diff --git a/artagent/Android.mk b/artagent/Android.mk
new file mode 100755
index 0000000..dc09243
--- /dev/null
+++ b/artagent/Android.mk
@@ -0,0 +1,27 @@
+#-------------------------------------------------
+# Copyright (c) 2012 Qualcomm Atheros, Inc..
+# All Rights Reserved.
+# Qualcomm Atheros Confidential and Proprietary.
+#-------------------------------------------------
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := artagent
+
+LOCAL_C_INCLUDES += $(TARGET_OUT_HEADERS)/libtcmd \
+
+LOCAL_CFLAGS+=
+
+LOCAL_SRC_FILES:= \ artagent.c
+
+LOCAL_LDLIBS += -lpthread -lrt
+
+LOCAL_MODULE_TAGS := optional eng
+
+LOCAL_SHARED_LIBRARIES += libcutils
+LOCAL_SHARED_LIBRARIES += libnl_2
+LOCAL_STATIC_LIBRARIES += libtcmd
+
+include $(BUILD_EXECUTABLE)
diff --git a/artagent/COPYING b/artagent/COPYING
new file mode 100644
index 0000000..77650bc
--- /dev/null
+++ b/artagent/COPYING
@@ -0,0 +1,13 @@
+Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/artagent/Makefile b/artagent/Makefile
new file mode 100644
index 0000000..8f4e719
--- /dev/null
+++ b/artagent/Makefile
@@ -0,0 +1,23 @@
+CC = gcc
+CFLAGS += -Wall -g
+
+PREFIX ?= /usr
+SBINDIR ?= $(PREFIX)/sbin
+INSTALL ?= install
+
+NLLIBNAME = libnl-1
+LIBTCMD_DIR := ../libtcmd
+
+#LDLIBS += -L/home/mattwagner/ambarella-a5s-sdk/packages/wireless/dist/usr/lib/libnl-3.so  -lrt -ltcmd
+override LDLIBS += -lrt -ltcmd $(shell pkg-config --libs $(NLLIBNAME)) 
+override CFLAGS += $(shell pkg-config --cflags $(NLLIBNAME)) -I$(LIBTCMD_DIR) -L$(LIBTCMD_DIR) -L../../dist/usr/lib/
+
+artagent: artagent.c artagent.h
+	$(MAKE) -C $(LIBTCMD_DIR)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+
+install: artagent
+	install -m 755 artagent $(DESTDIR)$(SBINDIR)
+
+clean:
+	rm -f artagent
diff --git a/artagent/artagent b/artagent/artagent
new file mode 100755
index 0000000..1a0e2de
--- /dev/null
+++ b/artagent/artagent
Binary files differ
diff --git a/artagent/artagent.c b/artagent/artagent.c
new file mode 100755
index 0000000..ab1ee57
--- /dev/null
+++ b/artagent/artagent.c
@@ -0,0 +1,383 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/errno.h>
+#include <sys/socket.h>
+#include <linux/types.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <signal.h>
+
+#include <time.h>
+#include "artagent.h"
+#include "libtcmd.h"
+
+static int sid, cid, aid;
+static char ar6kifname[32];
+unsigned int readLength = 0;
+unsigned char  line[LINE_ARRAY_SIZE];
+int cmdId,cmdLen;
+
+void callback_rx(void *buf, int len)
+{
+    int length, version;
+
+     /* skip cmd id, act */
+    buf += 2 * sizeof(unsigned int);
+    unsigned char *reply = (unsigned char*)buf;
+    length = *(unsigned short *)&(reply[0]);
+    version = (unsigned char)(reply[2]);
+
+    readLength = *(unsigned int *)&(reply[4]);
+    //printf("Version %d rx length %d read Length %d\n",version,length,readLength);
+    memcpy((void*)line, (void*)&(reply[8]),readLength);
+}
+
+static int initInterface(char *ifname)
+{
+    int err = 0;
+    err = tcmd_tx_init(ifname, callback_rx);
+    return err;
+}
+
+static int wmiSend(unsigned char *cmdBuf, unsigned int len, unsigned int totalLen, unsigned char version, bool resp)
+{
+    TC_CMDS tCmd;
+    int err=0;
+
+    memset(&tCmd,0,sizeof(tCmd));
+
+    tCmd.hdr.testCmdId = TC_CMDS_ID;
+    tCmd.hdr.u.parm.length = totalLen;
+    tCmd.hdr.u.parm.version = version;
+    tCmd.hdr.u.parm.bufLen = len;   // less than 256
+    memcpy((void*)tCmd.buf, (void*)cmdBuf, len);
+
+    if ((err = tcmd_tx((char*)&tCmd, sizeof(tCmd), resp))) {
+        fprintf(stderr, "tcmd_tx had error: %s!\n", strerror(err));
+        return 0;
+    }
+
+    return 1;
+}
+
+static void cleanup(int sig)
+{
+    if (cid>=0) {
+        close(cid);
+    }
+    if (sid>=0) {
+        close(sid);
+    }
+}
+
+int sock_init(int port)
+{
+    int                sockid;
+    struct sockaddr_in myaddr;
+    socklen_t          sinsize;
+    int                i, res;
+
+    /* Create socket */
+    sockid = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (sockid == -1) {
+        perror(__FUNCTION__);
+        printf("Create socket to PC failed\n");
+        return -1;
+    }
+
+    i = 1;
+    res = setsockopt(sockid, SOL_SOCKET, SO_REUSEADDR, (char *)&i, sizeof(i));
+    if (res == -1) {
+        close(sockid);
+        return -1;
+    }
+
+    i = 1;
+    res = setsockopt(sockid, IPPROTO_TCP, TCP_NODELAY, (char *)&i, sizeof(i));
+    if (res == -1) {
+        close(sockid);
+        return -1;
+    }
+
+    myaddr.sin_family      = AF_INET;
+    myaddr.sin_port        = htons(port);
+    myaddr.sin_addr.s_addr = htonl(INADDR_ANY);
+
+    memset(&(myaddr.sin_zero), 0, 8);
+
+    res = bind(sockid, (struct sockaddr *)&myaddr, sizeof(struct sockaddr));
+
+    if (res != 0) {
+        perror(__FUNCTION__);
+        printf("Bind failed\n");
+		close(sockid);
+        return -1;
+    }
+
+    if (listen(sockid, 4) == -1) {
+        perror(__FUNCTION__);
+        printf("Listen failed\n");
+		close(sockid);
+        return -1;
+    }
+
+    printf("Waiting for client to connect...\n");
+
+    sinsize = sizeof(struct sockaddr_in);
+    if ((cid = accept(sockid, (struct sockaddr *)&myaddr, &sinsize)) == -1) {
+        printf("Accept failed\n");
+		close(sockid);
+        return -1;
+    }
+
+    i = 1;
+    res = setsockopt(cid, IPPROTO_TCP, TCP_NODELAY, (char *)&i, sizeof(i));
+    if (res == -1) {
+        printf("cannot set NOdelay for cid\n");
+        close(sockid);
+        return -1;
+    }
+    printf("Client connected!\n");
+
+    return sockid;
+}
+
+int sock_recv(int sockid, unsigned char *buf, int buflen)
+{
+    int recvbytes;
+    recvbytes = recv(sockid, buf, buflen, 0);
+    if (recvbytes == 0) {
+        printf("Connection close!? zero bytes received\n");
+        return -1;
+    } else if (recvbytes > 0) {
+        return recvbytes;
+    }
+    return -1;
+}
+
+int sock_send(int sockid, unsigned char *buf, int bytes)
+{
+    int cnt;
+    unsigned char* bufpos = buf;
+    while (bytes) {
+        cnt = write(sockid, bufpos, bytes);
+
+        if (!cnt) {
+            break;
+        }
+        if (cnt == -1) {
+            if (errno == EINTR) {
+                continue;
+            } else {
+                return -1;
+            }
+        }
+
+        bytes -= cnt;
+        bufpos += cnt;
+    }
+    return (bufpos - buf);
+}
+
+static void print_help(char *pname)
+{
+    printf("An agent program to connect ART host and AR6K device, must be\n");
+    printf("started after AR6K device driver is installed.\n\n");
+    printf("Usage: %s ifname fragsize\n\n", pname);
+    printf("  ifname      AR6K interface name\n");
+    printf("  fragsize    Fragment size, must be multiple of 4\n\n");
+    printf("Example:\n");
+    printf("%s eth1 80\n\n", pname);
+}
+
+int main (int argc, char **argv)
+{
+    int recvbytes=0,bytesRcvd=0;
+    int chunkLen = 0;
+    unsigned char *bufpos;
+    int reducedARTPacket = 1;
+    int frag_size = 200;
+    //int i=0;
+    int port = ART_PORT;
+    bool resp = false;
+    bool firstpacket = true;
+
+    struct sigaction sa;
+
+    printf("setup signal\n");
+    memset(&sa, 0, sizeof(struct sigaction));
+
+    sa.sa_flags = SA_NOCLDSTOP;
+    sa.sa_handler = cleanup;
+
+    printf("before call sigaction\n");
+    sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGINT,  &sa, NULL);
+    sigaction(SIGHUP, &sa, NULL);
+    sigaction(SIGABRT, &sa, NULL);
+
+    cid = sid = aid = -1;
+    printf("setup ifname\n");
+    memset(ar6kifname, '\0', sizeof(ar6kifname));
+
+    if (argc == 1 ) {
+        print_help(argv[0]);
+        return -1;
+    }
+
+    if (argc > 1 ) {
+        strcpy(ar6kifname, argv[1]);
+    }
+    else {
+        strcpy(ar6kifname, "wlan0");
+    }
+
+    if (argc > 2) {
+        frag_size = atoi(argv[2]);
+    }
+
+    if (argc > 3) {
+        port = atoi(argv[3]);
+    }
+
+    if (port == 0)
+	port = ART_PORT;
+    else if (port < 0 || port >65534) {
+	printf("Invalid port number\n");
+	goto main_exit;
+    }
+
+    //NOTE: issue with bigger size on ath6kl driver..
+    if ( ((frag_size == 0) || ((frag_size % 4) != 0)) || (frag_size > 200) ) {
+        printf("Invalid fragsize, should be multiple of 4 and frag size less than 200\n");
+        goto main_exit;
+    }
+
+    if ( initInterface(ar6kifname) ) {
+        printf("Init interface cfg80211 failed\n");
+        cleanup(0);
+        return -1;
+    }
+
+    printf("open sock\n");
+    sid = sock_init(port);
+    if (sid < 0) {
+        printf("Create socket to ART failed\n");
+        cleanup(0);
+        return -1;
+    }
+
+    if ((recvbytes=sock_recv(cid, line, LINE_ARRAY_SIZE)) < 0) {
+        printf("Cannot nego packet size\n");
+        cleanup(0);
+        return -1;
+    }
+
+    printf("Get nego bytes %d\n", recvbytes);
+
+    if (1 == (*(unsigned int *)line)) {
+	reducedARTPacket = 1;
+        printf("Not supporting reducedARTPacket\n");
+        goto main_exit;
+    }
+    else {
+	reducedARTPacket = 0;
+    }
+
+    sock_send(cid, &(line[0]), 1);
+
+    printf("Ready to loop for art packet reduce %d\n", reducedARTPacket);
+
+    while (1) {
+        //printf("wait for tcp socket\n");
+        if ((recvbytes = sock_recv(cid, line, LINE_ARRAY_SIZE)) < 0) {
+            printf("Cannot recv packet size %d\n", recvbytes);
+            cleanup(0);
+            return -1;
+        }
+
+        bytesRcvd = recvbytes;
+        readLength = 0;
+        resp = false;
+
+        if ( firstpacket == true )
+        {
+            cmdLen = *(unsigned short *)&(line[0]);
+            cmdId = *(unsigned char *)&(line[2]);
+
+            printf("->FW len %d Command %d recvbytes %d\n",cmdLen,cmdId,recvbytes);
+            firstpacket = false;
+        }
+
+        if (!reducedARTPacket) {
+            //printf("Recived bytes from NART %d frag size %d\n",recvbytes,frag_size);
+            bufpos = line;
+
+            while (recvbytes) {
+                if (recvbytes > frag_size) {
+                    chunkLen = frag_size;
+                } else {
+                    chunkLen = recvbytes;
+                }
+
+                //we have to find out whether we need a resp or not for the last packet..
+                recvbytes-=chunkLen;
+
+                if ( recvbytes <=0 )
+                {
+                    resp = true;
+                    firstpacket = true; //look for first packet again..
+                }
+
+                //printf("Chunk Len %d total size %d respNeeded %d\n",chunkLen,bytesRcvd,resp);
+                wmiSend(bufpos, chunkLen, bytesRcvd, 1, resp);
+
+                bufpos+=chunkLen;
+            }
+        }
+
+        //line and readLength is populated in the callback
+        if ((REG_WRITE_CMD_ID != line[0]) && (MEM_WRITE_CMD_ID != line[0]) &&
+            (M_PCI_WRITE_CMD_ID != line[0]) && (M_PLL_PROGRAM_CMD_ID != line[0]) &&
+            (M_CREATE_DESC_CMD_ID != line[0])) {
+            printf("<- N/ART len %d Command %d status %d\n", readLength,(int)line[0],(int)line[4]);
+            sock_send(cid, line, readLength);
+        } else {
+            printf("<- N/ART ACK Command %d\n", (int)line[0]);
+            sock_send(cid, &(line[0]), 1);
+        }
+    }
+
+
+main_exit:
+    printf("Normal exit\n");
+    cleanup(0);
+    return 0;
+}
diff --git a/artagent/artagent.h b/artagent/artagent.h
new file mode 100755
index 0000000..0aa3227
--- /dev/null
+++ b/artagent/artagent.h
@@ -0,0 +1,237 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef _ARTAGENT_H_
+#define _ARTAGENT_H_
+
+/* ATHENV */
+#define ART_PORT                5454
+//#define ART_PORT                33120
+/* ATHENV */
+#define LINE_ARRAY_SIZE         4096
+#define SEND_ENDPOINT	        0
+#define HTC_RAW_WRITE_MAX_LEN   (16 * 5) // 96, 112
+#define TC_CMDS_SIZE_MAX  255
+
+#ifndef POSTPACK
+#ifdef __GNUC__
+#define POSTPACK __attribute__ ((packed))
+#else
+#define POSTPACK
+#endif
+#endif
+
+#ifndef PREPACK
+#ifdef __GNUC__
+#define PREPACK
+#else
+#define PREPACK
+#endif
+#endif
+
+typedef enum {
+    TCMD_CONT_TX_ID,
+    TCMD_CONT_RX_ID,
+    TCMD_PM_ID,
+    TC_CMDS_ID,
+    TCMD_SET_REG_ID,
+
+    INVALID_CMD_ID=255,
+} TCMD_ID;
+
+typedef enum {
+    TCMD_CONT_RX_PROMIS =0,
+    TCMD_CONT_RX_FILTER,
+    TCMD_CONT_RX_REPORT,
+    TCMD_CONT_RX_SETMAC,
+    TCMD_CONT_RX_SET_ANT_SWITCH_TABLE,
+
+    TC_CMD_RESP,
+} TCMD_CONT_RX_ACT;
+
+typedef struct cmdReply {
+        unsigned int replyCmdLen;
+        unsigned int replyCmdId; // command ID of command to which this is a reply
+        unsigned int status; // status of the command
+        unsigned char cmdBytes[4000]; // bytes of the command reply
+} CMD_REPLY;
+
+typedef PREPACK struct {
+    unsigned int   testCmdId;
+    unsigned int   act;
+    PREPACK union {
+        unsigned int  enANI;    // to be identical to CONT_RX struct
+        struct PREPACK {
+            unsigned short   length;
+            unsigned char    version;
+            unsigned char    bufLen;
+        } POSTPACK parm;
+    } POSTPACK u;
+} POSTPACK TC_CMDS_HDR;
+
+typedef PREPACK struct {
+    TC_CMDS_HDR  hdr;
+    unsigned char      buf[TC_CMDS_SIZE_MAX+1];
+} POSTPACK TC_CMDS;
+
+
+enum COMMAND_IDS {
+	INIT_F2_CMD_ID,                         //0
+	SELECT_HW_CMD_ID,						//1
+	MEM_WRITE_CMD_ID,						//2
+	MEM_READ_CMD_ID,						//3
+	REG_READ_CMD_ID,						//4
+	REG_WRITE_CMD_ID,						//5
+	CFG_READ_CMD_ID,						//6
+	CFG_WRITE_CMD_ID,					//7
+	MEM_ALLOC_CMD_ID,					//8
+	MEM_FREE_CMD_ID,					//9
+	MEM_WRITE_BLOCK_CMD_ID,				//10
+	MEM_READ_BLOCK_CMD_ID,				//11
+	REMAP_HW_CMD_ID,					//12
+	CREATE_EVENT_CMD_ID,				//13
+	ANY_EVENTS_CMD_ID,					//14
+	GET_EVENT_CMD_ID,					//15
+	DISCONNECT_PIPE_CMD_ID,				//16
+	CLOSE_PIPE_CMD_ID,					//17
+	ISR_FEATURE_ENABLE_CMD_ID,			//18
+	ISR_GET_RX_STATS_CMD_ID,			//19
+	ISR_GET_TX_STATS_CMD_ID,			//20
+	ISR_SINGLE_RX_STAT_CMD_ID,			//21
+	ISR_SINGLE_TX_STAT_CMD_ID,			//22
+	WAIT_ON_EVENT_CMD_ID,				//23
+	WAIT_ON_TIME_CMD_ID,					//24
+	ISR_FEATURE_DISABLE_CMD_ID,				//25
+	M_EEPROM_READ_CMD_ID,					//26
+	M_EEPROM_WRITE_CMD_ID,					//27
+	M_EEPROM_READ_BLOCK_CMD_ID,				//28
+	M_EEPROM_WRITE_BLOCK_CMD_ID,			//29
+	M_RESET_DEVICE_CMD_ID,					//30
+	M_GENERIC_CMD_ID,						//31
+	M_CHECK_REGS_CMD_ID,				//31
+	M_CHANGE_CHANNEL_CMD_ID,			//33
+	M_CHECK_PROM_CMD_ID,				//34
+	M_REREAD_PROM_CMD_ID,				//35
+	M_TX_DATA_SETUP_CMD_ID,				//36
+	M_TX_DATA_BEGIN_CMD_ID,				//37
+	M_TX_DATA_START_CMD_ID,					//38
+	M_TX_DATA_COMPLETE_CMD_ID,				//39
+	M_RX_DATA_SETUP_CMD_ID,				//40
+	M_RX_DATA_BEGIN_CMD_ID,				//41
+	M_RX_DATA_START_CMD_ID,					//42
+	M_RX_DATA_COMPLETE_CMD_ID,				//43
+	M_RX_STATS_SNAPSHOT_CMD_ID,				//44
+	M_TXRX_DATA_BEGIN_CMD_ID,			//45
+	M_CLEANUP_TXRX_MEMORY_CMD_ID,			//46
+	M_TX_GET_STATS_CMD_ID,				//47
+	M_RX_GET_STATS_CMD_ID,				//48
+	M_RX_GET_DATA_CMD_ID,				//49
+	M_TX_CONT_BEGIN_CMD_ID,				//50
+	M_TX_CONT_FRAME_BEGIN_CMD_ID,			//51
+	M_TX_CONT_END_CMD_ID,				//52
+	M_SET_ANTENNA_CMD_ID,				//53
+	M_SET_POWER_SCALE_CMD_ID,			//54
+	M_SET_TRANSMIT_POWER_CMD_ID,		//55
+	M_SET_SINGLE_TRANSMIT_POWER_CMD_ID,	//56
+	M_DEV_SLEEP_CMD_ID,					//57
+	M_CLOSE_DEVICE_CMD_ID,				//58
+	M_CHANGE_FIELD_CMD_ID,					//59
+	M_ENABLE_WEP_CMD_ID,					//60
+	M_ENABLE_PA_PRE_DIST_CMD_ID,			//61
+	M_DUMP_REGS_CMD_ID,						//62
+	M_DUMP_PCI_WRITES_CMD_ID,				//63
+	M_TEST_LIB_CMD_ID,						//64
+	M_DISPLAY_FIELD_VALUES_CMD_ID,			//65
+	M_GET_FIELD_VALUE_CMD_ID,				//66
+	M_READ_FIELD_CMD_ID,					//67
+	M_WRITE_FIELD_CMD_ID,					//68
+	M_SET_RESET_PARAMS_CMD_ID,				//69
+	M_CHANGE_MULTIPLE_FIELDS_ALL_MODES_CMD_ID, //70
+	M_CHANGE_MULTIPLE_FIELDS_CMD_ID,		//71
+	M_GET_FIELD_FOR_MODE_CMD_ID,			//72
+	LOAD_AND_RUN_CODE_CMD_ID,				//73
+	M_FORCE_SINGLE_PCDAC_TABLE_CMD_ID,		//74
+	M_FORCE_PCDAC_TABLE_CMD_ID,				//75
+	M_FORCE_POWER_TX_MAX_CMD_ID,			//76
+	M_GET_EEPROM_STRUCT_CMD_ID,				//77
+	M_GET_DEVICE_INFO_CMD_ID,				//78
+	M_WRITE_PROD_DATA_CMD_ID,				//79
+	M_WRITE_NEW_PROD_DATA_CMD_ID,			//80
+	M_SPECIFY_SUBSYSTEM_CMD_ID,				//81
+	M_FORCE_SINGLE_POWER_TX_MAX_CMD_ID,		//82
+	M_SET_QUEUE_CMD_ID,						//83
+	M_MAP_QUEUE_CMD_ID,						//84
+	M_CLEAR_KEY_CACHE_CMD_ID,				//85
+	RUN_SCREENING_TEST_CMD_ID,				//86
+	DIAG_CMD,								//87
+	ENABLE_HW_CAL_CMD,						//88
+	TRAM_WRITE_BLOCK_CMD_ID,				//89
+	TRAM_READ_BLOCK_CMD_ID,					//90
+	M_GET_MAX_POWER_CMD_ID,					//91
+	M_GET_PCDAC_FOR_POWER_CMD_ID,			//92
+	M_FALSE_DETECT_BACKOFF_VALS_CMD_ID,		//93
+	M_GET_MAC_ADDR_CMD_ID,					//94
+	M_MASK_TRIGGER_SWEEP_CMD_ID,			//95
+	M_MASK_DETECT_SIGNAL_CMD_ID,			//96
+	M_MASK_SET_DEV_NUMS_CMD_ID,				//97
+	M_MASK_FORCE_MIN_CCAPWR_CMD_ID,			//98
+	M_MASK_CONFIG_CAPTURE_CMD_ID,			//99
+	AP_REG_READ_CMD_ID,						//100
+	AP_REG_WRITE_CMD_ID,					//101
+	M_SET_LIB_CONFIG_CMD_ID,				//102
+	M_GET_XPDGAIN_CMD_ID,					//103
+	M_SELECT_DEV_NUM_CMD_ID,				//104
+	M_GET_POWER_INDEX_CMD_ID,				//105
+	M_GET_ART_ANI_LEVEL_CMD_ID,				//106
+	M_SET_ART_ANI_LEVEL_CMD_ID,				//107
+	M_FTP_DOWNLOAD_FILE_CMD_ID,				//108
+	M_GET_CTL_INFO_CMD_ID,					//109
+	M_GET_MAX_LIN_PWR_CMD_ID,				//110
+	M_HW_RESET_CMD_ID,						//111
+	M_PLL_PROGRAM_CMD_ID,					//112
+	M_PCI_WRITE_CMD_ID,						//113
+	M_CAL_CHECK_CMD_ID,						//114
+	M_FILL_TX_STATS_CMD_ID,					//115
+	M_CREATE_DESC_CMD_ID,					//116
+	LOAD_AND_PROGRAM_CODE_CMD_ID,			//117
+	M_FORCE_SINGLE_PCDAC_TABLE_GRIFFIN_CMD_ID,		//118
+	PHS_CHANNEL_TOGGLE_CMD_ID,				//119
+	STOP_PHS_CHANNEL_TOGGLE_CMD_ID,					//120
+	GENERIC_FN_CALL_CMD_ID,					//121
+	SEND_FRAME_CMD_ID,					// 122
+	RECV_FRAME_CMD_ID,					// 123
+	M_EEPROM_READ_LOCS_CMD_ID,				//124
+	GET_REF_CLK_SPEED_CMD_ID,				//125
+	SLEEP_CMD_ID,				//126
+
+        ART_IMAGE_DOWNLOAD_ID,       //127
+	ART_TEST_UITRON,					//128
+	ART_TEST_CLIENT,					//129
+
+	ART_CLIENT_REWIND_ID,     //130
+	ART_THROUGHPUT_TEST_CMD_ID,   //131
+	ART_THROUGHPUT_TEST_CMD_ID_1,   //132
+
+	ART_BMI_WRITE_SOC_REGISTER_ID,     //133
+	ART_BMI_WRITE_SOC_MEMORY_ID,               //134
+	ART_BMI_OP_DONE_ID,           //135
+        ART_BMI_READ_SOC_REGISTER_ID,     //136
+        ART_BMI_READ_SOC_TARGET_ID //137
+
+};
+
+
+#endif /* _ARTAGENT_H_ */
diff --git a/ath6kl-tcmd/.gitignore b/ath6kl-tcmd/.gitignore
new file mode 100644
index 0000000..1a72503
--- /dev/null
+++ b/ath6kl-tcmd/.gitignore
@@ -0,0 +1,2 @@
+/athtestcmd
+*~
diff --git a/ath6kl-tcmd/Android.mk b/ath6kl-tcmd/Android.mk
new file mode 100755
index 0000000..214f4ba
--- /dev/null
+++ b/ath6kl-tcmd/Android.mk
@@ -0,0 +1,52 @@
+#-------------------------------------------------
+# Copyright (c) 2012 Qualcomm Atheros, Inc..
+# All Rights Reserved.
+# Qualcomm Atheros Confidential and Proprietary.
+#-------------------------------------------------
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := athtestcmd 
+
+LOCAL_C_INCLUDES += $(TARGET_OUT_HEADERS)/libtcmd \
+
+LOCAL_CFLAGS+=
+
+LOCAL_SRC_FILES:= \
+    athtestcmd.c  \
+    sinit_common.c
+
+LOCAL_LDLIBS += -lpthread -lrt
+
+LOCAL_MODULE_TAGS := optional eng
+
+LOCAL_SHARED_LIBRARIES += libcutils
+LOCAL_SHARED_LIBRARIES += libnl_2
+LOCAL_STATIC_LIBRARIES += libtcmd
+
+include $(BUILD_EXECUTABLE)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := psatUtil
+
+LOCAL_C_INCLUDES += $(TARGET_OUT_HEADERS)/libtcmd \
+
+LOCAL_CFLAGS+=
+
+LOCAL_SRC_FILES:= \
+    psatUtil.c \
+    sinit_common.c
+
+LOCAL_LDLIBS += -lpthread -lrt
+
+LOCAL_MODULE_TAGS := optional eng
+
+LOCAL_SHARED_LIBRARIES += libcutils
+LOCAL_SHARED_LIBRARIES += libnl_2
+LOCAL_STATIC_LIBRARIES += libtcmd
+
+include $(BUILD_EXECUTABLE)
+
diff --git a/ath6kl-tcmd/COPYING b/ath6kl-tcmd/COPYING
new file mode 100644
index 0000000..77650bc
--- /dev/null
+++ b/ath6kl-tcmd/COPYING
@@ -0,0 +1,13 @@
+Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/ath6kl-tcmd/Makefile b/ath6kl-tcmd/Makefile
new file mode 100644
index 0000000..00d99fc
--- /dev/null
+++ b/ath6kl-tcmd/Makefile
@@ -0,0 +1,31 @@
+CC = gcc
+CFLAGS = -Wall -g
+
+NLLIBNAME = libnl-1
+LIBTCMD_DIR := ../libtcmd
+
+PREFIX ?= /usr
+SBINDIR ?= $(PREFIX)/sbin
+INSTALL ?= install
+
+override LDLIBS += $(shell pkg-config --libs $(NLLIBNAME)) -lrt -ltcmd -lm 
+override CFLAGS += $(shell pkg-config --cflags $(NLLIBNAME)) -I$(LIBTCMD_DIR) -L$(LIBTCMD_DIR)
+
+all:
+	$(MAKE) athtestcmd
+	$(MAKE) psatUtil
+
+athtestcmd: athtestcmd.c athtestcmd.h testcmd.h sinit_common.h sinit_common.c sinit_eep.h
+	$(MAKE) -C $(LIBTCMD_DIR)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+
+psatUtil: psatUtil.c athtestcmd.h testcmd.h sinit_common.h sinit_common.c
+	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+
+install: psatUtil athtestcmd
+	install -m 755 psatUtil $(DESTDIR)$(SBINDIR)
+	install -m 755 athtestcmd $(DESTDIR)$(SBINDIR)
+
+clean:
+	rm -f athtestcmd
+	rm -f psatUtil
diff --git a/ath6kl-tcmd/athtestcmd.c b/ath6kl-tcmd/athtestcmd.c
new file mode 100644
index 0000000..ecd6bc4
--- /dev/null
+++ b/ath6kl-tcmd/athtestcmd.c
@@ -0,0 +1,1557 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <linux/types.h>
+#include <net/if.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <assert.h>
+#include <ctype.h>
+#include <math.h>
+#include <time.h>
+
+#include "athtestcmd.h"
+#include "libtcmd.h"
+#include "testcmd.h"
+#include "sinit_eep.h"
+#include "sinit_common.h"
+
+const char *progname;
+const char commands[] = "commands:\n"
+	"--tx <sine/frame/tx99/tx100/off>\n"
+	"--txfreq <Tx channel or freq(default 2412)>\n"
+	"--txrate <rate index>\n"
+        "--txpwr <frame/tx99/tx100: 0-30dBm,0.5dBm resolution; sine: 0-60, PCDAC vaule>\n"
+	"--txantenna <1/2/0 (auto)>\n"
+	"--txpktsz <pkt size, [32-1500](default 1500)>\n"
+	"--txpattern <tx data pattern, 0: all zeros; 1: all ones;"
+	" 2: repeating 10; 3: PN7; 4: PN9; 5: PN15\n"
+	"--ani (Enable ANI. The ANI is disabled if this option is not specified)\n"
+	"--scrambleroff (Disable scrambler. The scrambler is enabled by default)\n"
+	"--aifsn <AIFS slots num,[0-252](Used only under '--tx frame' mode)>\n"
+	"--shortguard (use short guard)\n"
+	"--mode <ht40plus/ht40minus/ht20>\n"
+	"--setlongpreamble <1/0>\n"
+	"--numpackets <number of packets to send 0-65535>\n"
+        "--tx sine --txfreq <Tx channel or freq(default 2412)>\n"
+	"--rx <promis/filter/report>\n"
+	"--rxfreq <Rx channel or freq(default 2412)>\n"
+	"--rxantenna <1/2/0 (auto)>\n"
+	"--mode <ht40plus/ht40minus>\n"
+	"--pm <wakeup/sleep/deepsleep>\n"
+	"--setmac <mac addr like 00:03:7f:be:ef:11>\n"
+	"--getmac\n"
+	"--SetAntSwitchTable <table1 in decimal value>"
+	" <table2 in decimal value>  (Set table1=0 and table2=0 will"
+	" restore the default AntSwitchTable)\n"
+        "--efusedump --start <start address> --end <end address>\n"
+        "--efusewrite --start <start address> --data <data> (could be one or multiple data in quotation marks)\n"
+        "--otpwrite --data (could be one or multiple data in quotation marks)\n"
+        "--otpdump\n";
+
+#define A_ERR(ret, args...) printf(args); exit(ret);
+
+#define A_FREQ_MIN              4920
+#define A_FREQ_MAX              5825
+
+#define A_CHAN0_FREQ            5000
+#define A_CHAN_MAX              ((A_FREQ_MAX - A_CHAN0_FREQ)/5)
+
+#define BG_FREQ_MIN             2412
+#define BG_FREQ_MAX             2484
+
+#define BG_CHAN0_FREQ           2407
+#define BG_CHAN_MIN             ((BG_FREQ_MIN - BG_CHAN0_FREQ)/5)
+#define BG_CHAN_MAX             14	/* corresponding to 2484 MHz */
+
+#define A_20MHZ_BAND_FREQ_MAX   5000
+
+#define INVALID_FREQ    0
+#define A_OK            0
+
+#define ATH6KL_INTERFACE "wlan0"
+
+#define A_RATE_NUM      28
+#define G_RATE_NUM      28
+
+#define RATE_STR_LEN    20
+#define VENUS_OTP_SIZE  512
+typedef const char RATE_STR[RATE_STR_LEN];
+
+const RATE_STR bgRateStrTbl[G_RATE_NUM] = {
+	{"1   Mb"},
+	{"2   Mb"},
+	{"5.5 Mb"},
+	{"11  Mb"},
+	{"6   Mb"},
+	{"9   Mb"},
+	{"12  Mb"},
+	{"18  Mb"},
+	{"24  Mb"},
+	{"36  Mb"},
+	{"48  Mb"},
+	{"54  Mb"},
+	{"HT20 MCS0 6.5  Mb"},
+	{"HT20 MCS1 13  Mb"},
+	{"HT20 MCS2 19.5  Mb"},
+	{"HT20 MCS3 26  Mb"},
+	{"HT20 MCS4 39  Mb"},
+	{"HT20 MCS5 52  Mb"},
+	{"HT20 MCS6 58.5  Mb"},
+	{"HT20 MCS7 65  Mb"},
+	{"HT40 MCS0 13.5  Mb"},
+	{"HT40 MCS1 27.0  Mb"},
+	{"HT40 MCS2 40.5  Mb"},
+	{"HT40 MCS3 54  Mb"},
+	{"HT40 MCS4 81  Mb"},
+	{"HT40 MCS5 108  Mb"},
+	{"HT40 MCS6 121.5  Mb"},
+	{"HT40 MCS7 135  Mb"}
+};
+#if !defined(_printf)
+#define _printf printf
+#endif
+
+#define _NAME_MAX  256
+#define _LABEL_MAX  16
+
+typedef struct _calSetup {
+    double         attenDUT2PM_5G;
+    double         attenDUT2PM_2G;
+    char           testflowBinFilename[_NAME_MAX];
+    char           goldenBinFilename[_NAME_MAX];
+    char           outputBinFilename[_NAME_MAX];
+    char           label[_LABEL_MAX];
+} _CAL_SETUP;
+_CAL_SETUP  calSetup = {
+    19.0,
+    18.0,
+    "calTestFlow.bin",
+#ifdef ANDROID
+    "/system/etc/firmware/ath6k/AR6003/hw2.1.1/bdata.bin",
+#else
+    "/lib/firmware/ath6k/AR6003/hw2.1.1/bdata.bin",
+#endif
+#ifdef ANDROID
+    "/persist/bdata.bin",
+#else
+    "new_bdata.bin",
+#endif
+    "wbgf10_010_d0001",
+};
+
+uint32_t  AR6003_EEPROM_SIZE;
+uint32_t  AR6K_EEPROM_SIZE;
+static bool bCalResult;
+#define FIRST_WAIT_INTERVAL	2
+#define POLLING_INTERVAL	1
+#define MAX_WAIT_CYCLE		20
+
+static time_t startTime, endTime;
+static void rxReport(void *buf);
+static void rx_cb(void *buf, int len);
+static uint32_t freqValid(uint32_t val);
+static uint16_t wmic_ieee2freq(uint32_t chan);
+static void prtRateTbl(uint32_t freq);
+static uint32_t rateValid(uint32_t val, uint32_t freq);
+static uint32_t antValid(uint32_t val);
+static bool txPwrValid(TCMD_CONT_TX * txCmd);
+static int ath_ether_aton(const char *orig, uint8_t * eth);
+static uint32_t pktSzValid(uint32_t val);
+static void updateCALData(_CAL_SETUP *pCalSetup, TC_MSG *pTCMsg);
+static bool dumpPSATCharResult2File(TC_MSG *pTCMsg);
+
+static bool isHex(char c) {
+    return (((c >= '0') && (c <= '9')) ||
+            ((c >= 'A') && (c <= 'F')) ||
+            ((c >= 'a') && (c <= 'f')));
+}
+
+static int usage(void)
+{
+	fprintf(stderr, "usage:\n%s [-i device] commands\n", progname);
+	fprintf(stderr, "%s\n", commands);
+	prtRateTbl(INVALID_FREQ);
+	A_ERR(-1, "Incorrect usage");
+}
+
+unsigned int cmd = 0;
+unsigned int act = 0;
+uint16_t data_length = 0;
+uint16_t efuse_begin = 0, efuse_end = (VENUS_OTP_SIZE - 1);
+static TC_CMDS sTcCmds;
+
+int main(int argc, char **argv)
+{
+	int c, err,i;
+	char ifname[IFNAMSIZ];
+	progname = argv[0];
+	char buf[2048];
+	bool resp = false;
+	TCMD_CONT_TX *txCmd = (TCMD_CONT_TX *) buf;
+	TCMD_CONT_RX *rxCmd = (TCMD_CONT_RX *) buf;
+	TCMD_PM *pmCmd = (TCMD_PM *) buf;
+        TCMD_SET_REG *setRegCmd = (TCMD_SET_REG *)buf;
+        TC_CMDS  *tCmds = (TC_CMDS *)buf;
+        char efuseBuf[VENUS_OTP_SIZE];
+        char efuseWriteBuf[VENUS_OTP_SIZE];
+        int bufferLength = sizeof(*txCmd);
+
+	txCmd->numPackets = 0;
+	txCmd->wlanMode = TCMD_WLAN_MODE_NOHT;
+        txCmd->tpcm = TPC_TX_PWR;
+	rxCmd->u.para.wlanMode = TCMD_WLAN_MODE_NOHT;
+        rxCmd->u.para.freq = 2412;
+
+	if (argc == 1) {
+		usage();
+	}
+
+	/* Log The Start time */
+	startTime = time(NULL);
+
+	while (1) {
+		int option_index = 0;
+
+                static struct option long_options[] = {
+			{"version", 0, NULL, 'v'},
+			{"interface", 1, NULL, 'i'},
+			{"tx", 1, NULL, 't'},
+			{"txfreq", 1, NULL, 'f'},
+			{"txrate", 1, NULL, 'g'},
+			{"txpwr", 1, NULL, 'h'},
+			{"tgtpwr", 0, NULL, 'H'},
+			{"pcdac", 1, NULL, 'I'},
+			{"txantenna", 1, NULL, 'j'},
+			{"txpktsz", 1, NULL, 'z'},
+			{"txpattern", 1, NULL, 'e'},
+			{"rx", 1, NULL, 'r'},
+			{"rxfreq", 1, NULL, 'p'},
+			{"rxantenna", 1, NULL, 'q'},
+			{"pm", 1, NULL, 'x'},
+			{"setmac", 1, NULL, 's'},
+			{"getmac", 0, NULL, 'C'},
+			{"ani", 0, NULL, 'a'},
+			{"scrambleroff", 0, NULL, 'o'},
+			{"aifsn", 1, NULL, 'u'},
+			{"SetAntSwitchTable", 1, NULL, 'S'},
+			{"shortguard", 0, NULL, 'G'},
+			{"numpackets", 1, NULL, 'n'},
+			{"mode", 1, NULL, 'M'},
+			{"setlongpreamble", 1, NULL, 'l'},
+			{"setreg", 1, NULL, 'R'},
+			{"regval", 1, NULL, 'V'},
+			{"flag", 1, NULL, 'F'},
+			{"writeotp", 0, NULL, 'w'},
+			{"otpregdmn", 1, NULL, 'E'},
+			{"efusedump", 0, NULL, 'm'},
+			{"efusewrite", 0, NULL, 'W'},
+			{"start", 1, NULL, 'A'},
+			{"end", 1, NULL, 'L'},
+			{"data", 1, NULL, 'U'},
+			{"otpwrite", 0, NULL, 'O'},
+			{"otpdump", 0, NULL, 'P'},
+			{"btaddr", 1, NULL, 'B'},
+			{"therm", 0, NULL, 'c'},
+			{"selfInit", 0, NULL, TCMD_PSAT_CAL},
+			{"selfInit_result", 0, NULL, TCMD_PSAT_CAL_RESULT},
+			{"psat_char", 1, NULL, TCMD_CHAR_PSAT},
+			{"psat_char_result", 0, NULL, TCMD_CHAR_PSAT_RESULT},
+			{"sinit", 0, NULL, TCMD_SINIT_WAIT},
+			{0, 0, 0, 0}
+		};
+
+		c = getopt_long(argc, argv, "vi:t:f:g:h:HI:r:p:q:x:u:ao:M:A:L:mU:WOP",
+                         long_options, &option_index);
+
+		if (c == -1)
+			break;
+
+        switch (c) {
+        case 'i':
+            memset(ifname, '\0', 8);
+            strcpy(ifname, optarg);
+            break;
+        case 't':
+            cmd = TESTMODE_CONT_TX;
+	    txCmd->testCmdId = TCMD_CONT_TX_ID;
+            if (!strcmp(optarg, "sine")) {
+                txCmd->mode = TCMD_CONT_TX_SINE;
+            } else if (!strcmp(optarg, "offset")) {
+                txCmd->mode = TCMD_CONT_TX_OFFSETTONE;
+            } else if (!strcmp(optarg, "frame")) {
+                txCmd->mode = TCMD_CONT_TX_FRAME;
+            } else if (!strcmp(optarg, "tx99")) {
+                txCmd->mode = TCMD_CONT_TX_TX99;
+            } else if (!strcmp(optarg, "tx100")) {
+                txCmd->mode = TCMD_CONT_TX_TX100;
+            } else if (!strcmp(optarg, "off")) {
+                txCmd->mode = TCMD_CONT_TX_OFF;
+            }else {
+                cmd = 0;
+            }
+            break;
+        case 'f':
+          if (TESTMODE_CMDS == cmd) {
+                uint32_t freq = freqValid(atoi(optarg));
+                uint8_t  freqBin;
+                // TBD: temporarily borrow the length's high B for freq 
+                if (freq < 4900) {
+                    freqBin = FREQ2FBIN(atoi(optarg), 1);
+                }
+                else {
+                    freqBin = FREQ2FBIN(atoi(optarg), 0);
+                }
+                tCmds->hdr.u.parm.length &= 0x00ff;
+                tCmds->hdr.u.parm.length |= (freqBin << 8) & 0xff00;
+            } 
+            else {
+                txCmd->freq = freqValid(atoi(optarg));
+            }
+            break;
+        case 'G':
+            txCmd->shortGuard = 1;
+            break;
+        case 'M':
+            if(cmd == TESTMODE_CONT_TX) {
+                if (!strcmp(optarg, "ht20")) {
+                    txCmd->wlanMode = TCMD_WLAN_MODE_HT20;
+                } else if (!strcmp(optarg, "ht40plus")) {
+                    txCmd->wlanMode = TCMD_WLAN_MODE_HT40PLUS;
+                } else if (!strcmp(optarg, "ht40minus")) {
+                    txCmd->wlanMode = TCMD_WLAN_MODE_HT40MINUS;
+                }
+            } else if(cmd == TESTMODE_CONT_RX) {
+                if (!strcmp(optarg, "ht20")) {
+                    rxCmd->u.para.wlanMode = TCMD_WLAN_MODE_HT20;
+                } else if (!strcmp(optarg, "ht40plus")) {
+                    rxCmd->u.para.wlanMode = TCMD_WLAN_MODE_HT40PLUS;
+                } else if (!strcmp(optarg, "ht40minus")) {
+                    rxCmd->u.para.wlanMode = TCMD_WLAN_MODE_HT40MINUS;
+                }
+            }
+            break;
+        case 'n':
+            txCmd->numPackets = atoi(optarg);
+            break;
+        case 'g':
+            /* let user input index of rateTable instead of string parse */
+            txCmd->dataRate = rateValid(atoi(optarg), txCmd->freq);
+            break;
+        case 'h':
+        {
+            int txPowerAsInt;
+            /* Get tx power from user.  This is given in the form of a number
+             * that's supposed to be either an integer, or an integer + 0.5
+             */
+            double txPowerIndBm = atof(optarg);
+
+            /*
+             * Check to make sure that the number given is either an integer
+             * or an integer + 0.5
+             */
+            txPowerAsInt = (int)txPowerIndBm;
+            if (((txPowerIndBm - (double)txPowerAsInt) == 0) ||
+                (((txPowerIndBm - (double)txPowerAsInt)) == 0.5) ||
+                (((txPowerIndBm - (double)txPowerAsInt)) == -0.5)) {
+                if ((txCmd->mode != TCMD_CONT_TX_SINE) && (txCmd->mode != TCMD_CONT_TX_OFFSETTONE)) {
+                    txCmd->txPwr = txPowerIndBm * 2;
+                } else {
+                    txCmd->txPwr = txPowerIndBm;
+                }
+           } else {
+                printf("Bad argument to --txpwr, must be in steps of 0.5 dBm\n");
+                cmd = 0;
+           }
+
+            txCmd->tpcm = TPC_TX_PWR;
+        }
+            break;
+        case 'H':
+            txCmd->tpcm = TPC_TGT_PWR;
+            break;
+        case 'I':
+            txCmd->tpcm = TPC_FORCED_GAIN;
+            txCmd->txPwr = atof(optarg);
+            break;
+        case 'j':
+            txCmd->antenna = antValid(atoi(optarg));
+            break;
+        case 'z':
+            txCmd->pktSz = pktSzValid(atoi(optarg));
+            break;
+        case 'e':
+            txCmd->txPattern = atoi(optarg);
+            break;
+        case 'r':
+            cmd = TESTMODE_CONT_RX;
+	    rxCmd->testCmdId = TCMD_CONT_RX_ID;
+            if (!strcmp(optarg, "promis")) {
+                rxCmd->act = TCMD_CONT_RX_PROMIS;
+		printf(" Its cont Rx promis mode \n");
+            } else if (!strcmp(optarg, "filter")) {
+                rxCmd->act = TCMD_CONT_RX_FILTER;
+		printf(" Its cont Rx  filter  mode \n");
+            } else if (!strcmp(optarg, "report")) {
+		printf(" Its cont Rx report  mode \n");
+                rxCmd->act = TCMD_CONT_RX_REPORT;
+                resp = true;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case 'p':
+            rxCmd->u.para.freq = freqValid(atoi(optarg));
+            break;
+        case 'q':
+            rxCmd->u.para.antenna = antValid(atoi(optarg));
+            break;
+        case 'x':
+            cmd = TESTMODE_PM;
+	    pmCmd->testCmdId = TCMD_PM_ID;
+            if (!strcmp(optarg, "wakeup")) {
+                pmCmd->mode = TCMD_PM_WAKEUP;
+            } else if (!strcmp(optarg, "sleep")) {
+                pmCmd->mode = TCMD_PM_SLEEP;
+            } else if (!strcmp(optarg, "deepsleep")) {
+                pmCmd->mode = TCMD_PM_DEEPSLEEP;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case 's':
+            {
+                uint8_t mac[ATH_MAC_LEN];
+
+                cmd = TESTMODE_CONT_RX;
+                rxCmd->testCmdId = TCMD_CONT_RX_ID;
+                rxCmd->act = TCMD_CONT_RX_SETMAC;
+                if (ath_ether_aton(optarg, mac) != 0) {
+                    printf("Invalid mac address format! \n");
+                }
+                memcpy(rxCmd->u.mac.addr, mac, ATH_MAC_LEN);
+                printf("JLU: tcmd: setmac 0x%02x, 0x%02x, 0x%02x, 0x%02x, 0x%02x, 0x%02x\n",
+                        mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+                break;
+            }
+        case 'C':
+            cmd = TESTMODE_CONT_RX;
+            rxCmd->testCmdId = TCMD_CONT_RX_ID;
+            act = rxCmd->act = TCMD_CONT_RX_GETMAC;
+            resp = true;
+            break;
+        case 'u':
+            {
+                txCmd->aifsn = atoi(optarg) & 0xff;
+                printf("AIFS:%d\n", txCmd->aifsn);
+            }
+            break;
+        case 'a':
+            if(cmd == TESTMODE_CONT_TX) {
+                txCmd->enANI = true;
+            } else if(cmd == TESTMODE_CONT_RX) {
+                rxCmd->enANI = true;
+            }
+            break;
+        case 'o':
+            txCmd->scramblerOff = true;
+            break;
+        case 'S':
+            if (argc < 4)
+                usage();
+            cmd = TESTMODE_CONT_RX;
+            rxCmd->testCmdId = TCMD_CONT_RX_ID;
+            rxCmd->act = TCMD_CONT_RX_SET_ANT_SWITCH_TABLE;
+            rxCmd->u.antswitchtable.antswitch1 = strtoul(argv[2], (char **)NULL,0);
+            rxCmd->u.antswitchtable.antswitch2 = strtoul(argv[3], (char **)NULL,0);
+            break;
+        case 'l':
+            printf("Not supported\n");
+            return 0;
+            break;
+        case 'R':
+            if (argc < 5) {
+                printf("usage:athtestcmd -i wlan0 --setreg 0x1234 --regval 0x01 --flag 0\n");
+            }
+            cmd = TESTMODE_SETREG;
+            setRegCmd->testCmdId = TCMD_SET_REG_ID;
+            setRegCmd->regAddr   = strtoul(optarg, (char **)NULL, 0);//atoi(optarg);
+            break;
+        case 'V':
+            setRegCmd->val = strtoul(optarg, (char **)NULL, 0);
+            break;
+        case 'F':
+            setRegCmd->flag = atoi(optarg);
+            break;
+        case 'w':
+            rxCmd->u.mac.otpWriteFlag = 1;
+            break;
+        case 'E':
+            rxCmd->u.mac.regDmn[0] = 0xffff&(strtoul(optarg, (char **)NULL, 0));
+            rxCmd->u.mac.regDmn[1] = 0xffff&(strtoul(optarg, (char **)NULL, 0)>>16);
+            break;
+        case 'B':
+            {
+                uint8_t btaddr[ATH_MAC_LEN];
+                if (ath_ether_aton(optarg, btaddr) != 0) {
+                    printf("Invalid mac address format! \n");
+                }
+                memcpy(rxCmd->u.mac.btaddr, btaddr, ATH_MAC_LEN);
+                printf("JLU: tcmd: setbtaddr 0x%02x, 0x%02x, 0x%02x, 0x%02x, 0x%02x, 0x%02x\n",
+                        btaddr[0], btaddr[1], btaddr[2], btaddr[3], btaddr[4], btaddr[5]);
+            }
+            break;
+        case 'c':
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            {
+                tCmds->hdr.u.parm.length = 0;
+                tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;
+                act = tCmds->hdr.act = TC_CMDS_READTHERMAL;//TC_CMDS_CAL_THERMALVOLT;
+                resp = true;
+            }
+            break;
+        case 'A':
+            efuse_begin = atoi(optarg);
+            break;
+
+        case 'L':
+            efuse_end = atoi(optarg);
+            break;
+
+        case 'U':
+            {
+                uint8_t* pucArg = (uint8_t*)optarg;
+                uint8_t  c;
+                uint8_t  strBuf[256];
+                uint8_t  pos = 0;
+                uint16_t length = 0;
+                uint32_t  data;
+
+                /* Sweep string to end */
+                while (1) {
+                    c = *pucArg++;
+                    if (isHex(c)) {
+                        strBuf[pos++] = c;
+                    } else {
+                        strBuf[pos] = '\0';
+                        pos = 0;
+                        sscanf(((char *)&strBuf), "%x", &data);
+                        efuseWriteBuf[length++] = (data & 0xFF);
+
+                        /* End of arg string */
+                        if (c == '\0') {
+                            break;
+                        }
+                    }
+                }
+
+                data_length = length;
+            }
+            break;
+
+        case 'm':
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId      = TC_CMDS_ID;
+            act = tCmds->hdr.act      = TC_CMDS_EFUSEDUMP;
+            resp = true;
+            break;
+
+        case 'W':
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId      = TC_CMDS_ID;
+            act = tCmds->hdr.act      = TC_CMDS_EFUSEWRITE;
+            resp = true;
+            break;
+
+        case 'O':
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId      = TC_CMDS_ID;
+            act = tCmds->hdr.act      = TC_CMDS_OTPSTREAMWRITE;
+            resp = true;
+            break;
+
+        case 'P':
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId      = TC_CMDS_ID;
+            act = tCmds->hdr.act      = TC_CMDS_OTPDUMP;
+            resp = true;
+            break;
+
+        case TCMD_PSAT_CAL:
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            tCmds->hdr.u.parm.length = 0;    
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+            tCmds->hdr.act = TC_CMDS_PSAT_CAL;
+            resp = true;
+            break;
+
+        case TCMD_SINIT_WAIT:
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            tCmds->hdr.u.parm.length = (uint16_t)0;    
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+            tCmds->hdr.act = TC_CMDS_SINIT_WAIT;
+            resp = true;
+            break;
+
+        case TCMD_PSAT_CAL_RESULT:
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            {
+                tCmds->hdr.u.parm.length = 0;    
+                tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+                tCmds->hdr.act = TC_CMDS_PSAT_CAL_RESULT;
+            }
+            resp = true;
+            bCalResult = false;
+            break;
+
+        case TCMD_CHAR_PSAT:
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            {
+                tCmds->hdr.u.parm.length = 0;    
+                tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+                tCmds->hdr.act = TC_CMDS_CHAR_PSAT;
+            }
+            // TBD: temporarily borrow the length's lower B for sweep entry
+            tCmds->hdr.u.parm.length &= 0xff00;
+            tCmds->hdr.u.parm.length |= (atoi(optarg)) & 0xff;
+            printf("optarg %s %d\n", optarg, tCmds->hdr.u.parm.length );
+
+            break;
+
+        case TCMD_CHAR_PSAT_RESULT:
+            cmd = TESTMODE_CMDS;
+            tCmds->hdr.testCmdId = TC_CMDS_ID;
+            {
+                tCmds->hdr.u.parm.length = NUM_PSAT_CHAR_PARMS;    
+                tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+                tCmds->hdr.act = TC_CMDS_CHAR_PSAT_RESULT;
+            }
+            resp = true;
+            break;
+
+        default:
+            usage();
+        }
+     }
+
+     if ( cmd == TESTMODE_CMDS )
+     {
+         if ( tCmds->hdr.act == TC_CMDS_EFUSEWRITE )
+         {
+            int i;
+            /* Error check */
+            if (data_length == 0) {
+                printf("No data to write, exit..\n");
+                return 0;
+            } else if ((efuse_begin + data_length + 4) > TC_CMDS_SIZE_MAX) {
+                printf("Exceed eFuse border: %d, exit..\n", (TC_CMDS_SIZE_MAX - 1));
+                return 0;
+            }
+
+            /* PRINT */
+            printf("eFuse data (%d Bytes): ", data_length);
+            for (i = 0; i < data_length; i++) {
+                printf("%02X ", efuseWriteBuf[i]);
+            }
+            printf("\n");
+
+            /* Write address and data length */
+            tCmds->buf[0] = (efuse_begin & 0xFF);
+            tCmds->buf[1] = (efuse_begin >> 8) & 0xFF;
+            tCmds->buf[2] = (data_length & 0xFF);
+            tCmds->buf[3] = (data_length >> 8) & 0xFF;
+
+            /* Copy data to tcmd buffer. The first 4 bytes are the ID and length */
+            memcpy((void*)&(tCmds->buf[4]), (void*)&(efuseWriteBuf[0]), data_length);
+
+            /* Construct eFuse Write */
+            tCmds->hdr.u.parm.length  = (4 + data_length);
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;
+        }
+        else if ( tCmds->hdr.act == TC_CMDS_OTPSTREAMWRITE )
+        {
+            int i;
+
+            /* Error check */
+            if (data_length == 0) {
+                printf("No data to write, exit..\n");
+                return 0;
+            } else if ((data_length + 4) > TC_CMDS_SIZE_MAX) {
+                printf("Exceed OTP size: %d, exit..\n", data_length);
+                return 0;
+            }
+
+            /* PRINT */
+            printf("Write OTP data (%d Bytes): ", data_length);
+            for (i = 0; i < data_length; i++) {
+                printf("%02X ", efuseWriteBuf[i]);
+            }
+            printf("\n");
+
+            /* Copy data to tcmd buffer. The first 4 bytes are the ID and length */
+            memcpy((void*)&(tCmds->buf[0]), (void*)&(efuseWriteBuf[0]), data_length);
+
+            /* Construct eFuse Write */
+            tCmds->hdr.u.parm.length  = data_length;
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;
+        }
+        else if ( tCmds->hdr.act == TC_CMDS_OTPDUMP )
+        {
+            tCmds->hdr.u.parm.length  = 0;
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;
+        }
+        else if ( tCmds->hdr.act == TC_CMDS_CHAR_PSAT )
+        {
+            uint32_t ii = tCmds->hdr.u.parm.length & 0xff;
+            uint8_t freq= (uint8_t)((tCmds->hdr.u.parm.length >> 8) & 0xff);
+            tCmds->hdr.u.parm.length = NUM_PSAT_CHAR_PARMS;
+            tCmds->buf[0] = psatSweepTbl[ii].an_txrf3_rdiv2g;
+            tCmds->buf[1] = psatSweepTbl[ii].an_txrf3_pdpredist2g;
+            tCmds->buf[2] = psatSweepTbl[ii].an_rxtx2_mxrgain;
+            tCmds->buf[3] = psatSweepTbl[ii].an_rxrf_bias1_pwd_ic25mxr2gh;
+            tCmds->buf[4] = psatSweepTbl[ii].an_bias2_pwd_ic25rxrf;
+            tCmds->buf[5] = psatSweepTbl[ii].an_bb1_i2v_curr2x;
+            tCmds->buf[6] = psatSweepTbl[ii].an_txrf3_capdiv2g;
+            tCmds->buf[7] = freq;
+            printf("freq %d %d %d %d %d %d %d %d\n", tCmds->buf[7], tCmds->buf[0], tCmds->buf[1], tCmds->buf[2], tCmds->buf[3],tCmds->buf[4], tCmds->buf[5], tCmds->buf[6]);
+        }
+    }
+
+    /* default bufferLength = sizeof(*txCmd)*/
+    if ( cmd == TESTMODE_CONT_TX )
+    {
+	bufferLength = sizeof(*txCmd);
+    }
+    else if ( cmd == TESTMODE_CONT_RX )
+    {
+	bufferLength = sizeof(*rxCmd);
+    }
+    else if ( cmd == TESTMODE_PM )
+    {
+	bufferLength = sizeof(*pmCmd);
+    }
+    else if ( cmd == TESTMODE_SETREG)
+    {
+	bufferLength = sizeof(*setRegCmd);
+    }
+    else if ( cmd == TESTMODE_CMDS )
+    {
+	bufferLength = sizeof(*tCmds);
+    }
+
+     printf("Cmd %d length %d respNeeded %d\n",cmd,bufferLength,resp);
+
+     err = tcmd_tx_init(ATH6KL_INTERFACE, rx_cb);
+
+     if (err)
+        return err;
+
+     if ( (cmd == TESTMODE_CMDS) && (tCmds->hdr.act == TC_CMDS_EFUSEDUMP) )
+     {
+        int i, k;
+        int blkNum;
+        uint16_t efuseEnd   = efuse_end;
+        uint16_t efuseBegin = efuse_begin;
+        uint16_t efusePrintAnkor;
+        uint16_t numPlaceHolder;
+
+        /* Input check */
+        if (efuseEnd > (VENUS_OTP_SIZE - 1)) {
+            efuseEnd = (VENUS_OTP_SIZE - 1);
+        }
+
+        if (efuseBegin > efuseEnd) {
+            efuseBegin = efuseEnd;
+        }
+
+        efusePrintAnkor = efuseBegin;
+
+        blkNum = ((efuseEnd - efuseBegin) / TC_CMDS_SIZE_MAX) + 1;
+
+        /* Request data in several trys */
+        for (i = 0; i < blkNum; i++) {
+            tCmds->hdr.testCmdId      = TC_CMDS_ID;
+            tCmds->hdr.act            = TC_CMDS_EFUSEDUMP;
+            tCmds->hdr.u.parm.length  = 4;
+            tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;
+
+            tCmds->buf[0] = (efuseBegin & 0xFF);
+            tCmds->buf[1] = (efuseBegin >> 8) & 0xFF;
+            tCmds->buf[2] = (efuseEnd & 0xFF);
+            tCmds->buf[3] = (efuseEnd >> 8) & 0xFF;
+
+            /* This field may get polluted so needs a refresh here */
+            tCmds->hdr.u.parm.bufLen = 4;
+
+            if ((err = tcmd_tx(buf, bufferLength /* weak */, resp))) {
+	        fprintf(stderr, "tcmd_tx had error: %s!\n", strerror(-err));
+                return 0;
+            }
+
+            /* Last block? */
+            //sTcCmds populated in the callback..
+            if ((efuseEnd - efuseBegin + 1) < TC_CMDS_SIZE_MAX) {
+                memcpy((void*)(efuseBuf + efuseBegin), (void*)&(sTcCmds.buf[0]), (efuseEnd - efuseBegin + 1));
+            } else {
+                memcpy((void*)(efuseBuf + efuseBegin), (void*)&(sTcCmds.buf[0]), TC_CMDS_SIZE_MAX);
+            }
+
+            /* Adjust the efuseBegin but keep efuseEnd unchanged */
+            efuseBegin += TC_CMDS_SIZE_MAX;
+         }
+
+         /* Output Dump */
+         printf("------------------- eFuse Dump ----------------------");
+         for (i = efusePrintAnkor; i <= efuseEnd; i++) {
+             /* Cosmetics */
+             if (i == efusePrintAnkor) {
+                 numPlaceHolder = (efusePrintAnkor & 0x0F);
+                 printf("\n%04X:", (efusePrintAnkor & 0xFFF0));
+                 for (k = 0; k < numPlaceHolder; k++) {
+                     printf("   ");
+                  }
+             } else if ((i & 0x0F) == 0) {
+                 printf("\n%04X:", i);
+             }
+
+             printf(" %02X", efuseBuf[i]);
+         }
+         printf("\n\n");
+     }
+     else if ( (cmd == TESTMODE_CMDS) && (tCmds->hdr.act == TC_CMDS_SINIT_WAIT) )
+     {
+         if ((err = tcmd_tx(buf, bufferLength /* weak */, resp))) {
+	    fprintf(stderr, "tcmd_tx had error: %s!\n", strerror(-err));
+            return 0;
+          }
+
+         sleep(FIRST_WAIT_INTERVAL); /* Wait 2s first */
+
+         /* Request data in several trys */
+         for (i = 0; i < MAX_WAIT_CYCLE; i++) {
+             tCmds->hdr.testCmdId      = TC_CMDS_ID;
+             tCmds->hdr.u.parm.length  = (uint16_t)0;    
+             tCmds->hdr.u.parm.version = TC_CMDS_VERSION_TS;    
+             tCmds->hdr.act            = TC_CMDS_PSAT_CAL_RESULT;
+             resp = true;
+             bCalResult = false;
+
+             if ((err = tcmd_tx(buf, bufferLength /* weak */, resp))) {
+	        /*don't let main return bcs the reply may not be ready. Try again.*/
+                /*fprintf(stderr, "tcmd_tx had error: %s!\n", strerror(-err));*/
+                /*return 0;*/
+             }
+             if (!bCalResult) {
+                 sleep(POLLING_INTERVAL);
+                 printf(".");
+             } else {
+                 endTime = time(NULL);
+                 printf("Wait time = %ld(s)\n", (endTime - startTime));
+                 break;
+             }
+          }
+     }
+     else
+     {
+         if ((err = tcmd_tx(buf, bufferLength /* weak */, resp))) {
+	    fprintf(stderr, "tcmd_tx had error: %s!\n", strerror(-err));
+          }
+    }
+
+     return 0;
+}
+
+static void rxReport(void *buf)
+{
+	struct TCMD_CONT_RX_REPORT *report = &((TCMD_CONT_RX *) buf)->u.report;
+	uint32_t pkt = report->totalPkt;
+	int32_t rssi = report->rssiInDBm;
+	uint32_t crcError = report->crcErrPkt;
+	uint32_t secErr = report->secErrPkt;
+	uint16_t *rateCnt = report->rateCnt;
+	uint16_t *rateCntShortGuard = report->rateCntShortGuard;
+
+	printf
+	    ("total pkt %d ; crcError pkt %d ; secErr pkt %d ;  average rssi %d\n",
+	     pkt, crcError, secErr,
+	     (int32_t) (pkt ? (rssi / (int32_t) pkt) : 0));
+
+	printf("1Mbps     %d\n", rateCnt[0]);
+	printf("2Mbps     %d\n", rateCnt[1]);
+	printf("5.5Mbps   %d\n", rateCnt[2]);
+	printf("11Mbps    %d\n", rateCnt[3]);
+	printf("6Mbps     %d\n", rateCnt[4]);
+	printf("9Mbps     %d\n", rateCnt[5]);
+	printf("12Mbps    %d\n", rateCnt[6]);
+	printf("18Mbps    %d\n", rateCnt[7]);
+	printf("24Mbps    %d\n", rateCnt[8]);
+	printf("36Mbps    %d\n", rateCnt[9]);
+	printf("48Mbps    %d\n", rateCnt[10]);
+	printf("54Mbps    %d\n", rateCnt[11]);
+	printf("\n");
+	printf("HT20 MCS0 6.5Mbps   %d (SGI: %d)\n", rateCnt[12],
+	       rateCntShortGuard[12]);
+	printf("HT20 MCS1 13Mbps    %d (SGI: %d)\n", rateCnt[13],
+	       rateCntShortGuard[13]);
+	printf("HT20 MCS2 19.5Mbps  %d (SGI: %d)\n", rateCnt[14],
+	       rateCntShortGuard[14]);
+	printf("HT20 MCS3 26Mbps    %d (SGI: %d)\n", rateCnt[15],
+	       rateCntShortGuard[15]);
+	printf("HT20 MCS4 39Mbps    %d (SGI: %d)\n", rateCnt[16],
+	       rateCntShortGuard[16]);
+	printf("HT20 MCS5 52Mbps    %d (SGI: %d)\n", rateCnt[17],
+	       rateCntShortGuard[17]);
+	printf("HT20 MCS6 58.5Mbps  %d (SGI: %d)\n", rateCnt[18],
+	       rateCntShortGuard[18]);
+	printf("HT20 MCS7 65Mbps    %d (SGI: %d)\n", rateCnt[19],
+	       rateCntShortGuard[19]);
+	printf("\n");
+	printf("HT40 MCS0 13.5Mbps    %d (SGI: %d)\n", rateCnt[20],
+	       rateCntShortGuard[20]);
+	printf("HT40 MCS1 27.0Mbps    %d (SGI: %d)\n", rateCnt[21],
+	       rateCntShortGuard[21]);
+	printf("HT40 MCS2 40.5Mbps    %d (SGI: %d)\n", rateCnt[22],
+	       rateCntShortGuard[22]);
+	printf("HT40 MCS3 54Mbps      %d (SGI: %d)\n", rateCnt[23],
+	       rateCntShortGuard[23]);
+	printf("HT40 MCS4 81Mbps      %d (SGI: %d)\n", rateCnt[24],
+	       rateCntShortGuard[24]);
+	printf("HT40 MCS5 108Mbps     %d (SGI: %d)\n", rateCnt[25],
+	       rateCntShortGuard[25]);
+	printf("HT40 MCS6 121.5Mbps   %d (SGI: %d)\n", rateCnt[26],
+	       rateCntShortGuard[26]);
+	printf("HT40 MCS7 135Mbps     %d (SGI: %d)\n", rateCnt[27],
+	       rateCntShortGuard[27]);
+
+}
+
+static void readThermal(void *buf,int len)
+{
+    TC_CMDS *tCmd;
+
+    tCmd = (TC_CMDS *)buf;
+
+    printf("Length rx cb rcvd %d\n",len);
+    printf("act %d version %d length %d\n",tCmd->hdr.act,tCmd->hdr.u.parm.version,tCmd->hdr.u.parm.length);
+    printf("chip thermal value:%d\n", tCmd->buf[0]);
+    return;
+}
+
+static void getMac(void *buf,int len)
+{
+    TC_CMDS *tCmd;
+
+    tCmd = (TC_CMDS *)buf;
+
+    printf("Length rx cb rcvd %d\n",len);
+    printf("act %d version %d length %d\n",tCmd->hdr.act,tCmd->hdr.u.parm.version,tCmd->hdr.u.parm.length);
+    printf("MAC address : %02x:%02x:%02x:%02x:%02x:%02x\n", tCmd->buf[0], tCmd->buf[1], tCmd->buf[2], tCmd->buf[3], tCmd->buf[4], tCmd->buf[5]);
+    return;
+}
+
+static void cmdReply(void *buf, int len)
+{
+    TC_CMDS  tCmdReply;
+    TC_MSG *pTCMsg;
+    uint32_t act;
+    uint16_t wBytes;
+    int i=0;
+
+    printf("Length rx cb rcvd %d\n",len);
+
+    buf = (void*)((uint8_t*)buf + (2 * sizeof(unsigned int)));
+
+    uint8_t *reply = (uint8_t*)buf;
+
+    tCmdReply.hdr.u.parm.length = *(uint16_t *)&(reply[0]);
+    tCmdReply.hdr.u.parm.version = (uint8_t)(reply[2]);
+    act = tCmdReply.hdr.u.parm.version;
+    pTCMsg = (TC_MSG *)&(tCmdReply.buf[0]);
+
+    /* Error Check */
+    if (tCmdReply.hdr.u.parm.length > (TC_CMDS_SIZE_MAX + 1)) {
+        printf("Error: Reply lenth=%d, limit=%d\n", tCmdReply.hdr.u.parm.length, TC_CMDS_SIZE_MAX);
+        return;
+    } else {
+        ;
+    }
+
+    if (tCmdReply.hdr.u.parm.length > 0) {
+        memcpy((void*)&(tCmdReply.buf), (void*)((uint8_t*)buf+4),  tCmdReply.hdr.u.parm.length);
+        memcpy((void*)&(sTcCmds.buf[0]), (void*)&(tCmdReply.buf[0]),  tCmdReply.hdr.u.parm.length);
+        sTcCmds.hdr.u.parm.length = tCmdReply.hdr.u.parm.length;
+   }
+
+    switch (act) {
+        case TC_CMDS_EFUSEDUMP:
+            printf("eFuse data:\n");
+            break;
+        case TC_CMDS_EFUSEWRITE:
+            printf("(write eFuse data)\n");
+            wBytes = ((sTcCmds.buf[1] << 8) | sTcCmds.buf[0]);
+            printf("%d bytes written to eFuse.\n", wBytes);
+            break;
+        case TC_CMDS_OTPSTREAMWRITE:
+            printf("(OTP stream write)\n");
+
+            if (sTcCmds.buf[0] == A_OK) {
+                printf("Write %d bytes to OTP\n", data_length);
+            } else {
+                printf("Failed to write OTP\n");
+            }
+            break;
+        case TC_CMDS_OTPDUMP:
+            printf("OTP Dump\n");
+            if (sTcCmds.hdr.u.parm.length) {
+                /* Received bytes are in sTcCmds */
+                for (i = 0; i < sTcCmds.hdr.u.parm.length; i++) {
+                    printf("%02x ", sTcCmds.buf[i]);
+                }
+                printf("\n");
+            } else {
+                printf("No valid stream found in OTP!\n");
+            }
+            break;
+        case TC_CMDS_PSAT_CAL:
+            break;
+        case TC_CMDS_SINIT_WAIT:
+            if (TC_MSG_PSAT_CAL_ACK == (TC_MSG_ID)pTCMsg->msgId) {
+                printf("ACK Received.\n");
+            }
+            break;
+        case TC_CMDS_PSAT_CAL_RESULT:
+            if (TC_MSG_PSAT_CAL_RESULTS == (TC_MSG_ID)pTCMsg->msgId) {
+              // update CAL data, read eeprom bin,  re-generate eeprom bin
+              updateCALData(&calSetup, pTCMsg);
+              bCalResult = true;
+            }
+            break;
+        case TC_CMDS_CHAR_PSAT:
+            break;
+        case TC_CMDS_CHAR_PSAT_RESULT:
+            if (TC_MSG_CHAR_PSAT_RESULTS == (TC_MSG_ID)pTCMsg->msgId) {
+              dumpPSATCharResult2File(pTCMsg);
+            }
+            break;
+        default:
+            printf("Invalid action!\n");
+            break;
+    }
+}
+
+static void rx_cb(void *buf, int len)
+{
+	TCMD_ID tcmd;
+
+	if ( cmd == TESTMODE_CMDS )
+        {
+            if ( act == TC_CMDS_READTHERMAL )
+            {
+                readThermal(buf,len);
+	    }
+            else
+            {
+               cmdReply(buf,len);
+            }
+
+            return;
+        }
+
+	if ( cmd == TESTMODE_CONT_RX )
+	{
+            if ( act == TCMD_CONT_RX_GETMAC )
+            {
+                getMac(buf, len);
+            }
+	}
+
+	tcmd = * ((uint32_t *) buf + 1);
+
+	switch (tcmd) {
+	case TCMD_CONT_RX_REPORT:
+		rxReport(buf);
+		break;
+	default:
+		 break;
+	}
+
+}
+
+static uint32_t freqValid(uint32_t val)
+{
+	do {
+		if (val <= A_CHAN_MAX) {
+			uint16_t freq;
+
+			if (val < BG_CHAN_MIN)
+				break;
+
+			freq = wmic_ieee2freq(val);
+			if (INVALID_FREQ == freq)
+				break;
+			else
+				return freq;
+		}
+
+		if ((val == BG_FREQ_MAX) ||
+		    ((val < BG_FREQ_MAX) && (val >= BG_FREQ_MIN)
+		     && !((val - BG_FREQ_MIN) % 5)))
+			return val;
+		else if ((val >= A_FREQ_MIN) && (val < A_20MHZ_BAND_FREQ_MAX)
+			 && !((val - A_FREQ_MIN) % 20))
+			return val;
+		else if ((val >= A_20MHZ_BAND_FREQ_MAX) && (val <= A_FREQ_MAX)
+			 && !((val - A_20MHZ_BAND_FREQ_MAX) % 5))
+			return val;
+	} while (false);
+
+	A_ERR(-1, "Invalid channel or freq #: %d !\n", val);
+	return 0;
+}
+
+static uint32_t rateValid(uint32_t val, uint32_t freq)
+{
+	if (((freq >= A_FREQ_MIN) && (freq <= A_FREQ_MAX)
+	     && (val >= A_RATE_NUM)) || ((freq >= BG_FREQ_MIN)
+					 && (freq <= BG_FREQ_MAX)
+					 && (val >= G_RATE_NUM))) {
+		printf("Invalid rate value %d for frequency %d! \n", val, freq);
+		prtRateTbl(freq);
+		A_ERR(-1, "Invalid rate value %d for frequency %d! \n", val,
+		      freq);
+	}
+
+	return val;
+}
+
+static void prtRateTbl(uint32_t freq)
+{
+	int i;
+
+	for (i = 0; i < G_RATE_NUM; i++) {
+		printf("<rate> %d \t \t %s \n", i, bgRateStrTbl[i]);
+	}
+	printf("\n");
+}
+
+/*
+ * converts ieee channel number to frequency
+ */
+static uint16_t wmic_ieee2freq(uint32_t chan)
+{
+	if (chan == BG_CHAN_MAX) {
+		return BG_FREQ_MAX;
+	}
+	if (chan < BG_CHAN_MAX) {	/* 0-13 */
+		return (BG_CHAN0_FREQ + (chan * 5));
+	}
+	if (chan <= A_CHAN_MAX) {
+		return (A_CHAN0_FREQ + (chan * 5));
+	} else {
+		return INVALID_FREQ;
+	}
+}
+
+static uint32_t antValid(uint32_t val)
+{
+	if (val > 2) {
+		A_ERR(-1,
+		      "Invalid antenna setting! <0: auto;  1/2: ant 1/2>\n");
+	}
+
+	return val;
+}
+
+static bool txPwrValid(TCMD_CONT_TX * txCmd)
+{
+	bool rc = false;
+	if (txCmd->mode == TCMD_CONT_TX_SINE) {
+		if ((txCmd->txPwr >= 0) && (txCmd->txPwr <= 150))
+			rc = true;
+	} else if (txCmd->mode == TCMD_CONT_TX_OFFSETTONE) {
+		if ((txCmd->txPwr >= 0) && (txCmd->txPwr <= 150))
+			rc = true;
+	} else if (txCmd->mode != TCMD_CONT_TX_OFF) {
+		if (txCmd->tpcm != TPC_FORCED_GAIN) {
+			if ((txCmd->txPwr >= -30) && (txCmd->txPwr <= 60))
+				rc = true;
+		} else {
+			if ((txCmd->txPwr >= 0) && (txCmd->txPwr <= 120))
+				rc = true;
+		}
+	} else if (txCmd->mode == TCMD_CONT_TX_OFF) {
+		rc = true;
+	}
+
+	if (!rc)
+		A_ERR(1,
+		"Invalid Tx Power value! \nTx data: [-15 - 14]dBm  \nTx sine: [  0 - 150]PCDAC value\n");
+	return rc;
+}
+
+static uint32_t pktSzValid(uint32_t val)
+{
+	if ((val < 32) || (val > 1500)) {
+		A_ERR(-1, "Invalid package size! < 32 - 1500 >\n");
+	}
+	return val;
+}
+
+#ifdef NOTYET
+
+// Validate a hex character
+static bool _is_hex(char c)
+{
+	return (((c >= '0') && (c <= '9')) ||
+		((c >= 'A') && (c <= 'F')) || ((c >= 'a') && (c <= 'f')));
+}
+
+// Convert a single hex nibble
+static int _from_hex(char c)
+{
+	int ret = 0;
+
+	if ((c >= '0') && (c <= '9')) {
+		ret = (c - '0');
+	} else if ((c >= 'a') && (c <= 'f')) {
+		ret = (c - 'a' + 0x0a);
+	} else if ((c >= 'A') && (c <= 'F')) {
+		ret = (c - 'A' + 0x0A);
+	}
+	return ret;
+}
+
+// Convert a character to lower case
+static char _tolower(char c)
+{
+	if ((c >= 'A') && (c <= 'Z')) {
+		c = (c - 'A') + 'a';
+	}
+	return c;
+}
+
+// Validate alpha
+static bool isalpha(int c)
+{
+	return (((c >= 'a') && (c <= 'z')) || ((c >= 'A') && (c <= 'Z')));
+}
+
+// Validate digit
+static bool isdigit(int c)
+{
+	return ((c >= '0') && (c <= '9'));
+}
+
+// Validate alphanum
+static bool isalnum(int c)
+{
+	return (isalpha(c) || isdigit(c));
+}
+#endif
+
+/*------------------------------------------------------------------*/
+/*
+ * Input an Ethernet address and convert to binary.
+ */
+static int ath_ether_aton(const char *orig, uint8_t * eth)
+{
+	int mac[6];
+	if (sscanf(orig, "%02x:%02x:%02X:%02X:%02X:%02X",
+		   &mac[0], &mac[1], &mac[2], &mac[3], &mac[4], &mac[5]) == 6) {
+		int i;
+#ifdef DEBUG
+		if (*(orig + 12 + 5) != 0) {
+			fprintf(stderr, "%s: trailing junk '%s'!\n", __func__,
+				orig);
+			return -1;
+		}
+#endif
+		for (i = 0; i < 6; ++i)
+			eth[i] = mac[i] & 0xff;
+		return 0;
+	}
+	return -1;
+}
+
+// Read "golden" eeprom bin
+// Update it with CAL data
+
+bool readCalDataFromFileBin(char *fileName, AR6003_EEPROM *eepromData)
+{
+    FILE *fp;
+    bool rc=true;
+    uint32_t numBytes;
+
+    printf("readCalDataFromFile - reading EEPROM file %s\n",fileName);
+    if( (fp = fopen(fileName, "rb")) == NULL) {
+        _printf("Could not open %s to read\n", fileName);
+        return false;
+    }
+
+    if (AR6K_EEPROM_SIZE_LARGEST == (numBytes = fread((uint8_t *)eepromData, 1, AR6K_EEPROM_SIZE_LARGEST, fp))) {
+        printf("Read %d from %s\n", numBytes, fileName);  
+        rc = true;
+    }
+    else {
+        if (feof(fp)) {
+            printf("good Read %d from %s\n", numBytes, fileName);  
+            rc = true;
+        } 
+        else if (ferror(fp)) {
+            _printf("Error reading %s\n", fileName);
+            rc = false;
+        }
+        else { _printf("Unknown fread rc\n"); rc = false; }
+    }
+    if (fp) fclose(fp);
+
+    if (rc) {
+        if ((eepromData->baseEepHeader.version & AR6003_EEP_VER_MINOR_MASK) >= AR6003_EEP_MINOR_VER10) {
+            if (AR6K_EEPROM_SIZE_LARGEST != numBytes) {
+                printf("Num of bytes read %d mismatch expected %d\n", numBytes, AR6K_EEPROM_SIZE_LARGEST);
+                rc = false;
+            }
+            else {
+                AR6K_EEPROM_SIZE = AR6003_EEPROM_SIZE = AR6K_EEPROM_SIZE_LARGEST;
+                printf("New TPC scheme selected! %x %d\n", eepromData->baseEepHeader.version, AR6K_EEPROM_SIZE);
+            }
+        }
+        else {
+            _printf("EEPROM file version %d not supported, please re-calibrate it.\n", eepromData->baseEepHeader.version);
+            rc = false;
+        }
+    }
+    return rc;
+}
+
+#define _PSAT_COMMON_4_HOST
+
+// if host doesn't support math.h, this section can be skipped, it is purely for data gathering
+static double cmacPwr(double cmac)
+{
+    double pwr;
+    double vfull=1.0, cycles = -15.0;
+
+    pwr = 10*log10(4*((double)cmac)*((double)pow(2.0, cycles))*((double)pow(vfull/512, 2)));
+    return(pwr);
+}
+static bool dumpPSATCharResult2File(TC_MSG *pTCMsg)
+{
+    FILE *dbgFp;
+    int i;
+    uint32_t cmac_i;
+
+#ifdef ANDROID
+    if ( (dbgFp = fopen("/persist/psatCharData.csv", "a+")) == NULL) {
+        printf("Error: open _psatCharData.csv\n");
+        return(false);
+    }
+#else
+    if ( (dbgFp = fopen("_psatCharData.csv", "a+")) == NULL) {
+        printf("Error: open _psatCharData.csv\n");
+        return(false);
+    }
+#endif
+    
+    fprintf(dbgFp, "%d, %d, %d, %d, %d, %d, %d, %d\n", 
+    pTCMsg->msg.psatCharResults.freq, 
+    pTCMsg->msg.psatCharResults.an_txrf3_rdiv2g, 
+    pTCMsg->msg.psatCharResults.an_txrf3_pdpredist2g, 
+    pTCMsg->msg.psatCharResults.an_rxtx2_mxrgain, 
+    pTCMsg->msg.psatCharResults.an_rxrf_bias1_pwd_ic25mxr2gh, 
+    pTCMsg->msg.psatCharResults.an_bias2_pwd_ic25rxrf, 
+    pTCMsg->msg.psatCharResults.an_bb1_i2v_curr2x, 
+    pTCMsg->msg.psatCharResults.an_txrf3_capdiv2g); 
+    for (i=0;i<_MAX_TX_GAIN_ENTRIES;i++) {
+        cmac_i = pTCMsg->msg.psatCharResults.cmac_i[i]; 
+        fprintf(dbgFp, "%d, %d, %f, %d\n", pTCMsg->msg.psatCharResults.pcdac[i], cmac_i, cmacPwr(cmac_i), cmac2Pwr_t10(cmac_i)); 
+    }
+
+    if (dbgFp) fclose(dbgFp);
+    return(true); 
+}
+   
+uint16_t computeChecksumOnly(uint16_t *pHalf, uint16_t length)
+{
+    uint16_t sum = 0, i;
+    for (i = 0; i < length; i++) { sum ^= *pHalf++; }
+    return(sum);
+}
+
+void computeChecksum(AR6003_EEPROM *pEepStruct)
+{
+  uint16_t sum, *pHalf;
+  uint8_t eepromVersion;
+    
+  eepromVersion = pEepStruct->baseEepHeader.version & AR6003_EEP_VER_MINOR_MASK;
+  if (eepromVersion >= AR6003_EEP_MINOR_VER5) {
+    // first checksum
+    pEepStruct->baseEepHeader.checksum = 0x0000;
+    pHalf = (uint16_t *)pEepStruct;
+    sum = computeChecksumOnly(pHalf, AR6K_EEPROM_SIZE_PRIOR_VER4/2);
+    pEepStruct->baseEepHeader.checksum = 0xFFFF ^ sum;
+
+    // second (expanded checksum)
+    pEepStruct->checksumExpanded = 0x0000;
+    pHalf = (uint16_t *)pEepStruct;
+    pHalf += AR6K_EEPROM_SIZE_PRIOR_VER4/2;
+    sum = computeChecksumOnly(pHalf, (AR6003_EEPROM_SIZE - AR6K_EEPROM_SIZE_PRIOR_VER4)/2);
+    pEepStruct->checksumExpanded = 0xFFFF ^ sum;
+
+    _printf("--computeChecksum old 0x%x expanded 0x%x\n", pEepStruct->baseEepHeader.checksum, pEepStruct->checksumExpanded);
+  }
+  else {
+    pEepStruct->baseEepHeader.checksum = 0x0000;
+    pHalf = (uint16_t *)pEepStruct;
+    sum = computeChecksumOnly(pHalf, AR6K_EEPROM_SIZE_PRIOR_VER4/2);
+    pEepStruct->baseEepHeader.checksum = 0xFFFF ^ sum;
+    _printf("--computeChecksum old 0x%x\n", pEepStruct->baseEepHeader.checksum);
+  }
+}
+
+bool genEepromBinFile(char *fileName, AR6003_EEPROM *pEepStruct) 
+{
+    FILE *fp;
+    
+    // re-computing checksum
+    pEepStruct->baseEepHeader.checksum = 0;
+    computeChecksum(pEepStruct);
+
+    if ( (fp = fopen(fileName, "wb")) == NULL) {
+        _printf("Error: open to write eeprom bin %s \n", fileName);
+        return false;
+    }
+    if (sizeof(AR6003_EEPROM) != fwrite((uint8_t *)pEepStruct, 1, sizeof(AR6003_EEPROM), fp)) {
+        _printf("Error: writing to %s\n", fileName);
+    }
+    if (fp) fclose(fp);
+    return(true);
+}
+
+static void updateCALData(_CAL_SETUP *pCalSetup, TC_MSG *pTCMsg)
+{
+    bool rc;
+    AR6003_EEPROM     eepromData, *pEeprom=&eepromData;
+    AR6003_BASE_EEP_HEADER   *pBase;
+    AR6003_CAL_DATA_PER_FREQ_OLPC_EXPANDED *pRawDataSet2G_ext, *pRawDataSet5G_ext;
+    uint8_t  *pCalChans2G, *pCalChans5G;
+    uint32_t numPiers2G, numPiers5G;
+    uint32_t i; 
+    
+    // read in golden bin 
+    rc = readCalDataFromFileBin(pCalSetup->goldenBinFilename, pEeprom);
+    assert(rc);
+    printf("Read %s\n", pCalSetup->goldenBinFilename);
+
+    numPiers2G = numPiers5G = 0;
+    pBase = &(pEeprom->baseEepHeader);
+
+    {
+        if (pBase->opCapFlags & WLAN_11G_CAPABILITY) { 
+            pRawDataSet2G_ext = pEeprom->calPierData2GExpanded;
+            pCalChans2G = pEeprom->calFreqPier2GExpanded;
+            for (numPiers2G = 0; numPiers2G < AR6003_NUM_2G_CAL_PIERS_EXPANDED; numPiers2G++) {
+                if (pCalChans2G[numPiers2G] == AR6003_BCHAN_UNUSED) {
+                    break;
+                }
+            }
+        }
+
+        if (pBase->opCapFlags & WLAN_11A_CAPABILITY) {
+            pRawDataSet5G_ext = pEeprom->calPierData5GExpanded;
+            pCalChans5G = pEeprom->calFreqPier5GExpanded;
+            for (numPiers5G = 0; numPiers5G < AR6003_NUM_5G_CAL_PIERS_EXPANDED; numPiers5G++) {
+                if (pCalChans5G[numPiers5G] == AR6003_BCHAN_UNUSED) {
+                    break;
+                }
+            }
+        }
+    }
+
+    PSAT_CAL_RESULTS *pPsatCalResults = &(pTCMsg->msg.psatCalResults);
+
+    for (i=0;i<numPiers2G;i++) {
+                printf("%d %d %d %d %d %.2f %.2f %d %d 0x%x %d %d 0x%x\n", pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_diff, pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_abs, pPsatCalResults->olpcGainTherm2G[i].thermCalVal,
+                    pPsatCalResults->olpcGainTherm2G[i].cmac_psat, pPsatCalResults->olpcGainTherm2G[i].cmac_olpc,
+                    cmacPwr(pPsatCalResults->olpcGainTherm2G[i].cmac_psat), cmacPwr(pPsatCalResults->olpcGainTherm2G[i].cmac_olpc),
+                    pPsatCalResults->olpcGainTherm2G[i].cmac_psat_pcdac, pPsatCalResults->olpcGainTherm2G[i].cmac_olpc_pcdac,
+                    pPsatCalResults->olpcGainTherm2G[i].numTryBF, 
+                    pPsatCalResults->olpcGainTherm2G[i].lineSlope, pPsatCalResults->olpcGainTherm2G[i].lineVariance,
+                    pPsatCalResults->olpcGainTherm2G[i].psatParm);
+            //}
+    }
+    for (i=0;i<numPiers5G ;i++) {
+                printf("%d %d %d %d %d %.2f %.2f %d %d 0x%x\n", pPsatCalResults->olpcGainTherm5G[i].olpcGainDelta_diff, pPsatCalResults->olpcGainTherm5G[i].olpcGainDelta_abs, pPsatCalResults->olpcGainTherm5G[i].thermCalVal,
+                    pPsatCalResults->olpcGainTherm5G[i].cmac_psat, pPsatCalResults->olpcGainTherm5G[i].cmac_olpc,
+                    cmacPwr(pPsatCalResults->olpcGainTherm5G[i].cmac_psat), cmacPwr(pPsatCalResults->olpcGainTherm5G[i].cmac_olpc),
+                    pPsatCalResults->olpcGainTherm5G[i].cmac_psat_pcdac, pPsatCalResults->olpcGainTherm5G[i].cmac_olpc_pcdac,
+                    pPsatCalResults->olpcGainTherm5G[i].numTryBF);
+            //}
+    }
+
+    for (i=0;i<numPiers2G;i++) {
+        if (pEeprom->baseEepHeader.boardFlagsExt & AR6003_BOARDFLAGSEXT_PSAT_CAL_ABS) {
+            pRawDataSet2G_ext[i].olpcBasic.olpcGainDelta = (int8_t)  (pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_abs); 
+            pRawDataSet2G_ext[i].olpcGainDelta_t10       = (int16_t) (pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_abs *5);
+        }
+        else {
+            pRawDataSet2G_ext[i].olpcBasic.olpcGainDelta = (int8_t)  (pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_diff); 
+            pRawDataSet2G_ext[i].olpcGainDelta_t10       = (int16_t) (pPsatCalResults->olpcGainTherm2G[i].olpcGainDelta_diff *5);
+        }
+        pRawDataSet2G_ext[i].olpcBasic.thermCalVal   = (uint8_t) pPsatCalResults->olpcGainTherm2G[i].thermCalVal;
+    }
+
+    for (i=0;i<numPiers5G;i++) {
+        if (pEeprom->baseEepHeader.boardFlagsExt & AR6003_BOARDFLAGSEXT_PSAT_CAL_ABS) {
+        pRawDataSet5G_ext[i].olpcBasic.olpcGainDelta = (int8_t)pPsatCalResults->olpcGainTherm5G[i].olpcGainDelta_abs; 
+        }
+        else {
+        pRawDataSet5G_ext[i].olpcBasic.olpcGainDelta = (int8_t)pPsatCalResults->olpcGainTherm5G[i].olpcGainDelta_diff; 
+        }
+        pRawDataSet5G_ext[i].olpcBasic.thermCalVal   = (uint8_t)pPsatCalResults->olpcGainTherm5G[i].thermCalVal;
+        pRawDataSet5G_ext[i].olpcGainDelta_t10       = (int16_t)(pPsatCalResults->olpcGainTherm5G[i].olpcGainDelta_diff * 5); 
+    }
+    
+    memcpy((void*)&(pEeprom->baseEepHeader.custData[0]), pCalSetup->label, sizeof(pCalSetup->label));
+    
+    // Generate bin
+    if (pEeprom->baseEepHeader.boardFlagsExt & AR6003_BOARDFLAGSEXT_PSAT_CAL_GEN_EEPROM) {
+    rc = genEepromBinFile(pCalSetup->outputBinFilename, pEeprom);
+    assert(rc);
+    }
+
+    return;
+}
+
diff --git a/ath6kl-tcmd/athtestcmd.h b/ath6kl-tcmd/athtestcmd.h
new file mode 100644
index 0000000..0b0977f
--- /dev/null
+++ b/ath6kl-tcmd/athtestcmd.h
@@ -0,0 +1,57 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef _TCMD_H_
+#define _TCMD_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+enum {
+    TESTMODE_CONT_TX = 801,     /* something that doesn't collide with ascii */
+    TESTMODE_CONT_RX,
+    TESTMODE_PM,
+    TESTMODE_SETLPREAMBLE,
+    TESTMODE_SETREG,
+    TESTMODE_CMDS,
+};
+
+enum {
+    TCMD_SET_RX_LPL=501,     /* something that doesn't collide with ascii */
+    TCMD_EFUSE_START=502,
+    TCMD_EFUSE_END=503,
+    TCMD_EFUSE_DATA=504,
+    TCMD_EFUSE_DUMP=505,
+    TCMD_EFUSE_WRITE=506,
+    TCMD_OTP_DUMP=507,
+    TCMD_OTP_WRITE=508,
+    TCMD_READ_THERMAL=509,
+    TCMD_PSAT_CAL=510,
+    TCMD_PSAT_CAL_RESULT,
+    TCMD_PM_CAL_RESULT, 
+    TCMD_PM_CAL,
+    TCMD_UPDATE_CAL_OTP, 
+    TCMD_CHAR_PSAT,
+    TCMD_CHAR_PSAT_RESULT,    
+    TCMD_SINIT_WAIT,
+};
+
+#ifdef __cplusplus
+}
+#endif
+#endif				/* _TCMD_H_ */
diff --git a/ath6kl-tcmd/psatUtil b/ath6kl-tcmd/psatUtil
new file mode 100755
index 0000000..223a0a9
--- /dev/null
+++ b/ath6kl-tcmd/psatUtil
Binary files differ
diff --git a/ath6kl-tcmd/psatUtil.c b/ath6kl-tcmd/psatUtil.c
new file mode 100644
index 0000000..b8a79ef
--- /dev/null
+++ b/ath6kl-tcmd/psatUtil.c
@@ -0,0 +1,105 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <linux/types.h>
+#include <linux/if.h>
+#include <linux/wireless.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <getopt.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <math.h>
+
+#include "testcmd.h"
+#include "athtestcmd.h"
+#include "sinit_common.h"
+
+#ifdef ATHTESTCMD_LIB
+#include <setjmp.h>
+extern void testcmd_error(int code, const char *fmt, ...);
+#define A_ERR testcmd_error
+#else
+#define A_ERR err
+#endif
+
+// defines
+
+#define strnicmp strncmp
+
+typedef unsigned long A_UINT32;
+typedef unsigned char A_UINT8;
+typedef int           A_BOOL;
+
+#ifdef ANDROID
+#define _TCMD_PATH "/system/bin/athtestcmd -i wlan0"
+#else
+#define _TCMD_PATH "./athtestcmd -i wlan0"
+#endif
+
+int main(void)
+{
+    char  cmd[128];
+    A_UINT32 i;
+    A_UINT32 freq;
+
+#ifdef ANDROID
+    system("insmod /system/lib/modules/cfg80211.ko");
+    sleep(2);
+
+    system("insmod /system/lib/modules/ath6kl_sdio.ko testmode=2");
+    sleep(3);
+#else
+    system("insmod /lib/modules/`uname -r`/kernel/drivers/net/wireless/ath/ath6kl/ath6kl_sdio.ko testmode=2");
+    sleep(3);
+#endif
+
+    freq=2412;
+
+    for (i = 0; i < NumEntriesPSTSweepTable; i++) 
+    {
+            sprintf(cmd, "%s --psat_char %ld --txfreq %ld", _TCMD_PATH, i, freq);
+            //printf("%s\n", cmd);
+            system(cmd);
+            sprintf(cmd, "%s --psat_char_result", _TCMD_PATH);
+            //printf("%s\n", cmd);
+            system(cmd);
+            sleep(1);
+    }
+
+#ifdef ANDROID
+    system("rmmod ath6kl_sdio");
+    sleep(1);
+    system("rmmod cfg80211");
+#else
+    system("rmmod ath6kl_sdio.ko");
+#endif
+
+    return 0;
+}
+
diff --git a/ath6kl-tcmd/sinit_common.c b/ath6kl-tcmd/sinit_common.c
new file mode 100644
index 0000000..56214ce
--- /dev/null
+++ b/ath6kl-tcmd/sinit_common.c
@@ -0,0 +1,309 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <stdint.h>
+#include "testcmd.h"
+#include "sinit_common.h"
+
+PSAT_SWEEP_TABLE psatSweepTbl[] = {
+{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+{3, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+{0, 1, 0, 0, 0, 0, 0, 0, 0, 0},
+{3, 1, 0, 0, 0, 0, 0, 0, 0, 0},
+{0, 0, 3, 0, 0, 0, 0, 0, 0, 0},
+{3, 0, 3, 0, 0, 0, 0, 0, 0, 0},
+{0, 1, 3, 0, 0, 0, 0, 0, 0, 0},
+{3, 1, 3, 0, 0, 0, 0, 0, 0, 0},
+{0, 0, 0, 3, 0, 0, 0, 0, 0, 0},
+{3, 0, 0, 3, 0, 0, 0, 0, 0, 0},
+{0, 1, 0, 3, 0, 0, 0, 0, 0, 0},
+{3, 1, 0, 3, 0, 0, 0, 0, 0, 0},
+{0, 0, 3, 3, 0, 0, 0, 0, 0, 0},
+{3, 0, 3, 3, 0, 0, 0, 0, 0, 0},
+{0, 1, 3, 3, 0, 0, 0, 0, 0, 0},
+{3, 1, 3, 3, 0, 0, 0, 0, 0, 0},
+{0, 0, 0, 0, 3, 0, 0, 0, 0, 0},
+{3, 0, 0, 0, 3, 0, 0, 0, 0, 0},
+{0, 1, 0, 0, 3, 0, 0, 0, 0, 0},
+{3, 1, 0, 0, 3, 0, 0, 0, 0, 0},
+{0, 0, 3, 0, 3, 0, 0, 0, 0, 0},
+{3, 0, 3, 0, 3, 0, 0, 0, 0, 0},
+{0, 1, 3, 0, 3, 0, 0, 0, 0, 0},
+{3, 1, 3, 0, 3, 0, 0, 0, 0, 0},
+{0, 0, 0, 3, 3, 0, 0, 0, 0, 0},
+{3, 0, 0, 3, 3, 0, 0, 0, 0, 0},
+{0, 1, 0, 3, 3, 0, 0, 0, 0, 0},
+{3, 1, 0, 3, 3, 0, 0, 0, 0, 0},
+{0, 0, 3, 3, 3, 0, 0, 0, 0, 0},
+{3, 0, 3, 3, 3, 0, 0, 0, 0, 0},
+{0, 1, 3, 3, 3, 0, 0, 0, 0, 0},
+{3, 1, 3, 3, 3, 0, 0, 0, 0, 0},
+{0, 0, 0, 0, 0, 1, 0, 0, 0, 0},
+{3, 0, 0, 0, 0, 1, 0, 0, 0, 0},
+{0, 1, 0, 0, 0, 1, 0, 0, 0, 0},
+{3, 1, 0, 0, 0, 1, 0, 0, 0, 0},
+{0, 0, 3, 0, 0, 1, 0, 0, 0, 0},
+{3, 0, 3, 0, 0, 1, 0, 0, 0, 0},
+{0, 1, 3, 0, 0, 1, 0, 0, 0, 0},
+{3, 1, 3, 0, 0, 1, 0, 0, 0, 0},
+{0, 0, 0, 3, 0, 1, 0, 0, 0, 0},
+{3, 0, 0, 3, 0, 1, 0, 0, 0, 0},
+{0, 1, 0, 3, 0, 1, 0, 0, 0, 0},
+{3, 1, 0, 3, 0, 1, 0, 0, 0, 0},
+{0, 0, 3, 3, 0, 1, 0, 0, 0, 0},
+{3, 0, 3, 3, 0, 1, 0, 0, 0, 0},
+{0, 1, 3, 3, 0, 1, 0, 0, 0, 0},
+{3, 1, 3, 3, 0, 1, 0, 0, 0, 0},
+{0, 0, 0, 0, 3, 1, 0, 0, 0, 0},
+{3, 0, 0, 0, 3, 1, 0, 0, 0, 0},
+{0, 1, 0, 0, 3, 1, 0, 0, 0, 0},
+{3, 1, 0, 0, 3, 1, 0, 0, 0, 0},
+{0, 0, 3, 0, 3, 1, 0, 0, 0, 0},
+{3, 0, 3, 0, 3, 1, 0, 0, 0, 0},
+{0, 1, 3, 0, 3, 1, 0, 0, 0, 0},
+{3, 1, 3, 0, 3, 1, 0, 0, 0, 0},
+{0, 0, 0, 3, 3, 1, 0, 0, 0, 0},
+{3, 0, 0, 3, 3, 1, 0, 0, 0, 0},
+{0, 1, 0, 3, 3, 1, 0, 0, 0, 0},
+{3, 1, 0, 3, 3, 1, 0, 0, 0, 0},
+{0, 0, 3, 3, 3, 1, 0, 0, 0, 0},
+{3, 0, 3, 3, 3, 1, 0, 0, 0, 0},
+{0, 1, 3, 3, 3, 1, 0, 0, 0, 0},
+{3, 1, 3, 3, 3, 1, 0, 0, 0, 0},
+{0, 0, 0, 0, 0, 0, 15, 0, 0, 0},
+{3, 0, 0, 0, 0, 0, 15, 0, 0, 0},
+{0, 1, 0, 0, 0, 0, 15, 0, 0, 0},
+{3, 1, 0, 0, 0, 0, 15, 0, 0, 0},
+{0, 0, 3, 0, 0, 0, 15, 0, 0, 0},
+{3, 0, 3, 0, 0, 0, 15, 0, 0, 0},
+{0, 1, 3, 0, 0, 0, 15, 0, 0, 0},
+{3, 1, 3, 0, 0, 0, 15, 0, 0, 0},
+{0, 0, 0, 3, 0, 0, 15, 0, 0, 0},
+{3, 0, 0, 3, 0, 0, 15, 0, 0, 0},
+{0, 1, 0, 3, 0, 0, 15, 0, 0, 0},
+{3, 1, 0, 3, 0, 0, 15, 0, 0, 0},
+{0, 0, 3, 3, 0, 0, 15, 0, 0, 0},
+{3, 0, 3, 3, 0, 0, 15, 0, 0, 0},
+{0, 1, 3, 3, 0, 0, 15, 0, 0, 0},
+{3, 1, 3, 3, 0, 0, 15, 0, 0, 0},
+{0, 0, 0, 0, 3, 0, 15, 0, 0, 0},
+{3, 0, 0, 0, 3, 0, 15, 0, 0, 0},
+{0, 1, 0, 0, 3, 0, 15, 0, 0, 0},
+{3, 1, 0, 0, 3, 0, 15, 0, 0, 0},
+{0, 0, 3, 0, 3, 0, 15, 0, 0, 0},
+{3, 0, 3, 0, 3, 0, 15, 0, 0, 0},
+{0, 1, 3, 0, 3, 0, 15, 0, 0, 0},
+{3, 1, 3, 0, 3, 0, 15, 0, 0, 0},
+{0, 0, 0, 3, 3, 0, 15, 0, 0, 0},
+{3, 0, 0, 3, 3, 0, 15, 0, 0, 0},
+{0, 1, 0, 3, 3, 0, 15, 0, 0, 0},
+{3, 1, 0, 3, 3, 0, 15, 0, 0, 0},
+{0, 0, 3, 3, 3, 0, 15, 0, 0, 0},
+{3, 0, 3, 3, 3, 0, 15, 0, 0, 0},
+{0, 1, 3, 3, 3, 0, 15, 0, 0, 0},
+{3, 1, 3, 3, 3, 0, 15, 0, 0, 0},
+{0, 0, 0, 0, 0, 1, 15, 0, 0, 0},
+{3, 0, 0, 0, 0, 1, 15, 0, 0, 0},
+{0, 1, 0, 0, 0, 1, 15, 0, 0, 0},
+{3, 1, 0, 0, 0, 1, 15, 0, 0, 0},
+{0, 0, 3, 0, 0, 1, 15, 0, 0, 0},
+{3, 0, 3, 0, 0, 1, 15, 0, 0, 0},
+{0, 1, 3, 0, 0, 1, 15, 0, 0, 0},
+{3, 1, 3, 0, 0, 1, 15, 0, 0, 0},
+{0, 0, 0, 3, 0, 1, 15, 0, 0, 0},
+{3, 0, 0, 3, 0, 1, 15, 0, 0, 0},
+{0, 1, 0, 3, 0, 1, 15, 0, 0, 0},
+{3, 1, 0, 3, 0, 1, 15, 0, 0, 0},
+{0, 0, 3, 3, 0, 1, 15, 0, 0, 0},
+{3, 0, 3, 3, 0, 1, 15, 0, 0, 0},
+{0, 1, 3, 3, 0, 1, 15, 0, 0, 0},
+{3, 1, 3, 3, 0, 1, 15, 0, 0, 0},
+{0, 0, 0, 0, 3, 1, 15, 0, 0, 0},
+{3, 0, 0, 0, 3, 1, 15, 0, 0, 0},
+{0, 1, 0, 0, 3, 1, 15, 0, 0, 0},
+{3, 1, 0, 0, 3, 1, 15, 0, 0, 0},
+{0, 0, 3, 0, 3, 1, 15, 0, 0, 0},
+{3, 0, 3, 0, 3, 1, 15, 0, 0, 0},
+{0, 1, 3, 0, 3, 1, 15, 0, 0, 0},
+{3, 1, 3, 0, 3, 1, 15, 0, 0, 0},
+{0, 0, 0, 3, 3, 1, 15, 0, 0, 0},
+{3, 0, 0, 3, 3, 1, 15, 0, 0, 0},
+{0, 1, 0, 3, 3, 1, 15, 0, 0, 0},
+{3, 1, 0, 3, 3, 1, 15, 0, 0, 0},
+{0, 0, 3, 3, 3, 1, 15, 0, 0, 0},
+{3, 0, 3, 3, 3, 1, 15, 0, 0, 0},
+{0, 1, 3, 3, 3, 1, 15, 0, 0, 0},
+{3, 1, 3, 3, 3, 1, 15, 0, 0, 0},
+};
+
+_CMAP_PWR_MAPPING CmacPwrLkupTbl[] = { 
+{100000, -433},
+{110000, -429},
+{120000, -425},
+{130000, -421},
+{140000, -418},
+{150000, -415},
+{160000, -412},
+{170000, -410},
+{180000, -407},
+{190000, -405},
+{200000, -403},
+{210000, -400},
+{220000, -398},
+{230000, -397},
+{240000, -395},
+{250000, -393},
+{260000, -391},
+{280000, -388},
+{290000, -386},
+{310000, -384},
+{330000, -381},
+{350000, -378},
+{380000, -375},
+{400000, -372},
+{430000, -369},
+{460000, -366},
+{500000, -363},
+{550000, -359},
+{600000, -355},
+{650000, -351},
+{700000, -348},
+{750000, -345},
+{800000, -342},
+{850000, -340},
+{900000, -337},
+{950000, -335},
+{1000000, -333},
+{1100000, -329},
+{1200000, -325},
+{1300000, -321},
+{1400000, -318},
+{1500000, -315},
+{1600000, -312},
+{1700000, -310},
+{1800000, -307},
+{1900000, -305},
+{2000000, -303},
+{2100000, -300},
+{2200000, -298},
+{2400000, -295},
+{2500000, -293},
+{2700000, -290},
+{2800000, -288},
+{3000000, -285},
+{3200000, -282},
+{3500000, -278},
+{3800000, -275},
+{4000000, -272},
+{4200000, -270},
+{4400000, -268},
+{4800000, -265},
+{5200000, -261},
+{5400000, -259},
+{5800000, -256},
+{6200000, -253},
+{6800000, -249},
+{7400000, -246},
+{7800000, -243},
+{8400000, -240},
+{8600000, -239},
+{9300000, -236},
+{10200000, -232},
+{10800000, -229},
+{11700000, -226},
+{12400000, -223},
+{13600000, -219},
+{14800000, -216},
+{15600000, -213},
+{16800000, -210},
+{17600000, -208},
+{18800000, -205},
+{20500000, -202},
+{21500000, -199},
+{23500000, -196},
+{25000000, -193},
+{26500000, -190},
+{29000000, -186},
+{33500000, -180},
+{42000000, -170},
+{53000000, -160},
+{67000000, -150},
+{84000000, -140},
+{106000000, -130},
+{135000000, -120},
+{155000000, -114},
+{175000000, -109},
+{200000000, -103},
+{230000000, -97},
+{265000000, -91},
+{300000000, -85},
+{330000000, -81},
+{360000000, -78},
+{390000000, -74},
+{430000000, -70},
+{470000000, -66},
+{520000000, -62},
+{570000000, -58},
+{620000000, -54},
+{680000000, -50},
+{750000000, -46},
+};
+
+uint16_t NumEntriesPSTSweepTable = sizeof(psatSweepTbl)/sizeof(PSAT_SWEEP_TABLE);
+
+int32_t
+interpolate_round(int32_t target, int32_t srcLeft, int32_t srcRight,
+            int32_t targetLeft, int32_t targetRight, int32_t roundUp)
+{
+    int32_t rv, tmp;
+
+    if (srcRight == srcLeft) {
+        rv = targetLeft;
+    } else {
+        tmp = srcRight - srcLeft;
+        rv = (((target - srcLeft) * targetRight) / tmp) +
+             (((srcRight - target) * targetLeft) / tmp);
+    }
+
+    return(rv);
+}
+
+
+int16_t cmac2Pwr_t10(uint32_t cmac)
+{
+   uint32_t i;
+   int16_t cmacResult;
+   for (i=0;i<CMAC_PWR_LOOKUP_MAX;i++) {
+       if (cmac < CmacPwrLkupTbl[i].cmac) {
+           break;
+       }
+   } 
+   if (0 == i) {
+       return(CmacPwrLkupTbl[0].pwr_t10);
+   }
+   else if (CMAC_PWR_LOOKUP_MAX == i) {
+       return(CmacPwrLkupTbl[CMAC_PWR_LOOKUP_MAX -1].pwr_t10);
+   }
+   else {
+        /* Added a "DEVIDE_COEFF" to avoid the overflow */      
+        cmacResult = interpolate_round((cmac / DEVIDE_COEFF), (CmacPwrLkupTbl[i-1].cmac / DEVIDE_COEFF), (CmacPwrLkupTbl[i].cmac / DEVIDE_COEFF), 
+            CmacPwrLkupTbl[i-1].pwr_t10, CmacPwrLkupTbl[i].pwr_t10, 10);
+   }
+
+   return(cmacResult);
+}
+
+
diff --git a/ath6kl-tcmd/sinit_common.h b/ath6kl-tcmd/sinit_common.h
new file mode 100644
index 0000000..b19770f
--- /dev/null
+++ b/ath6kl-tcmd/sinit_common.h
@@ -0,0 +1,41 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef  _PSAT_COMMON_H_
+#define  _PSAT_COMMON_H_
+
+#include <stdint.h>
+#include "testcmd.h"
+
+#define DEVIDE_COEFF 10000
+
+// CMAC to power lookup table, for platform such as embedded without sophisticated math function 
+typedef struct {
+    uint32_t cmac;
+    int32_t  pwr_t10;
+} _CMAP_PWR_MAPPING;
+
+extern _CMAP_PWR_MAPPING CmacPwrLkupTbl[];
+#define CMAC_PWR_LOOKUP_MAX (sizeof(CmacPwrLkupTbl) / sizeof(_CMAP_PWR_MAPPING))
+
+extern PSAT_SWEEP_TABLE psatSweepTbl[];
+extern uint16_t NumEntriesPSTSweepTable;
+
+int32_t interpolate_round(int32_t target, int32_t srcLeft, int32_t srcRight,
+            int32_t targetLeft, int32_t targetRight, int32_t roundUp);
+int16_t cmac2Pwr_t10(uint32_t cmac);
+
+#endif //#ifndef _PSAT_COMMON_H_
diff --git a/ath6kl-tcmd/sinit_eep.h b/ath6kl-tcmd/sinit_eep.h
new file mode 100644
index 0000000..709be34
--- /dev/null
+++ b/ath6kl-tcmd/sinit_eep.h
@@ -0,0 +1,359 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef _AR6003_EEPROM_STRUCT_H_
+#define _AR6003_EEPROM_STRUCT_H_
+
+#include <stdint.h>
+
+#define PREPACK
+#define POSTPACK __attribute__ ((packed))
+
+#define AR6003_EEP_VER_MINOR_MASK    0xFFF
+#define AR6003_EEP_MINOR_VER5        0x5  
+#define AR6003_EEP_MINOR_VER10        0xA
+#define AR6K_EEPROM_SIZE_PRIOR_VER4   1024
+#define AR6K_EEPROM_SIZE_LARGEST      2048
+
+#define AR6003_NUM_5G_CAL_PIERS      8
+#define AR6003_NUM_2G_CAL_PIERS      3
+#define AR6003_NUM_5G_CAL_PIERS_EXPANDED      32
+#define AR6003_NUM_2G_CAL_PIERS_EXPANDED      16
+#define AR6003_BCHAN_UNUSED          0xFF
+
+#define AR6003_BOARDFLAGSEXT_PSAT_CAL_GEN_EEPROM    0x04
+#define AR6003_BOARDFLAGSEXT_PSAT_CAL_ABS           0x08
+
+#define FREQ2FBIN(x,y) ((y) ? ((x) - 2300) : (((x) - 4800) / 5))
+#define FBIN2FREQ(x,y) ((y) ? ((x) + 2300) : (((x) * 5) + 4800))
+#define AR6003_MAX_CHAINS            1
+#define AR6003_EEPROM_MODAL_SPURS    5
+#define AR6003_NUM_ALPHATHERM_CHAN_PIERS        4
+#define AR6003_NUM_ALPHATHERM_TEMP_PIERS        4
+#define AR6003_NUM_5G_20_TARGET_POWERS  8
+#define AR6003_NUM_5G_40_TARGET_POWERS  8
+#define AR6003_NUM_2G_CCK_TARGET_POWERS 2
+#define AR6003_NUM_2G_20_TARGET_POWERS  3
+#define AR6003_NUM_2G_40_TARGET_POWERS  3
+#define AR6003_NUM_CTLS              21
+#define AR6003_NUM_BAND_EDGES        8
+#define AR6003_NUM_PD_GAINS          4
+#define NUM_ATECAL_CHANS_2G  4
+#define NUM_ATECAL_CHANS_5G  10
+#define AR6003_PD_GAIN_ICEPTS        5
+#define STICKY_REG_TBL_SIZE_MAX 8
+#define MAX_CUSTDATA_BYTES 16
+
+typedef enum {
+    WLAN_11A_CAPABILITY   = 1,
+    WLAN_11G_CAPABILITY   = 2,
+    WLAN_11AG_CAPABILITY  = 3,
+}WALN_CAPABILITY;
+
+typedef enum {
+    TGTPWR_LEG_6_24 = 0,
+    TGTPWR_LEG_36,
+    TGTPWR_LEG_48,
+    TGTPWR_LEG_54,
+    TGTPWR_LEG_LAST
+} TGTPWR_LEG;
+
+typedef enum {
+    TGTPWR_HT_0 = 0,
+    TGTPWR_HT_1,
+    TGTPWR_HT_2,
+    TGTPWR_HT_3,
+    TGTPWR_HT_4,
+    TGTPWR_HT_5,
+    TGTPWR_HT_6,
+    TGTPWR_HT_7,
+    TGTPWR_HT_LAST
+} TGTPWR_HT;
+
+typedef PREPACK struct Ar6003_spurChanStruct {
+    uint8_t   spurChan;                      /*spur mitigation enabled in the channel bitmap, 1 bit 1 channel*/
+    uint8_t   spurABChoose;              /*choose which is master spur ,spur_A or spur_B*/
+    uint8_t   spurA_PrimSecChoose; /*choose primary and secondary spur which produce by spur_A*/            
+    uint8_t   spurB_PrimSecChoose; /*choose primary and secondary spur which produce by spur_B*/            
+} POSTPACK AR6003_SPUR_CHAN;
+
+typedef union Ar6003_obdbStruct {
+    uint16_t value;
+    struct g_bits {
+        uint16_t paloff   :  3,
+                 qam      :  3,
+                 psk      :  3,
+                 cck      :  3,
+                 db       :  3,
+                 unused   :  1;
+    } g_obdb;
+    struct a_bits {
+        uint16_t d2b      :  3,
+                 d3b      :  3,
+                 d4b      :  3,
+                 ob       :  3,
+                 unused   :  4;
+    } a_obdb;
+} POSTPACK AR6003_OBDB;
+
+typedef PREPACK struct Ar6003_BaseEepHeader {
+    uint32_t  length;                                                  // 4 B
+    uint16_t  checksum;                                                // 2 B
+    uint16_t  version;                                                 // 2 B
+    uint16_t  opCapFlags;                                              // 2 B
+    uint16_t  boardFlags;                                              // 2 B
+    uint16_t  regDmn[2];                                               // 4 B
+    uint16_t  subSystemId;                                             // 2 B
+    uint16_t  blueToothOptions;                                        // 2 B 
+    uint16_t  binBuildNumber; // major(4):minor(5):build(7)            // 2 B   
+    uint8_t   macAddr[6];                                              // 6 B
+    uint8_t   bdAddr[6];                                               // 6 B
+    uint8_t   rxMask;                                                  // 1 B
+    uint8_t   txMask;                                                  // 1 B
+    int8_t    cckOfdmDelta;                                            // 1 B
+    uint8_t   custData[MAX_CUSTDATA_BYTES];                            // 16 B    
+    uint8_t   reserved[4];                                             // 4 B reserved for custData. Sometimes custData exceed the max bytes
+    uint8_t   spurBaseA;                                               // 1 B
+    uint8_t   spurBaseB;                                               // 1 B
+    uint8_t   spurRssiThresh;                                          // 1 B
+    uint8_t   HTCapFlags;                                              // 1 B 
+    uint8_t   boardFlagsExt;                                           // 1 B
+    uint8_t   futureBase[6];                                           // 6 B
+} POSTPACK AR6003_BASE_EEP_HEADER;                                     // 68 B
+
+// Notes:
+// - IQ CAL is done by sw for every reset, here we store the default values in case IQ CAL 
+//   is not done for whatever reason.
+typedef PREPACK struct Ar6003_ModalEepHeader {
+    uint32_t  antCtrlChain[AR6003_MAX_CHAINS];                         // 4B, "chn_b0_switch_table", AntE only  
+    uint32_t  antCtrlCom1;                                             // 4B, "com1_switch_table", AntA, B, C, D
+    uint32_t  antCtrlCom2;                                             // 4B, "com2_switch_table"
+    AR6003_OBDB ob_db;                                                 // 2B, a number of ob, db fields
+    uint8_t   anaXtalConfig[6];                                        // 6B, tbd?: for xtal/synth related fields, tobe replaced with a struct
+    int8_t    antennaGainCh[AR6003_MAX_CHAINS];                        // 1B, affect antenna gain calculation
+    uint8_t   switchSettling;                                          // 1B, "time_switch_settling"
+    uint8_t   swSettleHt40;                                            // 1B, "time_switch_settling" for HT40 
+    uint8_t   xatten1Db[AR6003_MAX_CHAINS];                            // 1B, "xatten1_db_0"
+    uint8_t   xatten1Margin[AR6003_MAX_CHAINS];                        // 1B, "xatten1_margin_0"    
+    uint8_t   xatten1Hyst[AR6003_MAX_CHAINS];                          // 1B, "xatten1_hyst_margin_0"
+    uint8_t   xatten2Db[AR6003_MAX_CHAINS];                            // 1B, "xatten2_db_0"
+    uint8_t   xatten2Margin[AR6003_MAX_CHAINS];                        // 1B, "xatten2_margin_0"    
+    uint8_t   xatten2Hyst[AR6003_MAX_CHAINS];                          // 1B, "xatten2_hyst_margin_0"    
+    int8_t    adcDesiredSize;                                          // 1B, "adc_desired_size"
+    uint8_t   txEndToXpaOff;                                           // 1B, "tx_end_to_xpaa_off", "tx_end_to_xpab_off"
+    uint8_t   txEndToRxOn;                                             // 1B, "tx_end_to_a2_rx_on"
+    uint8_t   txFrameToXpaOn;                                          // 1B, "tx_frame_to_xpaa_on", "tx_frame_to_xpab_on"
+    uint8_t   txFrameToDataStart;                                      // 1B, "tx_frame_to_tx_d_start"
+    uint8_t   txFrameToPaOn;                                           // 1B, "tx_frame_to_pa_on"
+    uint8_t   thresh62;                                                // 1B, "cf_thresh62"
+    int8_t    noiseFloorThreshCh[AR6003_MAX_CHAINS];                   // 1B, tbd?: what to set?
+    int8_t    rxIqCalICh[AR6003_MAX_CHAINS];                           // 1B, "rx_iqcorr_q_i_coff_0"  
+    int8_t    rxIqCalQCh[AR6003_MAX_CHAINS];                           // 1B, "rx_iqcorr_q_q_coff_0"
+    uint8_t   xpaBiasLvl;                                              // 1B, "an_top_xpabiaslvl"
+    uint8_t   ht40PowerIncForPdadc;                                    // 1B, affect tx power in HT40
+    uint8_t   enableXpa;                                               // 1B, "bb_enable_xpab | bb_enable_xpaa"
+    AR6003_SPUR_CHAN spurChans[AR6003_EEPROM_MODAL_SPURS];             // 4 * 5 = 20 B, tbd?:     
+    uint8_t   alphaTherm;                                              // 1B, "alpha_therm"
+    uint8_t   alphaThermPalOn;                                         // 1B, "alpha_therm_pal_on"
+    uint8_t   alphaVolt;                                               // 1B, "alpha_volt"
+    uint8_t   alphaVoltPalOn;                                          // 1B, "alpha_volt_pal_on"
+    int8_t    adcDesiredSizeHT40;                                      // 1B, "adc_desired_size" for HT40
+    uint8_t   paprdQuickDrop;                                          // 1B, "bb_paprd_trainer_cntl3_cf_paprd_quick_drop"
+    uint8_t   txGainTbl_0;           // bb_tx_gain_table_0
+    uint8_t   txGainTblDelta[16];    // bb_tx_gain_table_x (_1 to _32, 4 bits per delta) for PAL OFF??
+    uint8_t   reserved[3];
+    uint32_t  antCtrlExtCommon1;
+    uint32_t  antCtrlExtCommon2;
+    uint8_t   alphaThermChans[AR6003_NUM_ALPHATHERM_CHAN_PIERS];        // 4B, "alpha therm channels"
+    uint8_t   alphaThermTbl[AR6003_NUM_ALPHATHERM_CHAN_PIERS][AR6003_NUM_ALPHATHERM_TEMP_PIERS];      // 16B, "alpha_therm_tbl" lowtemp midtemp1 midtemp2 hightemp
+    uint8_t   areg_lvlctr;                                              // 1 B
+    uint8_t   pareg_lvlctr;                                             // 1 B
+    uint8_t   txGainTblMax;                                             // 1 B
+    uint8_t   cckInitRfGain;                                            // 1 B
+    uint16_t  paprdMinCorrThreshold;                                    // 2 B
+    uint8_t   an_rxrf_bias1_pwd_ic25vga5g;                              // 1 B
+    uint8_t   futureModal[5];                                           // 5 B  
+} POSTPACK AR6003_MODAL_EEP_HEADER;                                     // 128 B
+
+typedef PREPACK struct Ar6003_calDataPerFreq {
+    uint8_t pwrPdg[AR6003_NUM_PD_GAINS][AR6003_PD_GAIN_ICEPTS];        // 20 B
+    uint8_t vpdPdg[AR6003_NUM_PD_GAINS][AR6003_PD_GAIN_ICEPTS];        // 20 B
+} POSTPACK AR6003_CAL_DATA_PER_FREQ;                                   // 40 B
+
+typedef PREPACK struct Ar6003_calDataPerFreqOlpc {
+    int8_t  olpcGainDelta;                                             // 1B, "olpc_gain_delta"
+    uint8_t thermCalVal;                                               // 1B, "therm_cal_value"
+    uint8_t voltCalVal;                                                // 1B, "volt_cal_value"
+    int8_t  olpcGainDeltaPALOn;                                        // 1B, "olpc_gain_delta_pal_on"
+} POSTPACK AR6003_CAL_DATA_PER_FREQ_OLPC;                              // 4 B
+
+typedef PREPACK struct Ar6003_calDataPerFreqOlpcExpanded {
+    AR6003_CAL_DATA_PER_FREQ_OLPC olpcBasic;                            // 4B
+    int16_t  olpcGainDelta_t10;                                         // 2B  "untruncated olpc gain delta 0.1dB resolution"
+    uint8_t  desiredScaleCck_t10;                                       // 1B, "desired_scale_cck"
+    uint8_t  desiredScale6M_t10;                                        // 1B
+    uint8_t  desiredScale36M_t10;                                       // 1B
+    uint8_t  desiredScale54M_t10;                                       // 1B
+    uint8_t  desiredScaleMCS0HT20_t10;                                  // 1B
+    uint8_t  desiredScaleMCS7HT20_t10;                                  // 1B
+    uint8_t  desiredScaleMCS0HT40_t10;                                  // 1B
+    uint8_t  desiredScaleMCS7HT40_t10;                                  // 1B
+} POSTPACK AR6003_CAL_DATA_PER_FREQ_OLPC_EXPANDED;                      // 14 B
+
+typedef PREPACK struct Ar6003_calDataPerFreqOlpcATEDelta {
+    int16_t olpcGainDelta_t10;                                         // 2B  
+} POSTPACK AR6003_CAL_DATA_PER_FREQ_OLPC_FE_DELTA;                     // 2B
+
+typedef PREPACK struct Ar6003_CalTargetPowerLegacy {
+    uint8_t  bChannel;
+    uint8_t  tPow2x[4];
+} POSTPACK AR6003_CAL_TARGET_POWER_LEG;     // 5B
+
+typedef PREPACK struct Ar6003_CalTargetPowerHt {
+    uint8_t  bChannel;
+    uint8_t  tPow2x[8];
+} POSTPACK AR6003_CAL_TARGET_POWER_HT;
+
+typedef PREPACK struct Ar6003_CalCtlEdges {
+    uint8_t  bChannel;
+    uint8_t  tPower :6,
+             flag   :2;
+} POSTPACK AR6003_CAL_CTL_EDGES;
+
+typedef PREPACK struct Ar6003_CalCtlData {
+    AR6003_CAL_CTL_EDGES  ctlEdges[AR6003_MAX_CHAINS][AR6003_NUM_BAND_EDGES];                     // 2 * 8 = 16 B 
+} POSTPACK AR6003_CAL_CTL_DATA;  // 16 B
+
+typedef PREPACK struct Ar6003_CalDataPerChip {
+    int16_t     thermAdcScaledGain;   // 2B, "therm_adc_scaled_gain"
+    int8_t      thermAdcOffset;       // 1B, "therm_adc_offset"
+    uint8_t     xtalCapOutDac;        // 1B, "xtal_capoutdac"
+    uint8_t     xtalCapInDac;         // 1B, "xtal_capindac"
+    uint8_t     refBiasTrim;          // 1B, tbd?: what field? 
+} POSTPACK AR6003_CAL_DATA_PER_CHIP;  // 6 B
+
+typedef PREPACK struct ateProvided {
+    uint8_t GoldenTherm;
+    uint8_t GoldenVolt;
+    uint8_t pcDac;
+    uint8_t vtestLCodeGolden;           
+    int8_t  vtestLVoltGolden;            
+    uint8_t vtestHCodeGolden;             
+    int8_t  vtestHVoltGolden;              
+    uint8_t numCalChans5G;
+    uint8_t numCalChans2G;                            // 1B
+    uint8_t calFreqPier5G[NUM_ATECAL_CHANS_5G];       // 10B
+    uint8_t calFreqPier2G[NUM_ATECAL_CHANS_2G];       // 4B
+    uint8_t ateZeroCalFlag;                           // 1B
+} POSTPACK AR6003_ATE_PROVIDED_DATA;                  // 24B
+
+typedef PREPACK struct stickyRegTbl {
+	uint32_t address;
+	uint32_t value;
+} POSTPACK AR6003_STICKY_REG_TABLE;             // 8B
+
+#define PSAT_AN_TXRF3_RDIV2G_LSB                    0        // an_txrf3_rdiv2g;
+#define PSAT_AN_TXRF3_RDIV2G_MASK                   0x3      // an_txrf3_rdiv2g;
+#define PSAT_AN_TXRF3_PDPREDIST2G_LSB               2        // an_txrf3_pdpredist2g;               
+#define PSAT_AN_TXRF3_PDPREDIST2G_MASK              0x1      // an_txrf3_pdpredist2g;               
+#define PSAT_AN_RXTX2_MXRGAIN_LSB                   3        // an_rxtx2_mxrgain;            
+#define PSAT_AN_RXTX2_MXRGAIN_MASK                  0x3      // an_rxtx2_mxrgain;            
+#define PSAT_AN_RXRF_BIAS1_PWD_IC25MXR2GH_LSB       5        // an_rxrf_bias1_pwd_ic25mxr2gh;
+#define PSAT_AN_RXRF_BIAS1_PWD_IC25MXR2GH_MASK      0x7      // an_rxrf_bias1_pwd_ic25mxr2gh;
+#define PSAT_AN_BIAS2_PWD_IC25RXRF_LSB              8        // an_bias2_pwd_ic25rxrf;      
+#define PSAT_AN_BIAS2_PWD_IC25RXRF_MASK             0x7      // an_bias2_pwd_ic25rxrf;      
+#define PSAT_AN_BB1_I2V_CURR2X_LSB                  11       // an_bb1_i2v_curr2x;         
+#define PSAT_AN_BB1_I2V_CURR2X_MASK                 0x1      // an_bb1_i2v_curr2x;         
+#define PSAT_AN_TXRF6_CAPDIV2G_LSB                  12       // an_txrf6_capdiv2g;         
+#define PSAT_AN_TXRF6_CAPDIV2G_MASK                 0xF      // an_txrf6_capdiv2g;         
+
+typedef PREPACK struct ar6kPSATCAL {
+    int16_t    psat_t10;
+    int16_t    ofdmCwDelta_t10;
+    int16_t    cmacOlpcPsatDeltaGu_t10;
+    int16_t    olpcGainDeltaGu_t10;
+    uint8_t    olpcPcdac;
+    uint8_t    psatPcdac;
+    uint16_t   psatTuneParms;
+    uint16_t   psatTuneParmsAlt1;
+} POSTPACK AR6003_PSAT_CAL_PARMS;             
+
+typedef PREPACK struct ar6kEeprom {
+    // base
+    AR6003_BASE_EEP_HEADER       baseEepHeader;                                                // 68 B
+    // modal
+    AR6003_MODAL_EEP_HEADER      modalHeader[2];                                               // 256 B
+
+    // CAL section
+    uint8_t                      calFreqPier5G[AR6003_NUM_5G_CAL_PIERS];                       // 8 B
+    uint8_t                      calFreqPier2G[AR6003_NUM_2G_CAL_PIERS];                       // 3 B
+    uint8_t                      padding1;                                                     // 1 B
+    AR6003_CAL_DATA_PER_FREQ_OLPC calPierData5G[AR6003_NUM_5G_CAL_PIERS];                      // 4 * 8 = 32 B
+    AR6003_CAL_DATA_PER_FREQ_OLPC calPierData2G[AR6003_NUM_2G_CAL_PIERS];                      // 4 * 3 = 12 B 
+    // ATE CAL data from OTP
+    AR6003_CAL_DATA_PER_CHIP     calPerChip;                                                   // 6 B
+    // future expansion of CAL data
+    AR6003_PSAT_CAL_PARMS        psatCAL;                                                      // 14B
+
+    // target power
+    AR6003_CAL_TARGET_POWER_LEG  calTargetPower5G[AR6003_NUM_5G_20_TARGET_POWERS];             // 5 * 8 = 40 B 
+    AR6003_CAL_TARGET_POWER_HT   calTargetPower5GHT20[AR6003_NUM_5G_20_TARGET_POWERS];         // 9 * 8 = 72 B 
+    AR6003_CAL_TARGET_POWER_HT   calTargetPower5GHT40[AR6003_NUM_5G_40_TARGET_POWERS];         // 9 * 8 = 72 B
+    AR6003_CAL_TARGET_POWER_LEG  calTargetPowerCck[AR6003_NUM_2G_CCK_TARGET_POWERS];           // 5 * 2 = 10 B 
+    AR6003_CAL_TARGET_POWER_LEG  calTargetPower2G[AR6003_NUM_2G_20_TARGET_POWERS];             // 5 * 3 = 15 B  
+    AR6003_CAL_TARGET_POWER_HT   calTargetPower2GHT20[AR6003_NUM_2G_20_TARGET_POWERS];         // 9 * 3 = 27 B
+    AR6003_CAL_TARGET_POWER_HT   calTargetPower2GHT40[AR6003_NUM_2G_40_TARGET_POWERS];         // 9 * 3 = 27 B    // 263B  
+    uint8_t                      psatTuneParmsAlt4_H;                                          // 1 B             // 264B
+    // CTL
+    uint8_t                      ctlIndex[AR6003_NUM_CTLS];                                    // 21 B
+    uint8_t                      psatTuneParmsAlt4_L;                                          // 1 B             
+    uint16_t                     psatTuneParmsAlt2;                                            // 2 B             
+    AR6003_CAL_CTL_DATA          ctlData[AR6003_NUM_CTLS];                                     // 16 * 21 = 336 B  // 360B 
+                                                                                               // total: 1024B
+    uint8_t                      calFreqPier5GExpanded[AR6003_NUM_5G_CAL_PIERS_EXPANDED];      // 32 B
+    uint8_t                      calFreqPier2GExpanded[AR6003_NUM_2G_CAL_PIERS_EXPANDED];      // 16 B
+    AR6003_CAL_DATA_PER_FREQ_OLPC_EXPANDED calPierData5GExpanded[AR6003_NUM_5G_CAL_PIERS_EXPANDED]; // 14 * 32 = 448 B
+    AR6003_CAL_DATA_PER_FREQ_OLPC_EXPANDED calPierData2GExpanded[AR6003_NUM_2G_CAL_PIERS_EXPANDED]; // 14 * 16 = 224 B 
+
+    AR6003_ATE_PROVIDED_DATA     ateProvidedData;                                              // 24B
+
+    int8_t                       calTgtPwrBkoff2GLeg[TGTPWR_LEG_LAST];                         // 4B
+    int8_t                       calTgtPwrBkoff2GHT20[TGTPWR_HT_LAST];                         // 8B
+    int8_t                       calTgtPwrBkoff2GHT40[TGTPWR_HT_LAST];                         // 8B
+
+    uint16_t                     psatTuneParmsAlt3;                                            // 2B
+    uint16_t                     checksumExpanded;                                             // 2B
+                                                                                               // total: 768B 
+    AR6003_CAL_DATA_PER_FREQ_OLPC_FE_DELTA calDataFEDelta5G[AR6003_NUM_5G_CAL_PIERS_EXPANDED];                  // 2 * 32 =  64 B	
+    AR6003_CAL_DATA_PER_FREQ_OLPC_FE_DELTA calDataFEDelta2G[AR6003_NUM_2G_CAL_PIERS_EXPANDED];                  // 2 * 16 = 32 B
+    uint16_t                    psatTuneParmsAlt7;                                               // 2B
+    uint16_t                    psatTuneParmsAlt8;                                               // 2B
+    uint16_t                    psatTuneParmsAlt9;                                               // 2B
+    int16_t                     cmacOlpcPsatDeltaGuMid_t10;                                      // 2B
+    int16_t                     cmacOlpcPsatDeltaGuHigh_t10;                                     // 2B
+    uint16_t                    psatTuneParmsAltSet[10];                                         // 20B
+    int8_t                      psatTuneParmsOlpcPsatCmacDelta[20];                              // 20B               
+    uint8_t                     padding5[42];                                                    // 42B 
+	  //uint32_t                   pllClkModa;                                                          
+    AR6003_STICKY_REG_TABLE stickyRegTable[STICKY_REG_TBL_SIZE_MAX];                             // 64B
+    //uint8_t                     stickyRegTableSize;                                            
+    uint16_t                    psatTuneParmsAlt5;                                               // 2B 
+    uint16_t                    psatTuneParmsAlt6;                                               // 2B 
+    //uint16_t                    checksum0CAL;                                                  
+                                                                                                 // total: 256B
+} POSTPACK AR6003_EEPROM;                                                                        // 1024 + 768 + 256 = 2048B
+
+#endif //_AR6003_EEPROM_STRUCT_H_
diff --git a/ath6kl-tcmd/testcmd.h b/ath6kl-tcmd/testcmd.h
new file mode 100644
index 0000000..f543e39
--- /dev/null
+++ b/ath6kl-tcmd/testcmd.h
@@ -0,0 +1,364 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef  TESTCMD_H_
+#define  TESTCMD_H_
+
+#include <stdint.h>
+
+#ifdef AR6002_REV2
+#define TCMD_MAX_RATES 12
+#else
+#define TCMD_MAX_RATES 28
+#endif
+
+#define PREPACK
+#define POSTPACK __attribute__ ((packed))
+
+#define ATH_MAC_LEN 6
+#define TC_CMDS_SIZE_MAX  256
+
+typedef enum {
+	ZEROES_PATTERN = 0,
+	ONES_PATTERN,
+	REPEATING_10,
+	PN7_PATTERN,
+	PN9_PATTERN,
+	PN15_PATTERN
+} TX_DATA_PATTERN;
+
+/* Continous tx
+   mode : TCMD_CONT_TX_OFF - Disabling continous tx
+          TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
+          TCMD_CONT_TX_FRAME- Enable continuous modulated tx
+   freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
+dataRate: 0 - 1 Mbps
+          1 - 2 Mbps
+          2 - 5.5 Mbps
+          3 - 11 Mbps
+          4 - 6 Mbps
+          5 - 9 Mbps
+          6 - 12 Mbps
+          7 - 18 Mbps
+          8 - 24 Mbps
+          9 - 36 Mbps
+         10 - 28 Mbps
+         11 - 54 Mbps
+  txPwr: Tx power in dBm[5 -11] for unmod Tx, [5-14] for mod Tx
+antenna:  1 - one antenna
+          2 - two antenna
+Note : Enable/disable continuous tx test cmd works only when target is awake.
+*/
+
+typedef enum {
+	TCMD_CONT_TX_OFF = 0,
+	TCMD_CONT_TX_SINE,
+	TCMD_CONT_TX_FRAME,
+	TCMD_CONT_TX_TX99,
+	TCMD_CONT_TX_TX100,
+	TCMD_CONT_TX_OFFSETTONE,
+} TCMD_CONT_TX_MODE;
+
+typedef enum {
+	TCMD_WLAN_MODE_NOHT = 0,
+	TCMD_WLAN_MODE_HT20 = 1,
+	TCMD_WLAN_MODE_HT40PLUS = 2,
+	TCMD_WLAN_MODE_HT40MINUS = 3,
+        TCMD_WLAN_MODE_CCK = 4,
+
+        TCMD_WLAN_MODE_MAX,
+        TCMD_WLAN_MODE_INVALID = TCMD_WLAN_MODE_MAX
+} TCMD_WLAN_MODE;
+
+typedef enum {
+    TPC_TX_PWR = 0,
+    TPC_FORCED_GAIN,
+    TPC_TGT_PWR
+} TPC_TYPE;
+
+typedef PREPACK struct {
+	uint32_t testCmdId;
+	uint32_t mode;
+	uint32_t freq;
+	uint32_t dataRate;
+	int32_t txPwr;
+	uint32_t antenna;
+	uint32_t enANI;
+	uint32_t scramblerOff;
+	uint32_t aifsn;
+	uint16_t pktSz;
+	uint16_t txPattern;
+	uint32_t shortGuard;
+	uint32_t numPackets;
+	uint32_t wlanMode;
+        uint32_t tpcm;
+} POSTPACK TCMD_CONT_TX;
+
+#define TCMD_TXPATTERN_ZERONE                 0x1
+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE    0x2
+
+/* Continuous Rx
+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
+      TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
+                                             address equal specified
+                                             mac address (set via act =3)
+      TCMD_CONT_RX_REPORT  off mode  (disable cont rx mode and get the
+                                          report from the last cont
+                                          Rx test)
+
+     TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
+                                                 target. This Overrides
+                                                 the default MAC address.)
+
+*/
+typedef enum {
+	TCMD_CONT_RX_PROMIS = 0,
+	TCMD_CONT_RX_FILTER,
+	TCMD_CONT_RX_REPORT,
+	TCMD_CONT_RX_SETMAC,
+	TCMD_CONT_RX_SET_ANT_SWITCH_TABLE,
+	TC_CMD_RESP,
+	TCMD_CONT_RX_GETMAC,
+} TCMD_CONT_RX_ACT;
+
+typedef PREPACK struct {
+	uint32_t testCmdId;
+	uint32_t act;
+	uint32_t enANI;
+	PREPACK union {
+		struct PREPACK TCMD_CONT_RX_PARA {
+			uint32_t freq;
+			uint32_t antenna;
+			uint32_t wlanMode;
+		} POSTPACK para;
+		struct PREPACK TCMD_CONT_RX_REPORT {
+			uint32_t totalPkt;
+			int32_t rssiInDBm;
+			uint32_t crcErrPkt;
+			uint32_t secErrPkt;
+			uint16_t rateCnt[TCMD_MAX_RATES];
+			uint16_t rateCntShortGuard[TCMD_MAX_RATES];
+		} POSTPACK report;
+		struct PREPACK TCMD_CONT_RX_MAC {
+			char addr[ATH_MAC_LEN];
+			char btaddr[ATH_MAC_LEN];
+                        uint16_t regDmn[2];
+                        uint32_t otpWriteFlag;
+		} POSTPACK mac;
+		struct PREPACK TCMD_CONT_RX_ANT_SWITCH_TABLE {
+			uint32_t antswitch1;
+			uint32_t antswitch2;
+		} POSTPACK antswitchtable;
+	} POSTPACK u;
+} POSTPACK TCMD_CONT_RX;
+
+/* Force sleep/wake  test cmd
+ mode: TCMD_PM_WAKEUP - Wakeup the target
+       TCMD_PM_SLEEP - Force the target to sleep.
+ */
+typedef enum {
+	TCMD_PM_WAKEUP = 1,	/* be consistent with target */
+	TCMD_PM_SLEEP,
+	TCMD_PM_DEEPSLEEP
+} TCMD_PM_MODE;
+
+typedef enum {
+    TC_CMDS_VERSION_RESERVED=0,
+    TC_CMDS_VERSION_MDK,
+    TC_CMDS_VERSION_TS,
+    TC_CMDS_VERSION_LAST,
+} TC_CMDS_VERSION;
+
+typedef enum {
+    TC_CMDS_TS =0,
+    TC_CMDS_CAL,
+    TC_CMDS_TPCCAL = TC_CMDS_CAL,
+    TC_CMDS_TPCCAL_WITH_OTPWRITE,
+    TC_CMDS_OTPDUMP,
+    TC_CMDS_OTPSTREAMWRITE,
+    TC_CMDS_EFUSEDUMP,
+    TC_CMDS_EFUSEWRITE,
+    TC_CMDS_READTHERMAL,
+    TC_CMDS_PM_CAL,
+    TC_CMDS_PSAT_CAL,
+    TC_CMDS_PSAT_CAL_RESULT,
+    TC_CMDS_CAL_PWRS,
+    TC_CMDS_WRITE_CAL_2_OTP,
+    TC_CMDS_CHAR_PSAT,
+    TC_CMDS_CHAR_PSAT_RESULT,
+    TC_CMDS_PM_CAL_RESULT,
+    TC_CMDS_SINIT_WAIT,
+    TC_CMDS_COUNT
+} TC_CMDS_ACT;
+
+typedef PREPACK struct {
+    uint32_t   testCmdId;
+    uint32_t   act;
+    PREPACK union {
+        uint32_t  enANI;    // to be identical to CONT_RX struct
+        struct PREPACK {
+            uint16_t   length;
+            uint8_t    version;
+            uint8_t    bufLen;
+        } POSTPACK parm;
+    } POSTPACK u;
+} POSTPACK TC_CMDS_HDR;
+
+typedef PREPACK struct {
+    TC_CMDS_HDR  hdr;
+    char buf[TC_CMDS_SIZE_MAX];
+} POSTPACK TC_CMDS;
+
+typedef PREPACK struct {
+    uint32_t    testCmdId;
+    uint32_t    regAddr;
+    uint32_t    val;
+    uint16_t    flag;
+} POSTPACK TCMD_SET_REG;
+
+typedef PREPACK struct {
+	uint32_t testCmdId;
+	uint32_t mode;
+} POSTPACK TCMD_PM;
+
+typedef enum {
+	TCMD_CONT_TX_ID,
+	TCMD_CONT_RX_ID,
+	TCMD_PM_ID,
+        TC_CMDS_ID,
+        TCMD_SET_REG_ID,
+
+	/*For synergy purpose we added the following tcmd id but these
+	tcmd's will not go to the firmware instead we will write values
+	to the NV area */
+
+	TCMD_NIC_MAC = 100,
+	TCMD_CAL_FILE_INDEX = 101,
+} TCMD_ID;
+
+typedef PREPACK struct
+{
+    uint32_t  testCmdId;
+    char   mac_address[ATH_MAC_LEN];
+} POSTPACK TCMD_NIC_MAC_S;
+
+typedef PREPACK struct
+{
+       uint32_t  testCmdId;
+       uint32_t  cal_file_index;
+} POSTPACK TCMD_CAL_FILE_INDEX_S;
+
+typedef PREPACK union {
+	TCMD_CONT_TX contTx;
+	TCMD_CONT_RX contRx;
+	TCMD_PM pm;
+          // New test cmds from ART/MDK ...
+        TC_CMDS              tcCmds;
+        TCMD_SET_REG setReg;
+} POSTPACK TEST_CMD;
+
+/* New structure for selfinit */
+typedef enum {
+    TC_MSG_RESERVED,
+    TC_MSG_PSAT_CAL_RESULTS,
+    TC_MSG_CAL_POWER,
+    TC_MSG_CHAR_PSAT_RESULTS,
+    TC_MSG_PM_CAL_RESULTS,
+    TC_MSG_PSAT_CAL_ACK,
+    TC_MSG_COUNT
+} TC_MSG_ID;
+
+typedef PREPACK struct {
+    int8_t  olpcGainDelta_diff;
+    int8_t  olpcGainDelta_abs;
+    uint8_t thermCalVal;
+    uint8_t numTryBF;
+    uint32_t  cmac_olpc;
+    uint32_t  cmac_psat;
+    uint16_t  cmac_olpc_pcdac;
+    uint16_t  cmac_psat_pcdac;
+    int16_t   lineSlope;
+    int16_t   lineVariance;
+    uint16_t  psatParm;
+    uint8_t reserved[2];
+} POSTPACK OLPCGAIN_THERM_DUPLET;
+
+#define WHAL_NUM_11G_CAL_PIERS_EXT 16
+#define WHAL_NUM_11A_CAL_PIERS_EXT 32
+#define PSAT_WHAL_NUM_11G_CAL_PIERS_MAX 3
+#define PSAT_WHAL_NUM_11A_CAL_PIERS_MAX 5
+#define NUM_PSAT_CHAR_PARMS  7
+#define _MAX_TX_GAIN_ENTRIES 32
+
+typedef PREPACK struct {
+    OLPCGAIN_THERM_DUPLET olpcGainTherm2G[PSAT_WHAL_NUM_11G_CAL_PIERS_MAX];
+    OLPCGAIN_THERM_DUPLET olpcGainTherm5G[PSAT_WHAL_NUM_11A_CAL_PIERS_MAX];
+} POSTPACK PSAT_CAL_RESULTS;
+
+typedef PREPACK struct {
+    uint32_t  cmac_i[_MAX_TX_GAIN_ENTRIES];
+    uint8_t pcdac[_MAX_TX_GAIN_ENTRIES];
+
+    uint8_t freq;
+    uint8_t an_txrf3_rdiv2g;
+    uint8_t an_txrf3_pdpredist2g;
+    uint8_t an_rxtx2_mxrgain;
+    uint8_t an_rxrf_bias1_pwd_ic25mxr2gh;
+    uint8_t an_bias2_pwd_ic25rxrf;
+    uint8_t an_bb1_i2v_curr2x;
+    uint8_t an_txrf3_capdiv2g;
+
+} POSTPACK CHAR_PSAT_RESULTS;
+
+typedef PREPACK struct {
+    int16_t txPwr2G_t10[WHAL_NUM_11G_CAL_PIERS_EXT];
+    int16_t txPwr5G_t10[WHAL_NUM_11A_CAL_PIERS_EXT];
+} POSTPACK CAL_TXPWR;
+
+typedef PREPACK struct {
+    uint8_t thermCalVal;
+    uint8_t future[3];
+} POSTPACK PM_CAL_RESULTS;
+
+typedef PREPACK struct {
+    TC_MSG_ID msgId;
+    PREPACK union {
+        PSAT_CAL_RESULTS  psatCalResults;
+        CAL_TXPWR txPwrs;
+        CHAR_PSAT_RESULTS psatCharResults;
+        PM_CAL_RESULTS  pmCalResults;
+    } POSTPACK msg;
+
+} POSTPACK TC_MSG;
+
+typedef struct _psat_sweep_table {
+    uint8_t  an_txrf3_rdiv2g;
+    uint8_t  an_txrf3_pdpredist2g;
+    uint8_t  an_rxtx2_mxrgain;
+    uint8_t  an_rxrf_bias1_pwd_ic25mxr2gh;
+    uint8_t  an_bias2_pwd_ic25rxrf;
+    uint8_t  an_bb1_i2v_curr2x;
+    uint8_t  an_txrf3_capdiv2g;
+    int8_t   olpcPsatCmacDelta;
+    uint16_t psatParm;
+    uint16_t padding2;
+} PSAT_SWEEP_TABLE;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TESTCMD_H_ */
diff --git a/ath6kl-wmiconfig/Android.mk b/ath6kl-wmiconfig/Android.mk
new file mode 100755
index 0000000..9f62851
--- /dev/null
+++ b/ath6kl-wmiconfig/Android.mk
@@ -0,0 +1,28 @@
+#------------------------------------------------
+# Copyright (c) 2012 Qualcomm Atheros, Inc..
+# All Rights Reserved.
+# Qualcomm Atheros Confidential and Proprietary.
+#------------------------------------------------
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := wmiconfig
+LOCAL_C_INCLUDES := \
+	$(TARGET_OUT_HEADERS)/libtcmd \
+	$(LOCAL_PATH)/include \
+	$(LOCAL_PATH)/../../bionic/libc/kernel/common \
+	#$(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr/include \
+
+
+LOCAL_CFLAGS+=-DUSER_KEYS
+LOCAL_SRC_FILES:= wmiconfig.c
+
+LOCAL_MODULE_TAGS := debug eng optional
+LOCAL_SHARED_LIBRARIES += libcutils
+LOCAL_SHARED_LIBRARIES += libnl_2
+LOCAL_STATIC_LIBRARIES += libtcmd
+include $(BUILD_EXECUTABLE)
+
+
diff --git a/ath6kl-wmiconfig/Makefile b/ath6kl-wmiconfig/Makefile
new file mode 100755
index 0000000..10d4832
--- /dev/null
+++ b/ath6kl-wmiconfig/Makefile
@@ -0,0 +1,31 @@
+#------------------------------------------------
+# Copyright (c) 2012 Qualcomm Atheros, Inc..
+# All Rights Reserved.
+# Qualcomm Atheros Confidential and Proprietary.
+#------------------------------------------------
+-include .config
+
+LDFLAGS +=  $(shell pkg-config --cflags --libs glib-2.0)
+
+CC :=$(ATH_CROSS_COMPILE_TYPE)gcc
+APP=wmiconfig
+
+NLLIBNAME = libnl-1
+LIBTCMD_DIR := ../libtcmd
+
+PREFIX ?= /usr
+SBINDIR ?= $(PREFIX)/sbin
+INSTALL ?= install
+
+
+override LDFLAGS += -ltcmd $(shell pkg-config --libs $(NLLIBNAME)) -lrt
+override CFLAGS += $(shell pkg-config --cflags $(NLLIBNAME)) -I$(LIBTCMD_DIR) -L$(LIBTCMD_DIR)
+all:
+	$(CC) -Wall -DUSER_KEYS -g -I$(KERNEL_SRC)/include -Iinclude wmiconfig.c -o $(APP) $(CFLAGS) $(LDFLAGS)
+
+install: wmiconfig
+	install -m 755 wmiconfig $(DESTDIR)$(SBINDIR)
+	
+
+clean:
+	$(RM) $(APP)
diff --git a/ath6kl-wmiconfig/include/a_config.h b/ath6kl-wmiconfig/include/a_config.h
new file mode 100755
index 0000000..93d3d08
--- /dev/null
+++ b/ath6kl-wmiconfig/include/a_config.h
@@ -0,0 +1,44 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+//==============================================================================
+// This file contains software configuration options that enables
+// specific software "features"
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_CONFIG_H_
+#define _A_CONFIG_H_
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/config.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/config.h"
+#endif
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+//#include "/config_linux.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/config_rexos.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/config.h"
+#pragma warning( disable:4242)
+#pragma warning( disable:4100)
+#pragma warning( disable:4189)
+#pragma warning( disable:4244)
+#pragma warning( disable:4701)
+#pragma warning( disable:4389)
+#pragma warning( disable:4057)
+#pragma warning( disable:28193)
+#endif
+
+#endif
+
diff --git a/ath6kl-wmiconfig/include/a_osapi.h b/ath6kl-wmiconfig/include/a_osapi.h
new file mode 100755
index 0000000..6396255
--- /dev/null
+++ b/ath6kl-wmiconfig/include/a_osapi.h
@@ -0,0 +1,45 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_OSAPI_H_
+#define _A_OSAPI_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "osapi_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/osapi.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/osapi.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/osapi_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/osapi_win.h"
+#include "../os/win_art/include/netbuf.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/win/osapi_win.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#endif /* _OSAPI_H_ */
+
diff --git a/ath6kl-wmiconfig/include/a_types.h b/ath6kl-wmiconfig/include/a_types.h
new file mode 100755
index 0000000..d489337
--- /dev/null
+++ b/ath6kl-wmiconfig/include/a_types.h
@@ -0,0 +1,41 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_TYPES_H_
+#define _A_TYPES_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "athtypes_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/athtypes.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/athtypes.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/athtypes_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/athtypes_win.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include <athtypes_win.h>
+#endif
+
+#endif /* _ATHTYPES_H_ */
+
diff --git a/ath6kl-wmiconfig/include/athdefs.h b/ath6kl-wmiconfig/include/athdefs.h
new file mode 100755
index 0000000..8ba5945
--- /dev/null
+++ b/ath6kl-wmiconfig/include/athdefs.h
@@ -0,0 +1,68 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+#ifndef __ATHDEFS_H__
+#define __ATHDEFS_H__
+
+/*
+ * This file contains definitions that may be used across both
+ * Host and Target software.  Nothing here is module-dependent
+ * or platform-dependent.
+ */
+
+/*
+ * Generic error codes that can be used by hw, sta, ap, sim, dk
+ * and any other environments. Since these are enums, feel free to
+ * add any more codes that you need.
+ */
+
+typedef enum {
+    A_ERROR = -1,               /* Generic error return */
+    A_OK = 0,                   /* success */
+                                /* Following values start at 1 */
+    A_DEVICE_NOT_FOUND,         /* not able to find PCI device */
+    A_NO_MEMORY,                /* not able to allocate memory, not available */
+    A_MEMORY_NOT_AVAIL,         /* memory region is not free for mapping */
+    A_NO_FREE_DESC,             /* no free descriptors available */
+    A_BAD_ADDRESS,              /* address does not match descriptor */
+    A_WIN_DRIVER_ERROR,         /* used in NT_HW version, if problem at init */
+    A_REGS_NOT_MAPPED,          /* registers not correctly mapped */
+    A_EPERM,                    /* Not superuser */
+    A_EACCES,                   /* Access denied */
+    A_ENOENT,                   /* No such entry, search failed, etc. */
+    A_EEXIST,                   /* The object already exists (can't create) */
+    A_EFAULT,                   /* Bad address fault */
+    A_EBUSY,                    /* Object is busy */
+    A_EINVAL,                   /* Invalid parameter */
+    A_EMSGSIZE,                 /* Inappropriate message buffer length */
+    A_ECANCELED,                /* Operation canceled */
+    A_ENOTSUP,                  /* Operation not supported */
+    A_ECOMM,                    /* Communication error on send */
+    A_EPROTO,                   /* Protocol error */
+    A_ENODEV,                   /* No such device */
+    A_EDEVNOTUP,                /* device is not UP */
+    A_NO_RESOURCE,              /* No resources for requested operation */
+    A_HARDWARE,                 /* Hardware failure */
+    A_PENDING,                  /* Asynchronous routine; will send up results la
+ter (typically in callback) */
+    A_EBADCHANNEL,              /* The channel cannot be used */
+    A_DECRYPT_ERROR,            /* Decryption error */
+    A_PHY_ERROR,                /* RX PHY error */
+    A_CONSUMED                  /* Object was consumed */
+} A_STATUS;
+
+#define A_SUCCESS(x)        (x == A_OK)
+#define A_FAILED(x)         (!A_SUCCESS(x))
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#endif /* __ATHDEFS_H__ */
+
diff --git a/ath6kl-wmiconfig/include/athdrv_linux.h b/ath6kl-wmiconfig/include/athdrv_linux.h
new file mode 100755
index 0000000..71a7578
--- /dev/null
+++ b/ath6kl-wmiconfig/include/athdrv_linux.h
@@ -0,0 +1,1461 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef _ATHDRV_LINUX_H
+#define _ATHDRV_LINUX_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/*
+ * There are two types of ioctl's here: Standard ioctls and
+ * eXtended ioctls.  All extended ioctls (XIOCTL) are multiplexed
+ * off of the single ioctl command, AR6000_IOCTL_EXTENDED.  The
+ * arguments for every XIOCTL starts with a 32-bit command word
+ * that is used to select which extended ioctl is in use.  After
+ * the command word are command-specific arguments.
+ */
+
+/* Linux standard Wireless Extensions, private ioctl interfaces */
+#define IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)
+#define IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+1)
+#define IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+2)
+#define IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+3)
+#define IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+4)
+#define IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+5)
+//#define IEEE80211_IOCTL_GETPARAM             (SIOCIWFIRSTPRIV+6)
+//#define IEEE80211_IOCTL_SETWMMPARAMS         (SIOCIWFIRSTPRIV+7)
+//#define IEEE80211_IOCTL_GETWMMPARAMS         (SIOCIWFIRSTPRIV+8)
+//#define IEEE80211_IOCTL_GETOPTIE             (SIOCIWFIRSTPRIV+9)
+//#define IEEE80211_IOCTL_SETAUTHALG           (SIOCIWFIRSTPRIV+10)
+#define IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+10)
+
+
+
+/*                      ====WMI Ioctls====                                    */
+/*
+ *
+ * Many ioctls simply provide WMI services to application code:
+ * an application makes such an ioctl call with a set of arguments
+ * that are packaged into the corresponding WMI message, and sent
+ * to the Target.
+ */
+
+#define AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+11)
+/*
+ * arguments:
+ *   ar6000_version *revision
+ */
+
+#define AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+12)
+/*
+ * arguments:
+ *   WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
+ * uses: WMI_SET_POWER_MODE_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+13)
+/*
+ * arguments:
+ *   WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
+ * uses: WMI_SET_SCAN_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+14)
+/*
+ * arguments:
+ *   UINT32 listenInterval
+ * uses: WMI_SET_LISTEN_INT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+15)
+/*
+ * arguments:
+ *   WMI_BSS_FILTER filter (see include/wmi.h)
+ * uses: WMI_SET_BSS_FILTER_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)
+/*
+ * arguments:
+ *   WMI_CHANNEL_PARAMS_CMD chParams
+ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)
+/*
+ * arguments:
+ *   WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
+ * uses: WMI_SETPROBED_SSID_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)
+/*
+ * arguments:
+ *   WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
+ * uses: WMI_SET_POWER_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)
+/*
+ * arguments:
+ *   WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
+ * uses: WMI_ADD_BAD_AP_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)
+/*
+ * arguments:
+ *   ar6000_queuereq queueRequest (see below)
+ */
+
+#define AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)
+/*
+ * arguments:
+ *   WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
+ * uses: WMI_CREATE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)
+/*
+ * arguments:
+ *   WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
+ * uses: WMI_DELETE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD   (SIOCIWFIRSTPRIV+23)
+/*
+ * arguments:
+ *   WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
+/*
+ * arguments:
+ *   WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
+ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)
+/*
+ * arguments:
+ *   TARGET_STATS *targetStats (see below)
+ * uses: WMI_GET_STATISTICS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)
+/*
+ * arguments:
+ *   WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
+ * uses: WMI_SET_ASSOC_INFO_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)
+/*
+ * arguments:
+ *   WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
+ * uses: WMI_SET_ACCESS_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)
+/*
+ * arguments:
+ *   UINT32 beaconMissTime
+ * uses: WMI_SET_BMISS_TIME_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)
+/*
+ * arguments:
+ *   WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
+ * uses: WMI_SET_DISC_TIMEOUT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)
+/*
+ * arguments:
+ *   WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
+ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
+ */
+
+/*
+ * There is a very small space available for driver-private
+ * wireless ioctls.  In order to circumvent this limitation,
+ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
+ * single AR6000_IOCTL_EXTENDED ioctl.
