg = reset_regs[engine].reg;
++ uint16_t val = reset_regs[engine].val;
++
++ if (engine >= ARRAY_SIZE(reset_regs)) {
++ dev_warn(&glamo->pdev->dev, "unknown engine %u ", engine);
++ return;
++ }
++
++ spin_lock(&glamo->lock);
++ __reg_set_bit(glamo, reg, val);
++ __reg_clear_bit(glamo, reg, val);
++ spin_unlock(&glamo->lock);
++}
++EXPORT_SYMBOL_GPL(glamo_engine_reset);
++
++int glamo_pll_rate(struct glamo_core *glamo,
++ enum glamo_pll pll)
++{
++ uint16_t reg;
++ unsigned int osci = glamo->pdata->osci_clock_rate;
++
++ switch (pll) {
++ case GLAMO_PLL1:
++ reg = __reg_read(glamo, GLAMO_REG_PLL_GEN1);
++ break;
++ case GLAMO_PLL2:
++ reg = __reg_read(glamo, GLAMO_REG_PLL_GEN3);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return (int)osci * (int)reg;
++}
++EXPORT_SYMBOL_GPL(glamo_pll_rate);
++
++int glamo_engine_reclock(struct glamo_core *glamo,
++ enum glamo_engine engine,
++ int hz)
++{
++ int pll;
++ uint16_t reg, mask, div;
++
++ if (!hz)
++ return -EINVAL;
++
++ switch (engine) {
++ case GLAMO_ENGINE_LCD:
++ pll = GLAMO_PLL1;
++ reg = GLAMO_REG_CLOCK_GEN7;
++ mask = 0xff;
++ break;
++ case GLAMO_ENGINE_MMC:
++ pll = GLAMO_PLL1;
++ reg = GLAMO_REG_CLOCK_GEN8;
++ mask = 0xff;
++ break;
++ default:
++ dev_warn(&glamo->pdev->dev,
++ "reclock of engine 0x%x not supported\n", engine);
++ return -EINVAL;
++ break;
++ }
++
++ pll = glamo_pll_rate(glamo, pll);
++
++ div = pll / hz;
++
++ if (div != 0 && pll / div <= hz)
++ --div;
++
++ if (div > mask)
++ div = mask;
++
++ dev_dbg(&glamo->pdev->dev,
++ "PLL %d, kHZ %d, div %d\n", pll, hz / 1000, div);
++
++ reg_set_bit_mask(glamo, reg, mask, div);
++ mdelay(5); /* wait some time to stabilize */
++
++ return pll / (div + 1);
++}
++EXPORT_SYMBOL_GPL(glamo_engine_reclock);
++
++/***********************************************************************
++ * script support
++ ***********************************************************************/
++
++#define GLAMO_SCRIPT_END 0xffff
++#define GLAMO_SCRIPT_WAIT 0xfffe
++#define GLAMO_SCRIPT_LOCK_PLL 0xfffd
++
++/*
++ * couple of people reported artefacts with 2.6.28 changes, this
++ * allows reversion to 2.6.24 settings
++*/
++static const uint16_t reg_0x200[] = {
++ 0xe03, /* 0 waits on Async BB R & W, Use PLL 2 for mem bus */
++ 0xef0, /* 3 waits on Async BB R & W, Use PLL 1 for mem bus */
++ 0xea0, /* 2 waits on Async BB R & W, Use PLL 1 for mem bus */
++ 0xe50, /* 1 waits on Async BB R & W, Use PLL 1 for mem bus */
++ 0xe00, /* 0 waits on Async BB R & W, Use PLL 1 for mem bus */
++ 0xef3, /* 3 waits on Async BB R & W, Use PLL 2 for mem bus */
++ 0xea3, /* 2 waits on Async BB R & W, Use PLL 2 for mem bus */
++ 0xe53, /* 1 waits on Async BB R & W, Use PLL 2 for mem bus */
++};
++
++static int glamo_run_script(struct glamo_core *glamo,
++ const struct glamo_script *script, int len,
++ int may_sleep)
++{
++ int i;
++ uint16_t status;
++ const struct glamo_script *line = script;
++
++ for (i = 0; i < len; ++i, ++line) {
++ switch (line->reg) {
++ case GLAMO_SCRIPT_END:
++ return 0;
++ case GLAMO_SCRIPT_WAIT:
++ if (may_sleep)
++ msleep(line->val);
++ else
++ mdelay(line->val * 4);
++ break;
++ case GLAMO_SCRIPT_LOCK_PLL:
++ /* spin until PLLs lock */
++ do {
++ status = __reg_read(glamo, GLAMO_REG_PLL_GEN5);
++ } while ((status & 3) != 3);
++ break;
++ case 0x200:
++ __reg_write(glamo, line->reg,
++ reg_0x200[slow_memory & 0x7]);
++ break;
++ default:
++ __reg_write(glamo, line->reg, line->val);
++ break;
++ }
++ }
++
++ return 0;
++}
++
++static const struct glamo_script glamo_init_script[] = {
++ { GLAMO_REG_CLOCK_HOST, 0x1000 },
++ { GLAMO_SCRIPT_WAIT, 2 },
++ { GLAMO_REG_CLOCK_MEMORY, 0x1000 },
++ { GLAMO_REG_CLOCK_MEMORY, 0x2000 },
++ { GLAMO_REG_CLOCK_LCD, 0x1000 },
++ { GLAMO_REG_CLOCK_MMC, 0x1000 },
++ { GLAMO_REG_CLOCK_ISP, 0x1000 },
++ { GLAMO_REG_CLOCK_ISP, 0x3000 },
++ { GLAMO_REG_CLOCK_JPEG, 0x1000 },
++ { GLAMO_REG_CLOCK_3D, 0x1000 },
++ { GLAMO_REG_CLOCK_3D, 0x3000 },
++ { GLAMO_REG_CLOCK_2D, 0x1000 },
++ { GLAMO_REG_CLOCK_2D, 0x3000 },
++ { GLAMO_REG_CLOCK_RISC1, 0x1000 },
++ { GLAMO_REG_CLOCK_MPEG, 0x1000 },
++ { GLAMO_REG_CLOCK_MPEG, 0x3000 },
++ { GLAMO_REG_CLOCK_MPROC, 0x1000 /*0x100f*/ },
++ { GLAMO_SCRIPT_WAIT, 2 },
++ { GLAMO_REG_CLOCK_HOST, 0x0000 },
++ { GLAMO_REG_CLOCK_MEMORY, 0x0000 },
++ { GLAMO_REG_CLOCK_LCD, 0x0000 },
++ { GLAMO_REG_CLOCK_MMC, 0x0000 },
++ { GLAMO_REG_PLL_GEN1, 0x05db }, /* 48MHz */
++ { GLAMO_REG_PLL_GEN3, 0x0aba }, /* 90MHz */
++ { GLAMO_SCRIPT_LOCK_PLL, 0 },
++ /*
++ * b9 of this register MUST be zero to get any interrupts on INT#
++ * the other set bits enable all the engine interrupt sources
++ */
++ { GLAMO_REG_IRQ_ENABLE, 0x0100 },
++ { GLAMO_REG_CLOCK_GEN6, 0x2000 },
++ { GLAMO_REG_CLOCK_GEN7, 0x0101 },
++ { GLAMO_REG_CLOCK_GEN8, 0x0100 },
++ { GLAMO_REG_CLOCK_HOST, 0x000d },
++ /*
++ * b7..b4 = 0 = no wait states on read or write
++ * b0 = 1 select PLL2 for Host interface, b1 = enable it
++ */
++ { GLAMO_REG_HOSTBUS(1), 0x0e03 /* this is replaced by script parser */ },
++ { GLAMO_REG_HOSTBUS(2), 0x07ff }, /* TODO: Disable all */
++ { GLAMO_REG_HOSTBUS(10), 0x0000 },
++ { GLAMO_REG_HOSTBUS(11), 0x4000 },
++ { GLAMO_REG_HOSTBUS(12), 0xf00e },
++
++ /* S-Media recommended "set tiling mode to 512 mode for memory access
++ * more efficiency when 640x480" */
++ { GLAMO_REG_MEM_TYPE, 0x0c74 }, /* 8MB, 16 word pg wr+rd */
++ { GLAMO_REG_MEM_GEN, 0xafaf }, /* 63 grants min + max */
++
++ { GLAMO_REG_MEM_TIMING1, 0x0108 },
++ { GLAMO_REG_MEM_TIMING2, 0x0010 }, /* Taa = 3 MCLK */
++ { GLAMO_REG_MEM_TIMING3, 0x0000 },
++ { GLAMO_REG_MEM_TIMING4, 0x0000 }, /* CE1# delay fall/rise */
++ { GLAMO_REG_MEM_TIMING5, 0x0000 }, /* UB# LB# */
++ { GLAMO_REG_MEM_TIMING6, 0x0000 }, /* OE# */
++ { GLAMO_REG_MEM_TIMING7, 0x0000 }, /* WE# */
++ { GLAMO_REG_MEM_TIMING8, 0x1002 }, /* MCLK delay, was 0x1000 */
++ { GLAMO_REG_MEM_TIMING9, 0x6006 },
++ { GLAMO_REG_MEM_TIMING10, 0x00ff },
++ { GLAMO_REG_MEM_TIMING11, 0x0001 },
++ { GLAMO_REG_MEM_POWER1, 0x0020 },
++ { GLAMO_REG_MEM_POWER2, 0x0000 },
++ { GLAMO_REG_MEM_DRAM1, 0x0000 },
++ { GLAMO_SCRIPT_WAIT, 1 },
++ { GLAMO_REG_MEM_DRAM1, 0xc100 },
++ { GLAMO_SCRIPT_WAIT, 1 },
++ { GLAMO_REG_MEM_DRAM1, 0xe100 },
++ { GLAMO_REG_MEM_DRAM2, 0x01d6 },
++ { GLAMO_REG_CLOCK_MEMORY, 0x000b },
++};
++
++/* Find out if we can support this version of the Glamo chip */
++static int __devinit glamo_supported(struct glamo_core *glamo)
++{
++ uint16_t dev_id, rev_id;
++
++ dev_id = __reg_read(glamo, GLAMO_REG_DEVICE_ID);
++ rev_id = __reg_read(glamo, GLAMO_REG_REVISION_ID);
++
++ switch (dev_id) {
++ case 0x3650:
++ switch (rev_id) {
++ case GLAMO_CORE_REV_A2:
++ break;
++ case GLAMO_CORE_REV_A0:
++ case GLAMO_CORE_REV_A1:
++ case GLAMO_CORE_REV_A3:
++ dev_warn(&glamo->pdev->dev, "untested core revision "
++ "%04x, your mileage may vary\n", rev_id);
++ break;
++ default:
++ dev_warn(&glamo->pdev->dev, "unknown glamo revision "
++ "%04x, your mileage may vary\n", rev_id);
++ }
++ break;
++ default:
++ dev_err(&glamo->pdev->dev, "unsupported Glamo device %04x\n",
++ dev_id);
++ return 0;
++ }
++
++ dev_dbg(&glamo->pdev->dev, "Detected Glamo core %04x Revision %04x "
++ "(%uHz CPU / %uHz Memory)\n", dev_id, rev_id,
++ glamo_pll_rate(glamo, GLAMO_PLL1),
++ glamo_pll_rate(glamo, GLAMO_PLL2));
++
++ return 1;
++}
++
++static int __devinit glamo_probe(struct platform_device *pdev)
++{
++ int ret = 0, n, irq, irq_base;
++ struct glamo_core *glamo;
++ struct resource *mem;
++
++ glamo = kmalloc(GFP_KERNEL, sizeof(*glamo));
++ if (!glamo)
++ return -ENOMEM;
++
++ for (n = 0; n < __NUM_GLAMO_ENGINES; n++)
++ glamo->engine_state[n] = GLAMO_ENGINE_DISABLED;
++
++ spin_lock_init(&glamo->lock);
++
++ glamo->pdev = pdev;
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ glamo->irq = platform_get_irq(pdev, 0);
++ glamo->irq_base = irq_base = platform_get_irq(pdev, 1);
++ glamo->pdata = pdev->dev.platform_data;
++
++ if (glamo->irq < 0) {
++ ret = glamo->irq;
++ dev_err(&pdev->dev, "Failed to get platform irq: %d\n", ret);
++ goto err_free;
++ }
++
++ if (irq_base < 0) {
++ ret = glamo->irq;
++ dev_err(&pdev->dev, "Failed to get glamo irq base: %d\n", ret);
++ goto err_free;
++ }
++
++ if (!mem) {
++ dev_err(&pdev->dev, "Failed to get platform memory\n");
++ ret = -ENOENT;
++ goto err_free;
++ }
++
++ if (!glamo->pdata) {
++ dev_err(&pdev->dev, "Missing platform data\n");
++ ret = -ENOENT;
++ goto err_free;
++ }
++
++ /* only request the generic, hostbus and memory controller registers */
++ glamo->mem = request_mem_region(mem->start, GLAMO_REGOFS_VIDCAP,
++ pdev->name);
++
++ if (!glamo->mem) {
++ dev_err(&pdev->dev, "Failed to request io memory region\n");
++ ret = -ENOENT;
++ goto err_free;
++ }
++
++ glamo->base = ioremap(glamo->mem->start, resource_size(glamo->mem));
++ if (!glamo->base) {
++ dev_err(&pdev->dev, "Failed to ioremap() memory region\n");
++ goto err_release_mem_region;
++ }
++
++ /* confirm it isn't insane version */
++ if (!glamo_supported(glamo)) {
++ dev_err(&pdev->dev,
++ "This version of the Glamo is not supported\n");
++ goto err_iounmap;
++ }
++
++ platform_set_drvdata(pdev, glamo);
++
++ /* debugfs */
++ glamo_init_debugfs(glamo);
++
++ /* init the chip with canned register set */
++ glamo_run_script(glamo, glamo_init_script,
++ ARRAY_SIZE(glamo_init_script), 1);
++
++ /*
++ * finally set the mfd interrupts up
++ */
++ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
++#ifdef CONFIG_ARM
++ set_irq_flags(irq, IRQF_VALID);
++#else
++ set_irq_noprobe(irq);
++#endif
++ set_irq_chip_data(irq, glamo);
++ set_irq_chip_and_handler(irq, &glamo_irq_chip,
++ handle_level_irq);
++ }
++
++ set_irq_type(glamo->irq, IRQ_TYPE_EDGE_FALLING);
++ set_irq_data(glamo->irq, glamo);
++ set_irq_chained_handler(glamo->irq, glamo_irq_demux_handler);
++
++ ret = mfd_add_devices(&pdev->dev, pdev->id, glamo_cells,
++ ARRAY_SIZE(glamo_cells), mem, glamo->irq_base);
++
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to add child devices: %d\n", ret);
++ goto err_free_irqs;
++ }
++
++ dev_info(&glamo->pdev->dev, "Glamo core PLL1: %uHz, PLL2: %uHz\n",
++ glamo_pll_rate(glamo, GLAMO_PLL1),
++ glamo_pll_rate(glamo, GLAMO_PLL2));
++
++ return 0;
++
++err_free_irqs:
++ disable_irq(glamo->irq);
++ set_irq_chained_handler(glamo->irq, NULL);
++ set_irq_chip_data(glamo->irq, NULL);
++
++ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
++ set_irq_chip(irq, NULL);
++#ifdef CONFIG_ARM
++ set_irq_flags(irq, 0);
++#else
++ set_irq_probe(irq);
++#endif
++ set_irq_chip_data(irq, NULL);
++ }
++err_iounmap:
++ iounmap(glamo->base);
++err_release_mem_region:
++ release_mem_region(glamo->mem->start, resource_size(glamo->mem));
++err_free:
++ platform_set_drvdata(pdev, NULL);
++ kfree(glamo);
++
++ return ret;
++}
++
++static int __devexit glamo_remove(struct platform_device *pdev)
++{
++ struct glamo_core *glamo = platform_get_drvdata(pdev);
++ int irq;
++ int irq_base = glamo->irq_base;
++
++ glamo_exit_debugfs(glamo);
++
++ mfd_remove_devices(&pdev->dev);
++
++ disable_irq(glamo->irq);
++ set_irq_chained_handler(glamo->irq, NULL);
++ set_irq_chip_data(glamo->irq, NULL);
++
++ for (irq = irq_base; irq < irq_base + GLAMO_NR_IRQS; ++irq) {
++#ifdef CONFIG_ARM
++ set_irq_flags(irq, 0);
++#else
++ set_irq_noprobe();
++#endif
++ set_irq_chip(irq, NULL);
++ set_irq_chip_data(irq, NULL);
++ }
++
++ platform_set_drvdata(pdev, NULL);
++ iounmap(glamo->base);
++ release_mem_region(glamo->mem->start, resource_size(glamo->mem));
++ kfree(glamo);
++
++ return 0;
++}
++
++#ifdef CONFIG_PM
++#if 0
++static struct glamo_script glamo_resume_script[] = {
++
++ { GLAMO_REG_PLL_GEN1, 0x05db }, /* 48MHz */
++ { GLAMO_REG_PLL_GEN3, 0x0aba }, /* 90MHz */
++ { GLAMO_REG_DFT_GEN6, 1 },
++ { 0xfffe, 100 },
++ { 0xfffd, 0 },
++ { 0x200, 0x0e03 },
++
++ /*
++ * b9 of this register MUST be zero to get any interrupts on INT#
++ * the other set bits enable all the engine interrupt sources
++ */
++ { GLAMO_REG_IRQ_ENABLE, 0x01ff },
++ { GLAMO_REG_CLOCK_HOST, 0x0018 },
++ { GLAMO_REG_CLOCK_GEN5_1, 0x18b1 },
++
++ { GLAMO_REG_MEM_DRAM1, 0x0000 },
++ { 0xfffe, 1 },
++ { GLAMO_REG_MEM_DRAM1, 0xc100 },
++ { 0xfffe, 1 },
++ { GLAMO_REG_MEM_DRAM1, 0xe100 },
++ { GLAMO_REG_MEM_DRAM2, 0x01d6 },
++ { GLAMO_REG_CLOCK_MEMORY, 0x000b },
++};
++#endif
++
++#if 0
++static void glamo_power(struct glamo_core *glamo)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&glamo->lock, flags);
++
++ /*
++Power management
++static const REG_VALUE_MASK_TYPE reg_powerOn[] =
++{
++ { REG_GEN_DFT6, REG_BIT_ALL, REG_DATA(1u << 0) },
++ { REG_GEN_PLL3, 0u, REG_DATA(1u << 13) },
++ { REG_GEN_MEM_CLK, REG_BIT_ALL, REG_BIT_EN_MOCACLK },
++ { REG_MEM_DRAM2, 0u, REG_BIT_EN_DEEP_POWER_DOWN },
++ { REG_MEM_DRAM1, 0u, REG_BIT_SELF_REFRESH }
++};
++
++static const REG_VALUE_MASK_TYPE reg_powerStandby[] =
++{
++ { REG_MEM_DRAM1, REG_BIT_ALL, REG_BIT_SELF_REFRESH },
++ { REG_GEN_MEM_CLK, 0u, REG_BIT_EN_MOCACLK },
++ { REG_GEN_PLL3, REG_BIT_ALL, REG_DATA(1u << 13) },
++ { REG_GEN_DFT5, REG_BIT_ALL, REG_DATA(1u << 0) }
++};
++
++static const REG_VALUE_MASK_TYPE reg_powerSuspend[] =
++{
++ { REG_MEM_DRAM2, REG_BIT_ALL, REG_BIT_EN_DEEP_POWER_DOWN },
++ { REG_GEN_MEM_CLK, 0u, REG_BIT_EN_MOCACLK },
++ { REG_GEN_PLL3, REG_BIT_ALL, REG_DATA(1u << 13) },
++ { REG_GEN_DFT5, REG_BIT_ALL, REG_DATA(1u << 0) }
++};
++*/
++ switch (new_state) {
++ case GLAMO_POWER_ON:
++
++ /*
++ * glamo state on resume is nondeterministic in some
++ * fundamental way, it has also been observed that the
++ * Glamo reset pin can get asserted by, eg, touching it with
++ * a scope probe. So the only answer is to roll with it and
++ * force an external reset on the Glamo during resume.
++ */
++
++
++ break;
++
++ case GLAMO_POWER_SUSPEND:
++
++ break;
++ }
++ spin_unlock_irqrestore(&glamo->lock, flags);
++}
++#endif
++
++static int glamo_suspend(struct device *dev)
++{
++ struct glamo_core *glamo = dev_get_drvdata(dev);
++ int n;
++
++ spin_lock(&glamo->lock);
++
++ glamo->saved_irq_mask = __reg_read(glamo, GLAMO_REG_IRQ_ENABLE);
++
++ /* nuke interrupts */
++ __reg_write(glamo, GLAMO_REG_IRQ_ENABLE, 0x200);
++
++ /* take down each engine before we kill mem and pll */
++ for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
++ if (glamo->engine_state[n] != GLAMO_ENGINE_DISABLED)
++ __glamo_engine_disable(glamo, n);
++ }
++
++ /* enable self-refresh */
++
++ __reg_write(glamo, GLAMO_REG_MEM_DRAM1,
++ GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
++ GLAMO_MEM_DRAM1_EN_GATE_CKE |
++ GLAMO_MEM_DRAM1_SELF_REFRESH |
++ GLAMO_MEM_REFRESH_COUNT);
++ __reg_write(glamo, GLAMO_REG_MEM_DRAM1,
++ GLAMO_MEM_DRAM1_EN_MODEREG_SET |
++ GLAMO_MEM_DRAM1_EN_DRAM_REFRESH |
++ GLAMO_MEM_DRAM1_EN_GATE_CKE |
++ GLAMO_MEM_DRAM1_SELF_REFRESH |
++ GLAMO_MEM_REFRESH_COUNT);
++
++ /* force RAM into deep powerdown */
++ __reg_write(glamo, GLAMO_REG_MEM_DRAM2,
++ GLAMO_MEM_DRAM2_DEEP_PWRDOWN |
++ (7 << 6) | /* tRC */
++ (1 << 4) | /* tRP */
++ (1 << 2) | /* tRCD */
++ 2); /* CAS latency */
++
++ /* disable clocks to memory */
++ __reg_write(glamo, GLAMO_REG_CLOCK_MEMORY, 0);
++
++ /* all dividers from OSCI */
++ __reg_set_bit_mask(glamo, GLAMO_REG_CLOCK_GEN5_1, 0x400, 0x400);
++
++ /* PLL2 into bypass */
++ __reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 12, 1 << 12);
++
++ __reg_write(glamo, GLAMO_BASIC_MMC_EN_TCLK_DLYA1, 0x0e00);
++
++ /* kill PLLS 1 then 2 */
++ __reg_write(glamo, GLAMO_REG_DFT_GEN5, 0x0001);
++ __reg_set_bit_mask(glamo, GLAMO_REG_PLL_GEN3, 1 << 13, 1 << 13);
++
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static int glamo_resume(struct device *dev)
++{
++ struct glamo_core *glamo = dev_get_drvdata(dev);
++ int n;
++
++ (glamo->pdata->glamo_external_reset)(0);
++ udelay(10);
++ (glamo->pdata->glamo_external_reset)(1);
++ mdelay(5);
++
++ spin_lock(&glamo->lock);
++
++ glamo_run_script(glamo, glamo_init_script,
++ ARRAY_SIZE(glamo_init_script), 0);
++
++
++ for (n = 0; n < __NUM_GLAMO_ENGINES; n++) {
++ switch (glamo->engine_state[n]) {
++ case GLAMO_ENGINE_SUSPENDED:
++ __glamo_engine_suspend(glamo, n);
++ break;
++ case GLAMO_ENGINE_ENABLED:
++ __glamo_engine_enable(glamo, n);
++ break;
++ default:
++ break;
++ }
++ }
++
++ __reg_write(glamo, GLAMO_REG_IRQ_ENABLE, glamo->saved_irq_mask);
++
++ spin_unlock(&glamo->lock);
++
++ return 0;
++}
++
++static const struct dev_pm_ops glamo_pm_ops = {
++ .suspend = glamo_suspend,
++ .resume = glamo_resume,
++ .poweroff = glamo_suspend,
++ .restore = glamo_resume,
++};
++
++#define GLAMO_PM_OPS (&glamo_pm_ops)
++
++#else
++#define GLAMO_PM_OPS NULL
++#endif
++
++static struct platform_driver glamo_driver = {
++ .probe = glamo_probe,
++ .remove = __devexit_p(glamo_remove),
++ .driver = {
++ .name = "glamo3362",
++ .owner = THIS_MODULE,
++ .pm = GLAMO_PM_OPS,
++ },
++};
++
++static int __devinit glamo_init(void)
++{
++ return platform_driver_register(&glamo_driver);
++}
++module_init(glamo_init);
++
++static void __exit glamo_exit(void)
++{
++ platform_driver_unregister(&glamo_driver);
++}
++module_exit(glamo_exit);
++
++MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
++MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
++MODULE_DESCRIPTION("Smedia Glamo 3362 core/resource driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:glamo3362");
+diff --git a/drivers/mfd/pcf50606-adc.c b/drivers/mfd/pcf50606-adc.c
+new file mode 100644
+index 0000000..9d37c4a
+--- /dev/null
++++ b/drivers/mfd/pcf50606-adc.c
+@@ -0,0 +1,279 @@
++/* Philips PCF50606 ADC Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte, Andy Green, Werner Almesberger and Matt Hsu
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ * NOTE: This driver does not yet support subtractive ADC mode, which means
++ * you can do only one measurement per read request.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/platform_device.h>
++#include <linux/completion.h>
++#include <linux/slab.h>
++
++#include <linux/mfd/pcf50606/core.h>
++#include <linux/mfd/pcf50606/adc.h>
++
++struct pcf50606_adc_request {
++ int mux;
++ int result;
++ void (*callback)(struct pcf50606 *, void *, int);
++ void *callback_param;
++
++ /* Used in case of sync requests */
++ struct completion completion;
++
++};
++
++#define PCF50606_MAX_ADC_FIFO_DEPTH 8
++
++struct pcf50606_adc {
++ struct pcf50606 *pcf;
++
++ /* Private stuff */
++ struct pcf50606_adc_request *queue[PCF50606_MAX_ADC_FIFO_DEPTH];
++ int queue_head;
++ int queue_tail;
++ struct mutex queue_mutex;
++};
++
++static inline struct pcf50606_adc *__to_adc(struct pcf50606 *pcf)
++{
++ return platform_get_drvdata(pcf->adc_pdev);
++}
++
++static void adc_setup(struct pcf50606 *pcf, int channel)
++{
++ channel &= PCF50606_ADCC2_ADCMUX_MASK;
++
++ /* start ADC conversion of selected channel */
++ pcf50606_reg_write(pcf, PCF50606_REG_ADCC2, channel |
++ PCF50606_ADCC2_ADCSTART | PCF50606_ADCC2_RES_10BIT);
++
++}
++
++static void trigger_next_adc_job_if_any(struct pcf50606 *pcf)
++{
++ struct pcf50606_adc *adc = __to_adc(pcf);
++ int head, tail;
++
++ mutex_lock(&adc->queue_mutex);
++
++ head = adc->queue_head;
++ tail = adc->queue_tail;
++
++ if (!adc->queue[head])
++ goto out;
++
++ adc_setup(pcf, adc->queue[head]->mux);
++out:
++ mutex_unlock(&adc->queue_mutex);
++}
++
++static int
++adc_enqueue_request(struct pcf50606 *pcf, struct pcf50606_adc_request *req)
++{
++ struct pcf50606_adc *adc = __to_adc(pcf);
++ int head, tail;
++
++ mutex_lock(&adc->queue_mutex);
++ head = adc->queue_head;
++ tail = adc->queue_tail;
++
++ if (adc->queue[tail]) {
++ mutex_unlock(&adc->queue_mutex);
++ return -EBUSY;
++ }
++
++ adc->queue[tail] = req;
++
++ adc->queue_tail =
++ (tail + 1) & (PCF50606_MAX_ADC_FIFO_DEPTH - 1);
++
++ mutex_unlock(&adc->queue_mutex);
++
++ trigger_next_adc_job_if_any(pcf);
++
++ return 0;
++}
++
++static void
++pcf50606_adc_sync_read_callback(struct pcf50606 *pcf, void *param, int result)
++{
++ struct pcf50606_adc_request *req;
++
++ /*We know here that the passed param is an adc_request object */
++ req = (struct pcf50606_adc_request *)param;
++
++ req->result = result;
++ complete(&req->completion);
++}
++
++int pcf50606_adc_sync_read(struct pcf50606 *pcf, int mux)
++{
++
++ struct pcf50606_adc_request *req;
++ int result;
++
++ /* req is freed when the result is ready, in irq handler*/
++ req = kzalloc(sizeof(*req), GFP_KERNEL);
++ if (!req)
++ return -ENOMEM;
++
++ req->mux = mux;
++ req->callback = pcf50606_adc_sync_read_callback;
++ req->callback_param = req;
++ init_completion(&req->completion);
++
++ adc_enqueue_request(pcf, req);
++
++ if (wait_for_completion_timeout(&req->completion, 5 * HZ) == 5 * HZ) {
++ dev_err(pcf->dev, "ADC read timed out \n");
++ }
++
++ result = req->result;
++
++ return result;
++}
++EXPORT_SYMBOL_GPL(pcf50606_adc_sync_read);
++
++int pcf50606_adc_async_read(struct pcf50606 *pcf, int mux,
++ void (*callback)(struct pcf50606 *, void *, int),
++ void *callback_param)
++{
++ struct pcf50606_adc_request *req;
++
++ /* req is freed when the result is ready, in pcf50606_work*/
++ req = kmalloc(sizeof(*req), GFP_KERNEL);
++ if (!req)
++ return -ENOMEM;
++
++ req->mux = mux;
++ req->callback = callback;
++ req->callback_param = callback_param;
++
++ adc_enqueue_request(pcf, req);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pcf50606_adc_async_read);
++
++static int adc_result(struct pcf50606 *pcf)
++{
++ u16 ret = (pcf50606_reg_read(pcf, PCF50606_REG_ADCS1) << 2) |
++ (pcf50606_reg_read(pcf, PCF50606_REG_ADCS2) & 0x03);
++
++ dev_dbg(pcf->dev, "adc result = %d\n", ret);
++
++ return ret;
++}
++
++static void pcf50606_adc_irq(int irq, void *data)
++{
++ struct pcf50606_adc *adc = data;
++ struct pcf50606 *pcf = adc->pcf;
++ struct pcf50606_adc_request *req;
++ int head;
++
++ mutex_lock(&adc->queue_mutex);
++ head = adc->queue_head;
++
++ req = adc->queue[head];
++ if (WARN_ON(!req)) {
++ dev_err(pcf->dev, "pcf50606-adc irq: ADC queue empty!\n");
++ mutex_unlock(&adc->queue_mutex);
++ return;
++ }
++
++ adc->queue[head] = NULL;
++ adc->queue_head = (head + 1) &
++ (PCF50606_MAX_ADC_FIFO_DEPTH - 1);
++
++ mutex_unlock(&adc->queue_mutex);
++
++ req->callback(pcf, req->callback_param, adc_result(pcf));
++ kfree(req);
++
++ trigger_next_adc_job_if_any(pcf);
++}
++
++static int __devinit pcf50606_adc_probe(struct platform_device *pdev)
++{
++ struct pcf50606_adc *adc;
++
++ adc = kzalloc(sizeof(*adc), GFP_KERNEL);
++ if (!adc)
++ return -ENOMEM;
++
++ adc->pcf = dev_to_pcf50606(pdev->dev.parent);
++ platform_set_drvdata(pdev, adc);
++
++ pcf50606_register_irq(adc->pcf, PCF50606_IRQ_ADCRDY,
++ pcf50606_adc_irq, adc);
++
++ mutex_init(&adc->queue_mutex);
++
++ return 0;
++}
++
++static int __devexit pcf50606_adc_remove(struct platform_device *pdev)
++{
++ struct pcf50606_adc *adc = platform_get_drvdata(pdev);
++ int i, head;
++
++ pcf50606_free_irq(adc->pcf, PCF50606_IRQ_ADCRDY);
++
++ mutex_lock(&adc->queue_mutex);
++ head = adc->queue_head;
++
++ if (WARN_ON(adc->queue[head]))
++ dev_err(adc->pcf->dev,
++ "adc driver removed with request pending\n");
++
++ for (i = 0; i < PCF50606_MAX_ADC_FIFO_DEPTH; i++)
++ kfree(adc->queue[i]);
++
++ mutex_unlock(&adc->queue_mutex);
++ kfree(adc);
++
++ return 0;
++}
++
++struct platform_driver pcf50606_adc_driver = {
++ .driver = {
++ .name = "pcf50606-adc",
++ },
++ .probe = pcf50606_adc_probe,
++ .remove = __devexit_p(pcf50606_adc_remove),
++};
++
++static int __init pcf50606_adc_init(void)
++{
++ return platform_driver_register(&pcf50606_adc_driver);
++}
++module_init(pcf50606_adc_init);
++
++static void __exit pcf50606_adc_exit(void)
++{
++ platform_driver_unregister(&pcf50606_adc_driver);
++}
++module_exit(pcf50606_adc_exit);
++
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
++MODULE_DESCRIPTION("PCF50606 adc driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:pcf50606-adc");
++
+diff --git a/drivers/mfd/pcf50606-core.c b/drivers/mfd/pcf50606-core.c
+new file mode 100644
+index 0000000..4f35acb
+--- /dev/null
++++ b/drivers/mfd/pcf50606-core.c
+@@ -0,0 +1,682 @@
++/* Philips PCF50606 Power Management Unit (PMU) driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
++ * Matt Hsu <matt@openmoko.org>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ *
++ */
++#include <linux/kernel.h>
++#include <linux/device.h>
++#include <linux/sysfs.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/types.h>
++#include <linux/interrupt.h>
++#include <linux/workqueue.h>
++#include <linux/platform_device.h>
++#include <linux/i2c.h>
++#include <linux/irq.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++
++#include <linux/mfd/pcf50606/core.h>
++
++static int __pcf50606_read(struct pcf50606 *pcf, uint8_t reg, int num, uint8_t *data)
++{
++ int ret;
++
++ ret = i2c_smbus_read_i2c_block_data(pcf->i2c_client, reg,
++ num, data);
++ if (ret < 0)
++ dev_err(pcf->dev, "Error reading %d regs at %d\n", num, reg);
++
++ return ret;
++}
++
++static int __pcf50606_write(struct pcf50606 *pcf, uint8_t reg, int num, uint8_t *data)
++{
++ int ret;
++
++ ret = i2c_smbus_write_i2c_block_data(pcf->i2c_client, reg,
++ num, data);
++ if (ret < 0)
++ dev_err(pcf->dev, "Error writing %d regs at %d\n", num, reg);
++
++ return ret;
++
++}
++
++/* Read a block of upto 32 regs */
++int pcf50606_read_block(struct pcf50606 *pcf, uint8_t reg,
++ int nr_regs, uint8_t *data)
++{
++ int ret;
++
++ mutex_lock(&pcf->lock);
++ ret = __pcf50606_read(pcf, reg, nr_regs, data);
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50606_read_block);
++
++/* Write a block of upto 32 regs */
++int pcf50606_write_block(struct pcf50606 *pcf , uint8_t reg,
++ int nr_regs, uint8_t *data)
++{
++ int ret;
++
++ mutex_lock(&pcf->lock);
++ ret = __pcf50606_write(pcf, reg, nr_regs, data);
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50606_write_block);
++
++uint8_t pcf50606_reg_read(struct pcf50606 *pcf, uint8_t reg)
++{
++ uint8_t val;
++
++ mutex_lock(&pcf->lock);
++ __pcf50606_read(pcf, reg, 1, &val);
++ mutex_unlock(&pcf->lock);
++
++ return val;
++}
++EXPORT_SYMBOL_GPL(pcf50606_reg_read);
++
++int pcf50606_reg_write(struct pcf50606 *pcf, uint8_t reg, uint8_t val)
++{
++ int ret;
++
++ mutex_lock(&pcf->lock);
++ ret = __pcf50606_write(pcf, reg, 1, &val);
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50606_reg_write);
++
++int pcf50606_reg_set_bit_mask(struct pcf50606 *pcf, uint8_t reg, uint8_t mask, uint8_t val)
++{
++ int ret;
++ uint8_t tmp;
++
++ val &= mask;
++
++ mutex_lock(&pcf->lock);
++ ret = __pcf50606_read(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ tmp &= ~mask;
++ tmp |= val;
++ ret = __pcf50606_write(pcf, reg, 1, &tmp);
++
++out:
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50606_reg_set_bit_mask);
++
++int pcf50606_reg_clear_bits(struct pcf50606 *pcf, uint8_t reg, uint8_t val)
++{
++ int ret;
++ uint8_t tmp;
++
++ mutex_lock(&pcf->lock);
++ ret = __pcf50606_read(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ tmp &= ~val;
++ ret = __pcf50606_write(pcf, reg, 1, &tmp);
++
++out:
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(pcf50606_reg_clear_bits);
++
++/* sysfs attributes */
++static ssize_t show_dump_regs(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ struct pcf50606 *pcf = dev_get_drvdata(dev);
++ uint8_t dump[16];
++ int n, n1, idx = 0;
++ char *buf1 = buf;
++ static uint8_t address_no_read[] = { /* must be ascending */
++ PCF50606_REG_INT1,
++ PCF50606_REG_INT2,
++ PCF50606_REG_INT3,
++ 0 /* terminator */
++ };
++
++ for (n = 0; n < 256; n += sizeof(dump)) {
++ for (n1 = 0; n1 < sizeof(dump); n1++)
++ if (n == address_no_read[idx]) {
++ idx++;
++ dump[n1] = 0x00;
++ } else
++ dump[n1] = pcf50606_reg_read(pcf, n + n1);
++
++ hex_dump_to_buffer(dump, sizeof(dump), 16, 1, buf1, 128, 0);
++ buf1 += strlen(buf1);
++ *buf1++ = '\n';
++ *buf1 = '\0';
++ }
++
++ return buf1 - buf;
++}
++static DEVICE_ATTR(dump_regs, 0400, show_dump_regs, NULL);
++
++static ssize_t show_resume_reason(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct pcf50606 *pcf = dev_get_drvdata(dev);
++ int n;
++
++ n = sprintf(buf, "%02x%02x%02x\n",
++ pcf->resume_reason[0],
++ pcf->resume_reason[1],
++ pcf->resume_reason[2]);
++
++ return n;
++}
++static DEVICE_ATTR(resume_reason, 0400, show_resume_reason, NULL);
++
++static struct attribute *pcf_sysfs_entries[] = {
++ &dev_attr_dump_regs.attr,
++ &dev_attr_resume_reason.attr,
++ NULL,
++};
++
++static struct attribute_group pcf_attr_group = {
++ .name = NULL, /* put in device directory */
++ .attrs = pcf_sysfs_entries,
++};
++
++int pcf50606_register_irq(struct pcf50606 *pcf, int irq,
++ void (*handler) (int, void *), void *data)
++{
++ if (irq < 0 || irq > PCF50606_NUM_IRQ || !handler)
++ return -EINVAL;
++
++ if (WARN_ON(pcf->irq_handler[irq].handler))
++ return -EBUSY;
++
++ mutex_lock(&pcf->lock);
++ pcf->irq_handler[irq].handler = handler;
++ pcf->irq_handler[irq].data = data;
++ mutex_unlock(&pcf->lock);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pcf50606_register_irq);
++
++int pcf50606_free_irq(struct pcf50606 *pcf, int irq)
++{
++ if (irq < 0 || irq > PCF50606_NUM_IRQ)
++ return -EINVAL;
++
++ mutex_lock(&pcf->lock);
++ pcf->irq_handler[irq].handler = NULL;
++ mutex_unlock(&pcf->lock);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pcf50606_free_irq);
++
++static int __pcf50606_irq_mask_set(struct pcf50606 *pcf, int irq, uint8_t mask)
++{
++ uint8_t reg, bits, tmp;
++ int ret = 0, idx;
++
++ idx = irq >> 3;
++ reg = PCF50606_REG_INT1M + idx;
++ bits = 1 << (irq & 0x07);
++
++ mutex_lock(&pcf->lock);
++
++ if (mask) {
++ ret = __pcf50606_read(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ tmp |= bits;
++
++ ret = __pcf50606_write(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ pcf->mask_regs[idx] &= ~bits;
++ pcf->mask_regs[idx] |= bits;
++ } else {
++ ret = __pcf50606_read(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ tmp &= ~bits;
++
++ ret = __pcf50606_write(pcf, reg, 1, &tmp);
++ if (ret < 0)
++ goto out;
++
++ pcf->mask_regs[idx] &= ~bits;
++ }
++out:
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++
++int pcf50606_irq_mask(struct pcf50606 *pcf, int irq)
++{
++ dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
++
++ return __pcf50606_irq_mask_set(pcf, irq, 1);
++}
++EXPORT_SYMBOL_GPL(pcf50606_irq_mask);
++
++int pcf50606_irq_unmask(struct pcf50606 *pcf, int irq)
++{
++ dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
++
++ return __pcf50606_irq_mask_set(pcf, irq, 0);
++}
++EXPORT_SYMBOL_GPL(pcf50606_irq_unmask);
++
++int pcf50606_irq_mask_get(struct pcf50606 *pcf, int irq)
++{
++ uint8_t reg, bits;
++
++ reg = (irq / 8);
++ bits = (1 << (irq % 8));
++
++ return pcf->mask_regs[reg] & bits;
++}
++EXPORT_SYMBOL_GPL(pcf50606_irq_mask_get);
++
++static void pcf50606_irq_call_handler(struct pcf50606 *pcf,
++ int irq)
++{
++ if (pcf->irq_handler[irq].handler)
++ pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
++}
++
++#define PCF50606_ONKEY1S_TIMEOUT 8
++
++#define PCF50606_REG_MBCS1 0x2c
++
++static void pcf50606_irq_worker(struct work_struct *work)
++{
++ int ret;
++ struct pcf50606 *pcf;
++ uint8_t pcf_int[3], charger_status;
++ size_t i, j;
++
++ pcf = container_of(work, struct pcf50606, irq_work);
++
++ /* Read the 3 INT regs in one transaction */
++ ret = pcf50606_read_block(pcf, PCF50606_REG_INT1,
++ ARRAY_SIZE(pcf_int), pcf_int);
++ if (ret != ARRAY_SIZE(pcf_int)) {
++ dev_err(pcf->dev, "Error reading INT registers\n");
++
++ /*
++ * If this doesn't ACK the interrupt to the chip, we'll be
++ * called once again as we're level triggered.