+ */
+#define AR6000_IOCTL_EXTENDED                (SIOCIWFIRSTPRIV+31)
+
+typedef enum {
+    AR6000_XIOCTL_BMI_DONE = 1,
+    AR6000_XIOCTL_BMI_READ_MEMORY,
+    AR6000_XIOCTL_BMI_WRITE_MEMORY,
+    AR6000_XIOCTL_BMI_EXECUTE,
+    AR6000_XIOCTL_BMI_SET_APP_START,
+    AR6000_XIOCTL_BMI_READ_SOC_REGISTER,
+    AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER,
+    AR6000_XIOCTL_BMI_TEST,
+    AR6000_XIOCTL_UNUSED9,
+    AR6000_XIOCTL_UNUSED10, /* 10 */
+    AR6000_XIOCTL_UNUSED11,
+    AR6000_XIOCTL_FORCE_TARGET_RESET,
+    AR6000_XIOCTL_HTC_RAW_OPEN,
+    AR6000_XIOCTL_HTC_RAW_CLOSE,
+    AR6000_XIOCTL_HTC_RAW_READ,
+    AR6000_XIOCTL_HTC_RAW_WRITE,
+    AR6000_XIOCTL_CHECK_TARGET_READY,
+    AR6000_XIOCTL_GPIO_OUTPUT_SET,
+    AR6000_XIOCTL_GPIO_INPUT_GET,
+    AR6000_XIOCTL_GPIO_REGISTER_SET,  /* 20 */
+    AR6000_XIOCTL_GPIO_REGISTER_GET,
+    AR6000_XIOCTL_GPIO_INTR_ACK,
+    AR6000_XIOCTL_GPIO_INTR_WAIT,
+    AR6000_XIOCTL_SET_ADHOC_BSSID,
+    AR6000_XIOCTL_UNUSED25,
+    AR6000_XIOCTL_UNUSED26,
+    AR6000_XIOCTL_SET_BEACON_INTVAL,
+    IEEE80211_IOCTL_SETAUTHALG,
+    AR6000_XIOCTL_SET_VOICE_PKT_SIZE,
+    AR6000_XIOCTL_SET_MAX_SP,   /* 30 */
+    AR6000_XIOCTL_WMI_GET_ROAM_TBL,
+    AR6000_XIOCTL_WMI_SET_ROAM_CTRL,
+    AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS,
+    AR6000_XIOCTRL_WMI_GET_POWER_MODE,
+    AR6000_XIOCTRL_WMI_SET_WLAN_STATE,
+    AR6000_XIOCTL_WMI_GET_ROAM_DATA,
+    AR6000_XIOCTL_WMI_SETRETRYLIMITS,
+    AR6000_XIOCTL_TCMD_CONT_TX,
+    AR6000_XIOCTL_TCMD_CONT_RX,
+    AR6000_XIOCTL_TCMD_PM,  /* 40 */
+    AR6000_XIOCTL_WMI_STARTSCAN,
+    AR6000_XIOCTL_WMI_SETFIXRATES,
+    AR6000_XIOCTL_WMI_GETFIXRATES,
+    AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD,
+    AR6000_XIOCTL_WMI_CLR_RSSISNR,                   
+    AR6000_XIOCTL_WMI_SET_LQTHRESHOLD,               
+    AR6000_XIOCTL_WMI_SET_RTS,
+    AR6000_XIOCTL_WMI_SET_LPREAMBLE,
+    AR6000_XIOCTL_WMI_SET_AUTHMODE,
+    AR6000_XIOCTL_WMI_SET_REASSOCMODE, /* 50 */
+    AR6000_XIOCTL_WMI_SET_WMM,
+    AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS,
+    AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP,
+    AR6000_XIOCTL_WMI_GET_RD,
+    AR6000_XIOCTL_DIAG_READ,
+    AR6000_XIOCTL_DIAG_WRITE,
+    AR6000_XIOCTL_WMI_SET_TXOP,
+    AR6000_XIOCTL_USER_SETKEYS,
+    AR6000_XIOCTL_WMI_SET_KEEPALIVE,
+    AR6000_XIOCTL_WMI_GET_KEEPALIVE, /* 60 */
+    AR6000_XIOCTL_BMI_ROMPATCH_INSTALL,
+    AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL,
+    AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE,
+    AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE,
+    AR6000_XIOCTL_WMI_SET_APPIE,
+    AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER,
+    AR6000_XIOCTL_DBGLOG_CFG_MODULE,
+    AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS,
+    AR6000_XIOCTL_WMI_SET_WSC_STATUS = 70,  /* 70 */
+    AR6000_XIOCTL_WMI_SET_BT_STATUS,
+    AR6000_XIOCTL_WMI_SET_BT_PARAMS,
+    AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE,
+    AR6000_XIOCTL_WMI_SET_WOW_MODE,
+    AR6000_XIOCTL_WMI_GET_WOW_LIST,
+    AR6000_XIOCTL_WMI_ADD_WOW_PATTERN,
+    AR6000_XIOCTL_WMI_DEL_WOW_PATTERN,
+    AR6000_XIOCTL_TARGET_INFO,
+    AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE,
+    AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE,  /* 80 */
+    AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS,
+    AR6000_XIOCTL_WMI_SET_AKMP_PARAMS,
+    AR6000_XIOCTL_WMI_GET_PMKID_LIST,
+    AR6000_XIOCTL_WMI_SET_PMKID_LIST,
+    AR6000_XIOCTL_WMI_SET_PARAMS,
+    AR6000_XIOCTL_WMI_SET_MCAST_FILTER,
+    AR6000_XIOCTL_WMI_DEL_MCAST_FILTER,
+    AR6000_XIOCTL_UNUSED90 = 90,  /* 90 */
+    AR6000_XIOCTL_BMI_LZ_STREAM_START,
+    AR6000_XIOCTL_BMI_LZ_DATA,
+    AR6000_XIOCTL_PROF_CFG,
+    AR6000_XIOCTL_PROF_ADDR_SET,
+    AR6000_XIOCTL_PROF_START,
+    AR6000_XIOCTL_PROF_STOP,
+    AR6000_XIOCTL_PROF_COUNT_GET,
+    AR6000_XIOCTL_WMI_ABORT_SCAN,
+    AR6000_XIOCTL_AP_GET_STA_LIST,
+    AR6000_XIOCTL_AP_HIDDEN_SSID, /* 100 */
+    AR6000_XIOCTL_AP_SET_NUM_STA,
+    AR6000_XIOCTL_AP_SET_ACL_MAC,
+    AR6000_XIOCTL_AP_GET_ACL_LIST,
+    AR6000_XIOCTL_AP_COMMIT_CONFIG,
+    IEEE80211_IOCTL_GETWPAIE,
+    AR6000_XIOCTL_AP_CONN_INACT_TIME,
+    AR6000_XIOCTL_AP_PROT_SCAN_TIME,
+    AR6000_XIOCTL_AP_SET_COUNTRY,
+    AR6000_XIOCTL_AP_SET_DTIM,
+    AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT, /* 110 */
+    AR6000_XIOCTL_SET_IP,
+    AR6000_XIOCTL_AP_SET_ACL_POLICY,
+    AR6000_XIOCTL_AP_CTRL_BSS_COMM,
+    AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO,
+    AR6000_XIOCTL_MODULE_DEBUG_SET_MASK,
+    AR6000_XIOCTL_MODULE_DEBUG_GET_MASK,
+    AR6000_XIOCTL_DUMP_RCV_AGGR_STATS,
+    AR6000_XIOCTL_SET_HT_CAP,
+    AR6000_XIOCTL_SET_HT_OP,
+    AR6000_XIOCTL_AP_GET_STAT, /* 120 */
+    AR6000_XIOCTL_SET_TX_SELECT_RATES,
+    AR6000_XIOCTL_SETUP_AGGR,
+    AR6000_XIOCTL_ALLOW_AGGR,
+    AR6000_XIOCTL_AP_GET_HIDDEN_SSID,
+    AR6000_XIOCTL_AP_GET_COUNTRY,
+    AR6000_XIOCTL_AP_GET_WMODE,
+    AR6000_XIOCTL_AP_GET_DTIM,
+    AR6000_XIOCTL_AP_GET_BINTVL,
+    AR6000_XIOCTL_AP_GET_RTS,
+    AR6000_XIOCTL_DELE_AGGR, /* 130 */
+    AR6000_XIOCTL_FETCH_TARGET_REGS,
+    AR6000_XIOCTL_HCI_CMD,
+    AR6000_XIOCTL_ACL_DATA,
+    AR6000_XIOCTL_WLAN_CONN_PRECEDENCE,
+    AR6000_XIOCTL_AP_SET_11BG_RATESET,
+    AR6000_XIOCTL_WMI_SET_AP_PS,
+    AR6000_XIOCTL_WMI_MCAST_FILTER,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG, /* 140 */
+    AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG,
+    AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS,
+    AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG,
+    AR6000_XIOCTL_WMI_GET_BTCOEX_STATS,
+    AR6000_XIOCTL_WMI_SET_QOS_SUPP,
+    AR6000_XIOCTL_AP_SET_DFS,
+    AR6000_XIOCTL_WMI_P2P_DISCOVER, /* 150 */
+    AR6000_XIOCTL_WMI_P2P_STOP_FIND,
+    AR6000_XIOCTL_WMI_P2P_CANCEL,
+    AR6000_XIOCTL_WMI_P2P_LISTEN,
+    AR6000_XIOCTL_WMI_P2P_GO_NEG,
+    AR6000_XIOCTL_WMI_P2P_AUTH_GO_NEG,
+    AR6000_XIOCTL_WMI_P2P_REJECT,
+    AR6000_XIOCTL_WMI_P2P_CONFIG,
+    AR6000_XIOCTL_WMI_WPS_CONFIG,
+    AR6000_XIOCTL_WMI_P2P_FINDNODE,
+    AR6000_XIOCTL_WMI_P2P_GRP_INIT, /* 160 */
+    AR6000_XIOCTL_WMI_P2P_GRP_FORMATION_DONE,
+    AR6000_XIOCTL_WMI_P2P_INVITE,
+    AR6000_XIOCTL_WMI_P2P_PROV_DISC,
+    AR6000_XIOCTL_WMI_P2P_SET,
+    AR6000_XIOCTL_WMI_P2P_PEER,
+    AR6000_XIOCTL_WMI_P2P_FLUSH,
+    AR6000_XIOCTL_WMI_GET_GO_PARAMS,
+    AR6000_XIOCTL_P2P_AUTH_INVITE,
+    AR6000_XIOCTL_WMI_P2P_GET_IF_ADDR,
+    AR6000_XIOCTL_WMI_P2P_GET_DEV_ADDR, /* 170 */
+    AR6000_XIOCTL_WMI_P2P_SDPD_TX_CMD,
+    AR6000_XIOTCL_WMI_P2P_SD_CANCEL_REQUEST,
+    AR6000_XIOCTL_SET_BT_HW_POWER_STATE,
+    AR6000_XIOCTL_GET_BT_HW_POWER_STATE,
+    AR6000_XIOCTL_GET_WLAN_SLEEP_STATE,
+    AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM,
+    AR6000_XIOCTL_WMI_ENABLE_WAC_PARAM,
+    AR6000_XIOCTL_WAC_SCAN_REPLY,
+    AR6000_XIOCTL_WMI_WAC_CTRL_REQ,
+    AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE, /* 180 */
+    AR6000_XIOCTL_WMI_SET_PASSPHRASE,
+    AR6000_XIOCTL_BMI_NVRAM_PROCESS,
+    AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM,
+    AR6000_XIOCTL_WMI_FORCE_ASSERT,
+    AR6000_XIOCTL_WMI_ENABLE_PKTLOG,
+    AR6000_XIOCTL_WMI_DISABLE_PKTLOG,
+    AR6000_XIOCTL_WMI_GET_PKTLOG,
+    AR6000_XIOCTL_AP_ACS_DISABLE_HI_CHANNELS,
+    AR6000_XIOCTL_TCMD_CMDS,
+    AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES, /* 190 */
+    AR6000_XIOCTL_AP_GET_NUM_STA,
+    AR6000_XIOCTL_SUSPEND_DRIVER,
+    AR6000_XIOCTL_RESUME_DRIVER,
+    AR6000_XIOCTL_GET_SUBMODE,
+    AR6000_XIOCTL_WMI_AP_SET_APSD,
+    AR6000_XIOCTL_TCMD_SETREG, 
+    AR6000_XIOCTL_GET_HT_CAP,
+    AR6000_XIOCTL_WMI_GET_P2P_IE, /* 198 */
+    AR6000_XIOCTL_WMI_P2P_GET_OWN_INFO,
+} XTND_IOCLTS; 
+
+
+
+///*                         ====BMI Extended Ioctls====                        */
+//
+//#define AR6000_XIOCTL_BMI_DONE                                  1
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
+// * uses: BMI_DONE
+// */
+//
+//#define AR6000_XIOCTL_BMI_READ_MEMORY                           2
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
+// *       UINT32 address
+// *       UINT32 length
+// *     }
+// *     char results[length]
+// *   }
+// * uses: BMI_READ_MEMORY
+// */
+//
+//#define AR6000_XIOCTL_BMI_WRITE_MEMORY                          3
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
+// *   UINT32 address
+// *   UINT32 length
+// *   char data[length]
+// * uses: BMI_WRITE_MEMORY
+// */
+//
+//#define AR6000_XIOCTL_BMI_EXECUTE                               4
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
+// *   UINT32 TargetAddress
+// *   UINT32 parameter
+// * uses: BMI_EXECUTE
+// */
+//
+//#define AR6000_XIOCTL_BMI_SET_APP_START                         5
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
+// *   UINT32 TargetAddress
+// * uses: BMI_SET_APP_START
+// */
+//
+//#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER                     6
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
+// *       UINT32 TargetAddress, 32-bit aligned
+// *     }
+// *     UINT32 result
+// *   }
+// * uses: BMI_READ_SOC_REGISTER
+// */
+//
+//#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER                    7
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
+// *       UINT32 TargetAddress, 32-bit aligned
+// *       UINT32 newValue
+// *     }
+// * uses: BMI_WRITE_SOC_REGISTER
+// */
+//
+//#define AR6000_XIOCTL_BMI_TEST                                  8
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
+// *   UINT32 address
+// *   UINT32 length
+// *   UINT32 count
+// */
+//
+//
+//
+///* Historical Host-side DataSet support */
+//#define AR6000_XIOCTL_UNUSED9                                   9
+//#define AR6000_XIOCTL_UNUSED10                                  10
+//#define AR6000_XIOCTL_UNUSED11                                  11
+//
+///*                      ====Misc Extended Ioctls====                          */
+//
+//#define AR6000_XIOCTL_FORCE_TARGET_RESET                        12
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
+// */
+//
+//
+//#ifdef HTC_RAW_INTERFACE
+///* HTC Raw Interface Ioctls */
+//#define AR6000_XIOCTL_HTC_RAW_OPEN                              13
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_CLOSE                             14
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_READ                              15
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
+// *       UINT32 mailboxID
+// *       UINT32 length
+// *     }
+// *     results[length]
+// *   }
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_WRITE                             16
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
+// *   UINT32 mailboxID
+// *   UINT32 length
+// *   char buffer[length]
+// */
+//#endif /* HTC_RAW_INTERFACE */
+//
+//#define AR6000_XIOCTL_CHECK_TARGET_READY                        17
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
+// */
+//
+//
+//
+///*                ====GPIO (General Purpose I/O) Extended Ioctls====          */
+//
+//#define AR6000_XIOCTL_GPIO_OUTPUT_SET                           18
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
+// *   ar6000_gpio_output_set_cmd_s (see below)
+// * uses: WMIX_GPIO_OUTPUT_SET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INPUT_GET                            19
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
+// * uses: WMIX_GPIO_INPUT_GET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_REGISTER_SET                         20
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
+// *   ar6000_gpio_register_cmd_s (see below)
+// * uses: WMIX_GPIO_REGISTER_SET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_REGISTER_GET                         21
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
+// *   ar6000_gpio_register_cmd_s (see below)
+// * uses: WMIX_GPIO_REGISTER_GET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INTR_ACK                             22
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
+// *   ar6000_cpio_intr_ack_cmd_s (see below)
+// * uses: WMIX_GPIO_INTR_ACK_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INTR_WAIT                            23
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
+// */
+//
+//
+//
+///*                    ====more wireless commands====                          */
+//
+//#define AR6000_XIOCTL_SET_ADHOC_BSSID                           24
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
+// *   WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
+// */
+//
+//#define AR6000_XIOCTL_SET_OPT_MODE                              25
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
+// *   WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
+// * uses: WMI_SET_OPT_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_OPT_SEND_FRAME                            26
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
+// *   WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
+// * uses: WMI_OPT_TX_FRAME_CMDID
+// */
+//
+//#define AR6000_XIOCTL_SET_BEACON_INTVAL                         27
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_BEACON_INTVAL)
+// *   WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
+// * uses: WMI_SET_BEACON_INT_CMDID
+// */
+//
+//
+//#define IEEE80211_IOCTL_SETAUTHALG                              28
+//
+//
+//#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE                        29
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
+// *   WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
+// * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
+// */
+//
+//
+//#define AR6000_XIOCTL_SET_MAX_SP                                30
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
+// *   WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
+// * uses: WMI_SET_MAX_SP_LEN_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_ROAM_TBL                          31
+//
+//#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL                         32
+//
+//#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS                 33
+//
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
+// *   WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
+// *   WMI_SET_POWERSAVE_TIMERS_CMDID
+// */
+//
+//#define AR6000_XIOCTRL_WMI_GET_POWER_MODE                        34
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
+// */
+//
+//#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE                       35
+
+typedef enum {
+    WLAN_DISABLED,
+    WLAN_ENABLED
+} AR6000_WLAN_STATE;
+
+///*
+// * arguments:
+// * enable/disable
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_ROAM_DATA                         36
+//
+//#define AR6000_XIOCTL_WMI_SETRETRYLIMITS                37
+///*
+// * arguments:
+// *   WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
+// * uses: WMI_SET_RETRY_LIMITS_CMDID
+// */
+//
+//#ifdef CONFIG_HOST_TCMD_SUPPORT
+///*       ====extended commands for radio test ====                          */
+//
+//#define AR6000_XIOCTL_TCMD_CONT_TX                      38
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
+// *   WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CONT_TX_CMDID
+// */
+//
+//#define AR6000_XIOCTL_TCMD_CONT_RX                      39
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
+// *   WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CONT_RX_CMDID
+// */
+//
+//#define AR6000_XIOCTL_TCMD_PM                           40
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
+// *   WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
+// * uses: WMI_TCMD_PM_CMDID
+// */
+//
+//#endif /* CONFIG_HOST_TCMD_SUPPORT */
+//
+//#define AR6000_XIOCTL_WMI_STARTSCAN                     41
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
+// *   UINT8  scanType
+// *   UINT8  scanConnected
+// *   A_BOOL forceFgScan
+// * uses: WMI_START_SCAN_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SETFIXRATES                   42
+//
+//#define AR6000_XIOCTL_WMI_GETFIXRATES                   43
+//
+//
+//#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44
+///*
+// * arguments:
+// *   WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_CLR_RSSISNR                   45
+///*
+// * arguments:
+// *   WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_CLR_RSSISNR_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46
+///*
+// * arguments:
+// *   WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_RTS                        47
+///*
+// * arguments:
+// *   WMI_SET_RTS_MODE_CMD (see include/wmi.h)
+// * uses: WMI_SET_RTS_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48
+//
+//#define AR6000_XIOCTL_WMI_SET_AUTHMODE                  49
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
+// *   UINT8  mode
+// * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_REASSOCMODE               50
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
+// *   UINT8  mode
+// * uses: WMI_SET_WMM_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_WMM                       51
+//
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
+// * UINT32 frequency
+// * UINT8  threshold
+// */
+//#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52
+//
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
+// * UINT32 cookie
+// */
+//#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
+// *   UINT32 regDomain
+// */
+//#define AR6000_XIOCTL_WMI_GET_RD                        54
+//
+//#define AR6000_XIOCTL_DIAG_READ                         55
+//
+//#define AR6000_XIOCTL_DIAG_WRITE                        56
+//
+///*
+// * arguments cmd (AR6000_XIOCTL_SET_TXOP)
+// * WMI_TXOP_CFG  txopEnable
+// */
+//#define AR6000_XIOCTL_WMI_SET_TXOP                      57
+//
+//#ifdef USER_KEYS
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
+// * UINT32 keyOpCtrl
+// * uses AR6000_USER_SETKEYS_INFO
+// */
+//#define AR6000_XIOCTL_USER_SETKEYS                      58
+//#endif /* USER_KEYS */
+//
+//#define AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59
+///*
+// * arguments:
+// *   UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
+// *   UINT8 keepaliveInterval
+// * uses: WMI_SET_KEEPALIVE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60
+///*
+// * arguments:
+// *   UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
+// *   UINT8 keepaliveInterval
+// *   A_BOOL configured
+// * uses: WMI_GET_KEEPALIVE_CMDID
+// */
+//
+///*               ====ROM Patching Extended Ioctls====                       */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61
+///*
+// * arguments:
+// *     union {
+// *       struct {
+// *         UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
+// *         UINT32 ROM Address
+// *         UINT32 RAM Address
+// *         UINT32 number of bytes
+// *         UINT32 activate? (0 or 1)
+// *       }
+// *       A_UINT32 resulting rompatch ID
+// *     }
+// * uses: BMI_ROMPATCH_INSTALL
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
+// *       UINT32 rompatch ID
+// *     }
+// * uses: BMI_ROMPATCH_UNINSTALL
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
+// *       UINT32 rompatch count
+// *       UINT32 rompatch IDs[rompatch count]
+// *     }
+// * uses: BMI_ROMPATCH_ACTIVATE
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
+// *       UINT32 rompatch count
+// *       UINT32 rompatch IDs[rompatch count]
+// *     }
+// * uses: BMI_ROMPATCH_DEACTIVATE
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_APPIE             65
+///*
+// * arguments:
+// *      struct {
+// *          UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
+// *          UINT32  app_frmtype;
+// *          UINT32  app_buflen;
+// *          UINT8   app_buf[];
+// *      }
+// */
+//#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER    66
+///*
+// * arguments:
+// *      A_UINT32 filter_type;
+// */
+//
+//#define AR6000_XIOCTL_DBGLOG_CFG_MODULE             67
+//
+//#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS         68
+//
+//#define AR6000_XIOCTL_WMI_SET_WSC_STATUS            70
+///*
+// * arguments:
+// *      A_UINT32 wsc_status;
+// *            (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
+// */
+//
+///*
+// * arguments:
+// *      struct {
+// *          A_UINT8 streamType;
+// *          A_UINT8 status;
+// *      }
+// * uses: WMI_SET_BT_STATUS_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_BT_STATUS             71
+//
+///*
+// * arguments:
+// *      struct {
+// *           A_UINT8 paramType;
+// *           union {
+// *               A_UINT8 noSCOPkts;
+// *               BT_PARAMS_A2DP a2dpParams;
+// *               BT_COEX_REGS regs;
+// *           };
+// *      }
+// * uses: WMI_SET_BT_PARAM_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_BT_PARAMS             72
+//
+//#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE       73
+//#define AR6000_XIOCTL_WMI_SET_WOW_MODE              74
+//#define AR6000_XIOCTL_WMI_GET_WOW_LIST              75
+//#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN           76
+//#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN           77
+//
+//
+//
+//#define AR6000_XIOCTL_TARGET_INFO                   78
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
+// *   A_UINT32 TargetVersion (returned)
+// *   A_UINT32 TargetType    (returned)
+// * (See also bmi_msg.h target_ver and target_type)
+// */
+//
+//#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE         79
+///*
+// * arguments:
+// *      none
+// */
+//
+//#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE       80
+///*
+// * This ioctl is used to emulate traffic activity
+// * timeouts.  Activity/inactivity will trigger the driver
+// * to re-balance credits.
+// *
+// * arguments:
+// *      ar6000_traffic_activity_change
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS    81
+///*
+// * This ioctl is used to set the connect control flags
+// *
+// * arguments:
+// *      A_UINT32 connectCtrlFlags
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS              82
+///*
+// * This IOCTL sets any Authentication,Key Management and Protection
+// * related parameters. This is used along with the information set in
+// * Connect Command.
+// * Currently this enables Multiple PMKIDs to an AP.
+// *
+// * arguments:
+// *      struct {
+// *          A_UINT32    akmpInfo;
+// *      }
+// * uses: WMI_SET_AKMP_PARAMS_CMD
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_PMKID_LIST            83
+//
+//#define AR6000_XIOCTL_WMI_SET_PMKID_LIST            84
+///*
+// * This IOCTL is used to set a list of PMKIDs. This list of
+// * PMKIDs is used in the [Re]AssocReq Frame. This list is used
+// * only if the MultiPMKID option is enabled via the
+// * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS  IOCTL.
+// *
+// * arguments:
+// *      struct {
+// *          A_UINT32    numPMKID;
+// *          WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+// *      }
+// * uses: WMI_SET_PMKIDLIST_CMD
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_PARAMS                85
+//#define AR6000_XIOCTL_WMI_SET_MCAST_FILTER     86
+//#define AR6000_XIOCTL_WMI_DEL_MCAST_FILTER     87
+//
+//
+///* Historical DSETPATCH support for INI patches */
+//#define AR6000_XIOCTL_UNUSED90                      90
+//
+//
+///* Support LZ-compressed firmware download */
+//#define AR6000_XIOCTL_BMI_LZ_STREAM_START           91
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_STREAM_START)
+// *   UINT32 address
+// * uses: BMI_LZ_STREAM_START
+// */
+//
+//#define AR6000_XIOCTL_BMI_LZ_DATA                   92
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_DATA)
+// *   UINT32 length
+// *   char data[length]
+// * uses: BMI_LZ_DATA
+// */
+//
+//#define AR6000_XIOCTL_PROF_CFG                      93
+///*
+// * arguments:
+// *   A_UINT32 period
+// *   A_UINT32 nbins
+// */
+//
+//#define AR6000_XIOCTL_PROF_ADDR_SET                 94
+///*
+// * arguments:
+// *   A_UINT32 Target address
+// */
+//
+//#define AR6000_XIOCTL_PROF_START                    95
+//
+//#define AR6000_XIOCTL_PROF_STOP                     96
+//
+//#define AR6000_XIOCTL_PROF_COUNT_GET                97
+//
+//#define AR6000_XIOCTL_WMI_ABORT_SCAN                98
+//
+///*
+// * AP mode
+// */
+//#define AR6000_XIOCTL_AP_GET_STA_LIST               99
+//
+//#define AR6000_XIOCTL_AP_HIDDEN_SSID                100
+//
+//#define AR6000_XIOCTL_AP_SET_NUM_STA                101
+//
+//#define AR6000_XIOCTL_AP_SET_ACL_MAC                102
+//
+//#define AR6000_XIOCTL_AP_GET_ACL_LIST               103
+//
+//#define AR6000_XIOCTL_AP_COMMIT_CONFIG              104
+//
+//#define IEEE80211_IOCTL_GETWPAIE                    105
+//
+//#define AR6000_XIOCTL_AP_CONN_INACT_TIME            106
+//
+//#define AR6000_XIOCTL_AP_PROT_SCAN_TIME             107
+//
+//#define AR6000_XIOCTL_AP_SET_COUNTRY                108
+//
+//#define AR6000_XIOCTL_AP_SET_DTIM                   109
+//
+//
+//
+//
+//#define AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT       110
+//
+//#define AR6000_XIOCTL_SET_IP                        111
+//
+//#define AR6000_XIOCTL_AP_SET_ACL_POLICY             112
+//
+//#define AR6000_XIOCTL_AP_CTRL_BSS_COMM              113
+//
+//#define AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO        114
+//
+//#define AR6000_XIOCTL_MODULE_DEBUG_SET_MASK         115
+//
+//#define AR6000_XIOCTL_MODULE_DEBUG_GET_MASK         116
+//
+//#define AR6000_XIOCTL_DUMP_RCV_AGGR_STATS           117
+//
+//#define AR6000_XIOCTL_SET_HT_CAP                    118
+//
+//#define AR6000_XIOCTL_SET_HT_OP                     119
+//
+//#define AR6000_XIOCTL_AP_GET_STAT                   120
+//
+//#define AR6000_XIOCTL_SET_TX_SELECT_RATES           121
+//
+//#define AR6000_XIOCTL_SETUP_AGGR                    122
+//
+//#define AR6000_XIOCTL_ALLOW_AGGR                    123
+//
+//#define AR6000_XIOCTL_AP_GET_HIDDEN_SSID            124
+//
+//#define AR6000_XIOCTL_AP_GET_COUNTRY                125
+//
+//#define AR6000_XIOCTL_AP_GET_WMODE                  126
+//
+//#define AR6000_XIOCTL_AP_GET_DTIM                   127
+//
+//#define AR6000_XIOCTL_AP_GET_BINTVL                 128
+//
+//#define AR6000_XIOCTL_AP_GET_RTS                    129
+//
+//#define AR6000_XIOCTL_DELE_AGGR                     130
+//
+//#define AR6000_XIOCTL_FETCH_TARGET_REGS             131
+//
+//#define AR6000_XIOCTL_HCI_CMD                       132
+//
+//#define AR6000_XIOCTL_ACL_DATA                      133
+//
+//#define AR6000_XIOCTL_WLAN_CONN_PRECEDENCE          134
+//
+//#define AR6000_XIOCTL_AP_SET_11BG_RATESET           135
+//
+//#define AR6000_XIOCTL_WMI_SET_AP_PS                 136
+//
+//#define AR6000_XIOCTL_WMI_MCAST_FILTER              137
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT                 138
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV           139
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG  140
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG             141
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG                142
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG         143
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG                      144
+//
+//#define AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS               145
+//
+//#define AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG                 146
+//
+//#define AR6000_XIOCTL_WMI_GET_BTCOEX_STATS                      147
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_QOS_SUPP)
+// *   UINT8  mode
+// * uses: WMI_SET_QOS_SUPP_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_QOS_SUPP                  148 
+//
+//#define AR6000_XIOCTL_AP_SET_DFS                        149
+//
+//#ifdef P2P
+//#define AR6000_XIOCTL_WMI_P2P_DISCOVER            150
+//#define AR6000_XIOCTL_WMI_P2P_LISTEN              151
+//#define AR6000_XIOCTL_WMI_P2P_GO_NEG              152
+//#define AR6000_XIOCTL_WMI_P2P_CONFIG              153
+//#define AR6000_XIOCTL_WMI_WPS_CONFIG              154
+//#define AR6000_XIOCTL_WMI_P2P_FINDNODE            155
+//#endif
+//#define AR6000_XIOCTL_SET_BT_HW_POWER_STATE             156 
+//#define AR6000_XIOCTL_GET_BT_HW_POWER_STATE             157 
+//#define AR6000_XIOCTL_GET_WLAN_SLEEP_STATE              158
+//#define AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM              159
+///*
+// * arguments:
+// *   WMI_AP_PS_CMD apPsCmd
+// * uses: WMI_AP_PS_CMDID
+// */
+//
+//
+//// WAC
+//#define AR6000_XIOCTL_WMI_ENABLE_WAC_PARAM              160
+//
+//#define AR6000_XIOCTL_WAC_SCAN_REPLY                    161
+//
+//#define AR6000_XIOCTL_WMI_WAC_CTRL_REQ                  162
+//
+//#define AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE         163
+//
+//#define AR6000_XIOCTL_WMI_SET_PASSPHRASE                164
+//
+//#define AR6000_XIOCTL_BMI_NVRAM_PROCESS                 165
+//
+//#define AR6000_XIOCTL_AP_ACS_DISABLE_HI_CHANNELS        166
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_NVRAM_PROCESS)
+// *   UINT8  name[BMI_NVRAM_SEG_NAME_SZ]
+// * uses: BMI_NVRAM_PROCESS
+// */
+//
+//
+//#ifdef CONFIG_HOST_TCMD_SUPPORT
+///*       ====additional extended commands for radio test ====                          */
+//
+//#define AR6000_XIOCTL_TCMD_CMDS                          167
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CMDS)
+// *   WMI_TCMD_CMDS_CMD cmdsCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CMDS_CMDID
+// */
+//
+//#endif //ifdef CONFIG_HOST_TCMD_SUPPORT
+//
+//#define AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM           168
+//
+//#define AR6000_XIOCTL_WMI_FORCE_ASSERT                  169
+//
+//#define AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES     170
+//
+//#define AR6000_XIOCTL_AP_GET_NUM_STA                    171
+//
+//#define AR6000_XIOCTL_SUSPEND_DRIVER                    172
+//
+//#define AR6000_XIOCTL_RESUME_DRIVER                     173
+
+/* used by AR6000_IOCTL_WMI_GETREV */
+struct ar6000_version {
+    A_UINT32        host_ver;
+    A_UINT32        target_ver;
+    A_UINT32        wlan_ver;
+    A_UINT32        abi_ver;
+    A_UINT32        targetconf_ver;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
+struct ar6000_queuereq {
+    A_UINT8         trafficClass;
+    A_UINT16        activeTsids;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
+typedef struct targetStats_t {
+    A_UINT64    tx_packets;
+    A_UINT64    tx_bytes;
+    A_UINT64    tx_unicast_pkts;
+    A_UINT64    tx_unicast_bytes;
+    A_UINT64    tx_multicast_pkts;
+    A_UINT64    tx_multicast_bytes;
+    A_UINT64    tx_broadcast_pkts;
+    A_UINT64    tx_broadcast_bytes;
+    A_UINT64    tx_rts_success_cnt;
+    A_UINT64    tx_packet_per_ac[4];
+
+    A_UINT64    tx_errors;
+    A_UINT64    tx_failed_cnt;
+    A_UINT64    tx_retry_cnt;
+    A_UINT64    tx_mult_retry_cnt;
+    A_UINT64    tx_rts_fail_cnt;
+
+    A_UINT64    rx_packets;
+    A_UINT64    rx_bytes;
+    A_UINT64    rx_unicast_pkts;
+    A_UINT64    rx_unicast_bytes;
+    A_UINT64    rx_multicast_pkts;
+    A_UINT64    rx_multicast_bytes;
+    A_UINT64    rx_broadcast_pkts;
+    A_UINT64    rx_broadcast_bytes;
+    A_UINT64    rx_fragment_pkt;
+
+    A_UINT64    rx_errors;
+    A_UINT64    rx_crcerr;
+    A_UINT64    rx_key_cache_miss;
+    A_UINT64    rx_decrypt_err;
+    A_UINT64    rx_duplicate_frames;
+
+    A_UINT64    tkip_local_mic_failure;
+    A_UINT64    tkip_counter_measures_invoked;
+    A_UINT64    tkip_replays;
+    A_UINT64    tkip_format_errors;
+    A_UINT64    ccmp_format_errors;
+    A_UINT64    ccmp_replays;
+
+    A_UINT64    power_save_failure_cnt;
+
+    A_UINT64    cs_bmiss_cnt;
+    A_UINT64    cs_lowRssi_cnt;
+    A_UINT64    cs_connect_cnt;
+    A_UINT64    cs_disconnect_cnt;
+
+    A_INT32     tx_unicast_rate;
+    A_INT32     rx_unicast_rate;
+
+    A_UINT32    lq_val;
+
+    A_UINT32    wow_num_pkts_dropped;
+    A_UINT16    wow_num_events_discarded;
+
+    A_INT16     noise_floor_calibation;
+    A_INT16     cs_rssi;
+    A_INT16     cs_aveBeacon_rssi;
+    A_UINT8     cs_aveBeacon_snr;
+    A_UINT8     cs_lastRoam_msec;
+    A_UINT8     cs_snr;
+
+    A_UINT8     wow_num_host_pkt_wakeups;
+    A_UINT8     wow_num_host_event_wakeups;
+
+    A_UINT32   arp_received;
+    A_UINT32   arp_matched;
+    A_UINT32   arp_replied;
+}TARGET_STATS;
+
+typedef struct targetStats_cmd_t {
+    TARGET_STATS targetStats;
+    int clearStats;
+} TARGET_STATS_CMD;
+
+/* used by AR6000_XIOCTL_USER_SETKEYS */
+
+/*
+ * Setting this bit to 1 doesnot initialize the RSC on the firmware
+ */
+#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL    1
+#define AR6000_USER_SETKEYS_RSC_UNCHANGED     0x00000002
+
+typedef struct {
+    A_UINT32  keyOpCtrl;  /* Bit Map of Key Mgmt Ctrl Flags */
+} AR6000_USER_SETKEYS_INFO;
+
+
+/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
+struct ar6000_gpio_output_set_cmd_s {
+    A_UINT32 set_mask;
+    A_UINT32 clear_mask;
+    A_UINT32 enable_mask;
+    A_UINT32 disable_mask;
+};
+
+/*
+ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
+ */
+struct ar6000_gpio_register_cmd_s {
+    A_UINT32 gpioreg_id;
+    A_UINT32 value;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
+struct ar6000_gpio_intr_ack_cmd_s {
+    A_UINT32 ack_mask;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
+struct ar6000_gpio_intr_wait_cmd_s {
+    A_UINT32 intr_mask;
+    A_UINT32 input_values;
+};
+
+/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
+typedef struct ar6000_dbglog_module_config_s {
+    A_UINT32 valid;
+    A_UINT16 mmask;
+    A_UINT16 tsr;
+    A_BOOL   rep;
+    A_UINT16 size;
+} DBGLOG_MODULE_CONFIG;
+
+typedef struct user_rssi_thold_t {
+    A_INT16     tag;
+    A_INT16     rssi;
+} USER_RSSI_THOLD;
+
+typedef struct user_rssi_params_t {
+    A_UINT8            weight;
+    A_UINT32           pollTime;
+    USER_RSSI_THOLD    tholds[12];
+} USER_RSSI_PARAMS;
+
+typedef struct ar6000_get_btcoex_config_cmd_t{
+    A_UINT32 btProfileType;
+    A_UINT32 linkId;
+ }AR6000_GET_BTCOEX_CONFIG_CMD;
+
+typedef struct ar6000_btcoex_config_t {
+    AR6000_GET_BTCOEX_CONFIG_CMD  configCmd;
+    A_UINT32 * configEvent;
+} AR6000_BTCOEX_CONFIG;
+
+typedef struct ar6000_btcoex_stats_t {
+    A_UINT32 * statsEvent;
+ }AR6000_BTCOEX_STATS;
+/*
+ * Host driver may have some config parameters. Typically, these
+ * config params are one time config parameters. These could
+ * correspond to any of the underlying modules. Host driver exposes
+ * an api for the underlying modules to get this config.
+ */
+#define AR6000_DRIVER_CFG_BASE                  0x8000
+
+/* Should driver perform wlan node caching? */
+#define AR6000_DRIVER_CFG_GET_WLANNODECACHING   0x8001
+/*Should we log raw WMI msgs */
+#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS      0x8002
+
+/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
+struct ar6000_diag_window_cmd_s {
+    unsigned int addr;
+    unsigned int value;
+};
+
+
+struct ar6000_traffic_activity_change {
+    A_UINT32    StreamID;   /* stream ID to indicate activity change */
+    A_UINT32    Active;     /* active (1) or inactive (0) */
+};
+
+/* Used with AR6000_XIOCTL_PROF_COUNT_GET */
+struct prof_count_s {
+    A_UINT32    addr;       /* bin start address */
+    A_UINT32    count;      /* hit count */
+};
+
+
+/* used by AR6000_XIOCTL_MODULE_DEBUG_SET_MASK */
+/*         AR6000_XIOCTL_MODULE_DEBUG_GET_MASK */
+/*         AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO */
+struct drv_debug_module_s {
+    A_CHAR      modulename[128];   /* name of module */
+    A_UINT32    mask;              /* new mask to set .. or .. current mask */
+};
+
+/* used by AR6000_XIOCTL_P2P_AUTH_INVITE */
+#define ATH_MAC_LEN 6
+typedef PREPACK struct {
+    A_UINT32 auth;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+}POSTPACK P2P_AUTH_INVITE_CMD;
+
+/* All HCI related rx events are sent up to the host app
+ * via a wmi event id. It can contain ACL data or HCI event, 
+ * based on which it will be de-multiplexed.
+ */
+typedef enum {
+    PAL_HCI_EVENT = 0,
+    PAL_HCI_RX_DATA,
+} WMI_PAL_EVENT_INFO;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/ath6kl-wmiconfig/include/athtypes_linux.h b/ath6kl-wmiconfig/include/athtypes_linux.h
new file mode 100755
index 0000000..b51b053
--- /dev/null
+++ b/ath6kl-wmiconfig/include/athtypes_linux.h
@@ -0,0 +1,40 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+//------------------------------------------------------------------------------
+//
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _ATHTYPES_LINUX_H_
+#define _ATHTYPES_LINUX_H_
+
+#ifdef __KERNEL__
+#include <linux/types.h>
+#else
+#include <sys/types.h>
+#endif
+
+typedef int8_t      A_INT8;
+typedef int16_t     A_INT16;
+typedef int32_t     A_INT32;
+typedef int64_t     A_INT64;
+
+typedef u_int8_t     A_UINT8;
+typedef u_int16_t    A_UINT16;
+typedef u_int32_t    A_UINT32;
+typedef u_int64_t    A_UINT64;
+
+typedef int             A_BOOL;
+typedef char            A_CHAR;
+typedef unsigned char   A_UCHAR;
+typedef unsigned long   A_ATH_TIMER;
+
+#endif /* _ATHTYPES_LINUX_H_ */
+
diff --git a/ath6kl-wmiconfig/include/config_linux.h b/ath6kl-wmiconfig/include/config_linux.h
new file mode 100755
index 0000000..35a5904
--- /dev/null
+++ b/ath6kl-wmiconfig/include/config_linux.h
@@ -0,0 +1,54 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef _CONFIG_LINUX_H_
+#define _CONFIG_LINUX_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <linux/version.h>
+
+/*
+ * Host-side GPIO support is optional.
+ * If run-time access to GPIO pins is not required, then
+ * this should be changed to #undef.
+ */
+#define CONFIG_HOST_GPIO_SUPPORT
+
+/*
+ * Host side Test Command support
+ * Note: when HCI SDIO is enabled, a low stack IRQ or statck overflow is
+ *       hit on FC10. So with HCI SDIO, minimize the stack allocation by 
+ *       mutually exclude TCMD_SUPPORT, which allocates large buffers 
+ *       in AR_TCMD_RESP in AR_SOFTC_T
+ *
+ */
+#ifndef HCI_TRANSPORT_SDIO
+#define CONFIG_HOST_TCMD_SUPPORT
+#endif
+
+/* Host-side support for Target-side profiling */
+#undef CONFIG_TARGET_PROFILE_SUPPORT
+/*DIX OFFLOAD SUPPORT*/
+/*#define DIX_RX_OFFLOAD*/
+/*#define DIX_TX_OFFLOAD*/
+
+/* IP/TCP checksum offload */
+/* Checksum offload is currently not supported for 64 bit platforms */
+#ifndef __LP64__
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25)
+#define CONFIG_CHECKSUM_OFFLOAD
+#endif
+#endif /* __LP64__ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
diff --git a/ath6kl-wmiconfig/include/dbglog.h b/ath6kl-wmiconfig/include/dbglog.h
new file mode 100755
index 0000000..61924dd
--- /dev/null
+++ b/ath6kl-wmiconfig/include/dbglog.h
@@ -0,0 +1,117 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef _DBGLOG_H_
+#define _DBGLOG_H_
+
+#ifndef ATH_TARGET
+//#include "athstartpack.h"
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define DBGLOG_TIMESTAMP_OFFSET          0
+#define DBGLOG_TIMESTAMP_MASK            0x0000FFFF /* Bit 0-15. Contains bit
+                                                       8-23 of the LF0 timer */
+#define DBGLOG_DBGID_OFFSET              16
+#define DBGLOG_DBGID_MASK                0x03FF0000 /* Bit 16-25 */
+#define DBGLOG_DBGID_NUM_MAX             256 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULEID_OFFSET           26
+#define DBGLOG_MODULEID_MASK             0x3C000000 /* Bit 26-29 */
+#define DBGLOG_MODULEID_NUM_MAX          16 /* Upper limit is width of mask */
+
+/*
+ * Please ensure that the definition of any new module intrduced is captured
+ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The 
+ * structure is required for the parser to correctly pick up the values for
+ * different modules.
+ */
+#define DBGLOG_MODULEID_START
+#define DBGLOG_MODULEID_INF                   0
+#define DBGLOG_MODULEID_WMI                   1
+#define DBGLOG_MODULEID_MISC                  2
+#define DBGLOG_MODULEID_PM                    3
+#define DBGLOG_MODULEID_TXRX_MGMTBUF          4
+#define DBGLOG_MODULEID_TXRX_TXBUF            5
+#define DBGLOG_MODULEID_TXRX_RXBUF            6
+#define DBGLOG_MODULEID_WOW                   7
+#define DBGLOG_MODULEID_WHAL                  8
+#define DBGLOG_MODULEID_DC                    9
+#define DBGLOG_MODULEID_CO                    10
+#define DBGLOG_MODULEID_RO                    11
+#define DBGLOG_MODULEID_CM                    12
+#define DBGLOG_MODULEID_MGMT                  13
+#define DBGLOG_MODULEID_TMR                   14
+#define DBGLOG_MODULEID_BTCOEX                15
+#define DBGLOG_MODULEID_END
+
+#define DBGLOG_NUM_ARGS_OFFSET             30
+#define DBGLOG_NUM_ARGS_MASK               0xC0000000 /* Bit 30-31 */
+#define DBGLOG_NUM_ARGS_MAX                2 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULE_LOG_ENABLE_OFFSET    0
+#define DBGLOG_MODULE_LOG_ENABLE_MASK      0x0000FFFF
+
+#define DBGLOG_REPORTING_ENABLED_OFFSET    16
+#define DBGLOG_REPORTING_ENABLED_MASK      0x00010000
+
+#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
+#define DBGLOG_TIMESTAMP_RESOLUTION_MASK   0x000E0000
+
+#define DBGLOG_REPORT_SIZE_OFFSET          20
+#define DBGLOG_REPORT_SIZE_MASK            0x3FF00000
+
+#define DBGLOG_LOG_BUFFER_SIZE             1500
+#define DBGLOG_DBGID_DEFINITION_LEN_MAX    90
+
+PREPACK struct dbglog_buf_s {
+    struct dbglog_buf_s *next;
+    A_UINT8             *buffer;
+    A_UINT32             bufsize;
+    A_UINT32             length;
+    A_UINT32             count;
+    A_UINT32             free;
+} POSTPACK;
+
+PREPACK struct dbglog_hdr_s {
+    struct dbglog_buf_s *dbuf;
+    A_UINT32             dropped;
+} POSTPACK;
+
+PREPACK struct dbglog_config_s {
+    A_UINT32                    cfgvalid; /* Mask with valid config bits */
+    union {
+        /* TODO: Take care of endianness */
+        struct {
+            A_UINT32            mmask:16; /* Mask of modules with logging on */
+            A_UINT32            rep:1; /* Reporting enabled or not */
+            A_UINT32            tsr:3; /* Time stamp resolution. Def: 1 ms */
+            A_UINT32            size:10; /* Report size in number of messages */
+            A_UINT32            reserved:2;
+        } dbglog_config;
+
+        A_UINT32                value;
+    } u;
+} POSTPACK;
+
+#define cfgmmask                   u.dbglog_config.mmask
+#define cfgrep                     u.dbglog_config.rep
+#define cfgtsr                     u.dbglog_config.tsr
+#define cfgsize                    u.dbglog_config.size
+#define cfgvalue                   u.value
+
+#ifdef __cplusplus
+}
+#endif
+
+#ifndef ATH_TARGET
+//#include "athendpack.h"
+#endif
+
+#endif /* _DBGLOG_H_ */
diff --git a/ath6kl-wmiconfig/include/dbglog_id.h b/ath6kl-wmiconfig/include/dbglog_id.h
new file mode 100755
index 0000000..8ef7b5f
--- /dev/null
+++ b/ath6kl-wmiconfig/include/dbglog_id.h
@@ -0,0 +1,576 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef _DBGLOG_ID_H_
+#define _DBGLOG_ID_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* 
+ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
+ * Please ensure that the definition of any new debugid introduced is captured
+ * between the <MODULE>_DBGID_DEFINITION_START and 
+ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the 
+ * parser to correctly pick up the values for different debug identifiers.
+ */
+
+/* INF debug identifier definitions */
+#define INF_DBGID_DEFINITION_START
+#define INF_ASSERTION_FAILED                          1
+#define INF_TARGET_ID                                 2
+#define INF_DBGID_DEFINITION_END
+
+/* WMI debug identifier definitions */
+#define WMI_DBGID_DEFINITION_START
+#define WMI_CMD_RX_XTND_PKT_TOO_SHORT                 1
+#define WMI_EXTENDED_CMD_NOT_HANDLED                  2
+#define WMI_CMD_RX_PKT_TOO_SHORT                      3
+#define WMI_CALLING_WMI_EXTENSION_FN                  4
+#define WMI_CMD_NOT_HANDLED                           5
+#define WMI_IN_SYNC                                   6
+#define WMI_TARGET_WMI_SYNC_CMD                       7
+#define WMI_SET_SNR_THRESHOLD_PARAMS                  8
+#define WMI_SET_RSSI_THRESHOLD_PARAMS                 9
+#define WMI_SET_LQ_TRESHOLD_PARAMS                   10
+#define WMI_TARGET_CREATE_PSTREAM_CMD                11
+#define WMI_WI_DTM_INUSE                             12
+#define WMI_TARGET_DELETE_PSTREAM_CMD                13
+#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD       14
+#define WMI_TARGET_GET_BIT_RATE_CMD                  15
+#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS       16
+#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD        17
+#define WMI_TARGET_GET_TX_PWR_CMD                    18
+#define WMI_FREE_EVBUF_WMIBUF                        19
+#define WMI_FREE_EVBUF_DATABUF                       20
+#define WMI_FREE_EVBUF_BADFLAG                       21
+#define WMI_HTC_RX_ERROR_DATA_PACKET                 22
+#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX             23
+#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT      24
+#define WMI_SENDING_READY_EVENT                      25
+#define WMI_SETPOWER_MDOE_TO_MAXPERF                 26
+#define WMI_SETPOWER_MDOE_TO_REC                     27
+#define WMI_BSSINFO_EVENT_FROM                       28
+#define WMI_TARGET_GET_STATS_CMD                     29
+#define WMI_SENDING_SCAN_COMPLETE_EVENT              30
+#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT        31
+#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT       32
+#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT     33
+#define WMI_SENDING_ERROR_REPORT_EVENT               34
+#define WMI_SENDING_CAC_EVENT                        35
+#define WMI_TARGET_GET_ROAM_TABLE_CMD                36
+#define WMI_TARGET_GET_ROAM_DATA_CMD                 37
+#define WMI_SENDING_GPIO_INTR_EVENT                  38
+#define WMI_SENDING_GPIO_ACK_EVENT                   39
+#define WMI_SENDING_GPIO_DATA_EVENT                  40
+#define WMI_CMD_RX                                   41
+#define WMI_CMD_RX_XTND                              42
+#define WMI_EVENT_SEND                               43
+#define WMI_EVENT_SEND_XTND                          44
+#define WMI_CMD_PARAMS_DUMP_START                    45
+#define WMI_CMD_PARAMS_DUMP_END                      46
+#define WMI_CMD_PARAMS                               47
+#define WMI_DBGID_DEFINITION_END
+
+/* MISC debug identifier definitions */
+#define MISC_DBGID_DEFINITION_START
+#define MISC_WLAN_SCHEDULER_EVENT_REGISTER_ERROR     1
+#define TLPM_INIT                                    2
+#define TLPM_FILTER_POWER_STATE                      3
+#define TLPM_NOTIFY_NOT_IDLE                         4
+#define TLPM_TIMEOUT_IDLE_HANDLER                    5
+#define TLPM_TIMEOUT_WAKEUP_HANDLER                  6
+#define TLPM_WAKEUP_SIGNAL_HANDLER                   7
+#define TLPM_UNEXPECTED_GPIO_INTR_ERROR              8
+#define TLPM_BREAK_ON_NOT_RECEIVED_ERROR             9
+#define TLPM_BREAK_OFF_NOT_RECIVED_ERROR             10
+#define TLPM_ACK_GPIO_INTR                           11
+#define TLPM_ON                                      12
+#define TLPM_OFF                                     13
+#define TLPM_WAKEUP_FROM_HOST                        14
+#define TLPM_WAKEUP_FROM_BT                          15 
+#define TLPM_TX_BREAK_RECIVED                        16
+#define TLPM_IDLE_TIMER_NOT_RUNNING                  17
+#define	WAC_ENABLE                                   18
+#define WAC_SCAN_DONE                                19
+#define WAC_REPORT_BSS                               20
+#define WAC_START_WPS                                21
+#define WAC_SCAN_REPLY                               22
+#define WAC_UPDATE_BSS                               23
+#define WAC_PIN_STATUS                               24
+#define WAC_PIN_STATUS_REJECT                        25
+#define WAC_RSSI_BELOW_THRESHOLD                     26
+#define WAC_CTRL_REQ_CMD                             27
+#define WAC_CTRL_REQ_REPLY                           28
+#define DV_SET_ANTENNA                               29
+#define MISC_DBGID_DEFINITION_END
+    
+/* TXRX debug identifier definitions */
+#define TXRX_TXBUF_DBGID_DEFINITION_START
+#define TXRX_TXBUF_ALLOCATE_BUF                      1
+#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX                 2
+#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ                  3
+#define TXRX_TXBUF_TXQ_DEPTH                         4   
+#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ                 5
+#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ         6
+#define TXRX_TXBUF_INITIALIZE_TIMER                  7
+#define TXRX_TXBUF_ARM_TIMER                         8
+#define TXRX_TXBUF_DISARM_TIMER                      9
+#define TXRX_TXBUF_UNINITIALIZE_TIMER                10
+#define TXRX_TXBUF_DBGID_DEFINITION_END
+ 
+#define TXRX_RXBUF_DBGID_DEFINITION_START    
+#define TXRX_RXBUF_ALLOCATE_BUF                      1
+#define TXRX_RXBUF_QUEUE_TO_HOST                     2
+#define TXRX_RXBUF_QUEUE_TO_WLAN                     3
+#define TXRX_RXBUF_ZERO_LEN_BUF                      4
+#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN  5
+#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF        6
+#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN         7
+#define TXRX_RXBUF_SEND_TO_RECV_MGMT                 8
+#define TXRX_RXBUF_SEND_TO_IEEE_LAYER                9
+#define TXRX_RXBUF_REQUEUE_ERROR                     10
+#define TXRX_RXBUF_DBGID_DEFINITION_END
+
+#define TXRX_MGMTBUF_DBGID_DEFINITION_START 
+#define TXRX_MGMTBUF_ALLOCATE_BUF                    1
+#define TXRX_MGMTBUF_ALLOCATE_SM_BUF                 2    
+#define TXRX_MGMTBUF_ALLOCATE_RMBUF                  3
+#define TXRX_MGMTBUF_GET_BUF                         4
+#define TXRX_MGMTBUF_GET_SM_BUF                      5
+#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ                6
+#define TXRX_MGMTBUF_REAPED_BUF                      7
+#define TXRX_MGMTBUF_REAPED_SM_BUF                   8
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN              9
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN          10
+#define TXRX_MGMTBUF_ENQUEUE_INTO_DATA_SFQ           11
+#define TXRX_MGMTBUF_DEQUEUE_FROM_DATA_SFQ           12
+#define TXRX_MGMTBUF_PAUSE_DATA_TXQ                  13
+#define TXRX_MGMTBUF_RESUME_DATA_TXQ                 14
+#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT       15
+#define TXRX_MGMTBUF_DRAINQ                          16
+#define TXRX_MGMTBUF_INDICATE_Q_DRAINED              17
+#define TXRX_MGMTBUF_ENQUEUE_INTO_HW_SFQ             18
+#define TXRX_MGMTBUF_DEQUEUE_FROM_HW_SFQ             19
+#define TXRX_MGMTBUF_PAUSE_HW_TXQ                    20
+#define TXRX_MGMTBUF_RESUME_HW_TXQ                   21
+#define TXRX_MGMTBUF_TEAR_DOWN_BA                    22
+#define TXRX_MGMTBUF_PROCESS_ADDBA_REQ               23
+#define TXRX_MGMTBUF_PROCESS_DELBA                   24
+#define TXRX_MGMTBUF_PERFORM_BA                      25
+#define TXRX_MGMTBUF_WLAN_RESET_ON_ERROR             26 
+#define TXRX_MGMTBUF_DBGID_DEFINITION_END
+
+/* PM (Power Module) debug identifier definitions */
+#define PM_DBGID_DEFINITION_START
+#define PM_INIT                                      1
+#define PM_ENABLE                                    2
+#define PM_SET_STATE                                 3
+#define PM_SET_POWERMODE                             4
+#define PM_CONN_NOTIFY                               5
+#define PM_REF_COUNT_NEGATIVE                        6
+#define PM_INFRA_STA_APSD_ENABLE                     7
+#define PM_INFRA_STA_UPDATE_APSD_STATE               8
+#define PM_CHAN_OP_REQ                               9
+#define PM_SET_MY_BEACON_POLICY                      10
+#define PM_SET_ALL_BEACON_POLICY                     11
+#define PM_INFRA_STA_SET_PM_PARAMS1                  12
+#define PM_INFRA_STA_SET_PM_PARAMS2                  13
+#define PM_ADHOC_SET_PM_CAPS_FAIL                    14
+#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID              15
+#define PM_ADHOC_SET_PM_PARAMS                       16
+#define PM_ADHOC_STATE1                              18
+#define PM_ADHOC_STATE2                              19
+#define PM_ADHOC_CONN_MAP                            20 
+#define PM_FAKE_SLEEP                                21
+#define PM_AP_STATE1                                 22
+#define PM_AP_SET_PM_PARAMS                          23
+#define PM_P2P_STATE1                                24
+#define PM_DBGID_DEFINITION_END
+
+/* Wake on Wireless debug identifier definitions */
+#define WOW_DBGID_DEFINITION_START
+#define WOW_INIT                                        1
+#define WOW_GET_CONFIG_DSET                             2   
+#define WOW_NO_CONFIG_DSET                              3
+#define WOW_INVALID_CONFIG_DSET                         4
+#define WOW_USE_DEFAULT_CONFIG                          5
+#define WOW_SETUP_GPIO                                  6
+#define WOW_INIT_DONE                                   7
+#define WOW_SET_GPIO_PIN                                8
+#define WOW_CLEAR_GPIO_PIN                              9
+#define WOW_SET_WOW_MODE_CMD                            10
+#define WOW_SET_HOST_MODE_CMD                           11  
+#define WOW_ADD_WOW_PATTERN_CMD                         12    
+#define WOW_NEW_WOW_PATTERN_AT_INDEX                    13    
+#define WOW_DEL_WOW_PATTERN_CMD                         14    
+#define WOW_LIST_CONTAINS_PATTERNS                      15    
+#define WOW_GET_WOW_LIST_CMD                            16 
+#define WOW_INVALID_FILTER_ID                           17
+#define WOW_INVALID_FILTER_LISTID                       18
+#define WOW_NO_VALID_FILTER_AT_ID                       19
+#define WOW_NO_VALID_LIST_AT_ID                         20
+#define WOW_NUM_PATTERNS_EXCEEDED                       21
+#define WOW_NUM_LISTS_EXCEEDED                          22
+#define WOW_GET_WOW_STATS                               23
+#define WOW_CLEAR_WOW_STATS                             24
+#define WOW_WAKEUP_HOST                                 25
+#define WOW_EVENT_WAKEUP_HOST                           26
+#define WOW_EVENT_DISCARD                               27
+#define WOW_PATTERN_MATCH                               28
+#define WOW_PATTERN_NOT_MATCH                           29
+#define WOW_PATTERN_NOT_MATCH_OFFSET                    30
+#define WOW_DISABLED_HOST_ASLEEP                        31
+#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS             32
+#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND          33
+#define WOW_DBGID_DEFINITION_END
+
+/* WHAL debug identifier definitions */
+#define WHAL_DBGID_DEFINITION_START
+#define WHAL_ERROR_ANI_CONTROL                      1
+#define WHAL_ERROR_CHIP_TEST1                       2
+#define WHAL_ERROR_CHIP_TEST2                       3
+#define WHAL_ERROR_EEPROM_CHECKSUM                  4
+#define WHAL_ERROR_EEPROM_MACADDR                   5
+#define WHAL_ERROR_INTERRUPT_HIU                    6
+#define WHAL_ERROR_KEYCACHE_RESET                   7
+#define WHAL_ERROR_KEYCACHE_SET                     8 
+#define WHAL_ERROR_KEYCACHE_TYPE                    9
+#define WHAL_ERROR_KEYCACHE_TKIPENTRY              10
+#define WHAL_ERROR_KEYCACHE_WEPLENGTH              11
+#define WHAL_ERROR_PHY_INVALID_CHANNEL             12
+#define WHAL_ERROR_POWER_AWAKE                     13
+#define WHAL_ERROR_POWER_SET                       14
+#define WHAL_ERROR_RECV_STOPDMA                    15
+#define WHAL_ERROR_RECV_STOPPCU                    16
+#define WHAL_ERROR_RESET_CHANNF1                   17
+#define WHAL_ERROR_RESET_CHANNF2                   18
+#define WHAL_ERROR_RESET_PM                        19
+#define WHAL_ERROR_RESET_OFFSETCAL                 20
+#define WHAL_ERROR_RESET_RFGRANT                   21
+#define WHAL_ERROR_RESET_RXFRAME                   22
+#define WHAL_ERROR_RESET_STOPDMA                   23
+#define WHAL_ERROR_RESET_RECOVER                   24
+#define WHAL_ERROR_XMIT_COMPUTE                    25
+#define WHAL_ERROR_XMIT_NOQUEUE                    26
+#define WHAL_ERROR_XMIT_ACTIVEQUEUE                27
+#define WHAL_ERROR_XMIT_BADTYPE                    28
+#define WHAL_ERROR_XMIT_STOPDMA                    29
+#define WHAL_ERROR_INTERRUPT_BB_PANIC              30 
+#define WHAL_ERROR_RESET_TXIQCAL                   31 
+#define WHAL_ERROR_PAPRD_MAXGAIN_ABOVE_WINDOW      32 
+#define WHAL_DBGID_DEFINITION_END
+
+/* DC debug identifier definitions */
+#define DC_DBGID_DEFINITION_START
+#define DC_SCAN_CHAN_START                          1
+#define DC_SCAN_CHAN_FINISH                         2
+#define DC_BEACON_RECEIVE7                          3
+#define DC_SSID_PROBE_CB                            4
+#define DC_SEND_NEXT_SSID_PROBE                     5
+#define DC_START_SEARCH                             6
+#define DC_CANCEL_SEARCH_CB                         7
+#define DC_STOP_SEARCH                              8
+#define DC_END_SEARCH                               9
+#define DC_MIN_CHDWELL_TIMEOUT                     10
+#define DC_START_SEARCH_CANCELED                   11
+#define DC_SET_POWER_MODE                          12
+#define DC_INIT                                    13
+#define DC_SEARCH_OPPORTUNITY                      14
+#define DC_RECEIVED_ANY_BEACON                     15
+#define DC_RECEIVED_MY_BEACON                      16
+#define DC_PROFILE_IS_ADHOC_BUT_BSS_IS_INFRA       17
+#define DC_PS_ENABLED_BUT_ATHEROS_IE_ABSENT        18
+#define DC_BSS_ADHOC_CHANNEL_NOT_ALLOWED           19
+#define DC_SET_BEACON_UPDATE                       20
+#define DC_BEACON_UPDATE_COMPLETE                  21
+#define DC_END_SEARCH_BEACON_UPDATE_COMP_CB        22
+#define DC_BSSINFO_EVENT_DROPPED                   23
+#define DC_IEEEPS_ENABLED_BUT_ATIM_ABSENT          24 
+#define DC_DBGID_DEFINITION_END
+
+/* CO debug identifier definitions */
+#define CO_DBGID_DEFINITION_START
+#define CO_INIT                                     1
+#define CO_ACQUIRE_LOCK                             2
+#define CO_START_OP1                                3
+#define CO_START_OP2                                4
+#define CO_DRAIN_TX_COMPLETE_CB                     5
+#define CO_CHANGE_CHANNEL_CB                        6
+#define CO_RETURN_TO_HOME_CHANNEL                   7
+#define CO_FINISH_OP_TIMEOUT                        8
+#define CO_OP_END                                   9
+#define CO_CANCEL_OP                               10
+#define CO_CHANGE_CHANNEL                          11
+#define CO_RELEASE_LOCK                            12
+#define CO_CHANGE_STATE                            13
+#define CO_DBGID_DEFINITION_END
+
+/* RO debug identifier definitions */
+#define RO_DBGID_DEFINITION_START
+#define RO_REFRESH_ROAM_TABLE                       1
+#define RO_UPDATE_ROAM_CANDIDATE                    2
+#define RO_UPDATE_ROAM_CANDIDATE_CB                 3
+#define RO_UPDATE_ROAM_CANDIDATE_FINISH             4
+#define RO_REFRESH_ROAM_TABLE_DONE                  5
+#define RO_PERIODIC_SEARCH_CB                       6
+#define RO_PERIODIC_SEARCH_TIMEOUT                  7
+#define RO_INIT                                     8
+#define RO_BMISS_STATE1                             9
+#define RO_BMISS_STATE2                            10
+#define RO_SET_PERIODIC_SEARCH_ENABLE              11
+#define RO_SET_PERIODIC_SEARCH_DISABLE             12
+#define RO_ENABLE_SQ_THRESHOLD                     13
+#define RO_DISABLE_SQ_THRESHOLD                    14
+#define RO_ADD_BSS_TO_ROAM_TABLE                   15
+#define RO_SET_PERIODIC_SEARCH_MODE                16
+#define RO_CONFIGURE_SQ_THRESHOLD1                 17
+#define RO_CONFIGURE_SQ_THRESHOLD2                 18
+#define RO_CONFIGURE_SQ_PARAMS                     19
+#define RO_LOW_SIGNAL_QUALITY_EVENT                20
+#define RO_HIGH_SIGNAL_QUALITY_EVENT               21
+#define RO_REMOVE_BSS_FROM_ROAM_TABLE              22
+#define RO_UPDATE_CONNECTION_STATE_METRIC          23
+#define RO_LOWRSSI_SCAN_PARAMS                     24
+#define RO_LOWRSSI_SCAN_START                      25
+#define RO_LOWRSSI_SCAN_END                        26
+#define RO_LOWRSSI_SCAN_CANCEL                     27
+#define RO_LOWRSSI_ROAM_CANCEL                     28
+#define RO_REFRESH_ROAM_CANDIDATE                  29
+#define RO_DBGID_DEFINITION_END
+
+/* CM debug identifier definitions */
+#define CM_DBGID_DEFINITION_START
+#define CM_INITIATE_HANDOFF                         1
+#define CM_INITIATE_HANDOFF_CB                      2
+#define CM_CONNECT_EVENT                            3
+#define CM_DISCONNECT_EVENT                         4
+#define CM_INIT                                     5
+#define CM_HANDOFF_SOURCE                           6
+#define CM_SET_HANDOFF_TRIGGERS                     7
+#define CM_CONNECT_REQUEST                          8
+#define CM_CONNECT_REQUEST_CB                       9
+#define CM_CONTINUE_SCAN_CB                         10 
+#define CM_DBGID_DEFINITION_END
+
+
+/* mgmt debug identifier definitions */
+#define MGMT_DBGID_DEFINITION_START
+#define KEYMGMT_CONNECTION_INIT                     1
+#define KEYMGMT_CONNECTION_COMPLETE                 2
+#define KEYMGMT_CONNECTION_CLOSE                    3
+#define KEYMGMT_ADD_KEY                             4
+#define MLME_NEW_STATE                              5
+#define MLME_CONN_INIT                              6
+#define MLME_CONN_COMPLETE                          7
+#define MLME_CONN_CLOSE                             8 
+#define MLME_WLAN_OPMODE                            9 
+#define MLME_WLAN_SLOTTIME                          10 
+#define MGMT_DBGID_DEFINITION_END
+
+/* TMR debug identifier definitions */
+#define TMR_DBGID_DEFINITION_START
+#define TMR_HANG_DETECTED                           1
+#define TMR_WDT_TRIGGERED                           2
+#define TMR_WDT_RESET                               3
+#define TMR_HANDLER_ENTRY                           4
+#define TMR_HANDLER_EXIT                            5
+#define TMR_SAVED_START                             6
+#define TMR_SAVED_END                               7
+#define TMR_DBGID_DEFINITION_END
+
+/* BTCOEX debug identifier definitions */
+#define BTCOEX_DBGID_DEFINITION_START
+#define BTCOEX_STATUS_CMD                           1
+#define BTCOEX_PARAMS_CMD                           2
+#define BTCOEX_ANT_CONFIG                           3
+#define BTCOEX_COLOCATED_BT_DEVICE                  4
+#define BTCOEX_CLOSE_RANGE_SCO_ON                   5
+#define BTCOEX_CLOSE_RANGE_SCO_OFF                  6
+#define BTCOEX_CLOSE_RANGE_A2DP_ON                  7
+#define BTCOEX_CLOSE_RANGE_A2DP_OFF                 8
+#define BTCOEX_A2DP_PROTECT_ON                      9
+#define BTCOEX_A2DP_PROTECT_OFF                     10
+#define BTCOEX_SCO_PROTECT_ON                       11
+#define BTCOEX_SCO_PROTECT_OFF                      12
+#define BTCOEX_CLOSE_RANGE_DETECTOR_START           13
+#define BTCOEX_CLOSE_RANGE_DETECTOR_STOP            14
+#define BTCOEX_CLOSE_RANGE_TOGGLE                   15
+#define BTCOEX_CLOSE_RANGE_TOGGLE_RSSI_LRCNT        16
+#define BTCOEX_CLOSE_RANGE_RSSI_THRESH              17
+#define BTCOEX_CLOSE_RANGE_LOW_RATE_THRESH          18
+#define BTCOEX_PTA_PRI_INTR_HANDLER  		        19
+#define BTCOEX_PSPOLL_QUEUED						20
+#define BTCOEX_PSPOLL_COMPLETE						21
+#define BTCOEX_DBG_PM_AWAKE							22
+#define BTCOEX_DBG_PM_SLEEP							23
+#define BTCOEX_DBG_SCO_COEX_ON						24
+#define BTCOEX_SCO_DATARECEIVE						25
+#define BTCOEX_INTR_INIT							26
+#define BTCOEX_PTA_PRI_DIFF							27
+#define BTCOEX_TIM_NOTIFICATION						28
+#define BTCOEX_SCO_WAKEUP_ON_DATA					29
+#define BTCOEX_SCO_SLEEP							30
+#define BTCOEX_SET_WEIGHTS							31
+#define BTCOEX_SCO_DATARECEIVE_LATENCY_VAL			32
+#define BTCOEX_SCO_MEASURE_TIME_DIFF				33
+#define BTCOEX_SET_EOL_VAL							34
+#define BTCOEX_OPT_DETECT_HANDLER					35
+#define BTCOEX_SCO_TOGGLE_STATE						36
+#define BTCOEX_SCO_STOMP							37
+#define BTCOEX_NULL_COMP_CALLBACK					38
+#define BTCOEX_RX_INCOMING							39
+#define BTCOEX_RX_INCOMING_CTL						40
+#define BTCOEX_RX_INCOMING_MGMT						41
+#define BTCOEX_RX_INCOMING_DATA						42
+#define BTCOEX_RTS_RECEPTION						43
+#define BTCOEX_FRAME_PRI_LOW_RATE_THRES				44
+#define BTCOEX_PM_FAKE_SLEEP						45
+#define BTCOEX_ACL_COEX_STATUS						46
+#define BTCOEX_ACL_COEX_DETECTION					47
+#define BTCOEX_A2DP_COEX_STATUS						48
+#define BTCOEX_SCO_STATUS							49
+#define BTCOEX_WAKEUP_ON_DATA						50
+#define BTCOEX_DATARECEIVE							51
+#define BTCOEX_GET_MAX_AGGR_SIZE					53
+#define BTCOEX_MAX_AGGR_AVAIL_TIME					54
+#define BTCOEX_DBG_WBTIMER_INTR						55
+#define BTCOEX_DBG_SCO_SYNC                         57
+#define BTCOEX_UPLINK_QUEUED_RATE  					59
+#define BTCOEX_DBG_UPLINK_ENABLE_EOL				60
+#define BTCOEX_UPLINK_FRAME_DURATION				61
+#define BTCOEX_UPLINK_SET_EOL						62
+#define BTCOEX_DBG_EOL_EXPIRED						63
+#define BTCOEX_DBG_DATA_COMPLETE					64
+#define BTCOEX_UPLINK_QUEUED_TIMESTAMP				65
+#define BTCOEX_DBG_DATA_COMPLETE_TIME				66
+#define BTCOEX_DBG_A2DP_ROLE_IS_SLAVE               67
+#define BTCOEX_DBG_A2DP_ROLE_IS_MASTER              68
+#define BTCOEX_DBG_UPLINK_SEQ_NUM					69
+#define BTCOEX_UPLINK_AGGR_SEQ						70
+#define BTCOEX_DBG_TX_COMP_SEQ_NO					71
+#define BTCOEX_DBG_MAX_AGGR_PAUSE_STATE				72
+#define BTCOEX_DBG_ACL_TRAFFIC                      73
+#define BTCOEX_CURR_AGGR_PROP						74
+#define BTCOEX_DBG_SCO_GET_PER_TIME_DIFF 			75
+#define BTCOEX_PSPOLL_PROCESS						76
+#define BTCOEX_RETURN_FROM_MAC						77
+#define BTCOEX_FREED_REQUEUED_CNT					78
+#define BTCOEX_DBG_TOGGLE_LOW_RATES					79
+#define BTCOEX_MAC_GOES_TO_SLEEP    				80
+#define BTCOEX_DBG_A2DP_NO_SYNC                     81
+#define BTCOEX_RETURN_FROM_MAC_HOLD_Q_INFO			82
+#define BTCOEX_RETURN_FROM_MAC_AC					83
+#define BTCOEX_DBG_DTIM_RECV                        84
+#define BTCOEX_IS_PRE_UPDATE						86
+#define BTCOEX_ENQUEUED_BIT_MAP						87
+#define BTCOEX_TX_COMPLETE_FIRST_DESC_STATS			88
+#define BTCOEX_UPLINK_DESC							89
+#define BTCOEX_SCO_GET_PER_FIRST_FRM_TIMESTAMP		90
+#define BTCOEX_DBG_RECV_ACK							94
+#define BTCOEX_DBG_ADDBA_INDICATION                 95
+#define BTCOEX_TX_COMPLETE_EOL_FAILED				96
+#define BTCOEX_DBG_A2DP_USAGE_COMPLETE  			97
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_HANDLER		98
+#define BTCOEX_DBG_A2DP_SYNC_INTR                   99
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_RECEPTION	   100
+#define BTCOEX_FORM_AGGR_CURR_AGGR				   101
+#define BTCOEX_DBG_TOGGLE_A2DP_BURST_CNT           102
+#define BTCOEX_DBG_BT_TRAFFIC   				   103
+#define BTCOEX_DBG_STOMP_BT_TRAFFIC 			   104
+#define BTCOEX_RECV_NULL                           105
+#define BTCOEX_DBG_A2DP_MASTER_BT_END			   106
+#define BTCOEX_DBG_A2DP_BT_START				   107
+#define BTCOEX_DBG_A2DP_SLAVE_BT_END			   108
+#define BTCOEX_DBG_A2DP_STOMP_BT				   109
+#define BTCOEX_DBG_GO_TO_SLEEP					   110
+#define BTCOEX_DBG_A2DP_PKT						   111
+#define BTCOEX_DBG_A2DP_PSPOLL_DATA_RECV		   112
+#define BTCOEX_DBG_A2DP_NULL					   113
+#define BTCOEX_DBG_UPLINK_DATA					   114
+#define BTCOEX_DBG_A2DP_STOMP_LOW_PRIO_NULL		   115
+#define BTCOEX_DBG_ADD_BA_RESP_TIMEOUT			   116
+#define BTCOEX_DBG_TXQ_STATE					   117
+#define BTCOEX_DBG_ALLOW_SCAN					   118
+#define BTCOEX_DBG_SCAN_REQUEST					   119
+#define BTCOEX_A2DP_SLEEP						   127
+#define BTCOEX_DBG_DATA_ACTIV_TIMEOUT			   128
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_ON_MODE		   129
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_OFF_MODE 	   130
+#define BTCOEX_DATARECEIVE_AGGR					   131
+#define BTCOEX_DBG_DATA_RECV_SLEEPING_PENDING	   132
+#define BTCOEX_DBG_DATARESP_TIMEOUT				   133
+#define BTCOEX_BDG_BMISS						   134
+#define BTCOEX_DBG_DATA_RECV_WAKEUP_TIM			   135
+#define BTCOEX_DBG_SECOND_BMISS					   136
+#define BTCOEX_DBG_SET_WLAN_STATE				   138
+#define BTCOEX_BDG_FIRST_BMISS					   139
+#define BTCOEX_DBG_A2DP_CHAN_OP					   140
+#define BTCOEX_DBG_A2DP_INTR					   141
+#define BTCOEX_DBG_BT_INQUIRY					   142
+#define BTCOEX_DBG_BT_INQUIRY_DATA_FETCH		   143
+#define BTCOEX_DBG_POST_INQUIRY_FINISH			   144
+#define BTCOEX_DBG_SCO_OPT_MODE_TIMER_HANDLER	   145
+#define BTCOEX_DBG_NULL_FRAME_SLEEP				   146
+#define BTCOEX_DBG_NULL_FRAME_AWAKE				   147
+#define BTCOEX_DBG_SET_AGGR_SIZE				   152
+#define BTCOEX_DBG_TEAR_BA_TIMEOUT				   153
+#define BTCOEX_DBG_MGMT_FRAME_SEQ_NO			   154
+#define BTCOEX_DBG_SCO_STOMP_HIGH_PRI			   155
+#define BTCOEX_DBG_COLOCATED_BT_DEV				   156
+#define BTCOEX_DBG_FE_ANT_TYPE				       157
+#define BTCOEX_DBG_BT_INQUIRY_CMD				   158
+#define BTCOEX_DBG_SCO_CONFIG					   159
+#define BTCOEX_DBG_SCO_PSPOLL_CONFIG			   160
+#define BTCOEX_DBG_SCO_OPTMODE_CONFIG		       161
+#define BTCOEX_DBG_A2DP_CONFIG				       162
+#define BTCOEX_DBG_A2DP_PSPOLL_CONFIG		       163
+#define BTCOEX_DBG_A2DP_OPTMODE_CONFIG		       164
+#define BTCOEX_DBG_ACLCOEX_CONFIG			       165
+#define BTCOEX_DBG_ACLCOEX_PSPOLL_CONFIG		   166
+#define BTCOEX_DBG_ACLCOEX_OPTMODE_CONFIG	       167
+#define BTCOEX_DBG_DEBUG_CMD					   168
+#define BTCOEX_DBG_SET_BT_OPERATING_STATUS		   169
+#define BTCOEX_DBG_GET_CONFIG					   170
+#define BTCOEX_DBG_GET_STATS					   171
+#define BTCOEX_DBG_BT_OPERATING_STATUS			   172
+#define BTCOEX_DBG_PERFORM_RECONNECT               173
+#define BTCOEX_DBG_ACL_WLAN_MED                    175
+#define BTCOEX_DBG_ACL_BT_MED                      176
+#define BTCOEX_DBG_WLAN_CONNECT                    177
+#define BTCOEX_DBG_A2DP_DUAL_START                 178
+#define BTCOEX_DBG_PMAWAKE_NOTIFY                  179
+#define BTCOEX_DBG_BEACON_SCAN_ENABLE              180
+#define BTCOEX_DBG_BEACON_SCAN_DISABLE             181
+#define BTCOEX_DBG_RX_NOTIFY                       182
+#define BTCOEX_SCO_GET_PER_SECOND_FRM_TIMESTAMP    183
+#define BTCOEX_DBG_TXQ_DETAILS                     184
+#define BTCOEX_DBG_SCO_STOMP_LOW_PRI               185
+#define BTCOEX_DBG_A2DP_FORCE_SCAN                 186
+#define BTCOEX_DBG_DTIM_STOMP_COMP                 187
+#define BTCOEX_ACL_PRESENCE_TIMER                  188
+#define BTCOEX_DBG_QUEUE_SELF_CTS                  189
+#define BTCOEX_DBG_SELF_CTS_COMP                   190
+#define BTCOEX_DBG_APMODE_WAIT_FOR_CTS_COMP_FAILED 191
+#define BTCOEX_DBG_APMODE_A2DP_MED_TO_BT           192
+#define BTCOEX_DBG_APMODE_SET_BTSTATE              193
+#define BTCOEX_DBG_APMODE_A2DP_STATUS              194
+#define BTCOEX_DBG_APMODE_SCO_CTS_HANDLER          195
+#define BTCOEX_DBG_APMODE_SCO_STATUS               196
+#define BTCOEX_DBG_APMODE_TXQ_DRAINED              197
+#define BTCOEX_DBG_APMODE_SCO_ARM_TIMER            198
+#define BTCOEX_DBG_APMODE_SWITCH_MED_TO_WLAN       199
+#define BTCOEX_APMODE_BCN_TX_HANDLER               200
+#define BTCOEX_APMODE_BCN_TX                       201
+#define BTCOEX_APMODE_SCO_RTS_HANDLER              202
+#define BTCOEX_DBGID_DEFINITION_END
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_ID_H_ */
diff --git a/ath6kl-wmiconfig/include/ieee80211.h b/ath6kl-wmiconfig/include/ieee80211.h
new file mode 100755
index 0000000..4824ee0
--- /dev/null
+++ b/ath6kl-wmiconfig/include/ieee80211.h
@@ -0,0 +1,384 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+#ifndef _NET80211_IEEE80211_H_
+#define _NET80211_IEEE80211_H_
+
+//#include "athstartpack.h"
+
+/*
+ * 802.11 protocol definitions.
+ */
+#define IEEE80211_WEP_KEYLEN        5   /* 40bit */
+#define IEEE80211_WEP_IVLEN         3   /* 24bit */
+#define IEEE80211_WEP_KIDLEN        1   /* 1 octet */
+#define IEEE80211_WEP_CRCLEN        4   /* CRC-32 */
+#define IEEE80211_WEP_NKID          4   /* number of key ids */
+
+/*
+ * 802.11i defines an extended IV for use with non-WEP ciphers.
+ * When the EXTIV bit is set in the key id byte an additional
+ * 4 bytes immediately follow the IV for TKIP.  For CCMP the
+ * EXTIV bit is likewise set but the 8 bytes represent the
+ * CCMP header rather than IV+extended-IV.
+ */
+#define IEEE80211_WEP_EXTIV         0x20
+#define IEEE80211_WEP_EXTIVLEN      4   /* extended IV length */
+#define IEEE80211_WEP_MICLEN        8   /* trailing MIC */
+
+#define IEEE80211_CRC_LEN           4
+
+#ifdef WAPI_ENABLE
+#define IEEE80211_WAPI_EXTIVLEN      10   /* extended IV length */
+#endif /* WAPI ENABLE */
+
+
+#define IEEE80211_ADDR_LEN  6       /* size of 802.11 address */
+/* is 802.11 address multicast/broadcast? */
+#define IEEE80211_IS_MULTICAST(_a)  (*(_a) & 0x01)
+#define IEEE80211_IS_BROADCAST(_a)  (*(_a) == 0xFF)
+#define WEP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
+#define WEP_TRAILER IEEE80211_WEP_CRCLEN
+#define CCMP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define CCMP_TRAILER IEEE80211_WEP_MICLEN
+#define TKIP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define TKIP_TRAILER IEEE80211_WEP_CRCLEN
+#define TKIP_MICLEN  IEEE80211_WEP_MICLEN
+
+
+#define IEEE80211_ADDR_EQ(addr1, addr2)     \
+    (A_MEMCMP(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
+
+#define IEEE80211_ADDR_COPY(dst,src)    A_MEMCPY(dst,src,IEEE80211_ADDR_LEN)
+
+#define IEEE80211_KEYBUF_SIZE 16
+#define IEEE80211_MICBUF_SIZE (8+8)  /* space for both tx and rx */
+
+/*
+ * NB: these values are ordered carefully; there are lots of
+ * of implications in any reordering.  In particular beware
+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
+ */
+#define IEEE80211_CIPHER_WEP            0
+#define IEEE80211_CIPHER_TKIP           1
+#define IEEE80211_CIPHER_AES_OCB        2
+#define IEEE80211_CIPHER_AES_CCM        3
+#define IEEE80211_CIPHER_CKIP           5
+#define IEEE80211_CIPHER_CCKM_KRK       6
+#define IEEE80211_CIPHER_NONE           7       /* pseudo value */
+
+#define IEEE80211_CIPHER_MAX            (IEEE80211_CIPHER_NONE+1)
+
+#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
+        (((len) == 5) || ((len) == 13) || ((len) == 16))
+
+
+
+/*
+ * generic definitions for IEEE 802.11 frames
+ */
+PREPACK struct ieee80211_frame {
+    A_UINT8    i_fc[2];
+    A_UINT8    i_dur[2];
+    A_UINT8    i_addr1[IEEE80211_ADDR_LEN];
+    A_UINT8    i_addr2[IEEE80211_ADDR_LEN];
+    A_UINT8    i_addr3[IEEE80211_ADDR_LEN];
+    A_UINT8    i_seq[2];
+    /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
+    /* see below */
+} POSTPACK;
+
+PREPACK struct ieee80211_qosframe {
+    A_UINT8 i_fc[2];
+    A_UINT8 i_dur[2];
+    A_UINT8 i_addr1[IEEE80211_ADDR_LEN];
+    A_UINT8 i_addr2[IEEE80211_ADDR_LEN];
+    A_UINT8 i_addr3[IEEE80211_ADDR_LEN];
+    A_UINT8 i_seq[2];
+    A_UINT8 i_qos[2];
+} POSTPACK;
+
+#define IEEE80211_FC0_VERSION_MASK          0x03
+#define IEEE80211_FC0_VERSION_SHIFT         0
+#define IEEE80211_FC0_VERSION_0             0x00
+#define IEEE80211_FC0_TYPE_MASK             0x0c
+#define IEEE80211_FC0_TYPE_SHIFT            2
+#define IEEE80211_FC0_TYPE_MGT              0x00
+#define IEEE80211_FC0_TYPE_CTL              0x04
+#define IEEE80211_FC0_TYPE_DATA             0x08
+
+#define IEEE80211_FC0_SUBTYPE_MASK          0xf0
+#define IEEE80211_FC0_SUBTYPE_SHIFT         4
+/* for TYPE_MGT */
+#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ     0x00
+#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP    0x10
+#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ   0x20
+#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP  0x30
+#define IEEE80211_FC0_SUBTYPE_PROBE_REQ     0x40
+#define IEEE80211_FC0_SUBTYPE_PROBE_RESP    0x50
+#define IEEE80211_FC0_SUBTYPE_BEACON        0x80
+#define IEEE80211_FC0_SUBTYPE_ATIM          0x90
+#define IEEE80211_FC0_SUBTYPE_DISASSOC      0xa0
+#define IEEE80211_FC0_SUBTYPE_AUTH          0xb0
+#define IEEE80211_FC0_SUBTYPE_DEAUTH        0xc0
+/* for TYPE_CTL */
+#define IEEE80211_FC0_SUBTYPE_PS_POLL       0xa0
+#define IEEE80211_FC0_SUBTYPE_RTS           0xb0
+#define IEEE80211_FC0_SUBTYPE_CTS           0xc0
+#define IEEE80211_FC0_SUBTYPE_ACK           0xd0
+#define IEEE80211_FC0_SUBTYPE_CF_END        0xe0
+#define IEEE80211_FC0_SUBTYPE_CF_END_ACK    0xf0
+/* for TYPE_DATA (bit combination) */
+#define IEEE80211_FC0_SUBTYPE_DATA          0x00
+#define IEEE80211_FC0_SUBTYPE_CF_ACK        0x10
+#define IEEE80211_FC0_SUBTYPE_CF_POLL       0x20
+#define IEEE80211_FC0_SUBTYPE_CF_ACPL       0x30
+#define IEEE80211_FC0_SUBTYPE_NODATA        0x40
+#define IEEE80211_FC0_SUBTYPE_CFACK         0x50
+#define IEEE80211_FC0_SUBTYPE_CFPOLL        0x60
+#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
+#define IEEE80211_FC0_SUBTYPE_QOS           0x80
+#define IEEE80211_FC0_SUBTYPE_QOS_NULL      0xc0
+
+#define IEEE80211_FC1_DIR_MASK              0x03
+#define IEEE80211_FC1_DIR_NODS              0x00    /* STA->STA */
+#define IEEE80211_FC1_DIR_TODS              0x01    /* STA->AP  */
+#define IEEE80211_FC1_DIR_FROMDS            0x02    /* AP ->STA */
+#define IEEE80211_FC1_DIR_DSTODS            0x03    /* AP ->AP  */
+
+#define IEEE80211_FC1_MORE_FRAG             0x04
+#define IEEE80211_FC1_RETRY                 0x08
+#define IEEE80211_FC1_PWR_MGT               0x10
+#define IEEE80211_FC1_MORE_DATA             0x20
+#define IEEE80211_FC1_WEP                   0x40
+#define IEEE80211_FC1_ORDER                 0x80
+
+#define IEEE80211_SEQ_FRAG_MASK             0x000f
+#define IEEE80211_SEQ_FRAG_SHIFT            0
+#define IEEE80211_SEQ_SEQ_MASK              0xfff0
+#define IEEE80211_SEQ_SEQ_SHIFT             4
+
+#define IEEE80211_NWID_LEN                  32
+
+/*
+ * 802.11 rate set.
+ */
+#define IEEE80211_RATE_SIZE     8       /* 802.11 standard */
+#define IEEE80211_RATE_MAXSIZE  15      /* max rates we'll handle */
+
+#define WMM_NUM_AC                  4   /* 4 AC categories */
+
+#define WMM_PARAM_ACI_M         0x60    /* Mask for ACI field */
+#define WMM_PARAM_ACI_S         5   /* Shift for ACI field */
+#define WMM_PARAM_ACM_M         0x10    /* Mask for ACM bit */
+#define WMM_PARAM_ACM_S         4       /* Shift for ACM bit */
+#define WMM_PARAM_AIFSN_M       0x0f    /* Mask for aifsn field */
+#define WMM_PARAM_LOGCWMIN_M    0x0f    /* Mask for CwMin field (in log) */
+#define WMM_PARAM_LOGCWMAX_M    0xf0    /* Mask for CwMax field (in log) */
+#define WMM_PARAM_LOGCWMAX_S    4   /* Shift for CwMax field */
+
+#define WMM_AC_TO_TID(_ac) (       \
+    ((_ac) == WMM_AC_VO) ? 6 : \
+    ((_ac) == WMM_AC_VI) ? 5 : \
+    ((_ac) == WMM_AC_BK) ? 1 : \
+    0)
+
+#define TID_TO_WMM_AC(_tid) (      \
+    ((_tid) < 1) ? WMM_AC_BE : \
+    ((_tid) < 3) ? WMM_AC_BK : \
+    ((_tid) < 6) ? WMM_AC_VI : \
+    WMM_AC_VO)
+/*
+ * Management information element payloads.
+ */
+
+enum {
+    IEEE80211_ELEMID_SSID       = 0,
+    IEEE80211_ELEMID_RATES      = 1,
+    IEEE80211_ELEMID_FHPARMS    = 2,
+    IEEE80211_ELEMID_DSPARMS    = 3,
+    IEEE80211_ELEMID_CFPARMS    = 4,
+    IEEE80211_ELEMID_TIM        = 5,
+    IEEE80211_ELEMID_IBSSPARMS  = 6,
+    IEEE80211_ELEMID_COUNTRY    = 7,
+    IEEE80211_ELEMID_CHALLENGE  = 16,
+    /* 17-31 reserved for challenge text extension */
+    IEEE80211_ELEMID_PWRCNSTR   = 32,
+    IEEE80211_ELEMID_PWRCAP     = 33,
+    IEEE80211_ELEMID_TPCREQ     = 34,
+    IEEE80211_ELEMID_TPCREP     = 35,
+    IEEE80211_ELEMID_SUPPCHAN   = 36,
+    IEEE80211_ELEMID_CHANSWITCH = 37,
+    IEEE80211_ELEMID_MEASREQ    = 38,
+    IEEE80211_ELEMID_MEASREP    = 39,
+    IEEE80211_ELEMID_QUIET      = 40,
+    IEEE80211_ELEMID_IBSSDFS    = 41,
+    IEEE80211_ELEMID_ERP        = 42,
+    IEEE80211_ELEMID_HTCAP_ANA  = 45,   /* Address ANA, and non-ANA story, for interop. CL#171733 */
+    IEEE80211_ELEMID_RSN        = 48,
+    IEEE80211_ELEMID_XRATES     = 50,
+    IEEE80211_ELEMID_HTINFO_ANA = 61,
+#ifdef WAPI_ENABLE
+    IEEE80211_ELEMID_WAPI       = 68,
+#endif
+    IEEE80211_ELEMID_TPC        = 150,
+    IEEE80211_ELEMID_CCKM       = 156,
+    IEEE80211_ELEMID_VENDOR     = 221,  /* vendor private */
+};
+
+#define ATH_OUI             0x7f0300        /* Atheros OUI */
+#define ATH_OUI_TYPE        0x01
+#define ATH_OUI_SUBTYPE     0x01
+#define ATH_OUI_VERSION     0x00
+
+#define WPA_OUI             0xf25000
+#define WPA_OUI_TYPE        0x01
+#define WPA_VERSION         1          /* current supported version */
+
+#define WPA_CSE_NULL        0x00
+#define WPA_CSE_WEP40       0x01
+#define WPA_CSE_TKIP        0x02
+#define WPA_CSE_CCMP        0x04
+#define WPA_CSE_WEP104      0x05
+
+#define WPA_ASE_NONE        0x00
+#define WPA_ASE_8021X_UNSPEC    0x01
+#define WPA_ASE_8021X_PSK   0x02
+
+#define RSN_OUI         0xac0f00
+#define RSN_VERSION     1       /* current supported version */
+
+#define RSN_CSE_NULL        0x00
+#define RSN_CSE_WEP40       0x01
+#define RSN_CSE_TKIP        0x02
+#define RSN_CSE_WRAP        0x03
+#define RSN_CSE_CCMP        0x04
+#define RSN_CSE_WEP104      0x05
+
+#define RSN_ASE_NONE            0x00
+#define RSN_ASE_8021X_UNSPEC    0x01
+#define RSN_ASE_8021X_PSK       0x02
+
+#define RSN_CAP_PREAUTH         0x01
+
+#define WMM_OUI                 0xf25000
+#define WMM_OUI_TYPE            0x02
+#define WMM_INFO_OUI_SUBTYPE    0x00
+#define WMM_PARAM_OUI_SUBTYPE   0x01
+#define WMM_VERSION             1
+
+/* WMM stream classes */
+#define WMM_NUM_AC  4
+#define WMM_AC_BE   0       /* best effort */
+#define WMM_AC_BK   1       /* background */
+#define WMM_AC_VI   2       /* video */
+#define WMM_AC_VO   3       /* voice */
+
+/* TSPEC related */
+#define ACTION_CATEGORY_CODE_TSPEC                 17
+#define ACTION_CODE_TSPEC_ADDTS                    0
+#define ACTION_CODE_TSPEC_ADDTS_RESP               1
+#define ACTION_CODE_TSPEC_DELTS                    2
+
+typedef enum {
+    TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
+    TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
+    TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
+    TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
+    TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
+    TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
+    TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
+    TSPEC_STATUS_CODE_DELTS_SENT    = 0x30,
+    TSPEC_STATUS_CODE_DELTS_RECV    = 0x31,
+} TSPEC_STATUS_CODE;
+
+#define TSPEC_TSID_MASK             0xF
+#define TSPEC_TSID_S                1
+
+/*
+ * WMM/802.11e Tspec Element
+ */
+typedef PREPACK struct wmm_tspec_ie_t {
+    A_UINT8     elementId;
+    A_UINT8     len;
+    A_UINT8     oui[3];
+    A_UINT8     ouiType;
+    A_UINT8     ouiSubType;
+    A_UINT8     version;
+    A_UINT16    tsInfo_info;
+    A_UINT8     tsInfo_reserved;
+    A_UINT16    nominalMSDU;
+    A_UINT16    maxMSDU;
+    A_UINT32    minServiceInt;
+    A_UINT32    maxServiceInt;
+    A_UINT32    inactivityInt;
+    A_UINT32    suspensionInt;
+    A_UINT32    serviceStartTime;
+    A_UINT32    minDataRate;
+    A_UINT32    meanDataRate;
+    A_UINT32    peakDataRate;
+    A_UINT32    maxBurstSize;
+    A_UINT32    delayBound;
+    A_UINT32    minPhyRate;
+    A_UINT16    sba;
+    A_UINT16    mediumTime;
+} POSTPACK WMM_TSPEC_IE;
+
+
+/*
+ * BEACON management packets
+ *
+ *  octet timestamp[8]
+ *  octet beacon interval[2]
+ *  octet capability information[2]
+ *  information element
+ *      octet elemid
+ *      octet length
+ *      octet information[length]
+ */
+
+#define IEEE80211_BEACON_INTERVAL(beacon) \
+    ((beacon)[8] | ((beacon)[9] << 8))
+#define IEEE80211_BEACON_CAPABILITY(beacon) \
+    ((beacon)[10] | ((beacon)[11] << 8))
+
+#define IEEE80211_CAPINFO_ESS               0x0001
+#define IEEE80211_CAPINFO_IBSS              0x0002
+#define IEEE80211_CAPINFO_CF_POLLABLE       0x0004
+#define IEEE80211_CAPINFO_CF_POLLREQ        0x0008
+#define IEEE80211_CAPINFO_PRIVACY           0x0010
+#define IEEE80211_CAPINFO_SHORT_PREAMBLE    0x0020
+#define IEEE80211_CAPINFO_PBCC              0x0040
+#define IEEE80211_CAPINFO_CHNL_AGILITY      0x0080
+/* bits 8-9 are reserved */
+#define IEEE80211_CAPINFO_SHORT_SLOTTIME    0x0400
+#define IEEE80211_CAPINFO_APSD              0x0800
+/* bit 12 is reserved */
+#define IEEE80211_CAPINFO_DSSSOFDM          0x2000
+/* bits 14-15 are reserved */
+
+/*
+ * Authentication Modes
+ */
+
+enum ieee80211_authmode {
+    IEEE80211_AUTH_NONE     = 0,
+    IEEE80211_AUTH_OPEN     = 1,
+    IEEE80211_AUTH_SHARED   = 2,
+    IEEE80211_AUTH_8021X    = 3,
+    IEEE80211_AUTH_AUTO     = 4,   /* auto-select/accept */
+    /* NB: these are used only for ioctls */
+    IEEE80211_AUTH_WPA      = 5,  /* WPA/RSN  w/ 802.1x */
+    IEEE80211_AUTH_WPA_PSK  = 6,  /* WPA/RSN  w/ PSK */
+    IEEE80211_AUTH_WPA_CCKM = 7,  /* WPA/RSN IE  w/ CCKM */
+};
+
+#define IEEE80211_PS_MAX_QUEUE    50 /*Maximum no of buffers that can be queues for PS*/
+
+//#include "athendpack.h"
+
+#endif /* _NET80211_IEEE80211_H_ */
diff --git a/ath6kl-wmiconfig/include/ieee80211_ioctl.h b/ath6kl-wmiconfig/include/ieee80211_ioctl.h
new file mode 100755
index 0000000..c0ff150
--- /dev/null
+++ b/ath6kl-wmiconfig/include/ieee80211_ioctl.h
@@ -0,0 +1,164 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef _IEEE80211_IOCTL_H_
+#define _IEEE80211_IOCTL_H_
+
+#include <linux/version.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
+ */
+
+/*
+ * WPA/RSN get/set key request.  Specify the key/cipher
+ * type and whether the key is to be used for sending and/or
+ * receiving.  The key index should be set only when working
+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
+ * Otherwise a unicast/pairwise key is specified by the bssid
+ * (on a station) or mac address (on an ap).  They key length
+ * must include any MIC key data; otherwise it should be no
+ more than IEEE80211_KEYBUF_SIZE.
+ */
+struct ieee80211req_key {
+    u_int8_t    ik_type;    /* key/cipher type */
+    u_int8_t    ik_pad;
+    u_int16_t   ik_keyix;   /* key index */
+    u_int8_t    ik_keylen;  /* key length in bytes */
+    u_int8_t    ik_flags;
+#define IEEE80211_KEY_XMIT  0x01
+#define IEEE80211_KEY_RECV  0x02
+#define IEEE80211_KEY_DEFAULT   0x80    /* default xmit key */
+    u_int8_t    ik_macaddr[IEEE80211_ADDR_LEN];
+    u_int64_t   ik_keyrsc;  /* key receive sequence counter */
+    u_int64_t   ik_keytsc;  /* key transmit sequence counter */
+    u_int8_t    ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
+};
+/*
+ * Delete a key either by index or address.  Set the index
+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
+ */
+struct ieee80211req_del_key {
+    u_int8_t    idk_keyix;  /* key index */
+    u_int8_t    idk_macaddr[IEEE80211_ADDR_LEN];
+};
+/*
+ * MLME state manipulation request.  IEEE80211_MLME_ASSOC
+ * only makes sense when operating as a station.  The other
+ * requests can be used when operating as a station or an
+ * ap (to effect a station).
+ */
+struct ieee80211req_mlme {
+    u_int8_t    im_op;      /* operation to perform */
+#define IEEE80211_MLME_ASSOC        1   /* associate station */
+#define IEEE80211_MLME_DISASSOC     2   /* disassociate station */
+#define IEEE80211_MLME_DEAUTH       3   /* deauthenticate station */
+#define IEEE80211_MLME_AUTHORIZE    4   /* authorize station */
+#define IEEE80211_MLME_UNAUTHORIZE  5   /* unauthorize station */
+    u_int16_t   im_reason;  /* 802.11 reason code */
+    u_int8_t    im_macaddr[IEEE80211_ADDR_LEN];
+};
+
+struct ieee80211req_addpmkid {
+    u_int8_t    pi_bssid[IEEE80211_ADDR_LEN];
+    u_int8_t    pi_enable;
+    u_int8_t    pi_pmkid[16];
+};
+
+#define AUTH_ALG_OPEN_SYSTEM    0x01
+#define AUTH_ALG_SHARED_KEY 0x02
+#define AUTH_ALG_LEAP       0x04
+
+struct ieee80211req_authalg {
+   u_int8_t auth_alg;
+};  
+
+/* 
+ * Request to add an IE to a Management Frame
+ */
+enum{
+    IEEE80211_APPIE_FRAME_BEACON     = 0,
+    IEEE80211_APPIE_FRAME_PROBE_REQ  = 1,
+    IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
+    IEEE80211_APPIE_FRAME_ASSOC_REQ  = 3,
+    IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
+    IEEE80211_APPIE_NUM_OF_FRAME     = 5
+};
+
+/*
+ * The Maximum length of the IE that can be added to a Management frame
+ */
+#define IEEE80211_APPIE_FRAME_MAX_LEN  200
+
+struct ieee80211req_getset_appiebuf {
+    u_int32_t app_frmtype; /* management frame type for which buffer is added */
+    u_int32_t app_buflen;  /*application supplied buffer length */
+    u_int8_t  app_buf[];
+};
+
+/* 
+ * The following definitions are used by an application to set filter
+ * for receiving management frames 
+ */
+enum {
+     IEEE80211_FILTER_TYPE_BEACON      =   0x1,
+     IEEE80211_FILTER_TYPE_PROBE_REQ   =   0x2,
+     IEEE80211_FILTER_TYPE_PROBE_RESP  =   0x4,
+     IEEE80211_FILTER_TYPE_ASSOC_REQ   =   0x8,
+     IEEE80211_FILTER_TYPE_ASSOC_RESP  =   0x10,
+     IEEE80211_FILTER_TYPE_AUTH        =   0x20,
+     IEEE80211_FILTER_TYPE_DEAUTH      =   0x40,
+     IEEE80211_FILTER_TYPE_DISASSOC    =   0x80,
+     IEEE80211_FILTER_TYPE_ALL         =   0xFF  /* used to check the valid filter bits */
+};
+
+struct ieee80211req_set_filter {
+      u_int32_t app_filterype; /* management frame filter type */
+};
+
+enum {
+    IEEE80211_PARAM_AUTHMODE = 3,   /* Authentication Mode */
+    IEEE80211_PARAM_MCASTCIPHER = 5,
+    IEEE80211_PARAM_MCASTKEYLEN = 6,    /* multicast key length */
+    IEEE80211_PARAM_UCASTCIPHER = 8,
+    IEEE80211_PARAM_UCASTKEYLEN = 9,    /* unicast key length */
+    IEEE80211_PARAM_WPA     = 10,   /* WPA mode (0,1,2) */
+    IEEE80211_PARAM_ROAMING     = 12,   /* roaming mode */
+    IEEE80211_PARAM_PRIVACY     = 13,   /* privacy invoked */
+    IEEE80211_PARAM_COUNTERMEASURES = 14,   /* WPA/TKIP countermeasures */
+    IEEE80211_PARAM_DROPUNENCRYPTED = 15,   /* discard unencrypted frames */
+    IEEE80211_PARAM_WAPI = 16,   /* WAPI policy from wapid */        
+};
+
+/*
+ * Values for IEEE80211_PARAM_WPA
+ */
+#define WPA_MODE_WPA1   1
+#define WPA_MODE_WPA2   2
+#define WPA_MODE_AUTO   3
+#define WPA_MODE_NONE   4
+
+struct ieee80211req_wpaie {
+    u_int8_t    wpa_macaddr[IEEE80211_ADDR_LEN];
+    u_int8_t    wpa_ie[IEEE80211_MAX_IE];
+    u_int8_t    rsn_ie[IEEE80211_MAX_IE];
+};
+
+#ifndef IW_ENCODE_ALG_PMK
+#define IW_ENCODE_ALG_PMK       4
+#endif
+#ifndef IW_ENCODE_ALG_KRK
+#define IW_ENCODE_ALG_KRK       6
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _IEEE80211_IOCTL_H_ */
diff --git a/ath6kl-wmiconfig/include/osapi_linux.h b/ath6kl-wmiconfig/include/osapi_linux.h
new file mode 100755
index 0000000..feb84d0
--- /dev/null
+++ b/ath6kl-wmiconfig/include/osapi_linux.h
@@ -0,0 +1,377 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+//------------------------------------------------------------------------------
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _OSAPI_LINUX_H_
+#define _OSAPI_LINUX_H_
+
+#ifdef __KERNEL__
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/device.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+#include <linux/ethtool.h>
+#endif
+/*************************************/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+#include <linux/jiffies.h>
+#endif
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#ifdef KERNEL_2_4
+#include <asm/arch/irq.h>
+#include <asm/irq.h>
+#endif
+
+#include <linux/cache.h>
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+/*
+ * Endianes macros
+ */
+#define A_BE2CPU8(x)       ntohb(x)
+#define A_BE2CPU16(x)      ntohs(x)
+#define A_BE2CPU32(x)      ntohl(x)
+
+#define A_LE2CPU8(x)       (x)
+#define A_LE2CPU16(x)      (x)
+#define A_LE2CPU32(x)      (x)
+
+#define A_CPU2BE8(x)       htonb(x)
+#define A_CPU2BE16(x)      htons(x)
+#define A_CPU2BE32(x)      htonl(x)
+
+#define A_MEMCPY(dst, src, len)         memcpy((A_UINT8 *)(dst), (src), (len))
+#define A_MEMZERO(addr, len)            memset(addr, 0, len)
+#define A_MEMCMP(addr1, addr2, len)     memcmp((addr1), (addr2), (len))
+
+#ifdef AR6K_ALLOC_DEBUG
+#define a_meminfo_add(p, s)  __a_meminfo_add(p, s, __func__, __LINE)
+void __a_meminfo_add(void *ptr, size_t msize, const char *func, int lineno);
+void  a_meminfo_del(void *ptr);
+void* a_mem_alloc(size_t msize, int type, const char *func, int lineno);
+void a_mem_free(void *ptr);
+void a_meminfo_report(int clear);
+A_BOOL a_meminfo_find(void *ptr);
+#define A_MALLOC(size)                  a_mem_alloc((size), GFP_KERNEL, __func__, __LINE__)
+#define A_MALLOC_NOWAIT(size)           a_mem_alloc((size), GFP_ATOMIC, __func__, __LINE__)
+#define A_FREE(addr)                    a_mem_free(addr)
+#define A_NETIF_RX(skb)                 do { a_meminfo_del(skb);  netif_rx(skb); } while (0)
+#define A_NETIF_RX_NI(skb)              do { a_meminfo_del(skb);  netif_rx_ni(skb); } while (0)
+#else
+#define a_meminfo_report(_c)
+#define A_MALLOC(size)                  kmalloc((size), GFP_KERNEL)
+#define A_MALLOC_NOWAIT(size)           kmalloc((size), GFP_ATOMIC)
+#define A_FREE(addr)                    kfree(addr)
+#define A_NETIF_RX(skb)                 netif_rx(skb)
+#define A_NETIF_RX_NI(skb)              netif_rx_ni(skb)
+#endif
+
+#if defined(ANDROID_ENV) && defined(CONFIG_ANDROID_LOGGER)
+extern unsigned int enablelogcat;
+extern int android_logger_lv(void* module, int mask);
+enum logidx { LOG_MAIN_IDX = 0 };
+extern int logger_write(const enum logidx idx, 
+                const unsigned char prio,
+                const char __kernel * const tag,
+                const char __kernel * const fmt,
+                ...);
+#define A_ANDROID_PRINTF(mask, module, tags, args...) do {  \
+    if (enablelogcat) \
+        logger_write(LOG_MAIN_IDX, android_logger_lv(module, mask), tags, args); \
+    else \
+        printk(KERN_ALERT args); \
+} while (0)
+#ifdef DEBUG
+#define A_LOGGER_MODULE_NAME(x) #x
+#define A_LOGGER(mask, mod, args...) \
+    A_ANDROID_PRINTF(mask, &GET_ATH_MODULE_DEBUG_VAR_NAME(mod), "ar6k_" A_LOGGER_MODULE_NAME(mod), args);
+#endif 
+#define A_PRINTF(args...) A_ANDROID_PRINTF(ATH_DEBUG_INFO, NULL, "ar6k_driver", args)
+#else
+#define A_LOGGER(mask, mod, args...)    printk(KERN_ALERT args)
+#define A_PRINTF(args...)               printk(KERN_ALERT args)
+#endif /* ANDROID */
+#define A_PRINTF_LOG(args...)           printk(args)
+#define A_SPRINTF(buf, args...)			sprintf (buf, args)
+
+/* Mutual Exclusion */
+typedef spinlock_t                      A_MUTEX_T;
+#define A_MUTEX_INIT(mutex)             spin_lock_init(mutex)
+#define A_MUTEX_LOCK(mutex)             spin_lock_bh(mutex)
+#define A_MUTEX_UNLOCK(mutex)           spin_unlock_bh(mutex)
+#define A_IS_MUTEX_VALID(mutex)         TRUE  /* okay to return true, since A_MUTEX_DELETE does nothing */
+#define A_MUTEX_DELETE(mutex)           /* spin locks are not kernel resources so nothing to free.. */
+
+/* Get current time in ms adding a constant offset (in ms) */
+#define A_GET_MS(offset)    \
+	(((jiffies / HZ) * 1000) + (offset))
+
+/*
+ * Timer Functions
+ */
+#define A_MDELAY(msecs)                 mdelay(msecs)
+typedef struct timer_list               A_TIMER;
+
+#define A_INIT_TIMER(pTimer, pFunction, pArg) do {              \
+    init_timer(pTimer);                                         \
+    (pTimer)->function = (pFunction);                           \
+    (pTimer)->data   = (unsigned long)(pArg);                   \
+} while (0)
+
+/*
+ * Start a Timer that elapses after 'periodMSec' milli-seconds
+ * Support is provided for a one-shot timer. The 'repeatFlag' is
+ * ignored.
+ */
+#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do {                   \
+    if (repeatFlag) {                                                       \
+        printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__);     \
+        panic("Timer Repeat");                                              \
+    }                                                                       \
+    mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000);                \
+} while (0)
+
+/*
+ * Cancel the Timer. 
+ */
+#define A_UNTIMEOUT(pTimer) do {                                \
+    del_timer((pTimer));                                        \
+} while (0)
+
+#define A_DELETE_TIMER(pTimer) do {                             \
+} while (0)
+
+define A_WAKE_UP(head)                 wake_up(head)
+
+#ifdef DEBUG
+extern unsigned int panic_on_assert;
+#define A_ASSERT(expr)  \
+    if (!(expr)) {   \
+        printk(KERN_ALERT"Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#expr); \
+        if (panic_on_assert) panic(#expr);                                                               \
+    }
+#else
+#define A_ASSERT(expr)
+#endif /* DEBUG */
+
+#ifdef ANDROID_ENV
+struct firmware;
+int android_request_firmware(const struct firmware **firmware_p, const char *filename,
+                     struct device *device);
+void android_release_firmware(const struct firmware *firmware);
+#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) android_request_firmware(_ppf, _pfile, _dev)
+#define A_RELEASE_FIRMWARE(_pf) android_release_firmware(_pf)
+#else
+#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) request_firmware(_ppf, _pfile, _dev)
+#define A_RELEASE_FIRMWARE(_pf) release_firmware(_pf)
+#endif 
+
+/*
+ * Initialization of the network buffer subsystem
+ */
+#define A_NETBUF_INIT()
+
+/*
+ * Network buffer queue support
+ */
+typedef struct sk_buff_head A_NETBUF_QUEUE_T;
+
+#define A_NETBUF_QUEUE_INIT(q)  \
+    a_netbuf_queue_init(q)
+
+#define A_NETBUF_ENQUEUE(q, pkt) \
+    a_netbuf_enqueue((q), (pkt))
+#define A_NETBUF_PREQUEUE(q, pkt) \
+    a_netbuf_prequeue((q), (pkt))
+#define A_NETBUF_DEQUEUE(q) \
+    (a_netbuf_dequeue(q))
+#define A_NETBUF_QUEUE_SIZE(q)  \
+    a_netbuf_queue_size(q)
+#define A_NETBUF_QUEUE_EMPTY(q) \
+    a_netbuf_queue_empty(q)
+
+/*
+ * Network buffer support
+ */
+#ifdef AR6K_ALLOC_DEBUG
+#define A_NETBUF_ALLOC(size) \
+    a_netbuf_alloc(size, __func__, __LINE__)
+#define A_NETBUF_ALLOC_RAW(size) \
+    a_netbuf_alloc_raw(size, __func__, __LINE__)
+#define A_NETBUF_CHECK(bufPtr) \
+    a_netbuf_check(bufPtr, __func__, __LINE__)
+#else
+#define A_NETBUF_ALLOC(size) \
+    a_netbuf_alloc(size)
+#define A_NETBUF_ALLOC_RAW(size) \
+    a_netbuf_alloc_raw(size)
+#endif /* AR6K_ALLOC_DEBUG */
+#define A_NETBUF_FREE(bufPtr) \
+    a_netbuf_free(bufPtr)
+#define A_NETBUF_DATA(bufPtr) \
+    a_netbuf_to_data(bufPtr)
+#define A_NETBUF_LEN(bufPtr) \
+    a_netbuf_to_len(bufPtr)
+#define A_NETBUF_PUSH(bufPtr, len) \
+    a_netbuf_push(bufPtr, len)
+#define A_NETBUF_PUT(bufPtr, len) \
+    a_netbuf_put(bufPtr, len)
+#define A_NETBUF_TRIM(bufPtr,len) \
+    a_netbuf_trim(bufPtr, len)
+#define A_NETBUF_PULL(bufPtr, len) \
+    a_netbuf_pull(bufPtr, len)
+#define A_NETBUF_HEADROOM(bufPtr)\
+    a_netbuf_headroom(bufPtr)
+#define A_NETBUF_SETLEN(bufPtr,len) \
+    a_netbuf_setlen(bufPtr, len)
+
+/* Add data to end of a buffer  */
+#define A_NETBUF_PUT_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_put_data(bufPtr, srcPtr, len) 
+
+/* Add data to start of the  buffer */
+#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_push_data(bufPtr, srcPtr, len) 
+
+/* Remove data at start of the buffer */
+#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_pull_data(bufPtr, dstPtr, len) 
+
+/* Remove data from the end of the buffer */
+#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_trim_data(bufPtr, dstPtr, len) 
+
+/* View data as "size" contiguous bytes of type "t" */
+#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
+    (t )( ((struct skbuf *)(bufPtr))->data)
+
+/* return the beginning of the headroom for the buffer */
+#define A_NETBUF_HEAD(bufPtr) \
+        ((((struct sk_buff *)(bufPtr))->head))
+    
+/*
+ * OS specific network buffer access routines
+ */
+#ifdef AR6K_ALLOC_DEBUG
+void *a_netbuf_alloc(int size, const char *func, int lineno);
+void *a_netbuf_alloc_raw(int size, const char *func, int lineno);
+void a_netbuf_check(void *bufPtr, const char *func, int lineno); 
+#else
+void *a_netbuf_alloc(int size);
+void *a_netbuf_alloc_raw(int size);
+#endif
+void a_netbuf_free(void *bufPtr);
+void *a_netbuf_to_data(void *bufPtr);
+A_UINT32 a_netbuf_to_len(void *bufPtr);
+A_STATUS a_netbuf_push(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len);
+A_STATUS a_netbuf_put(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len);
+A_STATUS a_netbuf_pull(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len);
+A_STATUS a_netbuf_trim(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len);
+A_STATUS a_netbuf_setlen(void *bufPtr, A_INT32 len);
+A_INT32 a_netbuf_headroom(void *bufPtr);
+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
+
+/*
+ * Kernel v.s User space functions
+ */
+A_UINT32 a_copy_to_user(void *to, const void *from, A_UINT32 n);
+A_UINT32 a_copy_from_user(void *to, const void *from, A_UINT32 n);
+
+/* In linux, WLAN Rx and Tx run in different contexts, so no need to check
+ * for any commands/data queued for WLAN */
+#define A_CHECK_DRV_TX()   
+             
+#define A_GET_CACHE_LINE_BYTES()    L1_CACHE_BYTES
+
+#define A_CACHE_LINE_PAD            128
+
+static inline void *A_ALIGN_TO_CACHE_LINE(void *ptr) {   
+    return (void *)L1_CACHE_ALIGN((unsigned long)ptr);
+}
+   
+#else /* __KERNEL__ */
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+#define A_MEMCPY(dst, src, len)         memcpy((dst), (src), (len))
+#define A_MEMZERO(addr, len)            memset((addr), 0, (len))
+#define A_MEMCMP(addr1, addr2, len)     memcmp((addr1), (addr2), (len))
+#define A_MALLOC(size)                  malloc(size)
+#define A_FREE(addr)                    free(addr)
+
+#ifdef ANDROID
+#ifndef err
+#include <errno.h>
+#define err(_s, args...) do { \
+    fprintf(stderr, "%s: line %d ", __FILE__, __LINE__); \
+    fprintf(stderr, args); fprintf(stderr, ": %d\n", errno); \
+    exit(_s); } while (0)
+#endif
+#else
+#include <err.h>
+#endif
+
+#endif /* __KERNEL__ */
+
+#endif /* _OSAPI_LINUX_H_ */
diff --git a/ath6kl-wmiconfig/include/pkt_log.h b/ath6kl-wmiconfig/include/pkt_log.h
new file mode 100755
index 0000000..a542a91
--- /dev/null
+++ b/ath6kl-wmiconfig/include/pkt_log.h
@@ -0,0 +1,29 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef __PKT_LOG_H__
+#define __PKT_LOG_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* Pkt log info */
+typedef PREPACK struct pkt_log_t {
+    struct info_t {
+        A_UINT16    st;
+        A_UINT16    end;
+        A_UINT16    cur;
+    }info[4096];
+    A_UINT16    last_idx;
+}POSTPACK PACKET_LOG;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif  /* __PKT_LOG_H__ */
diff --git a/ath6kl-wmiconfig/include/testcmd.h b/ath6kl-wmiconfig/include/testcmd.h
new file mode 100755
index 0000000..20f58c9
--- /dev/null
+++ b/ath6kl-wmiconfig/include/testcmd.h
@@ -0,0 +1,263 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+#ifndef  TESTCMD_H_
+#define  TESTCMD_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef AR6002_REV2
+#define TCMD_MAX_RATES 12
+#else
+#define TCMD_MAX_RATES 28
+#endif
+
+#define WMI_CMD_ID_SIZE   4
+#define WMI_CMDS_SIZE_MAX 2048
+#define TC_CMDS_GAP       16
+// should add up to the same size as buf[WMI_CMDS_SIZE_MAX]
+//#define TC_CMDS_SIZE_MAX  (WMI_CMDS_SIZE_MAX - sizeof(TC_CMDS_HDR) - WMI_CMD_ID_SIZE - TC_CMDS_GAP)  
+#define TC_CMDS_SIZE_MAX  256
+
+typedef enum {
+    ZEROES_PATTERN = 0,
+    ONES_PATTERN,
+    REPEATING_10,
+    PN7_PATTERN,
+    PN9_PATTERN,
+    PN15_PATTERN
+}TX_DATA_PATTERN;
+
+/* Continous tx
+   mode : TCMD_CONT_TX_OFF - Disabling continous tx
+          TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
+          TCMD_CONT_TX_FRAME- Enable continuous modulated tx
+   freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
+dataRate: 0 - 1 Mbps
+          1 - 2 Mbps
+          2 - 5.5 Mbps
+          3 - 11 Mbps
+          4 - 6 Mbps
+          5 - 9 Mbps
+          6 - 12 Mbps
+          7 - 18 Mbps
+          8 - 24 Mbps
+          9 - 36 Mbps
+         10 - 28 Mbps
+         11 - 54 Mbps
+  txPwr: twice the Tx power in dBm, actual dBm values of [5 -11] for unmod Tx,
+      [5-14] for mod Tx
+antenna:  1 - one antenna
+          2 - two antenna
+Note : Enable/disable continuous tx test cmd works only when target is awake.
+*/
+
+typedef enum {
+    TCMD_CONT_TX_OFF = 0,
+    TCMD_CONT_TX_SINE,
+    TCMD_CONT_TX_FRAME,
+    TCMD_CONT_TX_TX99,
+    TCMD_CONT_TX_TX100
+} TCMD_CONT_TX_MODE;
+
+typedef enum {
+    TCMD_WLAN_MODE_NOHT = 0,
+    TCMD_WLAN_MODE_HT20 = 1,
+    TCMD_WLAN_MODE_HT40PLUS = 2,
+    TCMD_WLAN_MODE_HT40MINUS = 3,
+    TCMD_WLAN_MODE_CCK = 4,
+
+    TCMD_WLAN_MODE_MAX,
+    TCMD_WLAN_MODE_INVALID = TCMD_WLAN_MODE_MAX,
+
+} TCMD_WLAN_MODE;
+
+typedef enum {
+    TPC_TX_PWR = 0,
+    TPC_FORCED_GAIN,
+    TPC_TGT_PWR
+} TPC_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32                testCmdId;
+    A_UINT32                mode;
+    A_UINT32                freq;
+    A_UINT32                dataRate;
+    A_INT32                 txPwr;
+    A_UINT32                antenna;
+    A_UINT32                enANI;
+    A_UINT32                scramblerOff;
+    A_UINT32                aifsn;
+    A_UINT16                pktSz;
+    A_UINT16                txPattern;
+    A_UINT32                shortGuard;
+    A_UINT32                numPackets;
+    A_UINT32                wlanMode;
+    A_UINT32                tpcm;
+} POSTPACK TCMD_CONT_TX;
+
+#define TCMD_TXPATTERN_ZERONE                 0x1
+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE    0x2
+
+/* Continuous Rx
+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
+      TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
+                                             address equal specified
+                                             mac address (set via act =3)
+      TCMD_CONT_RX_REPORT  off mode  (disable cont rx mode and get the
+                                          report from the last cont
+                                          Rx test)
+
+     TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
+                                                 target. This Overrides
+                                                 the default MAC address.)
+
+*/
+typedef enum {
+    TCMD_CONT_RX_PROMIS =0,
+    TCMD_CONT_RX_FILTER,
+    TCMD_CONT_RX_REPORT,
+    TCMD_CONT_RX_SETMAC,
+    TCMD_CONT_RX_SET_ANT_SWITCH_TABLE,
+ 
+    TC_CMD_RESP,
+} TCMD_CONT_RX_ACT;
+
+typedef PREPACK struct {
+    A_UINT32        testCmdId;
+    A_UINT32        act;
+    A_UINT32        enANI;
+    PREPACK union {
+        struct PREPACK TCMD_CONT_RX_PARA {
+            A_UINT32    freq;
+            A_UINT32    antenna;
+            A_UINT32    wlanMode;
+        } POSTPACK para;
+        struct PREPACK TCMD_CONT_RX_REPORT {
+            A_UINT32    totalPkt;
+            A_INT32     rssiInDBm;
+            A_UINT32    crcErrPkt;
+            A_UINT32    secErrPkt;
+            A_UINT16    rateCnt[TCMD_MAX_RATES];
+            A_UINT16    rateCntShortGuard[TCMD_MAX_RATES];
+        } POSTPACK report;
+        struct PREPACK TCMD_CONT_RX_MAC {
+            A_UCHAR     addr[ATH_MAC_LEN];			
+            A_UCHAR     btaddr[ATH_MAC_LEN];     
+            A_UINT16    regDmn[2];			
+            A_UINT32    otpWriteFlag;    			
+        } POSTPACK mac;
+        struct PREPACK TCMD_CONT_RX_ANT_SWITCH_TABLE {
+            A_UINT32                antswitch1;
+            A_UINT32                antswitch2;
+        }POSTPACK antswitchtable;
+    } POSTPACK u;
+} POSTPACK TCMD_CONT_RX;
+
+/* Force sleep/wake  test cmd
+ mode: TCMD_PM_WAKEUP - Wakeup the target
+       TCMD_PM_SLEEP - Force the target to sleep.
+ */
+typedef enum {
+    TCMD_PM_WAKEUP = 1, /* be consistent with target */
+    TCMD_PM_SLEEP,
+    TCMD_PM_DEEPSLEEP
+} TCMD_PM_MODE;
+
+typedef PREPACK struct {
+    A_UINT32  testCmdId;
+    A_UINT32  mode;
+} POSTPACK TCMD_PM;
+
+typedef enum {
+    TC_CMDS_VERSION_RESERVED=0,
+    TC_CMDS_VERSION_MDK,
+    TC_CMDS_VERSION_TS,
+    TC_CMDS_VERSION_LAST,
+} TC_CMDS_VERSION;
+
+typedef enum {
+    TC_CMDS_TS =0,
+    TC_CMDS_CAL,
+    TC_CMDS_TPCCAL = TC_CMDS_CAL,
+    TC_CMDS_TPCCAL_WITH_OTPWRITE,
+    TC_CMDS_OTPDUMP,
+    TC_CMDS_OTPSTREAMWRITE,    
+    TC_CMDS_EFUSEDUMP,    
+    TC_CMDS_EFUSEWRITE,    
+    TC_CMDS_READTHERMAL,
+} TC_CMDS_ACT;
+
+typedef PREPACK struct {
+    A_UINT32   testCmdId;
+    A_UINT32   act;
+    PREPACK union {
+        A_UINT32  enANI;    // to be identical to CONT_RX struct
+        struct PREPACK {
+            A_UINT16   length;
+            A_UINT8    version;
+            A_UINT8    bufLen;
+        } POSTPACK parm;
+    } POSTPACK u;
+} POSTPACK TC_CMDS_HDR;
+
+typedef PREPACK struct {
+    TC_CMDS_HDR  hdr;
+    A_UINT8      buf[TC_CMDS_SIZE_MAX];
+} POSTPACK TC_CMDS;
+
+typedef PREPACK struct {
+    A_UINT32    testCmdId;
+    A_UINT32    regAddr;
+    A_UINT32    val;
+    A_UINT16    flag;
+} POSTPACK TCMD_SET_REG;
+
+typedef enum {
+    TCMD_CONT_TX_ID,
+    TCMD_CONT_RX_ID,
+    TCMD_PM_ID,
+    TC_CMDS_ID,
+    TCMD_SET_REG_ID,
+	
+	/*For synergy purpose we added the following tcmd id but these
+	tcmd's will not go to the firmware instead we will write values 
+	to the NV area */
+	
+	TCMD_NIC_MAC = 100, 
+	TCMD_CAL_FILE_INDEX = 101,
+} TCMD_ID;
+
+typedef PREPACK struct 
+{
+    A_UINT32  testCmdId;
+    A_UINT8   mac_address[ATH_MAC_LEN];
+} POSTPACK TCMD_NIC_MAC_S;
+
+typedef PREPACK struct 
+{
+       A_UINT32  testCmdId;
+       A_UINT32   cal_file_index;
+} POSTPACK TCMD_CAL_FILE_INDEX_S;
+
+typedef PREPACK union {
+          TCMD_CONT_TX         contTx;
+          TCMD_CONT_RX         contRx;
+          TCMD_PM              pm;
+          // New test cmds from ART/MDK ...
+          TC_CMDS              tcCmds;          
+          TCMD_SET_REG setReg;
+} POSTPACK TEST_CMD;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TESTCMD_H_ */
+
+
diff --git a/ath6kl-wmiconfig/include/wmi.h b/ath6kl-wmiconfig/include/wmi.h
new file mode 100755
index 0000000..8655a85
--- /dev/null
+++ b/ath6kl-wmiconfig/include/wmi.h
@@ -0,0 +1,4838 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all the
+ * commands and events. Commands are messages from the host to the WM.
+ * Events and Replies are messages from the WM to the host.
+ *
+ * Ownership of correctness in regards to commands
+ * belongs to the host driver and the WMI is not required to validate
+ * parameters for value, proper range, or any other checking.
+ *
+ */
+
+#ifndef _WMI_H_
+#define _WMI_H_
+
+#ifndef ATH_TARGET
+//#include "athstartpack.h"
+#endif
+
+//#include "wmix.h"
+//#include "wlan_defs.h"
+//#include "dfs_common.h"
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define HTC_PROTOCOL_VERSION    0x0002
+#define HTC_PROTOCOL_REVISION   0x0000
+
+#define WMI_PROTOCOL_VERSION    0x0002
+#define WMI_PROTOCOL_REVISION   0x0000
+
+#define ATH_MAC_LEN             6               /* length of mac in bytes */
+#define WMI_CMD_MAX_LEN         100
+#define WMI_CONTROL_MSG_MAX_LEN     256
+#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
+#define IS_ETHERTYPE(_typeOrLen)        ((_typeOrLen) >= 0x0600)
+#define RFC1042OUI      {0x00, 0x00, 0x00}
+
+#define IP_ETHERTYPE 0x0800
+
+#define WMI_IMPLICIT_PSTREAM 0xFF
+#define WMI_MAX_THINSTREAM 15
+
+#ifdef AR6002_REV2
+#define IBSS_MAX_NUM_STA          4
+#else
+#define IBSS_MAX_NUM_STA          8
+#endif
+
+#define WMI_MODE_MAX              8
+#define WMI_MAX_RATE_MASK         2
+#define WMI_NETWORK_TYPE(networkType) ((networkType) & 0x000F)
+#define WMI_CONNECTED_PHYMODE(networkType) (((networkType) & 0x0F00) >> 8)
+
+/* Max rates we'll handle */
+#define WMI_RATE_MAXSIZE       15
+/*
+ * These constants are used with A_WLAN_BAND_SET.
+ */
+#define A_BAND_24GHZ           0
+#define A_BAND_5GHZ            1
+#define A_NUM_BANDS            2
+
+PREPACK struct host_app_area_s {
+    A_UINT32 wmi_protocol_ver;
+} POSTPACK;
+
+/*
+ * Data Path
+ */
+typedef PREPACK struct {
+    A_UINT8     dstMac[ATH_MAC_LEN];
+    A_UINT8     srcMac[ATH_MAC_LEN];
+    A_UINT16    typeOrLen;
+} POSTPACK ATH_MAC_HDR;
+
+typedef PREPACK struct {
+    A_UINT8     dsap;
+    A_UINT8     ssap;
+    A_UINT8     cntl;
+    A_UINT8     orgCode[3];
+    A_UINT16    etherType;
+} POSTPACK ATH_LLC_SNAP_HDR;
+
+typedef enum {
+    DATA_MSGTYPE = 0x0,
+    CNTL_MSGTYPE,
+    SYNC_MSGTYPE,
+    OPT_MSGTYPE,
+} WMI_MSG_TYPE;
+
+
+/*
+ * Macros for operating on WMI_DATA_HDR (info) field
+ */
+
+#define WMI_DATA_HDR_MSG_TYPE_MASK  0x03
+#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
+#define WMI_DATA_HDR_UP_MASK        0x07
+#define WMI_DATA_HDR_UP_SHIFT       2
+/* In AP mode, the same bit (b5) is used to indicate Power save state in
+ * the Rx dir and More data bit state in the tx direction.
+ */
+#define WMI_DATA_HDR_PS_MASK        0x1
+#define WMI_DATA_HDR_PS_SHIFT       5
+
+#define WMI_DATA_HDR_MORE_MASK      0x1
+#define WMI_DATA_HDR_MORE_SHIFT     5
+
+typedef enum {
+    WMI_DATA_HDR_DATA_TYPE_802_3 = 0,
+    WMI_DATA_HDR_DATA_TYPE_802_11,
+    WMI_DATA_HDR_DATA_TYPE_ACL,
+} WMI_DATA_HDR_DATA_TYPE;
+
+/* Bitmap of data header flags */
+typedef enum {
+    WMI_DATA_HDR_FLAGS_MORE = 0x1,
+    WMI_DATA_HDR_FLAGS_EOSP = 0x2,
+} WMI_DATA_HDR_FLAGS;
+
+#define WMI_DATA_HDR_DATA_TYPE_MASK     0x3
+#define WMI_DATA_HDR_DATA_TYPE_SHIFT    6
+
+#define WMI_DATA_HDR_GET_RSSI(h) ((h)->rssi)
+
+#define WMI_DATA_HDR_SET_MORE_BIT(h) ((h)->info |= (WMI_DATA_HDR_MORE_MASK << WMI_DATA_HDR_MORE_SHIFT))
+#define WMI_DATA_HDR_HAS_MORE_BIT(h) ((h)->info & (WMI_DATA_HDR_MORE_MASK << WMI_DATA_HDR_MORE_SHIFT))
+
+#define WMI_DATA_HDR_IS_MSG_TYPE(h, t)  (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
+#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
+#define WMI_DATA_HDR_GET_UP(h)    (((h)->info >> WMI_DATA_HDR_UP_SHIFT) & WMI_DATA_HDR_UP_MASK)
+#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
+
+#define WMI_DATA_HDR_GET_DATA_TYPE(h)   (((h)->info >> WMI_DATA_HDR_DATA_TYPE_SHIFT) & WMI_DATA_HDR_DATA_TYPE_MASK)
+#define WMI_DATA_HDR_SET_DATA_TYPE(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_DATA_TYPE_MASK << WMI_DATA_HDR_DATA_TYPE_SHIFT)) | ((p) << WMI_DATA_HDR_DATA_TYPE_SHIFT))
+
+#define WMI_DATA_HDR_GET_DOT11(h)   (WMI_DATA_HDR_GET_DATA_TYPE((h)) == WMI_DATA_HDR_DATA_TYPE_802_11)
+#define WMI_DATA_HDR_SET_DOT11(h, p) WMI_DATA_HDR_SET_DATA_TYPE((h), (p))
+
+/* Macros for operating on WMI_DATA_HDR (info2) field */
+#define WMI_DATA_HDR_SEQNO_MASK     0xFFF
+#define WMI_DATA_HDR_SEQNO_SHIFT    0
+
+#define WMI_DATA_HDR_AMSDU_MASK     0x1
+#define WMI_DATA_HDR_AMSDU_SHIFT    12
+
+#define WMI_DATA_HDR_META_MASK      0x7
+#define WMI_DATA_HDR_META_SHIFT     13
+
+#define GET_SEQ_NO(_v)                  ((_v) & WMI_DATA_HDR_SEQNO_MASK)
+#define GET_ISMSDU(_v)                  ((_v) & WMI_DATA_HDR_AMSDU_MASK)
+
+#define WMI_DATA_HDR_GET_SEQNO(h)        GET_SEQ_NO((h)->info2 >> WMI_DATA_HDR_SEQNO_SHIFT)
+#define WMI_DATA_HDR_SET_SEQNO(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_SEQNO_MASK << WMI_DATA_HDR_SEQNO_SHIFT)) | (GET_SEQ_NO(_v) << WMI_DATA_HDR_SEQNO_SHIFT))
+
+#define WMI_DATA_HDR_IS_AMSDU(h)        GET_ISMSDU((h)->info2 >> WMI_DATA_HDR_AMSDU_SHIFT)
+#define WMI_DATA_HDR_SET_AMSDU(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_AMSDU_MASK << WMI_DATA_HDR_AMSDU_SHIFT)) | (GET_ISMSDU(_v) << WMI_DATA_HDR_AMSDU_SHIFT))
+
+#define WMI_DATA_HDR_GET_META(h)        (((h)->info2 >> WMI_DATA_HDR_META_SHIFT) & WMI_DATA_HDR_META_MASK)
+#define WMI_DATA_HDR_SET_META(h, _v)    ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_META_MASK << WMI_DATA_HDR_META_SHIFT)) | ((_v) << WMI_DATA_HDR_META_SHIFT))
+
+/* Macros for operating on WMI_DATA_HDR (info3) field */
+#define WMI_DATA_HDR_DEVID_MASK      0xF
+#define WMI_DATA_HDR_DEVID_SHIFT     0
+#define GET_DEVID(_v)                ((_v) & WMI_DATA_HDR_DEVID_MASK)
+
+#define WMI_DATA_HDR_GET_DEVID(h)        (((h)->info3 >> WMI_DATA_HDR_DEVID_SHIFT) & WMI_DATA_HDR_DEVID_MASK)
+#define WMI_DATA_HDR_SET_DEVID(h, _v)   ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_DEVID_MASK << WMI_DATA_HDR_DEVID_SHIFT)) | (GET_DEVID(_v) << WMI_DATA_HDR_DEVID_SHIFT))
+
+#define WMI_DATA_HDR_RXFILT_SHIFT   4
+#define WMI_DATA_HDR_RXFILT_MASK    (0x1 << WMI_DATA_HDR_RXFILT_SHIFT)
+
+#define WMI_DATA_HDR_IS_RXFILTERED(h)  ((h)->info3 & WMI_DATA_HDR_RXFILT_MASK)
+#define SET_WMI_DATA_HDR_RXFILTERED(h)  (h)->info3 |= WMI_DATA_HDR_RXFILT_MASK 
+
+#define WMI_DATA_HDR_TRIGGER_MASK      0x1
+#define WMI_DATA_HDR_TRIGGER_SHIFT     4
+#define WMI_DATA_HDR_SET_TRIGGER(h, _v)   ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_TRIGGER_MASK << WMI_DATA_HDR_TRIGGER_SHIFT)) | ((_v) << WMI_DATA_HDR_TRIGGER_SHIFT))
+#define WMI_DATA_HDR_IS_TRIGGER(h)       ((((h)->info3 >> WMI_DATA_HDR_TRIGGER_SHIFT) & WMI_DATA_HDR_TRIGGER_MASK) == WMI_DATA_HDR_TRIGGER_MASK)
+
+#define WMI_DATA_HDR_EOSP_MASK      WMI_DATA_HDR_TRIGGER_MASK
+#define WMI_DATA_HDR_EOSP_SHIFT     WMI_DATA_HDR_TRIGGER_SHIFT
+
+#define WMI_DATA_HDR_SET_EOSP_BIT(h) ((h)->info3 |= (WMI_DATA_HDR_EOSP_MASK << WMI_DATA_HDR_EOSP_SHIFT))
+#define WMI_DATA_HDR_HAS_EOSP_BIT(h) ((h)->info3 & (WMI_DATA_HDR_EOSP_MASK << WMI_DATA_HDR_EOSP_SHIFT))
+
+
+#define WMI_DATA_HDR_CCX_LINKTEST_MASK      0x1
+#define WMI_DATA_HDR_CCX_LINKTEST_SHIFT     5
+#define WMI_DATA_HDR_SET_CCX_LINKTEST_BIT(h) ((h)->info3 |= (WMI_DATA_HDR_CCX_LINKTEST_MASK << WMI_DATA_HDR_CCX_LINKTEST_SHIFT))
+#define WMI_DATA_HDR_HAS_CCX_LINKTEST_BIT(h) ((h)->info3 & (WMI_DATA_HDR_CCX_LINKTEST_MASK << WMI_DATA_HDR_CCX_LINKTEST_SHIFT))
+
+#define WMI_DATA_HDR_PAD_BEFORE_DATA_MASK               0xFF
+#define WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT              0x8
+#define GET_PAD_BEFORE_DATA_START(_v)                   ((_v) & WMI_DATA_HDR_PAD_BEFORE_DATA_MASK)
+
+#define WMI_DATA_HDR_GET_PAD_BEFORE_DATA_START(h)       (((h)->info3 >> WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT) & WMI_DATA_HDR_PAD_BEFORE_DATA_MASK)
+#define WMI_DATA_HDR_SET_PAD_BEFORE_DATA_START(h, _v)   ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_PAD_BEFORE_DATA_MASK << WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT)) | (GET_PAD_BEFORE_DATA_START(_v) << WMI_DATA_HDR_PAD_BEFORE_DATA_SHIFT))
+
+typedef PREPACK struct {
+    A_INT8      rssi;
+    A_UINT8     info;               /* usage of 'info' field(8-bit):
+                                     *  b1:b0       - WMI_MSG_TYPE
+                                     *  b4:b3:b2    - UP(tid)
+                                     *  b5          - Used in AP mode. More-data in tx dir, PS in rx.
+                                     *  b7:b6       -  Dot3 header(0),
+                                     *                 Dot11 Header(1),
+                                     *                 ACL data(2)
+                                     */
+
+    A_UINT16    info2;              /* usage of 'info2' field(16-bit):
+                                     * b11:b0       - seq_no
+                                     * b12          - A-MSDU?
+                                     * b15:b13      - META_DATA_VERSION 0 - 7
+                                     */
+    A_UINT16    info3;              /* b3:b2:b1:b0  - device id
+                                     * b4           - Used in AP mode. uAPSD trigger in rx, EOSP in tx
+                                     * b7:b5        - unused?
+                                     * b15:b8       - pad before data start(irrespective of meta version)
+                                     */
+} POSTPACK WMI_DATA_HDR;
+
+/*
+ *  TX META VERSION DEFINITIONS
+ */
+#define WMI_MAX_TX_META_SZ  (12)
+#define WMI_MAX_TX_META_VERSION (7)
+#define WMI_META_VERSION_1 (0x01)
+#define WMI_META_VERSION_2 (0X02)
+#define WMI_META_VERSION_3 (0x03)
+#define WMI_META_VERSION_4 (0x04)
+
+#define WMI_ACL_TO_DOT11_HEADROOM   36
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_TX_META_V0;
+#endif
+
+typedef PREPACK struct {
+    A_UINT8     pktID;           /* The packet ID to identify the tx request */
+    A_UINT8     ratePolicyID;    /* The rate policy to be used for the tx of this frame */
+} POSTPACK WMI_TX_META_V1;
+
+
+#define WMI_CSUM_DIR_TX (0x1)
+#define TX_CSUM_CALC_FILL (0x1)
+typedef PREPACK struct {
+    A_UINT8    csumStart;       /*Offset from start of the Payload(SNAP header) for csum calculation to begin */
+    A_UINT8    csumDest;        /*Offset from start of Payload(SNAP header) where final csum goes*/
+    A_UINT8     csumFlags;    /*Flag for check sum engine to be offloaded to device*/
+} POSTPACK WMI_TX_META_V2;
+
+/* WMI_META_TX_FLAG... are used as TX qualifiers for frames containing WMI_TX_RATE_SCHEDULE in the
+ * meta data.  0 or more of these flags should be assigned to the flags member of the schedule. */
+#define WMI_META_TX_FLAG_ACK            0x01 // frame needs ACK response from receiver
+#define WMI_META_TX_FLAG_SET_RETRY_BIT  0x02 // device will set retry bit in MAC header for retried frames.
+#define WMI_META_TX_FLAG_SET_DURATION   0x04 // device will fill duration field in MAC header
+/* NOTE: If WMI_META_TX_FLAG_USE_PREFIX == 0 device will NOT use prefix frame.
+ *       If WMI_META_TX_FLAG_USE_PREFIX == 1 && WMI_META_TX_FLAG_PREFIX_RTS == 0 device will use CTS prefix.
+ *       If WMI_META_TX_FLAG_USE_PREFIX == 1 && WMI_META_TX_FLAG_PREFIX_RTS == 1 device will use RTS prefix.
+ */
+#define WMI_META_TX_FLAG_USE_PREFIX     0x08 // device will send either RTS or CTS frame prior to subject frame.
+#define WMI_META_TX_FLAG_PREFIX_RTS     0x10 // device will send RTS and wait for CTS prior to sending subject frame.
+#define WMI_META_TX_LOAD_TSF            0x20 // device will fill the TSF field during transmit procedure. <Beacons/probe responses>
+
+/* WMI_TX_RATE_SCHEDULE - Acts as a host-provided rate schedule to replace what would be normally determined
+ * by firmware.  This allows the host to specify what rates and attempts should be used to transmit the
+ * frame. */
+typedef PREPACK struct {
+#define WMI_TX_MAX_RATE_SERIES (4)
+    A_UINT8 rateSeries[WMI_TX_MAX_RATE_SERIES]; //rate index for each series. first invalid rate terminates series.
+    A_UINT8 trySeries[WMI_TX_MAX_RATE_SERIES]; //number of tries for each series.
+    A_UINT8 flags; // combination of WMI_META_TX_FLAG...
+    A_UINT8 accessCategory; // should be WMM_AC_BE for managment frames and multicast frames.
+    //A_UINT8 keyIndex;
+    //
+}POSTPACK WMI_TX_RATE_SCHEDULE;
+
+#ifdef TIME_BASED_DISCARD
+typedef PREPACK struct {
+    A_UINT32 txdiscardTime;
+    A_UINT8 discardDispostion;
+} POSTPACK WMI_TX_META_V4;
+#endif
+
+typedef PREPACK struct {
+    WMI_TX_RATE_SCHEDULE rateSched;
+    A_UINT8     pktID;           /* The packet ID to identify the tx request */
+} POSTPACK WMI_TX_META_V3;
+
+/*
+ *  RX META VERSION DEFINITIONS
+ */
+/* if RX meta data is present at all then the meta data field
+ *  will consume WMI_MAX_RX_META_SZ bytes of space between the
+ *  WMI_DATA_HDR and the payload. How much of the available
+ *  Meta data is actually used depends on which meta data
+ *  version is active. */
+#define WMI_MAX_RX_META_SZ  (12)
+#define WMI_MAX_RX_META_VERSION (7)
+
+#define WMI_RX_STATUS_OK            0 /* success */
+#define WMI_RX_STATUS_DECRYPT_ERR   1 /* decrypt error */
+#define WMI_RX_STATUS_MIC_ERR       2 /* tkip MIC error */
+#define WMI_RX_STATUS_ERR           3 /* undefined error */
+
+#define WMI_RX_FLAGS_AGGR           0x0001 /* part of AGGR */
+#define WMI_RX_FlAGS_STBC           0x0002 /* used STBC */
+#define WMI_RX_FLAGS_SGI            0x0004 /* used SGI */
+#define WMI_RX_FLAGS_HT             0x0008 /* is HT packet */
+/* the flags field is also used to store the CRYPTO_TYPE of the frame
+ * that value is shifted by WMI_RX_FLAGS_CRYPTO_SHIFT */
+#define WMI_RX_FLAGS_CRYPTO_SHIFT   4
+#define WMI_RX_FLAGS_CRYPTO_MASK    0x1f
+#define WMI_RX_META_GET_CRYPTO(flags) (((flags) >> WMI_RX_FLAGS_CRYPTO_SHIFT) & WMI_RX_FLAGS_CRYPTO_MASK)
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_RX_META_VERSION_0;
+#endif
+
+typedef PREPACK struct {
+    A_UINT8     status; /* one of WMI_RX_STATUS_... */
+    A_UINT8     rix;    /* rate index mapped to rate at which this packet was received. */
+    A_UINT8     rssi;   /* rssi of packet */
+    A_UINT8     channel;/* rf channel during packet reception */
+    A_UINT16    flags;  /* a combination of WMI_RX_FLAGS_... */
+} POSTPACK WMI_RX_META_V1;
+
+#define RX_CSUM_VALID_FLAG (0x1)
+typedef PREPACK struct {
+    A_UINT16    csum;
+    A_UINT8     csumFlags;/* bit 0 set -partial csum valid
+                             bit 1 set -test mode */
+} POSTPACK WMI_RX_META_V2;
+
+#ifdef TIME_BASED_DISCARD
+typedef PREPACK struct {
+	A_UINT8  	discardDispostion;
+	A_UINT32	txdiscardTime;
+} POSTPACK WMI_RX_META_V4;
+#endif
+
+
+#define WMI_GET_DEVICE_ID(info1) ((info1) & 0xF)
+/* Macros for operating on WMI_CMD_HDR (info1) field */
+#define WMI_CMD_HDR_DEVID_MASK      0xF
+#define WMI_CMD_HDR_DEVID_SHIFT     0
+#define GET_CMD_DEVID(_v)           ((_v) & WMI_CMD_HDR_DEVID_MASK)
+
+#define WMI_CMD_HDR_GET_DEVID(h)        (((h)->info1 >> WMI_CMD_HDR_DEVID_SHIFT) & WMI_CMD_HDR_DEVID_MASK)
+#define WMI_CMD_HDR_SET_DEVID(h, _v)   ((h)->info1 = ((h)->info1 & ~(WMI_CMD_HDR_DEVID_MASK << WMI_CMD_HDR_DEVID_SHIFT)) | (GET_CMD_DEVID(_v) << WMI_CMD_HDR_DEVID_SHIFT))
+
+/*
+ * Control Path
+ */
+typedef PREPACK struct {
+    A_UINT16    commandId;
+/*
+ * info1 - 16 bits
+ * b03:b00 - id
+ * b15:b04 - unused
+ */
+    A_UINT16    info1;
+
+    A_UINT16    reserved;      /* For alignment */
+} POSTPACK WMI_CMD_HDR;        /* used for commands and events */
+
+/*
+ * List of Commnands
+ */
+typedef enum {
+    WMI_CONNECT_CMDID           = 0x0001,
+    WMI_RECONNECT_CMDID,
+    WMI_DISCONNECT_CMDID,
+    WMI_SYNCHRONIZE_CMDID,
+    WMI_CREATE_PSTREAM_CMDID,
+    WMI_DELETE_PSTREAM_CMDID,
+    /* WMI_START_SCAN_CMDID is to be deprecated; WMI_BEGIN_SCAN is to
+     * be used instead. The new command supports P2P mgmt operations
+     * using station interface.
+     */
+    WMI_START_SCAN_CMDID,
+    WMI_SET_SCAN_PARAMS_CMDID,
+    WMI_SET_BSS_FILTER_CMDID,
+    WMI_SET_PROBED_SSID_CMDID,               /* 10 */
+    WMI_SET_LISTEN_INT_CMDID,
+    WMI_SET_BMISS_TIME_CMDID,
+    WMI_SET_DISC_TIMEOUT_CMDID,
+    WMI_GET_CHANNEL_LIST_CMDID,
+    WMI_SET_BEACON_INT_CMDID,
+    WMI_GET_STATISTICS_CMDID,
+    WMI_SET_CHANNEL_PARAMS_CMDID,
+    WMI_SET_POWER_MODE_CMDID,
+    WMI_SET_IBSS_PM_CAPS_CMDID,
+    WMI_SET_POWER_PARAMS_CMDID,              /* 20 */
+    WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
+    WMI_ADD_CIPHER_KEY_CMDID,
+    WMI_DELETE_CIPHER_KEY_CMDID,
+    WMI_ADD_KRK_CMDID,
+    WMI_DELETE_KRK_CMDID,
+    WMI_SET_PMKID_CMDID,
+    WMI_SET_TX_PWR_CMDID,
+    WMI_GET_TX_PWR_CMDID,
+    WMI_SET_ASSOC_INFO_CMDID,
+    WMI_ADD_BAD_AP_CMDID,                    /* 30 */
+    WMI_DELETE_BAD_AP_CMDID,
+    WMI_SET_TKIP_COUNTERMEASURES_CMDID,
+    WMI_RSSI_THRESHOLD_PARAMS_CMDID,
+    WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
+    WMI_SET_ACCESS_PARAMS_CMDID,
+    WMI_SET_RETRY_LIMITS_CMDID,
+    WMI_SET_OPT_MODE_CMDID,
+    WMI_OPT_TX_FRAME_CMDID,
+    WMI_SET_VOICE_PKT_SIZE_CMDID,
+    WMI_SET_MAX_SP_LEN_CMDID,                /* 40 */
+    WMI_SET_ROAM_CTRL_CMDID,
+    WMI_GET_ROAM_TBL_CMDID,
+    WMI_GET_ROAM_DATA_CMDID,
+    WMI_ENABLE_RM_CMDID,
+    WMI_SET_MAX_OFFHOME_DURATION_CMDID,
+    WMI_EXTENSION_CMDID,                        /* Non-wireless extensions */
+    WMI_SNR_THRESHOLD_PARAMS_CMDID,
+    WMI_LQ_THRESHOLD_PARAMS_CMDID,
+    WMI_SET_LPREAMBLE_CMDID,
+    WMI_SET_RTS_CMDID,                       /* 50 */
+    WMI_CLR_RSSI_SNR_CMDID,
+    WMI_SET_FIXRATES_CMDID,
+    WMI_GET_FIXRATES_CMDID,
+    WMI_SET_AUTH_MODE_CMDID,
+    WMI_SET_REASSOC_MODE_CMDID,
+    WMI_SET_WMM_CMDID,
+    WMI_SET_WMM_TXOP_CMDID,
+    WMI_TEST_CMDID,
+    /* COEX AR6002 only*/
+    WMI_SET_BT_STATUS_CMDID,
+    WMI_SET_BT_PARAMS_CMDID,                /* 60 */
+
+    WMI_SET_KEEPALIVE_CMDID,
+    WMI_GET_KEEPALIVE_CMDID,
+    WMI_SET_APPIE_CMDID,
+    WMI_GET_APPIE_CMDID,
+    WMI_SET_WSC_STATUS_CMDID,
+
+    /* Wake on Wireless */
+    WMI_SET_HOST_SLEEP_MODE_CMDID,
+    WMI_SET_WOW_MODE_CMDID,
+    WMI_GET_WOW_LIST_CMDID,
+    WMI_ADD_WOW_PATTERN_CMDID,
+    WMI_DEL_WOW_PATTERN_CMDID,               /* 70 */
+
+    WMI_SET_FRAMERATES_CMDID,
+    WMI_SET_AP_PS_CMDID,
+    WMI_SET_QOS_SUPP_CMDID,
+    /* WMI_THIN_RESERVED_... mark the start and end
+     * values for WMI_THIN_RESERVED command IDs. These
+     * command IDs can be found in wmi_thin.h */
+    WMI_THIN_RESERVED_START = 0x8000,
+    WMI_THIN_RESERVED_END = 0x8fff,
+    /*
+     * Developer commands starts at 0xF000
+     */
+    WMI_SET_BITRATE_CMDID = 0xF000,
+    WMI_GET_BITRATE_CMDID,
+    WMI_SET_WHALPARAM_CMDID,
+
+
+    /*Should add the new command to the tail for compatible with
+     * etna.
+     */
+    WMI_SET_MAC_ADDRESS_CMDID,
+    WMI_SET_AKMP_PARAMS_CMDID,
+    WMI_SET_PMKID_LIST_CMDID,
+    WMI_GET_PMKID_LIST_CMDID,
+    WMI_ABORT_SCAN_CMDID,
+    WMI_SET_TARGET_EVENT_REPORT_CMDID,
+
+    // Unused
+    WMI_UNUSED1,
+    WMI_UNUSED2,
+
+    /*
+     * AP mode commands
+     */
+    WMI_AP_HIDDEN_SSID_CMDID,   /* F00B */
+    WMI_AP_SET_NUM_STA_CMDID,
+    WMI_AP_ACL_POLICY_CMDID,
+    WMI_AP_ACL_MAC_LIST_CMDID,
+    WMI_AP_CONFIG_COMMIT_CMDID,
+    WMI_AP_SET_MLME_CMDID,    /* F010 */
+    WMI_AP_SET_PVB_CMDID,
+    WMI_AP_CONN_INACT_CMDID,
+    WMI_AP_PROT_SCAN_TIME_CMDID,
+    WMI_AP_SET_COUNTRY_CMDID,
+    WMI_AP_SET_DTIM_CMDID,
+    WMI_AP_MODE_STAT_CMDID,
+
+    WMI_SET_IP_CMDID,    /* F017 */
+    WMI_SET_PARAMS_CMDID,
+    WMI_SET_MCAST_FILTER_CMDID,
+    WMI_DEL_MCAST_FILTER_CMDID,
+
+    WMI_ALLOW_AGGR_CMDID,    /* F01B */
+    WMI_ADDBA_REQ_CMDID,
+    WMI_DELBA_REQ_CMDID,
+    WMI_SET_HT_CAP_CMDID,
+    WMI_SET_HT_OP_CMDID,
+    WMI_SET_TX_SELECT_RATES_CMDID,
+    WMI_SET_TX_SGI_PARAM_CMDID,
+    WMI_SET_RATE_POLICY_CMDID,
+
+    WMI_HCI_CMD_CMDID,    /* F023 */
+    WMI_RX_FRAME_FORMAT_CMDID,
+    WMI_SET_THIN_MODE_CMDID,
+    WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID,
+
+    WMI_AP_SET_11BG_RATESET_CMDID,     /* F027 */
+    WMI_SET_PMK_CMDID,
+    WMI_MCAST_FILTER_CMDID,
+    /* COEX CMDID AR6003*/
+    WMI_SET_BTCOEX_FE_ANT_CMDID, /* F02A */
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID,
+    WMI_SET_BTCOEX_SCO_CONFIG_CMDID,
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMDID,
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID,
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID,
+    WMI_SET_BTCOEX_DEBUG_CMDID,
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID,
+    WMI_GET_BTCOEX_STATS_CMDID,
+    WMI_GET_BTCOEX_CONFIG_CMDID,
+#if !defined(AR6002_REV61) || !defined(ATH_TARGET) /* WAR for EV 89272 */
+    WMI_DFS_RESERVED,                 /* F034 */
+#endif
+    WMI_SET_DFS_MINRSSITHRESH_CMDID,
+    WMI_SET_DFS_MAXPULSEDUR_CMDID,
+    WMI_DFS_RADAR_DETECTED_CMDID,
+
+    /* P2P CMDS */
+    WMI_P2P_SET_CONFIG_CMDID,    /* F037 */
+    WMI_WPS_SET_CONFIG_CMDID,
+    WMI_SET_REQ_DEV_ATTR_CMDID,
+    WMI_P2P_FIND_CMDID,
+    WMI_P2P_STOP_FIND_CMDID,
+    WMI_P2P_GO_NEG_START_CMDID,
+    WMI_P2P_LISTEN_CMDID,
+
+
+    WMI_CONFIG_TX_MAC_RULES_CMDID,    /* F044 */
+    WMI_SET_PROMISCUOUS_MODE_CMDID,
+    WMI_RX_FRAME_FILTER_CMDID,
+    WMI_SET_CHANNEL_CMDID,
+
+    /* WAC commands */
+    WMI_ENABLE_WAC_CMDID,
+    WMI_WAC_SCAN_REPLY_CMDID,
+    WMI_WAC_CTRL_REQ_CMDID,
+
+    WMI_SET_DIV_PARAMS_CMDID,
+    WMI_GET_PMK_CMDID,
+    WMI_SET_PASSPHRASE_CMDID,
+    WMI_SEND_ASSOC_RES_CMDID,
+    WMI_SET_ASSOC_REQ_RELAY_CMDID,
+
+    /* ACS command, consists of sub-commands */
+    WMI_ACS_CTRL_CMDID,
+    WMI_SET_EXCESS_TX_RETRY_THRES_CMDID,
+    WMI_SET_TBD_TIME_CMDID, /*added for wmiconfig command for TBD */
+
+    /* Pktlog cmds */
+    WMI_PKTLOG_ENABLE_CMDID,
+    WMI_PKTLOG_DISABLE_CMDID,
+
+    /* More P2P Cmds */
+    WMI_P2P_GO_NEG_REQ_RSP_CMDID,
+    WMI_P2P_GRP_INIT_CMDID,
+    WMI_P2P_GRP_FORMATION_DONE_CMDID,
+    WMI_P2P_INVITE_CMDID,
+    WMI_P2P_INVITE_REQ_RSP_CMDID,
+    WMI_P2P_PROV_DISC_REQ_CMDID,
+    WMI_P2P_SET_CMDID,
+
+    WMI_GET_RFKILL_MODE_CMDID,
+    WMI_SET_RFKILL_MODE_CMDID,
+    WMI_AP_SET_APSD_CMDID,
+    WMI_AP_APSD_BUFFERED_TRAFFIC_CMDID,
+
+    WMI_P2P_SDPD_TX_CMDID, /* F05C */
+    WMI_P2P_STOP_SDPD_CMDID,
+    WMI_P2P_CANCEL_CMDID,
+    /* Ultra low power store / recall commands */
+    WMI_STORERECALL_CONFIGURE_CMDID,
+    WMI_STORERECALL_RECALL_CMDID,
+    WMI_STORERECALL_HOST_READY_CMDID,
+    WMI_FORCE_TARGET_ASSERT_CMDID,
+    
+    WMI_SET_PROBED_SSID_EX_CMDID,
+    WMI_SET_NETWORK_LIST_OFFLOAD_CMDID,
+    WMI_SET_ARP_NS_OFFLOAD_CMDID,
+    WMI_ADD_WOW_EXT_PATTERN_CMDID,
+    WMI_GTK_OFFLOAD_OP_CMDID,
+  
+    WMI_REMAIN_ON_CHNL_CMDID,
+    WMI_CANCEL_REMAIN_ON_CHNL_CMDID,
+    /* WMI_SEND_ACTION_CMDID is to be deprecated; WMI_SEND_MGMT_CMDID 
+     * is to be used instead. The new command supports P2P mgmt
+     * operations using station interface
+     */
+    WMI_SEND_ACTION_CMDID,
+    WMI_PROBE_REQ_REPORT_CMDID,
+    WMI_DISABLE_11B_RATES_CMDID,
+    WMI_SEND_PROBE_RESPONSE_CMDID,
+    WMI_GET_P2P_INFO_CMDID,
+    WMI_AP_JOIN_BSS_CMDID,
+
+    WMI_SMPS_ENABLE_CMDID,
+    WMI_SMPS_CONFIG_CMDID,
+    WMI_SET_RATECTRL_PARM_CMDID,
+    /*  LPL specific commands*/
+    WMI_LPL_FORCE_ENABLE_CMDID,
+    WMI_LPL_SET_POLICY_CMDID,
+    WMI_LPL_GET_POLICY_CMDID,
+    WMI_LPL_GET_HWSTATE_CMDID,
+    WMI_LPL_SET_PARAMS_CMDID,
+    WMI_LPL_GET_PARAMS_CMDID,
+
+    WMI_SET_BUNDLE_PARAM_CMDID, 
+
+    /*GreenTx specific commands*/
+    
+    WMI_GREENTX_PARAMS_CMDID,
+
+    WMI_RTT_MEASREQ_CMDID,
+    WMI_RTT_CAPREQ_CMDID,
+    WMI_RTT_STATUSREQ_CMDID,
+
+    /* WPS Commands */
+    WMI_WPS_START_CMDID,
+    WMI_GET_WPS_STATUS_CMDID,
+
+    /* More P2P commands */
+    WMI_SET_NOA_CMDID,
+    WMI_GET_NOA_CMDID,
+    WMI_SET_OPPPS_CMDID,
+    WMI_GET_OPPPS_CMDID,
+    WMI_ADD_PORT_CMDID,
+    WMI_DEL_PORT_CMDID,
+
+    /* 802.11w cmd */
+    WMI_SET_RSN_CAP_CMDID,
+    WMI_GET_RSN_CAP_CMDID,
+    WMI_SET_IGTK_CMDID,
+
+    WMI_RX_FILTER_COALESCE_FILTER_OP_CMDID,
+    WMI_RX_FILTER_SET_FRAME_TEST_LIST_CMDID,
+
+    /* Commands added to support P2P mgmt operations on top of station
+     * interface. WMI_SEND_ACTION_CMDID and WMI_START_SCAN_CMDID to be
+     * deprecated.