++ */
++ goto out;
++ }
++
++ /* We immediately read the charger status. We thus make sure
++ * only one of CHGINS/CHGRM interrupt handlers are called */
++ if (pcf_int[1] & (PCF50606_INT2_CHGINS | PCF50606_INT2_CHGRM)) {
++ charger_status = pcf50606_reg_read(pcf, PCF50606_REG_MBCS1);
++ if (charger_status & (0x1 << 4))
++ pcf_int[1] &= ~PCF50606_INT2_CHGRM;
++ else
++ pcf_int[1] &= ~PCF50606_INT2_CHGINS;
++ }
++
++ dev_dbg(pcf->dev, "INT1=0x%02x INT2=0x%02x INT3=0x%02x\n",
++ pcf_int[0], pcf_int[1], pcf_int[2]);
++
++ /* Some revisions of the chip don't have a 8s standby mode on
++ * ONKEY1S press. We try to manually do it in such cases. */
++ if (pcf_int[0] & PCF50606_INT1_SECOND && pcf->onkey1s_held) {
++ dev_info(pcf->dev, "ONKEY1S held for %d secs\n",
++ pcf->onkey1s_held);
++ if (pcf->onkey1s_held++ == PCF50606_ONKEY1S_TIMEOUT)
++ if (pcf->pdata->force_shutdown)
++ pcf->pdata->force_shutdown(pcf);
++ }
++
++ if (pcf_int[0] & PCF50606_INT1_ONKEY1S) {
++ dev_info(pcf->dev, "ONKEY1S held\n");
++ pcf->onkey1s_held = 1 ;
++
++ /* Unmask IRQ_SECOND */
++ pcf50606_reg_clear_bits(pcf, PCF50606_REG_INT1M,
++ PCF50606_INT1_SECOND);
++
++ /* Unmask IRQ_ONKEYF */
++ pcf50606_reg_clear_bits(pcf, PCF50606_REG_INT1M,
++ PCF50606_INT1_ONKEYF);
++ }
++
++ if ((pcf_int[0] & PCF50606_INT1_ONKEYR) && pcf->onkey1s_held) {
++ pcf->onkey1s_held = 0;
++
++ /* Mask SECOND and ONKEYF interrupts */
++ if (pcf->mask_regs[0] & PCF50606_INT1_SECOND)
++ pcf50606_reg_set_bit_mask(pcf,
++ PCF50606_REG_INT1M,
++ PCF50606_INT1_SECOND,
++ PCF50606_INT1_SECOND);
++
++ if (pcf->mask_regs[0] & PCF50606_INT1_ONKEYF)
++ pcf50606_reg_set_bit_mask(pcf,
++ PCF50606_REG_INT1M,
++ PCF50606_INT1_ONKEYF,
++ PCF50606_INT1_ONKEYF);
++ }
++
++ /* Have we just resumed ? */
++ if (pcf->is_suspended) {
++
++ pcf->is_suspended = 0;
++
++ /* Set the resume reason filtering out non resumers */
++ for (i = 0; i < ARRAY_SIZE(pcf_int); i++)
++ pcf->resume_reason[i] = pcf_int[i] &
++ pcf->pdata->resumers[i];
++
++ /* Make sure we don't pass on ONKEY events to
++ * userspace now */
++ pcf_int[1] &= ~(PCF50606_INT1_ONKEYR | PCF50606_INT1_ONKEYF);
++ }
++
++ for (i = 0; i < ARRAY_SIZE(pcf_int); i++) {
++ /* Unset masked interrupts */
++ pcf_int[i] &= ~pcf->mask_regs[i];
++
++ for (j = 0; j < 8 ; j++)
++ if (pcf_int[i] & (1 << j))
++ pcf50606_irq_call_handler(pcf, (i * 8) + j);
++ }
++
++out:
++ put_device(pcf->dev);
++ enable_irq(pcf->irq);
++}
++
++static irqreturn_t pcf50606_irq(int irq, void *data)
++{
++ struct pcf50606 *pcf = data;
++
++ get_device(pcf->dev);
++ disable_irq_nosync(pcf->irq);
++ schedule_work(&pcf->irq_work);
++
++ return IRQ_HANDLED;
++}
++
++static void
++pcf50606_client_dev_register(struct pcf50606 *pcf, const char *name,
++ struct platform_device **pdev)
++{
++ int ret;
++
++ *pdev = platform_device_alloc(name, -1);
++ if (!*pdev) {
++ dev_err(pcf->dev, "Falied to allocate %s\n", name);
++ return;
++ }
++
++ (*pdev)->dev.parent = pcf->dev;
++
++ ret = platform_device_add(*pdev);
++ if (ret) {
++ dev_err(pcf->dev, "Failed to register %s: %d\n", name, ret);
++ platform_device_put(*pdev);
++ *pdev = NULL;
++ }
++}
++
++#ifdef CONFIG_PM
++static int pcf50606_suspend(struct i2c_client *client, pm_message_t state)
++{
++ int ret;
++ struct pcf50606 *pcf;
++ size_t i;
++ uint8_t res[3];
++
++ pcf = i2c_get_clientdata(client);
++
++ /* Make sure our interrupt handlers are not called
++ * henceforth */
++ disable_irq(pcf->irq);
++
++ /* Make sure that any running IRQ worker has quit */
++ cancel_work_sync(&pcf->irq_work);
++
++ /* Save the masks */
++ ret = pcf50606_read_block(pcf, PCF50606_REG_INT1M,
++ ARRAY_SIZE(pcf->suspend_irq_masks),
++ pcf->suspend_irq_masks);
++ if (ret < 0) {
++ dev_err(pcf->dev, "error saving irq masks\n");
++ goto out;
++ }
++
++ /* Write wakeup irq masks */
++ for (i = 0; i < ARRAY_SIZE(res); i++)
++ res[i] = ~pcf->pdata->resumers[i];
++
++ ret = pcf50606_write_block(pcf, PCF50606_REG_INT1M,
++ ARRAY_SIZE(res), &res[0]);
++ if (ret < 0) {
++ dev_err(pcf->dev, "error writing wakeup irq masks\n");
++ goto out;
++ }
++
++ pcf->is_suspended = 1;
++
++out:
++ return ret;
++}
++
++static int pcf50606_resume(struct i2c_client *client)
++{
++ struct pcf50606 *pcf;
++ int ret;
++
++ pcf = i2c_get_clientdata(client);
++
++ /* Write the saved mask registers */
++ ret = pcf50606_write_block(pcf, PCF50606_REG_INT1M,
++ ARRAY_SIZE(pcf->suspend_irq_masks),
++ pcf->suspend_irq_masks);
++ if (ret < 0)
++ dev_err(pcf->dev, "Error restoring saved suspend masks\n");
++
++ get_device(pcf->dev);
++
++ /*
++ * Clear any pending interrupts and set resume reason if any.
++ * This will leave with enable_irq()
++ */
++ pcf50606_irq_worker(&pcf->irq_work);
++
++ return 0;
++}
++#else
++#define pcf50606_suspend NULL
++#define pcf50606_resume NULL
++#endif
++
++static int pcf50606_probe(struct i2c_client *client,
++ const struct i2c_device_id *ids)
++{
++ int ret;
++ struct pcf50606 *pcf;
++ struct pcf50606_platform_data *pdata = client->dev.platform_data;
++ int i;
++ uint8_t version, variant;
++
++ if (!client->irq) {
++ dev_err(&client->dev, "Missing IRQ\n");
++ return -ENOENT;
++ }
++
++ pcf = kzalloc(sizeof(*pcf), GFP_KERNEL);
++ if (!pcf)
++ return -ENOMEM;
++
++ pcf->pdata = pdata;
++
++ mutex_init(&pcf->lock);
++
++ i2c_set_clientdata(client, pcf);
++ pcf->dev = &client->dev;
++ pcf->i2c_client = client;
++ pcf->irq = client->irq;
++
++ INIT_WORK(&pcf->irq_work, pcf50606_irq_worker);
++
++ version = pcf50606_reg_read(pcf, 0);
++ variant = pcf50606_reg_read(pcf, 1);
++
++ /* This test is always false, FIX it */
++ if (version < 0 || variant < 0) {
++ dev_err(pcf->dev, "Unable to probe pcf50606\n");
++ ret = -ENODEV;
++ goto err;
++ }
++
++ dev_info(pcf->dev, "Probed device version %d variant %d\n",
++ version, variant);
++ /* Enable all inteerupts except RTC SECOND */
++ pcf->mask_regs[0] = 0x40;
++ pcf50606_reg_write(pcf, PCF50606_REG_INT1M, pcf->mask_regs[0]);
++ pcf50606_reg_write(pcf, PCF50606_REG_INT2M, 0x00);
++ pcf50606_reg_write(pcf, PCF50606_REG_INT3M, 0x00);
++
++ ret = request_irq(client->irq, pcf50606_irq,
++ IRQF_TRIGGER_LOW, "pcf50606", pcf);
++
++ if (ret) {
++ dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
++ goto err;
++ }
++
++ pcf50606_client_dev_register(pcf, "pcf50606-input",
++ &pcf->input_pdev);
++ pcf50606_client_dev_register(pcf, "pcf50606-rtc",
++ &pcf->rtc_pdev);
++ pcf50606_client_dev_register(pcf, "pcf50606-mbc",
++ &pcf->mbc_pdev);
++ pcf50606_client_dev_register(pcf, "pcf50606-adc",
++ &pcf->adc_pdev);
++ pcf50606_client_dev_register(pcf, "pcf50606-wdt",
++ &pcf->wdt_pdev);
++ for (i = 0; i < PCF50606_NUM_REGULATORS; i++) {
++ struct platform_device *pdev;
++
++ pdev = platform_device_alloc("pcf50606-regltr", i);
++ if (!pdev) {
++ dev_err(pcf->dev, "Cannot create regulator %d\n", i);
++ continue;
++ }
++
++ pdev->dev.parent = pcf->dev;
++ platform_device_add_data(pdev, &pdata->reg_init_data[i],
++ sizeof(pdata->reg_init_data[i]));
++ pcf->regulator_pdev[i] = pdev;
++
++ platform_device_add(pdev);
++ }
++
++ if (enable_irq_wake(client->irq) < 0)
++ dev_info(pcf->dev, "IRQ %u cannot be enabled as wake-up source"
++ "in this hardware revision\n", client->irq);
++
++ ret = sysfs_create_group(&client->dev.kobj, &pcf_attr_group);
++ if (ret)
++ dev_info(pcf->dev, "error creating sysfs entries\n");
++
++ if (pdata->probe_done)
++ pdata->probe_done(pcf);
++
++ return 0;
++
++err:
++ i2c_set_clientdata(client, NULL);
++ kfree(pcf);
++ return ret;
++}
++
++static int pcf50606_remove(struct i2c_client *client)
++{
++ struct pcf50606 *pcf = i2c_get_clientdata(client);
++ unsigned int i;
++
++ free_irq(pcf->irq, pcf);
++
++ platform_device_unregister(pcf->input_pdev);
++ platform_device_unregister(pcf->rtc_pdev);
++ platform_device_unregister(pcf->mbc_pdev);
++ platform_device_unregister(pcf->adc_pdev);
++
++ for (i = 0; i < PCF50606_NUM_REGULATORS; i++)
++ platform_device_unregister(pcf->regulator_pdev[i]);
++
++ i2c_set_clientdata(client, NULL);
++ kfree(pcf);
++
++ return 0;
++}
++
++static struct i2c_device_id pcf50606_id_table[] = {
++ {"pcf50606", 0x08},
++};
++
++static struct i2c_driver pcf50606_driver = {
++ .driver = {
++ .name = "pcf50606",
++ },
++ .id_table = pcf50606_id_table,
++ .probe = pcf50606_probe,
++ .remove = pcf50606_remove,
++ .suspend = pcf50606_suspend,
++ .resume = pcf50606_resume,
++};
++
++static int __init pcf50606_init(void)
++{
++ return i2c_add_driver(&pcf50606_driver);
++}
++module_init(pcf50606_init);
++
++static void pcf50606_exit(void)
++{
++ i2c_del_driver(&pcf50606_driver);
++}
++module_exit(pcf50606_exit);
++
++MODULE_DESCRIPTION("I2C chip driver for NXP PCF50606 PMU");
++MODULE_AUTHOR("Harald Welte <laforge@openmoko.org>");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
+index fe8f922..bf77c8f 100644
+--- a/drivers/mfd/pcf50633-adc.c
++++ b/drivers/mfd/pcf50633-adc.c
+@@ -30,13 +30,13 @@
+ struct pcf50633_adc_request {
+ int mux;
+ int avg;
+- int result;
+ void (*callback)(struct pcf50633 *, void *, int);
+ void *callback_param;
++};
+
+- /* Used in case of sync requests */
++struct pcf50633_adc_sync_request {
++ int result;
+ struct completion completion;
+-
+ };
+
+ #define PCF50633_MAX_ADC_FIFO_DEPTH 8
+@@ -51,11 +51,6 @@ struct pcf50633_adc {
+ struct mutex queue_mutex;
+ };
+
+-static inline struct pcf50633_adc *__to_adc(struct pcf50633 *pcf)
+-{
+- return platform_get_drvdata(pcf->adc_pdev);
+-}
+-
+ static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
+ {
+ channel &= PCF50633_ADCC1_ADCMUX_MASK;
+@@ -71,7 +66,7 @@ static void adc_setup(struct pcf50633 *pcf, int channel, int avg)
+
+ static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
+ {
+- struct pcf50633_adc *adc = __to_adc(pcf);
++ struct pcf50633_adc *adc = pcf->adc;
+ int head;
+
+ head = adc->queue_head;
+@@ -85,7 +80,7 @@ static void trigger_next_adc_job_if_any(struct pcf50633 *pcf)
+ static int
+ adc_enqueue_request(struct pcf50633 *pcf, struct pcf50633_adc_request *req)
+ {
+- struct pcf50633_adc *adc = __to_adc(pcf);
++ struct pcf50633_adc *adc = pcf->adc;
+ int head, tail;
+
+ mutex_lock(&adc->queue_mutex);
+@@ -109,10 +104,10 @@ adc_enqueue_request(struct pcf50633 *pcf, struct pcf50633_adc_request *req)
+ return 0;
+ }
+
+-static void
+-pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param, int result)
++static void pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param,
++ int result)
+ {
+- struct pcf50633_adc_request *req = param;
++ struct pcf50633_adc_sync_request *req = param;
+
+ req->result = result;
+ complete(&req->completion);
+@@ -120,28 +115,19 @@ pcf50633_adc_sync_read_callback(struct pcf50633 *pcf, void *param, int result)
+
+ int pcf50633_adc_sync_read(struct pcf50633 *pcf, int mux, int avg)
+ {
+- struct pcf50633_adc_request *req;
+- int err;
++ struct pcf50633_adc_sync_request req;
++ int ret;
+
+- /* req is freed when the result is ready, in interrupt handler */
+- req = kzalloc(sizeof(*req), GFP_KERNEL);
+- if (!req)
+- return -ENOMEM;
+-
+- req->mux = mux;
+- req->avg = avg;
+- req->callback = pcf50633_adc_sync_read_callback;
+- req->callback_param = req;
++ init_completion(&req.completion);
+
+- init_completion(&req->completion);
+- err = adc_enqueue_request(pcf, req);
+- if (err)
+- return err;
++ ret = pcf50633_adc_async_read(pcf, mux, avg,
++ pcf50633_adc_sync_read_callback, &req);
++ if (ret)
++ return ret;
+
+- wait_for_completion(&req->completion);
++ wait_for_completion(&req.completion);
+
+- /* FIXME by this time req might be already freed */
+- return req->result;
++ return req.result;
+ }
+ EXPORT_SYMBOL_GPL(pcf50633_adc_sync_read);
+
+@@ -210,13 +196,14 @@ static void pcf50633_adc_irq(int irq, void *data)
+
+ static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
+ {
++ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
+ struct pcf50633_adc *adc;
+
+ adc = kzalloc(sizeof(*adc), GFP_KERNEL);
+ if (!adc)
+ return -ENOMEM;
+
+- adc->pcf = dev_to_pcf50633(pdev->dev.parent);
++ adc->pcf = pcf;
+ platform_set_drvdata(pdev, adc);
+
+ pcf50633_register_irq(adc->pcf, PCF50633_IRQ_ADCRDY,
+@@ -224,6 +211,8 @@ static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
+
+ mutex_init(&adc->queue_mutex);
+
++ pcf->adc = adc;
++
+ return 0;
+ }
+
+@@ -232,6 +221,8 @@ static int __devexit pcf50633_adc_remove(struct platform_device *pdev)
+ struct pcf50633_adc *adc = platform_get_drvdata(pdev);
+ int i, head;
+
++ adc->pcf->adc = NULL;
++
+ pcf50633_free_irq(adc->pcf, PCF50633_IRQ_ADCRDY);
+
+ mutex_lock(&adc->queue_mutex);
+diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
+index 63a614d..aa906ff 100644
+--- a/drivers/mfd/pcf50633-core.c
++++ b/drivers/mfd/pcf50633-core.c
+@@ -21,16 +21,18 @@
+ #include <linux/workqueue.h>
+ #include <linux/platform_device.h>
+ #include <linux/i2c.h>
+-#include <linux/irq.h>
+ #include <linux/slab.h>
+
++#include <linux/mfd/core.h>
++
+ #include <linux/mfd/pcf50633/core.h>
+
+-/* Two MBCS registers used during cold start */
+-#define PCF50633_REG_MBCS1 0x4b
+-#define PCF50633_REG_MBCS2 0x4c
+-#define PCF50633_MBCS1_USBPRES 0x01
+-#define PCF50633_MBCS1_ADAPTPRES 0x01
++int pcf50633_irq_init(struct pcf50633 *pcf, int irq);
++void pcf50633_irq_free(struct pcf50633 *pcf);
++#ifdef CONFIG_PM
++int pcf50633_irq_suspend(struct pcf50633 *pcf);
++int pcf50633_irq_resume(struct pcf50633 *pcf);
++#endif
+
+ static int __pcf50633_read(struct pcf50633 *pcf, u8 reg, int num, u8 *data)
+ {
+@@ -215,346 +217,70 @@ static struct attribute_group pcf_attr_group = {
+ .attrs = pcf_sysfs_entries,
+ };
+
+-int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
+- void (*handler) (int, void *), void *data)
+-{
+- if (irq < 0 || irq > PCF50633_NUM_IRQ || !handler)
+- return -EINVAL;
+-
+- if (WARN_ON(pcf->irq_handler[irq].handler))
+- return -EBUSY;
+-
+- mutex_lock(&pcf->lock);
+- pcf->irq_handler[irq].handler = handler;
+- pcf->irq_handler[irq].data = data;
+- mutex_unlock(&pcf->lock);
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_register_irq);
+-
+-int pcf50633_free_irq(struct pcf50633 *pcf, int irq)
+-{
+- if (irq < 0 || irq > PCF50633_NUM_IRQ)
+- return -EINVAL;
+-
+- mutex_lock(&pcf->lock);
+- pcf->irq_handler[irq].handler = NULL;
+- mutex_unlock(&pcf->lock);
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_free_irq);
+-
+-static int __pcf50633_irq_mask_set(struct pcf50633 *pcf, int irq, u8 mask)
+-{
+- u8 reg, bits, tmp;
+- int ret = 0, idx;
+-
+- idx = irq >> 3;
+- reg = PCF50633_REG_INT1M + idx;
+- bits = 1 << (irq & 0x07);
+-
+- mutex_lock(&pcf->lock);
+-
+- if (mask) {
+- ret = __pcf50633_read(pcf, reg, 1, &tmp);
+- if (ret < 0)
+- goto out;
+-
+- tmp |= bits;
+-
+- ret = __pcf50633_write(pcf, reg, 1, &tmp);
+- if (ret < 0)
+- goto out;
+-
+- pcf->mask_regs[idx] &= ~bits;
+- pcf->mask_regs[idx] |= bits;
+- } else {
+- ret = __pcf50633_read(pcf, reg, 1, &tmp);
+- if (ret < 0)
+- goto out;
+-
+- tmp &= ~bits;
+-
+- ret = __pcf50633_write(pcf, reg, 1, &tmp);
+- if (ret < 0)
+- goto out;
+-
+- pcf->mask_regs[idx] &= ~bits;
+- }
+-out:
+- mutex_unlock(&pcf->lock);
+-
+- return ret;
+-}
+-
+-int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
+-{
+- dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
+-
+- return __pcf50633_irq_mask_set(pcf, irq, 1);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
+-
+-int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
+-{
+- dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
+-
+- return __pcf50633_irq_mask_set(pcf, irq, 0);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_irq_unmask);
+-
+-int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq)
+-{
+- u8 reg, bits;
+-
+- reg = irq >> 3;
+- bits = 1 << (irq & 0x07);
+-
+- return pcf->mask_regs[reg] & bits;
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_irq_mask_get);
+-
+-static void pcf50633_irq_call_handler(struct pcf50633 *pcf, int irq)
+-{
+- if (pcf->irq_handler[irq].handler)
+- pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
+-}
+-
+-/* Maximum amount of time ONKEY is held before emergency action is taken */
+-#define PCF50633_ONKEY1S_TIMEOUT 8
+-
+-static void pcf50633_irq_worker(struct work_struct *work)
+-{
+- struct pcf50633 *pcf;
+- int ret, i, j;
+- u8 pcf_int[5], chgstat;
+-
+- pcf = container_of(work, struct pcf50633, irq_work);
+-
+- /* Read the 5 INT regs in one transaction */
+- ret = pcf50633_read_block(pcf, PCF50633_REG_INT1,
+- ARRAY_SIZE(pcf_int), pcf_int);
+- if (ret != ARRAY_SIZE(pcf_int)) {
+- dev_err(pcf->dev, "Error reading INT registers\n");
+-
+- /*
+- * If this doesn't ACK the interrupt to the chip, we'll be
+- * called once again as we're level triggered.
+- */
+- goto out;
+- }
+-
+- /* defeat 8s death from lowsys on A5 */
+- pcf50633_reg_write(pcf, PCF50633_REG_OOCSHDWN, 0x04);
+-
+- /* We immediately read the usb and adapter status. We thus make sure
+- * only of USBINS/USBREM IRQ handlers are called */
+- if (pcf_int[0] & (PCF50633_INT1_USBINS | PCF50633_INT1_USBREM)) {
+- chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
+- if (chgstat & (0x3 << 4))
+- pcf_int[0] &= ~(1 << PCF50633_INT1_USBREM);
+- else
+- pcf_int[0] &= ~(1 << PCF50633_INT1_USBINS);
+- }
+-
+- /* Make sure only one of ADPINS or ADPREM is set */
+- if (pcf_int[0] & (PCF50633_INT1_ADPINS | PCF50633_INT1_ADPREM)) {
+- chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
+- if (chgstat & (0x3 << 4))
+- pcf_int[0] &= ~(1 << PCF50633_INT1_ADPREM);
+- else
+- pcf_int[0] &= ~(1 << PCF50633_INT1_ADPINS);
+- }
+-
+- dev_dbg(pcf->dev, "INT1=0x%02x INT2=0x%02x INT3=0x%02x "
+- "INT4=0x%02x INT5=0x%02x\n", pcf_int[0],
+- pcf_int[1], pcf_int[2], pcf_int[3], pcf_int[4]);
+-
+- /* Some revisions of the chip don't have a 8s standby mode on
+- * ONKEY1S press. We try to manually do it in such cases. */
- if ((pcf_int[0] & PCF50633_INT1_SECOND) && pcf->onkey1s_held) {
- dev_info(pcf->dev, "ONKEY1S held for %d secs\n",
- pcf->onkey1s_held);
kfree(pcf);
-@@ -689,12 +357,11 @@ static struct i2c_device_id pcf50633_id_table[] = {
- static struct i2c_driver pcf50633_driver = {
- .driver = {
- .name = "pcf50633",
-+ .pm = PCF50633_PM_OPS,
- },
- .id_table = pcf50633_id_table,
- .probe = pcf50633_probe,
- .remove = __devexit_p(pcf50633_remove),
-- .suspend = pcf50633_suspend,
-- .resume = pcf50633_resume,
- };
+@@ -689,12 +357,11 @@ static struct i2c_device_id pcf50633_id_table[] = {
+ static struct i2c_driver pcf50633_driver = {
+ .driver = {
+ .name = "pcf50633",
++ .pm = PCF50633_PM_OPS,
+ },
+ .id_table = pcf50633_id_table,
+ .probe = pcf50633_probe,
+ .remove = __devexit_p(pcf50633_remove),
+- .suspend = pcf50633_suspend,
+- .resume = pcf50633_resume,
+ };
+
+ static int __init pcf50633_init(void)
+diff --git a/drivers/mfd/pcf50633-gpio.c b/drivers/mfd/pcf50633-gpio.c
+deleted file mode 100644
+index 9ab19a8..0000000
+--- a/drivers/mfd/pcf50633-gpio.c
++++ /dev/null
+@@ -1,121 +0,0 @@
+-/* NXP PCF50633 GPIO Driver
+- *
+- * (C) 2006-2008 by Openmoko, Inc.
+- * Author: Balaji Rao <balajirrao@openmoko.org>
+- * All rights reserved.
+- *
+- * Broken down from monstrous PCF50633 driver mainly by
+- * Harald Welte, Andy Green and Werner Almesberger
+- *
+- * This program is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License as published by the
+- * Free Software Foundation; either version 2 of the License, or (at your
+- * option) any later version.
+- *
+- */
+-
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-#include <linux/mfd/pcf50633/core.h>
+-#include <linux/mfd/pcf50633/gpio.h>
+-
+-enum pcf50633_regulator_id {
+- PCF50633_REGULATOR_AUTO,
+- PCF50633_REGULATOR_DOWN1,
+- PCF50633_REGULATOR_DOWN2,
+- PCF50633_REGULATOR_LDO1,
+- PCF50633_REGULATOR_LDO2,
+- PCF50633_REGULATOR_LDO3,
+- PCF50633_REGULATOR_LDO4,
+- PCF50633_REGULATOR_LDO5,
+- PCF50633_REGULATOR_LDO6,
+- PCF50633_REGULATOR_HCLDO,
+- PCF50633_REGULATOR_MEMLDO,
+-};
+-
+-#define PCF50633_REG_AUTOOUT 0x1a
+-#define PCF50633_REG_DOWN1OUT 0x1e
+-#define PCF50633_REG_DOWN2OUT 0x22
+-#define PCF50633_REG_MEMLDOOUT 0x26
+-#define PCF50633_REG_LDO1OUT 0x2d
+-#define PCF50633_REG_LDO2OUT 0x2f
+-#define PCF50633_REG_LDO3OUT 0x31
+-#define PCF50633_REG_LDO4OUT 0x33
+-#define PCF50633_REG_LDO5OUT 0x35
+-#define PCF50633_REG_LDO6OUT 0x37
+-#define PCF50633_REG_HCLDOOUT 0x39
+-
+-static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
+- [PCF50633_REGULATOR_AUTO] = PCF50633_REG_AUTOOUT,
+- [PCF50633_REGULATOR_DOWN1] = PCF50633_REG_DOWN1OUT,
+- [PCF50633_REGULATOR_DOWN2] = PCF50633_REG_DOWN2OUT,
+- [PCF50633_REGULATOR_MEMLDO] = PCF50633_REG_MEMLDOOUT,
+- [PCF50633_REGULATOR_LDO1] = PCF50633_REG_LDO1OUT,
+- [PCF50633_REGULATOR_LDO2] = PCF50633_REG_LDO2OUT,
+- [PCF50633_REGULATOR_LDO3] = PCF50633_REG_LDO3OUT,
+- [PCF50633_REGULATOR_LDO4] = PCF50633_REG_LDO4OUT,
+- [PCF50633_REGULATOR_LDO5] = PCF50633_REG_LDO5OUT,
+- [PCF50633_REGULATOR_LDO6] = PCF50633_REG_LDO6OUT,
+- [PCF50633_REGULATOR_HCLDO] = PCF50633_REG_HCLDOOUT,
+-};
+-
+-int pcf50633_gpio_set(struct pcf50633 *pcf, int gpio, u8 val)
+-{
+- u8 reg;
+-
+- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
+-
+- return pcf50633_reg_set_bit_mask(pcf, reg, 0x07, val);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_gpio_set);
+-
+-u8 pcf50633_gpio_get(struct pcf50633 *pcf, int gpio)
+-{
+- u8 reg, val;
+-
+- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
+- val = pcf50633_reg_read(pcf, reg) & 0x07;
+-
+- return val;
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_gpio_get);
+-
+-int pcf50633_gpio_invert_set(struct pcf50633 *pcf, int gpio, int invert)
+-{
+- u8 val, reg;
+-
+- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
+- val = !!invert << 3;
+-
+- return pcf50633_reg_set_bit_mask(pcf, reg, 1 << 3, val);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_set);
+-
+-int pcf50633_gpio_invert_get(struct pcf50633 *pcf, int gpio)
+-{
+- u8 reg, val;
+-
+- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
+- val = pcf50633_reg_read(pcf, reg);
+-
+- return val & (1 << 3);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_get);
+-
+-int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
+- int gpio, int regulator, int on)
+-{
+- u8 reg, val, mask;
+-
+- /* the *ENA register is always one after the *OUT register */
+- reg = pcf50633_regulator_registers[regulator] + 1;
+-
+- val = !!on << (gpio - PCF50633_GPIO1);
+- mask = 1 << (gpio - PCF50633_GPIO1);
+-
+- return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
+-}
+-EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
+-
+-MODULE_LICENSE("GPL");
+diff --git a/drivers/mfd/pcf50633-irq.c b/drivers/mfd/pcf50633-irq.c
+new file mode 100644
+index 0000000..c1923cf
+--- /dev/null
++++ b/drivers/mfd/pcf50633-irq.c
+@@ -0,0 +1,319 @@
++/* NXP PCF50633 Power Management Unit (PMU) driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Harald Welte <laforge@openmoko.org>
++ * Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/interrupt.h>
++#include <linux/kernel.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++
++#include <linux/mfd/pcf50633/core.h>
++
++/* Two MBCS registers used during cold start */
++#define PCF50633_REG_MBCS1 0x4b
++#define PCF50633_REG_MBCS2 0x4c
++#define PCF50633_MBCS1_USBPRES 0x01
++#define PCF50633_MBCS1_ADAPTPRES 0x01
++
++int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
++ void (*handler) (int, void *), void *data)
++{
++ if (irq < 0 || irq > PCF50633_NUM_IRQ || !handler)
++ return -EINVAL;
++
++ if (WARN_ON(pcf->irq_handler[irq].handler))
++ return -EBUSY;
++
++ mutex_lock(&pcf->lock);
++ pcf->irq_handler[irq].handler = handler;
++ pcf->irq_handler[irq].data = data;
++ mutex_unlock(&pcf->lock);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pcf50633_register_irq);
++
++int pcf50633_free_irq(struct pcf50633 *pcf, int irq)
++{
++ if (irq < 0 || irq > PCF50633_NUM_IRQ)
++ return -EINVAL;
++
++ mutex_lock(&pcf->lock);
++ pcf->irq_handler[irq].handler = NULL;
++ mutex_unlock(&pcf->lock);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pcf50633_free_irq);
++
++static int __pcf50633_irq_mask_set(struct pcf50633 *pcf, int irq, u8 mask)
++{
++ u8 reg, bit;
++ int ret = 0, idx;
++
++ idx = irq >> 3;
++ reg = PCF50633_REG_INT1M + idx;
++ bit = 1 << (irq & 0x07);
++
++ pcf50633_reg_set_bit_mask(pcf, reg, bit, mask ? bit : 0);
++
++ mutex_lock(&pcf->lock);
++
++ if (mask)
++ pcf->mask_regs[idx] |= bit;
++ else
++ pcf->mask_regs[idx] &= ~bit;
++
++ mutex_unlock(&pcf->lock);
++
++ return ret;
++}
++
++int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
++{
++ dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
++
++ return __pcf50633_irq_mask_set(pcf, irq, 1);
++}
++EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
++
++int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
++{
++ dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
++
++ return __pcf50633_irq_mask_set(pcf, irq, 0);
++}
++EXPORT_SYMBOL_GPL(pcf50633_irq_unmask);
++
++int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq)
++{
++ u8 reg, bits;
++
++ reg = irq >> 3;
++ bits = 1 << (irq & 0x07);
++
++ return pcf->mask_regs[reg] & bits;
++}
++EXPORT_SYMBOL_GPL(pcf50633_irq_mask_get);
++
++static void pcf50633_irq_call_handler(struct pcf50633 *pcf, int irq)
++{
++ if (pcf->irq_handler[irq].handler)
++ pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
++}
++
++/* Maximum amount of time ONKEY is held before emergency action is taken */
++#define PCF50633_ONKEY1S_TIMEOUT 8
++
++static irqreturn_t pcf50633_irq(int irq, void *data)
++{
++ struct pcf50633 *pcf = data;
++ int ret, i, j;
++ u8 pcf_int[5], chgstat;
++
++ /* Read the 5 INT regs in one transaction */
++ ret = pcf50633_read_block(pcf, PCF50633_REG_INT1,
++ ARRAY_SIZE(pcf_int), pcf_int);
++ if (ret != ARRAY_SIZE(pcf_int)) {
++ dev_err(pcf->dev, "Error reading INT registers\n");
++
++ /*
++ * If this doesn't ACK the interrupt to the chip, we'll be
++ * called once again as we're level triggered.
++ */
++ goto out;
++ }
++
++ /* defeat 8s death from lowsys on A5 */
++ pcf50633_reg_write(pcf, PCF50633_REG_OOCSHDWN, 0x04);
++
++ /* We immediately read the usb and adapter status. We thus make sure
++ * only of USBINS/USBREM IRQ handlers are called */
++ if (pcf_int[0] & (PCF50633_INT1_USBINS | PCF50633_INT1_USBREM)) {
++ chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
++ if (chgstat & (0x3 << 4))
++ pcf_int[0] &= ~PCF50633_INT1_USBREM;
++ else
++ pcf_int[0] &= ~PCF50633_INT1_USBINS;
++ }
++
++ /* Make sure only one of ADPINS or ADPREM is set */
++ if (pcf_int[0] & (PCF50633_INT1_ADPINS | PCF50633_INT1_ADPREM)) {
++ chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
++ if (chgstat & (0x3 << 4))
++ pcf_int[0] &= ~PCF50633_INT1_ADPREM;
++ else
++ pcf_int[0] &= ~PCF50633_INT1_ADPINS;
++ }
++
++ dev_dbg(pcf->dev, "INT1=0x%02x INT2=0x%02x INT3=0x%02x "
++ "INT4=0x%02x INT5=0x%02x\n", pcf_int[0],
++ pcf_int[1], pcf_int[2], pcf_int[3], pcf_int[4]);
++
++ /* Some revisions of the chip don't have a 8s standby mode on
++ * ONKEY1S press. We try to manually do it in such cases. */
++ if ((pcf_int[0] & PCF50633_INT1_SECOND) && pcf->onkey1s_held) {
++ dev_info(pcf->dev, "ONKEY1S held for %d secs\n",
++ pcf->onkey1s_held);
++ if (pcf->onkey1s_held++ == PCF50633_ONKEY1S_TIMEOUT)
++ if (pcf->pdata->force_shutdown)
++ pcf->pdata->force_shutdown(pcf);
++ }
++
++ if (pcf_int[2] & PCF50633_INT3_ONKEY1S) {
++ dev_info(pcf->dev, "ONKEY1S held\n");
++ pcf->onkey1s_held = 1 ;
++
++ /* Unmask IRQ_SECOND */
++ pcf50633_reg_clear_bits(pcf, PCF50633_REG_INT1M,
++ PCF50633_INT1_SECOND);
++
++ /* Unmask IRQ_ONKEYR */
++ pcf50633_reg_clear_bits(pcf, PCF50633_REG_INT2M,
++ PCF50633_INT2_ONKEYR);
++ }
++
++ if ((pcf_int[1] & PCF50633_INT2_ONKEYR) && pcf->onkey1s_held) {
++ pcf->onkey1s_held = 0;
++
++ /* Mask SECOND and ONKEYR interrupts */
++ if (pcf->mask_regs[0] & PCF50633_INT1_SECOND)
++ pcf50633_reg_set_bit_mask(pcf,
++ PCF50633_REG_INT1M,
++ PCF50633_INT1_SECOND,
++ PCF50633_INT1_SECOND);
++
++ if (pcf->mask_regs[1] & PCF50633_INT2_ONKEYR)
++ pcf50633_reg_set_bit_mask(pcf,
++ PCF50633_REG_INT2M,
++ PCF50633_INT2_ONKEYR,
++ PCF50633_INT2_ONKEYR);
++ }
++
++ /* Have we just resumed ? */
++ if (pcf->is_suspended) {
++ pcf->is_suspended = 0;
++
++ /* Set the resume reason filtering out non resumers */
++ for (i = 0; i < ARRAY_SIZE(pcf_int); i++)
++ pcf->resume_reason[i] = pcf_int[i] &
++ pcf->pdata->resumers[i];
++
++ /* Make sure we don't pass on any ONKEY events to
++ * userspace now */
++ pcf_int[1] &= ~(PCF50633_INT2_ONKEYR | PCF50633_INT2_ONKEYF);
++ }
++
++ for (i = 0; i < ARRAY_SIZE(pcf_int); i++) {
++ /* Unset masked interrupts */
++ pcf_int[i] &= ~pcf->mask_regs[i];
++
++ for (j = 0; j < 8 ; j++)
++ if (pcf_int[i] & (1 << j))
++ pcf50633_irq_call_handler(pcf, (i * 8) + j);
++ }
++
++out:
++ return IRQ_HANDLED;
++}
++
++#ifdef CONFIG_PM
++
++int pcf50633_irq_suspend(struct pcf50633 *pcf)
++{
++ int ret;
++ int i;
++ u8 res[5];
++
++
++ /* Make sure our interrupt handlers are not called
++ * henceforth */
++ disable_irq(pcf->irq);
++
++ /* Save the masks */
++ ret = pcf50633_read_block(pcf, PCF50633_REG_INT1M,
++ ARRAY_SIZE(pcf->suspend_irq_masks),
++ pcf->suspend_irq_masks);
++ if (ret < 0) {
++ dev_err(pcf->dev, "error saving irq masks\n");
++ goto out;
++ }
++
++ /* Write wakeup irq masks */
++ for (i = 0; i < ARRAY_SIZE(res); i++)
++ res[i] = ~pcf->pdata->resumers[i];
++
++ ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
++ ARRAY_SIZE(res), &res[0]);
++ if (ret < 0) {
++ dev_err(pcf->dev, "error writing wakeup irq masks\n");
++ goto out;
++ }
++
++ pcf->is_suspended = 1;
++
++out:
++ return ret;
++}
++
++int pcf50633_irq_resume(struct pcf50633 *pcf)
++{
++ int ret;
++
++ /* Write the saved mask registers */
++ ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
++ ARRAY_SIZE(pcf->suspend_irq_masks),
++ pcf->suspend_irq_masks);
++ if (ret < 0)
++ dev_err(pcf->dev, "Error restoring saved suspend masks\n");
++
++ enable_irq(pcf->irq);
++
++ return ret;
++}
++
++#endif
++
++int pcf50633_irq_init(struct pcf50633 *pcf, int irq)
++{
++ int ret;
++
++ pcf->irq = irq;
++
++ /* Enable all interrupts except RTC SECOND */
++ pcf->mask_regs[0] = 0x80;
++ pcf50633_reg_write(pcf, PCF50633_REG_INT1M, pcf->mask_regs[0]);
++ pcf50633_reg_write(pcf, PCF50633_REG_INT2M, 0x00);
++ pcf50633_reg_write(pcf, PCF50633_REG_INT3M, 0x00);
++ pcf50633_reg_write(pcf, PCF50633_REG_INT4M, 0x00);
++ pcf50633_reg_write(pcf, PCF50633_REG_INT5M, 0x00);
++
++ ret = request_threaded_irq(irq, NULL, pcf50633_irq,
++ IRQF_TRIGGER_LOW | IRQF_ONESHOT,
++ "pcf50633", pcf);
++
++ if (ret) {
++ dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
++ }
++
++ if (enable_irq_wake(irq) < 0)
++ dev_err(pcf->dev, "IRQ %u cannot be enabled as wake-up source"
++ "in this hardware revision", irq);
++
++ return ret;
++}
++
++void pcf50633_irq_free(struct pcf50633 *pcf)
++{
++ free_irq(pcf->irq, pcf);
++}
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 2e13b94..2b46c1f 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -353,6 +353,17 @@ config MMC_S3C_PIODMA
+
+ endchoice
- static int __init pcf50633_init(void)
-diff --git a/drivers/mfd/pcf50633-gpio.c b/drivers/mfd/pcf50633-gpio.c
-deleted file mode 100644
-index 9ab19a8..0000000
---- a/drivers/mfd/pcf50633-gpio.c
-+++ /dev/null
-@@ -1,121 +0,0 @@
--/* NXP PCF50633 GPIO Driver
-- *
-- * (C) 2006-2008 by Openmoko, Inc.