+     */
+    WMI_SEND_MGMT_CMDID,
+    WMI_BEGIN_SCAN_CMDID,
+    /* End of commands added to support P2P mgmt operations on station
+     * interface
+     */
+     WMI_SET_BLACK_LIST,
+     WMI_SET_MCASTRATE_CMDID,
+
+     WMI_STA_BMISS_ENHANCE_CMDID,
+
+     WMI_SET_REGDOMAIN_CMDID,
+
+     WMI_SET_RSSI_FILTER_CMDID,
+     WMI_SET_KEEPALIVE_CMDID_EXT,
+
+    WMI_VOICE_DETECTION_ENABLE_CMDID,
+
+    WMI_SET_TXE_NOTIFY_CMDID,
+
+    WMI_SET_RECOVERY_TEST_PARAMETER_CMDID,
+
+    WMI_ENABLE_SCHED_SCAN,
+
+WMI_DISABLE_BCAST_IN_PM_CMDID = 0xf200,
+
+} WMI_COMMAND_ID;
+
+/*
+ * Frame Types
+ */
+typedef enum {
+    WMI_FRAME_BEACON        =   0,
+    WMI_FRAME_PROBE_REQ,
+    WMI_FRAME_PROBE_RESP,
+    WMI_FRAME_ASSOC_REQ,
+    WMI_FRAME_ASSOC_RESP,
+    WMI_NUM_MGMT_FRAME
+} WMI_MGMT_FRAME_TYPE;
+
+/*
+ * Connect Command
+ */
+typedef enum {
+    INFRA_NETWORK       = 0x01,
+    ADHOC_NETWORK       = 0x02,
+    ADHOC_CREATOR       = 0x04,
+    AP_NETWORK          = 0x10,
+    NETWORK_CONNECTED_USING_WPS = 0x20,
+} NETWORK_TYPE;
+
+typedef enum {
+    SUBTYPE_NONE,
+    SUBTYPE_BT,
+    SUBTYPE_P2PDEV,
+    SUBTYPE_P2PCLIENT,
+    SUBTYPE_P2PGO,
+} NETWORK_SUBTYPE;
+
+typedef enum {
+    OPEN_AUTH           = 0x01,
+    SHARED_AUTH         = 0x02,
+    LEAP_AUTH           = 0x04,  /* different from IEEE_AUTH_MODE definitions */
+} DOT11_AUTH_MODE;
+
+typedef enum {
+    WMI_NONE_AUTH           = 0x01,
+    WMI_WPA_AUTH            = 0x02,
+    WMI_WPA2_AUTH           = 0x04,
+    WMI_WPA_PSK_AUTH        = 0x08,
+    WMI_WPA2_PSK_AUTH       = 0x10,
+    WMI_WPA_AUTH_CCKM       = 0x20,
+    WMI_WPA2_AUTH_CCKM      = 0x40,
+} AUTH_MODE;
+
+typedef enum {
+    NONE_CRYPT          = 0x01,
+    WEP_CRYPT           = 0x02,
+    TKIP_CRYPT          = 0x04,
+    AES_CRYPT           = 0x08,
+#ifdef WAPI_ENABLE
+    WAPI_CRYPT          = 0x10,
+#endif /*WAPI_ENABLE*/
+} CRYPTO_TYPE;
+
+#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
+#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_CRYPTO_TYPE
+#define WMI_MAX_CRYPTO_TYPE (WAPI_CRYPT + 1)
+#endif /* WAPI_ENABLE */
+
+#ifdef WAPI_ENABLE
+#define IW_ENCODE_ALG_SM4       0x20
+/*
+ * Defined this to be some very high bit because it is less likely to be
+ * clobbered by future changes to the kernel's wireless.h file
+*/
+#define IW_AUTH_CIPHER_SMS4     0x40000000
+#endif
+
+#define WMI_MIN_KEY_INDEX   0
+#define WMI_MAX_KEY_INDEX   3
+
+#ifdef IEEE80211W
+#undef WMI_MAX_KEY_INDEX
+#define WMI_MAX_KEY_INDEX   5
+#endif
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_KEY_INDEX
+#define WMI_MAX_KEY_INDEX   7 /* wapi grpKey 0-3, prwKey 4-7 */
+#endif /* WAPI_ENABLE */
+
+#define WMI_MAX_KEY_LEN     32
+
+#define WMI_MAX_SSID_LEN    32
+
+typedef enum {
+    CONNECT_ASSOC_POLICY_USER           = 0x0001,
+    CONNECT_SEND_REASSOC                = 0x0002,
+    CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+    CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+    CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+    CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+    CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+    CONNECT_DO_NOT_DEAUTH               = 0x0080,
+    CONNECT_WPS_FLAG                    = 0x0100,
+    /* AP configuration flags */
+    AP_NO_DISASSOC_UPON_DEAUTH          = 0x10000,
+    AP_HOSTPAL_SUPPORT                  = 0x20000
+} WMI_CONNECT_CTRL_FLAGS_BITS;
+
+#define DEFAULT_CONNECT_CTRL_FLAGS    (CONNECT_CSA_FOLLOW_BSS)
+
+typedef PREPACK struct {
+    A_UINT8     networkType;
+    A_UINT8     dot11AuthMode;
+    A_UINT8     authMode;
+    A_UINT8     pairwiseCryptoType;
+    A_UINT8     pairwiseCryptoLen;
+    A_UINT8     groupCryptoType;
+    A_UINT8     groupCryptoLen;
+    A_UINT8     ssidLength;
+    A_UCHAR     ssid[WMI_MAX_SSID_LEN];
+    A_UINT16    channel;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT32    ctrl_flags;
+    A_UINT8     networkSubtype;
+} POSTPACK WMI_CONNECT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT32 divIdleTime;
+    A_UINT8   antRssiThresh;
+    A_UINT8   divEnable;
+    A_UINT16 active_treshold_rate;
+} POSTPACK WMI_DIV_PARAMS_CMD;
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;                    /* hint */
+    A_UINT8     bssid[ATH_MAC_LEN];         /* mandatory if set */
+} POSTPACK WMI_RECONNECT_CMD;
+
+/*
+ * WMI_SET_PMK_CMDID
+ */
+#define WMI_PMK_LEN     32
+typedef PREPACK struct {
+    A_UINT8 pmk[WMI_PMK_LEN];
+    A_UINT8 pmk_len;
+} POSTPACK WMI_SET_PMK_CMD, WMI_GET_PMK_REPLY;
+
+/*
+ * WMI_SET_PASSPHRASE_CMDID
+ */
+#define WMI_PASSPHRASE_LEN    64
+typedef PREPACK struct {
+    A_UCHAR ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 passphrase[WMI_PASSPHRASE_LEN];
+    A_UINT8 ssid_len;
+    A_UINT8 passphrase_len;
+} POSTPACK WMI_SET_PASSPHRASE_CMD;
+
+/*
+ * WMI_SET_EXCESS_TX_RETRY_THRES_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT32 threshold;
+} POSTPACK WMI_SET_EXCESS_TX_RETRY_THRES_CMD;
+
+/*
+ * WMI_SET_MCASTRATE_CMD
+ */
+typedef PREPACK struct {
+    A_UINT16 bitrate; /* in units of 100 Kbps */
+    		      /* Valid values are 10, 20, 55, 110, 60, 90, 120, 180,
+		       * 240, 360, 480, 540 */
+} POSTPACK WMI_SET_MCASTRATE_CMD;
+
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+typedef enum {
+    PAIRWISE_USAGE      = 0x00,
+    GROUP_USAGE         = 0x01,
+    TX_USAGE            = 0x02,     /* default Tx Key - Static WEP only */
+} KEY_USAGE;
+
+/*
+ * Bit Flag
+ * Bit 0 - Initialise TSC - default is Initialize
+ */
+#define KEY_OP_INIT_TSC       0x01
+#define KEY_OP_INIT_RSC       0x02
+#ifdef WAPI_ENABLE
+#define KEY_OP_INIT_WAPIPN    0x10
+#endif /* WAPI_ENABLE */
+
+#define KEY_OP_INIT_VAL     0x03     /* Default Initialise the TSC & RSC */
+#define KEY_OP_VALID_MASK   0x03
+
+typedef PREPACK struct {
+    A_UINT8     keyIndex;
+    A_UINT8     keyType;
+    A_UINT8     keyUsage;           /* KEY_USAGE */
+    A_UINT8     keyLength;
+    A_UINT8     keyRSC[8];          /* key replay sequence counter */
+    A_UINT8     key[WMI_MAX_KEY_LEN];
+    A_UINT8     key_op_ctrl;       /* Additional Key Control information */
+    A_UINT8    key_macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     keyIndex;
+} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
+
+
+/*
+ *for Linux, it need KRK, length is 16
+ *for Win7, it need CCKM ie, length is 26
+ */
+#define WMI_KRK_LEN     16
+#define WMI_CCKM_IE_LEN 26
+/*
+ * WMI_ADD_KRK_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     krk[WMI_CCKM_IE_LEN];
+} POSTPACK WMI_ADD_KRK_CMD;
+
+/*
+ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
+ */
+typedef enum {
+    WMI_TKIP_CM_DISABLE = 0x0,
+    WMI_TKIP_CM_ENABLE  = 0x1,
+} WMI_TKIP_CM_CONTROL;
+
+typedef PREPACK struct {
+    A_UINT8  cm_en;                     /* WMI_TKIP_CM_CONTROL */
+} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
+
+/*
+ * WMI_SET_PMKID_CMDID
+ */
+
+#define WMI_PMKID_LEN 16
+
+typedef enum {
+   PMKID_DISABLE = 0,
+   PMKID_ENABLE  = 1,
+} PMKID_ENABLE_FLG;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT8     enable;                 /* PMKID_ENABLE_FLG */
+    A_UINT8     pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_SET_PMKID_CMD;
+
+/*
+ * WMI_START_SCAN_CMD
+ */
+typedef enum {
+    WMI_LONG_SCAN  = 0,
+    WMI_SHORT_SCAN = 1,
+} WMI_SCAN_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8 nrates;
+    A_UINT8 rates[WMI_RATE_MAXSIZE];
+} POSTPACK WMI_SUPPORTED_RATES;
+
+typedef PREPACK struct {
+    A_BOOL   forceFgScan;
+    A_BOOL   isLegacy;        /* For Legacy Cisco AP compatibility */
+    A_UINT32 homeDwellTime;   /* Maximum duration in the home channel(milliseconds) */
+    A_UINT32 forceScanInterval;    /* Time interval between scans (milliseconds)*/
+    A_BOOL  no_cck;             /* Flag to force no CCK rates to be used for 
+                                   probe request frames */
+    A_UINT8  scanType;           /* WMI_SCAN_TYPE */
+    WMI_SUPPORTED_RATES supp_rates[A_NUM_BANDS]; /* Supported rates to 
+                                                    advertise in probe request 
+                                                    frames */
+    A_UINT8  numChannels;            /* how many channels follow */
+    A_UINT16 channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_BEGIN_SCAN_CMD;
+
+/* WMI_START_SCAN_CMD is to be deprecated; WMI_BEGIN_SCAN_CMD is 
+ * to be used instead. The new command supports P2P mgmt operations using
+ * station interface
+ */
+typedef PREPACK struct {
+    A_BOOL   forceFgScan;
+    A_BOOL   isLegacy;        /* For Legacy Cisco AP compatibility */
+    A_UINT32 homeDwellTime;   /* Maximum duration in the home channel(milliseconds) */
+    A_UINT32 forceScanInterval;    /* Time interval between scans (milliseconds)*/
+    A_UINT8  scanType;           /* WMI_SCAN_TYPE */
+    A_UINT8  numChannels;            /* how many channels follow */
+    A_UINT16 channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_START_SCAN_CMD;
+
+
+/*
+ * WMI_SET_SCAN_PARAMS_CMDID
+ */
+#define WMI_SHORTSCANRATIO_DEFAULT      3
+/*
+ *  Warning: ScanCtrlFlag value of 0xFF is used to disable all flags in WMI_SCAN_PARAMS_CMD
+ *  Do not add any more flags to WMI_SCAN_CTRL_FLAG_BITS
+ */
+typedef enum {
+    CONNECT_SCAN_CTRL_FLAGS = 0x01,    /* set if can scan in the Connect cmd */
+    SCAN_CONNECTED_CTRL_FLAGS = 0x02,  /* set if scan for the SSID it is */
+                                       /* already connected to */
+    ACTIVE_SCAN_CTRL_FLAGS = 0x04,     /* set if enable active scan */
+    ROAM_SCAN_CTRL_FLAGS = 0x08,       /* set if enable roam scan when bmiss and lowrssi */
+    REPORT_BSSINFO_CTRL_FLAGS = 0x10,   /* set if follows customer BSSINFO reporting rule */
+    ENABLE_AUTO_CTRL_FLAGS = 0x20,      /* if disabled, target doesn't
+                                          scan after a disconnect event  */
+    ENABLE_SCAN_ABORT_EVENT = 0x40      /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
+} WMI_SCAN_CTRL_FLAGS_BITS;
+
+#define CAN_SCAN_IN_CONNECT(flags)      (flags & CONNECT_SCAN_CTRL_FLAGS)
+#define CAN_SCAN_CONNECTED(flags)       (flags & SCAN_CONNECTED_CTRL_FLAGS)
+#define ENABLE_ACTIVE_SCAN(flags)       (flags & ACTIVE_SCAN_CTRL_FLAGS)
+#define ENABLE_ROAM_SCAN(flags)         (flags & ROAM_SCAN_CTRL_FLAGS)
+#define CONFIG_REPORT_BSSINFO(flags)     (flags & REPORT_BSSINFO_CTRL_FLAGS)
+#define IS_AUTO_SCAN_ENABLED(flags)      (flags & ENABLE_AUTO_CTRL_FLAGS)
+#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
+
+#define DEFAULT_SCAN_CTRL_FLAGS         (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
+
+
+typedef PREPACK struct {
+    A_UINT16    fg_start_period;        /* seconds */
+    A_UINT16    fg_end_period;          /* seconds */
+    A_UINT16    bg_period;              /* seconds */
+    A_UINT16    maxact_chdwell_time;    /* msec */
+    A_UINT16    pas_chdwell_time;       /* msec */
+    A_UINT8     shortScanRatio;         /* how many shorts scan for one long */
+    A_UINT8     scanCtrlFlags;
+    A_UINT16    minact_chdwell_time;    /* msec */
+    A_UINT16    maxact_scan_per_ssid;   /* max active scans per ssid */
+    A_UINT32    max_dfsch_act_time;  /* msecs */
+} POSTPACK WMI_SCAN_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT16   chan_index;
+    A_INT8    bang_radar;
+} POSTPACK WMI_RADAR_DETECTED_CMD;
+
+/*
+ * WMI_SET_BSS_FILTER_CMDID
+ */
+typedef enum {
+    NONE_BSS_FILTER = 0x0,              /* no beacons forwarded */
+    ALL_BSS_FILTER,                     /* all beacons forwarded */
+    PROFILE_FILTER,                     /* only beacons matching profile */
+    ALL_BUT_PROFILE_FILTER,             /* all but beacons matching profile */
+    CURRENT_BSS_FILTER,                 /* only beacons matching current BSS */
+    ALL_BUT_BSS_FILTER,                 /* all but beacons matching BSS */
+    PROBED_SSID_FILTER,                 /* beacons matching probed ssid */
+    LAST_BSS_FILTER,                    /* marker only */
+} WMI_BSS_FILTER;
+
+typedef PREPACK struct {
+    A_UINT8    bssFilter;                      /* see WMI_BSS_FILTER */
+    A_UINT8    reserved1;                      /* For alignment */
+    A_UINT16   reserved2;                      /* For alignment */
+    A_UINT32   ieMask;
+} POSTPACK WMI_BSS_FILTER_CMD;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   15
+
+typedef enum {
+    DISABLE_SSID_FLAG  = 0,                  /* disables entry */
+    SPECIFIC_SSID_FLAG = 0x01,               /* probes specified ssid */
+    ANY_SSID_FLAG      = 0x02,               /* probes for any ssid */
+    PASSIVE_LISTEN_SSID_FLAG = 0x04,               /* Just Listen on the Channel without Probing for any SSIDs But we wanted to use the Probed SSID List*/ 							   /* for Profile Matching */
+} WMI_SSID_FLAG;
+
+typedef PREPACK struct {
+    A_UINT8     entryIndex;                     /* 0 to MAX_PROBED_SSID_INDEX */
+    A_UINT8     flag;                           /* WMI_SSID_FLG */
+    A_UINT8     ssidLength;
+    A_UINT8     ssid[32];
+    A_UINT8     authentication;
+    A_UINT8     encryption;
+    A_UINT8     channelHint;
+    A_BOOL      bmatchcompleteprofile;         /* If this Flag is True, we do a complete profile match of SSID, AUTH, Encryption */
+} POSTPACK WMI_PROBED_SSID_CMD;
+
+/*
+ * WMI_SET_LISTEN_INT_CMDID
+ * The Listen interval is between 15 and 3000 TUs
+ */
+#define MIN_LISTEN_INTERVAL 15
+#define MAX_LISTEN_INTERVAL 5000
+#define MIN_LISTEN_BEACONS 1
+#define MAX_LISTEN_BEACONS 50
+
+typedef PREPACK struct {
+    A_UINT16     listenInterval;
+    A_UINT16     numBeacons;
+} POSTPACK WMI_LISTEN_INT_CMD;
+
+/*
+ * WMI_SET_BEACON_INT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16     beaconInterval;
+} POSTPACK WMI_BEACON_INT_CMD;
+
+/*
+ * WMI_SET_BMISS_TIME_CMDID
+ * valid values are between 1000 and 5000 TUs
+ */
+
+#define MIN_BMISS_TIME     1000
+#define MAX_BMISS_TIME     5000
+#define MIN_BMISS_BEACONS  1
+#define MAX_BMISS_BEACONS  50
+
+typedef PREPACK struct {
+    A_UINT16     bmissTime;
+    A_UINT16     numBeacons;
+} POSTPACK WMI_BMISS_TIME_CMD;
+
+/*
+ * WMI_SET_POWER_MODE_CMDID
+ */
+typedef enum {
+    REC_POWER = 0x01,
+    MAX_PERF_POWER,
+} WMI_POWER_MODE;
+
+typedef PREPACK struct {
+    A_UINT8     powerMode;      /* WMI_POWER_MODE */
+} POSTPACK WMI_POWER_MODE_CMD;
+
+typedef PREPACK struct {
+    A_INT8 status;      /* WMI_SET_PARAMS_REPLY */
+} POSTPACK WMI_SET_PARAMS_REPLY;
+
+typedef PREPACK struct {
+    A_UINT32 opcode;
+    A_UINT32 length;
+    A_CHAR buffer[1];      /* WMI_SET_PARAMS */
+} POSTPACK WMI_SET_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 multicast_mac[ATH_MAC_LEN];      /* WMI_SET_MCAST_FILTER */
+} POSTPACK WMI_SET_MCAST_FILTER_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;      /* WMI_MCAST_FILTER */
+} POSTPACK WMI_MCAST_FILTER_CMD;
+
+/*
+ * WMI_SET_POWER_PARAMS_CMDID
+ */
+typedef enum {
+    IGNORE_DTIM = 0x01,
+    NORMAL_DTIM = 0x02,
+    STICK_DTIM  = 0x03,
+    AUTO_DTIM   = 0x04,
+} WMI_DTIM_POLICY;
+
+/* Policy to determnine whether TX should wakeup WLAN if sleeping */
+typedef enum {
+    TX_WAKEUP_UPON_SLEEP = 1,
+    TX_DONT_WAKEUP_UPON_SLEEP = 2
+} WMI_TX_WAKEUP_POLICY_UPON_SLEEP;
+
+/*
+ * Policy to determnine whether power save failure event should be sent to
+ * host during scanning
+ */
+typedef enum {
+    SEND_POWER_SAVE_FAIL_EVENT_ALWAYS = 1,
+    IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN = 2,
+} POWER_SAVE_FAIL_EVENT_POLICY;
+
+typedef PREPACK struct {
+    A_UINT16    idle_period;             /* msec */
+    A_UINT16    pspoll_number;
+    A_UINT16    dtim_policy;
+    A_UINT16    tx_wakeup_policy;
+    A_UINT16    num_tx_to_wakeup;
+    A_UINT16    ps_fail_event_policy;
+} POSTPACK WMI_POWER_PARAMS_CMD;
+
+/* Adhoc power save types */
+typedef enum {
+    ADHOC_PS_DISABLE=1,
+    ADHOC_PS_ATH=2,
+    ADHOC_PS_IEEE=3,
+    ADHOC_PS_OTHER=4,
+} WMI_ADHOC_PS_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8    power_saving;
+    A_UINT8    ttl; /* number of beacon periods */
+    A_UINT16   atim_windows;          /* msec */
+    A_UINT16   timeout_value;         /* msec */
+} POSTPACK WMI_IBSS_PM_CAPS_CMD;
+
+/* AP power save types */
+typedef enum {
+    AP_PS_DISABLE=1,
+    AP_PS_ATH=2,
+} WMI_AP_PS_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32   idle_time;   /* in msec */
+    A_UINT32   ps_period;   /* in usec */
+    A_UINT8    sleep_period; /* in ps periods */
+    A_UINT8    psType;
+} POSTPACK WMI_AP_PS_CMD;
+
+/*
+ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
+ */
+typedef enum {
+    IGNORE_TIM_ALL_QUEUES_APSD = 0,
+    PROCESS_TIM_ALL_QUEUES_APSD = 1,
+    IGNORE_TIM_SIMULATED_APSD = 2,
+    PROCESS_TIM_SIMULATED_APSD = 3,
+} APSD_TIM_POLICY;
+
+typedef PREPACK struct {
+    A_UINT16    psPollTimeout;          /* msec */
+    A_UINT16    triggerTimeout;         /* msec */
+    A_UINT32    apsdTimPolicy;      /* TIM behavior with  ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
+    A_UINT32    simulatedAPSDTimPolicy;      /* TIM behavior with  simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
+} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
+
+/*
+ * WMI_SET_VOICE_PKT_SIZE_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16    voicePktSize;
+} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
+
+/*
+ * WMI_SET_MAX_SP_LEN_CMDID
+ */
+typedef enum {
+    DELIVER_ALL_PKT = 0x0,
+    DELIVER_2_PKT = 0x1,
+    DELIVER_4_PKT = 0x2,
+    DELIVER_6_PKT = 0x3,
+} APSD_SP_LEN_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8    maxSPLen;
+} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
+
+/*
+ * WMI_SET_DISC_TIMEOUT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     disconnectTimeout;          /* seconds */
+} POSTPACK WMI_DISC_TIMEOUT_CMD;
+
+typedef enum {
+    UPLINK_TRAFFIC = 0,
+    DNLINK_TRAFFIC = 1,
+    BIDIR_TRAFFIC = 2,
+} DIR_TYPE;
+
+typedef enum {
+    DISABLE_FOR_THIS_AC = 0,
+    ENABLE_FOR_THIS_AC  = 1,
+    ENABLE_FOR_ALL_AC   = 2,
+} VOICEPS_CAP_TYPE;
+
+typedef enum {
+    TRAFFIC_TYPE_APERIODIC = 0,
+    TRAFFIC_TYPE_PERIODIC = 1,
+}TRAFFIC_TYPE;
+
+/*
+ * WMI_SYNCHRONIZE_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8 dataSyncMap;
+} POSTPACK WMI_SYNC_CMD;
+
+/*
+ * WMI_CREATE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT32        minServiceInt;           /* in milli-sec */
+    A_UINT32        maxServiceInt;           /* in milli-sec */
+    A_UINT32        inactivityInt;           /* in milli-sec */
+    A_UINT32        suspensionInt;           /* in milli-sec */
+    A_UINT32        serviceStartTime;
+    A_UINT32        minDataRate;             /* in bps */
+    A_UINT32        meanDataRate;            /* in bps */
+    A_UINT32        peakDataRate;            /* in bps */
+    A_UINT32        maxBurstSize;
+    A_UINT32        delayBound;
+    A_UINT32        minPhyRate;              /* in bps */
+    A_UINT32        sba;
+    A_UINT32        mediumTime;
+    A_UINT16        nominalMSDU;             /* in octects */
+    A_UINT16        maxMSDU;                 /* in octects */
+    A_UINT8         trafficClass;
+    A_UINT8         trafficDirection;        /* DIR_TYPE */
+    A_UINT8         rxQueueNum;
+    A_UINT8         trafficType;             /* TRAFFIC_TYPE */
+    A_UINT8         voicePSCapability;       /* VOICEPS_CAP_TYPE */
+    A_UINT8         tsid;
+    A_UINT8         userPriority;            /* 802.1D user priority */
+    A_UINT8         nominalPHY;              /* nominal phy rate */
+} POSTPACK WMI_CREATE_PSTREAM_CMD;
+
+/*
+ * WMI_DELETE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;
+    A_UINT8     trafficClass;
+    A_UINT8     tsid;
+} POSTPACK WMI_DELETE_PSTREAM_CMD;
+
+/*
+ * WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+typedef enum {
+    WMI_11A_MODE  = 0x1,
+    WMI_11G_MODE  = 0x2,
+    WMI_11AG_MODE = 0x3,
+    WMI_11B_MODE  = 0x4,
+    WMI_11GONLY_MODE = 0x5,
+} WMI_PHY_MODE;
+
+#define WMI_MAX_CHANNELS        32
+
+typedef PREPACK struct {
+    A_UINT8     reserved1;
+    A_UINT8     scanParam;              /* set if enable scan */
+    A_UINT8     phyMode;                /* see WMI_PHY_MODE */
+    A_UINT8     numChannels;            /* how many channels follow */
+    A_UINT16    channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_CHANNEL_PARAMS_CMD;
+
+
+/*
+ *  WMI_RSSI_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ *  Threshold values are in the ascending order, and should agree to:
+ *  (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
+ *      < highThreshold_upperVal)
+ */
+
+typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
+    A_INT16     thresholdAbove1_Val;          /* lowest of upper */
+    A_INT16     thresholdAbove2_Val;
+    A_INT16     thresholdAbove3_Val;
+    A_INT16     thresholdAbove4_Val;
+    A_INT16     thresholdAbove5_Val;
+    A_INT16     thresholdAbove6_Val;          /* highest of upper */
+    A_INT16     thresholdBelow1_Val;         /* lowest of bellow */
+    A_INT16     thresholdBelow2_Val;
+    A_INT16     thresholdBelow3_Val;
+    A_INT16     thresholdBelow4_Val;
+    A_INT16     thresholdBelow5_Val;
+    A_INT16     thresholdBelow6_Val;         /* highest of bellow */
+    A_UINT8     weight;                  /* "alpha" */
+    A_UINT8     reserved[3];
+} POSTPACK  WMI_RSSI_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_SNR_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ */
+
+typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
+    A_UINT8     weight;                  /* "alpha" */
+    A_UINT8     thresholdAbove1_Val;      /* lowest of uppper*/
+    A_UINT8     thresholdAbove2_Val;
+    A_UINT8     thresholdAbove3_Val;
+    A_UINT8     thresholdAbove4_Val;      /* highest of upper */
+    A_UINT8     thresholdBelow1_Val;     /* lowest of bellow */
+    A_UINT8     thresholdBelow2_Val;
+    A_UINT8     thresholdBelow3_Val;
+    A_UINT8     thresholdBelow4_Val;     /* highest of bellow */
+    A_UINT8     reserved[3];
+} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_LQ_THRESHOLD_PARAMS_CMDID
+ */
+typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
+    A_UINT8     enable;
+    A_UINT8     thresholdAbove1_Val;
+    A_UINT8     thresholdAbove2_Val;
+    A_UINT8     thresholdAbove3_Val;
+    A_UINT8     thresholdAbove4_Val;
+    A_UINT8     thresholdBelow1_Val;
+    A_UINT8     thresholdBelow2_Val;
+    A_UINT8     thresholdBelow3_Val;
+    A_UINT8     thresholdBelow4_Val;
+    A_UINT8     reserved[3];
+} POSTPACK  WMI_LQ_THRESHOLD_PARAMS_CMD;
+
+typedef enum {
+    WMI_LPREAMBLE_DISABLED = 0,
+    WMI_LPREAMBLE_ENABLED
+} WMI_LPREAMBLE_STATUS;
+
+typedef enum {
+    WMI_IGNORE_BARKER_IN_ERP = 0,
+    WMI_DONOT_IGNORE_BARKER_IN_ERP
+} WMI_PREAMBLE_POLICY;
+
+typedef PREPACK struct {
+    A_UINT8     status;
+    A_UINT8     preamblePolicy;
+}POSTPACK WMI_SET_LPREAMBLE_CMD;
+
+typedef PREPACK struct {
+    A_UINT16    threshold;
+}POSTPACK WMI_SET_RTS_CMD;
+
+/*
+ *  WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ *  Sets the error reporting event bitmask in target. Target clears it
+ *  upon an error. Subsequent errors are counted, but not reported
+ *  via event, unless the bitmask is set again.
+ */
+typedef PREPACK struct {
+    A_UINT32    bitmask;
+} POSTPACK  WMI_TARGET_ERROR_REPORT_BITMASK;
+
+/*
+ * WMI_SET_TX_PWR_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     dbM;                  /* in dbM units */
+} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
+
+/*
+ * WMI_SET_ASSOC_INFO_CMDID
+ *
+ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
+ * A 3rd one, the CCX version IE can also be set from the host.
+ */
+
+/*
+ * Bit 7: 1 CCX cckm ie upload to host, 0 default, don't upload
+ * Bit 6: 1 ccx radio measurement upload to host, 0 default, don't upload
+ * Bit 3~5: reserved
+ * Bit 0~2: ccx version
+ */
+
+#define WMI_CCX_VERSION_MASK            0x7
+#define WMI_CCX_CCKMIE_UPLOAD_MASK      (0x1 << 7)
+#define WMI_CCX_RM_UPLOAD_MASK   (0x1 << 6)
+
+#define WMI_MAX_ASSOC_INFO_TYPE    2
+#define WMI_CCX_VER_IE             2 /* ieType to set CCX Version IE */
+
+#define WMI_MAX_ASSOC_INFO_LEN     240
+
+typedef PREPACK struct {
+    A_UINT8     ieType;
+    A_UINT8     bufferSize;
+    A_UINT8     assocInfo[1];       /* up to WMI_MAX_ASSOC_INFO_LEN */
+} POSTPACK WMI_SET_ASSOC_INFO_CMD;
+
+
+/*
+ * WMI_GET_TX_PWR_CMDID does not take any parameters
+ */
+
+/*
+ * WMI_ADD_BAD_AP_CMDID
+ */
+#define WMI_MAX_BAD_AP_INDEX      1
+
+typedef PREPACK struct {
+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_BAD_AP_CMD;
+
+/*
+ * WMI_DELETE_BAD_AP_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+} POSTPACK WMI_DELETE_BAD_AP_CMD;
+
+/*
+ * WMI_SET_ACCESS_PARAMS_CMDID
+ */
+#define WMI_DEFAULT_TXOP_ACPARAM    0       /* implies one MSDU */
+#define WMI_DEFAULT_ECWMIN_ACPARAM  4       /* corresponds to CWmin of 15 */
+#define WMI_DEFAULT_ECWMAX_ACPARAM  10      /* corresponds to CWmax of 1023 */
+#define WMI_MAX_CW_ACPARAM          15      /* maximum eCWmin or eCWmax */
+#define WMI_DEFAULT_AIFSN_ACPARAM   2
+#define WMI_MAX_AIFSN_ACPARAM       15
+typedef PREPACK struct {
+    A_UINT16 txop;                      /* in units of 32 usec */
+    A_UINT8  eCWmin;
+    A_UINT8  eCWmax;
+    A_UINT8  aifsn;
+    A_UINT8  ac;
+} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
+
+
+/*
+ * WMI_SET_RETRY_LIMITS_CMDID
+ *
+ * This command is used to customize the number of retries the
+ * wlan device will perform on a given frame.
+ */
+#define WMI_MIN_RETRIES 2
+#define WMI_MAX_RETRIES 13
+typedef enum {
+    MGMT_FRAMETYPE    = 0,
+    CONTROL_FRAMETYPE = 1,
+    DATA_FRAMETYPE    = 2
+} WMI_FRAMETYPE;
+
+typedef PREPACK struct {
+    A_UINT8 frameType;                      /* WMI_FRAMETYPE */
+    A_UINT8 trafficClass;                   /* applies only to DATA_FRAMETYPE */
+    A_UINT8 maxRetries;
+    A_UINT8 enableNotify;
+} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
+
+/*
+ * WMI_SET_ROAM_CTRL_CMDID
+ *
+ * This command is used to influence the Roaming behaviour
+ * Set the host biases of the BSSs before setting the roam mode as bias
+ * based.
+ */
+
+/*
+ * Different types of Roam Control
+ */
+
+typedef enum {
+        WMI_FORCE_ROAM          = 1,      /* Roam to the specified BSSID */
+        WMI_SET_ROAM_MODE       = 2,      /* default ,progd bias, no roam */
+        WMI_SET_HOST_BIAS       = 3,     /* Set the Host Bias */
+        WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
+} WMI_ROAM_CTRL_TYPE;
+
+#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
+#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
+
+/*
+ * ROAM MODES
+ */
+
+typedef enum {
+        WMI_DEFAULT_ROAM_MODE   = 1,  /* RSSI based ROAM */
+        WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
+        WMI_LOCK_BSS_MODE  = 3  /* Lock to the Current BSS - no Roam */
+} WMI_ROAM_MODE;
+
+/*
+ * BSS HOST BIAS INFO
+ */
+
+typedef PREPACK struct {
+        A_UINT8 bssid[ATH_MAC_LEN];
+        A_INT8  bias;
+} POSTPACK WMI_BSS_BIAS;
+
+typedef PREPACK struct {
+        A_UINT8 numBss;
+        WMI_BSS_BIAS bssBias[1];
+} POSTPACK WMI_BSS_BIAS_INFO;
+
+typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
+        A_UINT16 lowrssi_scan_period;
+        A_INT16  lowrssi_scan_threshold;
+        A_INT16  lowrssi_roam_threshold;
+        A_UINT8  roam_rssi_floor;
+        A_UINT8  reserved[1];              /* For alignment */
+} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
+
+typedef PREPACK struct {
+    PREPACK union {
+        A_UINT8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
+        A_UINT8 roamMode;           /* WMI_SET_ROAM_MODE  */
+        WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
+        WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
+    } POSTPACK info;
+    A_UINT8   roamCtrlType ;
+} POSTPACK WMI_SET_ROAM_CTRL_CMD;
+
+/*
+ * WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID
+ */
+typedef enum {
+    BT_WLAN_CONN_PRECDENCE_WLAN=0,  /* Default */
+    BT_WLAN_CONN_PRECDENCE_PAL,
+} BT_WLAN_CONN_PRECEDENCE;
+
+typedef PREPACK struct {
+    A_UINT8 precedence;
+} POSTPACK WMI_SET_BT_WLAN_CONN_PRECEDENCE;
+
+/*
+ * WMI_ENABLE_RM_CMDID
+ */
+typedef PREPACK struct {
+        A_BOOL enable_radio_measurements;
+} POSTPACK WMI_ENABLE_RM_CMD;
+
+/*
+ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
+ */
+typedef PREPACK struct {
+        A_UINT8 max_offhome_duration;
+} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 frequency;
+    A_UINT8  threshold;
+} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
+
+typedef enum {
+    WMI_PKTLOG_CMD_DISABLE,
+    WMI_PKTLOG_CMD_SETSIZE,
+} WMI_PKTLOG_CMD;
+
+#define PKTLOG_MAX_BYTES 4096
+
+typedef PREPACK struct {
+    A_UINT32 nbytes;
+    A_UINT8 buffer[PKTLOG_MAX_BYTES];
+} POSTPACK WMI_GET_PKTLOG_CMD;
+
+/* LPL commands */
+typedef PREPACK struct  {
+    A_UINT8 lplPolicy; /*0 - force off, 1 force on, 2 dynamic*/
+    A_UINT8 noBlockerDetect; /*don't do blocker detection if lpl policy is set
+                               to dynamic*/
+    A_UINT8 noRfbDetect; /*don't do rate fall back  detection if lpl policy is set
+                               to dynamic*/
+    A_UINT8 rsvd;
+} POSTPACK  WMI_LPL_FORCE_ENABLE_CMD;
+
+/*command structure for all policy related commands*/
+typedef PREPACK struct  {  
+    A_UINT64    index;
+    A_BOOL      value;
+} POSTPACK  WMI_LPL_POLICY_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    rfbPeriod;
+    A_UINT32    rfbObsDuration;
+    A_UINT32    blockerBeaconRssi;
+    A_UINT8     chanOff;
+    A_UINT32    rfbDiffThold;
+    A_UINT32    bRssiThold;
+    A_UINT32    maxBlockerRssi;
+} POSTPACK WMI_LPL_PARAMS_CMD;
+
+typedef enum {
+    WMI_PKTLOG_OPTION_LOG_TCP_HEADERS = 0x1,
+    WMI_PKTLOG_OPTION_TRIGGER_THRUPUT = 0x2,
+    WMI_PKTLOG_OPTION_TRIGGER_SACK    = 0x4,
+    WMI_PKTLOG_OPTION_TRIGGER_PER     = 0x8
+} WMI_PKTLOG_OPTION;
+
+typedef enum {
+    WMI_PKTLOG_EVENT_RX  = 0x1,
+    WMI_PKTLOG_EVENT_TX  = 0x2,
+    WMI_PKTLOG_EVENT_RCF = 0x4, /* Rate Control Find */
+    WMI_PKTLOG_EVENT_RCU = 0x8, /* Rate Control Update */
+} WMI_PKTLOG_EVENT;
+
+typedef PREPACK struct {
+    WMI_PKTLOG_EVENT evlist;
+    WMI_PKTLOG_OPTION option;
+    A_UINT32 trigger_thresh;
+    A_UINT32 trigger_interval;
+    A_UINT32 trigger_tail_count;
+    A_UINT32 buffer_size;
+} POSTPACK WMI_ENABLE_PKTLOG_CMD;
+
+typedef enum {
+    WMI_SMPS_OPTION_MODE          = 0x1,
+    WMI_SMPS_OPTION_AUTO          = 0x2,
+    WMI_SMPS_OPTION_DATATHRESH    = 0x4,
+    WMI_SMPS_OPTION_RSSITHRESH    = 0x8,
+} WMI_SMPS_OPTION;
+
+typedef enum {
+    WMI_SMPS_MODE_STATIC    = 0x1,
+    WMI_SMPS_MODE_DYNAMIC   = 0x2,
+} WMI_SMPS_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 flags;      /* To indicate which options have changed */
+    A_UINT8 rssiThresh;
+    A_UINT8 dataThresh;
+    A_UINT8 mode;       /* static/dynamic */
+    A_UINT8 automatic;
+} POSTPACK WMI_CONFIG_SMPS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;      /* Enable/disable */
+} POSTPACK WMI_ENABLE_SMPS_CMD;
+
+
+typedef enum {
+    WMI_CCX_RM_STATUS_UNKNOWN = 0,
+    WMI_CCX_RM_REPORT_SENT,
+    WMI_CCX_RM_REFUSE_REPORT_SENT,
+    WMI_CCX_RM_STATUS_MAX
+} WMI_CCX_RM_STATUS_TYPE;
+
+/*---------------------- BTCOEX RELATED -------------------------------------*/
+/*----------------------COMMON to AR6002 and AR6003 -------------------------*/
+typedef enum {
+    BT_STREAM_UNDEF = 0,
+    BT_STREAM_SCO,             /* SCO stream */
+    BT_STREAM_A2DP,            /* A2DP stream */
+    BT_STREAM_SCAN,            /* BT Discovery or Page */
+    BT_STREAM_ESCO,
+    BT_STREAM_MAX
+} BT_STREAM_TYPE;
+
+typedef enum {
+    BT_PARAM_SCO_PSPOLL_LATENCY_ONE_FOURTH =1,
+    BT_PARAM_SCO_PSPOLL_LATENCY_HALF,
+    BT_PARAM_SCO_PSPOLL_LATENCY_THREE_FOURTH,
+} BT_PARAMS_SCO_PSPOLL_LATENCY;
+
+typedef enum {
+    BT_PARAMS_SCO_STOMP_SCO_NEVER =1,
+    BT_PARAMS_SCO_STOMP_SCO_ALWAYS,
+    BT_PARAMS_SCO_STOMP_SCO_IN_LOWRSSI,
+} BT_PARAMS_SCO_STOMP_RULES;
+
+typedef enum {
+    BT_STATUS_UNDEF = 0,
+    BT_STATUS_ON,
+    BT_STATUS_OFF,
+    BT_STATUS_MAX
+} BT_STREAM_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8 streamType;
+    A_UINT8 status;
+} POSTPACK WMI_SET_BT_STATUS_CMD;
+
+typedef enum {
+    BT_ANT_TYPE_UNDEF=0,
+    BT_ANT_TYPE_DUAL,
+    BT_ANT_TYPE_SPLITTER,
+    BT_ANT_TYPE_SWITCH,
+    BT_ANT_TYPE_HIGH_ISO_DUAL
+} BT_ANT_FRONTEND_CONFIG;
+
+typedef enum {
+    BT_COLOCATED_DEV_BTS4020=0,
+    BT_COLCATED_DEV_CSR ,
+    BT_COLOCATED_DEV_VALKYRIE
+} BT_COLOCATED_DEV_TYPE;
+
+/*********************** Applicable to AR6002 ONLY ******************************/
+
+typedef enum {
+    BT_PARAM_SCO = 1,         /* SCO stream parameters */
+    BT_PARAM_A2DP ,
+    BT_PARAM_ANTENNA_CONFIG,
+    BT_PARAM_COLOCATED_BT_DEVICE,
+    BT_PARAM_ACLCOEX,
+    BT_PARAM_11A_SEPARATE_ANT,
+    BT_PARAM_MAX
+} BT_PARAM_TYPE;
+
+
+#define BT_SCO_ALLOW_CLOSE_RANGE_OPT    (1 << 0)
+#define BT_SCO_FORCE_AWAKE_OPT          (1 << 1)
+#define BT_SCO_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_SCO_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_SCO_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_SCO_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_SCO_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_SCO_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_SCO_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_SCO_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    A_UINT32 numScoCyclesForceTrigger;  /* Number SCO cycles after which
+                                           force a pspoll. default = 10 */
+    A_UINT32 dataResponseTimeout;       /* Timeout Waiting for Downlink pkt
+                                           in response for ps-poll,
+                                           default = 10 msecs */
+    A_UINT32  stompScoRules;
+    A_UINT32 scoOptFlags;               /* SCO Options Flags :
+                                            bits:     meaning:
+                                             0        Allow Close Range Optimization
+                                             1        Force awake during close range
+                                             2        If set use host supplied RSSI for OPT
+                                             3        If set use host supplied RTS COUNT for OPT
+                                             4..7     Unused
+                                             8..15    Low Data Rate Min Cnt
+                                             16..23   Low Data Rate Max Cnt
+                                        */
+
+    A_UINT8 stompDutyCyleVal;           /* Sco cycles to limit ps-poll queuing
+                                           if stomped */
+    A_UINT8 stompDutyCyleMaxVal;        /*firm ware increases stomp duty cycle
+                                          gradually uptill this value on need basis*/
+    A_UINT8 psPollLatencyFraction;      /* Fraction of idle
+                                           period, within which
+                                           additional ps-polls
+                                           can be queued */
+    A_UINT8 noSCOSlots;                 /* Number of SCO Tx/Rx slots.
+                                           HVx, EV3, 2EV3 = 2 */
+    A_UINT8 noIdleSlots;                /* Number of Bluetooth idle slots between
+                                           consecutive SCO Tx/Rx slots
+                                           HVx, EV3 = 4
+                                           2EV3 = 10 */
+    A_UINT8 scoOptOffRssi;/*RSSI value below which we go to ps poll*/
+    A_UINT8 scoOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    A_UINT8 scoOptRtsCount;
+} POSTPACK BT_PARAMS_SCO;
+
+#define BT_A2DP_ALLOW_CLOSE_RANGE_OPT  (1 << 0)
+#define BT_A2DP_FORCE_AWAKE_OPT        (1 << 1)
+#define BT_A2DP_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_A2DP_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_A2DP_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_A2DP_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_A2DP_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_A2DP_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_A2DP_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_A2DP_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    A_UINT32 a2dpWlanUsageLimit; /* MAX time firmware uses the medium for
+                                    wlan, after it identifies the idle time
+                                    default (30 msecs) */
+    A_UINT32 a2dpBurstCntMin;   /* Minimum number of bluetooth data frames
+                                   to replenish Wlan Usage  limit (default 3) */
+    A_UINT32 a2dpDataRespTimeout;
+    A_UINT32 a2dpOptFlags;      /* A2DP Option flags:
+                                       bits:    meaning:
+                                        0       Allow Close Range Optimization
+                                        1       Force awake during close range
+                                        2        If set use host supplied RSSI for OPT
+                                        3        If set use host supplied RTS COUNT for OPT
+                                        4..7    Unused
+                                        8..15   Low Data Rate Min Cnt
+                                        16..23  Low Data Rate Max Cnt
+                                 */
+    A_UINT8 isCoLocatedBtRoleMaster;
+    A_UINT8 a2dpOptOffRssi;/*RSSI value below which we go to ps poll*/
+    A_UINT8 a2dpOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    A_UINT8 a2dpOptRtsCount;
+}POSTPACK BT_PARAMS_A2DP;
+
+/* During BT ftp/ BT OPP or any another data based acl profile on bluetooth
+   (non a2dp).*/
+typedef PREPACK struct {
+    A_UINT32 aclWlanMediumUsageTime;  /* Wlan usage time during Acl (non-a2dp)
+                                       coexistence (default 30 msecs) */
+    A_UINT32 aclBtMediumUsageTime;   /* Bt usage time during acl coexistence
+                                       (default 30 msecs)*/
+    A_UINT32 aclDataRespTimeout;
+    A_UINT32 aclDetectTimeout;      /* ACL coexistence enabled if we get
+                                       10 Pkts in X msec(default 100 msecs) */
+    A_UINT32 aclmaxPktCnt;          /* No of ACL pkts to receive before
+                                         enabling ACL coex */
+
+}POSTPACK BT_PARAMS_ACLCOEX;
+
+typedef PREPACK struct {
+    PREPACK union {
+        BT_PARAMS_SCO scoParams;
+        BT_PARAMS_A2DP a2dpParams;
+        BT_PARAMS_ACLCOEX  aclCoexParams;
+        A_UINT8 antType;         /* 0 -Disabled (default)
+                                     1 - BT_ANT_TYPE_DUAL
+                                     2 - BT_ANT_TYPE_SPLITTER
+                                     3 - BT_ANT_TYPE_SWITCH */
+        A_UINT8 coLocatedBtDev;  /* 0 - BT_COLOCATED_DEV_BTS4020 (default)
+                                     1 - BT_COLCATED_DEV_CSR
+                                     2 - BT_COLOCATED_DEV_VALKYRIe
+                                   */
+    } POSTPACK info;
+    A_UINT8 paramType ;
+} POSTPACK WMI_SET_BT_PARAMS_CMD;
+
+/************************ END AR6002 BTCOEX *******************************/
+/*-----------------------AR6003 BTCOEX -----------------------------------*/
+
+/*  ---------------WMI_SET_BTCOEX_FE_ANT_CMDID --------------------------*/
+/* Indicates front end antenna configuration. This command needs to be issued
+ * right after initialization and after WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID.
+ * AR6003 enables coexistence and antenna switching based on the configuration.
+ */
+typedef enum {
+    WMI_BTCOEX_NOT_ENABLED = 0,
+    WMI_BTCOEX_FE_ANT_SINGLE =1,
+    WMI_BTCOEX_FE_ANT_DUAL=2,
+    WMI_BTCOEX_FE_ANT_DUAL_HIGH_ISO=3,
+    WMI_BTCOEX_FE_ANT_DUAL_SH_BT_LOW_ISO = 4,
+    WMI_BTCOEX_FE_ANT_DUAL_SH_BT_HIGH_ISO = 5,
+    WMI_BTCOEX_FE_ANT_TYPE_MAX
+}WMI_BTCOEX_FE_ANT_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8 btcoexFeAntType; /* 1 - WMI_BTCOEX_FE_ANT_SINGLE for single antenna front end
+                                2 - WMI_BTCOEX_FE_ANT_DUAL for dual antenna front end
+                                    (for isolations less 35dB, for higher isolation there
+                                    is not need to pass this command).
+                                    (not implemented)
+                              */
+}POSTPACK WMI_SET_BTCOEX_FE_ANT_CMD;
+
+/* -------------WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID ----------------*/
+/* Indicate the bluetooth chip to the firmware. Firmware can have different algorithm based
+ * bluetooth chip type.Based on bluetooth device, different coexistence protocol would be used.
+ */
+typedef PREPACK struct {
+    A_UINT8 btcoexCoLocatedBTdev; /*1 - Qcom BT (3 -wire PTA)
+                                    2 - CSR BT  (3 wire PTA)
+                                    3 - Atheros 3001 BT (3 wire PTA)
+                                    4 - STE bluetooth (4-wire ePTA)
+                                    5 - Atheros 3002 BT (4-wire MCI)
+                                    defaults= 3 (Atheros 3001 BT )
+                                    */
+}POSTPACK WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD;
+
+/* -------------WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID ------------*/
+/* Configuration parameters during bluetooth inquiry and page. Page configuration
+ * is applicable only on interfaces which can distinguish page (applicable only for ePTA -
+ * STE bluetooth).
+ * Bluetooth inquiry start and end is indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID.
+ * During this the station will be  power-save mode.
+ */
+typedef PREPACK struct {
+    A_UINT32 btInquiryDataFetchFrequency;/* The frequency of querying the AP for data
+                                            (via pspoll) is configured by this parameter.
+                                            "default = 10 ms" */
+
+    A_UINT32 protectBmissDurPostBtInquiry;/* The firmware will continue to be in inquiry state
+                                             for configured duration, after inquiry completion
+                                             . This is to ensure other bluetooth transactions
+                                             (RDP, SDP profiles, link key exchange ...etc)
+                                             goes through smoothly without wifi stomping.
+                                             default = 10 secs*/
+
+    A_UINT32 maxpageStomp;                 /*Applicable only for STE-BT interface. Currently not
+                                             used */
+    A_UINT32 btInquiryPageFlag;           /* Not used */
+}POSTPACK WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD;
+
+/*---------------------WMI_SET_BTCOEX_SCO_CONFIG_CMDID ---------------*/
+/* Configure  SCO parameters. These parameters would be used whenever firmware is indicated
+ * of (e)SCO profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configration of BTCOEX_SCO_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between sco gaps.
+ * Opt Mode - station is in awake state and access point can send data to station any time.
+ * BTCOEX_PSPOLLMODE_SCO_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_SCO_CONFIG - Configuration applied only during opt mode.
+ */
+#define WMI_SCO_CONFIG_FLAG_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_SCO_CONFIG_FLAG_IS_EDR_CAPABLE       (1 << 1)
+#define WMI_SCO_CONFIG_FLAG_IS_BT_MASTER         (1 << 2)
+#define WMI_SCO_CONFIG_FLAG_FW_DETECT_OF_PER     (1 << 3)
+typedef PREPACK struct {
+    A_UINT32 scoSlots;                  /* Number of SCO Tx/Rx slots.
+                                           HVx, EV3, 2EV3 = 2 */
+    A_UINT32 scoIdleSlots;              /* Number of Bluetooth idle slots between
+                                           consecutive SCO Tx/Rx slots
+                                           HVx, EV3 = 4
+                                           2EV3 = 10
+                                         */
+    A_UINT32 scoFlags;                 /* SCO Options Flags :
+                                          bits:    meaning:
+                                          0   Allow Close Range Optimization
+                                          1   Is EDR capable or Not
+                                          2   IS Co-located Bt role Master
+                                          3   Firmware determines the periodicity of SCO.
+                                         */
+
+    A_UINT32 linkId;                      /* applicable to STE-BT - not used */
+}POSTPACK BTCOEX_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32  scoCyclesForceTrigger;    /* Number SCO cycles after which
+                                            force a pspoll. default = 10 */
+    A_UINT32 scoDataResponseTimeout;     /* Timeout Waiting for Downlink pkt
+                                            in response for ps-poll,
+                                            default = 20 msecs */
+
+    A_UINT32 scoStompDutyCyleVal;        /* not implemented */
+
+    A_UINT32 scoStompDutyCyleMaxVal;     /*Not implemented */
+
+    A_UINT32 scoPsPollLatencyFraction;   /* Fraction of idle
+                                            period, within which
+                                            additional ps-polls can be queued
+                                            1 - 1/4 of idle duration
+                                            2 - 1/2 of idle duration
+                                            3 - 3/4 of idle duration
+                                            default =2 (1/2)
+                                           */
+}POSTPACK BTCOEX_PSPOLLMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 scoStompCntIn100ms;/*max number of SCO stomp in 100ms allowed in
+                                   opt mode. If exceeds the configured value,
+                                   switch to ps-poll mode
+                                  default = 3 */
+
+    A_UINT32 scoContStompMax;   /* max number of continous stomp allowed in opt mode.
+                                   if excedded switch to pspoll mode
+                                    default = 3 */
+
+    A_UINT32 scoMinlowRateMbps; /* Low rate threshold */
+
+    A_UINT32 scoLowRateCnt;     /* number of low rate pkts (< scoMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+    A_UINT32 scoHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+    A_UINT32 scoMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                   Recommended value Basic rate headsets = 1, EDR (2-EV3)  =4.
+                                 */
+}POSTPACK BTCOEX_OPTMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 scanInterval;
+    A_UINT32 maxScanStompCnt;
+}POSTPACK BTCOEX_WLANSCAN_SCO_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_SCO_CONFIG scoConfig;
+    BTCOEX_PSPOLLMODE_SCO_CONFIG scoPspollConfig;
+    BTCOEX_OPTMODE_SCO_CONFIG scoOptModeConfig;
+    BTCOEX_WLANSCAN_SCO_CONFIG scoWlanScanConfig;
+}POSTPACK WMI_SET_BTCOEX_SCO_CONFIG_CMD;
+
+/* ------------------WMI_SET_BTCOEX_A2DP_CONFIG_CMDID -------------------*/
+/* Configure A2DP profile parameters. These parameters would be used whenver firmware is indicated
+ * of A2DP profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configuration of BTCOEX_A2DP_CONFIG data structure are common configuration and applies to
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between a2dp data bursts.
+ * Opt Mode - station is in power save during a2dp bursts and awake in the gaps.
+ * BTCOEX_PSPOLLMODE_A2DP_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_A2DP_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_A2DP_CONFIG_FLAG_ALLOW_OPTIMIZATION    (1 << 0)
+#define WMI_A2DP_CONFIG_FLAG_IS_EDR_CAPABLE        (1 << 1)
+#define WMI_A2DP_CONFIG_FLAG_IS_BT_ROLE_MASTER     (1 << 2)
+#define WMI_A2DP_CONFIG_FLAG_IS_A2DP_HIGH_PRI      (1 << 3)
+#define WMI_A2DP_CONFIG_FLAG_FIND_BT_ROLE          (1 << 4)
+
+typedef PREPACK struct {
+    A_UINT32 a2dpFlags;      /* A2DP Option flags:
+                                bits:    meaning:
+                                0       Allow Close Range Optimization
+                                1       IS EDR capable
+                                2       IS Co-located Bt role Master
+                                3       a2dp traffic is high priority
+                                4       Fw detect the role of bluetooth.
+                             */
+    A_UINT32 linkId;         /* Applicable only to STE-BT - not used */
+
+}POSTPACK BTCOEX_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 a2dpWlanMaxDur; /* MAX time firmware uses the medium for
+                                wlan, after it identifies the idle time
+                                default (30 msecs) */
+
+    A_UINT32 a2dpMinBurstCnt;   /* Minimum number of bluetooth data frames
+                                to replenish Wlan Usage  limit (default 3) */
+
+    A_UINT32 a2dpDataRespTimeout; /* Max duration firmware waits for downlink
+                                     by stomping on  bluetooth
+                                     after ps-poll is acknowledged.
+                                     default = 20 ms
+                                   */
+}POSTPACK BTCOEX_PSPOLLMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 a2dpMinlowRateMbps;  /* Low rate threshold */
+
+    A_UINT32 a2dpLowRateCnt;    /* number of low rate pkts (< a2dpMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+    A_UINT32 a2dpHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+    A_UINT32 a2dpMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                  Recommended value Basic rate headsets = 1, EDR (2-EV3)  =8.
+                                 */
+    A_UINT32 a2dpPktStompCnt;    /*number of a2dp pkts that can be stomped per burst.
+                                   default = 6*/
+
+}POSTPACK BTCOEX_OPTMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_A2DP_CONFIG a2dpConfig;
+    BTCOEX_PSPOLLMODE_A2DP_CONFIG a2dppspollConfig;
+    BTCOEX_OPTMODE_A2DP_CONFIG a2dpOptConfig;
+}POSTPACK WMI_SET_BTCOEX_A2DP_CONFIG_CMD;
+
+/*------------ WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID---------------------*/
+/* Configure non-A2dp ACL profile parameters.The starts of ACL profile can either be
+ * indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID orenabled via firmware detection
+ *  which is configured via "aclCoexFlags".
+ * Configration of BTCOEX_ACLCOEX_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data during wlan medium.
+ * Opt Mode - station is in power save during bluetooth medium time and awake during wlan duration.
+ *             (Not implemented yet)
+ *
+ * BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_ACLCOEX_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_ACLCOEX_FLAGS_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_ACLCOEX_FLAGS_DISABLE_FW_DETECTION (1 << 1)
+
+typedef PREPACK struct {
+    A_UINT32 aclWlanMediumDur;      /* Wlan usage time during Acl (non-a2dp)
+                                        coexistence (default 30 msecs)
+                                    */
+
+    A_UINT32 aclBtMediumDur;       /* Bt usage time during acl coexistence
+                                         (default 30 msecs)
+                                   */
+
+    A_UINT32 aclDetectTimeout;     /* BT activity observation time limit.
+                                      In this time duration, number of bt pkts are counted.
+                                      If the Cnt reaches "aclPktCntLowerLimit" value
+                                      for "aclIterToEnableCoex" iteration continuously,
+                                      firmware gets into ACL coexistence mode.
+                                      Similarly, if bt traffic count during ACL coexistence
+                                      has not reached "aclPktCntLowerLimit" continuously
+                                      for "aclIterToEnableCoex", then ACL coexistence is
+                                      disabled.
+                                      -default 100 msecs
+                                    */
+
+     A_UINT32 aclPktCntLowerLimit;   /* Acl Pkt Cnt to be received in duration of
+                                        "aclDetectTimeout" for
+                                        "aclIterForEnDis" times to enabling ACL coex.
+                                        Similar logic is used to disable acl coexistence.
+                                        (If "aclPktCntLowerLimit"  cnt of acl pkts
+                                         are not seen by the for "aclIterForEnDis"
+                                         then acl coexistence is disabled).
+                                        default = 10
+                                   */
+
+     A_UINT32 aclIterForEnDis;      /* number of Iteration of "aclPktCntLowerLimit" for Enabling and
+                                       Disabling Acl Coexistence.
+                                       default = 3
+                                     */
+
+     A_UINT32 aclPktCntUpperLimit; /* This is upperBound limit, if there is more than
+                                      "aclPktCntUpperLimit" seen in "aclDetectTimeout",
+                                      ACL coexistence is enabled right away.
+                                      - default 15*/
+
+    A_UINT32 aclCoexFlags;          /* A2DP Option flags:
+                                      bits:    meaning:
+                                      0       Allow Close Range Optimization
+                                      1       disable Firmware detection
+                                      (Currently supported configuration is aclCoexFlags =0)
+                                    */
+
+    A_UINT32 linkId;                /* Applicable only for STE-BT - not used */
+
+}POSTPACK BTCOEX_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 aclDataRespTimeout;   /* Max duration firmware waits for downlink
+                                      by stomping on  bluetooth
+                                      after ps-poll is acknowledged.
+                                     default = 20 ms */
+
+}POSTPACK BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG;
+
+
+/* Not implemented yet*/
+typedef PREPACK struct {
+    A_UINT32 aclCoexMinlowRateMbps;
+    A_UINT32 aclCoexLowRateCnt;
+    A_UINT32 aclCoexHighPktRatio;
+    A_UINT32 aclCoexMaxAggrSize;
+    A_UINT32 aclPktStompCnt;
+}POSTPACK BTCOEX_OPTMODE_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_ACLCOEX_CONFIG aclCoexConfig;
+    BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG aclCoexPspollConfig;
+    BTCOEX_OPTMODE_ACLCOEX_CONFIG aclCoexOptConfig;
+}POSTPACK WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD;
+
+/* -----------WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID ------------------*/
+typedef enum {
+    WMI_BTCOEX_BT_PROFILE_SCO =1,
+    WMI_BTCOEX_BT_PROFILE_A2DP,
+    WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE,
+    WMI_BTCOEX_BT_PROFILE_ACLCOEX,
+}WMI_BTCOEX_BT_PROFILE;
+
+typedef PREPACK struct {
+    A_UINT32 btProfileType;
+    A_UINT32 btOperatingStatus;
+    A_UINT32 btLinkId;
+}WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD;
+
+/*--------------------- WMI_SET_BTCOEX_DEBUG_CMDID ---------------------*/
+/* Used for firmware development and debugging */
+typedef PREPACK struct {
+    A_UINT32 btcoexDbgParam1;
+    A_UINT32 btcoexDbgParam2;
+    A_UINT32 btcoexDbgParam3;
+    A_UINT32 btcoexDbgParam4;
+    A_UINT32 btcoexDbgParam5;
+}WMI_SET_BTCOEX_DEBUG_CMD;
+
+/*---------------------WMI_GET_BTCOEX_CONFIG_CMDID --------------------- */
+/* Command to firmware to get configuration parameters of the bt profile
+ * reported via WMI_BTCOEX_CONFIG_EVENTID */
+typedef PREPACK struct {
+    A_UINT32 btProfileType; /* 1 - SCO
+                               2 - A2DP
+                               3 - INQUIRY_PAGE
+                               4 - ACLCOEX
+                            */
+    A_UINT32 linkId;    /* not used */
+}WMI_GET_BTCOEX_CONFIG_CMD;
+
+/*------------------WMI_REPORT_BTCOEX_CONFIG_EVENTID------------------- */
+/* Event from firmware to host, sent in response to WMI_GET_BTCOEX_CONFIG_CMDID
+ * */
+typedef PREPACK struct {
+    A_UINT32 btProfileType;
+    A_UINT32 linkId; /* not used */
+    PREPACK union {
+        WMI_SET_BTCOEX_SCO_CONFIG_CMD scoConfigCmd;
+        WMI_SET_BTCOEX_A2DP_CONFIG_CMD a2dpConfigCmd;
+        WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD aclcoexConfig;
+        WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD btinquiryPageConfigCmd;
+    } POSTPACK info;
+} POSTPACK WMI_BTCOEX_CONFIG_EVENT;
+
+/*------------- WMI_REPORT_BTCOEX_BTCOEX_STATS_EVENTID--------------------*/
+/* Used for firmware development and debugging*/
+typedef PREPACK struct {
+    A_UINT32 highRatePktCnt;
+    A_UINT32 firstBmissCnt;
+    A_UINT32 psPollFailureCnt;
+    A_UINT32 nullFrameFailureCnt;
+    A_UINT32 optModeTransitionCnt;
+}BTCOEX_GENERAL_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    scoStompCntAvg;
+    A_UINT32    scoStompIn100ms;
+    A_UINT32    scoMaxContStomp;
+    A_UINT32    scoAvgNoRetries;
+    A_UINT32    scoMaxNoRetriesIn100ms;
+}BTCOEX_SCO_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    a2dpBurstCnt;
+    A_UINT32    a2dpMaxBurstCnt;
+    A_UINT32    a2dpAvgIdletimeIn100ms;
+    A_UINT32    a2dpAvgStompCnt;
+}BTCOEX_A2DP_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    aclPktCntInBtTime;
+    A_UINT32    aclStompCntInWlanTime;
+    A_UINT32    aclPktCntIn100ms;
+}BTCOEX_ACLCOEX_STATS;
+
+typedef PREPACK struct {
+    BTCOEX_GENERAL_STATS coexStats;
+    BTCOEX_SCO_STATS scoStats;
+    BTCOEX_A2DP_STATS a2dpStats;
+    BTCOEX_ACLCOEX_STATS aclCoexStats;
+}WMI_BTCOEX_STATS_EVENT;
+
+
+/*--------------------------END OF BTCOEX -------------------------------------*/
+
+/* WAC commands
+ */
+
+
+typedef PREPACK struct {
+    A_UINT32    period;
+    A_UINT32    threshold;
+    A_INT32     rssi;
+    A_BOOL      enable;
+    A_CHAR      wps_pin[8];
+}WMI_WAC_ENABLE_CMD;
+
+typedef enum {
+    WAC_MORE_SCAN = -1,
+    WAC_SEND_PROBE_IDX = 0,
+}WAC_SUBCMD;
+
+typedef PREPACK struct {
+    WAC_SUBCMD  cmdid;
+}WMI_WAC_SCAN_REPLY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8     req;
+    A_UINT8     cmd;
+    A_UINT8     frame;
+    A_UINT8     ie[64];
+    A_INT32     status;
+}WMI_WAC_CTRL_REQ_CMD;
+
+/* END OF WAC */
+
+typedef PREPACK struct {
+    A_UINT32 sleepState;
+}WMI_REPORT_SLEEP_STATE_EVENT;
+
+typedef enum {
+    WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP =0,
+    WMI_REPORT_SLEEP_STATUS_IS_AWAKE
+} WMI_REPORT_SLEEP_STATUS;
+typedef enum {
+    DISCONN_EVT_IN_RECONN = 0,  /* default */
+    NO_DISCONN_EVT_IN_RECONN
+} TARGET_EVENT_REPORT_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 evtConfig;
+} POSTPACK WMI_SET_TARGET_EVENT_REPORT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT16    cmd_buf_sz;     /* HCI cmd buffer size */
+    A_UINT8     buf[1];         /* Absolute HCI cmd */
+} POSTPACK WMI_HCI_CMD;
+
+/*
+ * Command Replies
+ */
+
+/*
+ * WMI_GET_CHANNEL_LIST_CMDID reply
+ */
+typedef PREPACK struct {
+    A_UINT8     reserved1;
+    A_UINT8     numChannels;            /* number of channels in reply */
+    A_UINT16    channelList[1];         /* channel in Mhz */
+} POSTPACK WMI_CHANNEL_LIST_REPLY;
+
+typedef enum {
+    A_SUCCEEDED = A_OK,
+    A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
+    A_SUCCEEDED_MODIFY_STREAM=251,
+    A_FAILED_INVALID_STREAM = 252,
+    A_FAILED_MAX_THINSTREAMS = 253,
+    A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
+} PSTREAM_REPLY_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8     status;                 /* PSTREAM_REPLY_STATUS */
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficClass;
+    A_UINT8     trafficDirection;       /* DIR_TYPE */
+} POSTPACK WMI_CRE_PRIORITY_STREAM_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8     status;                 /* PSTREAM_REPLY_STATUS */
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;       /* DIR_TYPE */
+    A_UINT8     trafficClass;
+} POSTPACK WMI_DEL_PRIORITY_STREAM_REPLY;
+
+#ifdef TIME_BASED_DISCARD
+/*
+ * WMI_SET_TBD_TIME_CMDID
+ */
+typedef PREPACK struct{
+	A_UINT32 discardDispostion:1;
+  	A_UINT32 txdiscardTime:31;
+} POSTPACK WMI_SET_TBD_TIME;
+extern WMI_SET_TBD_TIME *txDiscard ;
+#endif
+/*
+ * List of Events (target to host)
+ */
+typedef enum {
+    WMI_READY_EVENTID           = 0x1001,
+    WMI_CONNECT_EVENTID,
+    WMI_DISCONNECT_EVENTID,
+    WMI_BSSINFO_EVENTID,
+    WMI_CMDERROR_EVENTID,
+    WMI_REGDOMAIN_EVENTID,
+    WMI_PSTREAM_TIMEOUT_EVENTID,
+    WMI_NEIGHBOR_REPORT_EVENTID,
+    WMI_TKIP_MICERR_EVENTID,
+    WMI_SCAN_COMPLETE_EVENTID,           /* 0x100a */
+    WMI_REPORT_STATISTICS_EVENTID,
+    WMI_RSSI_THRESHOLD_EVENTID,
+    WMI_ERROR_REPORT_EVENTID,
+    WMI_OPT_RX_FRAME_EVENTID,
+    WMI_REPORT_ROAM_TBL_EVENTID,
+    WMI_EXTENSION_EVENTID,
+    WMI_CAC_EVENTID,
+    WMI_SNR_THRESHOLD_EVENTID,
+    WMI_LQ_THRESHOLD_EVENTID,
+    WMI_TX_RETRY_ERR_EVENTID,            /* 0x1014 */
+    WMI_REPORT_ROAM_DATA_EVENTID,
+    WMI_TEST_EVENTID,
+    WMI_APLIST_EVENTID,
+    WMI_GET_WOW_LIST_EVENTID,
+    WMI_GET_PMKID_LIST_EVENTID,
+    WMI_CHANNEL_CHANGE_EVENTID,
+    WMI_PEER_NODE_EVENTID,
+    WMI_PSPOLL_EVENTID,
+    WMI_DTIMEXPIRY_EVENTID,
+    WMI_WLAN_VERSION_EVENTID,
+    WMI_SET_PARAMS_REPLY_EVENTID,
+    WMI_ADDBA_REQ_EVENTID,              /*0x1020 */
+    WMI_ADDBA_RESP_EVENTID,
+    WMI_DELBA_REQ_EVENTID,
+    WMI_TX_COMPLETE_EVENTID,
+    WMI_HCI_EVENT_EVENTID,
+    WMI_ACL_DATA_EVENTID,
+    WMI_REPORT_SLEEP_STATE_EVENTID,
+    WMI_WAPI_REKEY_EVENTID,
+    WMI_REPORT_BTCOEX_STATS_EVENTID,
+    WMI_REPORT_BTCOEX_CONFIG_EVENTID,
+    WMI_GET_PMK_EVENTID,
+
+    /* DFS Events */
+    WMI_DFS_HOST_ATTACH_EVENTID,    /* 102B */
+    WMI_DFS_HOST_INIT_EVENTID,
+    WMI_DFS_RESET_DELAYLINES_EVENTID,
+    WMI_DFS_RESET_RADARQ_EVENTID,
+    WMI_DFS_RESET_AR_EVENTID,
+    WMI_DFS_RESET_ARQ_EVENTID,
+    WMI_DFS_SET_DUR_MULTIPLIER_EVENTID,
+    WMI_DFS_SET_BANGRADAR_EVENTID,
+    WMI_DFS_SET_DEBUGLEVEL_EVENTID,
+    WMI_DFS_PHYERR_EVENTID,
+    /* CCX Evants */
+    WMI_CCX_RM_STATUS_EVENTID,    /* 1035 */
+
+    /* P2P Events */
+    WMI_P2P_GO_NEG_RESULT_EVENTID,    /* 1036 */
+
+    WMI_WAC_SCAN_DONE_EVENTID,
+    WMI_WAC_REPORT_BSS_EVENTID,
+    WMI_WAC_START_WPS_EVENTID,
+    WMI_WAC_CTRL_REQ_REPLY_EVENTID,
+    WMI_REPORT_WMM_PARAMS_EVENTID,
+    WMI_WAC_REJECT_WPS_EVENTID,
+
+    /* More P2P Events */
+    WMI_P2P_GO_NEG_REQ_EVENTID,
+    WMI_P2P_INVITE_REQ_EVENTID,
+    WMI_P2P_INVITE_RCVD_RESULT_EVENTID,
+    WMI_P2P_INVITE_SENT_RESULT_EVENTID,
+    WMI_P2P_PROV_DISC_RESP_EVENTID,
+    WMI_P2P_PROV_DISC_REQ_EVENTID,
+
+    /*RFKILL Events*/
+    WMI_RFKILL_STATE_CHANGE_EVENTID,
+    WMI_RFKILL_GET_MODE_CMD_EVENTID,
+
+    WMI_P2P_START_SDPD_EVENTID,
+    WMI_P2P_SDPD_RX_EVENTID,
+
+    /* Special event used to notify host that AR6003
+     * has processed sleep command (needed to prevent
+     * a late incoming credit report from crashing
+     * the system)
+     */
+    WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID,
+
+    WMI_THIN_RESERVED_START_EVENTID = 0x8000,
+    /* Events in this range are reserved for thinmode
+     * See wmi_thin.h for actual definitions */
+    WMI_THIN_RESERVED_END_EVENTID = 0x8fff,
+
+    WMI_SET_CHANNEL_EVENTID,
+    WMI_ASSOC_REQ_EVENTID,
+
+    /* generic ACS event */
+    WMI_ACS_EVENTID,
+    WMI_STORERECALL_STORE_EVENTID,
+    WMI_WOW_EXT_WAKE_EVENTID,
+    WMI_GTK_OFFLOAD_STATUS_EVENTID,
+    WMI_NETWORK_LIST_OFFLOAD_EVENTID,
+    WMI_REMAIN_ON_CHNL_EVENTID,
+    WMI_CANCEL_REMAIN_ON_CHNL_EVENTID,
+    WMI_TX_STATUS_EVENTID,
+    WMI_RX_PROBE_REQ_EVENTID,
+    WMI_P2P_CAPABILITIES_EVENTID,
+    WMI_RX_ACTION_EVENTID,
+    WMI_P2P_INFO_EVENTID,
+    /*WMI Location API Commands*/
+#ifdef WLAN_LOCATION_SUPPORT   
+    WMI_RTT_MEASRESP_EVENTID,
+    WMI_RTT_CAPRESP_EVENTID,
+    WMI_RTT_STATUSRESP_EVENTID,
+#endif
+    /* WPS Events */ 
+    WMI_WPS_GET_STATUS_EVENTID,
+    WMI_WPS_PROFILE_EVENTID,  
+
+    /* more P2P events */
+    WMI_NOA_INFO_EVENTID,
+    WMI_OPPPS_INFO_EVENTID,
+    WMI_PORT_STATUS_EVENTID,
+
+    /* 802.11w */
+    WMI_GET_RSN_CAP_EVENTID,
+} WMI_EVENT_ID;
+
+typedef enum {
+    WMI_11A_CAPABILITY   = 1,
+    WMI_11G_CAPABILITY   = 2,
+    WMI_11AG_CAPABILITY  = 3,
+    WMI_11NA_CAPABILITY  = 4,
+    WMI_11NG_CAPABILITY  = 5,
+    WMI_11NAG_CAPABILITY = 6,
+    // END CAPABILITY
+    WMI_11N_CAPABILITY_OFFSET = (WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY),
+} WMI_PHY_CAPABILITY;
+
+typedef PREPACK struct {
+    A_UINT8     macaddr[ATH_MAC_LEN];
+    A_UINT8     phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_1;
+
+typedef PREPACK struct {
+    A_UINT32    sw_version;
+    A_UINT32    abi_version;
+    A_UINT8     macaddr[ATH_MAC_LEN];
+    A_UINT8     phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_2;
+
+#if defined(ATH_TARGET)
+#ifdef AR6002_REV2
+#define WMI_READY_EVENT WMI_READY_EVENT_1  /* AR6002_REV2 target code */
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2  /* AR6001, AR6002_REV4, AR6002_REV6 */
+#endif
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2 /* host code */
+#endif
+
+
+/*
+ * Connect Event
+ *
+ * In STA mode networkType comes along with connected phy mode
+ * To get networkType, WMI_NETWORK_TYPE (networkType)
+ * To get connected phymode, WMI_CONNECTED_PHYMODE(networkType)
+ * will give the phymode value.
+ */
+typedef PREPACK struct {
+    PREPACK union {
+        struct {
+            A_UINT16    channel;
+            A_UINT8     bssid[ATH_MAC_LEN];
+            A_UINT16    listenInterval;
+            A_UINT16    beaconInterval;
+#if defined(EXTENDED_TX_COMPLETE)
+            A_UINT16    networkType;
+            A_UINT8     aid;
+            A_UINT8     unused;
+#else
+            A_UINT32    networkType;
+#endif /* EXTENDED_TX_COMPLETE */
+        } infra_ibss_bss;
+        struct {
+            A_UINT8     phymode;
+            A_UINT8     aid;
+            A_UINT8     mac_addr[ATH_MAC_LEN];
+            A_UINT8     auth;
+            A_UINT8     keymgmt;
+            A_UINT16    cipher;
+            A_UINT8     apsd_info;
+            A_UINT8     unused[3];
+        } ap_sta;
+        struct {
+            A_UINT16    channel;
+            A_UINT8     bssid[ATH_MAC_LEN];
+            A_UINT8     unused[8];
+        } ap_bss;
+    } POSTPACK u;
+    A_UINT8     beaconIeLen;
+    A_UINT8     assocReqLen;
+    A_UINT8     assocRespLen;
+    A_UINT8     assocInfo[1];
+} POSTPACK WMI_CONNECT_EVENT;
+
+
+typedef struct {
+    A_UINT8   status;
+    A_UINT8   rspType;
+} WMI_ASSOCREQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8   host_accept;
+    A_UINT8   host_reasonCode;
+    A_UINT8   target_status;
+    A_UINT8   sta_mac_addr[ATH_MAC_LEN];
+    A_UINT8   rspType;
+} POSTPACK WMI_SEND_ASSOCRES_CMD;
+
+typedef struct {
+    A_UINT8   enable;
+} WMI_SET_ASSOCREQ_RELAY;
+
+/*
+ * Disconnect Event
+ */
+typedef enum {
+    NO_NETWORK_AVAIL   = 0x01,
+    LOST_LINK          = 0x02,     /* bmiss */
+    DISCONNECT_CMD     = 0x03,
+    BSS_DISCONNECTED   = 0x04,
+    AUTH_FAILED        = 0x05,
+    ASSOC_FAILED       = 0x06,
+    NO_RESOURCES_AVAIL = 0x07,
+    CSERV_DISCONNECT   = 0x08,
+    INVALID_PROFILE    = 0x0a,
+    DOT11H_CHANNEL_SWITCH = 0x0b,
+    PROFILE_MISMATCH   = 0x0c,
+    CONNECTION_EVICTED = 0x0d,
+    IBSS_MERGE         = 0x0e,
+    EXCESS_TX_RETRY    = 0x0f,     /* TX frames failed after excessive retries */
+    SEC_HS_TO_RECV_M1  = 0x10,     /* Security 4-way handshake timed out waiting for M1 */
+    SEC_HS_TO_RECV_M3  = 0x11,     /* Security 4-way handshake timed out waiting for M3 */
+    TKIP_COUNTERMEASURES = 0x12,
+    MLME_TIMEOUT       = 0x13,
+    CCX_TARGET_ROAMING_INDICATION = 0xfd,  /* hack for CCX AP-Assisted roaming*/
+    CCKM_ROAMING_INDICATION = 0xfe,  /* hack for CCKM fast roaming */
+} WMI_DISCONNECT_REASON;
+
+typedef PREPACK struct {
+    A_UINT16    protocolReasonStatus;  /* reason code, see 802.11 spec. */
+    A_UINT8     bssid[ATH_MAC_LEN];    /* set if known */
+    A_UINT8     disconnectReason ;      /* see WMI_DISCONNECT_REASON */
+    A_UINT8     assocRespLen;
+    A_UINT8     assocInfo[1];
+} POSTPACK WMI_DISCONNECT_EVENT;
+
+/*
+ * BSS Info Event.
+ * Mechanism used to inform host of the presence and characteristic of
+ * wireless networks present.  Consists of bss info header followed by
+ * the beacon or probe-response frame body.  The 802.11 header is not included.
+ */
+typedef enum {
+    BEACON_FTYPE = 0x1,
+    PROBERESP_FTYPE,
+    ACTION_MGMT_FTYPE,
+    PROBEREQ_FTYPE,
+} WMI_BI_FTYPE;
+
+enum {
+    BSS_ELEMID_CHANSWITCH = 0x01,
+    BSS_ELEMID_ATHEROS = 0x02,
+};
+
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_BI_FTYPE */
+    A_UINT8     snr;
+    A_INT16     rssi;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT32    ieMask;
+} POSTPACK WMI_BSS_INFO_HDR;
+
+/*
+ * BSS INFO HDR version 2.0
+ * With 6 bytes HTC header and 6 bytes of WMI header
+ * WMI_BSS_INFO_HDR cannot be accomodated in the removed 802.11 management
+ * header space.
+ * - Reduce the ieMask to 2 bytes as only two bit flags are used
+ * - Remove rssi and compute it on the host. rssi = snr - 95
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_BI_FTYPE */
+    A_UINT8     snr;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT16    ieMask;
+} POSTPACK WMI_BSS_INFO_HDR2;
+
+typedef PREPACK struct {
+    A_UINT8    bssid[ATH_MAC_LEN];
+    A_UINT8    pin[8];
+} POSTPACK WMI_WPS_PIN_INFO;
+
+typedef PREPACK struct {
+    PREPACK union {
+        A_UINT8 ie[17];
+        A_INT32 wac_status;
+    } POSTPACK info;
+} POSTPACK WMI_GET_WAC_INFO;
+
+#define IEEE80211_NWID_LEN                  32
+typedef PREPACK struct {
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 ssid[IEEE80211_NWID_LEN];
+    A_UINT8 ssid_len;
+    A_UINT8 channel;
+    A_UINT8 snr;
+    A_UINT8 id;
+    A_UINT8 device_type;
+    A_UINT8 antenna_type;
+    A_INT8  threshold_offset1;  /* offset for AP Tx power */
+    A_INT8  threshold_offset2;  /* offset for antenna gain */
+} POSTPACK WMI_WAC_BSS_INFO_REPORT;
+
+/*
+ * Command Error Event
+ */
+typedef enum {
+    INVALID_PARAM  = 0x01,
+    ILLEGAL_STATE  = 0x02,
+    INTERNAL_ERROR = 0x03,
+    DFS_CHANNEL    = 0x05,
+} WMI_ERROR_CODE;
+
+typedef PREPACK struct {
+    A_UINT16    commandId;
+    A_UINT8     errorCode;
+} POSTPACK WMI_CMD_ERROR_EVENT;
+
+/*
+ * New Regulatory Domain Event
+ */
+typedef PREPACK struct {
+    A_UINT32    regDomain;
+} POSTPACK WMI_REG_DOMAIN_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;
+    A_UINT8     trafficClass;
+} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
+
+/*
+ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
+ * the host of BSS's it has found that matches the current profile.
+ * It can be used by the host to cache PMKs and/to initiate pre-authentication
+ * if the BSS supports it.  The first bssid is always the current associated
+ * BSS.
+ * The bssid and bssFlags information repeats according to the number
+ * or APs reported.
+ */
+typedef enum {
+    WMI_DEFAULT_BSS_FLAGS   = 0x00,
+    WMI_PREAUTH_CAPABLE_BSS = 0x01,
+    WMI_PMKID_VALID_BSS     = 0x02,
+} WMI_BSS_FLAGS;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT8     bssFlags;            /* see WMI_BSS_FLAGS */
+} POSTPACK WMI_NEIGHBOR_INFO;
+
+typedef PREPACK struct {
+    A_INT8      numberOfAps;
+    WMI_NEIGHBOR_INFO neighbor[1];
+} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
+
+/*
+ * TKIP MIC Error Event
+ */
+typedef PREPACK struct {
+    A_UINT8 keyid;
+    A_UINT8 ismcast;
+} POSTPACK WMI_TKIP_MICERR_EVENT;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
+ */
+typedef PREPACK struct {
+    A_INT32 status;
+} POSTPACK WMI_SCAN_COMPLETE_EVENT;
+
+typedef PREPACK struct {
+    A_INT32 rm_type;
+    A_INT32 status;
+} POSTPACK WMI_CCX_RM_STATUS_EVENT;
+
+#define MAX_OPT_DATA_LEN 1400
+
+/*
+ * WMI_SET_ADHOC_BSSID_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
+
+/*
+ * Special frame receive Event.
+ * Mechanism used to inform host of the receiption of the special frames.
+ * Consists of special frame info header followed by special frame body.
+ * The 802.11 header is not included.
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_OPT_FTYPE */
+    A_INT8      snr;
+    A_UINT8     srcAddr[ATH_MAC_LEN];
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_OPT_RX_INFO_HDR;
+
+/*
+ * Reporting statistics.
+ */
+typedef PREPACK struct {
+    A_UINT32   tx_packets;
+    A_UINT32   tx_bytes;
+    A_UINT32   tx_unicast_pkts;
+    A_UINT32   tx_unicast_bytes;
+    A_UINT32   tx_multicast_pkts;
+    A_UINT32   tx_multicast_bytes;
+    A_UINT32   tx_broadcast_pkts;
+    A_UINT32   tx_broadcast_bytes;
+    A_UINT32   tx_rts_success_cnt;
+    A_UINT32   tx_packet_per_ac[4];
+    A_UINT32   tx_errors_per_ac[4];
+
+    A_UINT32   tx_errors;
+    A_UINT32   tx_failed_cnt;
+    A_UINT32   tx_retry_cnt;
+    A_UINT32   tx_mult_retry_cnt;
+    A_UINT32   tx_rts_fail_cnt;
+    A_INT32    tx_unicast_rate;
+}POSTPACK tx_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   rx_packets;
+    A_UINT32   rx_bytes;
+    A_UINT32   rx_unicast_pkts;
+    A_UINT32   rx_unicast_bytes;
+    A_UINT32   rx_multicast_pkts;
+    A_UINT32   rx_multicast_bytes;
+    A_UINT32   rx_broadcast_pkts;
+    A_UINT32   rx_broadcast_bytes;
+    A_UINT32   rx_fragment_pkt;
+
+    A_UINT32   rx_errors;
+    A_UINT32   rx_crcerr;
+    A_UINT32   rx_key_cache_miss;
+    A_UINT32   rx_decrypt_err;
+    A_UINT32   rx_duplicate_frames;
+    A_INT32    rx_unicast_rate;
+}POSTPACK rx_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   tkip_local_mic_failure;
+    A_UINT32   tkip_counter_measures_invoked;
+    A_UINT32   tkip_replays;
+    A_UINT32   tkip_format_errors;
+    A_UINT32   ccmp_format_errors;
+    A_UINT32   ccmp_replays;
+}POSTPACK tkip_ccmp_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   power_save_failure_cnt;
+    A_UINT16   stop_tx_failure_cnt;
+    A_UINT16   atim_tx_failure_cnt;
+    A_UINT16   atim_rx_failure_cnt;
+    A_UINT16   bcn_rx_failure_cnt;
+}POSTPACK pm_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    cs_bmiss_cnt;
+    A_UINT32    cs_lowRssi_cnt;
+    A_UINT16    cs_connect_cnt;
+    A_UINT16    cs_disconnect_cnt;
+    A_INT16     cs_aveBeacon_rssi;
+    A_UINT16    cs_roam_count;
+    A_INT16     cs_rssi;
+    A_UINT8     cs_snr;
+    A_UINT8     cs_aveBeacon_snr;
+    A_UINT8     cs_lastRoam_msec;
+} POSTPACK cserv_stats_t;
+
+typedef PREPACK struct {
+    tx_stats_t          tx_stats;
+    rx_stats_t          rx_stats;
+    tkip_ccmp_stats_t   tkipCcmpStats;
+}POSTPACK wlan_net_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    arp_received;
+    A_UINT32    arp_matched;
+    A_UINT32    arp_replied;
+} POSTPACK arp_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    wow_num_pkts_dropped;
+    A_UINT16    wow_num_events_discarded;
+    A_UINT8     wow_num_host_pkt_wakeups;
+    A_UINT8     wow_num_host_event_wakeups;
+} POSTPACK wlan_wow_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32            lqVal;
+    A_INT32             noise_floor_calibation;
+    pm_stats_t          pmStats;
+    wlan_net_stats_t    txrxStats;
+    wlan_wow_stats_t    wowStats;
+    arp_stats_t         arpStats;
+    cserv_stats_t       cservStats;
+} POSTPACK WMI_TARGET_STATS;
+
+/*
+ * WMI_RSSI_THRESHOLD_EVENTID.
+ * Indicate the RSSI events to host. Events are indicated when we breach a
+ * thresold value.
+ */
+typedef enum{
+    WMI_RSSI_THRESHOLD1_ABOVE = 0,
+    WMI_RSSI_THRESHOLD2_ABOVE,
+    WMI_RSSI_THRESHOLD3_ABOVE,
+    WMI_RSSI_THRESHOLD4_ABOVE,
+    WMI_RSSI_THRESHOLD5_ABOVE,
+    WMI_RSSI_THRESHOLD6_ABOVE,
+    WMI_RSSI_THRESHOLD1_BELOW,
+    WMI_RSSI_THRESHOLD2_BELOW,
+    WMI_RSSI_THRESHOLD3_BELOW,
+    WMI_RSSI_THRESHOLD4_BELOW,
+    WMI_RSSI_THRESHOLD5_BELOW,
+    WMI_RSSI_THRESHOLD6_BELOW
+}WMI_RSSI_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_INT16 rssi;
+    A_UINT8 range;
+}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
+
+/*
+ *  WMI_ERROR_REPORT_EVENTID
+ */
+typedef enum{
+    WMI_TARGET_PM_ERR_FAIL      = 0x00000001,
+    WMI_TARGET_KEY_NOT_FOUND    = 0x00000002,
+    WMI_TARGET_DECRYPTION_ERR   = 0x00000004,
+    WMI_TARGET_BMISS            = 0x00000008,
+    WMI_PSDISABLE_NODE_JOIN     = 0x00000010,
+    WMI_TARGET_COM_ERR          = 0x00000020,
+    WMI_TARGET_FATAL_ERR        = 0x00000040,
+    WMI_TARGET_BCN_FOUND        = 0x00000080
+} WMI_TARGET_ERROR_VAL;
+
+typedef PREPACK struct {
+    A_UINT32 errorVal;
+}POSTPACK  WMI_TARGET_ERROR_REPORT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 retrys;
+}POSTPACK  WMI_TX_RETRY_ERR_EVENT;
+
+typedef enum{
+    WMI_SNR_THRESHOLD1_ABOVE = 1,
+    WMI_SNR_THRESHOLD1_BELOW,
+    WMI_SNR_THRESHOLD2_ABOVE,
+    WMI_SNR_THRESHOLD2_BELOW,
+    WMI_SNR_THRESHOLD3_ABOVE,
+    WMI_SNR_THRESHOLD3_BELOW,
+    WMI_SNR_THRESHOLD4_ABOVE,
+    WMI_SNR_THRESHOLD4_BELOW
+} WMI_SNR_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_UINT8 range;  /* WMI_SNR_THRESHOLD_VAL */
+    A_UINT8 snr;
+}POSTPACK  WMI_SNR_THRESHOLD_EVENT;
+
+typedef enum{
+    WMI_LQ_THRESHOLD1_ABOVE = 1,
+    WMI_LQ_THRESHOLD1_BELOW,
+    WMI_LQ_THRESHOLD2_ABOVE,
+    WMI_LQ_THRESHOLD2_BELOW,
+    WMI_LQ_THRESHOLD3_ABOVE,
+    WMI_LQ_THRESHOLD3_BELOW,
+    WMI_LQ_THRESHOLD4_ABOVE,
+    WMI_LQ_THRESHOLD4_BELOW
+} WMI_LQ_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_INT32 lq;
+    A_UINT8 range;  /* WMI_LQ_THRESHOLD_VAL */
+}POSTPACK  WMI_LQ_THRESHOLD_EVENT;
+/*
+ * WMI_REPORT_ROAM_TBL_EVENTID
+ */
+#define MAX_ROAM_TBL_CAND   5
+
+typedef PREPACK struct {
+    A_INT32 roam_util;
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_INT8  rssi;
+    A_INT8  rssidt;
+    A_INT8  last_rssi;
+    A_INT8  util;
+    A_INT8  bias;
+    A_UINT8 reserved; /* For alignment */
+} POSTPACK WMI_BSS_ROAM_INFO;
+
+
+typedef PREPACK struct {
+    A_UINT16  roamMode;
+    A_UINT16  numEntries;
+    WMI_BSS_ROAM_INFO bssRoamInfo[1];
+} POSTPACK WMI_TARGET_ROAM_TBL;
+
+/*
+ * WMI_HCI_EVENT_EVENTID
+ */
+typedef PREPACK struct {
+    A_UINT16    evt_buf_sz;     /* HCI event buffer size */
+    A_UINT8     buf[1];         /* HCI  event */
+} POSTPACK WMI_HCI_EVENT;
+
+/*
+ *  WMI_CAC_EVENTID
+ */
+typedef enum {
+    CAC_INDICATION_ADMISSION = 0x00,
+    CAC_INDICATION_ADMISSION_RESP = 0x01,
+    CAC_INDICATION_DELETE = 0x02,
+    CAC_INDICATION_NO_RESP = 0x03,
+}CAC_INDICATION;
+
+#define WMM_TSPEC_IE_LEN   63
+
+typedef PREPACK struct {
+    A_UINT8 ac;
+    A_UINT8 cac_indication;
+    A_UINT8 statusCode;
+    A_UINT8 tspecSuggestion[WMM_TSPEC_IE_LEN];
+}POSTPACK  WMI_CAC_EVENT;
+
+/*
+ * WMI_APLIST_EVENTID
+ */
+
+typedef enum {
+    APLIST_VER1 = 1,
+} APLIST_VER;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT16    channel;
+} POSTPACK  WMI_AP_INFO_V1;
+
+typedef PREPACK union {
+    WMI_AP_INFO_V1  apInfoV1;
+} POSTPACK WMI_AP_INFO;
+
+typedef PREPACK struct {
+    A_UINT8     apListVer;
+    A_UINT8     numAP;
+    WMI_AP_INFO apList[1];
+} POSTPACK WMI_APLIST_EVENT;
+
+/*
+ * developer commands
+ */
+
+/*
+ * WMI_SET_BITRATE_CMDID
+ *
+ * Get bit rate cmd uses same definition as set bit rate cmd
+ *
+ */
+typedef enum {
+    RATE_AUTO   = -1,
+     AR6003_RATE_1Mb       = 0,
+     AR6003_RATE_2Mb       = 1,
+     AR6003_RATE_5_5Mb     = 2,
+     AR6003_RATE_11Mb      = 3,
+     AR6003_RATE_6Mb       = 4,
+     AR6003_RATE_9Mb       = 5,
+     AR6003_RATE_12Mb      = 6,
+     AR6003_RATE_18Mb      = 7,
+     AR6003_RATE_24Mb      = 8,
+     AR6003_RATE_36Mb      = 9,
+     AR6003_RATE_48Mb      = 10,
+     AR6003_RATE_54Mb      = 11,
+     AR6003_RATE_MCS_0_20  = 12,
+     AR6003_RATE_MCS_1_20  = 13,
+     AR6003_RATE_MCS_2_20  = 14,
+     AR6003_RATE_MCS_3_20  = 15,
+     AR6003_RATE_MCS_4_20  = 16,
+     AR6003_RATE_MCS_5_20  = 17,
+     AR6003_RATE_MCS_6_20  = 18,
+     AR6003_RATE_MCS_7_20  = 19,
+     AR6003_RATE_MCS_0_40  = 20,
+     AR6003_RATE_MCS_1_40  = 21,
+     AR6003_RATE_MCS_2_40  = 22,
+     AR6003_RATE_MCS_3_40  = 23,
+     AR6003_RATE_MCS_4_40  = 24,
+     AR6003_RATE_MCS_5_40  = 25,
+     AR6003_RATE_MCS_6_40  = 26,
+     AR6003_RATE_MCS_7_40  = 27,
+     AR6003_RATE_MAX,
+
+     AR6004_RATE_1Mb       = 0,
+     AR6004_RATE_2Mb       = 1,
+     AR6004_RATE_5_5Mb     = 2,
+     AR6004_RATE_11Mb      = 3,
+     AR6004_RATE_6Mb       = 4,
+     AR6004_RATE_9Mb       = 5,
+     AR6004_RATE_12Mb      = 6,
+     AR6004_RATE_18Mb      = 7,
+     AR6004_RATE_24Mb      = 8,
+     AR6004_RATE_36Mb      = 9,
+     AR6004_RATE_48Mb      = 10,
+     AR6004_RATE_54Mb      = 11,
+     AR6004_RATE_MCS_0_20  = 12,
+     AR6004_RATE_MCS_1_20  = 13,
+     AR6004_RATE_MCS_2_20  = 14,
+     AR6004_RATE_MCS_3_20  = 15,
+     AR6004_RATE_MCS_4_20  = 16,
+     AR6004_RATE_MCS_5_20  = 17,
+     AR6004_RATE_MCS_6_20  = 18,
+     AR6004_RATE_MCS_7_20  = 19,
+     AR6004_RATE_MCS_8_20  = 20,
+     AR6004_RATE_MCS_9_20  = 21,
+     AR6004_RATE_MCS_10_20 = 22,
+     AR6004_RATE_MCS_11_20 = 23,
+     AR6004_RATE_MCS_12_20 = 24,
+     AR6004_RATE_MCS_13_20 = 25,
+     AR6004_RATE_MCS_14_20 = 26,
+     AR6004_RATE_MCS_15_20 = 27,
+     AR6004_RATE_MCS_0_40  = 28,
+     AR6004_RATE_MCS_1_40  = 29,
+     AR6004_RATE_MCS_2_40  = 30,
+     AR6004_RATE_MCS_3_40  = 31,
+     AR6004_RATE_MCS_4_40  = 32,
+     AR6004_RATE_MCS_5_40  = 33,
+     AR6004_RATE_MCS_6_40  = 34,
+     AR6004_RATE_MCS_7_40  = 35,
+     AR6004_RATE_MCS_8_40  = 36,
+     AR6004_RATE_MCS_9_40  = 37,
+     AR6004_RATE_MCS_10_40 = 38,
+     AR6004_RATE_MCS_11_40 = 39,
+     AR6004_RATE_MCS_12_40 = 40,
+     AR6004_RATE_MCS_13_40 = 41,
+     AR6004_RATE_MCS_14_40 = 42,
+     AR6004_RATE_MCS_15_40 = 43,
+     AR6004_RATE_MAX,
+} WMI_BIT_RATE;
+
+typedef PREPACK struct {
+    A_INT8      rateIndex;          /* see WMI_BIT_RATE */
+    A_INT8      mgmtRateIndex;
+    A_INT8      ctlRateIndex;
+} POSTPACK WMI_BIT_RATE_CMD;
+
+
+typedef PREPACK struct {
+    A_INT8      rateIndex;          /* see WMI_BIT_RATE */
+} POSTPACK  WMI_BIT_RATE_REPLY;
+
+
+/*
+ * WMI_SET_FIXRATES_CMDID
+ *
+ * Get fix rates cmd uses same definition as set fix rates cmd
+ * Fix rate mask is now 64 bit, which is split across two words.
+ * Refer WMI_BIT_RATE for bit position for each rate.
+ */
+#define FIX_RATE_1Mb            ((A_UINT32)0x1)
+#define FIX_RATE_2Mb            ((A_UINT32)0x2)
+#define FIX_RATE_5_5Mb          ((A_UINT32)0x4)
+#define FIX_RATE_11Mb           ((A_UINT32)0x8)
+#define FIX_RATE_6Mb            ((A_UINT32)0x10)
+#define FIX_RATE_9Mb            ((A_UINT32)0x20)
+#define FIX_RATE_12Mb           ((A_UINT32)0x40)
+#define FIX_RATE_18Mb           ((A_UINT32)0x80)
+#define FIX_RATE_24Mb           ((A_UINT32)0x100)
+#define FIX_RATE_36Mb           ((A_UINT32)0x200)
+#define FIX_RATE_48Mb           ((A_UINT32)0x400)
+#define FIX_RATE_54Mb           ((A_UINT32)0x800)
+
+typedef PREPACK struct {
+    A_UINT32      fixRateMask[WMI_MAX_RATE_MASK];          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8      bEnableMask;
+    A_UINT8      frameType;              /* type and subtype */
+    A_UINT8      reserved[2];            /* for alignment    */
+    A_UINT32     frameRateMask[WMI_MAX_RATE_MASK];          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FRAME_RATES_CMD, WMI_FRAME_RATES_REPLY;
+
+/*
+ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    RECONN_DO_AUTH = 0x00,
+    RECONN_NOT_AUTH = 0x01
+} WMI_AUTH_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 mode;
+} POSTPACK WMI_SET_AUTH_MODE_CMD;
+
+/*
+ * WMI_SET_REASSOC_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    REASSOC_DO_DISASSOC = 0x00,
+    REASSOC_DONOT_DISASSOC = 0x01
+} WMI_REASSOC_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 mode;
+}POSTPACK WMI_SET_REASSOC_MODE_CMD;
+
+typedef enum {
+    ROAM_DATA_TIME = 1,            /* Get The Roam Time Data */
+} ROAM_DATA_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32        disassoc_time;
+    A_UINT32        no_txrx_time;
+    A_UINT32        assoc_time;
+    A_UINT32        allow_txrx_time;
+    A_UINT8         disassoc_bssid[ATH_MAC_LEN];
+    A_INT8          disassoc_bss_rssi;
+    A_UINT8         assoc_bssid[ATH_MAC_LEN];
+    A_INT8          assoc_bss_rssi;
+} POSTPACK WMI_TARGET_ROAM_TIME;
+
+typedef PREPACK struct {
+    PREPACK union {
+        WMI_TARGET_ROAM_TIME roamTime;
+    } POSTPACK u;
+    A_UINT8 roamDataType ;
+} POSTPACK WMI_TARGET_ROAM_DATA;
+
+typedef enum {
+    WMI_WMM_DISABLED = 0,
+    WMI_WMM_ENABLED
+} WMI_WMM_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8    status;
+}POSTPACK WMI_SET_WMM_CMD;
+
+typedef PREPACK struct {
+    A_UINT8    status;
+}POSTPACK WMI_SET_QOS_SUPP_CMD;
+
+typedef enum {
+    WMI_TXOP_DISABLED = 0,
+    WMI_TXOP_ENABLED
+} WMI_TXOP_CFG;
+
+typedef PREPACK struct {
+    A_UINT8    txopEnable;
+}POSTPACK WMI_SET_WMM_TXOP_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 keepaliveInterval;
+} POSTPACK WMI_SET_KEEPALIVE_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 keepaliveInterval;
+    A_UINT8 keepaliveMode;
+    A_UINT8 reserved[2];
+    A_UINT32 keepalive_arp_srcip;
+    A_UINT32 keepalive_arp_tgtip;
+    A_UINT8 peer_mac_address[6];
+} POSTPACK WMI_SET_KEEPALIVE_CMD_EXT;
+
+
+typedef PREPACK struct {
+    A_BOOL configured;
+    A_UINT8 keepaliveInterval;
+} POSTPACK WMI_GET_KEEPALIVE_CMD;
+
+/*
+ * Add Application specified IE to a management frame
+ */
+#define WMI_MAX_IE_LEN  255
+
+typedef PREPACK struct {
+    A_UINT8 mgmtFrmType;  /* one of WMI_MGMT_FRAME_TYPE */
+    A_UINT8 ieLen;    /* Length  of the IE that should be added to the MGMT frame */
+    A_UINT8 ieInfo[1];
+} POSTPACK WMI_SET_APPIE_CMD;
+
+/*
+ * Notify the WSC registration status to the target
+ */
+#define WSC_REG_ACTIVE     1
+#define WSC_REG_INACTIVE   0
+/* Generic Hal Interface for setting hal paramters. */
+/* Add new Set HAL Param cmdIds here for newer params */
+typedef enum {
+   WHAL_SETCABTO_CMDID = 1,
+}WHAL_CMDID;
+
+typedef PREPACK struct {
+    A_UINT8 cabTimeOut;
+} POSTPACK WHAL_SETCABTO_PARAM;
+
+typedef PREPACK struct {
+    A_UINT8  whalCmdId;
+    A_UINT8 data[1];
+} POSTPACK WHAL_PARAMCMD;
+
+
+#define WOW_MAX_FILTER_LISTS 1 /*4*/
+#define WOW_MAX_FILTERS_PER_LIST 4
+#define WOW_PATTERN_SIZE 64
+#define WOW_MASK_SIZE 64
+
+#define MAC_MAX_FILTERS_PER_LIST 7
+
+typedef PREPACK struct {
+    A_UINT8 wow_valid_filter;
+    A_UINT8 wow_filter_id;
+    A_UINT8 wow_filter_size;
+    A_UINT8 wow_filter_offset;
+    A_UINT8 wow_filter_mask[WOW_MASK_SIZE];
+    A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE];
+} POSTPACK WOW_FILTER;
+
+
+typedef PREPACK struct {
+    A_UINT8 wow_valid_list;
+    A_UINT8 wow_list_id;
+    A_UINT8 wow_num_filters;
+    A_UINT8 wow_total_list_size;
+    WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
+} POSTPACK WOW_FILTER_LIST;
+
+typedef PREPACK struct {
+    A_UINT8 valid_filter;
+    A_UINT8 mac_addr[ATH_MAC_LEN];
+} POSTPACK MAC_FILTER;
+
+
+typedef PREPACK struct {
+    A_UINT8 total_list_size;
+    A_UINT8 enable;
+    MAC_FILTER list[MAC_MAX_FILTERS_PER_LIST];
+} POSTPACK MAC_FILTER_LIST;
+
+#define MAX_IP_ADDRS  2
+typedef PREPACK struct {
+    A_UINT32 ips[MAX_IP_ADDRS];  /* IP in Network Byte Order */
+} POSTPACK WMI_SET_IP_CMD;
+
+typedef PREPACK struct {
+    A_BOOL awake;
+    A_BOOL asleep;
+} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
+
+typedef A_UINT32 WMI_WOW_FILTER;
+
+    /* bit positions for filter options */
+#define  WOW_FILTER_UNUSED          0
+#define  WOW_FILTER_SSID            1   /* wake up on probed SSID (legacy definition) */
+    /* the following filter options are available if the WOW extensions are installed in the target
+     * otherwise the feature setting has no effect  */
+
+#define WOW_FILTER_OPTION_MASK(option)  (1 << (option))
+#define WOW_FILTER_OPTION_MAGIC_PACKET  WOW_FILTER_OPTION_MASK(2)
+#define WOW_FILTER_OPTION_EAP_REQ       WOW_FILTER_OPTION_MASK(3)
+#define WOW_FILTER_OPTION_PATTERNS      WOW_FILTER_OPTION_MASK(4)
+#define WOW_FILTER_OPTION_OFFLOAD_ARP   WOW_FILTER_OPTION_MASK(5)
+#define WOW_FILTER_OPTION_OFFLOAD_NS    WOW_FILTER_OPTION_MASK(6)
+#define WOW_FILTER_OPTION_OFFLOAD_GTK   WOW_FILTER_OPTION_MASK(7)
+#define WOW_FILTER_OPTION_8021X_4WAYHS  WOW_FILTER_OPTION_MASK(8)
+#define WOW_FILTER_OPTION_NLO_DISCVRY   WOW_FILTER_OPTION_MASK(9)
+#define WOW_FILTER_OPTION_NWK_DISASSOC  WOW_FILTER_OPTION_MASK(10)
+#define WOW_FILTER_OPTION_GTK_ERROR     WOW_FILTER_OPTION_MASK(11)
+
+#define WOW_FILTER_OPTION_TEST_MODE     WOW_FILTER_OPTION_MASK(15)
+
+
+typedef PREPACK struct {
+    A_BOOL enable_wow;
+    WMI_WOW_FILTER filter;
+    A_UINT16 hostReqDelay;
+} POSTPACK WMI_SET_WOW_MODE_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 filter_list_id;
+} POSTPACK WMI_GET_WOW_LIST_CMD;
+
+/*
+ * WMI_GET_WOW_LIST_CMD reply
+ */
+typedef PREPACK struct {
+    A_UINT8     num_filters;     /* number of patterns in reply */
+    A_UINT8     this_filter_num; /*  this is filter # x of total num_filters */
+    A_UINT8     wow_mode;
+    A_UINT8     host_mode;
+    WOW_FILTER  wow_filters[1];
+} POSTPACK WMI_GET_WOW_LIST_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8 filter_list_id;
+    A_UINT8 filter_size;
+    A_UINT8 filter_offset;
+    A_UINT8 filter[1];
+} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 filter_list_id;
+    A_UINT16 filter_id;
+} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
+
+/* WMI_SET_TXE_NOTIFY_CMDID */
+typedef PREPACK struct {
+        A_UINT32 rate;
+        A_UINT32 pkts;
+        A_UINT32 intvl;
+} POSTPACK WMI_SET_TXE_NOTIFY_CMD;
+
+
+/*
+ * WMI_SET_AKMP_PARAMS_CMD
+ */
+
+#define WMI_AKMP_MULTI_PMKID_EN   0x000001
+
+typedef PREPACK struct {
+    A_UINT32    akmpInfo;
+} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_PMKID;
+
+/*
+ * WMI_SET_PMKID_LIST_CMD
+ */
+#define WMI_MAX_PMKID_CACHE   8
+
+typedef PREPACK struct {
+    A_UINT32    numPMKID;
+    WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+} POSTPACK WMI_SET_PMKID_LIST_CMD;
+
+/*
+ * WMI_GET_PMKID_LIST_CMD  Reply
+ * Following the Number of PMKIDs is the list of PMKIDs
+ */
+typedef PREPACK struct {
+    A_UINT32    numPMKID;
+    A_UINT8     bssidList[ATH_MAC_LEN][1];
+    WMI_PMKID   pmkidList[1];
+} POSTPACK WMI_PMKID_LIST_REPLY;
+
+typedef PREPACK struct {
+    A_UINT16 oldChannel;
+    A_UINT32 newChannel;
+} POSTPACK WMI_CHANNEL_CHANGE_EVENT;
+
+typedef PREPACK struct {
+    A_UINT32 version;
+} POSTPACK WMI_WLAN_VERSION_EVENT;
+
+
+/* WMI_ADDBA_REQ_EVENTID */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     win_sz;
+    A_UINT16    st_seq_no;
+    A_UINT8     status;         /* f/w response for ADDBA Req; OK(0) or failure(!=0) */
+} POSTPACK WMI_ADDBA_REQ_EVENT;
+
+/* WMI_ADDBA_RESP_EVENTID */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     status;         /* OK(0), failure (!=0) */
+    A_UINT16    amsdu_sz;       /* Three values: Not supported(0), 3839, 8k */
+} POSTPACK WMI_ADDBA_RESP_EVENT;
+
+/* WMI_DELBA_EVENTID
+ * f/w received a DELBA for peer and processed it.
+ * Host is notified of this
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     is_peer_initiator;
+    A_UINT16    reason_code;
+} POSTPACK WMI_DELBA_EVENT;
+
+
+#ifdef WAPI_ENABLE
+#define WAPI_REKEY_UCAST    1
+#define WAPI_REKEY_MCAST    2
+typedef PREPACK struct {
+    A_UINT8     type;
+    A_UINT8     macAddr[ATH_MAC_LEN];
+} POSTPACK WMI_WAPIREKEY_EVENT;
+#endif
+
+
+/* WMI_ALLOW_AGGR_CMDID
+ * Configures tid's to allow ADDBA negotiations
+ * on each tid, in each direction
+ */
+typedef PREPACK struct {
+    A_UINT16    tx_allow_aggr;  /* 16-bit mask to allow uplink ADDBA negotiation - bit position indicates tid*/
+    A_UINT16    rx_allow_aggr;  /* 16-bit mask to allow donwlink ADDBA negotiation - bit position indicates tid*/
+} POSTPACK WMI_ALLOW_AGGR_CMD;
+
+/* WMI_ADDBA_REQ_CMDID
+ * f/w starts performing ADDBA negotiations with peer
+ * on the given tid
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+} POSTPACK WMI_ADDBA_REQ_CMD;
+
+/* WMI_DELBA_REQ_CMDID
+ * f/w would teardown BA with peer.
+ * is_send_initiator indicates if it's or tx or rx side
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     is_sender_initiator;
+
+} POSTPACK WMI_DELBA_REQ_CMD;
+
+#define PEER_NODE_JOIN_EVENT 0x00
+#define PEER_NODE_LEAVE_EVENT 0x01
+#define PEER_FIRST_NODE_JOIN_EVENT 0x10
+#define PEER_LAST_NODE_LEAVE_EVENT 0x11
+typedef PREPACK struct {
+    A_UINT8 eventCode;
+    A_UINT8 peerMacAddr[ATH_MAC_LEN];
+} POSTPACK WMI_PEER_NODE_EVENT;
+
+#define IEEE80211_FRAME_TYPE_MGT          0x00
+#define IEEE80211_FRAME_TYPE_CTL          0x04
+
+typedef PREPACK struct {
+    A_UINT32    rules; /* combination of WMI_WRT_... values */
+} POSTPACK WMI_CONFIG_TX_MAC_RULES_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;     /* 1 == device operates in promiscuous mode , 0 == normal mode <default> */
+} POSTPACK WMI_SET_PROMISCUOUS_MODE_CMD;
+
+
+/*RFKILL Related Data Structures*/
+typedef enum {
+    RADIO_STATE_OFF     = 0x1,
+    RADIO_STATE_ON      = 0x2,
+    RADIO_STATE_INVALID = 0xFF
+}RFKILL_RADIO_STATE;
+
+typedef PREPACK struct {
+    A_UINT8  GPIOPinNumber;
+    A_UINT8  IntrType;
+    A_UINT8  RadioState;
+} POSTPACK WMI_RFKILL_MODE_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 FastScanInterval;
+    A_UINT32 FastScanDuration;
+    A_UINT32 SlowScanInterval;
+    A_UINT8  ScanType; //ActiveUseSSID=0, ActiveUseWildCard=1, PassiveScan=2
+    A_UINT8  bStartNetworkListOffload; //TRUE - Use the Probed SSID
+}POSTPACK WMI_NETWORK_LIST_OFFLOAD_CMD;
+
+typedef PREPACK struct {
+   A_UINT8   bProfileMatch;
+   A_UINT8   Index;
+   A_UINT32  nFastScansRemaining;
+}POSTPACK WMI_NETWORK_LIST_OFFLOAD_INFO;
+
+typedef PREPACK struct _WMI_IPV6_ADDR {
+    A_UINT8    address[16];    /* IPV6 in Network Byte Order */
+} POSTPACK WMI_IPV6_ADDR;
+
+#define WMI_MAX_NS_OFFLOADS           2
+#define WMI_MAX_ARP_OFFLOADS          2
+
+#define WMI_ARPOFF_FLAGS_VALID              (1 << 0)    /* the tuple entry is valid */
+#define WMI_ARPOFF_FLAGS_MAC_VALID          (1 << 1)    /* the target mac address is valid */
+#define WMI_ARPOFF_FLAGS_REMOTE_IP_VALID    (1 << 2)    /* remote IP field is valid */
+
+typedef PREPACK struct {
+    A_UINT8           flags;                   /* flags */
+    A_UINT8           target_ipaddr[4];        /* IPV4 addresses of the local node*/
+    A_UINT8           remote_ipaddr[4];        /* source address of the remote node requesting the ARP (qualifier) */
+    A_UINT8           target_mac[ATH_MAC_LEN]; /* mac address for this tuple, if not valid, the local MAC is used */
+} POSTPACK WMI_ARP_OFFLOAD_TUPLE;
+
+#define WMI_NSOFF_FLAGS_VALID           (1 << 0)    /* the tuple entry is valid */
+#define WMI_NSOFF_FLAGS_MAC_VALID       (1 << 1)    /* the target mac address is valid */
+#define WMI_NSOFF_FLAGS_REMOTE_IP_VALID (1 << 2)    /* remote IP field is valid */
+
+#define WMI_NSOFF_MAX_TARGET_IPS    2
+
+typedef PREPACK struct {
+    A_UINT8           flags;                     /* flags */
+    WMI_IPV6_ADDR     target_ipaddr[WMI_NSOFF_MAX_TARGET_IPS]; /* IPV6 target addresses of the local node  */
+    WMI_IPV6_ADDR     solicitation_ipaddr;       /* multi-cast source IP addresses for receiving solicitations */
+    WMI_IPV6_ADDR     remote_ipaddr;             /* address of remote node requesting the solicitation (qualifier) */
+    A_UINT8           target_mac[ATH_MAC_LEN];   /* mac address for this tuple, if not valid, the local MAC is used */
+} POSTPACK WMI_NS_OFFLOAD_TUPLE;
+
+typedef PREPACK struct {
+    A_UINT32                flags;
+    WMI_NS_OFFLOAD_TUPLE    ns_tuples[WMI_MAX_NS_OFFLOADS];
+    WMI_ARP_OFFLOAD_TUPLE   arp_tuples[WMI_MAX_ARP_OFFLOADS];
+} POSTPACK WMI_SET_ARP_NS_OFFLOAD_CMD;
+
+typedef PREPACK struct {
+    A_UINT8  filter_list_id;
+    A_UINT8  filter_id;
+    A_UINT16 filter_size;
+    A_UINT8  filter_offset;
+    A_UINT8  filter[1];
+} POSTPACK WMI_ADD_WOW_EXT_PATTERN_CMD;
+
+    /* WOW extension for larger filter patterns, note these settings are only
+     * valid if the WOW extension is installed in the target
+     * When using the WOW extensions, the use of WMI_GET_WOW_LIST_REPLY will return an empty
+     * WOW_FILTER structure.  In WOW extended mode, the host is expected to track what filters
+     * are installed in the target. */
+#define WOW_EXT_DEF_FILTER_LISTS        1
+#define WOW_EXT_DEF_FILTERS_PER_LIST    16
+#define WOW_EXT_DEF_PATTERN_SIZE        136     /* typical pattern size (128 byte DIX + SNAPLLC) */
+#define WOW_EXT_FILTER_ID_CLEAR_ALL     0xFFFF  /* use this ID in WMI_DEL_WOW_PATTERN, to clear all patterns */
+
+#define WOW_EXT_MAX_PATTERN_LEN_SIZE    2040  /* absolute max limit on pattern */
+
+    /* compute mask size based on pattern size */
+#define WOW_EXT_COMPUTE_MASK_SIZE(msize,psize) \
+{                                              \
+    *(msize) = ((A_UINT32)psize)/8;            \
+    if (((A_UINT32)psize) % 8) {(*(msize))++;} \
+}
+
+    /* variable length event providing wake event information. Wake events can be
+     * the result of wake-packets, network events or other miscellaneous wake causes.
+     *
+     * NOTE: a WMI data header flag is not sufficient to use as WMI also forwards
+     * A-MSDU aggregates. The wake event indicates which frame caused the wake which could
+     * be embedded in an A-MSDU frame */
+typedef enum {
+    WOW_EXT_WAKE_TYPE_UNDEF = 0,
+    WOW_EXT_WAKE_TYPE_MAGIC  = 1,    /* magic, value = N/A, wake_data = copy of wake packet */
+    WOW_EXT_WAKE_TYPE_PATTERN = 2,   /* bitmap pattern, value = filter index, wake_data = copy of wake packet */
+    WOW_EXT_WAKE_TYPE_EAPREQ = 3,    /* eap request value = N/A, wake_data = copy of wake packet */
+    WOW_EXT_WAKE_TYPE_4WAYHS,        /* 802.1X 4-wake handshake request caused wakeup, wake_data - copy of packet */
+    WOW_EXT_WAKE_TYPE_NETWORK_NLO,            /* network list offload match */
+    WOW_EXT_WAKE_TYPE_NETWORK_DISASSOC,       /* network association loss */
+    WOW_EXT_WAKE_TYPE_NETWORK_GTK_OFFL_ERROR, /* if GTK refresh is enabled, a failure generates a wake event */
+    WOW_EXT_WAKE_TYPE_MAX
+} WOW_EXT_WAKE_TYPE;
+
+typedef PREPACK struct {
+    A_UINT16    flags;                /* flags, currently reserved */
+    A_UINT8     type;                 /* type of packet that caused the wake event */
+    A_UINT8     value;                /* optional value depending on type (see above) */
+    A_UINT16    packet_length;        /* if type is a wake packet, then this is the original length */
+    A_UINT16    wake_data_length;     /* copy length of wake packet data to follow */
+    A_UINT8     wake_data[1];         /* start of wake data*/
+} POSTPACK WMI_WOW_EXT_WAKE_EVENT;
+
+#define WMI_WOW_EXT_WAKE_MAX_DATA_LENGTH  128
+
+#define GTK_OFFLOAD_REPLAY_COUNTER_BYTES  8
+
+#define WMI_GTK_OFFLOAD_STATUS_FLAGS_RUNNING (1 << 0)  /* GTK offload is running*/
+
+
+#define GTK_OFFLOAD_KEK_BYTES       16
+#define GTK_OFFLOAD_KCK_BYTES       16
+#define GTK_REPLAY_COUNTER_BYTES    8
+
+typedef PREPACK struct {
+    A_UINT32    flags;          /* status flags */
+    A_UINT32    refresh_cnt;    /* number of successful GTK refresh exchanges since last SET operation */
+    A_UINT8     replay_counter[GTK_REPLAY_COUNTER_BYTES]; /* current replay counter */
+} POSTPACK  WMI_GTK_OFFLOAD_STATUS_EVENT;
+
+#define WMI_GTK_OFFLOAD_OPCODE_SET     1  /* set offload parameters, KEK,KCK and replay counter values are valid */
+#define WMI_GTK_OFFLOAD_OPCODE_CLEAR   2  /* clear offload parameters */
+#define WMI_GTK_OFFLOAD_OPCODE_STATUS  3  /* get status, generates WMI_GTK_OFFLOAD_STATUS_EVENT  */
+
+ /* structure to issue GTK offload opcode to set/clear or fetch status
+  * NOTE: offload is enabled when WOW options are enabled, see WOW_FILTER_OPTION_OFFLOAD_GTK */
+typedef PREPACK struct {
+    A_UINT32    flags;                          /* control flags */
+    A_UINT8     opcode;                         /* opcode */
+    A_UINT8     KEK[GTK_OFFLOAD_KEK_BYTES];     /* key encryption key */
+    A_UINT8     KCK[GTK_OFFLOAD_KCK_BYTES];     /* key confirmation key */
+    A_UINT8     replay_counter[GTK_REPLAY_COUNTER_BYTES];  /* replay counter for re-key */
+} POSTPACK  WMI_GTK_OFFLOAD_OP;
+
+
+#define WMI_RX_FILTER_DEFAULT_MAX_TESTS_PER_FILTER  5   
+#define WMI_RX_FILTER_DEFAULT_MAX_FILTERS           10
+
+   /* note the max pattern length was selected to balance size and usefulness.  Header
+     * filtering is sized to support IPV6 addresses (16 octets using 2 entries) 
+     * and MAC addresses (6 octets) */
+#define RX_FILTER_FRAME_TEST_MAX_PATTERN_LEN    8 
+
+typedef enum {
+    WMI_RX_FILTER_PACKET_TYPE_NOT_SPEC = 0,    /* not specified */
+    WMI_RX_FILTER_PACKET_TYPE_UNICAST = 1,
+    WMI_RX_FILTER_PACKET_TYPE_MULTICAST = 2,
+    WMI_RX_FILTER_PACKET_TYPE_BROADCAST = 3,
+    WMI_RX_FILTER_PACKET_TYPE_MAX      
+} WMI_RX_FILTER_PACKET_TYPE;
+
+#define RX_FILTER_FRAME_TEST_FLAGS_EQUALITY     (1 << 0) /* equality test, otherwise !=  */
+#define RX_FILTER_FRAME_TEST_FLAGS_MASK         (1 << 1) /* mask test */
+#define RX_FILTER_FRAME_TEST_FLAGS_TYPE_CHECK   (1 << 2) /* this entry is a packet type check place holder */
+
+/* testing a frame requires an offset, equality flag, an ANDing mask array and a check bytes array.
+ * This provides the flexibity to test a frame for a desired result using the following combinations:
+ * 
+ *    frame[offset] AND mask[] == check[]
+ *    frame[offset] AND mask[] != check[]
+ *    frame[offset] == check[] 
+ *    frame[offset] != check[] 
+ * 
+ */
+typedef PREPACK struct {
+    A_UINT8     flags;     /* frame test flags */
+    union {
+        A_UINT8  offset;   /* relative offset from this layer's header */
+        A_UINT8  type;     /* if flags indicate a type-check, this value is WMI_RX_FILTER_PACKET_TYPE */
+    } option;              /* additional test options depending on flags setting */
+    A_UINT8     length;    /* number of bytes to test */
+    A_UINT8     rsvd0;     /* reserved for target use */
+    A_UINT8     mask[RX_FILTER_FRAME_TEST_MAX_PATTERN_LEN];   /* AND mask to apply to each frame byte */
+    A_UINT8     check[RX_FILTER_FRAME_TEST_MAX_PATTERN_LEN];  /* check bytes */     
+} POSTPACK WMI_RX_FILTER_FRAME_TEST;
+
+typedef PREPACK struct {
+    A_UINT8                  index;             /* index for this entry */
+    A_UINT8                  reserved[3];       /* padding and future use */
+    WMI_RX_FILTER_FRAME_TEST frame_test;        /* frame test information for this entry */
+} POSTPACK WMI_RX_FILTER_SET_FRAME_TEST;
+
+    /* structure for WMI_RX_FILTER_SET_FRAME_TEST_LIST_CMDID */
+typedef PREPACK struct {
+    A_UINT8                       num_entries;            /* number of entries to follow */
+    A_UINT8                       reserved[3];            /* padding and future use */
+    WMI_RX_FILTER_SET_FRAME_TEST  frame_test_entries[1];  /* start of frame test entries */
+} POSTPACK WMI_RX_FILTER_SET_FRAME_TEST_LIST;
+
+typedef enum {
+    WMI_RX_FILTER_FRAME_HDR_TEST_MAC = 0,      /* testing MAC fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_SNAP = 1,     /* testing SNAP fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_ARP = 2,      /* testing ARP fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_GEN_ETHPROTO, /* testing a generic pattern in ether payload */
+    WMI_RX_FILTER_FRAME_HDR_TEST_IPV4,         /* testing IPV4 fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_IPV6,         /* testing IPV6 fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_GEN_IPPROTO,  /* testing a generic pattern in IP payload */
+    WMI_RX_FILTER_FRAME_HDR_TEST_UDP,          /* testing UDP fields */
+    WMI_RX_FILTER_FRAME_HDR_TEST_MAX        
+} WMI_RX_FILTER_FRAME_HDR_TEST_TYPE;
+
+#define MAKE_RX_FILTER_FRAME_HDR_MASK(b) (1 << (b))
+
+#define WMI_RX_FILT_FRAME_HDR_TEST_MAC  \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_MAC)
+#define WMI_RX_FILT_FRAME_HDR_TEST_SNAP  \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_SNAP)
+#define WMI_RX_FILT_FRAME_HDR_TEST_ARP  \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_ARP)
+#define WMI_RX_FILT_FRAME_HDR_TEST_IPV4 \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_IPV4)
+#define WMI_RX_FILT_FRAME_HDR_TEST_IPV6 \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_IPV6)
+#define WMI_RX_FILT_FRAME_HDR_TEST_UDP  \
+        MAKE_RX_FILTER_FRAME_HDR_MASK(WMI_RX_FILTER_FRAME_HDR_TEST_UDP)
+
+typedef PREPACK struct  {
+    A_UINT8  type;               /* header test type  (see WMI_RX_FILTER_FRAME_HDR_TEST_TYPE) */
+    A_UINT8  frame_test_index;   /* corresponding frame test */     
+    A_UINT8  reserved[2];        /* padding and future use */           
+} POSTPACK WMI_RX_FILTER_SET_HDR_TEST;
+
+typedef enum {
+    WMI_RX_COALESCE_FILTER_OP_UNDEF = 0,
+    WMI_RX_COALESCE_FILTER_OP_SET = 1,
+    WMI_RX_COALESCE_FILTER_OP_CLEAR = 2,  
+    WMI_RX_COALESCE_FILTER_OP_MAX,
+} WMI_RX_COALESCE_FILTER_OPCODE;
+
+typedef PREPACK struct  {
+    A_UINT8            op_code;              /* op code */
+    A_UINT8            index;                /* filter index  */
+    A_UINT8            reserved[2];          /* padding and future use */
+    union {
+            /* parameters for SET opcode */
+        struct {
+            A_UINT32   coalesc_delay_ms;     /* coalesc delay in milliseconds */      
+            A_UINT8    total_hdr_tests;      /* number of hdr test elements to follow */
+            A_UINT8    reserved[3];          /* padding and future use */
+        } set_filter_params;
+    } params;
+    union {
+            /* data for SET opcode */
+        WMI_RX_FILTER_SET_HDR_TEST  header_tests[1];      /* one or more entries */ 
+    } data;
+} POSTPACK WMI_RX_FILTER_COALESCE_FILTER_OP;
+
+     
+/*
+ * Transmit complete event data structure(s)
+ */
+
+
+typedef PREPACK struct {
+#define TX_COMPLETE_STATUS_SUCCESS 0
+#define TX_COMPLETE_STATUS_RETRIES 1
+#define TX_COMPLETE_STATUS_NOLINK  2
+#define TX_COMPLETE_STATUS_TIMEOUT 3
+#define TX_COMPLETE_STATUS_OTHER   4
+
+    A_UINT8 status; /* one of TX_COMPLETE_STATUS_... */
+    A_UINT8 pktID; /* packet ID to identify parent packet */
+    A_UINT8 rateIdx; /* rate index on successful transmission */
+    A_UINT8 ackFailures; /* number of ACK failures in tx attempt */
+#if 0 /* optional params currently ommitted. */
+    A_UINT32 queueDelay; // usec delay measured Tx Start time - host delivery time
+    A_UINT32 mediaDelay; // usec delay measured ACK rx time - host delivery time
+#endif
+} POSTPACK TX_COMPLETE_MSG_V1; /* version 1 of tx complete msg */
+
+#if defined(EXTENDED_TX_COMPLETE)
+typedef PREPACK struct {
+#define TX_COMPLETE_TYPE_UCAST 0
+#define TX_COMPLETE_TYPE_MGMT  1
+#define TX_COMPLETE_TYPE_MCAST 2
+#define TX_COMPLETE_TYPE_PAL   3
+    A_UINT8 status      : 4, /* one of TX_COMPLETE_STATUS_... */
+            dev_id      : 4;
+    A_UINT8 peer_id;
+    A_UINT8 tid         : 4,
+            pkt_type    : 4; /* 0:unicast data, 1:mgmt&ctrl, 2:multicast data, 3:pal */
+    A_UINT8 packet_id;
+} POSTPACK TX_COMPLETE_MSG_V2; /* version 1 of tx complete msg */
+#endif /* EXTENDED_TX_COMPLETE */
+
+typedef PREPACK struct {
+    A_UINT8 numMessages; /* number of tx comp msgs following this struct */
+    A_UINT8 msgLen; /* length in bytes for each individual msg following this struct */
+    A_UINT8 msgType; /* version of tx complete msg data following this struct */
+    A_UINT8 reserved; /* individual messages follow this header */
+} POSTPACK WMI_TX_COMPLETE_EVENT;
+
+#define WMI_TXCOMPLETE_VERSION_1 (0x01)
+#if defined(EXTENDED_TX_COMPLETE)
+#define WMI_TXCOMPLETE_VERSION_2 (0x02)
+#endif /* EXTENDED_TX_COMPLETE */
+
+
+/*
+ * ------- AP Mode definitions --------------
+ */
+
+/*
+ * !!! Warning !!!
+ * -Changing the following values needs compilation of both driver and firmware
+ */
+#ifdef AR6002_REV2
+#define AP_MAX_NUM_STA          4
+#else
+#define AP_MAX_NUM_STA          10
+#endif
+
+/*Maximum no. of virtual interface supported*/
+#ifdef AR6002_REV64
+#define NUM_DEV     4
+#define NUM_CONN    (AP_MAX_NUM_STA + NUM_DEV - 1) /* As P2P device port won't enter CONN state, so we omit 1 CONN buffer */
+#else
+#define NUM_DEV     3
+#define NUM_CONN    (AP_MAX_NUM_STA + NUM_DEV)
+#endif
+
+#define AP_ACL_SIZE             10
+#define IEEE80211_MAX_IE        256
+#define MCAST_AID               0xFF /* Spl. AID used to set DTIM flag in the beacons */
+#define DEF_AP_COUNTRY_CODE     "US "
+#define DEF_AP_WMODE_G          WMI_11G_MODE
+#define DEF_AP_WMODE_AG         WMI_11AG_MODE
+#define DEF_AP_DTIM             5
+#define DEF_BEACON_INTERVAL     100
+
+/* ACS scan policy */
+#define AP_ACS_NORMAL               0 /* 1, 6, 11 */
+#define AP_ACS_DISABLE_CH11         1 /* 1, 6 */
+#define AP_ACS_INCLUDE_CH13         2 /* 1, 5, 9, 13 */
+
+/* AP mode disconnect reasons */
+#define AP_DISCONNECT_STA_LEFT      101
+#define AP_DISCONNECT_FROM_HOST     102
+#define AP_DISCONNECT_COMM_TIMEOUT  103
+#define AP_DISCONNECT_MAX_STA       104
+#define AP_DISCONNECT_ACL           105
+#define AP_DISCONNECT_STA_ROAM      106
+#define AP_DISCONNECT_DFS_CHANNEL   107 
+/*
+ * Used with WMI_AP_HIDDEN_SSID_CMDID
+ */
+#define HIDDEN_SSID_FALSE   0
+#define HIDDEN_SSID_TRUE    1
+typedef PREPACK struct {
+    A_UINT8     hidden_ssid;
+} POSTPACK WMI_AP_HIDDEN_SSID_CMD;
+
+/*
+ * Used with WMI_AP_ACL_POLICY_CMDID
+ */
+#define AP_ACL_DISABLE          0x00
+#define AP_ACL_ALLOW_MAC        0x01
+#define AP_ACL_DENY_MAC         0x02
+#define AP_ACL_BLWL_MAC         0x03
+#define AP_ACL_RETAIN_LIST_MASK 0x80
+typedef PREPACK struct {
+    A_UINT8     policy;
+} POSTPACK WMI_AP_ACL_POLICY_CMD;
+
+/*
+ * Used with WMI_AP_ACL_MAC_LIST_CMDID
+ */
+#define ADD_MAC_ADDR    1
+#define DEL_MAC_ADDR    2
+
+#define ADD_WHITE_MAC_ADDR  0x01
+#define ADD_BLACK_MAC_ADDR  0x02
+#define RESET_WHITE_LIST	0x03
+#define RESET_BLACK_LIST	0x04
+#define RESET_BWLIST		0x10
+
+typedef PREPACK struct {
+    A_UINT8     action;
+    A_UINT8     index;
+    A_UINT8     mac[ATH_MAC_LEN];
+    A_UINT8     wildcard;
+} POSTPACK WMI_AP_ACL_MAC_CMD;
+
+typedef PREPACK struct {
+    A_UINT16    index;
+    A_UINT8     acl_mac[AP_ACL_SIZE][ATH_MAC_LEN];
+    A_UINT8     wildcard[AP_ACL_SIZE];
+    A_UINT8     policy;
+} POSTPACK WMI_AP_ACL;
+
+/*
+ * Used with WMI_AP_SET_NUM_STA_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     num_sta;
+} POSTPACK WMI_AP_NUM_STA_CMD;
+
+/*
+ * Used with WMI_AP_SET_MLME_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8    mac[ATH_MAC_LEN];
+    A_UINT16   reason;              /* 802.11 reason code */
+    A_UINT8    cmd;                 /* operation to perform */
+/* MLME Commands */
+#define WMI_AP_MLME_ASSOC       1   /* associate station */
+#define WMI_AP_DISASSOC         2   /* disassociate station */
+#define WMI_AP_DEAUTH           3   /* deauthenticate station */
+#define WMI_AP_MLME_AUTHORIZE   4   /* authorize station */
+#define WMI_AP_MLME_UNAUTHORIZE 5   /* unauthorize station */
+} POSTPACK WMI_AP_SET_MLME_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 period;
+    A_UINT8 num_null_func;
+} POSTPACK WMI_AP_CONN_INACT_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 period_min;
+    A_UINT32 dwell_ms;
+} POSTPACK WMI_AP_PROT_SCAN_TIME_CMD;
+
+typedef struct {
+    A_BOOL flag;
+    A_UINT16 rsvd;
+    A_UINT16 aid;
+} WMI_AP_SET_PVB_CMD;
+
+#define WMI_DISABLE_REGULATORY_CODE "FF"
+
+typedef PREPACK struct {
+    A_UCHAR countryCode[3];
+} POSTPACK WMI_AP_SET_COUNTRY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 dtim;
+} POSTPACK WMI_AP_SET_DTIM_CMD;
+
+typedef PREPACK struct {
+    A_UINT8  band; /* specifies which band to apply these values */
+    A_UINT8  enable; /* allows 11n to be disabled on a per band basis */
+    A_UINT8  chan_width_40M_supported;
+    A_UINT8  short_GI_20MHz;
+    A_UINT8  short_GI_40MHz;
+    A_UINT8  intolerance_40MHz;
+    A_UINT8  max_ampdu_len_exp;
+} POSTPACK WMI_SET_HT_CAP_CMD;
+
+typedef PREPACK struct {
+    A_UINT8   sta_chan_width;
+} POSTPACK WMI_SET_HT_OP_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 rateMasks[WMI_MODE_MAX*WMI_MAX_RATE_MASK];
+} POSTPACK WMI_SET_TX_SELECT_RATES_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    sgiMask[WMI_MAX_RATE_MASK];
+    A_UINT8     sgiPERThreshold;
+} POSTPACK WMI_SET_TX_SGI_PARAM_CMD;
+/* Enable for MCS 7/MCS 15 */
+#define DEFAULT_SGI_MASK_L32 0x08080000
+#define DEFAULT_SGI_MASK_U32 0x00000808
+#define DEFAULT_SGI_PER 10
+
+typedef PREPACK struct {
+    A_UINT32 rateField[WMI_MAX_RATE_MASK]; /* 1 bit per rate corresponding to index */
+#define WMI_RATE_POLICY_ID_MAX 5
+    A_UINT8 id; /* valid values == 1->WMI_RATE_POLICY_ID_MAX */
+    A_UINT8 shortTrys;
+    A_UINT8 longTrys;
+    A_UINT8 reserved; /* padding */
+} POSTPACK WMI_SET_RATE_POLICY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 metaVersion; /* version of meta data for rx packets <0 = default> (0-7 = valid) */
+    A_UINT8 dot11Hdr; /* 1 == leave .11 header intact , 0 == replace .11 header with .3 <default> */
+    A_UINT8 defragOnHost; /* 1 == defragmentation is performed by host, 0 == performed by target <default> */
+    A_UINT8 reserved[1]; /* alignment */
+} POSTPACK WMI_RX_FRAME_FORMAT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT8 enable;     /* 1 == device operates in thin mode , 0 == normal mode <default> */
+    A_UINT8 reserved[3];
+} POSTPACK WMI_SET_THIN_MODE_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT16    channel; /* frequency in Mhz */
+    //A_UINT8 mode; // HT20 or HT40
+    //A_UINT8 secondary; // if mode == HT40 secondary channel above | below
+} POSTPACK WMI_SET_CHANNEL_CMD;
+
+
+typedef enum {
+    WMI_SET_CHANNEL_RES_SUCCESS = 0, // device has joined the network
+    WMI_SET_CHANNEL_RES_FAIL, // device failed for unspecified reason
+}WMI_SET_CHANNEL_RESULT;
+
+typedef PREPACK struct {
+    A_UINT8 result; /* the result of the join cmd. one of WMI_THIN_JOIN_RESULT */
+    A_UINT8 reserved[3]; /* alignment */
+} POSTPACK WMI_SET_CHANNEL_EVENT;
+
+typedef enum {
+    WMI_FILTERMASK_MGMT=0,
+    WMI_FILTERMASK_CTRL,
+    WMI_FILTERMASK_DATA,
+    WMI_FILTERMASK_MAX
+}WMI_FILTERMASK_INDEX;
+
+typedef PREPACK struct {
+    A_UINT16 filtermask[WMI_FILTERMASK_MAX];
+    A_UINT16 reserved; /* alignment */
+} POSTPACK WMI_RX_FRAME_FILTER_CMD;
+
+/* AP mode events */
+/* WMI_PS_POLL_EVENT */
+typedef PREPACK struct {
+    A_UINT16 aid;
+} POSTPACK WMI_PSPOLL_EVENT;
+
+typedef PREPACK struct {
+    A_UINT32 tx_bytes;
+    A_UINT32 tx_pkts;
+    A_UINT32 tx_error;
+    A_UINT32 tx_discard;
+    A_UINT32 rx_bytes;
+    A_UINT32 rx_pkts;
+    A_UINT32 rx_error;
+    A_UINT32 rx_discard;
+    A_UINT32 aid;
+} POSTPACK WMI_PER_STA_STAT;
+
+#define AP_GET_STATS    0
+#define AP_CLEAR_STATS  1
+
+typedef PREPACK struct {
+    A_UINT32            action;
+    WMI_PER_STA_STAT    sta[AP_MAX_NUM_STA];
+} POSTPACK WMI_AP_MODE_STAT;
+
+#define AP_11BG_RATESET1        1
+#define AP_11BG_RATESET2        2
+#define DEF_AP_11BG_RATESET     AP_11BG_RATESET1
+typedef PREPACK struct {
+    A_UINT8 rateset;
+} POSTPACK WMI_AP_SET_11BG_RATESET_CMD;
+/*
+ * End of AP mode definitions
+ */
+
+struct _wmm_params {
+    A_UINT8     acm;           /* ACM parameter */
+    A_UINT8     aifsn;         /* AIFSN parameters */
+    A_UINT8     logcwmin;      /* cwmin in exponential form */
+    A_UINT8     logcwmax;      /* cwmax in exponential form */
+    A_UINT16    txopLimit;     /* txopLimit */
+};
+
+/* WMI_REPORT_WMM_PARAMS_EVENT */
+typedef PREPACK struct {
+    struct _wmm_params wmm_params[4];
+} POSTPACK WMI_REPORT_WMM_PARAMS_EVENT;
+
+/* P2P module definitions */
+
+/* P2P module commands */
+typedef PREPACK struct {
+    A_UINT8 go_intent;
+    A_UINT8 country[3];
+    A_UINT8 reg_class;
+    A_UINT8 listen_channel;
+    A_UINT8 op_reg_class;
+    A_UINT8 op_channel;
+} POSTPACK WMI_P2P_SET_CONFIG_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 categ;
+    A_UINT16 sub_categ;
+} POSTPACK device_type_tuple;
+
+typedef PREPACK struct {
+    device_type_tuple pri_dev_type;
+    //A_UINT8 pri_device_type[8];
+#define MAX_P2P_SEC_DEVICE_TYPES 5
+    device_type_tuple sec_dev_type[MAX_P2P_SEC_DEVICE_TYPES];
+#define WPS_UUID_LEN 16
+    A_UINT8 uuid[WPS_UUID_LEN];
+#define WPS_MAX_DEVNAME_LEN 32
+    A_UINT8 device_name[WPS_MAX_DEVNAME_LEN];
+    A_UINT8 dev_name_len;
+} POSTPACK WMI_WPS_SET_CONFIG_CMD;
+
+typedef PREPACK struct {
+    device_type_tuple pri_dev_type;
+    device_type_tuple sec_dev_type[MAX_P2P_SEC_DEVICE_TYPES];
+    A_UINT8  device_addr[ATH_MAC_LEN];
+} POSTPACK WMI_SET_REQ_DEV_ATTR_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 ssidLength;
+    A_UINT8 ssid[WMI_MAX_SSID_LEN];
+} POSTPACK P2P_SSID;
+
+typedef enum wmi_p2p_discovery_type {
+    WMI_P2P_FIND_START_WITH_FULL,
+    WMI_P2P_FIND_ONLY_SOCIAL,
+    WMI_P2P_FIND_PROGRESSIVE
+} WMI_P2P_DISC_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32 timeout;
+    WMI_P2P_DISC_TYPE type;
+} POSTPACK WMI_P2P_FIND_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT16 go_oper_freq;
+    A_UINT8  dialog_token;
+    A_UINT8  peer_addr[ATH_MAC_LEN];
+    A_UINT8  own_interface_addr[ATH_MAC_LEN];
+    A_UINT8  member_in_go_dev[ATH_MAC_LEN];
+    A_UINT8  go_dev_dialog_token;
+    P2P_SSID peer_go_ssid;
+    A_UINT8  wps_method;
+    A_UINT8 dev_capab;
+    A_INT8  go_intent;
+    A_UINT8 persistent_grp;
+} POSTPACK WMI_P2P_GO_NEG_START_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 persistent_group;
+    A_UINT8 group_formation;
+} POSTPACK WMI_P2P_GRP_INIT_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT8 grp_formation_status;
+} POSTPACK WMI_P2P_GRP_FORMATION_DONE_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 timeout;
+}POSTPACK WMI_P2P_LISTEN_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT8 status;
+    A_INT8 go_intent;
+    A_UINT8 wps_buf[512];
+    A_UINT16 wps_buflen;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 dialog_token;
+    A_UINT8 wps_method;
+    A_UINT8 persistent_grp;
+}POSTPACK WMI_P2P_GO_NEG_REQ_RSP_CMD;
+
+typedef enum {
+    WMI_P2P_INVITE_ROLE_GO,
+    WMI_P2P_INVITE_ROLE_ACTIVE_GO,
+    WMI_P2P_INVITE_ROLE_CLIENT,
+} WMI_P2P_INVITE_ROLE;
+
+typedef PREPACK struct {
+    WMI_P2P_INVITE_ROLE role;
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT8 dialog_token;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 is_persistent;
+    A_UINT8 wps_method;
+}POSTPACK WMI_P2P_INVITE_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 force_freq;
+    A_UINT8 status;
+    A_UINT8 dialog_token;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 is_go;
+    A_UINT8 group_bssid[ATH_MAC_LEN];
+}POSTPACK WMI_P2P_INVITE_REQ_RSP_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 wps_method;
+    A_UINT16 listen_freq;
+    A_UINT8 dialog_token;
+    A_UINT8 peer[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID go_oper_ssid;
+}POSTPACK WMI_P2P_PROV_DISC_REQ_CMD;
+
+typedef enum {
+    WMI_P2P_CONFID_LISTEN_CHANNEL=1,
+    WMI_P2P_CONFID_CROSS_CONNECT=2,
+    WMI_P2P_CONFID_SSID_POSTFIX=3,
+    WMI_P2P_CONFID_INTRA_BSS=4,
+
+} WMI_P2P_CONF_ID;
+
+typedef PREPACK struct {
+    A_UINT8 reg_class;
+    A_UINT8 listen_channel;
+}POSTPACK WMI_P2P_LISTEN_CHANNEL;
+
+typedef PREPACK struct {
+    A_UINT8 flag;
+}POSTPACK WMI_P2P_SET_CROSS_CONNECT;
+
+typedef PREPACK struct {
+    A_UINT8 ssid_postfix[WMI_MAX_SSID_LEN-9];
+    A_UINT8 ssid_postfix_len;
+}POSTPACK WMI_P2P_SET_SSID_POSTFIX;
+
+typedef PREPACK struct {
+    A_UINT8 flag;
+}POSTPACK WMI_P2P_SET_INTRA_BSS;
+
+typedef PREPACK struct {
+    A_UINT8 config_id;    /* set to one of WMI_P2P_CONF_ID */
+    PREPACK union {
+        WMI_P2P_LISTEN_CHANNEL listen_ch;
+        WMI_P2P_SET_CROSS_CONNECT cross_conn;
+        WMI_P2P_SET_SSID_POSTFIX ssid_postfix;
+        WMI_P2P_SET_INTRA_BSS intra_bss;
+    }POSTPACK val;
+}POSTPACK WMI_P2P_SET_CMD;
+
+#define RATECTRL_MODE_DEFAULT 0
+#define RATECTRL_MODE_PERONLY 1
+
+typedef PREPACK struct {
+    A_UINT32 mode;
+}POSTPACK WMI_SET_RATECTRL_PARM_CMD;
+
+#define WMI_P2P_MAX_TLV_LEN 1024
+typedef enum {
+    WMI_P2P_SD_TYPE_GAS_INITIAL_REQ     = 0x1,
+    WMI_P2P_SD_TYPE_GAS_INITIAL_RESP    = 0x2,
+    WMI_P2P_SD_TYPE_GAS_COMEBACK_REQ    = 0x3,
+    WMI_P2P_SD_TYPE_GAS_COMEBACK_RESP   = 0x4,
+    WMI_P2P_PD_TYPE_RESP                = 0x5,
+    WMI_P2P_SD_TYPE_STATUS_IND          = 0x6,
+} WMI_P2P_SDPD_TYPE;
+
+typedef enum {
+    WMI_P2P_SDPD_TRANSACTION_PENDING = 0x1,
+    WMI_P2P_SDPD_TRANSACTION_COMP = 0x2,
+} WMI_P2P_SDPD_TRANSACTION_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8 type;
+    A_UINT8 dialog_token;
+    A_UINT8 frag_id;
+    A_UINT8 reserved1;          /* alignment */
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT16 freq;
+    A_UINT16 status_code;
+    A_UINT16 comeback_delay;
+    A_UINT16 tlv_length;
+    A_UINT16 update_indic;
+    A_UINT16 total_length;
+    A_UINT16 reserved2;         /* future */
+    A_UINT8  tlv[WMI_P2P_MAX_TLV_LEN];
+} POSTPACK WMI_P2P_SDPD_TX_CMD;
+
+/* P2P module events */
+
+typedef PREPACK struct {
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 wps_buf[512];
+    A_UINT16 wps_buflen;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 dialog_token;
+}POSTPACK WMI_P2P_GO_NEG_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT16 freq;
+    A_INT8 status;
+    A_UINT8 role_go;
+    A_UINT8 ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 ssid_len;
+#define WMI_MAX_PASSPHRASE_LEN 9
+    A_CHAR pass_phrase[WMI_MAX_PASSPHRASE_LEN];
+    A_UINT8 peer_device_addr[ATH_MAC_LEN];
+    A_UINT8 peer_interface_addr[ATH_MAC_LEN];
+    A_UINT8 wps_method;
+    A_UINT8 persistent_grp;
+} POSTPACK WMI_P2P_GO_NEG_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 is_persistent;
+    A_UINT8 dialog_token;
+} POSTPACK WMI_P2P_INVITE_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT16 oper_freq;
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 is_bssid_valid;
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 status;
+} POSTPACK WMI_P2P_INVITE_RCVD_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 status;
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 is_bssid_valid;
+} POSTPACK WMI_P2P_INVITE_SENT_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT16 wps_config_method;
+    A_UINT8 dev_addr[ATH_MAC_LEN];
+#define WPS_DEV_TYPE_LEN 8
+    A_UINT8 pri_dev_type[WPS_DEV_TYPE_LEN];
+    A_UINT8 device_name[WPS_MAX_DEVNAME_LEN];
+    A_UINT8 dev_name_len;
+    A_UINT16 dev_config_methods;
+    A_UINT8 device_capab;
+    A_UINT8 group_capab;
+} POSTPACK WMI_P2P_PROV_DISC_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 peer[ATH_MAC_LEN];
+    A_UINT16 config_methods;
+} POSTPACK WMI_P2P_PROV_DISC_RESP_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 type;
+    A_UINT8 transaction_status;
+    A_UINT8 dialog_token;
+    A_UINT8 frag_id;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT16 freq;
+    A_UINT16 status_code;
+    A_UINT16 comeback_delay;
+    A_UINT16 tlv_length;
+    A_UINT16 update_indic;
+//  Variable length TLV will be placed after the event
+} POSTPACK WMI_P2P_SDPD_RX_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8    event_id;    /* event identifier  */
+    A_UINT8    length;      /* number of bytes of data that follows */
+    A_UINT8    data[1];     /* start of event data */
+} POSTPACK WMI_ACS_EVENT_MSG;
+
+#define WMI_ACS_EVENT_HDR_LEN  (sizeof(WMI_ACS_EVENT_MSG) - sizeof(A_UINT8))
+
+typedef PREPACK struct {
+    A_UINT8    ctrl_id;     /* control identifier */
+    A_UINT8    length;      /* number of bytes of data to follow */
+    A_UINT8    data[1];     /* start of control data */
+} POSTPACK WMI_ACS_CTRL_MSG;
+
+#define WMI_ACS_CTRL_HDR_LEN  (sizeof(WMI_ACS_CTRL_MSG) - sizeof(A_UINT8))
+
+/* STORE / RECALL Commands AND Events DEFINITION START */
+typedef PREPACK struct {
+    A_UINT8 enable;
+#define STRRCL_RECIPIENT_HOST 1
+#define STRRCL_RECIPIENT_POWERSAFE_MEM 2
+    A_UINT8 recipient;
+} POSTPACK WMI_STORERECALL_CONFIGURE_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 length; /* number of bytes of data to follow */
+    A_UINT8  data[1]; /* start of data */
+} POSTPACK WMI_STORERECALL_RECALL_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 sleep_msec;
+    A_UINT8 store_after_tx_empty;
+    A_UINT8 store_after_fresh_beacon_rx;
+} POSTPACK WMI_STORERECALL_HOST_READY_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    msec_sleep; /* time between power off/on */
+    A_UINT32    length; /* length of following data */
+    A_UINT8     data[1]; /* start of data */
+} POSTPACK WMI_STORERECALL_STORE_EVENT;
+
+/* STORE / RECALL Commands AND Events DEFINITION END */
+/* WPS Commands AND Events DEFINITION START */
+
+typedef PREPACK struct {
+    A_UINT8 ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 macaddress[ATH_MAC_LEN];
+    A_UINT16 channel;
+    A_UINT8 ssid_len;	
+} POSTPACK WPS_SCAN_LIST_ENTRY;
+
+#define WPS_PIN_LEN (8)
+
+typedef PREPACK struct {
+    A_UINT8 pin[WPS_PIN_LEN+1];
+}POSTPACK WPS_PIN;
+
+typedef enum {
+    WPS_PIN_MODE = 0x1,
+    WPS_PBC_MODE = 0x2
+} WPS_MODE;
+
+typedef enum {
+    WPS_REGISTRAR_ROLE = 0x1,
+    WPS_ENROLLEE_ROLE  = 0x2
+} WPS_OPER_MODE;
+
+typedef enum {
+    WPS_DO_CONNECT_AFTER_CRED_RECVD = 0x1
+} WPS_START_CTRL_FLAG;
+
+typedef PREPACK struct {
+    WPS_SCAN_LIST_ENTRY ssid_info;
+    A_UINT8 config_mode; /* WPS_MODE */
+    WPS_PIN wps_pin;
+    A_UINT8 timeout;     /* in Seconds */
+    A_UINT8 role;        /* WPS_OPER_MOD */	
+    A_UINT8 ctl_flag;    /* WPS_START_CTRL_FLAG */
+} POSTPACK WMI_WPS_START_CMD;
+
+typedef enum {
+    WPS_STATUS_SUCCESS = 0x0,
+    WPS_STATUS_FAILURE = 0x1,
+    WPS_STATUS_IDLE = 0x2,       
+    WPS_STATUS_IN_PROGRESS  = 0x3,
+} WPS_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8  wps_status;  /* WPS_STATUS */
+    A_UINT8  wps_state;
+} POSTPACK WMI_WPS_GET_STATUS_EVENT;
+
+typedef enum {
+    WPS_ERROR_INVALID_START_INFO  = 0x1,
+    WPS_ERROR_MULTIPLE_PBC_SESSIONS,
+    WPS_ERROR_WALKTIMER_TIMEOUT,
+    WPS_ERROR_M2D_RCVD,
+    WPS_ERROR_PWD_AUTH_FAIL
+} WPS_ERROR_CODE;
+
+typedef enum {
+    WPS_AUTH_TYPE_OPEN    = 0x0001,
+    WPS_AUTH_TYPE_WPAPSK  = 0x0002,
+    WPS_AUTH_TYPE_SHARED  = 0x0004,
+    WPS_AUTH_TYPE_WPA     = 0x0008,
+    WPS_AUTH_TYPE_WPA2    = 0x0010,
+    WPS_AUTH_TYPE_WPA2PSK = 0x0020
+} WPS_AUTH_TYPE;
+
+typedef enum {
+    WPS_ENCR_TYPE_NONE = 0x0001,
+    WPS_ENCR_TYPE_WEP  = 0x0002,
+    WPS_ENCR_TYPE_TKIP = 0x0004,
+    WPS_ENCR_TYPE_AES  = 0x0008,
+} WPS_ENCR_TYPE;
+
+typedef PREPACK struct {
+    A_UINT16 ap_channel; 
+    A_UINT8  ssid[WMI_MAX_SSID_LEN];
+    A_UINT8  ssid_len;
+    A_UINT16 auth_type; /* WPS_AUTH_TYPE */ 
+    A_UINT16 encr_type; /* WPS_ENCR_TYPE */
+    A_UINT8  key_idx;
+    A_UINT8  key[64];
+    A_UINT8  key_len;
+    A_UINT8  mac_addr[ATH_MAC_LEN];
+} POSTPACK WPS_CREDENTIAL;
+
+typedef PREPACK struct {
+    A_UINT8 status;      /* WPS_STATUS */
+    A_UINT8 error_code;  /* WPS_ERROR_CODE */
+    WPS_CREDENTIAL  credential;
+} POSTPACK WMI_WPS_PROFILE_EVENT;
+
+/* WPS Commands AND Events DEFINITION END */
+
+typedef enum {
+    WMI_AP_APSD_DISABLED = 0,
+    WMI_AP_APSD_ENABLED
+} WMI_AP_APSD_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8    enable;
+} POSTPACK WMI_AP_SET_APSD_CMD;
+
+typedef enum {
+    WMI_AP_APSD_NO_DELIVERY_FRAMES_FOR_THIS_TRIGGER =  0x1,
+} WMI_AP_APSD_BUFFERED_TRAFFIC_FLAGS;
+
+typedef PREPACK struct {
+    A_UINT16   aid;
+    A_UINT16   bitmap;
+    A_UINT32   flags;
+} POSTPACK WMI_AP_APSD_BUFFERED_TRAFFIC_CMD;
+    
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT32 duration;
+} POSTPACK WMI_REMAIN_ON_CHNL_CMD_STRUCT;
+
+/* WMI_SEND_ACTION_CMD_STRUCT is to be deprecated; WMI_SEND_MGMT_CMD_STRUCT is 
+ * to be used instead. The new command supports P2P mgmt operations using
+ * station interface
+ */
+typedef PREPACK struct {
+    A_UINT32 ID;
+    A_UINT32 freq;
+    A_UINT32 wait;
+    A_UINT16 len;
+    A_UINT8  data[1];
+} POSTPACK  WMI_SEND_ACTION_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 ID;
+    A_UINT32 freq;
+    A_UINT32 wait;
+    A_BOOL no_cck;
+    A_UINT16 len;
+    A_UINT8  data[1];
+} POSTPACK  WMI_SEND_MGMT_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 ID;
+    A_UINT8 ACKStatus;
+} POSTPACK  WMI_TX_STATUS_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8 enable;
+} POSTPACK  WMI_PROBE_REQ_REPORT_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8 disable;
+} POSTPACK  WMI_DISABLE_11B_RATES_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8 RoleID;
+    A_UINT8 mgmtFrmType;
+    A_UINT8 ieLen;
+    A_UINT8 ieInfo[1];
+} POSTPACK  WMI_SET_APPIE_EXTENDED_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT32 duration;
+} POSTPACK  WMI_REMAIN_ON_CHNL_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT32 duration;
+    A_UINT8  status;
+} POSTPACK  WMI_CANCEL_REMAIN_ON_CHNL_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT16 len;
+    A_UINT8 data[1];
+} POSTPACK  WMI_RX_ACTION_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT16 len;
+    A_UINT8 data[1];
+} POSTPACK  WMI_P2P_CAPABILITIES_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT16 len;
+    A_UINT8 data[1];
+} POSTPACK  WMI_P2P_RX_PROBE_REQ_EVENT_STRUCT;
+
+#define P2P_FLAG_CAPABILITIES_REQ   (0x00000001)
+#define P2P_FLAG_MACADDR_REQ        (0x00000002)
+#define P2P_FLAG_P2P_MODEL_REQ      (0x00000004)
+
+typedef PREPACK struct {
+    A_UINT32 InfoReqFlags;
+} POSTPACK  WMI_GET_P2P_INFO_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 InfoReqFlags;
+    A_UINT16 len;
+    A_UINT8  data[1];
+} POSTPACK  WMI_P2P_INFO_EVENT_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8  GOPowerSave;
+} POSTPACK  WMI_P2P_CAPABILITIES_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8  MACAddr[6];
+} POSTPACK  WMI_P2P_MACADDR_STRUCT;
+
+#define P2P_HOST_MODEL          1
+#define P2P_FW_MODEL            0
+
+typedef PREPACK struct {
+    A_UINT8  P2PModel;
+} POSTPACK  WMI_P2P_MODEL_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 freq;
+    A_UINT8  DestinationAddr[6];
+    A_UINT16 len;
+    A_UINT8  data[1];
+} POSTPACK  WMI_P2P_PROBE_RESPONSE_CMD_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT32 duration;
+    A_UINT32 interval;
+    A_UINT32 start_or_offset;
+    A_UINT8 count_or_type;
+} POSTPACK P2P_NOA_DESCRIPTOR;
+
+typedef PREPACK struct {
+    A_UINT8 enable;
+    A_UINT8 count;
+    A_UINT8 noas[1];
+} POSTPACK WMI_NOA_INFO_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8 enable;
+    A_UINT8 ctwin;
+} POSTPACK WMI_OPPPS_INFO_STRUCT;
+
+typedef PREPACK struct {
+    A_UINT8 port_id;
+    A_UINT8 port_opmode;
+    A_UINT8 port_subopmode;
+} POSTPACK WMI_ADD_PORT_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 port_id;
+} POSTPACK WMI_DEL_PORT_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 status;
+    A_UINT8 port_id;
+    A_UINT8 mac_addr[6];
+} POSTPACK WMI_PORT_STATUS_INFO;
+
+typedef PREPACK struct {
+    A_UINT16   rsn_cap;
+} POSTPACK WMI_RSN_CAP_CMD;
+
+typedef PREPACK struct {
+    A_UINT8     keyIndex;
+    A_UINT8     keyLength;
+    A_UINT8     keyRSC[6];/* key replay sequence counter */
+    A_UINT8     key[WMI_MAX_KEY_LEN];
+} POSTPACK WMI_SET_IGTK_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 min_rx_bundle_frame;
+    A_UINT8 min_rx_bundle_timeout;
+} POSTPACK WMI_SET_BUNDLE_PARAM_CMD;
+
+typedef PREPACK struct {
+    A_BOOL  enable;
+    A_UINT8 nextProbeCount;
+    A_UINT8 maxBackOff;
+    A_UINT8 forceBackOff;
+} POSTPACK WMI_GREENTX_PARAMS_CMD;
+
+/* voice detection enable/disable command structure */
+typedef PREPACK struct {
+    A_UINT8    enable;
+} POSTPACK WMI_VOICE_DETECTION_ENABLE_CMD;
+
+typedef enum {
+    RECOVERY_SIM_ASSERT     = 0x01,
+    RECOVERY_SIM_NO_DETECT  = 0x02,
+    RECOVERY_SIM_CTR_EP_FULL= 0x03,
+    RECOVERY_SIM_EMPTY_POINT= 0x04,
+    RECOVERY_SIM_STACK_OV   = 0x05,
+} RECOVERY_SIM_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8 type;     /*0:unused 1: ASSERT, 2: not respond detect command,3:  simulate ep-full(),4:empty point,5 stack overflow...*/
+    A_UINT8 reserved; /*unused now*/
+    A_UINT16 delay_time_ms;   /*0xffff means the simulate will delay for random time (0 ~0xffff ms)*/
+}POSTPACK WMI_SET_RECOVERY_TEST_PARAMETER_CMD;
+
+typedef PREPACK struct {
+A_UINT8 disable;  /*0: enable broadcast,  1: disable broadcast */
+} POSTPACK WMI_DISABLE_BCAST_IN_PM_CMD;
+
+typedef PREPACK struct {
+    A_INT8 rssi_value;
+} POSTPACK WMI_SET_RSSI_FILTER_CMD;
+
+
+#ifndef ATH_TARGET
+//#include "athendpack.h"
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_H_ */
diff --git a/ath6kl-wmiconfig/include/wmiconfig.h b/ath6kl-wmiconfig/include/wmiconfig.h
new file mode 100755
index 0000000..d9ac071
--- /dev/null
+++ b/ath6kl-wmiconfig/include/wmiconfig.h
@@ -0,0 +1,555 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*
+ * This file contains the definitions for wmiconfig utility
+ */
+
+#ifndef _WMI_CONFIG_H_
+#define _WMI_CONFIG_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+enum ath6kl_tm_attr {
+	__ATH6KL_TM_ATTR_INVALID	= 0,
+	ATH6KL_TM_ATTR_CMD		= 1,
+	ATH6KL_TM_ATTR_DATA		= 2,
+
+	/* keep last */
+	__ATH6KL_TM_ATTR_AFTER_LAST,
+	ATH6KL_TM_ATTR_MAX		= __ATH6KL_TM_ATTR_AFTER_LAST - 1,
+};
+
+enum ath6kl_tm_cmd {
+	ATH6KL_TM_CMD_TCMD		= 0,
+	ATH6KL_TM_CMD_RX_REPORT  = 1,	/* not used anymore */
+	ATH6KL_TM_CMD_WMI_CMD    = 0xF000,
+};
+
+
+enum {
+    WMI_GET_VERSION=501,     /* something that doesn't collide with ascii */
+    WMI_SET_POWER_MODE,
+    WMI_SET_IBSS_PM_CAPS,
+    WMI_SET_PM_PARAMS,
+    WMI_SET_SCAN_PARAMS,
+    WMI_SET_LISTEN_INTERVAL,
+    WMI_SET_BMISS_TIME,
+    WMI_SET_BSS_FILTER,
+    WMI_SET_RSSI_THRESHOLDS,
+    WMI_SET_CHANNEL,
+    WMI_SET_SSID,
+    WMI_SET_BADAP,
+    WMI_DELETE_BADAP,
+    WMI_CREATE_QOS,
+    WMI_DELETE_QOS,
+    WMI_GET_QOS_QUEUE,
+    WMI_GET_TARGET_STATS,
+    WMI_SET_TARGET_ERROR_REPORTING_BITMASK,
+    WMI_SET_AC_PARAMS,
+    WMI_SET_ASSOC_IE,
+    WMI_SET_DISC_TIMEOUT,
+    WMI_SET_ADHOC_BSSID,
+    WMI_SET_OPT_MODE,
+    WMI_OPT_SEND_FRAME,
+    WMI_SET_BEACON_INT,
+    WMI_SET_VOICE_PKT_SIZE,
+    WMI_SET_MAX_SP,
+    WMI_GET_ROAM_TBL,
+    WMI_SET_ROAM_CTRL,
+    WMI_SET_POWERSAVE_TIMERS,
+    WMI_SET_POWERSAVE_TIMERS_PSPOLLTIMEOUT,
+    WMI_SET_POWERSAVE_TIMERS_TRIGGERTIMEOUT,
+    WMI_GET_POWER_MODE,
+    WMI_SET_WLAN_STATE,
+    WMI_GET_WLAN_STATE,
+    WMI_GET_ROAM_DATA,
+    WMI_SET_BT_STATUS,
+    WMI_SET_BT_PARAMS,
+    WMI_SET_BTCOEX_FE_ANT,
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV,
+    WMI_SET_BTCOEX_SCO_CONFIG,
+    WMI_SET_BTCOEX_A2DP_CONFIG,
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG,
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG,
+    WMI_SET_BTCOEX_DEBUG,
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS,
+    WMI_GET_BTCOEX_CONFIG,
+    WMI_GET_BTCOEX_STATS,
+    WMI_SET_RETRYLIMITS,
+    WMI_START_SCAN,
+    WMI_SET_FIX_RATES,
+    WMI_GET_FIX_RATES,
+    WMI_SET_SNR_THRESHOLDS,
+    WMI_CLR_RSSISNR,
+    WMI_SET_LQ_THRESHOLDS,
+    WMI_SET_AUTH_MODE,
+    WMI_SET_REASSOC_MODE,
+    WMI_SET_LPREAMBLE,
+    WMI_SET_RTS,
+    WMI_SET_WMM,
+#ifdef USER_KEYS
+    USER_SETKEYS,
+#endif
+    WMI_APSD_TIM_POLICY,
+    WMI_SET_ERROR_DETECTION,
+    WMI_GET_HB_CHALLENGE_RESP,
+    WMI_SET_TXOP,
+    DIAG_ADDR,
+    DIAG_DATA,
+    DIAG_READ,
+    DIAG_WRITE,
+    WMI_GET_RD,
+    WMI_SET_KEEPALIVE,
+    WMI_GET_KEEPALIVE,
+    WMI_SET_APPIE,
+    WMI_SET_MGMT_FRM_RX_FILTER,
+    WMI_DBGLOG_CFG_MODULE,
+    WMI_DBGLOG_GET_DEBUG_LOGS,
+    WMI_SET_HOST_SLEEP_MODE,
+    WMI_SET_WOW_MODE,
+    WMI_GET_WOW_LIST,
+    WMI_ADD_WOW_PATTERN,
+    WMI_DEL_WOW_PATTERN,
+    DIAG_DUMP_CHIP_MEM,
+    WMI_SET_CONNECT_CTRL_FLAGS,
+    DUMP_HTC_CREDITS,
+    USER_SETKEYS_INITRSC,
+    WMI_SCAN_DFSCH_ACT_TIME,
+    WMI_SIMULATED_APSD_TIM_POLICY,
+    WMI_SET_AKMP_INFO,
+    WMI_AKMP_MULTI_PMKID,
+    WMI_NUM_PMKID,
+    WMI_PMKID_ENTRY,
+    WMI_SET_PMKID_LIST,
+    WMI_GET_PMKID_LIST,
+    WMI_SET_IEMASK,
+    WMI_SCAN_CHANNEL_LIST,
+    WMI_SET_BSS_PMKID_INFO,
+    WMI_BSS_PMKID_ENTRY,
+    WMI_BSSID,
+    WMI_ABORT_SCAN,
+    WMI_TARGET_EVENT_REPORT,
+    WMI_AP_GET_STA_LIST,    /* AP mode */
+    WMI_AP_HIDDEN_SSID,     /* AP mode */
+    WMI_AP_SET_NUM_STA,     /* AP mode */
+    WMI_AP_ACL_POLICY,      /* AP mode */
+    WMI_AP_ACL_MAC_LIST1,   /* AP mode */
+    WMI_AP_ACL_MAC_LIST2,   /* AP mode */
+    WMI_AP_GET_ACL_LIST,    /* AP mode */
+    WMI_AP_COMMIT_CONFIG,   /* AP mode */
+    WMI_AP_INACT_TIME,      /* AP mode */
+    WMI_AP_PROT_TIME,       /* AP mode */    
+    WMI_AP_SET_MLME,        /* AP mode */
+    WMI_AP_SET_COUNTRY,     /* AP mode */
+    WMI_AP_GET_COUNTRY_LIST,/* AP mode */
+    WMI_AP_DISABLE_REGULATORY, /* AP mode */
+    WMI_AP_SET_DTIM,        /* AP mode */    
+    WMI_AP_INTRA_BSS,       /* AP mode */    
+    WMI_AP_INTER_BSS,       /* AP mode */    
+    WMI_GET_IP,
+    WMI_SET_MCAST_FILTER,
+    WMI_DEL_MCAST_FILTER,
+    WMI_MCAST_FILTER,
+    WMI_DUMP_RCV_AGGR_STATS,
+    WMI_SETUP_AGGR,
+    WMI_CFG_ALLOW_AGGR,
+    WMI_CFG_DELE_AGGR,
+    WMI_SET_HT_CAP,
+    WMI_SET_HT_OP,
+    WMI_AP_GET_STAT,        /* AP mode */
+    WMI_AP_CLR_STAT,        /* AP mode */
+    WMI_SET_TX_SELECT_RATES,
+    WMI_SCAN_MAXACT_PER_SSID,
+    WMI_AP_GET_HIDDEN_SSID, /* AP mode */
+    WMI_AP_GET_COUNTRY,     /* AP mode */
+    WMI_AP_GET_WMODE,       /* AP mode */
+    WMI_AP_GET_DTIM,        /* AP mode */
+    WMI_AP_GET_BINTVL,      /* AP mode */    
+    WMI_GET_RTS,
+    DIAG_FETCH_TARGET_REGS,
+#ifdef ATH_INCLUDE_PAL
+    WMI_SEND_PAL_CMD,
+    WMI_SEND_PAL_DATA,
+#endif
+    WMI_SET_WLAN_CONN_PRECDNCE,
+    WMI_SET_AP_RATESET,     /* AP mode */
+    WMI_SET_TX_WAKEUP_POLICY,
+    WMI_SET_TX_NUM_FRAMES_TO_WAKEUP,
+    WMI_SET_AP_PS,
+    WMI_SET_AP_PS_PSTYPE,
+    WMI_SET_AP_PS_IDLE_TIME,
+    WMI_SET_AP_PS_PS_PERIOD,
+    WMI_SET_AP_PS_SLEEP_PERIOD,
+    WMI_SEND_CONNECT_CMD,
+    WMI_SEND_CONNECT_CMD1,
+    WMI_SEND_CONNECT_CMD2,
+    WMI_SET_WOW_FILTER,
+    WMI_SET_WOW_HOST_REQ_DELAY,
+    WMI_SET_QOS_SUPP,
+    WMI_SET_AC_VAL,
+    WMI_AP_SET_DFS, /* AP mode */
+    BT_HW_POWER_STATE,
+    SET_BT_HW_POWER_STATE,
+    GET_BT_HW_POWER_STATE,
+    DIAG_DUMP_CHIP_MEM_VENUS,
+    WMI_SET_TX_SGI_PARAM,
+    WMI_SGI_MASK,
+    WMI_PER_SGI,
+    WMI_WAC_ENABLE,
+    WMI_SET_WPA_OFFLOAD_STATE,
+    WMI_AP_ACS_DISABLE_HI_CHANNELS,
+    WMI_SET_DIVERSITY_PARAM,
+    WMI_SET_EXCESS_TX_RETRY_THRES,
+    WMI_FORCE_ASSERT,    
+    WMI_AP_SET_GNUM_STA,
+    WMI_AP_GET_GNUM_STA,
+    WMI_AP_GET_NUM_STA,
+    WMI_SUSPEND_DRIVER,
+    WMI_RESUME_DRIVER,    
+    WMI_SCAN_PROBED_SSID,
+    WMI_AP_SET_APSD,
+    WMI_GET_HT_CAP,
+    WMI_SET_MCASTRATE,
+    WMI_VOICE_DETECTION_ENABLE, /* enable/disable voice detection */
+    WMI_SET_TXE_NOTIFY,
+    WMI_SET_RECOVERY_SIMULATE, /*set recovery simulate*/
+WMI_DISABLE_BCAST_IN_PM,  /* enable/disable broadcast in power save */
+    WMI_AP_BLWL,                /*set SAP blacklist/whitelist*/
+    WMI_AP_BLWL_POLICY,          /*set SAP blacklist/whitelist policy*/
+    WMI_AP_BLWL_MAC_LIST,         /*set SAP blacklist/whitelist mac*/
+    WMI_SET_RSSI_FILTER,
+};
+
+/*
+***************************************************************************
+**  How to form a regcode from CountryCode, Regulatory domain or WWR code:
+**
+**  WWR code is nothing but a special case of Regulatory domain.