-- * Author: Balaji Rao <balajirrao@openmoko.org>
-- * All rights reserved.
-- *
-- * Broken down from monstrous PCF50633 driver mainly by
-- * Harald Welte, Andy Green and Werner Almesberger
-- *
-- * This program is free software; you can redistribute it and/or modify it
-- * under the terms of the GNU General Public License as published by the
-- * Free Software Foundation; either version 2 of the License, or (at your
-- * option) any later version.
-- *
-- */
--
--#include <linux/kernel.h>
--#include <linux/module.h>
--
--#include <linux/mfd/pcf50633/core.h>
--#include <linux/mfd/pcf50633/gpio.h>
--
--enum pcf50633_regulator_id {
-- PCF50633_REGULATOR_AUTO,
-- PCF50633_REGULATOR_DOWN1,
-- PCF50633_REGULATOR_DOWN2,
-- PCF50633_REGULATOR_LDO1,
-- PCF50633_REGULATOR_LDO2,
-- PCF50633_REGULATOR_LDO3,
-- PCF50633_REGULATOR_LDO4,
-- PCF50633_REGULATOR_LDO5,
-- PCF50633_REGULATOR_LDO6,
-- PCF50633_REGULATOR_HCLDO,
-- PCF50633_REGULATOR_MEMLDO,
--};
--
--#define PCF50633_REG_AUTOOUT 0x1a
--#define PCF50633_REG_DOWN1OUT 0x1e
--#define PCF50633_REG_DOWN2OUT 0x22
--#define PCF50633_REG_MEMLDOOUT 0x26
--#define PCF50633_REG_LDO1OUT 0x2d
--#define PCF50633_REG_LDO2OUT 0x2f
--#define PCF50633_REG_LDO3OUT 0x31
--#define PCF50633_REG_LDO4OUT 0x33
--#define PCF50633_REG_LDO5OUT 0x35
--#define PCF50633_REG_LDO6OUT 0x37
--#define PCF50633_REG_HCLDOOUT 0x39
--
--static const u8 pcf50633_regulator_registers[PCF50633_NUM_REGULATORS] = {
-- [PCF50633_REGULATOR_AUTO] = PCF50633_REG_AUTOOUT,
-- [PCF50633_REGULATOR_DOWN1] = PCF50633_REG_DOWN1OUT,
-- [PCF50633_REGULATOR_DOWN2] = PCF50633_REG_DOWN2OUT,
-- [PCF50633_REGULATOR_MEMLDO] = PCF50633_REG_MEMLDOOUT,
-- [PCF50633_REGULATOR_LDO1] = PCF50633_REG_LDO1OUT,
-- [PCF50633_REGULATOR_LDO2] = PCF50633_REG_LDO2OUT,
-- [PCF50633_REGULATOR_LDO3] = PCF50633_REG_LDO3OUT,
-- [PCF50633_REGULATOR_LDO4] = PCF50633_REG_LDO4OUT,
-- [PCF50633_REGULATOR_LDO5] = PCF50633_REG_LDO5OUT,
-- [PCF50633_REGULATOR_LDO6] = PCF50633_REG_LDO6OUT,
-- [PCF50633_REGULATOR_HCLDO] = PCF50633_REG_HCLDOOUT,
--};
--
--int pcf50633_gpio_set(struct pcf50633 *pcf, int gpio, u8 val)
--{
-- u8 reg;
--
-- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
--
-- return pcf50633_reg_set_bit_mask(pcf, reg, 0x07, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_set);
--
--u8 pcf50633_gpio_get(struct pcf50633 *pcf, int gpio)
--{
-- u8 reg, val;
--
-- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
-- val = pcf50633_reg_read(pcf, reg) & 0x07;
--
-- return val;
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_get);
--
--int pcf50633_gpio_invert_set(struct pcf50633 *pcf, int gpio, int invert)
--{
-- u8 val, reg;
--
-- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
-- val = !!invert << 3;
--
-- return pcf50633_reg_set_bit_mask(pcf, reg, 1 << 3, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_set);
--
--int pcf50633_gpio_invert_get(struct pcf50633 *pcf, int gpio)
--{
-- u8 reg, val;
--
-- reg = gpio - PCF50633_GPIO1 + PCF50633_REG_GPIO1CFG;
-- val = pcf50633_reg_read(pcf, reg);
--
-- return val & (1 << 3);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_invert_get);
--
--int pcf50633_gpio_power_supply_set(struct pcf50633 *pcf,
-- int gpio, int regulator, int on)
--{
-- u8 reg, val, mask;
--
-- /* the *ENA register is always one after the *OUT register */
-- reg = pcf50633_regulator_registers[regulator] + 1;
--
-- val = !!on << (gpio - PCF50633_GPIO1);
-- mask = 1 << (gpio - PCF50633_GPIO1);
--
-- return pcf50633_reg_set_bit_mask(pcf, reg, mask, val);
--}
--EXPORT_SYMBOL_GPL(pcf50633_gpio_power_supply_set);
--
--MODULE_LICENSE("GPL");
-diff --git a/drivers/mfd/pcf50633-irq.c b/drivers/mfd/pcf50633-irq.c
++config MMC_GLAMO
++ tristate "Glamo S3C SD/MMC Card Interface support"
++ depends on MFD_GLAMO && MMC && REGULATOR
++ select CRC7
++ help
++ This selects a driver for the MCI interface found in
++ the S-Media GLAMO chip, as used in Openmoko
++ neo1973 GTA-02.
++
++ If unsure, say N.
++
+ config MMC_SDRICOH_CS
+ tristate "MMC/SD driver for Ricoh Bay1Controllers (EXPERIMENTAL)"
+ depends on EXPERIMENTAL && PCI && PCMCIA
+diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
+index f480397..e82e21d 100644
+--- a/drivers/mmc/host/Makefile
++++ b/drivers/mmc/host/Makefile
+@@ -29,6 +29,7 @@ ifeq ($(CONFIG_OF),y)
+ obj-$(CONFIG_MMC_SPI) += of_mmc_spi.o
+ endif
+ obj-$(CONFIG_MMC_S3C) += s3cmci.o
++obj-$(CONFIG_MMC_GLAMO) += glamo-mci.o
+ obj-$(CONFIG_MMC_SDRICOH_CS) += sdricoh_cs.o
+ obj-$(CONFIG_MMC_TMIO) += tmio_mmc.o
+ obj-$(CONFIG_MMC_CB710) += cb710-mmc.o
+diff --git a/drivers/mmc/host/glamo-mci.c b/drivers/mmc/host/glamo-mci.c
new file mode 100644
-index 0000000..c1923cf
+index 0000000..f07ad09
--- /dev/null
-+++ b/drivers/mfd/pcf50633-irq.c
-@@ -0,0 +1,319 @@
-+/* NXP PCF50633 Power Management Unit (PMU) driver
-+ *
-+ * (C) 2006-2008 by Openmoko, Inc.
-+ * Author: Harald Welte <laforge@openmoko.org>
-+ * Balaji Rao <balajirrao@openmoko.org>
-+ * All rights reserved.
++++ b/drivers/mmc/host/glamo-mci.c
+@@ -0,0 +1,985 @@
++/*
++ * linux/drivers/mmc/host/glamo-mmc.c - Glamo MMC driver
+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by the
-+ * Free Software Foundation; either version 2 of the License, or (at your
-+ * option) any later version.
++ * Copyright (C) 2007 Openmoko, Inc, Andy Green <andy@openmoko.com>
++ * Copyright (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
++ * Based on S3C MMC driver that was:
++ * Copyright (C) 2004-2006 maintech GmbH, Thomas Kleffel <tk@maintech.de>
+ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
+ */
+
++#include <linux/module.h>
++#include <linux/mmc/mmc.h>
++#include <linux/mmc/sd.h>
++#include <linux/mmc/host.h>
++#include <linux/platform_device.h>
++#include <linux/irq.h>
++#include <linux/delay.h>
+#include <linux/interrupt.h>
-+#include <linux/kernel.h>
-+#include <linux/mutex.h>
-+#include <linux/slab.h>
++#include <linux/workqueue.h>
++#include <linux/crc7.h>
++#include <linux/scatterlist.h>
++#include <linux/io.h>
++#include <linux/regulator/consumer.h>
++#include <linux/err.h>
++#include <linux/mfd/glamo.h>
++#include <linux/mfd/glamo-core.h>
++#include <linux/mfd/glamo-regs.h>
++
++struct glamo_mci_host {
++ struct glamo_mmc_platform_data *pdata;
++ struct platform_device *pdev;
++ struct glamo_core *core;
++ struct mmc_host *mmc;
++ struct resource *mmio_mem;
++ struct resource *data_mem;
++ void __iomem *mmio_base;
++ uint16_t __iomem *data_base;
++
++ unsigned int irq;
++
++ struct regulator *regulator;
++ struct mmc_request *mrq;
++
++ unsigned int clk_rate;
++
++ unsigned short vdd;
++ char power_mode;
++
++ unsigned char request_counter;
++
++ struct workqueue_struct *workqueue;
++ struct work_struct read_work;
++};
++
++static void glamo_mci_send_request(struct mmc_host *mmc,
++ struct mmc_request *mrq);
++static void glamo_mci_send_command(struct glamo_mci_host *host,
++ struct mmc_command *cmd);
++
++/*
++ * Max SD clock rate
++ *
++ * held at /(3 + 1) due to concerns of 100R recommended series resistor
++ * allows 16MHz @ 4-bit --> 8MBytes/sec raw
++ *
++ * you can override this on kernel commandline using
++ *
++ * glamo_mci.sd_max_clk=10000000
++ *
++ * for example
++ */
++
++static int sd_max_clk = 21000000;
++module_param(sd_max_clk, int, 0644);
++
++/*
++ * Slow SD clock rate
++ *
++ * you can override this on kernel commandline using
++ *
++ * glamo_mci.sd_slow_ratio=8
++ *
++ * for example
++ *
++ * platform callback is used to decide effective clock rate, if not
++ * defined then max is used, if defined and returns nonzero, rate is
++ * divided by this factor
++ */
++
++static int sd_slow_ratio = 8;
++module_param(sd_slow_ratio, int, 0644);
++
++/*
++ * Post-power SD clock rate
++ *
++ * you can override this on kernel commandline using
++ *
++ * glamo_mci.sd_post_power_clock=1000000
++ *
++ * for example
++ *
++ * After changing power to card, clock is held at this rate until first bulk
++ * transfer completes
++ */
++
++static int sd_post_power_clock = 1000000;
++module_param(sd_post_power_clock, int, 0644);
++
++
++static inline void glamomci_reg_write(struct glamo_mci_host *glamo,
++ uint16_t reg, uint16_t val)
++{
++ writew(val, glamo->mmio_base + reg);
++}
++
++static inline uint16_t glamomci_reg_read(struct glamo_mci_host *glamo,
++ uint16_t reg)
++{
++ return readw(glamo->mmio_base + reg);
++}
++
++static void glamomci_reg_set_bit_mask(struct glamo_mci_host *glamo,
++ uint16_t reg, uint16_t mask,
++ uint16_t val)
++{
++ uint16_t tmp;
++
++ val &= mask;
++
++ tmp = glamomci_reg_read(glamo, reg);
++ tmp &= ~mask;
++ tmp |= val;
++ glamomci_reg_write(glamo, reg, tmp);
++}
++
++static void glamo_mci_reset(struct glamo_mci_host *host)
++{
++ glamo_engine_reset(host->core, GLAMO_ENGINE_MMC);
++
++ glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS1,
++ (uint16_t)(host->data_mem->start));
++ glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS2,
++ (uint16_t)(host->data_mem->start >> 16));
++
++ glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS1,
++ (uint16_t)(host->data_mem->start));
++ glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS2,
++ (uint16_t)(host->data_mem->start >> 16));
++
++}
++
++static int glamo_mci_clock_disable(struct mmc_host *mmc, int lazy)
++{
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ glamo_engine_suspend(host->core, GLAMO_ENGINE_MMC);
++ return 0;
++}
++
++static int glamo_mci_clock_enable(struct mmc_host *mmc)
++{
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ glamo_engine_enable(host->core, GLAMO_ENGINE_MMC);
++ return 0;
++}
++
++
++#ifndef GLAMO_MCI_WORKER
++static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
++{
++ struct sg_mapping_iter miter;
++ uint16_t __iomem *from_ptr = host->data_base;
++
++ dev_dbg(&host->pdev->dev, "pio_read():\n");
++
++ sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_TO_SG);
++
++ while (sg_miter_next(&miter)) {
++ memcpy(miter.addr, from_ptr, miter.length);
++ from_ptr += miter.length >> 1;
++
++ data->bytes_xfered += miter.length;
++ }
++
++ sg_miter_stop(&miter);
++
++ dev_dbg(&host->pdev->dev, "pio_read(): "
++ "complete (no more data).\n");
++}
++#endif
++
++static void do_pio_write(struct glamo_mci_host *host, struct mmc_data *data)
++{
++ struct sg_mapping_iter miter;
++ uint16_t __iomem *to_ptr = host->data_base;
++
++ dev_dbg(&host->pdev->dev, "pio_write():\n");
++ sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_FROM_SG);
++
++ while (sg_miter_next(&miter)) {
++ memcpy(to_ptr, miter.addr, miter.length);
++ to_ptr += miter.length >> 1;
++
++ data->bytes_xfered += miter.length;
++ }
++
++ sg_miter_stop(&miter);
++ dev_dbg(&host->pdev->dev, "pio_write(): complete\n");
++}
++
++static int glamo_mci_set_card_clock(struct glamo_mci_host *host, int freq)
++{
++ int real_rate = 0;
++
++ if (freq)
++ real_rate = glamo_engine_reclock(host->core, GLAMO_ENGINE_MMC,
++ freq);
++
++ return real_rate;
++}
++
++static int glamo_mci_wait_idle(struct glamo_mci_host *host,
++ unsigned long timeout)
++{
++ uint16_t status;
++ do {
++ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
++ } while (!(status & GLAMO_STAT1_MMC_IDLE) &&
++ time_is_after_jiffies(timeout));
++
++ if (time_is_before_eq_jiffies(timeout)) {
++ glamo_mci_reset(host);
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
++static void glamo_mci_request_done(struct glamo_mci_host *host,
++ struct mmc_request *mrq)
++{
++ mmc_request_done(host->mmc, mrq);
++}
++
++static irqreturn_t glamo_mci_irq(int irq, void *data)
++{
++ struct glamo_mci_host *host = data;
++ struct mmc_request *mrq;
++ struct mmc_command *cmd;
++ uint16_t status;
++
++ if (!host->mrq || !host->mrq->cmd)
++ return IRQ_HANDLED;
++
++ mrq = host->mrq;
++ cmd = mrq->cmd;
++
++ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
++ dev_dbg(&host->pdev->dev, "status = 0x%04x\n", status);
++
++ /* we ignore a data timeout report if we are also told the data came */
++ if (status & GLAMO_STAT1_MMC_RB_DRDY)
++ status &= ~GLAMO_STAT1_MMC_DTOUT;
++
++ if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
++ cmd->error = -ETIMEDOUT;
++ else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
++ cmd->error = -EILSEQ;
++
++ if (cmd->error) {
++ dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n", status);
++ goto done;
++ }
++
++ /* issue STOP if we have been given one to use */
++ if (mrq->stop)
++ glamo_mci_send_command(host, mrq->stop);
++
++ if (cmd->data->flags & MMC_DATA_READ)
++#ifndef GLAMO_MCI_WORKER
++ do_pio_read(host, cmd->data);
++#else
++ flush_workqueue(host->workqueue);
++#endif
++
++ if (mrq->stop)
++ mrq->stop->error = glamo_mci_wait_idle(host, jiffies + HZ);
++
++done:
++ host->mrq = NULL;
++ glamo_mci_request_done(host, cmd->mrq);
++
++ return IRQ_HANDLED;
++}
++
++#ifdef GLAMO_MCI_WORKER
++static void glamo_mci_read_worker(struct work_struct *work)
++{
++ struct glamo_mci_host *host = container_of(work, struct glamo_mci_host,
++ read_work);
++ struct mmc_command *cmd;
++ uint16_t status;
++ uint16_t blocks_ready;
++ size_t data_read = 0;
++ size_t data_ready;
++ struct scatterlist *sg;
++ uint16_t __iomem *from_ptr = host->data_base;
++ void *sg_pointer;
++
++
++ cmd = host->mrq->cmd;
++ sg = cmd->data->sg;
++ do {
++ /*
++ * TODO: How to get rid of that?
++ * Maybe just drop it... In fact, it is already handled in
++ * the IRQ handler, maybe we should only check cmd->error.
++ * But the question is: what happens between the moment
++ * the error occurs, and the moment the IRQ handler handles it?
++ */
++ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
++
++ if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
++ cmd->error = -ETIMEDOUT;
++ if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
++ cmd->error = -EILSEQ;
++ if (cmd->error) {
++ dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n",
++ status);
++ return;
++ }
+
-+#include <linux/mfd/pcf50633/core.h>
++ blocks_ready = glamomci_reg_read(host, GLAMO_REG_MMC_RB_BLKCNT);
++ data_ready = blocks_ready * cmd->data->blksz;
+
-+/* Two MBCS registers used during cold start */
-+#define PCF50633_REG_MBCS1 0x4b
-+#define PCF50633_REG_MBCS2 0x4c
-+#define PCF50633_MBCS1_USBPRES 0x01
-+#define PCF50633_MBCS1_ADAPTPRES 0x01
++ if (data_ready == data_read)
++ yield();
+
-+int pcf50633_register_irq(struct pcf50633 *pcf, int irq,
-+ void (*handler) (int, void *), void *data)
-+{
-+ if (irq < 0 || irq > PCF50633_NUM_IRQ || !handler)
-+ return -EINVAL;
++ while (sg && data_read + sg->length <= data_ready) {
++ sg_pointer = page_address(sg_page(sg)) + sg->offset;
++ memcpy(sg_pointer, from_ptr, sg->length);
++ from_ptr += sg->length >> 1;
+
-+ if (WARN_ON(pcf->irq_handler[irq].handler))
-+ return -EBUSY;
++ data_read += sg->length;
+
-+ mutex_lock(&pcf->lock);
-+ pcf->irq_handler[irq].handler = handler;
-+ pcf->irq_handler[irq].data = data;
-+ mutex_unlock(&pcf->lock);
++ sg = sg_next(sg);
++ }
+
-+ return 0;
++ } while (sg);
++ cmd->data->bytes_xfered = data_read;
+}
-+EXPORT_SYMBOL_GPL(pcf50633_register_irq);
++#endif
+
-+int pcf50633_free_irq(struct pcf50633 *pcf, int irq)
++static void glamo_mci_send_command(struct glamo_mci_host *host,
++ struct mmc_command *cmd)
+{
-+ if (irq < 0 || irq > PCF50633_NUM_IRQ)
-+ return -EINVAL;
++ uint8_t u8a[6];
++ uint16_t fire = 0;
++ unsigned int timeout = 1000000;
++ uint16_t *reg_resp = (uint16_t *)(host->mmio_base + GLAMO_REG_MMC_CMD_RSP1);
++ uint16_t status;
++ int triggers_int = 1;
+
-+ mutex_lock(&pcf->lock);
-+ pcf->irq_handler[irq].handler = NULL;
-+ mutex_unlock(&pcf->lock);
++ /* if we can't do it, reject as busy */
++ if (!(glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1) &
++ GLAMO_STAT1_MMC_IDLE)) {
++ cmd->error = -EBUSY;
++ return;
++ }
+
-+ return 0;
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_free_irq);
++ /* create an array in wire order for CRC computation */
++ u8a[0] = 0x40 | (cmd->opcode & 0x3f);
++ u8a[1] = (uint8_t)(cmd->arg >> 24);
++ u8a[2] = (uint8_t)(cmd->arg >> 16);
++ u8a[3] = (uint8_t)(cmd->arg >> 8);
++ u8a[4] = (uint8_t)cmd->arg;
++ u8a[5] = (crc7(0, u8a, 5) << 1) | 0x01;
+
-+static int __pcf50633_irq_mask_set(struct pcf50633 *pcf, int irq, u8 mask)
-+{
-+ u8 reg, bit;
-+ int ret = 0, idx;
++ /* issue the wire-order array including CRC in register order */
++ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG1, ((u8a[4] << 8) | u8a[5]));
++ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG2, ((u8a[2] << 8) | u8a[3]));
++ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG3, ((u8a[0] << 8) | u8a[1]));
+
-+ idx = irq >> 3;
-+ reg = PCF50633_REG_INT1M + idx;
-+ bit = 1 << (irq & 0x07);
++ /* command index toggle */
++ fire |= (host->request_counter & 1) << 12;
+
-+ pcf50633_reg_set_bit_mask(pcf, reg, bit, mask ? bit : 0);
++ /* set type of command */
++ switch (mmc_cmd_type(cmd)) {
++ case MMC_CMD_BC:
++ fire |= GLAMO_FIRE_MMC_CMDT_BNR;
++ break;
++ case MMC_CMD_BCR:
++ fire |= GLAMO_FIRE_MMC_CMDT_BR;
++ break;
++ case MMC_CMD_AC:
++ fire |= GLAMO_FIRE_MMC_CMDT_AND;
++ break;
++ case MMC_CMD_ADTC:
++ fire |= GLAMO_FIRE_MMC_CMDT_AD;
++ break;
++ }
++ /*
++ * if it expects a response, set the type expected
++ *
++ * R1, Length : 48bit, Normal response
++ * R1b, Length : 48bit, same R1, but added card busy status
++ * R2, Length : 136bit (really 128 bits with CRC snipped)
++ * R3, Length : 48bit (OCR register value)
++ * R4, Length : 48bit, SDIO_OP_CONDITION, Reverse SDIO Card
++ * R5, Length : 48bit, IO_RW_DIRECTION, Reverse SDIO Card
++ * R6, Length : 48bit (RCA register)
++ * R7, Length : 48bit (interface condition, VHS(voltage supplied),
++ * check pattern, CRC7)
++ */
++ switch (mmc_resp_type(cmd)) {
++ case MMC_RSP_R1: /* same index as R6 and R7 */
++ fire |= GLAMO_FIRE_MMC_RSPT_R1;
++ break;
++ case MMC_RSP_R1B:
++ fire |= GLAMO_FIRE_MMC_RSPT_R1b;
++ break;
++ case MMC_RSP_R2:
++ fire |= GLAMO_FIRE_MMC_RSPT_R2;
++ break;
++ case MMC_RSP_R3:
++ fire |= GLAMO_FIRE_MMC_RSPT_R3;
++ break;
++ /* R4 and R5 supported by chip not defined in linux/mmc/core.h (sdio) */
++ }
++ /*
++ * From the command index, set up the command class in the host ctrllr
++ *
++ * missing guys present on chip but couldn't figure out how to use yet:
++ * 0x0 "stream read"
++ * 0x9 "cancel running command"
++ */
++ switch (cmd->opcode) {
++ case MMC_READ_SINGLE_BLOCK:
++ fire |= GLAMO_FIRE_MMC_CC_SBR; /* single block read */
++ break;
++ case MMC_SWITCH: /* 64 byte payload */
++ case SD_APP_SEND_SCR:
++ case MMC_READ_MULTIPLE_BLOCK:
++ /* we will get an interrupt off this */
++ if (!cmd->mrq->stop) {
++ /* multiblock no stop */
++ fire |= GLAMO_FIRE_MMC_CC_MBRNS;
++ } else {
++ /* multiblock with stop */
++ fire |= GLAMO_FIRE_MMC_CC_MBRS;
++ }
++ break;
++ case MMC_WRITE_BLOCK:
++ fire |= GLAMO_FIRE_MMC_CC_SBW; /* single block write */
++ break;
++ case MMC_WRITE_MULTIPLE_BLOCK:
++ if (cmd->mrq->stop) {
++ /* multiblock with stop */
++ fire |= GLAMO_FIRE_MMC_CC_MBWS;
++ } else {
++ /* multiblock NO stop-- 'RESERVED'? */
++ fire |= GLAMO_FIRE_MMC_CC_MBWNS;
++ }
++ break;
++ case MMC_STOP_TRANSMISSION:
++ fire |= GLAMO_FIRE_MMC_CC_STOP; /* STOP */
++ triggers_int = 0;
++ break;
++ default:
++ fire |= GLAMO_FIRE_MMC_CC_BASIC; /* "basic command" */
++ triggers_int = 0;
++ break;
++ }
+
-+ mutex_lock(&pcf->lock);
++ if (cmd->data)
++ host->mrq = cmd->mrq;
+
-+ if (mask)
-+ pcf->mask_regs[idx] |= bit;
-+ else
-+ pcf->mask_regs[idx] &= ~bit;
++ /* always largest timeout */
++ glamomci_reg_write(host, GLAMO_REG_MMC_TIMEOUT, 0xfff);
+
-+ mutex_unlock(&pcf->lock);
++ /* Generate interrupt on txfer */
++ glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC, 0xff36,
++ 0x0800 |
++ GLAMO_BASIC_MMC_NO_CLK_RD_WAIT |
++ GLAMO_BASIC_MMC_EN_COMPL_INT |
++ GLAMO_BASIC_MMC_EN_DATA_PUPS |
++ GLAMO_BASIC_MMC_EN_CMD_PUP);
+
-+ return ret;
-+}
++ /* send the command out on the wire */
++ /* dev_info(&host->pdev->dev, "Using FIRE %04X\n", fire); */
++ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_FIRE, fire);
+
-+int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
-+{
-+ dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
++ /* we are deselecting card? because it isn't going to ack then... */
++ if ((cmd->opcode == 7) && (cmd->arg == 0))
++ return;
+
-+ return __pcf50633_irq_mask_set(pcf, irq, 1);
-+}
-+EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
++ /*
++ * we must spin until response is ready or timed out
++ * -- we don't get interrupts unless there is a bulk rx
++ */
++ do
++ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
++ while (((((status >> 15) & 1) != (host->request_counter & 1)) ||
++ (!(status & (GLAMO_STAT1_MMC_RB_RRDY |
++ GLAMO_STAT1_MMC_RTOUT |
++ GLAMO_STAT1_MMC_DTOUT |
++ GLAMO_STAT1_MMC_BWERR |
++ GLAMO_STAT1_MMC_BRERR)))) && (timeout--));
+
-+int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
-+{
-+ dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
++ if ((status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT)) ||
++ (timeout == 0)) {
++ cmd->error = -ETIMEDOUT;
++ } else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR)) {
++ cmd->error = -EILSEQ;
++ }
++
++ if (cmd->flags & MMC_RSP_PRESENT) {
++ if (cmd->flags & MMC_RSP_136) {
++ cmd->resp[3] = readw(®_resp[0]) |
++ (readw(®_resp[1]) << 16);
++ cmd->resp[2] = readw(®_resp[2]) |
++ (readw(®_resp[3]) << 16);
++ cmd->resp[1] = readw(®_resp[4]) |
++ (readw(®_resp[5]) << 16);
++ cmd->resp[0] = readw(®_resp[6]) |
++ (readw(®_resp[7]) << 16);
++ } else {
++ cmd->resp[0] = (readw(®_resp[0]) >> 8) |
++ (readw(®_resp[1]) << 8) |
++ (readw(®_resp[2]) << 24);
++ }
++ }
++
++#ifdef GLAMO_MCI_WORKER
++ /* We'll only get an interrupt when all data has been transfered.
++ By starting to copy data when it's avaiable we can increase
++ throughput by up to 30%. */
++ if (cmd->data && (cmd->data->flags & MMC_DATA_READ))
++ queue_work(host->workqueue, &host->read_work);
++#endif
+
-+ return __pcf50633_irq_mask_set(pcf, irq, 0);
+}
-+EXPORT_SYMBOL_GPL(pcf50633_irq_unmask);
+
-+int pcf50633_irq_mask_get(struct pcf50633 *pcf, int irq)
++static int glamo_mci_prepare_pio(struct glamo_mci_host *host,
++ struct mmc_data *data)
+{
-+ u8 reg, bits;
++ /* set up the block info */
++ glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKLEN, data->blksz);
++ glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKCNT, data->blocks);
+
-+ reg = irq >> 3;
-+ bits = 1 << (irq & 0x07);
++ data->bytes_xfered = 0;
+
-+ return pcf->mask_regs[reg] & bits;
++ /* if write, prep the write into the shared RAM before the command */
++ if (data->flags & MMC_DATA_WRITE)
++ do_pio_write(host, data);
++
++ dev_dbg(&host->pdev->dev, "(blksz=%d, count=%d)\n",
++ data->blksz, data->blocks);
++ return 0;
+}
-+EXPORT_SYMBOL_GPL(pcf50633_irq_mask_get);
+
-+static void pcf50633_irq_call_handler(struct pcf50633 *pcf, int irq)
++static void glamo_mci_send_request(struct mmc_host *mmc,
++ struct mmc_request *mrq)
+{
-+ if (pcf->irq_handler[irq].handler)
-+ pcf->irq_handler[irq].handler(irq, pcf->irq_handler[irq].data);
-+}
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ struct mmc_command *cmd = mrq->cmd;
+
-+/* Maximum amount of time ONKEY is held before emergency action is taken */
-+#define PCF50633_ONKEY1S_TIMEOUT 8
++ host->request_counter++;
++ if (cmd->data) {
++ if (glamo_mci_prepare_pio(host, cmd->data)) {
++ cmd->error = -EIO;
++ cmd->data->error = -EIO;
++ goto done;
++ }
++ }
+
-+static irqreturn_t pcf50633_irq(int irq, void *data)
++ dev_dbg(&host->pdev->dev, "cmd 0x%x, "
++ "arg 0x%x data=%p mrq->stop=%p flags 0x%x\n",
++ cmd->opcode, cmd->arg, cmd->data, cmd->mrq->stop,
++ cmd->flags);
++
++ glamo_mci_send_command(host, cmd);
++
++ /*
++ * if we don't have bulk data to take care of, we're done
++ */
++ if (!cmd->data || cmd->error)
++ goto done;
++
++ /*
++ * Otherwise can can use the interrupt as async completion --
++ * if there is read data coming, or we wait for write data to complete,
++ * exit without mmc_request_done() as the payload interrupt
++ * will service it
++ */
++ dev_dbg(&host->pdev->dev, "Waiting for payload data\n");
++ return;
++done:
++ if (!cmd->error)
++ cmd->error = glamo_mci_wait_idle(host, jiffies + 2 * HZ);
++ glamo_mci_request_done(host, mrq);
++}
++
++static void glamo_mci_set_power_mode(struct glamo_mci_host *host,
++ unsigned char power_mode)
+{
-+ struct pcf50633 *pcf = data;
-+ int ret, i, j;
-+ u8 pcf_int[5], chgstat;
++ int ret;
+
-+ /* Read the 5 INT regs in one transaction */
-+ ret = pcf50633_read_block(pcf, PCF50633_REG_INT1,
-+ ARRAY_SIZE(pcf_int), pcf_int);
-+ if (ret != ARRAY_SIZE(pcf_int)) {
-+ dev_err(pcf->dev, "Error reading INT registers\n");
++ if (power_mode == host->power_mode)
++ return;
+
-+ /*
-+ * If this doesn't ACK the interrupt to the chip, we'll be
-+ * called once again as we're level triggered.
-+ */
-+ goto out;
++ switch (power_mode) {
++ case MMC_POWER_UP:
++ if (host->power_mode == MMC_POWER_OFF) {
++ ret = regulator_enable(host->regulator);
++ if (ret)
++ dev_err(&host->pdev->dev,
++ "Failed to enable regulator: %d\n",
++ ret);
++ }
++ break;
++ case MMC_POWER_ON:
++ break;
++ case MMC_POWER_OFF:
++ default:
++ ret = regulator_disable(host->regulator);
++ if (ret)
++ dev_warn(&host->pdev->dev,
++ "Failed to disable regulator: %d\n",
++ ret);
++ break;
+ }
++ host->power_mode = power_mode;
++}
+
-+ /* defeat 8s death from lowsys on A5 */
-+ pcf50633_reg_write(pcf, PCF50633_REG_OOCSHDWN, 0x04);
++static void glamo_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++{
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ int bus_width = 0;
++ int rate;
++ int sd_drive;
++ int ret;
+
-+ /* We immediately read the usb and adapter status. We thus make sure
-+ * only of USBINS/USBREM IRQ handlers are called */
-+ if (pcf_int[0] & (PCF50633_INT1_USBINS | PCF50633_INT1_USBREM)) {
-+ chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
-+ if (chgstat & (0x3 << 4))
-+ pcf_int[0] &= ~PCF50633_INT1_USBREM;
-+ else
-+ pcf_int[0] &= ~PCF50633_INT1_USBINS;
-+ }
++ mmc_host_enable(mmc);
+
-+ /* Make sure only one of ADPINS or ADPREM is set */
-+ if (pcf_int[0] & (PCF50633_INT1_ADPINS | PCF50633_INT1_ADPREM)) {
-+ chgstat = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
-+ if (chgstat & (0x3 << 4))
-+ pcf_int[0] &= ~PCF50633_INT1_ADPREM;
++ /* Set power */
++ glamo_mci_set_power_mode(host, ios->power_mode);
++
++ if (host->vdd != ios->vdd) {
++ ret = mmc_regulator_set_ocr(host->regulator, ios->vdd);
++ if (ret)
++ dev_err(&host->pdev->dev,
++ "Failed to set regulator voltage: %d\n", ret);
+ else
-+ pcf_int[0] &= ~PCF50633_INT1_ADPINS;
++ host->vdd = ios->vdd;
+ }
+
-+ dev_dbg(pcf->dev, "INT1=0x%02x INT2=0x%02x INT3=0x%02x "
-+ "INT4=0x%02x INT5=0x%02x\n", pcf_int[0],
-+ pcf_int[1], pcf_int[2], pcf_int[3], pcf_int[4]);
++ rate = glamo_mci_set_card_clock(host, ios->clock);
+
-+ /* Some revisions of the chip don't have a 8s standby mode on
-+ * ONKEY1S press. We try to manually do it in such cases. */
-+ if ((pcf_int[0] & PCF50633_INT1_SECOND) && pcf->onkey1s_held) {
-+ dev_info(pcf->dev, "ONKEY1S held for %d secs\n",
-+ pcf->onkey1s_held);
-+ if (pcf->onkey1s_held++ == PCF50633_ONKEY1S_TIMEOUT)
-+ if (pcf->pdata->force_shutdown)
-+ pcf->pdata->force_shutdown(pcf);
++ if ((ios->power_mode == MMC_POWER_ON) ||
++ (ios->power_mode == MMC_POWER_UP)) {
++ dev_info(&host->pdev->dev,
++ "powered (vdd = %hu) clk: %dkHz div=%hu (req: %ukHz). "
++ "Bus width=%d\n", ios->vdd,
++ rate / 1000, 0,
++ ios->clock / 1000, (int)ios->bus_width);
++ } else {
++ dev_info(&host->pdev->dev, "glamo_mci_set_ios: power down.\n");
+ }
+
-+ if (pcf_int[2] & PCF50633_INT3_ONKEY1S) {
-+ dev_info(pcf->dev, "ONKEY1S held\n");
-+ pcf->onkey1s_held = 1 ;
++ /* set bus width */
++ if (ios->bus_width == MMC_BUS_WIDTH_4)
++ bus_width = GLAMO_BASIC_MMC_EN_4BIT_DATA;
+
-+ /* Unmask IRQ_SECOND */
-+ pcf50633_reg_clear_bits(pcf, PCF50633_REG_INT1M,
-+ PCF50633_INT1_SECOND);
++ sd_drive = (rate * 4) / host->clk_rate;
++ if (sd_drive > 3)
++ sd_drive = 3;
+
-+ /* Unmask IRQ_ONKEYR */
-+ pcf50633_reg_clear_bits(pcf, PCF50633_REG_INT2M,
-+ PCF50633_INT2_ONKEYR);
-+ }
++ glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC,
++ GLAMO_BASIC_MMC_EN_4BIT_DATA | 0xc0,
++ bus_width | sd_drive << 6);
+
-+ if ((pcf_int[1] & PCF50633_INT2_ONKEYR) && pcf->onkey1s_held) {
-+ pcf->onkey1s_held = 0;
++ if (host->power_mode == MMC_POWER_OFF)
++ mmc_host_disable(host->mmc);
++ else
++ mmc_host_lazy_disable(host->mmc);
++}
+
-+ /* Mask SECOND and ONKEYR interrupts */
-+ if (pcf->mask_regs[0] & PCF50633_INT1_SECOND)
-+ pcf50633_reg_set_bit_mask(pcf,
-+ PCF50633_REG_INT1M,
-+ PCF50633_INT1_SECOND,
-+ PCF50633_INT1_SECOND);
+
-+ if (pcf->mask_regs[1] & PCF50633_INT2_ONKEYR)
-+ pcf50633_reg_set_bit_mask(pcf,
-+ PCF50633_REG_INT2M,
-+ PCF50633_INT2_ONKEYR,
-+ PCF50633_INT2_ONKEYR);
-+ }
++/*
++ * no physical write protect supported by us
++ */
++static int glamo_mci_get_ro(struct mmc_host *mmc)
++{
++ return 0;
++}
+
-+ /* Have we just resumed ? */
-+ if (pcf->is_suspended) {
-+ pcf->is_suspended = 0;
++static struct mmc_host_ops glamo_mci_ops = {
++ .enable = glamo_mci_clock_enable,
++ .disable = glamo_mci_clock_disable,
++ .request = glamo_mci_send_request,
++ .set_ios = glamo_mci_set_ios,
++ .get_ro = glamo_mci_get_ro,
++};
+
-+ /* Set the resume reason filtering out non resumers */
-+ for (i = 0; i < ARRAY_SIZE(pcf_int); i++)
-+ pcf->resume_reason[i] = pcf_int[i] &
-+ pcf->pdata->resumers[i];
++static int glamo_mci_probe(struct platform_device *pdev)
++{
++ struct mmc_host *mmc;
++ struct glamo_mci_host *host;
++ struct glamo_core *core = dev_get_drvdata(pdev->dev.parent);
++ int ret;
+
-+ /* Make sure we don't pass on any ONKEY events to
-+ * userspace now */
-+ pcf_int[1] &= ~(PCF50633_INT2_ONKEYR | PCF50633_INT2_ONKEYF);
++ dev_info(&pdev->dev, "glamo_mci driver (C)2007 Openmoko, Inc\n");
++
++ mmc = mmc_alloc_host(sizeof(struct glamo_mci_host), &pdev->dev);
++ if (!mmc) {
++ ret = -ENOMEM;
++ goto probe_out;
+ }
+
-+ for (i = 0; i < ARRAY_SIZE(pcf_int); i++) {
-+ /* Unset masked interrupts */
-+ pcf_int[i] &= ~pcf->mask_regs[i];
++ host = mmc_priv(mmc);
++ host->mmc = mmc;
++ host->pdev = pdev;
++ if (core->pdata)
++ host->pdata = core->pdata->mmc_data;
++ host->power_mode = MMC_POWER_OFF;
++ host->core = core;
++ host->irq = platform_get_irq(pdev, 0);
+
-+ for (j = 0; j < 8 ; j++)
-+ if (pcf_int[i] & (1 << j))
-+ pcf50633_irq_call_handler(pcf, (i * 8) + j);
++#ifdef GLAMO_MCI_WORKER
++ INIT_WORK(&host->read_work, glamo_mci_read_worker);
++ host->workqueue = create_singlethread_workqueue("glamo-mci-read");
++#endif
++
++ host->regulator = regulator_get(pdev->dev.parent, "SD_3V3");
++ if (IS_ERR(host->regulator)) {
++ dev_err(&pdev->dev, "Cannot proceed without regulator.\n");
++ ret = PTR_ERR(host->regulator);
++ goto probe_free_host;
++ }
++
++ host->mmio_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!host->mmio_mem) {
++ dev_err(&pdev->dev,
++ "failed to get io memory region resouce.\n");
++ ret = -ENOENT;
++ goto probe_regulator_put;
+ }
+
-+out:
-+ return IRQ_HANDLED;
-+}
-+
-+#ifdef CONFIG_PM
++ host->mmio_mem = request_mem_region(host->mmio_mem->start,
++ resource_size(host->mmio_mem),
++ pdev->name);
+
-+int pcf50633_irq_suspend(struct pcf50633 *pcf)
-+{
-+ int ret;
-+ int i;
-+ u8 res[5];
++ if (!host->mmio_mem) {
++ dev_err(&pdev->dev, "failed to request io memory region.\n");
++ ret = -ENOENT;
++ goto probe_regulator_put;
++ }
+
++ host->mmio_base = ioremap(host->mmio_mem->start,
++ resource_size(host->mmio_mem));
++ if (!host->mmio_base) {
++ dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
++ ret = -EINVAL;
++ goto probe_free_mem_region_mmio;
++ }
+
-+ /* Make sure our interrupt handlers are not called
-+ * henceforth */
-+ disable_irq(pcf->irq);
+
-+ /* Save the masks */
-+ ret = pcf50633_read_block(pcf, PCF50633_REG_INT1M,
-+ ARRAY_SIZE(pcf->suspend_irq_masks),
-+ pcf->suspend_irq_masks);
-+ if (ret < 0) {
-+ dev_err(pcf->dev, "error saving irq masks\n");
-+ goto out;
++ /* Get ahold of our data buffer we use for data in and out on MMC */
++ host->data_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!host->data_mem) {
++ dev_err(&pdev->dev,
++ "failed to get io memory region resource.\n");
++ ret = -ENOENT;
++ goto probe_iounmap_mmio;
+ }
+
-+ /* Write wakeup irq masks */
-+ for (i = 0; i < ARRAY_SIZE(res); i++)
-+ res[i] = ~pcf->pdata->resumers[i];
++ host->data_mem = request_mem_region(host->data_mem->start,
++ resource_size(host->data_mem),
++ pdev->name);
+
-+ ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
-+ ARRAY_SIZE(res), &res[0]);
-+ if (ret < 0) {
-+ dev_err(pcf->dev, "error writing wakeup irq masks\n");
-+ goto out;
++ if (!host->data_mem) {
++ dev_err(&pdev->dev, "failed to request io memory region.\n");
++ ret = -ENOENT;
++ goto probe_iounmap_mmio;
+ }
++ host->data_base = ioremap(host->data_mem->start,
++ resource_size(host->data_mem));
+
-+ pcf->is_suspended = 1;
++ if (host->data_base == 0) {
++ dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
++ ret = -EINVAL;
++ goto probe_free_mem_region_data;
++ }
+
-+out:
-+ return ret;
-+}
++ ret = request_threaded_irq(host->irq, NULL, glamo_mci_irq, IRQF_SHARED,
++ pdev->name, host);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to register irq.\n");
++ goto probe_iounmap_data;
++ }
+
-+int pcf50633_irq_resume(struct pcf50633 *pcf)
-+{
-+ int ret;
+
-+ /* Write the saved mask registers */
-+ ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
-+ ARRAY_SIZE(pcf->suspend_irq_masks),
-+ pcf->suspend_irq_masks);
-+ if (ret < 0)
-+ dev_err(pcf->dev, "Error restoring saved suspend masks\n");
++ host->vdd = 0;
++ host->clk_rate = glamo_pll_rate(host->core, GLAMO_PLL1);
+
-+ enable_irq(pcf->irq);
++ /* explain our host controller capabilities */
++ mmc->ops = &glamo_mci_ops;
++ mmc->ocr_avail = mmc_regulator_get_ocrmask(host->regulator);
++ mmc->caps = MMC_CAP_4_BIT_DATA |
++ MMC_CAP_MMC_HIGHSPEED |
++ MMC_CAP_SD_HIGHSPEED;
+
-+ return ret;
-+}
++ if (host->pdata->nonremovable)
++ mmc->caps |= MMC_CAP_NONREMOVABLE;
+
-+#endif
++ mmc->f_min = host->clk_rate / 256;
++ mmc->f_max = sd_max_clk;
+
-+int pcf50633_irq_init(struct pcf50633 *pcf, int irq)
-+{
-+ int ret;
++ mmc->max_blk_count = (1 << 16) - 1; /* GLAMO_REG_MMC_RB_BLKCNT */
++ mmc->max_blk_size = (1 << 12) - 1; /* GLAMO_REG_MMC_RB_BLKLEN */
++ mmc->max_req_size = resource_size(host->data_mem);
++ mmc->max_seg_size = mmc->max_req_size;
++ mmc->max_phys_segs = 128;
++ mmc->max_hw_segs = 128;
+
-+ pcf->irq = irq;
++ if (mmc->ocr_avail < 0) {
++ dev_warn(&pdev->dev,
++ "Failed to get ocr list for regulator: %d.\n",
++ mmc->ocr_avail);
++ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
++ }
+
-+ /* Enable all interrupts except RTC SECOND */
-+ pcf->mask_regs[0] = 0x80;
-+ pcf50633_reg_write(pcf, PCF50633_REG_INT1M, pcf->mask_regs[0]);
-+ pcf50633_reg_write(pcf, PCF50633_REG_INT2M, 0x00);
-+ pcf50633_reg_write(pcf, PCF50633_REG_INT3M, 0x00);
-+ pcf50633_reg_write(pcf, PCF50633_REG_INT4M, 0x00);
-+ pcf50633_reg_write(pcf, PCF50633_REG_INT5M, 0x00);
++ platform_set_drvdata(pdev, mmc);
+
-+ ret = request_threaded_irq(irq, NULL, pcf50633_irq,
-+ IRQF_TRIGGER_LOW | IRQF_ONESHOT,
-+ "pcf50633", pcf);
++ mmc->caps |= MMC_CAP_DISABLE;
++ mmc_set_disable_delay(mmc, 1000 / 16);
++
++ mmc_host_enable(mmc);
++ glamo_mci_reset(host);
+
++ ret = mmc_add_host(mmc);
+ if (ret) {
-+ dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
++ dev_err(&pdev->dev, "failed to add mmc host.\n");
++ goto probe_mmc_host_disable;
+ }
+
-+ if (enable_irq_wake(irq) < 0)
-+ dev_err(pcf->dev, "IRQ %u cannot be enabled as wake-up source"
-+ "in this hardware revision", irq);
++ mmc_host_lazy_disable(mmc);
++
++ return 0;
+
++probe_mmc_host_disable:
++ mmc_host_disable(mmc);
++ free_irq(host->irq, host);
++probe_iounmap_data:
++ iounmap(host->data_base);
++probe_free_mem_region_data:
++ release_mem_region(host->data_mem->start,
++ resource_size(host->data_mem));
++probe_iounmap_mmio:
++ iounmap(host->mmio_base);
++probe_free_mem_region_mmio:
++ release_mem_region(host->mmio_mem->start,
++ resource_size(host->mmio_mem));
++probe_regulator_put:
++ regulator_put(host->regulator);
++probe_free_host:
++#ifdef GLAMO_MCI_WORKER
++ destroy_workqueue(host->workqueue);
++#endif
++ mmc_free_host(mmc);
++probe_out:
+ return ret;
+}
+
-+void pcf50633_irq_free(struct pcf50633 *pcf)
++static int glamo_mci_remove(struct platform_device *pdev)
+{
-+ free_irq(pcf->irq, pcf);
-+}
-diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
-index 2e13b94..2b46c1f 100644
---- a/drivers/mmc/host/Kconfig
-+++ b/drivers/mmc/host/Kconfig
-@@ -353,6 +353,17 @@ config MMC_S3C_PIODMA
-
- endchoice
-
-+config MMC_GLAMO
-+ tristate "Glamo S3C SD/MMC Card Interface support"
-+ depends on MFD_GLAMO && MMC && REGULATOR
-+ select CRC7
-+ help
-+ This selects a driver for the MCI interface found in
-+ the S-Media GLAMO chip, as used in Openmoko
-+ neo1973 GTA-02.
-+
-+ If unsure, say N.
-+
- config MMC_SDRICOH_CS
- tristate "MMC/SD driver for Ricoh Bay1Controllers (EXPERIMENTAL)"
- depends on EXPERIMENTAL && PCI && PCMCIA
-diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
-index f480397..e82e21d 100644
---- a/drivers/mmc/host/Makefile
-+++ b/drivers/mmc/host/Makefile
-@@ -29,6 +29,7 @@ ifeq ($(CONFIG_OF),y)
- obj-$(CONFIG_MMC_SPI) += of_mmc_spi.o
- endif
- obj-$(CONFIG_MMC_S3C) += s3cmci.o
-+obj-$(CONFIG_MMC_GLAMO) += glamo-mci.o
- obj-$(CONFIG_MMC_SDRICOH_CS) += sdricoh_cs.o
- obj-$(CONFIG_MMC_TMIO) += tmio_mmc.o
- obj-$(CONFIG_MMC_CB710) += cb710-mmc.o
-diff --git a/drivers/mmc/host/glamo-mci.c b/drivers/mmc/host/glamo-mci.c
-new file mode 100644
-index 0000000..f07ad09
---- /dev/null
-+++ b/drivers/mmc/host/glamo-mci.c
-@@ -0,0 +1,985 @@
-+/*
-+ * linux/drivers/mmc/host/glamo-mmc.c - Glamo MMC driver
-+ *
-+ * Copyright (C) 2007 Openmoko, Inc, Andy Green <andy@openmoko.com>
-+ * Copyright (C) 2009, Lars-Peter Clausen <lars@metafoo.de>
-+ * Based on S3C MMC driver that was:
-+ * Copyright (C) 2004-2006 maintech GmbH, Thomas Kleffel <tk@maintech.de>
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ */
-+
-+#include <linux/module.h>
-+#include <linux/mmc/mmc.h>
-+#include <linux/mmc/sd.h>
-+#include <linux/mmc/host.h>
-+#include <linux/platform_device.h>
-+#include <linux/irq.h>
-+#include <linux/delay.h>
-+#include <linux/interrupt.h>
-+#include <linux/workqueue.h>
-+#include <linux/crc7.h>
-+#include <linux/scatterlist.h>
-+#include <linux/io.h>
-+#include <linux/regulator/consumer.h>
-+#include <linux/err.h>
-+#include <linux/mfd/glamo.h>
-+#include <linux/mfd/glamo-core.h>
-+#include <linux/mfd/glamo-regs.h>
-+
-+struct glamo_mci_host {
-+ struct glamo_mmc_platform_data *pdata;
-+ struct platform_device *pdev;
-+ struct glamo_core *core;
-+ struct mmc_host *mmc;
-+ struct resource *mmio_mem;
-+ struct resource *data_mem;
-+ void __iomem *mmio_base;
-+ uint16_t __iomem *data_base;
-+
-+ unsigned int irq;
-+
-+ struct regulator *regulator;
-+ struct mmc_request *mrq;
++ struct mmc_host *mmc = platform_get_drvdata(pdev);
++ struct glamo_mci_host *host = mmc_priv(mmc);
+
-+ unsigned int clk_rate;
++#ifdef GLAMO_MCI_WORKER
++ flush_workqueue(host->workqueue);
++ destroy_workqueue(host->workqueue);
++#endif
+
-+ unsigned short vdd;
-+ char power_mode;
++ mmc_host_enable(mmc);
++ mmc_remove_host(mmc);
++ mmc_host_disable(mmc);
+
-+ unsigned char request_counter;
++ synchronize_irq(host->irq);
++ free_irq(host->irq, host);
+
-+ struct workqueue_struct *workqueue;
-+ struct work_struct read_work;
-+};
++ iounmap(host->mmio_base);
++ iounmap(host->data_base);
++ release_mem_region(host->mmio_mem->start,
++ resource_size(host->mmio_mem));
++ release_mem_region(host->data_mem->start,
++ resource_size(host->data_mem));
+
-+static void glamo_mci_send_request(struct mmc_host *mmc,
-+ struct mmc_request *mrq);
-+static void glamo_mci_send_command(struct glamo_mci_host *host,
-+ struct mmc_command *cmd);
++ regulator_put(host->regulator);
+
-+/*
-+ * Max SD clock rate
-+ *
-+ * held at /(3 + 1) due to concerns of 100R recommended series resistor
-+ * allows 16MHz @ 4-bit --> 8MBytes/sec raw
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ * glamo_mci.sd_max_clk=10000000
-+ *
-+ * for example
-+ */
++ mmc_free_host(mmc);
+
-+static int sd_max_clk = 21000000;
-+module_param(sd_max_clk, int, 0644);
++ return 0;
++}
+
-+/*
-+ * Slow SD clock rate
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ * glamo_mci.sd_slow_ratio=8
-+ *
-+ * for example
-+ *
-+ * platform callback is used to decide effective clock rate, if not
-+ * defined then max is used, if defined and returns nonzero, rate is
-+ * divided by this factor
-+ */
+
-+static int sd_slow_ratio = 8;
-+module_param(sd_slow_ratio, int, 0644);
++#ifdef CONFIG_PM
+
-+/*
-+ * Post-power SD clock rate
-+ *
-+ * you can override this on kernel commandline using
-+ *
-+ * glamo_mci.sd_post_power_clock=1000000
-+ *
-+ * for example
-+ *
-+ * After changing power to card, clock is held at this rate until first bulk
-+ * transfer completes
-+ */
++static int glamo_mci_suspend(struct device *dev)
++{
++ struct mmc_host *mmc = dev_get_drvdata(dev);
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ int ret;
+
-+static int sd_post_power_clock = 1000000;
-+module_param(sd_post_power_clock, int, 0644);
++ disable_irq(host->irq);
+
++ mmc_host_enable(mmc);
++ ret = mmc_suspend_host(mmc, PMSG_SUSPEND);
++ mmc_host_disable(mmc);
+
-+static inline void glamomci_reg_write(struct glamo_mci_host *glamo,
-+ uint16_t reg, uint16_t val)
-+{
-+ writew(val, glamo->mmio_base + reg);
++ return ret;
+}
+
-+static inline uint16_t glamomci_reg_read(struct glamo_mci_host *glamo,
-+ uint16_t reg)
++static int glamo_mci_resume(struct device *dev)
+{
-+ return readw(glamo->mmio_base + reg);
-+}
++ struct mmc_host *mmc = dev_get_drvdata(dev);
++ struct glamo_mci_host *host = mmc_priv(mmc);
++ int ret;
+
-+static void glamomci_reg_set_bit_mask(struct glamo_mci_host *glamo,
-+ uint16_t reg, uint16_t mask,
-+ uint16_t val)
-+{
-+ uint16_t tmp;
++ mmc_host_enable(mmc);
++ glamo_mci_reset(host);
++ mdelay(10);
+
-+ val &= mask;
++ enable_irq(host->irq);
+
-+ tmp = glamomci_reg_read(glamo, reg);
-+ tmp &= ~mask;
-+ tmp |= val;
-+ glamomci_reg_write(glamo, reg, tmp);
++ ret = mmc_resume_host(host->mmc);
++
++ mmc_host_lazy_disable(host->mmc);
++
++ return ret;
+}
+
-+static void glamo_mci_reset(struct glamo_mci_host *host)
-+{
-+ glamo_engine_reset(host->core, GLAMO_ENGINE_MMC);
++static const struct dev_pm_ops glamo_mci_pm_ops = {
++ .suspend = glamo_mci_suspend,
++ .resume = glamo_mci_resume,
++ .freeze = glamo_mci_suspend,
++ .thaw = glamo_mci_resume,
++};
++#define GLAMO_MCI_PM_OPS (&glamo_mci_pm_ops)
+
-+ glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS1,
-+ (uint16_t)(host->data_mem->start));
-+ glamomci_reg_write(host, GLAMO_REG_MMC_WDATADS2,
-+ (uint16_t)(host->data_mem->start >> 16));
++#else /* CONFIG_PM */
++#define GLAMO_MCI_PM_OPS NULL
++#endif /* CONFIG_PM */
+
-+ glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS1,
-+ (uint16_t)(host->data_mem->start));
-+ glamomci_reg_write(host, GLAMO_REG_MMC_RDATADS2,
-+ (uint16_t)(host->data_mem->start >> 16));
+
-+}
++static struct platform_driver glamo_mci_driver = {
++ .probe = glamo_mci_probe,
++ .remove = glamo_mci_remove,
++ .driver = {
++ .name = "glamo-mci",
++ .owner = THIS_MODULE,
++ .pm = GLAMO_MCI_PM_OPS,
++ },
++};
+
-+static int glamo_mci_clock_disable(struct mmc_host *mmc, int lazy)
++static int __init glamo_mci_init(void)
+{
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ glamo_engine_suspend(host->core, GLAMO_ENGINE_MMC);
++ platform_driver_register(&glamo_mci_driver);
+ return 0;
+}
++module_init(glamo_mci_init);
+
-+static int glamo_mci_clock_enable(struct mmc_host *mmc)
++static void __exit glamo_mci_exit(void)
+{
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ glamo_engine_enable(host->core, GLAMO_ENGINE_MMC);
-+ return 0;
++ platform_driver_unregister(&glamo_mci_driver);
+}
++module_exit(glamo_mci_exit);
+
++MODULE_DESCRIPTION("Glamo MMC/SD Card Interface driver");
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
++MODULE_ALIAS("platform:glamo-mci");
+diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
+index fa6e9c7..ec4ac09 100644
+--- a/drivers/mtd/nand/s3c2410.c
++++ b/drivers/mtd/nand/s3c2410.c
+@@ -816,7 +816,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
+ nmtd->mtd.owner = THIS_MODULE;
+ nmtd->set = set;
+
+- if (hardware_ecc) {
++ if (!(info->platform && info->platform->software_ecc) && hardware_ecc) {
+ chip->ecc.calculate = s3c2410_nand_calculate_ecc;
+ chip->ecc.correct = s3c2410_nand_correct_data;
+ chip->ecc.mode = NAND_ECC_HW;
+diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
+index faaa9b4..53da5dd 100644
+--- a/drivers/power/Kconfig
++++ b/drivers/power/Kconfig
+@@ -131,4 +131,27 @@ config CHARGER_PCF50633
+ help
+ Say Y to include support for NXP PCF50633 Main Battery Charger.
+
++config BATTERY_BQ27000_HDQ
++ tristate "BQ27000 HDQ battery monitor driver"
++ help
++ Say Y to enable support for the battery on the Neo Freerunner
+
-+#ifndef GLAMO_MCI_WORKER
-+static void do_pio_read(struct glamo_mci_host *host, struct mmc_data *data)
-+{
-+ struct sg_mapping_iter miter;
-+ uint16_t __iomem *from_ptr = host->data_base;
++config HDQ_GPIO_BITBANG
++ bool "Generic gpio based HDQ bitbang"
++ help
++ Say Y to enable supoort for generic gpio based HDQ bitbang driver.
++ This can not be built as a module.
+
-+ dev_dbg(&host->pdev->dev, "pio_read():\n");
++config BATTERY_PLATFORM
++ tristate "Platform battery driver"
++ help
++ Say Y here to include support for battery driver that gets all
++ information from platform functions.
+
-+ sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_TO_SG);
++config CHARGER_PCF50606
++ tristate "Support for NXP PCF50606 MBC"
++ depends on MFD_PCF50606
++ help
++ Say Y to include support for NXP PCF50606 Battery Charger.
+
-+ while (sg_miter_next(&miter)) {
-+ memcpy(miter.addr, from_ptr, miter.length);
-+ from_ptr += miter.length >> 1;
+ endif # POWER_SUPPLY
+diff --git a/drivers/power/Makefile b/drivers/power/Makefile
+index a2ba7c8..01d3976 100644
+--- a/drivers/power/Makefile
++++ b/drivers/power/Makefile
+@@ -32,3 +32,8 @@ obj-$(CONFIG_BATTERY_BQ27x00) += bq27x00_battery.o
+ obj-$(CONFIG_BATTERY_DA9030) += da9030_battery.o
+ obj-$(CONFIG_BATTERY_MAX17040) += max17040_battery.o
+ obj-$(CONFIG_CHARGER_PCF50633) += pcf50633-charger.o
++obj-$(CONFIG_CHARGER_PCF50606) += pcf50606-charger.o
++obj-$(CONFIG_BATTERY_BQ27000_HDQ) += bq27000_battery.o
++obj-$(CONFIG_BATTERY_PLATFORM) += platform_battery.o
++
++obj-$(CONFIG_HDQ_GPIO_BITBANG) += hdq.o
+diff --git a/drivers/power/bq27000_battery.c b/drivers/power/bq27000_battery.c
+new file mode 100644
+index 0000000..ff5a7ef
+--- /dev/null
++++ b/drivers/power/bq27000_battery.c
+@@ -0,0 +1,478 @@
++/*
++ * Driver for batteries with bq27000 chips inside via HDQ
++ *
++ * Copyright 2008 Openmoko, Inc
++ * Andy Green <andy@openmoko.com>
++ *
++ * based on ds2760 driver, original copyright notice for that --->
++ *
++ * Copyright © 2007 Anton Vorontsov
++ * 2004-2007 Matt Reimer
++ * 2004 Szabolcs Gyurko
++ *
++ * Use consistent with the GNU GPL is permitted,
++ * provided that this copyright notice is
++ * preserved in its entirety in all copies and derived works.
++ *
++ * Author: Anton Vorontsov <cbou@mail.ru>
++ * February 2007
++ *
++ * Matt Reimer <mreimer@vpop.net>
++ * April 2004, 2005, 2007
++ *
++ * Szabolcs Gyurko <szabolcs.gyurko@tlt.hu>
++ * September 2004
++ */
++
++#include <linux/module.h>
++#include <linux/param.h>
++#include <linux/jiffies.h>
++#include <linux/delay.h>
++#include <linux/pm.h>
++#include <linux/workqueue.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <linux/bq27000_battery.h>
++#include <linux/slab.h>
+
-+ data->bytes_xfered += miter.length;
-+ }
++enum bq27000_regs {
++ /* RAM regs */
++ /* read-write after this */
++ BQ27000_CTRL = 0, /* Device Control Register */
++ BQ27000_MODE, /* Device Mode Register */
++ BQ27000_AR_L, /* At-Rate H L */
++ BQ27000_AR_H,
++ /* read-only after this */
++ BQ27000_ARTTE_L, /* At-Rate Time To Empty H L */
++ BQ27000_ARTTE_H,
++ BQ27000_TEMP_L, /* Reported Temperature H L */
++ BQ27000_TEMP_H,
++ BQ27000_VOLT_L, /* Reported Voltage H L */
++ BQ27000_VOLT_H,
++ BQ27000_FLAGS, /* Status Flags */
++ BQ27000_RSOC, /* Relative State of Charge */
++ BQ27000_NAC_L, /* Nominal Available Capacity H L */
++ BQ27000_NAC_H,
++ BQ27000_CACD_L, /* Discharge Compensated H L */
++ BQ27000_CACD_H,
++ BQ27000_CACT_L, /* Temperature Compensated H L */
++ BQ27000_CACT_H,
++ BQ27000_LMD_L, /* Last measured discharge H L */
++ BQ27000_LMD_H,
++ BQ27000_AI_L, /* Average Current H L */
++ BQ27000_AI_H,
++ BQ27000_TTE_L, /* Time to Empty H L */
++ BQ27000_TTE_H,
++ BQ27000_TTF_L, /* Time to Full H L */
++ BQ27000_TTF_H,
++ BQ27000_SI_L, /* Standby Current H L */
++ BQ27000_SI_H,
++ BQ27000_STTE_L, /* Standby Time To Empty H L */
++ BQ27000_STTE_H,
++ BQ27000_MLI_L, /* Max Load Current H L */
++ BQ27000_MLI_H,
++ BQ27000_MLTTE_L, /* Max Load Time To Empty H L */
++ BQ27000_MLTTE_H,
++ BQ27000_SAE_L, /* Available Energy H L */
++ BQ27000_SAE_H,
++ BQ27000_AP_L, /* Available Power H L */
++ BQ27000_AP_H,
++ BQ27000_TTECP_L, /* Time to Empty at Constant Power H L */
++ BQ27000_TTECP_H,
++ BQ27000_CYCL_L, /* Cycle count since learning cycle H L */
++ BQ27000_CYCL_H,
++ BQ27000_CYCT_L, /* Cycle Count Total H L */
++ BQ27000_CYCT_H,
++ BQ27000_CSOC, /* Compensated State Of Charge */
++ /* EEPROM regs */
++ /* read-write after this */
++ BQ27000_EE_EE_EN = 0x6e, /* EEPROM Program Enable */
++ BQ27000_EE_ILMD = 0x76, /* Initial Last Measured Discharge High Byte */
++ BQ27000_EE_SEDVF, /* Scaled EDVF Threshold */
++ BQ27000_EE_SEDV1, /* Scaled EDV1 Threshold */
++ BQ27000_EE_ISLC, /* Initial Standby Load Current */
++ BQ27000_EE_DMFSD, /* Digital Magnitude Filter and Self Discharge */
++ BQ27000_EE_TAPER, /* Aging Estimate Enable, Charge Termination Taper */
++ BQ27000_EE_PKCFG, /* Pack Configuration Values */
++ BQ27000_EE_IMLC, /* Initial Max Load Current or ID #3 */
++ BQ27000_EE_DCOMP, /* Discharge rate compensation constants or ID #2 */
++ BQ27000_EE_TCOMP, /* Temperature Compensation constants or ID #1 */
++};
+
-+ sg_miter_stop(&miter);
++enum bq27000_status_flags {
++ BQ27000_STATUS_CHGS = 0x80, /* 1 = being charged */
++ BQ27000_STATUS_NOACT = 0x40, /* 1 = no activity */
++ BQ27000_STATUS_IMIN = 0x20, /* 1 = Lion taper current mode */
++ BQ27000_STATUS_CI = 0x10, /* 1 = capacity likely innacurate */
++ BQ27000_STATUS_CALIP = 0x08, /* 1 = calibration in progress */
++ BQ27000_STATUS_VDQ = 0x04, /* 1 = capacity should be accurate */
++ BQ27000_STATUS_EDV1 = 0x02, /* 1 = end of discharge.. <6% left */
++ BQ27000_STATUS_EDVF = 0x01, /* 1 = no, it's really empty now */
++};
+
-+ dev_dbg(&host->pdev->dev, "pio_read(): "
-+ "complete (no more data).\n");
-+}
-+#endif
++#define NANOVOLTS_UNIT 3750
+
-+static void do_pio_write(struct glamo_mci_host *host, struct mmc_data *data)
-+{
-+ struct sg_mapping_iter miter;
-+ uint16_t __iomem *to_ptr = host->data_base;
++struct bq27000_bat_regs {
++ int ai;
++ int flags;
++ int lmd;
++ int rsoc;
++ int temp;
++ int tte;
++ int ttf;
++ int volt;
++};
+
-+ dev_dbg(&host->pdev->dev, "pio_write():\n");
-+ sg_miter_start(&miter, data->sg, data->sg_len, SG_MITER_FROM_SG);
++struct bq27000_device_info {
++ struct device *dev;
++ struct power_supply bat;
++ struct power_supply ac;
++ struct power_supply usb;
++ struct delayed_work work;
++ struct bq27000_platform_data *pdata;
+
-+ while (sg_miter_next(&miter)) {
-+ memcpy(to_ptr, miter.addr, miter.length);
-+ to_ptr += miter.length >> 1;
++ struct bq27000_bat_regs regs;
++};
+
-+ data->bytes_xfered += miter.length;
-+ }
++static unsigned int cache_time = 5000;
++module_param(cache_time, uint, 0644);
++MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+
-+ sg_miter_stop(&miter);
-+ dev_dbg(&host->pdev->dev, "pio_write(): complete\n");
-+}
++/*
++ * reading 16 bit values over HDQ has a special hazard where the
++ * hdq device firmware can update the 16-bit register during the time we
++ * read the two halves. TI document SLUS556D recommends the algorithm here
++ * to avoid trouble
++ */
+
-+static int glamo_mci_set_card_clock(struct glamo_mci_host *host, int freq)
++static int hdq_read16(struct bq27000_device_info *di, int address)
+{
-+ int real_rate = 0;
++ int acc;
++ int high;
++ int retries = 3;
+
-+ if (freq)
-+ real_rate = glamo_engine_reclock(host->core, GLAMO_ENGINE_MMC,
-+ freq);
++ while (retries--) {
+
-+ return real_rate;
-+}
++ high = (di->pdata->hdq_read)(address + 1); /* high part */
+
-+static int glamo_mci_wait_idle(struct glamo_mci_host *host,
-+ unsigned long timeout)
-+{
-+ uint16_t status;
-+ do {
-+ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+ } while (!(status & GLAMO_STAT1_MMC_IDLE) &&
-+ time_is_after_jiffies(timeout));
++ if (high < 0)
++ return high;
++ acc = (di->pdata->hdq_read)(address);
++ if (acc < 0)
++ return acc;
+
-+ if (time_is_before_eq_jiffies(timeout)) {
-+ glamo_mci_reset(host);
-+ return -ETIMEDOUT;
++ /* confirm high didn't change between reading it and low */
++ if (high == (di->pdata->hdq_read)(address + 1))
++ return (high << 8) | acc;
+ }
+
-+ return 0;
++ return -ETIME;
+}
+
-+static void glamo_mci_request_done(struct glamo_mci_host *host,
-+ struct mmc_request *mrq)
++static void bq27000_battery_external_power_changed(struct power_supply *psy)
+{
-+ mmc_request_done(host->mmc, mrq);
++ struct bq27000_device_info *di = container_of(psy, struct bq27000_device_info, bat);
++
++ dev_dbg(di->dev, "%s\n", __FUNCTION__);
++ schedule_delayed_work(&di->work, 0);
+}
+
-+static irqreturn_t glamo_mci_irq(int irq, void *data)
++static int bq27000_battery_get_property(struct power_supply *psy,
++ enum power_supply_property psp,
++ union power_supply_propval *val)
+{
-+ struct glamo_mci_host *host = data;
-+ struct mmc_request *mrq;
-+ struct mmc_command *cmd;
-+ uint16_t status;
-+
-+ if (!host->mrq || !host->mrq->cmd)
-+ return IRQ_HANDLED;
-+
-+ mrq = host->mrq;
-+ cmd = mrq->cmd;
-+
-+ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+ dev_dbg(&host->pdev->dev, "status = 0x%04x\n", status);
-+
-+ /* we ignore a data timeout report if we are also told the data came */
-+ if (status & GLAMO_STAT1_MMC_RB_DRDY)
-+ status &= ~GLAMO_STAT1_MMC_DTOUT;
-+
-+ if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
-+ cmd->error = -ETIMEDOUT;
-+ else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
-+ cmd->error = -EILSEQ;
-+
-+ if (cmd->error) {
-+ dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n", status);
-+ goto done;
-+ }
-+
-+ /* issue STOP if we have been given one to use */
-+ if (mrq->stop)
-+ glamo_mci_send_command(host, mrq->stop);
-+
-+ if (cmd->data->flags & MMC_DATA_READ)
-+#ifndef GLAMO_MCI_WORKER
-+ do_pio_read(host, cmd->data);
-+#else
-+ flush_workqueue(host->workqueue);
-+#endif
-+
-+ if (mrq->stop)
-+ mrq->stop->error = glamo_mci_wait_idle(host, jiffies + HZ);
++ int n;
++ struct bq27000_device_info *di = container_of(psy, struct bq27000_device_info, bat);
+
-+done:
-+ host->mrq = NULL;
-+ glamo_mci_request_done(host, cmd->mrq);
++ if (di->regs.rsoc < 0 && psp != POWER_SUPPLY_PROP_PRESENT)
++ return -ENODEV;
+
-+ return IRQ_HANDLED;
-+}
++ switch (psp) {
++ case POWER_SUPPLY_PROP_STATUS:
++ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+
-+#ifdef GLAMO_MCI_WORKER
-+static void glamo_mci_read_worker(struct work_struct *work)
-+{
-+ struct glamo_mci_host *host = container_of(work, struct glamo_mci_host,
-+ read_work);
-+ struct mmc_command *cmd;
-+ uint16_t status;
-+ uint16_t blocks_ready;
-+ size_t data_read = 0;
-+ size_t data_ready;
-+ struct scatterlist *sg;
-+ uint16_t __iomem *from_ptr = host->data_base;
-+ void *sg_pointer;
++ if (!di->pdata->get_charger_online_status)
++ goto use_bat;
++ if ((di->pdata->get_charger_online_status)()) {
++ /*
++ * charger is definitively present
++ * we report our state in terms of what it says it
++ * is doing
++ */
++ if (!di->pdata->get_charger_active_status)
++ goto use_bat;
+
++ if ((di->pdata->get_charger_active_status)()) {
++ val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ break;
++ }
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
++ break;
++ }
+
-+ cmd = host->mrq->cmd;
-+ sg = cmd->data->sg;
-+ do {
+ /*
-+ * TODO: How to get rid of that?
-+ * Maybe just drop it... In fact, it is already handled in
-+ * the IRQ handler, maybe we should only check cmd->error.
-+ * But the question is: what happens between the moment
-+ * the error occurs, and the moment the IRQ handler handles it?
++ * platform provided definite indication of charger presence,
++ * and it is telling us it isn't there... but we are on so we
++ * must be running from battery --->
+ */
-+ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+
-+ if (status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT))
-+ cmd->error = -ETIMEDOUT;
-+ if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR))
-+ cmd->error = -EILSEQ;
-+ if (cmd->error) {
-+ dev_info(&host->pdev->dev, "Error after cmd: 0x%x\n",
-+ status);
-+ return;
-+ }
-+
-+ blocks_ready = glamomci_reg_read(host, GLAMO_REG_MMC_RB_BLKCNT);
-+ data_ready = blocks_ready * cmd->data->blksz;
+
-+ if (data_ready == data_read)
-+ yield();
-+
-+ while (sg && data_read + sg->length <= data_ready) {
-+ sg_pointer = page_address(sg_page(sg)) + sg->offset;
-+ memcpy(sg_pointer, from_ptr, sg->length);
-+ from_ptr += sg->length >> 1;
++ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
++ break;
+
-+ data_read += sg->length;
++use_bat:
++ /*
++ * either the charger is not connected, or the
++ * platform doesn't give info about charger, use battery state
++ * but... battery state can be out of date by 4 seconds or
++ * so... use the platform callbacks if possible.