+**
+**      code is of type U_INT32
+**
+**      Bit-31  Bit-30      Bit11-0
+**        0       0          xxxx    -> Bit11-0 is a Regulatory Domain
+**        0       1          xxxx    -> Bit11-0 is a WWR code
+**        1       X          xxxx    -> Bit11-0 is a Country code
+**  
+***************************************************************************
+*/
+#define REGCODE_IS_CC_BITSET(x)     ((x) & 0x80000000)
+#define REGCODE_GET_CODE(x)         ((x) & 0xFFF)
+#define REGCODE_IS_WWR_BITSET(x)    ((x) & 0x40000000)
+#ifdef ATH_INCLUDE_PAL
+#define MAX_BUFFER_SIZE             1512    
+#endif
+
+typedef struct {
+    A_UINT32        numPMKIDUser;          /* PMKIDs user wants to enter */
+    WMI_SET_PMKID_LIST_CMD  *pmkidInfo;
+} pmkidUserInfo_t;
+
+#define KEYTYPE_PSK     1
+#define KEYTYPE_PHRASE  2
+
+typedef struct {
+    char ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 ssid_len;
+    A_UINT8 wpa;
+    A_UINT8 ucipher;
+    A_UINT8 mcipher;
+    char    psk[64];
+    A_UINT8 psk_type;
+    A_UINT8 pmk[WMI_PMK_LEN];
+    A_UINT8 auth;
+    A_UINT8 wep_key[4][26];
+    A_UINT8 def_wep_key;
+} profile_t;
+
+/*
+ * Numbering from ISO 3166
+ */
+enum CountryCode {
+    CTRY_ALBANIA              = 8,       /* Albania */
+    CTRY_ALGERIA              = 12,      /* Algeria */
+    CTRY_ARGENTINA            = 32,      /* Argentina */
+    CTRY_ARMENIA              = 51,      /* Armenia */
+    CTRY_ARUBA                = 533,     /* Aruba */
+    CTRY_AUSTRALIA            = 36,      /* Australia (for STA) */
+    CTRY_AUSTRALIA_AP         = 5000,    /* Australia (for AP) */
+    CTRY_AUSTRIA              = 40,      /* Austria */
+    CTRY_AZERBAIJAN           = 31,      /* Azerbaijan */
+    CTRY_BAHRAIN              = 48,      /* Bahrain */
+    CTRY_BANGLADESH           = 50,      /* Bangladesh */
+    CTRY_BARBADOS             = 52,      /* Barbados */
+    CTRY_BELARUS              = 112,     /* Belarus */
+    CTRY_BELGIUM              = 56,      /* Belgium */
+    CTRY_BELIZE               = 84,      /* Belize */
+    CTRY_BOLIVIA              = 68,      /* Bolivia */
+    CTRY_BOSNIA_HERZEGOWANIA  = 70,      /* Bosnia & Herzegowania */
+    CTRY_BRAZIL               = 76,      /* Brazil */
+    CTRY_BRUNEI_DARUSSALAM    = 96,      /* Brunei Darussalam */
+    CTRY_BULGARIA             = 100,     /* Bulgaria */
+    CTRY_CAMBODIA             = 116,     /* Cambodia */
+    CTRY_CANADA               = 124,     /* Canada (for STA) */
+    CTRY_CANADA_AP            = 5001,    /* Canada (for AP) */
+    CTRY_CHILE                = 152,     /* Chile */
+    CTRY_CHINA                = 156,     /* People's Republic of China */
+    CTRY_COLOMBIA             = 170,     /* Colombia */
+    CTRY_COSTA_RICA           = 188,     /* Costa Rica */
+    CTRY_CROATIA              = 191,     /* Croatia */
+    CTRY_CYPRUS               = 196,
+    CTRY_CZECH                = 203,     /* Czech Republic */
+    CTRY_DENMARK              = 208,     /* Denmark */
+    CTRY_DOMINICAN_REPUBLIC   = 214,     /* Dominican Republic */
+    CTRY_ECUADOR              = 218,     /* Ecuador */
+    CTRY_EGYPT                = 818,     /* Egypt */
+    CTRY_EL_SALVADOR          = 222,     /* El Salvador */
+    CTRY_ESTONIA              = 233,     /* Estonia */
+    CTRY_FAEROE_ISLANDS       = 234,     /* Faeroe Islands */
+    CTRY_FINLAND              = 246,     /* Finland */
+    CTRY_FRANCE               = 250,     /* France */
+    CTRY_FRANCE2              = 255,     /* France2 */
+    CTRY_GEORGIA              = 268,     /* Georgia */
+    CTRY_GERMANY              = 276,     /* Germany */
+    CTRY_GREECE               = 300,     /* Greece */
+    CTRY_GREENLAND            = 304,     /* Greenland */
+    CTRY_GRENADA              = 308,     /* Grenada */
+    CTRY_GUAM                 = 316,     /* Guam */
+    CTRY_GUATEMALA            = 320,     /* Guatemala */
+    CTRY_HAITI                = 332,     /* Haiti */
+    CTRY_HONDURAS             = 340,     /* Honduras */
+    CTRY_HONG_KONG            = 344,     /* Hong Kong S.A.R., P.R.C. */
+    CTRY_HUNGARY              = 348,     /* Hungary */
+    CTRY_ICELAND              = 352,     /* Iceland */
+    CTRY_INDIA                = 356,     /* India */
+    CTRY_INDONESIA            = 360,     /* Indonesia */
+    CTRY_IRAN                 = 364,     /* Iran */
+    CTRY_IRAQ                 = 368,     /* Iraq */
+    CTRY_IRELAND              = 372,     /* Ireland */
+    CTRY_ISRAEL               = 376,     /* Israel */
+    CTRY_ITALY                = 380,     /* Italy */
+    CTRY_JAMAICA              = 388,     /* Jamaica */
+    CTRY_JAPAN                = 392,     /* Japan */
+    CTRY_JAPAN1               = 393,     /* Japan (JP1) */
+    CTRY_JAPAN2               = 394,     /* Japan (JP0) */
+    CTRY_JAPAN3               = 395,     /* Japan (JP1-1) */
+    CTRY_JAPAN4               = 396,     /* Japan (JE1) */
+    CTRY_JAPAN5               = 397,     /* Japan (JE2) */
+    CTRY_JAPAN6               = 399,     /* Japan (JP6) */
+    CTRY_JORDAN               = 400,     /* Jordan */
+    CTRY_KAZAKHSTAN           = 398,     /* Kazakhstan */
+    CTRY_KENYA                = 404,     /* Kenya */
+    CTRY_KOREA_NORTH          = 408,     /* North Korea */
+    CTRY_KOREA_ROC            = 410,     /* South Korea (for STA) */
+    CTRY_KOREA_ROC2           = 411,     /* South Korea */
+    CTRY_KOREA_ROC3           = 412,     /* South Korea (for AP) */
+    CTRY_KUWAIT               = 414,     /* Kuwait */
+    CTRY_LATVIA               = 428,     /* Latvia */
+    CTRY_LEBANON              = 422,     /* Lebanon */
+    CTRY_LIBYA                = 434,     /* Libya */
+    CTRY_LIECHTENSTEIN        = 438,     /* Liechtenstein */
+    CTRY_LITHUANIA            = 440,     /* Lithuania */
+    CTRY_LUXEMBOURG           = 442,     /* Luxembourg */
+    CTRY_MACAU                = 446,     /* Macau */
+    CTRY_MACEDONIA            = 807,     /* the Former Yugoslav Republic of Macedonia */
+    CTRY_MALAYSIA             = 458,     /* Malaysia */
+    CTRY_MALTA                = 470,     /* Malta */
+    CTRY_MEXICO               = 484,     /* Mexico */
+    CTRY_MONACO               = 492,     /* Principality of Monaco */
+    CTRY_MOROCCO              = 504,     /* Morocco */
+    CTRY_NEPAL                = 524,     /* Nepal */   
+    CTRY_NETHERLANDS          = 528,     /* Netherlands */
+    CTRY_NETHERLAND_ANTILLES  = 530,     /* Netherlands-Antilles */
+    CTRY_NEW_ZEALAND          = 554,     /* New Zealand */
+    CTRY_NICARAGUA            = 558,     /* Nicaragua */
+    CTRY_NORWAY               = 578,     /* Norway */
+    CTRY_OMAN                 = 512,     /* Oman */
+    CTRY_PAKISTAN             = 586,     /* Islamic Republic of Pakistan */
+    CTRY_PANAMA               = 591,     /* Panama */
+    CTRY_PARAGUAY             = 600,     /* Paraguay */
+    CTRY_PERU                 = 604,     /* Peru */
+    CTRY_PHILIPPINES          = 608,     /* Republic of the Philippines */
+    CTRY_POLAND               = 616,     /* Poland */
+    CTRY_PORTUGAL             = 620,     /* Portugal */
+    CTRY_PUERTO_RICO          = 630,     /* Puerto Rico */
+    CTRY_QATAR                = 634,     /* Qatar */
+    CTRY_ROMANIA              = 642,     /* Romania */
+    CTRY_RUSSIA               = 643,     /* Russia */
+    CTRY_RWANDA               = 646,     /* Rwanda */
+    CTRY_SAUDI_ARABIA         = 682,     /* Saudi Arabia */
+    CTRY_MONTENEGRO           = 891,     /* Montenegro */
+    CTRY_SINGAPORE            = 702,     /* Singapore */
+    CTRY_SLOVAKIA             = 703,     /* Slovak Republic */
+    CTRY_SLOVENIA             = 705,     /* Slovenia */
+    CTRY_SOUTH_AFRICA         = 710,     /* South Africa */
+    CTRY_SPAIN                = 724,     /* Spain */
+    CTRY_SRILANKA             = 144,     /* Sri Lanka */
+    CTRY_SWEDEN               = 752,     /* Sweden */
+    CTRY_SWITZERLAND          = 756,     /* Switzerland */
+    CTRY_SYRIA                = 760,     /* Syria */
+    CTRY_TAIWAN               = 158,     /* Taiwan */
+    CTRY_THAILAND             = 764,     /* Thailand */
+    CTRY_TRINIDAD_Y_TOBAGO    = 780,     /* Trinidad y Tobago */
+    CTRY_TUNISIA              = 788,     /* Tunisia */
+    CTRY_TURKEY               = 792,     /* Turkey */
+    CTRY_UAE                  = 784,     /* U.A.E. */
+    CTRY_UKRAINE              = 804,     /* Ukraine */
+    CTRY_UNITED_KINGDOM       = 826,     /* United Kingdom */
+    CTRY_UNITED_STATES        = 840,     /* United States (for STA) */
+    CTRY_UNITED_STATES_AP     = 841,     /* United States (for AP) */
+    CTRY_UNITED_STATES_PS     = 842,     /* United States - public safety */
+    CTRY_URUGUAY              = 858,     /* Uruguay */
+    CTRY_UZBEKISTAN           = 860,     /* Uzbekistan */
+    CTRY_VENEZUELA            = 862,     /* Venezuela */
+    CTRY_VIET_NAM             = 704,     /* Viet Nam */
+    CTRY_YEMEN                = 887,     /* Yemen */
+    CTRY_ZIMBABWE             = 716      /* Zimbabwe */
+};
+
+#define CTRY_DEBUG      0
+#define CTRY_DEFAULT    0x1ff
+#define REGCODE_COUNTRY_BIT 0x80000000
+
+typedef struct {
+    A_UINT16    countryCode;       
+    A_CHAR      isoName[3];
+} COUNTRY_CODE_MAP;
+#if 0
+static COUNTRY_CODE_MAP allCountries[] = {
+    {CTRY_DEBUG,        "DB"}, 
+    {CTRY_DEFAULT,      "NA"},
+    {CTRY_ALBANIA,      "AL"},
+    {CTRY_ALGERIA,      "DZ"},
+    {CTRY_ARGENTINA,    "AR"},
+    {CTRY_ARMENIA,      "AM"},
+    {CTRY_ARUBA,        "AW"},
+    {CTRY_AUSTRALIA,    "AU"},
+    {CTRY_AUSTRALIA_AP, "AU"},
+    {CTRY_AUSTRIA,      "AT"},
+    {CTRY_AZERBAIJAN,   "AZ"},
+    {CTRY_BAHRAIN,      "BH"},
+    {CTRY_BANGLADESH,   "BD"},
+    {CTRY_BARBADOS,     "BB"},
+    {CTRY_BELARUS,      "BY"},
+    {CTRY_BELGIUM,      "BE"},
+    {CTRY_BELIZE,       "BZ"},
+    {CTRY_BOLIVIA,      "BO"},
+    {CTRY_BOSNIA_HERZEGOWANIA,   "BA"},
+    {CTRY_BRAZIL,       "BR"},
+    {CTRY_BRUNEI_DARUSSALAM, "BN"},
+    {CTRY_BULGARIA,       "BG"},
+    {CTRY_CAMBODIA,       "KH"},
+    {CTRY_CANADA,         "CA"},
+    {CTRY_CANADA_AP,      "CA"},
+    {CTRY_CHILE,          "CL"},
+    {CTRY_CHINA,          "CN"},
+    {CTRY_COLOMBIA,       "CO"},
+    {CTRY_COSTA_RICA,     "CR"},
+    {CTRY_CROATIA,        "HR"},
+    {CTRY_CYPRUS,         "CY"},
+    {CTRY_CZECH,          "CZ"},
+    {CTRY_DENMARK,        "DK"},
+    {CTRY_DOMINICAN_REPUBLIC, "DO"},
+    {CTRY_ECUADOR,        "EC"},
+    {CTRY_EGYPT,          "EG"},
+    {CTRY_EL_SALVADOR,    "SV"},
+    {CTRY_ESTONIA,        "EE"},
+    {CTRY_FINLAND,        "FI"},
+    {CTRY_FRANCE,         "FR"},
+    {CTRY_FRANCE2,        "F2"},
+    {CTRY_GEORGIA,        "GE"},
+    {CTRY_GERMANY,        "DE"},
+    {CTRY_GREECE,         "GR"},
+    {CTRY_GREENLAND,      "GL"},
+    {CTRY_GRENADA,        "GD"},
+    {CTRY_GUAM,           "GU"},
+    {CTRY_GUATEMALA,      "GT"},
+    {CTRY_HAITI,          "HT"},
+    {CTRY_HONDURAS,       "HN"},
+    {CTRY_HONG_KONG,      "HK"},
+    {CTRY_HUNGARY,        "HU"},
+    {CTRY_ICELAND,        "IS"},
+    {CTRY_INDIA,          "IN"},
+    {CTRY_INDONESIA,      "ID"},
+    {CTRY_IRAN,           "IR"},
+    {CTRY_IRELAND,        "IE"},
+    {CTRY_ISRAEL,         "IL"},
+    {CTRY_ITALY,          "IT"},
+    {CTRY_JAMAICA,        "JM"},
+    {CTRY_JAPAN,          "JP"},
+    {CTRY_JORDAN,         "JO"},
+    {CTRY_KAZAKHSTAN,     "KZ"},
+    {CTRY_KENYA,          "KE"},
+    {CTRY_KOREA_NORTH,    "KP"},
+    {CTRY_KOREA_ROC,      "KR"},
+    {CTRY_KOREA_ROC2,     "K2"},
+    {CTRY_KOREA_ROC3,     "K3"},
+    {CTRY_KUWAIT,         "KW"},
+    {CTRY_LATVIA,         "LV"},
+    {CTRY_LEBANON,        "LB"},
+    {CTRY_LIECHTENSTEIN,  "LI"},
+    {CTRY_LITHUANIA,     "LT"},
+    {CTRY_LUXEMBOURG,    "LU"},
+    {CTRY_MACAU,         "MO"},
+    {CTRY_MACEDONIA,     "MK"},
+    {CTRY_MALAYSIA,      "MY"},
+    {CTRY_MALTA,         "MT"},
+    {CTRY_MEXICO,        "MX"},
+    {CTRY_MONACO,        "MC"},
+    {CTRY_MOROCCO,       "MA"},
+    {CTRY_NEPAL,         "NP"},
+    {CTRY_NEW_ZEALAND,   "NZ"},
+    {CTRY_NETHERLANDS,   "NL"},
+    {CTRY_NETHERLAND_ANTILLES,    "AN"},
+    {CTRY_NORWAY,         "NO"},
+    {CTRY_OMAN,           "OM"},
+    {CTRY_PAKISTAN,       "PK"},
+    {CTRY_PANAMA,         "PA"},
+    {CTRY_PERU,           "PE"},
+    {CTRY_PHILIPPINES,    "PH"},
+    {CTRY_POLAND,         "PL"},
+    {CTRY_PORTUGAL,       "PT"},
+    {CTRY_PUERTO_RICO,    "PR"},
+    {CTRY_QATAR,          "QA"},
+    {CTRY_ROMANIA,        "RO"},
+    {CTRY_RUSSIA,         "RU"},
+    {CTRY_RWANDA,         "RW"},
+    {CTRY_SAUDI_ARABIA,   "SA"},
+    {CTRY_MONTENEGRO,     "CS"},
+    {CTRY_SINGAPORE,      "SG"},
+    {CTRY_SLOVAKIA,       "SK"},
+    {CTRY_SLOVENIA,       "SI"},
+    {CTRY_SOUTH_AFRICA,   "ZA"},
+    {CTRY_SPAIN,          "ES"},
+    {CTRY_SRILANKA,       "LK"},
+    {CTRY_SWEDEN,         "SE"},
+    {CTRY_SWITZERLAND,    "CH"},
+    {CTRY_SYRIA,          "SY"},
+    {CTRY_TAIWAN,         "TW"},
+    {CTRY_THAILAND,       "TH"},
+    {CTRY_TRINIDAD_Y_TOBAGO, "TT"},
+    {CTRY_TUNISIA,        "TN"},
+    {CTRY_TURKEY,         "TR"},
+    {CTRY_UKRAINE,        "UA"},
+    {CTRY_UAE,            "AE"},
+    {CTRY_UNITED_KINGDOM, "GB"},
+    {CTRY_UNITED_STATES,    "US"},
+    {CTRY_UNITED_STATES_AP, "US"},
+    {CTRY_UNITED_STATES_PS, "PS"},
+    {CTRY_URUGUAY,        "UY"},
+    {CTRY_UZBEKISTAN,     "UZ"},    
+    {CTRY_VENEZUELA,      "VE"},
+    {CTRY_VIET_NAM,       "VN"},
+    {CTRY_YEMEN,          "YE"},
+    {CTRY_ZIMBABWE,       "ZW"}
+};
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_CONFIG_H_ */
diff --git a/ath6kl-wmiconfig/wmiconfig b/ath6kl-wmiconfig/wmiconfig
new file mode 100755
index 0000000..958ded7
--- /dev/null
+++ b/ath6kl-wmiconfig/wmiconfig
Binary files differ
diff --git a/ath6kl-wmiconfig/wmiconfig.c b/ath6kl-wmiconfig/wmiconfig.c
new file mode 100755
index 0000000..5e5c2c3
--- /dev/null
+++ b/ath6kl-wmiconfig/wmiconfig.c
@@ -0,0 +1,3530 @@
+/*
+* Copyright (c) 2012 Qualcomm Atheros, Inc..
+* All Rights Reserved.
+* Qualcomm Atheros Confidential and Proprietary.
+*/
+#define SUPPORT_11N
+#include "libtcmd.h"
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <linux/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdbool.h>
+#include <a_config.h>
+#include <a_osapi.h>
+#include <athdefs.h>
+#include <a_types.h>
+#include <wmi.h>
+
+#include "athdrv_linux.h"
+#include "ieee80211.h"
+#include "ieee80211_ioctl.h"
+#include "wmiconfig.h"
+#include "pkt_log.h"
+#include "wmi.h"
+#include "dbglog.h"
+#include "testcmd.h"
+
+#define TO_LOWER(c) ((((c) >= 'A') && ((c) <= 'Z')) ? ((c)+ 0x20) : (c))
+
+#define ISDIGIT(c)  ( (((c) >= '0') && ((c) <= '9')) ? (1) : (0) )
+
+//static int send_connect_cmd();
+
+//static int send_scan_probedssid_cmd();
+
+static int _from_hex(char c);
+//static A_INT8 getPhyMode(char *pArg);
+
+static A_UINT16 wmic_ieee2freq(int chan);
+static A_STATUS wmic_ether_aton(const char *orig, A_UINT8 *eth);
+void            printTargetStats(TARGET_STATS *pStats);
+static A_STATUS
+wmic_get_ip(const char *ipstr, A_UINT32 *ip);
+A_STATUS
+wmic_validate_setkeepalive(WMI_SET_KEEPALIVE_CMD_EXT *cmd, char **argv);
+A_STATUS
+wmic_validate_roam_ctrl(WMI_SET_ROAM_CTRL_CMD *pRoamCtrl, A_UINT8 numArgs,
+                        char **argv);
+A_STATUS
+wmic_validate_appie(struct ieee80211req_getset_appiebuf *appIEInfo, char **argv);
+void rx_cb(void *buf, int len);
+A_STATUS
+wmic_validate_mgmtfilter(A_UINT32 *pMgmtFilter, char **argv);
+void convert_hexstring_bytearray(char *hexStr, A_UINT8 *byteArray,
+                                    A_UINT8 numBytes);
+//static int is_mac_null(A_UINT8 *mac);
+void print_wild_mac(unsigned char *mac, char wildcard);
+A_STATUS wmic_ether_aton_wild(const char *orig, A_UINT8 *eth, A_UINT8 *wild);
+void printBtcoexConfig(WMI_BTCOEX_CONFIG_EVENT * pConfig);
+void printBtcoexStats(WMI_BTCOEX_STATS_EVENT * pStats);
+#ifdef ATH_INCLUDE_PAL
+void *phy_attach(char *if_name);
+int pal_send_hci_cmd(void *dev, char *buf, short sz);
+int pal_send_acl_data_pkt(void *dev, char *buf, short sz);
+void cmdParser(A_UINT8 *cmd,A_UINT16 len);
+void palData(A_UINT8 *data,A_UINT32 len);
+extern int eventLogLevel; //To enable/disable Debug messages. defined in pal parser library
+
+const char palcommands[]=
+"--sendpalcmd <filename> <on/off> ; on - enable debug; off - disable debug \n\
+--sendpaldata <filename> <on/off>; on - enable debug; off - disable debug \n";
+#endif
+const char *progname;
+const char commands[] =
+"commands:\n\
+--version\n\
+--power <mode> where <mode> is rec or maxperf\n\
+--getpower is used to get the power mode(rec or maxperf)\n\
+--pmparams --it=<msec> --np=<number of PS POLL> --dp=<DTIM policy: ignore/normal/stick> --twp=<Tx wakeup policy: wakeup/sleep> --nt=<number of tx to wakeup>\n\
+--psparams --psPollTimer=<psPollTimeout> --triggerTimer=<triggerTimeout> --apsdTimPolicy=<ignore/adhere> --simulatedAPSDTimPolicy=<ignore/adhere>\n\
+--forceAssert \n\
+--ibsspmcaps --ps=<disable/atheros/ieee> --aw=<ATIM Windows in millisecond> --to=<TIMEOUT in millisecond> --ttl=<Time to live in number of beacon periods>\n\
+--appsparams --pstype=<disable/atheros> --psit=<millisecond> --psperiod=<in microsecond> --sleepperiod=<in psperiods>\n\
+--scan --fgstart=<sec> --fgend=<sec> --bg=<sec> --minact=<msec> maxact=<msec> --pas=<msec> --sr=<short scan ratio> --maxact2pas=<msec> --scanctrlflags <connScan> <scanConnected> <activeScan> <roamScan> <reportBSSINFO> <EnableAutoScan> --maxactscan_ssid=<Max no of active scan per probed ssid>\n\
+  where: \n\\n\
+  <connScan>           is 0 to not scan when Connect and Reconnect command, \n\
+                          1 to scan when Connect and Reconnect command, \n\
+  <scanConnected>      is 0 to skip the ssid it is already connected to, \n\
+                          1 to scan the ssid it is already connected to, \n\
+  <activeScan>         is 0 to disable active scan, \n\
+                          1 to enable active scan, \n\
+  <roamScan>           is 0 to disable roam scan when beacom miss and low rssi.(It's only valible when connScan is 0.\n\
+                          1 to enable roam scan.\n\
+  <reportBSSINFO>      is 0 to disable specified BSSINFO reporting rule.\n\
+                          1 to enable specified BSSINFO reporting rule.\n\
+ <EnableAutoScan>      is 0 to disable autonomous scan. No scan after a disconnect event\n\
+                          1 Enable autonomous scan.\n\
+--listen=<#of TUs, can  range from 15 to 5000>\n\
+--listenbeacons=<#of beacons, can  range from 1 to 50>\n\
+--setbmisstime <#of TUs, can range from 1000 to 5000>\n\
+--setbmissbeacons <#of beacons, can range from 5 to 50>\n\
+--filter=<filter> --ieMask 0x<mask> where <filter> is none, all, profile, not_profile, bss, not_bss, or ssid and <mask> is a combination of the following\n\
+{\n\
+    BSS_ELEMID_CHANSWITCH = 0x01 \n\
+    BSS_ELEMID_ATHEROS = 0x02\n\
+}\n\
+--wmode <mode> <list> sc <scan> where \n\
+        <mode> is a, g, b,ag, gonly (use mode alone in AP mode) \n\
+        <list> is a list of channels (frequencies in mhz or ieee channel numbers)\n\
+        <scan> is 0 to disable scan after setting channel list.\n\
+                  1 to enable scan after setting channel list.\n\
+--getwmode \n\
+--ssid <index> <ssid> \n\
+        where <ssid> is the wireless network string,'any' mean empty ssid, 'off' means disable \n\
+              <index> is 0 ~ 15 \n\
+--badAP=<macaddr> [--num=<index>] where macaddr is macaddr of AP to be avoided in xx:xx:xx:xx:xx:xx format, and num is index from 0-1.\n\
+--clrAP [--num=<index>] is used to clear a badAP entry.  num is index from 0-1\n\
+--createqos <user priority> <direction> <traffic class> <trafficType> <voice PS capability> \n\
+    <min service interval> <max service interval> <inactivity interval> <suspension interval> \n\
+    <service start time> <tsid> <nominal MSDU> <max MSDU> <min data rate> <mean data rate> \n\
+    <peak data rate> <max burst size> <delay bound> <min phy rate> <sba> <medium time>where:\n\
+        <user priority>         802.1D user priority range : 0-7        \n\
+        <direction>             is 0 for Tx(uplink) traffic,            \n\
+                                   1 for Rx(downlink) traffic,          \n\
+                                   2 for bi-directional traffic;        \n\
+        <traffic class>         is 0 for BE,                            \n\
+                                   1 for BK,                            \n\
+                                   2 for VI,                            \n\
+                                   3 for VO;                            \n\
+        <trafficType>           1-periodic, 0-aperiodic                 \n\
+        <voice PS capability>   specifies whether the voice power save mechanism \n\
+                                (APSD if AP supports it or legacy/simulated APSD \n\
+                                    [using PS-Poll] ) should be used             \n\
+                                = 0 to disable voice power save for this traffic class,\n\
+                                = 1 to enable APSD voice power save for this traffic class,\n\
+                                = 2 to enable voice power save for ALL traffic classes,\n\
+        <min service interval>  in milliseconds                     \n\
+        <max service interval>  in milliseconds                     \n\
+        <inactivity interval>   in milliseconds;=0 means infinite inactivity interval\n\
+        <suspension interval>   in milliseconds \n\
+        <service start time>    service start time \n\
+        <tsid>                  TSID range: 0-15                    \n\
+        <nominal MSDU>          nominal MAC SDU size                \n\
+        <max MSDU>              maximum MAC SDU size                \n\
+        <min data rate>         min data rate in bps                \n\
+        <mean data rate>        mean data rate in bps               \n\
+        <peak data rate>        peak data rate in bps               \n\
+        <max burst size>        max burst size in bps               \n\
+        <delay bound>           delay bound                         \n\
+        <min phy rate>          min phy rate in bps                 \n\
+        <sba>                   surplus bandwidth allowance         \n\
+        <medium time>           medium time in TU of 32-us periods per sec    \n\
+--deleteqos <trafficClass> <tsid> where:\n\
+  <traffic class>         is 0 for BE,                            \n\
+                             1 for BK,                            \n\
+                             2 for VI,                            \n\
+                             3 for VO;                            \n\
+  <tsid> is the TspecID, use --qosqueue option to get the active tsids\n\
+--qosqueue <traffic class>, where:\n\
+  <traffic class>         is 0 for BE,                            \n\
+                             1 for BK,                            \n\
+                             2 for VI,                            \n\
+                             3 for VO;                            \n\
+--getTargetStats --clearStats\n\
+   tx_unicast_rate, rx_unicast_rate values will be 0Kbps when no tx/rx \n\
+   unicast data frame is received.\n\
+--setErrorReportingBitmask\n\
+--acparams --acval <0-3> --txop <limit> --cwmin <0-15> --cwmax <0-15> --aifsn<0-15>\n\
+--disc=<timeout> to set the disconnect timeout in seconds\n\
+--mode <mode> set the optional mode, where mode is special or off \n\
+--sendframe <frmType> <dstaddr> <bssid> <optIEDatalen> <optIEData> where:\n\
+  <frmType>   is 1 for probe request frame,\n\
+                 2 for probe response frame,\n\
+                 3 for CPPP start,\n\
+                 4 for CPPP stop, \n\
+  <dstaddr>   is the destination mac address, in xx:xx:xx:xx:xx:xx format, \n\
+  <bssid>     is the bssid, in xx:xx:xx:xx:xx:xx format, \n\
+  <optIEDatalen> optional IE data length,\n\
+  <optIEData> is the pointer to optional IE data arrary \n\
+--adhocbssid <macaddr> where macaddr is the BSSID for IBSS to be created in xx:xx:xx:xx:xx:xx format\n\
+--beaconintvl   <beacon_interval in milliseonds> \n\
+--getbeaconintvl \n\
+--setretrylimits  <frameType> <trafficClass> <maxRetries> <enableNotify>\n\
+  <frameType>      is 0 for management frame, \n\
+                      1 for control frame,\n\
+                      2,for data frame;\n\
+  <trafficClass>   is 0 for BE, 1 for BK, 2 for VI, 3 for VO, only applies to data frame type\n\
+  <maxRetries>     is # in [2 - 13];      \n\
+  <enableNotify>   is \"on\" to enable the notification of max retries exceed \n\
+                      \"off\" to disable the notification of max retries excedd \n\
+--rssiThreshold <weight> <pollTimer> <above_threshold_tag_1> <above_threshold_val_1> ... \n\
+                <above_threshold_tag_6> <above_threshold_val_6> \n\
+                <below_threshold_tag_1> <below_threshold_val_1> ... \n\
+                <below_threshold_tag_6> <below_threshold_val_6> \n\
+  <weight>        share with snrThreshold\n\
+  <threshold_x>   will be converted to negatvie value automatically, \n\
+                   i.e. input 90, actually -90 will be set into HW\n\
+  <pollTimer>     is timer to poll rssi value(factor of LI), set to 0 will disable all thresholds\n\
+                 \n\
+--snrThreshold <weight> <upper_threshold_1> ... <upper_threshold_4> \n\
+               <lower_threshold_1> ... <lower_threshold_4> <pollTimer>\n\
+  <weight>        share with rssiThreshold\n\
+  <threshold_x>  is positive value, in ascending order\n\
+  <pollTimer>     is timer to poll snr value(factor of LI), set to 0 will disable all thresholds\n\
+                 \n\
+--cleanRssiSnr \n\
+--lqThreshold <enable> <upper_threshold_1>  ... <upper_threshold_4>\n\
+              <lower_threshold_1> ... <lower_threshold_4>\n\
+   <enable>       is 0 for disable,\n\
+                     1 for enable lqThreshold\n\
+   <threshold_x>  is in ascending order            \n\
+--setlongpreamble <enable>\n\
+    <enable>      is 0 for diable,\n\
+                     1 for enable.\n\
+--setRTS  <pkt length threshold>\n\
+--getRTS \n\
+--startscan   --homeDwellTime=<msec> --forceScanInt<ms> --forceScanFlags <scan type> <forcefgscan> <isLegacyCisco> --scanlist <list> where:\n\
+  <homeDwellTime>     Maximum duration in the home channel(milliseconds),\n\
+  <forceScanInt>      Time interval between scans (milliseconds),\n\
+    <scan type>     is 0 for long scan,\n\
+                     1 for short scan,\n\
+  <forcefgscan>   is 0 for disable force fgscan,\n\
+                     1 for enable force fgscan,\n\
+  <isLegacyCisco> is 0 for disable legacy Cisco AP compatible,\n\
+                     1 for enable legacy Cisco AP compatible,\n\
+  <list> is a list of channels (frequencies in mhz or ieee channel numbers)\n\
+--setfixrates <rate index> where: \n\
+  <rate index> is {0 1M},{1 2M},{2 5.5M},{3 11M},{4 6M},{5 9M},{6 12M},{7 18M},{8 24M},{9 36M},{10 48M},{11 54M},\n\
+  if want to config more rare index, can use blank to space out, such as: --setfixrates 0 1 2 \n\
+--getfixrates : Get the fix rate index from target\n\
+--setauthmode <mode> where:\n\
+  <mode>        is 0 to do authentication when reconnect, \n\
+                   1 to not do authentication when reconnect.(not clean key). \n\
+--setreassocmode <mode> where:\n\
+  <mode>        is 0 do send disassoc when reassociation, \n\
+                   1 do not send disassoc when reassociation. \n\
+--setVoicePktSize  is maximum size of voice packet \n\
+--setMaxSPLength   is the maximum service period in packets, as applicable in APSD \n\
+                   0 - deliver all packets \n\
+                   1 - deliver up to 2 packets \n\
+                   2 - deliver up to 4 packets \n\
+                   3 - deliver up to 6 packets \n\
+--setAssocIe <IE String>\n\
+--roam <roamctrl> <info>\n\
+       where <roamctrl> is   1  force a roam to specified bssid\n\
+                             2  set the roam mode \n\
+                             3  set the host bias of the specified BSSID\n\
+                             4 set the lowrssi scan parameters \n\
+      where <info> is BSSID<aa:bb:cc:dd:ee:ff> for roamctrl of 1\n\
+                      DEFAULT ,BSSBIAS or LOCK for roamctrl of 2\n\
+                      BSSID<aa:bb:cc:dd:ee:ff> <bias> for  roamctrl of 3\n\
+                             where <bias> is  a value between -256 and 255\n\
+                      <scan period> <scan threshold> <roam threshold> \n\
+                      <roam rssi floor> for roamctrl of 4\n\
+--getroamtable\n\
+--getroamdata\n\
+--wlan <enable/disable/query>\n\
+--bt <on/off/query>\n\
+--setBTstatus <streamType> <status>\n\
+      where <streamType> is    1 - Bluetooth SCO stream\n\
+                               2 - Bluetooth A2DP stream\n\
+                               3 - Bluetooth Inquiry/low priority stream\n\
+                               4 - Bluetooth E-SCO stream\n\
+      \n\
+      where <status> is        1 - stream started\n\
+                               2 - stream stopped\n\
+                               3 - stream resumed\n\
+                               4 - stream suspended\n\
+--setBTparams <paramType> <params>\n\
+      where <paramType> is     1 - Bluetooth SCO stream parameters\n\
+                               2 - Bluetooth A2DP stream parameters \n\
+                               3 - Front end antenna configuration \n\
+                               4 - Co-located Bluetooth configuration\n\
+                               5 - Bluetooth ACL coex (non-a2dp) parameters\n\
+                               6 - 11a is using a separate antenna\n\
+      \n\
+      where <params> for Bluetooth SCO are:\n\
+              <numScoCyclesForceTrigger> - number of Sco cyles, to force a trigger\n\
+               <dataResponseTimeout> - timeout for receiving downlink packet per PS-poll\n\
+               <stompScoRules> - Applicable for dual/splitter front end\n\
+                           1, Never stomp BT to receive downlink pkt\n\
+                           2, Always stomp BT to receive downlink pkt\n\
+                           3, Stomp BT only during low rssi conditions\n\
+               <stompDutyCyleVal> If Sco is stomped while waiting for downlink pkt, number sco cyles to not queue ps-poll-(Applicable only for switch FE)\n\
+              <psPollLatencyFraction> Fraction of idle SCO idle time.\n\
+                           1, if more than 3/4 idle duration is left, retrieve downlink pkt\n\
+                           2, if more than 1/2 idle duration is left, retrieve downlink pkt\n\
+                           3, if more 1/4 idle duration is left, retrieve dwnlink pkt\n\
+               <SCO slots> - number of Tx+Rx SCO slots : 2 for single-slot SCO, 6 for 3-slot SCO\n\
+          <Idle SCO slots> - number of idle slots between two SCO Tx+Rx instances\n\
+      \n\
+      where <params> for A2DP configuration are\n\
+      <a2dpWlanUsageLimit> Max duration wlan can use the medium ,whenever firmware detects medium for wlan (in msecs) \n\
+     <a2dpBurstCntMin> Mininum number of bluetooth data frames to replenish wlan usage time\n\
+     <a2dpDataRespTimeout> Time to wait for downlink data, after queuing pspoll\n\
+      where <params> for front end antenna configuration are\n\
+      1 - Dual antenna configuration (BT and wlan have seperate antenna) \n\
+      2 - Single antenna splitter configuration \n\
+      3 - Single antenna switch  configuration \n\
+      \n\
+      where <params> for co-located Bluetooth configuration are\n\
+      0 - Qualcomm BTS402x (default)\n\
+      1 - CSR Bluetooth\n\
+      2 - Atheros Bluetooth\n\
+      \n\
+      where <params> for Bluetooth ACL coex(bt ftp or bt OPP or other data based ACL profile (non a2dp)  parameter are \n\
+      <aclWlanMediumUsageTime> Usage time for Wlan.(default 30 msecs)\n\
+      <aclBtMediumUsageTime> Usage time for bluetooth (default 30 msecs)\n\
+      <aclDataRespTimeout> - timeout for receiving downlink packet per PS-poll\n\
+--setbtcoexfeant <antType> \n\
+       <antType> - Front end antenna type\n\
+       1 - Single antenna\n\
+       2 - Dual antenna\n\
+       3 - Dual antenna high isolation\n\
+       4 - bypass mode\n\
+       5 - combine mode\n\
+--setbtcoexcolocatedbt <btdevType >\n\
+        <btdevType> Co-located bluetooth device\n\
+        1 - Qualcomm BTS402X \n\
+        2 - CSR BC06 bluetooth \n\
+        3 - Atheros 3001 bluetooth\n\
+        4 - ST-ericssion CG2900 \n\
+        5 - Atheros 3002/MCI \n\
+--setbtcoexscoconfig <noscoSlots> <noidleslots> <scoflags> <linkid> <scoCyclesForceTrigger> <scoDataResponseTimeout> <scoStompDutyCyleVal> <scoStompDutyCyleMaxVal> <scoPsPollLatencyFraction> <scoStompCntIn100ms> <scoContStompMax> <scoMinlowRateMbps> <scoLowRateCnt> <scoHighPktRatio> <scoMaxAggrSize>\n\
+--setbtcoexa2dpconfig <a2dpFlags> <linkid> <a2dpWlanMaxDur> <a2dpMinBurstCnt> <a2dpDataRespTimeout> <a2dpMinlowRateMbps> <a2dpLowRateCnt> <a2dpHighPktRatio> <a2dpMaxAggrSize> <a2dpPktStompCnt>\n\
+--setbtcoexaclcoexconfig <aclWlanMediumDur> <aclBtMediumDur> <aclDetectTimeout> <aclPktCntLowerLimit> <aclIterForEnDis> <aclPktCntUpperLimit> <aclCoexFlags> <linkId> <aclDataRespTimeout> <aclCoexMinlowRateMbps> <aclCoexLowRateCnt> <aclCoexHighPktRatio> <aclCoexMaxAggrSize> <aclPktStompCnt>  \n\
+--setbtcoexbtinquirypageconfig <btInquiryDataFetchFrequency> <protectBmissDurPostBtInquiry> <btInquiryPageFlag>\n\
+--setbtcoexbtoperatingstatus <btprofiletype> <btoperatingstatus> <btlinkid>\n\
+        <btprofiletype> - Bluetooth profile\n\
+        1 - Bluetooth SCO profile \n\
+        2 - Bluetooth A2DP profile \n\
+        3 - Bluetooth Inquiry Page profile \n\
+        4 - Bluetooth ACL (non-a2dp) profile \n\
+        \n\
+        <btoperatingstatus>  profile operating status \n\
+        1 - start \n\
+        2 - stop \n\
+        \n\
+        <btlinkid> bluetooth link id -Applicable only for STE Bluetooth\n\
+        \n\
+--setbtcoexdebug <params1> <params2> <params3> <params4> <params5> \n\
+--getbtcoexconfig <btprofile> <linkid>\n\
+        <btprofile> - bluetooth profile \n\
+        1 - Bluetooth SCO profile \n\
+        2 - Bluetooth A2DP profile \n\
+        3 - Bluetooth Inquiry Page profile \n\
+        4 - Bluetooth ACL (non-a2dp) profile \n\
+        \n\
+    <btlinkid> bluetooth link id -Applicable only for STE Bluetooth\n\
+    \n\
+\n\
+--getbtcoexstats\n\
+--detecterror --frequency=<sec> --threshold=<count> where:\n\
+  <frequency>   is the periodicity of the challenge messages in seconds, \n\
+  <threshold>   is the number of challenge misses after which the error detection module in the driver will report an error, \n\
+--getheartbeat --cookie=<cookie>\n\
+  <cookie>  is used to identify the response corresponding to a challenge sent\n\
+--usersetkeys --initrsc=<on/off>\n\
+  initrsc=on(off> initialises(doesnot initialise) the RSC in the firmware\n\
+--getRD\n\
+--setcountry <countryCode> (Use --countrycodes for list of codes)\n\
+--countrycodes (Lists all the valid country codes)\n\
+--getcountry \n\
+--disableregulatory\n\
+--txopbursting <burstEnable>\n\
+        where <burstEnable> is  0 disallow TxOp bursting\n\
+                                1 allow TxOp bursting\n\
+--diagread\n\
+--diagwrite\n\
+--setkeepalive <keepalive interval> <keepalive mode> <peer mac address> <arp src ip> <arp tgt ip>\n\
+  <keepalive interval> is the time within which if there is no transmission/reception activity, the station sends a null packet to AP.\n\
+  <keepalive mode> 1: NULL data frame (default)\n\
+		   2: ARP response \n\
+		   3: both \n\
+  valid if <keepalive mode> is 2 or 3:\n\
+  <peer mac address>: target mac address for arp response\n\
+  <arp src ip>: host ip\n\
+  <arp tgt ip>: arp response target ip\n\
+--getkeepalive\n\
+--setappie <frame> <IE>\n\
+         where frame is one of beacon, probe, respon, assoc\n\
+               IE is a hex string starting with dd\n\
+               if IE is 0 then no IE is sent in the management frame\n\
+--setmgmtfilter <op> <frametype>\n\
+                op is one of set, clear\n\
+                frametype is one of beacon proberesp\n\
+--setdbglogconfig --mmask=<mask> --rep=<0/1> --tsr=<tsr codes> --size=<num>\n\
+         where <mask> is a 16 bit wide mask to selectively enable logging for different modules. Example: 0xFFFD enables logging for all modules except WMI. The mask is derived from the module ids defined in etna/include/dbglog.h header file.\n\
+               <rep> is whether the target should generate log events to the host whenever the log buffer is full.\n\
+               <tsr> resolution of the debug timestamp (less than 16)\n\
+                     0: 31.25 us\n\
+                     1: 62.50 us\n\
+                     2: 125.0 us\n\
+                     3: 250.0 us\n\
+                     4: 500.0 us\n\
+                     5: 1.0 ms and so on.\n\
+               <size> size of the report in number of debug logs.\n\
+--getdbglogs\n\
+--sethostmode <mode>\n\
+  where <mode> is awake\n\
+                  asleep\n\
+--setwowmode <mode> --wowfilter <filter> --hostreqdelay <hostreqdelay> \n\
+  where <mode> is enable \n\
+                  disable\n\
+  where <filter> is ssid -to enable ssid filtering when asleep\n\
+                    none \n\
+--getwowlist <listid> \n\
+--addwowpattern <list-id> <pattern-size> <pattern-offset> <pattern> <pattern-mask \n\
+--delwowpattern <list-id> <pattern-id>\n\
+--dumpchipmem \n\
+--dumpchipmem_venus \n\
+--setconnectctrl <ctrl flags bitmask> \n\
+  where <flags> could take the following values:\n\
+      0x0001(CONNECT_ASSOC_POLICY_USER): Assoc frames are sent using the policy specified by the flag below.\n\
+      0x0002(CONNECT_SEND_REASSOC): Send Reassoc frame while connecting otherwise send assoc frames.\n\
+      0x0004(CONNECT_IGNORE_WPAx_GROUP_CIPHER): Ignore WPAx group cipher for WPA/WPA2.\n\
+      0x0008(CONNECT_PROFILE_MATCH_DONE): Ignore any profile check.\n\
+      0x0010(CONNECT_IGNORE_AAC_BEACON): Ignore the admission control beacon.\n\
+      0x0020(CONNECT_CSA_FOLLOW_BSS):Set to Follow BSS to the new channel and connect \n\
+                                 and reset to disconnect from BSS and change channel \n\
+--dumpcreditstates \n\
+      Triggers the HTC layer to dump credit state information to the debugger \n\
+--setakmp --multipmkid=<on/off>\n\
+  multipmkid=on(off> enables(doesnot enable) Multi PMKID Caching in firmware\n\
+--setpmkidlist --numpmkid=<n> --pmkid=<pmkid_1> ... --pmkid=<pmkid_n>\n\
+   where n is the number of pmkids (max 8)\n\
+   and pmkid_i is the ith pmkid (16 bytes in hex format)\n\
+--setbsspmkid --bssid=<aabbccddeeff> --bsspmkid=<pmkid>\n\
+   bssid is 6 bytes in hex format\n\
+   bsspmkid is 16 bytes in hex format\n\
+--getpmkidlist \n\
+--abortscan \n\
+--settgtevt <event value>\n\
+      where <event value> is  0 send WMI_DISCONNECT_EVENT with disconnectReason = BSS_DISCONNECTED\n\
+                                after re-connection with AP\n\
+                              1 NOT send WMI_DISCONNECT_EVENT with disconnectReason = BSS_DISCONNECTED\n\
+                                after re-connection with AP\n\
+--getsta \n\
+--hiddenssid <value> \n\
+    where value 1-Enable, 0-Disable. \n\
+--gethiddenssid \n\
+--numsta <num> \n\
+--gnumsta <num> \n\
+--getnumsta \n\
+--getgnumsta \n\
+--conninact <period> \n\
+    where period is time in min (default 5min). \n\
+    0 will disable STA inactivity check. \n\
+--protectionscan <period> <dwell> \n\
+    where period is in min (default 5min). 0 will disable. \n\
+    dwell is in ms. (default 200ms). \n\
+--addacl <mac> \n\
+    where mac is of the format xx:xx:xx:xx:xx:xx \n\
+--delacl <index> \n\
+    use --getacl to get index \n\
+--getacl \n\
+--aclpolicy <policy> <retain list> \n\
+    where <policy> \n\
+        0 - Disable ACL \n\
+        1 - Allow MAC \n\
+        2 - Deny MAC \n\
+          <retain list> \n\
+        0 - Clear the current ACL list \n\
+        1 - Retain the current ACL list \n\
+--removesta <action> <reason> <mac> \n\
+    where <action>  \n\
+            2 - Disassoc    \n\
+            3 - Deauth      \n\
+          <reason> protocol reason code, use 1 when in doubt \n\
+          <mac> mac addr of a connected STA            \n\
+--dtim <period> \n\
+--getdtim \n\
+--intrabss <ctrl> \n\
+    where <ctrl> 0 - Disable, 1 - Enable (default) \n\
+--interbss <ctrl> \n\
+    where <ctrl> 0 - Disable, 1 - Enable (default) \n\
+--apgetstats \n\
+--apclearstats \n\
+--acsdisablehichannels <0/1> \n\
+    where 0 - ACS will choose 1, 6 or 11 \n\
+          1 - ACS will choose 1, 6 or 11 \n\
+--commit \n\
+--ip arg, arg may be \n\
+   none  - resets ip \n\
+   x.x.x.x - ip addr is dotted form\n\
+--set_ht_cap <band> <enable> <supported channel width set> <short GI 20MHz> <short GI 40MHz> <40MHz intolerant> <max AMPDU len exponent> \n\
+    where <band> : 'g' for 2.4 GHZ or 'a' for 5GHZ \n\
+    <enable> : 0 to disable 11n in band, 1 to enable 11n in band \n\
+    <supported channel width set> : 0 if only 20MHz operation supported \n\
+                                          1 if 20MHz and 40MHz operation supported \n\
+    <short GI 20MHz> : 0 if not supported, 1 if supported \n\
+    <short GI 40MHz> : 0 if not supported, 1 if supported \n\
+    <40MHz intolerant> : 1 if prohibit a receing AP from operating as a 20/40 MHz BSS \n\
+                         0 otherwise \n\
+    <max AMPDU len exponent> : valid values from 0 to 3 \n\
+--dump_recv_aggr_stats \n\
+--setup_aggr <tid> <aid> \n\
+        where <aid> = aid of a connected STA. Ignored in STA mode \n\
+--allow_aggr <tx_tid_mask>  <rx_tid_mask> \n\
+--dele_aggr <tid>  <direction> <aid> \n\
+        where <direction> =1 uplink; \n\
+                          =0 dnlink  \n\
+              <aid> = aid of a connected STA. Ignored in STA mode \n\
+--set_ht_op <STA channel width> : 0 if only allow 20MHz channel width\n\
+                                  1 if allow any channel width in the supported channel width set \n\
+--wlan_conn_prec <prec_val> \n\
+        where 0: WLAN connection will have precedence;\n\
+              1: PAL connection will have precedence;\n\
+--settxselrates <11A ratemask> <11G ratemask> <11B ratemask> <11GOnly ratemask> <11A_HT20 ratemask> <11G_HT20 ratemask> \
+<11A_HT40 ratemask> <11G_HT40 ratemask> where all rate masks are hex integers. \n\
+--aprateset <val> \n\
+        where 1: RateSet#1 - 1,2,5.5,11 basic rates (default)\n\
+              2: RateSet#2 - 1,2,5.5,11,6,12,24 basic rates\n\
+--connect <ssid> \n\
+--connect <ssid> --wpa <ver> <ucipher> <mcipher> <psk> \n\
+--connect <ssid> --wep <mode> <def_keyix> <key1> <key2*> <key3*> <key4*> \n\
+        where   <ssid>     : SSID of network \n\
+                <ver>      : 1 - WPA, 2 - RSN   \n\
+                <ucipher>  : TKIP or CCMP for unicast \n\
+                <mcipher>  : TKIP or CCMP for multicast \n\
+                <psk>      : passphrase for WPA    \n\
+                <mode>     : open or shared    \n\
+                <def_keyix>: Default TX wep key index  [1-4] \n\
+                <key>      : wep key   \n\
+                *          : optional parameters  \n\
+--set_tx_sgi --masksgi <mask> --persgi <value> \n\
+         where <mask> is a 32 bit hexadecimal value (eg: 0x0808000 or 08080000) to select desired MCS and ht20/ht40 SGI implementation (refer spec for bit location of each MCS)\n\
+             For disabling SGI enter 0x00000000 or 0.\n\
+             If mask is not entered, the default mask is 0x08080000 which enables MCS 7 to use SGI for both ht20 and ht40, when set_tx_sgi command is issued \n\
+         where  <value> is the acceptable loss percentage for Packet Error Rate (PER) for SGI (default : 10)\n\
+--set_dfs <enable> \n\
+        where  <enable> : 1 to allow DFS \n\
+                        : 0 to disable DFS \n\
+--setdivparam <idleTime> <RSSIThresh> <Enable> <Threshold Rate> \n\
+        where <idleTime> : time in ms where the idle timer would start checking the other antenna (default: 10000) \n\
+                  <RSSIThresh> : in db, where the firmware will check the other antenna if the RSSI drops below this delta (default: 10) \n\
+                  <Enable> : 1 to enable diversity \n\
+                  <Threshold Rate> : in Mbps, where the firmware will block the idleTimer if the throughput is above this rate (default 48) \n\
+--scanprobedssid <ssid> where <ssid> is the wireless network string to scan. Broadcast probe will not be sent .  Set ssid to 'off' or 'any' to send broadcast probe requests \n\
+--ap_apsd <value> \n\
+    where value 1-Enable, 0-Disable \n\
+--get_ht_cap <band> \n\
+    where <band> : 'g' for 2.4 GHZ or 'a' for 5GHZ \n\
+--set_mcast_rate <value> \n\
+    where value is rate in units of 100 Kbps \n\
+    Valid values are 10, 20, 55, 110, 60, 90, 120, 180, 240, 360, 480, 540 \n\
+--enablevoicedetection <enable> \n\
+        where  <enable> : 1 to enable voice detection \n\
+                        : 0 to disable voice detection \n\
+--txe-notify <rate> <pkts> <intvl> \n\
+	send a TXE_NOTIFY_EVENT when <rate>% of <pkts> in given <intvl> fail to be transmitted to current AP.\n\
+--setrecoverysim <type> <delay_time_ms> \n\
+        where  <type>   : 1 assert \n\
+                        : 2 not respond detect command \n\
+                        : 3 simulate ep-full (disable wmi control ep), use 'echo 60>keepalive' trigger\n\
+                        : 4 null access \n\
+                        : 5: stack overflow\n\
+        <delay_time_ms> : 0~65534 ,delay time ms\n\
+                        : 65535 ,delay random time( 0~65535) ms\n\
+--disablebcast <enable> \n\
+--blwl <control> <index> <mac> \n\
+        where  <control>: 0 disable blwl \n\
+                        : 1 enable blwl \n\
+                        : 2 add white mac \n\
+                        : 3 add black mac \n\
+                        : 4 reset whitelist \n\
+                        : 5 reset blacklist \n\
+         <index>        : valid when control=2 3 4 5, mac address index [0,9] \n\
+         <mac>          : valid when control=2 3 4 5, mac address xx:xx:xx:xx:xx:xx  \n\
+--setrssifilter <snr_value> \n\
+	where <snr_value> : 0~127 the rssi value, (DBM: value-95dbm) \n\
+";
+
+A_UINT32 mercuryAdd[5][2] = {
+            {0x20000, 0x200fc},
+            {0x28000, 0x28800},
+            {0x20800, 0x20a40},
+            {0x21000, 0x212f0},
+            {0x500000, 0x500000+184*1024},
+        };
+
+typedef struct chip_internal_t{
+    A_UINT32 addr_st;
+    A_UINT32 addr_end;
+    A_UINT8 *info;
+}CHIP_INTERNAL;
+
+CHIP_INTERNAL venus_internal[8] = {
+            {0x20000, 0x200fc, (A_UINT8 *)"General DMA and recv related registers"},
+            {0x28000, 0x28900, (A_UINT8 *)"MAC PCU register & keycache"},
+            {0x20800, 0x20a40, (A_UINT8 *)"QCU"},
+            {0x21000, 0x212f0, (A_UINT8 *)"DCU"},
+            {0x4000,  0x42e4,  (A_UINT8 *)"RTC"},
+            {0x540000, 0x540000+256*1024, (A_UINT8 *)"RAM"},
+            {0x29800, 0x2B210, (A_UINT8 *)"BB"},
+            {0x1C000, 0x1C748, (A_UINT8 *)"Analog"},
+        };
+
+
+
+static void
+usage(void)
+{
+    fprintf(stderr, "usage:\n%s [-i device] commands\n", progname);
+    fprintf(stderr, "%s\n", commands);
+#ifdef ATH_INCLUDE_PAL
+    fprintf(stderr, "%s\n", palcommands);
+#endif
+    fprintf(stderr, "The options can be given in any order\n");
+    exit(-1);
+}
+
+/* List of Country codes */
+char    *my_ctr[] = {
+    "DB", "NA", "AL", "DZ", "AR", "AM", "AU", "AT", "AZ", "BH", "BY", "BE", "BZ", "BO", "BR", "BN",
+    "BG", "CA", "CL", "CN", "CO", "CR", "HR", "CY", "CZ", "DK", "DO", "EC", "EG", "SV", "EE", "FI",
+    "FR", "GE", "DE", "GR", "GT", "HN", "HK", "HU", "IS", "IN", "ID", "IR", "IE", "IL", "IT", "JP",
+    "JO", "KZ", "KP", "KR", "K2", "KW", "LV", "LB", "LI", "LT", "LU",
+    "MO", "MK", "MY", "MX", "MC", "MA", "NL", "NZ", "NO", "OM", "PK", "PA", "PE", "PH", "PL", "PT",
+    "PR", "QA", "RO", "RU", "SA", "SG", "SK", "SI", "ZA", "ES", "SE", "CH", "SY", "TW", "TH", "TT",
+    "TN", "TR", "UA", "AE", "GB", "US", "UY", "UZ", "VE", "VN", "YE", "ZW"
+    };
+
+const char *targ_reg_name[] = {
+"zero", "pc", "lbeg", "lend", "lcount", "sar", "litbaddr", "ps",
+"brtarg", "epc1", "epc2", "epc3", "epc4", "windowbase", "windowstart", "zero",
+"zero", "zero", "zero", "zero", "zero", "zero", "zero", "zero",
+"zero", "zero", "zero", "zero", "zero", "zero", "zero", "zero",
+"ar0", "ar1", "ar2", "ar3", "ar4", "ar5", "ar6", "ar7",
+"ar8", "ar9", "ar10", "ar11", "ar12", "ar13", "ar14", "ar15",
+"ar16", "ar17", "ar18", "ar19", "ar20", "ar21", "ar22", "ar23",
+"ar24", "ar25", "ar26", "ar27", "ar28", "ar29", "ar30", "ar31",
+};
+
+#ifdef ATH_INCLUDE_PAL
+
+A_INT32
+get_input_choice(char *fname,A_UINT8 *pdu, A_UINT16 *sz)
+{
+    int fhdl;
+    A_INT32 ret = -1;
+    fhdl = open(fname, O_RDONLY);
+    if(fhdl != -1)
+    {
+        *sz  = read(fhdl, pdu,MAX_BUFFER_SIZE);
+        close(fhdl);
+        ret = 0;
+    }
+    return ret;
+}
+
+
+#endif
+int
+main (int argc, char **argv)
+{
+    int c, error;
+    char ifname[IFNAMSIZ];
+    unsigned int cmd = 0;
+    progname = argv[0];
+    char *buf = malloc(sizeof(PACKET_LOG));
+    int clearstat = 0;
+    
+
+WMI_DISABLE_BCAST_IN_PM_CMD *disableBcastCmd = (WMI_DISABLE_BCAST_IN_PM_CMD *) (buf+4);
+    WMI_LISTEN_INT_CMD *listenCmd         = (WMI_LISTEN_INT_CMD*)buf;
+    WMI_BMISS_TIME_CMD *bmissCmd         = (WMI_BMISS_TIME_CMD*)buf;
+
+    WMI_POWER_MODE_CMD *pwrCmd         = (WMI_POWER_MODE_CMD *)buf;
+    WMI_SET_MCAST_FILTER_CMD *sMcastFilterCmd       = (WMI_SET_MCAST_FILTER_CMD *)(buf + 4);
+    WMI_MCAST_FILTER_CMD *mcastFilterCmd       = (WMI_MCAST_FILTER_CMD *)(buf + 4);
+    WMI_IBSS_PM_CAPS_CMD *adhocPmCmd   = (WMI_IBSS_PM_CAPS_CMD *)buf;
+    WMI_AP_PS_CMD *apPsCmd             = (WMI_AP_PS_CMD *)(buf + 4);
+    WMI_SCAN_PARAMS_CMD *sParamCmd     = (WMI_SCAN_PARAMS_CMD *)(buf + 4);
+    WMI_BSS_FILTER_CMD *filterCmd      = (WMI_BSS_FILTER_CMD *)buf;
+    WMI_CHANNEL_PARAMS_CMD *chParamCmd = (WMI_CHANNEL_PARAMS_CMD *)buf;
+    WMI_POWER_PARAMS_CMD *pmParamCmd   = (WMI_POWER_PARAMS_CMD *)buf;
+    WMI_ADD_BAD_AP_CMD *badApCmd       = (WMI_ADD_BAD_AP_CMD *)buf;
+    WMI_CREATE_PSTREAM_CMD *crePStreamCmd = (WMI_CREATE_PSTREAM_CMD *)buf;
+    WMI_DELETE_PSTREAM_CMD *delPStreamCmd = (WMI_DELETE_PSTREAM_CMD *)buf;
+    USER_RSSI_PARAMS *rssiThresholdParam = (USER_RSSI_PARAMS *)(buf + 4);
+    WMI_SNR_THRESHOLD_PARAMS_CMD *snrThresholdParam = (WMI_SNR_THRESHOLD_PARAMS_CMD *)buf;
+    WMI_LQ_THRESHOLD_PARAMS_CMD *lqThresholdParam = (WMI_LQ_THRESHOLD_PARAMS_CMD *)(buf + 4);
+    WMI_TARGET_ERROR_REPORT_BITMASK *pBitMask =
+                                    (WMI_TARGET_ERROR_REPORT_BITMASK *)buf;
+    WMI_SET_ASSOC_INFO_CMD *ieInfo = (WMI_SET_ASSOC_INFO_CMD *)buf;
+    WMI_SET_ACCESS_PARAMS_CMD *acParamsCmd = (WMI_SET_ACCESS_PARAMS_CMD *)buf;
+    WMI_DISC_TIMEOUT_CMD *discCmd = (WMI_DISC_TIMEOUT_CMD *)(buf + 4);
+    WMI_SET_ADHOC_BSSID_CMD *adhocBssidCmd = (WMI_SET_ADHOC_BSSID_CMD *)(buf + 4);
+    WMI_BEACON_INT_CMD *bconIntvl     = (WMI_BEACON_INT_CMD *)(buf + 4);
+    WMI_SET_RETRY_LIMITS_CMD *setRetryCmd  = (WMI_SET_RETRY_LIMITS_CMD *)(buf + 4);
+    WMI_START_SCAN_CMD *startScanCmd  = (WMI_START_SCAN_CMD *)(buf + 4);
+    WMI_SET_LPREAMBLE_CMD *setLpreambleCmd = (WMI_SET_LPREAMBLE_CMD *)(buf + 4);
+    WMI_SET_RTS_CMD *setRtsCmd = (WMI_SET_RTS_CMD *)(buf + 4);
+    struct ar6000_queuereq *getQosQueueCmd = (struct ar6000_queuereq *)buf;
+    WMI_SET_VOICE_PKT_SIZE_CMD *pSizeThresh = (WMI_SET_VOICE_PKT_SIZE_CMD *)(buf + sizeof(int));
+    WMI_SET_MAX_SP_LEN_CMD *pMaxSP          = (WMI_SET_MAX_SP_LEN_CMD *)(buf + sizeof(int));
+    WMI_SET_ROAM_CTRL_CMD *pRoamCtrl        = (WMI_SET_ROAM_CTRL_CMD *)(buf +
+                                                sizeof(int));
+    WMI_POWERSAVE_TIMERS_POLICY_CMD *pPowerSave    = (WMI_POWERSAVE_TIMERS_POLICY_CMD *)(buf + sizeof(int));
+    WMI_SET_BT_STATUS_CMD *pBtStatCmd = (WMI_SET_BT_STATUS_CMD *) (buf + sizeof(int));
+    WMI_SET_BT_PARAMS_CMD *pBtParmCmd = (WMI_SET_BT_PARAMS_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_FE_ANT_CMD *pBtcoexFeAntCmd = (WMI_SET_BTCOEX_FE_ANT_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD *pBtcoexCoLocatedBtCmd = (WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_SCO_CONFIG_CMD *pBtcoexScoConfigCmd = (WMI_SET_BTCOEX_SCO_CONFIG_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *pBtcoexbtinquiryPageConfigCmd = (WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *) (buf + sizeof(int));
+    AR6000_BTCOEX_CONFIG *pBtcoexConfig = (AR6000_BTCOEX_CONFIG *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMD *pBtcoexA2dpConfigCmd = (WMI_SET_BTCOEX_A2DP_CONFIG_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD *pBtcoexAclCoexConfigCmd = (WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD *) (buf + sizeof(int));
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD *pBtcoexBtOperatingStatusCmd = (WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD *) (buf + sizeof(int));
+    WMI_SET_WMM_CMD *setWmmCmd = (WMI_SET_WMM_CMD *)(buf + 4);
+    WMI_SET_QOS_SUPP_CMD *qosSupp = (WMI_SET_QOS_SUPP_CMD *)(buf +4);
+    WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD *hbparam = (WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD *)(buf + 4);
+    A_UINT32 *cookie = (A_UINT32 *)(buf + 4);
+    A_UINT32 *diagaddr = (A_UINT32 *)(buf + 4);
+    A_UINT32 *diagdata = (A_UINT32 *)(buf + 8);
+    WMI_SET_WMM_TXOP_CMD *pTxOp = (WMI_SET_WMM_TXOP_CMD *)(buf + sizeof(int));
+    WMI_AP_SET_COUNTRY_CMD *pCountry = (WMI_AP_SET_COUNTRY_CMD *)(buf + sizeof(int));
+    WMI_SET_KEEPALIVE_CMD_EXT *setKeepAlive = (WMI_SET_KEEPALIVE_CMD_EXT *)(buf + 4);
+    struct ieee80211req_getset_appiebuf     *appIEInfo     = (struct ieee80211req_getset_appiebuf *)(buf + 4);
+    A_UINT32              *pMgmtFilter  = (A_UINT32 *)(buf + 4);
+    DBGLOG_MODULE_CONFIG *dbglogCfg = (DBGLOG_MODULE_CONFIG *)(buf + 4);
+
+    WMI_SET_HOST_SLEEP_MODE_CMD *hostSleepModeCmd = (WMI_SET_HOST_SLEEP_MODE_CMD*)(buf + sizeof(int));
+    WMI_SET_WOW_MODE_CMD *wowModeCmd = (WMI_SET_WOW_MODE_CMD*)(buf + sizeof(int));
+    WMI_ADD_WOW_PATTERN_CMD *addWowCmd = (WMI_ADD_WOW_PATTERN_CMD*)(buf + sizeof(int));
+    WMI_DEL_WOW_PATTERN_CMD *delWowCmd = (WMI_DEL_WOW_PATTERN_CMD*)(buf + sizeof(int));
+    WMI_GET_WOW_LIST_CMD *getWowListCmd = (WMI_GET_WOW_LIST_CMD*)(buf + sizeof(int));
+    AR6000_USER_SETKEYS_INFO *user_setkeys_info =
+                                (AR6000_USER_SETKEYS_INFO *)(buf + sizeof(int));
+    WMI_SET_AKMP_PARAMS_CMD *akmpCtrlCmd =
+                                (WMI_SET_AKMP_PARAMS_CMD *)(buf + sizeof(int));
+    WMI_SET_TARGET_EVENT_REPORT_CMD *evtCfgCmd = (WMI_SET_TARGET_EVENT_REPORT_CMD *) (buf + sizeof(int));
+    WMI_ENABLE_SMPS_CMD *setDfsCmd = (WMI_ENABLE_SMPS_CMD*)(buf + 4);
+    pmkidUserInfo_t         pmkidUserInfo;
+    A_UINT8                 bssid[ATH_MAC_LEN];
+    struct ieee80211req_addpmkid *pi_cmd = (struct ieee80211req_addpmkid *)buf;
+
+    int i, index = 0, channel, chindex;//, cnt;
+    A_INT16 threshold[26];  /* user can set rssi tags */
+    A_UINT16 *clist;
+    A_UCHAR *ssid;
+    char *ethIf;
+
+    WMI_AP_HIDDEN_SSID_CMD *pHidden = (WMI_AP_HIDDEN_SSID_CMD *)(buf + 4);
+    WMI_AP_ACL_MAC_CMD *pACL = (WMI_AP_ACL_MAC_CMD *)(buf + 4);
+    WMI_AP_NUM_STA_CMD *pNumSta = (WMI_AP_NUM_STA_CMD *)(buf + 4);
+    WMI_AP_CONN_INACT_CMD *pInact = (WMI_AP_CONN_INACT_CMD *)(buf + 4);
+    WMI_AP_PROT_SCAN_TIME_CMD *pProt = (WMI_AP_PROT_SCAN_TIME_CMD *)(buf + 4);
+    struct ieee80211req_mlme *pMlme = (struct ieee80211req_mlme *)buf;
+    WMI_AP_SET_DTIM_CMD *pDtim = (WMI_AP_SET_DTIM_CMD *)(buf + 4);
+    WMI_AP_ACL_POLICY_CMD *pACLpolicy = (WMI_AP_ACL_POLICY_CMD *)(buf + 4);
+    A_UINT8 *intra = (A_UINT8 *)(buf + 4);
+    WMI_ADDBA_REQ_CMD *pAddbaReq = (WMI_ADDBA_REQ_CMD *)(buf + 4);
+    WMI_ALLOW_AGGR_CMD *pAllowAggr = (WMI_ALLOW_AGGR_CMD *)(buf + 4);
+    WMI_DELBA_REQ_CMD *pDeleteAggr = (WMI_DELBA_REQ_CMD *)(buf + 4);
+    WMI_SET_BT_WLAN_CONN_PRECEDENCE *prec = (WMI_SET_BT_WLAN_CONN_PRECEDENCE *) (buf + 4);
+    WMI_AP_SET_11BG_RATESET_CMD *pAPrs = (WMI_AP_SET_11BG_RATESET_CMD *) (buf + 4);
+    WMI_SET_TX_SGI_PARAM_CMD *set_txsgiparam = (WMI_SET_TX_SGI_PARAM_CMD *) (buf + 4);
+    WMI_DIV_PARAMS_CMD *pDiversity = (WMI_DIV_PARAMS_CMD *)(buf + 4);
+    WMI_AP_SET_APSD_CMD *pApApsd = (WMI_AP_SET_APSD_CMD *)(buf + 4);
+    WMI_SET_MCASTRATE_CMD *pMcast = (WMI_SET_MCASTRATE_CMD *)(buf + 4);
+    WMI_VOICE_DETECTION_ENABLE_CMD *pVoiceDetectionEnable = (WMI_VOICE_DETECTION_ENABLE_CMD *)(buf + 4);
+    WMI_SET_TXE_NOTIFY_CMD *pTXe = (WMI_SET_TXE_NOTIFY_CMD *)(buf + 4);
+    WMI_SET_RECOVERY_TEST_PARAMETER_CMD *pSetRecoveryParam = (WMI_SET_RECOVERY_TEST_PARAMETER_CMD*)(buf + 4);
+    WMI_SET_RSSI_FILTER_CMD *pSetRssiFilter = (WMI_SET_RSSI_FILTER_CMD*)(buf + 4);
+    WMI_PROBED_SSID_CMD *pSsidCmd = (WMI_PROBED_SSID_CMD*)(buf + 4);
+    profile_t   cp;
+    A_UINT8 *pWpaOffloadState = (A_UINT8 *) (buf + 4);
+    A_UINT32 *pExcessTxRetryThres = (A_UINT32 *)(buf + 4);
+
+    if (argc == 1) {
+        usage();
+    }
+
+    memset(buf, 0, sizeof(buf));
+    memset(ifname, '\0', IFNAMSIZ);
+    if ((ethIf = getenv("NETIF")) == NULL) {
+        ethIf = "eth1";
+    }
+    while (1) {
+        int option_index = 0;
+        static struct option long_options[] = {
+            {"it", 1, NULL, 'a'},
+            {"bg", 1, NULL, 'b'},
+            {"np", 1, NULL, 'c'},
+            {"dp", 1, NULL, 'd'},
+            {"fgend", 1, NULL, 'e'},
+            {"filter", 1, NULL, 'f'},
+            {"fgstart", 1, NULL, 'g'},
+            {"maxact", 1, NULL, 'h'},
+            {"interface", 1, NULL, 'i'},
+            {"createqos", 1, NULL, 'j'},
+            {"deleteqos", 1, NULL, 'k'},
+            {"listen", 1, NULL, 'l'},
+            {"listenbeacons", 1, NULL, 'N'},
+            {"pmparams", 0, NULL, 'm'},
+            {"num", 1, NULL, 'n'},
+            {"qosqueue", 1, NULL, 'o'},
+            {"power", 1, NULL, 'p'},
+            {"pas", 1, NULL, 'q'},
+            {"scan", 0, NULL, 's'},
+            {"sr", 1, NULL, 'r'},
+            {"ssid", 1, NULL, 't'},
+            {"rssiThreshold", 1, NULL, 'u'},
+            {"snrThreshold", 1, NULL, WMI_SET_SNR_THRESHOLDS},
+            {"cleanRssiSnr", 0, NULL, WMI_CLR_RSSISNR},
+            {"lqThreshold", 1, NULL, WMI_SET_LQ_THRESHOLDS},
+            {"version", 0, NULL, 'v'},  //WMI_GET_VERSION
+            {"wmode", 1, NULL, 'w'},
+            {"badAP", 1, NULL, 'x'},
+            {"clrAP", 0, NULL, 'y'},
+            {"minact", 1, NULL, 'z'},
+            {"getTargetStats", 0, NULL, WMI_GET_TARGET_STATS},
+            {"setErrorReportingBitmask", 1, NULL,
+                        WMI_SET_TARGET_ERROR_REPORTING_BITMASK},
+            {"acparams", 0, NULL, WMI_SET_AC_PARAMS},
+            {"acval", 1, NULL, WMI_SET_AC_VAL},
+            {"txop", 1, NULL, 'A'},
+            {"cwmin", 1, NULL, 'B'},
+            {"cwmax", 1, NULL, 'C'},
+            {"aifsn", 1, NULL, 'D'},
+            {"ps", 1, NULL, 'E'},
+            {"aw", 1, NULL, 'F'},
+            {"adhocbssid", 1, NULL, 'G'},
+            {"mode", 1, NULL, 'H'},
+            {"sendframe", 1, NULL, 'I'},
+            {"wlan", 1, NULL, 'J'},
+            {"to", 1, NULL, 'K'},
+            {"ttl", 1, NULL, 'L'},
+            {"scanctrlflags", 1, NULL, 'O'},
+            {"homeDwellTime", 1, NULL, 'P'},
+            {"forceScanInt", 1, NULL, 'Q'},
+            {"forceScanFlags",1, NULL, 'R'},
+            {"threshold", 1, NULL, 'S'},
+            {"frequency", 1, NULL, 'T'},
+            {"cookie", 1, NULL, 'U'},
+            {"mmask", 1, NULL, 'V'},
+            {"rep", 1, NULL, 'W'},
+            {"tsr", 1, NULL, 'X'},
+            {"size", 1, NULL, 'Y'},
+            {"bssid",1, NULL, WMI_BSSID},
+            {"initrsc", 1, NULL, USER_SETKEYS_INITRSC},
+            {"multipmkid", 1, NULL, WMI_AKMP_MULTI_PMKID},
+            {"numpmkid", 1, NULL, WMI_NUM_PMKID},
+            {"pmkid", 1, NULL, WMI_PMKID_ENTRY},
+            {"clearStats", 0, NULL, 'Z'},
+            {"maxact2pas", 1, NULL, WMI_SCAN_DFSCH_ACT_TIME},
+            {"maxactscan_ssid", 1, NULL, WMI_SCAN_MAXACT_PER_SSID},
+            {"ibsspmcaps", 0, NULL, WMI_SET_IBSS_PM_CAPS},
+            {"appsparams", 0, NULL, WMI_SET_AP_PS},
+            {"setAssocIe", 1, NULL, WMI_SET_ASSOC_IE},
+            {"setbmisstime", 1, NULL, WMI_SET_BMISS_TIME},
+            {"setbmissbeacons", 1, NULL, 'M'},
+            {"disc", 1, NULL, WMI_SET_DISC_TIMEOUT},
+            {"beaconintvl", 1, NULL, WMI_SET_BEACON_INT},
+            {"setVoicePktSize", 1, NULL, WMI_SET_VOICE_PKT_SIZE},
+            {"setMaxSPLength", 1, NULL, WMI_SET_MAX_SP},
+            {"getroamtable", 0, NULL, WMI_GET_ROAM_TBL},
+            {"roam", 1, NULL, WMI_SET_ROAM_CTRL},
+            {"psparams", 0, NULL, WMI_SET_POWERSAVE_TIMERS},
+            {"psPollTimer", 1, NULL, WMI_SET_POWERSAVE_TIMERS_PSPOLLTIMEOUT},
+            {"triggerTimer", 1, NULL, WMI_SET_POWERSAVE_TIMERS_TRIGGERTIMEOUT},
+            {"getpower", 0, NULL, WMI_GET_POWER_MODE},
+            {"getroamdata", 0, NULL, WMI_GET_ROAM_DATA},
+            {"setBTstatus", 1, NULL, WMI_SET_BT_STATUS},
+            {"setBTparams", 1, NULL, WMI_SET_BT_PARAMS},
+            {"setbtcoexfeant", 1, NULL, WMI_SET_BTCOEX_FE_ANT},
+            {"setbtcoexcolocatedbt", 1, NULL, WMI_SET_BTCOEX_COLOCATED_BT_DEV},
+            {"setbtcoexscoconfig", 1, NULL, WMI_SET_BTCOEX_SCO_CONFIG},
+            {"setbtcoexa2dpconfig", 1, NULL, WMI_SET_BTCOEX_A2DP_CONFIG},
+            {"setbtcoexaclcoexconfig", 1, NULL, WMI_SET_BTCOEX_ACLCOEX_CONFIG},
+            {"setbtcoexbtinquirypageconfig", 1, NULL, WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG},
+            {"setbtcoexbtoperatingstatus", 1, NULL, WMI_SET_BTCOEX_BT_OPERATING_STATUS},
+            {"getbtcoexconfig",1,NULL, WMI_GET_BTCOEX_CONFIG},
+            {"getbtcoexstats", 0, NULL, WMI_GET_BTCOEX_STATS},
+            {"setretrylimits", 1, NULL, WMI_SET_RETRYLIMITS},
+            {"startscan", 0, NULL, WMI_START_SCAN},
+            {"setfixrates", 1, NULL, WMI_SET_FIX_RATES},
+            {"getfixrates", 0, NULL, WMI_GET_FIX_RATES},
+            {"setauthmode", 1, NULL, WMI_SET_AUTH_MODE},
+            {"setreassocmode", 1, NULL, WMI_SET_REASSOC_MODE},
+            {"setlongpreamble", 1, NULL, WMI_SET_LPREAMBLE},
+            {"setRTS", 1, NULL, WMI_SET_RTS},
+            {"setwmm", 1, NULL, WMI_SET_WMM},
+            {"setqos", 1, NULL, WMI_SET_QOS_SUPP},
+            {"apsdTimPolicy", 1, NULL, WMI_APSD_TIM_POLICY},
+            {"simulatedAPSDTimPolicy", 1, NULL, WMI_SIMULATED_APSD_TIM_POLICY},
+            {"detecterror", 0, NULL, WMI_SET_ERROR_DETECTION},
+            {"getheartbeat", 0, NULL, WMI_GET_HB_CHALLENGE_RESP},
+#ifdef USER_KEYS
+            {"usersetkeys", 0, NULL, USER_SETKEYS},
+#endif
+            {"getRD", 0, NULL, WMI_GET_RD},
+            {"setcountry", 1, NULL, WMI_AP_SET_COUNTRY},
+            {"countrycodes", 0, NULL, WMI_AP_GET_COUNTRY_LIST},
+            {"disableregulatory", 0, NULL, WMI_AP_DISABLE_REGULATORY},
+            {"txopbursting", 1, NULL, WMI_SET_TXOP},
+            {"diagaddr", 1, NULL, DIAG_ADDR},
+            {"diagdata", 1, NULL, DIAG_DATA},
+            {"diagread", 0, NULL, DIAG_READ},
+            {"diagwrite", 0, NULL, DIAG_WRITE},
+            {"setkeepalive", 1, NULL, WMI_SET_KEEPALIVE},
+            {"getkeepalive", 0, NULL, WMI_GET_KEEPALIVE},
+            {"setappie", 1, NULL, WMI_SET_APPIE},
+            {"setmgmtfilter", 1, NULL, WMI_SET_MGMT_FRM_RX_FILTER},
+            {"setdbglogconfig", 0, NULL, WMI_DBGLOG_CFG_MODULE},
+            {"getdbglogs", 0, NULL, WMI_DBGLOG_GET_DEBUG_LOGS},
+            {"sethostmode", 1, NULL, WMI_SET_HOST_SLEEP_MODE},
+            {"setwowmode", 1, NULL, WMI_SET_WOW_MODE},
+            {"wowfilter",1,NULL,WMI_SET_WOW_FILTER},
+            {"hostreqdelay",1,NULL,WMI_SET_WOW_HOST_REQ_DELAY},
+            {"getwowlist", 1, NULL, WMI_GET_WOW_LIST},
+            {"addwowpattern", 1, NULL, WMI_ADD_WOW_PATTERN},
+            {"delwowpattern", 1, NULL, WMI_DEL_WOW_PATTERN},
+            {"dumpchipmem", 0, NULL, DIAG_DUMP_CHIP_MEM},
+            {"dumpchipmem_venus", 0, NULL, DIAG_DUMP_CHIP_MEM_VENUS},
+            {"setconnectctrl", 1, NULL, WMI_SET_CONNECT_CTRL_FLAGS},
+            {"dumpcreditstates",0, NULL, DUMP_HTC_CREDITS},
+            {"setakmp", 0, NULL, WMI_SET_AKMP_INFO},
+            {"setpmkidlist", 0, NULL, WMI_SET_PMKID_LIST},
+            {"getpmkidlist", 0, NULL, WMI_GET_PMKID_LIST},
+            {"ieMask", 1, NULL, WMI_SET_IEMASK},
+            {"scanlist", 1, NULL, WMI_SCAN_CHANNEL_LIST},
+            {"setbsspmkid", 0, NULL, WMI_SET_BSS_PMKID_INFO},
+            {"bsspmkid", 1, NULL, WMI_BSS_PMKID_ENTRY},
+            {"abortscan", 0, NULL, WMI_ABORT_SCAN},
+            {"settgtevt", 1, NULL, WMI_TARGET_EVENT_REPORT},
+            {"getsta", 0, NULL, WMI_AP_GET_STA_LIST},       /* AP mode */
+            {"hiddenssid", 0, NULL, WMI_AP_HIDDEN_SSID},    /* AP mode */
+            {"numsta", 0, NULL, WMI_AP_SET_NUM_STA},        /* AP mode */
+            {"aclpolicy", 0, NULL, WMI_AP_ACL_POLICY},      /* AP mode */
+            {"addacl", 0, NULL, WMI_AP_ACL_MAC_LIST1},      /* AP mode */
+            {"delacl", 0, NULL, WMI_AP_ACL_MAC_LIST2},      /* AP mode */
+            {"getacl", 0, NULL, WMI_AP_GET_ACL_LIST},       /* AP mode */
+            {"commit", 0, NULL, WMI_AP_COMMIT_CONFIG},      /* AP mode */
+            {"conninact", 0, NULL, WMI_AP_INACT_TIME},      /* AP mode */
+            {"protectionscan", 0, NULL, WMI_AP_PROT_TIME},  /* AP mode */
+            {"removesta", 0, NULL, WMI_AP_SET_MLME},        /* AP mode */
+            {"dtim", 0, NULL, WMI_AP_SET_DTIM},             /* AP mode */
+            {"intrabss", 0, NULL, WMI_AP_INTRA_BSS},        /* AP mode */
+            {"interbss", 0, NULL, WMI_AP_INTER_BSS},        /* AP mode */            
+            {"ip", 1, NULL, WMI_GET_IP},
+            {"setMcastFilter", 1, NULL, WMI_SET_MCAST_FILTER},
+            {"delMcastFilter", 1, NULL, WMI_DEL_MCAST_FILTER},
+            {"mcastFilter", 1, NULL, WMI_MCAST_FILTER},
+            {"dump_recv_aggr_stats",0, NULL, WMI_DUMP_RCV_AGGR_STATS},
+            {"setup_aggr", 2, NULL, WMI_SETUP_AGGR},
+            {"allow_aggr", 2, NULL, WMI_CFG_ALLOW_AGGR},
+            {"dele_aggr", 2, NULL, WMI_CFG_DELE_AGGR},
+            {"set_ht_cap",1, NULL, WMI_SET_HT_CAP},
+            {"set_ht_op",1, NULL, WMI_SET_HT_OP},
+            {"apgetstats", 0, NULL, WMI_AP_GET_STAT},       /* AP mode */
+            {"apclearstats", 0, NULL, WMI_AP_CLR_STAT},     /* AP mode */
+            {"settxselrates", 1, NULL, WMI_SET_TX_SELECT_RATES},
+            {"gethiddenssid", 0, NULL, WMI_AP_GET_HIDDEN_SSID},   /* AP mode */
+            {"getcountry", 0, NULL, WMI_AP_GET_COUNTRY},    /* AP mode */
+            {"getwmode", 0, NULL, WMI_AP_GET_WMODE},
+            {"getdtim", 0, NULL, WMI_AP_GET_DTIM},          /* AP mode */
+            {"getbeaconintvl", 0, NULL, WMI_AP_GET_BINTVL}, /* AP mode */
+            {"getRTS", 0, NULL, WMI_GET_RTS},
+            {"targregs", 0, NULL, DIAG_FETCH_TARGET_REGS},
+#ifdef ATH_INCLUDE_PAL
+            {"sendpalcmd", 2, NULL, WMI_SEND_PAL_CMD},
+            {"sendpaldata", 2, NULL, WMI_SEND_PAL_DATA},
+            {"wlan_conn_prec", 1, NULL, WMI_SET_WLAN_CONN_PRECDNCE},
+#endif
+            {"aprateset", 0, NULL, WMI_SET_AP_RATESET},
+            {"twp", 1, NULL, WMI_SET_TX_WAKEUP_POLICY},
+            {"nt", 1, NULL, WMI_SET_TX_NUM_FRAMES_TO_WAKEUP},
+            {"pstype", 1, NULL, WMI_SET_AP_PS_PSTYPE},
+            {"psit", 1, NULL, WMI_SET_AP_PS_IDLE_TIME},
+            {"psperiod", 1, NULL, WMI_SET_AP_PS_PS_PERIOD},
+            {"sleepperiod", 1, NULL, WMI_SET_AP_PS_SLEEP_PERIOD},
+            {"connect", 1, NULL, WMI_SEND_CONNECT_CMD},
+            {"wpa", 1, NULL, WMI_SEND_CONNECT_CMD1},
+            {"wep", 1, NULL, WMI_SEND_CONNECT_CMD2},
+            {"set_dfs", 1, NULL, WMI_AP_SET_DFS},
+            {"bt",1,NULL,BT_HW_POWER_STATE},
+            {"set_tx_sgi", 0, NULL, WMI_SET_TX_SGI_PARAM},
+            {"masksgi", 1, NULL, WMI_SGI_MASK},
+            {"persgi", 1, NULL, WMI_PER_SGI},
+            {"wac", 1, NULL, WMI_WAC_ENABLE},
+            {"setwpaoffload", 1, NULL, WMI_SET_WPA_OFFLOAD_STATE},
+            {"acsdisablehichannels", 0, NULL, WMI_AP_ACS_DISABLE_HI_CHANNELS},
+            {"setdivparam", 1, NULL, WMI_SET_DIVERSITY_PARAM},
+            {"setexcesstxretrythres", 1, NULL, WMI_SET_EXCESS_TX_RETRY_THRES},
+            {"forceAssert", 0, NULL, WMI_FORCE_ASSERT},            
+            {"gnumsta", 0, NULL, WMI_AP_SET_GNUM_STA},        /* AP mode */
+            {"getgnumsta", 0, NULL, WMI_AP_GET_GNUM_STA},     /* AP mode */
+            {"getnumsta", 0, NULL, WMI_AP_GET_NUM_STA},       /* AP mode */            
+            {"suspend", 0, NULL, WMI_SUSPEND_DRIVER},                
+            {"resume", 0, NULL, WMI_RESUME_DRIVER},                 
+            {"scanprobedssid", 1, NULL, WMI_SCAN_PROBED_SSID},  
+            {"ap_apsd", 0, NULL, WMI_AP_SET_APSD},    /* AP mode */
+            {"get_ht_cap", 0, NULL, WMI_GET_HT_CAP},
+            {"set_mcast_rate", 1, NULL, WMI_SET_MCASTRATE},
+            {"enablevoicedetection", 1, NULL, WMI_VOICE_DETECTION_ENABLE}, /* enable/disable voice detection command */            
+	    {"txe-notify", 1, NULL, WMI_SET_TXE_NOTIFY},
+            {"setrecoverysim", 0, NULL, WMI_SET_RECOVERY_SIMULATE}, /* set recovery simulation */   
+{"disablebcast", 1, NULL, WMI_DISABLE_BCAST_IN_PM},  /* disable broadcast in power save */
+            {"blwl", 0, NULL, WMI_AP_BLWL},                 /* AP mode */
+            {"setrssifilter", 0, NULL, WMI_SET_RSSI_FILTER},
+            {0, 0, 0, 0}
+        };
+
+        c = getopt_long(argc, argv, "rsvda:b:c:e:h:f:g:h:i:l:p:q:r:w:n:t:u:x:y:z:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:", long_options, &option_index);
+        if (c == -1)
+        break;
+        switch (c) {
+        case 'a':
+            pmParamCmd->idle_period = atoi(optarg);
+            break;
+        case 'b':
+            if (!strcasecmp(optarg,"default")) {
+                sParamCmd->bg_period = 0;
+            } else {
+                sParamCmd->bg_period = atoi(optarg);
+                /* Setting the background scan to 0 or 65535 has the same effect
+                 - it disables background scanning */
+                if(!sParamCmd->bg_period)
+                    sParamCmd->bg_period = 65535;
+            }
+            break;
+        case 'c':
+            pmParamCmd->pspoll_number = atoi(optarg);
+            break;
+        case 'd':
+            if (!strcmp(optarg, "ignore")) {
+                pmParamCmd->dtim_policy = IGNORE_DTIM;
+            } else if (!strcmp(optarg, "normal")) {
+                pmParamCmd->dtim_policy = NORMAL_DTIM;
+            } else if (!strcmp(optarg, "stick")) {
+                pmParamCmd->dtim_policy = STICK_DTIM;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case 'f':
+            cmd = WMI_SET_BSS_FILTER;
+            if (!strcmp(optarg, "none")) {
+                filterCmd->bssFilter = NONE_BSS_FILTER;
+            } else if (!strcmp(optarg, "all")) {
+                filterCmd->bssFilter = ALL_BSS_FILTER;
+            } else if (!strcmp(optarg, "profile")) {
+                filterCmd->bssFilter = PROFILE_FILTER;
+            } else if (!strcmp(optarg, "not_profile")) {
+                filterCmd->bssFilter = ALL_BUT_PROFILE_FILTER;
+            } else if (!strcmp(optarg, "bss")) {
+                filterCmd->bssFilter = CURRENT_BSS_FILTER;
+            } else if (!strcmp(optarg, "not_bss")) {
+                filterCmd->bssFilter = ALL_BUT_BSS_FILTER;
+            } else if (!strcmp(optarg, "ssid")) {
+                filterCmd->bssFilter = PROBED_SSID_FILTER;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case 'e':
+            sParamCmd->fg_end_period = atoi(optarg);
+            break;
+        case 'g':
+            sParamCmd->fg_start_period = atoi(optarg);
+            break;
+        case 'h':
+            sParamCmd->maxact_chdwell_time = atoi(optarg);
+            break;
+        case 'q':
+            sParamCmd->pas_chdwell_time = atoi(optarg);
+            break;
+        case 'j':
+            cmd = WMI_CREATE_QOS;
+            crePStreamCmd->userPriority = atoi(optarg);
+            break;
+        case 'k':
+            cmd = WMI_DELETE_QOS;
+            delPStreamCmd->trafficClass = atoi(optarg);
+            break;
+        case 'l':
+            cmd = WMI_SET_LISTEN_INTERVAL;
+            listenCmd->listenInterval = atoi(optarg);
+            if ((listenCmd->listenInterval < MIN_LISTEN_INTERVAL) ||
+                (listenCmd->listenInterval > MAX_LISTEN_INTERVAL))
+            {
+                printf("Listen Interval out of range\n");
+                cmd = 0;
+            }
+            break;
+        case 'N':
+            cmd =  WMI_SET_LISTEN_INTERVAL;
+            listenCmd->numBeacons = atoi(optarg);
+            if ((listenCmd->numBeacons < MIN_LISTEN_BEACONS) ||
+                (listenCmd->numBeacons > MAX_LISTEN_BEACONS))
+            {
+                printf("Listen beacons out of range\n");
+                cmd = 0;
+            }
+            break;
+        case 'm':
+            cmd = WMI_SET_PM_PARAMS;
+            break;
+        case 'n':
+            index = atoi(optarg);
+            break;
+        case 'v':
+            cmd = WMI_GET_VERSION;
+            break;
+        case 'o':
+            cmd = WMI_GET_QOS_QUEUE;
+            getQosQueueCmd->trafficClass = atoi(optarg);
+            break;
+        case 'p':
+            cmd = WMI_SET_POWER_MODE;
+            if (!strcmp(optarg, "rec")) {
+                pwrCmd->powerMode = REC_POWER;
+            } else if (!strcmp(optarg, "maxperf")) {
+                pwrCmd->powerMode = MAX_PERF_POWER;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case WMI_FORCE_ASSERT:
+            cmd = WMI_FORCE_ASSERT;
+            break;
+        case WMI_SET_MCAST_FILTER:
+            cmd = WMI_SET_MCAST_FILTER;
+            sMcastFilterCmd->multicast_mac[0] = (unsigned int) atoi(argv[2]);
+            sMcastFilterCmd->multicast_mac[1] = (unsigned int) atoi(argv[3]);
+            sMcastFilterCmd->multicast_mac[2] = (unsigned int) atoi(argv[4]);
+            sMcastFilterCmd->multicast_mac[3] = (unsigned int) atoi(argv[5]);
+            sMcastFilterCmd->multicast_mac[4] = (unsigned int) atoi(argv[6]);
+            sMcastFilterCmd->multicast_mac[5] = (unsigned int) atoi(argv[7]);
+
+            printf("sMcastFilterCmd->multicast_mac[0]  %d\n",sMcastFilterCmd->multicast_mac[0] );
+            printf("sMcastFilterCmd->multicast_mac[1]  %d\n",sMcastFilterCmd->multicast_mac[1] );
+            printf("sMcastFilterCmd->multicast_mac[2]  %d\n",sMcastFilterCmd->multicast_mac[2] );
+            printf("sMcastFilterCmd->multicast_mac[3]  %d\n",sMcastFilterCmd->multicast_mac[3] );
+            printf("sMcastFilterCmd->multicast_mac[4]  %d\n",sMcastFilterCmd->multicast_mac[4] );
+            printf("sMcastFilterCmd->multicast_mac[5]  %d\n",sMcastFilterCmd->multicast_mac[5] );
+            break;
+        case WMI_DEL_MCAST_FILTER:
+            cmd = WMI_DEL_MCAST_FILTER;
+            sMcastFilterCmd->multicast_mac[0] = (unsigned int) atoi(argv[2]);
+            sMcastFilterCmd->multicast_mac[1] = (unsigned int) atoi(argv[3]);
+            sMcastFilterCmd->multicast_mac[2] = (unsigned int) atoi(argv[4]);
+            sMcastFilterCmd->multicast_mac[3] = (unsigned int) atoi(argv[5]);
+            sMcastFilterCmd->multicast_mac[4] = (unsigned int) atoi(argv[6]);
+            sMcastFilterCmd->multicast_mac[5] = (unsigned int) atoi(argv[7]);
+
+            printf("sMcastFilterCmd->multicast_mac[0]  %d\n",sMcastFilterCmd->multicast_mac[0] );
+            printf("sMcastFilterCmd->multicast_mac[1]  %d\n",sMcastFilterCmd->multicast_mac[1] );
+            printf("sMcastFilterCmd->multicast_mac[2]  %d\n",sMcastFilterCmd->multicast_mac[2] );
+            printf("sMcastFilterCmd->multicast_mac[3]  %d\n",sMcastFilterCmd->multicast_mac[3] );
+            printf("sMcastFilterCmd->multicast_mac[4]  %d\n",sMcastFilterCmd->multicast_mac[4] );
+            printf("sMcastFilterCmd->multicast_mac[5]  %d\n",sMcastFilterCmd->multicast_mac[5] );
+            break;
+        case WMI_MCAST_FILTER:
+            cmd = WMI_MCAST_FILTER;
+
+            mcastFilterCmd->enable = (unsigned int) atoi(argv[2]);
+            printf("Multicast Filter State: %s\n", mcastFilterCmd->enable ? "enable" : "disable");
+            break;
+        case 'r':
+            sParamCmd->shortScanRatio = atoi(optarg);
+            break;
+        case 's':
+            cmd = WMI_SET_SCAN_PARAMS;
+            sParamCmd->scanCtrlFlags = DEFAULT_SCAN_CTRL_FLAGS;
+            sParamCmd->shortScanRatio = WMI_SHORTSCANRATIO_DEFAULT;
+            sParamCmd->max_dfsch_act_time = 0 ;
+            break;
+        case WMI_SCAN_DFSCH_ACT_TIME:
+            sParamCmd->max_dfsch_act_time = atoi(optarg);
+            break;
+        case WMI_SCAN_MAXACT_PER_SSID:
+            sParamCmd->maxact_scan_per_ssid = atoi(optarg);
+            break;
+        case 't':
+            cmd = WMI_SET_SSID;
+            index = optind-1;
+            pSsidCmd->entryIndex =(A_UINT8)atoi(argv[index++]);
+            ssid = (A_UCHAR *)argv[index++];
+            break;
+        case 'u':
+            cmd = WMI_SET_RSSI_THRESHOLDS;
+            memset(threshold, 0, sizeof(threshold));
+            for (index = optind; index <= argc; index++)
+                threshold[index-optind] = atoi(argv[index-1]);
+
+            rssiThresholdParam->weight                  = threshold[0];
+            rssiThresholdParam->pollTime                = threshold[1];
+            rssiThresholdParam->tholds[0].tag           = threshold[2];
+            rssiThresholdParam->tholds[0].rssi          = 0 - threshold[3];
+            rssiThresholdParam->tholds[1].tag           = threshold[4];
+            rssiThresholdParam->tholds[1].rssi          = 0 - threshold[5];
+            rssiThresholdParam->tholds[2].tag           = threshold[6];
+            rssiThresholdParam->tholds[2].rssi          = 0 - threshold[7];
+            rssiThresholdParam->tholds[3].tag           = threshold[8];
+            rssiThresholdParam->tholds[3].rssi          = 0 - threshold[9];
+            rssiThresholdParam->tholds[4].tag           = threshold[10];
+            rssiThresholdParam->tholds[4].rssi          = 0 - threshold[11];
+            rssiThresholdParam->tholds[5].tag           = threshold[12];
+            rssiThresholdParam->tholds[5].rssi          = 0 - threshold[13];
+            rssiThresholdParam->tholds[6].tag           = threshold[14];
+            rssiThresholdParam->tholds[6].rssi          = 0 - threshold[15];
+            rssiThresholdParam->tholds[7].tag           = threshold[16];
+            rssiThresholdParam->tholds[7].rssi          = 0 - threshold[17];
+            rssiThresholdParam->tholds[8].tag           = threshold[18];
+            rssiThresholdParam->tholds[8].rssi          = 0 - threshold[19];
+            rssiThresholdParam->tholds[9].tag           = threshold[20];
+            rssiThresholdParam->tholds[9].rssi          = 0 - threshold[21];
+            rssiThresholdParam->tholds[10].tag           = threshold[22];
+            rssiThresholdParam->tholds[10].rssi          = 0 - threshold[23];
+            rssiThresholdParam->tholds[11].tag           = threshold[24];
+            rssiThresholdParam->tholds[11].rssi          = 0 - threshold[25];
+
+            break;
+        case WMI_SET_SNR_THRESHOLDS:
+            cmd = WMI_SET_SNR_THRESHOLDS;
+            memset(threshold, 0, sizeof(threshold));
+            for (index = optind; index <= argc; index++)
+                threshold[index-optind] = atoi(argv[index-1]);
+
+            snrThresholdParam->weight                  = threshold[0];
+            snrThresholdParam->thresholdAbove1_Val     = threshold[1];
+            snrThresholdParam->thresholdAbove2_Val     = threshold[2];
+            snrThresholdParam->thresholdAbove3_Val     = threshold[3];
+            snrThresholdParam->thresholdAbove4_Val     = threshold[4];
+            snrThresholdParam->thresholdBelow1_Val    = threshold[5];
+            snrThresholdParam->thresholdBelow2_Val    = threshold[6];
+            snrThresholdParam->thresholdBelow3_Val    = threshold[7];
+            snrThresholdParam->thresholdBelow4_Val    = threshold[8];
+            snrThresholdParam->pollTime                = threshold[9];
+            break;
+        case WMI_CLR_RSSISNR:
+            cmd = WMI_CLR_RSSISNR;
+            break;
+        case WMI_SET_LQ_THRESHOLDS:
+            cmd = WMI_SET_LQ_THRESHOLDS;
+            memset(threshold, 0, sizeof(threshold));
+            for (index = optind; index <= argc; index++)
+                threshold[index-optind] = atoi(argv[index-1]);
+
+            lqThresholdParam->enable                       = threshold[0];
+            lqThresholdParam->thresholdAbove1_Val          = threshold[1];
+            lqThresholdParam->thresholdAbove2_Val          = threshold[2];
+            lqThresholdParam->thresholdAbove3_Val          = threshold[3];
+            lqThresholdParam->thresholdAbove4_Val          = threshold[4];
+            lqThresholdParam->thresholdBelow1_Val          = threshold[5];
+            lqThresholdParam->thresholdBelow2_Val          = threshold[6];
+            lqThresholdParam->thresholdBelow3_Val          = threshold[7];
+            lqThresholdParam->thresholdBelow4_Val          = threshold[8];
+
+            break;
+        case 'i':
+            memset(ifname, '\0', 8);
+		strncpy(ifname, optarg, sizeof(ifname));
+            break;
+        case 'w':
+            cmd = WMI_SET_CHANNEL;
+            chParamCmd->numChannels = 0;
+            chParamCmd->scanParam = 0;
+            break;
+        case 'x':
+            if (wmic_ether_aton(optarg, badApCmd->bssid) != A_OK) {
+                printf("bad mac address\n");
+                break;
+            }
+            cmd = WMI_SET_BADAP;
+            break;
+        case 'y':
+            /*
+             * we are clearing a bad AP. We pass a null mac address
+             */
+            cmd = WMI_DELETE_BADAP;
+            break;
+        case 'z':
+            sParamCmd->minact_chdwell_time = atoi(optarg);
+            break;
+        case WMI_GET_TARGET_STATS:
+            cmd = WMI_GET_TARGET_STATS;
+            break;
+        case WMI_SET_TARGET_ERROR_REPORTING_BITMASK:
+            cmd = WMI_SET_TARGET_ERROR_REPORTING_BITMASK;
+            pBitMask->bitmask = atoi(optarg);
+            printf("Setting the bitmask = 0x%x\n", pBitMask->bitmask);
+            break;
+        case WMI_SET_ASSOC_IE:
+            cmd = WMI_SET_ASSOC_INFO_CMDID;
+            ieInfo->ieType = 1;
+            if (strlen(optarg) > WMI_MAX_ASSOC_INFO_LEN) {
+                printf("IE Size cannot be greater than %d\n",
+                        WMI_MAX_ASSOC_INFO_LEN);
+                cmd = 0;
+            } else {
+                ieInfo->bufferSize = strlen(optarg) + 2;
+                memcpy(&ieInfo->assocInfo[2], optarg,
+                       ieInfo->bufferSize - 2);
+               ieInfo->assocInfo[0] = 0xdd;
+               ieInfo->assocInfo[1] = ieInfo->bufferSize - 2;
+            }
+            break;
+        case WMI_SET_BMISS_TIME:
+            cmd = WMI_SET_BMISS_TIME;
+            bmissCmd->bmissTime = atoi(optarg);
+            if ((bmissCmd->bmissTime < MIN_BMISS_TIME) ||
+                (bmissCmd->bmissTime > MAX_BMISS_TIME))
+            {
+                printf("BMISS time out of range\n");
+                cmd = 0;
+            } 
+            break;
+        case 'M':
+            cmd = WMI_SET_BMISS_TIME;
+            bmissCmd->numBeacons =  atoi(optarg);
+            if ((bmissCmd->numBeacons < MIN_BMISS_BEACONS) ||
+                (bmissCmd->numBeacons > MAX_BMISS_BEACONS))
+            {
+                printf("BMISS beacons out of range\n");
+                cmd = 0;
+            }
+            break;
+
+        case WMI_SET_AC_PARAMS:
+            cmd = WMI_SET_AC_PARAMS;
+            break;
+        case WMI_SET_AC_VAL:
+            acParamsCmd->ac = atoi(optarg);
+            break;
+        case 'A':
+            acParamsCmd->txop = atoi(optarg);
+            break;
+        case 'B':
+            acParamsCmd->eCWmin = atoi(optarg);
+            break;
+        case 'C':
+            acParamsCmd->eCWmax = atoi(optarg);
+            break;
+        case 'D':
+            acParamsCmd->aifsn = atoi(optarg);
+            break;
+        case 'E':
+            if (!strcmp(optarg, "disable")) {
+                adhocPmCmd->power_saving = ADHOC_PS_DISABLE;
+            } else if (!strcmp(optarg, "atheros")) {
+                adhocPmCmd->power_saving = ADHOC_PS_ATH;
+            } else if (!strcmp(optarg, "ieee")) {
+                adhocPmCmd->power_saving = ADHOC_PS_IEEE;
+            } else {
+                cmd = 0;
+            }
+
+            break;
+        case 'F':
+            adhocPmCmd->atim_windows = atoi(optarg);
+            break;
+        case 'G':
+            if (wmic_ether_aton(optarg, adhocBssidCmd->bssid) != A_OK) {
+                printf("bad mac address\n");
+                break;
+            }
+            printf("adhoc bssid address, %x\n", adhocBssidCmd->bssid[0]);
+            cmd = WMI_SET_ADHOC_BSSID;
+            break;
+
+       case 'J':
+            cmd = WMI_SET_WLAN_STATE;
+            if (!strcmp(optarg, "enable")) {
+                ((int *)buf)[1] = WLAN_ENABLED;
+            } else if (!strcmp(optarg, "disable")) {
+                ((int *)buf)[1] = WLAN_DISABLED;
+            } else if (!strcmp(optarg, "query")) {
+                cmd = WMI_GET_WLAN_STATE;
+            } else {
+                usage();
+            }
+            break;
+        case 'K':
+            adhocPmCmd->timeout_value = atoi(optarg);
+            break;
+       case 'O':
+            index = optind;
+            index--;
+            if((index + 6) > argc) {  /*6 is the number of  flags
+                                       scanctrlflags takes  */
+                printf("Incorrect number of scanctrlflags\n");
+                cmd = 0;
+                break;
+           }
+            sParamCmd->scanCtrlFlags = 0;
+            if (atoi(argv[index]) == 1)
+                sParamCmd->scanCtrlFlags |= CONNECT_SCAN_CTRL_FLAGS;
+            index++;
+            if (atoi(argv[index]) == 1)
+                sParamCmd->scanCtrlFlags |= SCAN_CONNECTED_CTRL_FLAGS;
+            index++;
+            if (atoi(argv[index]) == 1)
+                sParamCmd->scanCtrlFlags |= ACTIVE_SCAN_CTRL_FLAGS;
+            index++;
+            if (atoi(argv[index]) == 1)
+                sParamCmd->scanCtrlFlags |= ROAM_SCAN_CTRL_FLAGS;
+            index++;
+            if (atoi(argv[index]) == 1)
+                sParamCmd->scanCtrlFlags |= REPORT_BSSINFO_CTRL_FLAGS;
+            index++;
+            if(atoi(argv[index]) == 1)
+               sParamCmd->scanCtrlFlags |= ENABLE_AUTO_CTRL_FLAGS;
+            index++;
+            if (argc - index) {
+                if(atoi(argv[index]) == 1)
+                   sParamCmd->scanCtrlFlags |= ENABLE_SCAN_ABORT_EVENT;
+                index++;
+            }
+            if(!sParamCmd->scanCtrlFlags) {
+               sParamCmd->scanCtrlFlags = 255; /* all flags have being disabled by the user */
+            }
+            break;
+       case 'L':
+            adhocPmCmd->ttl = atoi(optarg);
+            break;
+       case  'P':
+            startScanCmd->homeDwellTime =atoi(optarg);
+            break;
+       case 'Q':
+            startScanCmd->forceScanInterval =atoi(optarg);
+            break;
+       case 'R':
+            index = optind;
+            index--;
+            if((index + 3) > argc) {
+                printf("Incorrect number of forceScanCtrlFlags\n");
+                cmd = 0;
+                break;
+            }
+            startScanCmd->scanType = atoi(argv[index]);
+            index++;
+            startScanCmd->forceFgScan = atoi(argv[index]);
+            index++;
+            startScanCmd->isLegacy = atoi(argv[index]);
+            index++;
+            break;
+       case WMI_SCAN_CHANNEL_LIST:
+            chindex = 0;
+            index = optind - 1;
+            clist = startScanCmd->channelList;
+
+            while (argv[index] != NULL) {
+                channel = atoi(argv[index]);
+                if (channel < 255) {
+                    /*
+                     * assume channel is a ieee channel #
+                     */
+                clist[chindex] = wmic_ieee2freq(channel);
+                } else {
+                    clist[chindex] = channel;
+                }
+                chindex++;
+                index++;
+            }
+            startScanCmd->numChannels = chindex;
+            break;
+       case WMI_SET_IBSS_PM_CAPS:
+            cmd = WMI_SET_IBSS_PM_CAPS;
+            break;
+       case WMI_SET_AP_PS:
+            cmd = WMI_SET_AP_PS;
+            break;
+        case WMI_SET_DISC_TIMEOUT:
+            cmd = WMI_SET_DISC_TIMEOUT;
+            discCmd->disconnectTimeout = atoi(optarg);
+            break;
+        case WMI_SET_BEACON_INT:
+            cmd = WMI_SET_BEACON_INT;
+            bconIntvl->beaconInterval = atoi(optarg);
+            break;
+        case WMI_SET_VOICE_PKT_SIZE:
+            cmd = WMI_SET_VOICE_PKT_SIZE;
+            pSizeThresh->voicePktSize = atoi(optarg);
+            break;
+        case WMI_SET_MAX_SP:
+            cmd = WMI_SET_MAX_SP;
+            pMaxSP->maxSPLen = atoi(optarg);
+            break;
+        case WMI_GET_ROAM_TBL:
+            cmd = WMI_GET_ROAM_TBL;
+            break;
+        case WMI_SET_ROAM_CTRL:
+            pRoamCtrl->roamCtrlType = atoi(optarg);
+            if (A_OK != wmic_validate_roam_ctrl(pRoamCtrl, argc-optind, argv)) {
+                break;
+            }
+            cmd = WMI_SET_ROAM_CTRL;
+            break;
+        case WMI_SET_POWERSAVE_TIMERS:
+            cmd = WMI_SET_POWERSAVE_TIMERS;
+            break;
+        case WMI_SET_POWERSAVE_TIMERS_PSPOLLTIMEOUT:
+            pPowerSave->psPollTimeout = atoi(optarg);
+            break;
+        case WMI_SET_POWERSAVE_TIMERS_TRIGGERTIMEOUT:
+            pPowerSave->triggerTimeout = atoi(optarg);
+            break;
+        case WMI_GET_POWER_MODE:
+            cmd = WMI_GET_POWER_MODE;
+            break;
+        case WMI_GET_ROAM_DATA:
+            cmd = WMI_GET_ROAM_DATA;
+            break;
+        case WMI_SET_BT_STATUS:
+            cmd = WMI_SET_BT_STATUS;
+            pBtStatCmd->streamType = atoi(optarg);
+            pBtStatCmd->status = atoi(argv[optind]);
+            if (pBtStatCmd->streamType >= BT_STREAM_MAX ||
+                pBtStatCmd->status >= BT_STATUS_MAX)
+            {
+                fprintf(stderr, "Invalid parameters.\n");
+                exit(0);
+            }
+            break;
+        case WMI_SET_BT_PARAMS:
+            cmd = WMI_SET_BT_PARAMS;
+            pBtParmCmd->paramType = atoi(optarg);
+            if (pBtParmCmd->paramType >= BT_PARAM_MAX)
+            {
+                fprintf(stderr, "Invalid parameters.\n");
+                exit(0);
+            }
+            if (BT_PARAM_SCO == pBtParmCmd->paramType) {
+                pBtParmCmd->info.scoParams.numScoCyclesForceTrigger =
+                                    strtoul(argv[optind], NULL, 0);
+                pBtParmCmd->info.scoParams.dataResponseTimeout =
+                    strtoul(argv[optind+1], NULL, 0);
+                pBtParmCmd->info.scoParams.stompScoRules =
+                    strtoul(argv[optind+2], NULL, 0);
+                pBtParmCmd->info.scoParams.scoOptFlags =
+                    strtoul(argv[optind+3], NULL, 0);
+                pBtParmCmd->info.scoParams.stompDutyCyleVal =
+                    strtoul(argv[optind+4], NULL, 0);
+                pBtParmCmd->info.scoParams.stompDutyCyleMaxVal =
+                    strtoul(argv[optind+5], NULL, 0);
+                pBtParmCmd->info.scoParams. psPollLatencyFraction =
+                    strtoul(argv[optind+6], NULL, 0);
+                pBtParmCmd->info.scoParams.noSCOSlots =
+                    strtoul(argv[optind+7], NULL, 0);
+                pBtParmCmd->info.scoParams.noIdleSlots =
+                    strtoul(argv[optind+8], NULL, 0);
+                pBtParmCmd->info.scoParams.scoOptOffRssi =
+                    strtoul(argv[optind+9], NULL, 0);
+                pBtParmCmd->info.scoParams.scoOptOnRssi =
+                    strtoul(argv[optind+10], NULL, 0);
+                pBtParmCmd->info.scoParams.scoOptRtsCount =
+                    strtoul(argv[optind+11], NULL, 0);
+            }else if (BT_PARAM_A2DP == pBtParmCmd->paramType) {
+                pBtParmCmd->info.a2dpParams.a2dpWlanUsageLimit =
+                    strtoul(argv[optind], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpBurstCntMin =
+                    strtoul(argv[optind+1 ], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpDataRespTimeout =
+                    strtoul(argv[optind+2 ], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpOptFlags =
+                    strtoul(argv[optind+3 ], NULL, 0);
+                pBtParmCmd->info.a2dpParams.isCoLocatedBtRoleMaster =
+                    strtoul(argv[optind+4 ], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpOptOffRssi =
+                    strtoul(argv[optind+5], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpOptOnRssi =
+                    strtoul(argv[optind+6], NULL, 0);
+                pBtParmCmd->info.a2dpParams.a2dpOptRtsCount =
+                    strtoul(argv[optind+7 ], NULL, 0);
+
+            }else if (BT_PARAM_ANTENNA_CONFIG == pBtParmCmd->paramType) {
+                pBtParmCmd->info.antType = strtoul(argv[optind], NULL, 0);
+            } else if (BT_PARAM_COLOCATED_BT_DEVICE == pBtParmCmd->paramType) {
+                pBtParmCmd->info.coLocatedBtDev =
+                                         strtoul(argv[optind], NULL, 0);
+            }else if(BT_PARAM_ACLCOEX == pBtParmCmd->paramType) {
+                pBtParmCmd->info.aclCoexParams.aclWlanMediumUsageTime =
+                                            strtoul(argv[optind], NULL, 0);
+                pBtParmCmd->info.aclCoexParams.aclBtMediumUsageTime =
+                                            strtoul(argv[optind+1], NULL, 0);
+                pBtParmCmd->info.aclCoexParams.aclDataRespTimeout =
+                                            strtoul(argv[optind+2], NULL, 0);
+                pBtParmCmd->info.aclCoexParams.aclDetectTimeout =
+                                            strtoul(argv[optind+3], NULL, 0);
+                pBtParmCmd->info.aclCoexParams.aclmaxPktCnt =
+                                            strtoul(argv[optind + 4], NULL, 0);
+            } else if (BT_PARAM_11A_SEPARATE_ANT == pBtParmCmd->paramType) {
+                printf("BT_PARAM_11A_SEPARATE_ANT \n");
+            }
+            else
+            {
+                fprintf(stderr, "Invalid parameters.\n");
+                exit(0);
+            }
+            break;
+        case WMI_SET_BTCOEX_FE_ANT:
+            cmd = WMI_SET_BTCOEX_FE_ANT;
+            pBtcoexFeAntCmd->btcoexFeAntType = atoi(optarg);
+            if (pBtcoexFeAntCmd->btcoexFeAntType >= WMI_BTCOEX_FE_ANT_TYPE_MAX) {
+                printf("Invalid configuration [1-Single Antenna,  2- dual antenna low isolation, 3 - dual antenna high isolation\n");
+                printf("4 - bypass mode, 5 - combine mode]\n");
+                exit(-1);
+            }
+            break;
+    case WMI_SET_BTCOEX_COLOCATED_BT_DEV:
+        cmd = WMI_SET_BTCOEX_COLOCATED_BT_DEV;
+        pBtcoexCoLocatedBtCmd->btcoexCoLocatedBTdev = atoi(optarg);
+            if (pBtcoexCoLocatedBtCmd->btcoexCoLocatedBTdev > 4) {
+                printf("Invalid configuration %d\n",
+                        pBtcoexCoLocatedBtCmd->btcoexCoLocatedBTdev);
+                exit(-1);
+            }
+        printf("btcoex colocated antType = %d\n",
+                   pBtcoexCoLocatedBtCmd->btcoexCoLocatedBTdev);
+        break;
+    case WMI_SET_BTCOEX_SCO_CONFIG:
+        cmd = WMI_SET_BTCOEX_SCO_CONFIG;
+        index = optind - 1;
+        if((index + 17) > argc) {
+            printf("Incorrect number of sco Config\n");
+            exit(-1);
+        }
+        pBtcoexScoConfigCmd->scoConfig.scoSlots =  atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoConfig.scoIdleSlots = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoConfig.scoFlags = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoConfig.linkId = atoi(argv[index++]);
+
+        pBtcoexScoConfigCmd->scoPspollConfig.scoCyclesForceTrigger = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoPspollConfig.scoDataResponseTimeout = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoPspollConfig.scoStompDutyCyleVal = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoPspollConfig.scoStompDutyCyleMaxVal = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoPspollConfig.scoPsPollLatencyFraction = atoi(argv[index++]);
+
+
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoStompCntIn100ms = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoContStompMax = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoMinlowRateMbps = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoLowRateCnt = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoHighPktRatio = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoOptModeConfig.scoMaxAggrSize = atoi(argv[index++]);
+
+        pBtcoexScoConfigCmd->scoWlanScanConfig.scanInterval = atoi(argv[index++]);
+        pBtcoexScoConfigCmd->scoWlanScanConfig.maxScanStompCnt = atoi(argv[index++]);
+        break;
+    case WMI_SET_BTCOEX_A2DP_CONFIG:
+        cmd = WMI_SET_BTCOEX_A2DP_CONFIG;
+        index = optind - 1;
+        if((index + 10) > argc ) {
+            printf("Incorrect number of A2DP Config\n");
+            exit(-1);
+        }
+        pBtcoexA2dpConfigCmd->a2dpConfig.a2dpFlags =  atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dpConfig.linkId = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dppspollConfig.a2dpWlanMaxDur = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dppspollConfig.a2dpMinBurstCnt = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dppspollConfig.a2dpDataRespTimeout = atoi(argv[index++]);
+
+        pBtcoexA2dpConfigCmd->a2dpOptConfig.a2dpMinlowRateMbps = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dpOptConfig.a2dpLowRateCnt = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dpOptConfig.a2dpHighPktRatio = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dpOptConfig.a2dpMaxAggrSize = atoi(argv[index++]);
+        pBtcoexA2dpConfigCmd->a2dpOptConfig.a2dpPktStompCnt = atoi(argv[index++]);
+
+        printf("a2dp Config, flags=%x\n", pBtcoexA2dpConfigCmd->a2dpConfig.a2dpFlags);
+        break;
+    case WMI_SET_BTCOEX_ACLCOEX_CONFIG:
+        cmd = WMI_SET_BTCOEX_ACLCOEX_CONFIG;
+        index = optind - 1;
+        if((index + 14) > argc ) {
+            printf("Incorrect number of ACL COEX Config\n");
+            exit(-1);
+        }
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclWlanMediumDur     =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclBtMediumDur       =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclDetectTimeout     =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclPktCntLowerLimit  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclIterForEnDis      =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclPktCntUpperLimit  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.aclCoexFlags         =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexConfig.linkId               =  atoi(argv[index++]);
+
+        pBtcoexAclCoexConfigCmd->aclCoexPspollConfig.aclDataRespTimeout =  atoi(argv[index++]);
+
+        pBtcoexAclCoexConfigCmd->aclCoexOptConfig.aclCoexMinlowRateMbps  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexOptConfig.aclCoexLowRateCnt  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexOptConfig.aclCoexHighPktRatio  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexOptConfig.aclCoexMaxAggrSize  =  atoi(argv[index++]);
+        pBtcoexAclCoexConfigCmd->aclCoexOptConfig.aclPktStompCnt  =  atoi(argv[index++]);
+        break;
+
+    case WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG:
+        cmd = WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG;
+        index = optind - 1;
+        if((index + 3) > argc) {
+            printf("Incorrect number of inquiry_page Config\n");
+            exit(-1);
+        }
+        pBtcoexbtinquiryPageConfigCmd->btInquiryDataFetchFrequency = atoi(argv[index++]);
+        pBtcoexbtinquiryPageConfigCmd->protectBmissDurPostBtInquiry = atoi(argv[index++]);
+        pBtcoexbtinquiryPageConfigCmd->btInquiryPageFlag = atoi(argv[index++]);
+        break;
+
+    case WMI_SET_BTCOEX_BT_OPERATING_STATUS:
+        cmd = WMI_SET_BTCOEX_BT_OPERATING_STATUS;
+        index = optind - 1;
+        if((index + 3) > argc) {
+            printf("Incorrect number of operating status cmdn");
+            exit(-1);
+        }
+
+        pBtcoexBtOperatingStatusCmd->btProfileType =atoi(argv[index++]);
+        pBtcoexBtOperatingStatusCmd->btOperatingStatus =atoi(argv[index++]);
+        pBtcoexBtOperatingStatusCmd->btLinkId =atoi(argv[index++]);
+        break;
+
+    case WMI_GET_BTCOEX_CONFIG:
+        cmd = WMI_GET_BTCOEX_CONFIG;
+        index = optind - 1;
+        if((index + 2) > argc) {
+            printf("Incorrect number of get Config\n");
+            exit(-1);
+        }
+        pBtcoexConfig->configCmd.btProfileType = atoi(argv[index++]);
+        pBtcoexConfig->configCmd.linkId = atoi(argv[index++]);
+        break;
+    case WMI_GET_BTCOEX_STATS:
+        cmd = WMI_GET_BTCOEX_STATS;
+        break;
+        case WMI_SET_RETRYLIMITS:
+            index = optind - 1;
+            setRetryCmd->frameType = atoi(argv[index++]);
+            if (setRetryCmd->frameType > 2) {
+                printf("Invalid frame type! [0 - 2]\n");
+                exit(-1);
+            }
+            setRetryCmd->trafficClass = atoi(argv[index++]);
+            if (setRetryCmd->trafficClass > 3) {
+                printf("Invalid traffic class! [0 - 3]\n");
+                exit(-1);
+            }
+            setRetryCmd->maxRetries = atoi(argv[index++]);
+            if (setRetryCmd->maxRetries > WMI_MAX_RETRIES) {
+                printf("Invalid max retries! [0 - 13] \n");
+                exit(-1);
+            }
+            if (!strcmp(argv[index], "on")) {
+                setRetryCmd->enableNotify = 1;
+            } else if (!strcmp(argv[index], "off")) {
+                setRetryCmd->enableNotify = 0;
+            } else {
+                usage();
+            }
+            cmd = WMI_SET_RETRYLIMITS;
+            break;
+        case WMI_START_SCAN:
+            cmd = WMI_START_SCAN;
+            startScanCmd->scanType= 0;
+            startScanCmd->forceFgScan= false;
+            startScanCmd->isLegacy= false;
+            startScanCmd->homeDwellTime = 0;
+            startScanCmd->forceScanInterval = 0;
+            startScanCmd->numChannels = 0;
+            break;
+        case WMI_SET_FIX_RATES:
+            cmd = WMI_SET_FIX_RATES;
+            break;
+        case WMI_GET_FIX_RATES:
+            cmd = WMI_GET_FIX_RATES;
+            break;
+        case WMI_SET_AUTH_MODE:
+            cmd = WMI_SET_AUTH_MODE;
+            break;
+        case WMI_SET_REASSOC_MODE:
+            cmd = WMI_SET_REASSOC_MODE;
+            break;
+        case WMI_SET_LPREAMBLE:
+            cmd = WMI_SET_LPREAMBLE;
+            setLpreambleCmd->status = atoi(optarg);
+            break;
+        case WMI_SET_RTS:
+            cmd = WMI_SET_RTS;
+            setRtsCmd->threshold = atoi(optarg);
+            break;
+        case WMI_SET_WMM:
+            cmd = WMI_SET_WMM;
+            setWmmCmd->status = atoi(optarg);
+            break;
+        case WMI_SET_QOS_SUPP:
+            cmd = WMI_SET_QOS_SUPP;
+            qosSupp->status = atoi(optarg);
+            break;
+        case WMI_APSD_TIM_POLICY:
+            if (!strcmp(optarg, "ignore")) {
+                pPowerSave->apsdTimPolicy = IGNORE_TIM_ALL_QUEUES_APSD;
+            } else {
+                pPowerSave->apsdTimPolicy = PROCESS_TIM_ALL_QUEUES_APSD;
+            }
+            break;
+        case WMI_SIMULATED_APSD_TIM_POLICY:
+            if (!strcmp(optarg, "ignore")) {
+                pPowerSave->simulatedAPSDTimPolicy = IGNORE_TIM_SIMULATED_APSD;
+            } else {
+                pPowerSave->simulatedAPSDTimPolicy = PROCESS_TIM_SIMULATED_APSD;
+            }
+            break;
+        case WMI_SET_ERROR_DETECTION:
+            cmd = WMI_SET_ERROR_DETECTION;
+            break;
+        case 'S':
+            hbparam->threshold = atoi(optarg);
+            break;
+        case 'T':
+            hbparam->frequency = atoi(optarg);
+            break;
+        case WMI_GET_HB_CHALLENGE_RESP:
+            cmd = WMI_GET_HB_CHALLENGE_RESP;
+            break;
+        case 'U':
+            *cookie = strtoul(optarg, (char **)NULL, 0);
+            break;
+        case USER_SETKEYS:
+            if (argc == 5) {
+                user_setkeys_info->keyOpCtrl = 0;
+                cmd = USER_SETKEYS;
+            } else {
+              printf("Invalid arg %s:Usage --usersetkeys --initrsc=<on/off>",
+                     optarg);
+            }
+            break;
+        case WMI_GET_RD:
+            cmd = WMI_GET_RD;
+            break;
+        case WMI_SET_TXOP:
+            cmd = WMI_SET_TXOP;
+            pTxOp->txopEnable = atoi(optarg);
+            break;
+        case DIAG_ADDR:
+            *diagaddr = strtoul(optarg, (char **)NULL, 0);
+            printf("addr: 0x%x\n", *diagaddr);
+            break;
+        case DIAG_DATA:
+            *diagdata = strtoul(optarg, (char **)NULL, 0);
+            printf("data: 0x%x\n", *diagdata);
+            break;
+        case DIAG_READ:
+            cmd = DIAG_READ;
+            break;
+        case DIAG_WRITE:
+            cmd = DIAG_WRITE;
+            break;
+        case WMI_SET_KEEPALIVE:
+             cmd = WMI_SET_KEEPALIVE;
+	     if (wmic_validate_setkeepalive(setKeepAlive, argv) != A_OK) {
+		     printf("setkeepalive: invalid args\n");
+		     cmd = 0;
+		     break;
+	     }
+             break;
+        case WMI_GET_KEEPALIVE:
+             cmd = WMI_GET_KEEPALIVE;
+             break;
+        case WMI_SET_APPIE:
+             cmd = WMI_SET_APPIE;
+
+            if (argc - optind != 1) {
+                printf("Usage is --setappie <beacon/probe/respon/assoc> <IE>\n");
+                cmd = 0;
+                break;
+            }
+
+            if (A_OK != wmic_validate_appie(appIEInfo, argv)) {
+                cmd = 0;
+                break;
+            }
+            break;
+        case WMI_SET_MGMT_FRM_RX_FILTER:
+             cmd = WMI_SET_MGMT_FRM_RX_FILTER;
+            if (argc - optind != 1) {
+                printf("Usage is --setmgmtfilter <set/clear> <frmtype> \n");
+                cmd = 0;
+                break;
+            }
+
+            if (A_OK != wmic_validate_mgmtfilter(pMgmtFilter, argv)) {
+                cmd = 0;
+                break;
+            }
+            break;
+        case 'V':
+            dbglogCfg->mmask = strtoul(optarg, (char **)NULL, 0);
+            dbglogCfg->valid |= DBGLOG_MODULE_LOG_ENABLE_MASK;
+            break;
+        case 'W':
+            dbglogCfg->rep = strtoul(optarg, (char **)NULL, 0);
+            dbglogCfg->valid |= DBGLOG_REPORTING_ENABLED_MASK;
+            break;
+        case 'X':
+            dbglogCfg->tsr = strtoul(optarg, (char **)NULL, 0);
+            dbglogCfg->valid |= DBGLOG_TIMESTAMP_RESOLUTION_MASK;
+            break;
+        case 'Y':
+            dbglogCfg->size = strtoul(optarg, (char **)NULL, 0);
+            dbglogCfg->valid |= DBGLOG_REPORT_SIZE_MASK;
+            break;
+        case 'Z':
+            clearstat = 1;
+            break;
+        case WMI_BSSID:
+             convert_hexstring_bytearray(optarg, bssid, sizeof(bssid));
+            break;
+        case USER_SETKEYS_INITRSC:
+            if (strcmp(optarg, "on") == 0) {
+                user_setkeys_info->keyOpCtrl &=
+                                    ~AR6000_USER_SETKEYS_RSC_UNCHANGED;
+            } else if (strcmp(optarg, "off") == 0) {
+                user_setkeys_info->keyOpCtrl |=
+                                    AR6000_USER_SETKEYS_RSC_UNCHANGED;
+            } else {
+              printf("Invalid arg %s:Usage --usersetkeys --initrsc=<on/off>",
+                     optarg);
+            }
+            break;
+        case WMI_DBGLOG_CFG_MODULE:
+            dbglogCfg->valid = 0;
+            cmd = WMI_DBGLOG_CFG_MODULE;
+            break;
+        case WMI_DBGLOG_GET_DEBUG_LOGS:
+            cmd = WMI_DBGLOG_GET_DEBUG_LOGS;
+            break;
+        case WMI_SET_HOST_SLEEP_MODE:
+            cmd = WMI_SET_HOST_SLEEP_MODE;
+            if (!strcmp(optarg, "asleep")) {
+                hostSleepModeCmd->asleep = TRUE;
+                hostSleepModeCmd->awake = FALSE;
+            } else if (!strcmp(optarg, "awake")) {
+                hostSleepModeCmd->asleep = FALSE;
+                hostSleepModeCmd->awake = TRUE;
+            }
+            break;
+	case WMI_SET_WOW_MODE:
+            cmd = WMI_SET_WOW_MODE;
+            if (!strcmp(optarg, "enable")) {
+                wowModeCmd->enable_wow = TRUE;
+            } else if (!strcmp(optarg, "disable")) {
+                wowModeCmd->enable_wow = FALSE;
+            }
+            break;
+        case WMI_SET_WOW_FILTER:
+            if (!strcmp(optarg, "none")) {
+               wowModeCmd->filter = 0;
+            } else if (!strcmp(optarg, "ssid")) {
+                wowModeCmd->filter |= (1<<WOW_FILTER_SSID);
+            }
+            break;
+        case WMI_SET_WOW_HOST_REQ_DELAY:
+             wowModeCmd->hostReqDelay=atoi(optarg);
+             break;
+        case WMI_ADD_WOW_PATTERN:
+            cmd = WMI_ADD_WOW_PATTERN;
+            index = (optind - 1);
+            A_UINT8* filter_mask = NULL;
+            A_UINT8 temp1[64]={0};
+            A_UINT8 temp2[64]={0};
+
+            if((index + 4) > argc) {
+                printf("Incorrect number of add wow pattern parameters\n");
+                cmd = 0;
+                break;
+            }
+            memset((char*)addWowCmd, 0, sizeof(WMI_ADD_WOW_PATTERN_CMD));
+            i = addWowCmd->filter_list_id = 0;
+            addWowCmd->filter_list_id = atoi(argv[index++]);
+            addWowCmd->filter_size = atoi(argv[index++]);
+            addWowCmd->filter_offset = atoi(argv[index++]);
+            printf("optind=%d, size=%d offset=%d id=%d\n", optind,
+                    addWowCmd->filter_size, addWowCmd->filter_offset,
+                    addWowCmd->filter_list_id);
+            convert_hexstring_bytearray(argv[index], temp1,addWowCmd->filter_size );
+            memcpy(&addWowCmd->filter[0], temp1, addWowCmd->filter_size);
+            index++;
+            filter_mask = (A_UINT8*)(addWowCmd->filter + addWowCmd->filter_size);
+            convert_hexstring_bytearray(argv[index], temp2,addWowCmd->filter_size );
+            memcpy(filter_mask, temp2, addWowCmd->filter_size);
+
+            for (i=0; i< addWowCmd->filter_size; i++) {
+
+                printf ("mask[%d]=%x pattern[%d]=%x temp=%x\n", i, filter_mask[i], i, addWowCmd->filter[i], temp1[i]);
+            }
+            break;
+        case WMI_DEL_WOW_PATTERN:
+            cmd = WMI_DEL_WOW_PATTERN;
+            index = (optind - 1);
+            if ((index  + 1) > argc) {
+                printf("Incorrect number of del wow pattern parameters\n");
+                cmd = 0;
+                break;
+            }
+            delWowCmd->filter_list_id = 0;
+            index++;
+            delWowCmd->filter_id = atoi(argv[index]);
+            break;
+        case WMI_GET_WOW_LIST:
+            cmd = WMI_GET_WOW_LIST;
+            index = (optind - 1);
+            if ((index  + 1) > argc) {
+                printf("Incorrect number of get wow list parameters\n");
+                cmd = 0;
+                break;
+            }
+            getWowListCmd->filter_list_id = atoi(argv[index]);
+            printf("Get wow filters in list %d\n", getWowListCmd->filter_list_id);
+            break;
+        case DIAG_DUMP_CHIP_MEM:
+            cmd = DIAG_DUMP_CHIP_MEM;
+            break;
+        case DIAG_DUMP_CHIP_MEM_VENUS:
+            cmd = DIAG_DUMP_CHIP_MEM_VENUS;
+            break;
+        case WMI_SET_CONNECT_CTRL_FLAGS:
+            cmd = WMI_SET_CONNECT_CTRL_FLAGS;
+            break;
+        case DUMP_HTC_CREDITS:
+            cmd = DUMP_HTC_CREDITS;
+            break;
+        case WMI_AKMP_MULTI_PMKID:
+            if (strcmp(optarg, "on") == 0) {
+                akmpCtrlCmd->akmpInfo |= WMI_AKMP_MULTI_PMKID_EN;
+            } else if (strcmp(optarg, "off") == 0) {
+                akmpCtrlCmd->akmpInfo &= ~WMI_AKMP_MULTI_PMKID_EN;
+            } else {
+              printf("Invalid arg %s:Usage --setakmctrl --multipmkid=<on/off>",
+                     optarg);
+            }
+            break;
+        case WMI_SET_AKMP_INFO:
+            cmd = WMI_SET_AKMP_INFO;
+            break;
+        case WMI_NUM_PMKID:
+            if ((pmkidUserInfo.numPMKIDUser = atoi(optarg))
+                                                > WMI_MAX_PMKID_CACHE)
+            {
+                printf("Number of PMKIDs %d is out of range [1-%d]\n",
+                       pmkidUserInfo.numPMKIDUser,
+                       WMI_MAX_PMKID_CACHE);
+                pmkidUserInfo.numPMKIDUser = 0;
+            }
+            break;
+        case WMI_PMKID_ENTRY:
+            if (pmkidUserInfo.pmkidInfo->numPMKID <
+                    pmkidUserInfo.numPMKIDUser)
+            {
+                A_UINT8 nextEntry = pmkidUserInfo.pmkidInfo->numPMKID;
+
+                convert_hexstring_bytearray(optarg,
+                                            pmkidUserInfo.pmkidInfo->
+                                            pmkidList[nextEntry].pmkid,
+                                            WMI_PMKID_LEN);
+                pmkidUserInfo.pmkidInfo->numPMKID++;
+            }
+            break;
+        case WMI_SET_PMKID_LIST:
+            cmd = WMI_SET_PMKID_LIST;
+            pmkidUserInfo.pmkidInfo =
+                                 (WMI_SET_PMKID_LIST_CMD *)(buf + sizeof(int));
+            pmkidUserInfo.pmkidInfo->numPMKID = 0;
+            pmkidUserInfo.numPMKIDUser = 0;
+            break;
+        case WMI_GET_PMKID_LIST:
+            cmd = WMI_GET_PMKID_LIST;
+            break;
+        case WMI_SET_IEMASK:
+            filterCmd->ieMask = strtoul(argv[optind-1], NULL, 0);
+            break;
+        case WMI_SET_BSS_PMKID_INFO:
+            cmd = WMI_SET_BSS_PMKID_INFO;
+            memset(bssid, 0, sizeof(bssid));
+            pi_cmd->pi_enable = FALSE;
+            break;
+        case WMI_BSS_PMKID_ENTRY:
+            convert_hexstring_bytearray(optarg, pi_cmd->pi_pmkid,
+                                        sizeof(pi_cmd->pi_pmkid));
+            memcpy(pi_cmd->pi_bssid, bssid, sizeof(bssid));
+            pi_cmd->pi_enable = TRUE;
+            break;
+        case WMI_ABORT_SCAN:
+             cmd = WMI_ABORT_SCAN;
+             break;
+        case WMI_TARGET_EVENT_REPORT:
+             cmd = WMI_TARGET_EVENT_REPORT;
+             evtCfgCmd->evtConfig = atoi(optarg);
+             break;
+        /* AP mode commands */
+        case WMI_AP_GET_STA_LIST:
+            cmd = WMI_AP_GET_STA_LIST;
+            break;
+        case WMI_AP_HIDDEN_SSID:
+            cmd = WMI_AP_HIDDEN_SSID;
+            pHidden->hidden_ssid = atoi(argv[optind]);
+            break;
+        case WMI_AP_SET_NUM_STA:
+            cmd = WMI_AP_SET_NUM_STA;
+            pNumSta->num_sta = atoi(argv[optind]);
+            break;
+        case WMI_AP_SET_GNUM_STA:
+            cmd = WMI_AP_SET_GNUM_STA;
+            pNumSta->num_sta = atoi(argv[optind]);
+            pNumSta->num_sta |= 0x80;
+            break;
+        case WMI_AP_GET_NUM_STA:
+            cmd = WMI_AP_GET_NUM_STA;
+            pNumSta->num_sta = 0;
+            break;
+        case WMI_AP_GET_GNUM_STA:
+            cmd = WMI_AP_GET_GNUM_STA;
+            pNumSta->num_sta = 0x80;
+            break;
+        case WMI_AP_SET_DFS:
+            cmd = WMI_AP_SET_DFS;
+            setDfsCmd->enable = atoi(optarg);
+            break;
+        case WMI_AP_ACL_POLICY:
+        {
+            A_UINT8 policy, retain;
+            cmd = WMI_AP_ACL_POLICY;
+            index = optind;
+            policy = atoi(argv[index++]);
+            retain = atoi(argv[index++]);
+            pACLpolicy->policy = policy |
+                (retain?AP_ACL_RETAIN_LIST_MASK:0);
+            break;
+        }
+        case WMI_AP_ACL_MAC_LIST1:
+            cmd = WMI_AP_ACL_MAC_LIST1;
+            pACL->action = ADD_MAC_ADDR;
+            if(wmic_ether_aton_wild(argv[optind], pACL->mac, &pACL->wildcard) != A_OK) {
+                printf("bad mac address\n");
+                exit (0);
+            }
+            break;
+        case WMI_AP_ACL_MAC_LIST2:
+            cmd = WMI_AP_ACL_MAC_LIST2;
+            pACL->action = DEL_MAC_ADDR;
+            if( (strlen(argv[optind]) == 2) && ISDIGIT(argv[optind][0]) && ISDIGIT(argv[optind][1]) ) {
+                pACL->index = atoi(argv[optind]);
+            } else if( (strlen(argv[optind]) == 1) && ISDIGIT(argv[optind][0]) ) {
+                pACL->index = atoi(argv[optind]);
+            } else {
+                printf("bad ACL index\n");
+                exit(0);
+            }
+            break;
+        case WMI_AP_GET_ACL_LIST:
+            cmd = WMI_AP_GET_ACL_LIST;
+            break;
+        case WMI_AP_COMMIT_CONFIG:
+            cmd = WMI_AP_COMMIT_CONFIG;
+            break;
+        case WMI_AP_INACT_TIME:
+            cmd = WMI_AP_INACT_TIME;
+            pInact->period = atoi(argv[optind]);
+            break;
+        case WMI_AP_PROT_TIME:
+            cmd = WMI_AP_PROT_TIME;
+            index = optind;
+            pProt->period_min = atoi(argv[index++]);
+            pProt->dwell_ms = atoi(argv[index++]);
+            break;
+        case WMI_AP_SET_MLME:
+            cmd = WMI_AP_SET_MLME;
+            index = optind;
+            if((index + 3) > argc) {
+                printf("Incorrect number of arguments\n");
+                exit(0);
+            }
+            pMlme->im_op = atoi(argv[index++]);
+            pMlme->im_reason = atoi(argv[index++]);
+            if(wmic_ether_aton(argv[index++], pMlme->im_macaddr) != A_OK) {
+                printf("bad mac address\n");
+                exit (0);
+            }
+            break;
+        case WMI_AP_SET_DTIM:
+            cmd = WMI_AP_SET_DTIM;
+            pDtim->dtim = atoi(argv[optind]);
+            break;
+        case WMI_AP_SET_COUNTRY:
+            cmd = WMI_AP_SET_COUNTRY;
+            A_BOOL match=FALSE;
+
+            for(i = 0; i < sizeof(my_ctr)/sizeof(my_ctr[0]); i++) {
+                if(!strcasecmp(optarg, my_ctr[i])) {
+                    match = 1;
+                    break;
+                }
+            }
+
+            if (!match) {
+                cmd = 0;
+            } else {
+                memcpy(pCountry->countryCode,my_ctr[i], 2);
+                *(pCountry->countryCode + 2)=0x20;
+            }
+
+            break;
+        case WMI_AP_GET_COUNTRY_LIST:
+            cmd = WMI_AP_GET_COUNTRY_LIST;
+            break;
+        case WMI_AP_DISABLE_REGULATORY:
+            cmd = WMI_AP_DISABLE_REGULATORY;
+            break;
+        case WMI_AP_INTRA_BSS:
+            cmd = WMI_AP_INTRA_BSS;
+            *intra = atoi(argv[optind]);
+            *intra &= 0xF;
+            break;
+        case WMI_AP_INTER_BSS:
+            cmd = WMI_AP_INTER_BSS;
+            *intra = atoi(argv[optind]);
+            *intra |= 0x80;
+            break;
+        case WMI_DUMP_RCV_AGGR_STATS:
+            cmd = WMI_DUMP_RCV_AGGR_STATS;
+            break;
+        case WMI_SUSPEND_DRIVER:
+            cmd = WMI_SUSPEND_DRIVER;
+            break;
+        case WMI_RESUME_DRIVER:
+            cmd = WMI_RESUME_DRIVER;
+            break;				
+        case WMI_SETUP_AGGR:
+        {
+            A_UINT8 aid;
+            cmd = WMI_SETUP_AGGR;
+            if(argc-optind < 2) {
+                printf("--setup_aggr <tid> <aid>\n");
+                return 0;
+            }
+            pAddbaReq->tid = strtoul(argv[optind++], NULL, 0);
+            if(argv[optind]) aid = strtoul(argv[optind], NULL, 0);
+            pAddbaReq->tid = (pAddbaReq->tid & 0xF) | (aid << 4);
+            break;
+        }
+        case WMI_CFG_ALLOW_AGGR:
+            cmd = WMI_CFG_ALLOW_AGGR;
+            pAllowAggr->tx_allow_aggr = strtoul(argv[argc-2], NULL, 0);
+            pAllowAggr->rx_allow_aggr = strtoul(argv[argc-1], NULL, 0);
+            break;
+        case WMI_CFG_DELE_AGGR:
+        {
+            A_UINT8 aid;
+            cmd = WMI_CFG_DELE_AGGR;
+            if(argc-optind < 2) {
+                printf("--dele_aggr <tid> <direction> <aid>\n");
+                return 0;
+            }
+            pDeleteAggr->tid = strtoul(argv[optind++], NULL, 0);
+            pDeleteAggr->is_sender_initiator = strtoul(argv[optind++], NULL, 0);
+            if(argv[optind]) aid = strtoul(argv[optind], NULL, 0);
+            pDeleteAggr->tid = (pDeleteAggr->tid & 0xF) | (aid << 4);
+            break;
+        }
+        case WMI_SET_HT_CAP:
+            cmd = WMI_SET_HT_CAP;
+            break;
+        case WMI_SET_HT_OP:
+            cmd = WMI_SET_HT_OP;
+            break;
+        case WMI_AP_GET_STAT:
+            cmd = WMI_AP_GET_STAT;
+            break;
+        case WMI_AP_CLR_STAT:
+            cmd = WMI_AP_CLR_STAT;
+            break;
+        case WMI_SET_TX_SELECT_RATES:
+            cmd = WMI_SET_TX_SELECT_RATES;
+            break;
+        case WMI_AP_GET_HIDDEN_SSID:
+            cmd = WMI_AP_GET_HIDDEN_SSID;
+            break;
+        case WMI_AP_GET_COUNTRY:
+            cmd = WMI_AP_GET_COUNTRY;
+            break;
+        case WMI_AP_GET_WMODE:
+            cmd = WMI_AP_GET_WMODE;
+            break;
+        case WMI_AP_GET_DTIM:
+            cmd = WMI_AP_GET_DTIM;
+            break;
+        case WMI_AP_GET_BINTVL:
+            cmd = WMI_AP_GET_BINTVL;
+            break;
+        case WMI_GET_RTS:
+            cmd = WMI_GET_RTS;
+            break;
+        case DIAG_FETCH_TARGET_REGS:
+            cmd = DIAG_FETCH_TARGET_REGS;
+            break;
+#ifdef ATH_INCLUDE_PAL
+        case WMI_SEND_PAL_CMD:
+            cmd = WMI_SEND_PAL_CMD;
+            break;
+        case WMI_SEND_PAL_DATA:
+            cmd = WMI_SEND_PAL_DATA;
+            break;
+#endif
+        case WMI_SET_WLAN_CONN_PRECDNCE:
+            cmd = WMI_SET_WLAN_CONN_PRECDNCE;
+            prec->precedence = atoi(argv[argc-1]);
+            break;
+        case WMI_SET_AP_RATESET:
+            cmd = WMI_SET_AP_RATESET;
+            pAPrs->rateset = atoi(argv[optind]);
+            break;
+        case WMI_SET_TX_WAKEUP_POLICY:
+            if (!strcmp(optarg, "sleep")) {
+                pmParamCmd->tx_wakeup_policy = TX_DONT_WAKEUP_UPON_SLEEP;
+            } else if (!strcmp(optarg, "wakeup")) {
+                pmParamCmd->tx_wakeup_policy = TX_WAKEUP_UPON_SLEEP;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case WMI_SET_TX_NUM_FRAMES_TO_WAKEUP:
+            pmParamCmd->num_tx_to_wakeup = atoi(optarg);
+            break;
+        case WMI_SET_AP_PS_PSTYPE:
+            if (!strcmp(optarg, "disable")) {
+                apPsCmd->psType = AP_PS_DISABLE;
+            } else if (!strcmp(optarg, "atheros")) {
+                apPsCmd->psType = AP_PS_ATH;
+            } else {
+                cmd = 0;
+            }
+            break;
+        case WMI_SET_AP_PS_IDLE_TIME:
+            apPsCmd->idle_time = atoi(optarg);
+            break;
+        case WMI_SET_AP_PS_PS_PERIOD:
+            apPsCmd->ps_period = atoi(optarg);
+            break;
+        case WMI_SET_AP_PS_SLEEP_PERIOD:
+            apPsCmd->sleep_period = atoi(optarg);
+            break;
+        case WMI_SEND_CONNECT_CMD:
+            cmd = WMI_SEND_CONNECT_CMD;
+            memset(&cp,0,sizeof(cp));
+            if(strlen(optarg) > 32) {
+                printf("Error: Wrong SSID\n");
+            } else {
+                cp.ssid_len = strlen(optarg);
+                memcpy(cp.ssid, optarg, cp.ssid_len);
+            }
+            break;
+        case WMI_SEND_CONNECT_CMD1:
+#ifdef WPA_SUPPORT
+        {
+            unsigned long val;
+            index = optind-1;
+
+            if(argc-index != 4) {
+                printf("Error: wpa needs 4 args but only %d given\n", argc-index);
+                break;
+            }
+
+            val = strtol(argv[index++], NULL, 0);
+            if(val == 1) {
+                cp.wpa = IW_AUTH_WPA_VERSION_WPA;
+            } else if(val == 2) {
+                cp.wpa = IW_AUTH_WPA_VERSION_WPA2;
+            } else {
+                cp.wpa = 0;
+                printf("Error: Wrong WPA version\n");
+            }
+
+            if (!strcasecmp(argv[index], "tkip")) {
+                cp.ucipher = IW_AUTH_CIPHER_TKIP;
+            } else if (!strcasecmp(argv[index], "ccmp")) {
+                cp.ucipher = IW_AUTH_CIPHER_CCMP;
+            } else {
+                cp.ucipher = IW_AUTH_CIPHER_NONE;
+                printf("Error: Wrong unicast cipher\n");
+            }
+            index++;
+
+            if (!strcasecmp(argv[index], "tkip")) {
+                cp.mcipher = IW_AUTH_CIPHER_TKIP;
+            } else if (!strcasecmp(argv[index], "ccmp")) {
+                cp.mcipher = IW_AUTH_CIPHER_CCMP;
+            } else {
+                cp.mcipher = IW_AUTH_CIPHER_NONE;
+                printf("Error: Wrong multicast cipher\n");
+            }
+            index++;
+
+            val = strlen(argv[index]);
+            if(val >= 8 && val <= 63) {
+                memcpy(cp.psk, argv[index], val);
+                cp.psk_type = KEYTYPE_PHRASE;
+            } else if (val == 64) {
+                memcpy(cp.psk, argv[index], val);
+                cp.psk_type = KEYTYPE_PSK;
+            } else {
+                printf("Error: Wrong PSK\n");
+            }
+            break;
+        }
+#else
+            return -1;
+#endif
+       case WMI_SEND_CONNECT_CMD2:
+            printf("Error: WEP not yet implemented\n");
+            return 0;
+
+       case WMI_SET_WPA_OFFLOAD_STATE:
+       {
+           index = optind-1;
+
+           if(argc-index != 1) {
+               printf("Error: setwpaoffload needs 1 arg but only %d given\n", argc-index);
+               break;
+           }
+
+           *pWpaOffloadState = strtol(argv[index++], NULL, 0);
+
+           cmd = WMI_SET_WPA_OFFLOAD_STATE;
+
+           break;
+       }
+       case WMI_SET_EXCESS_TX_RETRY_THRES:
+       {
+           index = optind-1;
+
+           if(argc-index != 1) {
+               printf("Error: setexcesstxretrythres needs 1 arg but only %d given\n", argc-index);
+               break;
+           }
+
+           *pExcessTxRetryThres = strtol(argv[index++], NULL, 0);
+
+           cmd = WMI_SET_EXCESS_TX_RETRY_THRES;
+
+           break;
+       }
+       case BT_HW_POWER_STATE:
+            if (!strcmp(optarg, "on")) {
+                cmd = SET_BT_HW_POWER_STATE;
+                ((int *)buf)[0] = AR6000_XIOCTL_SET_BT_HW_POWER_STATE;
+                ((int *)buf)[1] = 1;
+            } else if (!strcmp(optarg, "off")) {
+                cmd = SET_BT_HW_POWER_STATE;
+                ((int *)buf)[0] = AR6000_XIOCTL_SET_BT_HW_POWER_STATE;
+                ((int *)buf)[1] = 0;
+            } else if (!strcmp(optarg, "query")) {
+                cmd = GET_BT_HW_POWER_STATE;
+                ((int *)buf)[0] = AR6000_XIOCTL_GET_BT_HW_POWER_STATE;
+            } else {
+                usage();
+            }
+            break;
+
+
+       case WMI_SET_TX_SGI_PARAM:
+             cmd = WMI_SET_TX_SGI_PARAM;
+             set_txsgiparam->sgiMask[0] = DEFAULT_SGI_MASK_L32;
+             set_txsgiparam->sgiMask[1] = DEFAULT_SGI_MASK_U32;
+             set_txsgiparam->sgiPERThreshold = DEFAULT_SGI_PER;
+             break;
+
+       case WMI_SGI_MASK:
+            {
+                unsigned long long val;
+
+                val = strtoll(optarg, NULL, 16);
+                set_txsgiparam->sgiMask[0] = (unsigned long) val;
+                set_txsgiparam->sgiMask[1] = (unsigned long) (val>>32);
+            }
+            break;
+       
+
+       case WMI_PER_SGI:
+            {set_txsgiparam->sgiPERThreshold = atoi(optarg);
+             break;
+            }
+
+       case WMI_WAC_ENABLE:
+            cmd = WMI_WAC_ENABLE;
+            break;
+
+       case WMI_AP_ACS_DISABLE_HI_CHANNELS:
+            cmd = WMI_AP_ACS_DISABLE_HI_CHANNELS;
+            ((int *)buf)[1] = atoi(argv[optind]);
+            break;
+
+       case WMI_SET_DIVERSITY_PARAM:
+            cmd = WMI_SET_DIVERSITY_PARAM;
+            index = optind-1;
+            
+            pDiversity->divIdleTime = atoi(argv[index++]);
+            pDiversity->antRssiThresh = atoi(argv[index++]);
+            pDiversity->divEnable = atoi(argv[index++]);
+            pDiversity->active_treshold_rate = atoi(argv[index++]);
+            break;
+       
+       case WMI_SCAN_PROBED_SSID:
+            cmd = WMI_SCAN_PROBED_SSID;
+            ssid = (A_UCHAR *)optarg;
+            break;
+
+        case WMI_AP_SET_APSD:
+            cmd = WMI_AP_SET_APSD;
+            pApApsd->enable = atoi(argv[optind]);
+            break;
+
+        case WMI_GET_HT_CAP:
+            cmd = WMI_GET_HT_CAP;
+            break;
+
+        case WMI_SET_MCASTRATE:
+            cmd = WMI_SET_MCASTRATE;
+            break;
+
+        case WMI_VOICE_DETECTION_ENABLE:
+            cmd = WMI_VOICE_DETECTION_ENABLE;
+            
+            if (argc - optind != 0) {
+                printf("Usage is --enablevoicedetection <enable>\n");
+                cmd = 0;
+                break;
+            }
+            
+            pVoiceDetectionEnable->enable = atoi(optarg);            
+            break;
+            
+	case WMI_SET_TXE_NOTIFY:
+	    cmd = WMI_SET_TXE_NOTIFY;
+	    index = optind - 1;
+
+	    pTXe->rate = atoi(argv[index++]);
+	    pTXe->pkts = atoi(argv[index++]);
+	    pTXe->intvl = atoi(argv[index++]);
+	    break;
+    case WMI_SET_RECOVERY_SIMULATE:
+            /*wmiconfig -i wlan0 --setrecoverysim 0 100*/
+            if(argc - optind != 2){
+                printf("Error: WMI_SET_RECOVERY_SIMULATE optind:%x argc:%x\n", optind,argc);
+                cmd = 0;
+                break;
+            }
+            cmd = WMI_SET_RECOVERY_SIMULATE;
+            index = optind;
+            pSetRecoveryParam->type = atoi(argv[index++]);
+            pSetRecoveryParam->delay_time_ms = atoi(argv[index++]);
+            break;
+case WMI_DISABLE_BCAST_IN_PM:
+/* wmiconfig -i wlan0 --disablebcast <para0> */
+index = optind-1;
+if (argc - index != 1) {
+printf("Error: WMI_DISABLE_BCAST_IN_PM optind:%x argc:%x\n", optind, argc);
+cmd = 0;
+break;
+}
+cmd = WMI_DISABLE_BCAST_IN_PM;
+disableBcastCmd->disable = atoi(argv[index++]);
+break;
+       case WMI_AP_BLWL:
+        {
+           A_UINT8 control, macindex;
+
+           index = optind;
+           control = atoi(argv[index++]);
+
+           if (0 == control)     //enable blwl
+           {
+                cmd = WMI_AP_BLWL_POLICY;
+                pACLpolicy->policy = AP_ACL_DISABLE;
+           }
+           else if (1 == control)   //enable blwl
+           {
+                cmd = WMI_AP_BLWL_POLICY;
+                pACLpolicy->policy = AP_ACL_BLWL_MAC;
+           }
+           else if (2 == control)   //add a mac into whitelist
+           {
+                cmd = WMI_AP_BLWL_MAC_LIST;
+                macindex = atoi(argv[index++]);
+                pACL->action = ADD_WHITE_MAC_ADDR;
+                pACL->index = macindex;
+                if (wmic_ether_aton_wild(argv[index], pACL->mac, &pACL->wildcard) != A_OK)
+                {
+                    printf("bad mac address\n");
+                    exit (0);
+                }
+           }
+           else if (3 == control)   //add a mac into blacklist
+           {
+                cmd = WMI_AP_BLWL_MAC_LIST;
+                macindex = atoi(argv[index++]);
+                pACL->action = ADD_BLACK_MAC_ADDR;
+                pACL->index = macindex;
+                if (wmic_ether_aton_wild(argv[index], pACL->mac, &pACL->wildcard) != A_OK)
+                {
+                    printf("bad mac address\n");
+                    exit (0);
+                }
+           }
+           else if (4 == control)   //reset whitelist
+           {
+                cmd = WMI_AP_BLWL_MAC_LIST;
+                pACL->action = RESET_WHITE_LIST;
+           }
+           else if (5 == control)   //reset blacklist
+           {
+                cmd = WMI_AP_BLWL_MAC_LIST;
+                pACL->action = RESET_BLACK_LIST;
+           }
+           else
+           {
+                printf("cmd para error\n");
+                exit (0);
+           }
+
+           break;
+       }
+       case WMI_SET_RSSI_FILTER:
+         cmd = WMI_SET_RSSI_FILTER;
+         pSetRssiFilter->rssi_value = atoi(argv[optind]);
+         pSetRssiFilter->rssi_value -= 95; /*the configure value is the real dbm*/
+         break;
+       default:
+            usage();
+            break;
+        }
+    }
+
+    error = tcmd_init(ifname, rx_cb, TCMD_EP_WMI);
+
+    if (error) {
+	 printf("Error\n");
+       return error;
+    }
+
+    switch (cmd) {
+    case WMI_SET_KEEPALIVE:
+        ((int *)buf)[0] = WMI_SET_KEEPALIVE_CMDID_EXT;
+	 printf("Sending WMI_SET_KEEPALIVE\n");
+	 tcmd_tx(buf, sizeof(*setKeepAlive) + 4, false);
+        break;
+    case WMI_SET_DISC_TIMEOUT:
+	((int *)buf)[0] = WMI_SET_DISC_TIMEOUT_CMDID;
+	index = optind;
+	index--;
+	printf("Sending WMI_SET_DISC_TIMEOUT\n");
+	tcmd_tx(buf, 5, false);
+        break;
+    case WMI_GET_TARGET_STATS:
+        ((int *)buf)[0] = WMI_GET_STATISTICS_CMDID;
+         index = optind;
+         index--; 
+  	 printf("case WMI_GET_TARGET_STATS=%d\n", WMI_GET_STATISTICS_CMDID);
+	 tcmd_tx(buf, 4, true);  
+        //printTargetStats(&(tgtStatsCmd.targetStats))
+        break;	
+    case WMI_GET_VERSION:
+        ((int *)buf)[0] = WMI_GET_VERSION;
+         index = optind;
+         index--; 
+  	 printf("case WMI_GET_VERSION\n");
+	 tcmd_tx(buf, 4, true);  
+        //printTargetStats(&(tgtStatsCmd.targetStats))
+        break;	
+    case WMI_SET_SCAN_PARAMS:
+        ((int *)buf)[0] = WMI_SET_SCAN_PARAMS_CMDID;
+        index = optind;
+        index--; 
+        printf("Sending WMI_SET_SCAN_PARAMS\n");
+        tcmd_tx(buf, 24, false);  
+        break;         
+    case WMI_SET_MCASTRATE:
+        ((int *)buf)[0] = WMI_SET_MCASTRATE_CMDID;
+	index = optind;
+	index--;
+	pMcast->bitrate = atoi(argv[index]);
+	printf("Sending WMI_SET_MCASTRATE %d\n", pMcast->bitrate);
+	tcmd_tx(buf, sizeof(WMI_SET_MCASTRATE_CMD) + 4, false);
+	break;
+    case WMI_VOICE_DETECTION_ENABLE:
+        ((int *)buf)[0] = WMI_VOICE_DETECTION_ENABLE_CMDID;
+        printf("Sending WMI_VOICE_DETECTION_ENABLE_CMDID(0x%x) to %s\n", WMI_VOICE_DETECTION_ENABLE_CMDID, pVoiceDetectionEnable->enable?"enable":"disable");        
+        tcmd_tx(buf, sizeof(WMI_VOICE_DETECTION_ENABLE_CMD) + 4, false);
+        break;
+    case WMI_SET_TXE_NOTIFY:
+        ((int *)buf)[0] = WMI_SET_TXE_NOTIFY_CMDID;
+	printf("Sending WMI_SET_TXE_NOTIFY_CMDID, rate %d, pkts %d, intvl %d\n", pTXe->rate, pTXe->pkts, pTXe->intvl);
+	/* XXX: we do expect a TXE_NOTIFY_EVENT in response to this, but
+	 * libtcmd currently does not support event listening. */
+        tcmd_tx(buf, sizeof(WMI_SET_TXE_NOTIFY_CMD) + 4, false);
+	break;
+    case WMI_SET_RECOVERY_SIMULATE:
+        ((int *)buf)[0] = WMI_SET_RECOVERY_TEST_PARAMETER_CMDID;
+        printf("Sending WMI_SET_RECOVERY_TEST_PARAMETER_CMDID(0x%x),type:%d, delay:%d\n", WMI_SET_RECOVERY_TEST_PARAMETER_CMDID,pSetRecoveryParam->type,pSetRecoveryParam->delay_time_ms);        
+        tcmd_tx(buf, sizeof(WMI_SET_RECOVERY_TEST_PARAMETER_CMD) + 4, false);
+        break;
+case WMI_DISABLE_BCAST_IN_PM:
+((int *)buf)[0] =  WMI_DISABLE_BCAST_IN_PM_CMDID;
+printf("Sending  WMI_DISABLE_BCAST_IN_PM(0x%x),disable:%d\n", WMI_DISABLE_BCAST_IN_PM, disableBcastCmd->disable);
+tcmd_tx(buf, sizeof(WMI_DISABLE_BCAST_IN_PM_CMD)+4, false);
+break;
+    case WMI_AP_BLWL_POLICY:
+        ((int *)buf)[0] = WMI_AP_ACL_POLICY_CMDID;
+        printf("Sending WMI_AP_ACL_POLICY_CMDID(0x%x), policy = %d\n", WMI_AP_ACL_POLICY_CMDID, pACLpolicy->policy);
+        tcmd_tx(buf, sizeof(WMI_AP_ACL_POLICY_CMD) + 4, false);
+        break;
+    case WMI_AP_BLWL_MAC_LIST:
+        ((int *)buf)[0] = WMI_AP_ACL_MAC_LIST_CMDID;
+        printf("Sending WMI_AP_ACL_MAC_LIST_CMDID(0x%x), action = %d, index = %d, mac=%02X:%02X:%02X:%02X:%02X:%02X\n",
+            WMI_AP_ACL_MAC_LIST_CMDID, pACL->action, pACL->index,
+            pACL->mac[0], pACL->mac[1], pACL->mac[2], pACL->mac[3], pACL->mac[4], pACL->mac[5]);
+        tcmd_tx(buf, sizeof(WMI_AP_ACL_MAC_CMD) + 4, false);
+        break;
+    case WMI_AP_SET_NUM_STA:
+        ((int *)buf)[0] =  WMI_AP_SET_NUM_STA_CMDID;
+        printf("Sending  WMI_AP_SET_NUM_STA_CMDID(0x%x),NUMBER:%d\n", WMI_AP_SET_NUM_STA_CMDID, pNumSta->num_sta);
+        tcmd_tx(buf, sizeof(WMI_AP_NUM_STA_CMD)+4, false);
+        break;
+    case WMI_SET_RSSI_FILTER:
+        ((int *)buf)[0] =  WMI_SET_RSSI_FILTER_CMDID;
+        printf("Sending  WMI_SET_RSSI_FILTER_CMDID(0x%x),rssi:%d\n", WMI_SET_RSSI_FILTER_CMDID, pSetRssiFilter->rssi_value);
+        tcmd_tx(buf, sizeof(WMI_SET_RSSI_FILTER_CMD)+4, false);
+        break;
+    case WMI_SET_SSID:
+        ((int *)buf)[0] =  WMI_SET_PROBED_SSID_CMDID;
+        printf("Sending  WMI_SET_PROBED_SSID_CMDID(0x%x),ssid:%s index:%d\n", WMI_SET_PROBED_SSID_CMDID, ssid, pSsidCmd->entryIndex);
+        if (ssid && (strlen((const char *)ssid) > sizeof (pSsidCmd->ssid))) {
+            break;
+        }
+        if (strcmp((const char *)ssid, "off") == 0) {
+            pSsidCmd->ssidLength = 0;
+            pSsidCmd->flag = DISABLE_SSID_FLAG;
+        } else if (strcmp((const char *)ssid, "any") == 0) {
+            pSsidCmd->ssidLength = 0;
+            pSsidCmd->flag = ANY_SSID_FLAG;
+        } else {
+            pSsidCmd->flag = SPECIFIC_SSID_FLAG;
+            pSsidCmd->ssidLength = (A_UINT8)strlen((const char *)ssid);
+            memcpy(pSsidCmd->ssid, ssid, pSsidCmd->ssidLength);
+        }
+        tcmd_tx(buf, sizeof(WMI_PROBED_SSID_CMD)+4, false);
+        break;
+    case WMI_START_SCAN:
+        ((int *)buf)[0] = WMI_START_SCAN_CMDID;
+        printf("Sending  WMI_START_SCAN_CMDID(0x%x),scanType:%d forceFgScan:%d,isLegacy:%d,homeDwellTime:%d,forceScanInterval:%d,numChannels:%d\n",  
+               WMI_START_SCAN_CMDID, startScanCmd->scanType,startScanCmd->forceFgScan,startScanCmd->isLegacy,startScanCmd->homeDwellTime,startScanCmd->forceScanInterval,startScanCmd->numChannels);
+       tcmd_tx(buf, sizeof(WMI_START_SCAN_CMD)+4, false);
+        break;
+    case WMI_AP_SET_DTIM:
+        ((int *)buf)[0] = WMI_AP_SET_DTIM_CMDID;
+        printf("Sending WMI_AP_SET_DTIM_CMD(0x%x), dtim = %d\n", WMI_AP_SET_DTIM_CMDID, pDtim->dtim);
+        tcmd_tx(buf, sizeof(WMI_AP_SET_DTIM_CMD) + 4, false);
+        break;
+    case WMI_SET_DIVERSITY_PARAM:
+        ((int *)buf)[0] = WMI_SET_DIV_PARAMS_CMDID;
+        printf("Sending WMI_SET_DIVERSITY_PARAM IdleTime %d, antRssiThresh %d, divEnable %d, active_threshols_rate %d\n",
+            pDiversity->divIdleTime,
+            pDiversity->antRssiThresh,
+            pDiversity->divEnable,
+            pDiversity->active_treshold_rate);
+        tcmd_tx(buf, sizeof(WMI_DIV_PARAMS_CMD) + 4, false);
+        break;
+    default:
+        usage();
+    }
+
+    exit (0);
+}
+
+void rx_cb(void *buf, int len)
+{
+	TCMD_ID tcmd;
+	int i;
+	uint32_t * buff;
+	buff = (uint32_t *) buf;
+	char fw_version[32];
+
+	tcmd = * ((uint32_t *) buf + 1); 
+	//printf("rx_cb: sizeof(TARGET_STATS)=%d, len=%d, user_cmd=%d\n", 
+	//	  sizeof(TARGET_STATS), len, user_cmd);
+	
+	for (i=0; i< len/4+1; i=i+4)
+		printf("rx_cb: 0x%08X 0x%08X 0x%08X 0x%08X\n",
+		        buff[i], buff[i+1], buff[i+2], buff[i+3]);
+
+ 	//fprintf(stderr, "tcmd=%d\n", tcmd);
+	switch (buff[0]) {
+		case WMI_REPORT_STATISTICS_EVENTID:
+			printTargetStats((TARGET_STATS *)((uint32_t*)buf+1));
+			break;
+		case WMI_WLAN_VERSION_EVENTID:
+			memcpy(fw_version, (int *)buf+1, 32);
+			printf("FW Version: %s\n", fw_version);
+			break;
+		default:
+			break;
+	}
+
+}
+
+
+/*
+ * converts ieee channel number to frequency
+ */
+static A_UINT16
+wmic_ieee2freq(int chan)
+{
+    if (chan == 14) {
+        return 2484;
+    }
+    if (chan < 14) {    /* 0-13 */
+        return (2407 + (chan*5));
+    }
+    if (chan < 27) {    /* 15-26 */
+        return (2512 + ((chan-15)*20));
+    }
+    return (5000 + (chan*5));
+}
+
+
+#ifdef NOT_YET
+// Validate a hex character
+static A_BOOL
+_is_hex(char c)
+{
+    return (((c >= '0') && (c <= '9')) ||
+            ((c >= 'A') && (c <= 'F')) ||
+            ((c >= 'a') && (c <= 'f')));
+}
+
+// Validate alpha
+static A_BOOL
+isalpha(int c)
+{
+    return (((c >= 'a') && (c <= 'z')) ||
+            ((c >= 'A') && (c <= 'Z')));
+}
+
+// Validate alphanum
+static A_BOOL
+isalnum(int c)
+{
+    return (isalpha(c) || isdigit(c));
+}
+
+#endif
+
+// Convert a single hex nibble
+static int
+_from_hex(char c)
+{
+    int ret = 0;
+
+    if ((c >= '0') && (c <= '9')) {
+        ret = (c - '0');
+    } else if ((c >= 'a') && (c <= 'f')) {
+        ret = (c - 'a' + 0x0a);
+    } else if ((c >= 'A') && (c <= 'F')) {
+        ret = (c - 'A' + 0x0A);
+    }
+    return ret;
+}
+
+// Validate digit
+static A_BOOL
+isdigit(int c)
+{
+    return ((c >= '0') && (c <= '9'));
+}
+
+void
+convert_hexstring_bytearray(char *hexStr, A_UINT8 *byteArray, A_UINT8 numBytes)
+{
+    A_UINT8 i;
+
+    for (i = 0; i < numBytes; i++) {
+        byteArray[i] = 16*_from_hex(hexStr[2*i + 0]) + _from_hex(hexStr[2*i +1]);
+    }
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * Input an Ethernet address and convert to binary.