++ */
+
-+ sg = sg_next(sg);
++ /* no real activity on the battery */
++ if (di->regs.ai < 2) {
++ if (!di->regs.ttf)
++ val->intval = POWER_SUPPLY_STATUS_FULL;
++ else
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
++ break;
+ }
-+
-+ } while (sg);
-+ cmd->data->bytes_xfered = data_read;
-+}
-+#endif
-+
-+static void glamo_mci_send_command(struct glamo_mci_host *host,
-+ struct mmc_command *cmd)
-+{
-+ uint8_t u8a[6];
-+ uint16_t fire = 0;
-+ unsigned int timeout = 1000000;
-+ uint16_t *reg_resp = (uint16_t *)(host->mmio_base + GLAMO_REG_MMC_CMD_RSP1);
-+ uint16_t status;
-+ int triggers_int = 1;
-+
-+ /* if we can't do it, reject as busy */
-+ if (!(glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1) &
-+ GLAMO_STAT1_MMC_IDLE)) {
-+ cmd->error = -EBUSY;
-+ return;
-+ }
-+
-+ /* create an array in wire order for CRC computation */
-+ u8a[0] = 0x40 | (cmd->opcode & 0x3f);
-+ u8a[1] = (uint8_t)(cmd->arg >> 24);
-+ u8a[2] = (uint8_t)(cmd->arg >> 16);
-+ u8a[3] = (uint8_t)(cmd->arg >> 8);
-+ u8a[4] = (uint8_t)cmd->arg;
-+ u8a[5] = (crc7(0, u8a, 5) << 1) | 0x01;
-+
-+ /* issue the wire-order array including CRC in register order */
-+ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG1, ((u8a[4] << 8) | u8a[5]));
-+ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG2, ((u8a[2] << 8) | u8a[3]));
-+ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_REG3, ((u8a[0] << 8) | u8a[1]));
-+
-+ /* command index toggle */
-+ fire |= (host->request_counter & 1) << 12;
-+
-+ /* set type of command */
-+ switch (mmc_cmd_type(cmd)) {
-+ case MMC_CMD_BC:
-+ fire |= GLAMO_FIRE_MMC_CMDT_BNR;
-+ break;
-+ case MMC_CMD_BCR:
-+ fire |= GLAMO_FIRE_MMC_CMDT_BR;
++ /* power is actually going in or out... */
++ if (di->regs.flags < 0)
++ return di->regs.flags;
++ if (di->regs.flags & BQ27000_STATUS_CHGS)
++ val->intval = POWER_SUPPLY_STATUS_CHARGING;
++ else
++ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
-+ case MMC_CMD_AC:
-+ fire |= GLAMO_FIRE_MMC_CMDT_AND;
++ case POWER_SUPPLY_PROP_HEALTH:
++ val->intval = POWER_SUPPLY_HEALTH_UNKNOWN;
++ /* Do we have accurate readings... */
++ if (di->regs.flags < 0)
++ return di->regs.flags;
++ if (di->regs.flags & BQ27000_STATUS_VDQ)
++ val->intval = POWER_SUPPLY_HEALTH_GOOD;
+ break;
-+ case MMC_CMD_ADTC:
-+ fire |= GLAMO_FIRE_MMC_CMDT_AD;
++ case POWER_SUPPLY_PROP_VOLTAGE_NOW:
++ if (di->regs.volt < 0)
++ return di->regs.volt;
++ /* mV -> uV */
++ val->intval = di->regs.volt * 1000;
+ break;
-+ }
-+ /*
-+ * if it expects a response, set the type expected
-+ *
-+ * R1, Length : 48bit, Normal response
-+ * R1b, Length : 48bit, same R1, but added card busy status
-+ * R2, Length : 136bit (really 128 bits with CRC snipped)
-+ * R3, Length : 48bit (OCR register value)
-+ * R4, Length : 48bit, SDIO_OP_CONDITION, Reverse SDIO Card
-+ * R5, Length : 48bit, IO_RW_DIRECTION, Reverse SDIO Card
-+ * R6, Length : 48bit (RCA register)
-+ * R7, Length : 48bit (interface condition, VHS(voltage supplied),
-+ * check pattern, CRC7)
-+ */
-+ switch (mmc_resp_type(cmd)) {
-+ case MMC_RSP_R1: /* same index as R6 and R7 */
-+ fire |= GLAMO_FIRE_MMC_RSPT_R1;
++ case POWER_SUPPLY_PROP_CURRENT_NOW:
++ if (di->regs.flags < 0)
++ return di->regs.flags;
++ if (di->regs.flags & BQ27000_STATUS_CHGS)
++ n = -NANOVOLTS_UNIT;
++ else
++ n = NANOVOLTS_UNIT;
++ if (di->regs.ai < 0)
++ return di->regs.ai;
++ val->intval = (di->regs.ai * n) / di->pdata->rsense_mohms;
+ break;
-+ case MMC_RSP_R1B:
-+ fire |= GLAMO_FIRE_MMC_RSPT_R1b;
++ case POWER_SUPPLY_PROP_CHARGE_FULL:
++ if (di->regs.lmd < 0)
++ return di->regs.lmd;
++ val->intval = (di->regs.lmd * 3570) / di->pdata->rsense_mohms;
+ break;
-+ case MMC_RSP_R2:
-+ fire |= GLAMO_FIRE_MMC_RSPT_R2;
++ case POWER_SUPPLY_PROP_TEMP:
++ if (di->regs.temp < 0)
++ return di->regs.temp;
++ /* K (in 0.25K units) is 273.15 up from C (in 0.1C)*/
++ /* 10926 = 27315 * 4 / 10 */
++ val->intval = (((long)di->regs.temp * 10l) - 10926) / 4;
+ break;
-+ case MMC_RSP_R3:
-+ fire |= GLAMO_FIRE_MMC_RSPT_R3;
++ case POWER_SUPPLY_PROP_TECHNOLOGY:
++ val->intval = POWER_SUPPLY_TECHNOLOGY_LION;
+ break;
-+ /* R4 and R5 supported by chip not defined in linux/mmc/core.h (sdio) */
-+ }
-+ /*
-+ * From the command index, set up the command class in the host ctrllr
-+ *
-+ * missing guys present on chip but couldn't figure out how to use yet:
-+ * 0x0 "stream read"
-+ * 0x9 "cancel running command"
-+ */
-+ switch (cmd->opcode) {
-+ case MMC_READ_SINGLE_BLOCK:
-+ fire |= GLAMO_FIRE_MMC_CC_SBR; /* single block read */
++ case POWER_SUPPLY_PROP_CAPACITY:
++ val->intval = di->regs.rsoc;
++ if (val->intval < 0)
++ return val->intval;
+ break;
-+ case MMC_SWITCH: /* 64 byte payload */
-+ case SD_APP_SEND_SCR:
-+ case MMC_READ_MULTIPLE_BLOCK:
-+ /* we will get an interrupt off this */
-+ if (!cmd->mrq->stop) {
-+ /* multiblock no stop */
-+ fire |= GLAMO_FIRE_MMC_CC_MBRNS;
-+ } else {
-+ /* multiblock with stop */
-+ fire |= GLAMO_FIRE_MMC_CC_MBRS;
-+ }
++ case POWER_SUPPLY_PROP_PRESENT:
++ val->intval = !(di->regs.rsoc < 0);
+ break;
-+ case MMC_WRITE_BLOCK:
-+ fire |= GLAMO_FIRE_MMC_CC_SBW; /* single block write */
++ case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW:
++ if (di->regs.tte < 0)
++ return di->regs.tte;
++ val->intval = 60 * di->regs.tte;
+ break;
-+ case MMC_WRITE_MULTIPLE_BLOCK:
-+ if (cmd->mrq->stop) {
-+ /* multiblock with stop */
-+ fire |= GLAMO_FIRE_MMC_CC_MBWS;
-+ } else {
-+ /* multiblock NO stop-- 'RESERVED'? */
-+ fire |= GLAMO_FIRE_MMC_CC_MBWNS;
-+ }
++ case POWER_SUPPLY_PROP_TIME_TO_FULL_NOW:
++ if (di->regs.ttf < 0)
++ return di->regs.ttf;
++ val->intval = 60 * di->regs.ttf;
+ break;
-+ case MMC_STOP_TRANSMISSION:
-+ fire |= GLAMO_FIRE_MMC_CC_STOP; /* STOP */
-+ triggers_int = 0;
++ case POWER_SUPPLY_PROP_ONLINE:
++ if (di->pdata->get_charger_online_status)
++ val->intval = (di->pdata->get_charger_online_status)();
++ else
++ return -EINVAL;
+ break;
+ default:
-+ fire |= GLAMO_FIRE_MMC_CC_BASIC; /* "basic command" */
-+ triggers_int = 0;
-+ break;
++ return -EINVAL;
+ }
+
-+ if (cmd->data)
-+ host->mrq = cmd->mrq;
++ return 0;
++}
++
++static void bq27000_battery_work(struct work_struct *work)
++{
++ struct bq27000_device_info *di =
++ container_of(work, struct bq27000_device_info, work.work);
++
++ if ((di->pdata->hdq_initialized)()) {
++ struct bq27000_bat_regs regs;
++
++ regs.ai = hdq_read16(di, BQ27000_AI_L);
++ regs.flags = (di->pdata->hdq_read)(BQ27000_FLAGS);
++ regs.lmd = hdq_read16(di, BQ27000_LMD_L);
++ regs.rsoc = (di->pdata->hdq_read)(BQ27000_RSOC);
++ regs.temp = hdq_read16(di, BQ27000_TEMP_L);
++ regs.tte = hdq_read16(di, BQ27000_TTE_L);
++ regs.ttf = hdq_read16(di, BQ27000_TTF_L);
++ regs.volt = hdq_read16(di, BQ27000_VOLT_L);
++
++ if (memcmp (®s, &di->regs, sizeof(regs)) != 0) {
++ di->regs = regs;
++ power_supply_changed(&di->bat);
++ }
++ }
++
++ if (!schedule_delayed_work(&di->work, cache_time))
++ dev_err(di->dev, "battery service reschedule failed\n");
++}
++
++static enum power_supply_property bq27000_battery_props[] = {
++ POWER_SUPPLY_PROP_STATUS,
++ POWER_SUPPLY_PROP_HEALTH,
++ POWER_SUPPLY_PROP_VOLTAGE_NOW,
++ POWER_SUPPLY_PROP_CURRENT_NOW,
++ POWER_SUPPLY_PROP_CHARGE_FULL,
++ POWER_SUPPLY_PROP_TEMP,
++ POWER_SUPPLY_PROP_TECHNOLOGY,
++ POWER_SUPPLY_PROP_PRESENT,
++ POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
++ POWER_SUPPLY_PROP_TIME_TO_FULL_NOW,
++ POWER_SUPPLY_PROP_CAPACITY,
++ POWER_SUPPLY_PROP_ONLINE
++};
+
-+ /* always largest timeout */
-+ glamomci_reg_write(host, GLAMO_REG_MMC_TIMEOUT, 0xfff);
++static int bq27000_battery_probe(struct platform_device *pdev)
++{
++ int retval = 0;
++ struct bq27000_device_info *di;
++ struct bq27000_platform_data *pdata;
+
-+ /* Generate interrupt on txfer */
-+ glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC, 0xff36,
-+ 0x0800 |
-+ GLAMO_BASIC_MMC_NO_CLK_RD_WAIT |
-+ GLAMO_BASIC_MMC_EN_COMPL_INT |
-+ GLAMO_BASIC_MMC_EN_DATA_PUPS |
-+ GLAMO_BASIC_MMC_EN_CMD_PUP);
++ dev_info(&pdev->dev, "BQ27000 Battery Driver (C) 2008 Openmoko, Inc\n");
+
-+ /* send the command out on the wire */
-+ /* dev_info(&host->pdev->dev, "Using FIRE %04X\n", fire); */
-+ glamomci_reg_write(host, GLAMO_REG_MMC_CMD_FIRE, fire);
++ di = kzalloc(sizeof(*di), GFP_KERNEL);
++ if (!di) {
++ retval = -ENOMEM;
++ goto di_alloc_failed;
++ }
+
-+ /* we are deselecting card? because it isn't going to ack then... */
-+ if ((cmd->opcode == 7) && (cmd->arg == 0))
-+ return;
++ platform_set_drvdata(pdev, di);
+
-+ /*
-+ * we must spin until response is ready or timed out
-+ * -- we don't get interrupts unless there is a bulk rx
-+ */
-+ do
-+ status = glamomci_reg_read(host, GLAMO_REG_MMC_RB_STAT1);
-+ while (((((status >> 15) & 1) != (host->request_counter & 1)) ||
-+ (!(status & (GLAMO_STAT1_MMC_RB_RRDY |
-+ GLAMO_STAT1_MMC_RTOUT |
-+ GLAMO_STAT1_MMC_DTOUT |
-+ GLAMO_STAT1_MMC_BWERR |
-+ GLAMO_STAT1_MMC_BRERR)))) && (timeout--));
++ pdata = pdev->dev.platform_data;
++ di->dev = &pdev->dev;
++ /* di->w1_dev = pdev->dev.parent; */
++ di->bat.name = pdata->name;
++ di->bat.type = POWER_SUPPLY_TYPE_BATTERY;
++ di->bat.properties = bq27000_battery_props;
++ di->bat.num_properties = ARRAY_SIZE(bq27000_battery_props);
++ di->bat.get_property = bq27000_battery_get_property;
++ di->bat.external_power_changed =
++ bq27000_battery_external_power_changed;
++ di->bat.use_for_apm = 1;
++ di->pdata = pdata;
+
-+ if ((status & (GLAMO_STAT1_MMC_RTOUT | GLAMO_STAT1_MMC_DTOUT)) ||
-+ (timeout == 0)) {
-+ cmd->error = -ETIMEDOUT;
-+ } else if (status & (GLAMO_STAT1_MMC_BWERR | GLAMO_STAT1_MMC_BRERR)) {
-+ cmd->error = -EILSEQ;
++ retval = power_supply_register(&pdev->dev, &di->bat);
++ if (retval) {
++ dev_err(di->dev, "failed to register battery\n");
++ goto batt_failed;
+ }
+
-+ if (cmd->flags & MMC_RSP_PRESENT) {
-+ if (cmd->flags & MMC_RSP_136) {
-+ cmd->resp[3] = readw(®_resp[0]) |
-+ (readw(®_resp[1]) << 16);
-+ cmd->resp[2] = readw(®_resp[2]) |
-+ (readw(®_resp[3]) << 16);
-+ cmd->resp[1] = readw(®_resp[4]) |
-+ (readw(®_resp[5]) << 16);
-+ cmd->resp[0] = readw(®_resp[6]) |
-+ (readw(®_resp[7]) << 16);
-+ } else {
-+ cmd->resp[0] = (readw(®_resp[0]) >> 8) |
-+ (readw(®_resp[1]) << 8) |
-+ (readw(®_resp[2]) << 24);
-+ }
-+ }
++ INIT_DELAYED_WORK(&di->work, bq27000_battery_work);
+
-+#ifdef GLAMO_MCI_WORKER
-+ /* We'll only get an interrupt when all data has been transfered.
-+ By starting to copy data when it's avaiable we can increase
-+ throughput by up to 30%. */
-+ if (cmd->data && (cmd->data->flags & MMC_DATA_READ))
-+ queue_work(host->workqueue, &host->read_work);
-+#endif
++ if (!schedule_delayed_work(&di->work, 0))
++ dev_err(di->dev, "failed to schedule bq27000_battery_work\n");
++
++ return 0;
+
++batt_failed:
++ kfree(di);
++di_alloc_failed:
++ return retval;
+}
+
-+static int glamo_mci_prepare_pio(struct glamo_mci_host *host,
-+ struct mmc_data *data)
++static int bq27000_battery_remove(struct platform_device *pdev)
+{
-+ /* set up the block info */
-+ glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKLEN, data->blksz);
-+ glamomci_reg_write(host, GLAMO_REG_MMC_DATBLKCNT, data->blocks);
++ struct bq27000_device_info *di = platform_get_drvdata(pdev);
+
-+ data->bytes_xfered = 0;
++ cancel_delayed_work(&di->work);
+
-+ /* if write, prep the write into the shared RAM before the command */
-+ if (data->flags & MMC_DATA_WRITE)
-+ do_pio_write(host, data);
++ power_supply_unregister(&di->bat);
+
-+ dev_dbg(&host->pdev->dev, "(blksz=%d, count=%d)\n",
-+ data->blksz, data->blocks);
+ return 0;
+}
+
-+static void glamo_mci_send_request(struct mmc_host *mmc,
-+ struct mmc_request *mrq)
++void bq27000_charging_state_change(struct platform_device *pdev)
+{
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ struct mmc_command *cmd = mrq->cmd;
-+
-+ host->request_counter++;
-+ if (cmd->data) {
-+ if (glamo_mci_prepare_pio(host, cmd->data)) {
-+ cmd->error = -EIO;
-+ cmd->data->error = -EIO;
-+ goto done;
-+ }
-+ }
++ struct bq27000_device_info *di = platform_get_drvdata(pdev);
+
-+ dev_dbg(&host->pdev->dev, "cmd 0x%x, "
-+ "arg 0x%x data=%p mrq->stop=%p flags 0x%x\n",
-+ cmd->opcode, cmd->arg, cmd->data, cmd->mrq->stop,
-+ cmd->flags);
++ if (!di)
++ return;
++}
++EXPORT_SYMBOL_GPL(bq27000_charging_state_change);
+
-+ glamo_mci_send_command(host, cmd);
++#ifdef CONFIG_PM
+
-+ /*
-+ * if we don't have bulk data to take care of, we're done
-+ */
-+ if (!cmd->data || cmd->error)
-+ goto done;
++static int bq27000_battery_suspend(struct platform_device *pdev,
++ pm_message_t state)
++{
++ struct bq27000_device_info *di = platform_get_drvdata(pdev);
+
-+ /*
-+ * Otherwise can can use the interrupt as async completion --
-+ * if there is read data coming, or we wait for write data to complete,
-+ * exit without mmc_request_done() as the payload interrupt
-+ * will service it
-+ */
-+ dev_dbg(&host->pdev->dev, "Waiting for payload data\n");
-+ return;
-+done:
-+ if (!cmd->error)
-+ cmd->error = glamo_mci_wait_idle(host, jiffies + 2 * HZ);
-+ glamo_mci_request_done(host, mrq);
++ cancel_delayed_work(&di->work);
++ return 0;
+}
+
-+static void glamo_mci_set_power_mode(struct glamo_mci_host *host,
-+ unsigned char power_mode)
++static int bq27000_battery_resume(struct platform_device *pdev)
+{
-+ int ret;
++ struct bq27000_device_info *di = platform_get_drvdata(pdev);
+
-+ if (power_mode == host->power_mode)
-+ return;
++ schedule_delayed_work(&di->work, 0);
++ return 0;
++}
+
-+ switch (power_mode) {
-+ case MMC_POWER_UP:
-+ if (host->power_mode == MMC_POWER_OFF) {
-+ ret = regulator_enable(host->regulator);
-+ if (ret)
-+ dev_err(&host->pdev->dev,
-+ "Failed to enable regulator: %d\n",
-+ ret);
-+ }
-+ break;
-+ case MMC_POWER_ON:
-+ break;
-+ case MMC_POWER_OFF:
-+ default:
-+ ret = regulator_disable(host->regulator);
-+ if (ret)
-+ dev_warn(&host->pdev->dev,
-+ "Failed to disable regulator: %d\n",
-+ ret);
-+ break;
-+ }
-+ host->power_mode = power_mode;
++#else
++
++#define bq27000_battery_suspend NULL
++#define bq27000_battery_resume NULL
++
++#endif /* CONFIG_PM */
++
++static struct platform_driver bq27000_battery_driver = {
++ .driver = {
++ .name = "bq27000-battery",
++ },
++ .probe = bq27000_battery_probe,
++ .remove = bq27000_battery_remove,
++ .suspend = bq27000_battery_suspend,
++ .resume = bq27000_battery_resume,
++};
++
++static int __init bq27000_battery_init(void)
++{
++ return platform_driver_register(&bq27000_battery_driver);
+}
+
-+static void glamo_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
++static void __exit bq27000_battery_exit(void)
+{
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ int bus_width = 0;
-+ int rate;
-+ int sd_drive;
-+ int ret;
++ platform_driver_unregister(&bq27000_battery_driver);
++}
+
-+ mmc_host_enable(mmc);
++module_init(bq27000_battery_init);
++module_exit(bq27000_battery_exit);
+
-+ /* Set power */
-+ glamo_mci_set_power_mode(host, ios->power_mode);
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
++MODULE_DESCRIPTION("bq27000 battery driver");
+diff --git a/drivers/power/hdq.c b/drivers/power/hdq.c
+new file mode 100644
+index 0000000..cea024f
+--- /dev/null
++++ b/drivers/power/hdq.c
+@@ -0,0 +1,512 @@
++/*
++ * HDQ generic GPIO bitbang driver using FIQ
++ *
++ * (C) 2006-2007 by Openmoko, Inc.
++ * Author: Andy Green <andy@openmoko.com>
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ */
+
-+ if (host->vdd != ios->vdd) {
-+ ret = mmc_regulator_set_ocr(host->regulator, ios->vdd);
-+ if (ret)
-+ dev_err(&host->pdev->dev,
-+ "Failed to set regulator voltage: %d\n", ret);
-+ else
-+ host->vdd = ios->vdd;
-+ }
++#include <linux/kernel.h>
++#include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/platform_device.h>
++#include <linux/hdq.h>
+
-+ rate = glamo_mci_set_card_clock(host, ios->clock);
++#define HDQ_READ 0
++#define HDQ_WRITE 0x80
+
-+ if ((ios->power_mode == MMC_POWER_ON) ||
-+ (ios->power_mode == MMC_POWER_UP)) {
-+ dev_info(&host->pdev->dev,
-+ "powered (vdd = %hu) clk: %dkHz div=%hu (req: %ukHz). "
-+ "Bus width=%d\n", ios->vdd,
-+ rate / 1000, 0,
-+ ios->clock / 1000, (int)ios->bus_width);
-+ } else {
-+ dev_info(&host->pdev->dev, "glamo_mci_set_ios: power down.\n");
-+ }
++enum hdq_bitbang_states {
++ HDQB_IDLE = 0,
++ HDQB_TX_BREAK,
++ HDQB_TX_BREAK_RECOVERY,
++ HDQB_ADS_CALC,
++ HDQB_ADS_LOW,
++ HDQB_ADS_HIGH,
++ HDQB_WAIT_RX,
++ HDQB_DATA_RX_LOW,
++ HDQB_DATA_RX_HIGH,
++ HDQB_WAIT_TX,
++};
+
-+ /* set bus width */
-+ if (ios->bus_width == MMC_BUS_WIDTH_4)
-+ bus_width = GLAMO_BASIC_MMC_EN_4BIT_DATA;
++static struct hdq_priv {
++ u8 hdq_probed; /* nonzero after HDQ driver probed */
++ struct mutex hdq_lock; /* if you want to use hdq, you have to take lock */
++ u8 hdq_ads; /* b7..b6 = register address, b0 = r/w */
++ u8 hdq_tx_data; /* data to tx for write action */
++ u8 hdq_rx_data; /* data received in read action */
++ u8 hdq_request_ctr; /* incremented by "user" to request a transfer */
++ u8 hdq_transaction_ctr; /* incremented after each transfer */
++ u8 hdq_error; /* 0 = no error */
++ u8 hdq_ctr;
++ u8 hdq_ctr2;
++ u8 hdq_bit;
++ u8 hdq_shifter;
++ u8 hdq_tx_data_done;
++ enum hdq_bitbang_states hdq_state;
++ int reported_error;
+
-+ sd_drive = (rate * 4) / host->clk_rate;
-+ if (sd_drive > 3)
-+ sd_drive = 3;
++ struct hdq_platform_data *pdata;
++} hdq_priv;
+
-+ glamomci_reg_set_bit_mask(host, GLAMO_REG_MMC_BASIC,
-+ GLAMO_BASIC_MMC_EN_4BIT_DATA | 0xc0,
-+ bus_width | sd_drive << 6);
+
-+ if (host->power_mode == MMC_POWER_OFF)
-+ mmc_host_disable(host->mmc);
-+ else
-+ mmc_host_lazy_disable(host->mmc);
++static void hdq_bad(void)
++{
++ if (!hdq_priv.reported_error)
++ printk(KERN_ERR "HDQ error: %d\n", hdq_priv.hdq_error);
++ hdq_priv.reported_error = 1;
+}
+
-+
-+/*
-+ * no physical write protect supported by us
-+ */
-+static int glamo_mci_get_ro(struct mmc_host *mmc)
++static void hdq_good(void)
+{
-+ return 0;
++ if (hdq_priv.reported_error)
++ printk(KERN_INFO "HDQ responds again\n");
++ hdq_priv.reported_error = 0;
+}
+
-+static struct mmc_host_ops glamo_mci_ops = {
-+ .enable = glamo_mci_clock_enable,
-+ .disable = glamo_mci_clock_disable,
-+ .request = glamo_mci_send_request,
-+ .set_ios = glamo_mci_set_ios,
-+ .get_ro = glamo_mci_get_ro,
-+};
-+
-+static int glamo_mci_probe(struct platform_device *pdev)
++int hdq_fiq_handler(void)
+{
-+ struct mmc_host *mmc;
-+ struct glamo_mci_host *host;
-+ struct glamo_core *core = dev_get_drvdata(pdev->dev.parent);
-+ int ret;
-+
-+ dev_info(&pdev->dev, "glamo_mci driver (C)2007 Openmoko, Inc\n");
-+
-+ mmc = mmc_alloc_host(sizeof(struct glamo_mci_host), &pdev->dev);
-+ if (!mmc) {
-+ ret = -ENOMEM;
-+ goto probe_out;
-+ }
-+
-+ host = mmc_priv(mmc);
-+ host->mmc = mmc;
-+ host->pdev = pdev;
-+ if (core->pdata)
-+ host->pdata = core->pdata->mmc_data;
-+ host->power_mode = MMC_POWER_OFF;
-+ host->core = core;
-+ host->irq = platform_get_irq(pdev, 0);
++ if (!hdq_priv.hdq_probed)
++ return 0;
+
-+#ifdef GLAMO_MCI_WORKER
-+ INIT_WORK(&host->read_work, glamo_mci_read_worker);
-+ host->workqueue = create_singlethread_workqueue("glamo-mci-read");
-+#endif
++ switch (hdq_priv.hdq_state) {
++ case HDQB_IDLE:
++ if (hdq_priv.hdq_request_ctr == hdq_priv.hdq_transaction_ctr)
++ break;
++ hdq_priv.hdq_ctr = 250 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.pdata->gpio_set(0);
++ hdq_priv.pdata->gpio_dir_out();
++ hdq_priv.hdq_tx_data_done = 0;
++ hdq_priv.hdq_state = HDQB_TX_BREAK;
++ break;
+
-+ host->regulator = regulator_get(pdev->dev.parent, "SD_3V3");
-+ if (IS_ERR(host->regulator)) {
-+ dev_err(&pdev->dev, "Cannot proceed without regulator.\n");
-+ ret = PTR_ERR(host->regulator);
-+ goto probe_free_host;
-+ }
++ case HDQB_TX_BREAK: /* issue low for > 190us */
++ if (--hdq_priv.hdq_ctr == 0) {
++ hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_state = HDQB_TX_BREAK_RECOVERY;
++ hdq_priv.pdata->gpio_set(1);
++ }
++ break;
+
-+ host->mmio_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-+ if (!host->mmio_mem) {
-+ dev_err(&pdev->dev,
-+ "failed to get io memory region resouce.\n");
-+ ret = -ENOENT;
-+ goto probe_regulator_put;
-+ }
++ case HDQB_TX_BREAK_RECOVERY: /* issue low for > 40us */
++ if (--hdq_priv.hdq_ctr)
++ break;
++ hdq_priv.hdq_shifter = hdq_priv.hdq_ads;
++ hdq_priv.hdq_bit = 8; /* 8 bits of ads / rw */
++ hdq_priv.hdq_tx_data_done = 0; /* doing ads */
++ /* fallthru on last one */
++ case HDQB_ADS_CALC:
++ if (hdq_priv.hdq_shifter & 1)
++ hdq_priv.hdq_ctr = 50 / HDQ_SAMPLE_PERIOD_US;
++ else
++ hdq_priv.hdq_ctr = 120 / HDQ_SAMPLE_PERIOD_US;
++ /* carefully precompute the other phase length */
++ hdq_priv.hdq_ctr2 = (210 - (hdq_priv.hdq_ctr * HDQ_SAMPLE_PERIOD_US)) /
++ HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_state = HDQB_ADS_LOW;
++ hdq_priv.hdq_shifter >>= 1;
++ hdq_priv.hdq_bit--;
++ hdq_priv.pdata->gpio_set(0);
++ break;
+
-+ host->mmio_mem = request_mem_region(host->mmio_mem->start,
-+ resource_size(host->mmio_mem),
-+ pdev->name);
++ case HDQB_ADS_LOW:
++ if (--hdq_priv.hdq_ctr)
++ break;
++ hdq_priv.pdata->gpio_set(1);
++ hdq_priv.hdq_state = HDQB_ADS_HIGH;
++ break;
+
-+ if (!host->mmio_mem) {
-+ dev_err(&pdev->dev, "failed to request io memory region.\n");
-+ ret = -ENOENT;
-+ goto probe_regulator_put;
-+ }
++ case HDQB_ADS_HIGH:
++ if (--hdq_priv.hdq_ctr2 > 1) /* account for HDQB_ADS_CALC */
++ break;
++ if (hdq_priv.hdq_bit) { /* more bits to do */
++ hdq_priv.hdq_state = HDQB_ADS_CALC;
++ break;
++ }
++ /* no more bits, wait it out until hdq_priv.hdq_ctr2 exhausted */
++ if (hdq_priv.hdq_ctr2)
++ break;
++ /* ok no more bits and very last state */
++ hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
++ /* FIXME 0 = read */
++ if (hdq_priv.hdq_ads & 0x80) { /* write the byte out */
++ /* set delay before payload */
++ hdq_priv.hdq_ctr = 300 / HDQ_SAMPLE_PERIOD_US;
++ /* already high, no need to write */
++ hdq_priv.hdq_state = HDQB_WAIT_TX;
++ break;
++ }
++ /* read the next byte */
++ hdq_priv.hdq_bit = 8; /* 8 bits of data */
++ hdq_priv.hdq_ctr = 2500 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_state = HDQB_WAIT_RX;
++ hdq_priv.pdata->gpio_dir_in();
++ break;
+
-+ host->mmio_base = ioremap(host->mmio_mem->start,
-+ resource_size(host->mmio_mem));
-+ if (!host->mmio_base) {
-+ dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
-+ ret = -EINVAL;
-+ goto probe_free_mem_region_mmio;
-+ }
++ case HDQB_WAIT_TX: /* issue low for > 40us */
++ if (--hdq_priv.hdq_ctr)
++ break;
++ if (!hdq_priv.hdq_tx_data_done) { /* was that the data sent? */
++ hdq_priv.hdq_tx_data_done++;
++ hdq_priv.hdq_shifter = hdq_priv.hdq_tx_data;
++ hdq_priv.hdq_bit = 8; /* 8 bits of data */
++ hdq_priv.hdq_state = HDQB_ADS_CALC; /* start sending */
++ break;
++ }
++ hdq_priv.hdq_error = 0;
++ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
++ hdq_priv.hdq_state = HDQB_IDLE; /* all tx is done */
++ /* idle in input mode, it's pulled up by 10K */
++ hdq_priv.pdata->gpio_dir_in();
++ break;
+
++ case HDQB_WAIT_RX: /* wait for battery to talk to us */
++ if (hdq_priv.pdata->gpio_get() == 0) {
++ /* it talks to us! */
++ hdq_priv.hdq_ctr2 = 1;
++ hdq_priv.hdq_bit = 8; /* 8 bits of data */
++ /* timeout */
++ hdq_priv.hdq_ctr = 500 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
++ break;
++ }
++ if (--hdq_priv.hdq_ctr == 0) { /* timed out, error */
++ hdq_priv.hdq_error = 1;
++ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
++ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
++ }
++ break;
+
-+ /* Get ahold of our data buffer we use for data in and out on MMC */
-+ host->data_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-+ if (!host->data_mem) {
-+ dev_err(&pdev->dev,
-+ "failed to get io memory region resource.\n");
-+ ret = -ENOENT;
-+ goto probe_iounmap_mmio;
-+ }
++ /*
++ * HDQ basically works by measuring the low time of the bit cell
++ * 32-50us --> '1', 80 - 145us --> '0'
++ */
+
-+ host->data_mem = request_mem_region(host->data_mem->start,
-+ resource_size(host->data_mem),
-+ pdev->name);
++ case HDQB_DATA_RX_LOW:
++ if (hdq_priv.pdata->gpio_get()) {
++ hdq_priv.hdq_rx_data >>= 1;
++ if (hdq_priv.hdq_ctr2 <= (65 / HDQ_SAMPLE_PERIOD_US))
++ hdq_priv.hdq_rx_data |= 0x80;
+
-+ if (!host->data_mem) {
-+ dev_err(&pdev->dev, "failed to request io memory region.\n");
-+ ret = -ENOENT;
-+ goto probe_iounmap_mmio;
-+ }
-+ host->data_base = ioremap(host->data_mem->start,
-+ resource_size(host->data_mem));
++ if (--hdq_priv.hdq_bit == 0) {
++ hdq_priv.hdq_error = 0;
++ hdq_priv.hdq_transaction_ctr =
++ hdq_priv.hdq_request_ctr;
+
-+ if (host->data_base == 0) {
-+ dev_err(&pdev->dev, "failed to ioremap() io memory region.\n");
-+ ret = -EINVAL;
-+ goto probe_free_mem_region_data;
-+ }
++ hdq_priv.hdq_state = HDQB_IDLE;
++ } else
++ hdq_priv.hdq_state = HDQB_DATA_RX_HIGH;
++ /* timeout */
++ hdq_priv.hdq_ctr = 1000 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_ctr2 = 1;
++ break;
++ }
++ hdq_priv.hdq_ctr2++;
++ if (--hdq_priv.hdq_ctr)
++ break;
++ /* timed out, error */
++ hdq_priv.hdq_error = 2;
++ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
++ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
++ break;
+
-+ ret = request_threaded_irq(host->irq, NULL, glamo_mci_irq, IRQF_SHARED,
-+ pdev->name, host);
-+ if (ret) {
-+ dev_err(&pdev->dev, "failed to register irq.\n");
-+ goto probe_iounmap_data;
++ case HDQB_DATA_RX_HIGH:
++ if (!hdq_priv.pdata->gpio_get()) {
++ /* it talks to us! */
++ hdq_priv.hdq_ctr2 = 1;
++ /* timeout */
++ hdq_priv.hdq_ctr = 400 / HDQ_SAMPLE_PERIOD_US;
++ hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
++ break;
++ }
++ if (--hdq_priv.hdq_ctr)
++ break;
++ /* timed out, error */
++ hdq_priv.hdq_error = 3;
++ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
++
++ /* we're in input mode already */
++ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
++ break;
+ }
+
++ /* Are we interested in keeping the FIQ source alive ? */
++ if (hdq_priv.hdq_state != HDQB_IDLE)
++ return 1;
++ else
++ return 0;
++}
++static int fiq_busy(void)
++{
++ int request = (volatile u8)hdq_priv.hdq_request_ctr;
++ int transact = (volatile u8)hdq_priv.hdq_transaction_ctr;
+
-+ host->vdd = 0;
-+ host->clk_rate = glamo_pll_rate(host->core, GLAMO_PLL1);
+
-+ /* explain our host controller capabilities */
-+ mmc->ops = &glamo_mci_ops;
-+ mmc->ocr_avail = mmc_regulator_get_ocrmask(host->regulator);
-+ mmc->caps = MMC_CAP_4_BIT_DATA |
-+ MMC_CAP_MMC_HIGHSPEED |
-+ MMC_CAP_SD_HIGHSPEED;
++ return (request != transact);
++}
+
-+ if (host->pdata->nonremovable)
-+ mmc->caps |= MMC_CAP_NONREMOVABLE;
++int hdq_initialized(void)
++{
++ return hdq_priv.hdq_probed;
++}
++EXPORT_SYMBOL_GPL(hdq_initialized);
+
-+ mmc->f_min = host->clk_rate / 256;
-+ mmc->f_max = sd_max_clk;
++int hdq_read(int address)
++{
++ int count_sleeps = 5;
++ int ret = -ETIME;
+
-+ mmc->max_blk_count = (1 << 16) - 1; /* GLAMO_REG_MMC_RB_BLKCNT */
-+ mmc->max_blk_size = (1 << 12) - 1; /* GLAMO_REG_MMC_RB_BLKLEN */
-+ mmc->max_req_size = resource_size(host->data_mem);
-+ mmc->max_seg_size = mmc->max_req_size;
-+ mmc->max_phys_segs = 128;
-+ mmc->max_hw_segs = 128;
++ if (!hdq_priv.hdq_probed)
++ return -EINVAL;
+
-+ if (mmc->ocr_avail < 0) {
-+ dev_warn(&pdev->dev,
-+ "Failed to get ocr list for regulator: %d.\n",
-+ mmc->ocr_avail);
-+ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-+ }
++ mutex_lock(&hdq_priv.hdq_lock);
+
-+ platform_set_drvdata(pdev, mmc);
++ hdq_priv.hdq_error = 0;
++ hdq_priv.hdq_ads = address | HDQ_READ;
++ hdq_priv.hdq_request_ctr++;
++ hdq_priv.pdata->kick_fiq();
++ /*
++ * FIQ takes care of it while we block our calling process
++ * But we're not spinning -- other processes run normally while
++ * we wait for the result
++ */
++ while (count_sleeps--) {
++ msleep(10); /* valid transaction always completes in < 10ms */
+
-+ mmc->caps |= MMC_CAP_DISABLE;
-+ mmc_set_disable_delay(mmc, 1000 / 16);
++ if (fiq_busy())
++ continue;
+
-+ mmc_host_enable(mmc);
-+ glamo_mci_reset(host);
++ if (hdq_priv.hdq_error) {
++ hdq_bad();
++ goto done; /* didn't see a response in good time */
++ }
++ hdq_good();
+
-+ ret = mmc_add_host(mmc);
-+ if (ret) {
-+ dev_err(&pdev->dev, "failed to add mmc host.\n");
-+ goto probe_mmc_host_disable;
++ ret = hdq_priv.hdq_rx_data;
++ goto done;
+ }
+
-+ mmc_host_lazy_disable(mmc);
-+
-+ return 0;
-+
-+probe_mmc_host_disable:
-+ mmc_host_disable(mmc);
-+ free_irq(host->irq, host);
-+probe_iounmap_data:
-+ iounmap(host->data_base);
-+probe_free_mem_region_data:
-+ release_mem_region(host->data_mem->start,
-+ resource_size(host->data_mem));
-+probe_iounmap_mmio:
-+ iounmap(host->mmio_base);
-+probe_free_mem_region_mmio:
-+ release_mem_region(host->mmio_mem->start,
-+ resource_size(host->mmio_mem));
-+probe_regulator_put:
-+ regulator_put(host->regulator);
-+probe_free_host:
-+#ifdef GLAMO_MCI_WORKER
-+ destroy_workqueue(host->workqueue);
-+#endif
-+ mmc_free_host(mmc);
-+probe_out:
++done:
++ mutex_unlock(&hdq_priv.hdq_lock);
+ return ret;
+}
++EXPORT_SYMBOL_GPL(hdq_read);
+
-+static int glamo_mci_remove(struct platform_device *pdev)
++int hdq_write(int address, u8 data)
+{
-+ struct mmc_host *mmc = platform_get_drvdata(pdev);
-+ struct glamo_mci_host *host = mmc_priv(mmc);
++ int count_sleeps = 5;
++ int ret = -ETIME;
+
-+#ifdef GLAMO_MCI_WORKER
-+ flush_workqueue(host->workqueue);
-+ destroy_workqueue(host->workqueue);
-+#endif
++ if (!hdq_priv.hdq_probed)
++ return -EINVAL;
+
-+ mmc_host_enable(mmc);
-+ mmc_remove_host(mmc);
-+ mmc_host_disable(mmc);
++ mutex_lock(&hdq_priv.hdq_lock);
+
-+ synchronize_irq(host->irq);
-+ free_irq(host->irq, host);
++ hdq_priv.hdq_error = 0;
++ hdq_priv.hdq_ads = address | HDQ_WRITE;
++ hdq_priv.hdq_tx_data = data;
++ hdq_priv.hdq_request_ctr++;
++ hdq_priv.pdata->kick_fiq();
++ /*
++ * FIQ takes care of it while we block our calling process
++ * But we're not spinning -- other processes run normally while
++ * we wait for the result
++ */
++ while (count_sleeps--) {
++ msleep(10); /* valid transaction always completes in < 10ms */
+
-+ iounmap(host->mmio_base);
-+ iounmap(host->data_base);
-+ release_mem_region(host->mmio_mem->start,
-+ resource_size(host->mmio_mem));
-+ release_mem_region(host->data_mem->start,
-+ resource_size(host->data_mem));
++ if (fiq_busy())
++ continue; /* something bad with FIQ */
+
-+ regulator_put(host->regulator);
++ if (hdq_priv.hdq_error) {
++ hdq_bad();
++ goto done; /* didn't see a response in good time */
++ }
++ hdq_good();
+
-+ mmc_free_host(mmc);
++ ret = 0;
++ goto done;
++ }
+
-+ return 0;
++done:
++ mutex_unlock(&hdq_priv.hdq_lock);
++ return ret;
+}
++EXPORT_SYMBOL_GPL(hdq_write);
+
++/* sysfs */
+
-+#ifdef CONFIG_PM
-+
-+static int glamo_mci_suspend(struct device *dev)
++static ssize_t hdq_sysfs_dump(struct device *dev, struct device_attribute *attr,
++ char *buf)
+{
-+ struct mmc_host *mmc = dev_get_drvdata(dev);
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ int ret;
++ int n;
++ int v;
++ u8 u8a[128]; /* whole address space for HDQ */
++ char *end = buf;
+
-+ disable_irq(host->irq);
++ if (!hdq_priv.hdq_probed)
++ return -EINVAL;
+
-+ mmc_host_enable(mmc);
-+ ret = mmc_suspend_host(mmc, PMSG_SUSPEND);
-+ mmc_host_disable(mmc);
++ /* the dump does not take care about 16 bit regs, because at this
++ * bus level we don't know about the chip details
++ */
++ for (n = 0; n < sizeof(u8a); n++) {
++ v = hdq_read(n);
++ if (v < 0)
++ goto bail;
++ u8a[n] = v;
++ }
+
-+ return ret;
++ for (n = 0; n < sizeof(u8a); n += 16) {
++ hex_dump_to_buffer(u8a + n, sizeof(u8a), 16, 1, end, 4096, 0);
++ end += strlen(end);
++ *end++ = '\n';
++ *end = '\0';
++ }
++ return (end - buf);
++
++bail:
++ return sprintf(buf, "ERROR %d\n", v);
+}
+
-+static int glamo_mci_resume(struct device *dev)
-+{
-+ struct mmc_host *mmc = dev_get_drvdata(dev);
-+ struct glamo_mci_host *host = mmc_priv(mmc);
-+ int ret;
++/* you write by <address> <data>, eg, "34 128" */
+
-+ mmc_host_enable(mmc);
-+ glamo_mci_reset(host);
-+ mdelay(10);
++#define atoi(str) simple_strtoul(((str != NULL) ? str : ""), NULL, 0)
+
-+ enable_irq(host->irq);
++static ssize_t hdq_sysfs_write(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t count)
++{
++ const char *end = buf + count;
++ int address = atoi(buf);
+
-+ ret = mmc_resume_host(host->mmc);
++ if (!hdq_priv.hdq_probed)
++ return -EINVAL;
+
-+ mmc_host_lazy_disable(host->mmc);
++ while ((buf != end) && (*buf != ' '))
++ buf++;
++ if (buf >= end)
++ return 0;
++ while ((buf < end) && (*buf == ' '))
++ buf++;
++ if (buf >= end)
++ return 0;
+
-+ return ret;
-+}
++ hdq_write(address, atoi(buf));
+
-+static const struct dev_pm_ops glamo_mci_pm_ops = {
-+ .suspend = glamo_mci_suspend,
-+ .resume = glamo_mci_resume,
-+ .freeze = glamo_mci_suspend,
-+ .thaw = glamo_mci_resume,
-+};
-+#define GLAMO_MCI_PM_OPS (&glamo_mci_pm_ops)
++ return count;
++}
+
-+#else /* CONFIG_PM */
-+#define GLAMO_MCI_PM_OPS NULL
-+#endif /* CONFIG_PM */
++static DEVICE_ATTR(dump, 0400, hdq_sysfs_dump, NULL);
++static DEVICE_ATTR(write, 0600, NULL, hdq_sysfs_write);
+
++static struct attribute *hdq_sysfs_entries[] = {
++ &dev_attr_dump.attr,
++ &dev_attr_write.attr,
++ NULL
++};
+
-+static struct platform_driver glamo_mci_driver = {
-+ .probe = glamo_mci_probe,
-+ .remove = glamo_mci_remove,
-+ .driver = {
-+ .name = "glamo-mci",
-+ .owner = THIS_MODULE,
-+ .pm = GLAMO_MCI_PM_OPS,
-+ },
++static struct attribute_group hdq_attr_group = {
++ .name = "hdq",
++ .attrs = hdq_sysfs_entries,
+};
+
-+static int __init glamo_mci_init(void)
++
++#ifdef CONFIG_PM
++static int hdq_suspend(struct platform_device *pdev, pm_message_t state)
+{
-+ platform_driver_register(&glamo_mci_driver);
++ /* after 18s of this, the battery monitor will also go to sleep */
++ hdq_priv.pdata->gpio_dir_in();
++ hdq_priv.pdata->disable_fiq();
+ return 0;
+}
-+module_init(glamo_mci_init);
+
-+static void __exit glamo_mci_exit(void)
++static int hdq_resume(struct platform_device *pdev)
+{
-+ platform_driver_unregister(&glamo_mci_driver);
++ hdq_priv.pdata->gpio_set(1);
++ hdq_priv.pdata->gpio_dir_out();
++ hdq_priv.pdata->enable_fiq();
++ return 0;
+}
-+module_exit(glamo_mci_exit);
-+
-+MODULE_DESCRIPTION("Glamo MMC/SD Card Interface driver");
-+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_ALIAS("platform:glamo-mci");
-diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
-index fa6e9c7..ec4ac09 100644
---- a/drivers/mtd/nand/s3c2410.c
-+++ b/drivers/mtd/nand/s3c2410.c
-@@ -816,7 +816,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
- nmtd->mtd.owner = THIS_MODULE;
- nmtd->set = set;
-
-- if (hardware_ecc) {
-+ if (!(info->platform && info->platform->software_ecc) && hardware_ecc) {
- chip->ecc.calculate = s3c2410_nand_calculate_ecc;
- chip->ecc.correct = s3c2410_nand_correct_data;
- chip->ecc.mode = NAND_ECC_HW;
-diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
-index faaa9b4..06e65f9 100644
---- a/drivers/power/Kconfig
-+++ b/drivers/power/Kconfig
-@@ -131,4 +131,22 @@ config CHARGER_PCF50633
- help
- Say Y to include support for NXP PCF50633 Main Battery Charger.