+ */
+static A_STATUS
+wmic_ether_aton(const char *orig, A_UINT8 *eth)
+{
+  const char *bufp;
+  int i;
+
+  i = 0;
+  for(bufp = orig; *bufp != '\0'; ++bufp) {
+    unsigned int val;
+    unsigned char c = *bufp++;
+    if (isdigit(c)) val = c - '0';
+    else if (c >= 'a' && c <= 'f') val = c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val = c - 'A' + 10;
+    else break;
+
+    val <<= 4;
+    c = *bufp++;
+    if (isdigit(c)) val |= c - '0';
+    else if (c >= 'a' && c <= 'f') val |= c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val |= c - 'A' + 10;
+    else break;
+
+    eth[i] = (unsigned char) (val & 0377);
+    if(++i == ATH_MAC_LEN) {
+        /* That's it.  Any trailing junk? */
+        if (*bufp != '\0') {
+#ifdef DEBUG
+            fprintf(stderr, "iw_ether_aton(%s): trailing junk!\n", orig);
+            return(A_EINVAL);
+#endif
+        }
+        return(A_OK);
+    }
+    if (*bufp != ':')
+        break;
+  }
+
+  return(A_EINVAL);
+}
+
+A_STATUS
+wmic_ether_aton_wild(const char *orig, A_UINT8 *eth, A_UINT8 *wild)
+{
+  const char *bufp;
+  unsigned char val, c;
+  int i=0;
+
+  *wild = 0;
+  for(bufp = orig; *bufp != '\0'; ++bufp) {
+    c = *bufp++;
+    if (isdigit(c)) val = c - '0';
+    else if (c >= 'a' && c <= 'f') val = c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val = c - 'A' + 10;
+    else if (c == '*')  { val = 0; *wild |= 1<<i; goto next; }
+    else break;
+
+    val <<= 4;
+    c = *bufp++;
+    if (isdigit(c)) val |= c - '0';
+    else if (c >= 'a' && c <= 'f') val |= c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val |= c - 'A' + 10;
+    else break;
+
+next:
+    eth[i] = (unsigned char) (val & 0xFF);
+    if(++i == ATH_MAC_LEN) {
+        /* That's it.  Any trailing junk? */
+        if (*bufp != '\0') {
+        }
+        return(A_OK);
+    }
+    if (*bufp != ':')
+        break;
+  }
+
+  return(A_EINVAL);
+}
+
+A_STATUS
+wmic_validate_roam_ctrl(WMI_SET_ROAM_CTRL_CMD *pRoamCtrl, A_UINT8 numArgs,
+                        char **argv)
+{
+    A_STATUS status = A_OK;
+    WMI_BSS_BIAS *pBssBias;
+    A_INT32 bias;
+    A_UINT8 i = 0;
+
+    switch (pRoamCtrl->roamCtrlType) {
+        case WMI_FORCE_ROAM:
+            if (numArgs != 1) {
+                fprintf(stderr, "BSSID to roam not given\n");
+                status = A_EINVAL;
+            } else if (wmic_ether_aton(argv[optind], pRoamCtrl->info.bssid)
+                                       != A_OK)
+            {
+                fprintf(stderr,"BSSID %s not in correct format\n",
+                         argv[optind]);
+                status = A_EINVAL;
+            }
+            break;
+        case WMI_SET_ROAM_MODE:
+            if (numArgs != 1) {
+                fprintf(stderr, "roam mode(default, bssbias, lock) not "
+                        " given\n");
+                status = A_EINVAL;
+            } else {
+                if (strcasecmp(argv[optind], "default") == 0) {
+                    pRoamCtrl->info.roamMode = WMI_DEFAULT_ROAM_MODE;
+                } else if (strcasecmp(argv[optind], "bssbias") == 0) {
+                    pRoamCtrl->info.roamMode = WMI_HOST_BIAS_ROAM_MODE;
+                } else if (strcasecmp(argv[optind], "lock") == 0) {
+                    pRoamCtrl->info.roamMode = WMI_LOCK_BSS_MODE;
+                } else {
+                    fprintf(stderr, "roam mode(default, bssbias, lock) not "
+                        " given\n");
+                    status = A_EINVAL;
+                }
+            }
+            break;
+        case WMI_SET_HOST_BIAS:
+            if ((numArgs & 0x01) || (numArgs > 25) ) {
+                fprintf(stderr, "roam bias too many entries or bss bias"
+                        "not input for every BSSID\n");
+                status = A_EINVAL;
+            } else {
+                pRoamCtrl->info.bssBiasInfo.numBss = numArgs >> 1;
+                pBssBias = pRoamCtrl->info.bssBiasInfo.bssBias;
+                while (i < pRoamCtrl->info.bssBiasInfo.numBss) {
+                    if (wmic_ether_aton(argv[optind + 2 * i],
+                                        pBssBias[i].bssid)
+                                        != A_OK)
+                    {
+                        fprintf(stderr,"BSSID %s not in correct format\n",
+                                argv[optind + 2 * i]);
+                        status = A_EINVAL;
+                        pRoamCtrl->info.bssBiasInfo.numBss = 0;
+                        break;
+                    }
+                    bias  = atoi(argv[optind + 2 * i + 1]);
+                    if ((bias < -256) || (bias > 255)) {
+                        fprintf(stderr,"bias value %d is  not in range\n",
+                                bias);
+                        status = A_EINVAL;
+                        pRoamCtrl->info.bssBiasInfo.numBss = 0;
+                        break;
+                    }
+                    pBssBias[i].bias = bias;
+                    i++;
+                }
+            }
+            break;
+        case WMI_SET_LOWRSSI_SCAN_PARAMS:
+            if (numArgs != 4) {
+                fprintf(stderr, "not enough arguments\n");
+                status = A_EINVAL;
+            } else {
+                pRoamCtrl->info.lrScanParams.lowrssi_scan_period = atoi(argv[optind]);
+                if (atoi(argv[optind+1]) >= atoi(argv[optind+2])) {
+                    pRoamCtrl->info.lrScanParams.lowrssi_scan_threshold = atoi(argv[optind+1]);
+                    pRoamCtrl->info.lrScanParams.lowrssi_roam_threshold = atoi(argv[optind+2]);
+                } else {
+                    fprintf(stderr, "Scan threshold should be greater than \
+                            equal to roam threshold\n");
+                    status = A_EINVAL;
+                }
+                pRoamCtrl->info.lrScanParams.roam_rssi_floor = atoi(argv[optind+3]);
+            }
+
+            break;
+        default:
+            status = A_EINVAL;
+            fprintf(stderr,"roamctrl type %d out if range should be between"
+                       " %d and %d\n", pRoamCtrl->roamCtrlType,
+                        WMI_MIN_ROAM_CTRL_TYPE, WMI_MAX_ROAM_CTRL_TYPE);
+            break;
+    }
+    return status;
+}
+
+A_STATUS
+wmic_validate_appie(struct ieee80211req_getset_appiebuf *appIEInfo, char **argv)
+{
+    A_STATUS status = A_OK;
+    A_UINT8 index = optind - 1;
+    A_UINT16 ieLen;
+
+    if ((strlen(argv[index]) == strlen("probe")) &&
+        (strcmp(argv[index], "probe") == 0))
+    {
+        appIEInfo->app_frmtype = IEEE80211_APPIE_FRAME_PROBE_REQ;
+    } else if ((strlen(argv[index]) == strlen("assoc")) &&
+               (strcmp(argv[index], "assoc") == 0))
+    {
+        appIEInfo->app_frmtype = IEEE80211_APPIE_FRAME_ASSOC_REQ;
+    } else if((strlen(argv[index]) == strlen("beacon")) &&
+        (strcmp(argv[index], "beacon") == 0)) {
+        appIEInfo->app_frmtype = IEEE80211_APPIE_FRAME_BEACON;
+    } else if((strlen(argv[index]) == strlen("respon")) &&
+        (strcmp(argv[index], "respon") == 0)) {
+        appIEInfo->app_frmtype = IEEE80211_APPIE_FRAME_PROBE_RESP;
+    } else {
+        printf("specify one of beacon/probe/respon/assoc\n");
+        return A_EINVAL;
+    }
+    index++;
+
+    ieLen = strlen(argv[index]);
+    if ((ieLen == 1) && argv[index][0] == '0') {
+        appIEInfo->app_buflen = 0;
+    } else if ((ieLen > 4)  && (ieLen <= 2*IEEE80211_APPIE_FRAME_MAX_LEN) &&
+               _from_hex(argv[index][2])*16 +
+               _from_hex(argv[index][3]) + 2  == ieLen/2)
+    {
+        if ((argv[index][0] != 'd') && (argv[index][1] != 'd')) {
+            status = A_EINVAL;
+        } else {
+            convert_hexstring_bytearray(argv[index], appIEInfo->app_buf, ieLen/2);
+            appIEInfo->app_buflen = ieLen/2;
+        }
+    } else {
+        status = A_EINVAL;
+        printf("Invalid IE format should be of format dd04aabbccdd\n");
+    }
+
+    return status;
+}
+
+static A_STATUS
+wmic_get_ip(const char *ipstr, A_UINT32 *ip)
+{
+	char tokstr[strlen(ipstr)];
+	char *tok;
+	int i = 4;
+	A_UINT32 addr = 0;
+	A_UINT32 sb;
+
+	strcpy(tokstr, ipstr);
+	tok = strtok(tokstr, ".");
+	if (!tok)
+		return A_EINVAL;
+
+	do {
+		if ((sb = strtoul(tok, NULL, 10)) < 0)
+			return A_EINVAL;
+		addr |= sb << (--i * 8);
+
+		if (i < 0)
+			return A_EINVAL;
+	} while ((tok = strtok(NULL, ".")) != NULL);
+
+	*ip = addr;
+	return A_OK;
+}
+
+A_STATUS
+wmic_validate_setkeepalive(WMI_SET_KEEPALIVE_CMD_EXT *cmd, char **argv)
+{
+    A_STATUS status = A_OK;
+    A_UINT8 index = optind - 1;
+    A_UINT8 intvl, mode;
+
+    if ((intvl = strtol(argv[index++], NULL, 10)) < 0) {
+	    status = A_EINVAL;
+	    printf("invalid keepalive interval\n");
+	    goto out;
+    }
+    cmd->keepaliveInterval = intvl;
+
+    mode = strtol(argv[index++], NULL, 10);
+    if (mode < 0 || mode > 3) {
+	    status = A_EINVAL;
+	    printf("invalid keepalive mode\n");
+	    goto out;
+    }
+    cmd->keepaliveMode = mode;
+
+    if (wmic_ether_aton(argv[index++], cmd->peer_mac_address) != A_OK) {
+	    status = A_EINVAL;
+	    printf("invalid target mac\n");
+	    goto out;
+    }
+
+    if (wmic_get_ip(argv[index++], &cmd->keepalive_arp_srcip) != A_OK) {
+	    status = A_EINVAL;
+	    printf("invalid src ip\n");
+	    goto out;
+    }
+
+    if (wmic_get_ip(argv[index++], &cmd->keepalive_arp_tgtip) != A_OK) {
+	    status = A_EINVAL;
+	    printf("invalid tgt ip\n");
+	    goto out;
+    }
+
+out:
+    return status;
+}
+
+A_STATUS
+wmic_validate_mgmtfilter(A_UINT32 *pMgmtFilter, char **argv)
+{
+    A_UINT8 index = optind - 1;
+    A_BOOL  setFilter = FALSE;
+    A_UINT32    filterType;
+
+    if ((strlen(argv[index]) == strlen("set")) &&
+        (strcmp(argv[index], "set") == 0))
+    {
+        setFilter = TRUE;
+    } else if ((strlen(argv[index]) == strlen("clear")) &&
+        (strcmp(argv[index], "clear") == 0))
+    {
+        setFilter = FALSE;
+    } else {
+        printf("specify one of set/clear\n");
+        return A_EINVAL;
+    }
+    index++;
+    if ((strlen(argv[index]) == strlen("beacon")) &&
+        (strcmp(argv[index], "beacon") == 0))
+    {
+        filterType = IEEE80211_FILTER_TYPE_BEACON;
+    } else if ((strlen(argv[index]) == strlen("proberesp")) &&
+        (strcmp(argv[index], "proberesp") == 0))
+    {
+        filterType = IEEE80211_FILTER_TYPE_PROBE_RESP;
+    } else {
+        printf("specify one of beacon/proberesp\n");
+        return A_EINVAL;
+    }
+    *pMgmtFilter = 0;
+
+    if (setFilter) {
+        *pMgmtFilter |= filterType;
+    } else {
+        *pMgmtFilter &= ~filterType;
+    }
+
+    return A_OK;
+}
+
+void
+printTargetStats(TARGET_STATS *pStats)
+{
+    printf("Target stats\n");
+    printf("------------\n");
+    printf("tx_packets = %d\n"
+           "tx_bytes = %d\n"
+           "tx_unicast_pkts  = %d\n"
+           "tx_unicast_bytes = %d\n"
+           "tx_multicast_pkts = %d\n"
+           "tx_multicast_bytes = %d\n"
+           "tx_broadcast_pkts = %d\n"
+           "tx_broadcast_bytes = %d\n"
+           "tx_rts_success_cnt = %d\n"
+           "tx_packet_per_ac[%d] = %d\n"
+           "tx_packet_per_ac[%d] = %d\n"
+           "tx_packet_per_ac[%d] = %d\n"
+           "tx_packet_per_ac[%d] = %d\n"
+           "tx_errors = %d\n"
+           "tx_failed_cnt = %d\n"
+           "tx_retry_cnt = %d\n"
+           "tx_mult_retry_cnt = %d\n"
+           "tx_rts_fail_cnt = %d\n"
+           "tx_unicast_rate = %d Kbps\n"
+           "rx_packets = %d\n"
+           "rx_bytes = %d\\n"
+           "rx_unicast_pkts = %d\n"
+           "rx_unicast_bytes = %d\n"
+           "rx_multicast_pkts = %d\n"
+           "rx_multicast_bytes = %d\n"
+           "rx_broadcast_pkts = %d\n"
+           "rx_broadcast_bytes = %d\n"
+           "rx_fragment_pkt = %d\n"
+           "rx_errors = %d\n"
+           "rx_crcerr = %d\n"
+           "rx_key_cache_miss = %d\n"
+           "rx_decrypt_err = %d\n"
+           "rx_duplicate_frames = %d\n"
+           "rx_unicast_rate = %d Kbps\n"
+           "tkip_local_mic_failure = %d\n"
+           "tkip_counter_measures_invoked = %d\n"
+           "tkip_replays = %d\n"
+           "tkip_format_errors = %d\n"
+           "ccmp_format_errors = %d\n"
+           "ccmp_replays = %d\n"
+           "power_save_failure_cnt = %d\n"
+           "noise_floor_calibation = %d\n"
+           "cs_bmiss_cnt = %d\n"
+           "cs_lowRssi_cnt = %d\n"
+           "cs_connect_cnt = %d\n"
+           "cs_disconnect_cnt = %d\n"
+           "cs_aveBeacon_snr= %d\n"
+           "cs_aveBeacon_rssi = %d\n"
+           "cs_lastRoam_msec = %d\n"
+           "cs_rssi = %d\n"
+           "cs_snr = %d\n"
+           "lqVal = %d\n"
+           "wow_num_pkts_dropped = %d\n"
+           "wow_num_host_pkt_wakeups = %d\n"
+           "wow_num_host_event_wakeups = %d\n"
+           "wow_num_events_discarded = %d\n"
+           "arp_received = %d\n"
+           "arp_matched = %d\n"
+           "arp_replied = %d\n",
+           (int) pStats->tx_packets,
+           (int) pStats->tx_bytes,
+           (int) pStats->tx_unicast_pkts,
+           (int) pStats->tx_unicast_bytes,
+           (int) pStats->tx_multicast_pkts,
+           (int) pStats->tx_multicast_bytes,
+           (int) pStats->tx_broadcast_pkts,
+           (int) pStats->tx_broadcast_bytes,
+           (int) pStats->tx_rts_success_cnt,
+           0, (int) pStats->tx_packet_per_ac[0],
+           1, (int) pStats->tx_packet_per_ac[1],
+           2, (int) pStats->tx_packet_per_ac[2],
+           3, (int) pStats->tx_packet_per_ac[3],
+           (int) pStats->tx_errors,
+           (int) pStats->tx_failed_cnt,
+           (int) pStats->tx_retry_cnt,
+           (int) pStats->tx_mult_retry_cnt,
+           (int) pStats->tx_rts_fail_cnt,
+           (int) pStats->tx_unicast_rate,
+           (int) pStats->rx_packets,
+           (int) pStats->rx_bytes,
+           (int) pStats->rx_unicast_pkts,
+           (int) pStats->rx_unicast_bytes,
+           (int) pStats->rx_multicast_pkts,
+           (int) pStats->rx_multicast_bytes,
+           (int) pStats->rx_broadcast_pkts,
+           (int) pStats->rx_broadcast_bytes,
+           (int) pStats->rx_fragment_pkt,
+           (int) pStats->rx_errors,
+           (int) pStats->rx_crcerr,
+           (int) pStats->rx_key_cache_miss,
+           (int) pStats->rx_decrypt_err,
+           (int) pStats->rx_duplicate_frames,
+           (int) pStats->rx_unicast_rate,
+           (int) pStats->tkip_local_mic_failure,
+           (int) pStats->tkip_counter_measures_invoked,
+           (int) pStats->tkip_replays,
+           (int) pStats->tkip_format_errors,
+           (int) pStats->ccmp_format_errors,
+           (int) pStats->ccmp_replays,
+           (int) pStats->power_save_failure_cnt,
+           (int) pStats->noise_floor_calibation,
+           (int) pStats->cs_bmiss_cnt,
+           (int) pStats->cs_lowRssi_cnt,
+           (int) pStats->cs_connect_cnt,
+           (int) pStats->cs_disconnect_cnt,
+           (int) pStats->cs_aveBeacon_snr,
+           (int) pStats->cs_aveBeacon_rssi,
+           (int) pStats->cs_lastRoam_msec,
+           (int) pStats->cs_rssi,
+           (int) pStats->cs_snr,
+           (int) pStats->lq_val,
+           (int) pStats->wow_num_pkts_dropped,
+           (int) pStats->wow_num_host_pkt_wakeups,
+           (int) pStats->wow_num_host_event_wakeups,
+           (int) pStats->wow_num_events_discarded,
+           (int) pStats->arp_received,
+           (int) pStats->arp_matched,
+           (int) pStats->arp_replied
+);
+
+}
+
+void
+printBtcoexConfig(WMI_BTCOEX_CONFIG_EVENT *pConfig)
+{
+    switch(pConfig->btProfileType) {
+    case WMI_BTCOEX_BT_PROFILE_SCO:
+        {
+            WMI_SET_BTCOEX_SCO_CONFIG_CMD *scoConfigCmd = &pConfig->info.scoConfigCmd;
+            printf("BTCOEX SCO CONFIG\n");
+            printf("GENERIC SCO CONFIG\n");
+            printf("scoSlots =%d\n"
+                    "scoIdleSlots =%d\n"
+                    "scoFlags = %d\n"
+                    "linkId = %d\n",
+                    scoConfigCmd->scoConfig.scoSlots,
+                    scoConfigCmd->scoConfig.scoIdleSlots,
+                    scoConfigCmd->scoConfig.scoFlags,
+                    scoConfigCmd->scoConfig.linkId
+                   );
+            printf("PSPOLL SCO CONFIG \n");
+            printf( "scoCyclesForceTrigger = %d\n"
+                    "scoDataResponseTimeout = %d\n"
+                    "scoStompDutyCyleVal = %d\n"
+                    "scoStompDutyCyleMaxVal = %d\n"
+                    "scoPsPollLatencyFraction = %d\n",
+                    scoConfigCmd->scoPspollConfig.scoCyclesForceTrigger,
+                    scoConfigCmd->scoPspollConfig.scoDataResponseTimeout,
+                    scoConfigCmd->scoPspollConfig.scoStompDutyCyleVal,
+                    scoConfigCmd->scoPspollConfig.scoStompDutyCyleMaxVal,
+                    scoConfigCmd->scoPspollConfig.scoPsPollLatencyFraction
+                    );
+            printf("SCO optmode Config\n");
+            printf( "scoStompCntIn100ms = %d\n"
+                    "scoContStompMax = %d\n"
+                    "scoMinlowRateMbps = %d\n"
+                    "scoLowRateCnt = %d\n"
+                    "scoHighPktRatio = %d\n"
+                    "scoMaxAggrSize = %d\n",
+                    scoConfigCmd->scoOptModeConfig.scoStompCntIn100ms,
+                    scoConfigCmd->scoOptModeConfig.scoContStompMax,
+                    scoConfigCmd->scoOptModeConfig.scoMinlowRateMbps,
+                    scoConfigCmd->scoOptModeConfig.scoLowRateCnt,
+                    scoConfigCmd->scoOptModeConfig.scoHighPktRatio,
+                    scoConfigCmd->scoOptModeConfig.scoMaxAggrSize
+                 );
+            printf("SCO wlan scan config\n");
+            printf("scanInterval = %d\n"
+                   "maxScanStompCnt = %d\n",
+                   scoConfigCmd->scoWlanScanConfig.scanInterval,
+                   scoConfigCmd->scoWlanScanConfig.maxScanStompCnt
+                  );
+
+         }
+         break;
+
+    case WMI_BTCOEX_BT_PROFILE_A2DP:
+        {
+            WMI_SET_BTCOEX_A2DP_CONFIG_CMD *a2dpConfigCmd = &pConfig->info.a2dpConfigCmd;
+            printf("BTCOEX A2DP CONFIG\n");
+            printf("a2dpFlags           = %d\n"
+                   "linkId              = %d\n",
+                   a2dpConfigCmd->a2dpConfig.a2dpFlags,
+                   a2dpConfigCmd->a2dpConfig.linkId
+            );
+            printf("BTCOEX PSPOLLMODE A2DP CONFIG\n");
+            printf("a2dpWlanMaxDur      = %d\n"
+                   "a2dpMinBurstCnt     = %d\n"
+                   "a2dpDataRespTimeout = %d\n",
+                   a2dpConfigCmd->a2dppspollConfig.a2dpWlanMaxDur,
+                   a2dpConfigCmd->a2dppspollConfig.a2dpMinBurstCnt,
+                   a2dpConfigCmd->a2dppspollConfig.a2dpDataRespTimeout
+            );
+            printf("BTCOEX OPTMODE A2DP CONFIG\n");
+            printf("a2dpMinlowRateMbps  = %d\n"
+                   "a2dpLowRateCnt      = %d\n"
+                   "a2dpHighPktRatio    = %d\n"
+                   "a2dpMaxAggrSize     = %d\n"
+                   "a2dpPktStompCnt     = %d\n",
+                   a2dpConfigCmd->a2dpOptConfig.a2dpMinlowRateMbps,
+                   a2dpConfigCmd->a2dpOptConfig.a2dpLowRateCnt,
+                   a2dpConfigCmd->a2dpOptConfig.a2dpHighPktRatio,
+                   a2dpConfigCmd->a2dpOptConfig.a2dpMaxAggrSize,
+                   a2dpConfigCmd->a2dpOptConfig.a2dpPktStompCnt
+            );
+        }
+        break;
+
+    case WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE:
+        {
+            WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *btinquiryPageConfigCmd = &pConfig->info.btinquiryPageConfigCmd;
+
+            printf("BTCOEX BTINQUIRY PAGE CONFIG\n");
+            printf("btInquiryDataFetchFrequency     = %d\n"
+                   "protectBmissDurPostBtInquiry    = %d\n"
+                   "maxpageStomp                    = %d\n"
+                   "btInquiryPageFlag               = %d\n",
+                   btinquiryPageConfigCmd->btInquiryDataFetchFrequency,
+                   btinquiryPageConfigCmd->protectBmissDurPostBtInquiry,
+                   btinquiryPageConfigCmd->maxpageStomp,
+                   btinquiryPageConfigCmd->btInquiryPageFlag
+            );
+        }
+        break;
+
+    case WMI_BTCOEX_BT_PROFILE_ACLCOEX:
+        {
+            WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD *aclcoexConfig = &pConfig->info.aclcoexConfig;
+            printf("BTCOEX ACLCOEX CONFIG\n");
+            printf("aclWlanMediumDur        = %d\n"
+                   "aclBtMediumDur          = %d\n"
+                   "aclDetectTimeout        = %d\n"
+                   "aclPktCntLowerLimit     = %d\n"
+                   "aclIterForEnDis         = %d\n"
+                   "aclPktCntUpperLimit     = %d\n"
+                   "aclCoexFlags            = %d\n"
+                   "linkId                  = %d\n",
+                   aclcoexConfig->aclCoexConfig.aclWlanMediumDur,
+                   aclcoexConfig->aclCoexConfig.aclBtMediumDur,
+                   aclcoexConfig->aclCoexConfig.aclDetectTimeout,
+                   aclcoexConfig->aclCoexConfig.aclPktCntLowerLimit,
+                   aclcoexConfig->aclCoexConfig.aclIterForEnDis,
+                   aclcoexConfig->aclCoexConfig.aclPktCntUpperLimit,
+                   aclcoexConfig->aclCoexConfig.aclCoexFlags,
+                   aclcoexConfig->aclCoexConfig.linkId
+            );
+            printf("BTCOEX PSPOLLMODE ACLCOEX CONFIG\n");
+            printf("aclDataRespTimeout      = %d\n",
+                   aclcoexConfig->aclCoexPspollConfig.aclDataRespTimeout
+            );
+            printf("BTCOEX OPTMODE ACLCOEX CONFIG\n");
+            printf("aclCoexMinlowRateMbps   = %d\n"
+                   "aclCoexLowRateCnt       = %d\n"
+                   "aclCoexHighPktRatio     = %d\n"
+                   "aclCoexMaxAggrSize      = %d\n"
+                   "aclPktStompCnt          = %d\n",
+                   aclcoexConfig->aclCoexOptConfig.aclCoexMinlowRateMbps,
+                   aclcoexConfig->aclCoexOptConfig.aclCoexLowRateCnt,
+                   aclcoexConfig->aclCoexOptConfig.aclCoexHighPktRatio,
+                   aclcoexConfig->aclCoexOptConfig.aclCoexMaxAggrSize,
+                   aclcoexConfig->aclCoexOptConfig.aclPktStompCnt
+            );
+        }
+        break;
+
+    default:
+        break;
+    }
+    return;
+}
+
+
+void print_wild_mac(unsigned char *mac, char wildcard)
+{
+    int i;
+
+    printf("    ");
+    for(i=0;i<5;i++) {
+        if(wildcard & (1<<i))   printf("*:");
+        else                    printf("%02X:", mac[i]);
+    }
+
+    if(wildcard & (1<<i))   printf("*\n");
+    else                    printf("%02X\n", mac[5]);
+}
diff --git a/btconfig_1.05/Android.mk b/btconfig_1.05/Android.mk
new file mode 100755
index 0000000..d61ca11
--- /dev/null
+++ b/btconfig_1.05/Android.mk
@@ -0,0 +1,21 @@
+ifeq ($(BOARD_HAVE_BLUETOOTH),true)
+
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_C_INCLUDES:= \
+	$(call include-path-for,bluez)/lib/ \
+
+LOCAL_SRC_FILES:= \
+	compat/getline.c \
+	btconfig.c
+
+LOCAL_SHARED_LIBRARIES := \
+	libbluetooth \
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES)
+LOCAL_MODULE_TAGS := eng
+LOCAL_MODULE:=btconfig
+
+include $(BUILD_EXECUTABLE)
+endif
diff --git a/btconfig_1.05/COPYING b/btconfig_1.05/COPYING
new file mode 100644
index 0000000..e90dfed
--- /dev/null
+++ b/btconfig_1.05/COPYING
@@ -0,0 +1,340 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year  name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.
diff --git a/btconfig_1.05/ChangeLog.txt b/btconfig_1.05/ChangeLog.txt
new file mode 100755
index 0000000..00581d5
--- /dev/null
+++ b/btconfig_1.05/ChangeLog.txt
@@ -0,0 +1,5 @@
+10/03/2012: define HI_MAGIC_NUMBER as unsigned short int, send sleep mode enabled command before do soft reset in master blaster mode since sleep mode is enabled from PS_ASIC.pst. version:1.05
+06/08/2012: Sync the structure tBtHost_Interest and PsSysCfgTransmitPowerControlEntry with BtTest version: 1.04
+04/26/2012: Support RX test and get BER at "Masterblaster" mode version: 1.03
+0
+03/14/2012: BtAgent is running at customer platform. It communicates with the host via USB. It looks like a router, which is forwarding packet between the host and AR3002. BtSoc.exe is running at the host. Like BtUART.exe, it can send command or receive event from AR3002 via BtAgent. version: 1.02
diff --git a/btconfig_1.05/Makefile b/btconfig_1.05/Makefile
new file mode 100755
index 0000000..520e903
--- /dev/null
+++ b/btconfig_1.05/Makefile
@@ -0,0 +1,23 @@
+ # Copyright (c) 2008-2009 Atheros Corporation. All rights reserved.
+ # 
+ # This program is free software; you can redistribute it and/or modify
+ # it under the terms of the GNU General Public License version 2 as
+ # published by the Free Software Foundation;
+ #
+ # Software distributed under the License is distributed on an "AS
+ # IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ # implied. See the License for the specific language governing
+ # rights and limitations under the License.
+ 
+
+CC := arm-none-linux-gnueabi-gcc
+CFLAGS=-I../../../bluez/bluez/lib/ -mtune=arm1136j-s -march=armv6
+LDFLAGS=-lbluetooth -L../../../bluez/dist/usr/lib -L../../../../a5s_linux_sdk/ambarella/prebuild/third-party/ncurses/lib/
+
+all: btconfig
+
+btconfig: btconfig.c
+	$(CC) -Wall -g btconfig.c $(CFLAGS) $(LDFLAGS)  -o btconfig
+
+clean:
+	rm btconfig  
diff --git a/btconfig_1.05/README b/btconfig_1.05/README
new file mode 100755
index 0000000..21a93cf
--- /dev/null
+++ b/btconfig_1.05/README
@@ -0,0 +1,68 @@
+Compilation Instructions
+========================
+
+In order to compile Bluetooth utilities you need following software packages:
+        - Linux Bluetooth protocol stack (BlueZ)
+        - GCC compiler
+        - D-Bus library
+        - GLib library
+        - Lexical Analyzer (flex, lex)
+        - YACC (yacc, bison, byacc)
+
+To install these packages, switch to root previlege.
+
+Fedora Core:
+1] Linux Bluetooth protocol stack (BlueZ):
+	Download latest source code of BlueZ stack from:
+		http://www.bluez.org/download/
+2]GCC Compiler:
+	=>yum install gcc
+
+3]D-Bus library:
+	=>yum install dbus
+
+4]Lexical Analyzer (flex, lex)
+	=>yum install flex
+
+5]YACC (yacc, bison, byacc)
+	=>yum install byacc bison
+
+
+Ubuntu:
+1] Linux Bluetooth protocol stack (BlueZ):
+        Download latest source code of BlueZ stack from:
+                http://www.bluez.org/download/
+
+2]GCC Compiler:
+	=>sudo apt-get install gcc
+
+3]D-Bus library
+	=>sudo apt-get install libdbus-glib-1-dev
+
+4]Lexical Analyzer (flex, lex)
+	=>sudo apt-get install flex
+
+5]YACC (yacc, bison, byacc)
+	=>sudo apt-get install byacc
+
+After downloading these packages please follow README file from bluez source folder to install Bluez stack.
+
+Once BlueZ Stack is installed, go to btconfig folder and give make command to compile btconfig source code:
+	=>make 
+	
+	"btconfig" executable will be genearated and copied to /usr/bin folder, so that you can access it from any location.
+
+Application usage
+=================
+
+Use following command to get help about the features supported by btconfig:
+	=> btconfig --help
+	=> btconfig
+
+To get the help about syntax and additional parameters of the command:
+	E.g. To get help about Write BD Address (wba) command
+	=> btconfig wba
+	Read PS tag operation
+	=> btconfig rpst
+
+
diff --git a/btconfig_1.05/btconfig.c b/btconfig_1.05/btconfig.c
new file mode 100755
index 0000000..a3dc89b
--- /dev/null
+++ b/btconfig_1.05/btconfig.c
@@ -0,0 +1,5308 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Corporation. All rights reserved.
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation;
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * <Configuration utility for AR3001>
+ *
+ * <btconfig.c>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <errno.h>
+#include <ctype.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <signal.h>
+#include <time.h>
+#include <sys/param.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <linux/types.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <bluetooth/bluetooth.h>
+#include <bluetooth/hci.h>
+#include <bluetooth/hci_lib.h>
+
+#include "compat/getline.h"
+#include "btconfig.h"
+#include "masterblaster.h"
+
+#define BT_PORT 2398
+/* Global Variables */
+static int sid, cid, aid;
+static int Tag_Count = 0;
+static int Patch_Count = 0;
+static unsigned short DynMem_Count = 0;
+static int Total_tag_lenght = 0;
+static BOOL CtrlCBreak = FALSE;
+bdaddr_t BdAddr;
+/* Function Declarations */
+static int LoadConfFile(const char *path, int basetag, int format);
+static int ParseFiles(FILE *fpt, int basetag, int format);
+static void LoadPSHeader(UCHAR *HCI_PS_Command,UCHAR opcode,int length,int index);
+static BOOL PSOperations(int dd, UCHAR Opcode, int Param1, UINT32 *out);
+static BOOL SU_LERxTest(int dev_id, UCHAR channel);
+static BOOL SU_LETxTest(int dev_id, UCHAR channel, UCHAR length, UCHAR payload);
+static int PSInit(int dd);
+static void usage(void);
+static int writeHciCommand(int dd, uint16_t ogf, uint16_t ocf, uint8_t plen, UCHAR *buf);
+static int MemBlkRead(int dd, UINT32 Address,UCHAR *pBuffer, UINT32 Length);
+static int MemBlkwrite(int dd, UINT32 Address,UCHAR *pBuffer, UINT32 Length);
+static int Dut(int dd);
+static int ReadAudioStats(int dd);
+static int ReadGlobalDMAStats(int dd);
+static int ResetGlobalDMAStats(int dd);
+static int ReadTpcTable(int dd);
+static int ReadHostInterest(int dd,tBtHostInterest *pHostInt);
+static int ReadMemoryBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length );
+static int WriteMemoryBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length );
+static int write_otpRaw(int dev_id, int address, int length, UCHAR *data);
+static int read_otpRaw(int dev_id, int address, int length, UCHAR *data);
+static void dumpHex(UCHAR *buf, int length, int col);
+static void sig_term(int sig);
+static UCHAR LEMode = 0;
+
+static struct option main_options[] = {
+	{ "help",	0, 0, 'h' },
+	{ "device",	1, 0, 'i' },
+	{ 0, 0, 0, 0 }
+};
+//Read the configuration files, file paths are hardcoded in btconfig.h
+static int LoadConfFile(const char *path, int basetag, int format){
+
+	FILE *fp;
+	//printf("\nOpening file :%s\n",path);
+	fp = fopen(path,"r");
+	if(fp == NULL){
+	//	perror("File open error");
+		return FALSE;
+	}
+	// Parse file
+	if(!ParseFiles(fp,basetag,format)){
+		printf("\nError :Invalid file format\n");
+		return FALSE;
+	}	
+	// Load conf data to PS
+	
+	fclose(fp);
+	return TRUE;
+}
+
+
+unsigned int uGetInputDataFormat(char **str, struct ST_PS_DATA_FORMAT *pstFormat) 
+{
+	char *pCharLine = *str;
+	if(pCharLine[0] != '[') {
+		pstFormat->eDataType = eHex;
+		pstFormat->bIsArray = TRUE;
+		return TRUE;
+	}
+	switch(pCharLine[1]) {
+		case 'H':
+		case 'h':
+        if(pCharLine[2]==':') {
+			if((pCharLine[3]== 'a') || (pCharLine[3]== 'A')) {
+				if(pCharLine[4] == ']') {
+					pstFormat->eDataType = eHex;
+					pstFormat->bIsArray = TRUE;
+					//pCharLine += 5;
+					*str += 5;
+					return TRUE;
+				}
+				else {
+				   	printf("\nuGetInputDataFormat - Invalid Data Format \r\n"); //[H:A
+					return FALSE;
+				}
+			}
+			if((pCharLine[3]== 'S') || (pCharLine[3]== 's')) {
+				if(pCharLine[4] == ']') {
+					pstFormat->eDataType = eHex;
+					pstFormat->bIsArray = FALSE;
+					//pCharLine += 5;
+					*str += 5;
+					//printf("\nDEBUG H-1:%s\n",pCharLine);
+					return TRUE;
+				}
+				else {
+				   	printf("\nuGetInputDataFormat - Invalid Data Format \r\n"); //[H:A
+					return FALSE;
+				}
+			}
+			else if(pCharLine[3] == ']') {         //[H:]
+				pstFormat->eDataType = eHex;
+				pstFormat->bIsArray = TRUE;
+				//pCharLine += 4;
+				*str += 4;
+				return TRUE;
+			}
+			else {                            //[H:
+				printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+				return FALSE;					
+			}
+		}
+		else if(pCharLine[2]==']') {    //[H]
+			pstFormat->eDataType = eHex;
+			pstFormat->bIsArray = TRUE;
+			//pCharLine += 3;
+			*str += 5;
+			return TRUE;
+		}
+		else {                      //[H
+			printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+			return FALSE;			
+		}
+		break;
+
+		case 'A':
+		case 'a':
+        if(pCharLine[2]==':') {
+			if((pCharLine[3]== 'h') || (pCharLine[3]== 'H')) {
+				if(pCharLine[4] == ']') {
+					pstFormat->eDataType = eHex;
+					pstFormat->bIsArray = TRUE;
+					//pCharLine += 5;
+					*str += 5;
+					return TRUE;
+				}
+				else {
+					printf("\nuGetInputDataFormat - Invalid Data Format \r\n"); //[A:H
+					return FALSE;
+				}
+		 	}
+			else if(pCharLine[3]== ']') {         //[A:]
+				pstFormat->eDataType = eHex;
+				pstFormat->bIsArray = TRUE;
+				//pCharLine += 4;
+				*str += 5;
+				return TRUE;
+			}
+			else {                            //[A:
+				printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+				return FALSE;					
+			}
+        }
+		else if(pCharLine[2]==']') {    //[H]
+			pstFormat->eDataType = eHex;
+			pstFormat->bIsArray = TRUE;
+			//pCharLine += 3;
+			*str += 5;
+			return TRUE;
+		}
+		else {                      //[H
+			printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+			return FALSE;			
+		}
+		break;
+
+		case 'S':
+		case 's':
+        if(pCharLine[2]==':') {
+			if((pCharLine[3]== 'h') || (pCharLine[3]== 'H')) {
+				if(pCharLine[4] == ']') {
+					pstFormat->eDataType = eHex;
+					pstFormat->bIsArray = TRUE;
+					//pCharLine += 5;
+					*str += 5;
+					return TRUE;
+				}
+				else {
+					printf("\nuGetInputDataFormat - Invalid Data Format \r\n");//[A:H
+					return FALSE;
+				}
+		 	}
+			else if(pCharLine[3]== ']') {         //[A:]
+				pstFormat->eDataType = eHex;
+				pstFormat->bIsArray = TRUE;
+				//pCharLine += 4;
+				*str += 5;
+				return TRUE;
+			}
+			else {                            //[A:
+				printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+				return FALSE;					
+			}
+        }
+		else if(pCharLine[2]==']') {    //[H]
+			pstFormat->eDataType = eHex;
+			pstFormat->bIsArray = TRUE;
+			//pCharLine += 3;
+			*str += 5;
+			return TRUE;
+		}
+		else {                      //[H
+			printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+			return FALSE;			
+		}
+		break;
+	
+		default:
+		printf("\nuGetInputDataFormat - Invalid Data Format \r\n");
+		return FALSE;
+	}
+}
+
+unsigned int uReadDataInSection(char *pCharLine, struct ST_PS_DATA_FORMAT stPS_DataFormat)
+{
+	if(stPS_DataFormat.eDataType == eHex) {
+		if(stPS_DataFormat.bIsArray == TRUE) {
+            //Not implemented
+            		printf("\nNO IMP\n");
+            		return (0x0FFF);
+		}
+		else {
+			//printf("\nDEBUG H-2 %d\n",strtol(pCharLine, NULL, 16));
+			return (strtol(pCharLine, NULL, 16));
+		}
+	}
+	else {
+        //Not implemented
+        	printf("\nNO IMP-1\n");
+        	return (0x0FFF);
+	}
+}
+
+
+static int ParseFiles(FILE *fpt, int basetag, int format){
+	int i,j,k,linecnt,ByteCount=0,ByteCount_Org =0,data,Cnt;
+	char *str,line[LINE_SIZE_MAX],byte[3];
+	int ParseSelection=RAM_PS_SECTION;
+	struct ST_PS_DATA_FORMAT stPS_DataFormat;
+	struct ST_READ_STATUS   stReadStatus = {0, 0, 0,0};
+	unsigned int uReadCount;
+
+	switch(format){	
+		case MB_FILEFORMAT_PS:
+			linecnt = 0;
+			j=0;
+
+			while ((str = fgets(line, LINE_SIZE_MAX, fpt)) != NULL) {
+			SKIP_BLANKS(str);
+			//Comment line
+			if ((str[0]== '/') && (str[1]== '/'))
+				continue;
+		
+			if (str[0]== '#'){
+				if (stReadStatus.uSection != 0){
+			 		printf("\nParseFiles - Invalid file format %d\r\n",ParseSelection);
+			 		return FALSE;
+				 }
+			 	else {
+					 stReadStatus.uSection = 1;
+					 continue;
+			 	}
+			
+			}
+			if ((str[0]== '/') && (str[1]== '*'))
+			{
+				str+=2;
+				SKIP_BLANKS(str);
+				if(!strncmp(str,"PA",2)||!strncmp(str,"Pa",2)||!strncmp(str,"pa",2)){
+					
+					ParseSelection=RAM_PATCH_SECTION;
+				}
+				if(!strncmp(str,"DY",2)||!strncmp(str,"Dy",2)||!strncmp(str,"dy",2)){
+					
+					ParseSelection=RAM_DYN_MEM_SECTION;
+				}
+				if(!strncmp(str,"PS",2)||!strncmp(str,"Ps",2)||!strncmp(str,"ps",2)){
+					
+					ParseSelection=RAM_PS_SECTION;
+				}
+				linecnt = 0;
+				stReadStatus.uSection = 0;
+				continue;
+			}
+		
+			switch(ParseSelection){
+
+				case RAM_PS_SECTION:
+					if (stReadStatus.uSection == 1){ //TagID
+		         			SKIP_BLANKS(str);	
+						if(!uGetInputDataFormat(&str, &stPS_DataFormat)) {
+							return FALSE;
+                    				}	
+						PsTagEntry[Tag_Count].TagId = uReadDataInSection(str, stPS_DataFormat);
+						stReadStatus.uSection = 2;
+					}
+					else if (stReadStatus.uSection == 2){ //TagLength
+						if(!uGetInputDataFormat(&str, &stPS_DataFormat)) {
+							return FALSE;
+						}
+						ByteCount = uReadDataInSection(str, stPS_DataFormat);
+
+		            			if (ByteCount > RAMPS_MAX_PS_DATA_PER_TAG){
+			                		printf("\nParseFiles - INVALID %d: One of the table exceeds maximum table size of %d\r\n",ParseSelection, MAX_RADIO_CFG_TABLE_SIZE);
+		        				return FALSE;
+		        	    		}
+		           			 PsTagEntry[Tag_Count].TagLen = (ByteCount & 0xFF);
+						 stReadStatus.uSection = 3;
+						 stReadStatus.uLineCount = 0;
+		         		}
+					else if( stReadStatus.uSection == 3) {  //Data
+				        	if(stReadStatus.uLineCount == 0) {
+							if(!uGetInputDataFormat(&str,&stPS_DataFormat)) {
+								return FALSE;
+							}
+        		            		}
+					   	SKIP_BLANKS(str);
+                    				stReadStatus.uCharCount = 0;
+						uReadCount = (ByteCount > BYTES_OF_PS_DATA_PER_LINE)? BYTES_OF_PS_DATA_PER_LINE: ByteCount;
+						if((stPS_DataFormat.eDataType == eHex) && stPS_DataFormat.bIsArray == TRUE) {
+                       					while(uReadCount > 0) {
+		                 				PsTagEntry[Tag_Count].TagData[stReadStatus.uByteCount] = (UCHAR)(CONV_HEX_DIGIT_TO_VALUE(str[stReadStatus.uCharCount]) << 4) | (UCHAR)(CONV_HEX_DIGIT_TO_VALUE(str[stReadStatus.uCharCount + 1]));
+		                   				PsTagEntry[Tag_Count].TagData[stReadStatus.uByteCount+1] = (UCHAR)(CONV_HEX_DIGIT_TO_VALUE(str[stReadStatus.uCharCount + 3]) << 4) | (UCHAR)(CONV_HEX_DIGIT_TO_VALUE(str[stReadStatus.uCharCount + 4]));
+					       			stReadStatus.uCharCount += 6; // read two bytes, plus a space;
+					       			stReadStatus.uByteCount += 2;
+					       			uReadCount -= 2;
+                       					}
+
+					   if(ByteCount > BYTES_OF_PS_DATA_PER_LINE) {
+					   	   ByteCount -= BYTES_OF_PS_DATA_PER_LINE;
+					   }
+					   else {
+						  ByteCount = 0;
+					   }
+					}
+					else {
+						//to be implemented
+						printf("\nParseFiles - To be implemented");
+					}
+
+					stReadStatus.uLineCount++;
+					
+					if(ByteCount == 0) {
+						stReadStatus.uSection = 0;
+						stReadStatus.uCharCount = 0;
+						stReadStatus.uLineCount = 0;
+						stReadStatus.uByteCount = 0;
+					}
+					else { 
+					    stReadStatus.uCharCount = 0;
+					}
+					
+		            		if((stReadStatus.uSection == 0)&&(++Tag_Count == RAMPS_MAX_PS_TAGS_PER_FILE))
+		            		{
+						printf("\n ParseFiles - INVALID %d: Number of tables exceeds %d\r\n",ParseSelection, RAMPS_MAX_PS_TAGS_PER_FILE);
+		            			return FALSE;
+					}
+		
+		         
+				}
+				break;
+				default:
+	    	 		{
+					printf("\nParseFiles - Invalid file format %d\r\n",ParseSelection);
+				        return FALSE;
+				}
+				break;
+	
+					
+		}
+		linecnt++;	
+	}
+		break;
+	case MB_FILEFORMAT_DY:
+	{
+		linecnt = 0;
+		while ((str = fgets(line, LINE_SIZE_MAX, fpt)) != NULL) {
+			SKIP_BLANKS(str);
+			//Comment line
+			if ((str[0]== '/') && (str[1]== '/'))
+				continue;
+		
+			if ((str[0]== '/') && (str[1]== '*'))
+			{
+				continue;
+			}
+		
+	
+			if((linecnt % 2) == 0)
+			{
+	  			ByteCount = (UINT16)strtol(str, NULL, 16);
+		  		RamDynMemOverride.Len= (ByteCount & 0xFF);
+			}
+	  		else
+			{
+				for (i=0,k=0; k < ByteCount; i += 2,k++) {
+					memcpy(byte, &str[i], 2);
+					byte[2] = '\0';
+					data = strtoul(byte, NULL, 16);
+					RamDynMemOverride.Data[k] = (data & 0xFF);
+				}
+				DynMem_Count = TRUE;
+			}
+			linecnt++;
+		}
+	}
+		break;
+	case MB_FILEFORMAT_PATCH:
+	{
+		j=0;
+		Cnt=0;
+		linecnt = 0;
+		while ((str = fgets(line, LINE_SIZE_MAX, fpt)) != NULL) {
+			SKIP_BLANKS(str);
+			//Comment line
+			if ((str[0]== '/') && (str[1]== '/'))
+				continue;
+		
+			if ((str[0]== '/') && (str[1]== '*'))
+			{
+				continue;
+			}
+	
+			if(linecnt==0)
+			{
+				ByteCount = (UINT16)strtol(str, NULL, 16);
+				ByteCount_Org = ByteCount;
+				while(ByteCount > MAX_BYTE_LENGTH){
+					RamPatch[Patch_Count].Len= MAX_BYTE_LENGTH;
+					Patch_Count ++;
+					ByteCount= ByteCount - MAX_BYTE_LENGTH;
+				}
+				RamPatch[Patch_Count].Len= (ByteCount & 0xFF);
+				Patch_Count ++;
+	
+			}
+			else
+			{
+				while(ByteCount_Org > MAX_BYTE_LENGTH){
+					for (i = 0, k=0; i < MAX_BYTE_LENGTH*2; i += 2,k++) {
+						memcpy(byte, &str[Cnt], 2);
+						byte[2] = '\0';
+						data = strtoul(byte, NULL, 16);
+						RamPatch[j].Data[k] = (data & 0xFF);
+						Cnt += 2;
+					}
+					j++;
+					ByteCount_Org = ByteCount_Org - MAX_BYTE_LENGTH;
+				}
+				if(j == 0){
+					j++;
+				}
+				for (k=0; k < ByteCount_Org;k++) {
+					memcpy(byte, &str[Cnt], 2);
+					byte[2] = '\0';
+					data = strtoul(byte, NULL, 16);
+					RamPatch[j].Data[k] = (data & 0xFF);
+					Cnt += 2;
+				}
+			}
+	
+			linecnt++;	
+		}
+			
+	}
+	break;
+
+
+	
+	}
+	return TRUE;
+}
+
+static void LoadPSHeader(UCHAR *HCI_PS_Command,UCHAR opcode,int length,int index) {
+	
+	HCI_PS_Command[0]= opcode;
+	HCI_PS_Command[1]= (index & 0xFF);
+	HCI_PS_Command[2]= ((index>>8) & 0xFF);	
+	HCI_PS_Command[3]= length;	
+
+}
+
+
+static BOOL PSOperations(int dd, UCHAR Opcode, int Param1, UINT32 *out) {
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int Length,i,j,iRet;
+	memset(&buf,0,sizeof(buf));
+	switch(Opcode){
+		case WRITE_PATCH:
+			for(i=0;i< Param1;i++){
+				LoadPSHeader(buf,Opcode,RamPatch[i].Len,i);
+				for(j=0;j<RamPatch[i].Len;j++){
+					buf[4+j]=RamPatch[i].Data[j];
+				}
+				iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_PS,RamPatch[i].Len + PS_COMMAND_HEADER, buf);
+				if(buf[iRet-1] != 0){
+					return FALSE;
+				}
+			}
+			break;
+
+		case ENABLE_PATCH:
+			Length =0;
+			i=0;
+			LoadPSHeader(buf,Opcode,Length,i);
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0){
+				return FALSE;
+			}
+			break;
+
+		case PS_RESET:
+			Length =0;
+			i=0;
+			LoadPSHeader(buf,Opcode,Length,i);
+			buf[8] = (Param1 & 0xFF);
+			buf[9] = ((Param1 >>  8) & 0xFF);
+			Length = 6;
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,Length + PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0){
+				return FALSE;
+			}
+			break;
+
+		case PS_READ: {
+			UCHAR *len = (UCHAR *)out;
+			ssize_t plen = 0;
+			Length = len[0] | ( len[1] << 8);
+			LoadPSHeader(buf,Opcode,Length,Param1);
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS, Length + PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0) {
+				return FALSE;
+			}
+			do {
+				plen = read(dd, buf, HCI_MAX_EVENT_SIZE);
+				if (plen < 0)
+					return FALSE;
+			} while (buf[HCI_EVENT_HEADER_SIZE] != DEBUG_EVENT_TYPE_PS);
+			memcpy((UCHAR *)out, buf + HCI_EVENT_HEADER_SIZE + 1, plen - HCI_EVENT_HEADER_SIZE - 1);
+			break;
+		}
+
+		case PS_WRITE:
+			for(i=0;i< Param1;i++){
+				LoadPSHeader(buf,Opcode,PsTagEntry[i].TagLen,PsTagEntry[i].TagId);
+				for(j=0;j<PsTagEntry[i].TagLen;j++){
+					buf[4+j]=PsTagEntry[i].TagData[j];
+				}
+				iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PsTagEntry[i].TagLen + PS_COMMAND_HEADER, buf);
+				if(buf[iRet-1] != 0){
+					return FALSE;
+				}
+			}
+			break;
+
+		case PS_DYNMEM_OVERRIDE:
+			LoadPSHeader(buf,Opcode,RamDynMemOverride.Len,RamDynMemOverride.Len);
+			for(j=0;j<RamDynMemOverride.Len;j++){
+				buf[4+j]=RamDynMemOverride.Data[j];
+			}
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_PS,RamDynMemOverride.Len + PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0){
+				return FALSE;
+			}
+			break;
+
+		case PS_VERIFY_CRC:
+			//printf("PSOperations - PS_VERIFY_CRC:VALUE of CRC:%d\r\n",Param1); 
+			Length =0;
+			LoadPSHeader(buf,Opcode,Length,Param1);
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS, PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0){
+				return FALSE;
+			}
+			break;
+
+		case PS_GET_LENGTH: {
+			ssize_t plen = 0;
+			LoadPSHeader(buf,Opcode,0,Param1);
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS, PS_COMMAND_HEADER, buf);
+			if(buf[iRet-1] != 0){
+				return FALSE;
+			}
+			do {
+				plen = read(dd, buf, HCI_MAX_EVENT_SIZE);
+				if (plen < 0)
+					return FALSE;
+			} while (buf[HCI_EVENT_HEADER_SIZE] != DEBUG_EVENT_TYPE_PS);
+			*((UINT16 *)out) = (buf[HCI_EVENT_HEADER_SIZE + 2] << 8) | buf[HCI_EVENT_HEADER_SIZE + 1];
+			break;
+		}
+	}
+		return TRUE;
+}
+
+
+static int GetDeviceType(int dd){
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int iRet;
+	unsigned int Reg = 0;
+
+	memset(&buf,0,sizeof(buf));
+	buf[0] = (FPGA_REGISTER & 0xFF);
+	buf[1] = ((FPGA_REGISTER >> 8) & 0xFF);
+	buf[2] = ((FPGA_REGISTER >> 16) & 0xFF);
+	buf[3] = ((FPGA_REGISTER >> 24) & 0xFF); 
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY,4, buf);
+	if(buf[6] != 0){
+		return FALSE;
+	}
+
+	Reg = buf[10];
+	Reg = ((Reg << 8) | buf[9]);
+	Reg = ((Reg << 8) | buf[8]);
+	Reg = ((Reg << 8) | buf[7]);
+	return Reg;
+}
+/* PS Operations */
+static int PSInit(int dd){
+	int i,Crc=0,DevType =0; 
+   	BOOL BDADDR_Present = 0;	
+	BOOL File_Present = 0;
+	
+	//DevType = GetDeviceType(dd);
+	//printf("\nDevice Type:%x\n",DevType);
+	if(DevType){
+		if(DevType == 0xdeadc0de){
+		
+			if(!LoadConfFile(PS_ASIC_FILENAME,0xFFFFFFFF,MB_FILEFORMAT_PS)){
+				printf("\nPlease copy PS file to :%s\n",PS_ASIC_FILENAME);
+				//return FALSE;
+			}
+			else
+				File_Present = 1;
+		}
+		else{
+			if(!LoadConfFile(PS_FPGA_FILENAME,0xFFFFFFFF,MB_FILEFORMAT_PS)){
+				printf("\nPlease copy PS file to :%s\n",PS_FPGA_FILENAME);
+				File_Present = 1;
+				//return FALSE;
+			}
+			else
+				File_Present = 1;
+		}
+	}
+	else{
+		if(!LoadConfFile(PS_ASIC_FILENAME,0xFFFFFFFF,MB_FILEFORMAT_PS)){
+				printf("\nPlease copy PS file to :%s\n",PS_ASIC_FILENAME);
+				File_Present = 1;
+				//return FALSE;
+		}
+		else
+			File_Present = 1;
+	}
+
+	if(!LoadConfFile(PATCH_FILENAME,0xFFFFFFFF,MB_FILEFORMAT_PATCH)){
+		printf("\nPlease copy Patch file to :%s\n",PATCH_FILENAME);
+		File_Present = 1;
+	}
+	else
+		File_Present = 1;
+	
+	if(!File_Present){
+		printf("\nPS and Patch files are not present\n");
+		return FALSE;
+	}
+	if(Tag_Count == 0){
+		Total_tag_lenght = 10;
+
+	}
+	else{
+		for(i=0; i<Tag_Count; i++){
+			if(PsTagEntry[i].TagId == 1){
+				BDADDR_Present = TRUE;
+				//printf("ReadPSFiles - BD ADDR is present in Patch File \r\n");
+			}
+		
+			if(PsTagEntry[i].TagLen % 2 == 1){
+				Total_tag_lenght = Total_tag_lenght + PsTagEntry[i].TagLen + 1;
+			}
+			else{
+				Total_tag_lenght = Total_tag_lenght + PsTagEntry[i].TagLen;
+			}
+		
+		}
+	}
+	
+	if(Tag_Count > 0 && !BDADDR_Present){
+		//printf("\nReadPSFiles - BD ADDR is not present adding 10 extra bytes \r\n");
+		Total_tag_lenght=Total_tag_lenght + 10;
+	}
+	Total_tag_lenght = Total_tag_lenght+ 10 + (Tag_Count*4);
+
+//	printf("\nPSInitialize - PATCH:%d, DYN:%d, TAG:%d Total_tag_lenght:%d\n",Patch_Count,DynMem_Count,Tag_Count,Total_tag_lenght);
+	
+	if(Patch_Count > 0)
+		Crc |= RAM_PATCH_REGION;
+	if(DynMem_Count)
+		Crc |= RAM_DYN_MEM_REGION;
+	if(Tag_Count > 0)
+		Crc |= RAM_PS_REGION;
+
+	if(Patch_Count || DynMem_Count || Tag_Count ){
+		if(Patch_Count > 0){
+			if(!PSOperations(dd,WRITE_PATCH,Patch_Count, NULL)){
+				printf("\nPSInitialize - *** WRITE_PATCH FAILED**** \r\n");
+				return FALSE;
+			}
+			if(!PSOperations(dd,ENABLE_PATCH,0, NULL)){
+				printf("\nPSInitialize - *** ENABLE_PATCH FAILED**** \r\n");
+				return FALSE;
+			}
+		}
+		if(DynMem_Count){
+			if(!PSOperations(dd,PS_DYNMEM_OVERRIDE,DynMem_Count, NULL)){
+				printf("\nPSInitialize - *** PS_DYNMEM_OVERRIDE FAILED**** \r\n");
+				return FALSE;
+			}
+		}
+		if(!PSOperations(dd,PS_RESET,Total_tag_lenght, NULL)){
+			printf("\nPSInitialize - *** PS RESET FAILED**** \r\n");
+			return FALSE;
+		}
+		if(Tag_Count > 0){
+			if(!PSOperations(dd,PS_WRITE,Tag_Count, NULL)){
+				printf("\nPSInitialize - *** PS_WRITE FAILED**** \r\n");
+				return FALSE;
+			}
+		}	
+		
+	}	
+	
+	if(!PSOperations(dd,PS_VERIFY_CRC,Crc, NULL)){
+		printf("\nVerify CRC failed\n");	
+		return FALSE;
+	}
+	return TRUE;
+
+}
+
+static int writeHciCommand(int dd, uint16_t ogf, uint16_t ocf, uint8_t plen, UCHAR *buf){
+#ifdef DUMP_DEBUG
+#define cmd_opcode_pack(ogf, ocf) (uint16_t)((ocf & 0x03ff)|(ogf << 10))
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define htobs(d)	(d)
+#elif __BYTE_ORDER == __BIG_ENDIAN
+#define htobs(d)	bswap_16(d);
+#else
+#error "Unknown byte order"
+#endif
+	int i = 0, j = 0;
+	uint16_t opcode = htobs(cmd_opcode_pack(ogf, ocf));
+	
+	printf("\nDump:\n");
+	printf("0x%02X ", opcode & 0xff);
+	i++;
+	printf("0x%02X ", (opcode & 0xff00) >> 8);
+	i++;
+	printf("0x%02X ", plen);
+	i++;
+	for (j = 0; j < plen; i++, j++) {
+		printf("0x%02X ", buf[j]);
+		if (((i+1) % 8) == 0 && i != 0)
+			printf("\n");
+	}
+	if (((i+1) % 8) != 0) printf("\n");
+	buf[6] = 0;
+	return plen;
+#else
+	struct hci_filter flt;
+        uint16_t opcode, topcode;
+
+	/* Setup filter */
+	hci_filter_clear(&flt);
+	hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
+	hci_filter_all_events(&flt);
+	if (setsockopt(dd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+		perror("HCI filter setup failed");
+		exit(EXIT_FAILURE);
+	}
+
+	//printf("< HCI Command: ogf 0x%02x, ocf 0x%04x, plen %d\n", ogf, ocf, plen);
+	if (hci_send_cmd(dd, ogf, ocf, plen, buf) < 0) {
+		perror("Send failed");
+		hci_close_dev(dd);
+		exit(EXIT_FAILURE);
+	}
+	sleep(0.4);
+        opcode = (ogf << 10 | ocf);
+        do {
+	    plen = read(dd, buf,HCI_MAX_EVENT_SIZE);
+	    if (plen < 0) {
+		    perror("Read failed");
+		    hci_close_dev(dd);
+		    exit(EXIT_FAILURE);
+	    }
+	    topcode=(uint16_t)(buf[4] | (buf[5] << 8));
+        }while(topcode != opcode);
+	return plen;
+#endif
+}
+static int MemBlkRead(int dd,UINT32 Address,UCHAR *pBuffer, UINT32 Length){
+	UINT32         Size, ByteLeft,IntCnt;
+   	UCHAR          *pData,*pTemp=pBuffer;
+	int iRet;	
+       	int TempVal;
+
+	IntCnt =0;
+       	TempVal = (Length % 4);
+	if (TempVal !=0)
+       	{
+          Length = Length + (4- (Length%4));
+       	}
+        ByteLeft = Length;
+	while (ByteLeft > 0)
+   	{
+		Size = (ByteLeft > MEM_BLK_DATA_MAX) ? MEM_BLK_DATA_MAX : ByteLeft;
+	//	printf("\nMemBlkwrite : Size :%x   Address :%x\n",Size, Address);
+		pData = (UCHAR *) malloc(Size + 6);
+		pData[0]= 0x00;//depot/esw/projects/azure/AR3001_3_0/src/hci/Hci_Vsc_Proc.c
+		pData[1]= (Address & 0xFF);
+		pData[2]= ((Address >> 8) & 0xFF);
+		pData[3]= ((Address >> 16) & 0xFF);
+		pData[4]= ((Address >> 24) & 0xFF);
+		pData[5]= Size;
+		iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_MEMOP,6,pData);
+		if(pData[6]!= 0){
+			printf("\nwrite memory command failed due to reason 0x%X\n",pData[6]);	
+			free(pData);
+			return FALSE;
+		}
+		if ((read(dd, pData,HCI_MAX_EVENT_SIZE)) < 0) {
+			perror("Read failed");
+			exit(EXIT_FAILURE);
+	    	}
+
+	    	if(pData[3]!=3) {
+  			perror("Read failed");
+			exit(EXIT_FAILURE);
+	    	}
+	    	memcpy(pTemp,(pData+4),Size);
+		pTemp+=Size;
+	        IntCnt = Size;
+     		ByteLeft -= Size;
+	    	Address += Size;
+		free(pData);
+   	} 
+  	return TRUE;
+}
+
+
+static int MemBlkwrite(int dd,UINT32 Address,UCHAR *pBuffer, UINT32 Length){
+	UINT32         Size, ByteLeft,IntCnt;
+   	UCHAR          *pData;
+	int iRet;	
+	ByteLeft = Length;
+	IntCnt =0;
+	while (ByteLeft > 0)
+   	{
+	      	
+		Size = (ByteLeft > MEM_BLK_DATA_MAX) ? MEM_BLK_DATA_MAX : ByteLeft;
+	//	printf("\nMemBlkwrite : Size :%x   Address :%x\n",Size, Address);
+		pData = (UCHAR *) malloc(Size + 6);
+		pData[0]= 0x01;
+		pData[1]= (Address & 0xFF);
+		pData[2]= ((Address >> 8) & 0xFF);
+		pData[3]= ((Address >> 16) & 0xFF);
+		pData[4]= ((Address >> 24) & 0xFF);
+		pData[5]= Size;
+		memcpy(&pData[6],&pBuffer[IntCnt],Size);
+		iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_MEMOP,Size+6,pData);
+		if(pData[6]!= 0){
+			printf("\nwrite memory command faileddue to reason 0x%X\n",pData[6]);	
+			free(pData);
+			return FALSE;
+		}
+	      	IntCnt = Size;
+      		ByteLeft -= Size;
+	      	Address += Size;
+		free(pData);
+   	}
+  	return TRUE;
+}
+
+static int Dut(int dd){
+	int iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 3; //All scan enabled
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite scan mode command failed due to reason 0x%X\n",buf[6]);
+		return FALSE;
+	}
+	sleep(1);
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);	
+	iRet = writeHciCommand(dd, OGF_TEST_CMD, OCF_ENABLE_DEVICE_UNDER_TEST_MODE, 0, buf);	
+	if(buf[6] != 0){
+		printf("\nDUT mode command failed due to reason 0x%X\n",buf[6]);
+		return FALSE;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);	
+	buf[0] = 0; //SEQN Track enable =0
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_TEST_MODE_SEQN_TRACKING , 1, buf);	
+	if(buf[6] != 0){
+		printf("\nTest Mode seqn Tracking failed due to reason 0x%X\n",buf[6]);
+		return FALSE;
+	}
+	return TRUE;
+}
+
+
+void Audio_DumpStats(tAudioStat *AudioStats)
+{
+  printf("\n\n");
+  printf("    Audio Statistics\n");
+  printf(">RxCmplt:                 %d\n",AudioStats->RxCmplt);
+  printf(">TxCmplt:                 %d\n",AudioStats->TxCmplt);
+  printf(">RxSilenceInsert:         %d\n",AudioStats->RxSilenceInsert);
+  printf(">RxAirPktDump:            %d\n",AudioStats->RxAirPktDump);
+  printf(">MaxPLCGenInterval:       %d\n",AudioStats->MaxPLCGenInterval);
+  printf(">RxAirPktStatusGood:      %d\n",AudioStats->RxAirPktStatusGood);
+  printf(">RxAirPktStatusError:     %d\n",AudioStats->RxAirPktStatusError);
+  printf(">RxAirPktStatusLost:      %d\n",AudioStats->RxAirPktStatusLost);
+  printf(">RxAirPktStatusPartial:   %d\n",AudioStats->RxAirPktStatusPartial);
+  printf(">SampleMin:               %d\n",AudioStats->SampleMin);
+  printf(">SampleMax:               %d\n",AudioStats->SampleMax);
+  printf(">SampleCounter:           %d\n",AudioStats->SampleCounter);
+  printf("\n\n");
+
+  memset((UCHAR *)AudioStats, 0, sizeof(tAudioStat));
+  AudioStats->SampleMax =SHRT_MIN;
+  AudioStats->SampleMin =SHRT_MAX;
+}
+
+static int ReadAudioStats(int dd){
+
+	tBtHostInterest	HostInt;
+	tAudioStat Stats;
+
+	ReadHostInterest(dd, &HostInt);
+	if(!HostInt.AudioStatAddr || (HostInt.Version < 0x0300)){
+		printf("\nAudio Stat not present\n");
+		return FALSE;
+	}
+	ReadMemoryBlock(dd,HostInt.AudioStatAddr,(UCHAR *)&Stats,sizeof(tAudioStat));
+	Audio_DumpStats(&Stats);
+	return TRUE;
+}
+
+void BRM_DumpStats(tBRM_Stats *Stats)
+{
+   printf("\n  Link Controller Voice DMA Statistics\n");
+   printf("  %22s: %u\n", "VoiceTxDmaIntrs", Stats->VoiceTxDmaIntrs);
+   printf("  %22s: %u\n", "VoiceTxPktAvail", Stats->VoiceTxPktAvail);
+   printf("  %22s: %u\n", "VoiceTxPktDumped", Stats->VoiceTxPktDumped);
+   printf("  %22s: %u\n", "VoiceTxErrors", Stats->VoiceTxErrorIntrs);
+   printf("  %22s: %u\n", "VoiceTxDmaErrors", Stats->VoiceTxDmaErrorIntrs);
+   printf("  %22s: %u\n", "VoiceTxSilenceInserts", Stats->VoiceTxDmaSilenceInserts);
+   printf("\n");
+   printf("  %22s: %u\n", "VoiceRxDmaIntrs", Stats->VoiceRxDmaIntrs);
+   printf("  %22s: %u\n", "VoiceRxGoodPkts", Stats->VoiceRxGoodPkts);
+   printf("  %22s: %u\n", "VoiceRxPktDumped", Stats->VoiceRxPktDumped);
+   printf("  %22s: %u\n", "VoiceRxErrors", Stats->VoiceRxErrorIntrs);
+   printf("  %22s: %u\n", "VoiceRxCRC", Stats->VoiceRxErrCrc);
+   printf("  %22s: %u\n", "VoiceRxUnderOverFlow", Stats->VoiceRxErrUnderOverFlow);
+   printf("\n");
+   printf("  %22s: %u\n", "SchedOnVoiceError", Stats->SchedOnVoiceError);
+   printf("  %22s: %u\n", "VoiceTxReapOnError", Stats->VoiceTxReapOnError);
+   printf("  %22s: %u\n", "VoiceRxReapOnError", Stats->VoiceRxReapOnError);
+   printf("  %22s: %u\n", "VoiceSchedulingError", Stats->VoiceSchedulingError);
+
+   printf("\n  Link Controller ACL DMA Statistics\n");
+   printf("  %22s: %u\n", "DmaIntrs", Stats->DmaIntrs);
+   printf("  %22s: %u\n", "ErrWrongLlid", Stats->ErrWrongLlid);
+   printf("  %22s: %u\n", "ErrL2CapLen", Stats->ErrL2CapLen);
+   printf("  %22s: %u\n", "ErrUnderOverFlow", Stats->ErrUnderOverFlow);
+   printf("  %22s: %u\n", "RxBufferDumped", Stats->RxBufferDumped);
+   printf("  %22s: %u\n", "ErrWrongLmpPktType", Stats->ErrWrongLmpPktType);
+   printf("  %22s: %u\n", "ErrWrongL2CapPktType", Stats->ErrWrongL2CapPktType);
+   printf("  %22s: %u\n", "IgnoredPkts", Stats->IgnoredPkts);
+   printf("\n");
+   printf("  %22s: %u\n", "Data TxBuffers", Stats->DataTxBuffers);
+   printf("  %22s: %u\n", "Data RxBuffers", Stats->DataRxBuffers);
+   printf("  %22s: %u\n", "LMP TxBuffers", Stats->LmpTxBuffers);
+   printf("  %22s: %u\n", "LMP RxBuffers", Stats->LmpRxBuffers);
+   printf("  %22s: %u\n", "HEC Errors", Stats->HecFailPkts);
+   printf("  %22s: %u\n", "CRC Errors", Stats->CrcFailPkts);
+
+   // Buffer Management
+   printf("\n  Buffer Management Statistics\n");
+   printf("  %22s: %u\n", "CtrlErrNoLmpBufs", Stats->CtrlErrNoLmpBufs);
+
+   printf("\n  Sniff Statistics\n");
+   printf("  %22s: %u\n", "SniffSchedulingError", Stats->SniffSchedulingError);
+   printf("  %22s: %u\n", "SniffIntervalNoCorr", Stats->SniffIntervalNoCorr);
+
+   // Other stats
+   printf("\n  Other Statistics\n");
+   printf("  %22s: %u\n", "ForceOverQosJob", Stats->ForceOverQosJob);
+   //printf("  %22s: %u\n", "Temp 1", Stats->Temp1);
+   //printf("  %22s: %u\n", "Temp 2", Stats->Temp2);
+
+   // Test Mode Stats
+   printf("\n  Test Mode Statistics\n");
+   printf("  %22s: %u\n", "TestModeDroppedTxPkts", Stats->TestModeDroppedTxPkts);
+   printf("  %22s: %u\n", "TestModeDroppedLmps", Stats->TestModeDroppedLmps);
+
+   // Error Stats
+   printf("\n  General Error Statistics\n");
+   printf("  %22s: %u\n", "TimePassedIntrs", Stats->TimePassedIntrs);
+   printf("  %22s: %u\n", "NoCommandIntrs", Stats->NoCommandIntrs);
+}
+
+static int ReadGlobalDMAStats(int dd){
+	tBtHostInterest	HostInt;
+	tBRM_Stats  Stats;
+	
+	ReadHostInterest(dd, &HostInt);
+	if(!HostInt.GlobalDmaStats || (HostInt.Version < 0x0100)){
+		printf("\nGlobal DMA stats not present\n");
+		return FALSE;
+	}
+	ReadMemoryBlock(dd,HostInt.GlobalDmaStats,(UCHAR *)&Stats,sizeof(tBRM_Stats));
+	BRM_DumpStats(&Stats);
+	return TRUE;
+}
+
+static int ResetGlobalDMAStats(int dd){
+	tBtHostInterest	HostInt;
+	tBRM_Stats  Stats;
+	
+	ReadHostInterest(dd, &HostInt);
+	if(!HostInt.GlobalDmaStats || (HostInt.Version < 0x0100)){
+		printf("\nGlobal DMA stats not present\n");
+		return FALSE;
+	}
+	memset(&Stats,0,sizeof(Stats));
+	printf("\nHarry\n");
+	WriteMemoryBlock(dd,HostInt.GlobalDmaStats,(UCHAR *)&Stats,sizeof(tBRM_Stats));
+	printf("\nDMA stattestics has been reset\n");
+	return TRUE;
+}
+
+static int ReadTpcTable(int dd){
+	tBtHostInterest	HostInt;
+	tPsSysCfgTransmitPowerControlTable  TpcTable;
+	int i;
+	
+	ReadHostInterest(dd, &HostInt);
+	if(!HostInt.TpcTableAddr || (HostInt.Version < 0x0100)){
+		printf("\nTPC table not present\n");
+		return FALSE;
+	}
+	ReadMemoryBlock(dd,HostInt.TpcTableAddr,(UCHAR *)&TpcTable,sizeof(TpcTable));
+	for(i=0;i< TpcTable.NumOfEntries; i++){
+		printf("Level [%d] represents %3d dBm\n",i,TpcTable.t[i].TxPowerLevel);
+	}
+	return TRUE;
+}
+
+/*
+static void dump_conf_data(){
+	printf("\nTAG_COUNT %d\n",Tag_Count);
+	int i=0,j=0;
+	for(i=0;i<Tag_Count;i++){
+		printf("\nTAG ID :%X    LEN:%X\n",PsTagEntry[i].TagId,PsTagEntry[i].TagLen);
+		for(j=0;j<PsTagEntry[i].TagLen;j++)
+			printf("\t %x",PsTagEntry[i].TagData[j]);
+	}
+	printf("\n");
+	printf("\nPATCH_COUNT %d\n",Patch_Count);
+	for(i=0;i<Patch_Count;i++){
+		printf("\tPATCH LEN:%X\t",RamPatch[i].Len);
+		for(j=0;j<RamPatch[i].Len;j++)
+			printf("\t %x",RamPatch[i].Data[j]);
+	}
+	printf("\n");
+
+	printf("\tDYMA LEN:%X\t",RamDynMemOverride.Len);
+	for(j=0;j<RamDynMemOverride.Len;j++)
+		printf("\t %x",RamDynMemOverride.Data[j]);
+	printf("\n");
+
+}
+*/
+static const char *psreset_help =
+	"Usage:\n"
+	"\n psreset\n";
+
+static void cmd_psreset(int dev_id, int argc, char **argv){
+	int dd,Length =0,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	if(argc > 1){
+		printf("\n%s\n",psreset_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	PSInit(dd);
+	memset(&buf,0,sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_HOST_CTL,OCF_RESET,Length,buf);
+	if(buf[6] != 0){
+		printf("\nError: HCI RESET failed due to reason 0x%X\n",buf[6]);
+		return;
+	}
+ 
+    // Bttest work around for external 32k
+
+
+    int IsForeverRepeat=0;
+    int IsCmdIdle=0;
+    int address=0, width = 0, value=0;
+    int loop=0,Reg=0;
+    do
+    {
+
+        address = 0x00020024;
+        width = 4;
+        buf[0] = (address & 0xFF);
+        buf[1] = ((address >>8) & 0xFF);
+        buf[2] = ((address>>16) & 0xFF);
+        buf[3] = ((address>>24) & 0xFF);
+        buf[4] = (UCHAR)width;  //Memory width
+        iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY, 5, buf);	
+        if(buf[6] != 0){
+            printf("\nRead Memory address failed due to reason 0x%X\n",buf[6]);
+            hci_close_dev(dd);	
+            return;
+        }
+        value = buf[10];
+        value = ((value << 8) | buf[9]);
+        value = ((value << 8) | buf[8]);
+        value = ((value << 8) | buf[7]);
+
+
+        if(value&0x40000000)
+            IsForeverRepeat=1;
+        else
+            IsForeverRepeat=0;
+
+
+        address = 0x00020020;
+        width = 4;
+        buf[0] = (address & 0xFF);
+        buf[1] = ((address >>8) & 0xFF);
+        buf[2] = ((address>>16) & 0xFF);
+        buf[3] = ((address>>24) & 0xFF);
+        buf[4] = (UCHAR)width;  //Memory width
+        iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY, 5, buf);	
+        if(buf[6] != 0){
+            printf("\nRead Memory address failed due to reason 0x%X\n",buf[6]);
+            hci_close_dev(dd);	
+            return;
+        }
+        value = buf[10];
+        value = ((value << 8) | buf[9]);
+        value = ((value << 8) | buf[8]);
+        value = ((value << 8) | buf[7]);
+
+        if((value&0x0000000f)==0x8)
+            IsCmdIdle=1;
+        else
+            IsCmdIdle=0;
+
+    }
+    while(!(IsForeverRepeat&IsCmdIdle));//Wait til brm issues forever idle
+
+
+    address = 0x000200a8;
+    width = 4;
+    buf[0] = (address & 0xFF);
+    buf[1] = ((address >>8) & 0xFF);
+    buf[2] = ((address>>16) & 0xFF);
+    buf[3] = ((address>>24) & 0xFF);
+    buf[4] = (UCHAR)width;  //Memory width
+    iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY, 5, buf);	
+    if(buf[6] != 0){
+        printf("\nRead Memory address failed due to reason 0x%X\n",buf[6]);
+        hci_close_dev(dd);	
+        return;
+    }
+    value = buf[10];
+    value = ((value << 8) | buf[9]);
+    value = ((value << 8) | buf[8]);
+    value = ((value << 8) | buf[7]);
+
+
+    value |= 0x1;
+
+    loop = 0;
+    while ( loop < 10 ) {
+  
+            loop++;
+
+	    address = 0x000200a8;
+	    width = 4;
+
+	    buf[0] = (address & 0xFF);
+	    buf[1] = ((address >>8) & 0xFF);
+	    buf[2] = ((address>>16) & 0xFF);
+	    buf[3] = ((address>>24) & 0xFF);
+	    buf[4] = width;  //Memory width
+	    buf[5] = (value & 0xFF);
+	    buf[6] = ((value >> 8) & 0xFF);
+	    buf[7] = ((value >> 16) & 0xFF);
+	    buf[8] = ((value >> 24) & 0xFF);
+	    buf[9] =  0xFF;
+	    buf[10] = 0xFF;
+	    buf[11] = 0xFF;
+	    buf[12] = 0xFF;
+	    iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 13, buf);	
+	    if(buf[6] != 0){
+		printf("\nWrite memory address failed\n");
+		hci_close_dev(dd);	
+		return;
+	    }
+
+	address = 0x00004064;
+	width = 4;
+	buf[0] = (address & 0xFF);
+	buf[1] = ((address >>8) & 0xFF);
+	buf[2] = ((address>>16) & 0xFF);
+	buf[3] = ((address>>24) & 0xFF);
+	buf[4] = (UCHAR)width;  //Memory width
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY, 5, buf);	
+	if(buf[6] != 0){
+	    printf("\nRead Memory address failed\n");
+	    hci_close_dev(dd);	
+	    return;
+	}
+	Reg = buf[10];
+	Reg = ((Reg << 8) | buf[9]);
+	Reg = ((Reg << 8) | buf[8]);
+	Reg = ((Reg << 8) | buf[7]);
+
+	if(Reg & 0x04) {
+           break;
+        }
+    }
+
+//--------------------------------------------------------------
+
+
+	hci_close_dev(dd);
+	printf("\nReset Done\n");
+}
+static const char *reset_help =
+	"Usage:\n"
+	"\n reset\n";
+
+static void cmd_reset(int dev_id, int argc, char **argv){
+	int dd,Length =0,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	if(argc > 1) {
+		printf("\n%s\n",reset_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_HOST_CTL,OCF_RESET,Length,buf);
+	if(buf[6] != 0){
+		printf("\nError: HCI RESET failed due to reason 0x%X\n",buf[6]);
+		return;
+	}
+ 
+	hci_close_dev(dd);
+	printf("\nReset Done\n");
+}
+static const char *rba_help =
+	"Usage:\n"
+	"\n rba\n";
+
+static void cmd_rba(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	if(argc > 1){
+		printf("\n%s\n",rba_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = writeHciCommand(dd, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, buf);	
+	if(buf[6] != 0){
+		printf("\nread bdaddr command failed due to reason 0x%X\n",buf[6] );
+		return;
+	}
+	printf("\nBD ADDRESS: \n");
+	int i;
+	for(i=iRet-1;i > 7;i--){
+		printf("%02X:",buf[i]);
+	}
+	printf("%X \n\n",buf[7]);
+	hci_close_dev(dd);
+
+}
+
+static const char *dtx_help =
+	"Usage:\n"
+	"\n dtx\n";
+
+static void cmd_dtx(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	if(argc > 1){
+		printf("\n%s\n",dtx_help);	
+		return;
+	}
+
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+
+        memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_DISABLE_TX, 0, buf);	
+	if(buf[6] != 0){
+		printf("\nDisable TX command failed due to reason 0x%X\n",buf[6]);
+		return;
+	}
+        else {
+             printf("\nDisable TX command passed\n");
+        }
+	hci_close_dev(dd);
+
+}
+
+static const char *ssm_help =
+	"Usage:\n"
+	"\n ssm [0|1]\n"
+	"\nExample:\n"
+	"\tssm 0\t(Sleep disabled)\n"
+	"\tssm 1\t(Sleep enabled)\n";
+
+static void cmd_ssm(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	
+	if(argc != 2){
+		printf("\n%s\n",ssm_help);	
+		return;
+	}
+
+	if(atoi(argv[1]) > 1){
+		printf("\nInvalid sleep mode :%d\n",atoi(argv[1]));
+		return;
+	}
+
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+
+        memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = atoi(argv[1]);;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_SLEEP_MODE, 1, buf);	
+	if(buf[6] != 0){
+		printf("\nSet sleep mode command failed due to reason 0x%X\n",buf[6]);
+		return;
+	}
+        else {
+             printf("\nSet sleep mode command passed\n");
+        }
+	hci_close_dev(dd);
+
+}
+
+static const char *wba_help =
+	"Usage:\n"
+	"\n wba <bdaddr>\n"
+	"\nExample:\n"
+	"\n wba 00:03:ff:56:23:89\n";
+
+static void cmd_wba(int dev_id, int argc, char **argv){
+	//printf("\nFeature not implemented\n");	
+	int dd,iRet;
+	bdaddr_t bdaddr;
+	
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if(argc < 2){
+		printf("\n%s\n",wba_help);	
+		return;
+	}
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	str2ba(argv[1],&bdaddr);	
+	if((strlen(argv[1]) < 17)||(strlen(argv[1]) > 17)){
+		printf("\nInvalid BD address : %s\n",argv[1]);	
+		printf("\n%s\n",wba_help);
+		hci_close_dev(dd);	
+		return;
+	}
+	LoadPSHeader(buf,PS_WRITE,BD_ADDR_SIZE,BD_ADDR_PSTAG);
+	int i,j=0;
+	for(i= 0,j=4;i< BD_ADDR_SIZE;i++,j++){
+		buf[j] = bdaddr.b[i];
+        }
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,BD_ADDR_SIZE + PS_COMMAND_HEADER, buf);
+	if(buf[6] != 0){
+		printf("\n Write BD address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	memset(&buf,0,sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_HOST_CTL,OCF_RESET,0,buf);
+	if(buf[iRet-1] != 0){
+		printf("\nError: HCI RESET failed\n");
+		hci_close_dev(dd);	
+		return;
+	} 
+	memset(&buf,0,sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, buf);	
+	if(buf[6] != 0){
+		printf("\nread bdaddr command failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nBD address changed successfully\n");	
+	hci_close_dev(dd);	
+}
+
+static const char *edutm_help =
+	"Usage:\n"
+	"\n edutm\n";
+
+static void cmd_edutm(int dev_id, int argc, char **argv){
+	int Crc = 0;	
+	int dd;
+	//UCHAR buf[HCI_MAX_EVENT_SIZE];
+	UCHAR ZeroBuf[MEM_BLK_DATA_MAX*2] = {0};	
+	if(argc > 1){
+		printf("\n%s\n",edutm_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+/*
+	Patch_Count = 20;
+	for(i=0; i < Patch_Count; i++){
+		RamPatch[i].Len = MAX_BYTE_LENGTH;
+		memset(&RamPatch[i].Data,0,MAX_BYTE_LENGTH);
+	}
+	printf("\nCMD DUT MODE\n");
+*/
+//When Patch file is present write the patch, if not present just enter DUT mode
+	if(!LoadConfFile(TESTPATCH_FILENAME,0xFFFFFFFF,MB_FILEFORMAT_PATCH)){
+		if(!Dut(dd)){
+			hci_close_dev(dd);	
+			return;	
+		}
+		printf("\nDevice is in test mode ...\n");
+		hci_close_dev(dd);
+		return;
+	}
+	//dump_conf_data();
+	Crc |= RAM_PATCH_REGION;
+	if(!MemBlkwrite(dd,(UINT32)MC_BCAM_COMPARE_ADDRESS, ZeroBuf, HCI_3_PATCH_SPACE_LENGTH_1)){
+  		printf("\nError in clearing the patch space 1\n"); 
+		return;
+   	}
+
+   	if(!MemBlkwrite(dd,(UINT32)MC_BCAM_VALID_ADDRESS, ZeroBuf, HCI_3_PATCH_SPACE_LENGTH_1)){
+  		printf("\nError in clearing the patch space 2\n"); 
+		return;
+   	}
+	printf("\nLoading Patch from file :%s\n",TESTPATCH_FILENAME);
+	if(!PSOperations(dd,WRITE_PATCH,Patch_Count, NULL)){
+		printf("EnterDUT_HCI_3 : patch write failed \r\n");
+		return;
+	}
+	if(!PSOperations(dd,ENABLE_PATCH,0, NULL)){
+		printf("EnterDUT_HCI_3 : patch enable failed \r\n");
+		return;
+	}	
+	if(!PSOperations(dd,PS_VERIFY_CRC,Crc, NULL)){
+		printf("EnterDUT_HCI_3 : verify crc failed \r\n");
+		return;
+	}
+	if(!Dut(dd)){
+		hci_close_dev(dd);	
+		return;	
+	}
+	printf("\nDevice is in test mode ...\n");
+	hci_close_dev(dd);	
+}
+
+
+static int ReadMemorySmallBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length ){
+	int iRet;
+   	UCHAR *pData;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	pData = (UCHAR *) malloc(Length + 6);
+	memset(pData,0,Length+6);	
+	pData[0]= 0x00;  //Memory Read Opcode
+	pData[1]= (StartAddress & 0xFF);
+	pData[2]= ((StartAddress >> 8) & 0xFF);
+	pData[3]= ((StartAddress >> 16) & 0xFF);
+	pData[4]= ((StartAddress >> 24) & 0xFF);
+	pData[5]= Length;
+	
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_MEMOP,Length+6,pData);
+	if(pData[6]!= 0){
+		printf("\nwrite memory command failed due to reason 0x%X\n",pData[6]);	
+		free(pData);
+		return FALSE;
+	}
+	int plen =0;
+	do{
+		plen = read(dd, buf,HCI_MAX_EVENT_SIZE);
+		if (plen < 0) {
+			free(pData);
+			perror("Read failed");
+			exit(EXIT_FAILURE);
+		}
+	}while (buf[HCI_EVENT_HEADER_SIZE] != DEBUG_EVENT_TYPE_MEMBLK);	
+	memcpy(pBufToWrite,(buf+HCI_EVENT_HEADER_SIZE+1),Length);
+	free(pData);
+	return TRUE;
+}
+
+static int ReadMemoryBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length ){
+			
+	int ModResult,i;
+	
+	if(Length > MEM_BLK_DATA_MAX){
+		ModResult = Length % MEM_BLK_DATA_MAX;	
+		for(i=0;i < (Length - ModResult);i += MEM_BLK_DATA_MAX) {
+			ReadMemorySmallBlock(dd, (StartAddress + i),(pBufToWrite + i), MEM_BLK_DATA_MAX);
+		}
+		if(ModResult){
+			ReadMemorySmallBlock(dd, (StartAddress + i),(pBufToWrite + i), ModResult);
+		}
+	}
+	else{
+
+		ReadMemorySmallBlock(dd, StartAddress, pBufToWrite, Length);
+	}
+	return TRUE;
+}
+
+static int WriteMemorySmallBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length ){
+	int iRet;
+   	UCHAR *pData;
+	
+	printf("\nStart Address:%x Length:%x  %x\n",StartAddress,Length,MEM_BLK_DATA_MAX);
+	/*if(Length <= MEM_BLK_DATA_MAX)
+		return FALSE; */
+	pData = (UCHAR *) malloc(Length + 6);
+	memset(pData,0,Length+6);	
+	pData[0]= 0x01;  //Write Read Opcode
+	pData[1]= (StartAddress & 0xFF);
+	pData[2]= ((StartAddress >> 8) & 0xFF);
+	pData[3]= ((StartAddress >> 16) & 0xFF);
+	pData[4]= ((StartAddress >> 24) & 0xFF);
+	pData[5]= Length;
+	
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_MEMOP,Length+6,pData);
+	if(pData[6]!= 0){
+		printf("\nwrite memory command failed due to reason 0x%X\n",pData[6]);	
+		free(pData);
+		return FALSE;
+	}
+	free(pData);
+	return TRUE;
+}
+
+
+static int WriteMemoryBlock(int dd, int StartAddress,UCHAR *pBufToWrite, int Length ){
+			
+	int ModResult,i;
+	
+	if(Length > MEM_BLK_DATA_MAX){
+		ModResult = Length % MEM_BLK_DATA_MAX;	
+		for(i=0;i < (Length - ModResult);i += MEM_BLK_DATA_MAX) {
+			WriteMemorySmallBlock(dd, (StartAddress + i),(pBufToWrite + i), MEM_BLK_DATA_MAX);
+		}
+		if(ModResult){
+			WriteMemorySmallBlock(dd, (StartAddress + i),(pBufToWrite + i), ModResult);
+		}
+	}
+	else{
+
+		WriteMemorySmallBlock(dd, StartAddress, pBufToWrite, Length);
+	}
+	return TRUE;
+}
+
+
+static int ReadHostInterest(int dd,tBtHostInterest *pHostInt){
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int iRet;
+	int HostInterestAddress;	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);	
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_HOST_INTEREST, 0, buf);	
+	if(buf[6] != 0){
+		printf("\nhost interest command failed due to reason 0x%X\n",buf[6]);
+		return FALSE;
+	}
+	HostInterestAddress = buf[iRet-1];
+	HostInterestAddress = ((HostInterestAddress << 8)|buf[iRet-2]);	
+	HostInterestAddress = ((HostInterestAddress << 8)|buf[iRet-3]);	
+	HostInterestAddress = ((HostInterestAddress << 8)|buf[iRet-4]);	
+	ReadMemoryBlock(dd, HostInterestAddress,(UCHAR*)pHostInt, sizeof(tBtHostInterest));
+	
+	if(pHostInt->MagicNumber != HI_MAGIC_NUMBER){
+		if((pHostInt->MagicNumber != 0xFBAD)|| (pHostInt->Version != 0xDECA))
+			return 0;
+	}
+	return TRUE;
+	
+}
+
+static int contRxAtGivenChannel(int dd, UCHAR *pString){
+	int Address, Mask, Reg, RxFreq,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	//1. Disable all scans and set intervals and scan windows eually
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0; //All scan disabled
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite scan mode command failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}	
+	short int inq_scan = 0x1000;		
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = (inq_scan&0xFF);
+	buf[1] = ((inq_scan >> 8)& 0xFF);
+	buf[2] = (inq_scan&0xFF);
+	buf[3] = ((inq_scan >> 8)& 0xFF);
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_INQ_ACTIVITY, 4, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite inquiry scan activity command failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}	
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = (inq_scan&0xFF);
+	buf[1] = ((inq_scan >> 8)& 0xFF);
+	buf[2] = (inq_scan&0xFF);
+	buf[3] = ((inq_scan >> 8)& 0xFF);
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_PAGE_ACTIVITY, 4, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite page scan activity command failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}
+	//2. Disbable AGC
+	Address = LC_JTAG_MODEM_REGS_ADDRESS + AGC_BYPASS_ADDRESS;
+	Mask = AGC_BYPASS_ENABLE_MASK;
+	Reg = AGC_BYPASS_ENABLE_SET(1);
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = (Address & 0xFF);
+	buf[1] = ((Address >>8) & 0xFF);
+	buf[2] = ((Address>>16) & 0xFF);
+	buf[3] = ((Address>>24) & 0xFF);
+	buf[4] = 0x04;  //Memory width
+	buf[5] = (Reg & 0xFF);
+	buf[6] = ((Reg >> 8) & 0xFF);
+	buf[7] = ((Reg >> 16) & 0xFF);
+	buf[8] = ((Reg >> 24) & 0xFF);
+	buf[9] = (Mask & 0xFF);
+	buf[10] = ((Mask >>8) & 0xFF);
+	buf[11] = ((Mask>>16) & 0xFF);
+	buf[12] = ((Mask>>24) & 0xFF);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite to AGC bypass register failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}
+	// 3. Disable frequency hoping and set rx frequency
+
+	RxFreq = (int)pString;
+	Address = LC_DEV_PARAM_CTL_ADDRESS;
+   	Mask = 	LC_DEV_PARAM_CTL_FREQ_HOP_EN_MASK |
+          	LC_DEV_PARAM_CTL_RX_FREQ_MASK     |
+          	LC_DEV_PARAM_CTL_WHITEN_EN_MASK;
+	Reg = LC_DEV_PARAM_CTL_RX_FREQ_SET(RxFreq);
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = (Address & 0xFF);
+	buf[1] = ((Address >>8) & 0xFF);
+	buf[2] = ((Address>>16) & 0xFF);
+	buf[3] = ((Address>>24) & 0xFF);
+	buf[4] = 0x04;  //Memory width
+	buf[5] = (Reg & 0xFF);
+	buf[6] = ((Reg >> 8) & 0xFF);
+	buf[7] = ((Reg >> 16) & 0xFF);
+	buf[8] = ((Reg >> 24) & 0xFF);
+	buf[9] = (Mask & 0xFF);
+	buf[10] = ((Mask >>8) & 0xFF);
+	buf[11] = ((Mask>>16) & 0xFF);
+	buf[12] = ((Mask>>24) & 0xFF);
+	
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite to Rx Freq register failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}
+	// 4. Enable page scan only (Note: the old way puts device into inq scan mode only ???)
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 2; //Page scan enabled
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, buf);	
+	if(buf[6] != 0){
+		printf("\nPage scan enable command failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}
+	// 5. Increase correlator
+	Address = LC_JTAG_MODEM_REGS_ADDRESS + CORR_PARAM1_ADDRESS;
+	Mask = CORR_PARAM1_TIM_THR_MASK;
+	Reg = CORR_PARAM1_TIM_THR_SET(0x3f);
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = (Address & 0xFF);
+	buf[1] = ((Address >>8) & 0xFF);
+	buf[2] = ((Address>>16) & 0xFF);
+	buf[3] = ((Address>>24) & 0xFF);
+	buf[4] = 0x04;  //Memory width
+	buf[5] = (Reg & 0xFF);
+	buf[6] = ((Reg >> 8) & 0xFF);
+	buf[7] = ((Reg >> 16) & 0xFF);
+	buf[8] = ((Reg >> 24) & 0xFF);
+	buf[9] = (Mask & 0xFF);
+	buf[10] = ((Mask >>8) & 0xFF);
+	buf[11] = ((Mask>>16) & 0xFF);
+	buf[12] = ((Mask>>24) & 0xFF);
+	
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 12, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite to Correlator register failed due to reason 0x%X\n",buf[6]);
+		return 0;
+	}
+
+	return TRUE;
+}
+static const char *cwrx_help =
+	"Usage:\n"
+	"\n cwrx <Channel>\n";
+
+static void cmd_cwrx(int dev_id, int argc, char **argv){
+
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	UCHAR channel;
+	BOOL Ok = TRUE;
+	if(argc != 2){
+		printf("\n%s\n",cwrx_help);	
+		return;
+	}
+	
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	channel = atoi(argv[1]);
+	if(channel > 78 || channel < 0){
+		printf("\nPlease enter channel 0-78!\n");
+		return;	
+	}
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+
+	// Disable sleep mode
+	memset(&buf,0,sizeof(buf));
+	buf[0] = 0;
+	iRet = writeHciCommand(dd,OGF_VENDOR_CMD,OCF_SLEEP_MODE,1,buf);
+	if(buf[6] != 0){
+		printf("\nError: Sleep mode failed due to reason 0x%X\n",buf[6]);
+		Ok = 0;
+	}
+       	printf (" Continuoux Rx at channel %d\n",channel);
+	Ok = contRxAtGivenChannel(dd, &channel);
+
+         // All modes come here
+	if (Ok)
+       	{
+       		printf (" Continuoux Rx at channel %d Done...\n",channel);
+       	}
+       	else
+       	{
+        	printf ("\nERROR ---> Could not enter continuous Rx mode\n");
+  	}
+
+	hci_close_dev(dd);
+}
+static const char *mb_help =
+	"Usage:\n"
+	"\n mb\n";
+
+static void cmd_mb(int dev_id, int argc, char **argv){
+
+	int newfd, FieldNum,dd,iRet,need_raw, iDataSize, address,width,value,mask, fdmax, k, l;
+	bdaddr_t bdaddr;
+	tBRM_Control_packet MasterBlaster;
+	UCHAR	SkipRxSlot; 	
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	char FieldAlias;
+	BOOL TestEnabled = 0,Ok = TRUE;
+	UINT8 setContTxType;
+	tBtHostInterest	HostInt;
+	fd_set master, read_fds;
+    uint32_t m_BerTotalBits, m_BerGoodBits;
+    uint8_t m_pattern[16];
+    uint16_t m_pPatternlength;
+    struct hci_filter flt;
+    struct hci_dev_info di;
+    struct timeval timeout;
+
+	if(argc > 1) {
+		printf("\n%s\n",mb_help);	
+		return;
+	}
+	
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = writeHciCommand(dd, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, buf);	
+	if (buf[6] != 0) {
+		printf("\nread bdaddr command failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);
+		return;
+	}
+	int i,j;
+	char bda[18];
+	for (i=iRet-1,j=0;i>7;i--,j+=3) {
+		sprintf(&bda[j],"%X",((buf[i]>>4)&0xFF));
+		sprintf(&bda[j+1],"%X",(buf[i]&0x0F));
+		sprintf(&bda[j+2],":");
+	}
+	sprintf(&bda[15],"%X",((buf[7]>>4)&0xFF));
+	sprintf(&bda[16],"%X",(buf[7]&0x0F));
+	bda[18] ='\0';
+	str2ba(bda,&bdaddr);
+	
+	InitMasterBlaster(&MasterBlaster, &bdaddr, &SkipRxSlot);
+#ifndef DUMP_DEBUG
+	Ok = ReadHostInterest(dd,&HostInt);	
+	if(Ok) {
+		if (HostInt.TpcTableAddr && (HostInt.Version >= 0x0100)) {	
+         		Ok = ReadMemoryBlock(dd, HostInt.TpcTableAddr, (UCHAR *)&TpcTable, sizeof(TpcTable));
+	         	MasterBlaster.testCtrl.Power = TpcTable.NumOfEntries - 1;
+      		}
+   	}
+   	if(!Ok) {
+      		printf ("\nCould not load TPC table.\n");
+		sleep (2);
+      		Ok = TRUE;
+   	}
+#endif
+
+	PrintMasterBlasterMenu (&MasterBlaster);
+    m_BerGoodBits = 0;
+    m_BerTotalBits = 0;
+    m_pattern[0] = 0x0f;
+    m_pPatternlength = 1;
+
+	FD_ZERO(&master);
+	FD_ZERO(&read_fds);
+	FD_SET(0, &master);
+	fdmax = 0;
+	newfd = -1;
+
+   while (1) {
+        read_fds = master;
+        timeout.tv_sec = 5;
+        timeout.tv_usec = 0;
+        iRet = select(fdmax+1, &read_fds, NULL, NULL, &timeout);
+        if (iRet == -1) {
+            perror("cmd_mb select() error!");
+            goto exits_mb;
+        }
+        if (iRet == 0) continue;
+
+        for(i = 0; i <= fdmax; i++) {
+	    if(FD_ISSET(i, &read_fds)) {
+	    	if (i==0) {	// input 
+		    scanf("%s",buf);
+		    FieldAlias = (char)buf[0];
+		    FieldNum = CheckField(MasterBlaster, &FieldAlias);
+		    if (FieldNum == INVALID_MASTERBLASTER_FIELD) {
+			printf ("\nERROR ---> Invalid command. Try again.\n");
+		        printf ("mb>");
+			continue;
+      		    }
+
+		    if (!strncmp(&FieldAlias, MasterBlasterMenu[EXX].Alias, 1)) {
+			printf("\nExit the Master Blaster Mode without reset\n");
+			goto exits_mb;
+		    }
+
+	            // if the test is in rx and the key is neither 'd' nor 'g', then stop the test, renew the option, and procced
+		    // if the test is in tx and the key is not 'e', then stop the test, renew the option, and procced
+		    // if the test is in (LE) continuous rx/tx and the key is not 'j' , then stop the test, renew the option, and procced
+		    if (((TestEnabled == MB_RX_TEST) && strncmp(&FieldAlias, MasterBlasterMenu[RX].Alias, 1) && strncmp(&FieldAlias, MasterBlasterMenu[GB].Alias, 1))
+		    	|| ((TestEnabled == MB_TX_TEST) && strncmp(&FieldAlias, MasterBlasterMenu[TX].Alias, 1))
+		    	|| ((TestEnabled == MB_CONT_RX_TEST || TestEnabled == MB_CONT_TX_TEST
+		        || TestEnabled == MB_LE_RX_TEST || TestEnabled == MB_LE_TX_TEST) &&
+		       	(strncmp(&FieldAlias, MasterBlasterMenu[EN].Alias, 1)))) {
+			printf (" ... Please wait ...");
+         		if (MasterBlaster.ContTxMode) {
+		        	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+				buf[0] = 255;
+				iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_CONT_TX_TESTER, 14, buf);	
+				if(buf[6] != 0) {
+					printf("\nContinious Tx Tester command failed due to reason 0x%X\n",buf[6]);
+					Ok = 0;
+				} else
+					Ok = TRUE;
+         		}
+			if (TestEnabled == MB_RX_TEST) {
+                       	    if (need_raw) {
+                            	if (ioctl(dd, HCISETRAW, 0) < 0)
+                                    perror("Can't clear raw mode \n");
+			    }
+                       	    FD_CLR(newfd, &master);
+                            newfd = -1;
+			    fdmax = 0;
+			}
+		        // Ok = Diag::Reset (Unit, "");
+			//PSInit(dd);
+			// The default setting is sleep mode enabled.
+                        memset(&buf,0,sizeof(buf));
+                        buf[0] = 1;
+                        iRet = writeHciCommand(dd,OGF_VENDOR_CMD,OCF_SLEEP_MODE,1,buf);
+                        if(buf[6] != 0) {
+                                printf("\nError: Sleep mode failed due to reason 0x%X\n",buf[6]);
+                        }
+
+			memset(&buf,0,sizeof(buf));
+			iRet = writeHciCommand(dd,OGF_HOST_CTL,OCF_RESET,0,buf);
+			if (buf[6] != 0) {
+				printf("\nError: HCI RESET failed due to reason 0x%X\n",buf[6]);
+				Ok = FALSE;
+			} else
+				Ok = TRUE;
+         		if (!Ok) {
+		            printf ("\nERROR ---> Could not stop test mode\n");
+         		} else if (!strncmp(&FieldAlias, MasterBlasterMenu[RX].Alias, 1)
+				|| !strncmp(&FieldAlias, MasterBlasterMenu[TX].Alias, 1)
+				|| ((TestEnabled != MB_NO_TEST) &&
+				(!strncmp(&FieldAlias, MasterBlasterMenu[CR].Alias, 1) ||
+				 !strncmp(&FieldAlias, MasterBlasterMenu[CT].Alias, 1) ||
+				 !strncmp(&FieldAlias, MasterBlasterMenu[LR].Alias, 1) ||
+				 !strncmp(&FieldAlias, MasterBlasterMenu[LT].Alias, 1))) ||
+				 !strncmp(&FieldAlias, MasterBlasterMenu[EN].Alias, 1)) {
+				TestEnabled = MB_NO_TEST;
+			}
+	      		sleep(1);
+		    } 
+		    if (!strncmp(&FieldAlias,MasterBlasterMenu[EX].Alias,1)) {			// Exit
+		        TestEnabled = MB_NO_TEST;
+		        printf ("\n Exit ..\n");
+		    	goto exits_mb;
+      		    } else if (!strncmp(&FieldAlias,MasterBlasterMenu[ST].Alias,1)) {		// Stop Test
+			TestEnabled = MB_NO_TEST;
+		        PrintMasterBlasterMenu (&MasterBlaster);
+			continue;
+		    } else if (!strncmp(&FieldAlias,MasterBlasterMenu[GB].Alias,1)) {		// get BER
+		        printf("\n\tGoodBits %d, total is %d\n", m_BerGoodBits, m_BerTotalBits);
+		        printf("mb>\n");
+		        continue;
+		    } else if (!strncmp(&FieldAlias,MasterBlasterMenu[PO].Alias,1)) {		// set Power
+			MasterBlasterMenu[FieldNum].pFunc (&MasterBlaster, &FieldAlias);
+      		    } else if (!MasterBlasterMenu[FieldNum].pFunc (&MasterBlaster, MasterBlasterMenu[FieldNum].Options)) {
+			printf ("\nERROR ---> Invalid option. Try again.\n");
+		        printf ("mb>");
+		        continue;
+      		    }
+		    PrintMasterBlasterMenu(&MasterBlaster);
+
+                // Enable RX test mode
+                    if ((!strncmp(&FieldAlias, MasterBlasterMenu[RX].Alias, 1) && (TestEnabled == MB_NO_TEST))		
+                    	|| (strncmp(&FieldAlias, MasterBlasterMenu[RX].Alias, 1) && (TestEnabled == MB_RX_TEST))) {
+                        Ok = Dut(dd);
+                        if (!Ok) {
+                                printf("\nERROR ---> Could not enter DUT mode\n");
+                                printf("mb>");
+                                continue;
+                        }
+
+                        printf(".");
+    			if (hci_devinfo(dev_id, &di) < 0) {
+        			printf("Can't get device info\n");
+				printf("mb>");
+				continue;
+			}
+
+			need_raw = !hci_test_bit(HCI_RAW, &di.flags);
+
+                        memset(&buf,0,HCI_MAX_EVENT_SIZE);
+                        buf[0] = eBRM_TestMode_Rx;
+                        buf[1] = MasterBlaster.testCtrl.Packet;
+                        buf[2] = MasterBlaster.testCtrl.DataLen & 0xFF;
+                        buf[3] = ((MasterBlaster.testCtrl.DataLen>>8) & 0xFF);
+                        buf[4] = MasterBlaster.testCtrl.HopMode;
+                        buf[5] = MasterBlaster.testCtrl.TxFreq;
+                        buf[6] = MasterBlaster.testCtrl.Power;
+                        buf[7] = MasterBlaster.testCtrl.RxFreq;
+                        buf[8] = MasterBlaster.bdaddr[0];
+                        buf[9] = MasterBlaster.bdaddr[1];
+                        buf[10] = MasterBlaster.bdaddr[2];
+                        buf[11] = MasterBlaster.bdaddr[3];
+                        buf[12] = MasterBlaster.bdaddr[4];
+                        buf[13] = MasterBlaster.bdaddr[5];
+                        buf[14] = SkipRxSlot;
+                        iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_RX_TESTER, 15, buf);
+                        if (buf[6] != 0) {
+                                printf("\nRx Tester command failed due to reason 0x%X\n",buf[6]);
+                                printf("\nERROR --> Could not enable master blaster mode\n");
+                                TestEnabled = MB_NO_TEST;
+                                Ok = 0;
+                        } else {
+                            printf(" rx test is in progress. Press 's' to stop the test\n");
+                            TestEnabled = MB_RX_TEST;
+			    hci_filter_clear(&flt);
+                            hci_filter_all_ptypes(&flt);
+                            hci_filter_all_events(&flt);
+
+                            if (setsockopt(dd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+                                printf("Can't set filter for hci\n");
+                                printf("mb>");
+                                continue;
+                            }
+
+                            if (need_raw) {
+                                if (ioctl(dd, HCISETRAW, 1) < 0) {
+                                    printf("Can't set raw mode on hci\n");
+                                    printf("mb>");
+				    continue;
+                            	}
+                            }
+                            newfd = dd;
+			    FD_SET(newfd, &master);
+                            fdmax = dd;
+                        }
+                        printf("mb>");
+                        continue;
+                    } else if ((!strncmp(&FieldAlias, MasterBlasterMenu[RX].Alias, 1)) && (TestEnabled == MB_RX_TEST)) {
+                        printf(" rx test is in progress. Press 's' to stop the test\n");
+                        printf("mb>");
+                        continue;
+                    }
+
+      		// Enable TX test mode
+		    if ((!strncmp(&FieldAlias, MasterBlasterMenu[TX].Alias, 1) && (TestEnabled == MB_NO_TEST))
+		    	|| (strncmp(&FieldAlias, MasterBlasterMenu[TX].Alias, 1) && (TestEnabled == MB_TX_TEST))) {
+		        // Disable sleep mode
+	        	printf (".");
+			Ok = TRUE;
+			memset(&buf,0,sizeof(buf));
+			buf[0] = 0;
+			iRet = writeHciCommand(dd,OGF_VENDOR_CMD,OCF_SLEEP_MODE,1,buf);
+			if(buf[6] != 0) {
+				printf("\nError: Sleep mode failed due to reason 0x%X\n",buf[6]);
+				Ok = 0;
+			}
+	
+			if (!Ok) {
+            			printf ("\nERROR ---> Could not disable sleep mode\n");
+			        printf ("mb>");
+        	    		continue;
+         		}
+
+	        	printf (".");
+			Ok = Dut(dd);
+			if (!Ok) {
+				printf("\nERROR ---> Could not enter DUT mode\n");
+				printf("mb>");
+				continue;
+			}
+
+			printf(".");
+			memset(&buf,0,HCI_MAX_EVENT_SIZE);
+			buf[0] = MasterBlaster.testCtrl.Mode ;
+			buf[1] = MasterBlaster.testCtrl.Packet;
+			buf[2] = MasterBlaster.testCtrl.DataLen & 0xFF; 
+			buf[3] = ((MasterBlaster.testCtrl.DataLen>>8) & 0xFF); 
+			buf[4] = MasterBlaster.testCtrl.HopMode;
+			buf[5] = MasterBlaster.testCtrl.TxFreq;
+			buf[6] = MasterBlaster.testCtrl.Power;
+			buf[7] = MasterBlaster.testCtrl.RxFreq;
+			buf[8] = MasterBlaster.bdaddr[0]; 
+			buf[9] = MasterBlaster.bdaddr[1]; 
+			buf[10] = MasterBlaster.bdaddr[2]; 
+			buf[11] = MasterBlaster.bdaddr[3]; 
+			buf[12] = MasterBlaster.bdaddr[4]; 
+			buf[13] = MasterBlaster.bdaddr[5]; 
+			buf[14] = SkipRxSlot;
+			iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_TX_TESTER, 15, buf);	
+			if (buf[6] != 0) {
+				printf("\nTx Tester command failed due to reason 0x%X\n",buf[6]);
+				printf("\nERROR --> Could not enable master blaster mode\n");
+				TestEnabled = MB_NO_TEST;
+				Ok = 0;
+			} else {
+				printf(" tx test is in progress. Press 's' to stop the test\n");
+				TestEnabled = MB_TX_TEST;
+			}
+			printf("mb>");
+			continue;
+		    } else if ((!strncmp(&FieldAlias, MasterBlasterMenu[TX].Alias, 1)) && TestEnabled == MB_TX_TEST) {
+			printf(" tx test is in progress. Press 's' to stop the test\n");
+			printf("mb>");
+			continue;
+		    }
+
+		/* Enable (LE) continuous tx/rx test modes */
+		    if (((!strncmp(&FieldAlias, MasterBlasterMenu[EN].Alias, 1)) && (TestEnabled == MB_NO_TEST))
+		    	|| (strncmp(&FieldAlias, MasterBlasterMenu[EN].Alias, 1) && (TestEnabled == MB_CONT_RX_TEST
+			|| TestEnabled == MB_CONT_TX_TEST || TestEnabled == MB_LE_RX_TEST || TestEnabled == MB_LE_TX_TEST))) {
+		        // Disable sleep mode
+	        	printf (".");
+			Ok = TRUE;
+			memset(&buf,0,sizeof(buf));
+			buf[0] = 0;
+			iRet = writeHciCommand(dd,OGF_VENDOR_CMD,OCF_SLEEP_MODE,1,buf);
+			if (buf[6] != 0) {
+				printf("\nError: Sleep mode failed due to reason 0x%X\n",buf[6]);
+				Ok = 0;
+			}
+	
+			if (!Ok) {
+            			printf ("\nERROR ---> Could not disable sleep mode\n");
+			        printf ("mb>");
+        	    		continue;
+         		}
+
+			/*  LE Rx Mode */
+			if (MasterBlaster.LERxMode == ENABLE) {
+				Ok = SU_LERxTest(dd, MasterBlaster.testCtrl.RxFreq);
+				TestEnabled = MB_LE_RX_TEST;
+			} else if (MasterBlaster.LETxMode == ENABLE) {
+				Ok = SU_LETxTest(dd, MasterBlaster.testCtrl.TxFreq, MasterBlaster.testCtrl.DataLen,
+						MasterBlaster.LETxParms.PktPayload);
+				TestEnabled = MB_LE_TX_TEST;
+			} else if (MasterBlaster.ContRxMode == ENABLE) {
+				UCHAR RxFreq = MasterBlaster.testCtrl.RxFreq;
+				Ok = contRxAtGivenChannel(dd, &RxFreq);
+				TestEnabled = MB_CONT_RX_TEST;
+			} else /* Continous TX mode */ {
+				printf(".");
+				Ok = Dut(dd);
+				if (!Ok) {
+					printf("\nERROR ---> Could not enter DUT mode\n");
+					printf("mb>");
+					continue;
+				}
+				/* Enable master blaster mode */
+				printf(".");
+				if (CW_Single_Tone == MasterBlaster.ContTxType)
+					setContTxType = Cont_Tx_Raw_1MHz;
+				else
+					setContTxType = MasterBlaster.ContTxType;
+					
+				memset(&buf, 0, HCI_MAX_EVENT_SIZE);
+				buf[0] = MasterBlaster.testCtrl.Mode ;
+				buf[1] = MasterBlaster.testCtrl.Packet;
+				buf[2] = MasterBlaster.testCtrl.DataLen & 0xFF; 
+				buf[3] = ((MasterBlaster.testCtrl.DataLen>>8) & 0xFF); 
+				buf[4] = MasterBlaster.ContTxType;
+				buf[5] = MasterBlaster.testCtrl.TxFreq;
+				buf[6] = MasterBlaster.testCtrl.Power;
+				buf[7] = MasterBlaster.testCtrl.RxFreq;
+				buf[8] = MasterBlaster.bdaddr[0]; 
+				buf[9] = MasterBlaster.bdaddr[1]; 
+				buf[10] = MasterBlaster.bdaddr[2]; 
+				buf[11] = MasterBlaster.bdaddr[3]; 
+				buf[12] = MasterBlaster.bdaddr[4]; 
+				buf[13] = MasterBlaster.bdaddr[5]; 
+				iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_CONT_TX_TESTER, 14, buf);	
+				if(buf[6] != 0){
+					printf("\nContinious Tx Tester command failed due to reason 0x%X\n",buf[6]);
+					Ok = FALSE;
+				} else
+					Ok = TRUE;
+
+                                memset(&buf,0,HCI_MAX_EVENT_SIZE);
+                        	address = 0x00022914;
+                        	value = 0x00200000;
+                        	mask = 0x00200000;
+                    		width = 4;
+                        	buf[0] = (address & 0xFF);
+                        	buf[1] = ((address >>8) & 0xFF);
+                        	buf[2] = ((address>>16) & 0xFF);
+                        	buf[3] = ((address>>24) & 0xFF);
+                        	buf[4] = width;  //Memory width
+                        	buf[5] = (value & 0xFF);
+                        	buf[6] = ((value >> 8) & 0xFF);
+                        	buf[7] = ((value >> 16) & 0xFF);
+                        	buf[8] = ((value >> 24) & 0xFF);
+                        	buf[9] = (mask & 0xFF);
+                        	buf[10] = ((mask >>8) & 0xFF);
+                        	buf[11] = ((mask>>16) & 0xFF);
+                        	buf[12] = ((mask>>24) & 0xFF);
+                        	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 13, buf);	
+                        	if(buf[6] != 0){
+                        		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+                        		Ok = FALSE;
+				} else 
+					Ok = TRUE;
+
+				TestEnabled = MB_CONT_TX_TEST;
+			}
+			if (Ok) {
+				printf("Test is in progress. Press 's' to stop the test\n");
+			} else {
+				printf("\nERROR ---> Could not enable master blaster mode\n");
+				TestEnabled = MB_NO_TEST;
+			}
+			printf("mb>");
+			continue;
+      		    } else if ((!strncmp(&FieldAlias, MasterBlasterMenu[EN].Alias, 1)) && TestEnabled) {
+		        printf (" Test mode is in progress. Press 's' to stop the test\n");
+         		printf ("mb>");
+         		continue;
+      		    }
+	        }
+	    	else if (i == newfd) {
+                    iRet = read(i, buf, sizeof(buf));
+                    iDataSize = iRet - 5;
+//		    printf("first:%x,nbyte:%d, packet:%d, pattern:%x\n",buf[0], iRet, (uint16_t)(buf[3] | (buf[4] << 8)), buf[5]);
+                    if (buf[0] == 0x2) {        // ACL data
+                            m_BerTotalBits = m_BerTotalBits + iDataSize * 8;
+                            for(j=0,l=0;j<iDataSize;j++,l++) {
+                                if (l == m_pPatternlength) l = 0;
+                                for(k=0;k<8;k++){
+                                    if((m_pattern[l]&(1<<k)) == (buf[8+j]&(1<<k)))
+                                    m_BerGoodBits++;
+                                }
+                            }
+                    }
+	    	}
+	    }
+	}
+   }
+exits_mb:
+        if (need_raw) {
+                if (ioctl(dd, HCISETRAW, 0) < 0)
+                        perror("Can't clear raw mode \n");
+        }
+	hci_close_dev(dd);
+}
+/*
+static void cmd_gid(int dev_id, int argc, char **argv){
+	printf("\nFeature not implemented\n");
+}
+*/
+static const char *wsm_help =
+	"Usage:\n"
+	"\n wsm [0|1|2|3]\n"
+	"\nExample:\n"
+	"\twsm 0\t(Scan disabled)\n"
+	"\twsm 1\t(Inquiry scan enabled)\n"
+	"\twsm 2\t(Page scan enabled)\n"
+	"\twsm 3\t(Inquiry and Page scan enabled)\n";
+
+static void cmd_wsm(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if(argc < 2){
+		printf("\n%s\n",wsm_help);	
+		return;
+	}
+	if(atoi(argv[1]) > 3){
+		printf("\nInvalid scan mode :%d\n",atoi(argv[1]));
+		return;
+	}
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = atoi(argv[1]);
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite scan mode command failed due to reason 0x%X\n",buf[6]);
+		return;
+	}
+	hci_close_dev(dd);
+	printf("\nScan Mode set to :%d\n",atoi(argv[1]));
+}
+
+static void dumpHex(UCHAR *buf, int length, int col)
+{
+	int i;
+	for (i = 0; i < length; i++) {
+		printf("0x%02x ", buf[i]);
+		if (((i+1) % col) == 0 && i != 0)
+			printf("\n");
+	}
+	if (((i+1) % col) != 0) printf("\n");
+}
+
+static void ReverseHexString(char *pStr)
+{
+	int i, j;
+	char temp;
+	int len = strlen(pStr);
+
+	for (i = 0; pStr[i] == ' ' || pStr[i] == '\t'; i++);
+
+	if (pStr[i] == '0' && pStr[i+1] == 'x')
+		i += 2;
+	
+	for (j = len - 1; i < j - 2; i += 2, j -= 2) {
+		temp = pStr[i];
+		pStr[i] = pStr[j - 1];
+		pStr[j - 1] = temp;
+		temp = pStr[i + 1];
+		pStr[i + 1] = pStr[j];
+		pStr[j] = temp;
+	}
+}
+
+static void GetByteSeq(UCHAR *pDst, UCHAR *pSrc, int Size)
+{
+	UCHAR LowNibble, Nibble = 0;
+	UCHAR *pLastHex;
+	UCHAR *pStr = pSrc;
+
+	while (*pStr == ' ' || *pStr == '\t') pStr++;
+
+	if ((pStr[0] == '0') && (pStr[1] == 'x'))
+		pStr += 2;
+
+	pLastHex = pStr - 1;
+	while (IS_HEX(*(pLastHex + 1)))
+		pLastHex++;
+
+	LowNibble = 0;
+
+	while (Size > 0) {
+		if (pStr <= pLastHex) {
+			Nibble = CONV_HEX_DIGIT_TO_VALUE(*pStr);
+			pStr++;
+		} else {
+			Nibble = 0;
+		}
+
+		if (LowNibble) {
+			*pDst |= (UCHAR)(Nibble & 0x0F);
+			LowNibble = 0;
+			pDst++;
+			Size--;
+		} else {
+			*pDst = (UCHAR)((Nibble << 4) & 0xF0);
+			LowNibble = 1;
+		}
+	}
+}
+
+unsigned int GetUInt(char **ppLine, unsigned int DefaultValue)
+{
+  char *pStr = *ppLine;
+  unsigned int Value = 0;
+
+  // Is it a hex value?
+  if ((*pStr == '0') && (*(pStr+1) == 'x'))
+  {
+    // We have a hex value
+
+    pStr += 2;
+
+    while (IS_HEX(*pStr))
+    {
+      Value = CONV_HEX_DIGIT_TO_VALUE(*pStr) + (Value*16);
+      pStr++;
+    }
+
+  }
+  else if (IS_DIGIT(*pStr))
+  {
+    // We have a decimal value
+    while (IS_DIGIT(*pStr))
+    {
+      Value = CONV_DEC_DIGIT_TO_VALUE(*pStr) + (Value*10);
+      pStr++;
+    }
+  }
+  else
+  {
+    // We don't have a value at all - return default value
+    return DefaultValue;
+  }
+
+  // Update the BtString ptr
+  *ppLine = pStr;
+  return Value;
+}
+
+static const char *mbr_help =
+	"Usage:\n"
+	"\n mbr <address> <length> \n"
+	"\n Example \n"
+	"\n mbr 0x00004FFC 10 \n"
+	"\n mbr 0x00004FFC 0x10 \n";
+
+static void cmd_mbr(int dev_id, int argc, char **argv){
+	int dd;
+	UCHAR buf[HCI_MAX_EVENT_SIZE*20];
+
+	if(argc != 3){
+		printf("\n%s\n",mbr_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+
+        int length = GetUInt(&(argv[2]),0);
+        int address  = GetUInt(&(argv[1]),0);
+
+	if ((address == 0) || (length==0)){
+		return;
+	}
+		memset(&buf,0,HCI_MAX_EVENT_SIZE*20);
+    	if(!MemBlkRead(dd,address,buf, length)) {
+        	printf("\nmemory bulk read command failed\n");
+		return;
+    	}
+	printf("\ndata: \n");
+	int i;
+	for(i=0;i < length;i+=4){
+        printf("%08X: ",address+i);
+		printf("%08X",*((int*)(buf+i)));
+        printf("\n");
+	}
+        printf("\n");
+	
+	hci_close_dev(dd);
+
+}
+
+static const char *psr_help =
+	"Usage:\n"
+	"\n psr \n";
+
+static void cmd_psr(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if(argc > 1){
+		printf("\n%s\n",psr_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	LoadPSHeader(buf,PS_RESET,0,0);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER+2, buf);
+        if(buf[7] != 0){ /* Check for status */
+		printf("\n PS Reset failed\n");
+		hci_close_dev(dd);	
+		return;
+	}
+	hci_close_dev(dd);
+        printf("PS reset done\n");	
+}
+
+static const char *rpst_help =
+	"Usage:\n"
+	"\n rpst <tag id> <tag length> \n"
+	"\n Example:\n"
+	"\n rpst 1 6 \n";
+static void cmd_rpst(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int tag_id,tag_len,i,j;
+	if(argc != 3){
+		printf("\n%s\n",rpst_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	tag_id = GetUInt(&(argv[1]),0);
+	tag_len = GetUInt(&(argv[2]),0);
+	LoadPSHeader(buf,PS_READ,tag_len,tag_id);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER, buf);
+	if(buf[6] != 0){
+		printf("\n read PS tag failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = read(dd,&buf,HCI_MAX_EVENT_SIZE);
+	if(iRet < 0){
+		printf("\n read PS tag failed\n");
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nTag ID :%X\nTag Length:%X\nTag Data:\n",tag_id,tag_len);
+	
+	for(i=4,j=1;i<iRet;i++,j++){
+		printf("%02X ",buf[i]);
+		if(j%16 == 0)
+			printf("\n");
+	}
+	printf("\n\n");
+	hci_close_dev(dd);	
+}
+static const char *wpst_help =
+	"Usage:\n"
+	"\n wpst <tag id> <tag length> <tag data>\n"
+	"\n Example:\n"
+	"\n wpst 1 6 00 03 F4 55 AB 77 \n";
+
+static void cmd_wpst(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int tag_id,tag_len,i;
+	if(argc < 4){
+		printf("\n%s\n",wpst_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	tag_id = GetUInt(&(argv[1]),0);
+	tag_len = GetUInt(&(argv[2]),0);
+	if(argc < tag_len+3){
+		printf("\n Tag Data is less than Tag Length\n");
+		hci_close_dev(dd);	
+		return;
+	}
+	LoadPSHeader(buf,PS_WRITE,tag_len,tag_id);
+	for(i=0;i<tag_len;i++){
+		buf[i+4] = strtol(argv[i+3], NULL, 16);
+	}
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER + tag_len, buf);
+	if(buf[6] != 0){
+		printf("\n Write PS tag failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	hci_close_dev(dd);	
+}
+
+static const char *setam_help =
+	"Usage:\n"
+	"\nsetam <storage medium> <access mode>\n"
+	"\nstorage medium: 0-RAM  1-EEPROM\n"
+	"\naccess mode: 0-Read-only 1-Write-only 2-Read-Write 3- Disabled\n"
+	"\nExample:\n"
+	"\nsetam 0 3\n";
+static void cmd_setam(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int medium,mode;
+	if(argc !=3){
+		printf("\n%s\n",setam_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	medium = GetUInt(&(argv[1]),0);
+	mode = GetUInt(&(argv[2]),0);
+	LoadPSHeader(buf,PS_SET_ACCESS_MODE,mode,medium);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER, buf);
+	if(buf[6] != 0){
+		printf("\nSet Access mode failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	hci_close_dev(dd);
+	printf("\nAccess mode changed successfully!\n");	
+}
+
+static const char *setap_help =
+	"Usage:\n"
+	"\nsetap <storage medium> <priority>\n"
+	"\nstorage medium: 0-RAM  1-EEPROM\n"
+	"\npriority: #Highest number corresponds to highest priority\n"
+	"\nExample:\n"
+	"\nsetap 0 1\n";
+
+static void cmd_setap(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int medium,priority;
+	if(argc !=3){
+		printf("\n%s\n",setap_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	medium = GetUInt(&(argv[1]),0);
+	priority = GetUInt(&(argv[2]),0);
+	LoadPSHeader(buf,PS_SET_ACCESS_MODE,priority,medium);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER, buf);
+	if(buf[6] != 0){
+		printf("\nSet Access priority failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	hci_close_dev(dd);
+	printf("\nPriority changed successfully!\n");
+}
+
+static const char *rpsraw_help =
+	"Usage:\n"
+	"\n rpsraw <offset> <length> \n"
+	"\n Example:\n"
+	"\n rpsraw 0x012c 10\n";
+static void cmd_rpsraw(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int offset,len,i,j;
+	if(argc != 3){
+		printf("\n%s\n",rpsraw_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	offset = GetUInt(&(argv[1]),0);
+	len = GetUInt(&(argv[2]),0);
+	LoadPSHeader(buf,PS_READ_RAW,len,offset);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER, buf);
+	if(buf[6] != 0){
+		printf("\n read PS raw failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = read(dd,&buf,HCI_MAX_EVENT_SIZE);
+	if(iRet < 0){
+		printf("\n read PS raw failed\n");
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nOffset :%X\nLength:%X\nData:\n",offset,len);
+	
+	for(i=4,j=1;i<iRet;i++,j++){
+		printf("%02X ",buf[i]);
+		if(j%16 == 0)
+			printf("\n");
+	}
+	printf("\n\n");
+	hci_close_dev(dd);	
+}
+static const char *wpsraw_help =
+	"Usage:\n"
+	"\n wpsraw <offset> <length> <data>\n"
+	"\n Example:\n"
+	"\n wpsraw 0x012C 6 00 03 F4 55 AB 77 \n";
+
+static void cmd_wpsraw(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int offset,len,i;
+	if(argc < 4){
+		printf("\n%s\n",wpsraw_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	offset = GetUInt(&(argv[1]),0);
+	len = GetUInt(&(argv[2]),0);
+	if(argc < len+3){
+		printf("\nData is less than Length\n");
+		hci_close_dev(dd);	
+		return;
+	}
+	LoadPSHeader(buf,PS_WRITE_RAW,len,offset);
+	for(i=0;i<len;i++){
+		buf[i+4] = strtol(argv[i+3], NULL, 16);
+	}
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS,PS_COMMAND_HEADER + len, buf);
+	if(buf[6] != 0){
+		printf("\n Write PS tag failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	hci_close_dev(dd);	
+}
+
+static const char *peek_help =
+	"\nUsage:"
+	"\npeek <address> <width>\n"
+	"\nExample:\n"
+	"\npeek 0x00004FFC 5\n";
+static void cmd_peek(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int address,width,value;
+	if(argc < 2){
+		printf("\n%s\n",peek_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	address = GetUInt(&(argv[1]),0);
+	if(argc == 3)
+		width = GetUInt(&(argv[2]),0x4);
+	else
+		width = 4;
+
+	buf[0] = (address & 0xFF);
+	buf[1] = ((address >>8) & 0xFF);
+	buf[2] = ((address>>16) & 0xFF);
+	buf[3] = ((address>>24) & 0xFF);
+	buf[4] = (UCHAR)width;  //Memory width
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_MEMORY, 5, buf);	
+	if(buf[6] != 0){
+		printf("\nRead Memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	value = buf[10];
+	value = ((value << 8) | buf[9]);
+	value = ((value << 8) | buf[8]);
+	value = ((value << 8) | buf[7]);
+	
+	printf("\n0x%X : 0x%X \n",address,value);
+	//printf("\n0x%X : 0x%02X%02X%02X%02X \n",address,buf[7],buf[8],buf[9],buf[10]);
+	hci_close_dev(dd);	
+}
+
+static const char *cwtx_help =
+	"\nUsage:"
+	"\ncwtx <channel number>\n"
+	"\nExample:\n"
+        "\ncwtx 40"
+	"\n\n";
+
+static void cmd_cwtx(int dev_id, int argc, char **argv){
+	int dd,iRet, Length = 0;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int channel;
+	if(argc != 2){
+		printf("\n%s\n",cwtx_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	channel = atoi(argv[1]);
+	if(channel > 78 || channel < 0){
+		printf("\nPlease enter channel 0-78!\n");
+		hci_close_dev(dd);
+		return;	
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	iRet = writeHciCommand(dd, OGF_HOST_CTL,OCF_RESET,Length,buf);
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x80;
+	buf[1] = 0x20;
+	buf[2] = 0x02;
+	buf[3] = 0x00;
+	buf[4] = 0x04;
+	buf[5] = 0xFF;
+	buf[6] = 0x08;
+	buf[7] = 0xC0;
+	buf[8] = 0x00;
+	buf[9] = 0xFF;
+	buf[10] = 0xFF;
+	buf[11] = 0xFF;
+	buf[12] = 0xFF;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	/* hcitool cmd 0x3F 0x06 0x34 0x20 0x02 0x00 0x04 0x88 0xA0 0x00 0x02 0xFF 0xFF 0xFF 0xFF */
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x34;
+	buf[1] = 0x20;
+	buf[2] = 0x02;
+	buf[3] = 0x00;
+	buf[4] = 0x04;
+	buf[5] = 0x88;
+	buf[6] = 0xA0;
+	buf[7] = 0x00;
+	buf[8] = 0x02;
+	buf[9] = 0xFF;
+	buf[10] = 0xFF;
+	buf[11] = 0xFF;
+	buf[12] = 0xFF;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+
+	/* hcitool cmd 0x3F 0x06 0x28 0x20 0x02 0x00 0x04 0x00 0x90 0x05 0x20 0xFF 0xFF 0xFF 0xFF */
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x28;
+	buf[1] = 0x20;
+	buf[2] = 0x02;
+	buf[3] = 0x00;
+	buf[4] = 0x04;
+	buf[5] = 0x00;
+	buf[6] = 0x90;
+	buf[7] = 0x05;
+	buf[8] = 0x20;
+	buf[9] = 0xFF;
+	buf[10] = 0xFF;
+	buf[11] = 0xFF;
+	buf[12] = 0xFF;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+
+	/* hcitool cmd 0x3F 0x06 0x7C 0x08 0x02 0x00 0x04 0x01 0x00 0x00 0x4B 0xFF 0xFF 0xFF 0xFF */
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x7C;
+	buf[1] = 0x08;
+	buf[2] = 0x02;
+	buf[3] = 0x00;
+	buf[4] = 0x04;
+	buf[5] = 0x01;
+	buf[6] = 0x00;
+	buf[7] = 0x00;
+	buf[8] = 0x4B;
+	buf[9] = 0xFF;
+	buf[10] = 0xFF;
+	buf[11] = 0xFF;
+	buf[12] = 0xFF;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+
+	
+	/* hcitool cmd 0x3F 0x06 0x00 0x08 0x02 0x00 0x04 $number 0x00 0x00 0x00 0xFF 0xFF 0xFF 0xFF */
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x00;
+	buf[1] = 0x08;
+	buf[2] = 0x02;
+	buf[3] = 0x00;
+	buf[4] = 0x04;
+	buf[5] = (UCHAR)channel; /* Num */
+	buf[6] = 0x00;
+	buf[7] = 0x00;
+	buf[8] = 0x00;
+	buf[9] = 0xFF;
+	buf[10] = 0xFF;
+	buf[11] = 0xFF;
+	buf[12] = 0xFF;
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD,OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nEntering continuous wave Tx on channel %d\n",channel);
+
+	hci_close_dev(dd);	
+}
+
+
+static const char *poke_help =
+	"\nUsage:"
+	"\npoke <address> <value> <mask> <width>\n"
+	"\nExample:\n"
+        "\npoke 0x580000 0x22005FF 0xFFFFFFFF 4"
+	"\n\n";
+
+static void cmd_poke(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	int address,width,value,mask;
+	if(argc < 2){
+		printf("\n%s\n",poke_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	address = GetUInt(&(argv[1]),0);
+	value = GetUInt(&(argv[2]),0);
+	printf("\nARGC :%d\n",argc);
+	if(argc < 4)
+		mask = 0xffffffff;
+	else
+		mask = GetUInt(&(argv[3]),0xFFFFFFFF);
+	if(argc < 5)
+		width = 4;
+	else
+		width = GetUInt(&(argv[4]),0x4);
+	buf[0] = (address & 0xFF);
+	buf[1] = ((address >>8) & 0xFF);
+	buf[2] = ((address>>16) & 0xFF);
+	buf[3] = ((address>>24) & 0xFF);
+	buf[4] = width;  //Memory width
+	buf[5] = (value & 0xFF);
+	buf[6] = ((value >> 8) & 0xFF);
+	buf[7] = ((value >> 16) & 0xFF);
+	buf[8] = ((value >> 24) & 0xFF);
+	buf[9] = (mask & 0xFF);
+	buf[10] = ((mask >>8) & 0xFF);
+	buf[11] = ((mask>>16) & 0xFF);
+	buf[12] = ((mask>>24) & 0xFF);
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_WRITE_MEMORY, 13, buf);	
+	if(buf[6] != 0){
+		printf("\nWrite memory address failed due to reason 0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nPoke successful!\n");
+	hci_close_dev(dd);	
+}
+
+
+
+static const char *dump_help =
+	"\nUsage:"
+	"\ndump audio - Display Audio statistics\n"
+	"\ndump dma- Display DMA statistics\n"
+	"\ndump dma r - Display and Reset DMA statistics\n"
+	"\ndump tpc - Dump TPC tables\n"
+	"\nExample:\n"
+        "\ndump audio"
+        "\ndump dma"
+        "\ndump dma r"
+        "\ndump tpc"
+	"\n";
+
+
+static void cmd_dump(int dev_id, int argc, char **argv){
+	int dd;	
+	if(argc < 2){
+		printf("\n%s\n",dump_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	if(!strncmp(argv[1],"audio",5)){
+		ReadAudioStats(dd);
+	}
+	else if(!strncmp(argv[1],"dma",3)){
+		ReadGlobalDMAStats(dd);
+		if(argc == 3 && !strncmp(argv[2],"r",1)){
+			ResetGlobalDMAStats(dd);
+		}	
+	}
+	else if(!strncmp(argv[1],"tpc",3)){
+		ReadTpcTable(dd);
+	}
+	else{
+		printf("\nInvalid option");
+		printf("\n%s\n",dump_help);	
+	}
+	
+	hci_close_dev(dd);	
+	return;
+}
+
+static const char *rafh_help =
+	"\nUsage:"
+	"\nrafh <connection handle>\n"
+	"\nExample:\n"
+        "\nrafh 0x15"
+	"\n\n";
+
+static void cmd_rafh(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	short int handle;
+
+	if(argc < 2){
+		printf("\n%s\n",rafh_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	handle = GetUInt(&(argv[1]),0);	
+	buf[0] = (handle & 0xFF);
+	buf[1] = ((handle >>8) & 0xFF);
+	iRet = writeHciCommand(dd, OGF_STATUS_PARAM,OCF_READ_AFH_MAP, 2, buf);	
+	if(buf[6] != 0){
+		printf("\nRead AFH failed due to reason :0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	
+	if(buf[9] == 0)
+		printf(" AFH is disabled");
+	else
+		printf(" AFH is enabled");
+
+	handle = (buf[7] | (buf[8] << 8));
+	printf("\n AFH chaneel classification for handle: 0x%X",handle);
+	int i;
+	printf("\n Channel Classification Map :");
+	for(i=iRet-1; i>9 ; i--){
+		printf("%X",buf[i]);
+	}
+	printf("\n");
+	hci_close_dev(dd);	
+}
+
+static const char *safh_help =
+	"\nUsage:"
+	"\nsafh <host channel classification>\n"
+	"\nExample:\n"
+        "\nsafh 0x7FFFFFFFFFFFFFFFFFFF"
+	"\n\n";
+
+static void cmd_safh(int dev_id, int argc, char **argv){
+	int dd,iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	if(argc < 2){
+		printf("\n%s\n",safh_help);	
+		return;
+	}
+	int i,j;
+	i = strlen(argv[1]);
+	if(i > 20 || i < 20){
+		printf("\n%s\n",safh_help);	
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(&buf,0,HCI_MAX_EVENT_SIZE);
+	const char *map = argv[1];
+	char byte[3];
+	int data;
+	for (i = 0,j=9; i < 20 ; i+=2,j--) {
+		memcpy(byte,&map[i],2);
+		byte[2] = '\0';
+		data = strtol(byte, NULL, 16);
+		buf[j] = (data & 0xFF);
+	}
+	iRet = writeHciCommand(dd, OGF_HOST_CTL,OCF_SET_AFH_CLASSIFICATION,10, buf);	
+	if(buf[6] != 0){
+		printf("\nSet AFH failed due to reason :0x%X\n",buf[6]);
+		hci_close_dev(dd);	
+		return;
+	}
+	printf("\nSet AFH successful!\n");
+	hci_close_dev(dd);
+}
+
+static const char *wotp_help =
+	"\nUsage:"
+	"\nwotp <address> <data> [length=1]\n"
+	"\nExample:\n"
+        "\nwotp 0x15 0x2020 2"
+	"\n\n";
+
+static void cmd_wotp(int dev_id, int argc, char **argv)
+{
+	UINT32 address, length;
+
+	if (argc < 3) {
+		printf("\n%s\n", wotp_help);
+		return;
+	}
+	if (argc == 4)
+		length = GetUInt(&argv[3], 1);
+	else
+		length = 1;
+	address = GetUInt(&argv[1], 0xffffffff);
+	if (address == 0xffffffff) {
+		printf("\n%s\n", wotp_help);
+		return;
+	}
+	ReverseHexString(argv[2]);
+	if (!write_otpRaw(dev_id, address, length, (UCHAR *)argv[2]))
+		printf("Write to OTP sucessful!\n");
+}
+
+static int write_otpRaw(int dev_id, int address, int length, UCHAR *data)
+{
+	int dd, iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return dd;
+	}
+	memset(&buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x12;				/* write RAW OTP */ 
+	buf[1] = address & 0xFF;		/* PS tag */
+	buf[2] = (address >> 8) & 0xFF;
+	buf[3] = length;			/* Entry Size */
+	GetByteSeq(buf + 4, data, 244);	/* Entry Data */
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS, 244 + PS_COMMAND_HEADER, buf); 
+	if (buf[6] != 0) {
+		printf("\nWrite to OTP failed due to reason :0x%X\n", buf[6]);
+		hci_close_dev(dd);
+		return buf[6];
+	}
+	hci_close_dev(dd);
+	return 0;
+}
+
+static const char *rotp_help =
+	"\nUsage:"
+	"\nrotp <address> [length=1]\n"
+	"\nExample:\n"
+        "\nrotp 0x15 2"
+	"\n\n";
+
+static void cmd_rotp(int dev_id, int argc, char **argv)
+{
+	UINT32 address, length;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	if (argc < 2) {
+		printf("\n%s\n", rotp_help);
+		return;
+	}
+	if (argc == 3)
+		length = GetUInt(&argv[2], 1);
+	else
+		length = 1;
+	address = GetUInt(&argv[1], 0xffffffff);
+	if (address == 0xffffffff) {
+		printf("\n%s\n", rotp_help);
+		return;
+	}
+	if (!read_otpRaw(dev_id, address, length, buf))
+		dumpHex(buf, length, 8);
+}
+
+static int read_otpRaw(int dev_id, int address, int length, UCHAR *data)
+{
+	int dd, iRet, plen;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return dd;
+	}
+	memset(&buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x11;				/* read OTP */ 
+	buf[1] = address & 0xFF;		/* PS tag */
+	buf[2] = (address >> 8) & 0xFF;
+	buf[3] = length;			/* Entry Size */
+	buf[4] = 0x00;				/* Entry Data */
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_PS, 244 + PS_COMMAND_HEADER, buf); 
+	if (buf[6] != 0) {
+		printf("\nRead from OTP failed due to reason :0x%X\n", buf[6]);
+		hci_close_dev(dd);
+		return buf[6];
+	}
+	do {
+		plen = read(dd, buf, HCI_MAX_EVENT_SIZE);
+		if (plen < 0) {
+			perror("Read OTP error\n");
+			exit(EXIT_FAILURE);
+		}
+	} while (buf[HCI_EVENT_HEADER_SIZE] != DEBUG_EVENT_TYPE_PS);
+	memcpy(data, buf + HCI_EVENT_HEADER_SIZE + 1, length);
+	hci_close_dev(dd);
+	return 0;
+}
+
+static int SU_GetId(int dev_id, char *pStr, tSU_RevInfo *pRetRevInfo)
+{
+	tSU_RevInfo RevInfo;
+	int dd, iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	RevInfo.RomVersion = 0x99999999;
+	RevInfo.BuildVersion = 0x99999999;
+	RevInfo.RadioFormat = 0xffff;
+	RevInfo.SysCfgFormat = 0xffff;
+
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return dd;
+	}
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_READ_VERSION, 0, buf);
+	if (buf[6] != 0) {
+		printf("\nRead version failed due to reason :0x%X\n", buf[6]);
+		return buf[6];
+	}
+	RevInfo.RomVersion = buf[7] + (buf[8]<<8) + (buf[9]<<16) + (buf[10]<<24);
+	RevInfo.BuildVersion = buf[11] + (buf[12]<<8) + (buf[13]<<16) + (buf[14]<<24);
+	return 0;
+}
+
+/*static const char *otp_help =
+	"\nUsage:"
+	"\notp [dump|imp|exp|test|rpid|wpid|rvid|wvid|rba|wba|hid|cpw|cpw|pwridx|ledo] [file]\n"
+	"\notp wba <BdAddr>:\n"
+	"\n\n";
+*/
+
+static void cmd_otp(int dev_id, int argc, char **argv)
+{
+	UCHAR buf[512], format[16];
+	FILE *pF = NULL;
+	UINT32 data;
+	int i;
+
+	if (argc == 1 || !strcmp(argv[1], "dump")) {
+		printf("dump:\n");
+		for (i = 0; i < 4; i++) {
+			if (read_otpRaw(dev_id, 128 * i, 128, &buf[128*i])) {
+				printf("read failed\n");
+				return;
+			}
+		}
+		dumpHex(buf, 512, 8);
+	} else if (!strcmp(argv[1], "test")) {
+		printf("test:\n");
+		printf("To be continue.\n");
+	} else if (!strcmp(argv[1], "imp")) {
+		if (argc < 3 || !*argv[2]) {
+			printf("Import file content into OTP. File name is required\n");
+			return;
+		}
+		printf("Import from %s into OTP:\n", argv[2]);
+		if (!(pF = fopen(argv[2], "rb"))) {
+			printf("Open file failed\n");
+			return;
+		}
+		fread(&buf[0], sizeof(buf), 1, pF);
+		fclose(pF);
+		for (i = 0; i < 512; i += 4) {
+			data = buf[i];
+			data <<= 8;
+			data += buf[i+1];
+			data <<= 8;
+			data += buf[i+2];
+			data <<= 8;
+			data += buf[i+3];
+			sprintf((char *)&format, "0x%08x", data);
+			if (write_otpRaw(dev_id, i, 4, (UCHAR *)format)) {
+				printf("Failed!(%d)\n", i);
+				return;
+			}
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "exp")) {
+		for (i = 0; i < 4; i++) {
+			if (read_otpRaw(dev_id, 128 * i, 128, &buf[128*i])) {
+				printf("Failed\n");
+				return;
+			}
+		}
+		if (argc < 3 || !*argv[2] || (!(pF = fopen(argv[2], "wb")))) {
+			/* export the content to the screen */
+			dumpHex(buf, 512, 8);
+		} else {
+			/* export the content to the file */
+			fwrite(&buf[0], sizeof(buf), 1, pF);
+			fclose(pF);
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "ledo")) {
+		int opendrain;
+		tSU_RevInfo RevInfo;
+
+		if (SU_GetId(dev_id, NULL, &RevInfo))
+			return;
+
+		printf("RomVer:%02X.%02X.%02X.%02X \n", (UINT8)((RevInfo.RomVersion >> (8*3)) & 0xff),
+				(UINT8)((RevInfo.RomVersion >> (8*2)) & 0xff),
+				(UINT8)((RevInfo.RomVersion >> 8) & 0xff),
+				(UINT8)(RevInfo.RomVersion & 0xff));
+		if (((UINT8)((RevInfo.RomVersion >> (8*3)) & 0xff) == 0x01) &&
+		    ((UINT8)((RevInfo.RomVersion >> (8*2)) & 0xff) == 0x02) &&
+		    ((UINT8)((RevInfo.RomVersion >> 8) & 0xff) == 0x02) &&
+		    ((UINT8)(RevInfo.RomVersion & 0xff) == 0x00)) {
+			UINT8 LedValue[] = {0xCE, 0xDA, 0x04, 0x0C, 0x58,
+					    0x04, 0x05, 0x06, 0xff, 0x50,
+					    0x40, 0x01, 0x24, 0x08, 0x00,
+					    0x00};
+			for (opendrain = 112; opendrain < 128; opendrain++) {
+				if (write_otpRaw(dev_id, opendrain, 1, &LedValue[opendrain-112])) {
+					printf("Failed\n");
+					return;
+				}
+			}
+			printf("OTP led opendrain done\n");
+		} else {
+			printf("Wrong RomVer\n");
+		}
+	} else if (!strcmp(argv[1], "cpw")) {
+		UINT32 cin_value = 0, cout_value = 0;
+		char tempStr[8];
+
+		if (argc < 3) {
+			printf("\n Enter cin_value : ");
+			scanf("%d", &cin_value);
+		} else
+			cin_value = GetUInt(&argv[2], 0);
+		if (cin_value < 0 || cin_value > 128) {
+			printf("Invalid cin_value = %d\n", cin_value);
+			return;
+		}
+		if (argc < 4) {
+			printf("\n Enter cout_value : ");
+			scanf("%d", &cout_value);
+		} else
+			cout_value = GetUInt(&argv[3], 0);
+		if (cout_value < 0 || cout_value > 128) {
+			printf("Invalid cout_value = %d\n", cout_value);
+			return;
+		}
+		if (cout_value & 0x01) cin_value += 0x80;
+		sprintf(tempStr, "0x%02x", cin_value);
+		if (write_otpRaw(dev_id, 4, 1, (UCHAR *)tempStr)) {
+			printf("CapTune Error\n");
+			return;
+		}
+		sprintf(tempStr, "0x%02x", cout_value >> 1);
+		if (write_otpRaw(dev_id, 5, 1, (UCHAR *)tempStr)) {
+			printf("CapTune Error\n");
+			return;
+		}
+		sprintf(tempStr, "0x40");
+		if (write_otpRaw(dev_id, 5, 1, (UCHAR *)tempStr)) {
+			printf("CapTune Error\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "pwridx")) {
+		char tempStr[8];
+		sprintf(tempStr, "0x02");
+		if (write_otpRaw(dev_id, 21, 1, (UCHAR *)tempStr)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "hid")) {
+		char tempStr[8];
+		UINT32 value = 0;
+		if (argc < 3 || !*argv[2]) {
+			printf("\n Enter HID value(0|1) : ");
+			scanf("%d", &value);
+		} else
+			value = GetUInt(&argv[2], 0);
+		if (value != 0 && value != 1) {
+			printf("\n Error: Syntax \"otp hid 0x00|0x01\"\n");
+			return;
+		}
+		sprintf(tempStr, "0x%02x", value);
+		if (write_otpRaw(dev_id, 12, 1, (UCHAR *)tempStr)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "wpid")) {
+		UINT32 offset = 134;
+		size_t len = 0;
+		char pid[8] = {0};
+		char *ofs = NULL;
+		printf("\n Enter OTP_PID_OFFSET(default 134) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		memset(pid, 0, sizeof(pid));
+		if (argc < 3 || !*argv[2]) {
+			printf("\n Enter PID : ");
+			fgets((char *)pid, 7, stdin);
+		} else
+			strncpy((char *)pid, argv[2], 7);
+		len = strlen(pid) - 1;
+		if (pid[len] == '\n' || pid[len] == '\r')
+			pid[len] = 0;
+		ReverseHexString(pid);
+		if (write_otpRaw(dev_id, offset, 4, (UCHAR *)pid)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "rpid")) {
+		UINT32 offset = 134;
+		size_t len = 0;
+		UCHAR Data[2];
+		char *ofs = NULL;
+		printf("\n Enter OTP_PID_OFFSET(default 134) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		if (read_otpRaw(dev_id, offset, 2, Data)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("The OTP PID is 0x%02x%02x\n", Data[1], Data[0]);
+	} else if (!strcmp(argv[1], "wvid")) {
+		UINT32 offset = 136;
+		size_t len = 0;
+		char vid[8] = {0};
+		char *ofs = NULL;
+		printf("\n Enter OTP_VID_OFFSET(default 136) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		memset(vid, 0, sizeof(vid));
+		if (argc < 3 || !*argv[2]) {
+			printf("\n Enter VID : ");
+			fgets(vid, 8, stdin);
+		} else
+			strncpy(vid, argv[2], 7);
+		len = strlen(vid) - 1;
+		if (vid[len] == '\n' || vid[len] == '\r')
+			vid[len] = 0;
+		ReverseHexString(vid);
+		if (write_otpRaw(dev_id, offset, 2, (UCHAR *)vid)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "rvid")) {
+		UINT32 offset = 136;
+		size_t len = 0;
+		char *ofs = NULL;
+		UCHAR Data[2];
+		printf("\n Enter OTP_VID_OFFSET(default 136) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		if (read_otpRaw(dev_id, offset, 2, Data)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("The OTP VID is 0x%02x%02x\n", Data[1], Data[0]);
+	} else if (!strcmp(argv[1], "wba")) {
+		UINT32 offset = 128;
+		size_t len = 0;
+		char bdaddr[16] = {0};
+		char *ofs = NULL;
+		printf("\n Enter OTP_BDA_OFFSET(default 128) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		memset(bdaddr, 0, sizeof(bdaddr));
+		if (argc < 3 || !*argv[2]) {
+			printf("\n Enter BDADDR : ");
+			fgets(bdaddr, 16, stdin);
+		} else
+			strncpy(bdaddr, argv[2], 15);
+		len = strlen(bdaddr) - 1;
+		if (bdaddr[len] == '\n' || bdaddr[len] == '\r')
+			bdaddr[len] = 0;
+		ReverseHexString(bdaddr);
+		if (write_otpRaw(dev_id, offset, 6, (UCHAR *)bdaddr)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("Done\n");
+	} else if (!strcmp(argv[1], "rba")) {
+		UINT32 offset = 128;
+		size_t len = 0;
+		char *ofs = NULL;
+		UCHAR Data[6];
+		printf("\n Enter OTP_BDA_OFFSET(default 128) : ");
+		getline(&ofs, &len, stdin);
+		sscanf(ofs, "%d", &offset);
+		if (ofs) free(ofs);
+		if (read_otpRaw(dev_id, offset, 6, Data)) {
+			printf("Failed\n");
+			return;
+		}
+		printf("The OTP BDADDR is 0x%02x%02x%02x%02x%02x%02x\n",
+				Data[5], Data[4], Data[3], Data[2], Data[1], Data[0]);
+	}
+}
+
+static const char *plb_help =
+	"\nUsage:"
+	"\nplb [1|0]\n"
+	"\nplb 1\n"
+	"\n\n";
+
+static void cmd_plb(int dev_id, int argc, char **argv)
+{
+	int dd, enable, iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if (argc < 2)
+		enable = 1;
+	else
+		enable = GetUInt(&argv[1], 1);
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x09;					/* audio commmand opcode */
+	buf[4] = (enable == 0) ? 0x00 : 0x01;		/* audio command param */
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_AUDIO_CMD, 8, buf); 
+	if (buf[6] != 0) {
+		printf("\nError in setting PCM CODEC loopback :0x%X\n", buf[6]);
+		hci_close_dev(dd);
+		return;
+	}
+	printf("\nPCM CODEC loopback is %s\n", (enable == 0) ? "OFF" : "ON");
+	hci_close_dev(dd);
+}
+
+static const char *psw_help =
+	"\nUsage:"
+	"\npsw [1|0] [Frequency]\n"
+	"\npsw 1 3000\n"
+	"\n\n";
+
+static void cmd_psw(int dev_id, int argc, char **argv)
+{
+	int dd, enable, freq, iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	if (argc < 2) {
+		enable = 1;
+		freq = 440;
+	}
+	else if (argc < 3) {
+		printf("aa\n");
+		enable = GetUInt(&argv[1], 1);
+		freq = 440;
+	} else {
+		enable = GetUInt(&argv[1], 1);
+		freq = GetUInt(&argv[2], 440);
+	}
+	if (freq > 3700) {
+		printf("Invalid frequency. It should be in the range of 0 to 3700\n");
+		return;
+	}
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = 0x0a;					/* audio command opcode */
+	buf[4] = (enable == 0) ? 0x00 : 0x01;		/* audio command param */
+	buf[5] = 0x00;
+	buf[6] = freq & 0xff;
+	buf[7] = (freq >> 8) & 0xff;
+
+	iRet = writeHciCommand(dd, OGF_VENDOR_CMD, OCF_AUDIO_CMD, 8, buf); 
+	if (buf[6] != 0) {
+		printf("\nError in running PCM sine wave playback :0x%X\n", buf[6]);
+		hci_close_dev(dd);
+		return;
+	}
+	printf("PCM CODEC PCM sine wave playback is %s\n", (enable == 0) ? "OFF" : "ON");
+	hci_close_dev(dd);
+}
+
+static const char *lert_help=
+	"\nUsage:"
+	"\nlert <rx_channel>\n"
+	"\nlert 30 \n"
+	"\n\n";
+
+static void cmd_lert(int dev_id, int argc, char **argv)
+{
+	int dd;
+	UCHAR channel;
+	if (argc < 2) {
+		printf("\n%s\n", lert_help);
+		return;
+	}
+	channel = (UCHAR)GetUInt(&argv[1], 0);
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+
+	SU_LERxTest(dd, channel);
+	hci_close_dev(dd);
+}
+
+static BOOL SU_LERxTest(int dd, UCHAR channel)
+{
+	int iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	if (channel < MB_MIN_FREQUENCY_LE || channel > MB_MAX_FREQUENCY_LE) {
+		printf("Invalid rx channel. It should be in the range of %d to %d\n", 
+			MB_MIN_FREQUENCY_LE, MB_MAX_FREQUENCY_LE);
+		return FALSE;
+	}
+	
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = channel;			/* rx_channel */
+	iRet = writeHciCommand(dd, OGF_LE_CTL, OCF_LE_RECEIVER_TEST, 1, buf);
+	if (buf[6] != 0) {
+		printf("\nError in putting the device into LE RX mode\n");
+		return FALSE;
+	}
+	return TRUE;
+}
+
+static const char *lett_help=
+	"\nUsage:"
+	"\nlett <rx_channel> <length> <packet_payload>\n"
+	"\nlett 30 30 5\n"
+	"\n\n";
+
+static void cmd_lett(int dev_id, int argc, char **argv)
+{
+	int dd;
+	UCHAR channel, length, payload;
+	if (argc < 4) {
+		printf("\n%s\n", lett_help);
+		return;
+	}
+	channel = (UCHAR)GetUInt(&argv[1], 0);
+	length = (UCHAR)GetUInt(&argv[2], 0);
+	payload = (UCHAR)GetUInt(&argv[3], 0);
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	SU_LETxTest(dd, channel, length, payload);
+	hci_close_dev(dd);
+}
+
+static BOOL SU_LETxTest(int dd, UCHAR channel, UCHAR length, UCHAR payload)
+{
+	int iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	if (channel < MB_MIN_FREQUENCY_LE || channel > MB_MAX_FREQUENCY_LE) {
+		printf("Invalid tx channel. It should be in the range of %d to %d\n", 
+			MB_MIN_FREQUENCY_LE, MB_MAX_FREQUENCY_LE);
+		return FALSE;
+	}
+	if (length < MB_MIN_DATALEN_LE || length > MB_MAX_DATALEN_LE) {
+		printf("Invalid data length. It should be in the range of %d to %d\n", 
+			MB_MIN_DATALEN_LE, MB_MAX_DATALEN_LE);
+		return FALSE;
+	}
+	if (payload > 7) {
+		printf("Invalid packet payload. It should be in the range of 0 to 7\n");
+		return FALSE;
+	}
+
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	buf[0] = channel;			/* tx_channel */
+	buf[1] = length;			/* length of test data */
+	buf[2] = payload;			/* packet payload */
+	iRet = writeHciCommand(dd, OGF_LE_CTL, OCF_LE_TRANSMITTER_TEST, 3, buf);
+	if (buf[6] != 0) {
+		printf("\nError in putting the device into LE TX mode\n");
+		return FALSE;
+	}
+	return TRUE;
+}
+
+static const char *lete_help =
+	"\nUsage:"
+	"\nlete\n"
+	"\n\n";
+
+static void cmd_lete(int dev_id, int argc, char **argv)
+{
+	int dd, iRet;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	memset(buf, 0, HCI_MAX_EVENT_SIZE);
+	iRet = writeHciCommand(dd, OGF_LE_CTL, OCF_LE_TEST_END, 0, buf);
+	if (buf[6] != 0) {
+		printf("\nError in ending LE test\n");
+		hci_close_dev(dd);
+		return;
+	}
+	printf("Number of packets = %d\n", buf[7] | (buf[8] << 8));
+	hci_close_dev(dd);
+}
+
+static const char *tputs_help =
+	"\nUsage:"
+	"\ntput-s [BD_Addr] [Judgment value] Logfile times"
+	"\ntput-s 11:22:33:44:55:66 150 log.txt 10"
+	"\n\n";
+
+static void CalculateTput(int dd, UINT16 hci_handle, char *filename, double threshold, int tx_size)
+{
+	time_t start, finish, checkbreak;
+	UCHAR buf[1009];
+	FILE *fp = NULL;
+	int aclnum = 8;
+	int retval;
+	unsigned long sentnum = 0;
+	double TimeResult = 0;
+	fd_set rfds;
+	struct hci_filter flt;
+	struct timeval tv1, tv2, timeout;
+	unsigned long long start_utime, end_utime, time_diff;
+	unsigned long long throughput;
+
+	hci_filter_clear(&flt);
+	hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
+	hci_filter_set_event(EVT_NUM_COMP_PKTS, &flt);
+	if (setsockopt(dd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+		perror("HCI filter setup failed");
+		exit(EXIT_FAILURE);
+	}
+	start = time(NULL);
+	gettimeofday(&tv1, NULL);
+	start_utime = tv1.tv_sec*1000000 + tv1.tv_usec;
+	while (sentnum < 1024 * tx_size) {
+		while (aclnum > 0) {
+			aclnum--;
+			buf[0] = HCI_ACLDATA_PKT;
+			/* ACL packet header */
+			buf[1] = hci_handle & 0xFF;
+			buf[2] = ((hci_handle >> 8) & 0x0E);
+			buf[3] = 1004 & 0xff;
+			buf[4] = (1004 >> 8) & 0xff;
+			/* L2CAP packet header */
+			buf[5] = 1000 & 0xff;
+			buf[6] = (1000 >> 8) & 0xff;
+			buf[7] = 0x40 & 0xff;
+			buf[8] = 0;
+
+			memset(buf+9, sentnum++, 1000);
+			while (write(dd, (const void *)buf, 1009) < 0) {
+				if (errno == EAGAIN || errno == EINTR)
+					continue;
+				perror("HCI send packet failed");
+				exit(EXIT_FAILURE);
+			}
+		}
+		timeout.tv_sec = 5;
+		timeout.tv_usec = 0;
+
+		FD_ZERO(&rfds);
+		FD_SET(dd, &rfds);
+		retval = select(dd+1, &rfds, NULL, NULL, &timeout);
+		if (retval == -1) {
+			perror("select()");
+			exit(EXIT_FAILURE);
+		} else if (retval) {
+			/* Data is available now */
+			ssize_t plen;
+			UCHAR buffer[64];
+			int i;
+			plen = read(dd, buffer, 64);
+			if (plen < 0) {
+				perror("HCI read buffer failed");
+				exit(EXIT_FAILURE);
+			}
+			for (i = 0; i < buffer[HCI_EVENT_HEADER_SIZE]; i++)
+				aclnum += (buffer[HCI_EVENT_HEADER_SIZE+(i+1)*2+1] | (buffer[HCI_EVENT_HEADER_SIZE+(i+1)*2+2] << 8));
+		}
+		checkbreak = time(NULL);
+		if ((checkbreak - start) >= 300) break;
+	}
+	finish = time(NULL);
+	gettimeofday(&tv2, NULL);
+	end_utime = tv2.tv_sec*1000000 + tv2.tv_usec;
+	time_diff = end_utime - start_utime;
+	throughput = time_diff/1000;
+	throughput = (sentnum * 1000)/throughput;
+	printf("Transfer Completed! throughput [%0d KB/s]", (int)throughput);
+	printf(" result [%s]\n", threshold > throughput ? " Fail " : " Pass ");
+	if (filename && *filename)
+		fp = fopen(filename, "at+");
+	if (fp) {
+		fprintf(fp, "Transfer Completed! throughput [%.0f KB/s]", TimeResult);
+		fprintf(fp, " result [%s]\n", threshold > TimeResult ? " Fail " : " Pass ");
+		fclose(fp);
+	}
+}
+
+static void cmd_tputs(int dev_id, int argc, char **argv)
+{
+	int j, dd, iRet, loop = 1, tx_test_size = 1;
+	UINT16 Ps_EntrySize = 0;
+	UINT16 hci_handle = 0;
+	double threshold = 0.0;
+	char *filename = NULL;
+	struct sigaction sa;
+	FILE *fp = NULL;
+	bdaddr_t bdaddr;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	UCHAR Ps_Data[HCI_MAX_EVENT_SIZE];
+	UINT16 *pPs_Data;
+	BOOL Ok = FALSE;
+	char timeString[9] = {0};
+	char dateString[15] = {0};
+	time_t current_time;
+	struct tm *time_info;
+	tSU_RevInfo RevInfo;
+
+	if (argc < 3) {
+		printf("\n%s\n", tputs_help);
+		return;
+	}
+		
+	if (str2ba(argv[1],&bdaddr)) {
+		printf("\nPlease input valid bdaddr.\n");
+		return;
+	}
+	threshold = atof(argv[2]);
+	if (!threshold) {
+		printf("\nPlease input valid throughput threshold.\n");
+		return;
+	}
+	if (argc > 3)
+		filename = strdup(argv[3]);
+	if (argc > 4)
+		loop = GetUInt(&argv[4], 1);
+	if (argc > 5)
+		tx_test_size = GetUInt(&argv[5],1);
+	if (dev_id < 0)
+		dev_id = hci_get_route(NULL);
+
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	CtrlCBreak = FALSE;
+	memset(&sa, 0, sizeof(sa));
+	sa.sa_handler = sig_term;
+	sigaction(SIGTERM, &sa, NULL);
+	sigaction(SIGINT, &sa, NULL);
+	PSInit(dd);
+	memset(buf, 0, sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_RESET, 0, buf);
+	if (buf[6] != 0) {
+		printf("Error: HCI RESET failed.\n");
+		hci_close_dev(dd);
+		return;
+	}
+	sleep(1);
+	for (j = 0; j < loop; j++) {
+		int i = 0;
+		if (!j) sleep(1);
+		printf("\n-----------------------------------");
+		printf("\nTimes %d/%d\n", j + 1, loop);
+
+		time(&current_time);
+		time_info = localtime(&current_time);
+		strftime(timeString, sizeof(timeString), "%H %M %S", time_info);
+		strftime(dateString, sizeof(dateString), "%b %d %Y", time_info);
+		if (j == 0) {
+			if (filename && *filename)
+				fp = fopen(filename, "at+");
+			if (fp != NULL)
+				fprintf(fp, "\n[%s %s] \nCMD : TPUT-S %s %f %s %d\n",
+						dateString, timeString, argv[1], threshold, filename, loop);
+			/* SFLAGS FW */
+			Ok = PSOperations(dd, PS_GET_LENGTH, PSTAG_RF_TEST_BLOCK_START, (UINT32 *)&Ps_EntrySize);
+			if (Ok) {
+				Ps_Data[0] = Ps_EntrySize & 0xff;
+				Ps_Data[1] = (Ps_EntrySize >> 8) & 0xff;
+				Ok = PSOperations(dd, PS_READ, PSTAG_RF_TEST_BLOCK_START, (UINT32 *)&Ps_Data);
+				if (Ok) {
+					pPs_Data = (UINT16 *)&Ps_Data[0];
+					if (*pPs_Data == BT_SOC_INIT_TOOL_START_MAGIC_WORD) {
+						RevInfo.RadioFormat = *(pPs_Data + 1);
+						RevInfo.RadioContent = *(pPs_Data + 2);
+					}
+				}
+			}
+
+			/* Get syscfg info */
+			Ok = PSOperations(dd, PS_GET_LENGTH, PSTAG_SYSCFG_PARAM_TABLE0, (UINT32 *)&Ps_EntrySize);
+			if (Ok) {
+				Ps_Data[0] = Ps_EntrySize & 0xff;
+				Ps_Data[1] = (Ps_EntrySize >> 8) & 0xff;
+				Ok = PSOperations(dd, PS_READ, PSTAG_SYSCFG_PARAM_TABLE0, (UINT32 *)&Ps_Data);
+				if (Ok) {
+					pPs_Data = (UINT16 *)&Ps_Data[0];
+					if (*pPs_Data == 0xC1C1) {
+						RevInfo.SysCfgFormat = *(pPs_Data + 1);
+						RevInfo.SysCfgContent = *(pPs_Data + 2);
+					}
+
+				}
+			}
+			
+			if (RevInfo.SysCfgFormat != 0xff) {
+				printf("SysCfg -    Format:  %d.%d\n",((RevInfo.SysCfgFormat >> 4) & 0xfff), (RevInfo.SysCfgFormat & 0xf));
+				printf("            Content: %d\n", RevInfo.SysCfgContent);
+				if (fp) {
+					fprintf(fp, "SysCfg -    Format:  %d.%d\n",((RevInfo.SysCfgFormat >> 4) & 0xfff), 
+							(RevInfo.SysCfgFormat & 0xf));
+					fprintf(fp, "            Content: %d\n", RevInfo.SysCfgContent);
+				}
+			} else {
+				printf("SysCfg - N/A\n");
+				if(fp)
+					fprintf(fp, "SysCfg - N/A\n");
+			}
+
+			/* bd addr */
+			memset(&buf, 0, sizeof(buf));
+			iRet = writeHciCommand(dd, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, buf);
+			if (buf[6] != 0) {
+				printf("\nCould not read the BD_ADDR (time out)\n");
+			} else {
+				char temp[16] = {0};
+				memset(temp, 0, sizeof(temp));
+				sprintf(temp, "%02X%02X%02X%02X%02X%02X", buf[iRet-1], buf[iRet-2],
+						buf[iRet-3], buf[iRet-4], buf[iRet-5], buf[iRet-6]);
+				printf("\nLocal BDAddress : 0x%s\n", temp);
+				if (fp)
+					fprintf(fp, "Local BDAddress : 0x%s\n", temp);
+			}
+
+			if (fp) {
+				fclose(fp);
+				fp = NULL;
+			}
+		}
+		printf("Sending packages to 0x%s\n", argv[1]);
+		while (i++ < 3) {
+			iRet = hci_create_connection(dd, &bdaddr, 0xCC18, 0, 0, &hci_handle, 0);
+			if (!iRet || CtrlCBreak) break;
+		}
+
+		if (iRet) {
+			if (filename && *filename) {
+				fp = fopen(filename, "at+");
+				if (fp) {
+					fprintf(fp, "Transfer Failed! \n");
+					fclose(fp);
+					fp = NULL;
+				}
+			}
+			printf("Transfer Failed! \n");
+			CtrlCBreak = TRUE;
+			hci_close_dev(dd);
+			return;
+		}
+		CalculateTput(dd, hci_handle, filename, threshold, tx_test_size);
+
+		hci_disconnect(dd, hci_handle, 0, 30);
+
+		if (CtrlCBreak) break;
+        }
+	CtrlCBreak = TRUE;
+	hci_close_dev(dd);
+}
+
+static void cmd_tputr(int dev_id, int argc, char **argv)
+{
+	int dd, iRet;
+	ssize_t plen;
+	UINT16 hci_handle = 0;
+	UCHAR buf[HCI_MAX_EVENT_SIZE];
+	struct hci_filter flt;
+	struct sigaction sa;
+
+	if (dev_id < 0)
+	       dev_id = hci_get_route(NULL);
+	dd = hci_open_dev(dev_id);
+	if (dd < 0) {
+		perror("\nERROR: Can not open HCI device\n");
+		return;
+	}
+	CtrlCBreak = FALSE;
+	memset(&sa, 0, sizeof(sa));
+	sa.sa_handler = sig_term;
+	sigaction(SIGTERM, &sa, NULL);
+	sigaction(SIGINT, &sa, NULL);
+	memset(buf, 0, sizeof(buf));
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_RESET, 0, buf);
+	if (buf[6] != 0) {
+		printf("Error: HCI RESET failed.\n");
+		hci_close_dev(dd);
+		return;
+	}
+	sleep(1);	
+	memset(buf, 0, sizeof(buf));
+	buf[0] = 0x02;
+	iRet = writeHciCommand(dd, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, buf);
+	if (buf[6] != 0) {
+		printf("Error: Write scan failed\n");
+		return;
+	}
+	hci_filter_clear(&flt);
+	hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
+	hci_filter_all_events(&flt);
+	if (setsockopt(dd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+		perror("HCI filter setup failed");
+		exit(EXIT_FAILURE);
+	}
+	printf("Start listening ...\n");
+	do {
+		plen = read(dd, buf, HCI_MAX_EVENT_SIZE);
+		if (plen < 0) {
+			printf("reading failed...\n");
+			if (errno == EAGAIN || errno == EINTR) continue;
+			else {
+				perror("HCI read failed");
+				exit(EXIT_FAILURE);
+			}
+		}
+		if (buf[1] == EVT_CONN_REQUEST) {
+			int i, j;
+			ssize_t plen = 0;
+			printf("Connection come in\n");
+			for (i = 0, j = 3; i < BD_ADDR_SIZE; i++, j++)
+				buf[i] = buf[j];
+			buf[BD_ADDR_SIZE] = 0x01;
+			if (hci_send_cmd(dd, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ, 7, buf)) {
+				printf("Accept connection error\n");
+				return;
+			}
+			do {
+				plen = read(dd, buf, HCI_MAX_EVENT_SIZE);
+				if (plen < 0) {
+					perror("Read failed");
+					exit(EXIT_FAILURE);
+				}
+			} while (buf[1] != EVT_CONN_COMPLETE);
+			if (buf[3] == 0) {
+				printf("Connection up\n");
+			} else {
+				printf("Connection failed\n");
+			}
+			hci_handle = (buf[4] | (buf[5] << 8)) & 0x0EFF;
+		} else if (buf[1] == EVT_DISCONN_COMPLETE) {
+			UINT16 hdl = buf[4] | (buf[5] << 8);
+			printf("Disconnect...\n");
+			if (hdl == hci_handle) {
+				break;
+			}
+		} else if (CtrlCBreak) {
+			printf("CtrlBreak...\n");
+			break;
+		}
+	} while (plen >= 0);
+	CtrlCBreak = TRUE;
+	hci_close_dev(dd);
+}
+
+static void cleanup()
+{
+    if (cid>=0) {
+        close(cid);
+    }
+    if (sid>=0) {
+        close(sid);
+    }
+}
+
+int sock_recv(int sockid, unsigned char *buf, int buflen)
+{
+    int recvbytes;
+    recvbytes = recv(sockid, buf, buflen, 0);
+    if (recvbytes == 0) {
+        printf("Connection close!? zero bytes received\n");
+        return -1;
+    } else if (recvbytes > 0) {
+        return recvbytes;
+    }
+    return -1;
+}
+
+int sock_send(int sockid, unsigned char *buf, int bytes)
+{
+    int cnt;
+    unsigned char* bufpos = buf;
+    while (bytes) {
+        cnt = write(sockid, bufpos, bytes);
+	if (cnt != bytes) 
+		printf("cnt:%d,bytes:%d\n",cnt, bytes);
+
+        if (!cnt) {
+            break;
+        }
+        if (cnt == -1) {
+            if (errno == EINTR) {
+                continue;
+            } else {
+                return -1;
+            }
+        }
+
+        bytes -= cnt;
+        bufpos += cnt;
+    }
+    return (bufpos - buf);
+}
+
+static void cmd_btagent(int dev_id, int argc, char **argv)
+{
+    int dd, i, j, k, l, iRet, need_raw, rx_enable, iDataSize;
+    uint32_t m_BerTotalBits, m_BerGoodBits;
+    uint8_t m_pattern[16];
+    uint16_t m_pPatternlength;
+    int port = BT_PORT;
+    struct sigaction sa;
+    unsigned char buf[1024];
+    struct hci_filter flt;
+    struct hci_dev_info di;
+    struct timeval timeout;
+
+/* master file descriptor list */
+    fd_set master;
+    fd_set read_fds;
+
+/* server address */
+    struct sockaddr_in serveraddr;
+
+    int fdmax;
+
+/* listening socket descriptor */
+    int listener = -1;
+
+/* newly accept()ed socket descriptor */
+    int newfd = -1;
+
+    int nbytes;
+
+/* for setsockopt() SO_REUSEADDR, below */
+    int yes = 1;
+
+    int addrlen;
+                
+    if (argc > 1) 
+	port = atoi(argv[1]);
+    if (port == 0)
+	port = BT_PORT;
+    else if (port < 0 || port >65534) {
+	perror("\nERROR: Invalid port number\n");
+	return;
+    }
+
+    if (dev_id < 0)
+    	dev_id = hci_get_route(NULL);
+    dd = hci_open_dev(dev_id);
+    if (dd < 0) {
+        perror("\nERROR: Can not open HCI device\n");
+        return;
+    }
+
+    if (hci_devinfo(dev_id, &di) < 0) {
+        perror("Can't get device info\n");
+        hci_close_dev(dd);
+        return;
+    }
+
+        need_raw = !hci_test_bit(HCI_RAW, &di.flags);
+
+        hci_filter_clear(&flt);
+        hci_filter_all_ptypes(&flt);
+        hci_filter_all_events(&flt);
+
+        if (setsockopt(dd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
+                perror("Can't set filter for hci\n");
+                hci_close_dev(dd);
+                return;
+        }
+
+        if (need_raw) {
+                if (ioctl(dd, HCISETRAW, 1) < 0) {
+                        perror("Can't set raw mode on hci\n");
+                        hci_close_dev(dd);
+                        return;
+                }
+        }
+
+    CtrlCBreak = FALSE;
+    memset(&sa, 0, sizeof(sa));
+    sa.sa_handler = sig_term;
+    sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGINT, &sa, NULL);
+
+    /* clear the master and temp sets */
+    FD_ZERO(&master);
+    FD_ZERO(&read_fds);
+
+    /* get the listener */
+    if((listener = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
+       	perror("Server-socket() error lol!");
+       	return;
+    }
+
+    if(setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(int)) == -1) {
+       	perror("Server-setsockopt() error lol!");
+	close(listener);
+       	return;
+    }
+
+    if(setsockopt(listener, IPPROTO_TCP, TCP_NODELAY, (char *)&yes, sizeof(int)) == -1) {
+	perror("Server-setsockopt() error TCP_NODELAY\n");
+        close(listener);
+        return;
+    }
+
+    /* bind */
+    serveraddr.sin_family = AF_INET;
+    serveraddr.sin_addr.s_addr = htonl(INADDR_ANY);
+    serveraddr.sin_port = htons(port);
+    memset(&(serveraddr.sin_zero), 0, 8);
+
+    if(bind(listener, (struct sockaddr *)&serveraddr, sizeof(serveraddr)) == -1) {
+   	perror("Server-bind() error lol!");
+	close(listener);
+    	return;
+    }
+
+    /* listen */
+    if(listen(listener, 10) == -1) {
+   	perror("Server-listen() error lol!");
+	close(listener);
+     	return;
+    }
+
+    /* add the listener to the master set */
+    FD_SET(listener, &master);
+
+    /* add hci handler to the master set */
+    FD_SET(dd, &master);
+
+    FD_SET(0, &master);
+    /* keep track of the biggest file descriptor */
+    fdmax = listener;
+    if (dd > listener) fdmax = dd;
+
+    printf("Start BtAgent, press 'q' to exit.\n");
+
+    rx_enable = 0;
+    m_BerGoodBits = 0;
+    m_BerTotalBits = 0;
+    m_pattern[0] = 0x0f;
+    m_pPatternlength = 1;
+
+    while (1) {
+       	read_fds = master;
+        timeout.tv_sec = 5;
+        timeout.tv_usec = 0;
+       	iRet = select(fdmax+1, &read_fds, NULL, NULL, &timeout);
+	if (iRet == -1) {
+       	    perror("Server-select() error lol!");
+	    if (newfd > 0) close(newfd);
+	    close(listener);
+	    goto exits;
+        }
+	if (CtrlCBreak) break;
+	if (iRet == 0) continue;
+
+       	/*run through the existing connections looking for data to be read*/
+       	for(i = 0; i <= fdmax; i++) {
+       	    if(FD_ISSET(i, &read_fds)) {
+
+		if(i == 0) {
+	            printf("Shutting down btagent\n");
+                    iRet = getchar();
+		    if (iRet == 'q') goto exits;
+		    continue;
+		}
+	    
+            	if(i == listener) {
+                    /* handle new connections */
+                    addrlen = sizeof(struct sockaddr_in);
+                    if((newfd = accept(listener, (struct sockaddr *)&serveraddr, &addrlen)) == -1) {
+                        perror("Server-accept() error lol!");
+			goto exits;
+                    }
+                    else {
+                        printf("Server-accept() is OK...%d\n",newfd);
+                        FD_SET(newfd, &master); /* add to master set */
+                        if(newfd > fdmax) 
+                             fdmax = newfd;
+		    }
+                }
+                else if (i == newfd) {
+                    /* handle data from a client */
+                    if((nbytes = sock_recv(i, buf, sizeof(buf))) < 0) {
+                    	/* got error or connection closed by client */
+                        close(i);
+                        /* remove from master set */
+                        FD_CLR(i, &master);
+                    }
+                    else {
+
+                	for (j=0; j<nbytes; j++)
+                            printf("%x ",buf[j]);
+                	printf("\n");
+			if (buf[0] == 0x7) {	// BTAGENT_CMD_EVENT
+			    if (buf[3] == 0x01) {	// BTAGENT_CMD_EVENT_GETBER
+			    	buf[11] = (m_BerTotalBits & 0xff000000) >> 24;
+			    	buf[10] = (m_BerTotalBits & 0xff0000) >> 16;
+			    	buf[9] = (m_BerTotalBits & 0xff00) >> 8;
+			    	buf[8] = m_BerTotalBits & 0xff;
+			    	buf[7] = (m_BerGoodBits & 0xff000000) >> 24;
+			    	buf[6] = (m_BerGoodBits & 0xff0000) >> 16;
+			    	buf[5] = (m_BerGoodBits & 0xff00) >> 8;
+			    	buf[4] = m_BerGoodBits & 0xff;
+			    	buf[3] = 1;		// BTAGENT_CMD_EVENT_GETBER
+                            	buf[2] = 0;
+                            	buf[1] = 9;
+                            	buf[0] = 7;
+                            	sock_send(newfd, buf, 9+3);
+                            	usleep(2000);
+			    }
+			    else if (buf[3] == 0x02) {	// BTAGENT_CMD_EVENT_PATTERN
+				m_pPatternlength = (uint16_t)(buf[1] | (buf[2] << 8));
+				m_pPatternlength --;
+				if (m_pPatternlength > 16) m_pPatternlength = 16;
+				memcpy(m_pattern,&buf[4],m_pPatternlength);
+				printf("PatternLength:%d,%x\n",m_pPatternlength,buf[4]);
+			    }
+			    continue;
+                        }
+			    
+			if (rx_enable == 1) {
+			    if ((buf[4] == 0x03) && (buf[5] == 0x0c)) 
+				rx_enable = 0;
+			}    
+			write(dd, &buf[3], nbytes - 3);
+		    }
+		}
+		else if (i == dd) {
+                    nbytes = read(dd, &buf[3], sizeof(buf) - 3);
+		    iDataSize = nbytes - 5;
+//		    printf("nbyte:%d, packet:%d, pattern:%x\n",nbytes, (uint16_t)(buf[6] | (buf[7] << 8)), buf[8]);
+		    if (buf[3] == 0x2) {	// ACL data
+		    	if (rx_enable) {
+			    m_BerTotalBits = m_BerTotalBits + iDataSize * 8;
+  			    for(j=0,l=0;j<iDataSize;j++,l++) {
+				if (l == m_pPatternlength) l = 0;
+  				for(k=0;k<8;k++){
+				    if((m_pattern[l]&(1<<k)) == (buf[8+j]&(1<<k)))
+				    m_BerGoodBits++;
+				}
+  			    }
+			}
+		    }
+		    else {
+		        if ((buf[7] == 0x5b) && (buf[8] == 0xfc)) {		// Rx start CMD's event
+			    rx_enable = 1;
+			    m_BerTotalBits = 0;
+			    m_BerGoodBits = 0;
+			}
+                    	buf[2] = 0;
+                    	buf[1] = (uint16_t)nbytes;
+                    	buf[0] = 3;
+		    	if (newfd > 0) {
+                    	    sock_send(newfd, buf, nbytes+3);
+			    usleep(2000);
+			}
+		    }
+		}
+	    }
+        }
+    }
+exits:
+        if (need_raw) {
+                if (ioctl(dd, HCISETRAW, 0) < 0)
+                        perror("Can't clear raw mode \n");
+        }
+
+    hci_close_dev(dd);
+    if (listener > 0) close(listener);
+    if (newfd > 0) close(newfd);
+    printf("Total:%d,Good:%d\n",m_BerTotalBits, m_BerGoodBits);
+}
+
+static void sig_term(int sig)
+{
+	if (CtrlCBreak) return;
+	CtrlCBreak = TRUE;
+}
+
+static struct {
+	char *cmd;
+	char *cmd_option;
+	void (*func)(int dev_id, int argc, char **argv);
+	char *doc;
+} command[] = {
+	{ "psreset","      ",   cmd_psreset,    "Download PS files and Reset Target"                },
+	{ "reset","      ",   cmd_reset,    "Reset Target"                },
+	{ "rba","       ",  cmd_rba,    "Read BD Address"                },
+	{ "wba","<bdaddr> ",   cmd_wba,    "Write BD Address"                },
+	{ "edutm","       ",  cmd_edutm,    "Enter DUT Mode"                },
+	{ "wsm","<mode>  ",   cmd_wsm,    "Write Scan Mode"                },
+	{ "mb","       ",   cmd_mb,    "Enter Master Blaster Mode"                },
+	{ "mbr","<address> <length>  ",   cmd_mbr,    "Block memory read"                },
+	{ "peek","<address> <width>  ",   cmd_peek,    "Read Value of an Address"                },
+	{ "poke","<address> <value> <mask> <width>  ",   cmd_poke,    "Write Value to an Address"                },
+	{ "cwtx","<channel number> ",   cmd_cwtx,    "Enter Continuous wave Tx"                },
+	{ "cwrx","<channel number> ",   cmd_cwrx,    "Enter Continuous wave Rx"                },
+	{ "rpst","<length> <id>  ",   cmd_rpst,    "Read PS Tag"                },
+	{ "wpst","<length> <id> <data> ",   cmd_wpst,    "Write PS Tag"                },
+	{ "psr","       ",   cmd_psr,    "PS Reset"                },
+	{ "setap","<storage medium> <priority>",   cmd_setap,    "Set Access Priority"                },
+	{ "setam","<storage medium> <access mode>",   cmd_setam,    "Set Access Mode"               },
+	{ "rpsraw","<offset> <length>  ",   cmd_rpsraw,    "Read Raw PS"                },
+	{ "wpsraw","<offset> <length>  <data>",   cmd_wpsraw,    "Write Raw PS"                },
+	{ "ssm","<disable|enable>         ", cmd_ssm, "Set Sleep Mode"      },
+	{ "dtx","         ", cmd_dtx, "Disable TX"      },
+	{ "dump","<option>         ", cmd_dump, "Display Host Controller Information"      },
+	{ "rafh","<connection handle>         ", cmd_rafh, "Read AFH channel Map"      },
+	{ "safh","<channel classification>         ", cmd_safh, "Set AFH Host Channel Classification"      },
+	{ "wotp", "<address> <data> [length=1]", cmd_wotp, "Write Length (default 1) bytes of Data to OTP started at Address"      },
+	{ "rotp", "<address> [length=1]", cmd_rotp, "Read Length (default 1) bytes of Data to OTP started at Address"	},
+	{ "otp", "[dump|imp|exp|test|rpid|wpid|rvid|wvid|rba|wba|hid|cpw|pwridx|ledo] [file]; opt wba <BdAddr>", 
+		cmd_otp, "Misc OTP operation: dump/import otp content; imp file content into otp; test otp; otp wba <BdAddr>"	}, 
+	{ "plb", "[1|0]", cmd_plb, "Enable/disable PCM CODEC loopback"	},
+	{ "psw", "[1|0] [Frequency]", cmd_psw, "Enable/disable PCM sine wave playback at frequency (0..3700)"	},
+	{ "lert", "<rx_channel>", cmd_lert, "Put unit in LE RX mode at rx_channel (0..39)"	},
+	{ "lett", "<tx_channel> <length> <packet_payload>", cmd_lett, "Put unit in LE TX mode at tx_channel (0..39) with packet of given length (0..37) and packet_payload"	},
+	{ "lete", "        ", cmd_lete, "End LE test"	},
+	{ "tput-s", "[BD_Addr] [Judgment value] Logfile times data_size", cmd_tputs, "Throughput test - sender side"	},
+	{ "tput-r", "        ", cmd_tputr, "Throughput test - receiver side"	},
+	{ "btagent","<port number>", cmd_btagent, "BT Agent for IQFact" }, 
+	{ NULL, NULL, NULL, NULL }
+};
+/*
+	{ "get_id",   cmd_gid,    "Get Chip Identification Number"                },
+*/
+static void usage(void)
+{
+	int i;
+
+	printf("btconfig - BTCONFIG Tool ver %s\n", VERSION);
+	printf("Usage:\n"
+		"\tbtconfig [options] <command> [command parameters]\n");
+	printf("Options:\n"
+		"\t--help\tDisplay help\n"
+		"\t-i dev\tHCI device\n");
+	printf("Commands:\n");
+	for (i = 0; command[i].cmd; i++)
+		printf("\t%-8s %-40s\t%s\n", command[i].cmd,command[i].cmd_option,command[i].doc);
+	printf("\n"
+		"For more information on the usage of each command use:\n"
+		"\tbtconfig <command> --help\n" );
+}
+
+int main(int argc, char *argv[])
+{
+	int opt, i, dev_id = -1;
+	bdaddr_t ba;
+
+	while ((opt=getopt_long(argc, argv, "+i:h", main_options, NULL)) != -1) {
+		switch (opt) {
+		case 'i':
+			dev_id = hci_devid(optarg);
+			if (dev_id < 0) {
+				perror("Invalid device");
+				exit(1);
+			}
+			break;
+
+		case 'h':
+		default:
+			usage();
+			exit(0);
+		}
+	}
+
+	argc -= optind;
+	argv += optind;
+	optind = 0;
+
+	if (argc < 1) {
+		usage();
+		exit(0);
+	}
+
+	if (dev_id != -1 && hci_devba(dev_id, &ba) < 0) {
+		perror("Device is not available");
+		exit(1);
+	}
+
+	for (i = 0; command[i].cmd; i++) {
+		if (strcmp(command[i].cmd, argv[0]))
+			continue;
+		command[i].func(dev_id, argc, argv);
+		break;
+	}
+	return 0;
+}
+
+
+// MAster BLaster fucntions
+tMasterBlasterField MasterBlasterMenu[] =
+{
+   {"ContRxMode", "n", "toggle coNtinuous Rx", 0,                     ContRxModeOption,   SetMasterBlasterContRxMode},
+   {"ContTxMode", "c", "toggle Continuous Tx", 0,                     ContTxModeOption,   SetMasterBlasterContTxMode},
+   {"LERxMode",   "q", "toggle LE Rx mode",    0,                     ContRxModeOption,   SetMasterBlasterLERxMode},
+   {"LETxMode",   "w", "toggle LE Tx mode",    0,                     ContTxModeOption,   SetMasterBlasterLETxMode},
+   {"LETxPktPayload", "y", "set LE Tx packet payload", 0,             LETxPktPayloadOption, SetMasterBlasterLETxPktPayload},
+   {"ContTxType", "u", "toggle continUous Tx Type", Cont_Tx_Raw_1MHz, ContTxTypeOption,   SetMasterBlasterContTxType},
+   {"TestMode",   "m", "toggle test Mode",     eBRM_TestMode_TX_1010, TestModeOption,     SetMasterBlasterTestMode},
+   {"HopMode",    "h", "toggle Hop mode",      0,                     HopModeOption,      SetMasterBlasterHopMode},
+   {"TxFreq",     "t", "set Tx freq",          39,                    NULL,               SetMasterBlasterTxFreq},
+   {"RxFreq",     "r", "set Rx freq",          39,                    NULL,               SetMasterBlasterRxFreq},
+   {"PacketType", "p", "toggle Packet type",   TxTest_PktType_DH1,    PacketTypeOption,   SetMasterBlasterPacketType},
+   {"DataLen",    "l", "set data Length",      15,                    NULL,               SetMasterBlasterDataLen},
+   {"Power",      "o", "toggle pOwer",         9,                     NULL,               SetMasterBlasterPower},
+   {"BdAddr",     "a", "set bdAddr",           0,                     NULL,               SetMasterBlasterBdAddr},
+   {"SetBERType", "k", "set BER type",         eBRM_BERMode_ALL_DATA, BERPacketTypeOption,SetMasterBlasterBERType},
+   {"GetBER",     "g", "get BER type",	       0,		      NULL,		  SetMasterBlasterNothing},
+   {"EnableRxTest", "d", "Enable rx test mode", 0,                    NULL,               SetMasterBlasterNothing},
+   {"EnableTxTest", "e", "Enable tx test mode", 0,                    NULL,               SetMasterBlasterNothing},
+   {"EnableTest", "j", "Start test mode",      0,                     NULL,               SetMasterBlasterNothing},
+   {"StopTest",   "s", "Stop test mode",       0,                     NULL,               SetMasterBlasterNothing},
+   {"Exit",       "x", "eXit",                 0,                     NULL,               SetMasterBlasterNothing},
+   {"ExitWithoutReset", "b", "Exit without reset", 0,                 NULL,               SetMasterBlasterNothing},
+};
+
+tPsSysCfgTransmitPowerControlTable  TpcTable;
+
+//----------------------------------------------------------------------------
+
+void InitMasterBlaster (tBRM_Control_packet *MasterBlaster, bdaddr_t *BdAddr, UCHAR *SkipRxSlot)
+{
+   *SkipRxSlot = 0x01;	
+   MasterBlaster->testCtrl.Mode     = MasterBlasterMenu[TM].Default;
+   MasterBlaster->testCtrl.HopMode  = MasterBlasterMenu[HM].Default;
+   MasterBlaster->testCtrl.Packet   = MasterBlasterMenu[PT].Default;
+   MasterBlaster->testCtrl.TxFreq   = MasterBlasterMenu[TF].Default;
+   MasterBlaster->testCtrl.RxFreq   = MasterBlasterMenu[RF].Default;
+   MasterBlaster->testCtrl.Power    = MasterBlasterMenu[PO].Default;
+   MasterBlaster->testCtrl.DataLen  = MasterBlasterMenu[DL].Default;
+   MasterBlaster->ContTxMode        = MasterBlasterMenu[CT].Default;
+   MasterBlaster->ContTxType        = MasterBlasterMenu[CX].Default;
+   MasterBlaster->ContRxMode        = MasterBlasterMenu[CR].Default;
+   MasterBlaster->BERType           = MasterBlasterMenu[SB].Default;
+   MasterBlaster->LERxMode          = MasterBlasterMenu[LR].Default;
+   MasterBlaster->LETxMode          = MasterBlasterMenu[LT].Default;
+   MasterBlaster->LETxParms.PktPayload = MasterBlasterMenu[LTM].Default;
+   memcpy(MasterBlaster->bdaddr,&BdAddr->b[0],6);
+
+   TpcTable.NumOfEntries = 0;
+}
+
+//----------------------------------------------------------------------------
+
+int CheckField (tBRM_Control_packet MasterBlaster, char *FieldAlias)
+{
+   if (((!strncmp(FieldAlias,MasterBlasterMenu[HM].Alias,1)) && MasterBlaster.ContTxMode) ||
+       (((!strncmp(FieldAlias,MasterBlasterMenu[TF].Alias,1)) || (!strncmp(FieldAlias,MasterBlasterMenu[RF].Alias,1))) && MasterBlaster.testCtrl.HopMode == 1) ||
+       ((!strncmp(FieldAlias,MasterBlasterMenu[CX].Alias,1)) && MasterBlaster.ContTxMode == 0))
+   {
+	 return INVALID_MASTERBLASTER_FIELD;
+   }
+   unsigned int i;
+   for (i = 0; i < sizeof(MasterBlasterMenu)/sizeof(tMasterBlasterField); ++i)
+   {
+      if (!strncmp(FieldAlias,MasterBlasterMenu[i].Alias,1))
+      {
+         return i;
+      }
+   }
+
+   return INVALID_MASTERBLASTER_FIELD;
+}
+
+//----------------------------------------------------------------------------
+
+int GetTestModeOptionIndex (int Value)
+{
+   unsigned int i;
+   for (i = 0; i < sizeof(TestModeOption)/sizeof(tMasterBlasterOption); ++i)
+   {
+      if (Value == TestModeOption[i].Value)
+      {
+         return i;
+      }
+   }
+  // assert (0);
+   return -1;
+}
+
+//----------------------------------------------------------------------------
+
+int GetPacketTypeOptionIndex (int Value)
+{
+   unsigned int i;
+   for (i = 0; i < sizeof(PacketTypeOption)/sizeof(tMasterBlasterOption); ++i)
+   {
+      if (Value == PacketTypeOption[i].Value)
+      {
+         return i;
+      }
+   }
+   //assert (0);
+   return -1;
+}
+
+//----------------------------------------------------------------------------
+
+void PrintMasterBlasterMenu(tBRM_Control_packet *MasterBlaster)
+{
+	unsigned int i;
+	printf ("\n---------- Master Blaster Mode ----------\n\n");
+	for (i = 0; i < sizeof(MasterBlasterMenu)/sizeof(tMasterBlasterField); ++i)
+	{
+		if (((i == HM || i == RF) && (MasterBlaster->ContTxMode == ENABLE)) ||
+			((i == TF || i == RF) && (MasterBlaster->testCtrl.HopMode == 1)) ||
+			((i == CX) && (MasterBlaster->ContTxMode == DISABLE)) ||
+			((i == CX || i == HM || i == TF || i == PT || i == DL || i == PO || i == BA) &&
+			(MasterBlaster->ContRxMode == ENABLE)))
+		{
+			continue;
+		}
+
+		printf ("\t%s - %s\n", MasterBlasterMenu[i].Alias, MasterBlasterMenu[i].Usage);
+	}
+	printf ("\n-----------------------------------------\n\n");
+
+	char BdAddr[18];
+	//strcpy(MasterBlaster.bdaddr,BdAddr);
+
+	printf ("ContRxMode: %s\n", ContRxModeOption[MasterBlaster->ContRxMode].Name);
+	printf ("ContTxMode: %s\n", ContTxModeOption[MasterBlaster->ContTxMode].Name);
+	printf ("LERxMode: %s\n", ContTxModeOption[MasterBlaster->LERxMode].Name);
+	printf ("LETxMode: %s\n", ContTxModeOption[MasterBlaster->LETxMode].Name);
+
+	// LE Rx mode
+	if (MasterBlaster->LERxMode == ENABLE)
+	{
+		if (MasterBlaster->testCtrl.RxFreq > MB_MAX_FREQUENCY_LE)
+			MasterBlaster->testCtrl.RxFreq = MB_MAX_FREQUENCY_LE;
+		printf("RxFreq:     %d\n", MasterBlaster->testCtrl.RxFreq); 
+	}
+	// LE Tx mode
+	if (MasterBlaster->LETxMode == ENABLE)
+	{
+		if (MasterBlaster->testCtrl.DataLen > MB_MAX_DATALEN_LE)
+			MasterBlaster->testCtrl.DataLen = MB_MAX_DATALEN_LE;
+		printf("TxFreq:     %d\n", MasterBlaster->testCtrl.TxFreq);
+		printf("DataLen:    %d\n", MasterBlaster->testCtrl.DataLen);
+		printf("PktPayload: %s\n", LETxPktPayloadOption[MasterBlaster->LETxParms.PktPayload].Name);
+	}
+	// Continous Rx mode
+	else if (MasterBlaster->ContRxMode == ENABLE)
+	{
+		printf ("BER Type: %s\n",BERPacketTypeOption[MasterBlaster->BERType].Name);
+		printf ("RxFreq:     %d\n", MasterBlaster->testCtrl.RxFreq);
+	}
+	// Continous Tx mode and Tx test mode
+	else
+	{
+		printf ("BER Type: %s\n",BERPacketTypeOption[MasterBlaster->BERType].Name);
+		if (MasterBlaster->ContTxMode == ENABLE)
+		{
+			printf ("ContTxType: %s\n", ContTxTypeOption[MasterBlaster->ContTxType].Name);
+			if (ContTxTypeOption[MasterBlaster->ContTxType].Value != CW_Single_Tone)
+				printf ("TestMode:   %s\n", TestModeOption[GetTestModeOptionIndex(MasterBlaster->testCtrl.Mode)].Name);
+			printf ("TxFreq:     %d\n", MasterBlaster->testCtrl.TxFreq);
+		}
+		else
+		{
+			printf ("TestMode:   %s\n", TestModeOption[GetTestModeOptionIndex(MasterBlaster->testCtrl.Mode)].Name);
+			printf ("HopMode:    %s\n", HopModeOption[MasterBlaster->testCtrl.HopMode].Name);
+
+			if (MasterBlaster->testCtrl.HopMode == 0)
+			{
+				printf ("TxFreq:     %d\n", MasterBlaster->testCtrl.TxFreq);
+				printf ("RxFreq:     %d\n", MasterBlaster->testCtrl.RxFreq);
+			}
+		}
+		if (TpcTable.NumOfEntries > 0)
+		{
+			printf ("Power:      Step = %d/%d; Level = %d dBm\n", MasterBlaster->testCtrl.Power+1,
+			TpcTable.NumOfEntries, TpcTable.t[MasterBlaster->testCtrl.Power].TxPowerLevel);
+		}
+		else
+		{
+			printf ("Power:      Step = Max; Level = N/A\n");
+		}
+		if ((MasterBlaster->ContTxMode == ENABLE && ContTxTypeOption[MasterBlaster->ContTxType].Value == Cont_Tx_Regular) ||
+		(MasterBlaster->ContTxMode == DISABLE))
+		{
+			printf ("PacketType: %s\n", PacketTypeOption[GetPacketTypeOptionIndex(MasterBlaster->testCtrl.Packet)].Name);
+			printf ("DataLen:    %d\n", MasterBlaster->testCtrl.DataLen);
+		}
+		if (ContTxTypeOption[MasterBlaster->ContTxType].Value != CW_Single_Tone) {//for single tone, no bdaddr
+			ba2str((const bdaddr_t *)MasterBlaster->bdaddr, BdAddr); 
+			printf ("BdAddr:     0x%s\n\n",BdAddr);
+		}
+	}
+	printf ("\nmb>\n");
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterTestMode(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+	int Value = (int)MasterBlaster->testCtrl.Mode;
+
+	if (ToggleOption (&Value, Option, TestModeOption,
+			  sizeof(TestModeOption)/sizeof(tMasterBlasterOption), TM,1))
+	{
+		MasterBlaster->testCtrl.Mode = (UCHAR)Value;
+		// Enable continous Tx should disable continous Rx
+		MasterBlaster->ContRxMode = DISABLE;
+		MasterBlaster->ContTxMode = DISABLE;
+		return TRUE;
+	}
+	return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterHopMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->testCtrl.HopMode;
+
+   if (ToggleOption (&Value, Option, HopModeOption,
+                        sizeof(HopModeOption)/sizeof(tMasterBlasterOption), HM,1))
+   {
+      MasterBlaster->testCtrl.HopMode = (UCHAR)Value;
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterTxFreq (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   //char Buffer[20];
+   tMasterBlasterOption NewValue;
+   int LoopCount = 4;
+   int Value = (int)MasterBlaster->testCtrl.TxFreq;
+   int MaxFreq = LEMode ? MB_MAX_FREQUENCY_LE : MB_MAX_FREQUENCY;
+   int MinFreq = LEMode ? MB_MIN_FREQUENCY_LE : MB_MIN_FREQUENCY;
+
+   while (--LoopCount > 0)
+   {
+      printf ("\n   Enter Tx frequency (%d..%d): ", MinFreq, MaxFreq);
+      scanf("%d",&NewValue.Value);
+//    fgets(NewValue,3,stdin);
+      if (MinMaxOption (&Value, &NewValue, MinFreq, MaxFreq))
+      {
+         MasterBlaster->testCtrl.TxFreq = (UCHAR)Value;
+         return TRUE;
+      }
+      else if (LoopCount > 1)
+      {
+         printf ("\n   ERROR ---> Invalid Tx frequency.\n");
+      }
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterRxFreq (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   tMasterBlasterOption NewValue;
+   int LoopCount = 4;
+   int Value = (int)MasterBlaster->testCtrl.RxFreq;
+   int MaxFreq = LEMode ? MB_MAX_FREQUENCY_LE : MB_MAX_FREQUENCY;
+   int MinFreq = LEMode ? MB_MIN_FREQUENCY_LE : MB_MIN_FREQUENCY;
+
+   while (--LoopCount > 0)
+   {
+      printf ("\n   Enter Rx frequency (%d..%d): ", MinFreq, MaxFreq);
+      scanf("%d",&NewValue.Value);
+      if (MinMaxOption (&Value, &NewValue, MinFreq, MaxFreq))
+      {
+         MasterBlaster->testCtrl.RxFreq = (UCHAR)Value;
+         return TRUE;
+      }
+      else if (LoopCount > 1)
+      {
+         printf ("\n   ERROR ---> Invalid Rx frequency.\n");
+      }
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterPacketType (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->testCtrl.Packet;
+
+   if (ToggleOption (&Value, Option, PacketTypeOption,
+                        sizeof(PacketTypeOption)/sizeof(tMasterBlasterOption), PT,1))
+   {
+      MasterBlaster->testCtrl.Packet = (UCHAR)Value;
+      MasterBlaster->testCtrl.DataLen = MaxDataLenOption[GetPacketTypeOptionIndex(Value)];
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterDataLen (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   tMasterBlasterOption NewValue;
+   int LoopCount = 4;
+   int MaxLen = LEMode ? MB_MAX_DATALEN_LE : MB_MAX_DATALEN;
+   int MinLen = LEMode ? MB_MIN_DATALEN_LE : MB_MIN_DATALEN;
+
+   while (--LoopCount > 0)
+   {
+      printf ("\n   Enter data length (%d..%d): ", MinLen, MaxLen);
+      scanf("%d",&NewValue.Value);
+      if (MinMaxOption (&MasterBlaster->testCtrl.DataLen, &NewValue, MinLen, MaxLen))
+      {
+         return TRUE;
+      }
+      else if (LoopCount > 1)
+      {
+         printf ("\n   ERROR ---> Invalid data length.\n");
+      }
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterPower (tBRM_Control_packet *MasterBlaster, char *Option)
+{
+   if (TpcTable.NumOfEntries > MAX_TRANSMIT_POWER_CONTROL_ENTRIES)
+   {
+      printf ("\nNumber of entries in TPC table exceeds the limit.\n");
+      sleep(3);
+      return TRUE;
+   }
+
+   if (TpcTable.NumOfEntries == 0)
+   {
+      printf ("\nThere is no entry in TPC table.\n");
+      sleep(3);
+      return TRUE;
+   }
+
+   int Value = (int)MasterBlaster->testCtrl.Power;
+
+   if (ToggleMinMaxOption (&Value, Option, PO, 0, TpcTable.NumOfEntries-1,1))
+   {
+      MasterBlaster->testCtrl.Power = (UCHAR)Value;
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterBdAddr (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   char Buffer[20];
+   bdaddr_t bdaddr;
+
+   printf ("\n Enter BdAddr: ");
+//   gets(Buffer);
+   scanf("%s",Buffer);
+   str2ba(Buffer,&bdaddr);
+   strncpy(MasterBlaster->bdaddr,bdaddr.b,6);
+   return TRUE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterContTxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->ContTxMode;
+
+   if (ToggleOption (&Value, Option, ContTxModeOption,
+                        sizeof(ContTxModeOption)/sizeof(tMasterBlasterOption), CT,1))
+   {
+      MasterBlaster->ContTxMode = (UCHAR)Value;
+      if (MasterBlaster->ContTxMode == ENABLE)
+      {
+         // Enable continous Tx should disable continous Rx
+         MasterBlaster->ContRxMode = DISABLE;
+	 MasterBlaster->LERxMode = DISABLE;
+	 MasterBlaster->LETxMode = DISABLE;
+	 LEMode = FALSE;
+      }
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterContTxType (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->ContTxType;
+
+   if (ToggleOption (&Value, Option, ContTxTypeOption,
+                        sizeof(ContTxTypeOption)/sizeof(tMasterBlasterOption), CX,1))
+   {
+      MasterBlaster->ContTxType = (UCHAR)Value;
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterLERxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = MasterBlaster->LERxMode;
+
+   if (ToggleOption (&Value, Option, ContRxModeOption,
+                       sizeof(ContRxModeOption)/sizeof(tMasterBlasterOption), LR, 1))
+   {
+      MasterBlaster->LERxMode = (UCHAR)Value;
+      if (MasterBlaster->LERxMode == ENABLE)
+      {
+         /* Enable continous Tx should disable other modes */
+         MasterBlaster->LETxMode = DISABLE;
+         MasterBlaster->ContTxMode = DISABLE;
+         MasterBlaster->ContRxMode = DISABLE;
+         if (MasterBlaster->testCtrl.RxFreq > 39)
+         {
+            MasterBlaster->testCtrl.RxFreq = 39;
+         }
+         LEMode = TRUE;
+      }
+      else
+      {
+         LEMode = FALSE;
+      }
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterLETxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = MasterBlaster->LETxMode;
+
+   if (ToggleOption (&Value, Option, ContTxModeOption,
+                sizeof(ContTxModeOption)/sizeof(tMasterBlasterOption), LT, 1))
+   {
+      MasterBlaster->LETxMode = (UCHAR)Value;
+      if (MasterBlaster->LETxMode == ENABLE)
+      {
+         /* Enable continous Tx should disable other modes */
+         MasterBlaster->LERxMode = DISABLE;
+         MasterBlaster->ContTxMode = DISABLE;
+         MasterBlaster->ContRxMode = DISABLE;
+         if (MasterBlaster->testCtrl.TxFreq > MB_MAX_FREQUENCY_LE)
+         {
+            MasterBlaster->testCtrl.TxFreq = 39;
+         }
+         LEMode = TRUE;
+      }
+      else
+      {
+         LEMode = FALSE;
+      }
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterLETxPktPayload(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = MasterBlaster->LETxParms.PktPayload;
+
+   if (ToggleOption(&Value, Option, LETxPktPayloadOption,
+                    sizeof(LETxPktPayloadOption)/sizeof(tMasterBlasterOption), LTM, 1))
+   {
+      MasterBlaster->LETxParms.PktPayload = (UCHAR)Value;
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterContRxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->ContRxMode;
+   printf("\n N op\n");
+   if (ToggleOption (&Value, Option, ContRxModeOption,
+                        sizeof(ContRxModeOption)/sizeof(tMasterBlasterOption), CR,1))
+   {
+      MasterBlaster->ContRxMode = (UCHAR)Value;
+      if (MasterBlaster->ContRxMode == ENABLE)
+      {
+         // Enable continous Tx should disable continous Rx
+         MasterBlaster->ContTxMode = DISABLE;
+	 MasterBlaster->LERxMode = DISABLE;
+	 MasterBlaster->LETxMode = DISABLE;
+	 LEMode = FALSE;
+      }
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+int SetMasterBlasterBERType (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   int Value = (int)MasterBlaster->BERType;
+   if (ToggleOption (&Value, Option, BERPacketTypeOption,
+			sizeof(BERPacketTypeOption)/sizeof(tMasterBlasterOption), SB, 1))
+   {
+      MasterBlaster->BERType = (UCHAR)Value;
+      return TRUE;
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int SetMasterBlasterNothing (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option)
+{
+   UNUSED(MasterBlaster);
+   UNUSED(Option);
+
+   return TRUE;
+}
+
+//----------------------------------------------------------------------------
+
+int ToggleOption (int *Value, tMasterBlasterOption *Option, tMasterBlasterOption *OptionArray,
+                   int Size, int FieldID, int Step)
+{
+   char Opt = Option->Name[0];
+
+   int Backward = ((Opt - 'A' + 'a') == MasterBlasterMenu[FieldID].Alias[0]);
+   int i;
+   for (i = 0; i < Size; ++i)
+   {
+      if (*Value == OptionArray[i].Value)
+      {
+         if (Backward)
+         {
+            i = ((i - Step) < 0) ? (Size - Step + i) : (i - Step);
+         }
+         else
+         {
+            i = (i + Step) % Size;
+         }
+         *Value = OptionArray[i].Value;
+         return TRUE;
+      }
+   }
+   return FALSE;
+}
+
+//----------------------------------------------------------------------------
+
+int MinMaxOption (int *Value,  tMasterBlasterOption *Option, int Min, int Max)
+{
+   int NewValue = Option->Value;
+
+   if (NewValue < Min || NewValue > Max)
+   {
+      return FALSE;
+   }
+   *Value = NewValue;
+   return TRUE;
+}
+
+//----------------------------------------------------------------------------
+
+int ToggleMinMaxOption (int *Value, char *Option, int FieldID, int Min, int Max, int Step)
+{
+   char Opt = *Option;
+   int Backward = ((Opt - 'A' + 'a') == MasterBlasterMenu[FieldID].Alias[0]);
+
+   if (Backward)
+   {
+      *Value = ((*Value - Step) < Min) ? (Max + 1 - (Step - (*Value - Min))) : (*Value - Step);
+   }
+   else
+   {
+      *Value = ((*Value + Step) > Max) ? (Min + (Step - (Max + 1 - *Value))) : (*Value + Step);
+   }
+   return TRUE;
+
+}
+
+//----------------------------------------------------------------------------
diff --git a/btconfig_1.05/btconfig.h b/btconfig_1.05/btconfig.h
new file mode 100755
index 0000000..13de972
--- /dev/null
+++ b/btconfig_1.05/btconfig.h
@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Corporation. All rights reserved.