-
-+config BATTERY_BQ27000_HDQ
-+ tristate "BQ27000 HDQ battery monitor driver"
-+ help
-+ Say Y to enable support for the battery on the Neo Freerunner
++#endif
+
-+config HDQ_GPIO_BITBANG
-+ bool "Generic gpio based HDQ bitbang"
-+ help
-+ Say Y to enable supoort for generic gpio based HDQ bitbang driver.
-+ This can not be built as a module.
++static int __init hdq_probe(struct platform_device *pdev)
++{
++ int ret;
++ struct hdq_platform_data *pdata = pdev->dev.platform_data;
+
-+config BATTERY_PLATFORM
-+ tristate "Platform battery driver"
-+ help
-+ Say Y here to include support for battery driver that gets all
-+ information from platform functions.
++ if (!pdata)
++ return -EINVAL;
+
- endif # POWER_SUPPLY
++ platform_set_drvdata(pdev, NULL);
+
-diff --git a/drivers/power/Makefile b/drivers/power/Makefile
-index a2ba7c8..1a0ecf6 100644
---- a/drivers/power/Makefile
-+++ b/drivers/power/Makefile
-@@ -32,3 +32,7 @@ obj-$(CONFIG_BATTERY_BQ27x00) += bq27x00_battery.o
- obj-$(CONFIG_BATTERY_DA9030) += da9030_battery.o
- obj-$(CONFIG_BATTERY_MAX17040) += max17040_battery.o
- obj-$(CONFIG_CHARGER_PCF50633) += pcf50633-charger.o
-+obj-$(CONFIG_BATTERY_BQ27000_HDQ) += bq27000_battery.o
-+obj-$(CONFIG_BATTERY_PLATFORM) += platform_battery.o
++ mutex_init(&hdq_priv.hdq_lock);
+
-+obj-$(CONFIG_HDQ_GPIO_BITBANG) += hdq.o
-diff --git a/drivers/power/bq27000_battery.c b/drivers/power/bq27000_battery.c
-new file mode 100644
-index 0000000..ff5a7ef
---- /dev/null
-+++ b/drivers/power/bq27000_battery.c
-@@ -0,0 +1,478 @@
-+/*
-+ * Driver for batteries with bq27000 chips inside via HDQ
-+ *
-+ * Copyright 2008 Openmoko, Inc
-+ * Andy Green <andy@openmoko.com>
-+ *
-+ * based on ds2760 driver, original copyright notice for that --->
-+ *
-+ * Copyright © 2007 Anton Vorontsov
-+ * 2004-2007 Matt Reimer
-+ * 2004 Szabolcs Gyurko
-+ *
-+ * Use consistent with the GNU GPL is permitted,
-+ * provided that this copyright notice is
-+ * preserved in its entirety in all copies and derived works.
-+ *
-+ * Author: Anton Vorontsov <cbou@mail.ru>
-+ * February 2007
-+ *
-+ * Matt Reimer <mreimer@vpop.net>
-+ * April 2004, 2005, 2007
-+ *
-+ * Szabolcs Gyurko <szabolcs.gyurko@tlt.hu>
-+ * September 2004
-+ */
++ /* set our HDQ comms pin from the platform data */
++ hdq_priv.pdata = pdata;
+
-+#include <linux/module.h>
-+#include <linux/param.h>
-+#include <linux/jiffies.h>
-+#include <linux/delay.h>
-+#include <linux/pm.h>
-+#include <linux/workqueue.h>
-+#include <linux/platform_device.h>
-+#include <linux/power_supply.h>
-+#include <linux/bq27000_battery.h>
-+#include <linux/slab.h>
++ hdq_priv.pdata->gpio_set(1);
++ hdq_priv.pdata->gpio_dir_out();
+
-+enum bq27000_regs {
-+ /* RAM regs */
-+ /* read-write after this */
-+ BQ27000_CTRL = 0, /* Device Control Register */
-+ BQ27000_MODE, /* Device Mode Register */
-+ BQ27000_AR_L, /* At-Rate H L */
-+ BQ27000_AR_H,
-+ /* read-only after this */
-+ BQ27000_ARTTE_L, /* At-Rate Time To Empty H L */
-+ BQ27000_ARTTE_H,
-+ BQ27000_TEMP_L, /* Reported Temperature H L */
-+ BQ27000_TEMP_H,
-+ BQ27000_VOLT_L, /* Reported Voltage H L */
-+ BQ27000_VOLT_H,
-+ BQ27000_FLAGS, /* Status Flags */
-+ BQ27000_RSOC, /* Relative State of Charge */
-+ BQ27000_NAC_L, /* Nominal Available Capacity H L */
-+ BQ27000_NAC_H,
-+ BQ27000_CACD_L, /* Discharge Compensated H L */
-+ BQ27000_CACD_H,
-+ BQ27000_CACT_L, /* Temperature Compensated H L */
-+ BQ27000_CACT_H,
-+ BQ27000_LMD_L, /* Last measured discharge H L */
-+ BQ27000_LMD_H,
-+ BQ27000_AI_L, /* Average Current H L */
-+ BQ27000_AI_H,
-+ BQ27000_TTE_L, /* Time to Empty H L */
-+ BQ27000_TTE_H,
-+ BQ27000_TTF_L, /* Time to Full H L */
-+ BQ27000_TTF_H,
-+ BQ27000_SI_L, /* Standby Current H L */
-+ BQ27000_SI_H,
-+ BQ27000_STTE_L, /* Standby Time To Empty H L */
-+ BQ27000_STTE_H,
-+ BQ27000_MLI_L, /* Max Load Current H L */
-+ BQ27000_MLI_H,
-+ BQ27000_MLTTE_L, /* Max Load Time To Empty H L */
-+ BQ27000_MLTTE_H,
-+ BQ27000_SAE_L, /* Available Energy H L */
-+ BQ27000_SAE_H,
-+ BQ27000_AP_L, /* Available Power H L */
-+ BQ27000_AP_H,
-+ BQ27000_TTECP_L, /* Time to Empty at Constant Power H L */
-+ BQ27000_TTECP_H,
-+ BQ27000_CYCL_L, /* Cycle count since learning cycle H L */
-+ BQ27000_CYCL_H,
-+ BQ27000_CYCT_L, /* Cycle Count Total H L */
-+ BQ27000_CYCT_H,
-+ BQ27000_CSOC, /* Compensated State Of Charge */
-+ /* EEPROM regs */
-+ /* read-write after this */
-+ BQ27000_EE_EE_EN = 0x6e, /* EEPROM Program Enable */
-+ BQ27000_EE_ILMD = 0x76, /* Initial Last Measured Discharge High Byte */
-+ BQ27000_EE_SEDVF, /* Scaled EDVF Threshold */
-+ BQ27000_EE_SEDV1, /* Scaled EDV1 Threshold */
-+ BQ27000_EE_ISLC, /* Initial Standby Load Current */
-+ BQ27000_EE_DMFSD, /* Digital Magnitude Filter and Self Discharge */
-+ BQ27000_EE_TAPER, /* Aging Estimate Enable, Charge Termination Taper */
-+ BQ27000_EE_PKCFG, /* Pack Configuration Values */
-+ BQ27000_EE_IMLC, /* Initial Max Load Current or ID #3 */
-+ BQ27000_EE_DCOMP, /* Discharge rate compensation constants or ID #2 */
-+ BQ27000_EE_TCOMP, /* Temperature Compensation constants or ID #1 */
-+};
++ /* Initialize FIQ */
++ if (hdq_priv.pdata->enable_fiq() < 0) {
++ dev_err(&pdev->dev, "Could not enable FIQ source\n");
++ return -EINVAL;
++ }
+
-+enum bq27000_status_flags {
-+ BQ27000_STATUS_CHGS = 0x80, /* 1 = being charged */
-+ BQ27000_STATUS_NOACT = 0x40, /* 1 = no activity */
-+ BQ27000_STATUS_IMIN = 0x20, /* 1 = Lion taper current mode */
-+ BQ27000_STATUS_CI = 0x10, /* 1 = capacity likely innacurate */
-+ BQ27000_STATUS_CALIP = 0x08, /* 1 = calibration in progress */
-+ BQ27000_STATUS_VDQ = 0x04, /* 1 = capacity should be accurate */
-+ BQ27000_STATUS_EDV1 = 0x02, /* 1 = end of discharge.. <6% left */
-+ BQ27000_STATUS_EDVF = 0x01, /* 1 = no, it's really empty now */
-+};
++ ret = sysfs_create_group(&pdev->dev.kobj, &hdq_attr_group);
++ if (ret)
++ return ret;
+
-+#define NANOVOLTS_UNIT 3750
++ hdq_priv.hdq_probed = 1; /* we are ready to do stuff now */
+
-+struct bq27000_bat_regs {
-+ int ai;
-+ int flags;
-+ int lmd;
-+ int rsoc;
-+ int temp;
-+ int tte;
-+ int ttf;
-+ int volt;
-+};
++ /*
++ * if wanted, users can defer registration of devices
++ * that depend on HDQ until after we register, and can use our
++ * device as parent so suspend-resume ordering is correct
++ */
++ if (pdata->attach_child_devices)
++ (pdata->attach_child_devices)(&pdev->dev);
+
-+struct bq27000_device_info {
-+ struct device *dev;
-+ struct power_supply bat;
-+ struct power_supply ac;
-+ struct power_supply usb;
-+ struct delayed_work work;
-+ struct bq27000_platform_data *pdata;
++ hdq_priv.pdata = pdata;
+
-+ struct bq27000_bat_regs regs;
++ return 0;
++}
++
++static int hdq_remove(struct platform_device *pdev)
++{
++ sysfs_remove_group(&pdev->dev.kobj, &hdq_attr_group);
++ return 0;
++}
++
++static struct platform_driver hdq_driver = {
++ .probe = hdq_probe,
++ .remove = hdq_remove,
++#ifdef CONFIG_PM
++ .suspend = hdq_suspend,
++ .resume = hdq_resume,
++#endif
++ .driver = {
++ .name = "hdq",
++ },
+};
+
-+static unsigned int cache_time = 5000;
-+module_param(cache_time, uint, 0644);
-+MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
++static int __init hdq_init(void)
++{
++ return platform_driver_register(&hdq_driver);
++}
+
-+/*
-+ * reading 16 bit values over HDQ has a special hazard where the
-+ * hdq device firmware can update the 16-bit register during the time we
-+ * read the two halves. TI document SLUS556D recommends the algorithm here
-+ * to avoid trouble
++static void __exit hdq_exit(void)
++{
++ platform_driver_unregister(&hdq_driver);
++}
++
++module_init(hdq_init);
++module_exit(hdq_exit);
++
++MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
++MODULE_DESCRIPTION("HDQ driver");
+diff --git a/drivers/power/pcf50606-charger.c b/drivers/power/pcf50606-charger.c
+new file mode 100644
+index 0000000..52c0191
+--- /dev/null
++++ b/drivers/power/pcf50606-charger.c
+@@ -0,0 +1,261 @@
++/* NXP PCF50606 Main Battery Charger Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte, Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
+ */
+
-+static int hdq_read16(struct bq27000_device_info *di, int address)
-+{
-+ int acc;
-+ int high;
-+ int retries = 3;
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/types.h>
++#include <linux/device.h>
++#include <linux/sysfs.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <linux/slab.h>
+
-+ while (retries--) {
++#include <linux/mfd/pcf50606/core.h>
++#include <linux/mfd/pcf50606/mbc.h>
+
-+ high = (di->pdata->hdq_read)(address + 1); /* high part */
++struct pcf50606_mbc {
++ struct pcf50606 *pcf;
+
-+ if (high < 0)
-+ return high;
-+ acc = (di->pdata->hdq_read)(address);
-+ if (acc < 0)
-+ return acc;
++ int charger_online;
++ struct power_supply charger;
++};
+
-+ /* confirm high didn't change between reading it and low */
-+ if (high == (di->pdata->hdq_read)(address + 1))
-+ return (high << 8) | acc;
++int pcf50606_charge_fast(struct pcf50606 *pcf, int on)
++{
++ struct pcf50606_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
++
++ /*
++ * This is a fix to work around boot-time ordering problems if
++ * the s3c2410_udc is initialized before the pcf50606 mbc is
++ * ready.
++ */
++ if (!mbc)
++ return -ENODEV;
++
++ if (on) {
++ pcf50606_reg_set_bit_mask(pcf, PCF50606_REG_MBCC1,
++ PCF50606_MBCC1_AUTOFST,
++ PCF50606_MBCC1_AUTOFST);\
++ mbc->charger_online = 1;
++ } else {
++ /* disable automatic fast-charge */
++ pcf50606_reg_clear_bits(pcf, PCF50606_REG_MBCC1,
++ PCF50606_MBCC1_AUTOFST);
++ /* switch to idle mode to abort existing charge process */
++ pcf50606_reg_set_bit_mask(pcf, PCF50606_REG_MBCC1,
++ PCF50606_MBCC1_CHGMOD_MASK,
++ PCF50606_MBCC1_CHGMOD_IDLE);
++ mbc->charger_online = 0;
+ }
+
-+ return -ETIME;
++ return 0;
+}
++EXPORT_SYMBOL_GPL(pcf50606_charge_fast);
+
-+static void bq27000_battery_external_power_changed(struct power_supply *psy)
-+{
-+ struct bq27000_device_info *di = container_of(psy, struct bq27000_device_info, bat);
++static const char *charge_mode_descs[] = {
++ "qualification",
++ "pre",
++ "trickle",
++ "fast_cccv",
++ "idle",
++};
+
-+ dev_dbg(di->dev, "%s\n", __FUNCTION__);
-+ schedule_delayed_work(&di->work, 0);
++static ssize_t
++show_charge_mode(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ struct pcf50606_mbc *mbc = dev_get_drvdata(dev);
++ const char **desc = charge_mode_descs;
++
++ uint8_t charge_mode = pcf50606_reg_read(mbc->pcf, PCF50606_REG_MBCC1);
++ charge_mode &= PCF50606_MBCC1_CHGMOD_MASK;
++ switch (charge_mode) {
++ case PCF50606_MBCC1_CHGMOD_IDLE:
++ ++desc;
++ case PCF50606_MBCC1_CHGMOD_FAST_CCCV:
++ ++desc;
++ case PCF50606_MBCC1_CHGMOD_TRICKLE:
++ ++desc;
++ case PCF50606_MBCC1_CHGMOD_PRE:
++ ++desc;
++ case PCF50606_MBCC1_CHGMOD_QUAL:
++ return sprintf(buf, "%s\n", *desc);
++ break;
++ default:
++ return sprintf(buf, "unkown: %d\n", charge_mode);
++ break;
++ }
+}
+
-+static int bq27000_battery_get_property(struct power_supply *psy,
-+ enum power_supply_property psp,
-+ union power_supply_propval *val)
++static ssize_t set_charge_mode(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t count)
+{
-+ int n;
-+ struct bq27000_device_info *di = container_of(psy, struct bq27000_device_info, bat);
++ struct pcf50606_mbc *mbc = dev_get_drvdata(dev);
++ uint8_t mbcc1 = pcf50606_reg_read(mbc->pcf, PCF50606_REG_MBCC1);
++
++ mbcc1 &= ~PCF50606_MBCC1_CHGMOD_MASK;
++
++ if (!strcmp(buf, "qualification"))
++ mbcc1 |= PCF50606_MBCC1_CHGMOD_QUAL;
++ else if (!strcmp(buf, "pre"))
++ mbcc1 |= PCF50606_MBCC1_CHGMOD_PRE;
++ else if (!strcmp(buf, "trickle"))
++ mbcc1 |= PCF50606_MBCC1_CHGMOD_TRICKLE;
++ else if (!strcmp(buf, "fast_cccv"))
++ mbcc1 |= PCF50606_MBCC1_CHGMOD_FAST_CCCV;
++ /* We don't allow the other fast modes for security reasons */
++ else if (!strcmp(buf, "idle"))
++ mbcc1 |= PCF50606_MBCC1_CHGMOD_IDLE;
++ else
++ return -EINVAL;
+
-+ if (di->regs.rsoc < 0 && psp != POWER_SUPPLY_PROP_PRESENT)
-+ return -ENODEV;
++ pcf50606_reg_write(mbc->pcf, PCF50606_REG_MBCC1, mbcc1);
+
-+ switch (psp) {
-+ case POWER_SUPPLY_PROP_STATUS:
-+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
++ return count;
++}
+
-+ if (!di->pdata->get_charger_online_status)
-+ goto use_bat;
-+ if ((di->pdata->get_charger_online_status)()) {
-+ /*
-+ * charger is definitively present
-+ * we report our state in terms of what it says it
-+ * is doing
-+ */
-+ if (!di->pdata->get_charger_active_status)
-+ goto use_bat;
++static DEVICE_ATTR(charge_mode, S_IRUGO | S_IWUSR, show_charge_mode, set_charge_mode);
+
-+ if ((di->pdata->get_charger_active_status)()) {
-+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
-+ break;
-+ }
-+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
-+ break;
-+ }
++static void
++pcf50606_mbc_irq_handler(int irq, void *data)
++{
++ struct pcf50606_mbc *mbc = data;
+
-+ /*
-+ * platform provided definite indication of charger presence,
-+ * and it is telling us it isn't there... but we are on so we
-+ * must be running from battery --->
-+ */
++ power_supply_changed(&mbc->charger);
+
-+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
-+ break;
++ if (mbc->pcf->pdata->mbc_event_callback)
++ mbc->pcf->pdata->mbc_event_callback(mbc->pcf, irq);
++}
+
-+use_bat:
-+ /*
-+ * either the charger is not connected, or the
-+ * platform doesn't give info about charger, use battery state
-+ * but... battery state can be out of date by 4 seconds or
-+ * so... use the platform callbacks if possible.
-+ */
++static int charger_get_property(struct power_supply *psy,
++ enum power_supply_property psp,
++ union power_supply_propval *val)
++{
++ struct pcf50606_mbc *mbc = container_of(psy, struct pcf50606_mbc, charger);
++ int ret = 0;
+
-+ /* no real activity on the battery */
-+ if (di->regs.ai < 2) {
-+ if (!di->regs.ttf)
-+ val->intval = POWER_SUPPLY_STATUS_FULL;
-+ else
-+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
-+ break;
-+ }
-+ /* power is actually going in or out... */
-+ if (di->regs.flags < 0)
-+ return di->regs.flags;
-+ if (di->regs.flags & BQ27000_STATUS_CHGS)
-+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
-+ else
-+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
-+ break;
-+ case POWER_SUPPLY_PROP_HEALTH:
-+ val->intval = POWER_SUPPLY_HEALTH_UNKNOWN;
-+ /* Do we have accurate readings... */
-+ if (di->regs.flags < 0)
-+ return di->regs.flags;
-+ if (di->regs.flags & BQ27000_STATUS_VDQ)
-+ val->intval = POWER_SUPPLY_HEALTH_GOOD;
-+ break;
-+ case POWER_SUPPLY_PROP_VOLTAGE_NOW:
-+ if (di->regs.volt < 0)
-+ return di->regs.volt;
-+ /* mV -> uV */
-+ val->intval = di->regs.volt * 1000;
-+ break;
-+ case POWER_SUPPLY_PROP_CURRENT_NOW:
-+ if (di->regs.flags < 0)
-+ return di->regs.flags;
-+ if (di->regs.flags & BQ27000_STATUS_CHGS)
-+ n = -NANOVOLTS_UNIT;
-+ else
-+ n = NANOVOLTS_UNIT;
-+ if (di->regs.ai < 0)
-+ return di->regs.ai;
-+ val->intval = (di->regs.ai * n) / di->pdata->rsense_mohms;
-+ break;
-+ case POWER_SUPPLY_PROP_CHARGE_FULL:
-+ if (di->regs.lmd < 0)
-+ return di->regs.lmd;
-+ val->intval = (di->regs.lmd * 3570) / di->pdata->rsense_mohms;
-+ break;
-+ case POWER_SUPPLY_PROP_TEMP:
-+ if (di->regs.temp < 0)
-+ return di->regs.temp;
-+ /* K (in 0.25K units) is 273.15 up from C (in 0.1C)*/
-+ /* 10926 = 27315 * 4 / 10 */
-+ val->intval = (((long)di->regs.temp * 10l) - 10926) / 4;
-+ break;
-+ case POWER_SUPPLY_PROP_TECHNOLOGY:
-+ val->intval = POWER_SUPPLY_TECHNOLOGY_LION;
-+ break;
-+ case POWER_SUPPLY_PROP_CAPACITY:
-+ val->intval = di->regs.rsoc;
-+ if (val->intval < 0)
-+ return val->intval;
-+ break;
-+ case POWER_SUPPLY_PROP_PRESENT:
-+ val->intval = !(di->regs.rsoc < 0);
-+ break;
-+ case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW:
-+ if (di->regs.tte < 0)
-+ return di->regs.tte;
-+ val->intval = 60 * di->regs.tte;
-+ break;
-+ case POWER_SUPPLY_PROP_TIME_TO_FULL_NOW:
-+ if (di->regs.ttf < 0)
-+ return di->regs.ttf;
-+ val->intval = 60 * di->regs.ttf;
-+ break;
++ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
-+ if (di->pdata->get_charger_online_status)
-+ val->intval = (di->pdata->get_charger_online_status)();
-+ else
-+ return -EINVAL;
++ val->intval = mbc->charger_online;
+ break;
+ default:
-+ return -EINVAL;
++ ret = -EINVAL;
++ break;
++ }
++ return ret;
++}
++
++static enum power_supply_property power_props[] = {
++ POWER_SUPPLY_PROP_ONLINE,
++};
++
++static const uint8_t mbc_irq_handlers[] = {
++ PCF50606_IRQ_CHGINS,
++ PCF50606_IRQ_CHGRM,
++ PCF50606_IRQ_CHGFOK,
++ PCF50606_IRQ_CHGERR,
++ PCF50606_IRQ_CHGFRDY,
++ PCF50606_IRQ_CHGPROT,
++};
++
++static int __devinit pcf50606_mbc_probe(struct platform_device *pdev)
++{
++ struct pcf50606_mbc *mbc;
++ int ret;
++ size_t i;
++ uint8_t oocs;
++
++ mbc = kzalloc(sizeof(*mbc), GFP_KERNEL);
++ if (!mbc)
++ return -ENOMEM;
++
++ mbc->pcf = dev_to_pcf50606(pdev->dev.parent);
++
++ mbc->charger.name = "charger";
++ mbc->charger.type = POWER_SUPPLY_TYPE_MAINS;
++ mbc->charger.properties = power_props;
++ mbc->charger.num_properties = ARRAY_SIZE(power_props);
++ mbc->charger.get_property = &charger_get_property;
++ mbc->charger.supplied_to = mbc->pcf->pdata->batteries;
++ mbc->charger.num_supplicants = mbc->pcf->pdata->num_batteries;
++
++ ret = power_supply_register(&pdev->dev, &mbc->charger);
++ if (ret) {
++ dev_err(mbc->pcf->dev, "failed to register charger\n");
++ kfree(mbc);
++ return ret;
+ }
+
++ /* Set up IRQ handlers */
++ for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
++ pcf50606_register_irq(mbc->pcf, mbc_irq_handlers[i],
++ pcf50606_mbc_irq_handler, mbc);
++
++ ret = sysfs_create_file(&pdev->dev.kobj, &dev_attr_charge_mode.attr);
++ if (ret)
++ dev_err(mbc->pcf->dev, "failed to create sysfs entries\n");
++
++ oocs = pcf50606_reg_read(mbc->pcf, PCF50606_REG_OOCS);
++ if (oocs & PCF50606_OOCS_CHGOK)
++ pcf50606_mbc_irq_handler(PCF50606_IRQ_CHGINS, mbc);
++
++ platform_set_drvdata(pdev, mbc);
++
+ return 0;
+}
+
-+static void bq27000_battery_work(struct work_struct *work)
++static int __devexit pcf50606_mbc_remove(struct platform_device *pdev)
+{
-+ struct bq27000_device_info *di =
-+ container_of(work, struct bq27000_device_info, work.work);
++ struct pcf50606_mbc *mbc = platform_get_drvdata(pdev);
++ size_t i;
+
-+ if ((di->pdata->hdq_initialized)()) {
-+ struct bq27000_bat_regs regs;
++ /* Remove IRQ handlers */
++ for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
++ pcf50606_free_irq(mbc->pcf, mbc_irq_handlers[i]);
+
-+ regs.ai = hdq_read16(di, BQ27000_AI_L);
-+ regs.flags = (di->pdata->hdq_read)(BQ27000_FLAGS);
-+ regs.lmd = hdq_read16(di, BQ27000_LMD_L);
-+ regs.rsoc = (di->pdata->hdq_read)(BQ27000_RSOC);
-+ regs.temp = hdq_read16(di, BQ27000_TEMP_L);
-+ regs.tte = hdq_read16(di, BQ27000_TTE_L);
-+ regs.ttf = hdq_read16(di, BQ27000_TTF_L);
-+ regs.volt = hdq_read16(di, BQ27000_VOLT_L);
++ power_supply_unregister(&mbc->charger);
+
-+ if (memcmp (®s, &di->regs, sizeof(regs)) != 0) {
-+ di->regs = regs;
-+ power_supply_changed(&di->bat);
-+ }
-+ }
++ platform_set_drvdata(pdev, NULL);
++ kfree(mbc);
+
-+ if (!schedule_delayed_work(&di->work, cache_time))
-+ dev_err(di->dev, "battery service reschedule failed\n");
++ return 0;
+}
+
-+static enum power_supply_property bq27000_battery_props[] = {
-+ POWER_SUPPLY_PROP_STATUS,
-+ POWER_SUPPLY_PROP_HEALTH,
-+ POWER_SUPPLY_PROP_VOLTAGE_NOW,
-+ POWER_SUPPLY_PROP_CURRENT_NOW,
-+ POWER_SUPPLY_PROP_CHARGE_FULL,
-+ POWER_SUPPLY_PROP_TEMP,
-+ POWER_SUPPLY_PROP_TECHNOLOGY,
-+ POWER_SUPPLY_PROP_PRESENT,
-+ POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
-+ POWER_SUPPLY_PROP_TIME_TO_FULL_NOW,
-+ POWER_SUPPLY_PROP_CAPACITY,
-+ POWER_SUPPLY_PROP_ONLINE
++static struct platform_driver pcf50606_mbc_driver = {
++ .driver = {
++ .name = "pcf50606-mbc",
++ .owner = THIS_MODULE,
++ },
++ .probe = pcf50606_mbc_probe,
++ .remove = __devexit_p(pcf50606_mbc_remove),
+};
+
-+static int bq27000_battery_probe(struct platform_device *pdev)
++static int __init pcf50606_mbc_init(void)
+{
-+ int retval = 0;
-+ struct bq27000_device_info *di;
-+ struct bq27000_platform_data *pdata;
-+
-+ dev_info(&pdev->dev, "BQ27000 Battery Driver (C) 2008 Openmoko, Inc\n");
-+
-+ di = kzalloc(sizeof(*di), GFP_KERNEL);
-+ if (!di) {
-+ retval = -ENOMEM;
-+ goto di_alloc_failed;
-+ }
++ return platform_driver_register(&pcf50606_mbc_driver);
++}
++module_init(pcf50606_mbc_init);
+
-+ platform_set_drvdata(pdev, di);
++static void __exit pcf50606_mbc_exit(void)
++{
++ platform_driver_unregister(&pcf50606_mbc_driver);
++}
++module_exit(pcf50606_mbc_exit);
+
-+ pdata = pdev->dev.platform_data;
-+ di->dev = &pdev->dev;
-+ /* di->w1_dev = pdev->dev.parent; */
-+ di->bat.name = pdata->name;
-+ di->bat.type = POWER_SUPPLY_TYPE_BATTERY;
-+ di->bat.properties = bq27000_battery_props;
-+ di->bat.num_properties = ARRAY_SIZE(bq27000_battery_props);
-+ di->bat.get_property = bq27000_battery_get_property;
-+ di->bat.external_power_changed =
-+ bq27000_battery_external_power_changed;
-+ di->bat.use_for_apm = 1;
-+ di->pdata = pdata;
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
++MODULE_DESCRIPTION("PCF50606 mbc driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:pcf50606-mbc");
+diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
+index 066f994..f711485 100644
+--- a/drivers/power/pcf50633-charger.c
++++ b/drivers/power/pcf50633-charger.c
+@@ -40,7 +40,7 @@ struct pcf50633_mbc {
+
+ int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
+ {
+- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
++ struct pcf50633_mbc *mbc = pcf->mbc;
+ int ret = 0;
+ u8 bits;
+ int charging_start = 1;
+@@ -112,7 +112,7 @@ EXPORT_SYMBOL_GPL(pcf50633_mbc_usb_curlim_set);
+
+ int pcf50633_mbc_get_status(struct pcf50633 *pcf)
+ {
+- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
++ struct pcf50633_mbc *mbc = pcf->mbc;
+ int status = 0;
+ u8 chgmod;
+
+@@ -143,7 +143,7 @@ EXPORT_SYMBOL_GPL(pcf50633_mbc_get_status);
+
+ int pcf50633_mbc_get_usb_online_status(struct pcf50633 *pcf)
+ {
+- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
++ struct pcf50633_mbc *mbc = pcf->mbc;
+
+ if (!mbc)
+ return 0;
+@@ -368,6 +368,7 @@ static const u8 mbc_irq_handlers[] = {
+
+ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
+ {
++ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
+ struct pcf50633_mbc *mbc;
+ int ret;
+ int i;
+@@ -378,7 +379,7 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ platform_set_drvdata(pdev, mbc);
+- mbc->pcf = dev_to_pcf50633(pdev->dev.parent);
++ mbc->pcf = pcf;
+
+ /* Set up IRQ handlers */
+ for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
+@@ -444,6 +445,8 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
+ if (mbcs1 & PCF50633_MBCS1_ADAPTPRES)
+ pcf50633_mbc_irq_handler(PCF50633_IRQ_ADPINS, mbc);
+
++ pcf->mbc = mbc;
+
-+ retval = power_supply_register(&pdev->dev, &di->bat);
-+ if (retval) {
-+ dev_err(di->dev, "failed to register battery\n");
-+ goto batt_failed;
-+ }
+ return 0;
+ }
+
+@@ -452,6 +455,8 @@ static int __devexit pcf50633_mbc_remove(struct platform_device *pdev)
+ struct pcf50633_mbc *mbc = platform_get_drvdata(pdev);
+ int i;
+
++ mbc->pcf->mbc = NULL;
+
-+ INIT_DELAYED_WORK(&di->work, bq27000_battery_work);
+ /* Remove IRQ handlers */
+ for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
+ pcf50633_free_irq(mbc->pcf, mbc_irq_handlers[i]);
+diff --git a/drivers/power/platform_battery.c b/drivers/power/platform_battery.c
+new file mode 100644
+index 0000000..a5c9f35
+--- /dev/null
++++ b/drivers/power/platform_battery.c
+@@ -0,0 +1,120 @@
++/*
++ * Driver for platform battery
++ *
++ * Copyright (c) Paul Fertser <fercerpav@gmail.com>
++ * Inspired by Balaji Rao <balajirrao@openmoko.org>
++ *
++ * This driver can be used for dumb batteries when all knowledge about
++ * their state belongs to the platform that does necessary ADC readings,
++ * conversions, guessimations etc.
++ *
++ * Use consistent with the GNU GPL is permitted, provided that this
++ * copyright notice is preserved in its entirety in all copies and derived
++ * works.
++ */
+
-+ if (!schedule_delayed_work(&di->work, 0))
-+ dev_err(di->dev, "failed to schedule bq27000_battery_work\n");
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/power_supply.h>
++#include <linux/slab.h>
++#include <linux/workqueue.h>
+
-+ return 0;
++#include <linux/delay.h>
++#include <linux/platform_battery.h>
+
-+batt_failed:
-+ kfree(di);
-+di_alloc_failed:
-+ return retval;
-+}
++struct platform_battery {
++ struct power_supply psy;
++ struct platform_bat_platform_data *pdata;
++};
+
-+static int bq27000_battery_remove(struct platform_device *pdev)
++static int platform_bat_get_property(struct power_supply *psy,
++ enum power_supply_property psp,
++ union power_supply_propval *val)
+{
-+ struct bq27000_device_info *di = platform_get_drvdata(pdev);
++ struct platform_battery *bat =
++ container_of(psy, struct platform_battery, psy);
++ size_t i;
++ int present=1;
+
-+ cancel_delayed_work(&di->work);
++ if (bat->pdata->is_present)
++ present = bat->pdata->is_present();
+
-+ power_supply_unregister(&di->bat);
++ if (psp != POWER_SUPPLY_PROP_PRESENT && !present)
++ return -ENODEV;
+
-+ return 0;
++ for (i = 0; i < psy->num_properties; i++)
++ if (psy->properties[i] == psp) {
++ val->intval = bat->pdata->get_property[i]();
++ return 0;
++ }
++
++ return -EINVAL;
+}
+
-+void bq27000_charging_state_change(struct platform_device *pdev)
++static void platform_bat_ext_changed(struct power_supply *psy)
+{
-+ struct bq27000_device_info *di = platform_get_drvdata(pdev);
-+
-+ if (!di)
-+ return;
++ struct platform_battery *bat =
++ container_of(psy, struct platform_battery, psy);
++ power_supply_changed(&bat->psy);
+}
-+EXPORT_SYMBOL_GPL(bq27000_charging_state_change);
+
-+#ifdef CONFIG_PM
++static int platform_battery_probe(struct platform_device *pdev)
++{
++ struct platform_battery *platform_bat;
++ struct platform_bat_platform_data *pdata =
++ (struct platform_bat_platform_data *)pdev->dev.platform_data;
++
++ platform_bat = kzalloc(sizeof(*platform_bat), GFP_KERNEL);
++ if (!platform_bat)
++ return -ENOMEM;
+
-+static int bq27000_battery_suspend(struct platform_device *pdev,
-+ pm_message_t state)
-+{
-+ struct bq27000_device_info *di = platform_get_drvdata(pdev);
++ if (pdata->name)
++ platform_bat->psy.name = pdata->name;
++ else
++ platform_bat->psy.name = dev_name(&pdev->dev);
++ platform_bat->psy.type = POWER_SUPPLY_TYPE_BATTERY;
++ platform_bat->psy.properties = pdata->properties;
++ platform_bat->psy.num_properties = pdata->num_properties;
++ platform_bat->psy.get_property = platform_bat_get_property;
++ platform_bat->psy.external_power_changed = platform_bat_ext_changed;
++
++ platform_bat->pdata = pdata;
++ platform_set_drvdata(pdev, platform_bat);
++ power_supply_register(&pdev->dev, &platform_bat->psy);
+
-+ cancel_delayed_work(&di->work);
+ return 0;
+}
+
-+static int bq27000_battery_resume(struct platform_device *pdev)
++static int platform_battery_remove(struct platform_device *pdev)
+{
-+ struct bq27000_device_info *di = platform_get_drvdata(pdev);
++ struct platform_battery *bat = platform_get_drvdata(pdev);
++
++ power_supply_unregister(&bat->psy);
++ kfree(bat);
+
-+ schedule_delayed_work(&di->work, 0);
+ return 0;
+}
+
-+#else
-+
-+#define bq27000_battery_suspend NULL
-+#define bq27000_battery_resume NULL
-+
-+#endif /* CONFIG_PM */
-+
-+static struct platform_driver bq27000_battery_driver = {
++static struct platform_driver platform_battery_driver = {
+ .driver = {
-+ .name = "bq27000-battery",
++ .name = "platform_battery",
+ },
-+ .probe = bq27000_battery_probe,
-+ .remove = bq27000_battery_remove,
-+ .suspend = bq27000_battery_suspend,
-+ .resume = bq27000_battery_resume,
++ .probe = platform_battery_probe,
++ .remove = platform_battery_remove,
+};
+
-+static int __init bq27000_battery_init(void)
++static int __init platform_battery_init(void)
+{
-+ return platform_driver_register(&bq27000_battery_driver);
++ return platform_driver_register(&platform_battery_driver);
+}
++module_init(platform_battery_init);
+
-+static void __exit bq27000_battery_exit(void)
++static void __exit platform_battery_exit(void)
+{
-+ platform_driver_unregister(&bq27000_battery_driver);
++ platform_driver_unregister(&platform_battery_driver);
+}
-+
-+module_init(bq27000_battery_init);
-+module_exit(bq27000_battery_exit);
++module_exit(platform_battery_exit);
+
+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_DESCRIPTION("bq27000 battery driver");
-diff --git a/drivers/power/hdq.c b/drivers/power/hdq.c
++MODULE_AUTHOR("Paul Fertser <fercerpav@gmail.com>");
++MODULE_DESCRIPTION("platform battery driver");
+diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
+index 04f2e08..fe57909 100644
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -201,5 +201,12 @@ config REGULATOR_88PM8607
+ help
+ This driver supports 88PM8607 voltage regulator chips.
+
++config REGULATOR_PCF50606
++ bool "PCF50606 regulator driver"
++ depends on MFD_PCF50606
++ help
++ Say Y here to support the voltage regulators and convertors
++ on PCF50606
++
+ endif
+
+diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
+index 4e7feec..0727ecd 100644
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -23,6 +23,7 @@ obj-$(CONFIG_REGULATOR_WM8350) += wm8350-regulator.o
+ obj-$(CONFIG_REGULATOR_WM8400) += wm8400-regulator.o
+ obj-$(CONFIG_REGULATOR_WM8994) += wm8994-regulator.o
+ obj-$(CONFIG_REGULATOR_DA903X) += da903x.o
++obj-$(CONFIG_REGULATOR_PCF50606) += pcf50606-regulator.o
+ obj-$(CONFIG_REGULATOR_PCF50633) += pcf50633-regulator.o
+ obj-$(CONFIG_REGULATOR_PCAP) += pcap-regulator.o
+ obj-$(CONFIG_REGULATOR_MC13783) += mc13783-regulator.o
+diff --git a/drivers/regulator/pcf50606-regulator.c b/drivers/regulator/pcf50606-regulator.c
new file mode 100644
-index 0000000..cea024f
+index 0000000..ae3193f
--- /dev/null
-+++ b/drivers/power/hdq.c
-@@ -0,0 +1,512 @@
-+/*
-+ * HDQ generic GPIO bitbang driver using FIQ
++++ b/drivers/regulator/pcf50606-regulator.c
+@@ -0,0 +1,358 @@
++/* NXP PCF50606 PMIC Driver
+ *
-+ * (C) 2006-2007 by Openmoko, Inc.
-+ * Author: Andy Green <andy@openmoko.com>
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
+ * All rights reserved.
+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte and Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
+ *
+ */
+
+#include <linux/kernel.h>
++#include <linux/module.h>
+#include <linux/init.h>
-+#include <linux/delay.h>
++#include <linux/device.h>
++#include <linux/err.h>
+#include <linux/platform_device.h>
-+#include <linux/hdq.h>
+
-+#define HDQ_READ 0
-+#define HDQ_WRITE 0x80
++#include <linux/mfd/pcf50606/core.h>
++#include <linux/mfd/pcf50606/pmic.h>
+
-+enum hdq_bitbang_states {
-+ HDQB_IDLE = 0,
-+ HDQB_TX_BREAK,
-+ HDQB_TX_BREAK_RECOVERY,
-+ HDQB_ADS_CALC,
-+ HDQB_ADS_LOW,
-+ HDQB_ADS_HIGH,
-+ HDQB_WAIT_RX,
-+ HDQB_DATA_RX_LOW,
-+ HDQB_DATA_RX_HIGH,
-+ HDQB_WAIT_TX,
++#define PCF50606_REGULATOR(_name, _id) \
++ { \
++ .name = _name, \
++ .id = _id, \
++ .ops = &pcf50606_regulator_ops, \
++ .type = REGULATOR_VOLTAGE, \
++ .owner = THIS_MODULE, \
++ }
++
++static const uint8_t pcf50606_regulator_registers[PCF50606_NUM_REGULATORS] = {
++ [PCF50606_REGULATOR_DCD] = PCF50606_REG_DCDC1,
++ [PCF50606_REGULATOR_DCDE] = PCF50606_REG_DCDEC1,
++ [PCF50606_REGULATOR_DCUD] = PCF50606_REG_DCUDC1,
++ [PCF50606_REGULATOR_D1REG] = PCF50606_REG_D1REGC1,
++ [PCF50606_REGULATOR_D2REG] = PCF50606_REG_D2REGC1,
++ [PCF50606_REGULATOR_D3REG] = PCF50606_REG_D3REGC1,
++ [PCF50606_REGULATOR_LPREG] = PCF50606_REG_LPREGC1,
++ [PCF50606_REGULATOR_IOREG] = PCF50606_REG_IOREGC,
+};
+
-+static struct hdq_priv {
-+ u8 hdq_probed; /* nonzero after HDQ driver probed */
-+ struct mutex hdq_lock; /* if you want to use hdq, you have to take lock */
-+ u8 hdq_ads; /* b7..b6 = register address, b0 = r/w */
-+ u8 hdq_tx_data; /* data to tx for write action */
-+ u8 hdq_rx_data; /* data received in read action */
-+ u8 hdq_request_ctr; /* incremented by "user" to request a transfer */
-+ u8 hdq_transaction_ctr; /* incremented after each transfer */
-+ u8 hdq_error; /* 0 = no error */
-+ u8 hdq_ctr;
-+ u8 hdq_ctr2;
-+ u8 hdq_bit;
-+ u8 hdq_shifter;
-+ u8 hdq_tx_data_done;
-+ enum hdq_bitbang_states hdq_state;
-+ int reported_error;
++static uint8_t dcudc_voltage(unsigned int millivolts)
++{
++ if (millivolts <= 900)
++ return 0;
++ else if (millivolts <= 3300)
++ return (millivolts - 900) / 300;
++ else if (millivolts < 4000)
++ return 0x0f;
++ else if (millivolts <= 5500)
++ return (millivolts - 4000) / 100;
+
-+ struct hdq_platform_data *pdata;
-+} hdq_priv;
++ return 0x1f;
++}
+
++static unsigned int dcudc_2voltage(uint8_t bits)
++{
++ bits &= 0x1f;
++ if (bits < 0x08)
++ return 900 + bits * 300;
++ else if (bits < 0x10)
++ return 3300;
++ else
++ return 4000 + (bits & 0xf) * 100;
++}
+
-+static void hdq_bad(void)
++static uint8_t dcdec_voltage(unsigned int millivolts)
+{
-+ if (!hdq_priv.reported_error)
-+ printk(KERN_ERR "HDQ error: %d\n", hdq_priv.hdq_error);
-+ hdq_priv.reported_error = 1;
++ if (millivolts < 900)
++ return 0;
++ else if (millivolts > 3300)
++ return 0x0f;
++
++ return (millivolts - 900) / 300;
+}
+
-+static void hdq_good(void)
++static unsigned int dcdec_2voltage(uint8_t bits)
+{
-+ if (hdq_priv.reported_error)
-+ printk(KERN_INFO "HDQ responds again\n");
-+ hdq_priv.reported_error = 0;
++ bits &= 0x0f;
++ return 900 + bits * 300;
+}
+
-+int hdq_fiq_handler(void)
++static uint8_t dcdc_voltage(unsigned int millivolts)
+{
-+ if (!hdq_priv.hdq_probed)
++ if (millivolts < 900)
+ return 0;
++ else if (millivolts > 3600)
++ return 0x1f;
+
-+ switch (hdq_priv.hdq_state) {
-+ case HDQB_IDLE:
-+ if (hdq_priv.hdq_request_ctr == hdq_priv.hdq_transaction_ctr)
-+ break;
-+ hdq_priv.hdq_ctr = 250 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.pdata->gpio_set(0);
-+ hdq_priv.pdata->gpio_dir_out();
-+ hdq_priv.hdq_tx_data_done = 0;
-+ hdq_priv.hdq_state = HDQB_TX_BREAK;
-+ break;
-+
-+ case HDQB_TX_BREAK: /* issue low for > 190us */
-+ if (--hdq_priv.hdq_ctr == 0) {
-+ hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_state = HDQB_TX_BREAK_RECOVERY;
-+ hdq_priv.pdata->gpio_set(1);
-+ }
-+ break;
++ if (millivolts < 1500)
++ return (millivolts - 900) / 25;
++ else
++ return 0x18 + (millivolts - 1500) / 300;
++}
+
-+ case HDQB_TX_BREAK_RECOVERY: /* issue low for > 40us */
-+ if (--hdq_priv.hdq_ctr)
-+ break;
-+ hdq_priv.hdq_shifter = hdq_priv.hdq_ads;
-+ hdq_priv.hdq_bit = 8; /* 8 bits of ads / rw */
-+ hdq_priv.hdq_tx_data_done = 0; /* doing ads */
-+ /* fallthru on last one */
-+ case HDQB_ADS_CALC:
-+ if (hdq_priv.hdq_shifter & 1)
-+ hdq_priv.hdq_ctr = 50 / HDQ_SAMPLE_PERIOD_US;
-+ else
-+ hdq_priv.hdq_ctr = 120 / HDQ_SAMPLE_PERIOD_US;
-+ /* carefully precompute the other phase length */
-+ hdq_priv.hdq_ctr2 = (210 - (hdq_priv.hdq_ctr * HDQ_SAMPLE_PERIOD_US)) /
-+ HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_state = HDQB_ADS_LOW;
-+ hdq_priv.hdq_shifter >>= 1;
-+ hdq_priv.hdq_bit--;
-+ hdq_priv.pdata->gpio_set(0);
-+ break;
++static unsigned int dcdc_2voltage(uint8_t bits)
++{
++ bits &= 0x1f;
++ if ((bits & 0x18) == 0x18)
++ return 1500 + ((bits & 0x7) * 300);
++ else
++ return 900 + (bits * 25);
++}
+
-+ case HDQB_ADS_LOW:
-+ if (--hdq_priv.hdq_ctr)
-+ break;
-+ hdq_priv.pdata->gpio_set(1);
-+ hdq_priv.hdq_state = HDQB_ADS_HIGH;
-+ break;
++static uint8_t dx_voltage(unsigned int millivolts)
++{
++ if (millivolts < 900)
++ return 0;
++ else if (millivolts > 3300)
++ return 0x18;
+
-+ case HDQB_ADS_HIGH:
-+ if (--hdq_priv.hdq_ctr2 > 1) /* account for HDQB_ADS_CALC */
-+ break;
-+ if (hdq_priv.hdq_bit) { /* more bits to do */
-+ hdq_priv.hdq_state = HDQB_ADS_CALC;
-+ break;
-+ }
-+ /* no more bits, wait it out until hdq_priv.hdq_ctr2 exhausted */
-+ if (hdq_priv.hdq_ctr2)
-+ break;
-+ /* ok no more bits and very last state */
-+ hdq_priv.hdq_ctr = 60 / HDQ_SAMPLE_PERIOD_US;
-+ /* FIXME 0 = read */
-+ if (hdq_priv.hdq_ads & 0x80) { /* write the byte out */
-+ /* set delay before payload */
-+ hdq_priv.hdq_ctr = 300 / HDQ_SAMPLE_PERIOD_US;
-+ /* already high, no need to write */
-+ hdq_priv.hdq_state = HDQB_WAIT_TX;
-+ break;
-+ }
-+ /* read the next byte */
-+ hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+ hdq_priv.hdq_ctr = 2500 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_state = HDQB_WAIT_RX;
-+ hdq_priv.pdata->gpio_dir_in();
-+ break;
++ return (millivolts - 900) / 100;
++}
+
-+ case HDQB_WAIT_TX: /* issue low for > 40us */
-+ if (--hdq_priv.hdq_ctr)
-+ break;
-+ if (!hdq_priv.hdq_tx_data_done) { /* was that the data sent? */
-+ hdq_priv.hdq_tx_data_done++;
-+ hdq_priv.hdq_shifter = hdq_priv.hdq_tx_data;
-+ hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+ hdq_priv.hdq_state = HDQB_ADS_CALC; /* start sending */
-+ break;
-+ }
-+ hdq_priv.hdq_error = 0;
-+ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+ hdq_priv.hdq_state = HDQB_IDLE; /* all tx is done */
-+ /* idle in input mode, it's pulled up by 10K */
-+ hdq_priv.pdata->gpio_dir_in();
-+ break;
++static unsigned int dx_2voltage(uint8_t bits)
++{
++ bits &= 0x1f;
++ return 900 + (bits * 100);
++}
+
-+ case HDQB_WAIT_RX: /* wait for battery to talk to us */
-+ if (hdq_priv.pdata->gpio_get() == 0) {
-+ /* it talks to us! */
-+ hdq_priv.hdq_ctr2 = 1;
-+ hdq_priv.hdq_bit = 8; /* 8 bits of data */
-+ /* timeout */
-+ hdq_priv.hdq_ctr = 500 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
-+ break;
-+ }
-+ if (--hdq_priv.hdq_ctr == 0) { /* timed out, error */
-+ hdq_priv.hdq_error = 1;
-+ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
-+ }
-+ break;
++static int pcf50606_regulator_set_voltage(struct regulator_dev *rdev,
++ int min_uV, int max_uV)
++{
++ struct pcf50606 *pcf;
++ int regulator_id, millivolts;
++ uint8_t volt_bits, regnr;
+
-+ /*
-+ * HDQ basically works by measuring the low time of the bit cell
-+ * 32-50us --> '1', 80 - 145us --> '0'
-+ */
++ pcf = rdev_get_drvdata(rdev);
+
-+ case HDQB_DATA_RX_LOW:
-+ if (hdq_priv.pdata->gpio_get()) {
-+ hdq_priv.hdq_rx_data >>= 1;
-+ if (hdq_priv.hdq_ctr2 <= (65 / HDQ_SAMPLE_PERIOD_US))
-+ hdq_priv.hdq_rx_data |= 0x80;
++ regulator_id = rdev_get_id(rdev);
+
-+ if (--hdq_priv.hdq_bit == 0) {
-+ hdq_priv.hdq_error = 0;
-+ hdq_priv.hdq_transaction_ctr =
-+ hdq_priv.hdq_request_ctr;
++ millivolts = min_uV / 1000;
+
-+ hdq_priv.hdq_state = HDQB_IDLE;
-+ } else
-+ hdq_priv.hdq_state = HDQB_DATA_RX_HIGH;
-+ /* timeout */
-+ hdq_priv.hdq_ctr = 1000 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_ctr2 = 1;
-+ break;
-+ }
-+ hdq_priv.hdq_ctr2++;
-+ if (--hdq_priv.hdq_ctr)
-+ break;
-+ /* timed out, error */
-+ hdq_priv.hdq_error = 2;
-+ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
++ switch (regulator_id) {
++ case PCF50606_REGULATOR_DCD:
++ volt_bits = dcdc_voltage(millivolts);
++ regnr = PCF50606_REG_DCDC1;
+ break;
-+
-+ case HDQB_DATA_RX_HIGH:
-+ if (!hdq_priv.pdata->gpio_get()) {
-+ /* it talks to us! */
-+ hdq_priv.hdq_ctr2 = 1;
-+ /* timeout */
-+ hdq_priv.hdq_ctr = 400 / HDQ_SAMPLE_PERIOD_US;
-+ hdq_priv.hdq_state = HDQB_DATA_RX_LOW;
-+ break;
-+ }
-+ if (--hdq_priv.hdq_ctr)
-+ break;
-+ /* timed out, error */
-+ hdq_priv.hdq_error = 3;
-+ hdq_priv.hdq_transaction_ctr = hdq_priv.hdq_request_ctr;
-+
-+ /* we're in input mode already */
-+ hdq_priv.hdq_state = HDQB_IDLE; /* abort */
++ case PCF50606_REGULATOR_DCDE:
++ volt_bits = dcdec_voltage(millivolts);
++ regnr = PCF50606_REG_DCDEC1;
+ break;
++ case PCF50606_REGULATOR_DCUD:
++ volt_bits = dcudc_voltage(millivolts);
++ regnr = PCF50606_REG_DCUDC1;
++ break;
++ case PCF50606_REGULATOR_D1REG:
++ case PCF50606_REGULATOR_D2REG:
++ case PCF50606_REGULATOR_D3REG:
++ regnr = PCF50606_REG_D1REGC1 +
++ (regulator_id - PCF50606_REGULATOR_D1REG);
++ volt_bits = dx_voltage(millivolts);
++ break;
++ case PCF50606_REGULATOR_LPREG:
++ volt_bits = dx_voltage(millivolts);
++ regnr = PCF50606_REG_LPREGC1;
++ break;
++ case PCF50606_REGULATOR_IOREG:
++ if (millivolts < 1800)
++ return -EINVAL;
++ volt_bits = dx_voltage(millivolts);
++ regnr = PCF50606_REG_IOREGC;
++ break;
++ default:
++ return -EINVAL;
+ }
+
-+ /* Are we interested in keeping the FIQ source alive ? */
-+ if (hdq_priv.hdq_state != HDQB_IDLE)
-+ return 1;
-+ else
-+ return 0;
++ return pcf50606_reg_set_bit_mask(pcf, regnr, 0x1f, volt_bits);
+}
-+static int fiq_busy(void)
++
++static int pcf50606_regulator_get_voltage(struct regulator_dev *rdev)
+{
-+ int request = (volatile u8)hdq_priv.hdq_request_ctr;
-+ int transact = (volatile u8)hdq_priv.hdq_transaction_ctr;
++ struct pcf50606 *pcf;
++ uint8_t volt_bits, regnr;
++ int regulator_id;
++ int voltage;
+
++ pcf = rdev_get_drvdata(rdev);
+
-+ return (request != transact);
++ regulator_id = rdev_get_id(rdev);
++
++ switch (regulator_id) {
++ case PCF50606_REGULATOR_DCD:
++ volt_bits = pcf50606_reg_read(pcf, PCF50606_REG_DCDC1) & 0x1f;
++ voltage = dcdc_2voltage(volt_bits);
++ break;
++ case PCF50606_REGULATOR_DCDE:
++ volt_bits = pcf50606_reg_read(pcf, PCF50606_REG_DCDEC1) & 0x0f;
++ voltage = dcdec_2voltage(volt_bits);
++ break;
++ case PCF50606_REGULATOR_DCUD:
++ volt_bits = pcf50606_reg_read(pcf, PCF50606_REG_DCUDC1) & 0x1f;
++ voltage = dcudc_2voltage(volt_bits);
++ break;
++ case PCF50606_REGULATOR_D1REG:
++ case PCF50606_REGULATOR_D2REG:
++ case PCF50606_REGULATOR_D3REG:
++ regnr = PCF50606_REG_D1REGC1 + (regulator_id - PCF50606_REGULATOR_D1REG);
++ volt_bits = pcf50606_reg_read(pcf, regnr) & 0x1f;
++ if (volt_bits > 0x18)
++ volt_bits = 0x18;
++ voltage = dx_2voltage(volt_bits);
++ break;
++ case PCF50606_REGULATOR_LPREG:
++ volt_bits = pcf50606_reg_read(pcf, PCF50606_REG_LPREGC1) & 0x1f;
++ if (volt_bits > 0x18)
++ volt_bits = 0x18;
++ voltage = dx_2voltage(volt_bits);
++ break;
++ case PCF50606_REGULATOR_IOREG:
++ volt_bits = pcf50606_reg_read(pcf, PCF50606_REG_IOREGC) & 0x1f;
++ if (volt_bits > 0x18)
++ volt_bits = 0x18;
++ voltage = dx_2voltage(volt_bits);
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return voltage * 1000;
+}
+
-+int hdq_initialized(void)
++static int pcf50606_regulator_enable(struct regulator_dev *rdev)
+{
-+ return hdq_priv.hdq_probed;
++ struct pcf50606 *pcf = rdev_get_drvdata(rdev);
++ int regulator_id;
++ uint8_t regnr;
++
++ regulator_id = rdev_get_id(rdev);
++
++ regnr = pcf50606_regulator_registers[regulator_id];
++
++ return pcf50606_reg_set_bit_mask(pcf, regnr, 0xe0, 0xe0);
+}
-+EXPORT_SYMBOL_GPL(hdq_initialized);
+
-+int hdq_read(int address)
++static int pcf50606_regulator_disable(struct regulator_dev *rdev)
+{
-+ int count_sleeps = 5;
-+ int ret = -ETIME;
++ struct pcf50606 *pcf = rdev_get_drvdata(rdev);
++ int regulator_id;
++ uint8_t regnr;
+
-+ if (!hdq_priv.hdq_probed)
++ regulator_id = rdev_get_id(rdev);
++
++ /* IOREG cannot be powered off since it powers the PMU I2C */
++ if (regulator_id == PCF50606_REGULATOR_IOREG)
+ return -EINVAL;
+
-+ mutex_lock(&hdq_priv.hdq_lock);
++ regnr = pcf50606_regulator_registers[regulator_id];
+
-+ hdq_priv.hdq_error = 0;
-+ hdq_priv.hdq_ads = address | HDQ_READ;
-+ hdq_priv.hdq_request_ctr++;
-+ hdq_priv.pdata->kick_fiq();
-+ /*
-+ * FIQ takes care of it while we block our calling process
-+ * But we're not spinning -- other processes run normally while
-+ * we wait for the result
-+ */
-+ while (count_sleeps--) {
-+ msleep(10); /* valid transaction always completes in < 10ms */
++ return pcf50606_reg_set_bit_mask(pcf, regnr, 0xe0, 0);
++}
+
-+ if (fiq_busy())
-+ continue;
++static int pcf50606_regulator_is_enabled(struct regulator_dev *rdev)
++{
++ struct pcf50606 *pcf = rdev_get_drvdata(rdev);
++ int regulator_id = rdev_get_id(rdev);
++ uint8_t regnr, val;
+
-+ if (hdq_priv.hdq_error) {
-+ hdq_bad();
-+ goto done; /* didn't see a response in good time */
-+ }
-+ hdq_good();
++ regulator_id = rdev_get_id(rdev);
+
-+ ret = hdq_priv.hdq_rx_data;
-+ goto done;
-+ }
++ /* the *ENA register is always one after the *OUT register */
++ regnr = pcf50606_regulator_registers[regulator_id];
++ val = (pcf50606_reg_read(pcf, regnr) & 0xe0) >> 5;
+
-+done:
-+ mutex_unlock(&hdq_priv.hdq_lock);
-+ return ret;
++ /* PWREN1 = 1, PWREN2 = 1, see table 16 of datasheet */
++ if (val == 0 || val == 5)
++ return 0;
++
++ return 1;
+}
-+EXPORT_SYMBOL_GPL(hdq_read);
+
-+int hdq_write(int address, u8 data)
-+{
-+ int count_sleeps = 5;
-+ int ret = -ETIME;
++static struct regulator_ops pcf50606_regulator_ops = {
++ .set_voltage = pcf50606_regulator_set_voltage,
++ .get_voltage = pcf50606_regulator_get_voltage,
++ .enable = pcf50606_regulator_enable,
++ .disable = pcf50606_regulator_disable,
++ .is_enabled = pcf50606_regulator_is_enabled,
++};
+
-+ if (!hdq_priv.hdq_probed)
-+ return -EINVAL;
++static struct regulator_desc regulators[] = {
++ [PCF50606_REGULATOR_DCD] =
++ PCF50606_REGULATOR("dcd", PCF50606_REGULATOR_DCD),
++ [PCF50606_REGULATOR_DCDE] =
++ PCF50606_REGULATOR("dcde", PCF50606_REGULATOR_DCDE),
++ [PCF50606_REGULATOR_DCUD] =
++ PCF50606_REGULATOR("dcud", PCF50606_REGULATOR_DCUD),
++ [PCF50606_REGULATOR_D1REG] =
++ PCF50606_REGULATOR("d1reg", PCF50606_REGULATOR_D1REG),
++ [PCF50606_REGULATOR_D2REG] =
++ PCF50606_REGULATOR("d2reg", PCF50606_REGULATOR_D2REG),
++ [PCF50606_REGULATOR_D3REG] =
++ PCF50606_REGULATOR("d3reg", PCF50606_REGULATOR_D3REG),
++ [PCF50606_REGULATOR_LPREG] =
++ PCF50606_REGULATOR("lpreg", PCF50606_REGULATOR_LPREG),
++ [PCF50606_REGULATOR_IOREG] =
++ PCF50606_REGULATOR("ioreg", PCF50606_REGULATOR_IOREG),
++};
+
-+ mutex_lock(&hdq_priv.hdq_lock);
++static int __devinit pcf50606_regulator_probe(struct platform_device *pdev)
++{
++ struct regulator_dev *rdev;
++ struct pcf50606 *pcf;
+
-+ hdq_priv.hdq_error = 0;
-+ hdq_priv.hdq_ads = address | HDQ_WRITE;
-+ hdq_priv.hdq_tx_data = data;
-+ hdq_priv.hdq_request_ctr++;
-+ hdq_priv.pdata->kick_fiq();
-+ /*
-+ * FIQ takes care of it while we block our calling process
-+ * But we're not spinning -- other processes run normally while
-+ * we wait for the result
-+ */
-+ while (count_sleeps--) {
-+ msleep(10); /* valid transaction always completes in < 10ms */
++ pcf = dev_to_pcf50606(pdev->dev.parent);
+
-+ if (fiq_busy())
-+ continue; /* something bad with FIQ */
++ rdev = regulator_register(®ulators[pdev->id], &pdev->dev,
++ pdev->dev.platform_data, pcf);
++ if (IS_ERR(rdev))
++ return PTR_ERR(rdev);
+
-+ if (hdq_priv.hdq_error) {
-+ hdq_bad();
-+ goto done; /* didn't see a response in good time */
-+ }
-+ hdq_good();
++ platform_set_drvdata(pdev, rdev);
+
-+ ret = 0;
-+ goto done;
-+ }
++ if (pcf->pdata->regulator_registered)
++ pcf->pdata->regulator_registered(pcf, pdev->id);
+
-+done:
-+ mutex_unlock(&hdq_priv.hdq_lock);
-+ return ret;
++ return 0;
+}
-+EXPORT_SYMBOL_GPL(hdq_write);
+
-+/* sysfs */
-+
-+static ssize_t hdq_sysfs_dump(struct device *dev, struct device_attribute *attr,
-+ char *buf)
++static int __devexit pcf50606_regulator_remove(struct platform_device *pdev)
+{
-+ int n;
-+ int v;
-+ u8 u8a[128]; /* whole address space for HDQ */
-+ char *end = buf;
-+
-+ if (!hdq_priv.hdq_probed)
-+ return -EINVAL;
-+
-+ /* the dump does not take care about 16 bit regs, because at this
-+ * bus level we don't know about the chip details
-+ */
-+ for (n = 0; n < sizeof(u8a); n++) {
-+ v = hdq_read(n);
-+ if (v < 0)
-+ goto bail;
-+ u8a[n] = v;
-+ }
++ struct regulator_dev *rdev = platform_get_drvdata(pdev);
+
-+ for (n = 0; n < sizeof(u8a); n += 16) {
-+ hex_dump_to_buffer(u8a + n, sizeof(u8a), 16, 1, end, 4096, 0);
-+ end += strlen(end);
-+ *end++ = '\n';
-+ *end = '\0';
-+ }
-+ return (end - buf);
++ platform_set_drvdata(pdev, NULL);
++ regulator_unregister(rdev);
+
-+bail:
-+ return sprintf(buf, "ERROR %d\n", v);
++ return 0;
+}
+
-+/* you write by <address> <data>, eg, "34 128" */
-+
-+#define atoi(str) simple_strtoul(((str != NULL) ? str : ""), NULL, 0)
++static struct platform_driver pcf50606_regulator_driver = {
++ .driver = {
++ .name = "pcf50606-regltr",
++ .owner = THIS_MODULE,
++ },
++ .probe = pcf50606_regulator_probe,
++ .remove = __devexit_p(pcf50606_regulator_remove),
++};
+
-+static ssize_t hdq_sysfs_write(struct device *dev,
-+ struct device_attribute *attr,
-+ const char *buf, size_t count)
++static int __init pcf50606_regulator_init(void)
+{
-+ const char *end = buf + count;
-+ int address = atoi(buf);
-+
-+ if (!hdq_priv.hdq_probed)
-+ return -EINVAL;
++ return platform_driver_register(&pcf50606_regulator_driver);
++}
++module_init(pcf50606_regulator_init);
+
-+ while ((buf != end) && (*buf != ' '))
-+ buf++;
-+ if (buf >= end)
-+ return 0;
-+ while ((buf < end) && (*buf == ' '))
-+ buf++;
-+ if (buf >= end)
-+ return 0;
++static void __exit pcf50606_regulator_exit(void)
++{
++ platform_driver_unregister(&pcf50606_regulator_driver);
++}
++module_exit(pcf50606_regulator_exit);
+
-+ hdq_write(address, atoi(buf));
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
++MODULE_DESCRIPTION("PCF50606 regulator driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:pcf50606-regulator");
+diff --git a/drivers/regulator/pcf50633-regulator.c b/drivers/regulator/pcf50633-regulator.c
+index c8f41dc..6ef66d9 100644
+--- a/drivers/regulator/pcf50633-regulator.c
++++ b/drivers/regulator/pcf50633-regulator.c
+@@ -313,11 +313,10 @@ static int __devinit pcf50633_regulator_probe(struct platform_device *pdev)
+ struct regulator_dev *rdev;
+ struct pcf50633 *pcf;
+
+- /* Already set by core driver */
+ pcf = dev_to_pcf50633(pdev->dev.parent);
+
+ rdev = regulator_register(®ulators[pdev->id], &pdev->dev,
+- pdev->dev.platform_data, pcf);
++ &pcf->pdata->reg_init_data[pdev->id], pcf);
+ if (IS_ERR(rdev))
+ return PTR_ERR(rdev);
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 6a13037..1bd28bb 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -618,6 +618,13 @@ config RTC_DRV_NUC900
+ If you say yes here you get support for the RTC subsystem of the
+ NUC910/NUC920 used in embedded systems.
+
++config RTC_DRV_PCF50606
++ depends on MFD_PCF50606
++ tristate "NXP PCF50606 RTC"
++ help
++ If you say yes here you get support for the RTC subsystem of the
++ NXP PCF50606 used in embedded systems.
++
+ comment "on-CPU RTC drivers"
+
+ config RTC_DRV_OMAP
+diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
+index 44ef194..02a0fe4 100644
+--- a/drivers/rtc/Makefile
++++ b/drivers/rtc/Makefile
+@@ -64,6 +64,7 @@ obj-$(CONFIG_RTC_DRV_PCAP) += rtc-pcap.o
+ obj-$(CONFIG_RTC_DRV_PCF8563) += rtc-pcf8563.o
+ obj-$(CONFIG_RTC_DRV_PCF8583) += rtc-pcf8583.o
+ obj-$(CONFIG_RTC_DRV_PCF2123) += rtc-pcf2123.o
++obj-$(CONFIG_RTC_DRV_PCF50606) += rtc-pcf50606.o
+ obj-$(CONFIG_RTC_DRV_PCF50633) += rtc-pcf50633.o
+ obj-$(CONFIG_RTC_DRV_PL030) += rtc-pl030.o
+ obj-$(CONFIG_RTC_DRV_PL031) += rtc-pl031.o
+diff --git a/drivers/rtc/rtc-pcf50606.c b/drivers/rtc/rtc-pcf50606.c
+new file mode 100644
+index 0000000..5501615
+--- /dev/null
++++ b/drivers/rtc/rtc-pcf50606.c
+@@ -0,0 +1,342 @@
++/* NXP PCF50606 RTC Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte, Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ */
+
-+ return count;
-+}
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/platform_device.h>
++#include <linux/rtc.h>
++#include <linux/bcd.h>
++#include <linux/err.h>
++#include <linux/slab.h>
+
-+static DEVICE_ATTR(dump, 0400, hdq_sysfs_dump, NULL);
-+static DEVICE_ATTR(write, 0600, NULL, hdq_sysfs_write);
++#include <linux/mfd/pcf50606/core.h>
++
++#define PCF50606_REG_RTCSC 0x0a /* Second */
++#define PCF50606_REG_RTCMN 0x0b /* Minute */
++#define PCF50606_REG_RTCHR 0x0c /* Hour */
++#define PCF50606_REG_RTCWD 0x0d /* Weekday */
++#define PCF50606_REG_RTCDT 0x0e /* Day */
++#define PCF50606_REG_RTCMT 0x0f /* Month */
++#define PCF50606_REG_RTCYR 0x10 /* Year */
++#define PCF50606_REG_RTCSCA 0x11 /* Alarm Second */
++#define PCF50606_REG_RTCMNA 0x12 /* Alarm Minute */
++#define PCF50606_REG_RTCHRA 0x13 /* Alarm Hour */
++#define PCF50606_REG_RTCWDA 0x14 /* Alarm Weekday */
++#define PCF50606_REG_RTCDTA 0x15 /* Alarm Day */
++#define PCF50606_REG_RTCMTA 0x16 /* Alarm Month */
++#define PCF50606_REG_RTCYRA 0x17 /* Alarm Year */
++
++enum pcf50606_time_indexes {
++ PCF50606_TI_SEC,
++ PCF50606_TI_MIN,
++ PCF50606_TI_HOUR,
++ PCF50606_TI_WKDAY,
++ PCF50606_TI_DAY,
++ PCF50606_TI_MONTH,
++ PCF50606_TI_YEAR,
++ PCF50606_TI_EXTENT /* always last */
++};
+
-+static struct attribute *hdq_sysfs_entries[] = {
-+ &dev_attr_dump.attr,
-+ &dev_attr_write.attr,
-+ NULL
++struct pcf50606_time {
++ uint8_t time[PCF50606_TI_EXTENT];
+};
+
-+static struct attribute_group hdq_attr_group = {
-+ .name = "hdq",
-+ .attrs = hdq_sysfs_entries,
++struct pcf50606_rtc {
++ int alarm_enabled;
++ int second_enabled;
++ int alarm_pending;
++
++ struct pcf50606 *pcf;
++ struct rtc_device *rtc_dev;
+};
+
++static void pcf2rtc_time(struct rtc_time *rtc, struct pcf50606_time *pcf)
++{
++ rtc->tm_sec = bcd2bin(pcf->time[PCF50606_TI_SEC]);
++ rtc->tm_min = bcd2bin(pcf->time[PCF50606_TI_MIN]);
++ rtc->tm_hour = bcd2bin(pcf->time[PCF50606_TI_HOUR]);
++ rtc->tm_wday = bcd2bin(pcf->time[PCF50606_TI_WKDAY]);
++ rtc->tm_mday = bcd2bin(pcf->time[PCF50606_TI_DAY]);
++ rtc->tm_mon = bcd2bin(pcf->time[PCF50606_TI_MONTH]) - 1;
++ rtc->tm_year = bcd2bin(pcf->time[PCF50606_TI_YEAR]) + 100;
++}
+
-+#ifdef CONFIG_PM
-+static int hdq_suspend(struct platform_device *pdev, pm_message_t state)
++static void rtc2pcf_time(struct pcf50606_time *pcf, struct rtc_time *rtc)
+{
-+ /* after 18s of this, the battery monitor will also go to sleep */
-+ hdq_priv.pdata->gpio_dir_in();
-+ hdq_priv.pdata->disable_fiq();
-+ return 0;
++ pcf->time[PCF50606_TI_SEC] = bin2bcd(rtc->tm_sec);
++ pcf->time[PCF50606_TI_MIN] = bin2bcd(rtc->tm_min);
++ pcf->time[PCF50606_TI_HOUR] = bin2bcd(rtc->tm_hour);
++ pcf->time[PCF50606_TI_WKDAY] = bin2bcd(rtc->tm_wday);
++ pcf->time[PCF50606_TI_DAY] = bin2bcd(rtc->tm_mday);
++ pcf->time[PCF50606_TI_MONTH] = bin2bcd(rtc->tm_mon + 1);
++ pcf->time[PCF50606_TI_YEAR] = bin2bcd(rtc->tm_year % 100);
+}
+
-+static int hdq_resume(struct platform_device *pdev)
++static int
++pcf50606_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
-+ hdq_priv.pdata->gpio_set(1);
-+ hdq_priv.pdata->gpio_dir_out();
-+ hdq_priv.pdata->enable_fiq();
-+ return 0;
++ struct pcf50606_rtc *rtc = dev_get_drvdata(dev);
++
++ switch (cmd) {
++ case RTC_AIE_OFF:
++ rtc->alarm_enabled = 0;
++ pcf50606_irq_mask(rtc->pcf, PCF50606_IRQ_ALARM);
++ return 0;
++ case RTC_AIE_ON:
++ rtc->alarm_enabled = 1;
++ pcf50606_irq_unmask(rtc->pcf, PCF50606_IRQ_ALARM);
++ return 0;
++ case RTC_UIE_OFF:
++ rtc->second_enabled = 0;
++ pcf50606_irq_mask(rtc->pcf, PCF50606_IRQ_SECOND);
++ return 0;
++ case RTC_UIE_ON:
++ rtc->second_enabled = 1;
++ pcf50606_irq_unmask(rtc->pcf, PCF50606_IRQ_SECOND);
++ return 0;
++ }
++
++ return -ENOIOCTLCMD;
+}
-+#endif
+
-+static int __init hdq_probe(struct platform_device *pdev)
++static int pcf50606_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
++ struct pcf50606_rtc *rtc;
++ struct pcf50606_time pcf_tm;
+ int ret;
-+ struct hdq_platform_data *pdata = pdev->dev.platform_data;
+
-+ if (!pdata)
-+ return -EINVAL;
++ rtc = dev_get_drvdata(dev);
+
-+ platform_set_drvdata(pdev, NULL);
++ ret = pcf50606_read_block(rtc->pcf, PCF50606_REG_RTCSC,
++ PCF50606_TI_EXTENT,
++ &pcf_tm.time[0]);
++ if (ret != PCF50606_TI_EXTENT) {
++ dev_err(dev, "Failed to read time\n");
++ return -EIO;
++ }
+
-+ mutex_init(&hdq_priv.hdq_lock);
++ dev_dbg(dev, "PCF_TIME: %02x.%02x.%02x %02x:%02x:%02x\n",
++ pcf_tm.time[PCF50606_TI_DAY],
++ pcf_tm.time[PCF50606_TI_MONTH],
++ pcf_tm.time[PCF50606_TI_YEAR],
++ pcf_tm.time[PCF50606_TI_HOUR],
++ pcf_tm.time[PCF50606_TI_MIN],
++ pcf_tm.time[PCF50606_TI_SEC]);
+
-+ /* set our HDQ comms pin from the platform data */
-+ hdq_priv.pdata = pdata;
++ pcf2rtc_time(tm, &pcf_tm);
+
-+ hdq_priv.pdata->gpio_set(1);
-+ hdq_priv.pdata->gpio_dir_out();
++ dev_dbg(dev, "RTC_TIME: %u.%u.%u %u:%u:%u\n",
++ tm->tm_mday, tm->tm_mon, tm->tm_year,
++ tm->tm_hour, tm->tm_min, tm->tm_sec);
+
-+ /* Initialize FIQ */
-+ if (hdq_priv.pdata->enable_fiq() < 0) {
-+ dev_err(&pdev->dev, "Could not enable FIQ source\n");
-+ return -EINVAL;
-+ }
++ return rtc_valid_tm(tm);
++}
+
-+ ret = sysfs_create_group(&pdev->dev.kobj, &hdq_attr_group);
-+ if (ret)
-+ return ret;
++static int pcf50606_rtc_set_time(struct device *dev, struct rtc_time *tm)
++{
++ struct pcf50606_rtc *rtc;
++ struct pcf50606_time pcf_tm;
++ int second_masked, alarm_masked, ret = 0;
+
-+ hdq_priv.hdq_probed = 1; /* we are ready to do stuff now */
++ rtc = dev_get_drvdata(dev);
+
-+ /*
-+ * if wanted, users can defer registration of devices
-+ * that depend on HDQ until after we register, and can use our
-+ * device as parent so suspend-resume ordering is correct
-+ */
-+ if (pdata->attach_child_devices)
-+ (pdata->attach_child_devices)(&pdev->dev);
++ dev_dbg(dev, "RTC_TIME: %u.%u.%u %u:%u:%u\n",
++ tm->tm_mday, tm->tm_mon, tm->tm_year,
++ tm->tm_hour, tm->tm_min, tm->tm_sec);
+
-+ hdq_priv.pdata = pdata;
++ rtc2pcf_time(&pcf_tm, tm);
+
-+ return 0;
-+}
++ dev_dbg(dev, "PCF_TIME: %02x.%02x.%02x %02x:%02x:%02x\n",
++ pcf_tm.time[PCF50606_TI_DAY],
++ pcf_tm.time[PCF50606_TI_MONTH],
++ pcf_tm.time[PCF50606_TI_YEAR],
++ pcf_tm.time[PCF50606_TI_HOUR],
++ pcf_tm.time[PCF50606_TI_MIN],
++ pcf_tm.time[PCF50606_TI_SEC]);
+
-+static int hdq_remove(struct platform_device *pdev)
-+{
-+ sysfs_remove_group(&pdev->dev.kobj, &hdq_attr_group);
-+ return 0;
-+}
+
-+static struct platform_driver hdq_driver = {
-+ .probe = hdq_probe,
-+ .remove = hdq_remove,
-+#ifdef CONFIG_PM
-+ .suspend = hdq_suspend,
-+ .resume = hdq_resume,
-+#endif
-+ .driver = {
-+ .name = "hdq",
-+ },
-+};
++ second_masked = pcf50606_irq_mask_get(rtc->pcf, PCF50606_IRQ_SECOND);
++ alarm_masked = pcf50606_irq_mask_get(rtc->pcf, PCF50606_IRQ_ALARM);
+
-+static int __init hdq_init(void)
-+{
-+ return platform_driver_register(&hdq_driver);
++ if (!second_masked)
++ pcf50606_irq_mask(rtc->pcf, PCF50606_IRQ_SECOND);
++ if (!alarm_masked)
++ pcf50606_irq_mask(rtc->pcf, PCF50606_IRQ_ALARM);
++
++ /* Returns 0 on success */
++ ret = pcf50606_write_block(rtc->pcf, PCF50606_REG_RTCSC,
++ PCF50606_TI_EXTENT,
++ &pcf_tm.time[0]);
++
++ if (!second_masked)
++ pcf50606_irq_unmask(rtc->pcf, PCF50606_IRQ_SECOND);
++ if (!alarm_masked)
++ pcf50606_irq_unmask(rtc->pcf, PCF50606_IRQ_ALARM);
++
++ return ret;
+}
+
-+static void __exit hdq_exit(void)
++static int pcf50606_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
-+ platform_driver_unregister(&hdq_driver);
-+}
++ struct pcf50606_rtc *rtc;
++ struct pcf50606_time pcf_tm;
++ int ret = 0;
+
-+module_init(hdq_init);
-+module_exit(hdq_exit);
++ rtc = dev_get_drvdata(dev);
+
-+MODULE_AUTHOR("Andy Green <andy@openmoko.com>");
-+MODULE_DESCRIPTION("HDQ driver");
-diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
-index 066f994..f711485 100644
---- a/drivers/power/pcf50633-charger.c
-+++ b/drivers/power/pcf50633-charger.c
-@@ -40,7 +40,7 @@ struct pcf50633_mbc {
-
- int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
- {
-- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
-+ struct pcf50633_mbc *mbc = pcf->mbc;
- int ret = 0;
- u8 bits;
- int charging_start = 1;
-@@ -112,7 +112,7 @@ EXPORT_SYMBOL_GPL(pcf50633_mbc_usb_curlim_set);
-
- int pcf50633_mbc_get_status(struct pcf50633 *pcf)
- {
-- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
-+ struct pcf50633_mbc *mbc = pcf->mbc;
- int status = 0;
- u8 chgmod;
-
-@@ -143,7 +143,7 @@ EXPORT_SYMBOL_GPL(pcf50633_mbc_get_status);
-
- int pcf50633_mbc_get_usb_online_status(struct pcf50633 *pcf)
- {
-- struct pcf50633_mbc *mbc = platform_get_drvdata(pcf->mbc_pdev);
-+ struct pcf50633_mbc *mbc = pcf->mbc;
-
- if (!mbc)
- return 0;
-@@ -368,6 +368,7 @@ static const u8 mbc_irq_handlers[] = {
-
- static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- {
-+ struct pcf50633 *pcf = dev_to_pcf50633(pdev->dev.parent);
- struct pcf50633_mbc *mbc;
- int ret;
- int i;
-@@ -378,7 +379,7 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- return -ENOMEM;
-
- platform_set_drvdata(pdev, mbc);
-- mbc->pcf = dev_to_pcf50633(pdev->dev.parent);
-+ mbc->pcf = pcf;
-
- /* Set up IRQ handlers */
- for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
-@@ -444,6 +445,8 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
- if (mbcs1 & PCF50633_MBCS1_ADAPTPRES)
- pcf50633_mbc_irq_handler(PCF50633_IRQ_ADPINS, mbc);
-
-+ pcf->mbc = mbc;
++ alrm->enabled = rtc->alarm_enabled;
++ alrm->pending = rtc->alarm_pending;
+
- return 0;
- }
-
-@@ -452,6 +455,8 @@ static int __devexit pcf50633_mbc_remove(struct platform_device *pdev)
- struct pcf50633_mbc *mbc = platform_get_drvdata(pdev);
- int i;
-
-+ mbc->pcf->mbc = NULL;
++ ret = pcf50606_read_block(rtc->pcf, PCF50606_REG_RTCSCA,
++ PCF50606_TI_EXTENT, &pcf_tm.time[0]);
++ if (ret != PCF50606_TI_EXTENT) {
++ dev_err(dev, "Failed to read time\n");
++ return -EIO;
++ }
+
- /* Remove IRQ handlers */
- for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
- pcf50633_free_irq(mbc->pcf, mbc_irq_handlers[i]);
-diff --git a/drivers/power/platform_battery.c b/drivers/power/platform_battery.c
-new file mode 100644
-index 0000000..a5c9f35
---- /dev/null
-+++ b/drivers/power/platform_battery.c
-@@ -0,0 +1,120 @@
-+/*
-+ * Driver for platform battery
-+ *
-+ * Copyright (c) Paul Fertser <fercerpav@gmail.com>
-+ * Inspired by Balaji Rao <balajirrao@openmoko.org>
-+ *
-+ * This driver can be used for dumb batteries when all knowledge about
-+ * their state belongs to the platform that does necessary ADC readings,
-+ * conversions, guessimations etc.