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation;
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * <Header File>
+ *
+ * <btconfig.h>
+ */
+
+#ifndef _BTCONFIG_H_
+#define _BTCONFIG_H_
+
+#define VERSION		"1.05"
+#define PS_ASIC_FILENAME  "/etc/firmware/ar3k/1020200/PS_ASIC.pst"
+#define PS_FPGA_FILENAME  "/etc/firmware/ar3k/1020200/PS_FPGA.pst"
+#define TESTPATCH_FILENAME  "/etc/firmware/ar3k/1020200/Testpatch.txt"
+#define PATCH_FILENAME  "/etc/firmware/ar3k/1020200/RamPatch.txt"
+
+#define TRUE	1
+#define FALSE	0	
+#define LINE_SIZE_MAX						3000
+#define BD_ADDR_SIZE		6
+#define BD_ADDR_PSTAG		1
+#define WRITE_PATCH		8
+#define ENABLE_PATCH		11
+#define PS_RESET		2
+#define PS_READ			0
+#define PS_WRITE		1
+#define PS_READ_RAW		3
+#define PS_WRITE_RAW		4
+#define PS_GET_LENGTH		5
+#define PS_SET_ACCESS_MODE	6
+#define PS_SET_ACCESS_PRIORITY	7
+#define PS_WRITE		1
+#define PS_DYNMEM_OVERRIDE	10
+#define PS_VERIFY_CRC		9
+#define CHANGE_BDADDR		15
+#define PS_COMMAND_HEADER	4
+#define HCI_EVENT_SIZE		7
+#define PS_RETRY_COUNT		3
+#define RAM_PS_REGION		(1<<0)
+#define RAM_PATCH_REGION	(1<<1)
+#define RAM_DYN_MEM_REGION	(1<<2)
+#define RAMPS_MAX_PS_DATA_PER_TAG       244
+#define RAMPS_MAX_PS_TAGS_PER_FILE      50
+#define PSTAG_RF_TEST_BLOCK_START   	(300)
+#define PSTAG_SYSTEM_BLOCK_START	(1)
+#define BT_SOC_INIT_TOOL_START_MAGIC_WORD 0xB1B1
+#define PSTAG_RF_PARAM_TABLE0        (PSTAG_RF_TEST_BLOCK_START+0)
+#define PSTAG_SYSCFG_PARAM_TABLE0    (PSTAG_SYSTEM_BLOCK_START+18)
+#define PATCH_MAX_LEN                     20000
+#define DYN_MEM_MAX_LEN                   40
+#define SKIP_BLANKS(str) while (*str == ' ') str++
+#define MAX_RADIO_CFG_TABLE_SIZE			1000
+#define MAX_BYTE_LENGTH    244
+#define DEBUG_EVENT_TYPE_PS		0x02
+#define DEBUG_EVENT_TYPE_MEMBLK		0x03
+#define HCI_EVENT_HEADER_SIZE		0x03
+#define HI_MAGIC_NUMBER	((const unsigned short int) 0xFADE)
+#define HI_VERSION	(0x0300)  //Version 3.0
+#define EEPROM_CONFIG	0x00020C00
+#define FPGA_REGISTER	0x4FFC
+
+// Vendor specific command OCF
+#define OCF_PS	0x000B
+#define OCF_MEMOP	0x0014
+#define OGF_TEST_CMD	0x06
+#define OCF_HOST_INTEREST	0x000A
+#define OCF_CONT_TX_TESTER	0x0023
+#define OCF_TX_TESTER		0x001B
+#define OCF_SLEEP_MODE		0x0004
+#define OCF_READ_MEMORY		0x0005
+#define OCF_WRITE_MEMORY	0x0006
+#define OCF_DISABLE_TX		0x002D
+#define OCF_TEST_MODE_SEQN_TRACKING	0x0018
+#define OCF_READ_VERSION	0x001E
+#define OCF_AUDIO_CMD		0x0013
+#define OCF_GET_BERTYPE		0x005C
+#define OCF_RX_TESTER		0x005B
+
+#define UCHAR unsigned char
+#define BOOL unsigned short
+#define UINT16 unsigned short int
+#define UINT32 unsigned int
+#define SINT16 signed short int
+#define UINT8 unsigned char
+#define SINT8 signed char
+
+typedef struct tPsTagEntry
+{
+   int   TagId;
+   UCHAR   TagLen;
+   UCHAR    TagData[RAMPS_MAX_PS_DATA_PER_TAG];
+} tPsTagEntry, *tpPsTagEntry;
+
+typedef struct tRamPatch
+{
+   int   Len;
+   UCHAR    Data[PATCH_MAX_LEN];
+} tRamPatch, *ptRamPatch;
+
+typedef struct tRamDynMemOverride
+{
+   int   Len;
+   UCHAR    Data[DYN_MEM_MAX_LEN];
+} tRamDynMemOverride, *ptRamDynMemOverride;
+
+tPsTagEntry PsTagEntry[RAMPS_MAX_PS_TAGS_PER_FILE];
+tRamPatch   RamPatch[50];
+tRamDynMemOverride RamDynMemOverride;
+
+enum MB_FILEFORMAT {
+	MB_FILEFORMAT_PS,
+	MB_FILEFORMAT_PATCH,
+	MB_FILEFORMAT_DY,
+};
+enum RamPsSection
+{
+   RAM_PS_SECTION,
+   RAM_PATCH_SECTION,
+   RAM_DYN_MEM_SECTION
+};
+
+enum eType {
+   eHex,
+   edecimal,
+};
+
+struct ST_PS_DATA_FORMAT {
+   enum eType   eDataType;
+   BOOL    bIsArray;
+};
+#define CONV_DEC_DIGIT_TO_VALUE(c) ((c) - '0')
+#define IS_HEX(c)   (IS_BETWEEN((c), '0', '9') || IS_BETWEEN((c), 'a', 'f') || IS_BETWEEN((c), 'A', 'F'))
+#define IS_BETWEEN(x, lower, upper) (((lower) <= (x)) && ((x) <= (upper)))
+#define IS_DIGIT(c) (IS_BETWEEN((c), '0', '9'))
+#define CONV_HEX_DIGIT_TO_VALUE(c) (IS_DIGIT(c) ? ((c) - '0') : (IS_BETWEEN((c), 'A', 'Z') ? ((c) - 'A' + 10) : ((c) - 'a' + 10)))
+#define BYTES_OF_PS_DATA_PER_LINE    16
+struct ST_READ_STATUS {
+	unsigned uTagID;
+   	unsigned uSection;
+	unsigned uLineCount;
+	unsigned uCharCount;
+	unsigned uByteCount;
+};
+
+//DUT MODE related
+#define MC_BCAM_COMPARE_ADDRESS           0x00008080
+#define HCI_3_PATCH_SPACE_LENGTH_1            (0x80)
+#define HCI_3_PATCH_SPACE_LENGTH_2            (0x279C)
+#define MEM_BLK_DATA_MAX                (244)
+#define MC_BCAM_VALID_ADDRESS                    0x00008100
+
+//Audio stat
+
+typedef struct tAudio_Stat {
+    UINT16      RxSilenceInsert;
+    UINT16      RxAirPktDump;
+    UINT16      RxCmplt;
+    UINT16      TxCmplt;
+    UINT16      MaxPLCGenInterval;
+    UINT16      RxAirPktStatusGood;
+    UINT16      RxAirPktStatusError;
+    UINT16      RxAirPktStatusLost;
+    UINT16      RxAirPktStatusPartial;
+    SINT16      SampleMin;
+    SINT16      SampleMax;
+    UINT16      SampleCounter;
+    UINT16      SampleStatEnable;
+} tAudioStat;
+
+//DMA stats
+
+typedef struct tBRM_Stats {
+  // DMA Stats
+  UINT32 DmaIntrs;
+
+  // Voice Stats
+  UINT16 VoiceTxDmaIntrs;
+  UINT16 VoiceTxErrorIntrs;
+  UINT16 VoiceTxDmaErrorIntrs;
+  UINT16 VoiceTxPktAvail;
+  UINT16 VoiceTxPktDumped;
+  UINT16 VoiceTxDmaSilenceInserts;
+
+  UINT16 VoiceRxDmaIntrs;
+  UINT16 VoiceRxErrorIntrs;
+  UINT16 VoiceRxGoodPkts;
+  UINT16 VoiceRxErrCrc;
+  UINT16 VoiceRxErrUnderOverFlow;
+  UINT16 VoiceRxPktDumped;
+
+  UINT16 VoiceTxReapOnError;
+  UINT16 VoiceRxReapOnError;
+  UINT16 VoiceSchedulingError;
+  UINT16 SchedOnVoiceError;
+
+  UINT16 Temp1;
+  UINT16 Temp2;
+
+  // Control Stats
+  UINT16 ErrWrongLlid;
+  UINT16 ErrL2CapLen;
+  UINT16 ErrUnderOverFlow;
+  UINT16 RxBufferDumped;
+  UINT16 ErrWrongLmpPktType;
+  UINT16 ErrWrongL2CapPktType;
+  UINT16 HecFailPkts;
+  UINT16 IgnoredPkts;
+  UINT16 CrcFailPkts;
+  UINT16 HwErrRxOverflow;
+
+  UINT16 CtrlErrNoLmpBufs;
+
+  // ACL Stats
+  UINT16 DataTxBuffers;
+  UINT16 DataRxBuffers;
+  UINT16 DataRxErrCrc;
+  UINT16 DataRxPktDumped;
+  UINT16 LmpTxBuffers;
+  UINT16 LmpRxBuffers;
+  UINT16 ForceOverQosJob;
+
+  // Sniff Stats
+  UINT16 SniffSchedulingError;
+  UINT16 SniffIntervalNoCorr;
+
+  // Test Mode Stats
+  UINT16 TestModeDroppedTxPkts;
+  UINT16 TestModeDroppedLmps;
+
+  // Error Stats
+  UINT16 TimePassedIntrs;
+  UINT16 NoCommandIntrs;
+
+} tBRM_Stats;
+
+typedef struct tSYSUTIL_ChipId {
+  char *pName;
+  UINT32 HwRev;
+} tSYSUTIL_ChipId;
+
+typedef struct tSU_RevInfo {
+  tSYSUTIL_ChipId *pChipId;
+  tSYSUTIL_ChipId *pChipRadioId;
+  UINT32 ChipRadioId;
+  UINT32 SubRadioId;
+  UINT32 RomVersion;
+  UINT32 RomBuildNumber;
+  UINT32 BuildVersion;
+  UINT32 BuildNumber;
+  UINT16 RadioFormat;
+  UINT16 RadioContent;
+  UINT16 SysCfgFormat;
+  UINT16 SysCfgContent;
+  UINT8 ProductId;
+} tSU_RevInfo;
+
+#endif
diff --git a/btconfig_1.05/btconfig.tar.bz2 b/btconfig_1.05/btconfig.tar.bz2
new file mode 100644
index 0000000..129811c
--- /dev/null
+++ b/btconfig_1.05/btconfig.tar.bz2
Binary files differ
diff --git a/btconfig_1.05/build_btconfig.sh b/btconfig_1.05/build_btconfig.sh
new file mode 100755
index 0000000..2885118
--- /dev/null
+++ b/btconfig_1.05/build_btconfig.sh
@@ -0,0 +1,10 @@
+source ../../../../a5s_linux_sdk/ambarella/build/env/CodeSourcery.env
+PATH=$PATH:$ARM_LINUX_TOOLCHAIN_DIR/bin
+
+make -f Makefile
+
+rm -rf fakeroot
+mkdir -p fakeroot/usr/bin
+cp -d btconfig fakeroot/usr/bin
+
+tar cjfv btconfig.tar.bz2 fakeroot
diff --git a/btconfig_1.05/compat/arc4random.c b/btconfig_1.05/compat/arc4random.c
new file mode 100755
index 0000000..29528ce
--- /dev/null
+++ b/btconfig_1.05/compat/arc4random.c
@@ -0,0 +1,158 @@
+/*
+ * Arc4 random number generator for OpenBSD.
+ * Copyright 1996 David Mazieres <dm@lcs.mit.edu>.
+ *
+ * Modification and redistribution in source and binary forms is
+ * permitted provided that due credit is given to the author and the
+ * OpenBSD project by leaving this copyright notice intact.
+ */
+
+/*
+ * This code is derived from section 17.1 of Applied Cryptography,
+ * second edition, which describes a stream cipher allegedly
+ * compatible with RSA Labs "RC4" cipher (the actual description of
+ * which is a trade secret).  The same algorithm is used as a stream
+ * cipher called "arcfour" in Tatu Ylonen's ssh package.
+ *
+ * Here the stream cipher has been modified always to include the time
+ * when initializing the state.  That makes it impossible to
+ * regenerate the same random sequence twice, so this can't be used
+ * for encryption, but will generate good random numbers.
+ *
+ * RC4 is a registered trademark of RSA Laboratories.
+ */
+
+#include <sys/time.h>
+
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "arc4random.h"
+
+struct arc4_stream {
+	uint8_t i;
+	uint8_t j;
+	uint8_t s[256];
+};
+
+static int rs_initialized;
+static struct arc4_stream rs;
+static int arc4_count;
+
+static void
+arc4_init(struct arc4_stream *as)
+{
+	int n;
+
+	for (n = 0; n < 256; n++)
+		as->s[n] = n;
+	as->i = 0;
+	as->j = 0;
+}
+
+static void
+arc4_addrandom(struct arc4_stream *as, unsigned char *dat, int datlen)
+{
+	int n;
+	uint8_t si;
+
+	as->i--;
+	for (n = 0; n < 256; n++) {
+		as->i = (as->i + 1);
+		si = as->s[as->i];
+		as->j = (as->j + si + dat[n % datlen]);
+		as->s[as->i] = as->s[as->j];
+		as->s[as->j] = si;
+	}
+	as->j = as->i;
+}
+
+static uint8_t
+arc4_getbyte(struct arc4_stream *as)
+{
+	uint8_t si, sj;
+
+	as->i = (as->i + 1);
+	si = as->s[as->i];
+	as->j = (as->j + si);
+	sj = as->s[as->j];
+	as->s[as->i] = sj;
+	as->s[as->j] = si;
+	return (as->s[(si + sj) & 0xff]);
+}
+
+static uint32_t
+arc4_getword(struct arc4_stream *as)
+{
+	uint32_t val;
+
+	val = arc4_getbyte(as) << 24;
+	val |= arc4_getbyte(as) << 16;
+	val |= arc4_getbyte(as) << 8;
+	val |= arc4_getbyte(as);
+	return val;
+}
+
+static void
+arc4_stir(struct arc4_stream *as)
+{
+	int fd;
+	struct {
+		struct timeval tv;
+		unsigned int rnd[(128 - sizeof(struct timeval)) /
+			sizeof(unsigned int)];
+	}       rdat;
+	int n;
+
+	gettimeofday(&rdat.tv, NULL);
+	fd = open("/dev/urandom", O_RDONLY);
+	if (fd != -1) {
+		n = read(fd, rdat.rnd, sizeof(rdat.rnd));
+		close(fd);
+	}
+
+	/* fd < 0?  Ah, what the heck. We'll just take
+	 * whatever was on the stack... */
+	arc4_addrandom(as, (void *) &rdat, sizeof(rdat));
+
+	/*
+	 * Throw away the first N words of output, as suggested in the
+	 * paper "Weaknesses in the Key Scheduling Algorithm of RC4"
+	 * by Fluher, Mantin, and Shamir.  (N = 256 in our case.)
+	 */
+	for (n = 0; n < 256 * 4; n++)
+		arc4_getbyte(as);
+	arc4_count = 1600000;
+}
+
+void
+arc4random_stir()
+{
+
+	if (!rs_initialized) {
+		arc4_init(&rs);
+		rs_initialized = 1;
+	}
+	arc4_stir(&rs);
+}
+
+void
+arc4random_addrandom(unsigned char *dat, int datlen)
+{
+
+	if (!rs_initialized)
+		arc4random_stir();
+	arc4_addrandom(&rs, dat, datlen);
+}
+
+uint32_t
+arc4random()
+{
+
+	arc4_count -= 4;
+	if (!rs_initialized || arc4_count <= 0)
+		arc4random_stir();
+	return arc4_getword(&rs);
+}
diff --git a/btconfig_1.05/compat/arc4random.h b/btconfig_1.05/compat/arc4random.h
new file mode 100755
index 0000000..6724cef
--- /dev/null
+++ b/btconfig_1.05/compat/arc4random.h
@@ -0,0 +1,36 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2010 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef ARC4RANDOM_H
+#define ARC4RANDOM_H
+
+#include <stdint.h>
+
+void arc4random_stir(void);
+void arc4random_addrandom(unsigned char *, int);
+uint32_t arc4random(void);
+#endif
diff --git a/btconfig_1.05/compat/closefrom.c b/btconfig_1.05/compat/closefrom.c
new file mode 100755
index 0000000..5c02005
--- /dev/null
+++ b/btconfig_1.05/compat/closefrom.c
@@ -0,0 +1,42 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <unistd.h>
+
+#include "closefrom.h"
+
+int
+closefrom(int fd)
+{
+	int max = getdtablesize();
+	int i;
+	int r = 0;
+
+	for (i = fd; i < max; i++)
+		r += close(i);
+	return r;
+}
diff --git a/btconfig_1.05/compat/closefrom.h b/btconfig_1.05/compat/closefrom.h
new file mode 100755
index 0000000..6b8709b
--- /dev/null
+++ b/btconfig_1.05/compat/closefrom.h
@@ -0,0 +1,31 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef CLOSEFROM_H
+#define CLOSEFROM_H
+int closefrom(int);
+#endif
diff --git a/btconfig_1.05/compat/getline.c b/btconfig_1.05/compat/getline.c
new file mode 100755
index 0000000..79fcf1e
--- /dev/null
+++ b/btconfig_1.05/compat/getline.c
@@ -0,0 +1,75 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <errno.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "getline.h"
+
+/* Redefine a small buffer for our simple text config files */
+#undef BUFSIZ
+#define BUFSIZ 128
+
+ssize_t
+getline(char ** __restrict buf, size_t * __restrict buflen,
+    FILE * __restrict fp)
+{
+	size_t bytes, newlen;
+	char *newbuf, *p;
+	
+	if (buf == NULL || buflen == NULL) {
+		errno = EINVAL;
+		return -1;
+	}
+	if (*buf == NULL)
+		*buflen = 0;
+	
+	bytes = 0;
+	do {
+		if (feof(fp))
+			break;
+		if (*buf == NULL || bytes != 0) {
+			newlen = *buflen + BUFSIZ;
+			newbuf = realloc(*buf, newlen);
+			if (newbuf == NULL)
+				return -1;
+			*buf = newbuf;
+			*buflen = newlen;
+		}
+		p = *buf + bytes;
+		memset(p, 0, BUFSIZ);
+		if (fgets(p, BUFSIZ, fp) == NULL)
+			break;
+		bytes += strlen(p);
+	} while (bytes == 0 || *(*buf + (bytes - 1)) != '\n');
+	if (bytes == 0)
+		return -1;
+	return bytes;
+}
diff --git a/btconfig_1.05/compat/getline.h b/btconfig_1.05/compat/getline.h
new file mode 100755
index 0000000..be3b57c
--- /dev/null
+++ b/btconfig_1.05/compat/getline.h
@@ -0,0 +1,36 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef GETLINE_H
+#define GETLINE_H
+
+#include <sys/types.h>
+#include <stdio.h>
+
+ssize_t getline(char ** __restrict buf, size_t * __restrict buflen,
+    FILE * __restrict fp);
+#endif
diff --git a/btconfig_1.05/compat/linkaddr.c b/btconfig_1.05/compat/linkaddr.c
new file mode 100755
index 0000000..8c7a6c8
--- /dev/null
+++ b/btconfig_1.05/compat/linkaddr.c
@@ -0,0 +1,120 @@
+/*-
+ * Copyright (c) 1990, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+#if defined(LIBC_SCCS) && !defined(lint)
+static char sccsid[] = "@(#)linkaddr.c	8.1 (Berkeley) 6/4/93";
+#endif /* LIBC_SCCS and not lint */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if_dl.h>
+
+#include <string.h>
+
+/* States*/
+#define NAMING	0
+#define GOTONE	1
+#define GOTTWO	2
+#define RESET	3
+/* Inputs */
+#define	DIGIT	(4*0)
+#define	END	(4*1)
+#define DELIM	(4*2)
+#define LETTER	(4*3)
+
+void
+link_addr(addr, sdl)
+	const char *addr;
+	struct sockaddr_dl *sdl;
+{
+	char *cp = sdl->sdl_data;
+	char *cplim = sdl->sdl_len + (char *)(void *)sdl;
+	int byte = 0, state = NAMING;
+	int newaddr = 0;
+
+	(void)memset(&sdl->sdl_family, 0, (size_t)sdl->sdl_len - 1);
+	sdl->sdl_family = AF_LINK;
+	do {
+		state &= ~LETTER;
+		if ((*addr >= '0') && (*addr <= '9')) {
+			newaddr = *addr - '0';
+		} else if ((*addr >= 'a') && (*addr <= 'f')) {
+			newaddr = *addr - 'a' + 10;
+		} else if ((*addr >= 'A') && (*addr <= 'F')) {
+			newaddr = *addr - 'A' + 10;
+		} else if (*addr == 0) {
+			state |= END;
+		} else if (state == NAMING &&
+			   (((*addr >= 'A') && (*addr <= 'Z')) ||
+			   ((*addr >= 'a') && (*addr <= 'z'))))
+			state |= LETTER;
+		else
+			state |= DELIM;
+		addr++;
+		switch (state /* | INPUT */) {
+		case NAMING | DIGIT:
+		case NAMING | LETTER:
+			*cp++ = addr[-1];
+			continue;
+		case NAMING | DELIM:
+			state = RESET;
+			sdl->sdl_nlen = cp - sdl->sdl_data;
+			continue;
+		case GOTTWO | DIGIT:
+			*cp++ = byte;
+			/* FALLTHROUGH */
+		case RESET | DIGIT:
+			state = GOTONE;
+			byte = newaddr;
+			continue;
+		case GOTONE | DIGIT:
+			state = GOTTWO;
+			byte = newaddr + (byte << 4);
+			continue;
+		default: /* | DELIM */
+			state = RESET;
+			*cp++ = byte;
+			byte = 0;
+			continue;
+		case GOTONE | END:
+		case GOTTWO | END:
+			*cp++ = byte;
+			/* FALLTHROUGH */
+		case RESET | END:
+			break;
+		}
+		break;
+	} while (cp < cplim);
+	sdl->sdl_alen = cp - LLADDR(sdl);
+	newaddr = cp - (char *)(void *)sdl;
+	if ((size_t) newaddr > sizeof(*sdl))
+		sdl->sdl_len = newaddr;
+	return;
+}
diff --git a/btconfig_1.05/compat/strlcpy.c b/btconfig_1.05/compat/strlcpy.c
new file mode 100755
index 0000000..2cdd6a5
--- /dev/null
+++ b/btconfig_1.05/compat/strlcpy.c
@@ -0,0 +1,51 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+
+#include "strlcpy.h"
+
+size_t
+strlcpy(char *dst, const char *src, size_t size)
+{
+	const char *s = src;
+	size_t n = size;
+
+	if (n && --n)
+		do {
+			if (!(*dst++ = *src++))
+				break;
+		} while (--n);
+
+	if (!n) {
+		if (size)
+			*dst = '\0';
+		while (*src++);
+	}
+
+	return src - s - 1;
+}
diff --git a/btconfig_1.05/compat/strlcpy.h b/btconfig_1.05/compat/strlcpy.h
new file mode 100755
index 0000000..75eaec8
--- /dev/null
+++ b/btconfig_1.05/compat/strlcpy.h
@@ -0,0 +1,34 @@
+/* 
+ * dhcpcd - DHCP client daemon
+ * Copyright (c) 2006-2009 Roy Marples <roy@marples.name>
+ * All rights reserved
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef STRLCPY_H
+#define STRLCPY_H
+
+#include <sys/types.h>
+
+size_t strlcpy(char *, const char *, size_t);
+#endif
diff --git a/btconfig_1.05/masterblaster.h b/btconfig_1.05/masterblaster.h
new file mode 100755
index 0000000..c5fd410
--- /dev/null
+++ b/btconfig_1.05/masterblaster.h
@@ -0,0 +1,413 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Corporation. All rights reserved.
+ * 
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation;
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * <Header file contains required data for master blaster mode>
+ *
+ * <masterblaster.h>
+ */
+
+#ifndef _MASTERBLASTER_H_
+#define _MASTERBLASTER_H_
+#include "btconfig.h"
+
+#define INVALID_MASTERBLASTER_FIELD    (-1)
+#define UNUSED(x) (x=x)
+// Bluetooth Packet Type Identifiers
+#define  MAX_TRANSMIT_POWER_CONTROL_ENTRIES    15
+
+#define LC_JTAG_MODEM_REGS_ADDRESS               0x00020800
+#define AGC_BYPASS_ADDRESS                       0x0000040c
+#define AGC_BYPASS_ENABLE_MASK                   0x00000001
+#define AGC_BYPASS_ENABLE_LSB                    0
+#define AGC_BYPASS_ENABLE_SET(x)                 (((x) << AGC_BYPASS_ENABLE_LSB) & AGC_BYPASS_ENABLE_MASK)
+#define LC_DEV_PARAM_CTL_ADDRESS                 0x00020010
+#define LC_DEV_PARAM_CTL_FREQ_HOP_EN_MASK        0x00000001
+#define LC_DEV_PARAM_CTL_RX_FREQ_MASK            0x00007f00
+#define LC_DEV_PARAM_CTL_WHITEN_EN_MASK          0x00008000
+#define LC_DEV_PARAM_CTL_RX_FREQ_SET(x)          (((x) << LC_DEV_PARAM_CTL_RX_FREQ_LSB) & LC_DEV_PARAM_CTL_RX_FREQ_MASK)
+#define LC_DEV_PARAM_CTL_RX_FREQ_LSB             8
+
+#define CORR_PARAM1_ADDRESS                      0x00000048
+#define CORR_PARAM1_TIM_THR_MASK                 0xfc000000
+#define CORR_PARAM1_TIM_THR_LSB                  26
+#define CORR_PARAM1_TIM_THR_SET(x)               (((x) << CORR_PARAM1_TIM_THR_LSB) & CORR_PARAM1_TIM_THR_MASK)
+
+typedef struct tBtHost_Interest {
+  UINT16 MagicNumber;
+  UINT16 Version;
+  UINT32 TraceDataAddr;
+  UINT32 GlobalDmaStats;   // BRM Global DMA Statistics
+  UINT32 TpcTableAddr;     // SysCfg Transmit power table
+  UINT32 AudioStatAddr;
+  UINT32 AudioInternalAddr;
+  UINT32 SysCfgAddr;
+  UINT32 ReservedRamAddr;
+  UINT32 HostConfigAddr;
+  UINT32 RamVersionAddr;
+  // Version 1.01
+  UINT32 BrmGlobalDataAddr;  // BRM Global Context pointer
+  UINT32 LeGlobalDataAddr;   // LE Global Context pointer
+  // Version 1.02
+  UINT32 MmGlobalDataAddr;
+} tBtHostInterest;
+
+typedef struct PsSysCfgTransmitPowerControlEntry {
+    SINT8               TxPowerLevel;
+    UINT32              RadioConfig;
+    UINT32              EdrRadioConfig;
+    SINT16              Slope;
+    SINT16              EdrSlope;
+    UINT8               TxFreqCorr;
+    UINT8               EdrTxFreqCorr;
+} tPsSysCfgTransmitPowerControlEntry;
+
+typedef struct PsSysCfgTransmitPowerControlTable {
+  int  NumOfEntries;
+  tPsSysCfgTransmitPowerControlEntry t[MAX_TRANSMIT_POWER_CONTROL_ENTRIES];
+} tPsSysCfgTransmitPowerControlTable;
+typedef UCHAR tBRM_PktType;
+
+enum {
+   TxTest_PktType_NULL    = 0x00,
+   TxTest_PktType_POLL    = 0x01,
+   TxTest_PktType_FHS     = 0x02,
+   TxTest_PktType_DM1     = 0x03,
+   TxTest_PktType_DH1     = 0x04,
+   TxTest_PktType_HV1     = 0x05,
+   TxTest_PktType_HV2     = 0x06,
+   TxTest_PktType_HV3     = 0x07,
+   TxTest_PktType_DV      = 0x08,
+   TxTest_PktType_AUX1    = 0x09,
+   TxTest_PktType_DM3     = 0x0A,
+   TxTest_PktType_DH3     = 0x0B,
+   TxTest_PktType_DM5     = 0x0E,
+   TxTest_PktType_DH5     = 0x0F,
+   TxTest_PktType_2DH1    = 0x24,
+   TxTest_PktType_2DH3    = 0x2A,
+   TxTest_PktType_2DH5    = 0x2E,
+   TxTest_PktType_3DH1    = 0x28,
+   TxTest_PktType_3DH3    = 0x2B,
+   TxTest_PktType_3DH5    = 0x2F,
+   TxTest_PktType_Invalid = 0xff,
+};
+
+typedef UCHAR tBRM_eSCO_PktType;
+
+enum {
+   TxTest_PktType_EV3     = 0x17,
+   TxTest_PktType_EV4     = 0x1C,
+   TxTest_PktType_EV5     = 0x1D,
+   TxTest_PktType_2EV3    = 0x36,
+   TxTest_PktType_2EV5    = 0x3C,
+   TxTest_PktType_3EV3    = 0x37,
+   TxTest_PktType_3EV5    = 0x3D,
+};
+
+typedef UCHAR tBRM_PktMode;
+
+enum {
+   eBRM_Mode_Basic = 0,
+   eBRM_Mode_2Mbps = 2,
+   eBRM_Mode_3Mbps = 3
+};
+
+// tBRM_TestMode
+enum {
+   eBRM_TestMode_Pause = 0,
+   eBRM_TestMode_TX_0,
+   eBRM_TestMode_TX_1,
+   eBRM_TestMode_TX_1010,
+   eBRM_TestMode_TX_PRBS,
+   eBRM_TestMode_Loop_ACL,
+   eBRM_TestMode_Loop_SCO,
+   eBRM_TestMode_Loop_ACL_No_Whitening,
+   eBRM_TestMode_Loop_SCO_No_Whitening,
+   eBRM_TestMode_TX_11110000,
+   eBRM_TestMode_Rx,
+   eBRM_TestMode_Exit = 255,
+};
+enum {
+   Cont_Tx_Raw_1MHz = 0,
+   Cont_Tx_Raw_2MHz,
+   Cont_Tx_Raw_3MHz,
+   Cont_Tx_Regular,
+   CW_Single_Tone,
+};
+typedef UCHAR tBRM_TestMode;
+
+typedef struct tBRM_TestControl {
+   tBRM_TestMode       Mode;
+   UCHAR               HopMode;
+   UCHAR               TxFreq;
+   UCHAR               RxFreq;
+   UCHAR               Power;
+// UCHAR               PollPeriod;
+   UCHAR               Packet;
+   UCHAR               SkipRxSlot;
+   int              DataLen;
+} tBRM_TestControl;
+
+typedef struct tLE_TxParms {
+   UCHAR PktPayload;
+} tLE_TxParms;
+
+typedef struct tBRM_Control_packet {
+   tBRM_TestControl testCtrl;
+   UCHAR bdaddr[6];
+   UCHAR ContTxMode;    // Continuous TX Mode
+   UCHAR ContTxType;
+   UCHAR ContRxMode;    // Continuous RX Mode
+   UCHAR BERType;
+   UCHAR LERxMode;
+   UCHAR LETxMode;
+   tLE_TxParms LETxParms;
+} tBRM_Control_packet;
+
+
+#define DM1_MAX_PAYLOAD             17
+#define DH1_MAX_PAYLOAD             27
+#define DM3_MAX_PAYLOAD             121
+#define DH3_MAX_PAYLOAD             183
+#define DM5_MAX_PAYLOAD             224
+#define DH5_MAX_PAYLOAD             339
+#define AUX1_MAX_PAYLOAD            29
+#define E2_DH1_MAX_PAYLOAD          54
+#define E2_DH3_MAX_PAYLOAD          367
+#define E2_DH5_MAX_PAYLOAD          679
+#define E3_DH1_MAX_PAYLOAD          83
+#define E3_DH3_MAX_PAYLOAD          552
+#define E3_DH5_MAX_PAYLOAD          1021
+
+enum E_MasterBlasterFieldID
+{
+   CR = 0,
+   CT,
+   LR,
+   LT,
+   LTM,
+   CX,
+   TM,
+   HM,
+   TF,
+   RF,
+   PT,
+   DL,
+   PO,
+   BA,
+   SB,
+   GB,
+   RX,
+   TX,
+   EN,
+   ST,
+   EX,
+   EXX,
+};
+
+enum E_MasterBlasterTestFlag
+{
+   MB_NO_TEST = 0,
+   MB_RX_TEST,
+   MB_TX_TEST,
+   MB_CONT_RX_TEST,
+   MB_CONT_TX_TEST,
+   MB_LE_RX_TEST,
+   MB_LE_TX_TEST,
+};
+
+enum E_DisableEnable
+{
+   DISABLE = 0,
+   ENABLE = 1,
+};
+
+#define MB_MIN_DATALEN			0
+#define MB_MAX_DATALEN			1021
+#define MB_MIN_FREQUENCY		0
+#define MB_MAX_FREQUENCY		79
+#define MB_MIN_FREQUENCY_LE		0
+#define MB_MAX_FREQUENCY_LE		39
+#define MB_MIN_DATALEN_LE		0
+#define MB_MAX_DATALEN_LE		37
+typedef struct STR_MasterBlasterOption
+{
+   char *Name;
+   int Value;
+} tMasterBlasterOption;
+
+typedef struct STR_MasterBlasterField
+{
+   char *Name;
+   char *Alias;
+   char *Usage;
+   int Default;
+   tMasterBlasterOption *Options;
+   int (*pFunc)(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+} tMasterBlasterField;
+
+static tMasterBlasterOption TestModeOption[] =
+{
+   {"TX_0",                   eBRM_TestMode_TX_0},
+   {"TX_1",                   eBRM_TestMode_TX_1},
+   {"TX_1010",                eBRM_TestMode_TX_1010},
+   {"TX_PRBS",                eBRM_TestMode_TX_PRBS},
+   {"TX_11110000",            eBRM_TestMode_TX_11110000},
+   {"RX",                     eBRM_TestMode_Rx},
+};
+
+static tMasterBlasterOption HopModeOption[] =
+{
+   {"Disable",                DISABLE},
+   {"Enable",                 ENABLE},
+};
+
+static tMasterBlasterOption PacketTypeOption[] =
+{
+   {"DM1",                    TxTest_PktType_DM1},
+   {"DM3",                    TxTest_PktType_DM3},
+   {"DM5",                    TxTest_PktType_DM5},
+   {"DH1",                    TxTest_PktType_DH1},
+   {"DH3",                    TxTest_PktType_DH3},
+   {"DH5",                    TxTest_PktType_DH5},
+   {"2-DH1",                  TxTest_PktType_2DH1},
+   {"2-DH3",                  TxTest_PktType_2DH3},
+   {"2-DH5",                  TxTest_PktType_2DH5},
+   {"3-DH1",                  TxTest_PktType_3DH1},
+   {"3-DH3",                  TxTest_PktType_3DH3},
+   {"3-DH5",                  TxTest_PktType_3DH5},
+};
+
+static int MaxDataLenOption[] =
+{
+   DM1_MAX_PAYLOAD,
+   DM3_MAX_PAYLOAD,
+   DM5_MAX_PAYLOAD,
+   DH1_MAX_PAYLOAD,
+   DH3_MAX_PAYLOAD,
+   DH5_MAX_PAYLOAD,
+   E2_DH1_MAX_PAYLOAD,
+   E2_DH3_MAX_PAYLOAD,
+   E2_DH5_MAX_PAYLOAD,
+   E3_DH1_MAX_PAYLOAD,
+   E3_DH3_MAX_PAYLOAD,
+   E3_DH5_MAX_PAYLOAD,
+};
+
+enum {
+   eBRM_BERMode_ALL = 0, // ALL type
+   eBRM_BERMode_ALL_DATA, // All type except dm1,dm3,dm5
+   eBRM_BERMode_DM1,
+   eBRM_BERMode_DM3,
+   eBRM_BERMode_DM5,
+   eBRM_BERMode_DH1,
+   eBRM_BERMode_DH3,
+   eBRM_BERMode_DH5,
+   eBRM_BERMode_2DH1,
+   eBRM_BERMode_2DH3,
+   eBRM_BERMode_2DH5,
+   eBRM_BERMode_3DH1,
+   eBRM_BERMode_3DH3,
+   eBRM_BERMode_3DH5,
+};
+
+static tMasterBlasterOption BERPacketTypeOption[] =
+{
+   {"ALL",                  eBRM_BERMode_ALL},
+   {"ALL_DATA",             eBRM_BERMode_ALL_DATA},
+   {"DM1",                  eBRM_BERMode_DM1},
+   {"DM3",                  eBRM_BERMode_DM3},
+   {"DM5",                  eBRM_BERMode_DM5},
+   {"DH1",                  eBRM_BERMode_DH1},
+   {"DH3",                  eBRM_BERMode_DH3},
+   {"DH5",                  eBRM_BERMode_DH5},
+   {"2DH1",                 eBRM_BERMode_2DH1},
+   {"2DH3",                 eBRM_BERMode_2DH3},
+   {"2DH5",                 eBRM_BERMode_2DH5},
+   {"3DH1",                 eBRM_BERMode_3DH1},
+   {"3DH3",                 eBRM_BERMode_3DH3},
+   {"3DH5",                 eBRM_BERMode_3DH5},
+};
+
+static tMasterBlasterOption ContTxModeOption[] =
+{
+   {"Disable",                DISABLE},
+   {"Enable",                 ENABLE},
+};
+
+static tMasterBlasterOption ContTxTypeOption[] =
+{
+   {"Raw_1MHz",                  Cont_Tx_Raw_1MHz},
+   {"Raw_2MHz",                  Cont_Tx_Raw_2MHz},
+   {"Raw_3MHz",                  Cont_Tx_Raw_3MHz},
+   {"Regular_BT_Packet_Format",  Cont_Tx_Regular},
+   {"CW_Single_Tone",		 CW_Single_Tone},
+};
+
+static tMasterBlasterOption ContRxModeOption[] =
+{
+   {"Disable",                DISABLE},
+   {"Enable",                 ENABLE},
+};
+
+static tMasterBlasterOption LETxPktPayloadOption[] =
+{
+   {"Random_9",               0},
+   {"11110000",               1},
+   {"10101010",               2},
+   {"Random_15",              3},
+   {"11111111",               4},
+   {"00000000",               5},
+   {"00001111",               6},
+   {"01010101",               7},
+};
+
+//----------------------------------------------------------------------------
+// Prototypes
+//----------------------------------------------------------------------------
+
+void InitMasterBlaster (tBRM_Control_packet *MasterBlaster, bdaddr_t *BdAddr, UCHAR *SkipRxSlot);
+
+int CheckField (tBRM_Control_packet MasterBlaster, char *FieldAlias);
+int GetTestModeOptionIndex (int Mode);
+int GetPacketTypeOptionIndex (int PacketType);
+
+void PrintMasterBlasterMenu (tBRM_Control_packet *MasterBlaster);
+int SetMasterBlasterTestMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterHopMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterPacketType (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterTxFreq (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterRxFreq (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterPower (tBRM_Control_packet *MasterBlaster, char *Option);
+int SetMasterBlasterDataLen (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterBdAddr (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterContTxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterContTxType (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterNothing (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterContRxMode (tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterLERxMode(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterLETxMode(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterLETxPktPayload(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+int SetMasterBlasterBERType(tBRM_Control_packet *MasterBlaster, tMasterBlasterOption *Option);
+
+int ToggleOption (int *Value, tMasterBlasterOption *Option, tMasterBlasterOption *OptionArray,
+                     int Size, int FieldID, int Step);
+int MinMaxOption (int *Value, tMasterBlasterOption *Option, int Min, int Max);
+int ToggleMinMaxOption (int *Value, char *Option, int FieldID, int Min, int Max, int Step);
+
+//----------------------------------------------------------------------------
+// Variables
+//----------------------------------------------------------------------------
+
+extern tMasterBlasterField MasterBlasterMenu[];
+extern tPsSysCfgTransmitPowerControlTable  TpcTable;
+
+#endif // _MASTERBLASTER_H_
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/bmiloader b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/bmiloader
new file mode 100755
index 0000000..55626f6
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/bmiloader
Binary files differ
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/dbgParser b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/dbgParser
new file mode 100755
index 0000000..c12e413
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/dbgParser
Binary files differ
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/drvdebugctrl b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/drvdebugctrl
new file mode 100755
index 0000000..8bb12ad
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/drvdebugctrl
Binary files differ
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/eeprom b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/eeprom
new file mode 100755
index 0000000..a428f57
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/eeprom
Binary files differ
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/recEvent b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/recEvent
new file mode 100755
index 0000000..3f7ab32
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/recEvent
Binary files differ
diff --git a/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/restore.sh b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/restore.sh
new file mode 100755
index 0000000..953ee6e
--- /dev/null
+++ b/host/.output/A5S_ARM_NATIVEMMC-SDIO/image/restore.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+if [ -z "$WORKAREA" ]
+then
+        echo "Please set your WORKAREA environment variable."
+        exit
+fi
+
+if [ -z "$ATH_PLATFORM" ]
+then
+        echo "Please set your ATH_PLATFORM environment variable."
+        exit 1
+fi
+
+if [ -z "$NETIF" ]
+then
+        NETIF=eth1
+fi
+
+export IMAGEPATH=${IMAGEPATH:-$WORKAREA/host/.output/$ATH_PLATFORM/image}
+
+/sbin/ifconfig $NETIF down
+rmmod ar6000
+sleep 2
+case $ATH_PLATFORM in
+        LOCAL_i686-SDIO|LOCAL_i686-CF|SANDGATEII_ARM-SDIO|SANDGATEII_ARM-CF)
+        /sbin/insmod $IMAGEPATH/ar6000.ko
+        ;;
+        *)
+        /sbin/insmod $IMAGEPATH/ar6000.o
+esac
diff --git a/host/include/a_config.h b/host/include/a_config.h
new file mode 100644
index 0000000..087ad4c
--- /dev/null
+++ b/host/include/a_config.h
@@ -0,0 +1,58 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_config.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains software configuration options that enables
+// specific software "features"
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_CONFIG_H_
+#define _A_CONFIG_H_
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/config.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/config.h"
+#endif
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/config_linux.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/config_rexos.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/config.h"
+#pragma warning( disable:4242)
+#pragma warning( disable:4100)
+#pragma warning( disable:4189)
+#pragma warning( disable:4244)
+#pragma warning( disable:4701)
+#pragma warning( disable:4389)
+#pragma warning( disable:4057)
+#pragma warning( disable:28193)
+#endif
+
+#endif
+
diff --git a/host/include/a_debug.h b/host/include/a_debug.h
new file mode 100644
index 0000000..a1b732e
--- /dev/null
+++ b/host/include/a_debug.h
@@ -0,0 +1,220 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_debug.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DEBUG_H_
+#define _A_DEBUG_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#include <a_types.h>
+#include <a_osapi.h>
+
+    /* standard debug print masks bits 0..7 */
+#define ATH_DEBUG_ERR   (1 << 0)   /* errors */
+#define ATH_DEBUG_WARN  (1 << 1)   /* warnings */
+#define ATH_DEBUG_INFO  (1 << 2)   /* informational (module startup info) */
+#define ATH_DEBUG_TRC   (1 << 3)   /* generic function call tracing */
+#define ATH_DEBUG_RSVD1 (1 << 4)
+#define ATH_DEBUG_RSVD2 (1 << 5)
+#define ATH_DEBUG_RSVD3 (1 << 6)
+#define ATH_DEBUG_RSVD4 (1 << 7)
+
+#define ATH_DEBUG_MASK_DEFAULTS  (ATH_DEBUG_ERR | ATH_DEBUG_WARN)
+#define ATH_DEBUG_ANY  0xFFFF
+
+    /* other aliases used throughout */
+#define ATH_DEBUG_ERROR   ATH_DEBUG_ERR
+#define ATH_LOG_ERR       ATH_DEBUG_ERR
+#define ATH_LOG_INF       ATH_DEBUG_INFO
+#define ATH_LOG_TRC       ATH_DEBUG_TRC
+#define ATH_DEBUG_TRACE   ATH_DEBUG_TRC
+#define ATH_DEBUG_INIT    ATH_DEBUG_INFO
+
+    /* bits 8..31 are module-specific masks */
+#define ATH_DEBUG_MODULE_MASK_SHIFT   8
+
+    /* macro to make a module-specific masks */
+#define ATH_DEBUG_MAKE_MODULE_MASK(index)  (1 << (ATH_DEBUG_MODULE_MASK_SHIFT + (index)))
+
+void DebugDumpBytes(A_UCHAR *buffer, A_UINT16 length, char *pDescription);
+
+/* Debug support on a per-module basis
+ *
+ * Usage:
+ *
+ *   Each module can utilize it's own debug mask variable.  A set of commonly used
+ *   masks are provided (ERRORS, WARNINGS, TRACE etc..).  It is up to each module
+ *   to define module-specific masks using the macros above.
+ *
+ *   Each module defines a single debug mask variable debug_XXX where the "name" of the module is
+ *   common to all C-files within that module.  This requires every C-file that includes a_debug.h
+ *   to define the module name in that file.
+ *
+ *   Example:
+ *
+ *   #define ATH_MODULE_NAME htc
+ *   #include "a_debug.h"
+ *
+ *   This will define a debug mask structure called debug_htc and all debug macros will reference this
+ *   variable.
+ *
+ *   A module can define module-specific bit masks using the ATH_DEBUG_MAKE_MODULE_MASK() macro:
+ *
+ *      #define ATH_DEBUG_MY_MASK1  ATH_DEBUG_MAKE_MODULE_MASK(0)
+ *      #define ATH_DEBUG_MY_MASK2  ATH_DEBUG_MAKE_MODULE_MASK(1)
+ *
+ *   The instantiation of the debug structure should be made by the module.  When a module is
+ *   instantiated, the module can set a description string, a default mask and an array of description
+ *   entries containing information on each module-defined debug mask.
+ *   NOTE: The instantiation is statically allocated, only one instance can exist per module.
+ *
+ *   Example:
+ *
+ *
+ *   #define ATH_DEBUG_BMI  ATH_DEBUG_MAKE_MODULE_MASK(0)
+ *
+ *   #ifdef DEBUG
+ *   static ATH_DEBUG_MASK_DESCRIPTION bmi_debug_desc[] = {
+ *       { ATH_DEBUG_BMI , "BMI Tracing"},   <== description of the module specific mask
+ *   };
+ *
+ *   ATH_DEBUG_INSTANTIATE_MODULE_VAR(bmi,
+ *                                    "bmi"  <== module name
+ *                                    "Boot Manager Interface",  <== description of module
+ *                                    ATH_DEBUG_MASK_DEFAULTS,          <== defaults
+ *                                    ATH_DEBUG_DESCRIPTION_COUNT(bmi_debug_desc),
+ *                                    bmi_debug_desc);
+ *
+ *   #endif
+ *
+ *  A module can optionally register it's debug module information in order for other tools to change the
+ *  bit mask at runtime.  A module can call  A_REGISTER_MODULE_DEBUG_INFO() in it's module
+ *  init code.  This macro can be called multiple times without consequence.  The debug info maintains
+ *  state to indicate whether the information was previously registered.
+ *
+ * */
+
+#define ATH_DEBUG_MAX_MASK_DESC_LENGTH   32
+#define ATH_DEBUG_MAX_MOD_DESC_LENGTH    64
+
+typedef struct {
+    A_UINT32 Mask;
+    A_CHAR   Description[ATH_DEBUG_MAX_MASK_DESC_LENGTH];
+} ATH_DEBUG_MASK_DESCRIPTION;
+
+#define ATH_DEBUG_INFO_FLAGS_REGISTERED (1 << 0)
+
+typedef struct  _ATH_DEBUG_MODULE_DBG_INFO{
+    struct _ATH_DEBUG_MODULE_DBG_INFO *pNext;
+    A_CHAR                      ModuleName[16];
+    A_CHAR                      ModuleDescription[ATH_DEBUG_MAX_MOD_DESC_LENGTH];
+    A_UINT32                    Flags;
+    A_UINT32                    CurrentMask;
+    int                         MaxDescriptions;
+    ATH_DEBUG_MASK_DESCRIPTION  *pMaskDescriptions; /* pointer to array of descriptions */
+} ATH_DEBUG_MODULE_DBG_INFO;
+
+#define ATH_DEBUG_DESCRIPTION_COUNT(d)  (int)((sizeof((d))) / (sizeof(ATH_DEBUG_MASK_DESCRIPTION)))
+
+#define GET_ATH_MODULE_DEBUG_VAR_NAME(s) _XGET_ATH_MODULE_NAME_DEBUG_(s)
+#define GET_ATH_MODULE_DEBUG_VAR_MASK(s) _XGET_ATH_MODULE_NAME_DEBUG_(s).CurrentMask
+#define _XGET_ATH_MODULE_NAME_DEBUG_(s) debug_ ## s
+
+#ifdef DEBUG
+
+    /* for source files that will instantiate the debug variables */
+#define ATH_DEBUG_INSTANTIATE_MODULE_VAR(s,name,moddesc,initmask,count,descriptions) \
+ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(s) = \
+            {NULL,(name),(moddesc),0,(initmask),count,(descriptions)}
+
+#ifdef ATH_MODULE_NAME
+extern ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(ATH_MODULE_NAME);
+#define AR_DEBUG_LVL_CHECK(lvl) (GET_ATH_MODULE_DEBUG_VAR_MASK(ATH_MODULE_NAME) & (lvl))
+#endif /* ATH_MODULE_NAME */
+
+#define ATH_DEBUG_SET_DEBUG_MASK(s,lvl) GET_ATH_MODULE_DEBUG_VAR_MASK(s) = (lvl)
+
+#define ATH_DEBUG_DECLARE_EXTERN(s) \
+    extern ATH_DEBUG_MODULE_DBG_INFO GET_ATH_MODULE_DEBUG_VAR_NAME(s)
+
+#define AR_DEBUG_PRINTBUF(buffer, length, desc) DebugDumpBytes(buffer,length,desc)
+
+
+#define AR_DEBUG_ASSERT A_ASSERT
+
+void a_dump_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo);
+void a_register_module_debug_info(ATH_DEBUG_MODULE_DBG_INFO *pInfo);
+#define A_DUMP_MODULE_DEBUG_INFO(s) a_dump_module_debug_info(&(GET_ATH_MODULE_DEBUG_VAR_NAME(s)))
+#define A_REGISTER_MODULE_DEBUG_INFO(s) a_register_module_debug_info(&(GET_ATH_MODULE_DEBUG_VAR_NAME(s)))
+
+#else /* !DEBUG */
+    /* NON DEBUG */
+#define ATH_DEBUG_INSTANTIATE_MODULE_VAR(s,name,moddesc,initmask,count,descriptions)
+#define AR_DEBUG_LVL_CHECK(lvl) 0
+#define AR_DEBUG_PRINTBUF(buffer, length, desc)
+#define AR_DEBUG_ASSERT(test)
+#define ATH_DEBUG_DECLARE_EXTERN(s)
+#define ATH_DEBUG_SET_DEBUG_MASK(s,lvl)
+#define A_DUMP_MODULE_DEBUG_INFO(s)
+#define A_REGISTER_MODULE_DEBUG_INFO(s)
+
+#endif
+
+A_STATUS a_get_module_mask(A_CHAR *module_name, A_UINT32 *pMask);
+A_STATUS a_set_module_mask(A_CHAR *module_name, A_UINT32 Mask);
+void a_dump_module_debug_info_by_name(A_CHAR *module_name);
+void a_module_debug_support_init(void);
+void a_module_debug_support_cleanup(void);
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/debug.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/debug.h"
+#endif
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/debug_linux.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/debug_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/debug_win.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/win/debug_win.h"
+#endif
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif
+
diff --git a/host/include/a_drv.h b/host/include/a_drv.h
new file mode 100644
index 0000000..e86f2e5
--- /dev/null
+++ b/host/include/a_drv.h
@@ -0,0 +1,50 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_drv.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DRV_H_
+#define _A_DRV_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/athdrv_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/athdrv.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/athdrv.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/athdrv_rexos.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/athdrv.h"
+#endif
+
+#endif /* _ADRV_H_ */
diff --git a/host/include/a_drv_api.h b/host/include/a_drv_api.h
new file mode 100644
index 0000000..1da72dd
--- /dev/null
+++ b/host/include/a_drv_api.h
@@ -0,0 +1,341 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_drv_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_DRV_API_H_
+#define _A_DRV_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/****************************************************************************/
+/****************************************************************************/
+/**                                                                        **/
+/** WMI related hooks                                                      **/
+/**                                                                        **/
+/****************************************************************************/
+/****************************************************************************/
+
+#include <ar6000_api.h>
+
+#define A_WMI_CHANNELLIST_RX(devt, numChan, chanList)   \
+    ar6000_channelList_rx((devt), (numChan), (chanList))
+
+#define A_WMI_SET_NUMDATAENDPTS(devt, num)  \
+    ar6000_set_numdataendpts((devt), (num))
+
+#define A_WMI_CONTROL_TX(devt, osbuf, streamID) \
+    ar6000_control_tx((devt), (osbuf), (streamID))
+
+#define A_WMI_TARGETSTATS_EVENT(devt, pStats, len)  \
+    ar6000_targetStats_event((devt), (pStats), (len))
+
+#define A_WMI_SCANCOMPLETE_EVENT(devt, status)  \
+    ar6000_scanComplete_event((devt), (status))
+
+#ifdef CONFIG_HOST_DSET_SUPPORT
+
+#define A_WMI_DSET_DATA_REQ(devt, access_cookie, offset, length, targ_buf, targ_reply_fn, targ_reply_arg)   \
+    ar6000_dset_data_req((devt), (access_cookie), (offset), (length), (targ_buf), (targ_reply_fn), (targ_reply_arg))
+
+#define A_WMI_DSET_CLOSE(devt, access_cookie)   \
+    ar6000_dset_close((devt), (access_cookie))
+
+#endif
+
+#define A_WMI_DSET_OPEN_REQ(devt, id, targ_handle, targ_reply_fn, targ_reply_arg) \
+    ar6000_dset_open_req((devt), (id), (targ_handle), (targ_reply_fn), (targ_reply_arg))
+
+#define A_WMI_CONNECT_EVENT(devt, pEvt) \
+    ar6000_connect_event((devt), (pEvt))
+
+#define A_WMI_PSPOLL_EVENT(devt, aid)\
+    ar6000_pspoll_event((devt),(aid))
+
+#define A_WMI_DTIMEXPIRY_EVENT(devt)\
+    ar6000_dtimexpiry_event((devt))
+
+#ifdef WAPI_ENABLE
+#define A_WMI_WAPI_REKEY_EVENT(devt, type, mac)\
+    ap_wapi_rekey_event((devt),(type),(mac))
+#endif
+
+#ifdef P2P
+#define A_WMI_P2PGONEG_EVENT(devt, res, len)\
+    p2p_go_neg_event((devt),(res), (len))
+
+#define A_WMI_P2PGONEG_REQ_EVENT(devt, sa, dev_passwd_id)\
+    p2p_go_neg_req_event((devt), (sa), (dev_passwd_id))
+
+#define A_WMI_P2P_INVITE_SENT_RESULT_EVENT(devt, res, len)\
+    p2p_invite_sent_result_event((devt), (res), (len))
+
+#define A_WMI_P2P_INVITE_RCVD_RESULT_EVENT(devt, res, len)\
+    p2p_invite_rcvd_result_event((devt), (res), (len))
+
+#define A_WMI_P2PDEV_EVENT(devt, addr, dev_addr, \
+     pri_dev_type, dev_name, dev_name_len, config_methods,\
+     dev_capab, grp_capab)\
+    ar6000_p2pdev_event((devt), (addr), (dev_addr),\
+        (pri_dev_type), (dev_name), (dev_name_len), (config_methods),\
+        (dev_capab), (grp_capab))
+#define A_WMI_P2PDEV_LOST_EVENT(devt, dev_addr) \
+    ar6000_p2pdev_lost_event((devt),(dev_addr))
+
+#define A_WMI_P2P_PROV_DISC_REQ_EVENT(devt, peer, config_methods, dev_addr, \
+    pri_dev_type, dev_name, dev_name_len, supp_config_methods,\
+        dev_capab, group_capab) \
+    ar6000_p2p_prov_disc_req_event((devt), (peer), (config_methods), \
+            (dev_addr), (pri_dev_type), (dev_name), (dev_name_len),\
+            (supp_config_methods), (dev_capab), (group_capab))
+
+#define A_WMI_P2P_PROV_DISC_RESP_EVENT(devt, peer, config_methods) \
+    ar6000_p2p_prov_disc_resp_event((devt), (peer), (config_methods))
+
+#define A_WMI_GET_P2P_CTX(devt) \
+     get_p2p_ctx((devt))
+
+#define A_WMI_GET_WMI_CTX(devt) \
+     get_wmi_ctx((devt))
+
+#define A_WMI_GET_DEV_NETWORK_SUBTYPE(devt) \
+     get_network_subtype((devt))
+
+#define A_WMI_P2P_SD_RX_EVENT(devt, ev) \
+    ar6000_p2p_sd_rx_event((devt), (ev))
+#endif /* P2P */
+
+#ifdef CONFIG_WLAN_RFKILL
+#define A_WMI_RFKILL_STATE_CHANGE_EVENT(devt,radiostate) \
+    ar6000_rfkill_state_change_event((devt),(radiostate))
+
+#define A_WMI_RFKILL_GET_MODE_CMD_EVENT(devt,datap,len) \
+    ar6000_rfkill_get_mode_cmd_event_rx((devt),(datap));
+
+#endif
+
+#define A_WMI_REGDOMAIN_EVENT(devt, regCode)    \
+    ar6000_regDomain_event((devt), (regCode))
+
+#define A_WMI_NEIGHBORREPORT_EVENT(devt, numAps, info)  \
+    ar6000_neighborReport_event((devt), (numAps), (info))
+
+#define A_WMI_DISCONNECT_EVENT(devt, reason, bssid, assocRespLen, assocInfo, protocolReasonStatus)  \
+    ar6000_disconnect_event((devt), (reason), (bssid), (assocRespLen), (assocInfo), (protocolReasonStatus))
+
+#ifdef ATH_SUPPORT_DFS
+    
+#define A_WMI_DFS_ATTACH_EVENT(devt, capinfo) \
+    ar6000_dfs_attach_event((devt),(capinfo))
+
+#define A_WMI_DFS_INIT_EVENT(devt, capinfo) \
+    ar6000_dfs_init_event((devt),(capinfo))
+
+#define A_WMI_DFS_PHYERR_EVENT(devt, info) \
+    ar6000_dfs_phyerr_event((devt),(info))
+
+#define A_WMI_DFS_RESET_DELAYLINES_EVENT(devt) \
+    ar6000_dfs_reset_delaylines_event((devt))
+
+#define A_WMI_DFS_RESET_RADARQ_EVENT(devt) \
+    ar6000_dfs_reset_radarq_event((devt))
+
+#define A_WMI_DFS_RESET_AR_EVENT(devt) \
+    ar6000_dfs_reset_ar_event((devt))
+
+#define A_WMI_DFS_RESET_ARQ_EVENT(devt) \
+    ar6000_dfs_reset_arq_event((devt))
+
+#define A_WMI_DFS_SET_DUR_MULTIPLIER_EVENT(devt, value) \
+    ar6000_dfs_set_dur_multiplier_event((devt), (value))
+
+#define A_WMI_DFS_SET_BANGRADAR_EVENT(devt, value) \
+    ar6000_dfs_set_bangradar_event((devt), (value))
+
+#define A_WMI_DFS_SET_DEBUGLEVEL_EVENT(devt, value) \
+    ar6000_dfs_set_debuglevel_event((devt), (value))
+    
+#endif /* ATH_SUPPORT_DFS */ 
+
+#define A_WMI_TKIP_MICERR_EVENT(devt, keyid, ismcast)   \
+    ar6000_tkip_micerr_event((devt), (keyid), (ismcast))
+
+#define A_WMI_BITRATE_RX(devt, rateKbps)    \
+    ar6000_bitrate_rx((devt), (rateKbps))
+
+#define A_WMI_TXPWR_RX(devt, txPwr) \
+    ar6000_txPwr_rx((devt), (txPwr))
+
+#define A_WMI_READY_EVENT(devt, datap, phyCap, sw_ver, abi_ver) \
+    ar6000_ready_event((devt), (datap), (phyCap), (sw_ver), (abi_ver))
+
+#define A_WMI_DBGLOG_INIT_DONE(devt) \
+    ar6000_dbglog_init_done(devt);
+
+#define A_WMI_RSSI_THRESHOLD_EVENT(devt, newThreshold, rssi)    \
+    ar6000_rssiThreshold_event((devt), (newThreshold), (rssi))
+
+#define A_WMI_REPORT_ERROR_EVENT(devt, errorVal)    \
+    ar6000_reportError_event((devt), (errorVal))
+
+#define A_WMI_ROAM_TABLE_EVENT(devt, pTbl) \
+    ar6000_roam_tbl_event((devt), (pTbl))
+
+#define A_WMI_ROAM_DATA_EVENT(devt, p) \
+    ar6000_roam_data_event((devt), (p))
+
+#define A_WMI_WOW_LIST_EVENT(devt, num_filters, wow_filters)    \
+    ar6000_wow_list_event((devt), (num_filters), (wow_filters))
+
+#define A_WMI_CAC_EVENT(devt, ac, cac_indication, statusCode, tspecSuggestion)  \
+    ar6000_cac_event((devt), (ac), (cac_indication), (statusCode), (tspecSuggestion))
+
+#define A_WMI_CHANNEL_CHANGE_EVENT(devt, oldChannel, newChannel)  \
+    ar6000_channel_change_event((devt), (oldChannel), (newChannel))
+
+#define A_WMI_PMKID_LIST_EVENT(devt, num_pmkid, pmkid_list, bssid_list) \
+    ar6000_pmkid_list_event((devt), (num_pmkid), (pmkid_list), (bssid_list))
+
+#define A_WMI_PEER_EVENT(devt, eventCode, bssid)    \
+    ar6000_peer_event ((devt), (eventCode), (bssid))
+
+#define A_WMI_WACINFO_EVENT(devt, pStats, len)  \
+    ar6000_wacinfo_event((devt), (pStats), (len))
+
+#ifdef CONFIG_HOST_GPIO_SUPPORT
+
+#define A_WMI_GPIO_INTR_RX(devt, intr_mask, input_values) \
+    ar6000_gpio_intr_rx((devt), (intr_mask), (input_values))
+
+#define A_WMI_GPIO_DATA_RX(devt, reg_id, value) \
+    ar6000_gpio_data_rx((devt), (reg_id), (value))
+
+#define A_WMI_GPIO_ACK_RX(devt) \
+    ar6000_gpio_ack_rx((devt))
+
+#endif
+
+#ifdef SEND_EVENT_TO_APP
+
+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len) \
+    ar6000_send_event_to_app((ar), (eventId), (datap), (len))
+
+#define A_WMI_SEND_GENERIC_EVENT_TO_APP(ar, eventId, datap, len) \
+    ar6000_send_generic_event_to_app((ar), (eventId), (datap), (len))
+
+#else
+
+#define A_WMI_SEND_EVENT_TO_APP(ar, eventId, datap, len)
+#define A_WMI_SEND_GENERIC_EVENT_TO_APP(ar, eventId, datap, len)
+
+#endif
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+#define A_WMI_TCMD_RX_REPORT_EVENT(devt, results, len) \
+    ar6000_tcmd_rx_report_event((devt), (results), (len))
+#endif
+
+#define A_WMI_HBCHALLENGERESP_EVENT(devt, cookie, source)    \
+    ar6000_hbChallengeResp_event((devt), (cookie), (source))
+
+#define A_WMI_TX_RETRY_ERR_EVENT(devt) \
+    ar6000_tx_retry_err_event((devt))
+
+#define A_WMI_SNR_THRESHOLD_EVENT_RX(devt, newThreshold, snr) \
+    ar6000_snrThresholdEvent_rx((devt), (newThreshold), (snr))
+
+#define A_WMI_LQ_THRESHOLD_EVENT_RX(devt, range, lqVal) \
+    ar6000_lqThresholdEvent_rx((devt), (range), (lqVal))
+
+#define A_WMI_RATEMASK_RX(devt, ratemask) \
+    ar6000_ratemask_rx((devt), (ratemask))
+
+#define A_WMI_KEEPALIVE_RX(devt, configured)    \
+    ar6000_keepalive_rx((devt), (configured))
+
+#define A_WMI_BSSINFO_EVENT_RX(ar, datp, len)   \
+    ar6000_bssInfo_event_rx((ar), (datap), (len))
+
+#define A_WMI_AP_MODE_PROBE_RX(ar, datp, len)   \
+    ar6000_ap_mode_probe_rx((ar), (datap), (len))
+
+#define A_WMI_DBGLOG_EVENT(ar, dropped, buffer, length) \
+    ar6000_dbglog_event((ar), (dropped), (buffer), (length));
+
+#define A_WMI_STREAM_TX_ACTIVE(devt,trafficClass) \
+    ar6000_indicate_tx_activity((devt),(trafficClass), TRUE)
+
+#define A_WMI_STREAM_TX_INACTIVE(devt,trafficClass) \
+    ar6000_indicate_tx_activity((devt),(trafficClass), FALSE)
+#define A_WMI_Ac2EndpointID(devht, ac)\
+    ar6000_ac2_endpoint_id((devht), (ac))
+
+#define A_WMI_AGGR_RECV_ADDBA_REQ_EVT(devt, cmd)\
+    ar6000_aggr_rcv_addba_req_evt((devt), (cmd))
+#define A_WMI_AGGR_RECV_ADDBA_RESP_EVT(devt, cmd)\
+    ar6000_aggr_rcv_addba_resp_evt((devt), (cmd))
+#define A_WMI_AGGR_RECV_DELBA_REQ_EVT(devt, cmd)\
+    ar6000_aggr_rcv_delba_req_evt((devt), (cmd))
+#define A_WMI_HCI_EVENT_EVT(devt, cmd)\
+    ar6000_hci_event_rcv_evt((devt), (cmd))
+
+#define A_WMI_Endpoint2Ac(devt, ep) \
+    ar6000_endpoint_id2_ac((devt), (ep))
+
+#define A_WMI_BTCOEX_CONFIG_EVENT(devt, evt, len)\
+    ar6000_btcoex_config_event((devt), (evt), (len))
+
+#define A_WMI_BTCOEX_STATS_EVENT(devt, datap, len)\
+    ar6000_btcoex_stats_event((devt), (datap), (len))
+
+#define A_WMI_PROBERESP_RECV_EVENT(devt, datap, len,  bssid)\
+    ar6000_indicate_proberesp((devt), (datap), (len),  (bssid))
+
+#define A_WMI_BEACON_RECV_EVENT(devt, datap, len,  bssid)\
+    ar6000_indicate_beacon((devt), (datap), (len),  (bssid))
+
+#define A_WMI_ASSOC_REQ_REPORT_EVENT(devt, status, rspType, datap, len)\
+    ar6000_assoc_req_report_event((devt),(status),(rspType),(datap),(len))
+
+#define A_WMI_GET_DEVICE_ADDR(devt, addr) \
+    ar6000_get_device_addr((devt), (addr))
+
+#define A_WMI_GET_NETWORK_TYPE(devt) \
+    ar6000_get_network_type((devt))
+
+/****************************************************************************/
+/****************************************************************************/
+/**                                                                        **/
+/** HTC related hooks                                                      **/
+/**                                                                        **/
+/****************************************************************************/
+/****************************************************************************/
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+#define A_WMI_PROF_COUNT_RX(addr, count) prof_count_rx((addr), (count))
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/host/include/a_hci.h b/host/include/a_hci.h
new file mode 100644
index 0000000..803f75c
--- /dev/null
+++ b/host/include/a_hci.h
@@ -0,0 +1,679 @@
+//-
+// Copyright (c) 2009-2010 Atheros Communications Inc.
+// All rights reserved.
+// 
+//
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+//
+//
+//
+//
+
+
+#ifndef __A_HCI_H__
+#define __A_HCI_H__
+
+#define HCI_CMD_OGF_MASK            0x3F
+#define HCI_CMD_OGF_SHIFT           10
+#define HCI_CMD_GET_OGF(opcode)     ((opcode >> HCI_CMD_OGF_SHIFT) & HCI_CMD_OGF_MASK)
+
+#define HCI_CMD_OCF_MASK            0x3FF
+#define HCI_CMD_OCF_SHIFT           0 
+#define HCI_CMD_GET_OCF(opcode)     (((opcode) >> HCI_CMD_OCF_SHIFT) & HCI_CMD_OCF_MASK)
+
+#define HCI_FORM_OPCODE(ocf, ogf)    ((ocf & HCI_CMD_OCF_MASK) << HCI_CMD_OCF_SHIFT | \
+                                          (ogf & HCI_CMD_OGF_MASK) << HCI_CMD_OGF_SHIFT)
+
+
+/*======== HCI Opcode groups ===============*/
+#define OGF_NOP                         0x00
+#define OGF_LINK_CONTROL                0x01
+#define OGF_LINK_POLICY                 0x03
+#define OGF_INFO_PARAMS                 0x04
+#define OGF_STATUS                      0x05
+#define OGF_TESTING                     0x06
+#define OGF_BLUETOOTH                   0x3E
+#define OGF_VENDOR_DEBUG                0x3F
+
+
+
+#define OCF_NOP                         0x00
+
+
+/*===== Link Control Commands Opcode===================*/
+#define OCF_HCI_Create_Physical_Link                0x35
+#define OCF_HCI_Accept_Physical_Link_Req            0x36
+#define OCF_HCI_Disconnect_Physical_Link            0x37
+#define OCF_HCI_Create_Logical_Link                 0x38
+#define OCF_HCI_Accept_Logical_Link                 0x39
+#define OCF_HCI_Disconnect_Logical_Link             0x3A
+#define OCF_HCI_Logical_Link_Cancel                 0x3B
+#define OCF_HCI_Flow_Spec_Modify                    0x3C
+
+
+
+/*===== Link Policy Commands Opcode====================*/
+#define OCF_HCI_Set_Event_Mask                      0x01
+#define OCF_HCI_Reset                               0x03
+#define OCF_HCI_Read_Conn_Accept_Timeout            0x15
+#define OCF_HCI_Write_Conn_Accept_Timeout           0x16
+#define OCF_HCI_Read_Link_Supervision_Timeout       0x36
+#define OCF_HCI_Write_Link_Supervision_Timeout      0x37
+#define OCF_HCI_Enhanced_Flush                      0x5F
+#define OCF_HCI_Read_Logical_Link_Accept_Timeout    0x61
+#define OCF_HCI_Write_Logical_Link_Accept_Timeout   0x62
+#define OCF_HCI_Set_Event_Mask_Page_2               0x63
+#define OCF_HCI_Read_Location_Data                  0x64
+#define OCF_HCI_Write_Location_Data                 0x65
+#define OCF_HCI_Read_Flow_Control_Mode              0x66
+#define OCF_HCI_Write_Flow_Control_Mode             0x67
+#define OCF_HCI_Read_BE_Flush_Timeout               0x69
+#define OCF_HCI_Write_BE_Flush_Timeout              0x6A
+#define OCF_HCI_Short_Range_Mode                    0x6B
+
+
+/*======== Info Commands Opcode========================*/
+#define OCF_HCI_Read_Local_Ver_Info                 0x01
+#define OCF_HCI_Read_Local_Supported_Cmds           0x02
+#define OCF_HCI_Read_Data_Block_Size                0x0A
+/*======== Status Commands Opcode======================*/
+#define OCF_HCI_Read_Failed_Contact_Counter         0x01
+#define OCF_HCI_Reset_Failed_Contact_Counter        0x02
+#define OCF_HCI_Read_Link_Quality                   0x03
+#define OCF_HCI_Read_RSSI                           0x05
+#define OCF_HCI_Read_Local_AMP_Info                 0x09    
+#define OCF_HCI_Read_Local_AMP_ASSOC                0x0A
+#define OCF_HCI_Write_Remote_AMP_ASSOC              0x0B
+
+
+/*======= AMP_ASSOC Specific TLV tags =================*/
+#define AMP_ASSOC_MAC_ADDRESS_INFO_TYPE             0x1
+#define AMP_ASSOC_PREF_CHAN_LIST                    0x2
+#define AMP_ASSOC_CONNECTED_CHAN                    0x3
+#define AMP_ASSOC_PAL_CAPABILITIES                  0x4
+#define AMP_ASSOC_PAL_VERSION                       0x5
+
+
+/*========= PAL Events =================================*/
+#define PAL_COMMAND_COMPLETE_EVENT                  0x0E
+#define PAL_COMMAND_STATUS_EVENT                    0x0F
+#define PAL_HARDWARE_ERROR_EVENT                    0x10
+#define PAL_FLUSH_OCCURRED_EVENT                    0x11
+#define PAL_LOOPBACK_EVENT                          0x19
+#define PAL_BUFFER_OVERFLOW_EVENT                   0x1A
+#define PAL_QOS_VIOLATION_EVENT                     0x1E
+#define PAL_ENHANCED_FLUSH_COMPLT_EVENT             0x39
+#define PAL_PHYSICAL_LINK_COMPL_EVENT               0x40
+#define PAL_CHANNEL_SELECT_EVENT                    0x41
+#define PAL_DISCONNECT_PHYSICAL_LINK_EVENT          0x42
+#define PAL_PHY_LINK_EARLY_LOSS_WARNING_EVENT       0x43
+#define PAL_PHY_LINK_RECOVERY_EVENT                 0x44
+#define PAL_LOGICAL_LINK_COMPL_EVENT                0x45
+#define PAL_DISCONNECT_LOGICAL_LINK_COMPL_EVENT     0x46
+#define PAL_FLOW_SPEC_MODIFY_COMPL_EVENT            0x47
+#define PAL_NUM_COMPL_DATA_BLOCK_EVENT              0x48
+#define PAL_SHORT_RANGE_MODE_CHANGE_COMPL_EVENT     0x4C
+#define PAL_AMP_STATUS_CHANGE_EVENT                 0x4D
+/*======== End of PAL events definiton =================*/
+
+
+/*======== Timeouts (not part of HCI cmd, but input to PAL engine) =========*/
+#define Timer_Conn_Accept_TO                        0x01
+#define Timer_Link_Supervision_TO                   0x02
+
+#define NUM_HCI_COMMAND_PKTS                0x1
+
+
+/*====== NOP Cmd ============================*/
+#define HCI_CMD_NOP                     HCI_FORM_OPCODE(OCF_NOP, OGF_NOP)
+
+
+/*===== Link Control Commands================*/
+#define HCI_Create_Physical_Link        HCI_FORM_OPCODE(OCF_HCI_Create_Physical_Link, OGF_LINK_CONTROL)
+#define HCI_Accept_Physical_Link_Req    HCI_FORM_OPCODE(OCF_HCI_Accept_Physical_Link_Req, OGF_LINK_CONTROL)
+#define HCI_Disconnect_Physical_Link    HCI_FORM_OPCODE(OCF_HCI_Disconnect_Physical_Link, OGF_LINK_CONTROL)
+#define HCI_Create_Logical_Link         HCI_FORM_OPCODE(OCF_HCI_Create_Logical_Link, OGF_LINK_CONTROL)
+#define HCI_Accept_Logical_Link         HCI_FORM_OPCODE(OCF_HCI_Accept_Logical_Link, OGF_LINK_CONTROL)
+#define HCI_Disconnect_Logical_Link     HCI_FORM_OPCODE(OCF_HCI_Disconnect_Logical_Link, OGF_LINK_CONTROL)
+#define HCI_Logical_Link_Cancel         HCI_FORM_OPCODE(OCF_HCI_Logical_Link_Cancel, OGF_LINK_CONTROL)
+#define HCI_Flow_Spec_Modify            HCI_FORM_OPCODE(OCF_HCI_Flow_Spec_Modify, OGF_LINK_CONTROL)
+
+
+/*===== Link Policy Commands ================*/
+#define HCI_Set_Event_Mask              HCI_FORM_OPCODE(OCF_HCI_Set_Event_Mask, OGF_LINK_POLICY)
+#define HCI_Reset                       HCI_FORM_OPCODE(OCF_HCI_Reset, OGF_LINK_POLICY)
+#define HCI_Enhanced_Flush              HCI_FORM_OPCODE(OCF_HCI_Enhanced_Flush, OGF_LINK_POLICY)
+#define HCI_Read_Conn_Accept_Timeout    HCI_FORM_OPCODE(OCF_HCI_Read_Conn_Accept_Timeout, OGF_LINK_POLICY)
+#define HCI_Write_Conn_Accept_Timeout   HCI_FORM_OPCODE(OCF_HCI_Write_Conn_Accept_Timeout, OGF_LINK_POLICY)
+#define HCI_Read_Logical_Link_Accept_Timeout    HCI_FORM_OPCODE(OCF_HCI_Read_Logical_Link_Accept_Timeout, OGF_LINK_POLICY)
+#define HCI_Write_Logical_Link_Accept_Timeout   HCI_FORM_OPCODE(OCF_HCI_Write_Logical_Link_Accept_Timeout, OGF_LINK_POLICY)
+#define HCI_Read_Link_Supervision_Timeout       HCI_FORM_OPCODE(OCF_HCI_Read_Link_Supervision_Timeout, OGF_LINK_POLICY)
+#define HCI_Write_Link_Supervision_Timeout      HCI_FORM_OPCODE(OCF_HCI_Write_Link_Supervision_Timeout, OGF_LINK_POLICY)
+#define HCI_Read_Location_Data          HCI_FORM_OPCODE(OCF_HCI_Read_Location_Data, OGF_LINK_POLICY)
+#define HCI_Write_Location_Data         HCI_FORM_OPCODE(OCF_HCI_Write_Location_Data, OGF_LINK_POLICY)
+#define HCI_Set_Event_Mask_Page_2       HCI_FORM_OPCODE(OCF_HCI_Set_Event_Mask_Page_2, OGF_LINK_POLICY)
+#define HCI_Read_Flow_Control_Mode      HCI_FORM_OPCODE(OCF_HCI_Read_Flow_Control_Mode, OGF_LINK_POLICY)
+#define HCI_Write_Flow_Control_Mode     HCI_FORM_OPCODE(OCF_HCI_Write_Flow_Control_Mode, OGF_LINK_POLICY)
+#define HCI_Write_BE_Flush_Timeout      HCI_FORM_OPCODE(OCF_HCI_Write_BE_Flush_Timeout, OGF_LINK_POLICY)
+#define HCI_Read_BE_Flush_Timeout       HCI_FORM_OPCODE(OCF_HCI_Read_BE_Flush_Timeout, OGF_LINK_POLICY)
+#define HCI_Short_Range_Mode            HCI_FORM_OPCODE(OCF_HCI_Short_Range_Mode, OGF_LINK_POLICY)            
+
+
+/*===== Info Commands =====================*/
+#define HCI_Read_Local_Ver_Info         HCI_FORM_OPCODE(OCF_HCI_Read_Local_Ver_Info,  OGF_INFO_PARAMS)
+#define HCI_Read_Local_Supported_Cmds   HCI_FORM_OPCODE(OCF_HCI_Read_Local_Supported_Cmds, OGF_INFO_PARAMS)
+#define HCI_Read_Data_Block_Size        HCI_FORM_OPCODE(OCF_HCI_Read_Data_Block_Size, OGF_INFO_PARAMS)
+
+/*===== Status Commands =====================*/
+#define HCI_Read_Link_Quality           HCI_FORM_OPCODE(OCF_HCI_Read_Link_Quality, OGF_STATUS)
+#define HCI_Read_RSSI                   HCI_FORM_OPCODE(OCF_HCI_Read_RSSI, OGF_STATUS)
+#define HCI_Read_Local_AMP_Info         HCI_FORM_OPCODE(OCF_HCI_Read_Local_AMP_Info, OGF_STATUS)
+#define HCI_Read_Local_AMP_ASSOC        HCI_FORM_OPCODE(OCF_HCI_Read_Local_AMP_ASSOC, OGF_STATUS)
+#define HCI_Write_Remote_AMP_ASSOC      HCI_FORM_OPCODE(OCF_HCI_Write_Remote_AMP_ASSOC, OGF_STATUS)
+
+/*====== End of cmd definitions =============*/
+
+
+
+/*===== Timeouts(private - can't come from HCI)=================*/
+#define Conn_Accept_TO                  HCI_FORM_OPCODE(Timer_Conn_Accept_TO, OGF_VENDOR_DEBUG)
+#define Link_Supervision_TO             HCI_FORM_OPCODE(Timer_Link_Supervision_TO, OGF_VENDOR_DEBUG)
+
+/*----- PAL Constants (Sec 6 of Doc)------------------------*/
+#define Max80211_PAL_PDU_Size      1492
+#define Max80211_AMP_ASSOC_Len      672
+#define MinGUserPrio                4
+#define MaxGUserPrio                7
+#define BEUserPrio0                 0
+#define BEUserPrio1                 3
+#define Max80211BeaconPeriod        2000    /* in millisec */
+#define ShortRangeModePowerMax      4       /* dBm */
+
+/*------ PAL Protocol Identifiers (Sec5.1) ------------------*/
+typedef enum {
+    ACL_DATA = 0x01,
+    ACTIVITY_REPORT,
+    SECURED_FRAMES,
+    LINK_SUPERVISION_REQ,
+    LINK_SUPERVISION_RESP,
+}PAL_PROTOCOL_IDENTIFIERS;
+
+#define HCI_CMD_HDR_SZ          3
+#define HCI_EVENT_HDR_SIZE      2
+#define MAX_EVT_PKT_SZ          255
+#define AMP_ASSOC_MAX_FRAG_SZ   248
+#define AMP_MAX_GUARANTEED_BW   20000
+
+#define DEFAULT_CONN_ACCPT_TO   5000
+#define DEFAULT_LL_ACCPT_TO     5000
+#define DEFAULT_LSTO            10000
+
+#define PACKET_BASED_FLOW_CONTROL_MODE      0x00
+#define DATA_BLK_BASED_FLOW_CONTROL_MODE    0x01
+
+#define SERVICE_TYPE_BEST_EFFORT    0x01
+#define SERVICE_TYPE_GUARANTEED     0x02
+
+#define MAC_ADDR_LEN            6
+#define LINK_KEY_LEN            32
+
+typedef enum  {
+    ACL_DATA_PB_1ST_NON_AUTOMATICALLY_FLUSHABLE = 0x00,
+    ACL_DATA_PB_CONTINUING_FRAGMENT = 0x01,
+    ACL_DATA_PB_1ST_AUTOMATICALLY_FLUSHABLE = 0x02,
+    ACL_DATA_PB_COMPLETE_PDU = 0x03,
+} ACL_DATA_PB_FLAGS;
+#define ACL_DATA_PB_FLAGS_SHIFT     12
+
+typedef enum {
+    ACL_DATA_BC_POINT_TO_POINT = 0x00,
+} ACL_DATA_BC_FLAGS;
+#define ACL_DATA_BC_FLAGS_SHIFT     14
+
+/* Command pkt */
+typedef struct  hci_cmd_pkt_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     params[255];
+} POSTPACK HCI_CMD_PKT;
+
+#define ACL_DATA_HDR_SIZE   4   /* hdl_and flags + data_len */
+/* Data pkt */
+typedef struct  hci_acl_data_pkt_t {
+    A_UINT16    hdl_and_flags;
+    A_UINT16    data_len;
+    A_UINT8     data[Max80211_PAL_PDU_Size];
+} POSTPACK HCI_ACL_DATA_PKT;
+
+/* Event pkt */
+typedef struct  hci_event_pkt_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     params[256];
+} POSTPACK HCI_EVENT_PKT;
+
+
+/*============== HCI Command definitions ======================= */
+typedef struct hci_cmd_phy_link_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    A_UINT8     link_key_len;
+    A_UINT8     link_key_type;
+    A_UINT8     link_key[LINK_KEY_LEN];
+} POSTPACK HCI_CMD_PHY_LINK;
+
+typedef struct  hci_cmd_write_rem_amp_assoc_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    A_UINT16    len_so_far;
+    A_UINT16    amp_assoc_remaining_len;
+    A_UINT8     amp_assoc_frag[AMP_ASSOC_MAX_FRAG_SZ];
+} POSTPACK HCI_CMD_WRITE_REM_AMP_ASSOC;
+
+
+typedef struct  hci_cmd_opcode_hdl_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    hdl;
+} POSTPACK HCI_CMD_READ_LINK_QUAL,
+           HCI_CMD_FLUSH,
+           HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT;
+
+typedef struct  hci_cmd_read_local_amp_assoc_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    A_UINT16    len_so_far;
+    A_UINT16    max_rem_amp_assoc_len;
+} POSTPACK HCI_CMD_READ_LOCAL_AMP_ASSOC;
+
+
+typedef struct hci_cmd_set_event_mask_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT64    mask;
+}POSTPACK HCI_CMD_SET_EVT_MASK, HCI_CMD_SET_EVT_MASK_PG_2;
+
+
+typedef struct  hci_cmd_enhanced_flush_t{
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    hdl;
+    A_UINT8     type;
+} POSTPACK HCI_CMD_ENHANCED_FLUSH;
+
+
+typedef struct  hci_cmd_write_timeout_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    timeout;
+} POSTPACK  HCI_CMD_WRITE_TIMEOUT;
+
+typedef struct  hci_cmd_write_link_supervision_timeout_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    hdl;
+    A_UINT16    timeout;
+} POSTPACK HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT;
+
+typedef struct  hci_cmd_write_flow_control_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     mode;
+} POSTPACK  HCI_CMD_WRITE_FLOW_CONTROL;
+
+typedef struct  location_data_cfg_t {
+    A_UINT8     reg_domain_aware;
+    A_UINT8     reg_domain[3];
+    A_UINT8     reg_options;
+} POSTPACK LOCATION_DATA_CFG;
+
+typedef struct  hci_cmd_write_location_data_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    LOCATION_DATA_CFG   cfg;
+} POSTPACK  HCI_CMD_WRITE_LOCATION_DATA;
+
+
+typedef struct  flow_spec_t {
+    A_UINT8     id;
+    A_UINT8     service_type;
+    A_UINT16    max_sdu;
+    A_UINT32    sdu_inter_arrival_time;
+    A_UINT32    access_latency;
+    A_UINT32    flush_timeout;
+} POSTPACK FLOW_SPEC;
+
+
+typedef struct  hci_cmd_create_logical_link_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    FLOW_SPEC   tx_flow_spec;
+    FLOW_SPEC   rx_flow_spec;
+} POSTPACK HCI_CMD_CREATE_LOGICAL_LINK;
+
+typedef struct  hci_cmd_flow_spec_modify_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    hdl;
+    FLOW_SPEC   tx_flow_spec;
+    FLOW_SPEC   rx_flow_spec;
+} POSTPACK HCI_CMD_FLOW_SPEC_MODIFY;
+
+typedef struct hci_cmd_logical_link_cancel_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    A_UINT8     tx_flow_spec_id;
+} POSTPACK HCI_CMD_LOGICAL_LINK_CANCEL;
+
+typedef struct  hci_cmd_disconnect_logical_link_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT16    logical_link_hdl;
+} POSTPACK HCI_CMD_DISCONNECT_LOGICAL_LINK;
+
+typedef struct  hci_cmd_disconnect_phy_link_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+} POSTPACK HCI_CMD_DISCONNECT_PHY_LINK;
+
+typedef struct  hci_cmd_srm_t {
+    A_UINT16    opcode;
+    A_UINT8     param_length;
+    A_UINT8     phy_link_hdl;
+    A_UINT8     mode;
+} POSTPACK HCI_CMD_SHORT_RANGE_MODE;
+/*============== HCI Command definitions end ======================= */
+
+
+
+/*============== HCI Event definitions ============================= */
+
+/* Command complete event */
+typedef struct  hci_event_cmd_complete_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     num_hci_cmd_pkts;
+    A_UINT16    opcode;
+    A_UINT8     params[255];
+} POSTPACK HCI_EVENT_CMD_COMPLETE;
+
+
+/* Command status event */
+typedef struct  hci_event_cmd_status_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT8     num_hci_cmd_pkts;
+    A_UINT16    opcode;
+} POSTPACK HCI_EVENT_CMD_STATUS;
+
+/* Hardware Error event */
+typedef struct  hci_event_hw_err_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     hw_err_code;
+} POSTPACK HCI_EVENT_HW_ERR;
+
+/* Flush occured event */
+/* Qos Violation event */
+typedef struct  hci_event_handle_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT16    handle;
+} POSTPACK HCI_EVENT_FLUSH_OCCRD,
+           HCI_EVENT_QOS_VIOLATION;
+
+/* Loopback command event */
+typedef struct hci_loopback_cmd_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     params[252];
+} POSTPACK HCI_EVENT_LOOPBACK_CMD;
+
+/* Data buffer overflow event */
+typedef struct  hci_data_buf_overflow_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     link_type;
+} POSTPACK  HCI_EVENT_DATA_BUF_OVERFLOW;
+
+/* Enhanced Flush complete event */
+typedef struct hci_enhanced_flush_complt_t{
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT16    hdl;
+} POSTPACK  HCI_EVENT_ENHANCED_FLUSH_COMPLT;
+
+/* Channel select event */
+typedef struct  hci_event_chan_select_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     phy_link_hdl;
+} POSTPACK HCI_EVENT_CHAN_SELECT;
+
+/* Physical Link Complete event */
+typedef struct  hci_event_phy_link_complete_event_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT8     phy_link_hdl;
+} POSTPACK HCI_EVENT_PHY_LINK_COMPLETE;
+
+/* Logical Link complete event */
+typedef struct hci_event_logical_link_complete_event_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT16    logical_link_hdl;
+    A_UINT8     phy_hdl;
+    A_UINT8     tx_flow_id;
+} POSTPACK HCI_EVENT_LOGICAL_LINK_COMPLETE_EVENT;
+
+/* Disconnect Logical Link complete event */
+typedef struct hci_event_disconnect_logical_link_event_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT16    logical_link_hdl;
+    A_UINT8     reason;
+} POSTPACK HCI_EVENT_DISCONNECT_LOGICAL_LINK_EVENT;
+
+/* Disconnect Physical Link complete event */
+typedef struct hci_event_disconnect_phy_link_complete_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT8     phy_link_hdl;
+    A_UINT8     reason;
+} POSTPACK HCI_EVENT_DISCONNECT_PHY_LINK_COMPLETE;
+
+typedef struct hci_event_physical_link_loss_early_warning_t{
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     phy_hdl;
+    A_UINT8     reason;
+} POSTPACK HCI_EVENT_PHY_LINK_LOSS_EARLY_WARNING;
+
+typedef struct hci_event_physical_link_recovery_t{
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     phy_hdl;
+} POSTPACK HCI_EVENT_PHY_LINK_RECOVERY;
+
+
+/* Flow spec modify complete event */
+/* Flush event */
+typedef struct hci_event_status_handle_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT16    handle;
+} POSTPACK HCI_EVENT_FLOW_SPEC_MODIFY,
+           HCI_EVENT_FLUSH;
+
+
+/* Num of completed data blocks event */
+typedef struct hci_event_num_of_compl_data_blks_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT16    num_data_blks;
+    A_UINT8     num_handles;
+    A_UINT8     params[255];
+} POSTPACK HCI_EVENT_NUM_COMPL_DATA_BLKS;
+
+/* Short range mode change complete event */
+typedef struct  hci_srm_cmpl_t {
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT8     phy_link;
+    A_UINT8     state;
+} POSTPACK HCI_EVENT_SRM_COMPL;
+
+typedef struct hci_event_amp_status_change_t{
+    A_UINT8     event_code;
+    A_UINT8     param_len;
+    A_UINT8     status;
+    A_UINT8     amp_status;
+} POSTPACK HCI_EVENT_AMP_STATUS_CHANGE;
+
+/*============== Event definitions end =========================== */
+
+
+typedef struct  local_amp_info_resp_t {
+    A_UINT8     status;
+    A_UINT8     amp_status;
+    A_UINT32    total_bw;           /* kbps */
+    A_UINT32    max_guranteed_bw;   /* kbps */
+    A_UINT32    min_latency;
+    A_UINT32    max_pdu_size;
+    A_UINT8     amp_type;
+    A_UINT16    pal_capabilities;
+    A_UINT16    amp_assoc_len;
+    A_UINT32    max_flush_timeout;  /* in ms */
+    A_UINT32    be_flush_timeout;   /* in ms */
+} POSTPACK  LOCAL_AMP_INFO;
+
+typedef struct  amp_assoc_cmd_resp_t{
+    A_UINT8     status;
+    A_UINT8     phy_hdl;
+    A_UINT16    amp_assoc_len;
+    A_UINT8     amp_assoc_frag[AMP_ASSOC_MAX_FRAG_SZ];
+}POSTPACK AMP_ASSOC_CMD_RESP;
+
+
+enum PAL_HCI_CMD_STATUS {
+    PAL_HCI_CMD_PROCESSED,
+    PAL_HCI_CMD_IGNORED
+}; 
+
+
+/*============= HCI Error Codes =======================*/
+#define HCI_SUCCESS                             0x00
+#define HCI_ERR_UNKNOW_CMD                      0x01
+#define HCI_ERR_UNKNOWN_CONN_ID                 0x02
+#define HCI_ERR_HW_FAILURE                      0x03
+#define HCI_ERR_PAGE_TIMEOUT                    0x04
+#define HCI_ERR_AUTH_FAILURE                    0x05
+#define HCI_ERR_KEY_MISSING                     0x06
+#define HCI_ERR_MEM_CAP_EXECED                  0x07
+#define HCI_ERR_CON_TIMEOUT                     0x08
+#define HCI_ERR_CON_LIMIT_EXECED                0x09
+#define	HCI_ERR_ACL_CONN_ALRDY_EXISTS	        0x0B
+#define	HCI_ERR_COMMAND_DISALLOWED		        0x0C
+#define HCI_ERR_CONN_REJ_BY_LIMIT_RES           0x0D
+#define HCI_ERR_CONN_REJ_BY_SEC                 0x0E
+#define HCI_ERR_CONN_REJ_BY_BAD_ADDR            0x0F
+#define HCI_ERR_CONN_ACCPT_TIMEOUT              0x10
+#define HCI_ERR_UNSUPPORT_FEATURE               0x11
+#define HCI_ERR_INVALID_HCI_CMD_PARAMS          0x12
+#define HCI_ERR_REMOTE_USER_TERMINATE_CONN      0x13
+#define HCI_ERR_CON_TERM_BY_HOST                0x16
+#define HCI_ERR_UNSPECIFIED_ERROR               0x1F
+#define HCI_ERR_ENCRYPTION_MODE_NOT_SUPPORT     0x25
+#define HCI_ERR_REQUESTED_QOS_NOT_SUPPORT       0x27
+#define HCI_ERR_QOS_UNACCEPTABLE_PARM           0x2C
+#define HCI_ERR_QOS_REJECTED                    0x2D
+#define HCI_ERR_CONN_REJ_NO_SUITABLE_CHAN       0x39
+
+/*============= HCI Error Codes End =======================*/
+
+
+/* Following are event return parameters.. part of HCI events 
+ */
+typedef struct  timeout_read_t {
+    A_UINT8     status;
+    A_UINT16    timeout;
+}POSTPACK TIMEOUT_INFO;
+
+typedef struct  link_supervision_timeout_read_t {
+    A_UINT8     status;
+    A_UINT16    hdl;
+    A_UINT16    timeout;
+}POSTPACK LINK_SUPERVISION_TIMEOUT_INFO;
+
+typedef struct  status_hdl_t {
+    A_UINT8     status;
+    A_UINT16    hdl;
+}POSTPACK INFO_STATUS_HDL;
+
+typedef struct write_remote_amp_assoc_t{
+    A_UINT8     status;
+    A_UINT8     hdl;
+}POSTPACK WRITE_REMOTE_AMP_ASSOC_INFO;
+
+typedef struct  read_loc_info_t {
+    A_UINT8             status;
+    LOCATION_DATA_CFG   loc;
+}POSTPACK READ_LOC_INFO;
+
+typedef struct  read_flow_ctrl_mode_t {
+    A_UINT8     status;
+    A_UINT8     mode;
+}POSTPACK READ_FLWCTRL_INFO;
+
+typedef struct  read_data_blk_size_t {
+    A_UINT8     status;
+    A_UINT16    max_acl_data_pkt_len;
+    A_UINT16    data_block_len;
+    A_UINT16    total_num_data_blks;
+}POSTPACK READ_DATA_BLK_SIZE_INFO;
+
+/* Read Link quality info */
+typedef struct link_qual_t {
+    A_UINT8     status;
+    A_UINT16    hdl;
+    A_UINT8     link_qual;
+} POSTPACK READ_LINK_QUAL_INFO,
+            READ_RSSI_INFO;
+
+typedef struct ll_cancel_resp_t {
+    A_UINT8 status;
+    A_UINT8 phy_link_hdl;
+    A_UINT8 tx_flow_spec_id;
+} POSTPACK LL_CANCEL_RESP;
+
+typedef struct read_local_ver_info_t {
+    A_UINT8     status;
+    A_UINT8     hci_version;
+    A_UINT16    hci_revision;
+    A_UINT8     pal_version;
+    A_UINT16    manf_name;
+    A_UINT16    pal_sub_ver;
+} POSTPACK READ_LOCAL_VER_INFO;
+
+
+#endif  /* __A_HCI_H__ */
diff --git a/host/include/a_osapi.h b/host/include/a_osapi.h
new file mode 100644
index 0000000..aa9103d
--- /dev/null
+++ b/host/include/a_osapi.h
@@ -0,0 +1,59 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_osapi.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_OSAPI_H_
+#define _A_OSAPI_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/osapi_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/osapi.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/osapi.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/osapi_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/osapi_win.h"
+#include "../os/win_art/include/netbuf.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/win/osapi_win.h"
+#include "../os/windows/include/netbuf.h"
+#endif
+
+#endif /* _OSAPI_H_ */
+
diff --git a/host/include/a_types.h b/host/include/a_types.h
new file mode 100644
index 0000000..6586ac2
--- /dev/null
+++ b/host/include/a_types.h
@@ -0,0 +1,55 @@
+//------------------------------------------------------------------------------
+// <copyright file="a_types.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _A_TYPES_H_
+#define _A_TYPES_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/athtypes_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/athtypes.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/athtypes.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/athtypes_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/athtypes_win.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include <athtypes_win.h>
+#endif
+
+#endif /* _ATHTYPES_H_ */
+
diff --git a/host/include/aggr_recv_api.h b/host/include/aggr_recv_api.h
new file mode 100644
index 0000000..acec0f4
--- /dev/null
+++ b/host/include/aggr_recv_api.h
@@ -0,0 +1,165 @@
+/*
+ *
+ * Copyright (c) 2004-2010 Atheros Communications Inc.
+ * All rights reserved.
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ *
+ */
+
+#ifndef __AGGR_RECV_API_H__
+#define __AGGR_RECV_API_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (* RX_CALLBACK)(void * dev, void *osbuf);
+
+typedef void (* ALLOC_NETBUFS)(A_NETBUF_QUEUE_T *q, A_UINT16 num);
+
+/*
+ * aggr_init:
+ * Initialises the data structures, allocates data queues and 
+ * os buffers. Netbuf allocator is the input param, used by the
+ * aggr module for allocation of NETBUFs from driver context.
+ * These NETBUFs are used for AMSDU processing.
+ *
+ * Also registers OS call back function to deliver the
+ * frames to OS. This is generally the topmost layer of
+ * the driver context, after which the frames go to
+ * IP stack via the call back function.
+ * This dispatcher is active only when aggregation is ON.
+ * Returns A_OK if init success, else returns A_ERROR
+ */
+A_UINT8
+aggr_init(ALLOC_NETBUFS netbuf_allocator, RX_CALLBACK fn);
+
+/*
+ * aggr_init_conn:
+ * Initialises the data structures, allocates data queues and 
+ * os buffers. Returns the context for a single conn aggr.
+ * For each supported conn, this API should be called.
+ */
+void *
+aggr_init_conn(void);
+
+/*
+ * aggr_process_bar:
+ * When target receives BAR, it communicates to host driver
+ * for modifying window parameters. Target indicates this via the 
+ * event: WMI_ADDBA_REQ_EVENTID. Host will dequeue all frames
+ * up to the indicated sequence number.
+ */
+void
+aggr_process_bar(void *cntxt, A_UINT8 tid, A_UINT16 seq_no);
+
+
+/*
+ * aggr_recv_addba_req_evt:
+ * This event is to initiate/modify the receive side window.
+ * Target will send WMI_ADDBA_REQ_EVENTID event to host - to setup 
+ * recv re-ordering queues. Target will negotiate ADDBA with peer, 
+ * and indicate via this event after succesfully completing the 
+ * negotiation. This happens in two situations:
+ *  1. Initial setup of aggregation
+ *  2. Renegotiation of current recv window.
+ * Window size for re-ordering is limited by target buffer
+ * space, which is reflected in win_sz.
+ * (Re)Start the periodic timer to deliver long standing frames,
+ * in hold_q to OS.
+ */
+void
+aggr_recv_addba_req_evt(void * cntxt, A_UINT8 tid, A_UINT16 seq_no, A_UINT8 win_sz);
+
+
+/*
+ * aggr_recv_delba_req_evt:
+ * Target indicates deletion of a BA window for a tid via the
+ * WMI_DELBA_EVENTID. Host would deliver all the frames in the 
+ * hold_q, reset tid config and disable the periodic timer, if 
+ * aggr is not enabled on any tid.
+ */
+void
+aggr_recv_delba_req_evt(void * cntxt, A_UINT8 tid);
+
+
+
+/*
+ * aggr_process_recv_frm:
+ * Called only for data frames. When aggr is ON for a tid, the buffer 
+ * is always consumed, and osbuf would be NULL. For a non-aggr case,
+ * osbuf is not modified.
+ * AMSDU frames are consumed and are later freed. They are sliced and 
+ * diced to individual frames and dispatched to stack.
+ * After consuming a osbuf(when aggr is ON), a previously registered
+ * callback may be called to deliver frames in order.
+ */
+void
+aggr_process_recv_frm(void *cntxt, A_UINT8 tid, A_UINT16 seq_no, A_BOOL is_amsdu, void **osbuf);
+
+
+/*
+ * aggr_module_destroy:
+ * Frees up all the queues and frames in them.
+ */
+void
+aggr_module_destroy(void);
+
+/*
+ *  * aggr_module_destroy_timers:
+ *   * Disarm the timers.
+ *    */
+void
+aggr_module_destroy_timers(void *cntxt);
+
+/*
+ * aggr_module_destroy_conn:
+ * Frees up all the queues and frames in them. Releases the cntxt to OS.
+ */
+void
+aggr_module_destroy_conn(void *cntxt);
+
+/*
+ * Dumps the aggregation stats 
+ */
+void
+aggr_dump_stats(void *cntxt, PACKET_LOG **log_buf);
+
+/* 
+ * aggr_reset_state -- Called when it is deemed necessary to clear the aggregate
+ *  hold Q state.  Examples include when a Connect event or disconnect event is 
+ *  received. 
+ */
+void
+aggr_reset_state(void *cntxt, void *dev);
+
+
+/*
+ * aggr_reset_state -- Called when it is deemed necessary to clear the aggregate
+ *  hold Q state.  Examples include when a Connect event or disconnect event is
+ *  received.
+ */
+void
+aggr_delba_request (void *cntxt, void *wmicntxt, A_UINT16 aid, A_UINT8 reasonCode);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*__AGGR_RECV_API_H__ */
diff --git a/host/include/ar3kconfig.h b/host/include/ar3kconfig.h
new file mode 100644
index 0000000..3a5584e
--- /dev/null
+++ b/host/include/ar3kconfig.h
@@ -0,0 +1,65 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/* AR3K module configuration APIs for HCI-bridge operation */
+
+#ifndef AR3KCONFIG_H_
+#define AR3KCONFIG_H_
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define AR3K_CONFIG_FLAG_FORCE_MINBOOT_EXIT         (1 << 0)
+#define AR3K_CONFIG_FLAG_SET_AR3K_BAUD              (1 << 1)
+#define AR3K_CONFIG_FLAG_AR3K_BAUD_CHANGE_DELAY     (1 << 2)
+#define AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP        (1 << 3)
+
+
+typedef struct {
+    A_UINT32                 Flags;           /* config flags */
+    void                     *pHCIDev;        /* HCI bridge device     */
+    HCI_TRANSPORT_PROPERTIES *pHCIProps;      /* HCI bridge props      */
+    HIF_DEVICE               *pHIFDevice;     /* HIF layer device      */
+    
+    A_UINT32                 AR3KBaudRate;    /* AR3K operational baud rate */
+    A_UINT16                 AR6KScale;       /* AR6K UART scale value */    
+    A_UINT16                 AR6KStep;        /* AR6K UART step value  */
+    struct hci_dev           *pBtStackHCIDev; /* BT Stack HCI dev */
+    A_UINT32                 PwrMgmtEnabled;  /* TLPM enabled? */  
+    A_UINT32                 IdleTimeout;     /* TLPM idle timeout */
+    A_UINT16                 WakeupTimeout;   /* TLPM wakeup timeout */
+    A_UINT8                  bdaddr[6];       /* Bluetooth device address */
+} AR3K_CONFIG_INFO;
+                                                                                        
+A_STATUS AR3KConfigure(AR3K_CONFIG_INFO *pConfigInfo);
+
+A_STATUS AR3KConfigureExit(void *config);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*AR3KCONFIG_H_*/
diff --git a/host/include/ar6000_api.h b/host/include/ar6000_api.h
new file mode 100644
index 0000000..62f7766
--- /dev/null
+++ b/host/include/ar6000_api.h
@@ -0,0 +1,54 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6000_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the API to access the OS dependent atheros host driver
+// by the WMI or WLAN generic modules.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _AR6000_API_H_
+#define _AR6000_API_H_
+
+#if defined(__linux__) && !defined(LINUX_EMULATION)
+#include "../os/linux/include/ar6xapi_linux.h"
+#endif
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/ar6xapi.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/ar6xapi.h"
+#endif
+
+#ifdef REXOS
+#include "../os/rexos/include/common/ar6xapi_rexos.h"
+#endif
+
+#if defined ART_WIN
+#include "../os/win_art/include/ar6xapi_win.h"
+#endif
+
+#ifdef ATHR_WIN_NWF
+#include "../os/windows/include/ar6xapi.h"
+#endif
+
+#endif /* _AR6000_API_H */
+
diff --git a/host/include/ar6000_diag.h b/host/include/ar6000_diag.h
new file mode 100644
index 0000000..b53512e
--- /dev/null
+++ b/host/include/ar6000_diag.h
@@ -0,0 +1,48 @@
+//------------------------------------------------------------------------------
+// <copyright file="ar6000_diag.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef AR6000_DIAG_H_
+#define AR6000_DIAG_H_
+
+
+A_STATUS
+ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
+A_STATUS
+ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
+A_STATUS
+ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
+                    A_UCHAR *data, A_UINT32 length);
+
+A_STATUS
+ar6000_WriteDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,
+                     A_UCHAR *data, A_UINT32 length);
+
+A_STATUS
+ar6k_ReadTargetRegister(HIF_DEVICE *hifDevice, int regsel, A_UINT32 *regval);
+
+void
+ar6k_FetchTargetRegs(HIF_DEVICE *hifDevice, A_UINT32 *targregs);
+
+#endif /*AR6000_DIAG_H_*/
diff --git a/host/include/ar6kap_common.h b/host/include/ar6kap_common.h
new file mode 100644
index 0000000..9ab8531
--- /dev/null
+++ b/host/include/ar6kap_common.h
@@ -0,0 +1,46 @@
+//------------------------------------------------------------------------------
+
+// <copyright file="ar6kap_common.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+
+//==============================================================================
+
+// This file contains the definitions of common AP mode data structures.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _AR6KAP_COMMON_H_
+#define _AR6KAP_COMMON_H_
+/*
+ * Used with AR6000_XIOCTL_AP_GET_STA_LIST
+ */
+typedef struct {
+    A_UINT8     mac[ATH_MAC_LEN];
+    A_UINT8     aid;
+    A_UINT8     keymgmt;
+    A_UINT8     ucipher;
+    A_UINT8     auth;
+    A_UINT8     wmode;
+} station_t;
+
+typedef struct {
+    station_t sta[AP_MAX_NUM_STA];
+} ap_get_sta_t;
+#endif /* _AR6KAP_COMMON_H_ */
diff --git a/host/include/athbtfilter.h b/host/include/athbtfilter.h
new file mode 100644
index 0000000..b7ba661
--- /dev/null
+++ b/host/include/athbtfilter.h
@@ -0,0 +1,135 @@
+//------------------------------------------------------------------------------
+// <copyright file="athbtfilter.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Public Bluetooth filter APIs
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef ATHBTFILTER_H_
+#define ATHBTFILTER_H_
+
+#define ATH_DEBUG_INFO  (1 << 2)
+#define ATH_DEBUG_INF    ATH_DEBUG_INFO
+
+typedef enum _ATHBT_HCI_CTRL_TYPE {
+    ATHBT_HCI_COMMAND     = 0,
+    ATHBT_HCI_EVENT       = 1,
+} ATHBT_HCI_CTRL_TYPE;
+
+typedef enum _ATHBT_STATE_INDICATION {
+    ATH_BT_NOOP        = 0,
+    ATH_BT_INQUIRY     = 1,
+    ATH_BT_CONNECT     = 2,
+    ATH_BT_SCO         = 3,
+    ATH_BT_ACL         = 4,
+    ATH_BT_A2DP        = 5,
+    ATH_BT_ESCO        = 6,
+    /* new states go here.. */
+
+    ATH_BT_MAX_STATE_INDICATION
+} ATHBT_STATE_INDICATION;
+
+    /* filter function for OUTGOING commands and INCOMMING events */
+typedef void   (*ATHBT_FILTER_CMD_EVENTS_FN)(void *pContext, ATHBT_HCI_CTRL_TYPE Type, unsigned char *pBuffer, int Length);
+
+    /* filter function for OUTGOING data HCI packets */
+typedef void   (*ATHBT_FILTER_DATA_FN)(void *pContext, unsigned char *pBuffer, int Length);
+
+typedef enum _ATHBT_STATE {
+    STATE_OFF  = 0,
+    STATE_ON   = 1,
+    STATE_MAX
+} ATHBT_STATE;
+
+    /* BT state indication (when filter functions are not used) */
+
+typedef void   (*ATHBT_INDICATE_STATE_FN)(void *pContext, ATHBT_STATE_INDICATION Indication, ATHBT_STATE State, unsigned char LMPVersion);
+
+typedef struct _ATHBT_FILTER_INSTANCE {
+#ifdef UNDER_CE
+    WCHAR                       *pWlanAdapterName;  /* filled in by user */
+#else
+    A_CHAR                      *pWlanAdapterName;  /* filled in by user */
+#endif /* UNDER_CE */
+    int                         FilterEnabled;      /* filtering is enabled */
+    int                         Attached;           /* filter library is attached */
+    void                        *pContext;          /* private context for filter library */
+    ATHBT_FILTER_CMD_EVENTS_FN  pFilterCmdEvents;   /* function ptr to filter a command or event */
+    ATHBT_FILTER_DATA_FN        pFilterAclDataOut;  /* function ptr to filter ACL data out (to radio) */
+    ATHBT_FILTER_DATA_FN        pFilterAclDataIn;   /* function ptr to filter ACL data in (from radio) */
+    ATHBT_INDICATE_STATE_FN     pIndicateState;     /* function ptr to indicate a state */
+} ATH_BT_FILTER_INSTANCE;
+
+
+/* API MACROS */
+
+#define AthBtFilterHciCommand(instance,packet,length)          \
+    if ((instance)->FilterEnabled) {                           \
+        (instance)->pFilterCmdEvents((instance)->pContext,     \
+                                   ATHBT_HCI_COMMAND,          \
+                                   (unsigned char *)(packet),  \
+                                   (length));                  \
+    }
+
+#define AthBtFilterHciEvent(instance,packet,length)            \
+    if ((instance)->FilterEnabled) {                           \
+        (instance)->pFilterCmdEvents((instance)->pContext,     \
+                                   ATHBT_HCI_EVENT,            \
+                                   (unsigned char *)(packet),  \
+                                   (length));                  \
+    }
+
+#define AthBtFilterHciAclDataOut(instance,packet,length)     \
+    if ((instance)->FilterEnabled) {                         \
+        (instance)->pFilterAclDataOut((instance)->pContext,  \
+                                 (unsigned char *)(packet),  \
+                                 (length));                  \
+    }
+
+#define AthBtFilterHciAclDataIn(instance,packet,length)      \
+    if ((instance)->FilterEnabled) {                         \
+        (instance)->pFilterAclDataIn((instance)->pContext,   \
+                                 (unsigned char *)(packet),  \
+                                 (length));                  \
+    }
+        
+/* if filtering is not desired, the application can indicate the state directly using this
+ * macro:
+ */
+#define AthBtIndicateState(instance,indication,state)           \
+    if ((instance)->FilterEnabled) {                            \
+        (instance)->pIndicateState((instance)->pContext,        \
+                                   (indication),                \
+                                   (state),                     \
+                                   0);                          \
+    }
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* API prototypes */
+int     AthBtFilter_Attach(ATH_BT_FILTER_INSTANCE *pInstance, A_UINT32 flags);
+void    AthBtFilter_Detach(ATH_BT_FILTER_INSTANCE *pInstance);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*ATHBTFILTER_H_*/
diff --git a/host/include/athdefs.h b/host/include/athdefs.h
new file mode 100644
index 0000000..2d7dc9c
--- /dev/null
+++ b/host/include/athdefs.h
@@ -0,0 +1,85 @@
+//------------------------------------------------------------------------------
+// <copyright file="athdefs.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __ATHDEFS_H__
+#define __ATHDEFS_H__
+
+/*
+ * This file contains definitions that may be used across both
+ * Host and Target software.  Nothing here is module-dependent
+ * or platform-dependent.
+ */
+
+/*
+ * Generic error codes that can be used by hw, sta, ap, sim, dk
+ * and any other environments. Since these are enums, feel free to
+ * add any more codes that you need.
+ */
+
+typedef enum {
+    A_ERROR = -1,               /* Generic error return */
+    A_OK = 0,                   /* success */
+                                /* Following values start at 1 */
+    A_DEVICE_NOT_FOUND,         /* not able to find PCI device */
+    A_NO_MEMORY,                /* not able to allocate memory, not available */
+    A_MEMORY_NOT_AVAIL,         /* memory region is not free for mapping */
+    A_NO_FREE_DESC,             /* no free descriptors available */
+    A_BAD_ADDRESS,              /* address does not match descriptor */
+    A_WIN_DRIVER_ERROR,         /* used in NT_HW version, if problem at init */
+    A_REGS_NOT_MAPPED,          /* registers not correctly mapped */
+    A_EPERM,                    /* Not superuser */
+    A_EACCES,                   /* Access denied */
+    A_ENOENT,                   /* No such entry, search failed, etc. */
+    A_EEXIST,                   /* The object already exists (can't create) */
+    A_EFAULT,                   /* Bad address fault */
+    A_EBUSY,                    /* Object is busy */
+    A_EINVAL,                   /* Invalid parameter */
+    A_EMSGSIZE,                 /* Inappropriate message buffer length */
+    A_ECANCELED,                /* Operation canceled */
+    A_ENOTSUP,                  /* Operation not supported */
+    A_ECOMM,                    /* Communication error on send */
+    A_EPROTO,                   /* Protocol error */
+    A_ENODEV,                   /* No such device */
+    A_EDEVNOTUP,                /* device is not UP */
+    A_NO_RESOURCE,              /* No resources for requested operation */
+    A_HARDWARE,                 /* Hardware failure */
+    A_PENDING,                  /* Asynchronous routine; will send up results la
+ter (typically in callback) */
+    A_EBADCHANNEL,              /* The channel cannot be used */
+    A_DECRYPT_ERROR,            /* Decryption error */
+    A_PHY_ERROR,                /* RX PHY error */
+    A_CONSUMED                  /* Object was consumed */
+} A_STATUS;
+
+#define A_SUCCESS(x)        (x == A_OK)
+#define A_FAILED(x)         (!A_SUCCESS(x))
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#endif /* __ATHDEFS_H__ */
+
diff --git a/host/include/athendpack.h b/host/include/athendpack.h
new file mode 100644
index 0000000..96445d7
--- /dev/null
+++ b/host/include/athendpack.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="athendpack.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// end compiler-specific structure packing
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifdef VXWORKS
+#endif /* VXWORKS */
+
+#if defined(LINUX) || defined(__linux__)
+#endif /* LINUX */
+
+#ifdef QNX
+#endif /* QNX */
+
+#ifdef INTEGRITY
+#include "integrity/athendpack_integrity.h"
+#endif /* INTEGRITY */
+
+#ifdef NUCLEUS
+#endif /* NUCLEUS */
+
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/athendpack.h"
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/athendpack.h"
+#endif /* WINCE */
+
+#ifdef ATHR_WIN_NWF
+#include <athendpack_win.h>
+#endif
diff --git a/host/include/athstartpack.h b/host/include/athstartpack.h
new file mode 100644
index 0000000..c81435b
--- /dev/null
+++ b/host/include/athstartpack.h
@@ -0,0 +1,69 @@
+//------------------------------------------------------------------------------
+// <copyright file="athstartpack.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// start compiler-specific structure packing
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifdef VXWORKS
+#endif /* VXWORKS */
+
+#if defined(LINUX) || defined(__linux__)
+#endif /* LINUX */
+
+#ifdef QNX
+#endif /* QNX */
+
+#ifdef INTEGRITY
+#include "integrity/athstartpack_integrity.h"
+#endif /* INTEGRITY */
+
+#ifdef NUCLEUS
+#endif /* NUCLEUS */
+
+#ifdef ATHR_WM_NWF
+#include "../os/windows/include/athstartpack.h"
+#define PREPACK
+#endif
+
+#ifdef ATHR_CE_LEGACY
+#include "../os/windows/include/athstartpack.h"
+#endif /* WINCE */
+
+#ifdef ATHR_WIN_NWF
+
+#ifndef PREPACK
+#define PREPACK __declspec(align(1))
+#endif
+
+#include <athstartpack_win.h>
+#define __ATTRIB_PACK POSTPACK
+
+#endif
+
+#if __LONG_MAX__ == __INT_MAX__
+/* 32-bit compilation */
+#define PREPACK64
+#define POSTPACK64
+#else
+/* 64-bit compilation */
+#define PREPACK64 PREPACK
+#define POSTPACK64 POSTPACK
+#endif
diff --git a/host/include/bmi.h b/host/include/bmi.h
new file mode 100644
index 0000000..960294e
--- /dev/null
+++ b/host/include/bmi.h
@@ -0,0 +1,140 @@
+//------------------------------------------------------------------------------
+// <copyright file="bmi.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// BMI declarations and prototypes
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _BMI_H_
+#define _BMI_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* Header files */
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_types.h"
+#include "hif.h"
+#include "a_osapi.h"
+#include "bmi_msg.h"
+
+void
+BMIInit(void);
+
+void
+BMICleanup(void);
+
+A_STATUS
+BMIDone(HIF_DEVICE *device);
+
+A_STATUS
+BMIGetTargetInfo(HIF_DEVICE *device, struct bmi_target_info *targ_info);
+
+A_STATUS
+BMIReadMemory(HIF_DEVICE *device,
+              A_UINT32 address,
+              A_UCHAR *buffer,
+              A_UINT32 length);
+
+A_STATUS
+BMIWriteMemory(HIF_DEVICE *device,
+               A_UINT32 address,
+               A_UCHAR *buffer,
+               A_UINT32 length);
+
+A_STATUS
+BMIExecute(HIF_DEVICE *device,
+           A_UINT32 address,
+           A_UINT32 *param);
+
+A_STATUS
+BMISetAppStart(HIF_DEVICE *device,
+               A_UINT32 address);
+
+A_STATUS
+BMIReadSOCRegister(HIF_DEVICE *device,
+                   A_UINT32 address,
+                   A_UINT32 *param);
+
+A_STATUS
+BMIWriteSOCRegister(HIF_DEVICE *device,
+                    A_UINT32 address,
+                    A_UINT32 param);
+
+A_STATUS
+BMIrompatchInstall(HIF_DEVICE *device,
+                   A_UINT32 ROM_addr,
+                   A_UINT32 RAM_addr,
+                   A_UINT32 nbytes,
+                   A_UINT32 do_activate,
+                   A_UINT32 *patch_id);
+
+A_STATUS
+BMIrompatchUninstall(HIF_DEVICE *device,
+                     A_UINT32 rompatch_id);
+
+A_STATUS
+BMIrompatchActivate(HIF_DEVICE *device,
+                    A_UINT32 rompatch_count,
+                    A_UINT32 *rompatch_list);
+
+A_STATUS
+BMIrompatchDeactivate(HIF_DEVICE *device,
+                      A_UINT32 rompatch_count,
+                      A_UINT32 *rompatch_list);
+
+A_STATUS
+BMILZStreamStart(HIF_DEVICE *device,
+                 A_UINT32 address);
+
+A_STATUS
+BMILZData(HIF_DEVICE *device,
+          A_UCHAR *buffer,
+          A_UINT32 length);
+
+A_STATUS
+BMIFastDownload(HIF_DEVICE *device,
+                A_UINT32 address,
+                A_UCHAR *buffer,
+                A_UINT32 length);
+
+A_STATUS
+BMInvramProcess(HIF_DEVICE *device,
+                A_UCHAR *seg_name,
+                A_UINT32 *retval);
+
+A_STATUS
+BMIRawWrite(HIF_DEVICE *device,
+            A_UCHAR *buffer,
+            A_UINT32 length);
+
+A_STATUS
+BMIRawRead(HIF_DEVICE *device, 
+           A_UCHAR *buffer, 
+           A_UINT32 length, 
+           A_BOOL want_timeout);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _BMI_H_ */
diff --git a/host/include/bmi_msg.h b/host/include/bmi_msg.h
new file mode 100644
index 0000000..e7032ab
--- /dev/null
+++ b/host/include/bmi_msg.h
@@ -0,0 +1,334 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __BMI_MSG_H__
+#define __BMI_MSG_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+/*
+ * Bootloader Messaging Interface (BMI)
+ *
+ * BMI is a very simple messaging interface used during initialization
+ * to read memory, write memory, execute code, and to define an
+ * application entry PC.
+ *
+ * It is used to download an application to AR6K, to provide
+ * patches to code that is already resident on AR6K, and generally
+ * to examine and modify state.  The Host has an opportunity to use
+ * BMI only once during bootup.  Once the Host issues a BMI_DONE
+ * command, this opportunity ends.
+ *
+ * The Host writes BMI requests to mailbox0, and reads BMI responses
+ * from mailbox0.   BMI requests all begin with a command
+ * (see below for specific commands), and are followed by
+ * command-specific data.