-+ *
-+ * Use consistent with the GNU GPL is permitted, provided that this
-+ * copyright notice is preserved in its entirety in all copies and derived
-+ * works.
-+ */
++ pcf2rtc_time(&alrm->time, &pcf_tm);
+
-+#include <linux/module.h>
-+#include <linux/platform_device.h>
-+#include <linux/power_supply.h>
-+#include <linux/slab.h>
-+#include <linux/workqueue.h>
++ return rtc_valid_tm(&alrm->time);
++}
+
-+#include <linux/delay.h>
-+#include <linux/platform_battery.h>
++static int pcf50606_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
++{
++ struct pcf50606_rtc *rtc;
++ struct pcf50606_time pcf_tm;
++ int alarm_masked, ret = 0;
+
-+struct platform_battery {
-+ struct power_supply psy;
-+ struct platform_bat_platform_data *pdata;
-+};
++ rtc = dev_get_drvdata(dev);
+
-+static int platform_bat_get_property(struct power_supply *psy,
-+ enum power_supply_property psp,
-+ union power_supply_propval *val)
-+{
-+ struct platform_battery *bat =
-+ container_of(psy, struct platform_battery, psy);
-+ size_t i;
-+ int present=1;
++ rtc2pcf_time(&pcf_tm, &alrm->time);
+
-+ if (bat->pdata->is_present)
-+ present = bat->pdata->is_present();
++ /* do like mktime does and ignore tm_wday */
++ pcf_tm.time[PCF50606_TI_WKDAY] = 7;
+
-+ if (psp != POWER_SUPPLY_PROP_PRESENT && !present)
-+ return -ENODEV;
++ alarm_masked = pcf50606_irq_mask_get(rtc->pcf, PCF50606_IRQ_ALARM);
+
-+ for (i = 0; i < psy->num_properties; i++)
-+ if (psy->properties[i] == psp) {
-+ val->intval = bat->pdata->get_property[i]();
-+ return 0;
-+ }
++ /* disable alarm interrupt */
++ if (!alarm_masked)
++ pcf50606_irq_mask(rtc->pcf, PCF50606_IRQ_ALARM);
+
-+ return -EINVAL;
++ /* Returns 0 on success */
++ ret = pcf50606_write_block(rtc->pcf, PCF50606_REG_RTCSCA,
++ PCF50606_TI_EXTENT, &pcf_tm.time[0]);
++
++ if (!alrm->enabled)
++ rtc->alarm_pending = 0;
++
++ if (!alarm_masked || alrm->enabled)
++ pcf50606_irq_unmask(rtc->pcf, PCF50606_IRQ_ALARM);
++ rtc->alarm_enabled = alrm->enabled;
++
++ return ret;
+}
+
-+static void platform_bat_ext_changed(struct power_supply *psy)
++static struct rtc_class_ops pcf50606_rtc_ops = {
++ .ioctl = pcf50606_rtc_ioctl,
++ .read_time = pcf50606_rtc_read_time,
++ .set_time = pcf50606_rtc_set_time,
++ .read_alarm = pcf50606_rtc_read_alarm,
++ .set_alarm = pcf50606_rtc_set_alarm,
++};
++
++static void pcf50606_rtc_irq(int irq, void *data)
+{
-+ struct platform_battery *bat =
-+ container_of(psy, struct platform_battery, psy);
-+ power_supply_changed(&bat->psy);
++ struct pcf50606_rtc *rtc = data;
++
++ switch (irq) {
++ case PCF50606_IRQ_ALARM:
++ rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
++ rtc->alarm_pending = 1;
++ break;
++ case PCF50606_IRQ_SECOND:
++ rtc_update_irq(rtc->rtc_dev, 1, RTC_UF | RTC_IRQF);
++ break;
++ }
+}
+
-+static int platform_battery_probe(struct platform_device *pdev)
++static int __devinit pcf50606_rtc_probe(struct platform_device *pdev)
+{
-+ struct platform_battery *platform_bat;
-+ struct platform_bat_platform_data *pdata =
-+ (struct platform_bat_platform_data *)pdev->dev.platform_data;
++ struct pcf50606_rtc *rtc;
+
-+ platform_bat = kzalloc(sizeof(*platform_bat), GFP_KERNEL);
-+ if (!platform_bat)
++ rtc = kzalloc(sizeof(*rtc), GFP_KERNEL);
++ if (!rtc)
+ return -ENOMEM;
+
-+ if (pdata->name)
-+ platform_bat->psy.name = pdata->name;
-+ else
-+ platform_bat->psy.name = dev_name(&pdev->dev);
-+ platform_bat->psy.type = POWER_SUPPLY_TYPE_BATTERY;
-+ platform_bat->psy.properties = pdata->properties;
-+ platform_bat->psy.num_properties = pdata->num_properties;
-+ platform_bat->psy.get_property = platform_bat_get_property;
-+ platform_bat->psy.external_power_changed = platform_bat_ext_changed;
++ rtc->pcf = dev_to_pcf50606(pdev->dev.parent);
++ platform_set_drvdata(pdev, rtc);
++ rtc->rtc_dev = rtc_device_register("pcf50606-rtc", &pdev->dev,
++ &pcf50606_rtc_ops, THIS_MODULE);
+
-+ platform_bat->pdata = pdata;
-+ platform_set_drvdata(pdev, platform_bat);
-+ power_supply_register(&pdev->dev, &platform_bat->psy);
++ if (IS_ERR(rtc->rtc_dev)) {
++ kfree(rtc);
++ return PTR_ERR(rtc->rtc_dev);
++ }
++
++ pcf50606_register_irq(rtc->pcf, PCF50606_IRQ_ALARM,
++ pcf50606_rtc_irq, rtc);
++ pcf50606_register_irq(rtc->pcf, PCF50606_IRQ_SECOND,
++ pcf50606_rtc_irq, rtc);
+
+ return 0;
+}
+
-+static int platform_battery_remove(struct platform_device *pdev)
++
++static int __devexit pcf50606_rtc_remove(struct platform_device *pdev)
+{
-+ struct platform_battery *bat = platform_get_drvdata(pdev);
++ struct pcf50606_rtc *rtc;
+
-+ power_supply_unregister(&bat->psy);
-+ kfree(bat);
++ rtc = platform_get_drvdata(pdev);
++
++ rtc_device_unregister(rtc->rtc_dev);
++
++ pcf50606_free_irq(rtc->pcf, PCF50606_IRQ_ALARM);
++ pcf50606_free_irq(rtc->pcf, PCF50606_IRQ_SECOND);
++
++ platform_set_drvdata(pdev, NULL);
++ kfree(rtc);
+
+ return 0;
+}
+
-+static struct platform_driver platform_battery_driver = {
++
++static struct platform_driver pcf50606_rtc_driver = {
+ .driver = {
-+ .name = "platform_battery",
++ .name = "pcf50606-rtc",
++ .owner = THIS_MODULE,
+ },
-+ .probe = platform_battery_probe,
-+ .remove = platform_battery_remove,
++ .probe = pcf50606_rtc_probe,
++ .remove = __devexit_p(pcf50606_rtc_remove),
+};
+
-+static int __init platform_battery_init(void)
++static int __init pcf50606_rtc_init(void)
+{
-+ return platform_driver_register(&platform_battery_driver);
++ return platform_driver_register(&pcf50606_rtc_driver);
+}
-+module_init(platform_battery_init);
++module_init(pcf50606_rtc_init);
+
-+static void __exit platform_battery_exit(void)
++static void __exit pcf50606_rtc_exit(void)
+{
-+ platform_driver_unregister(&platform_battery_driver);
++ platform_driver_unregister(&pcf50606_rtc_driver);
+}
-+module_exit(platform_battery_exit);
++module_exit(pcf50606_rtc_exit);
+
++MODULE_DESCRIPTION("PCF50606 RTC driver");
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
+MODULE_LICENSE("GPL");
-+MODULE_AUTHOR("Paul Fertser <fercerpav@gmail.com>");
-+MODULE_DESCRIPTION("platform battery driver");
-diff --git a/drivers/regulator/pcf50633-regulator.c b/drivers/regulator/pcf50633-regulator.c
-index c8f41dc..6ef66d9 100644
---- a/drivers/regulator/pcf50633-regulator.c
-+++ b/drivers/regulator/pcf50633-regulator.c
-@@ -313,11 +313,10 @@ static int __devinit pcf50633_regulator_probe(struct platform_device *pdev)
- struct regulator_dev *rdev;
- struct pcf50633 *pcf;
-
-- /* Already set by core driver */
- pcf = dev_to_pcf50633(pdev->dev.parent);
-
- rdev = regulator_register(®ulators[pdev->id], &pdev->dev,
-- pdev->dev.platform_data, pcf);
-+ &pcf->pdata->reg_init_data[pdev->id], pcf);
- if (IS_ERR(rdev))
- return PTR_ERR(rdev);
-
++
diff --git a/drivers/serial/samsung.c b/drivers/serial/samsung.c
index a9d6c56..f7b80ae 100644
--- a/drivers/serial/samsung.c
+MODULE_DESCRIPTION("Smedia Glamo 336x/337x framebuffer driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:glamo-fb");
+diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
+index 2b094de..33a83b7 100644
+--- a/drivers/video/s3c2410fb.c
++++ b/drivers/video/s3c2410fb.c
+@@ -631,7 +631,7 @@ static struct fb_ops s3c2410fb_ops = {
+ * cache. Once this area is remapped, all virtual memory
+ * access to the video memory should occur at the new region.
+ */
+-static int __init s3c2410fb_map_video_memory(struct fb_info *info)
++static int __devinit s3c2410fb_map_video_memory(struct fb_info *info)
+ {
+ struct s3c2410fb_info *fbi = info->par;
+ dma_addr_t map_dma;
+@@ -814,7 +814,7 @@ static inline void s3c2410fb_cpufreq_deregister(struct s3c2410fb_info *info)
+
+ static char driver_name[] = "s3c2410fb";
+
+-static int __init s3c24xxfb_probe(struct platform_device *pdev,
++static int __devinit s3c24xxfb_probe(struct platform_device *pdev,
+ enum s3c_drv_type drv_type)
+ {
+ struct s3c2410fb_info *info;
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index b87ba23..0ee6f41 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -161,6 +161,13 @@ config S3C2410_WATCHDOG
+ The driver can be built as a module by choosing M, and will
+ be called s3c2410_wdt
+
++config PCF50606_WATCHDOG
++ depends on MFD_PCF50606
++ tristate "Philips PCF50606 watchdog"
++ help
++ If you say yes here you get support for the Philips PCF50606
++ PMU's watchdog.
++
+ config SA1100_WATCHDOG
+ tristate "SA1100/PXA2xx watchdog"
+ depends on ARCH_SA1100 || ARCH_PXA
+diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
+index 5e3cb95..ae75364 100644
+--- a/drivers/watchdog/Makefile
++++ b/drivers/watchdog/Makefile
+@@ -35,6 +35,7 @@ obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
+ obj-$(CONFIG_IXP4XX_WATCHDOG) += ixp4xx_wdt.o
+ obj-$(CONFIG_KS8695_WATCHDOG) += ks8695_wdt.o
+ obj-$(CONFIG_S3C2410_WATCHDOG) += s3c2410_wdt.o
++obj-$(CONFIG_PCF50606_WATCHDOG) += pcf50606_wdt.o
+ obj-$(CONFIG_SA1100_WATCHDOG) += sa1100_wdt.o
+ obj-$(CONFIG_MPCORE_WATCHDOG) += mpcore_wdt.o
+ obj-$(CONFIG_EP93XX_WATCHDOG) += ep93xx_wdt.o
+diff --git a/drivers/watchdog/pcf50606_wdt.c b/drivers/watchdog/pcf50606_wdt.c
+new file mode 100644
+index 0000000..6a53c66
+--- /dev/null
++++ b/drivers/watchdog/pcf50606_wdt.c
+@@ -0,0 +1,216 @@
++/* Philips PCF50606 Watchdog Timer Driver
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * Author: Balaji Rao <balajirrao@openmoko.org>
++ * All rights reserved.
++ *
++ * Broken down from monstrous PCF50606 driver mainly by
++ * Harald Welte, Matt Hsu, Andy Green and Werner Almesberger
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License as
++ * published by the Free Software Foundation; either version 2 of
++ * the License, or (at your option) any later version.
++ */
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/device.h>
++#include <linux/rtc.h>
++#include <linux/bcd.h>
++#include <linux/err.h>
++#include <linux/miscdevice.h>
++#include <linux/watchdog.h>
++#include <linux/platform_device.h>
++
++#include <linux/mfd/pcf50606/core.h>
++
++static struct pcf50606 *pcf = NULL;
++static unsigned long wdt_status;
++
++#define WDT_IN_USE 0
++#define WDT_OK_TO_CLOSE 1
++#define WDT_REGION_INITED 2
++#define WDT_DEVICE_INITED 3
++
++static int allow_close;
++#define CLOSE_STATE_NOT 0x0000
++#define CLOSE_STATE_ALLOW 0x2342
++
++#define PCF50606_REG_OOCC1 0x08
++#define PCF50606_REG_OOCS 0x01
++
++#define PCF50606_OOCS_WDTEXP 0x80
++#define PCF50606_OOCC1_WDTRST 0x08
++
++static void pcf50606_wdt_start(void)
++{
++ pcf50606_reg_set_bit_mask(pcf, PCF50606_REG_OOCC1, PCF50606_OOCC1_WDTRST,
++ PCF50606_OOCC1_WDTRST);
++}
++
++static void pcf50606_wdt_stop(void)
++{
++ pcf50606_reg_clear_bits(pcf, PCF50606_REG_OOCS, PCF50606_OOCS_WDTEXP);
++}
++
++static void pcf50606_wdt_keepalive(void)
++{
++ pcf50606_wdt_start();
++}
++
++static int pcf50606_wdt_open(struct inode *inode, struct file *file)
++{
++ if (test_and_set_bit(WDT_IN_USE, &wdt_status))
++ return -EBUSY;
++
++ pcf50606_wdt_start();
++
++ return nonseekable_open(inode, file);
++}
++
++static int pcf50606_wdt_release(struct inode *inode, struct file *file)
++{
++ if (allow_close == CLOSE_STATE_ALLOW)
++ pcf50606_wdt_stop();
++ else {
++ printk(KERN_CRIT "Unexpected close, not stopping watchdog!\n");
++ pcf50606_wdt_keepalive();
++ }
++
++ allow_close = CLOSE_STATE_NOT;
++ clear_bit(WDT_IN_USE, &wdt_status);
++
++ return 0;
++}
++
++static ssize_t pcf50606_wdt_write(struct file *file, const char __user *data,
++ size_t len, loff_t *ppos)
++{
++ if (len) {
++ size_t i;
++
++ for (i = 0; i != len; i++) {
++ char c;
++ if (get_user(c, data + i))
++ return -EFAULT;
++ if (c == 'V')
++ allow_close = CLOSE_STATE_ALLOW;
++ }
++ pcf50606_wdt_keepalive();
++ }
++
++ return len;
++}
++
++static struct watchdog_info pcf50606_wdt_ident = {
++ .options = WDIOF_MAGICCLOSE,
++ .firmware_version = 0,
++ .identity = "PCF50606 Watchdog",
++};
++
++static int pcf50606_wdt_ioctl(struct inode *inode, struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ void __user *argp = (void __user *)arg;
++ int __user *p = argp;
++
++ switch (cmd) {
++ case WDIOC_GETSUPPORT:
++ return copy_to_user(argp, &pcf50606_wdt_ident,
++ sizeof(pcf50606_wdt_ident)) ? -EFAULT : 0;
++ break;
++ case WDIOC_GETSTATUS:
++ case WDIOC_GETBOOTSTATUS:
++ return put_user(0, p);
++ case WDIOC_KEEPALIVE:
++ pcf50606_wdt_keepalive();
++ return 0;
++ case WDIOC_GETTIMEOUT:
++ return put_user(8, p);
++ default:
++ return -ENOIOCTLCMD;
++ }
++}
++
++static struct file_operations pcf50606_wdt_fops = {
++ .owner = THIS_MODULE,
++ .llseek = no_llseek,
++ .write = &pcf50606_wdt_write,
++ .ioctl = &pcf50606_wdt_ioctl,
++ .open = &pcf50606_wdt_open,
++ .release = &pcf50606_wdt_release,
++};
++
++static struct miscdevice pcf50606_wdt_miscdev = {
++ .minor = WATCHDOG_MINOR,
++ .name = "watchdog",
++ .fops = &pcf50606_wdt_fops,
++};
++
++static void pcf50606_wdt_irq(int irq, void *unused)
++{
++ pcf50606_reg_set_bit_mask(pcf, PCF50606_REG_OOCC1,
++ PCF50606_OOCC1_WDTRST,
++ PCF50606_OOCC1_WDTRST);
++}
++
++int __init pcf50606_wdt_probe(struct platform_device *pdev)
++{
++ int err;
++
++ if (pcf) {
++ dev_err(pcf->dev, "Only one instance of WDT supported\n");
++ return -ENODEV;
++ }
++
++ pcf = dev_to_pcf50606(pdev->dev.parent);
++
++ err = misc_register(&pcf50606_wdt_miscdev);
++ if (err) {
++ dev_err(&pdev->dev, "cannot register miscdev on "
++ "minor=%d (%d)\n", WATCHDOG_MINOR, err);
++ return err;
++ }
++ set_bit(WDT_DEVICE_INITED, &wdt_status);
++
++ pcf50606_register_irq(pcf, PCF50606_IRQ_CHGWD10S, pcf50606_wdt_irq, NULL);
++
++ return 0;
++}
++
++static int __devexit pcf50606_wdt_remove(struct platform_device *pdev)
++{
++ pcf50606_free_irq(pcf, PCF50606_IRQ_CHGWD10S);
++ misc_deregister(&pcf50606_wdt_miscdev);
++ pcf = NULL;
++
++ return 0;
++}
++
++struct platform_driver pcf50606_wdt_driver = {
++ .driver = {
++ .name = "pcf50606-wdt",
++ },
++ .probe = pcf50606_wdt_probe,
++ .remove = __devexit_p(pcf50606_wdt_remove),
++};
++
++static int __init pcf50606_wdt_init(void)
++{
++ return platform_driver_register(&pcf50606_wdt_driver);
++}
++module_init(pcf50606_wdt_init);
++
++static void __exit pcf50606_wdt_exit(void)
++{
++ platform_driver_unregister(&pcf50606_wdt_driver);
++}
++module_exit(pcf50606_wdt_exit);
++
++MODULE_AUTHOR("Balaji Rao <balajirrao@openmoko.org>");
++MODULE_DESCRIPTION("PCF50606 wdt driver");
++MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:pcf50606-wdt");
++
diff --git a/include/linux/bq27000_battery.h b/include/linux/bq27000_battery.h
new file mode 100644
index 0000000..a617466
+
+#endif
diff --git a/include/linux/fb.h b/include/linux/fb.h
-index c10163b..71f714a 100644
+index 94af940..25a79ef 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -134,6 +134,7 @@ struct dentry;
+};
+
+#endif
+diff --git a/include/linux/mfd/pcf50606/adc.h b/include/linux/mfd/pcf50606/adc.h
+new file mode 100644
+index 0000000..fd48403
+--- /dev/null
++++ b/include/linux/mfd/pcf50606/adc.h
+@@ -0,0 +1,72 @@
++/*
++ * adc.h -- Driver for NXP PCF50606 ADC
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ */
++
++#ifndef __LINUX_MFD_PCF50606_ADC_H
++#define __LINUX_MFD_PCF50606_ADC_H
++
++#include <linux/mfd/pcf50633/core.h>
++#include <linux/platform_device.h>
++
++/* ADC Registers */
++#define PCF50606_REG_ADCC1 0x2e
++#define PCF50606_REG_ADCC2 0x2f
++#define PCF50606_REG_ADCS1 0x30
++#define PCF50606_REG_ADCS2 0x31
++#define PCF50606_REG_ADCS3 0x32
++
++#define PCF50606_ADCC1_TSCMODACT 0x01
++#define PCF50606_ADCC1_TSCMODSTB 0x02
++#define PCF50606_ADCC1_TRATSET 0x04
++#define PCF50606_ADCC1_NTCSWAPE 0x08
++#define PCF50606_ADCC1_NTCSWAOFF 0x10
++#define PCF50606_ADCC1_EXTSYNCBREAK 0x20
++ /* reserved */
++#define PCF50606_ADCC1_TSCINT 0x80
++
++#define PCF50606_ADCC2_ADCSTART 0x01
++ /* see enum pcf50606_adcc2_adcmux */
++#define PCF50606_ADCC2_SYNC_NONE 0x00
++#define PCF50606_ADCC2_SYNC_TXON 0x20
++#define PCF50606_ADCC2_SYNC_PWREN1 0x40
++#define PCF50606_ADCC2_SYNC_PWREN2 0x60
++#define PCF50606_ADCC2_RES_10BIT 0x00
++#define PCF50606_ADCC2_RES_8BIT 0x80
++
++#define PCF50606_ADCC2_ADCMUX_MASK (0xf << 1)
++
++#define ADCMUX_SHIFT 1
++#define PCF50606_ADCMUX_BATVOLT_RES (0x0 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_BATVOLT_SUBTR (0x1 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_ADCIN1_RES (0x2 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_ADCIN1_SUBTR (0x3 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_BATTEMP (0x4 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_ADCIN2 (0x5 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_ADCIN3 (0x6 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_ADCIN3_RATIO (0x7 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_XPOS (0x8 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_YPOS (0x9 << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_P1 (0xa << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_P2 (0xb << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_BATVOLT_ADCIN1 (0xc << ADCMUX_SHIFT)
++#define PCF50606_ADCMUX_XY_SEQUENCE (0xe << ADCMUX_SHIFT)
++#define PCF50606_P1_P2_RESISTANCE (0xf << ADCMUX_SHIFT)
++
++#define PCF50606_ADCS2_ADCRDY 0x80
++
++extern int
++pcf50606_adc_async_read(struct pcf50606 *pcf, int mux,
++ void (*callback)(struct pcf50606 *, void *, int),
++ void *callback_param);
++extern int
++pcf50606_adc_sync_read(struct pcf50606 *pcf, int mux);
++
++#endif /* __LINUX_PCF50606_ADC_H */
+diff --git a/include/linux/mfd/pcf50606/core.h b/include/linux/mfd/pcf50606/core.h
+new file mode 100644
+index 0000000..e036e07
+--- /dev/null
++++ b/include/linux/mfd/pcf50606/core.h
+@@ -0,0 +1,172 @@
++/*
++ * core.h -- Core driver for NXP PCF50606
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ */
++
++#ifndef __LINUX_MFD_PCF50606_CORE_H
++#define __LINUX_MFD_PCF50606_CORE_H
++
++#include <linux/i2c.h>
++#include <linux/workqueue.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/power_supply.h>
++
++struct pcf50606;
++
++#define PCF50606_NUM_REGULATORS 8
++
++struct pcf50606_platform_data {
++ struct regulator_init_data reg_init_data[PCF50606_NUM_REGULATORS];
++
++ char **batteries;
++ int num_batteries;
++
++ /* Callbacks */
++ void (*probe_done)(struct pcf50606 *);
++ void (*mbc_event_callback)(struct pcf50606 *, int);
++ void (*regulator_registered)(struct pcf50606 *, int);
++ void (*force_shutdown)(struct pcf50606 *);
++
++ u8 resumers[3];
++};
++
++struct pcf50606_irq {
++ void (*handler)(int, void *);
++ void *data;
++};
++
++int pcf50606_register_irq(struct pcf50606 *pcf, int irq,
++ void (*handler) (int, void *), void *data);
++int pcf50606_free_irq(struct pcf50606 *pcf, int irq);
++
++int pcf50606_irq_mask(struct pcf50606 *pcf, int irq);
++int pcf50606_irq_unmask(struct pcf50606 *pcf, int irq);
++int pcf50606_irq_mask_get(struct pcf50606 *pcf, int irq);
++
++int pcf50606_read_block(struct pcf50606 *, u8 reg,
++ int nr_regs, u8 *data);
++int pcf50606_write_block(struct pcf50606 *pcf, u8 reg,
++ int nr_regs, u8 *data);
++u8 pcf50606_reg_read(struct pcf50606 *, u8 reg);
++int pcf50606_reg_write(struct pcf50606 *pcf, u8 reg, u8 val);
++
++int pcf50606_reg_set_bit_mask(struct pcf50606 *pcf, u8 reg, u8 mask, u8 val);
++int pcf50606_reg_clear_bits(struct pcf50606 *pcf, u8 reg, u8 bits);
++
++/* Interrupt registers */
++
++#define PCF50606_REG_INT1 0x02
++#define PCF50606_REG_INT2 0x03
++#define PCF50606_REG_INT3 0x04
++
++#define PCF50606_REG_INT1M 0x05
++#define PCF50606_REG_INT2M 0x06
++#define PCF50606_REG_INT3M 0x07
++
++enum {
++ /* Chip IRQs */
++ PCF50606_IRQ_ONKEYR,
++ PCF50606_IRQ_ONKEYF,
++ PCF50606_IRQ_ONKEY1S,
++ PCF50606_IRQ_EXTONR,
++ PCF50606_IRQ_EXTONF,
++ PCF50606_IRQ_RESERVED_1,
++ PCF50606_IRQ_SECOND,
++ PCF50606_IRQ_ALARM,
++ PCF50606_IRQ_CHGINS,
++ PCF50606_IRQ_CHGRM,
++ PCF50606_IRQ_CHGFOK,
++ PCF50606_IRQ_CHGERR,
++ PCF50606_IRQ_CHGFRDY,
++ PCF50606_IRQ_CHGPROT,
++ PCF50606_IRQ_CHGWD10S,
++ PCF50606_IRQ_CHGWDEXP,
++ PCF50606_IRQ_ADCRDY,
++ PCF50606_IRQ_ACDINS,
++ PCF50606_IRQ_ACDREM,
++ PCF50606_IRQ_TSCPRES,
++ PCF50606_IRQ_RESERVED_2,
++ PCF50606_IRQ_RESERVED_3,
++ PCF50606_IRQ_LOWBAT,
++ PCF50606_IRQ_HIGHTMP,
++
++ /* Always last */
++ PCF50606_NUM_IRQ,
++};
++
++struct pcf50606 {
++ struct device *dev;
++ struct i2c_client *i2c_client;
++
++ struct pcf50606_platform_data *pdata;
++ int irq;
++ struct pcf50606_irq irq_handler[PCF50606_NUM_IRQ];
++ struct work_struct irq_work;
++ struct mutex lock;
++
++ u8 mask_regs[3];
++
++ u8 suspend_irq_masks[3];
++ u8 resume_reason[3];
++ int is_suspended;
++
++ int onkey1s_held;
++
++ struct platform_device *rtc_pdev;
++ struct platform_device *mbc_pdev;
++ struct platform_device *adc_pdev;
++ struct platform_device *input_pdev;
++ struct platform_device *wdt_pdev;
++ struct platform_device *regulator_pdev[PCF50606_NUM_REGULATORS];
++};
++
++enum pcf50606_reg_int1 {
++ PCF50606_INT1_ONKEYR = 0x01, /* ONKEY rising edge */
++ PCF50606_INT1_ONKEYF = 0x02, /* ONKEY falling edge */
++ PCF50606_INT1_ONKEY1S = 0x04, /* OMKEY at least 1sec low */
++ PCF50606_INT1_EXTONR = 0x08, /* EXTON rising edge */
++ PCF50606_INT1_EXTONF = 0x10, /* EXTON falling edge */
++ PCF50606_INT1_SECOND = 0x40, /* RTC periodic second interrupt */
++ PCF50606_INT1_ALARM = 0x80, /* RTC alarm time is reached */
++};
++
++enum pcf50606_reg_int2 {
++ PCF50606_INT2_CHGINS = 0x01, /* Charger inserted */
++ PCF50606_INT2_CHGRM = 0x02, /* Charger removed */
++ PCF50606_INT2_CHGFOK = 0x04, /* Fast charging OK */
++ PCF50606_INT2_CHGERR = 0x08, /* Error in charging mode */
++ PCF50606_INT2_CHGFRDY = 0x10, /* Fast charge completed */
++ PCF50606_INT2_CHGPROT = 0x20, /* Charging protection interrupt */
++ PCF50606_INT2_CHGWD10S = 0x40, /* Charger watchdig expires in 10s */
++ PCF50606_INT2_CHGWDEXP = 0x80, /* Charger watchdog expires */
++};
++
++enum pcf50606_reg_int3 {
++ PCF50606_INT3_ADCRDY = 0x01, /* ADC conversion finished */
++ PCF50606_INT3_ACDINS = 0x02, /* Accessory inserted */
++ PCF50606_INT3_ACDREM = 0x04, /* Accessory removed */
++ PCF50606_INT3_TSCPRES = 0x08, /* Touch screen pressed */
++ PCF50606_INT3_LOWBAT = 0x40, /* Low battery voltage */
++ PCF50606_INT3_HIGHTMP = 0x80, /* High temperature */
++};
++
++/* Misc regs */
++
++#define PCF50606_REG_OOCC1 0x08
++#define PCF50606_OOCC1_GOSTDBY 0x01
++
++static inline struct pcf50606 *dev_to_pcf50606(struct device *dev)
++{
++ return dev_get_drvdata(dev);
++}
++
++#endif
++
+diff --git a/include/linux/mfd/pcf50606/mbc.h b/include/linux/mfd/pcf50606/mbc.h
+new file mode 100644
+index 0000000..23aeb9e
+--- /dev/null
++++ b/include/linux/mfd/pcf50606/mbc.h
+@@ -0,0 +1,52 @@
++/*
++ * mbc.h -- Driver for NXP PCF50606 Main Battery Charger
++ *
++ * (C) 2006-2008 by Openmoko, Inc.
++ * All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ */
++
++#ifndef __LINUX_MFD_PCF50606_MBC_H
++#define __LINUX_MFD_PCF50606_MBC_H
++
++#include <linux/mfd/pcf50606/core.h>
++#include <linux/platform_device.h>
++
++#define PCF50606_REG_OOCS 0x01
++
++/* Charger OK */
++#define PCF50606_OOCS_CHGOK 0x20
++
++#define PCF50606_REG_MBCC1 0x29
++#define PCF50606_REG_MBCC2 0x2a
++#define PCF50606_REG_MBCC3 0x2b
++#define PCF50606_REG_MBCS1 0x2c
++
++#define PCF50606_MBCC1_CHGAPE 0x01
++#define PCF50606_MBCC1_AUTOFST 0x02
++#define PCF50606_MBCC1_CHGMOD_MASK 0x1c
++#define PCF50606_MBCC1_CHGMOD_QUAL 0x00
++#define PCF50606_MBCC1_CHGMOD_PRE 0x04
++#define PCF50606_MBCC1_CHGMOD_TRICKLE 0x08
++#define PCF50606_MBCC1_CHGMOD_FAST_CCCV 0x0c
++#define PCF50606_MBCC1_CHGMOD_FAST_NOCC 0x10
++#define PCF50606_MBCC1_CHGMOD_FAST_NOCV 0x14
++#define PCF50606_MBCC1_CHGMOD_FAST_SW 0x18
++#define PCF50606_MBCC1_CHGMOD_IDLE 0x1c
++#define PCF50606_MBCC1_DETMOD_LOWCHG 0x20
++#define PCF50606_MBCC1_DETMOD_WDRST 0x40
++
++#define PCF50606_MBCC1_CHGMOD_SHIFT 2
++
++/* Charger status */
++#define PCF50606_MBC_CHARGER_ONLINE 0x01
++#define PCF50606_MBC_CHARGER_ACTIVE 0x02
++
++int pcf50606_charge_fast(struct pcf50606 *pcf, int on);
++
++#endif
++
+diff --git a/include/linux/mfd/pcf50606/pmic.h b/include/linux/mfd/pcf50606/pmic.h
+new file mode 100644
+index 0000000..1bcfe39
+--- /dev/null
++++ b/include/linux/mfd/pcf50606/pmic.h
+@@ -0,0 +1,73 @@
++#ifndef __LINUX_MFD_PCF50606_PMIC_H
++#define __LINUX_MFD_PCF50606_PMIC_H
++
++#define PCF50606_REG_DCDC1 0x1b
++#define PCF50606_REG_DCDC2 0x1c
++#define PCF50606_REG_DCDC3 0x1d
++#define PCF50606_REG_DCDC4 0x1e
++#define PCF50606_REG_DCDEC1 0x1f
++#define PCF50606_REG_DCDEC2 0x20
++#define PCF50606_REG_DCUDC1 0x21
++#define PCF50606_REG_DCUDC2 0x22
++#define PCF50606_REG_IOREGC 0x23
++#define PCF50606_REG_D1REGC1 0x24
++#define PCF50606_REG_D2REGC1 0x25
++#define PCF50606_REG_D3REGC1 0x26
++#define PCF50606_REG_LPREGC1 0x27
++#define PCF50606_REG_LPREGC2 0x28
++
++/* used by PSSC, PWROKM, PWROKS, */
++enum pcf50606_regu {
++ PCF50606_REGU_DCD = 0x01, /* DCD in phase 2 */
++ PCF50606_REGU_DCDE = 0x02, /* DCDE in phase 2 */
++ PCF50606_REGU_DCUD = 0x04, /* DCDU in phase 2 */
++ PCF50606_REGU_IO = 0x08, /* IO in phase 2 */
++ PCF50606_REGU_D1 = 0x10, /* D1 in phase 2 */
++ PCF50606_REGU_D2 = 0x20, /* D2 in phase 2 */
++ PCF50606_REGU_D3 = 0x40, /* D3 in phase 2 */
++ PCF50606_REGU_LP = 0x80, /* LP in phase 2 */
++};
++
++enum pcf50606_reg_dcdc4 {
++ PCF50606_DCDC4_MODE_AUTO = 0x00,
++ PCF50606_DCDC4_MODE_PWM = 0x01,
++ PCF50606_DCDC4_MODE_PCF = 0x02,
++ PCF50606_DCDC4_OFF_FLOAT = 0x00,
++ PCF50606_DCDC4_OFF_BYPASS = 0x04,
++ PCF50606_DCDC4_OFF_PULLDOWN = 0x08,
++ PCF50606_DCDC4_CURLIM_500mA = 0x00,
++ PCF50606_DCDC4_CURLIM_750mA = 0x10,
++ PCF50606_DCDC4_CURLIM_1000mA = 0x20,
++ PCF50606_DCDC4_CURLIM_1250mA = 0x30,
++ PCF50606_DCDC4_TOGGLE = 0x40,
++ PCF50606_DCDC4_REGSEL_DCDC2 = 0x80,
++};
++
++enum pcf50606_reg_dcdec2 {
++ PCF50606_DCDEC2_MODE_AUTO = 0x00,
++ PCF50606_DCDEC2_MODE_PWM = 0x01,
++ PCF50606_DCDEC2_MODE_PCF = 0x02,
++ PCF50606_DCDEC2_OFF_FLOAT = 0x00,
++ PCF50606_DCDEC2_OFF_BYPASS = 0x04,
++};
++
++enum pcf50606_reg_dcudc2 {
++ PCF50606_DCUDC2_MODE_AUTO = 0x00,
++ PCF50606_DCUDC2_MODE_PWM = 0x01,
++ PCF50606_DCUDC2_MODE_PCF = 0x02,
++ PCF50606_DCUDC2_OFF_FLOAT = 0x00,
++ PCF50606_DCUDC2_OFF_BYPASS = 0x04,
++};
++
++enum pcf50606_regulator_id {
++ PCF50606_REGULATOR_DCD,
++ PCF50606_REGULATOR_DCDE,
++ PCF50606_REGULATOR_DCUD,
++ PCF50606_REGULATOR_D1REG,
++ PCF50606_REGULATOR_D2REG,
++ PCF50606_REGULATOR_D3REG,
++ PCF50606_REGULATOR_LPREG,
++ PCF50606_REGULATOR_IOREG,
++};
++
++#endif
diff --git a/include/linux/mfd/pcf50633/backlight.h b/include/linux/mfd/pcf50633/backlight.h
new file mode 100644
index 0000000..9d3646a
config SND_SOC_MAX9877
tristate
+diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
+index dd5ce6d..5134c2e 100644
+--- a/sound/soc/codecs/Makefile
++++ b/sound/soc/codecs/Makefile
+@@ -56,6 +56,7 @@ snd-soc-wm9713-objs := wm9713.o
+ snd-soc-wm-hubs-objs := wm_hubs.o
+
+ # Amp
++snd-soc-lm4857-objs := lm4857.o
+ snd-soc-max9877-objs := max9877.o
+ snd-soc-tpa6130a2-objs := tpa6130a2.o
+ snd-soc-wm2000-objs := wm2000.o
+@@ -118,6 +119,7 @@ obj-$(CONFIG_SND_SOC_WM9713) += snd-soc-wm9713.o
+ obj-$(CONFIG_SND_SOC_WM_HUBS) += snd-soc-wm-hubs.o
+
+ # Amp
++obj-$(CONFIG_SND_SOC_LM4857) += snd-soc-lm4857.o
+ obj-$(CONFIG_SND_SOC_MAX9877) += snd-soc-max9877.o
+ obj-$(CONFIG_SND_SOC_TPA6130A2) += snd-soc-tpa6130a2.o
+ obj-$(CONFIG_SND_SOC_WM2000) += snd-soc-wm2000.o
diff --git a/sound/soc/codecs/lm4857.c b/sound/soc/codecs/lm4857.c
new file mode 100644
-index 0000000..3143797
+index 0000000..48dbf88
--- /dev/null
+++ b/sound/soc/codecs/lm4857.c
-@@ -0,0 +1,224 @@
+@@ -0,0 +1,225 @@
+/*
+ * LM4857 AMP driver
+ *
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
++#include <sound/tlv.h>
+
+#include "lm4857.h"
+
+ return;
+
+ if (i2c_master_send(lm4857.i2c, lm4857.regs, 4) != 4)
-+ dev_err(&lm4857_i2c->dev, "lm4857: i2c write failed\n");
++ dev_err(&lm4857.i2c->dev, "lm4857: i2c write failed\n");
+}
+
+static int lm4857_get_reg(struct snd_kcontrol *kcontrol,
+int lm4857_add_controls(struct snd_soc_codec *codec)
+{
+ return snd_soc_add_controls(codec, lm4857_controls,
-+ ARRAY_SIZE(lm5857_controls));
++ ARRAY_SIZE(lm4857_controls));
+}
-+EXPORT_GPL(lm4857_add_controlls);
++EXPORT_SYMBOL_GPL(lm4857_add_controls);
+
+static int __devinit lm4857_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+
+static void lm4857_shutdown(struct i2c_client *client)
+{
-+ lm4857_regs[LM4857_CTRL] &= 0xf0;
++ lm4857.regs[LM4857_CTRL] &= 0xf0;
+ lm4857_write_regs();
+}
+
+
+static int lm4857_suspend(struct i2c_client *client, pm_message_t state)
+{
-+ lm4857.state = lm4857_regs[LM4857_CTRL] & 0xf;
++ lm4857.state = lm4857.regs[LM4857_CTRL] & 0xf;
+
+ if (lm4857.state)
+ lm4857_shutdown(client);
+static int lm4857_resume(struct i2c_client *dev)
+{
+ if (lm4857.state) {
-+ lm4857_regs[LM4857_CTRL] |= (lm4857.state & 0x0f);
++ lm4857.regs[LM4857_CTRL] |= (lm4857.state & 0x0f);
+ lm4857_write_regs();
+ }
+ return 0;
git.openpandora.org / openembedded.git / commitdiff