+ *
+ * Flow control:
+ * The Host can only issue a command once the Target gives it a
+ * "BMI Command Credit", using AR6K Counter #4.  As soon as the
+ * Target has completed a command, it issues another BMI Command
+ * Credit (so the Host can issue the next command).
+ *
+ * BMI handles all required Target-side cache flushing.
+ */
+
+
+/* Maximum data size used for BMI transfers */
+#define BMI_DATASZ_MAX                      256
+
+/* BMI Commands */
+
+#define BMI_NO_COMMAND                      0
+
+#define BMI_DONE                            1
+        /*
+         * Semantics: Host is done using BMI
+         * Request format:
+         *    A_UINT32      command (BMI_DONE)
+         * Response format: none
+         */
+
+#define BMI_READ_MEMORY                     2
+        /*
+         * Semantics: Host reads AR6K memory
+         * Request format:
+         *    A_UINT32      command (BMI_READ_MEMORY)
+         *    A_UINT32      address
+         *    A_UINT32      length, at most BMI_DATASZ_MAX
+         * Response format:
+         *    A_UINT8       data[length]
+         */
+
+#define BMI_WRITE_MEMORY                    3
+        /*
+         * Semantics: Host writes AR6K memory
+         * Request format:
+         *    A_UINT32      command (BMI_WRITE_MEMORY)
+         *    A_UINT32      address
+         *    A_UINT32      length, at most BMI_DATASZ_MAX
+         *    A_UINT8       data[length]
+         * Response format: none
+         */
+/* 
+ * Capbility to write "segmented files" is provided for two reasons
+ * 1) backwards compatibility for certain situations where Hosts
+ *    have limited flexibility
+ * 2) because it's darn convenient.
+ *
+ * A segmented file consists of a file header followed by an arbitrary number
+ * of segments.  Each segment contains segment metadata -- a Target address and
+ * a length -- followed by "length" bytes of data. A segmented file ends with
+ * a segment that specifies length=BMI_SGMTFILE_DONE. When a segmented file
+ * is sent to the Target, firmware writes each segment to the specified address.
+ *
+ * Special cases:
+ * 1) If a segment's metadata indicates length=BMI_SGMTFILE_EXEC, then the
+ * specified address is used as a function entry point for a brief function
+ * with prototype "(void *)(void)". That function is called immediately.
+ * After execution of the function completes, firmware continues with the
+ * next segment. No data is expected when length=BMI_SGMTFILE_EXEC.
+ *
+ * 2) If a segment's metadata indicates length=BMI_SGMTFILE_BEGINADDR, then
+ * the specified address is established as the application start address
+ * so that a subsequent BMI_DONE jumps there.
+ *
+ * 3) If a segment's metadata indicates length=BMI_SGMTFILE_BDDATA, then
+ * the specified address is used as the (possibly compressed) length of board
+ * data, which is loaded into the proper Target address as specified by
+ * hi_board_data. In addition, the hi_board_data_initialized flag is set.
+ *
+ * A segmented file is sent to the Target using a sequence of 1 or more
+ * BMI_WRITE_MEMORY commands.  The first such command must have
+ * address=BMI_SEGMENTED_WRITE_ADDR.  Subsequent BMI_WRITE_MEMORY commands
+ * can use an arbitrary address.  In each BMI_WRITE_MEMORY command, the
+ * length specifies the number of data bytes transmitted (except for the
+ * special cases listed above).
+ * 
+ * Alternatively, a segmented file may be sent to the Target using a
+ * BMI_LZ_STREAM_START command with address=BMI_SEGMENTED_WRITE_ADDR
+ * followed by a series of BMI_LZ_DATA commands that each send the next portion
+ * of the segmented file.
+ *
+ * The data segments may be lz77 compressed.  In this case, the segmented file
+ * header flag, BMI_SGMTFILE_FLAG_COMPRESS, must be set.  Note that segmented
+ * file METAdata is never compressed; only the data segments themselves are
+ * compressed. There is no way to mix compressed and uncompressed data segments
+ * in a single segmented file. Compressed (or uncompressed) segments are handled
+ * by both BMI_WRITE_MEMORY and by BMI_LZ_DATA commands.  (Compression is an
+ * attribute of the segmented file rather than of the command used to transmit
+ * it.)
+ */
+#define BMI_SEGMENTED_WRITE_ADDR 0x1234
+
+/* File header for a segmented file */
+struct bmi_segmented_file_header {
+    A_UINT32 magic_num;
+    A_UINT32 file_flags;
+};
+#define BMI_SGMTFILE_MAGIC_NUM          0x544d4753 /* "SGMT" */
+#define BMI_SGMTFILE_FLAG_COMPRESS      1
+
+/* Metadata for a segmented file segment */
+struct bmi_segmented_metadata {
+    A_UINT32 addr;
+    A_UINT32 length;
+};
+/* Special values for bmi_segmented_metadata.length (all have high bit set) */
+#define BMI_SGMTFILE_DONE               0xffffffff      /* end of segmented data */
+#define BMI_SGMTFILE_BDDATA             0xfffffffe      /* Board Data segment */
+#define BMI_SGMTFILE_BEGINADDR          0xfffffffd      /* set beginning address */
+#define BMI_SGMTFILE_EXEC               0xfffffffc      /* immediate function execution */
+
+#define BMI_EXECUTE                         4
+        /*
+         * Semantics: Causes AR6K to execute code
+         * Request format:
+         *    A_UINT32      command (BMI_EXECUTE)
+         *    A_UINT32      address
+         *    A_UINT32      parameter
+         * Response format:
+         *    A_UINT32      return value
+         */
+/*
+ * Note: In order to support the segmented file feature
+ * (see BMI_WRITE_MEMORY), when the address specified in a
+ * BMI_EXECUTE command matches (same physical address)
+ * BMI_SEGMENTED_WRITE_ADDR, it is ignored. Instead, execution
+ * begins at the address specified by hi_app_start.
+ */
+
+#define BMI_SET_APP_START                   5
+        /*
+         * Semantics: Set Target application starting address
+         * Request format:
+         *    A_UINT32      command (BMI_SET_APP_START)
+         *    A_UINT32      address
+         * Response format: none
+         */
+
+#define BMI_READ_SOC_REGISTER               6
+        /*
+         * Semantics: Read a 32-bit Target SOC register.
+         * Request format:
+         *    A_UINT32      command (BMI_READ_REGISTER)
+         *    A_UINT32      address
+         * Response format: 
+         *    A_UINT32      value
+         */
+
+#define BMI_WRITE_SOC_REGISTER              7
+        /*
+         * Semantics: Write a 32-bit Target SOC register.
+         * Request format:
+         *    A_UINT32      command (BMI_WRITE_REGISTER)
+         *    A_UINT32      address
+         *    A_UINT32      value
+         *
+         * Response format: none
+         */
+
+#define BMI_GET_TARGET_ID                  8
+#define BMI_GET_TARGET_INFO                8
+        /*
+         * Semantics: Fetch the 4-byte Target information
+         * Request format:
+         *    A_UINT32      command (BMI_GET_TARGET_ID/INFO)
+         * Response format1 (old firmware):
+         *    A_UINT32      TargetVersionID
+         * Response format2 (newer firmware):
+         *    A_UINT32      TARGET_VERSION_SENTINAL
+         *    struct bmi_target_info;
+         */
+
+PREPACK struct bmi_target_info {
+    A_UINT32 target_info_byte_count; /* size of this structure */
+    A_UINT32 target_ver;             /* Target Version ID */
+    A_UINT32 target_type;            /* Target type */
+} POSTPACK;
+#define TARGET_VERSION_SENTINAL 0xffffffff
+#define TARGET_TYPE_AR6001 1
+#define TARGET_TYPE_AR6002 2
+#define TARGET_TYPE_AR6003 3
+#define TARGET_TYPE_MCKINLEY 5
+
+
+#define BMI_ROMPATCH_INSTALL               9
+        /*
+         * Semantics: Install a ROM Patch.
+         * Request format:
+         *    A_UINT32      command (BMI_ROMPATCH_INSTALL)
+         *    A_UINT32      Target ROM Address
+         *    A_UINT32      Target RAM Address or Value (depending on Target Type)
+         *    A_UINT32      Size, in bytes
+         *    A_UINT32      Activate? 1-->activate;
+         *                            0-->install but do not activate
+         * Response format:
+         *    A_UINT32      PatchID
+         */
+
+#define BMI_ROMPATCH_UNINSTALL             10
+        /*
+         * Semantics: Uninstall a previously-installed ROM Patch,
+         * automatically deactivating, if necessary.
+         * Request format:
+         *    A_UINT32      command (BMI_ROMPATCH_UNINSTALL)
+         *    A_UINT32      PatchID
+         *
+         * Response format: none
+         */
+
+#define BMI_ROMPATCH_ACTIVATE              11
+        /*
+         * Semantics: Activate a list of previously-installed ROM Patches.
+         * Request format:
+         *    A_UINT32      command (BMI_ROMPATCH_ACTIVATE)
+         *    A_UINT32      rompatch_count
+         *    A_UINT32      PatchID[rompatch_count]
+         *
+         * Response format: none
+         */
+
+#define BMI_ROMPATCH_DEACTIVATE            12
+        /*
+         * Semantics: Deactivate a list of active ROM Patches.
+         * Request format:
+         *    A_UINT32      command (BMI_ROMPATCH_DEACTIVATE)
+         *    A_UINT32      rompatch_count
+         *    A_UINT32      PatchID[rompatch_count]
+         *
+         * Response format: none
+         */
+
+
+#define BMI_LZ_STREAM_START                13
+        /*
+         * Semantics: Begin an LZ-compressed stream of input
+         * which is to be uncompressed by the Target to an
+         * output buffer at address.  The output buffer must
+         * be sufficiently large to hold the uncompressed
+         * output from the compressed input stream.  This BMI
+         * command should be followed by a series of 1 or more
+         * BMI_LZ_DATA commands.
+         *    A_UINT32      command (BMI_LZ_STREAM_START)
+         *    A_UINT32      address
+         * Note: Not supported on all versions of ROM firmware.
+         */
+
+#define BMI_LZ_DATA                        14
+        /*
+         * Semantics: Host writes AR6K memory with LZ-compressed
+         * data which is uncompressed by the Target.  This command
+         * must be preceded by a BMI_LZ_STREAM_START command. A series
+         * of BMI_LZ_DATA commands are considered part of a single
+         * input stream until another BMI_LZ_STREAM_START is issued.
+         * Request format:
+         *    A_UINT32      command (BMI_LZ_DATA)
+         *    A_UINT32      length (of compressed data),
+         *                  at most BMI_DATASZ_MAX
+         *    A_UINT8       CompressedData[length]
+         * Response format: none
+         * Note: Not supported on all versions of ROM firmware.
+         */
+
+#define BMI_NVRAM_PROCESS                  15
+#define BMI_NVRAM_SEG_NAME_SZ 16
+        /*
+         * Semantics: Cause Target to search NVRAM (if any) for a
+         * segment with the specified name and process it according
+         * to NVRAM metadata.
+         * Request format:
+         *    A_UINT32      command (BMI_NVRAM_PROCESS)
+         *    A_UCHAR       name[BMI_NVRAM_SEG_NAME_SZ] name (LE format)
+         * Response format:
+         *    A_UINT32      0, if nothing was executed;
+         *                  otherwise the value returned from the
+         *                  last NVRAM segment that was executed
+         */
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __BMI_MSG_H__ */
diff --git a/host/include/btcoexGpio.h b/host/include/btcoexGpio.h
new file mode 100644
index 0000000..15f3f01
--- /dev/null
+++ b/host/include/btcoexGpio.h
@@ -0,0 +1,86 @@
+// Copyright (c) 2010 Atheros Communications Inc.
+// All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+
+#ifndef BTCOEX_GPIO_H_
+#define BTCOEX_GPIO_H_
+
+
+
+#ifdef FPGA
+#define GPIO_A      (15)
+#define GPIO_B      (16)
+#define GPIO_C      (17)
+#define GPIO_D      (18)
+#define GPIO_E      (19)
+#define GPIO_F      (21)
+#define GPIO_G      (21)
+#else
+#define GPIO_A      (0)
+#define GPIO_B      (5)
+#define GPIO_C      (6)
+#define GPIO_D      (7)
+#define GPIO_E      (7)
+#define GPIO_F      (7)
+#define GPIO_G      (7)
+#endif
+
+
+
+
+
+#define GPIO_DEBUG_WORD_1                                 (1<<GPIO_A)
+#define GPIO_DEBUG_WORD_2                   (1<<GPIO_B)
+#define GPIO_DEBUG_WORD_3                  ((1<<GPIO_B) | (1<<GPIO_A))
+#define GPIO_DEBUG_WORD_4     (1<<GPIO_C)
+#define GPIO_DEBUG_WORD_5    ((1<<GPIO_C) |               (1<<GPIO_A))
+#define GPIO_DEBUG_WORD_6    ((1<<GPIO_C) | (1<<GPIO_B))
+#define GPIO_DEBUG_WORD_7    ((1<<GPIO_C) | (1<<GPIO_B) | (1<<GPIO_A))
+
+#define GPIO_DEBUG_WORD_8     (1<<GPIO_D)
+#define GPIO_DEBUG_WORD_9    ((1<<GPIO_D) | GPIO_DEBUG_WORD_1)
+#define GPIO_DEBUG_WORD_10   ((1<<GPIO_D) | GPIO_DEBUG_WORD_2)
+#define GPIO_DEBUG_WORD_11   ((1<<GPIO_D) | GPIO_DEBUG_WORD_3)
+#define GPIO_DEBUG_WORD_12   ((1<<GPIO_D) | GPIO_DEBUG_WORD_4)
+#define GPIO_DEBUG_WORD_13   ((1<<GPIO_D) | GPIO_DEBUG_WORD_5)
+#define GPIO_DEBUG_WORD_14   ((1<<GPIO_D) | GPIO_DEBUG_WORD_6)
+#define GPIO_DEBUG_WORD_15   ((1<<GPIO_D) | GPIO_DEBUG_WORD_7)
+
+#define GPIO_DEBUG_WORD_16   (1<<GPIO_E)
+#define GPIO_DEBUG_WORD_17    ((1<<GPIO_E) | GPIO_DEBUG_WORD_1)
+#define GPIO_DEBUG_WORD_18   ((1<<GPIO_E) | GPIO_DEBUG_WORD_2)
+#define GPIO_DEBUG_WORD_19   ((1<<GPIO_E) | GPIO_DEBUG_WORD_3)
+#define GPIO_DEBUG_WORD_20   ((1<<GPIO_E) | GPIO_DEBUG_WORD_4)
+#define GPIO_DEBUG_WORD_21   ((1<<GPIO_E) | GPIO_DEBUG_WORD_5)
+#define GPIO_DEBUG_WORD_22   ((1<<GPIO_E) | GPIO_DEBUG_WORD_6)
+#define GPIO_DEBUG_WORD_23   ((1<<GPIO_E) | GPIO_DEBUG_WORD_7)
+
+
+
+extern void btcoexDbgPulseWord(A_UINT32 gpioPinMask);
+extern void btcoexDbgPulse(A_UINT32 pin);
+
+#ifdef CONFIG_BTCOEX_ENABLE_GPIO_DEBUG
+#define BTCOEX_DBG_PULSE_WORD(gpioPinMask)  (btcoexDbgPulseWord(gpioPinMask))
+#define BTCOEX_DBG_PULSE(pin)               (btcoexDbgPulse(pin))
+#else
+#define BTCOEX_DBG_PULSE_WORD(gpioPinMask)
+#define BTCOEX_DBG_PULSE(pin)
+
+#endif
+#endif
+
diff --git a/host/include/cnxmgmt.h b/host/include/cnxmgmt.h
new file mode 100644
index 0000000..3177957
--- /dev/null
+++ b/host/include/cnxmgmt.h
@@ -0,0 +1,38 @@
+//------------------------------------------------------------------------------
+// <copyright file="cnxmgmt.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _CNXMGMT_H_
+#define _CNXMGMT_H_
+
+typedef enum {
+    CM_CONNECT_WITHOUT_SCAN             = 0x0001,
+    CM_CONNECT_ASSOC_POLICY_USER        = 0x0002,
+    CM_CONNECT_SEND_REASSOC             = 0x0004,
+    CM_CONNECT_WITHOUT_ROAMTABLE_UPDATE = 0x0008,
+    CM_CONNECT_DO_WPA_OFFLOAD           = 0x0010,
+    CM_CONNECT_DO_NOT_DEAUTH            = 0x0020,
+    CM_CONNECT_IGNORE_BSSID_HINT        = 0x0040,
+    CM_CONNECT_STAY_AWAKE               = 0x0080,
+} CM_CONNECT_TYPE;
+
+#endif  /* _CNXMGMT_H_ */
diff --git a/host/include/common_drv.h b/host/include/common_drv.h
new file mode 100644
index 0000000..43dc199
--- /dev/null
+++ b/host/include/common_drv.h
@@ -0,0 +1,107 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef COMMON_DRV_H_
+#define COMMON_DRV_H_
+
+#include "hif.h"
+#include "htc_packet.h"
+#include "htc_api.h"
+
+/* structure that is the state information for the default credit distribution callback
+ * drivers should instantiate (zero-init as well) this structure in their driver instance
+ * and pass it as a context to the HTC credit distribution functions */
+typedef struct _COMMON_CREDIT_STATE_INFO {
+    int TotalAvailableCredits;      /* total credits in the system at startup */
+    int CurrentFreeCredits;         /* credits available in the pool that have not been
+                                       given out to endpoints */
+    HTC_ENDPOINT_CREDIT_DIST *pLowestPriEpDist;  /* pointer to the lowest priority endpoint dist struct */
+} COMMON_CREDIT_STATE_INFO;
+
+typedef struct {
+    A_INT32 (*setupTransport)(void *ar);
+    void (*cleanupTransport)(void *ar);
+} HCI_TRANSPORT_CALLBACKS;
+
+typedef struct {
+   void *netDevice;
+   void *hifDevice;
+   void *htcHandle;
+} HCI_TRANSPORT_MISC_HANDLES;
+
+/* HTC TX packet tagging definitions */
+#define AR6K_CONTROL_PKT_TAG    HTC_TX_PACKET_TAG_USER_DEFINED
+#define AR6K_DATA_PKT_TAG       (AR6K_CONTROL_PKT_TAG + 1)
+
+#define AR6002_VERSION_REV2     0x20000188
+#define AR6003_VERSION_REV2     0x30000384
+
+#define AR6002_CUST_DATA_SIZE 112
+#define AR6003_CUST_DATA_SIZE 16
+#define MCKINLEY_CUST_DATA_SIZE 16
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* OS-independent APIs */
+A_STATUS ar6000_setup_credit_dist(HTC_HANDLE HTCHandle, COMMON_CREDIT_STATE_INFO *pCredInfo);
+
+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
+A_STATUS ar6000_ReadDataDiag(HIF_DEVICE *hifDevice, A_UINT32 address,  A_UCHAR *data, A_UINT32 length);
+
+A_STATUS ar6000_reset_device(HIF_DEVICE *hifDevice, A_UINT32 TargetType, A_BOOL waitForCompletion, A_BOOL coldReset);
+
+void ar6000_dump_target_assert_info(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
+
+A_STATUS ar6000_set_htc_params(HIF_DEVICE *hifDevice,
+                               A_UINT32    TargetType,
+                               A_UINT32    MboxIsrYieldValue,
+                               A_UINT8     HtcControlBuffers);
+
+A_STATUS ar6000_prepare_target(HIF_DEVICE *hifDevice,
+                               A_UINT32    TargetType,
+                               A_UINT32    TargetVersion);
+
+A_STATUS ar6000_set_hci_bridge_flags(HIF_DEVICE *hifDevice,
+                                     A_UINT32    TargetType,
+                                     A_UINT32    Flags);
+
+void ar6000_copy_cust_data_from_target(HIF_DEVICE *hifDevice, A_UINT32 TargetType);
+
+A_UINT8 *ar6000_get_cust_data_buffer(A_UINT32 TargetType);
+
+A_STATUS ar6000_setBTState(void *context, A_UINT8 *pInBuf, A_UINT32 InBufSize);
+
+A_STATUS ar6000_setDevicePowerState(void *context, A_UINT8 *pInBuf, A_UINT32 InBufSize);
+
+A_STATUS ar6000_setWowMode(void *context, A_UINT8 *pInBuf, A_UINT32 InBufSize);
+
+A_STATUS ar6000_setHostMode(void *context, A_UINT8 *pInBuf, A_UINT32 InBufSize);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /*COMMON_DRV_H_*/
diff --git a/host/include/dbglog.h b/host/include/dbglog.h
new file mode 100644
index 0000000..3061f94
--- /dev/null
+++ b/host/include/dbglog.h
@@ -0,0 +1,134 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DBGLOG_H_
+#define _DBGLOG_H_
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define DBGLOG_TIMESTAMP_OFFSET          0
+#define DBGLOG_TIMESTAMP_MASK            0x0000FFFF /* Bit 0-15. Contains bit
+                                                       8-23 of the LF0 timer */
+#define DBGLOG_DBGID_OFFSET              16
+#define DBGLOG_DBGID_MASK                0x03FF0000 /* Bit 16-25 */
+#define DBGLOG_DBGID_NUM_MAX             256 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULEID_OFFSET           26
+#define DBGLOG_MODULEID_MASK             0x3C000000 /* Bit 26-29 */
+#define DBGLOG_MODULEID_NUM_MAX          16 /* Upper limit is width of mask */
+
+/*
+ * Please ensure that the definition of any new module intrduced is captured
+ * between the DBGLOG_MODULEID_START and DBGLOG_MODULEID_END defines. The 
+ * structure is required for the parser to correctly pick up the values for
+ * different modules.
+ */
+#define DBGLOG_MODULEID_START
+#define DBGLOG_MODULEID_INF                   0
+#define DBGLOG_MODULEID_WMI                   1
+#define DBGLOG_MODULEID_MISC                  2
+#define DBGLOG_MODULEID_PM                    3
+#define DBGLOG_MODULEID_TXRX_MGMTBUF          4
+#define DBGLOG_MODULEID_TXRX_TXBUF            5
+#define DBGLOG_MODULEID_TXRX_RXBUF            6
+#define DBGLOG_MODULEID_WOW                   7
+#define DBGLOG_MODULEID_WHAL                  8
+#define DBGLOG_MODULEID_DC                    9
+#define DBGLOG_MODULEID_CO                    10
+#define DBGLOG_MODULEID_RO                    11
+#define DBGLOG_MODULEID_CM                    12
+#define DBGLOG_MODULEID_MGMT                  13
+#define DBGLOG_MODULEID_TMR                   14
+#define DBGLOG_MODULEID_BTCOEX                15
+#define DBGLOG_MODULEID_END
+
+#define DBGLOG_NUM_ARGS_OFFSET             30
+#define DBGLOG_NUM_ARGS_MASK               0xC0000000 /* Bit 30-31 */
+#define DBGLOG_NUM_ARGS_MAX                2 /* Upper limit is width of mask */
+
+#define DBGLOG_MODULE_LOG_ENABLE_OFFSET    0
+#define DBGLOG_MODULE_LOG_ENABLE_MASK      0x0000FFFF
+
+#define DBGLOG_REPORTING_ENABLED_OFFSET    16
+#define DBGLOG_REPORTING_ENABLED_MASK      0x00010000
+
+#define DBGLOG_TIMESTAMP_RESOLUTION_OFFSET 17
+#define DBGLOG_TIMESTAMP_RESOLUTION_MASK   0x000E0000
+
+#define DBGLOG_REPORT_SIZE_OFFSET          20
+#define DBGLOG_REPORT_SIZE_MASK            0x3FF00000
+
+#define DBGLOG_LOG_BUFFER_SIZE             1500
+#define DBGLOG_DBGID_DEFINITION_LEN_MAX    90
+
+PREPACK struct dbglog_buf_s {
+    struct dbglog_buf_s *next;
+    A_UINT8             *buffer;
+    A_UINT32             bufsize;
+    A_UINT32             length;
+    A_UINT32             count;
+    A_UINT32             free;
+} POSTPACK;
+
+PREPACK struct dbglog_hdr_s {
+    struct dbglog_buf_s *dbuf;
+    A_UINT32             dropped;
+} POSTPACK;
+
+PREPACK struct dbglog_config_s {
+    A_UINT32                    cfgvalid; /* Mask with valid config bits */
+    union {
+        /* TODO: Take care of endianness */
+        struct {
+            A_UINT32            mmask:16; /* Mask of modules with logging on */
+            A_UINT32            rep:1; /* Reporting enabled or not */
+            A_UINT32            tsr:3; /* Time stamp resolution. Def: 1 ms */
+            A_UINT32            size:10; /* Report size in number of messages */
+            A_UINT32            reserved:2;
+        } dbglog_config;
+
+        A_UINT32                value;
+    } u;
+} POSTPACK;
+
+#define cfgmmask                   u.dbglog_config.mmask
+#define cfgrep                     u.dbglog_config.rep
+#define cfgtsr                     u.dbglog_config.tsr
+#define cfgsize                    u.dbglog_config.size
+#define cfgvalue                   u.value
+
+#ifdef __cplusplus
+}
+#endif
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* _DBGLOG_H_ */
diff --git a/host/include/dbglog_api.h b/host/include/dbglog_api.h
new file mode 100644
index 0000000..7aba883
--- /dev/null
+++ b/host/include/dbglog_api.h
@@ -0,0 +1,58 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains host side debug primitives.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _DBGLOG_API_H_
+#define _DBGLOG_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dbglog.h"
+
+#define DBGLOG_HOST_LOG_BUFFER_SIZE            DBGLOG_LOG_BUFFER_SIZE
+
+#define DBGLOG_GET_DBGID(arg) \
+    ((arg & DBGLOG_DBGID_MASK) >> DBGLOG_DBGID_OFFSET)
+
+#define DBGLOG_GET_MODULEID(arg) \
+    ((arg & DBGLOG_MODULEID_MASK) >> DBGLOG_MODULEID_OFFSET)
+
+#define DBGLOG_GET_NUMARGS(arg) \
+    ((arg & DBGLOG_NUM_ARGS_MASK) >> DBGLOG_NUM_ARGS_OFFSET)
+
+#define DBGLOG_GET_TIMESTAMP(arg) \
+    ((arg & DBGLOG_TIMESTAMP_MASK) >> DBGLOG_TIMESTAMP_OFFSET)
+
+/** 
+  @param lv 0->RAW info, 1->Breif translated info, 2->Full info
+  @param logbuf dbglog buffer
+ */
+int dbg_formater(int lv, char *output, size_t len, A_UINT32 ts, A_INT32 *logbuf);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_API_H_ */
diff --git a/host/include/dbglog_id.h b/host/include/dbglog_id.h
new file mode 100644
index 0000000..9bc48ff
--- /dev/null
+++ b/host/include/dbglog_id.h
@@ -0,0 +1,593 @@
+//------------------------------------------------------------------------------
+// <copyright file="dbglog_id.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DBGLOG_ID_H_
+#define _DBGLOG_ID_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* 
+ * The nomenclature for the debug identifiers is MODULE_DESCRIPTION.
+ * Please ensure that the definition of any new debugid introduced is captured
+ * between the <MODULE>_DBGID_DEFINITION_START and 
+ * <MODULE>_DBGID_DEFINITION_END defines. The structure is required for the 
+ * parser to correctly pick up the values for different debug identifiers.
+ */
+
+/* INF debug identifier definitions */
+#define INF_DBGID_DEFINITION_START
+#define INF_ASSERTION_FAILED                          1
+#define INF_TARGET_ID                                 2
+#define INF_DBGID_DEFINITION_END
+
+/* WMI debug identifier definitions */
+#define WMI_DBGID_DEFINITION_START
+#define WMI_CMD_RX_XTND_PKT_TOO_SHORT                 1
+#define WMI_EXTENDED_CMD_NOT_HANDLED                  2
+#define WMI_CMD_RX_PKT_TOO_SHORT                      3
+#define WMI_CALLING_WMI_EXTENSION_FN                  4
+#define WMI_CMD_NOT_HANDLED                           5
+#define WMI_IN_SYNC                                   6
+#define WMI_TARGET_WMI_SYNC_CMD                       7
+#define WMI_SET_SNR_THRESHOLD_PARAMS                  8
+#define WMI_SET_RSSI_THRESHOLD_PARAMS                 9
+#define WMI_SET_LQ_TRESHOLD_PARAMS                   10
+#define WMI_TARGET_CREATE_PSTREAM_CMD                11
+#define WMI_WI_DTM_INUSE                             12
+#define WMI_TARGET_DELETE_PSTREAM_CMD                13
+#define WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD       14
+#define WMI_TARGET_GET_BIT_RATE_CMD                  15
+#define WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS       16
+#define WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD        17
+#define WMI_TARGET_GET_TX_PWR_CMD                    18
+#define WMI_FREE_EVBUF_WMIBUF                        19
+#define WMI_FREE_EVBUF_DATABUF                       20
+#define WMI_FREE_EVBUF_BADFLAG                       21
+#define WMI_HTC_RX_ERROR_DATA_PACKET                 22
+#define WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX             23
+#define WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT      24
+#define WMI_SENDING_READY_EVENT                      25
+#define WMI_SETPOWER_MDOE_TO_MAXPERF                 26
+#define WMI_SETPOWER_MDOE_TO_REC                     27
+#define WMI_BSSINFO_EVENT_FROM                       28
+#define WMI_TARGET_GET_STATS_CMD                     29
+#define WMI_SENDING_SCAN_COMPLETE_EVENT              30
+#define WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT        31
+#define WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT       32
+#define WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT     33
+#define WMI_SENDING_ERROR_REPORT_EVENT               34
+#define WMI_SENDING_CAC_EVENT                        35
+#define WMI_TARGET_GET_ROAM_TABLE_CMD                36
+#define WMI_TARGET_GET_ROAM_DATA_CMD                 37
+#define WMI_SENDING_GPIO_INTR_EVENT                  38
+#define WMI_SENDING_GPIO_ACK_EVENT                   39
+#define WMI_SENDING_GPIO_DATA_EVENT                  40
+#define WMI_CMD_RX                                   41
+#define WMI_CMD_RX_XTND                              42
+#define WMI_EVENT_SEND                               43
+#define WMI_EVENT_SEND_XTND                          44
+#define WMI_CMD_PARAMS_DUMP_START                    45
+#define WMI_CMD_PARAMS_DUMP_END                      46
+#define WMI_CMD_PARAMS                               47
+#define WMI_DBGID_DEFINITION_END
+
+/* MISC debug identifier definitions */
+#define MISC_DBGID_DEFINITION_START
+#define MISC_WLAN_SCHEDULER_EVENT_REGISTER_ERROR     1
+#define TLPM_INIT                                    2
+#define TLPM_FILTER_POWER_STATE                      3
+#define TLPM_NOTIFY_NOT_IDLE                         4
+#define TLPM_TIMEOUT_IDLE_HANDLER                    5
+#define TLPM_TIMEOUT_WAKEUP_HANDLER                  6
+#define TLPM_WAKEUP_SIGNAL_HANDLER                   7
+#define TLPM_UNEXPECTED_GPIO_INTR_ERROR              8
+#define TLPM_BREAK_ON_NOT_RECEIVED_ERROR             9
+#define TLPM_BREAK_OFF_NOT_RECIVED_ERROR             10
+#define TLPM_ACK_GPIO_INTR                           11
+#define TLPM_ON                                      12
+#define TLPM_OFF                                     13
+#define TLPM_WAKEUP_FROM_HOST                        14
+#define TLPM_WAKEUP_FROM_BT                          15 
+#define TLPM_TX_BREAK_RECIVED                        16
+#define TLPM_IDLE_TIMER_NOT_RUNNING                  17
+#define	WAC_ENABLE                                   18
+#define WAC_SCAN_DONE                                19
+#define WAC_REPORT_BSS                               20
+#define WAC_START_WPS                                21
+#define WAC_SCAN_REPLY                               22
+#define WAC_UPDATE_BSS                               23
+#define WAC_PIN_STATUS                               24
+#define WAC_PIN_STATUS_REJECT                        25
+#define WAC_RSSI_BELOW_THRESHOLD                     26
+#define WAC_CTRL_REQ_CMD                             27
+#define WAC_CTRL_REQ_REPLY                           28
+#define DV_SET_ANTENNA                               29
+#define MISC_DBGID_DEFINITION_END
+    
+/* TXRX debug identifier definitions */
+#define TXRX_TXBUF_DBGID_DEFINITION_START
+#define TXRX_TXBUF_ALLOCATE_BUF                      1
+#define TXRX_TXBUF_QUEUE_BUF_TO_MBOX                 2
+#define TXRX_TXBUF_QUEUE_BUF_TO_TXQ                  3
+#define TXRX_TXBUF_TXQ_DEPTH                         4   
+#define TXRX_TXBUF_IBSS_QUEUE_TO_SFQ                 5
+#define TXRX_TXBUF_IBSS_QUEUE_TO_TXQ_FRM_SFQ         6
+#define TXRX_TXBUF_INITIALIZE_TIMER                  7
+#define TXRX_TXBUF_ARM_TIMER                         8
+#define TXRX_TXBUF_DISARM_TIMER                      9
+#define TXRX_TXBUF_UNINITIALIZE_TIMER                10
+#define TXRX_TXBUF_DBGID_DEFINITION_END
+ 
+#define TXRX_RXBUF_DBGID_DEFINITION_START    
+#define TXRX_RXBUF_ALLOCATE_BUF                      1
+#define TXRX_RXBUF_QUEUE_TO_HOST                     2
+#define TXRX_RXBUF_QUEUE_TO_WLAN                     3
+#define TXRX_RXBUF_ZERO_LEN_BUF                      4
+#define TXRX_RXBUF_QUEUE_TO_HOST_LASTBUF_IN_RXCHAIN  5
+#define TXRX_RXBUF_LASTBUF_IN_RXCHAIN_ZEROBUF        6
+#define TXRX_RXBUF_QUEUE_EMPTY_QUEUE_TO_WLAN         7
+#define TXRX_RXBUF_SEND_TO_RECV_MGMT                 8
+#define TXRX_RXBUF_SEND_TO_IEEE_LAYER                9
+#define TXRX_RXBUF_REQUEUE_ERROR                     10
+#define TXRX_RXBUF_DBGID_DEFINITION_END
+
+#define TXRX_MGMTBUF_DBGID_DEFINITION_START 
+#define TXRX_MGMTBUF_ALLOCATE_BUF                    1
+#define TXRX_MGMTBUF_ALLOCATE_SM_BUF                 2    
+#define TXRX_MGMTBUF_ALLOCATE_RMBUF                  3
+#define TXRX_MGMTBUF_GET_BUF                         4
+#define TXRX_MGMTBUF_GET_SM_BUF                      5
+#define TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ                6
+#define TXRX_MGMTBUF_REAPED_BUF                      7
+#define TXRX_MGMTBUF_REAPED_SM_BUF                   8
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN              9
+#define TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN          10
+#define TXRX_MGMTBUF_ENQUEUE_INTO_DATA_SFQ           11
+#define TXRX_MGMTBUF_DEQUEUE_FROM_DATA_SFQ           12
+#define TXRX_MGMTBUF_PAUSE_DATA_TXQ                  13
+#define TXRX_MGMTBUF_RESUME_DATA_TXQ                 14
+#define TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT       15
+#define TXRX_MGMTBUF_DRAINQ                          16
+#define TXRX_MGMTBUF_INDICATE_Q_DRAINED              17
+#define TXRX_MGMTBUF_ENQUEUE_INTO_HW_SFQ             18
+#define TXRX_MGMTBUF_DEQUEUE_FROM_HW_SFQ             19
+#define TXRX_MGMTBUF_PAUSE_HW_TXQ                    20
+#define TXRX_MGMTBUF_RESUME_HW_TXQ                   21
+#define TXRX_MGMTBUF_TEAR_DOWN_BA                    22
+#define TXRX_MGMTBUF_PROCESS_ADDBA_REQ               23
+#define TXRX_MGMTBUF_PROCESS_DELBA                   24
+#define TXRX_MGMTBUF_PERFORM_BA                      25
+#define TXRX_MGMTBUF_WLAN_RESET_ON_ERROR             26 
+#define TXRX_MGMTBUF_DBGID_DEFINITION_END
+
+/* PM (Power Module) debug identifier definitions */
+#define PM_DBGID_DEFINITION_START
+#define PM_INIT                                      1
+#define PM_ENABLE                                    2
+#define PM_SET_STATE                                 3
+#define PM_SET_POWERMODE                             4
+#define PM_CONN_NOTIFY                               5
+#define PM_REF_COUNT_NEGATIVE                        6
+#define PM_INFRA_STA_APSD_ENABLE                     7
+#define PM_INFRA_STA_UPDATE_APSD_STATE               8
+#define PM_CHAN_OP_REQ                               9
+#define PM_SET_MY_BEACON_POLICY                      10
+#define PM_SET_ALL_BEACON_POLICY                     11
+#define PM_INFRA_STA_SET_PM_PARAMS1                  12
+#define PM_INFRA_STA_SET_PM_PARAMS2                  13
+#define PM_ADHOC_SET_PM_CAPS_FAIL                    14
+#define PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID              15
+#define PM_ADHOC_SET_PM_PARAMS                       16
+#define PM_ADHOC_STATE1                              18
+#define PM_ADHOC_STATE2                              19
+#define PM_ADHOC_CONN_MAP                            20 
+#define PM_FAKE_SLEEP                                21
+#define PM_AP_STATE1                                 22
+#define PM_AP_SET_PM_PARAMS                          23
+#define PM_P2P_STATE1                                24
+#define PM_DBGID_DEFINITION_END
+
+/* Wake on Wireless debug identifier definitions */
+#define WOW_DBGID_DEFINITION_START
+#define WOW_INIT                                        1
+#define WOW_GET_CONFIG_DSET                             2   
+#define WOW_NO_CONFIG_DSET                              3
+#define WOW_INVALID_CONFIG_DSET                         4
+#define WOW_USE_DEFAULT_CONFIG                          5
+#define WOW_SETUP_GPIO                                  6
+#define WOW_INIT_DONE                                   7
+#define WOW_SET_GPIO_PIN                                8
+#define WOW_CLEAR_GPIO_PIN                              9
+#define WOW_SET_WOW_MODE_CMD                            10
+#define WOW_SET_HOST_MODE_CMD                           11  
+#define WOW_ADD_WOW_PATTERN_CMD                         12    
+#define WOW_NEW_WOW_PATTERN_AT_INDEX                    13    
+#define WOW_DEL_WOW_PATTERN_CMD                         14    
+#define WOW_LIST_CONTAINS_PATTERNS                      15    
+#define WOW_GET_WOW_LIST_CMD                            16 
+#define WOW_INVALID_FILTER_ID                           17
+#define WOW_INVALID_FILTER_LISTID                       18
+#define WOW_NO_VALID_FILTER_AT_ID                       19
+#define WOW_NO_VALID_LIST_AT_ID                         20
+#define WOW_NUM_PATTERNS_EXCEEDED                       21
+#define WOW_NUM_LISTS_EXCEEDED                          22
+#define WOW_GET_WOW_STATS                               23
+#define WOW_CLEAR_WOW_STATS                             24
+#define WOW_WAKEUP_HOST                                 25
+#define WOW_EVENT_WAKEUP_HOST                           26
+#define WOW_EVENT_DISCARD                               27
+#define WOW_PATTERN_MATCH                               28
+#define WOW_PATTERN_NOT_MATCH                           29
+#define WOW_PATTERN_NOT_MATCH_OFFSET                    30
+#define WOW_DISABLED_HOST_ASLEEP                        31
+#define WOW_ENABLED_HOST_ASLEEP_NO_PATTERNS             32
+#define WOW_ENABLED_HOST_ASLEEP_NO_MATCH_FOUND          33
+#define WOW_DBGID_DEFINITION_END
+
+/* WHAL debug identifier definitions */
+#define WHAL_DBGID_DEFINITION_START
+#define WHAL_ERROR_ANI_CONTROL                      1
+#define WHAL_ERROR_CHIP_TEST1                       2
+#define WHAL_ERROR_CHIP_TEST2                       3
+#define WHAL_ERROR_EEPROM_CHECKSUM                  4
+#define WHAL_ERROR_EEPROM_MACADDR                   5
+#define WHAL_ERROR_INTERRUPT_HIU                    6
+#define WHAL_ERROR_KEYCACHE_RESET                   7
+#define WHAL_ERROR_KEYCACHE_SET                     8 
+#define WHAL_ERROR_KEYCACHE_TYPE                    9
+#define WHAL_ERROR_KEYCACHE_TKIPENTRY              10
+#define WHAL_ERROR_KEYCACHE_WEPLENGTH              11
+#define WHAL_ERROR_PHY_INVALID_CHANNEL             12
+#define WHAL_ERROR_POWER_AWAKE                     13
+#define WHAL_ERROR_POWER_SET                       14
+#define WHAL_ERROR_RECV_STOPDMA                    15
+#define WHAL_ERROR_RECV_STOPPCU                    16
+#define WHAL_ERROR_RESET_CHANNF1                   17
+#define WHAL_ERROR_RESET_CHANNF2                   18
+#define WHAL_ERROR_RESET_PM                        19
+#define WHAL_ERROR_RESET_OFFSETCAL                 20
+#define WHAL_ERROR_RESET_RFGRANT                   21
+#define WHAL_ERROR_RESET_RXFRAME                   22
+#define WHAL_ERROR_RESET_STOPDMA                   23
+#define WHAL_ERROR_RESET_RECOVER                   24
+#define WHAL_ERROR_XMIT_COMPUTE                    25
+#define WHAL_ERROR_XMIT_NOQUEUE                    26
+#define WHAL_ERROR_XMIT_ACTIVEQUEUE                27
+#define WHAL_ERROR_XMIT_BADTYPE                    28
+#define WHAL_ERROR_XMIT_STOPDMA                    29
+#define WHAL_ERROR_INTERRUPT_BB_PANIC              30 
+#define WHAL_ERROR_RESET_TXIQCAL                   31 
+#define WHAL_ERROR_PAPRD_MAXGAIN_ABOVE_WINDOW      32 
+#define WHAL_DBGID_DEFINITION_END
+
+/* DC debug identifier definitions */
+#define DC_DBGID_DEFINITION_START
+#define DC_SCAN_CHAN_START                          1
+#define DC_SCAN_CHAN_FINISH                         2
+#define DC_BEACON_RECEIVE7                          3
+#define DC_SSID_PROBE_CB                            4
+#define DC_SEND_NEXT_SSID_PROBE                     5
+#define DC_START_SEARCH                             6
+#define DC_CANCEL_SEARCH_CB                         7
+#define DC_STOP_SEARCH                              8
+#define DC_END_SEARCH                               9
+#define DC_MIN_CHDWELL_TIMEOUT                     10
+#define DC_START_SEARCH_CANCELED                   11
+#define DC_SET_POWER_MODE                          12
+#define DC_INIT                                    13
+#define DC_SEARCH_OPPORTUNITY                      14
+#define DC_RECEIVED_ANY_BEACON                     15
+#define DC_RECEIVED_MY_BEACON                      16
+#define DC_PROFILE_IS_ADHOC_BUT_BSS_IS_INFRA       17
+#define DC_PS_ENABLED_BUT_ATHEROS_IE_ABSENT        18
+#define DC_BSS_ADHOC_CHANNEL_NOT_ALLOWED           19
+#define DC_SET_BEACON_UPDATE                       20
+#define DC_BEACON_UPDATE_COMPLETE                  21
+#define DC_END_SEARCH_BEACON_UPDATE_COMP_CB        22
+#define DC_BSSINFO_EVENT_DROPPED                   23
+#define DC_IEEEPS_ENABLED_BUT_ATIM_ABSENT          24 
+#define DC_DBGID_DEFINITION_END
+
+/* CO debug identifier definitions */
+#define CO_DBGID_DEFINITION_START
+#define CO_INIT                                     1
+#define CO_ACQUIRE_LOCK                             2
+#define CO_START_OP1                                3
+#define CO_START_OP2                                4
+#define CO_DRAIN_TX_COMPLETE_CB                     5
+#define CO_CHANGE_CHANNEL_CB                        6
+#define CO_RETURN_TO_HOME_CHANNEL                   7
+#define CO_FINISH_OP_TIMEOUT                        8
+#define CO_OP_END                                   9
+#define CO_CANCEL_OP                               10
+#define CO_CHANGE_CHANNEL                          11
+#define CO_RELEASE_LOCK                            12
+#define CO_CHANGE_STATE                            13
+#define CO_DBGID_DEFINITION_END
+
+/* RO debug identifier definitions */
+#define RO_DBGID_DEFINITION_START
+#define RO_REFRESH_ROAM_TABLE                       1
+#define RO_UPDATE_ROAM_CANDIDATE                    2
+#define RO_UPDATE_ROAM_CANDIDATE_CB                 3
+#define RO_UPDATE_ROAM_CANDIDATE_FINISH             4
+#define RO_REFRESH_ROAM_TABLE_DONE                  5
+#define RO_PERIODIC_SEARCH_CB                       6
+#define RO_PERIODIC_SEARCH_TIMEOUT                  7
+#define RO_INIT                                     8
+#define RO_BMISS_STATE1                             9
+#define RO_BMISS_STATE2                            10
+#define RO_SET_PERIODIC_SEARCH_ENABLE              11
+#define RO_SET_PERIODIC_SEARCH_DISABLE             12
+#define RO_ENABLE_SQ_THRESHOLD                     13
+#define RO_DISABLE_SQ_THRESHOLD                    14
+#define RO_ADD_BSS_TO_ROAM_TABLE                   15
+#define RO_SET_PERIODIC_SEARCH_MODE                16
+#define RO_CONFIGURE_SQ_THRESHOLD1                 17
+#define RO_CONFIGURE_SQ_THRESHOLD2                 18
+#define RO_CONFIGURE_SQ_PARAMS                     19
+#define RO_LOW_SIGNAL_QUALITY_EVENT                20
+#define RO_HIGH_SIGNAL_QUALITY_EVENT               21
+#define RO_REMOVE_BSS_FROM_ROAM_TABLE              22
+#define RO_UPDATE_CONNECTION_STATE_METRIC          23
+#define RO_LOWRSSI_SCAN_PARAMS                     24
+#define RO_LOWRSSI_SCAN_START                      25
+#define RO_LOWRSSI_SCAN_END                        26
+#define RO_LOWRSSI_SCAN_CANCEL                     27
+#define RO_LOWRSSI_ROAM_CANCEL                     28
+#define RO_REFRESH_ROAM_CANDIDATE                  29
+#define RO_DBGID_DEFINITION_END
+
+/* CM debug identifier definitions */
+#define CM_DBGID_DEFINITION_START
+#define CM_INITIATE_HANDOFF                         1
+#define CM_INITIATE_HANDOFF_CB                      2
+#define CM_CONNECT_EVENT                            3
+#define CM_DISCONNECT_EVENT                         4
+#define CM_INIT                                     5
+#define CM_HANDOFF_SOURCE                           6
+#define CM_SET_HANDOFF_TRIGGERS                     7
+#define CM_CONNECT_REQUEST                          8
+#define CM_CONNECT_REQUEST_CB                       9
+#define CM_CONTINUE_SCAN_CB                         10 
+#define CM_DBGID_DEFINITION_END
+
+
+/* mgmt debug identifier definitions */
+#define MGMT_DBGID_DEFINITION_START
+#define KEYMGMT_CONNECTION_INIT                     1
+#define KEYMGMT_CONNECTION_COMPLETE                 2
+#define KEYMGMT_CONNECTION_CLOSE                    3
+#define KEYMGMT_ADD_KEY                             4
+#define MLME_NEW_STATE                              5
+#define MLME_CONN_INIT                              6
+#define MLME_CONN_COMPLETE                          7
+#define MLME_CONN_CLOSE                             8 
+#define MLME_WLAN_OPMODE                            9 
+#define MLME_WLAN_SLOTTIME                          10 
+#define MGMT_DBGID_DEFINITION_END
+
+/* TMR debug identifier definitions */
+#define TMR_DBGID_DEFINITION_START
+#define TMR_HANG_DETECTED                           1
+#define TMR_WDT_TRIGGERED                           2
+#define TMR_WDT_RESET                               3
+#define TMR_HANDLER_ENTRY                           4
+#define TMR_HANDLER_EXIT                            5
+#define TMR_SAVED_START                             6
+#define TMR_SAVED_END                               7
+#define TMR_DBGID_DEFINITION_END
+
+/* BTCOEX debug identifier definitions */
+#define BTCOEX_DBGID_DEFINITION_START
+#define BTCOEX_STATUS_CMD                           1
+#define BTCOEX_PARAMS_CMD                           2
+#define BTCOEX_ANT_CONFIG                           3
+#define BTCOEX_COLOCATED_BT_DEVICE                  4
+#define BTCOEX_CLOSE_RANGE_SCO_ON                   5
+#define BTCOEX_CLOSE_RANGE_SCO_OFF                  6
+#define BTCOEX_CLOSE_RANGE_A2DP_ON                  7
+#define BTCOEX_CLOSE_RANGE_A2DP_OFF                 8
+#define BTCOEX_A2DP_PROTECT_ON                      9
+#define BTCOEX_A2DP_PROTECT_OFF                     10
+#define BTCOEX_SCO_PROTECT_ON                       11
+#define BTCOEX_SCO_PROTECT_OFF                      12
+#define BTCOEX_CLOSE_RANGE_DETECTOR_START           13
+#define BTCOEX_CLOSE_RANGE_DETECTOR_STOP            14
+#define BTCOEX_CLOSE_RANGE_TOGGLE                   15
+#define BTCOEX_CLOSE_RANGE_TOGGLE_RSSI_LRCNT        16
+#define BTCOEX_CLOSE_RANGE_RSSI_THRESH              17
+#define BTCOEX_CLOSE_RANGE_LOW_RATE_THRESH          18
+#define BTCOEX_PTA_PRI_INTR_HANDLER  		        19
+#define BTCOEX_PSPOLL_QUEUED						20
+#define BTCOEX_PSPOLL_COMPLETE						21
+#define BTCOEX_DBG_PM_AWAKE							22
+#define BTCOEX_DBG_PM_SLEEP							23
+#define BTCOEX_DBG_SCO_COEX_ON						24
+#define BTCOEX_SCO_DATARECEIVE						25
+#define BTCOEX_INTR_INIT							26
+#define BTCOEX_PTA_PRI_DIFF							27
+#define BTCOEX_TIM_NOTIFICATION						28
+#define BTCOEX_SCO_WAKEUP_ON_DATA					29
+#define BTCOEX_SCO_SLEEP							30
+#define BTCOEX_SET_WEIGHTS							31
+#define BTCOEX_SCO_DATARECEIVE_LATENCY_VAL			32
+#define BTCOEX_SCO_MEASURE_TIME_DIFF				33
+#define BTCOEX_SET_EOL_VAL							34
+#define BTCOEX_OPT_DETECT_HANDLER					35
+#define BTCOEX_SCO_TOGGLE_STATE						36
+#define BTCOEX_SCO_STOMP							37
+#define BTCOEX_NULL_COMP_CALLBACK					38
+#define BTCOEX_RX_INCOMING							39
+#define BTCOEX_RX_INCOMING_CTL						40
+#define BTCOEX_RX_INCOMING_MGMT						41
+#define BTCOEX_RX_INCOMING_DATA						42
+#define BTCOEX_RTS_RECEPTION						43
+#define BTCOEX_FRAME_PRI_LOW_RATE_THRES				44
+#define BTCOEX_PM_FAKE_SLEEP						45
+#define BTCOEX_ACL_COEX_STATUS						46
+#define BTCOEX_ACL_COEX_DETECTION					47
+#define BTCOEX_A2DP_COEX_STATUS						48
+#define BTCOEX_SCO_STATUS							49
+#define BTCOEX_WAKEUP_ON_DATA						50
+#define BTCOEX_DATARECEIVE							51
+#define BTCOEX_GET_MAX_AGGR_SIZE					53
+#define BTCOEX_MAX_AGGR_AVAIL_TIME					54
+#define BTCOEX_DBG_WBTIMER_INTR						55
+#define BTCOEX_DBG_SCO_SYNC                         57
+#define BTCOEX_UPLINK_QUEUED_RATE  					59
+#define BTCOEX_DBG_UPLINK_ENABLE_EOL				60
+#define BTCOEX_UPLINK_FRAME_DURATION				61
+#define BTCOEX_UPLINK_SET_EOL						62
+#define BTCOEX_DBG_EOL_EXPIRED						63
+#define BTCOEX_DBG_DATA_COMPLETE					64
+#define BTCOEX_UPLINK_QUEUED_TIMESTAMP				65
+#define BTCOEX_DBG_DATA_COMPLETE_TIME				66
+#define BTCOEX_DBG_A2DP_ROLE_IS_SLAVE               67
+#define BTCOEX_DBG_A2DP_ROLE_IS_MASTER              68
+#define BTCOEX_DBG_UPLINK_SEQ_NUM					69
+#define BTCOEX_UPLINK_AGGR_SEQ						70
+#define BTCOEX_DBG_TX_COMP_SEQ_NO					71
+#define BTCOEX_DBG_MAX_AGGR_PAUSE_STATE				72
+#define BTCOEX_DBG_ACL_TRAFFIC                      73
+#define BTCOEX_CURR_AGGR_PROP						74
+#define BTCOEX_DBG_SCO_GET_PER_TIME_DIFF 			75
+#define BTCOEX_PSPOLL_PROCESS						76
+#define BTCOEX_RETURN_FROM_MAC						77
+#define BTCOEX_FREED_REQUEUED_CNT					78
+#define BTCOEX_DBG_TOGGLE_LOW_RATES					79
+#define BTCOEX_MAC_GOES_TO_SLEEP    				80
+#define BTCOEX_DBG_A2DP_NO_SYNC                     81
+#define BTCOEX_RETURN_FROM_MAC_HOLD_Q_INFO			82
+#define BTCOEX_RETURN_FROM_MAC_AC					83
+#define BTCOEX_DBG_DTIM_RECV                        84
+#define BTCOEX_IS_PRE_UPDATE						86
+#define BTCOEX_ENQUEUED_BIT_MAP						87
+#define BTCOEX_TX_COMPLETE_FIRST_DESC_STATS			88
+#define BTCOEX_UPLINK_DESC							89
+#define BTCOEX_SCO_GET_PER_FIRST_FRM_TIMESTAMP		90
+#define BTCOEX_DBG_RECV_ACK							94
+#define BTCOEX_DBG_ADDBA_INDICATION                 95
+#define BTCOEX_TX_COMPLETE_EOL_FAILED				96
+#define BTCOEX_DBG_A2DP_USAGE_COMPLETE  			97
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_HANDLER		98
+#define BTCOEX_DBG_A2DP_SYNC_INTR                   99
+#define BTCOEX_DBG_A2DP_STOMP_FOR_BCN_RECEPTION	   100
+#define BTCOEX_FORM_AGGR_CURR_AGGR				   101
+#define BTCOEX_DBG_TOGGLE_A2DP_BURST_CNT           102
+#define BTCOEX_DBG_BT_TRAFFIC   				   103
+#define BTCOEX_DBG_STOMP_BT_TRAFFIC 			   104
+#define BTCOEX_RECV_NULL                           105
+#define BTCOEX_DBG_A2DP_MASTER_BT_END			   106
+#define BTCOEX_DBG_A2DP_BT_START				   107
+#define BTCOEX_DBG_A2DP_SLAVE_BT_END			   108
+#define BTCOEX_DBG_A2DP_STOMP_BT				   109
+#define BTCOEX_DBG_GO_TO_SLEEP					   110
+#define BTCOEX_DBG_A2DP_PKT						   111
+#define BTCOEX_DBG_A2DP_PSPOLL_DATA_RECV		   112
+#define BTCOEX_DBG_A2DP_NULL					   113
+#define BTCOEX_DBG_UPLINK_DATA					   114
+#define BTCOEX_DBG_A2DP_STOMP_LOW_PRIO_NULL		   115
+#define BTCOEX_DBG_ADD_BA_RESP_TIMEOUT			   116
+#define BTCOEX_DBG_TXQ_STATE					   117
+#define BTCOEX_DBG_ALLOW_SCAN					   118
+#define BTCOEX_DBG_SCAN_REQUEST					   119
+#define BTCOEX_A2DP_SLEEP						   127
+#define BTCOEX_DBG_DATA_ACTIV_TIMEOUT			   128
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_ON_MODE		   129
+#define BTCOEX_DBG_SWITCH_TO_PSPOLL_OFF_MODE 	   130
+#define BTCOEX_DATARECEIVE_AGGR					   131
+#define BTCOEX_DBG_DATA_RECV_SLEEPING_PENDING	   132
+#define BTCOEX_DBG_DATARESP_TIMEOUT				   133
+#define BTCOEX_BDG_BMISS						   134
+#define BTCOEX_DBG_DATA_RECV_WAKEUP_TIM			   135
+#define BTCOEX_DBG_SECOND_BMISS					   136
+#define BTCOEX_DBG_SET_WLAN_STATE				   138
+#define BTCOEX_BDG_FIRST_BMISS					   139
+#define BTCOEX_DBG_A2DP_CHAN_OP					   140
+#define BTCOEX_DBG_A2DP_INTR					   141
+#define BTCOEX_DBG_BT_INQUIRY					   142
+#define BTCOEX_DBG_BT_INQUIRY_DATA_FETCH		   143
+#define BTCOEX_DBG_POST_INQUIRY_FINISH			   144
+#define BTCOEX_DBG_SCO_OPT_MODE_TIMER_HANDLER	   145
+#define BTCOEX_DBG_NULL_FRAME_SLEEP				   146
+#define BTCOEX_DBG_NULL_FRAME_AWAKE				   147
+#define BTCOEX_DBG_SET_AGGR_SIZE				   152
+#define BTCOEX_DBG_TEAR_BA_TIMEOUT				   153
+#define BTCOEX_DBG_MGMT_FRAME_SEQ_NO			   154
+#define BTCOEX_DBG_SCO_STOMP_HIGH_PRI			   155
+#define BTCOEX_DBG_COLOCATED_BT_DEV				   156
+#define BTCOEX_DBG_FE_ANT_TYPE				       157
+#define BTCOEX_DBG_BT_INQUIRY_CMD				   158
+#define BTCOEX_DBG_SCO_CONFIG					   159
+#define BTCOEX_DBG_SCO_PSPOLL_CONFIG			   160
+#define BTCOEX_DBG_SCO_OPTMODE_CONFIG		       161
+#define BTCOEX_DBG_A2DP_CONFIG				       162
+#define BTCOEX_DBG_A2DP_PSPOLL_CONFIG		       163
+#define BTCOEX_DBG_A2DP_OPTMODE_CONFIG		       164
+#define BTCOEX_DBG_ACLCOEX_CONFIG			       165
+#define BTCOEX_DBG_ACLCOEX_PSPOLL_CONFIG		   166
+#define BTCOEX_DBG_ACLCOEX_OPTMODE_CONFIG	       167
+#define BTCOEX_DBG_DEBUG_CMD					   168
+#define BTCOEX_DBG_SET_BT_OPERATING_STATUS		   169
+#define BTCOEX_DBG_GET_CONFIG					   170
+#define BTCOEX_DBG_GET_STATS					   171
+#define BTCOEX_DBG_BT_OPERATING_STATUS			   172
+#define BTCOEX_DBG_PERFORM_RECONNECT               173
+#define BTCOEX_DBG_ACL_WLAN_MED                    175
+#define BTCOEX_DBG_ACL_BT_MED                      176
+#define BTCOEX_DBG_WLAN_CONNECT                    177
+#define BTCOEX_DBG_A2DP_DUAL_START                 178
+#define BTCOEX_DBG_PMAWAKE_NOTIFY                  179
+#define BTCOEX_DBG_BEACON_SCAN_ENABLE              180
+#define BTCOEX_DBG_BEACON_SCAN_DISABLE             181
+#define BTCOEX_DBG_RX_NOTIFY                       182
+#define BTCOEX_SCO_GET_PER_SECOND_FRM_TIMESTAMP    183
+#define BTCOEX_DBG_TXQ_DETAILS                     184
+#define BTCOEX_DBG_SCO_STOMP_LOW_PRI               185
+#define BTCOEX_DBG_A2DP_FORCE_SCAN                 186
+#define BTCOEX_DBG_DTIM_STOMP_COMP                 187
+#define BTCOEX_ACL_PRESENCE_TIMER                  188
+#define BTCOEX_DBG_QUEUE_SELF_CTS                  189
+#define BTCOEX_DBG_SELF_CTS_COMP                   190
+#define BTCOEX_DBG_APMODE_WAIT_FOR_CTS_COMP_FAILED 191
+#define BTCOEX_DBG_APMODE_A2DP_MED_TO_BT           192
+#define BTCOEX_DBG_APMODE_SET_BTSTATE              193
+#define BTCOEX_DBG_APMODE_A2DP_STATUS              194
+#define BTCOEX_DBG_APMODE_SCO_CTS_HANDLER          195
+#define BTCOEX_DBG_APMODE_SCO_STATUS               196
+#define BTCOEX_DBG_APMODE_TXQ_DRAINED              197
+#define BTCOEX_DBG_APMODE_SCO_ARM_TIMER            198
+#define BTCOEX_DBG_APMODE_SWITCH_MED_TO_WLAN       199
+#define BTCOEX_APMODE_BCN_TX_HANDLER               200
+#define BTCOEX_APMODE_BCN_TX                       201
+#define BTCOEX_APMODE_SCO_RTS_HANDLER              202
+#define BTCOEX_DBGID_DEFINITION_END
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DBGLOG_ID_H_ */
diff --git a/host/include/dfs_common.h b/host/include/dfs_common.h
new file mode 100644
index 0000000..cf1844f
--- /dev/null
+++ b/host/include/dfs_common.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (c) 2005-2006 Atheros Communications, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef _DFS_COMMON_H_
+#define _DFS_COMMON_H_
+
+enum {
+	DFS_UNINIT_DOMAIN	= 0,	/* Uninitialized dfs domain */
+	DFS_FCC_DOMAIN		= 1,	/* FCC3 dfs domain */
+	DFS_ETSI_DOMAIN		= 2,	/* ETSI dfs domain */
+	DFS_MKK4_DOMAIN		= 3	/* Japan dfs domain */
+};
+
+
+
+#define MAX_BIN5_DUR  131 /* 105 * 1.25*/
+
+PREPACK struct ath_dfs_capinfo {
+    A_UINT64 ext_chan_busy_ts;
+    A_UINT8 enable_ar;
+    A_UINT8 enable_radar;
+} POSTPACK;
+
+typedef struct ath_dfs_capinfo WMI_DFS_HOST_ATTACH_EVENT;
+
+PREPACK struct ath_dfs_info {
+    A_UINT32 dfs_domain;
+} POSTPACK;
+
+typedef struct ath_dfs_info WMI_DFS_HOST_INIT_EVENT;
+
+
+PREPACK struct dfs_event_info {
+    A_UINT64  full_ts;    /* 64-bit full timestamp from interrupt time */
+    A_UINT32  ts;         /* Original 15 bit recv timestamp */
+    A_UINT32  ext_chan_busy; /* Ext chan busy % */
+    A_UINT8   rssi;       /* rssi of radar event */
+    A_UINT8   dur;        /* duration of radar pulse */
+    A_UINT8   chanindex;  /* Channel of event */
+    A_UINT8   flags; 
+#define CH_TYPE_MASK 1
+#define PRIMARY_CH 0
+#define EXT_CH 1
+#define EVENT_TYPE_MASK 2
+#define AR_EVENT 0
+#define DFS_EVENT 2
+} POSTPACK;
+
+/* XXX: Replace 256 with WMI_SVC_MAX_BUFFERED_EVENT_SIZE */
+#define WMI_DFS_EVENT_MAX_BUFFER_SIZE ((256 - 1)/sizeof(struct dfs_event_info))
+/* Fill in event info */
+PREPACK struct dfs_ev_buffer {
+    A_UINT8 num_events;
+    struct dfs_event_info ev_info[WMI_DFS_EVENT_MAX_BUFFER_SIZE];
+} POSTPACK;
+
+typedef struct dfs_ev_buffer WMI_DFS_PHYERR_EVENT;
+
+
+ /* This should match the table from if_ath.c */
+enum {
+    ATH_DEBUG_DFS       = 0x00000100,   /* Minimal DFS debug */
+    ATH_DEBUG_DFS1      = 0x00000200,   /* Normal DFS debug */
+    ATH_DEBUG_DFS2      = 0x00000400,   /* Maximal DFS debug */
+    ATH_DEBUG_DFS3      = 0x00000800,   /* matched filterID display */
+};
+
+#define TRAFFIC_DETECTED 1
+
+#endif  /* _DFS_H_ */
diff --git a/host/include/dfs_host.h b/host/include/dfs_host.h
new file mode 100644
index 0000000..fc54ec5
--- /dev/null
+++ b/host/include/dfs_host.h
@@ -0,0 +1,387 @@
+/*
+ * Copyright (c) 2005-2006 Atheros Communications, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef _DFS_HOST_H_
+#define _DFS_HOST_H_
+
+#ifdef ATH_SUPPORT_DFS 
+
+#include "dfs_host_project.h"
+
+#define DFS_MIN(a,b) ((a)<(b)?(a):(b))
+#define DFS_MAX(a,b) ((a)>(b)?(a):(b))
+#define DFS_DIFF(a,b) (DFS_MAX(a,b) - DFS_MIN(a,b))
+/*
+ * Maximum number of radar events to be processed in a single iteration.
+ * Allows soft watchdog to run.
+ */
+#define MAX_EVENTS 100
+
+
+#define DFS_MARGIN_EQUAL(a, b, margin) ((DFS_DIFF(a,b)) <= margin)
+#define DFS_MAX_STAGGERED_BURSTS 3
+
+/* All filter thresholds in the radar filter tables are effective at a 50% channel loading */
+#define DFS_CHAN_LOADING_THRESH         50
+#define DFS_EXT_CHAN_LOADING_THRESH     30
+#define DFS_DEFAULT_PRI_MARGIN          10
+#define DFS_DEFAULT_FIXEDPATTERN_PRI_MARGIN       6
+
+
+#define	ATH_DFSQ_LOCK(_dfs)         spin_lock(&(_dfs)->dfs_radarqlock)
+#define	ATH_DFSQ_UNLOCK(_dfs)       spin_unlock(&(_dfs)->dfs_radarqlock)
+#define	ATH_DFSQ_LOCK_INIT(_dfs)    spin_lock_init(&(_dfs)->dfs_radarqlock)
+
+#define	ATH_ARQ_LOCK(_dfs)          spin_lock(&(_dfs)->dfs_arqlock)
+#define	ATH_ARQ_UNLOCK(_dfs)        spin_unlock(&(_dfs)->dfs_arqlock)
+#define	ATH_ARQ_LOCK_INIT(_dfs)     spin_lock_init(&(_dfs)->dfs_arqlock)
+
+#define	ATH_DFSEVENTQ_LOCK(_dfs)    spin_lock(&(_dfs)->dfs_eventqlock)
+#define	ATH_DFSEVENTQ_UNLOCK(_dfs)  spin_unlock(&(_dfs)->dfs_eventqlock)
+#define	ATH_DFSEVENTQ_LOCK_INIT(_dfs)   spin_lock_init(&(_dfs)->dfs_eventqlock)
+
+
+#define DFS_TSMASK              0xFFFFFFFF      /* Mask for time stamp from descriptor */
+#define DFS_TSSHIFT             32              /* Shift for time stamp from descriptor */
+#define	DFS_TSF_WRAP		0xFFFFFFFFFFFFFFFFULL	/* 64 bit TSF wrap value */
+#define	DFS_64BIT_TSFMASK	0x0000000000007FFFULL	/* TS mask for 64 bit value */
+
+
+#define	DFS_AR_RADAR_RSSI_THR		5	/* in dB */
+#define	DFS_AR_RADAR_RESET_INT		1	/* in secs */
+#define	DFS_AR_RADAR_MAX_HISTORY	500
+#define	DFS_AR_REGION_WIDTH		128
+#define	DFS_AR_RSSI_THRESH_STRONG_PKTS	17	/* in dB */
+#define	DFS_AR_RSSI_DOUBLE_THRESHOLD	15	/* in dB */
+#define	DFS_AR_MAX_NUM_ACK_REGIONS	9
+#define	DFS_AR_ACK_DETECT_PAR_THRESH	20
+#define	DFS_AR_PKT_COUNT_THRESH		20
+
+#define	DFS_MAX_DL_MASK			0x3F
+
+#define DFS_NOL_TIME			30*60*1000000	/* 30 minutes in usecs */
+
+#define DFS_WAIT_TIME			60*1000000	/* 1 minute in usecs */
+
+#define	DFS_DISABLE_TIME		3*60*1000000	/* 3 minutes in usecs */
+
+#define	DFS_MAX_B5_SIZE			128
+#define	DFS_MAX_B5_MASK			0x0000007F	/* 128 */
+
+#define	DFS_MAX_RADAR_OVERLAP		16		/* Max number of overlapping filters */
+
+#define	DFS_MAX_EVENTS			1024		/* Max number of dfs events which can be q'd */
+
+#define DFS_RADAR_EN		0x80000000	/* Radar detect is capable */
+#define DFS_AR_EN		0x40000000	/* AR detect is capable */
+#define	DFS_MAX_RSSI_VALUE	0x7fffffff	/* Max rssi value */
+
+#define DFS_BIN_MAX_PULSES              60      /* max num of pulses in a burst */
+#define DFS_BIN5_PRI_LOWER_LIMIT	990	/* us */
+#define DFS_BIN5_PRI_HIGHER_LIMIT	2010	/* us */
+#define DFS_BIN5_WIDTH_MARGIN	    	4	/* us */
+#define DFS_BIN5_RSSI_MARGIN	    	5	/* dBm */
+/*Following threshold is not specified but should be okay statistically*/
+#define DFS_BIN5_BRI_LOWER_LIMIT	300000  /* us */
+
+#define DFS_MAX_PULSE_BUFFER_SIZE 1024          /* Max number of pulses kept in buffer */
+#define DFS_MAX_PULSE_BUFFER_MASK 0x3ff
+        
+#define DFS_FAST_CLOCK_MULTIPLIER       (800/11)
+#define DFS_NO_FAST_CLOCK_MULTIPLIER    (80)
+
+typedef	spinlock_t dfsq_lock_t;
+
+struct  dfs_pulse {
+    A_UINT32    rp_numpulses;    /* Num of pulses in radar burst */
+    A_UINT32    rp_pulsedur;    /* Duration of each pulse in usecs */
+    A_UINT32    rp_pulsefreq;    /* Frequency of pulses in burst */
+    A_UINT32    rp_max_pulsefreq;    /* Frequency of pulses in burst */
+    A_UINT32       rp_patterntype;  /*fixed or variable pattern type*/
+    A_UINT32    rp_pulsevar;    /* Time variation of pulse duration for
+                                    matched filter (single-sided) in usecs */
+    A_UINT32    rp_threshold;    /* Thershold for MF output to indicate
+                                     radar match */
+    A_UINT32    rp_mindur;    /* Min pulse duration to be considered for
+                                  this pulse type */
+    A_UINT32    rp_maxdur;    /* Max pusle duration to be considered for
+                                  this pulse type */
+    A_UINT32    rp_rssithresh;    /* Minimum rssi to be considered a radar pulse */
+    A_UINT32    rp_meanoffset;    /* Offset for timing adjustment */
+    A_INT32        rp_rssimargin;  /* rssi threshold margin. In Turbo Mode HW reports rssi 3dBm 
+                                    * lower than in non TURBO mode.  This will be used to offset
+                                    * that diff.*/
+    A_UINT32    rp_pulseid;    /* Unique ID for identifying filter */
+
+};
+
+struct dfs_bin5pulse {
+    A_UINT32       b5_threshold;          /* Number of bin5 pulses to indicate detection */
+    A_UINT32       b5_mindur;             /* Min duration for a bin5 pulse */
+    A_UINT32       b5_maxdur;             /* Max duration for a bin5 pulse */
+    A_UINT32       b5_timewindow;         /* Window over which to count bin5 pulses */
+    A_UINT32       b5_rssithresh;         /* Min rssi to be considered a pulse */
+    A_UINT32       b5_rssimargin;         /* rssi threshold margin. In Turbo Mode HW reports rssi 3dB */
+};
+
+
+#define	DFS_MAX_DL_SIZE			64
+#include "athstartpack.h"
+PREPACK struct dfs_delayelem {
+    u_int32_t  de_time;  /* Current "filter" time for start of pulse in usecs*/
+    u_int8_t   de_dur;   /* Duration of pulse in usecs*/
+    u_int8_t   de_rssi;  /* rssi of pulse in dB*/
+} POSTPACK adf_os_packed;
+
+/* NB: The first element in the circular buffer is the oldest element */
+
+PREPACK struct dfs_delayline {
+	struct dfs_delayelem dl_elems[DFS_MAX_DL_SIZE];	/* Array of pulses in delay line */
+	u_int64_t	dl_last_ts;		/* Last timestamp the delay line was used (in usecs) */
+	u_int32_t	dl_firstelem;		/* Index of the first element */
+	u_int32_t	dl_lastelem;		/* Index of the last element */
+	u_int32_t	dl_numelems;		/* Number of elements in the delay line */
+} POSTPACK adf_os_packed;
+
+
+PREPACK struct dfs_filter {
+        struct dfs_delayline rf_dl;     /* Delay line of pulses for this filter */
+        u_int32_t       rf_numpulses;   /* Number of pulses in the filter */
+        u_int32_t       rf_minpri;      /* min pri to be considered for this filter*/
+        u_int32_t       rf_maxpri;      /* max pri to be considered for this filter*/
+        u_int32_t       rf_threshold;   /* match filter output threshold for radar detect */
+        u_int32_t       rf_filterlen;   /* Length (in usecs) of the filter */
+        u_int32_t       rf_patterntype; /* fixed or variable pattern type */
+        u_int32_t       rf_mindur;      /* Min duration for this radar filter */
+        u_int32_t       rf_maxdur;      /* Max duration for this radar filter */
+        u_int32_t       rf_pulseid;     /* Unique ID corresponding to the original filter ID */
+} POSTPACK adf_os_packed;
+
+
+                                   
+PREPACK struct dfs_pulseparams {
+    u_int64_t  p_time;  /* time for start of pulse in usecs*/
+    u_int8_t   p_dur;   /* Duration of pulse in usecs*/
+    u_int8_t   p_rssi;  /* Duration of pulse in usecs*/
+} POSTPACK adf_os_packed;
+
+PREPACK struct dfs_pulseline {
+    /* pl_elems - array of pulses in delay line */
+    struct dfs_pulseparams pl_elems[DFS_MAX_PULSE_BUFFER_SIZE];
+    u_int32_t  pl_firstelem;  /* Index of the first element */
+    u_int32_t  pl_lastelem;   /* Index of the last element */
+    u_int32_t  pl_numelems;   /* Number of elements in the delay line */
+} POSTPACK adf_os_packed;
+
+PREPACK struct dfs_event {
+	u_int64_t  re_full_ts;    /* 64-bit full timestamp from interrupt time */
+	u_int32_t  re_ts;         /* Original 15 bit recv timestamp */
+	u_int32_t  re_ext_chan_busy;  /* Ext channel busy % */
+	u_int8_t   re_rssi;       /* rssi of radar event */
+	u_int8_t   re_dur;        /* duration of radar pulse */
+	u_int8_t   re_chanindex;  /* Channel of event */
+	u_int8_t   re_chanindextype;  /* Primary channel or extension channel */
+	STAILQ_ENTRY(dfs_event)	re_list; /* List of radar events */
+} POSTPACK adf_os_packed;
+#include "athendpack.h"
+
+#define DFS_AR_MAX_ACK_RADAR_DUR	511
+#define DFS_AR_MAX_NUM_PEAKS		3
+#define DFS_AR_ARQ_SIZE			2048	/* 8K AR events for buffer size */
+#define DFS_AR_ARQ_SEQSIZE		2049	/* Sequence counter wrap for AR */
+
+#define DFS_RADARQ_SIZE		512		/* 1K radar events for buffer size */
+#define DFS_RADARQ_SEQSIZE	513		/* Sequence counter wrap for radar */
+#define DFS_NUM_RADAR_STATES	64		/* Number of radar channels we keep state for */
+#define DFS_MAX_NUM_RADAR_FILTERS 10		/* Max number radar filters for each type */ 
+#define DFS_MAX_RADAR_TYPES	32		/* Number of different radar types */
+
+struct dfs_ar_state {
+	u_int32_t	ar_prevwidth;
+	u_int32_t	ar_phyerrcount[DFS_AR_MAX_ACK_RADAR_DUR];
+	u_int32_t	ar_acksum;
+	u_int32_t	ar_packetthreshold;	/* Thresh to determine traffic load */
+	u_int32_t	ar_parthreshold;	/* Thresh to determine peak */
+	u_int32_t	ar_radarrssi;		/* Rssi threshold for AR event */
+	u_int16_t	ar_prevtimestamp;
+	u_int16_t	ar_peaklist[DFS_AR_MAX_NUM_PEAKS];
+};
+
+struct dfs_filtertype {
+    struct dfs_filter ft_filters[DFS_MAX_NUM_RADAR_FILTERS];
+    u_int32_t ft_filterdur;   /* Duration of pulse which specifies filter type*/
+    u_int32_t ft_numfilters;  /* Num filters of this type */
+    u_int64_t ft_last_ts;     /* Last timestamp this filtertype was used
+                               * (in usecs) */
+    u_int32_t ft_mindur;      /* min pulse duration to be considered
+                               * for this filter type */
+    u_int32_t ft_maxdur;	  /* max pulse duration to be considered
+                               * for this filter type */
+    u_int32_t ft_rssithresh;  /* min rssi to be considered
+                               * for this filter type */
+    u_int32_t ft_numpulses;   /* Num pulses in each filter of this type */
+    u_int32_t ft_patterntype; /* fixed or variable pattern type */
+    u_int32_t ft_minpri;      /* min pri to be considered for this type */
+    u_int32_t ft_rssimargin;  /* rssi threshold margin. In Turbo Mode HW
+                               * reports rssi 3dB lower than in non TURBO
+                               * mode. This will offset that diff. */
+};
+
+
+#define DFS_NOL_TIMEOUT_S  (30*60)    /* 30 minutes in seconds */
+#define DFS_NOL_TIMEOUT_MS (DFS_NOL_TIMEOUT_S * 1000)
+#define DFS_NOL_TIMEOUT_US (DFS_NOL_TIMEOUT_MS * 1000)
+
+#include "athstartpack.h"
+PREPACK struct dfs_info_host {
+    u_int32_t	rn_numradars;		/* Number of different types of radars  */
+    u_int64_t	rn_lastfull_ts;		/* Last 64 bit timstamp from recv interrupt */
+    u_int16_t	rn_last_ts;		/* last 15 bit ts from recv descriptor  */
+    u_int32_t   rn_last_unique_ts;      /* last unique 32 bit ts from recv descriptor  */
+    u_int64_t	rn_ts_prefix;		/* Prefix to prepend to 15 bit recv ts  */
+    u_int32_t	rn_numbin5radars;	/* Number of bin5 radar pulses to search for  */
+    u_int64_t       dfs_bin5_chirp_ts;  
+    u_int8_t        dfs_last_bin5_dur; 
+} POSTPACK adf_os_packed;
+#include "athendpack.h"
+
+struct dfs_bin5elem {
+	u_int64_t	be_ts;			/* Timestamp for the bin5 element */
+	u_int32_t	be_rssi;		/* Rssi for the bin5 element */
+	u_int32_t	be_dur;			/* Duration of bin5 element */
+};
+
+struct dfs_bin5radars {
+	struct dfs_bin5elem br_elems[DFS_MAX_B5_SIZE];	/* List of bin5 elems that fall
+							 * within the time window */
+	u_int32_t	br_firstelem;		/* Index of the first element */
+	u_int32_t	br_lastelem;		/* Index of the last element */
+	u_int32_t	br_numelems;		/* Number of elements in the delay line */
+	struct dfs_bin5pulse br_pulse;		/* Original info about bin5 pulse */
+};
+
+
+#define ATH_DFS_RESET_TIME_S 7
+#define ATH_DFS_WAIT (60 + ATH_DFS_RESET_TIME_S) /* 60 seconds */
+#define ATH_DFS_WAIT_MS ((ATH_DFS_WAIT) * 1000)	/*in MS*/
+
+#define ATH_DFS_WEATHER_CHANNEL_WAIT_MIN 10 /*10 minutes*/
+#define ATH_DFS_WEATHER_CHANNEL_WAIT_S (ATH_DFS_WEATHER_CHANNEL_WAIT_MIN * 60)
+#define ATH_DFS_WEATHER_CHANNEL_WAIT_MS ((ATH_DFS_WEATHER_CHANNEL_WAIT_S) * 1000)	/*in MS*/
+
+#define ATH_DFS_WAIT_POLL_PERIOD 2	/* 2 seconds */
+#define ATH_DFS_WAIT_POLL_PERIOD_MS ((ATH_DFS_WAIT_POLL_PERIOD) * 1000)	/*in MS*/
+#define	ATH_DFS_TEST_RETURN_PERIOD 2	/* 2 seconds */
+#define	ATH_DFS_TEST_RETURN_PERIOD_MS ((ATH_DFS_TEST_RETURN_PERIOD) * 1000)/* n MS*/
+
+#define IS_CHANNEL_WEATHER_RADAR(chan) ((chan->channel >= 5600) && (chan->channel <= 5650))
+
+#define DFS_DEBUG_TIMEOUT_S     30 // debug timeout is 30 seconds
+#define DFS_DEBUG_TIMEOUT_MS    (DFS_DEBUG_TIMEOUT_S * 1000)
+struct ath_dfs_host {
+    DEV_HDL dev_hdl;
+    u_int32_t dfs_debug_level;
+    OS_HDL os_hdl;
+    STAILQ_HEAD(,dfs_event)	dfs_eventq; /* Q of free dfs event objects */
+    dfsq_lock_t dfs_eventqlock;         /* Lock for free dfs event list */
+    STAILQ_HEAD(,dfs_event)	dfs_radarq; /* Q of radar events */
+    dfsq_lock_t dfs_radarqlock;         /* Lock for dfs q */
+    STAILQ_HEAD(,dfs_event) dfs_arq;    /* Q of AR events */
+    dfsq_lock_t dfs_arqlock;            /* Lock for AR q */
+
+    struct dfs_pulseline *pulses;       /* pulse history */
+    struct dfs_event     *events;       /* Events structure */
+    /* dfs_radarf - One filter for each radar pulse type */
+    struct dfs_filtertype *dfs_radarf[DFS_MAX_RADAR_TYPES];
+
+    int8_t **dfs_radartable;            /* map of radar durs to filter types */
+    struct dfs_bin5radars *dfs_b5radars;/* array of bin5 radar events */
+    struct dfs_ar_state dfs_ar_state; /* AR state */
+    struct dfs_info_host dfs_rinfo;          /* State vars for radar processing */
+    u_int8_t   dfs_bangradar;
+    u_int32_t  dur_multiplier;
+    A_TIMER dfs_radar_task_timer;
+};
+
+
+#define	HAL_CAP_RADAR	0
+#define	HAL_CAP_AR	1
+#define HAL_CAP_STRONG_DIV 2
+
+
+/* Attach, detach, handle ioctl prototypes */
+struct ath_dfs_host *dfs_attach_host(DEV_HDL dev, OS_HDL os, ATH_DFS_CAPINFO *cap_info);
+void        dfs_detach_host(struct ath_dfs_host *sc);
+
+
+/* PHY error and radar event handling */
+void        dfs_process_phyerr_host(struct ath_dfs_host *dfs, WMI_DFS_PHYERR_EVENT *ev);
+int         dfs_process_radarevent_host(struct ath_dfs_host *dfs, int16_t *chan_index, u_int8_t *bangradar);
+
+
+/* FCC Bin5 detection prototypes */
+int         dfs_bin5_addpulse(struct ath_dfs_host *sc, struct dfs_bin5radars *br,
+                               struct dfs_event *re, u_int64_t thists);
+int         dfs_bin5_check(struct ath_dfs_host *dfs);
+u_int8_t    dfs_retain_bin5_burst_pattern(struct ath_dfs_host *dfs, u_int32_t diff_ts, u_int8_t old_dur);
+
+/* Debug prototypes */
+void         dfs_print_delayline(struct ath_dfs_host *dfs, struct dfs_delayline *dl);
+void         dfs_print_filters(struct ath_dfs_host *dfs);
+void dfs_print_filter(struct ath_dfs_host *dfs, struct dfs_filter *rf);
+
+/* Misc prototypes */
+u_int32_t  dfs_round(int32_t val);
+
+/* Reset and init data structures */
+
+int           dfs_init_radar_filters_host(struct ath_dfs_host *dfs,  struct ath_dfs_info *dfs_info);
+void          dfs_reset_alldelaylines(struct ath_dfs_host *dfs);
+void          dfs_reset_delayline(struct dfs_delayline *dl);
+void          dfs_reset_filter_delaylines(struct dfs_filtertype *dft);
+void          dfs_reset_radarq(struct ath_dfs_host *dfs);
+
+/* Detection algorithm prototypes */
+void          dfs_add_pulse(struct ath_dfs_host *dfs, struct dfs_filter *rf,
+                           struct dfs_event *re, u_int32_t deltaT);
+
+int           dfs_bin_fixedpattern_check(struct ath_dfs_host *dfs, struct dfs_filter *rf, u_int32_t dur, int ext_chan_flag, u_int32_t ext_chan_busy);
+int           dfs_bin_check(struct ath_dfs_host *dfs, struct dfs_filter *rf,
+                            u_int32_t deltaT, u_int32_t dur, int ext_chan_flag, u_int32_t ext_chan_busy);
+
+
+int     dfs_bin_pri_check(struct ath_dfs_host *dfs, struct dfs_filter *rf,
+                             struct dfs_delayline *dl, u_int32_t score,
+                             u_int32_t refpri, u_int32_t refdur, int ext_chan_flag, u_int32_t ext_chan_busy);
+int    dfs_staggered_check(struct ath_dfs_host *dfs, struct dfs_filter *rf,
+                             u_int32_t deltaT, u_int32_t width, u_int32_t ext_chan_busy);
+
+/* AR related prototypes */
+u_int32_t        dfs_process_ar_event(struct ath_dfs_host *dfs);
+void        dfs_reset_ar(struct ath_dfs_host *dfs);
+void        dfs_reset_arq(struct ath_dfs_host *dfs);
+
+void dfs_bangradar_enable(struct ath_dfs_host *dfs, u_int8_t enable);
+void dfs_set_dur_multiplier(struct ath_dfs_host *dfs, u_int32_t dur_multiplier);
+void dfs_set_debug_level_host(struct ath_dfs_host *dfs, u_int32_t level);
+
+/* False detection reduction */
+int dfs_get_pri_margin(int is_extchan_detect, int is_fixed_pattern, u_int64_t lastfull_ts, u_int32_t ext_chan_busy);
+int dfs_get_filter_threshold(struct dfs_filter *rf, int is_extchan_detect, u_int64_t lastfull_ts, u_int32_t ext_chan_busy);
+
+#endif /* ATH_SUPPORT_DFS */
+#endif  /* _DFS_H_ */
diff --git a/host/include/dfs_host_project.h b/host/include/dfs_host_project.h
new file mode 100644
index 0000000..9f1ce2f
--- /dev/null
+++ b/host/include/dfs_host_project.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2005-2006 Atheros Communications, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef _DFS_PROJECT_H_
+#define _DFS_PROJECT_H_
+
+#ifdef ATH_SUPPORT_DFS
+
+#include <a_config.h>
+#include <athdefs.h>
+#include <a_types.h>
+#include <a_osapi.h>
+#include <a_debug.h>
+#include <queue.h> /* XXX: This is in target dir */
+#include "dfs_common.h"
+#include "ar6000_drv.h"
+#include "project.h"
+
+#define ATH_DFS_CAPINFO WMI_DFS_HOST_ATTACH_EVENT
+
+#define OS_HDL void *
+#define DEV_HDL void *
+
+#define DFS_MALLOC(os_hdl, nbytes) A_MALLOC(nbytes)
+
+#define DFS_DPRINTK(pDfs, _m, _fmt, ...) do {             \
+    if ((_m) <= pDfs->dfs_debug_level) {               \
+        A_PRINTF(_fmt, __VA_ARGS__);  \
+    }        \
+} while (0)
+
+
+void dfs_radar_task (unsigned long arg);
+
+#define adf_os_packed
+
+typedef enum {
+    AH_FALSE = 0,       /* NB: lots of code assumes false is zero */
+    AH_TRUE  = 1,
+} HAL_BOOL;
+#endif /* ATH_SUPPORT_DFS */
+
+#endif  /* _DFS_PROJECT_H_ */
diff --git a/host/include/discovery.h b/host/include/discovery.h
new file mode 100644
index 0000000..12e3a58
--- /dev/null
+++ b/host/include/discovery.h
@@ -0,0 +1,77 @@
+//------------------------------------------------------------------------------
+// <copyright file="discovery.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _DISCOVERY_H_
+#define _DISCOVERY_H_
+
+/*
+ * DC_SCAN_PRIORITY is an 8-bit bitmap of the scan priority of a channel
+ */
+typedef enum {
+    DEFAULT_SCPRI = 0x01,
+    POPULAR_SCPRI = 0x02,
+    SSIDS_SCPRI   = 0x04,
+    PROF_SCPRI    = 0x08,
+    DISABLE_SCPRI = 0x10,
+} DC_SCAN_PRIORITY;
+
+/* The following search type construct can be used to manipulate the behavior of the search module based on different bits set */
+typedef enum {
+    SCAN_RESET                     = 0,
+    SCAN_ALL                       = (DEFAULT_SCPRI | POPULAR_SCPRI |  \
+                                      SSIDS_SCPRI | PROF_SCPRI),
+
+    SCAN_POPULAR                   = (POPULAR_SCPRI | SSIDS_SCPRI | PROF_SCPRI),
+    SCAN_SSIDS                     = (SSIDS_SCPRI | PROF_SCPRI),
+    SCAN_PROF_MASK                 = (PROF_SCPRI),
+    SCAN_MULTI_CHANNEL             = 0x000100,
+    SCAN_DETERMINISTIC             = 0x000200,
+    SCAN_PROFILE_MATCH_TERMINATED  = 0x000400,
+    SCAN_HOME_CHANNEL_SKIP         = 0x000800,
+    SCAN_CHANNEL_LIST_CONTINUE     = 0x001000,
+    SCAN_CURRENT_SSID_SKIP         = 0x002000,
+    SCAN_ACTIVE_PROBE_DISABLE      = 0x004000,
+    SCAN_CHANNEL_HINT_ONLY         = 0x008000,
+    SCAN_ACTIVE_CHANNELS_ONLY      = 0x010000,
+    SCAN_UNUSED1                   = 0x020000, /* unused */
+    SCAN_PERIODIC                  = 0x040000,
+    SCAN_FIXED_DURATION            = 0x080000,
+    SCAN_AP_ASSISTED               = 0x100000,
+    SCAN_DONOT_RETURN_TO_HOME_AFTERSCAN      = 0x200000,
+} DC_SCAN_TYPE;
+
+typedef enum {
+    BSS_REPORTING_DEFAULT = 0x0,
+    EXCLUDE_NON_SCAN_RESULTS = 0x1, /* Exclude results outside of scan */
+} DC_BSS_REPORTING_POLICY;
+
+typedef enum {
+    DC_IGNORE_WPAx_GROUP_CIPHER = 0x01,
+    DC_PROFILE_MATCH_DONE = 0x02,
+    DC_IGNORE_AAC_BEACON = 0x04, 
+    DC_CSA_FOLLOW_BSS = 0x08,
+} DC_PROFILE_FILTER;
+
+#define DEFAULT_DC_PROFILE_FILTER   (DC_CSA_FOLLOW_BSS)
+
+#endif  /* _DISCOVERY_H_ */
diff --git a/host/include/dl_list.h b/host/include/dl_list.h
new file mode 100644
index 0000000..cc0e544
--- /dev/null
+++ b/host/include/dl_list.h
@@ -0,0 +1,154 @@
+//------------------------------------------------------------------------------
+// <copyright file="dl_list.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Double-link list definitions (adapted from Atheros SDIO stack)
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __DL_LIST_H___
+#define __DL_LIST_H___
+
+#include "a_osapi.h"
+
+#define A_CONTAINING_STRUCT(address, struct_type, field_name)\
+            ((struct_type *)((unsigned long)(address) - (unsigned long)(&((struct_type *)0)->field_name)))
+
+/* list functions */
+/* pointers for the list */
+typedef struct _DL_LIST {
+    struct _DL_LIST *pPrev;
+    struct _DL_LIST *pNext;
+}DL_LIST, *PDL_LIST;
+/*
+ * DL_LIST_INIT , initialize doubly linked list
+*/
+#define DL_LIST_INIT(pList)\
+    {(pList)->pPrev = pList; (pList)->pNext = pList;}
+
+/* faster macro to init list and add a single item */    
+#define DL_LIST_INIT_AND_ADD(pList,pItem) \
+{   (pList)->pPrev = (pItem); \
+    (pList)->pNext = (pItem); \
+    (pItem)->pNext = (pList); \
+    (pItem)->pPrev = (pList); \
+}
+    
+#define DL_LIST_IS_EMPTY(pList) (((pList)->pPrev == (pList)) && ((pList)->pNext == (pList)))
+#define DL_LIST_GET_ITEM_AT_HEAD(pList) (pList)->pNext
+#define DL_LIST_GET_ITEM_AT_TAIL(pList) (pList)->pPrev
+/*
+ * ITERATE_OVER_LIST pStart is the list, pTemp is a temp list member
+ * NOT: do not use this function if the items in the list are deleted inside the
+ * iteration loop
+*/
+#define ITERATE_OVER_LIST(pStart, pTemp) \
+    for((pTemp) =(pStart)->pNext; pTemp != (pStart); (pTemp) = (pTemp)->pNext)
+
+
+/* safe iterate macro that allows the item to be removed from the list
+ * the iteration continues to the next item in the list
+ */
+#define ITERATE_OVER_LIST_ALLOW_REMOVE(pStart,pItem,st,offset)  \
+{                                                       \
+    PDL_LIST  pTemp;                                     \
+    pTemp = (pStart)->pNext;                            \
+    while (pTemp != (pStart)) {                         \
+        (pItem) = A_CONTAINING_STRUCT(pTemp,st,offset);   \
+         pTemp = pTemp->pNext;                          \
+
+#define ITERATE_END }}
+
+/*
+ * DL_ListInsertTail - insert pAdd to the end of the list
+*/
+static INLINE PDL_LIST DL_ListInsertTail(PDL_LIST pList, PDL_LIST pAdd) {
+        /* insert at tail */
+    pAdd->pPrev = pList->pPrev;
+    pAdd->pNext = pList;
+    pList->pPrev->pNext = pAdd;
+    pList->pPrev = pAdd;
+    return pAdd;
+}
+
+/*
+ * DL_ListInsertHead - insert pAdd into the head of the list
+*/
+static INLINE PDL_LIST DL_ListInsertHead(PDL_LIST pList, PDL_LIST pAdd) {
+        /* insert at head */
+    pAdd->pPrev = pList;
+    pAdd->pNext = pList->pNext;
+    pList->pNext->pPrev = pAdd;
+    pList->pNext = pAdd;
+    return pAdd;
+}
+
+#define DL_ListAdd(pList,pItem) DL_ListInsertHead((pList),(pItem))
+/*
+ * DL_ListRemove - remove pDel from list
+*/
+static INLINE PDL_LIST DL_ListRemove(PDL_LIST pDel) {
+    pDel->pNext->pPrev = pDel->pPrev;
+    pDel->pPrev->pNext = pDel->pNext;
+        /* point back to itself just to be safe, incase remove is called again */
+    pDel->pNext = pDel;
+    pDel->pPrev = pDel;
+    return pDel;
+}
+
+/*
+ * DL_ListRemoveItemFromHead - get a list item from the head
+*/
+static INLINE PDL_LIST DL_ListRemoveItemFromHead(PDL_LIST pList) {
+    PDL_LIST pItem = NULL;
+    if (pList->pNext != pList) {
+        pItem = pList->pNext;
+            /* remove the first item from head */
+        DL_ListRemove(pItem);
+    }
+    return pItem;
+}
+
+static INLINE PDL_LIST DL_ListRemoveItemFromTail(PDL_LIST pList) {
+    PDL_LIST pItem = NULL;
+    if (pList->pPrev != pList) {
+        pItem = pList->pPrev;
+            /* remove the item from tail */
+        DL_ListRemove(pItem);
+    }
+    return pItem;
+}
+
+/* transfer src list items to the tail of the destination list */
+static INLINE void DL_ListTransferItemsToTail(PDL_LIST pDest, PDL_LIST pSrc) {
+        /* only concatenate if src is not empty */
+    if (!DL_LIST_IS_EMPTY(pSrc)) {
+            /* cut out circular list in src and re-attach to end of dest */
+        pSrc->pPrev->pNext = pDest;
+        pSrc->pNext->pPrev = pDest->pPrev;
+        pDest->pPrev->pNext = pSrc->pNext; 
+        pDest->pPrev = pSrc->pPrev;
+            /* terminate src list, it is now empty */      
+        pSrc->pPrev = pSrc;
+        pSrc->pNext = pSrc;
+    }
+}
+
+#endif /* __DL_LIST_H___ */
+
diff --git a/host/include/dset_api.h b/host/include/dset_api.h
new file mode 100644
index 0000000..0cc121f
--- /dev/null
+++ b/host/include/dset_api.h
@@ -0,0 +1,65 @@
+//------------------------------------------------------------------------------
+// <copyright file="dset_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Host-side DataSet API.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _DSET_API_H_
+#define _DSET_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/*
+ * Host-side DataSet support is optional, and is not
+ * currently required for correct operation.  To disable
+ * Host-side DataSet support, set this to 0.
+ */
+#ifndef CONFIG_HOST_DSET_SUPPORT
+#define CONFIG_HOST_DSET_SUPPORT 1
+#endif
+
+/* Called to send a DataSet Open Reply back to the Target. */
+A_STATUS wmi_dset_open_reply(struct wmi_t *wmip,
+                             A_UINT32 status,
+                             A_UINT32 access_cookie,
+                             A_UINT32 size,
+                             A_UINT32 version,
+                             A_UINT32 targ_handle,
+                             A_UINT32 targ_reply_fn,
+                             A_UINT32 targ_reply_arg);
+
+/* Called to send a DataSet Data Reply back to the Target. */
+A_STATUS wmi_dset_data_reply(struct wmi_t *wmip,
+                             A_UINT32 status,
+                             A_UINT8 *host_buf,
+                             A_UINT32 length,
+                             A_UINT32 targ_buf,
+                             A_UINT32 targ_reply_fn,
+                             A_UINT32 targ_reply_arg);
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+
+#endif /* _DSET_API_H_ */
diff --git a/host/include/dset_internal.h b/host/include/dset_internal.h
new file mode 100644
index 0000000..2330a57
--- /dev/null
+++ b/host/include/dset_internal.h
@@ -0,0 +1,63 @@
+//------------------------------------------------------------------------------
+// <copyright file="dset_internal.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+
+#ifndef __DSET_INTERNAL_H__
+#define __DSET_INTERNAL_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+/*
+ * Internal dset definitions, common for DataSet layer.
+ */
+
+#define DSET_TYPE_STANDARD      0
+#define DSET_TYPE_BPATCHED      1
+#define DSET_TYPE_COMPRESSED    2
+
+/* Dataset descriptor */
+
+typedef PREPACK struct dset_descriptor_s {
+  struct dset_descriptor_s  *next;         /* List link. NULL only at the last
+                                              descriptor */
+  A_UINT16                   id;           /* Dset ID */
+  A_UINT16                   size;         /* Dset size. */
+  void                      *DataPtr;      /* Pointer to raw data for standard
+                                              DataSet or pointer to original
+                                              dset_descriptor for patched
+                                              DataSet */
+  A_UINT32                   data_type;    /* DSET_TYPE_*, above */
+
+  void                      *AuxPtr;       /* Additional data that might
+                                              needed for data_type. For
+                                              example, pointer to patch
+                                              Dataset descriptor for BPatch. */
+} POSTPACK dset_descriptor_t;
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __DSET_INTERNAL_H__ */
diff --git a/host/include/dsetid.h b/host/include/dsetid.h
new file mode 100644
index 0000000..f17fc67
--- /dev/null
+++ b/host/include/dsetid.h
@@ -0,0 +1,134 @@
+//------------------------------------------------------------------------------
+// <copyright file="dsetid.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+
+#ifndef __DSETID_H__
+#define __DSETID_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+/* Well-known DataSet IDs */
+#define DSETID_UNUSED                     0x00000000
+#define DSETID_BOARD_DATA                 0x00000001 /* Cal and board data */
+#define DSETID_REGDB                      0x00000002 /* Regulatory Database */
+#define DSETID_POWER_CONTROL              0x00000003 /* TX Pwr Lim & Ant Gain */
+#define DSETID_USER_CONFIG                0x00000004 /* User Configuration */
+
+#define DSETID_ANALOG_CONTROL_DATA_START  0x00000005
+#define DSETID_ANALOG_CONTROL_DATA_END    0x00000025
+/*
+ * Get DSETID for various reference clock speeds.
+ * For each speed there are three DataSets that correspond
+ * to the three columns of bank6 data (addr, 11a, 11b/g).
+ * This macro returns the dsetid of the first of those
+ * three DataSets.
+ */
+#define ANALOG_CONTROL_DATA_DSETID(refclk) \
+        (DSETID_ANALOG_CONTROL_DATA_START + 3*refclk)
+
+/*
+ * There are TWO STARTUP_PATCH DataSets.
+ * DSETID_STARTUP_PATCH is historical, and was applied before BMI on
+ * earlier systems.  On AR6002, it is applied after BMI, just like
+ * DSETID_STARTUP_PATCH2.
+ */
+#define DSETID_STARTUP_PATCH              0x00000026
+#define DSETID_GPIO_CONFIG_PATCH          0x00000027
+#define DSETID_WLANREGS                   0x00000028 /* override wlan regs */
+#define DSETID_STARTUP_PATCH2             0x00000029
+
+#define DSETID_WOW_CONFIG                 0x00000090 /* WoW Configuration */
+
+/* Add WHAL_INI_DATA_ID to DSETID_INI_DATA for a specific WHAL INI table. */
+#define DSETID_INI_DATA                   0x00000100
+/* Reserved for WHAL INI Tables: 0x100..0x11f */
+#define DSETID_INI_DATA_END               0x0000011f
+
+#define DSETID_VENDOR_START               0x00010000 /* Vendor-defined DataSets */
+
+#define DSETID_INDEX_END                  0xfffffffe /* Reserved to indicate the
+                                                        end of a memory-based
+                                                        DataSet Index */
+#define DSETID_INDEX_FREE                 0xffffffff /* An unused index entry */
+
+/* 
+ * PATCH DataSet format:
+ * A list of patches, terminated by a patch with
+ * address=PATCH_END.
+ *
+ * This allows for patches to be stored in flash.
+ */
+PREPACK struct patch_s {
+    A_UINT32 *address;
+    A_UINT32  data;
+} POSTPACK ;
+
+/*
+ * Skip some patches.  Can be used to erase a single patch in a
+ * patch DataSet without having to re-write the DataSet.  May
+ * also be used to embed information for use by subsequent
+ * patch code.  The "data" in a PATCH_SKIP tells how many
+ * bytes of length "patch_s" to skip.
+ */
+#define PATCH_SKIP      ((A_UINT32 *)0x00000000)
+
+/*
+ * Execute code at the address specified by "data".
+ * The address of the patch structure is passed as
+ * the one parameter.
+ */
+#define PATCH_CODE_ABS  ((A_UINT32 *)0x00000001)
+
+/*
+ * Same as PATCH_CODE_ABS, but treat "data" as an
+ * offset from the start of the patch word.
+ */
+#define PATCH_CODE_REL  ((A_UINT32 *)0x00000002)
+
+/* Mark the end of this patch DataSet. */
+#define PATCH_END       ((A_UINT32 *)0xffffffff)
+
+/*
+ * A DataSet which contains a Binary Patch to some other DataSet
+ * uses the original dsetid with the DSETID_BPATCH_FLAG bit set.
+ * Such a BPatch DataSet consists of BPatch metadata followed by
+ * the bdiff bytes.  BPatch metadata consists of a single 32-bit
+ * word that contains the size of the BPatched final image.
+ *
+ * To create a suitable bdiff DataSet, use bdiff in host/tools/bdiff
+ * to create "diffs":
+ *  bdiff -q -O -nooldmd5 -nonewmd5 -d ORIGfile NEWfile diffs
+ * Then add BPatch metadata to the start of "diffs".
+ *
+ * NB: There are some implementation-induced restrictions
+ * on which DataSets can be BPatched.
+ */
+#define DSETID_BPATCH_FLAG                0x80000000
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __DSETID_H__ */
diff --git a/host/include/epping_test.h b/host/include/epping_test.h
new file mode 100644
index 0000000..62f609f
--- /dev/null
+++ b/host/include/epping_test.h
@@ -0,0 +1,120 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//
+
+/* This file contains shared definitions for the host/target endpoint ping test */
+
+#ifndef EPPING_TEST_H_
+#define EPPING_TEST_H_
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+    /* alignment to 4-bytes */
+#define EPPING_ALIGNMENT_PAD  (((sizeof(HTC_FRAME_HDR) + 3) & (~0x3)) - sizeof(HTC_FRAME_HDR))
+
+#ifndef A_OFFSETOF
+#define A_OFFSETOF(type,field) (int)(&(((type *)NULL)->field))
+#endif
+
+#define EPPING_RSVD_FILL                  0xCC
+
+#define HCI_RSVD_EXPECTED_PKT_TYPE_RECV_OFFSET  7 
+  
+typedef PREPACK struct {    
+    A_UINT8     _HCIRsvd[8];           /* reserved for HCI packet header (GMBOX) testing */
+    A_UINT8     StreamEcho_h;          /* stream no. to echo this packet on (filled by host) */
+    A_UINT8     StreamEchoSent_t;      /* stream no. packet was echoed to (filled by target)
+                                          When echoed: StreamEchoSent_t == StreamEcho_h */
+    A_UINT8     StreamRecv_t;          /* stream no. that target received this packet on (filled by target) */
+    A_UINT8     StreamNo_h;            /* stream number to send on (filled by host) */   
+    A_UINT8     Magic_h[4];            /* magic number to filter for this packet on the host*/
+    A_UINT8     _rsvd[6];              /* reserved fields that must be set to a "reserved" value
+                                          since this packet maps to a 14-byte ethernet frame we want 
+                                          to make sure ethertype field is set to something unknown */
+                                          
+    A_UINT8     _pad[2];               /* padding for alignment */                      
+    A_UINT8     TimeStamp[8];          /* timestamp of packet (host or target) */
+    A_UINT32    HostContext_h;         /* 4 byte host context, target echos this back */
+    A_UINT32    SeqNo;                 /* sequence number (set by host or target) */   
+    A_UINT16    Cmd_h;                 /* ping command (filled by host) */  
+    A_UINT16    CmdFlags_h;            /* optional flags */
+    A_UINT8     CmdBuffer_h[8];        /* buffer for command (host -> target) */
+    A_UINT8     CmdBuffer_t[8];        /* buffer for command (target -> host) */  
+    A_UINT16    DataLength;            /* length of data */
+    A_UINT16    DataCRC;               /* 16 bit CRC of data */
+    A_UINT16    HeaderCRC;             /* header CRC (fields : StreamNo_h to end, minus HeaderCRC) */                       
+} POSTPACK EPPING_HEADER;
+
+#define EPPING_PING_MAGIC_0               0xAA
+#define EPPING_PING_MAGIC_1               0x55
+#define EPPING_PING_MAGIC_2               0xCE
+#define EPPING_PING_MAGIC_3               0xEC
+
+
+
+#define IS_EPPING_PACKET(pPkt)   (((pPkt)->Magic_h[0] == EPPING_PING_MAGIC_0) && \
+                                  ((pPkt)->Magic_h[1] == EPPING_PING_MAGIC_1) && \
+                                  ((pPkt)->Magic_h[2] == EPPING_PING_MAGIC_2) && \
+                                  ((pPkt)->Magic_h[3] == EPPING_PING_MAGIC_3))
+
+#define SET_EPPING_PACKET_MAGIC(pPkt) { (pPkt)->Magic_h[0] = EPPING_PING_MAGIC_0; \
+                                        (pPkt)->Magic_h[1] = EPPING_PING_MAGIC_1; \
+                                        (pPkt)->Magic_h[2] = EPPING_PING_MAGIC_2; \
+                                        (pPkt)->Magic_h[3] = EPPING_PING_MAGIC_3;}
+                                                                            
+#define CMD_FLAGS_DATA_CRC            (1 << 0)  /* DataCRC field is valid */
+#define CMD_FLAGS_DELAY_ECHO          (1 << 1)  /* delay the echo of the packet */
+#define CMD_FLAGS_NO_DROP             (1 << 2)  /* do not drop at HTC layer no matter what the stream is */
+
+#define IS_EPING_PACKET_NO_DROP(pPkt)  ((pPkt)->CmdFlags_h & CMD_FLAGS_NO_DROP)
+
+#define EPPING_CMD_ECHO_PACKET          1   /* echo packet test */
+#define EPPING_CMD_RESET_RECV_CNT       2   /* reset recv count */
+#define EPPING_CMD_CAPTURE_RECV_CNT     3   /* fetch recv count, 4-byte count returned in CmdBuffer_t */
+#define EPPING_CMD_NO_ECHO              4   /* non-echo packet test (tx-only) */
+#define EPPING_CMD_CONT_RX_START        5   /* continous RX packets, parameters are in CmdBuffer_h */
+#define EPPING_CMD_CONT_RX_STOP         6   /* stop continuous RX packet transmission */
+
+    /* test command parameters may be no more than 8 bytes */
+typedef PREPACK struct {    
+    A_UINT16  BurstCnt;       /* number of packets to burst together (for HTC 2.1 testing) */
+    A_UINT16  PacketLength;   /* length of packet to generate including header */      
+    A_UINT16  Flags;          /* flags */
+
+#define EPPING_CONT_RX_DATA_CRC     (1 << 0)  /* Add CRC to all data */
+#define EPPING_CONT_RX_RANDOM_DATA  (1 << 1)  /* randomize the data pattern */
+#define EPPING_CONT_RX_RANDOM_LEN   (1 << 2)  /* randomize the packet lengths */          
+} POSTPACK EPPING_CONT_RX_PARAMS;
+
+#define EPPING_HDR_CRC_OFFSET    A_OFFSETOF(EPPING_HEADER,StreamNo_h)
+#define EPPING_HDR_BYTES_CRC     (sizeof(EPPING_HEADER) - EPPING_HDR_CRC_OFFSET - (sizeof(A_UINT16)))
+
+#define HCI_TRANSPORT_STREAM_NUM  16  /* this number is higher than the define WMM AC classes so we
+                                         can use this to distinguish packets */
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+    
+    
+#endif /*EPPING_TEST_H_*/
diff --git a/host/include/gmboxif.h b/host/include/gmboxif.h
new file mode 100644
index 0000000..8fb751c
--- /dev/null
+++ b/host/include/gmboxif.h
@@ -0,0 +1,83 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __GMBOXIF_H__
+#define __GMBOXIF_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+/* GMBOX interface definitions */
+    
+#define AR6K_GMBOX_CREDIT_COUNTER       1   /* we use credit counter 1 to track credits */
+#define AR6K_GMBOX_CREDIT_SIZE_COUNTER  2   /* credit counter 2 is used to pass the size of each credit */
+
+
+    /* HCI UART transport definitions when used over GMBOX interface */
+#define HCI_UART_COMMAND_PKT 0x01
+#define HCI_UART_ACL_PKT     0x02
+#define HCI_UART_SCO_PKT     0x03
+#define HCI_UART_EVENT_PKT   0x04
+
+    /* definitions for BT HCI packets */
+typedef PREPACK struct {
+    A_UINT16 Flags_ConnHandle;
+    A_UINT16 Length;
+} POSTPACK BT_HCI_ACL_HEADER;
+
+typedef PREPACK struct {
+    A_UINT16 Flags_ConnHandle;
+    A_UINT8  Length;
+} POSTPACK BT_HCI_SCO_HEADER;
+
+typedef PREPACK struct {
+    A_UINT16 OpCode;
+    A_UINT8  ParamLength;
+} POSTPACK BT_HCI_COMMAND_HEADER;
+
+typedef PREPACK struct {
+    A_UINT8  EventCode;
+    A_UINT8  ParamLength;
+} POSTPACK BT_HCI_EVENT_HEADER;
+
+/* MBOX host interrupt signal assignments */
+
+#define MBOX_SIG_HCI_BRIDGE_MAX      8
+#define MBOX_SIG_HCI_BRIDGE_BT_ON    0
+#define MBOX_SIG_HCI_BRIDGE_BT_OFF   1
+#define MBOX_SIG_HCI_BRIDGE_BAUD_SET 2
+#define MBOX_SIG_HCI_BRIDGE_PWR_SAV_ON    3
+#define MBOX_SIG_HCI_BRIDGE_PWR_SAV_OFF   4
+
+/* Host interrupts target to change baud rate and 
+ * baud rate info is stored in scratch registers 4 and 5
+ */
+#define LSB_SCRATCH_IDX     4
+#define MSB_SCRATCH_IDX     5
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __GMBOXIF_H__ */
+
diff --git a/host/include/gpio.h b/host/include/gpio.h
new file mode 100644
index 0000000..f69dcbe
--- /dev/null
+++ b/host/include/gpio.h
@@ -0,0 +1,51 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2005-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#define AR6001_GPIO_PIN_COUNT 18
+#define AR6002_GPIO_PIN_COUNT 18
+#define AR6003_GPIO_PIN_COUNT 28
+#define MCKINLEY_GPIO_PIN_COUNT 57
+
+/*
+ * Values of gpioreg_id in the WMIX_GPIO_REGISTER_SET_CMDID and WMIX_GPIO_REGISTER_GET_CMDID
+ * commands come in two flavors.  If the upper bit of gpioreg_id is CLEAR, then the
+ * remainder is interpreted as one of these values.  This provides platform-independent
+ * access to GPIO registers.  If the upper bit (GPIO_ID_OFFSET_FLAG) of gpioreg_id is SET,
+ * then the remainder is interpreted as a platform-specific GPIO register offset.
+ */
+#define GPIO_ID_OUT             0x00000000
+#define GPIO_ID_OUT_W1TS        0x00000001
+#define GPIO_ID_OUT_W1TC        0x00000002
+#define GPIO_ID_ENABLE          0x00000003
+#define GPIO_ID_ENABLE_W1TS     0x00000004
+#define GPIO_ID_ENABLE_W1TC     0x00000005
+#define GPIO_ID_IN              0x00000006
+#define GPIO_ID_STATUS          0x00000007
+#define GPIO_ID_STATUS_W1TS     0x00000008
+#define GPIO_ID_STATUS_W1TC     0x00000009
+#define GPIO_ID_PIN0            0x0000000a
+#define GPIO_ID_PIN(n)          (GPIO_ID_PIN0+(n))
+#define GPIO_ID_NONE            0xffffffff
+
+#define GPIO_ID_OFFSET_FLAG     0x80000000
+#define GPIO_ID_REG_MASK        0x7fffffff
+#define GPIO_ID_IS_OFFSET(reg_id) (((reg_id) & GPIO_ID_OFFSET_FLAG) != 0)
diff --git a/host/include/gpio_api.h b/host/include/gpio_api.h
new file mode 100644
index 0000000..96a1503
--- /dev/null
+++ b/host/include/gpio_api.h
@@ -0,0 +1,59 @@
+//------------------------------------------------------------------------------
+// <copyright file="gpio_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Host-side General Purpose I/O API.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _GPIO_API_H_
+#define _GPIO_API_H_
+
+/*
+ * Send a command to the Target in order to change output on GPIO pins.
+ */
+A_STATUS wmi_gpio_output_set(struct wmi_t *wmip,
+                             A_UINT32 set_mask,
+                             A_UINT32 clear_mask,
+                             A_UINT32 enable_mask,
+                             A_UINT32 disable_mask);
+
+/*
+ * Send a command to the Target requesting input state of GPIO pins.
+ */
+A_STATUS wmi_gpio_input_get(struct wmi_t *wmip);
+
+/*
+ * Send a command to the Target to change the value of a GPIO register.
+ */
+A_STATUS wmi_gpio_register_set(struct wmi_t *wmip,
+                               A_UINT32 gpioreg_id,
+                               A_UINT32 value);
+
+/*
+ * Send a command to the Target to fetch the value of a GPIO register.
+ */
+A_STATUS wmi_gpio_register_get(struct wmi_t *wmip, A_UINT32 gpioreg_id);
+
+/*
+ * Send a command to the Target, acknowledging some GPIO interrupts.
+ */
+A_STATUS wmi_gpio_intr_ack(struct wmi_t *wmip, A_UINT32 ack_mask);
+
+#endif /* _GPIO_API_H_ */
diff --git a/host/include/hci_transport_api.h b/host/include/hci_transport_api.h
new file mode 100644
index 0000000..b5157ea
--- /dev/null
+++ b/host/include/hci_transport_api.h
@@ -0,0 +1,259 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HCI_TRANSPORT_API_H_
+#define _HCI_TRANSPORT_API_H_
+
+    /* Bluetooth HCI packets are stored in HTC packet containers */
+#include "htc_packet.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+typedef void *HCI_TRANSPORT_HANDLE;
+
+typedef HTC_ENDPOINT_ID HCI_TRANSPORT_PACKET_TYPE; 
+
+    /* we map each HCI packet class to a static Endpoint ID */
+#define HCI_COMMAND_TYPE   ENDPOINT_1
+#define HCI_EVENT_TYPE     ENDPOINT_2
+#define HCI_ACL_TYPE       ENDPOINT_3
+#define HCI_PACKET_INVALID ENDPOINT_MAX
+
+#define HCI_GET_PACKET_TYPE(pP)    (pP)->Endpoint
+#define HCI_SET_PACKET_TYPE(pP,s)  (pP)->Endpoint = (s)
+
+/* callback when an HCI packet was completely sent */
+typedef void   (*HCI_TRANSPORT_SEND_PKT_COMPLETE)(void *, HTC_PACKET *);
+/* callback when an HCI packet is received */
+typedef void   (*HCI_TRANSPORT_RECV_PKT)(void *, HTC_PACKET *);
+/* Optional receive buffer re-fill callback,
+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
+ * to the network stack.  The driver never gets the packets back from the OS.  For these OSes
+ * a refill callback can be used to allocate and re-queue buffers into HTC.
+ * A refill callback is used for the reception of ACL and EVENT packets.  The caller must
+ * set the watermark trigger point to cause a refill.
+ */
+typedef void   (*HCI_TRANSPORT_RECV_REFILL)(void *, HCI_TRANSPORT_PACKET_TYPE Type, int BuffersAvailable);
+/* Optional receive packet refill
+ * On some systems packet buffers are an extremely limited resource.  Rather than
+ * queue largest-possible-sized buffers to the HCI bridge, some systems would rather
+ * allocate a specific size as the packet is received.  The trade off is
+ * slightly more processing (callback invoked for each RX packet)
+ * for the benefit of committing fewer buffer resources into the bridge.
+ *
+ * The callback is provided the length of the pending packet to fetch. This includes the
+ * full transport header, HCI header, plus the length of payload.  The callback can return a pointer to
+ * the allocated HTC packet for immediate use.
+ *
+ * NOTE*** This callback is mutually exclusive with the the refill callback above.
+ *
+ * */
+typedef HTC_PACKET *(*HCI_TRANSPORT_RECV_ALLOC)(void *, HCI_TRANSPORT_PACKET_TYPE Type, int Length);
+
+typedef enum _HCI_SEND_FULL_ACTION {
+    HCI_SEND_FULL_KEEP = 0,  /* packet that overflowed should be kept in the queue */
+    HCI_SEND_FULL_DROP = 1,  /* packet that overflowed should be dropped */
+} HCI_SEND_FULL_ACTION;
+
+/* callback when an HCI send queue exceeds the caller's MaxSendQueueDepth threshold,
+ * the callback must return the send full action to take (either DROP or KEEP) */
+typedef HCI_SEND_FULL_ACTION  (*HCI_TRANSPORT_SEND_FULL)(void *, HTC_PACKET *);
+
+typedef struct {
+    int    HeadRoom;      /* number of bytes in front of HCI packet for header space */
+    int    TailRoom;      /* number of bytes at the end of the HCI packet for tail space */
+    int    IOBlockPad;    /* I/O block padding required (always a power of 2) */
+} HCI_TRANSPORT_PROPERTIES;
+
+typedef struct _HCI_TRANSPORT_CONFIG_INFO {
+    int      ACLRecvBufferWaterMark;     /* low watermark to trigger recv refill */
+    int      EventRecvBufferWaterMark;   /* low watermark to trigger recv refill */  
+    int      MaxSendQueueDepth;          /* max number of packets in the single send queue */
+    void     *pContext;                  /* context for all callbacks */
+    void     (*TransportFailure)(void *pContext, A_STATUS Status); /* transport failure callback */
+    A_STATUS (*TransportReady)(HCI_TRANSPORT_HANDLE, HCI_TRANSPORT_PROPERTIES *,void *pContext); /* transport is ready */
+    void     (*TransportRemoved)(void *pContext);                  /* transport was removed */
+        /* packet processing callbacks */
+    HCI_TRANSPORT_SEND_PKT_COMPLETE    pHCISendComplete;
+    HCI_TRANSPORT_RECV_PKT             pHCIPktRecv;
+    HCI_TRANSPORT_RECV_REFILL          pHCIPktRecvRefill;
+    HCI_TRANSPORT_RECV_ALLOC           pHCIPktRecvAlloc;
+    HCI_TRANSPORT_SEND_FULL            pHCISendFull;
+} HCI_TRANSPORT_CONFIG_INFO;
+
+/* ------ Function Prototypes ------ */
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Attach to the HCI transport module
+  @function name: HCI_TransportAttach
+  @input:  HTCHandle - HTC handle (see HTC apis)
+           pInfo - initialization information
+  @output:
+  @return: HCI_TRANSPORT_HANDLE on success, NULL on failure
+  @notes:    The HTC module provides HCI transport services.
+  @example:
+  @see also: HCI_TransportDetach
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+HCI_TRANSPORT_HANDLE HCI_TransportAttach(void *HTCHandle, HCI_TRANSPORT_CONFIG_INFO *pInfo);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Detach from the HCI transport module
+  @function name: HCI_TransportDetach
+  @input:  HciTrans - HCI transport handle
+           pInfo - initialization information
+  @output:
+  @return: 
+  @notes:  
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void HCI_TransportDetach(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add receive packets to the HCI transport
+  @function name: HCI_TransportAddReceivePkts
+  @input:  HciTrans - HCI transport handle
+           pQueue - a queue holding one or more packets
+  @output:
+  @return: A_OK on success
+  @notes:  user must supply HTC packets for capturing incomming HCI packets.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro. Each packet in the queue must be of the same type and length 
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportAddReceivePkts(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET_QUEUE *pQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Send an HCI packet packet
+  @function name: HCI_TransportSendPkt
+  @input:  HciTrans - HCI transport handle
+           pPacket - packet to send
+           Synchronous - send the packet synchronously (blocking)
+  @output:
+  @return: A_OK
+  @notes:  Caller must initialize packet using SET_HTC_PACKET_INFO_TX() and
+           HCI_SET_PACKET_TYPE() macros to prepare the packet. 
+           If Synchronous is set to FALSE the call is fully asynchronous.  On error or completion, 
+           the registered send complete callback will be called.
+           If Synchronous is set to TRUE, the call will block until the packet is sent, if the
+           interface cannot send the packet within a 2 second timeout, the function will return 
+           the failure code : A_EBUSY.
+           
+           Synchronous Mode should only be used at start-up to initialize the HCI device using 
+           custom HCI commands.  It should NOT be mixed with Asynchronous operations.  Mixed synchronous
+           and asynchronous operation behavior is undefined.
+           
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportSendPkt(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET *pPacket, A_BOOL Synchronous);
+
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Stop HCI transport
+  @function name: HCI_TransportStop
+  @input:  HciTrans - hci transport handle 
+  @output:
+  @return:
+  @notes: HCI transport communication will be halted.  All receive and pending TX packets will
+          be flushed.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HCI_TransportStop(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Start the HCI transport
+  @function name: HCI_TransportStart
+  @input:  HciTrans - hci transport handle 
+  @output:
+  @return: A_OK on success
+  @notes: HCI transport communication will begin, the caller can expect the arrival
+          of HCI recv packets as soon as this call returns.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportStart(HCI_TRANSPORT_HANDLE HciTrans);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Enable or Disable Asynchronous Recv
+  @function name: HCI_TransportEnableDisableAsyncRecv
+  @input:  HciTrans - hci transport handle 
+           Enable - enable or disable asynchronous recv
+  @output:
+  @return: A_OK on success
+  @notes: This API must be called when HCI recv is handled synchronously
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportEnableDisableAsyncRecv(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Receive an event packet from the HCI transport synchronously using polling
+  @function name: HCI_TransportRecvHCIEventSync
+  @input:  HciTrans - hci transport handle 
+           pPacket - HTC packet to hold the recv data
+           MaxPollMS - maximum polling duration in Milliseconds;
+  @output: 
+  @return: A_OK on success
+  @notes: This API should be used only during HCI device initialization, the caller must call
+          HCI_TransportEnableDisableAsyncRecv with Enable=FALSE prior to using this API. 
+          This API will only capture HCI Event packets.
+  @example:
+  @see also: HCI_TransportEnableDisableAsyncRecv
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportRecvHCIEventSync(HCI_TRANSPORT_HANDLE HciTrans, 
+                                          HTC_PACKET           *pPacket,
+                                          int                  MaxPollMS);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Set the desired baud rate for the underlying transport layer
+  @function name: HCI_TransportSetBaudRate
+  @input:  HciTrans - hci transport handle 
+           Baud - baud rate in bps
+  @output: 
+  @return: A_OK on success
+  @notes: This API should be used only after HCI device initialization
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HCI_TransportSetBaudRate(HCI_TRANSPORT_HANDLE HciTrans, A_UINT32 Baud);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Enable/Disable HCI Transport Power Management
+  @function name: HCI_TransportEnablePowerMgmt
+  @input:  HciTrans - hci transport handle 
+           Enable - 1 = Enable, 0 = Disable
+  @output: 
+  @return: A_OK on success
+  @notes: 
+  @example:
+  @see also: 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS HCI_TransportEnablePowerMgmt(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HCI_TRANSPORT_API_H_ */
diff --git a/host/include/hif.h b/host/include/hif.h
new file mode 100644
index 0000000..71b4a80
--- /dev/null
+++ b/host/include/hif.h
@@ -0,0 +1,529 @@
+//------------------------------------------------------------------------------
+// <copyright file="hif.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HIF specific declarations and prototypes
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HIF_H_
+#define _HIF_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* Header files */
+#include "a_config.h"
+#include "athdefs.h"
+#include "a_types.h"
+#include "a_osapi.h"
+#include "dl_list.h"
+
+
+typedef struct htc_callbacks HTC_CALLBACKS;
+typedef struct hif_device HIF_DEVICE;
+
+#define HIF_TYPE_AR6002 2
+#define HIF_TYPE_AR6003 3
+#define HIF_TYPE_MCKINLEY 5
+
+/*
+ * Thread Priority - AR6K Driver Thread Priority
+ * Priority must be > 154, since critical modules like SMD holds the thread priorities
+ * upto 154
+ */
+#define HIF_THREAD_PRIORITY        155
+#define AP_THREAD_PRIORITY         200
+
+
+
+
+/*
+ * direction - Direction of transfer (HIF_READ/HIF_WRITE).
+ */
+#define HIF_READ                    0x00000001
+#define HIF_WRITE                   0x00000002
+#define HIF_DIR_MASK                (HIF_READ | HIF_WRITE)
+
+/*
+ *     type - An interface may support different kind of read/write commands.
+ *            For example: SDIO supports CMD52/CMD53s. In case of MSIO it
+ *            translates to using different kinds of TPCs. The command type
+ *            is thus divided into a basic and an extended command and can
+ *            be specified using HIF_BASIC_IO/HIF_EXTENDED_IO.
+ */
+#define HIF_BASIC_IO                0x00000004
+#define HIF_EXTENDED_IO             0x00000008
+#define HIF_TYPE_MASK               (HIF_BASIC_IO | HIF_EXTENDED_IO)
+
+/*
+ *     emode - This indicates the whether the command is to be executed in a
+ *             blocking or non-blocking fashion (HIF_SYNCHRONOUS/
+ *             HIF_ASYNCHRONOUS). The read/write data paths in HTC have been
+ *             implemented using the asynchronous mode allowing the the bus
+ *             driver to indicate the completion of operation through the
+ *             registered callback routine. The requirement primarily comes
+ *             from the contexts these operations get called from (a driver's
+ *             transmit context or the ISR context in case of receive).
+ *             Support for both of these modes is essential.
+ */
+#define HIF_SYNCHRONOUS             0x00000010
+#define HIF_ASYNCHRONOUS            0x00000020
+#define HIF_EMODE_MASK              (HIF_SYNCHRONOUS | HIF_ASYNCHRONOUS)
+
+/*
+ *     dmode - An interface may support different kinds of commands based on
+ *             the tradeoff between the amount of data it can carry and the
+ *             setup time. Byte and Block modes are supported (HIF_BYTE_BASIS/
+ *             HIF_BLOCK_BASIS). In case of latter, the data is rounded off
+ *             to the nearest block size by padding. The size of the block is
+ *             configurable at compile time using the HIF_BLOCK_SIZE and is
+ *             negotiated with the target during initialization after the
+ *             AR6000 interrupts are enabled.
+ */
+#define HIF_BYTE_BASIS              0x00000040
+#define HIF_BLOCK_BASIS             0x00000080
+#define HIF_DMODE_MASK              (HIF_BYTE_BASIS | HIF_BLOCK_BASIS)
+
+/*
+ *     amode - This indicates if the address has to be incremented on AR6000 
+ *             after every read/write operation (HIF?FIXED_ADDRESS/
+ *             HIF_INCREMENTAL_ADDRESS).
+ */
+#define HIF_FIXED_ADDRESS           0x00000100
+#define HIF_INCREMENTAL_ADDRESS     0x00000200
+#define HIF_AMODE_MASK              (HIF_FIXED_ADDRESS | HIF_INCREMENTAL_ADDRESS)
+
+#define HIF_WR_ASYNC_BYTE_FIX   \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_ASYNC_BYTE_INC   \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_ASYNC_BLOCK_INC  \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_SYNC_BYTE_FIX    \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_SYNC_BYTE_INC    \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_SYNC_BLOCK_INC  \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_WR_ASYNC_BLOCK_FIX \
+    (HIF_WRITE | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_WR_SYNC_BLOCK_FIX  \
+    (HIF_WRITE | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_SYNC_BYTE_INC    \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BYTE_FIX    \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BYTE_FIX   \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BLOCK_FIX  \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+#define HIF_RD_ASYNC_BYTE_INC   \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BYTE_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_ASYNC_BLOCK_INC  \
+    (HIF_READ | HIF_ASYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BLOCK_INC  \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_INCREMENTAL_ADDRESS)
+#define HIF_RD_SYNC_BLOCK_FIX  \
+    (HIF_READ | HIF_SYNCHRONOUS | HIF_EXTENDED_IO | HIF_BLOCK_BASIS | HIF_FIXED_ADDRESS)
+    
+typedef enum {
+    HIF_DEVICE_POWER_STATE = 0,
+    HIF_DEVICE_GET_MBOX_BLOCK_SIZE,
+    HIF_DEVICE_GET_MBOX_ADDR,
+    HIF_DEVICE_GET_PENDING_EVENTS_FUNC,
+    HIF_DEVICE_GET_IRQ_PROC_MODE,
+    HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC,
+    HIF_DEVICE_POWER_STATE_CHANGE,
+    HIF_DEVICE_GET_IRQ_YIELD_PARAMS,
+    HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT,
+    HIF_DEVICE_GET_OS_DEVICE,
+    HIF_DEVICE_DEBUG_BUS_STATE,
+} HIF_DEVICE_CONFIG_OPCODE;
+
+/*
+ * HIF CONFIGURE definitions:
+ *
+ *   HIF_DEVICE_GET_MBOX_BLOCK_SIZE
+ *   input : none
+ *   output : array of 4 A_UINT32s
+ *   notes: block size is returned for each mailbox (4)
+ *
+ *   HIF_DEVICE_GET_MBOX_ADDR
+ *   input : none
+ *   output : HIF_DEVICE_MBOX_INFO
+ *   notes: 
+ *
+ *   HIF_DEVICE_GET_PENDING_EVENTS_FUNC
+ *   input : none
+ *   output: HIF_PENDING_EVENTS_FUNC function pointer
+ *   notes: this is optional for the HIF layer, if the request is
+ *          not handled then it indicates that the upper layer can use
+ *          the standard device methods to get pending events (IRQs, mailbox messages etc..)
+ *          otherwise it can call the function pointer to check pending events.
+ *
+ *   HIF_DEVICE_GET_IRQ_PROC_MODE
+ *   input : none
+ *   output : HIF_DEVICE_IRQ_PROCESSING_MODE (interrupt processing mode)
+ *   note: the hif layer interfaces with the underlying OS-specific bus driver. The HIF
+ *         layer can report whether IRQ processing is requires synchronous behavior or
+ *         can be processed using asynchronous bus requests (typically faster).
+ *
+ *   HIF_DEVICE_GET_RECV_EVENT_MASK_UNMASK_FUNC
+ *   input :
+ *   output : HIF_MASK_UNMASK_RECV_EVENT function pointer
+ *   notes: this is optional for the HIF layer.  The HIF layer may require a special mechanism
+ *          to mask receive message events.  The upper layer can call this pointer when it needs
+ *          to mask/unmask receive events (in case it runs out of buffers).
+ *
+ *   HIF_DEVICE_POWER_STATE_CHANGE
+ *
+ *   input : HIF_DEVICE_POWER_CHANGE_TYPE
+ *   output : none
+ *   note: this is optional for the HIF layer.  The HIF layer can handle power on/off state change
+ *         requests in an interconnect specific way.  This is highly OS and bus driver dependent.
+ *         The caller must guarantee that no HIF read/write requests will be made after the device
+ *         is powered down.
+ *
+ *   HIF_DEVICE_GET_IRQ_YIELD_PARAMS
+ * 
+ *   input : none
+ *   output : HIF_DEVICE_IRQ_YIELD_PARAMS
+ *   note: This query checks if the HIF layer wishes to impose a processing yield count for the DSR handler.
+ *   The DSR callback handler will exit after a fixed number of RX packets or events are processed.  
+ *   This query is only made if the device reports an IRQ processing mode of HIF_DEVICE_IRQ_SYNC_ONLY. 
+ *   The HIF implementation can ignore this command if it does not desire the DSR callback to yield.
+ *   The HIF layer can indicate the maximum number of IRQ processing units (RX packets) before the
+ *   DSR handler callback must yield and return control back to the HIF layer.  When a yield limit is 
+ *   used the DSR callback will not call HIFAckInterrupts() as it would normally do before returning.  
+ *   The HIF implementation that requires a yield count must call HIFAckInterrupt() when it is prepared
+ *   to process interrupts again.
+ *   
+ *   HIF_CONFIGURE_QUERY_SCATTER_REQUEST_SUPPORT
+ *   input : none
+ *   output : HIF_DEVICE_SCATTER_SUPPORT_INFO
+ *   note:  This query checks if the HIF layer implements the SCATTER request interface.  Scatter requests
+ *   allows upper layers to submit mailbox I/O operations using a list of buffers.  This is useful for
+ *   multi-message transfers that can better utilize the bus interconnect.
+ * 
+ * 
+ *   HIF_DEVICE_GET_OS_DEVICE
+ *   intput : none
+ *   output : HIF_DEVICE_OS_DEVICE_INFO;
+ *   note: On some operating systems, the HIF layer has a parent device object for the bus.  This object
+ *         may be required to register certain types of logical devices.
+ * 
+ *   HIF_DEVICE_DEBUG_BUS_STATE
+ *   input : none
+ *   output : none
+ *   note: This configure option triggers the HIF interface to dump as much bus interface state.  This 
+ *   configuration request is optional (No-OP on some HIF implementations)
+ * 
+ */
+
+typedef struct {
+    A_UINT32    ExtendedAddress;  /* extended address for larger writes */  
+    A_UINT32    ExtendedSize;
+} HIF_MBOX_PROPERTIES;
+
+#define HIF_MBOX_FLAG_NO_BUNDLING   (1 << 0)   /* do not allow bundling over the mailbox */
+
+typedef struct {
+    A_UINT32 MboxAddresses[4];  /* must be first element for legacy HIFs that return the address in  
+                                   and ARRAY of 32-bit words */
+    
+        /* the following describe extended mailbox properties */
+    HIF_MBOX_PROPERTIES MboxProp[4];
+        /* if the HIF supports the GMbox extended address region it can report it
+         * here, some interfaces cannot support the GMBOX address range and not set this */
+    A_UINT32 GMboxAddress;  
+    A_UINT32 GMboxSize;
+    A_UINT32 Flags;             /* flags to describe mbox behavior or usage */
+} HIF_DEVICE_MBOX_INFO;
+
+typedef enum {
+    HIF_DEVICE_IRQ_SYNC_ONLY,   /* for HIF implementations that require the DSR to process all
+                                   interrupts before returning */
+    HIF_DEVICE_IRQ_ASYNC_SYNC,  /* for HIF implementations that allow DSR to process interrupts
+                                   using ASYNC I/O (that is HIFAckInterrupt can be called at a
+                                   later time */
+} HIF_DEVICE_IRQ_PROCESSING_MODE;
+
+typedef enum {
+    HIF_DEVICE_POWER_UP,    /* HIF layer should power up interface and/or module */
+    HIF_DEVICE_POWER_DOWN,  /* HIF layer should initiate bus-specific measures to minimize power */
+    HIF_DEVICE_POWER_CUT    /* HIF layer should initiate bus-specific AND/OR platform-specific measures
+                               to completely power-off the module and associated hardware (i.e. cut power supplies)
+                            */
+} HIF_DEVICE_POWER_CHANGE_TYPE;
+
+typedef struct {
+    int     RecvPacketYieldCount; /* max number of packets to force DSR to return */
+} HIF_DEVICE_IRQ_YIELD_PARAMS;
+
+
+typedef struct _HIF_SCATTER_ITEM {
+    A_UINT8     *pBuffer;             /* CPU accessible address of buffer */
+    int          Length;              /* length of transfer to/from this buffer */
+    void        *pCallerContexts[2];  /* space for caller to insert a context associated with this item */
+} HIF_SCATTER_ITEM;
+
+struct _HIF_SCATTER_REQ;
+
+typedef void ( *HIF_SCATTER_COMP_CB)(struct _HIF_SCATTER_REQ *);
+
+typedef enum _HIF_SCATTER_METHOD {
+    HIF_SCATTER_NONE = 0,
+    HIF_SCATTER_DMA_REAL,              /* Real SG support no restrictions */
+    HIF_SCATTER_DMA_BOUNCE,            /* Uses SG DMA but HIF layer uses an internal bounce buffer */    
+} HIF_SCATTER_METHOD;
+
+typedef struct _HIF_SCATTER_REQ {
+    DL_LIST             ListLink;           /* link management */
+    A_UINT32            Address;            /* address for the read/write operation */
+    A_UINT32            Request;            /* request flags */
+    A_UINT32            TotalLength;        /* total length of entire transfer */
+    A_UINT32            CallerFlags;        /* caller specific flags can be stored here */
+    HIF_SCATTER_COMP_CB CompletionRoutine;  /* completion routine set by caller */
+    A_STATUS            CompletionStatus;   /* status of completion */
+    void                *Context;           /* caller context for this request */
+    int                 ValidScatterEntries;  /* number of valid entries set by caller */
+    HIF_SCATTER_METHOD  ScatterMethod;        /* scatter method handled by HIF */  
+    void                *HIFPrivate[4];     /* HIF private area */
+    A_UINT8             *pScatterBounceBuffer;  /* bounce buffer for upper layers to copy to/from */
+    HIF_SCATTER_ITEM    ScatterList[1];     /* start of scatter list */
+} HIF_SCATTER_REQ;
+
+typedef HIF_SCATTER_REQ * ( *HIF_ALLOCATE_SCATTER_REQUEST)(HIF_DEVICE *device);
+typedef void ( *HIF_FREE_SCATTER_REQUEST)(HIF_DEVICE *device, HIF_SCATTER_REQ *request);
+typedef A_STATUS ( *HIF_READWRITE_SCATTER)(HIF_DEVICE *device, HIF_SCATTER_REQ *request);
+
+typedef struct _HIF_DEVICE_SCATTER_SUPPORT_INFO {
+        /* information returned from HIF layer */
+    HIF_ALLOCATE_SCATTER_REQUEST    pAllocateReqFunc;
+    HIF_FREE_SCATTER_REQUEST        pFreeReqFunc;
+    HIF_READWRITE_SCATTER           pReadWriteScatterFunc;    
+    int                             MaxScatterEntries;
+    int                             MaxTransferSizePerScatterReq;
+} HIF_DEVICE_SCATTER_SUPPORT_INFO;
+                      
+typedef struct {
+    void    *pOSDevice;
+} HIF_DEVICE_OS_DEVICE_INFO;
+                      
+#define HIF_MAX_DEVICES                 1
+
+struct htc_callbacks {
+    void      *context;     /* context to pass to the dsrhandler
+                               note : rwCompletionHandler is provided the context passed to HIFReadWrite  */
+    A_STATUS (* rwCompletionHandler)(void *rwContext, A_STATUS status);
+    A_STATUS (* dsrHandler)(void *context);
+};
+
+typedef struct osdrv_callbacks {
+    void      *context;     /* context to pass for all callbacks except deviceRemovedHandler 
+                               the deviceRemovedHandler is only called if the device is claimed */
+    A_STATUS (* deviceInsertedHandler)(void *context, void *hif_handle);
+    A_STATUS (* deviceRemovedHandler)(void *claimedContext, void *hif_handle);
+    A_STATUS (* deviceSuspendHandler)(void *context);
+    A_STATUS (* deviceResumeHandler)(void *context);
+    A_STATUS (* deviceWakeupHandler)(void *context);  
+    A_STATUS (* devicePowerChangeHandler)(void *context, HIF_DEVICE_POWER_CHANGE_TYPE config);  
+} OSDRV_CALLBACKS;
+
+#define HIF_OTHER_EVENTS     (1 << 0)   /* other interrupts (non-Recv) are pending, host
+                                           needs to read the register table to figure out what */
+#define HIF_RECV_MSG_AVAIL   (1 << 1)   /* pending recv packet */
+
+typedef struct _HIF_PENDING_EVENTS_INFO {
+    A_UINT32 Events;
+    A_UINT32 LookAhead;
+    A_UINT32 AvailableRecvBytes;
+} HIF_PENDING_EVENTS_INFO;
+
+    /* function to get pending events , some HIF modules use special mechanisms
+     * to detect packet available and other interrupts */
+typedef A_STATUS ( *HIF_PENDING_EVENTS_FUNC)(HIF_DEVICE              *device,
+                                             HIF_PENDING_EVENTS_INFO *pEvents,
+                                             void                    *AsyncContext);
+
+#define HIF_MASK_RECV    TRUE
+#define HIF_UNMASK_RECV  FALSE
+    /* function to mask recv events */
+typedef A_STATUS ( *HIF_MASK_UNMASK_RECV_EVENT)(HIF_DEVICE  *device,
+                                                A_BOOL      Mask,
+                                                void        *AsyncContext);
+
+
+/*
+ * This API is used to perform any global initialization of the HIF layer
+ * and to set OS driver callbacks (i.e. insertion/removal) to the HIF layer
+ * 
+ */
+A_STATUS HIFInit(OSDRV_CALLBACKS *callbacks);
+
+/* This API claims the HIF device and provides a context for handling removal.
+ * The device removal callback is only called when the OSDRV layer claims
+ * a device.  The claimed context must be non-NULL */
+void HIFClaimDevice(HIF_DEVICE *device, void *claimedContext);
+/* release the claimed device */
+void HIFReleaseDevice(HIF_DEVICE *device);
+
+/* This API allows the HTC layer to attach to the HIF device */
+A_STATUS HIFAttachHTC(HIF_DEVICE *device, HTC_CALLBACKS *callbacks);
+/* This API detaches the HTC layer from the HIF device */
+void     HIFDetachHTC(HIF_DEVICE *device);
+
+/*
+ * This API is used to provide the read/write interface over the specific bus
+ * interface.
+ * address - Starting address in the AR6000's address space. For mailbox
+ *           writes, it refers to the start of the mbox boundary. It should
+ *           be ensured that the last byte falls on the mailbox's EOM. For
+ *           mailbox reads, it refers to the end of the mbox boundary.
+ * buffer - Pointer to the buffer containg the data to be transmitted or
+ *          received.
+ * length - Amount of data to be transmitted or received.
+ * request - Characterizes the attributes of the command.
+ */
+A_STATUS
+HIFReadWrite(HIF_DEVICE    *device,
+             A_UINT32       address,
+             A_UCHAR       *buffer,
+             A_UINT32       length,
+             A_UINT32       request,
+             void          *context);
+
+/*
+ * This can be initiated from the unload driver context when the OSDRV layer has no more use for
+ * the device.
+ */
+void HIFShutDownDevice(HIF_DEVICE *device);
+
+/*
+ * This should translate to an acknowledgment to the bus driver indicating that
+ * the previous interrupt request has been serviced and the all the relevant
+ * sources have been cleared. HTC is ready to process more interrupts.
+ * This should prevent the bus driver from raising an interrupt unless the
+ * previous one has been serviced and acknowledged using the previous API.
+ */
+void HIFAckInterrupt(HIF_DEVICE *device);
+
+void HIFMaskInterrupt(HIF_DEVICE *device);
+
+void HIFUnMaskInterrupt(HIF_DEVICE *device);
+
+A_STATUS
+HIFConfigureDevice(HIF_DEVICE *device, HIF_DEVICE_CONFIG_OPCODE opcode,
+                   void *config, A_UINT32 configLen);
+
+/* 
+ * This API wait for the remaining MBOX messages to be drained
+ * This should be moved to HTC AR6K layer
+ */
+A_STATUS hifWaitForPendingRecv(HIF_DEVICE *device);
+
+/****************************************************************/
+/* message based HIF interfaces                                 */
+/****************************************************************/
+
+#define HIF_BMI_EXCHANGE_NO_TIMEOUT  ((A_UINT32)(0))
+
+struct _HIF_MSG_OBJ;
+
+typedef void (* HIF_MSG_RECV_CALLBACK)(void *, struct _HIF_MSG_OBJ *);
+typedef void (* HIF_MSG_REQ_COMPLETION)(void *,struct _HIF_MSG_OBJ *);
+                   
+typedef enum {
+    HIF_MSG_SIMPLE_BUFFER = 0, /* a simple buffer ptr and length */
+    HIF_MSG_NET_BUFFER = 1     /* advanced OS-specific network buffer */
+} HIF_MSG_BUFFER_TYPE;
+
+    /* object to pass HIF message requests from upper layers */
+typedef struct _HIF_MSG_OBJ {
+    DL_LIST                 ListLink;      /* for list management */
+    A_INT32                 PipeId;        /* pipe number to send on or recv'd from*/
+    HIF_MSG_BUFFER_TYPE     BufferType; 
+    union {
+        struct HIF_MSG_NET_BUFFER {
+            void            *pAppNetBuf;  /* OS-specific net buf */
+        } AsNetBuffer; 
+        struct HIF_MSG_SIMPLE_BUFFER {
+            void            *pBuffer;     /* for future use.... */
+            A_UINT32        Length;
+        } AsSimpleBuffer; 
+    }                       BufferInfo;    
+    void                    *pContext;          /* caller context of message */
+    HIF_MSG_REQ_COMPLETION  CompletionRoutine;  /* completion routine */
+    A_STATUS                Status;             /* completion status */
+    A_UINT32                Flags;              /* request flags */
+    void                    *HIFPriv[4];        /* private contexts for HIF layer to use */
+    
+} HIF_MSG_OBJ;
+
+    /* API to handle HIF-specific BMI message exchanges, this API is synchronous
+     * and only allowed to be called from a context that can block (sleep) */
+A_STATUS HIFExchangeBMIMsg(HIF_DEVICE *device, 
+                           A_UINT8    *pSendMessage, 
+                           A_UINT32   Length, 
+                           A_UINT8    *pResponseMessage,
+                           A_UINT32   *pResponseLength,
+                           A_UINT32   TimeoutMS);   
+
+    /* API to handle HIF specific diagnostic window read accesses, this API is synchronous
+     * and only allowed to be called from a context that can block (sleep) */
+A_STATUS HIFDiagReadAccess(HIF_DEVICE *hifDevice, A_UINT32 address, A_UINT32 *data);
+
+    /* API to handle HIF specific diagnostic window write accesses, this API is synchronous
+     * and only allowed to be called from a context that can block (sleep) */
+A_STATUS HIFDiagWriteAccess(HIF_DEVICE *hifDevice, A_UINT32 address, A_UINT32 data);
+
+    /* get the Pipe ID associated with the service ID */
+A_STATUS HIFGetPipeId(HIF_DEVICE *hifDevice, A_UINT16 ServiceId, A_INT32 *pId);
+    
+    /* API to let HIF layer know that pipe communications should be enabled
+     * caller will start to exchange messages on service pipes */
+A_STATUS HIFEnablePipes(HIF_DEVICE *hifDevice);
+
+    /* set the message recv handler for all incomming messages */
+void HIFSetMsgRecvHandler(HIF_DEVICE            *hifDevice,
+                          HIF_MSG_RECV_CALLBACK Callback,
+                          void                  *pContext);
+                                                 
+    /* upper layers should return the HIF_MSG_OBJ back to HIF as it may be associated
+     * with some recv resource.  The objects could be returned in a chain (batch mode)
+     * Note, upper layers can take ownership of the buffer (free it) if it is of the type
+     * HIF_MSG_NET_BUFFER, in this case upper layers will set 
+     * BufferInfo.AsNetBuffer.pAppNetBuf to NULL */
+void HIFReturnRecvMsgObjects(HIF_DEVICE *hifDevice, HIF_MSG_OBJ *pMessageObj);
+
+    /* API for upper layers to send one or more messages. Note, HIF may
+     * take ownership of the buffer (it will free it) if it is of the type
+     * HIF_MSG_NET_BUFFER, in this case the HIF layer will set 
+     * BufferInfo.AsNetBuffer.pAppNetBuf to NULL */
+A_STATUS HIFSendMessages(HIF_DEVICE *hifDevice, HIF_MSG_OBJ *pMessages);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HIF_H_ */
+
diff --git a/host/include/host_proxy_iface.h b/host/include/host_proxy_iface.h
new file mode 100644
index 0000000..a4b94ab
--- /dev/null
+++ b/host/include/host_proxy_iface.h
@@ -0,0 +1,45 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2011 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/*
+ * This file contains the definitions of the host_proxy interface.  
+ */
+
+#ifndef _HOST_PROXY_IFACE_H_
+#define _HOST_PROXY_IFACE_H_
+
+/* Host proxy initializes shared memory with HOST_PROXY_INIT to 
+ * indicate that it is ready to receive instruction */
+#define HOST_PROXY_INIT         (1)
+/* Host writes HOST_PROXY_NORMAL_BOOT to shared memory to 
+ * indicate to host proxy that it should proceed to boot 
+ * normally (bypassing BMI).
+ */
+#define HOST_PROXY_NORMAL_BOOT  (2)
+/* Host writes HOST_PROXY_BMI_BOOT to shared memory to
+ * indicate to host proxy that is should enable BMI and 
+ * exit.  This allows a host to reprogram the on board
+ * flash. 
+ */
+#define HOST_PROXY_BMI_BOOT     (3)
+
+#endif /* _HOST_PROXY_IFACE_H_ */
diff --git a/host/include/host_reg_table.h b/host/include/host_reg_table.h
new file mode 100644
index 0000000..a664cd8
--- /dev/null
+++ b/host/include/host_reg_table.h
@@ -0,0 +1,226 @@
+//------------------------------------------------------------------------------
+// <copyright file="target_reg_table.h" company="Atheros">
+//    Copyright (c) 2004-2008 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Target register table macros and structure definitions
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef HOST_REG_TABLE_H_
+#define HOST_REG_TABLE_H_
+
+#include "targaddrs.h"
+/*** WARNING : Add to the end of the TABLE! do not change the order ****/
+typedef struct hostdef_s {
+    A_UINT32 d_INT_STATUS_ENABLE_ERROR_LSB;
+    A_UINT32 d_INT_STATUS_ENABLE_ERROR_MASK;
+    A_UINT32 d_INT_STATUS_ENABLE_CPU_LSB;
+    A_UINT32 d_INT_STATUS_ENABLE_CPU_MASK;
+    A_UINT32 d_INT_STATUS_ENABLE_COUNTER_LSB;
+    A_UINT32 d_INT_STATUS_ENABLE_COUNTER_MASK;
+    A_UINT32 d_INT_STATUS_ENABLE_MBOX_DATA_LSB;
+    A_UINT32 d_INT_STATUS_ENABLE_MBOX_DATA_MASK;
+    A_UINT32 d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB;
+    A_UINT32 d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK;
+    A_UINT32 d_ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB;
+    A_UINT32 d_ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK;
+    A_UINT32 d_COUNTER_INT_STATUS_ENABLE_BIT_LSB;
+    A_UINT32 d_COUNTER_INT_STATUS_ENABLE_BIT_MASK;
+    A_UINT32 d_INT_STATUS_ENABLE_ADDRESS;                  
+    A_UINT32 d_CPU_INT_STATUS_ENABLE_BIT_LSB;
+    A_UINT32 d_CPU_INT_STATUS_ENABLE_BIT_MASK;
+    A_UINT32 d_HOST_INT_STATUS_ADDRESS;
+    A_UINT32 d_CPU_INT_STATUS_ADDRESS;
+    A_UINT32 d_ERROR_INT_STATUS_ADDRESS;
+    A_UINT32 d_ERROR_INT_STATUS_WAKEUP_MASK;
+    A_UINT32 d_ERROR_INT_STATUS_WAKEUP_LSB;
+    A_UINT32 d_ERROR_INT_STATUS_RX_UNDERFLOW_MASK;
+    A_UINT32 d_ERROR_INT_STATUS_RX_UNDERFLOW_LSB;
+    A_UINT32 d_ERROR_INT_STATUS_TX_OVERFLOW_MASK;
+    A_UINT32 d_ERROR_INT_STATUS_TX_OVERFLOW_LSB;
+    A_UINT32 d_COUNT_DEC_ADDRESS;
+    A_UINT32 d_HOST_INT_STATUS_CPU_MASK; 
+    A_UINT32 d_HOST_INT_STATUS_CPU_LSB;
+    A_UINT32 d_HOST_INT_STATUS_ERROR_MASK;
+    A_UINT32 d_HOST_INT_STATUS_ERROR_LSB;
+    A_UINT32 d_HOST_INT_STATUS_COUNTER_MASK;
+    A_UINT32 d_HOST_INT_STATUS_COUNTER_LSB;
+    A_UINT32 d_RX_LOOKAHEAD_VALID_ADDRESS;
+    A_UINT32 d_WINDOW_DATA_ADDRESS;
+    A_UINT32 d_WINDOW_READ_ADDR_ADDRESS;
+    A_UINT32 d_WINDOW_WRITE_ADDR_ADDRESS;
+} HOST_REGISTER_TABLE;
+
+#if defined(MY_HOST_DEF) /* { */
+#if defined(ATHR_WIN_DEF)
+#define ATH_REG_TABLE_DIRECT_ASSIGN
+#endif
+#ifdef ATH_REG_TABLE_DIRECT_ASSIGN
+
+static struct hostdef_s my_host_def = {
+    INT_STATUS_ENABLE_ERROR_LSB,
+    INT_STATUS_ENABLE_ERROR_MASK,
+    INT_STATUS_ENABLE_CPU_LSB,
+    INT_STATUS_ENABLE_CPU_MASK,
+    INT_STATUS_ENABLE_COUNTER_LSB,
+    INT_STATUS_ENABLE_COUNTER_MASK,
+    INT_STATUS_ENABLE_MBOX_DATA_LSB,
+    INT_STATUS_ENABLE_MBOX_DATA_MASK,
+    ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB,
+    ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK,
+    ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB,
+    ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK,
+    COUNTER_INT_STATUS_ENABLE_BIT_LSB,
+    COUNTER_INT_STATUS_ENABLE_BIT_MASK,
+    INT_STATUS_ENABLE_ADDRESS, 
+    CPU_INT_STATUS_ENABLE_BIT_LSB,
+    CPU_INT_STATUS_ENABLE_BIT_MASK,
+    HOST_INT_STATUS_ADDRESS,
+    CPU_INT_STATUS_ADDRESS,
+    ERROR_INT_STATUS_ADDRESS,
+    ERROR_INT_STATUS_WAKEUP_MASK,
+    ERROR_INT_STATUS_WAKEUP_LSB,
+    ERROR_INT_STATUS_RX_UNDERFLOW_MASK,
+    ERROR_INT_STATUS_RX_UNDERFLOW_LSB,
+    ERROR_INT_STATUS_TX_OVERFLOW_MASK,
+    ERROR_INT_STATUS_TX_OVERFLOW_LSB,
+    COUNT_DEC_ADDRESS,
+    HOST_INT_STATUS_CPU_MASK, 
+    HOST_INT_STATUS_CPU_LSB,
+    HOST_INT_STATUS_ERROR_MASK,
+    HOST_INT_STATUS_ERROR_LSB,
+    HOST_INT_STATUS_COUNTER_MASK,
+    HOST_INT_STATUS_COUNTER_LSB,
+    RX_LOOKAHEAD_VALID_ADDRESS,
+    WINDOW_DATA_ADDRESS,
+    WINDOW_READ_ADDR_ADDRESS,
+    WINDOW_WRITE_ADDR_ADDRESS,
+};
+
+#else
+
+static struct hostdef_s my_host_def = {
+    .d_INT_STATUS_ENABLE_ERROR_LSB = INT_STATUS_ENABLE_ERROR_LSB,
+    .d_INT_STATUS_ENABLE_ERROR_MASK = INT_STATUS_ENABLE_ERROR_MASK,
+    .d_INT_STATUS_ENABLE_CPU_LSB = INT_STATUS_ENABLE_CPU_LSB,
+    .d_INT_STATUS_ENABLE_CPU_MASK = INT_STATUS_ENABLE_CPU_MASK,
+    .d_INT_STATUS_ENABLE_COUNTER_LSB = INT_STATUS_ENABLE_COUNTER_LSB,
+    .d_INT_STATUS_ENABLE_COUNTER_MASK = INT_STATUS_ENABLE_COUNTER_MASK,
+    .d_INT_STATUS_ENABLE_MBOX_DATA_LSB = INT_STATUS_ENABLE_MBOX_DATA_LSB,
+    .d_INT_STATUS_ENABLE_MBOX_DATA_MASK = INT_STATUS_ENABLE_MBOX_DATA_MASK,
+    .d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB = ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB,
+    .d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK = ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK,
+    .d_ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB = ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB,
+    .d_ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK = ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK,
+    .d_COUNTER_INT_STATUS_ENABLE_BIT_LSB = COUNTER_INT_STATUS_ENABLE_BIT_LSB,
+    .d_COUNTER_INT_STATUS_ENABLE_BIT_MASK = COUNTER_INT_STATUS_ENABLE_BIT_MASK,
+    .d_INT_STATUS_ENABLE_ADDRESS = INT_STATUS_ENABLE_ADDRESS,             
+    .d_CPU_INT_STATUS_ENABLE_BIT_LSB = CPU_INT_STATUS_ENABLE_BIT_LSB,
+    .d_CPU_INT_STATUS_ENABLE_BIT_MASK = CPU_INT_STATUS_ENABLE_BIT_MASK,
+    .d_HOST_INT_STATUS_ADDRESS = HOST_INT_STATUS_ADDRESS,          
+    .d_CPU_INT_STATUS_ADDRESS = CPU_INT_STATUS_ADDRESS,
+    .d_ERROR_INT_STATUS_ADDRESS = ERROR_INT_STATUS_ADDRESS,
+    .d_ERROR_INT_STATUS_WAKEUP_MASK = ERROR_INT_STATUS_WAKEUP_MASK,
+    .d_ERROR_INT_STATUS_WAKEUP_LSB = ERROR_INT_STATUS_WAKEUP_LSB,
+    .d_ERROR_INT_STATUS_RX_UNDERFLOW_MASK = ERROR_INT_STATUS_RX_UNDERFLOW_MASK,
+    .d_ERROR_INT_STATUS_RX_UNDERFLOW_LSB = ERROR_INT_STATUS_RX_UNDERFLOW_LSB,
+    .d_ERROR_INT_STATUS_TX_OVERFLOW_MASK = ERROR_INT_STATUS_TX_OVERFLOW_MASK,
+    .d_ERROR_INT_STATUS_TX_OVERFLOW_LSB = ERROR_INT_STATUS_TX_OVERFLOW_LSB,
+    .d_COUNT_DEC_ADDRESS = COUNT_DEC_ADDRESS,
+    .d_HOST_INT_STATUS_CPU_MASK = HOST_INT_STATUS_CPU_MASK, 
+    .d_HOST_INT_STATUS_CPU_LSB = HOST_INT_STATUS_CPU_LSB,
+    .d_HOST_INT_STATUS_ERROR_MASK = HOST_INT_STATUS_ERROR_MASK,
+    .d_HOST_INT_STATUS_ERROR_LSB = HOST_INT_STATUS_ERROR_LSB,
+    .d_HOST_INT_STATUS_COUNTER_MASK = HOST_INT_STATUS_COUNTER_MASK,
+    .d_HOST_INT_STATUS_COUNTER_LSB = HOST_INT_STATUS_COUNTER_LSB,
+    .d_RX_LOOKAHEAD_VALID_ADDRESS = RX_LOOKAHEAD_VALID_ADDRESS,
+    .d_WINDOW_DATA_ADDRESS = WINDOW_DATA_ADDRESS,
+    .d_WINDOW_READ_ADDR_ADDRESS = WINDOW_READ_ADDR_ADDRESS,
+    .d_WINDOW_WRITE_ADDR_ADDRESS = WINDOW_WRITE_ADDR_ADDRESS,
+};
+
+#endif
+
+struct hostdef_s *MY_HOST_DEF = &my_host_def;
+
+#else /* } { */
+
+#define INT_STATUS_ENABLE_ERROR_LSB              (hostdef->d_INT_STATUS_ENABLE_ERROR_LSB)
+#define INT_STATUS_ENABLE_ERROR_MASK             (hostdef->d_INT_STATUS_ENABLE_ERROR_MASK)
+#define INT_STATUS_ENABLE_CPU_LSB                (hostdef->d_INT_STATUS_ENABLE_CPU_LSB)
+#define INT_STATUS_ENABLE_CPU_MASK               (hostdef->d_INT_STATUS_ENABLE_CPU_MASK)
+#define INT_STATUS_ENABLE_COUNTER_LSB            (hostdef->d_INT_STATUS_ENABLE_COUNTER_LSB)
+#define INT_STATUS_ENABLE_COUNTER_MASK           (hostdef->d_INT_STATUS_ENABLE_COUNTER_MASK)
+#define INT_STATUS_ENABLE_MBOX_DATA_LSB          (hostdef->d_INT_STATUS_ENABLE_MBOX_DATA_LSB)
+#define INT_STATUS_ENABLE_MBOX_DATA_MASK         (hostdef->d_INT_STATUS_ENABLE_MBOX_DATA_MASK)
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB     (hostdef->d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK    (hostdef->d_ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB      (hostdef->d_ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB)
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK     (hostdef->d_ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
+#define COUNTER_INT_STATUS_ENABLE_BIT_LSB        (hostdef->d_COUNTER_INT_STATUS_ENABLE_BIT_LSB)
+#define COUNTER_INT_STATUS_ENABLE_BIT_MASK       (hostdef->d_COUNTER_INT_STATUS_ENABLE_BIT_MASK)
+#define INT_STATUS_ENABLE_ADDRESS                (hostdef->d_INT_STATUS_ENABLE_ADDRESS)                    
+#define CPU_INT_STATUS_ENABLE_BIT_LSB            (hostdef->d_CPU_INT_STATUS_ENABLE_BIT_LSB)
+#define CPU_INT_STATUS_ENABLE_BIT_MASK           (hostdef->d_CPU_INT_STATUS_ENABLE_BIT_MASK)
+#define HOST_INT_STATUS_ADDRESS                  (hostdef->d_HOST_INT_STATUS_ADDRESS)
+#define CPU_INT_STATUS_ADDRESS                   (hostdef->d_CPU_INT_STATUS_ADDRESS)
+#define ERROR_INT_STATUS_ADDRESS                 (hostdef->d_ERROR_INT_STATUS_ADDRESS)
+#define ERROR_INT_STATUS_WAKEUP_MASK             (hostdef->d_ERROR_INT_STATUS_WAKEUP_MASK)
+#define ERROR_INT_STATUS_WAKEUP_LSB              (hostdef->d_ERROR_INT_STATUS_WAKEUP_LSB)
+#define ERROR_INT_STATUS_RX_UNDERFLOW_MASK       (hostdef->d_ERROR_INT_STATUS_RX_UNDERFLOW_MASK)
+#define ERROR_INT_STATUS_RX_UNDERFLOW_LSB        (hostdef->d_ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
+#define ERROR_INT_STATUS_TX_OVERFLOW_MASK        (hostdef->d_ERROR_INT_STATUS_TX_OVERFLOW_MASK)
+#define ERROR_INT_STATUS_TX_OVERFLOW_LSB         (hostdef->d_ERROR_INT_STATUS_TX_OVERFLOW_LSB)
+#define COUNT_DEC_ADDRESS                        (hostdef->d_COUNT_DEC_ADDRESS)
+#define HOST_INT_STATUS_CPU_MASK                 (hostdef->d_HOST_INT_STATUS_CPU_MASK) 
+#define HOST_INT_STATUS_CPU_LSB                  (hostdef->d_HOST_INT_STATUS_CPU_LSB)
+#define HOST_INT_STATUS_ERROR_MASK               (hostdef->d_HOST_INT_STATUS_ERROR_MASK)
+#define HOST_INT_STATUS_ERROR_LSB                (hostdef->d_HOST_INT_STATUS_ERROR_LSB)
+#define HOST_INT_STATUS_COUNTER_MASK             (hostdef->d_HOST_INT_STATUS_COUNTER_MASK)
+#define HOST_INT_STATUS_COUNTER_LSB              (hostdef->d_HOST_INT_STATUS_COUNTER_LSB)
+#define RX_LOOKAHEAD_VALID_ADDRESS               (hostdef->d_RX_LOOKAHEAD_VALID_ADDRESS)
+#define WINDOW_DATA_ADDRESS                      (hostdef->d_WINDOW_DATA_ADDRESS)
+#define WINDOW_READ_ADDR_ADDRESS                 (hostdef->d_WINDOW_READ_ADDR_ADDRESS)
+#define WINDOW_WRITE_ADDR_ADDRESS                (hostdef->d_WINDOW_WRITE_ADDR_ADDRESS)
+
+/* SET macros */
+#define INT_STATUS_ENABLE_ERROR_SET(x) (((x) << INT_STATUS_ENABLE_ERROR_LSB) & INT_STATUS_ENABLE_ERROR_MASK)
+#define INT_STATUS_ENABLE_CPU_SET(x) (((x) << INT_STATUS_ENABLE_CPU_LSB) & INT_STATUS_ENABLE_CPU_MASK)
+#define INT_STATUS_ENABLE_COUNTER_SET(x) (((x) << INT_STATUS_ENABLE_COUNTER_LSB) & INT_STATUS_ENABLE_COUNTER_MASK)
+#define INT_STATUS_ENABLE_MBOX_DATA_SET(x) (((x) << INT_STATUS_ENABLE_MBOX_DATA_LSB) & INT_STATUS_ENABLE_MBOX_DATA_MASK)
+#define CPU_INT_STATUS_ENABLE_BIT_SET(x) (((x) << CPU_INT_STATUS_ENABLE_BIT_LSB) & CPU_INT_STATUS_ENABLE_BIT_MASK)
+#define ERROR_STATUS_ENABLE_RX_UNDERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_RX_UNDERFLOW_LSB) & ERROR_STATUS_ENABLE_RX_UNDERFLOW_MASK)
+#define ERROR_STATUS_ENABLE_TX_OVERFLOW_SET(x) (((x) << ERROR_STATUS_ENABLE_TX_OVERFLOW_LSB) & ERROR_STATUS_ENABLE_TX_OVERFLOW_MASK)
+#define COUNTER_INT_STATUS_ENABLE_BIT_SET(x) (((x) << COUNTER_INT_STATUS_ENABLE_BIT_LSB) & COUNTER_INT_STATUS_ENABLE_BIT_MASK)
+#define ERROR_INT_STATUS_WAKEUP_GET(x) (((x) & ERROR_INT_STATUS_WAKEUP_MASK) >> ERROR_INT_STATUS_WAKEUP_LSB)
+#define ERROR_INT_STATUS_RX_UNDERFLOW_GET(x) (((x) & ERROR_INT_STATUS_RX_UNDERFLOW_MASK) >> ERROR_INT_STATUS_RX_UNDERFLOW_LSB)
+#define ERROR_INT_STATUS_TX_OVERFLOW_GET(x) (((x) & ERROR_INT_STATUS_TX_OVERFLOW_MASK) >> ERROR_INT_STATUS_TX_OVERFLOW_LSB)
+#define HOST_INT_STATUS_CPU_GET(x) (((x) & HOST_INT_STATUS_CPU_MASK) >> HOST_INT_STATUS_CPU_LSB)
+#define HOST_INT_STATUS_ERROR_GET(x) (((x) & HOST_INT_STATUS_ERROR_MASK) >> HOST_INT_STATUS_ERROR_LSB)
+#define HOST_INT_STATUS_COUNTER_GET(x) (((x) & HOST_INT_STATUS_COUNTER_MASK) >> HOST_INT_STATUS_COUNTER_LSB)
+
+
+extern struct hostdef_s *hostdef;
+
+#endif /* } */
+
+#endif /*HOST_REG_TABLE_H_*/
+
+
diff --git a/host/include/host_version.h b/host/include/host_version.h
new file mode 100644
index 0000000..74f1982
--- /dev/null
+++ b/host/include/host_version.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="host_version.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains version information for the sample host driver for the
+// AR6000 chip
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_VERSION_H_
+#define _HOST_VERSION_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <AR6002/AR6K_version.h>
+
+/*
+ * The version number is made up of major, minor, patch and build
+ * numbers. These are 16 bit numbers.  The build and release script will
+ * set the build number using a Perforce counter.  Here the build number is
+ * set to 9999 so that builds done without the build-release script are easily
+ * identifiable.
+ */
+
+#define ATH_SW_VER_MAJOR      __VER_MAJOR_
+#define ATH_SW_VER_MINOR      __VER_MINOR_
+#define ATH_SW_VER_PATCH      __VER_PATCH_
+#define ATH_SW_VER_BUILD      __BUILD_NUMBER_ 
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HOST_VERSION_H_ */
diff --git a/host/include/htc.h b/host/include/htc.h
new file mode 100644
index 0000000..8462a35
--- /dev/null
+++ b/host/include/htc.h
@@ -0,0 +1,238 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __HTC_H__
+#define __HTC_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#ifndef A_OFFSETOF
+#define A_OFFSETOF(type,field) (unsigned long)(&(((type *)NULL)->field))
+#endif
+
+#define ASSEMBLE_UNALIGNED_UINT16(p,highbyte,lowbyte) \
+        (((A_UINT16)(((A_UINT8 *)(p))[(highbyte)])) << 8 | (A_UINT16)(((A_UINT8 *)(p))[(lowbyte)]))
+
+/* alignment independent macros (little-endian) to fetch UINT16s or UINT8s from a
+ * structure using only the type and field name.
+ * Use these macros if there is the potential for unaligned buffer accesses. */
+#define A_GET_UINT16_FIELD(p,type,field) \
+    ASSEMBLE_UNALIGNED_UINT16(p,\
+                              A_OFFSETOF(type,field) + 1, \
+                              A_OFFSETOF(type,field))
+
+#define A_SET_UINT16_FIELD(p,type,field,value) \
+{                                              \
+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (A_UINT8)(value);        \
+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field) + 1] = (A_UINT8)((value) >> 8); \
+}
+
+#define A_GET_UINT8_FIELD(p,type,field) \
+            ((A_UINT8 *)(p))[A_OFFSETOF(type,field)]
+
+#define A_SET_UINT8_FIELD(p,type,field,value) \
+    ((A_UINT8 *)(p))[A_OFFSETOF(type,field)] = (value)
+
+/****** DANGER DANGER ***************
+ *
+ *   The frame header length and message formats defined herein were
+ *   selected to accommodate optimal alignment for target processing.  This reduces code
+ *   size and improves performance.
+ *
+ *   Any changes to the header length may alter the alignment and cause exceptions
+ *   on the target. When adding to the message structures insure that fields are
+ *   properly aligned.
+ *
+ */
+
+/* HTC frame header */
+typedef PREPACK struct _HTC_FRAME_HDR{
+        /* do not remove or re-arrange these fields, these are minimally required
+         * to take advantage of 4-byte lookaheads in some hardware implementations */
+    A_UINT8   EndpointID;
+    A_UINT8   Flags;
+    A_UINT16  PayloadLen;       /* length of data (including trailer) that follows the header */
+
+    /***** end of 4-byte lookahead ****/
+
+    A_UINT8   ControlBytes[2];
+
+    /* message payload starts after the header */
+
+} POSTPACK HTC_FRAME_HDR;
+
+/* frame header flags */
+
+    /* send direction */
+#define HTC_FLAGS_NEED_CREDIT_UPDATE (1 << 0)
+#define HTC_FLAGS_SEND_BUNDLE        (1 << 1)  /* start or part of bundle */
+    /* receive direction */
+#define HTC_FLAGS_RECV_UNUSED_0      (1 << 0)  /* bit 0 unused */
+#define HTC_FLAGS_RECV_TRAILER       (1 << 1)  /* bit 1 trailer data present */
+#define HTC_FLAGS_RECV_UNUSED_2      (1 << 0)  /* bit 2 unused */
+#define HTC_FLAGS_RECV_UNUSED_3      (1 << 0)  /* bit 3 unused */
+#define HTC_FLAGS_RECV_BUNDLE_CNT_MASK (0xF0)  /* bits 7..4  */
+#define HTC_FLAGS_RECV_BUNDLE_CNT_SHIFT 4
+
+#define HTC_HDR_LENGTH  (sizeof(HTC_FRAME_HDR))
+#define HTC_MAX_TRAILER_LENGTH   255
+#define HTC_MAX_PAYLOAD_LENGTH   (4096 - sizeof(HTC_FRAME_HDR))
+
+/* HTC control message IDs */
+
+#define HTC_MSG_READY_ID                    1
+#define HTC_MSG_CONNECT_SERVICE_ID          2
+#define HTC_MSG_CONNECT_SERVICE_RESPONSE_ID 3
+#define HTC_MSG_SETUP_COMPLETE_ID           4
+#define HTC_MSG_SETUP_COMPLETE_EX_ID        5
+
+#define HTC_MAX_CONTROL_MESSAGE_LENGTH  256
+
+/* base message ID header */
+typedef PREPACK struct {
+    A_UINT16 MessageID;
+} POSTPACK HTC_UNKNOWN_MSG;
+
+/* HTC ready message
+ * direction : target-to-host  */
+typedef PREPACK struct {
+    A_UINT16  MessageID;    /* ID */
+    A_UINT16  CreditCount;  /* number of credits the target can offer */
+    A_UINT16  CreditSize;   /* size of each credit */
+    A_UINT8   MaxEndpoints; /* maximum number of endpoints the target has resources for */
+    A_UINT8   _Pad1;
+} POSTPACK HTC_READY_MSG;
+
+    /* extended HTC ready message */
+typedef PREPACK struct {
+    HTC_READY_MSG   Version2_0_Info;   /* legacy version 2.0 information at the front... */
+    /* extended information */
+    A_UINT8         HTCVersion;
+    A_UINT8         MaxMsgsPerHTCBundle;
+} POSTPACK HTC_READY_EX_MSG;
+
+#define HTC_VERSION_2P0  0x00
+#define HTC_VERSION_2P1  0x01  /* HTC 2.1 */
+
+#define HTC_SERVICE_META_DATA_MAX_LENGTH 128
+
+/* connect service
+ * direction : host-to-target */
+typedef PREPACK struct {
+    A_UINT16  MessageID;
+    A_UINT16  ServiceID;           /* service ID of the service to connect to */
+    A_UINT16  ConnectionFlags;     /* connection flags */
+
+#define HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE (1 << 2)  /* reduce credit dribbling when
+                                                             the host needs credits */
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK             (0x3)
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_FOURTH        0x0
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF          0x1
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_THREE_FOURTHS     0x2
+#define HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_UNITY             0x3
+
+    A_UINT8   ServiceMetaLength;   /* length of meta data that follows */
+    A_UINT8   _Pad1;
+
+    /* service-specific meta data starts after the header */
+
+} POSTPACK HTC_CONNECT_SERVICE_MSG;
+
+/* connect response
+ * direction : target-to-host */
+typedef PREPACK struct {
+    A_UINT16  MessageID;
+    A_UINT16  ServiceID;            /* service ID that the connection request was made */
+    A_UINT8   Status;               /* service connection status */
+    A_UINT8   EndpointID;           /* assigned endpoint ID */
+    A_UINT16  MaxMsgSize;           /* maximum expected message size on this endpoint */
+    A_UINT8   ServiceMetaLength;    /* length of meta data that follows */
+    A_UINT8   _Pad1;
+
+    /* service-specific meta data starts after the header */
+
+} POSTPACK HTC_CONNECT_SERVICE_RESPONSE_MSG;
+
+typedef PREPACK struct {
+    A_UINT16  MessageID;
+    /* currently, no other fields */
+} POSTPACK HTC_SETUP_COMPLETE_MSG;
+
+    /* extended setup completion message */
+typedef PREPACK struct {
+    A_UINT16  MessageID;
+    A_UINT32  SetupFlags;
+    A_UINT8   MaxMsgsPerBundledRecv;
+    A_UINT8   Rsvd[3];
+} POSTPACK HTC_SETUP_COMPLETE_EX_MSG;
+
+#define HTC_SETUP_COMPLETE_FLAGS_ENABLE_BUNDLE_RECV     (1 << 0)
+
+/* connect response status codes */
+#define HTC_SERVICE_SUCCESS      0  /* success */
+#define HTC_SERVICE_NOT_FOUND    1  /* service could not be found */
+#define HTC_SERVICE_FAILED       2  /* specific service failed the connect */
+#define HTC_SERVICE_NO_RESOURCES 3  /* no resources (i.e. no more endpoints) */
+#define HTC_SERVICE_NO_MORE_EP   4  /* specific service is not allowing any more
+                                       endpoints */
+
+/* report record IDs */
+
+#define HTC_RECORD_NULL             0
+#define HTC_RECORD_CREDITS          1
+#define HTC_RECORD_LOOKAHEAD        2
+#define HTC_RECORD_LOOKAHEAD_BUNDLE 3
+
+typedef PREPACK struct {
+    A_UINT8 RecordID;     /* Record ID */
+    A_UINT8 Length;       /* Length of record */
+} POSTPACK HTC_RECORD_HDR;
+
+typedef PREPACK struct {
+    A_UINT8 EndpointID;     /* Endpoint that owns these credits */
+    A_UINT8 Credits;        /* credits to report since last report */
+} POSTPACK HTC_CREDIT_REPORT;
+
+typedef PREPACK struct {
+    A_UINT8 PreValid;         /* pre valid guard */
+    A_UINT8 LookAhead[4];     /* 4 byte lookahead */
+    A_UINT8 PostValid;        /* post valid guard */
+
+   /* NOTE: the LookAhead array is guarded by a PreValid and Post Valid guard bytes.
+    * The PreValid bytes must equal the inverse of the PostValid byte */
+
+} POSTPACK HTC_LOOKAHEAD_REPORT;
+
+typedef PREPACK struct {
+    A_UINT8 LookAhead[4];     /* 4 byte lookahead */
+} POSTPACK HTC_BUNDLED_LOOKAHEAD_REPORT;
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+
+#endif /* __HTC_H__ */
+
diff --git a/host/include/htc_api.h b/host/include/htc_api.h
new file mode 100644
index 0000000..b007051
--- /dev/null
+++ b/host/include/htc_api.h
@@ -0,0 +1,575 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_api.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HTC_API_H_
+#define _HTC_API_H_
+
+#include "htc_packet.h"
+#include <htc.h>
+#include <htc_services.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/* TODO.. for BMI */
+#define ENDPOINT1 0
+// TODO -remove me, but we have to fix BMI first
+#define HTC_MAILBOX_NUM_MAX    4
+
+/* this is the amount of header room required by users of HTC */
+#define HTC_HEADER_LEN         HTC_HDR_LENGTH
+
+typedef void *HTC_HANDLE;
+
+typedef A_UINT16 HTC_SERVICE_ID;
+
+typedef struct _HTC_INIT_INFO {
+    void   *pContext;           /* context for target failure notification */
+    void   (*TargetFailure)(void *Instance, A_STATUS Status);
+} HTC_INIT_INFO;
+
+/* per service connection send completion */
+typedef void   (*HTC_EP_SEND_PKT_COMPLETE)(void *,HTC_PACKET *);
+/* per service connection callback when a plurality of packets have been sent
+ * The HTC_PACKET_QUEUE is a temporary queue object (e.g. freed on return from the callback)
+ * to hold a list of completed send packets.
+ * If the handler cannot fully traverse the packet queue before returning, it should
+ * transfer the items of the queue into the caller's private queue using:
+ *   HTC_PACKET_ENQUEUE() */
+typedef void   (*HTC_EP_SEND_PKT_COMP_MULTIPLE)(void *,HTC_PACKET_QUEUE *);
+/* per service connection pkt received */
+typedef void   (*HTC_EP_RECV_PKT)(void *,HTC_PACKET *);
+/* per service connection callback when a plurality of packets are received
+ * The HTC_PACKET_QUEUE is a temporary queue object (e.g. freed on return from the callback)
+ * to hold a list of recv packets.
+ * If the handler cannot fully traverse the packet queue before returning, it should
+ * transfer the items of the queue into the caller's private queue using:
+ *   HTC_PACKET_ENQUEUE() */
+typedef void   (*HTC_EP_RECV_PKT_MULTIPLE)(void *,HTC_PACKET_QUEUE *);
+
+/* Optional per service connection receive buffer re-fill callback,
+ * On some OSes (like Linux) packets are allocated from a global pool and indicated up
+ * to the network stack.  The driver never gets the packets back from the OS.  For these OSes
+ * a refill callback can be used to allocate and re-queue buffers into HTC.
+ *
+ * On other OSes, the network stack can call into the driver's OS-specifc "return_packet" handler and
+ * the driver can re-queue these buffers into HTC. In this regard a refill callback is
+ * unnecessary */
+typedef void   (*HTC_EP_RECV_REFILL)(void *, HTC_ENDPOINT_ID Endpoint);
+
+/* Optional per service connection receive buffer allocation callback.
+ * On some systems packet buffers are an extremely limited resource.  Rather than
+ * queue largest-possible-sized buffers to HTC, some systems would rather
+ * allocate a specific size as the packet is received.  The trade off is
+ * slightly more processing (callback invoked for each RX packet)
+ * for the benefit of committing fewer buffer resources into HTC.
+ *
+ * The callback is provided the length of the pending packet to fetch. This includes the
+ * HTC header length plus the length of payload.  The callback can return a pointer to
+ * the allocated HTC packet for immediate use.
+ *
+ * Alternatively a variant of this handler can be used to allocate large receive packets as needed.  
+ * For example an application can use the refill mechanism for normal packets and the recv-alloc mechanism to 
+ * handle the case where a large packet buffer is required.  This can significantly reduce the
+ * amount of "committed" memory used to receive packets.
+ *  
+ * */
+typedef HTC_PACKET *(*HTC_EP_RECV_ALLOC)(void *, HTC_ENDPOINT_ID Endpoint, int Length);
+
+typedef enum _HTC_SEND_FULL_ACTION {
+    HTC_SEND_FULL_KEEP = 0,  /* packet that overflowed should be kept in the queue */
+    HTC_SEND_FULL_DROP = 1,  /* packet that overflowed should be dropped */
+} HTC_SEND_FULL_ACTION;
+
+/* Optional per service connection callback when a send queue is full. This can occur if the
+ * host continues queueing up TX packets faster than credits can arrive
+ * To prevent the host (on some Oses like Linux) from continuously queueing packets
+ * and consuming resources, this callback is provided so that that the host
+ * can disable TX in the subsystem (i.e. network stack).
+ * This callback is invoked for each packet that "overflows" the HTC queue. The callback can
+ * determine whether the new packet that overflowed the queue can be kept (HTC_SEND_FULL_KEEP) or
+ * dropped (HTC_SEND_FULL_DROP).  If a packet is dropped, the EpTxComplete handler will be called
+ * and the packet's status field will be set to A_NO_RESOURCE.
+ * Other OSes require a "per-packet" indication for each completed TX packet, this
+ * closed loop mechanism will prevent the network stack from overunning the NIC
+ * The packet to keep or drop is passed for inspection to the registered handler the handler
+ * must ONLY inspect the packet, it may not free or reclaim the packet. */
+typedef HTC_SEND_FULL_ACTION (*HTC_EP_SEND_QUEUE_FULL)(void *, HTC_PACKET *pPacket);
+
+typedef struct _HTC_EP_CALLBACKS {
+    void                     *pContext;     /* context for each callback */
+    HTC_EP_SEND_PKT_COMPLETE EpTxComplete;  /* tx completion callback for connected endpoint */
+    HTC_EP_RECV_PKT          EpRecv;        /* receive callback for connected endpoint */
+    HTC_EP_RECV_REFILL       EpRecvRefill;  /* OPTIONAL receive re-fill callback for connected endpoint */
+    HTC_EP_SEND_QUEUE_FULL   EpSendFull;    /* OPTIONAL send full callback */
+    HTC_EP_RECV_ALLOC        EpRecvAlloc;   /* OPTIONAL recv allocation callback */
+    HTC_EP_RECV_ALLOC        EpRecvAllocThresh;  /* OPTIONAL recv allocation callback based on a threshold */
+    HTC_EP_SEND_PKT_COMP_MULTIPLE EpTxCompleteMultiple; /* OPTIONAL completion handler for multiple complete
+                                                             indications (EpTxComplete must be NULL) */
+    HTC_EP_RECV_PKT_MULTIPLE      EpRecvPktMultiple;      /* OPTIONAL completion handler for multiple
+                                                             recv packet indications (EpRecv must be NULL) */           
+    int                      RecvAllocThreshold;    /* if EpRecvAllocThresh is non-NULL, HTC will compare the 
+                                                       threshold value to the current recv packet length and invoke
+                                                       the EpRecvAllocThresh callback to acquire a packet buffer */
+    int                      RecvRefillWaterMark;   /* if a EpRecvRefill handler is provided, this value
+                                                       can be used to set a trigger refill callback 
+                                                       when the recv queue drops below this value 
+                                                       if set to 0, the refill is only called when packets 
+                                                       are empty */
+} HTC_EP_CALLBACKS;
+
+/* service connection information */
+typedef struct _HTC_SERVICE_CONNECT_REQ {
+    HTC_SERVICE_ID   ServiceID;                 /* service ID to connect to */
+    A_UINT16         ConnectionFlags;           /* connection flags, see htc protocol definition */
+    A_UINT8         *pMetaData;                 /* ptr to optional service-specific meta-data */
+    A_UINT8          MetaDataLength;            /* optional meta data length */
+    HTC_EP_CALLBACKS EpCallbacks;               /* endpoint callbacks */
+    int              MaxSendQueueDepth;         /* maximum depth of any send queue */
+    A_UINT32         LocalConnectionFlags;      /* HTC flags for the host-side (local) connection */
+    unsigned int     MaxSendMsgSize;            /* override max message size in send direction */
+} HTC_SERVICE_CONNECT_REQ;
+
+#define HTC_LOCAL_CONN_FLAGS_ENABLE_SEND_BUNDLE_PADDING (1 << 0)  /* enable send bundle padding for this endpoint */
+
+/* service connection response information */
+typedef struct _HTC_SERVICE_CONNECT_RESP {
+    A_UINT8         *pMetaData;         /* caller supplied buffer to optional meta-data */
+    A_UINT8         BufferLength;       /* length of caller supplied buffer */
+    A_UINT8         ActualLength;       /* actual length of meta data */
+    HTC_ENDPOINT_ID Endpoint;           /* endpoint to communicate over */
+    unsigned int    MaxMsgLength;       /* max length of all messages over this endpoint */
+    A_UINT8         ConnectRespCode;    /* connect response code from target */
+} HTC_SERVICE_CONNECT_RESP;
+
+/* endpoint distribution structure */
+typedef struct _HTC_ENDPOINT_CREDIT_DIST {
+    struct _HTC_ENDPOINT_CREDIT_DIST *pNext;
+    struct _HTC_ENDPOINT_CREDIT_DIST *pPrev;
+    HTC_SERVICE_ID      ServiceID;          /* Service ID (set by HTC) */
+    HTC_ENDPOINT_ID     Endpoint;           /* endpoint for this distribution struct (set by HTC) */
+    A_UINT32            DistFlags;          /* distribution flags, distribution function can
+                                               set default activity using SET_EP_ACTIVE() macro */
+    int                 TxCreditsNorm;      /* credits for normal operation, anything above this
+                                               indicates the endpoint is over-subscribed, this field
+                                               is only relevant to the credit distribution function */
+    int                 TxCreditsMin;       /* floor for credit distribution, this field is
+                                               only relevant to the credit distribution function */
+    int                 TxCreditsAssigned;  /* number of credits assigned to this EP, this field
+                                               is only relevant to the credit dist function */
+    int                 TxCredits;          /* current credits available, this field is used by
+                                               HTC to determine whether a message can be sent or
+                                               must be queued */
+    int                 TxCreditsToDist;    /* pending credits to distribute on this endpoint, this
+                                               is set by HTC when credit reports arrive.
+                                               The credit distribution functions sets this to zero
+                                               when it distributes the credits */
+    int                 TxCreditsSeek;      /* this is the number of credits that the current pending TX
+                                               packet needs to transmit.  This is set by HTC when
+                                               and endpoint needs credits in order to transmit */
+    int                 TxCreditSize;       /* size in bytes of each credit (set by HTC) */
+    int                 TxCreditsPerMaxMsg; /* credits required for a maximum sized messages (set by HTC) */
+    void                *pHTCReserved;      /* reserved for HTC use */    
+    int                 TxQueueDepth;       /* current depth of TX queue , i.e. messages waiting for credits
+                                               This field is valid only when HTC_CREDIT_DIST_ACTIVITY_CHANGE
+                                               or HTC_CREDIT_DIST_SEND_COMPLETE is indicated on an endpoint
+                                               that has non-zero credits to recover
+                                              */
+} HTC_ENDPOINT_CREDIT_DIST;
+
+#define HTC_EP_ACTIVE                            ((A_UINT32) (1u << 31))
+
+/* macro to check if an endpoint has gone active, useful for credit
+ * distributions */
+#define IS_EP_ACTIVE(epDist)  ((epDist)->DistFlags & HTC_EP_ACTIVE)
+#define SET_EP_ACTIVE(epDist) (epDist)->DistFlags |= HTC_EP_ACTIVE
+
+    /* credit distibution code that is passed into the distrbution function,
+     * there are mandatory and optional codes that must be handled */
+typedef enum _HTC_CREDIT_DIST_REASON {
+    HTC_CREDIT_DIST_SEND_COMPLETE = 0,     /* credits available as a result of completed
+                                              send operations (MANDATORY) resulting in credit reports */
+    HTC_CREDIT_DIST_ACTIVITY_CHANGE = 1,   /* a change in endpoint activity occured (OPTIONAL) */
+    HTC_CREDIT_DIST_SEEK_CREDITS,          /* an endpoint needs to "seek" credits (OPTIONAL) */
+    HTC_DUMP_CREDIT_STATE                  /* for debugging, dump any state information that is kept by
+                                              the distribution function */
+} HTC_CREDIT_DIST_REASON;
+
+typedef void (*HTC_CREDIT_DIST_CALLBACK)(void                     *Context,
+                                         HTC_ENDPOINT_CREDIT_DIST *pEPList,
+                                         HTC_CREDIT_DIST_REASON   Reason);
+
+typedef void (*HTC_CREDIT_INIT_CALLBACK)(void *Context,
+                                         HTC_ENDPOINT_CREDIT_DIST *pEPList,
+                                         int                      TotalCredits);
+
+    /* endpoint statistics action */
+typedef enum _HTC_ENDPOINT_STAT_ACTION {
+    HTC_EP_STAT_SAMPLE = 0,                /* only read statistics */
+    HTC_EP_STAT_SAMPLE_AND_CLEAR = 1,      /* sample and immediately clear statistics */
+    HTC_EP_STAT_CLEAR                      /* clear only */
+} HTC_ENDPOINT_STAT_ACTION;
+
+    /* endpoint statistics */
+typedef struct _HTC_ENDPOINT_STATS {
+    A_UINT32  TxCreditLowIndications;  /* number of times the host set the credit-low flag in a send message on
+                                        this endpoint */
+    A_UINT32  TxIssued;               /* running count of total TX packets issued */
+    A_UINT32  TxPacketsBundled;       /* running count of TX packets that were issued in bundles */
+    A_UINT32  TxBundles;              /* running count of TX bundles that were issued */
+    A_UINT32  TxDropped;              /* tx packets that were dropped */
+    A_UINT32  TxCreditRpts;           /* running count of total credit reports received for this endpoint */
+    A_UINT32  TxCreditRptsFromRx;     /* credit reports received from this endpoint's RX packets */
+    A_UINT32  TxCreditRptsFromOther;  /* credit reports received from RX packets of other endpoints */
+    A_UINT32  TxCreditRptsFromEp0;    /* credit reports received from endpoint 0 RX packets */
+    A_UINT32  TxCreditsFromRx;        /* count of credits received via Rx packets on this endpoint */
+    A_UINT32  TxCreditsFromOther;     /* count of credits received via another endpoint */
+    A_UINT32  TxCreditsFromEp0;       /* count of credits received via another endpoint */
+    A_UINT32  TxCreditsConsummed;     /* count of consummed credits */
+    A_UINT32  TxCreditsReturned;      /* count of credits returned */
+    A_UINT32  RxReceived;             /* count of RX packets received */
+    A_UINT32  RxLookAheads;           /* count of lookahead records
+                                         found in messages received on this endpoint */
+    A_UINT32  RxPacketsBundled;       /* count of recv packets received in a bundle */                                     
+    A_UINT32  RxBundleLookAheads;     /* count of number of bundled lookaheads */
+    A_UINT32  RxBundleIndFromHdr;     /* count of the number of bundle indications from the HTC header */
+    A_UINT32  RxAllocThreshHit;       /* count of the number of times the recv allocation threshhold was hit */
+    A_UINT32  RxAllocThreshBytes;     /* total number of bytes */
+} HTC_ENDPOINT_STATS;
+
+/* ------ Function Prototypes ------ */
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Create an instance of HTC over the underlying HIF device
+  @function name: HTCCreate
+  @input:  HifDevice - hif device handle,
+           pInfo - initialization information
+  @output:
+  @return: HTC_HANDLE on success, NULL on failure
+  @notes: 
+  @example:
+  @see also: HTCDestroy
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+HTC_HANDLE HTCCreate(void *HifDevice, HTC_INIT_INFO *pInfo);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get the underlying HIF device handle
+  @function name: HTCGetHifDevice
+  @input:  HTCHandle - handle passed into the AddInstance callback
+  @output:
+  @return: opaque HIF device handle usable in HIF API calls.
+  @notes:
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void       *HTCGetHifDevice(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Set credit distribution parameters
+  @function name: HTCSetCreditDistribution
+  @input:  HTCHandle - HTC handle
+           pCreditDistCont - caller supplied context to pass into distribution functions
+           CreditDistFunc - Distribution function callback
+           CreditDistInit - Credit Distribution initialization callback
+           ServicePriorityOrder - Array containing list of service IDs, lowest index is highest
+                                  priority
+           ListLength - number of elements in ServicePriorityOrder
+  @output:
+  @return:
+  @notes:  The user can set a custom credit distribution function to handle special requirements
+           for each endpoint.  A default credit distribution routine can be used by setting
+           CreditInitFunc to NULL.  The default credit distribution is only provided for simple
+           "fair" credit distribution without regard to any prioritization.
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCSetCreditDistribution(HTC_HANDLE               HTCHandle,
+                                     void                     *pCreditDistContext,
+                                     HTC_CREDIT_DIST_CALLBACK CreditDistFunc,
+                                     HTC_CREDIT_INIT_CALLBACK CreditInitFunc,
+                                     HTC_SERVICE_ID           ServicePriorityOrder[],
+                                     int                      ListLength);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Wait for the target to indicate the HTC layer is ready
+  @function name: HTCWaitTarget
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:  This API blocks until the target responds with an HTC ready message.
+           The caller should not connect services until the target has indicated it is
+           ready.
+  @example:
+  @see also: HTCConnectService
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCWaitTarget(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Start target service communications
+  @function name: HTCStart
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes: This API indicates to the target that the service connection phase is complete
+          and the target can freely start all connected services.  This API should only be
+          called AFTER all service connections have been made.  TCStart will issue a
+          SETUP_COMPLETE message to the target to indicate that all service connections
+          have been made and the target can start communicating over the endpoints.
+  @example:
+  @see also: HTCConnectService
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCStart(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add receive packet to HTC
+  @function name: HTCAddReceivePkt
+  @input:  HTCHandle - HTC handle
+           pPacket - HTC receive packet to add
+  @output:
+  @return: A_OK on success
+  @notes:  user must supply HTC packets for capturing incomming HTC frames.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCAddReceivePkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Connect to an HTC service
+  @function name: HTCConnectService
+  @input:  HTCHandle - HTC handle
+           pReq - connection details
+  @output: pResp - connection response
+  @return:
+  @notes:  Service connections must be performed before HTCStart.  User provides callback handlers
+           for various endpoint events.
+  @example:
+  @see also: HTCStart
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCConnectService(HTC_HANDLE HTCHandle,
+                              HTC_SERVICE_CONNECT_REQ  *pReq,
+                              HTC_SERVICE_CONNECT_RESP *pResp);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Send an HTC packet
+  @function name: HTCSendPkt
+  @input:  HTCHandle - HTC handle
+           pPacket - packet to send
+  @output:
+  @return: A_OK
+  @notes:  Caller must initialize packet using SET_HTC_PACKET_INFO_TX() macro.
+           This interface is fully asynchronous.  On error, HTC SendPkt will
+           call the registered Endpoint callback to cleanup the packet.
+  @example:
+  @see also: HTCFlushEndpoint
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCSendPkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Stop HTC service communications
+  @function name: HTCStop
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes: HTC communications is halted.  All receive and pending TX packets will
+          be flushed.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCStop(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Destory HTC service
+  @function name: HTCDestroy
+  @input: HTCHandle 
+  @output:
+  @return:
+  @notes:  This cleans up all resources allocated by HTCCreate().
+  @example:
+  @see also: HTCCreate
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCDestroy(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Flush pending TX packets
+  @function name: HTCFlushEndpoint
+  @input:  HTCHandle - HTC handle
+           Endpoint - Endpoint to flush
+           Tag - flush tag
+  @output:
+  @return:
+  @notes:  The Tag parameter is used to selectively flush packets with matching tags.
+           The value of 0 forces all packets to be flush regardless of tag.
+  @example:
+  @see also: HTCSendPkt
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCFlushEndpoint(HTC_HANDLE HTCHandle, HTC_ENDPOINT_ID Endpoint, HTC_TX_TAG Tag);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Dump credit distribution state
+  @function name: HTCDumpCreditStates
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:  This dumps all credit distribution information to the debugger
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCDumpCreditStates(HTC_HANDLE HTCHandle);
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Indicate a traffic activity change on an endpoint
+  @function name: HTCIndicateActivityChange
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint in which activity has changed
+           Active - TRUE if active, FALSE if it has become inactive
+  @output:
+  @return:
+  @notes:  This triggers the registered credit distribution function to
+           re-adjust credits for active/inactive endpoints.
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void        HTCIndicateActivityChange(HTC_HANDLE      HTCHandle,
+                                      HTC_ENDPOINT_ID Endpoint,
+                                      A_BOOL          Active);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get endpoint statistics
+  @function name: HTCGetEndpointStatistics
+  @input:  HTCHandle - HTC handle
+           Endpoint - Endpoint identifier
+           Action - action to take with statistics
+  @output:
+           pStats - statistics that were sampled (can be NULL if Action is HTC_EP_STAT_CLEAR)
+
+  @return: TRUE if statistics profiling is enabled, otherwise FALSE.
+
+  @notes:  Statistics is a compile-time option and this function may return FALSE
+           if HTC is not compiled with profiling.
+
+           The caller can specify the statistic "action" to take when sampling
+           the statistics.  This includes:
+
+           HTC_EP_STAT_SAMPLE: The pStats structure is filled with the current values.
+           HTC_EP_STAT_SAMPLE_AND_CLEAR: The structure is filled and the current statistics
+                             are cleared.
+           HTC_EP_STAT_CLEA : the statistics are cleared, the called can pass a NULL value for
+                   pStats
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_BOOL       HTCGetEndpointStatistics(HTC_HANDLE               HTCHandle,
+                                      HTC_ENDPOINT_ID          Endpoint,
+                                      HTC_ENDPOINT_STAT_ACTION Action,
+                                      HTC_ENDPOINT_STATS       *pStats);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Unblock HTC message reception
+  @function name: HTCUnblockRecv
+  @input:  HTCHandle - HTC handle
+  @output:
+  @return:
+  @notes:
+           HTC will block the receiver if the EpRecvAlloc callback fails to provide a packet.
+           The caller can use this API to indicate to HTC when resources (buffers) are available
+           such that the  receiver can be unblocked and HTC may re-attempt fetching the pending message.
+
+           This API is not required if the user uses the EpRecvRefill callback or uses the HTCAddReceivePacket()
+           API to recycle or provide receive packets to HTC.
+
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+void HTCUnblockRecv(HTC_HANDLE HTCHandle);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: send a series of HTC packets  
+  @function name: HTCSendPktsMultiple
+  @input:  HTCHandle - HTC handle
+           pPktQueue - local queue holding packets to send
+  @output:
+  @return: A_OK
+  @notes:  Caller must initialize each packet using SET_HTC_PACKET_INFO_TX() macro.
+           The queue must only contain packets directed at the same endpoint.
+           Caller supplies a pointer to an HTC_PACKET_QUEUE structure holding the TX packets in FIFO order.
+           This API will remove the packets from the pkt queue and place them into the HTC Tx Queue
+           and bundle messages where possible.
+           The caller may allocate the pkt queue on the stack to hold the packets.           
+           This interface is fully asynchronous.  On error, HTCSendPkts will
+           call the registered Endpoint callback to cleanup the packet.
+  @example:
+  @see also: HTCFlushEndpoint
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCSendPktsMultiple(HTC_HANDLE HTCHandle, HTC_PACKET_QUEUE *pPktQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Add multiple receive packets to HTC
+  @function name: HTCAddReceivePktMultiple
+  @input:  HTCHandle - HTC handle
+           pPktQueue - HTC receive packet queue holding packets to add
+  @output:
+  @return: A_OK on success
+  @notes:  user must supply HTC packets for capturing incomming HTC frames.  The caller
+           must initialize each HTC packet using the SET_HTC_PACKET_INFO_RX_REFILL()
+           macro. The queue must only contain recv packets for the same endpoint.
+           Caller supplies a pointer to an HTC_PACKET_QUEUE structure holding the recv packet.
+           This API will remove the packets from the pkt queue and place them into internal
+           recv packet list.
+           The caller may allocate the pkt queue on the stack to hold the packets.           
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_STATUS    HTCAddReceivePktMultiple(HTC_HANDLE HTCHandle, HTC_PACKET_QUEUE *pPktQueue);
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Check if an endpoint is marked active
+  @function name: HTCIsEndpointActive
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint to check for active state
+  @output:
+  @return: returns TRUE if Endpoint is Active
+  @notes:  
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+A_BOOL      HTCIsEndpointActive(HTC_HANDLE      HTCHandle,
+                                HTC_ENDPOINT_ID Endpoint);
+
+
+/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+  @desc: Get the number of recv buffers currently queued into an HTC endpoint
+  @function name: HTCGetNumRecvBuffers
+  @input:  HTCHandle - HTC handle
+           Endpoint - endpoint to check
+  @output:
+  @return: returns number of buffers in queue
+  @notes:  
+  @example:
+  @see also:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*/
+int         HTCGetNumRecvBuffers(HTC_HANDLE      HTCHandle,
+                                 HTC_ENDPOINT_ID Endpoint);
+                                                                      
+/* internally used functions for testing... */
+void HTCEnableRecv(HTC_HANDLE HTCHandle);
+void HTCDisableRecv(HTC_HANDLE HTCHandle);
+A_STATUS HTCWaitForPendingRecv(HTC_HANDLE   HTCHandle,
+                               A_UINT32     TimeoutInMs,
+                               A_BOOL      *pbIsRecvPending);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HTC_API_H_ */
diff --git a/host/include/htc_packet.h b/host/include/htc_packet.h
new file mode 100644
index 0000000..15175cf
--- /dev/null
+++ b/host/include/htc_packet.h
@@ -0,0 +1,227 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_packet.h" company="Atheros">
+//    Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef HTC_PACKET_H_
+#define HTC_PACKET_H_
+
+
+#include "dl_list.h"
+
+/* ------ Endpoint IDS ------ */
+typedef enum
+{
+    ENDPOINT_UNUSED = -1,
+    ENDPOINT_0 = 0,
+    ENDPOINT_1 = 1,
+    ENDPOINT_2 = 2,
+    ENDPOINT_3,
+    ENDPOINT_4,
+    ENDPOINT_5,
+    ENDPOINT_6,
+    ENDPOINT_7,
+    ENDPOINT_8,
+    ENDPOINT_MAX,
+} HTC_ENDPOINT_ID;
+
+struct _HTC_PACKET;
+
+typedef void (* HTC_PACKET_COMPLETION)(void *,struct _HTC_PACKET *);
+
+typedef A_UINT16 HTC_TX_TAG;
+
+typedef struct _HTC_TX_PACKET_INFO {
+    HTC_TX_TAG    Tag;            /* tag used to selective flush packets */
+    int           CreditsUsed;    /* number of credits used for this TX packet (HTC internal) */
+    A_UINT8       SendFlags;      /* send flags (HTC internal) */
+    int           SeqNo;          /* internal seq no for debugging (HTC internal) */
+} HTC_TX_PACKET_INFO;
+
+#define HTC_TX_PACKET_TAG_ALL          0    /* a tag of zero is reserved and used to flush ALL packets */
+#define HTC_TX_PACKET_TAG_INTERNAL     1                                /* internal tags start here */
+#define HTC_TX_PACKET_TAG_USER_DEFINED (HTC_TX_PACKET_TAG_INTERNAL + 9) /* user-defined tags start here */
+
+typedef struct _HTC_RX_PACKET_INFO {
+    A_UINT32    ExpectedHdr;        /* HTC internal use */
+    A_UINT32    HTCRxFlags;         /* HTC internal use */
+    A_UINT32    IndicationFlags;    /* indication flags set on each RX packet indication */
+} HTC_RX_PACKET_INFO;
+
+#define HTC_RX_FLAGS_INDICATE_MORE_PKTS  (1 << 0)   /* more packets on this endpoint are being fetched */
+
+/* wrapper around endpoint-specific packets */
+typedef struct _HTC_PACKET {
+    DL_LIST         ListLink;       /* double link */
+    void            *pPktContext;   /* caller's per packet specific context */
+
+    A_UINT8         *pBufferStart;  /* the true buffer start , the caller can
+                                       store the real buffer start here.  In
+                                       receive callbacks, the HTC layer sets pBuffer
+                                       to the start of the payload past the header. This
+                                       field allows the caller to reset pBuffer when it
+                                       recycles receive packets back to HTC */
+    /*
+     * Pointer to the start of the buffer. In the transmit
+     * direction this points to the start of the payload. In the
+     * receive direction, however, the buffer when queued up
+     * points to the start of the HTC header but when returned
+     * to the caller points to the start of the payload
+     */
+    A_UINT8         *pBuffer;       /* payload start (RX/TX) */
+    A_UINT32        BufferLength;   /* length of buffer */
+    A_UINT32        ActualLength;   /* actual length of payload */
+    HTC_ENDPOINT_ID Endpoint;       /* endpoint that this packet was sent/recv'd from */
+    A_STATUS        Status;         /* completion status */
+    union {
+        HTC_TX_PACKET_INFO  AsTx;   /* Tx Packet specific info */
+        HTC_RX_PACKET_INFO  AsRx;   /* Rx Packet specific info */
+    } PktInfo;
+
+    /* the following fields are for internal HTC use */
+    HTC_PACKET_COMPLETION Completion;   /* completion */
+    void                  *pContext;    /* HTC private completion context */
+} HTC_PACKET;
+
+
+
+#define COMPLETE_HTC_PACKET(p,status)        \
+{                                            \
+    (p)->Status = (status);                  \
+    (p)->Completion((p)->pContext,(p));      \
+}
+
+#define INIT_HTC_PACKET_INFO(p,b,len)             \
+{                                                 \
+    (p)->pBufferStart = (b);                      \
+    (p)->BufferLength = (len);                    \
+}
+
+/* macro to set an initial RX packet for refilling HTC */
+#define SET_HTC_PACKET_INFO_RX_REFILL(p,c,b,len,ep) \
+{                                                 \
+    (p)->pPktContext = (c);                       \
+    (p)->pBuffer = (b);                           \
+    (p)->pBufferStart = (b);                      \
+    (p)->BufferLength = (len);                    \
+    (p)->Endpoint = (ep);                         \
+}
+
+/* fast macro to recycle an RX packet that will be re-queued to HTC */
+#define HTC_PACKET_RESET_RX(p)              \
+    { (p)->pBuffer = (p)->pBufferStart; (p)->ActualLength = 0; }  
+
+/* macro to set packet parameters for TX */
+#define SET_HTC_PACKET_INFO_TX(p,c,b,len,ep,tag)  \
+{                                                 \
+    (p)->pPktContext = (c);                       \
+    (p)->pBuffer = (b);                           \
+    (p)->ActualLength = (len);                    \
+    (p)->Endpoint = (ep);                         \
+    (p)->PktInfo.AsTx.Tag = (tag);                \
+}
+
+/* HTC Packet Queueing Macros */
+typedef struct _HTC_PACKET_QUEUE {
+    DL_LIST     QueueHead;
+    int         Depth;    
+} HTC_PACKET_QUEUE;
+ 
+/* initialize queue */
+#define INIT_HTC_PACKET_QUEUE(pQ)   \
+{                                   \
+    DL_LIST_INIT(&(pQ)->QueueHead); \
+    (pQ)->Depth = 0;                \
+}
+
+/* enqueue HTC packet to the tail of the queue */
+#define HTC_PACKET_ENQUEUE(pQ,p)                        \
+{   DL_ListInsertTail(&(pQ)->QueueHead,&(p)->ListLink); \
+    (pQ)->Depth++;                                      \
+}
+
+/* enqueue HTC packet to the tail of the queue */
+#define HTC_PACKET_ENQUEUE_TO_HEAD(pQ,p)                \
+{   DL_ListInsertHead(&(pQ)->QueueHead,&(p)->ListLink); \
+    (pQ)->Depth++;                                      \
+}
+/* test if a queue is empty */
+#define HTC_QUEUE_EMPTY(pQ)       ((pQ)->Depth == 0)
+/* get packet at head without removing it */
+static INLINE HTC_PACKET *HTC_GET_PKT_AT_HEAD(HTC_PACKET_QUEUE *queue)   {
+    if (queue->Depth == 0) {
+        return NULL; 
+    }  
+    return A_CONTAINING_STRUCT((DL_LIST_GET_ITEM_AT_HEAD(&queue->QueueHead)),HTC_PACKET,ListLink);
+}
+/* remove a packet from a queue, where-ever it is in the queue */
+#define HTC_PACKET_REMOVE(pQ,p)     \
+{                                   \
+    DL_ListRemove(&(p)->ListLink);  \
+    (pQ)->Depth--;                  \
+}
+
+/* dequeue an HTC packet from the head of the queue */
+static INLINE HTC_PACKET *HTC_PACKET_DEQUEUE(HTC_PACKET_QUEUE *queue) {
+    DL_LIST    *pItem = DL_ListRemoveItemFromHead(&queue->QueueHead);
+    if (pItem != NULL) {
+        queue->Depth--;
+        return A_CONTAINING_STRUCT(pItem, HTC_PACKET, ListLink);
+    }
+    return NULL;
+}
+
+/* dequeue an HTC packet from the tail of the queue */
+static INLINE HTC_PACKET *HTC_PACKET_DEQUEUE_TAIL(HTC_PACKET_QUEUE *queue) {
+    DL_LIST    *pItem = DL_ListRemoveItemFromTail(&queue->QueueHead);
+    if (pItem != NULL) {
+        queue->Depth--;
+        return A_CONTAINING_STRUCT(pItem, HTC_PACKET, ListLink);
+    }
+    return NULL;
+}
+
+#define HTC_PACKET_QUEUE_DEPTH(pQ) (pQ)->Depth
+
+
+#define HTC_GET_ENDPOINT_FROM_PKT(p) (p)->Endpoint
+#define HTC_GET_TAG_FROM_PKT(p)      (p)->PktInfo.AsTx.Tag
+
+    /* transfer the packets from one queue to the tail of another queue */
+#define HTC_PACKET_QUEUE_TRANSFER_TO_TAIL(pQDest,pQSrc) \
+{                                                                           \
+    DL_ListTransferItemsToTail(&(pQDest)->QueueHead,&(pQSrc)->QueueHead);   \
+    (pQDest)->Depth += (pQSrc)->Depth;                                      \
+    (pQSrc)->Depth = 0;                                                     \
+}
+
+    /* fast version to init and add a single packet to a queue */
+#define INIT_HTC_PACKET_QUEUE_AND_ADD(pQ,pP) \
+{                                            \
+    DL_LIST_INIT_AND_ADD(&(pQ)->QueueHead,&(pP)->ListLink)  \
+    (pQ)->Depth = 1;                                        \
+}
+    
+#define HTC_PACKET_QUEUE_ITERATE_ALLOW_REMOVE(pQ, pPTemp) \
+    ITERATE_OVER_LIST_ALLOW_REMOVE(&(pQ)->QueueHead,(pPTemp), HTC_PACKET, ListLink) 
+
+#define HTC_PACKET_QUEUE_ITERATE_END ITERATE_END
+        
+#endif /*HTC_PACKET_H_*/
diff --git a/host/include/htc_services.h b/host/include/htc_services.h
new file mode 100644
index 0000000..bba022f
--- /dev/null
+++ b/host/include/htc_services.h
@@ -0,0 +1,52 @@
+//------------------------------------------------------------------------------
+// <copyright file="htc_services.h" company="Atheros">
+//    Copyright (c) 2007 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __HTC_SERVICES_H__
+#define __HTC_SERVICES_H__
+
+/* Current service IDs */
+
+typedef enum {
+    RSVD_SERVICE_GROUP  = 0,
+    WMI_SERVICE_GROUP   = 1, 
+    
+    HTC_TEST_GROUP = 254,
+    HTC_SERVICE_GROUP_LAST = 255
+}HTC_SERVICE_GROUP_IDS;
+
+#define MAKE_SERVICE_ID(group,index) \
+            (int)(((int)group << 8) | (int)(index))
+
+/* NOTE: service ID of 0x0000 is reserved and should never be used */
+#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP,1)
+#define WMI_CONTROL_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,0)
+#define WMI_DATA_BE_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,1)
+#define WMI_DATA_BK_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,2)
+#define WMI_DATA_VI_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,3)
+#define WMI_DATA_VO_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP,4)
+#define WMI_MAX_SERVICES  5
+
+/* raw stream service (i.e. flash, tcmd, calibration apps) */
+#define HTC_RAW_STREAMS_SVC MAKE_SERVICE_ID(HTC_TEST_GROUP,0)
+
+#endif /*HTC_SERVICES_H_*/
diff --git a/host/include/ieee80211.h b/host/include/ieee80211.h
new file mode 100644
index 0000000..c4fd13f
--- /dev/null
+++ b/host/include/ieee80211.h
@@ -0,0 +1,401 @@
+//------------------------------------------------------------------------------
+// <copyright file="ieee80211.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _NET80211_IEEE80211_H_
+#define _NET80211_IEEE80211_H_
+
+#include "athstartpack.h"
+
+/*
+ * 802.11 protocol definitions.
+ */
+#define IEEE80211_WEP_KEYLEN        5   /* 40bit */
+#define IEEE80211_WEP_IVLEN         3   /* 24bit */
+#define IEEE80211_WEP_KIDLEN        1   /* 1 octet */
+#define IEEE80211_WEP_CRCLEN        4   /* CRC-32 */
+#define IEEE80211_WEP_NKID          4   /* number of key ids */
+
+/*
+ * 802.11i defines an extended IV for use with non-WEP ciphers.
+ * When the EXTIV bit is set in the key id byte an additional
+ * 4 bytes immediately follow the IV for TKIP.  For CCMP the
+ * EXTIV bit is likewise set but the 8 bytes represent the
+ * CCMP header rather than IV+extended-IV.
+ */
+#define IEEE80211_WEP_EXTIV         0x20
+#define IEEE80211_WEP_EXTIVLEN      4   /* extended IV length */
+#define IEEE80211_WEP_MICLEN        8   /* trailing MIC */
+
+#define IEEE80211_CRC_LEN           4
+
+#ifdef WAPI_ENABLE
+#define IEEE80211_WAPI_EXTIVLEN      10   /* extended IV length */
+#endif /* WAPI ENABLE */
+
+
+#define IEEE80211_ADDR_LEN  6       /* size of 802.11 address */
+/* is 802.11 address multicast/broadcast? */
+#define IEEE80211_IS_MULTICAST(_a)  (*(_a) & 0x01)
+#define IEEE80211_IS_BROADCAST(_a)  (*(_a) == 0xFF)
+#define WEP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
+#define WEP_TRAILER IEEE80211_WEP_CRCLEN
+#define CCMP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define CCMP_TRAILER IEEE80211_WEP_MICLEN
+#define TKIP_HEADER (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + \
+                    IEEE80211_WEP_EXTIVLEN)
+#define TKIP_TRAILER IEEE80211_WEP_CRCLEN
+#define TKIP_MICLEN  IEEE80211_WEP_MICLEN
+
+
+#define IEEE80211_ADDR_EQ(addr1, addr2)     \
+    (A_MEMCMP(addr1, addr2, IEEE80211_ADDR_LEN) == 0)
+
+#define IEEE80211_ADDR_COPY(dst,src)    A_MEMCPY(dst,src,IEEE80211_ADDR_LEN)
+
+#define IEEE80211_KEYBUF_SIZE 16
+#define IEEE80211_MICBUF_SIZE (8+8)  /* space for both tx and rx */
+
+/*
+ * NB: these values are ordered carefully; there are lots of
+ * of implications in any reordering.  In particular beware
+ * that 4 is not used to avoid conflicting with IEEE80211_F_PRIVACY.
+ */
+#define IEEE80211_CIPHER_WEP            0
+#define IEEE80211_CIPHER_TKIP           1
+#define IEEE80211_CIPHER_AES_OCB        2
+#define IEEE80211_CIPHER_AES_CCM        3
+#define IEEE80211_CIPHER_CKIP           5
+#define IEEE80211_CIPHER_CCKM_KRK       6
+#define IEEE80211_CIPHER_NONE           7       /* pseudo value */
+
+#define IEEE80211_CIPHER_MAX            (IEEE80211_CIPHER_NONE+1)
+
+#define IEEE80211_IS_VALID_WEP_CIPHER_LEN(len) \
+        (((len) == 5) || ((len) == 13) || ((len) == 16))
+
+
+
+/*
+ * generic definitions for IEEE 802.11 frames
+ */
+PREPACK struct ieee80211_frame {
+    A_UINT8    i_fc[2];
+    A_UINT8    i_dur[2];
+    A_UINT8    i_addr1[IEEE80211_ADDR_LEN];
+    A_UINT8    i_addr2[IEEE80211_ADDR_LEN];
+    A_UINT8    i_addr3[IEEE80211_ADDR_LEN];
+    A_UINT8    i_seq[2];
+    /* possibly followed by addr4[IEEE80211_ADDR_LEN]; */
+    /* see below */
+} POSTPACK;
+
+PREPACK struct ieee80211_qosframe {
+    A_UINT8 i_fc[2];
+    A_UINT8 i_dur[2];
+    A_UINT8 i_addr1[IEEE80211_ADDR_LEN];
+    A_UINT8 i_addr2[IEEE80211_ADDR_LEN];
+    A_UINT8 i_addr3[IEEE80211_ADDR_LEN];
+    A_UINT8 i_seq[2];
+    A_UINT8 i_qos[2];
+} POSTPACK;
+
+#define IEEE80211_FC0_VERSION_MASK          0x03
+#define IEEE80211_FC0_VERSION_SHIFT         0
+#define IEEE80211_FC0_VERSION_0             0x00
+#define IEEE80211_FC0_TYPE_MASK             0x0c
+#define IEEE80211_FC0_TYPE_SHIFT            2
+#define IEEE80211_FC0_TYPE_MGT              0x00
+#define IEEE80211_FC0_TYPE_CTL              0x04
+#define IEEE80211_FC0_TYPE_DATA             0x08
+
+#define IEEE80211_FC0_SUBTYPE_MASK          0xf0
+#define IEEE80211_FC0_SUBTYPE_SHIFT         4
+/* for TYPE_MGT */
+#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ     0x00
+#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP    0x10
+#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ   0x20
+#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP  0x30
+#define IEEE80211_FC0_SUBTYPE_PROBE_REQ     0x40
+#define IEEE80211_FC0_SUBTYPE_PROBE_RESP    0x50
+#define IEEE80211_FC0_SUBTYPE_BEACON        0x80
+#define IEEE80211_FC0_SUBTYPE_ATIM          0x90
+#define IEEE80211_FC0_SUBTYPE_DISASSOC      0xa0
+#define IEEE80211_FC0_SUBTYPE_AUTH          0xb0
+#define IEEE80211_FC0_SUBTYPE_DEAUTH        0xc0
+/* for TYPE_CTL */
+#define IEEE80211_FC0_SUBTYPE_PS_POLL       0xa0
+#define IEEE80211_FC0_SUBTYPE_RTS           0xb0
+#define IEEE80211_FC0_SUBTYPE_CTS           0xc0
+#define IEEE80211_FC0_SUBTYPE_ACK           0xd0
+#define IEEE80211_FC0_SUBTYPE_CF_END        0xe0
+#define IEEE80211_FC0_SUBTYPE_CF_END_ACK    0xf0
+/* for TYPE_DATA (bit combination) */
+#define IEEE80211_FC0_SUBTYPE_DATA          0x00
+#define IEEE80211_FC0_SUBTYPE_CF_ACK        0x10
+#define IEEE80211_FC0_SUBTYPE_CF_POLL       0x20
+#define IEEE80211_FC0_SUBTYPE_CF_ACPL       0x30
+#define IEEE80211_FC0_SUBTYPE_NODATA        0x40
+#define IEEE80211_FC0_SUBTYPE_CFACK         0x50
+#define IEEE80211_FC0_SUBTYPE_CFPOLL        0x60
+#define IEEE80211_FC0_SUBTYPE_CF_ACK_CF_ACK 0x70
+#define IEEE80211_FC0_SUBTYPE_QOS           0x80
+#define IEEE80211_FC0_SUBTYPE_QOS_NULL      0xc0
+
+#define IEEE80211_FC1_DIR_MASK              0x03
+#define IEEE80211_FC1_DIR_NODS              0x00    /* STA->STA */
+#define IEEE80211_FC1_DIR_TODS              0x01    /* STA->AP  */
+#define IEEE80211_FC1_DIR_FROMDS            0x02    /* AP ->STA */
+#define IEEE80211_FC1_DIR_DSTODS            0x03    /* AP ->AP  */
+
+#define IEEE80211_FC1_MORE_FRAG             0x04
+#define IEEE80211_FC1_RETRY                 0x08
+#define IEEE80211_FC1_PWR_MGT               0x10
+#define IEEE80211_FC1_MORE_DATA             0x20
+#define IEEE80211_FC1_WEP                   0x40
+#define IEEE80211_FC1_ORDER                 0x80
+
+#define IEEE80211_SEQ_FRAG_MASK             0x000f
+#define IEEE80211_SEQ_FRAG_SHIFT            0
+#define IEEE80211_SEQ_SEQ_MASK              0xfff0
+#define IEEE80211_SEQ_SEQ_SHIFT             4
+
+#define IEEE80211_NWID_LEN                  32
+
+/*
+ * 802.11 rate set.
+ */
+#define IEEE80211_RATE_SIZE     8       /* 802.11 standard */
+#define IEEE80211_RATE_MAXSIZE  15      /* max rates we'll handle */
+
+#define WMM_NUM_AC                  4   /* 4 AC categories */
+
+#define WMM_PARAM_ACI_M         0x60    /* Mask for ACI field */
+#define WMM_PARAM_ACI_S         5   /* Shift for ACI field */
+#define WMM_PARAM_ACM_M         0x10    /* Mask for ACM bit */
+#define WMM_PARAM_ACM_S         4       /* Shift for ACM bit */
+#define WMM_PARAM_AIFSN_M       0x0f    /* Mask for aifsn field */
+#define WMM_PARAM_LOGCWMIN_M    0x0f    /* Mask for CwMin field (in log) */
+#define WMM_PARAM_LOGCWMAX_M    0xf0    /* Mask for CwMax field (in log) */
+#define WMM_PARAM_LOGCWMAX_S    4   /* Shift for CwMax field */
+
+#define WMM_AC_TO_TID(_ac) (       \
+    ((_ac) == WMM_AC_VO) ? 6 : \
+    ((_ac) == WMM_AC_VI) ? 5 : \
+    ((_ac) == WMM_AC_BK) ? 1 : \
+    0)
+
+#define TID_TO_WMM_AC(_tid) (      \
+    ((_tid) < 1) ? WMM_AC_BE : \
+    ((_tid) < 3) ? WMM_AC_BK : \
+    ((_tid) < 6) ? WMM_AC_VI : \
+    WMM_AC_VO)
+/*
+ * Management information element payloads.
+ */
+
+enum {
+    IEEE80211_ELEMID_SSID       = 0,
+    IEEE80211_ELEMID_RATES      = 1,
+    IEEE80211_ELEMID_FHPARMS    = 2,
+    IEEE80211_ELEMID_DSPARMS    = 3,
+    IEEE80211_ELEMID_CFPARMS    = 4,
+    IEEE80211_ELEMID_TIM        = 5,
+    IEEE80211_ELEMID_IBSSPARMS  = 6,
+    IEEE80211_ELEMID_COUNTRY    = 7,
+    IEEE80211_ELEMID_CHALLENGE  = 16,
+    /* 17-31 reserved for challenge text extension */
+    IEEE80211_ELEMID_PWRCNSTR   = 32,
+    IEEE80211_ELEMID_PWRCAP     = 33,
+    IEEE80211_ELEMID_TPCREQ     = 34,
+    IEEE80211_ELEMID_TPCREP     = 35,
+    IEEE80211_ELEMID_SUPPCHAN   = 36,
+    IEEE80211_ELEMID_CHANSWITCH = 37,
+    IEEE80211_ELEMID_MEASREQ    = 38,
+    IEEE80211_ELEMID_MEASREP    = 39,
+    IEEE80211_ELEMID_QUIET      = 40,
+    IEEE80211_ELEMID_IBSSDFS    = 41,
+    IEEE80211_ELEMID_ERP        = 42,
+    IEEE80211_ELEMID_HTCAP_ANA  = 45,   /* Address ANA, and non-ANA story, for interop. CL#171733 */
+    IEEE80211_ELEMID_RSN        = 48,
+    IEEE80211_ELEMID_XRATES     = 50,
+    IEEE80211_ELEMID_HTINFO_ANA = 61,
+#ifdef WAPI_ENABLE
+    IEEE80211_ELEMID_WAPI       = 68,
+#endif
+    IEEE80211_ELEMID_TPC        = 150,
+    IEEE80211_ELEMID_CCKM       = 156,
+    IEEE80211_ELEMID_VENDOR     = 221,  /* vendor private */
+};
+
+#define ATH_OUI             0x7f0300        /* Atheros OUI */
+#define ATH_OUI_TYPE        0x01
+#define ATH_OUI_SUBTYPE     0x01
+#define ATH_OUI_VERSION     0x00
+
+#define WPA_OUI             0xf25000
+#define WPA_OUI_TYPE        0x01
+#define WPA_VERSION         1          /* current supported version */
+
+#define WPA_CSE_NULL        0x00
+#define WPA_CSE_WEP40       0x01
+#define WPA_CSE_TKIP        0x02
+#define WPA_CSE_CCMP        0x04
+#define WPA_CSE_WEP104      0x05
+
+#define WPA_ASE_NONE        0x00
+#define WPA_ASE_8021X_UNSPEC    0x01
+#define WPA_ASE_8021X_PSK   0x02
+
+#define RSN_OUI         0xac0f00
+#define RSN_VERSION     1       /* current supported version */
+
+#define RSN_CSE_NULL        0x00
+#define RSN_CSE_WEP40       0x01
+#define RSN_CSE_TKIP        0x02
+#define RSN_CSE_WRAP        0x03
+#define RSN_CSE_CCMP        0x04
+#define RSN_CSE_WEP104      0x05
+
+#define RSN_ASE_NONE            0x00
+#define RSN_ASE_8021X_UNSPEC    0x01
+#define RSN_ASE_8021X_PSK       0x02
+
+#define RSN_CAP_PREAUTH         0x01
+
+#define WMM_OUI                 0xf25000
+#define WMM_OUI_TYPE            0x02
+#define WMM_INFO_OUI_SUBTYPE    0x00
+#define WMM_PARAM_OUI_SUBTYPE   0x01
+#define WMM_VERSION             1
+
+/* WMM stream classes */
+#define WMM_NUM_AC  4
+#define WMM_AC_BE   0       /* best effort */
+#define WMM_AC_BK   1       /* background */
+#define WMM_AC_VI   2       /* video */
+#define WMM_AC_VO   3       /* voice */
+
+/* TSPEC related */
+#define ACTION_CATEGORY_CODE_TSPEC                 17
+#define ACTION_CODE_TSPEC_ADDTS                    0
+#define ACTION_CODE_TSPEC_ADDTS_RESP               1
+#define ACTION_CODE_TSPEC_DELTS                    2
+
+typedef enum {
+    TSPEC_STATUS_CODE_ADMISSION_ACCEPTED = 0,
+    TSPEC_STATUS_CODE_ADDTS_INVALID_PARAMS = 0x1,
+    TSPEC_STATUS_CODE_ADDTS_REQUEST_REFUSED = 0x3,
+    TSPEC_STATUS_CODE_UNSPECIFIED_QOS_RELATED_FAILURE = 0xC8,
+    TSPEC_STATUS_CODE_REQUESTED_REFUSED_POLICY_CONFIGURATION = 0xC9,
+    TSPEC_STATUS_CODE_INSUFFCIENT_BANDWIDTH = 0xCA,
+    TSPEC_STATUS_CODE_INVALID_PARAMS = 0xCB,
+    TSPEC_STATUS_CODE_DELTS_SENT    = 0x30,
+    TSPEC_STATUS_CODE_DELTS_RECV    = 0x31,
+} TSPEC_STATUS_CODE;
+
+#define TSPEC_TSID_MASK             0xF
+#define TSPEC_TSID_S                1
+
+/*
+ * WMM/802.11e Tspec Element
+ */
+typedef PREPACK struct wmm_tspec_ie_t {
+    A_UINT8     elementId;
+    A_UINT8     len;
+    A_UINT8     oui[3];
+    A_UINT8     ouiType;
+    A_UINT8     ouiSubType;
+    A_UINT8     version;
+    A_UINT16    tsInfo_info;
+    A_UINT8     tsInfo_reserved;
+    A_UINT16    nominalMSDU;
+    A_UINT16    maxMSDU;
+    A_UINT32    minServiceInt;
+    A_UINT32    maxServiceInt;
+    A_UINT32    inactivityInt;
+    A_UINT32    suspensionInt;
+    A_UINT32    serviceStartTime;
+    A_UINT32    minDataRate;
+    A_UINT32    meanDataRate;
+    A_UINT32    peakDataRate;
+    A_UINT32    maxBurstSize;
+    A_UINT32    delayBound;
+    A_UINT32    minPhyRate;
+    A_UINT16    sba;
+    A_UINT16    mediumTime;
+} POSTPACK WMM_TSPEC_IE;
+
+
+/*
+ * BEACON management packets
+ *
+ *  octet timestamp[8]
+ *  octet beacon interval[2]
+ *  octet capability information[2]
+ *  information element
+ *      octet elemid
+ *      octet length
+ *      octet information[length]
+ */
+
+#define IEEE80211_BEACON_INTERVAL(beacon) \
+    ((beacon)[8] | ((beacon)[9] << 8))
+#define IEEE80211_BEACON_CAPABILITY(beacon) \
+    ((beacon)[10] | ((beacon)[11] << 8))
+
+#define IEEE80211_CAPINFO_ESS               0x0001
+#define IEEE80211_CAPINFO_IBSS              0x0002
+#define IEEE80211_CAPINFO_CF_POLLABLE       0x0004
+#define IEEE80211_CAPINFO_CF_POLLREQ        0x0008
+#define IEEE80211_CAPINFO_PRIVACY           0x0010
+#define IEEE80211_CAPINFO_SHORT_PREAMBLE    0x0020
+#define IEEE80211_CAPINFO_PBCC              0x0040
+#define IEEE80211_CAPINFO_CHNL_AGILITY      0x0080
+/* bits 8-9 are reserved */
+#define IEEE80211_CAPINFO_SHORT_SLOTTIME    0x0400
+#define IEEE80211_CAPINFO_APSD              0x0800
+/* bit 12 is reserved */
+#define IEEE80211_CAPINFO_DSSSOFDM          0x2000
+/* bits 14-15 are reserved */
+
+/*
+ * Authentication Modes
+ */
+
+enum ieee80211_authmode {
+    IEEE80211_AUTH_NONE     = 0,
+    IEEE80211_AUTH_OPEN     = 1,
+    IEEE80211_AUTH_SHARED   = 2,
+    IEEE80211_AUTH_8021X    = 3,
+    IEEE80211_AUTH_AUTO     = 4,   /* auto-select/accept */
+    /* NB: these are used only for ioctls */
+    IEEE80211_AUTH_WPA      = 5,  /* WPA/RSN  w/ 802.1x */
+    IEEE80211_AUTH_WPA_PSK  = 6,  /* WPA/RSN  w/ PSK */
+    IEEE80211_AUTH_WPA_CCKM = 7,  /* WPA/RSN IE  w/ CCKM */
+};
+
+#define IEEE80211_PS_MAX_QUEUE    50 /*Maximum no of buffers that can be queues for PS*/
+
+#include "athendpack.h"
+
+#endif /* _NET80211_IEEE80211_H_ */
diff --git a/host/include/ieee80211_node.h b/host/include/ieee80211_node.h
new file mode 100644
index 0000000..b3808c2
--- /dev/null
+++ b/host/include/ieee80211_node.h
@@ -0,0 +1,92 @@
+//------------------------------------------------------------------------------
+// <copyright file="ieee80211_node.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _IEEE80211_NODE_H_
+#define _IEEE80211_NODE_H_
+
+/*
+ * Node locking definitions.
+ */
+#define IEEE80211_NODE_LOCK_INIT(_nt)   A_MUTEX_INIT(&(_nt)->nt_nodelock)
+#define IEEE80211_SCAN_REPORT_LOCK_INIT(_nt)   A_MUTEX_INIT(&(_nt)->nt_scanReportLock)
+
+#define IEEE80211_NODE_LOCK_DESTROY(_nt) if (A_IS_MUTEX_VALID(&(_nt)->nt_nodelock)) { \
+                                               A_MUTEX_DELETE(&(_nt)->nt_nodelock); }
+#define IEEE80211_SCAN_REPORT_LOCK_DESTROY(_nt) if (A_IS_MUTEX_VALID(&(_nt)->nt_scanReportLock)) { \
+                                               A_MUTEX_DELETE(&(_nt)->nt_scanReportLock); }
+       
+#define IEEE80211_NODE_LOCK(_nt)        A_MUTEX_LOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_UNLOCK(_nt)      A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_SCAN_REPORT_LOCK(_nt)        A_MUTEX_LOCK(&(_nt)->nt_scanReportLock)
+#define IEEE80211_SCAN_REPORT_UNLOCK(_nt)      A_MUTEX_UNLOCK(&(_nt)->nt_scanReportLock)
+
+#define IEEE80211_NODE_LOCK_BH(_nt)     A_MUTEX_LOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_UNLOCK_BH(_nt)   A_MUTEX_UNLOCK(&(_nt)->nt_nodelock)
+#define IEEE80211_NODE_LOCK_ASSERT(_nt)
+
+/*
+ * Node reference counting definitions.
+ *
+ * ieee80211_node_initref   initialize the reference count to 1
+ * ieee80211_node_incref    add a reference
+ * ieee80211_node_decref    remove a reference
+ * ieee80211_node_dectestref    remove a reference and return 1 if this
+ *              is the last reference, otherwise 0
+ * ieee80211_node_refcnt    reference count for printing (only)
+ */
+#define ieee80211_node_initref(_ni)     ((_ni)->ni_refcnt = 1)
+#define ieee80211_node_incref(_ni)      ((_ni)->ni_refcnt++)
+#define ieee80211_node_decref(_ni)      ((_ni)->ni_refcnt--)
+#define ieee80211_node_dectestref(_ni)  (((_ni)->ni_refcnt--) == 1)
+#define ieee80211_node_refcnt(_ni)      ((_ni)->ni_refcnt)
+
+#define IEEE80211_NODE_HASHSIZE 32
+/* simple hash is enough for variation of macaddr */
+#define IEEE80211_NODE_HASH(addr)   \
+    (((const A_UINT8 *)(addr))[IEEE80211_ADDR_LEN - 1] % \
+        IEEE80211_NODE_HASHSIZE)
+
+/*
+ * Table of ieee80211_node instances.  Each ieee80211com
+ * has at least one for holding the scan candidates.
+ * When operating as an access point or in ibss mode there
+ * is a second table for associated stations or neighbors.
+ */
+struct ieee80211_node_table {
+    void                   *nt_wmip;       /* back reference */
+    A_MUTEX_T               nt_nodelock;    /* on node table */
+    struct bss              *nt_node_first; /* information of all nodes */
+    struct bss              *nt_node_last;  /* information of all nodes */
+    struct bss              *nt_hash[IEEE80211_NODE_HASHSIZE];
+    const char              *nt_name;   /* for debugging */
+    A_UINT32                nt_scangen; /* gen# for timeout scan */
+    A_UINT32                nt_nodeAge; /* node aging time */
+#ifdef OS_ROAM_MANAGEMENT
+    A_UINT32                nt_si_gen; /* gen# for scan indication*/
+#endif
+    A_MUTEX_T               nt_scanReportLock;    /* to synchronize between scan ioctl and bssinfo event */
+};
+
+#define WLAN_NODE_INACT_TIMEOUT_MSEC            120000
+#define WLAN_NODE_INACT_CNT            4
+
+#endif /* _IEEE80211_NODE_H_ */
diff --git a/host/include/ini_dset.h b/host/include/ini_dset.h
new file mode 100644
index 0000000..3d80da7
--- /dev/null
+++ b/host/include/ini_dset.h
@@ -0,0 +1,83 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _INI_DSET_H_
+#define _INI_DSET_H_
+
+/*
+ * Each of these represents a WHAL INI table, which consists
+ * of an "address column" followed by 1 or more "value columns".
+ *
+ * Software uses the base WHAL_INI_DATA_ID+column to access a
+ * DataSet that holds a particular column of data.
+ */
+typedef enum {
+#if defined(AR6002_REV4) || defined(AR6003) || defined(AR6002_REV6)
+/* Add these definitions for compatability  */
+#define WHAL_INI_DATA_ID_BB_RFGAIN_LNA1 WHAL_INI_DATA_ID_BB_RFGAIN
+#define WHAL_INI_DATA_ID_BB_RFGAIN_LNA2 WHAL_INI_DATA_ID_BB_RFGAIN
+    WHAL_INI_DATA_ID_NULL               =0,
+    WHAL_INI_DATA_ID_MODE_SPECIFIC      =1,  /* 2,3,4,5 */
+    WHAL_INI_DATA_ID_COMMON             =6,  /* 7 */
+    WHAL_INI_DATA_ID_BB_RFGAIN          =8,  /* 9,10 */
+#ifdef FPGA
+    WHAL_INI_DATA_ID_ANALOG_BANK0       =11, /* 12 */
+    WHAL_INI_DATA_ID_ANALOG_BANK1       =13, /* 14 */
+    WHAL_INI_DATA_ID_ANALOG_BANK2       =15, /* 16 */
+    WHAL_INI_DATA_ID_ANALOG_BANK3       =17, /* 18, 19 */
+    WHAL_INI_DATA_ID_ANALOG_BANK6       =20, /* 21,22 */
+    WHAL_INI_DATA_ID_ANALOG_BANK7       =23, /* 24 */
+    WHAL_INI_DATA_ID_ADDAC              =25, /* 26 */
+#else
+    WHAL_INI_DATA_ID_ANALOG_COMMON      =11, /* 12 */ 
+    WHAL_INI_DATA_ID_ANALOG_MODE_SPECIFIC=13, /* 14,15 */ 
+    WHAL_INI_DATA_ID_ANALOG_BANK6       =16, /* 17,18 */
+    WHAL_INI_DATA_ID_MODE_OVERRIDES     =19, /* 20,21,22,23 */
+    WHAL_INI_DATA_ID_COMMON_OVERRIDES   =24, /* 25 */
+    WHAL_INI_DATA_ID_ANALOG_OVERRIDES   =26, /* 27,28 */
+#endif /* FPGA */
+#else
+    WHAL_INI_DATA_ID_NULL               =0,
+    WHAL_INI_DATA_ID_MODE_SPECIFIC      =1,  /* 2,3 */
+    WHAL_INI_DATA_ID_COMMON             =4,  /* 5 */
+    WHAL_INI_DATA_ID_BB_RFGAIN          =6,  /* 7,8 */
+#define WHAL_INI_DATA_ID_BB_RFGAIN_LNA1 WHAL_INI_DATA_ID_BB_RFGAIN
+    WHAL_INI_DATA_ID_ANALOG_BANK1       =9,  /* 10 */
+    WHAL_INI_DATA_ID_ANALOG_BANK2       =11, /* 12 */
+    WHAL_INI_DATA_ID_ANALOG_BANK3       =13, /* 14, 15 */
+    WHAL_INI_DATA_ID_ANALOG_BANK6       =16, /* 17, 18 */
+    WHAL_INI_DATA_ID_ANALOG_BANK7       =19, /* 20 */
+    WHAL_INI_DATA_ID_MODE_OVERRIDES     =21, /* 22,23 */
+    WHAL_INI_DATA_ID_COMMON_OVERRIDES   =24, /* 25 */
+    WHAL_INI_DATA_ID_ANALOG_OVERRIDES   =26, /* 27,28 */
+    WHAL_INI_DATA_ID_BB_RFGAIN_LNA2     =29, /* 30,31 */
+#endif
+    WHAL_INI_DATA_ID_MAX                =31
+} WHAL_INI_DATA_ID;
+
+typedef PREPACK struct {
+    A_UINT16 freqIndex; // 1 - A mode 2 - B or G mode 0 - common
+    A_UINT16 offset;
+    A_UINT32 newValue;
+} POSTPACK INI_DSET_REG_OVERRIDE;
+
+#endif
diff --git a/host/include/iot_flashotp.h b/host/include/iot_flashotp.h
new file mode 100644
index 0000000..67c24fc
--- /dev/null
+++ b/host/include/iot_flashotp.h
@@ -0,0 +1,55 @@
+#ifndef _IOT_FLASHOTP_H_
+#define _IOT_FLASHOTP_H_
+/******************************************/
+/* firmware input param value definitions */
+/******************************************/
+/* IOTFLASHOTP_PARAM_SKIP_OTP - instructs firmware to skip OTP operations */
+#define IOTFLASHOTP_PARAM_SKIP_OTP                  (0x00000001)
+/* IOTFLASHOTP_PARAM_SKIP_FLASH - instructs firmware to skip Flash operations */
+#define IOTFLASHOTP_PARAM_SKIP_FLASH                (0x00000002)
+/* IOTFLASHOTP_PARAM_USE_NVRAM_CONFIG_FROM_OTP - instructs firmware to use NVRAM config found in OTP
+ *  to access flash. */
+#define IOTFLASHOTP_PARAM_USE_NVRAM_CONFIG_FROM_OTP (0x00000004)
+/*************************************/
+/* firmware return value definitions */
+/*************************************/
+#define IOTFLASHOTP_RESULT_OTP_SUCCESS              (0x00000001)
+#define IOTFLASHOTP_RESULT_OTP_FAILED               (0x00000002)
+#define IOTFLASHOTP_RESULT_OTP_NOT_WRITTEN          (0x00000004)
+#define IOTFLASHOTP_RESULT_OTP_SKIPPED              (0x00000008)
+#define IOTFLASHOTP_RESULT_OTP_POS_MASK             (0x0000000f)
+#define IOTFLASHOTP_RESULT_OTP_POS_SHIFT            (8)
+#define IOTFLASHOTP_RESULT_OTP_MASK                 (0x0000ffff)
+
+#define IOTFLASHOTP_RESULT_FLASH_SUCCESS            (0x00010000)
+#define IOTFLASHOTP_RESULT_FLASH_FAILED             (0x00020000)
+#define IOTFLASHOTP_RESULT_FLASH_VALIDATE_FAILED    (0x00040000)
+#define IOTFLASHOTP_RESULT_FLASH_SKIPPED            (0x00080000)
+#define IOTFLASHOTP_RESULT_FLASH_MASK               (0xffff0000)
+
+
+#if !defined(AR6002_REV4)
+typedef unsigned long A_UINT32;
+#endif
+
+typedef struct{
+    A_UINT32 length; // length of binary in bytes
+    A_UINT32 loadAddr; // address to which the image should be loaded
+    A_UINT32 execAddr; // address from which execution should start
+    A_UINT32 MACOffset; // offset in image of MAC address location.
+    A_UINT32 ChksumOffset; // offset of checksum location <0 implies no checksum>
+    A_UINT32 ChksumStart; // offset in image for start of checksum calculation 
+    A_UINT32 ChksumEnd; // offset in image for end of checksum calculation
+    A_UINT32 partitionTableOffset; // offset in image for start of 3 word partition table
+    A_UINT32 flashDescOffset; // offset in image for the start of the flash descriptor file
+}CONFIG_HEADER;
+
+typedef struct{
+    A_UINT32 capacity; // size of flash chip in bytes
+    A_UINT32 blocksize; // size of a block needed for nvram block erase command
+    A_UINT32 sectorsize; // size of sector needed for nvram sector erase command
+    A_UINT32 pagesize; // size of page needed for nvram write command
+}FLASH_DESCRIPTOR;
+
+
+#endif /* _IOT_FLASHOTP_H_ */
diff --git a/host/include/p2p.h b/host/include/p2p.h
new file mode 100644
index 0000000..48764d6
--- /dev/null
+++ b/host/include/p2p.h
@@ -0,0 +1,430 @@
+//------------------------------------------------------------------------------
+// <copyright file="p2p.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file has the shared declarations between the host & target P2P modules.
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#define WPS_NONCE_LEN 16
+#define WPS_DEV_TYPE_LEN 8
+#define WPS_AUTHENTICATOR_LEN 8
+#define WPS_HASH_LEN 32
+#define WPS_SECRET_NONCE_LEN 16
+#define WPS_KWA_LEN 8
+#define WPS_MAX_PIN_LEN 8
+#define P2P_MAX_SSID_LEN 32
+
+#define WPS_DEV_OUI_WFA 0x0050f204
+#define P2P_IE_VENDOR_TYPE 0x506f9a09
+
+#define WLAN_EID_VENDOR_SPECIFIC 221
+
+#define P2P_DEV_CAPAB_SERVICE_DISCOVERY BIT(0)
+
+/* Config Methods */
+#define WPS_CONFIG_USBA 0x0001
+#define WPS_CONFIG_ETHERNET 0x0002
+#define WPS_CONFIG_LABEL 0x0004
+#define WPS_CONFIG_DISPLAY 0x0008
+#define WPS_CONFIG_EXT_NFC_TOKEN 0x0010
+#define WPS_CONFIG_INT_NFC_TOKEN 0x0020
+#define WPS_CONFIG_NFC_INTERFACE 0x0040
+#define WPS_CONFIG_PUSHBUTTON 0x0080
+#define WPS_CONFIG_KEYPAD 0x0100
+
+/* Attribute Types */
+enum wps_attribute {
+    ATTR_AP_CHANNEL = 0x1001,
+    ATTR_ASSOC_STATE = 0x1002,
+    ATTR_AUTH_TYPE = 0x1003,
+    ATTR_AUTH_TYPE_FLAGS = 0x1004,
+    ATTR_AUTHENTICATOR = 0x1005,
+    ATTR_CONFIG_METHODS = 0x1008,
+    ATTR_CONFIG_ERROR = 0x1009,
+    ATTR_CONFIRM_URL4 = 0x100a,
+    ATTR_CONFIRM_URL6 = 0x100b,
+    ATTR_CONN_TYPE = 0x100c,
+    ATTR_CONN_TYPE_FLAGS = 0x100d,
+    ATTR_CRED = 0x100e,
+    ATTR_ENCR_TYPE = 0x100f,
+    ATTR_ENCR_TYPE_FLAGS = 0x1010,
+    ATTR_DEV_NAME = 0x1011,
+    ATTR_DEV_PASSWORD_ID = 0x1012,
+    ATTR_E_HASH1 = 0x1014,
+    ATTR_E_HASH2 = 0x1015,
+    ATTR_E_SNONCE1 = 0x1016,
+    ATTR_E_SNONCE2 = 0x1017,
+    ATTR_ENCR_SETTINGS = 0x1018,
+    ATTR_ENROLLEE_NONCE = 0x101a,
+    ATTR_FEATURE_ID = 0x101b,
+    ATTR_IDENTITY = 0x101c,
+    ATTR_IDENTITY_PROOF = 0x101d,
+    ATTR_KEY_WRAP_AUTH = 0x101e,
+    ATTR_KEY_ID = 0x101f,
+    ATTR_MAC_ADDR = 0x1020,
+    ATTR_MANUFACTURER = 0x1021,
+    ATTR_MSG_TYPE = 0x1022,
+    ATTR_MODEL_NAME = 0x1023,
+    ATTR_MODEL_NUMBER = 0x1024,
+    ATTR_NETWORK_INDEX = 0x1026,
+    ATTR_NETWORK_KEY = 0x1027,
+    ATTR_NETWORK_KEY_INDEX = 0x1028,
+    ATTR_NEW_DEVICE_NAME = 0x1029,
+    ATTR_NEW_PASSWORD = 0x102a,
+    ATTR_OOB_DEVICE_PASSWORD = 0x102c,
+    ATTR_OS_VERSION = 0x102d,
+    ATTR_POWER_LEVEL = 0x102f,
+    ATTR_PSK_CURRENT = 0x1030,
+    ATTR_PSK_MAX = 0x1031,
+    ATTR_PUBLIC_KEY = 0x1032,
+    ATTR_RADIO_ENABLE = 0x1033,
+    ATTR_REBOOT = 0x1034,
+    ATTR_REGISTRAR_CURRENT = 0x1035,
+    ATTR_REGISTRAR_ESTABLISHED = 0x1036,
+    ATTR_REGISTRAR_LIST = 0x1037,
+    ATTR_REGISTRAR_MAX = 0x1038,
+    ATTR_REGISTRAR_NONCE = 0x1039,
+    ATTR_REQUEST_TYPE = 0x103a,
+    ATTR_RESPONSE_TYPE = 0x103b,
+    ATTR_RF_BANDS = 0x103c,
+    ATTR_R_HASH1 = 0x103d,
+    ATTR_R_HASH2 = 0x103e,
+    ATTR_R_SNONCE1 = 0x103f,
+    ATTR_R_SNONCE2 = 0x1040,
+    ATTR_SELECTED_REGISTRAR = 0x1041,
+    ATTR_SERIAL_NUMBER = 0x1042,
+    ATTR_WPS_STATE = 0x1044,
+    ATTR_SSID = 0x1045,
+    ATTR_TOTAL_NETWORKS = 0x1046,
+    ATTR_UUID_E = 0x1047,
+    ATTR_UUID_R = 0x1048,
+    ATTR_VENDOR_EXT = 0x1049,
+    ATTR_VERSION = 0x104a,
+    ATTR_X509_CERT_REQ = 0x104b,
+    ATTR_X509_CERT = 0x104c,
+    ATTR_EAP_IDENTITY = 0x104d,
+    ATTR_MSG_COUNTER = 0x104e,
+    ATTR_PUBKEY_HASH = 0x104f,
+    ATTR_REKEY_KEY = 0x1050,
+    ATTR_KEY_LIFETIME = 0x1051,
+    ATTR_PERMITTED_CFG_METHODS = 0x1052,
+    ATTR_SELECTED_REGISTRAR_CONFIG_METHODS = 0x1053,
+    ATTR_PRIMARY_DEV_TYPE = 0x1054,
+    ATTR_SECONDARY_DEV_TYP_ELIST = 0x1055,
+    ATTR_PORTABLE_DEV = 0x1056,
+    ATTR_AP_SETUP_LOCKED = 0x1057,
+    ATTR_APPLICATION_EXT = 0x1058,
+    ATTR_EAP_TYPE = 0x1059,
+    ATTR_IV = 0x1060,
+    ATTR_KEY_PROVIDED_AUTO = 0x1061,
+    ATTR_802_1X_ENABLED = 0x1062,
+    ATTR_APPSESSIONKEY = 0x1063,
+    ATTR_WEPTRANSMITKEY = 0x1064,
+    ATTR_REQUESTED_DEV_TYPE = 0x106a
+};
+
+enum p2p_wps_method {
+    WPS_NOT_READY, WPS_PIN_LABEL, WPS_PIN_DISPLAY, WPS_PIN_KEYPAD, WPS_PBC
+};
+
+enum p2p_status_code {
+    P2P_SC_SUCCESS = 0,
+    P2P_SC_FAIL_INFO_CURRENTLY_UNAVAILABLE = 1,
+    P2P_SC_FAIL_INCOMPATIBLE_PARAMS = 2,
+    P2P_SC_FAIL_LIMIT_REACHED = 3,
+    P2P_SC_FAIL_INVALID_PARAMS = 4,
+    P2P_SC_FAIL_UNABLE_TO_ACCOMMODATE = 5,
+    P2P_SC_FAIL_PREV_PROTOCOL_ERROR = 6,
+    P2P_SC_FAIL_NO_COMMON_CHANNELS = 7,
+    P2P_SC_FAIL_UNKNOWN_GROUP = 8,
+    P2P_SC_FAIL_BOTH_GO_INTENT_15 = 9,
+    P2P_SC_FAIL_INCOMPATIBLE_PROV_METHOD = 10,
+    P2P_SC_FAIL_REJECTED_BY_USER = 11,
+};
+
+struct wps_parse_attr {
+    /* fixed length fields */
+    const A_UINT8 *version; /* 1 octet */
+    const A_UINT8 *msg_type; /* 1 octet */
+    const A_UINT8 *enrollee_nonce; /* WPS_NONCE_LEN (16) octets */
+    const A_UINT8 *registrar_nonce; /* WPS_NONCE_LEN (16) octets */
+    const A_UINT8 *uuid_r; /* WPS_UUID_LEN (16) octets */
+    const A_UINT8 *uuid_e; /* WPS_UUID_LEN (16) octets */
+    const A_UINT8 *auth_type_flags; /* 2 octets */
+    const A_UINT8 *encr_type_flags; /* 2 octets */
+    const A_UINT8 *conn_type_flags; /* 1 octet */
+    const A_UINT8 *config_methods; /* 2 octets */
+    const A_UINT8 *sel_reg_config_methods; /* 2 octets */
+    const A_UINT8 *primary_dev_type; /* 8 octets */
+    const A_UINT8 *rf_bands; /* 1 octet */
+    const A_UINT8 *assoc_state; /* 2 octets */
+    const A_UINT8 *config_error; /* 2 octets */
+    const A_UINT8 *dev_password_id; /* 2 octets */
+    const A_UINT8 *oob_dev_password; /* WPS_OOB_DEVICE_PASSWORD_ATTR_LEN (54)
+                     * octets */
+    const A_UINT8 *os_version; /* 4 octets */
+    const A_UINT8 *wps_state; /* 1 octet */
+    const A_UINT8 *authenticator; /* WPS_AUTHENTICATOR_LEN (8) octets */
+    const A_UINT8 *r_hash1; /* WPS_HASH_LEN (32) octets */
+    const A_UINT8 *r_hash2; /* WPS_HASH_LEN (32) octets */
+    const A_UINT8 *e_hash1; /* WPS_HASH_LEN (32) octets */
+    const A_UINT8 *e_hash2; /* WPS_HASH_LEN (32) octets */
+    const A_UINT8 *r_snonce1; /* WPS_SECRET_NONCE_LEN (16) octets */
+    const A_UINT8 *r_snonce2; /* WPS_SECRET_NONCE_LEN (16) octets */
+    const A_UINT8 *e_snonce1; /* WPS_SECRET_NONCE_LEN (16) octets */
+    const A_UINT8 *e_snonce2; /* WPS_SECRET_NONCE_LEN (16) octets */
+    const A_UINT8 *key_wrap_auth; /* WPS_KWA_LEN (8) octets */
+    const A_UINT8 *auth_type; /* 2 octets */
+    const A_UINT8 *encr_type; /* 2 octets */
+    const A_UINT8 *network_idx; /* 1 octet */
+    const A_UINT8 *network_key_idx; /* 1 octet */
+    const A_UINT8 *mac_addr; /* ETH_ALEN (6) octets */
+    const A_UINT8 *key_prov_auto; /* 1 octet (Bool) */
+    const A_UINT8 *dot1x_enabled; /* 1 octet (Bool) */
+    const A_UINT8 *selected_registrar; /* 1 octet (Bool) */
+    const A_UINT8 *request_type; /* 1 octet */
+    const A_UINT8 *response_type; /* 1 octet */
+    const A_UINT8 *ap_setup_locked; /* 1 octet */
+
+    /* variable length fields */
+    const A_UINT8 *manufacturer;
+    A_UINT32 manufacturer_len;
+    const A_UINT8 *model_name;
+    A_UINT32 model_name_len;
+    const A_UINT8 *model_number;
+    A_UINT32 model_number_len;
+    const A_UINT8 *serial_number;
+    A_UINT32 serial_number_len;
+    const A_UINT8 *dev_name;
+    A_UINT32 dev_name_len;
+    const A_UINT8 *public_key;
+    A_UINT32 public_key_len;
+    const A_UINT8 *encr_settings;
+    A_UINT32 encr_settings_len;
+    const A_UINT8 *ssid; /* <= 32 octets */
+    A_UINT32 ssid_len;
+    const A_UINT8 *network_key; /* <= 64 octets */
+    A_UINT32 network_key_len;
+    const A_UINT8 *eap_type; /* <= 8 octets */
+    A_UINT32 eap_type_len;
+    const A_UINT8 *eap_identity; /* <= 64 octets */
+    A_UINT32 eap_identity_len;
+
+    /* attributes that can occur multiple times */
+#define MAX_CRED_COUNT 10
+    const A_UINT8 *cred[MAX_CRED_COUNT];
+    A_UINT32 cred_len[MAX_CRED_COUNT];
+    A_UINT32 num_cred;
+
+#define MAX_REQ_DEV_TYPE_COUNT 10
+    const A_UINT8 *req_dev_type[MAX_REQ_DEV_TYPE_COUNT];
+    A_UINT32 num_req_dev_type;
+};
+
+
+enum p2p_sublem_id {
+    P2P_ATTR_STATUS = 0,
+    P2P_ATTR_MINOR_REASON_CODE = 1,
+    P2P_ATTR_CAPABILITY = 2,
+    P2P_ATTR_DEVICE_ID = 3,
+    P2P_ATTR_GROUP_OWNER_INTENT = 4,
+    P2P_ATTR_CONFIGURATION_TIMEOUT = 5,
+    P2P_ATTR_LISTEN_CHANNEL = 6,
+    P2P_ATTR_GROUP_BSSID = 7,
+    P2P_ATTR_EXT_LISTEN_TIMING = 8,
+    P2P_ATTR_INTENDED_INTERFACE_ADDR = 9,
+    P2P_ATTR_MANAGEABILITY = 10,
+    P2P_ATTR_CHANNEL_LIST = 11,
+    P2P_ATTR_NOTICE_OF_ABSENCE = 12,
+    P2P_ATTR_DEVICE_INFO = 13,
+    P2P_ATTR_GROUP_INFO = 14,
+    P2P_ATTR_GROUP_ID = 15,
+    P2P_ATTR_INTERFACE = 16,
+    P2P_ATTR_OPERATING_CHANNEL = 17,
+    P2P_ATTR_INVITATION_FLAGS = 18,
+    P2P_ATTR_VENDOR_SPECIFIC = 221
+};
+
+#define P2P_MAX_REG_CLASSES 10
+#define P2P_MAX_REG_CLASS_CHANNELS 20
+
+#define P2P_WILDCARD_SSID "DIRECT-"
+#define P2P_WILDCARD_SSID_LEN 7
+
+struct p2p_channels {
+    struct p2p_reg_class {
+        A_UINT8 reg_class;
+        A_UINT8 channel[P2P_MAX_REG_CLASS_CHANNELS];
+        A_UINT8 channels;
+    } reg_class[P2P_MAX_REG_CLASSES];
+    A_UINT8 reg_classes;
+};
+
+#define P2P_NOA_DESCRIPTOR_LEN 13
+struct p2p_noa_descriptor {
+    A_UINT8   type_count; /* 255: continuous schedule, 0: reserved */
+    A_UINT32  duration ;  /* Absent period duration in micro seconds */
+    A_UINT32  interval;   /* Absent period interval in micro seconds */
+    A_UINT32  start_time; /* 32 bit tsf time when in starts */
+};
+
+#define P2P_MAX_NOA_DESCRIPTORS 4
+/*
+ * Length = (2 octets for Index and CTWin/Opp PS) and
+ * (13 octets for each NOA Descriptors)
+ */
+#define P2P_NOA_IE_SIZE(num_desc)     (2 + (13 * (num_desc)))
+
+#define P2P_NOE_IE_OPP_PS_SET                     (0x80)
+#define P2P_NOE_IE_CTWIN_MASK                     (0x7F)
+
+struct p2p_sub_element_noa {
+    A_UINT8        p2p_sub_id;
+    A_UINT8        p2p_sub_len;
+    A_UINT8        index;           /* identifies instance of NOA su element */
+    A_UINT8        oppPS:1,         /* oppPS state of the AP */
+                   ctwindow:7;      /* ctwindow in TUs */
+    A_UINT8        num_descriptors; /* number of NOA descriptors */
+    struct p2p_noa_descriptor noa_descriptors[P2P_MAX_NOA_DESCRIPTORS];
+};
+
+#define ETH_ALEN 6
+
+struct p2p_ie {
+    A_UINT8 dialog_token;
+    const A_UINT8 *capability;
+    const A_UINT8 *go_intent;
+    const A_UINT8 *status;
+    const A_UINT8 *listen_channel;
+    const A_UINT8 *operating_channel;
+    const A_UINT8 *channel_list;
+    A_UINT8 channel_list_len;
+    const A_UINT8 *config_timeout;
+    const A_UINT8 *intended_addr;
+    const A_UINT8 *group_bssid;
+    const A_UINT8 *invitation_flags;
+
+    const A_UINT8 *group_info;
+    A_UINT32 group_info_len;
+    const A_UINT8 *group_id;
+    A_UINT32 group_id_len;
+
+    const A_UINT8 *device_id;
+    const A_UINT8 *manageability;
+
+    const A_UINT8 *noa;
+    A_UINT32 noa_len;
+    const A_UINT8 *ext_listen_timing;
+
+    const A_UINT8 *minor_reason_code;
+
+    /* P2P Device Info */
+    const A_UINT8 *p2p_device_info;
+    A_UINT32 p2p_device_info_len;
+    const A_UINT8 *p2p_device_addr;
+    const A_UINT8 *pri_dev_type;
+    A_UINT8 num_sec_dev_types;
+    A_CHAR device_name[33];
+    A_UINT8 dev_name_len;
+    A_UINT16 config_methods;
+
+    /* WPS IE */
+    A_UINT16 dev_password_id;
+    A_UINT16 wps_config_methods;
+    const A_UINT8 *wps_pri_dev_type;
+    A_CHAR   wps_device_name[33];
+    A_UINT8  wps_dev_name_len;
+    
+
+    /* SSID IE */
+    const A_UINT8 *ssid;
+};
+
+struct p2p_device {
+    A_UINT16 listen_freq;
+    A_UINT32 wps_pbc;
+    A_CHAR wps_pin[WPS_MAX_PIN_LEN];
+    A_UINT8 pin_len;
+    enum p2p_wps_method wps_method;
+
+    A_UINT8 p2p_device_addr[ETH_ALEN];
+    A_UINT8 pri_dev_type[8];
+    A_CHAR device_name[33];
+    A_UINT16 config_methods;
+    A_UINT8 dev_capab;
+    A_UINT8 group_capab;
+
+    A_UINT8 interface_addr[ETH_ALEN];
+
+    /* Dev. Discoverability data */
+    A_UINT8 dev_disc_dialog_token;
+    A_UINT8 member_in_go_dev[ETH_ALEN];
+    A_UINT8 member_in_go_iface[ETH_ALEN];
+    A_UINT8 dev_disc_go_oper_ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 dev_disc_go_oper_ssid_len;
+    A_UINT16 dev_disc_go_oper_freq;
+
+    A_UINT32 go_neg_req_sent;
+    enum p2p_go_state { UNKNOWN_GO, LOCAL_GO, REMOTE_GO } go_state;
+    A_UINT8 dialog_token;
+    A_UINT8 intended_addr[ETH_ALEN];
+
+    A_CHAR country[3];
+    struct p2p_channels channels;
+    A_UINT16 oper_freq;
+    A_UINT8 oper_ssid[P2P_MAX_SSID_LEN];
+    A_UINT8 oper_ssid_len;
+
+    A_UINT16 req_config_methods;
+
+#define P2P_DEV_PROBE_REQ_ONLY BIT(0)
+#define P2P_DEV_REPORTED BIT(1)
+#define P2P_DEV_NOT_YET_READY BIT(2)
+#define P2P_DEV_SD_INFO BIT(3)
+#define P2P_DEV_SD_SCHEDULE BIT(4)
+#define P2P_DEV_PD_PEER_DISPLAY BIT(5)
+#define P2P_DEV_PD_PEER_KEYPAD BIT(6)
+#define P2P_DEV_USER_REJECTED BIT(7)
+#define P2P_DEV_PEER_WAITING_RESPONSE BIT(8)
+#define P2P_DEV_PREFER_PERSISTENT_GROUP BIT(9)
+#define P2P_DEV_WAIT_GO_NEG_RESPONSE BIT(10)
+#define P2P_DEV_WAIT_GO_NEG_CONFIRM BIT(11)
+#define P2P_DEV_GROUP_CLIENT_ONLY BIT(12)
+#define P2P_DEV_FORCE_FREQ BIT(13)
+#define P2P_DEV_PD_FOR_JOIN BIT(14)
+#define P2P_DEV_INVITATION_AUTHORIZED BIT(15)
+
+    A_UINT32 flags;
+
+    A_UINT32 status;
+    A_UINT8 wait_count;
+    A_UINT32 invitation_reqs;
+
+    A_UINT16 ext_listen_period;
+    A_UINT16 ext_listen_interval;
+
+    A_UINT8 go_timeout;
+    A_UINT8 client_timeout;
+    A_UINT8 persistent_grp;
+   
+};
+#endif /* _P2P_H_ */
diff --git a/host/include/p2p_api.h b/host/include/p2p_api.h
new file mode 100644
index 0000000..87191f7
--- /dev/null
+++ b/host/include/p2p_api.h
@@ -0,0 +1,144 @@
+//------------------------------------------------------------------------------
+// <copyright file="p2p_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains definitions exported by the P2P host module.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _HOST_P2P_API_H_
+#define _HOST_P2P_API_H_
+
+#include "utils_api.h"
+#include "wmi.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define P2P_OUI 0x99a6f50
+
+static int __inline
+isp2poui(const A_UINT8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == (P2P_OUI);
+}
+
+/* P2P Capability - Device Capability bitmap */
+#define P2P_DEV_CAPAB_SERVICE_DISCOVERY BIT(0)
+#define P2P_DEV_CAPAB_CLIENT_DISCOVERABILITY BIT(1)
+#define P2P_DEV_CAPAB_CONCURRENT_OPER BIT(2)
+#define P2P_DEV_CAPAB_INFRA_MANAGED BIT(3)
+#define P2P_DEV_CAPAB_DEVICE_LIMIT BIT(4)
+#define P2P_DEV_CAPAB_INVITATION_PROCEDURE BIT(5)
+
+/* P2P Capability - Group Capability bitmap */
+#define P2P_GROUP_CAPAB_GROUP_OWNER BIT(0)
+#define P2P_GROUP_CAPAB_PERSISTENT_GROUP BIT(1)
+#define P2P_GROUP_CAPAB_GROUP_LIMIT BIT(2)
+#define P2P_GROUP_CAPAB_INTRA_BSS_DIST BIT(3)
+#define P2P_GROUP_CAPAB_CROSS_CONN BIT(4)
+#define P2P_GROUP_CAPAB_PERSISTENT_RECONN BIT(5)
+#define P2P_GROUP_CAPAB_GROUP_FORMATION BIT(6)
+
+/* API function declarations */
+
+void *p2p_init(void *dev);
+void p2p_deinit(void);
+
+struct host_p2p_dev *p2p_get_device(void *p2p_dev_ctx, const A_UINT8 *addr);
+
+void *p2p_bssinfo_rx(void *p2p_dev_ctx, WMI_BI_FTYPE fType, A_UINT8 *addr, A_UINT16 channel, const A_UINT8 *data, A_UINT32 len);
+
+void p2p_go_neg_req_rx(void *p2p_dev_ctx, const A_UINT8 *datap, A_UINT8 len);
+
+void p2p_invite_req_rx(void *p2p_dev_ctx, const A_UINT8 *datap, A_UINT8 len);
+
+void p2p_prov_disc_req_rx(void *p2p_dev_ctx, const A_UINT8 *datap, A_UINT8 len);
+void p2p_prov_disc_resp_rx(void *p2p_dev_ctx,
+                     const A_UINT8 *datap, A_UINT8 len);
+void p2p_start_sdpd_event_rx(void *p2p_dev_ctx);
+void p2p_sdpd_rx_event_rx(void *p2p_dev_ctx,
+                      const A_UINT8 *datap, A_UINT8 len);
+void p2p_free_all_devices(void *ctx);
+void p2p_device_free(void *peer_dev);
+
+A_STATUS p2p_auth_go_neg(void *ctx,
+                WMI_P2P_GO_NEG_START_CMD *auth_go_neg_param);
+
+A_STATUS p2p_auth_invite(void *ctx, A_UINT32 auth, A_UINT8 *auth_peer);
+
+A_STATUS p2p_peer_reject(void *ctx, A_UINT8 *peer_addr);
+
+A_STATUS p2p_go_neg_start(void *ctx, WMI_P2P_GO_NEG_START_CMD *go_neg_param);
+
+A_STATUS p2p_invite_cmd(void *ctx, WMI_P2P_INVITE_CMD *invite_param);
+
+A_STATUS p2p_prov_disc_req(void *ctx, A_UINT8 *peer, A_UINT16 wps_method);
+
+A_STATUS p2p_peer(void *ctx, A_UINT8 *peer, A_UINT8 next);
+
+A_STATUS p2p_get_device_p2p_buf(void *ctx, A_UINT8 *peer,  A_UINT8 **p2p_buf, A_UINT8 *p2p_buf_len);
+
+A_STATUS wmi_p2p_get_go_params(void *ctx, A_UINT8 *go_dev_addr,
+             A_UINT16 *oper_freq, A_UINT8 *ssid, A_UINT8 *ssid_len);
+
+A_STATUS p2p_get_devaddr (void *ctx, A_UINT8 *intf_addr);
+
+A_STATUS p2p_get_ifaddr (void *ctx, A_UINT8 *dev_addr);
+
+struct host_p2p_dev *p2p_get_device_intf_addrs(void *ctx, const A_UINT8 *intfaddr);
+
+void p2p_increment_dev_ref_count(struct host_p2p_dev *dev);
+
+void p2p_free_all_sd_queries(void *ctx);
+
+A_STATUS p2p_sd_request(void *ctx, A_UINT8 *peer_addr, A_UINT8 *tlvbuf,
+                A_UINT8 tlv_buflen, A_UINT32 *qid);
+
+A_STATUS p2p_sdpd_tx_cmd(void *ctx, WMI_P2P_SDPD_TX_CMD *sdpd_tx_cmd, A_UINT32 *qid);
+
+A_STATUS p2p_sd_cancel_request(void *ctx, A_UINT32 qid);
+
+void p2p_go_neg_complete_rx(void *ctx, const A_UINT8 *datap, A_UINT8 len);
+
+int p2p_get_peer_info(void *ctx, A_UINT8 *peer_addr, A_UINT8 *buf, A_UINT32 buflen);
+
+int p2p_get_next_addr(void *ctx, A_UINT8 *addr, A_UINT8 *buf, A_UINT32 buflen, int first_element);
+
+void p2p_clear_peers_reported_flag(void *ctx);
+
+void p2p_clear_peers_authorized_flag(void *ctx, const A_UINT8 *addr);
+
+A_STATUS p2p_get_own_info(void *ctx, A_UINT8 *p2p_buf, A_UINT8 p2p_buf_len);
+
+void p2p_update_capability(void *ctx, A_UINT8 arNetworkType, A_UINT8 numDev);
+
+void p2p_set_group_capability(void *ctx, A_UINT8 flag, A_UINT8 set);
+
+void p2p_clear_group_peer(void *ctx);
+
+void p2p_set_device_capability(void *ctx, A_UINT8 flag, A_UINT8 set);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HOST_P2P_API_H_ */
diff --git a/host/include/pkt_log.h b/host/include/pkt_log.h
new file mode 100644
index 0000000..55ae2a3
--- /dev/null
+++ b/host/include/pkt_log.h
@@ -0,0 +1,45 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2005-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __PKT_LOG_H__
+#define __PKT_LOG_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* Pkt log info */
+typedef PREPACK struct pkt_log_t {
+    struct info_t {
+        A_UINT16    st;
+        A_UINT16    end;
+        A_UINT16    cur;
+    }info[4096];
+    A_UINT16    last_idx;
+}POSTPACK PACKET_LOG;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif  /* __PKT_LOG_H__ */
diff --git a/host/include/project.h b/host/include/project.h
new file mode 100644
index 0000000..43378de
--- /dev/null
+++ b/host/include/project.h
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2008 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _PROJECT_H_
+#define _PROJECT_H_
+#include "queue.h"
+
+#define OS_TIMER_FUNC(fn) void fn(A_HANDLE hdl, void *context)
+#define OS_TIMER_FUNC_PTR(fn) void (* fn)(A_HANDLE hdl, void *context)
+#define OS_CANCEL_TIMER(timer_hdl) A_UNTIMEOUT(timer_hdl)
+#define OS_SET_TIMER(timer_hdl, period, repeat) A_TIMEOUT_MS(timer_hdl, period, repeat)
+#define OS_INIT_TIMER(timer_hdl, fn, arg) A_INIT_TIMER(timer_hdl, fn, arg)
+
+typedef A_TIMER os_timer_t;
+
+/* Memory related */
+#define OS_MEMZERO(ptr, size) A_MEMZERO(ptr, size)
+#define OS_MEMCPY(dst, src, len) A_MEMCPY(dst, src, len)
+#define OS_MALLOC(nbytes) A_MALLOC(nbytes)
+#define OS_FREE(ptr) A_FREE(ptr)
+
+#endif
+
+
diff --git a/host/include/queue.h b/host/include/queue.h
new file mode 100644
index 0000000..62caf5e
--- /dev/null
+++ b/host/include/queue.h
@@ -0,0 +1,565 @@
+//
+// Copyright (c) 1991, 1993
+//  The Regents of the University of California.  All rights reserved.
+// 
+//
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+// 3. All advertising materials mentioning features or use of this software
+//    must display the following acknowledgement:
+//      This product includes software developed by the University of
+//      California, Berkeley and its contributors.
+// 4. Neither the name of the University nor the names of its contributors
+//    may be used to endorse or promote products derived from this software
+//    without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+// ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+// OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+// LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+// OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+// SUCH DAMAGE.
+//
+//  @(#)queue.h 8.5 (Berkeley) 8/20/94
+// $FreeBSD: src/sys/sys/queue.h,v 1.58 2004/04/07 04:19:49 imp Exp $
+// $Id: //depot/sw/releases/olca3.1-RC/include/queue.h#3 $
+//
+
+#ifndef _SYS_QUEUE_H_
+#define _SYS_QUEUE_H_
+
+/*
+ * This file defines four types of data structures: singly-linked lists,
+ * singly-linked tail queues, lists and tail queues.
+ *
+ * A singly-linked list is headed by a single forward pointer. The elements
+ * are singly linked for minimum space and pointer manipulation overhead at
+ * the expense of O(n) removal for arbitrary elements. New elements can be
+ * added to the list after an existing element or at the head of the list.
+ * Elements being removed from the head of the list should use the explicit
+ * macro for this purpose for optimum efficiency. A singly-linked list may
+ * only be traversed in the forward direction.  Singly-linked lists are ideal
+ * for applications with large datasets and few or no removals or for
+ * implementing a LIFO queue.
+ *
+ * A singly-linked tail queue is headed by a pair of pointers, one to the
+ * head of the list and the other to the tail of the list. The elements are
+ * singly linked for minimum space and pointer manipulation overhead at the
+ * expense of O(n) removal for arbitrary elements. New elements can be added
+ * to the list after an existing element, at the head of the list, or at the
+ * end of the list. Elements being removed from the head of the tail queue
+ * should use the explicit macro for this purpose for optimum efficiency.
+ * A singly-linked tail queue may only be traversed in the forward direction.
+ * Singly-linked tail queues are ideal for applications with large datasets
+ * and few or no removals or for implementing a FIFO queue.
+ *
+ * A list is headed by a single forward pointer (or an array of forward
+ * pointers for a hash table header). The elements are doubly linked
+ * so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before
+ * or after an existing element or at the head of the list. A list
+ * may only be traversed in the forward direction.
+ *
+ * A tail queue is headed by a pair of pointers, one to the head of the
+ * list and the other to the tail of the list. The elements are doubly
+ * linked so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before or
+ * after an existing element, at the head of the list, or at the end of
+ * the list. A tail queue may be traversed in either direction.
+ *
+ * For details on the use of these macros, see the queue(3) manual page.
+ *
+ *
+ *              SLIST   LIST    STAILQ  TAILQ
+ * _HEAD            +   +   +   +
+ * _HEAD_INITIALIZER        +   +   +   +
+ * _ENTRY           +   +   +   +
+ * _INIT            +   +   +   +
+ * _EMPTY           +   +   +   +
+ * _FIRST           +   +   +   +
+ * _NEXT            +   +   +   +
+ * _PREV            -   -   -   +
+ * _LAST            -   -   +   +
+ * _FOREACH         +   +   +   +
+ * _FOREACH_SAFE        +   +   +   +
+ * _FOREACH_REVERSE     -   -   -   +
+ * _FOREACH_REVERSE_SAFE    -   -   -   +
+ * _INSERT_HEAD         +   +   +   +
+ * _INSERT_BEFORE       -   +   -   +
+ * _INSERT_AFTER        +   +   +   +
+ * _INSERT_TAIL         -   -   +   +
+ * _CONCAT          -   -   +   +
+ * _REMOVE_HEAD         +   -   +   -
+ * _REMOVE          +   +   +   +
+ *
+ */
+#define QUEUE_MACRO_DEBUG 0
+#if QUEUE_MACRO_DEBUG
+/* Store the last 2 places the queue element or head was altered */
+struct qm_trace {
+    char * lastfile;
+    int lastline;
+    char * prevfile;
+    int prevline;
+};
+
+#define TRACEBUF    struct qm_trace trace;
+#define TRASHIT(x)  do {(x) = (void *)-1;} while (0)
+
+#define QMD_TRACE_HEAD(head) do {                   \
+    (head)->trace.prevline = (head)->trace.lastline;        \
+    (head)->trace.prevfile = (head)->trace.lastfile;        \
+    (head)->trace.lastline = __LINE__;              \
+    (head)->trace.lastfile = __FILE__;              \
+} while (0)
+
+#define QMD_TRACE_ELEM(elem) do {                   \
+    (elem)->trace.prevline = (elem)->trace.lastline;        \
+    (elem)->trace.prevfile = (elem)->trace.lastfile;        \
+    (elem)->trace.lastline = __LINE__;              \
+    (elem)->trace.lastfile = __FILE__;              \
+} while (0)
+
+#else
+#define QMD_TRACE_ELEM(elem)
+#define QMD_TRACE_HEAD(head)
+#define TRACEBUF
+#define TRASHIT(x)
+#endif  /* QUEUE_MACRO_DEBUG */
+
+/*
+ * Singly-linked List declarations.
+ */
+#define SLIST_HEAD(name, type)                      \
+struct name {                               \
+    struct type *slh_first; /* first element */         \
+}
+
+#define SLIST_HEAD_INITIALIZER(head)                    \
+    { NULL }
+
+#define SLIST_ENTRY(type)                       \
+struct {                                \
+    struct type *sle_next;  /* next element */          \
+}
+
+/*
+ * Singly-linked List functions.
+ */
+#define SLIST_EMPTY(head)   ((head)->slh_first == NULL)
+
+#define SLIST_FIRST(head)   ((head)->slh_first)
+
+#define SLIST_FOREACH(var, head, field)                 \
+    for ((var) = SLIST_FIRST((head));               \
+        (var);                          \
+        (var) = SLIST_NEXT((var), field))
+
+#define SLIST_FOREACH_SAFE(var, head, field, tvar)          \
+    for ((var) = SLIST_FIRST((head));               \
+        (var) && ((tvar) = SLIST_NEXT((var), field), 1);        \
+        (var) = (tvar))
+
+#define SLIST_FOREACH_PREVPTR(var, varp, head, field)           \
+    for ((varp) = &SLIST_FIRST((head));             \
+        ((var) = *(varp)) != NULL;                  \
+        (varp) = &SLIST_NEXT((var), field))
+
+#define SLIST_INIT(head) do {                       \
+    SLIST_FIRST((head)) = NULL;                 \
+} while (0)
+
+#define SLIST_INSERT_AFTER(slistelm, elm, field) do {           \
+    SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field);   \
+    SLIST_NEXT((slistelm), field) = (elm);              \
+} while (0)
+
+#define SLIST_INSERT_HEAD(head, elm, field) do {            \
+    SLIST_NEXT((elm), field) = SLIST_FIRST((head));         \
+    SLIST_FIRST((head)) = (elm);                    \
+} while (0)
+
+#define SLIST_NEXT(elm, field)  ((elm)->field.sle_next)
+
+#define SLIST_REMOVE(head, elm, type, field) do {           \
+    if (SLIST_FIRST((head)) == (elm)) {             \
+        SLIST_REMOVE_HEAD((head), field);           \
+    }                               \
+    else {                              \
+        struct type *curelm = SLIST_FIRST((head));      \
+        while (SLIST_NEXT(curelm, field) != (elm))      \
+            curelm = SLIST_NEXT(curelm, field);     \
+        SLIST_NEXT(curelm, field) =             \
+            SLIST_NEXT(SLIST_NEXT(curelm, field), field);   \
+    }                               \
+} while (0)
+
+#define SLIST_REMOVE_HEAD(head, field) do {             \
+    SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field);   \
+} while (0)
+
+/*
+ * Singly-linked Tail queue declarations.
+ */
+#define STAILQ_HEAD(name, type)                     \
+struct name {                               \
+    struct type *stqh_first;/* first element */         \
+    struct type **stqh_last;/* addr of last next element */     \
+}
+
+#define STAILQ_HEAD_INITIALIZER(head)                   \
+    { NULL, &(head).stqh_first }
+
+#define STAILQ_ENTRY(type)                      \
+struct {                                \
+    struct type *stqe_next; /* next element */          \
+}
+
+/*
+ * Singly-linked Tail queue functions.
+ */
+#define STAILQ_CONCAT(head1, head2) do {                \
+    if (!STAILQ_EMPTY((head2))) {                   \
+        *(head1)->stqh_last = (head2)->stqh_first;      \
+        (head1)->stqh_last = (head2)->stqh_last;        \
+        STAILQ_INIT((head2));                   \
+    }                               \
+} while (0)
+
+#define STAILQ_EMPTY(head)  ((head)->stqh_first == NULL)
+
+#define STAILQ_FIRST(head)  ((head)->stqh_first)
+
+#define STAILQ_FOREACH(var, head, field)                \
+    for((var) = STAILQ_FIRST((head));               \
+       (var);                           \
+       (var) = STAILQ_NEXT((var), field))
+
+
+#define STAILQ_FOREACH_SAFE(var, head, field, tvar)         \
+    for ((var) = STAILQ_FIRST((head));              \
+        (var) && ((tvar) = STAILQ_NEXT((var), field), 1);       \
+        (var) = (tvar))
+
+#define STAILQ_INIT(head) do {                      \
+    STAILQ_FIRST((head)) = NULL;                    \
+    (head)->stqh_last = &STAILQ_FIRST((head));          \
+} while (0)
+
+#define STAILQ_INSERT_AFTER(head, tqelm, elm, field) do {       \
+    if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\
+        (head)->stqh_last = &STAILQ_NEXT((elm), field);     \
+    STAILQ_NEXT((tqelm), field) = (elm);                \
+} while (0)
+
+#define STAILQ_INSERT_HEAD(head, elm, field) do {           \
+    if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL) \
+        (head)->stqh_last = &STAILQ_NEXT((elm), field);     \
+    STAILQ_FIRST((head)) = (elm);                   \
+} while (0)
+
+#define STAILQ_INSERT_TAIL(head, elm, field) do {           \
+    STAILQ_NEXT((elm), field) = NULL;               \
+    *(head)->stqh_last = (elm);                 \
+    (head)->stqh_last = &STAILQ_NEXT((elm), field);         \
+} while (0)
+
+#define FIELD_OFFSET(type, field) ((int)(int *)&(((struct type *)0)->field))
+
+#define STAILQ_LAST(head, type, field)                  \
+    (STAILQ_EMPTY((head)) ?                     \
+        NULL :                          \
+            ((struct type *)                    \
+        ((char *)((head)->stqh_last) - FIELD_OFFSET(type, field))))
+
+#define STAILQ_NEXT(elm, field) ((elm)->field.stqe_next)
+
+#define STAILQ_CONCAT_ELEM(prevelm, elm, field) do {          \
+    prevelm->field.stqe_next = elm;                           \
+} while (0)
+
+#define STAILQ_REMOVE(head, elm, type, field) do {          \
+    if (STAILQ_FIRST((head)) == (elm)) {                \
+        STAILQ_REMOVE_HEAD((head), field);          \
+    }                               \
+    else {                              \
+        struct type *curelm = STAILQ_FIRST((head));     \
+        while (STAILQ_NEXT(curelm, field) != (elm))     \
+            curelm = STAILQ_NEXT(curelm, field);        \
+        if ((STAILQ_NEXT(curelm, field) =           \
+             STAILQ_NEXT(STAILQ_NEXT(curelm, field), field)) == NULL)\
+            (head)->stqh_last = &STAILQ_NEXT((curelm), field);\
+    }                               \
+} while (0)
+
+#define STAILQ_REMOVE_HEAD(head, field) do {                \
+    if ((STAILQ_FIRST((head)) =                 \
+         STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL)     \
+        (head)->stqh_last = &STAILQ_FIRST((head));      \
+} while (0)
+
+#define STAILQ_REMOVE_HEAD_UNTIL(head, elm, field) do {         \
+    if ((STAILQ_FIRST((head)) = STAILQ_NEXT((elm), field)) == NULL) \
+        (head)->stqh_last = &STAILQ_FIRST((head));      \
+} while (0)
+
+/*
+ * List declarations.
+ */
+#define ATH_LIST_HEAD(name, type)                   \
+struct name {                               \
+    struct type *lh_first;  /* first element */         \
+}
+
+#define LIST_HEAD_INITIALIZER(head)                 \
+    { NULL }
+
+#define LIST_ENTRY(type)                        \
+struct {                                \
+    struct type *le_next;   /* next element */          \
+    struct type **le_prev;  /* address of previous next element */  \
+}
+
+/*
+ * List functions.
+ */
+
+#define LIST_EMPTY(head)    ((head)->lh_first == NULL)
+
+#define LIST_FIRST(head)    ((head)->lh_first)
+
+#define LIST_FOREACH(var, head, field)                  \
+    for ((var) = LIST_FIRST((head));                \
+        (var);                          \
+        (var) = LIST_NEXT((var), field))
+
+#define LIST_FOREACH_SAFE(var, head, field, tvar)           \
+    for ((var) = LIST_FIRST((head));                \
+        (var) && ((tvar) = LIST_NEXT((var), field), 1);     \
+        (var) = (tvar))
+
+#define LIST_INIT(head) do {                        \
+    LIST_FIRST((head)) = NULL;                  \
+} while (0)
+
+#define LIST_INSERT_AFTER(listelm, elm, field) do {         \
+    if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\
+        LIST_NEXT((listelm), field)->field.le_prev =        \
+            &LIST_NEXT((elm), field);               \
+    LIST_NEXT((listelm), field) = (elm);                \
+    (elm)->field.le_prev = &LIST_NEXT((listelm), field);        \
+} while (0)
+
+#define LIST_INSERT_BEFORE(listelm, elm, field) do {            \
+    (elm)->field.le_prev = (listelm)->field.le_prev;        \
+    LIST_NEXT((elm), field) = (listelm);                \
+    *(listelm)->field.le_prev = (elm);              \
+    (listelm)->field.le_prev = &LIST_NEXT((elm), field);        \
+} while (0)
+
+#define LIST_INSERT_HEAD(head, elm, field) do {             \
+    if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \
+        LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\
+    LIST_FIRST((head)) = (elm);                 \
+    (elm)->field.le_prev = &LIST_FIRST((head));         \
+} while (0)
+
+#define LIST_NEXT(elm, field)   ((elm)->field.le_next)
+
+#define LIST_REMOVE(elm, field) do {                    \
+    if (LIST_NEXT((elm), field) != NULL)                \
+        LIST_NEXT((elm), field)->field.le_prev =        \
+            (elm)->field.le_prev;               \
+    *(elm)->field.le_prev = LIST_NEXT((elm), field);        \
+} while (0)
+
+/*
+ * Tail queue declarations.
+ */
+#define TAILQ_HEAD(name, type)                      \
+struct name {                               \
+    struct type *tqh_first; /* first element */         \
+    struct type **tqh_last; /* addr of last next element */     \
+    TRACEBUF                            \
+}
+
+#define TAILQ_HEAD_INITIALIZER(head)                    \
+    { NULL, &(head).tqh_first }
+
+#define TAILQ_ENTRY(type)                       \
+struct {                                \
+    struct type *tqe_next;  /* next element */          \
+    struct type **tqe_prev; /* address of previous next element */  \
+    TRACEBUF                            \
+}
+
+/*
+ * Tail queue functions.
+ */
+#define TAILQ_CONCAT(head1, head2, field) do {              \
+    if (!TAILQ_EMPTY(head2)) {                  \
+        *(head1)->tqh_last = (head2)->tqh_first;        \
+        (head2)->tqh_first->field.tqe_prev = (head1)->tqh_last; \
+        (head1)->tqh_last = (head2)->tqh_last;          \
+        TAILQ_INIT((head2));                    \
+        QMD_TRACE_HEAD(head);                   \
+        QMD_TRACE_HEAD(head2);                  \
+    }                               \
+} while (0)
+
+#define TAILQ_EMPTY(head)   ((head)->tqh_first == NULL)
+
+#define TAILQ_FIRST(head)   ((head)->tqh_first)
+
+#define TAILQ_FOREACH(var, head, field)                 \
+    for ((var) = TAILQ_FIRST((head));               \
+        (var);                          \
+        (var) = TAILQ_NEXT((var), field))
+
+#define TAILQ_FOREACH_SAFE(var, head, field, tvar)          \
+    for ((var) = TAILQ_FIRST((head));               \
+        (var) && ((tvar) = TAILQ_NEXT((var), field), 1);        \
+        (var) = (tvar))
+
+#define TAILQ_FOREACH_REVERSE(var, head, headname, field)       \
+    for ((var) = TAILQ_LAST((head), headname);          \
+        (var);                          \
+        (var) = TAILQ_PREV((var), headname, field))
+
+#define TAILQ_FOREACH_REVERSE_SAFE(var, head, headname, field, tvar)    \
+    for ((var) = TAILQ_LAST((head), headname);          \
+        (var) && ((tvar) = TAILQ_PREV((var), headname, field), 1);  \
+        (var) = (tvar))
+
+#define TAILQ_INIT(head) do {                       \
+    TAILQ_FIRST((head)) = NULL;                 \
+    (head)->tqh_last = &TAILQ_FIRST((head));            \
+    QMD_TRACE_HEAD(head);                       \
+} while (0)
+
+#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do {      \
+    if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\
+        TAILQ_NEXT((elm), field)->field.tqe_prev =      \
+            &TAILQ_NEXT((elm), field);              \
+    else {                              \
+        (head)->tqh_last = &TAILQ_NEXT((elm), field);       \
+        QMD_TRACE_HEAD(head);                   \
+    }                               \
+    TAILQ_NEXT((listelm), field) = (elm);               \
+    (elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field);      \
+    QMD_TRACE_ELEM(&(elm)->field);                  \
+    QMD_TRACE_ELEM(&listelm->field);                \
+} while (0)
+
+#define TAILQ_INSERT_BEFORE(listelm, elm, field) do {           \
+    (elm)->field.tqe_prev = (listelm)->field.tqe_prev;      \
+    TAILQ_NEXT((elm), field) = (listelm);               \
+    *(listelm)->field.tqe_prev = (elm);             \
+    (listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field);      \
+    QMD_TRACE_ELEM(&(elm)->field);                  \
+    QMD_TRACE_ELEM(&listelm->field);                \
+} while (0)
+
+#define TAILQ_INSERT_HEAD(head, elm, field) do {            \
+    if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL)   \
+        TAILQ_FIRST((head))->field.tqe_prev =           \
+            &TAILQ_NEXT((elm), field);              \
+    else                                \
+        (head)->tqh_last = &TAILQ_NEXT((elm), field);       \
+    TAILQ_FIRST((head)) = (elm);                    \
+    (elm)->field.tqe_prev = &TAILQ_FIRST((head));           \
+    QMD_TRACE_HEAD(head);                       \
+    QMD_TRACE_ELEM(&(elm)->field);                  \
+} while (0)
+
+#define TAILQ_INSERT_TAIL(head, elm, field) do {            \
+    TAILQ_NEXT((elm), field) = NULL;                \
+    (elm)->field.tqe_prev = (head)->tqh_last;           \
+    *(head)->tqh_last = (elm);                  \
+    (head)->tqh_last = &TAILQ_NEXT((elm), field);           \
+    QMD_TRACE_HEAD(head);                       \
+    QMD_TRACE_ELEM(&(elm)->field);                  \
+} while (0)
+
+#define TAILQ_LAST(head, headname)                  \
+    (*(((struct headname *)((head)->tqh_last))->tqh_last))
+
+#define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next)
+
+#define TAILQ_PREV(elm, headname, field)                \
+    (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
+
+#define TAILQ_REMOVE(head, elm, field) do {             \
+    if ((TAILQ_NEXT((elm), field)) != NULL)             \
+        TAILQ_NEXT((elm), field)->field.tqe_prev =      \
+            (elm)->field.tqe_prev;              \
+    else {                              \
+        (head)->tqh_last = (elm)->field.tqe_prev;       \
+        QMD_TRACE_HEAD(head);                   \
+    }                               \
+    *(elm)->field.tqe_prev = TAILQ_NEXT((elm), field);      \
+    TRASHIT((elm)->field.tqe_next);                 \
+    TRASHIT((elm)->field.tqe_prev);                 \
+    QMD_TRACE_ELEM(&(elm)->field);                  \
+} while (0)
+
+
+#ifdef _KERNEL
+
+/*
+ * XXX insque() and remque() are an old way of handling certain queues.
+ * They bogusly assumes that all queue heads look alike.
+ */
+
+struct quehead {
+    struct quehead *qh_link;
+    struct quehead *qh_rlink;
+};
+
+#if defined(__GNUC__) || defined(__INTEL_COMPILER)
+
+static __inline void
+insque(void *a, void *b)
+{
+    struct quehead *element = (struct quehead *)a,
+         *head = (struct quehead *)b;
+
+    element->qh_link = head->qh_link;
+    element->qh_rlink = head;
+    head->qh_link = element;
+    element->qh_link->qh_rlink = element;
+}
+
+static __inline void
+remque(void *a)
+{
+    struct quehead *element = (struct quehead *)a;
+
+    element->qh_link->qh_rlink = element->qh_rlink;
+    element->qh_rlink->qh_link = element->qh_link;
+    element->qh_rlink = 0;
+}
+
+#else /* !(__GNUC__ || __INTEL_COMPILER) */
+
+void    insque(void *a, void *b);
+void    remque(void *a);
+
+#endif /* __GNUC__ || __INTEL_COMPILER */
+
+#endif /* _KERNEL */
+
+#endif /* !_SYS_QUEUE_H_ */
+
diff --git a/host/include/regDb.h b/host/include/regDb.h
new file mode 100644
index 0000000..562bb05
--- /dev/null
+++ b/host/include/regDb.h
@@ -0,0 +1,29 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2005-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __REG_DB_H__
+#define __REG_DB_H__
+
+#include "./regulatory/reg_dbschema.h"
+#include "./regulatory/reg_dbvalues.h"
+
+#endif  /* __REG_DB_H__ */
diff --git a/host/include/regdump.h b/host/include/regdump.h
new file mode 100644
index 0000000..f28a7a6
--- /dev/null
+++ b/host/include/regdump.h
@@ -0,0 +1,59 @@
+//------------------------------------------------------------------------------
+// <copyright file="regdump.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __REGDUMP_H__
+#define __REGDUMP_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#if defined(AR6001)
+#include "AR6001/AR6001_regdump.h"
+#endif
+#if defined(AR6002)
+#include "AR6002/AR6002_regdump.h"
+#endif
+
+#if !defined(__ASSEMBLER__)
+/*
+ * Target CPU state at the time of failure is reflected
+ * in a register dump, which the Host can fetch through
+ * the diagnostic window.
+ */
+PREPACK struct register_dump_s {
+    A_UINT32 target_id;               /* Target ID */
+    A_UINT32 assline;                 /* Line number (if assertion failure) */
+    A_UINT32 pc;                      /* Program Counter at time of exception */
+    A_UINT32 badvaddr;                /* Virtual address causing exception */
+    CPU_exception_frame_t exc_frame;  /* CPU-specific exception info */
+
+    /* Could copy top of stack here, too.... */
+} POSTPACK;
+#endif /* __ASSEMBLER__ */
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __REGDUMP_H__ */
diff --git a/host/include/roaming.h b/host/include/roaming.h
new file mode 100644
index 0000000..098508b
--- /dev/null
+++ b/host/include/roaming.h
@@ -0,0 +1,41 @@
+//------------------------------------------------------------------------------
+// <copyright file="roaming.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _ROAMING_H_
+#define _ROAMING_H_
+
+/* 
+ * The signal quality could be in terms of either snr or rssi. We should 
+ * have an enum for both of them. For the time being, we are going to move 
+ * it to wmi.h that is shared by both host and the target, since we are 
+ * repartitioning the code to the host 
+ */
+#define SIGNAL_QUALITY_NOISE_FLOOR        -96
+#define SIGNAL_QUALITY_METRICS_NUM_MAX    2
+typedef enum {
+    SIGNAL_QUALITY_METRICS_SNR = 0,
+    SIGNAL_QUALITY_METRICS_RSSI,
+    SIGNAL_QUALITY_METRICS_ALL,
+} SIGNAL_QUALITY_METRICS_TYPE;
+
+#endif  /* _ROAMING_H_ */
diff --git a/host/include/targaddrs.h b/host/include/targaddrs.h
new file mode 100644
index 0000000..3848f65
--- /dev/null
+++ b/host/include/targaddrs.h
@@ -0,0 +1,399 @@
+//------------------------------------------------------------------------------
+// <copyright file="targaddrs.h" company="Atheros">
+//    Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __TARGADDRS_H__
+#define __TARGADDRS_H__
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#if defined(AR6002)
+#include "AR6002/addrs.h"
+#endif
+
+/*
+ * AR6K option bits, to enable/disable various features.
+ * By default, all option bits are 0.
+ * These bits can be set in LOCAL_SCRATCH register 0.
+ */
+#define AR6K_OPTION_BMI_DISABLE      0x01 /* Disable BMI comm with Host */
+#define AR6K_OPTION_SERIAL_ENABLE    0x02 /* Enable serial port msgs */
+#define AR6K_OPTION_WDT_DISABLE      0x04 /* WatchDog Timer override */
+#define AR6K_OPTION_SLEEP_DISABLE    0x08 /* Disable system sleep */
+#define AR6K_OPTION_STOP_BOOT        0x10 /* Stop boot processes (for ATE) */
+#define AR6K_OPTION_ENABLE_NOANI     0x20 /* Operate without ANI */
+#define AR6K_OPTION_DSET_DISABLE     0x40 /* Ignore DataSets */
+#define AR6K_OPTION_IGNORE_FLASH     0x80 /* Ignore flash during bootup */
+
+/*
+ * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
+ * host_interest structure.  It must match the address of the _host_interest
+ * symbol (see linker script).
+ *
+ * Host Interest is shared between Host and Target in order to coordinate
+ * between the two, and is intended to remain constant (with additions only
+ * at the end) across software releases.
+ *
+ * All addresses are available here so that it's possible to
+ * write a single binary that works with all Target Types.
+ * May be used in assembler code as well as C.
+ */
+#define AR6002_HOST_INTEREST_ADDRESS    0x00500400
+#define AR6003_HOST_INTEREST_ADDRESS    0x00540600
+#define MCKINLEY_HOST_INTEREST_ADDRESS  0x00400600
+
+
+#define HOST_INTEREST_MAX_SIZE          0x100
+
+#if !defined(__ASSEMBLER__)
+struct register_dump_s;
+struct dbglog_hdr_s;
+
+/*
+ * These are items that the Host may need to access
+ * via BMI or via the Diagnostic Window. The position
+ * of items in this structure must remain constant
+ * across firmware revisions!
+ *
+ * Types for each item must be fixed size across
+ * target and host platforms.
+ *
+ * More items may be added at the end.
+ */
+PREPACK64 struct host_interest_s {
+    /*
+     * Pointer to application-defined area, if any.
+     * Set by Target application during startup.
+     */
+    A_UINT32               hi_app_host_interest;                      /* 0x00 */
+
+    /* Pointer to register dump area, valid after Target crash. */
+    A_UINT32               hi_failure_state;                          /* 0x04 */
+
+    /* Pointer to debug logging header */
+    A_UINT32               hi_dbglog_hdr;                             /* 0x08 */
+
+    /* Indicates whether or not flash is present on Target.
+     * NB: flash_is_present indicator is here not just
+     * because it might be of interest to the Host; but
+     * also because it's set early on by Target's startup
+     * asm code and we need it to have a special RAM address
+     * so that it doesn't get reinitialized with the rest
+     * of data.
+     */
+    A_UINT32               hi_flash_is_present;                       /* 0x0c */
+
+    /*
+     * General-purpose flag bits, similar to AR6000_OPTION_* flags.
+     * Can be used by application rather than by OS.
+     */
+    A_UINT32               hi_option_flag;                            /* 0x10 */
+
+    /*
+     * Boolean that determines whether or not to
+     * display messages on the serial port.
+     */
+    A_UINT32               hi_serial_enable;                          /* 0x14 */
+
+    /* Start address of DataSet index, if any */
+    A_UINT32               hi_dset_list_head;                         /* 0x18 */
+
+    /* Override Target application start address */
+    A_UINT32               hi_app_start;                              /* 0x1c */
+
+    /* Clock and voltage tuning */
+    A_UINT32               hi_skip_clock_init;                        /* 0x20 */
+    A_UINT32               hi_core_clock_setting;                     /* 0x24 */
+    A_UINT32               hi_cpu_clock_setting;                      /* 0x28 */
+    A_UINT32               hi_system_sleep_setting;                   /* 0x2c */
+    A_UINT32               hi_xtal_control_setting;                   /* 0x30 */
+    A_UINT32               hi_pll_ctrl_setting_24ghz;                 /* 0x34 */
+    A_UINT32               hi_pll_ctrl_setting_5ghz;                  /* 0x38 */
+    A_UINT32               hi_ref_voltage_trim_setting;               /* 0x3c */
+    A_UINT32               hi_clock_info;                             /* 0x40 */
+
+    /*
+     * Flash configuration overrides, used only
+     * when firmware is not executing from flash.
+     * (When using flash, modify the global variables
+     * with equivalent names.)
+     */
+    A_UINT32               hi_bank0_addr_value;                       /* 0x44 */
+    A_UINT32               hi_bank0_read_value;                       /* 0x48 */
+    A_UINT32               hi_bank0_write_value;                      /* 0x4c */
+    A_UINT32               hi_bank0_config_value;                     /* 0x50 */
+
+    /* Pointer to Board Data  */
+    A_UINT32               hi_board_data;                             /* 0x54 */
+    A_UINT32               hi_board_data_initialized;                 /* 0x58 */
+
+    A_UINT32               hi_dset_RAM_index_table;                   /* 0x5c */
+
+    A_UINT32               hi_desired_baud_rate;                      /* 0x60 */
+    A_UINT32               hi_dbglog_config;                          /* 0x64 */
+    A_UINT32               hi_end_RAM_reserve_sz;                     /* 0x68 */
+    A_UINT32               hi_mbox_io_block_sz;                       /* 0x6c */
+
+    A_UINT32               hi_num_bpatch_streams;                     /* 0x70 -- unused */
+    A_UINT32               hi_mbox_isr_yield_limit;                   /* 0x74 */
+
+    A_UINT32               hi_refclk_hz;                              /* 0x78 */
+    A_UINT32               hi_ext_clk_detected;                       /* 0x7c */
+    A_UINT32               hi_dbg_uart_txpin;                         /* 0x80 */
+    A_UINT32               hi_dbg_uart_rxpin;                         /* 0x84 */
+    A_UINT32               hi_hci_uart_baud;                          /* 0x88 */
+    A_UINT32               hi_hci_uart_pin_assignments;               /* 0x8C */
+        /* NOTE: byte [0] = tx pin, [1] = rx pin, [2] = rts pin, [3] = cts pin */
+    A_UINT32               hi_hci_uart_baud_scale_val;                /* 0x90 */
+    A_UINT32               hi_hci_uart_baud_step_val;                 /* 0x94 */
+
+    A_UINT32               hi_allocram_start;                         /* 0x98 */
+    A_UINT32               hi_allocram_sz;                            /* 0x9c */
+    A_UINT32               hi_hci_bridge_flags;                       /* 0xa0 */
+    A_UINT32               hi_hci_uart_support_pins;                  /* 0xa4 */
+        /* NOTE: byte [0] = RESET pin (bit 7 is polarity), bytes[1]..bytes[3] are for future use */
+    A_UINT32               hi_hci_uart_pwr_mgmt_params;               /* 0xa8 */
+        /* 0xa8 - [1]: 0 = UART FC active low, 1 = UART FC active high
+         *        [31:16]: wakeup timeout in ms
+         */
+    /* Pointer to extended board Data  */
+    A_UINT32               hi_board_ext_data;                         /* 0xac */
+    A_UINT32               hi_board_ext_data_config;                  /* 0xb0 */
+        /*
+         * Bit [0]  :   valid
+         * Bit[31:16:   size
+         */
+   /*
+     * hi_reset_flag is used to do some stuff when target reset.
+     * such as restore app_start after warm reset or
+     * preserve host Interest area, or preserve ROM data, literals etc.
+     */
+    A_UINT32                hi_reset_flag;                            /* 0xb4 */
+    /* indicate hi_reset_flag is valid */
+    A_UINT32                hi_reset_flag_valid;                      /* 0xb8 */
+    A_UINT32               hi_hci_uart_pwr_mgmt_params_ext;           /* 0xbc */
+        /* 0xbc - [31:0]: idle timeout in ms
+         */
+        /* ACS flags */
+    A_UINT32               hi_acs_flags;                              /* 0xc0 */
+    A_UINT32               hi_console_flags;                          /* 0xc4 */
+    A_UINT32               hi_nvram_state;                            /* 0xc8 */
+    A_UINT32               hi_option_flag2;                           /* 0xcc */
+
+    /* If non-zero, override values sent to Host in WMI_READY event. */
+    A_UINT32               hi_sw_version_override;                    /* 0xd0 */
+    A_UINT32               hi_abi_version_override;                   /* 0xd4 */
+
+    /* test applications flags */
+    A_UINT32               hi_test_apps_related    ;                  /* 0xd8 */
+    /* location of test script */
+    A_UINT32               hi_ota_testscript;                         /* 0xdc */
+    /* location of CAL data */
+    A_UINT32               hi_cal_data;                               /* 0xe0 */
+
+} POSTPACK64;
+/* bitmap for hi_test_apps_related */
+#define HI_TEST_APPS_TESTSCRIPT_LOADED   0x00000001
+#define HI_TEST_APPS_CAL_DATA_AVAIL      0x00000002
+
+/* Bits defined in hi_option_flag */
+#define HI_OPTION_TIMER_WAR         0x01 /* Enable timer workaround */
+#define HI_OPTION_BMI_CRED_LIMIT    0x02 /* Limit BMI command credits */
+#define HI_OPTION_RELAY_DOT11_HDR   0x04 /* Relay Dot11 hdr to/from host */
+#define HI_OPTION_MAC_ADDR_METHOD   0x08 /* MAC addr method 0-locally administred 1-globally unique addrs */
+#define HI_OPTION_ENABLE_RFKILL     0x10 /* RFKill Enable Feature*/
+#define HI_OPTION_ENABLE_PROFILE    0x20 /* Enable CPU profiling */
+#define HI_OPTION_DISABLE_DBGLOG    0x40 /* Disable debug logging */
+#define HI_OPTION_SKIP_ERA_TRACKING 0x80 /* Skip Era Tracking */
+#define HI_OPTION_PAPRD_DISABLE     0x100 /* Disable PAPRD (debug) */
+#define HI_OPTION_NUM_DEV_LSB       0x200
+#define HI_OPTION_NUM_DEV_MSB       0x800
+#define HI_OPTION_DEV_MODE_LSB      0x1000
+#define HI_OPTION_DEV_MODE_MSB      0x8000000
+#define HI_OPTION_NO_LFT_STBL       0x10000000 /* Disable LowFreq Timer Stabilization */
+#define HI_OPTION_SKIP_REG_SCAN     0x20000000 /* Skip regulatory scan */
+#define HI_OPTION_INIT_REG_SCAN     0x40000000 /* Do regulatory scan during init before sending WMI ready event to host */
+#define HI_OPTION_FW_BRIDGE         0x80000000
+
+#define HI_OPTION_OFFLOAD_AMSDU     0x01
+#define HI_OPTION_MAC_ADDR_METHOD_SHIFT 3
+
+/* 2 bits of hi_option_flag are used to represent 3 modes */
+#define HI_OPTION_FW_MODE_IBSS    0x0 /* IBSS Mode */
+#define HI_OPTION_FW_MODE_BSS_STA 0x1 /* STA Mode */
+#define HI_OPTION_FW_MODE_AP      0x2 /* AP Mode */
+#define HI_OPTION_FW_MODE_BT30AMP 0x3 /* BT30 AMP Mode */
+
+/* 2 bits of hi_option flag are usedto represent 4 submodes */
+#define HI_OPTION_FW_SUBMODE_NONE    0x0  /* Normal mode */
+#define HI_OPTION_FW_SUBMODE_P2PDEV  0x1  /* p2p device mode */
+#define HI_OPTION_FW_SUBMODE_P2PCLIENT 0x2 /* p2p client mode */
+#define HI_OPTION_FW_SUBMODE_P2PGO   0x3 /* p2p go mode */
+
+/* Num dev Mask */
+#define HI_OPTION_NUM_DEV_MASK    0x7
+#define HI_OPTION_NUM_DEV_SHIFT   0x9
+
+#define HI_OPTION_RF_KILL_SHIFT   0x4
+#define HI_OPTION_RF_KILL_MASK    0x1
+
+/* firmware bridging */
+#define HI_OPTION_FW_BRIDGE_SHIFT 0x1f
+
+/* Fw Mode/SubMode Mask
+|-------------------------------------------------------------------------------|
+|   SUB   |   SUB   |   SUB   |  SUB    |         |         |         |         |
+| MODE[3] | MODE[2] | MODE[1] | MODE[0] | MODE[3] | MODE[2] | MODE[1] | MODE[0] |
+|   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |   (2)   |
+|-------------------------------------------------------------------------------|
+*/
+#define HI_OPTION_FW_MODE_BITS         0x2
+#define HI_OPTION_FW_MODE_MASK         0x3
+#define HI_OPTION_FW_MODE_SHIFT        0xC
+#define HI_OPTION_ALL_FW_MODE_MASK     0xFF
+
+#define HI_OPTION_FW_SUBMODE_BITS      0x2
+#define HI_OPTION_FW_SUBMODE_MASK      0x3
+#define HI_OPTION_FW_SUBMODE_SHIFT     0x14
+#define HI_OPTION_ALL_FW_SUBMODE_MASK  0xFF00
+#define HI_OPTION_ALL_FW_SUBMODE_SHIFT 0x8
+
+/* hi_reset_flag */
+#define HI_RESET_FLAG_PRESERVE_APP_START         0x01   /* preserve App Start address */
+#define HI_RESET_FLAG_PRESERVE_HOST_INTEREST     0x02  /* preserve host interest */
+#define HI_RESET_FLAG_PRESERVE_ROMDATA           0x04  /* preserve ROM data */
+#define HI_RESET_FLAG_PRESERVE_NVRAM_STATE       0x08
+
+#define HI_RESET_FLAG_IS_VALID  0x12345678  /* indicate the reset flag is valid */
+
+#define ON_RESET_FLAGS_VALID() \
+        (HOST_INTEREST->hi_reset_flag_valid == HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_VALIDATE()  \
+        (HOST_INTEREST->hi_reset_flag_valid = HI_RESET_FLAG_IS_VALID)
+
+#define RESET_FLAGS_INVALIDATE() \
+        (HOST_INTEREST->hi_reset_flag_valid = 0)
+
+#define ON_RESET_PRESERVE_APP_START() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_APP_START)
+
+#define ON_RESET_PRESERVE_NVRAM_STATE() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_NVRAM_STATE)
+
+#define ON_RESET_PRESERVE_HOST_INTEREST() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_HOST_INTEREST)
+
+#define ON_RESET_PRESERVE_ROMDATA() \
+        (HOST_INTEREST->hi_reset_flag & HI_RESET_FLAG_PRESERVE_ROMDATA)
+
+#define HI_ACS_FLAGS_ENABLED        (1 << 0)    /* ACS is enabled */
+#define HI_ACS_FLAGS_USE_WWAN       (1 << 1)    /* Use physical WWAN device */
+#define HI_ACS_FLAGS_TEST_VAP       (1 << 2)    /* Use test VAP */
+
+/* CONSOLE FLAGS
+ *
+ * Bit Range  Meaning
+ * ---------  --------------------------------
+ *   2..0     UART ID (0 = Default)
+ *    3       Baud Select (0 = 9600, 1 = 115200)
+ *   30..4    Reserved
+ *    31      Enable Console
+ *
+ * */
+
+#define HI_CONSOLE_FLAGS_ENABLE       (1 << 31)
+#define HI_CONSOLE_FLAGS_UART_MASK    (0x7)
+#define HI_CONSOLE_FLAGS_UART_SHIFT   0
+#define HI_CONSOLE_FLAGS_BAUD_SELECT  (1 << 3)
+
+/*
+ * Intended for use by Host software, this macro returns the Target RAM
+ * address of any item in the host_interest structure.
+ * Example: target_addr = AR6002_HOST_INTEREST_ITEM_ADDRESS(hi_board_data);
+ */
+#define AR6002_HOST_INTEREST_ITEM_ADDRESS(item) \
+    (A_UINT32)((unsigned long)&((((struct host_interest_s *)(AR6002_HOST_INTEREST_ADDRESS))->item)))
+
+#define AR6003_HOST_INTEREST_ITEM_ADDRESS(item) \
+    (A_UINT32)((unsigned long)&((((struct host_interest_s *)(AR6003_HOST_INTEREST_ADDRESS))->item)))
+
+#define MCKINLEY_HOST_INTEREST_ITEM_ADDRESS(item) \
+    ((A_UINT32)&((((struct host_interest_s *)(MCKINLEY_HOST_INTEREST_ADDRESS))->item)))
+
+#define HOST_INTEREST_DBGLOG_IS_ENABLED() \
+        (!(HOST_INTEREST->hi_option_flag & HI_OPTION_DISABLE_DBGLOG))
+
+#define HOST_INTEREST_PROFILE_IS_ENABLED() \
+        (HOST_INTEREST->hi_option_flag & HI_OPTION_ENABLE_PROFILE)
+
+#define LF_TIMER_STABILIZATION_IS_ENABLED() \
+        (!(HOST_INTEREST->hi_option_flag & HI_OPTION_NO_LFT_STBL))
+
+#define IS_AMSDU_OFFLAOD_ENABLED() \
+        ((HOST_INTEREST->hi_option_flag2 & HI_OPTION_OFFLOAD_AMSDU))
+
+/* Convert a Target virtual address into a Target physical address */
+#define AR6002_VTOP(vaddr) ((vaddr) & 0x001fffff)
+#define AR6003_VTOP(vaddr) ((vaddr) & 0x001fffff)
+#define MCKINLEY_VTOP(vaddr) (vaddr)
+#define TARG_VTOP(TargetType, vaddr) \
+        (((TargetType) == TARGET_TYPE_AR6002) ? AR6002_VTOP(vaddr) : \
+        (((TargetType) == TARGET_TYPE_AR6003) ? AR6003_VTOP(vaddr) : \
+        (((TargetType) == TARGET_TYPE_MCKINLEY) ? MCKINLEY_VTOP(vaddr) : 0)))
+
+#define HOST_INTEREST_ITEM_ADDRESS(TargetType, item) \
+        (((TargetType) == TARGET_TYPE_AR6002) ? AR6002_HOST_INTEREST_ITEM_ADDRESS(item) : \
+        (((TargetType) == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : \
+        (((TargetType) == TARGET_TYPE_MCKINLEY) ? MCKINLEY_HOST_INTEREST_ITEM_ADDRESS(item) : 0)))
+
+/* override REV2 ROM's app start address */
+#define AR6002_REV2_APP_START_OVERRIDE      0x911A00
+#define AR6002_REV2_DATASET_PATCH_ADDRESS   0x52d8b0
+#define AR6002_REV2_APP_LOAD_ADDRESS        0x502070
+
+#define AR6003_REV2_APP_START_OVERRIDE    0x944C00
+#define AR6003_REV2_APP_LOAD_ADDRESS      0x543180
+#define AR6003_REV2_BOARD_EXT_DATA_ADDRESS      0x57E500
+#define AR6003_REV2_DATASET_PATCH_ADDRESS       0x57e884
+#define AR6003_REV2_RAM_RESERVE_SIZE      6912
+
+#define AR6003_REV3_APP_START_OVERRIDE    0x945E20
+#define AR6003_REV3_APP_LOAD_ADDRESS      0x545000
+#define AR6003_REV3_BOARD_EXT_DATA_ADDRESS      0x542330
+#define AR6003_REV3_DATASET_PATCH_ADDRESS       0x57FEC8 
+#define AR6003_REV3_RAM_RESERVE_SIZE            512
+#define AR6003_REV3_RAM_RESERVE_SIZE_TCMD       4352
+
+/* # of A_UINT32 entries in targregs, used by DIAG_FETCH_TARG_REGS */
+#define AR6003_FETCH_TARG_REGS_COUNT 64
+#define MCKINLEY_FETCH_TARG_REGS_COUNT 64
+
+#endif /* !__ASSEMBLER__ */
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#endif /* __TARGADDRS_H__ */
diff --git a/host/include/target_reg_table.h b/host/include/target_reg_table.h
new file mode 100644
index 0000000..d868a00
--- /dev/null
+++ b/host/include/target_reg_table.h
@@ -0,0 +1,353 @@
+//------------------------------------------------------------------------------
+// <copyright file="target_reg_table.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Target register table macros and structure definitions
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef TARGET_REG_TABLE_H_
+#define TARGET_REG_TABLE_H_
+
+#include "targaddrs.h"
+/*** WARNING : Add to the end of the TABLE! do not change the order ****/
+typedef struct targetdef_s {
+    A_UINT32 d_RTC_SOC_BASE_ADDRESS;
+    A_UINT32 d_RTC_WMAC_BASE_ADDRESS;
+    A_UINT32 d_SYSTEM_SLEEP_OFFSET;
+    A_UINT32 d_WLAN_SYSTEM_SLEEP_OFFSET;
+    A_UINT32 d_WLAN_SYSTEM_SLEEP_DISABLE_LSB;
+    A_UINT32 d_WLAN_SYSTEM_SLEEP_DISABLE_MASK;
+    A_UINT32 d_CLOCK_CONTROL_OFFSET;
+    A_UINT32 d_CLOCK_CONTROL_SI0_CLK_MASK;
+    A_UINT32 d_RESET_CONTROL_OFFSET;
+    A_UINT32 d_RESET_CONTROL_MBOX_RST_MASK;
+    A_UINT32 d_RESET_CONTROL_SI0_RST_MASK;
+    A_UINT32 d_WLAN_RESET_CONTROL_OFFSET;
+    A_UINT32 d_WLAN_RESET_CONTROL_COLD_RST_MASK;
+    A_UINT32 d_WLAN_RESET_CONTROL_WARM_RST_MASK;
+    A_UINT32 d_GPIO_BASE_ADDRESS;
+    A_UINT32 d_GPIO_PIN0_OFFSET;
+    A_UINT32 d_GPIO_PIN1_OFFSET;
+    A_UINT32 d_GPIO_PIN0_CONFIG_MASK;
+    A_UINT32 d_GPIO_PIN1_CONFIG_MASK;
+    A_UINT32 d_SI_CONFIG_BIDIR_OD_DATA_LSB;
+    A_UINT32 d_SI_CONFIG_BIDIR_OD_DATA_MASK;
+    A_UINT32 d_SI_CONFIG_I2C_LSB;
+    A_UINT32 d_SI_CONFIG_I2C_MASK;
+    A_UINT32 d_SI_CONFIG_POS_SAMPLE_LSB;
+    A_UINT32 d_SI_CONFIG_POS_SAMPLE_MASK;
+    A_UINT32 d_SI_CONFIG_INACTIVE_CLK_LSB;
+    A_UINT32 d_SI_CONFIG_INACTIVE_CLK_MASK;
+    A_UINT32 d_SI_CONFIG_INACTIVE_DATA_LSB;
+    A_UINT32 d_SI_CONFIG_INACTIVE_DATA_MASK;
+    A_UINT32 d_SI_CONFIG_DIVIDER_LSB;
+    A_UINT32 d_SI_CONFIG_DIVIDER_MASK;
+    A_UINT32 d_SI_BASE_ADDRESS;
+    A_UINT32 d_SI_CONFIG_OFFSET;
+    A_UINT32 d_SI_TX_DATA0_OFFSET;
+    A_UINT32 d_SI_TX_DATA1_OFFSET;
+    A_UINT32 d_SI_RX_DATA0_OFFSET;
+    A_UINT32 d_SI_RX_DATA1_OFFSET;
+    A_UINT32 d_SI_CS_OFFSET;
+    A_UINT32 d_SI_CS_DONE_ERR_MASK;
+    A_UINT32 d_SI_CS_DONE_INT_MASK;
+    A_UINT32 d_SI_CS_START_LSB;
+    A_UINT32 d_SI_CS_START_MASK;
+    A_UINT32 d_SI_CS_RX_CNT_LSB;
+    A_UINT32 d_SI_CS_RX_CNT_MASK;
+    A_UINT32 d_SI_CS_TX_CNT_LSB;
+    A_UINT32 d_SI_CS_TX_CNT_MASK;
+    A_UINT32 d_BOARD_DATA_SZ;
+    A_UINT32 d_BOARD_EXT_DATA_SZ;
+    A_UINT32 d_MBOX_BASE_ADDRESS;
+    A_UINT32 d_LOCAL_SCRATCH_OFFSET;
+    A_UINT32 d_CPU_CLOCK_OFFSET;
+    A_UINT32 d_LPO_CAL_OFFSET;
+    A_UINT32 d_GPIO_PIN10_OFFSET;
+    A_UINT32 d_GPIO_PIN11_OFFSET;
+    A_UINT32 d_GPIO_PIN12_OFFSET;
+    A_UINT32 d_GPIO_PIN13_OFFSET;
+    A_UINT32 d_CLOCK_GPIO_OFFSET;
+    A_UINT32 d_CPU_CLOCK_STANDARD_LSB;
+    A_UINT32 d_CPU_CLOCK_STANDARD_MASK;
+    A_UINT32 d_LPO_CAL_ENABLE_LSB;
+    A_UINT32 d_LPO_CAL_ENABLE_MASK;
+    A_UINT32 d_CLOCK_GPIO_BT_CLK_OUT_EN_LSB;
+    A_UINT32 d_CLOCK_GPIO_BT_CLK_OUT_EN_MASK;
+    A_UINT32 d_ANALOG_INTF_BASE_ADDRESS;
+    A_UINT32 d_GPIO_PIN9_OFFSET;
+} TARGET_REGISTER_TABLE;
+
+#define ATH_UNSUPPORTED_REG_OFFSET 0xffffffff
+#define ATH_SUPPORTED_BY_TARGET(reg_offset) ((reg_offset) != ATH_UNSUPPORTED_REG_OFFSET)
+
+#define BOARD_DATA_SZ_MAX 2048
+
+#if defined(MY_TARGET_DEF) /* { */
+#if defined(ATHR_WIN_DEF)
+#define ATH_REG_TABLE_DIRECT_ASSIGN
+#endif
+
+/* Cross-platform compatibility */
+#if !defined(SOC_RESET_CONTROL_OFFSET) && defined(RESET_CONTROL_OFFSET)
+#define SOC_RESET_CONTROL_OFFSET RESET_CONTROL_OFFSET
+#endif
+#if !defined(CLOCK_GPIO_OFFSET)
+#define CLOCK_GPIO_OFFSET ATH_UNSUPPORTED_REG_OFFSET
+#define CLOCK_GPIO_BT_CLK_OUT_EN_LSB 0
+#define CLOCK_GPIO_BT_CLK_OUT_EN_MASK 0
+#endif
+
+#ifdef ATH_REG_TABLE_DIRECT_ASSIGN
+
+static struct targetdef_s my_target_def = {
+    RTC_SOC_BASE_ADDRESS,
+    RTC_WMAC_BASE_ADDRESS,
+    SYSTEM_SLEEP_OFFSET,
+    WLAN_SYSTEM_SLEEP_OFFSET,
+    WLAN_SYSTEM_SLEEP_DISABLE_LSB,
+    WLAN_SYSTEM_SLEEP_DISABLE_MASK,
+    CLOCK_CONTROL_OFFSET,
+    CLOCK_CONTROL_SI0_CLK_MASK,
+    SOC_RESET_CONTROL_OFFSET,
+    RESET_CONTROL_MBOX_RST_MASK,
+    RESET_CONTROL_SI0_RST_MASK,
+    WLAN_RESET_CONTROL_OFFSET,
+    WLAN_RESET_CONTROL_COLD_RST_MASK,
+    WLAN_RESET_CONTROL_WARM_RST_MASK,
+    GPIO_BASE_ADDRESS,
+    GPIO_PIN0_OFFSET,
+    GPIO_PIN1_OFFSET,
+    GPIO_PIN0_CONFIG_MASK,
+    GPIO_PIN1_CONFIG_MASK,
+    SI_CONFIG_BIDIR_OD_DATA_LSB,
+    SI_CONFIG_BIDIR_OD_DATA_MASK,
+    SI_CONFIG_I2C_LSB,
+    SI_CONFIG_I2C_MASK,
+    SI_CONFIG_POS_SAMPLE_LSB,
+    SI_CONFIG_POS_SAMPLE_MASK,
+    SI_CONFIG_INACTIVE_CLK_LSB,
+    SI_CONFIG_INACTIVE_CLK_MASK,
+    SI_CONFIG_INACTIVE_DATA_LSB,
+    SI_CONFIG_INACTIVE_DATA_MASK,
+    SI_CONFIG_DIVIDER_LSB,
+    SI_CONFIG_DIVIDER_MASK,
+    SI_BASE_ADDRESS,
+    SI_CONFIG_OFFSET,
+    SI_TX_DATA0_OFFSET,
+    SI_TX_DATA1_OFFSET,
+    SI_RX_DATA0_OFFSET,
+    SI_RX_DATA1_OFFSET,
+    SI_CS_OFFSET,
+    SI_CS_DONE_ERR_MASK,
+    SI_CS_DONE_INT_MASK,
+    SI_CS_START_LSB,
+    SI_CS_START_MASK,
+    SI_CS_RX_CNT_LSB,
+    SI_CS_RX_CNT_MASK,
+    SI_CS_TX_CNT_LSB,
+    SI_CS_TX_CNT_MASK,
+    MY_TARGET_BOARD_DATA_SZ,
+    MY_TARGET_BOARD_EXT_DATA_SZ,
+    MBOX_BASE_ADDRESS,
+    LOCAL_SCRATCH_OFFSET,
+    CPU_CLOCK_OFFSET,
+    LPO_CAL_OFFSET,
+    GPIO_PIN10_OFFSET,
+    GPIO_PIN11_OFFSET,
+    GPIO_PIN12_OFFSET,
+    GPIO_PIN13_OFFSET,
+    CLOCK_GPIO_OFFSET,
+    CPU_CLOCK_STANDARD_LSB,
+    CPU_CLOCK_STANDARD_MASK,
+    LPO_CAL_ENABLE_LSB,
+    LPO_CAL_ENABLE_MASK,
+    CLOCK_GPIO_BT_CLK_OUT_EN_LSB,
+    CLOCK_GPIO_BT_CLK_OUT_EN_MASK,
+    ANALOG_INTF_BASE_ADDRESS,
+    GPIO_PIN9_OFFSET,
+};
+
+#else
+
+static struct targetdef_s my_target_def = {
+    .d_RTC_SOC_BASE_ADDRESS = RTC_SOC_BASE_ADDRESS,                      
+    .d_RTC_WMAC_BASE_ADDRESS = RTC_WMAC_BASE_ADDRESS,
+    .d_SYSTEM_SLEEP_OFFSET = WLAN_SYSTEM_SLEEP_OFFSET,
+    .d_WLAN_SYSTEM_SLEEP_OFFSET = WLAN_SYSTEM_SLEEP_OFFSET,
+    .d_WLAN_SYSTEM_SLEEP_DISABLE_LSB = WLAN_SYSTEM_SLEEP_DISABLE_LSB,
+    .d_WLAN_SYSTEM_SLEEP_DISABLE_MASK = WLAN_SYSTEM_SLEEP_DISABLE_MASK,
+    .d_CLOCK_CONTROL_OFFSET = CLOCK_CONTROL_OFFSET,
+    .d_CLOCK_CONTROL_SI0_CLK_MASK = CLOCK_CONTROL_SI0_CLK_MASK,
+    .d_RESET_CONTROL_OFFSET = SOC_RESET_CONTROL_OFFSET,
+    .d_RESET_CONTROL_MBOX_RST_MASK = RESET_CONTROL_MBOX_RST_MASK,
+    .d_RESET_CONTROL_SI0_RST_MASK = RESET_CONTROL_SI0_RST_MASK,
+    .d_WLAN_RESET_CONTROL_OFFSET = WLAN_RESET_CONTROL_OFFSET,
+    .d_WLAN_RESET_CONTROL_COLD_RST_MASK = WLAN_RESET_CONTROL_COLD_RST_MASK,
+    .d_WLAN_RESET_CONTROL_WARM_RST_MASK = WLAN_RESET_CONTROL_WARM_RST_MASK,
+    .d_GPIO_BASE_ADDRESS = GPIO_BASE_ADDRESS,
+    .d_GPIO_PIN0_OFFSET = GPIO_PIN0_OFFSET,
+    .d_GPIO_PIN1_OFFSET = GPIO_PIN1_OFFSET,
+    .d_GPIO_PIN0_CONFIG_MASK = GPIO_PIN0_CONFIG_MASK,
+    .d_GPIO_PIN1_CONFIG_MASK = GPIO_PIN1_CONFIG_MASK,
+    .d_SI_CONFIG_BIDIR_OD_DATA_LSB = SI_CONFIG_BIDIR_OD_DATA_LSB,
+    .d_SI_CONFIG_BIDIR_OD_DATA_MASK = SI_CONFIG_BIDIR_OD_DATA_MASK,
+    .d_SI_CONFIG_I2C_LSB = SI_CONFIG_I2C_LSB,
+    .d_SI_CONFIG_I2C_MASK = SI_CONFIG_I2C_MASK,
+    .d_SI_CONFIG_POS_SAMPLE_LSB = SI_CONFIG_POS_SAMPLE_LSB,
+    .d_SI_CONFIG_POS_SAMPLE_MASK = SI_CONFIG_POS_SAMPLE_MASK,
+    .d_SI_CONFIG_INACTIVE_CLK_LSB = SI_CONFIG_INACTIVE_CLK_LSB,
+    .d_SI_CONFIG_INACTIVE_CLK_MASK = SI_CONFIG_INACTIVE_CLK_MASK,
+    .d_SI_CONFIG_INACTIVE_DATA_LSB = SI_CONFIG_INACTIVE_DATA_LSB,
+    .d_SI_CONFIG_INACTIVE_DATA_MASK = SI_CONFIG_INACTIVE_DATA_MASK,
+    .d_SI_CONFIG_DIVIDER_LSB = SI_CONFIG_DIVIDER_LSB,
+    .d_SI_CONFIG_DIVIDER_MASK = SI_CONFIG_DIVIDER_MASK,
+    .d_SI_BASE_ADDRESS = SI_BASE_ADDRESS,
+    .d_SI_CONFIG_OFFSET = SI_CONFIG_OFFSET,
+    .d_SI_TX_DATA0_OFFSET = SI_TX_DATA0_OFFSET,
+    .d_SI_TX_DATA1_OFFSET = SI_TX_DATA1_OFFSET,
+    .d_SI_RX_DATA0_OFFSET = SI_RX_DATA0_OFFSET,
+    .d_SI_RX_DATA1_OFFSET = SI_RX_DATA1_OFFSET,
+    .d_SI_CS_OFFSET = SI_CS_OFFSET,
+    .d_SI_CS_DONE_ERR_MASK = SI_CS_DONE_ERR_MASK,
+    .d_SI_CS_DONE_INT_MASK = SI_CS_DONE_INT_MASK,
+    .d_SI_CS_START_LSB = SI_CS_START_LSB,
+    .d_SI_CS_START_MASK = SI_CS_START_MASK,
+    .d_SI_CS_RX_CNT_LSB = SI_CS_RX_CNT_LSB,
+    .d_SI_CS_RX_CNT_MASK = SI_CS_RX_CNT_MASK,
+    .d_SI_CS_TX_CNT_LSB = SI_CS_TX_CNT_LSB,
+    .d_SI_CS_TX_CNT_MASK = SI_CS_TX_CNT_MASK,
+    .d_BOARD_DATA_SZ = MY_TARGET_BOARD_DATA_SZ,
+    .d_BOARD_EXT_DATA_SZ = MY_TARGET_BOARD_EXT_DATA_SZ,
+    .d_MBOX_BASE_ADDRESS = MBOX_BASE_ADDRESS,
+    .d_LOCAL_SCRATCH_OFFSET = LOCAL_SCRATCH_OFFSET,
+    .d_CPU_CLOCK_OFFSET = CPU_CLOCK_OFFSET,
+    .d_LPO_CAL_OFFSET = LPO_CAL_OFFSET,
+    .d_GPIO_PIN10_OFFSET = GPIO_PIN10_OFFSET,
+    .d_GPIO_PIN11_OFFSET = GPIO_PIN11_OFFSET,
+    .d_GPIO_PIN12_OFFSET = GPIO_PIN12_OFFSET,
+    .d_GPIO_PIN13_OFFSET = GPIO_PIN13_OFFSET,
+    .d_CLOCK_GPIO_OFFSET = CLOCK_GPIO_OFFSET,
+    .d_CPU_CLOCK_STANDARD_LSB = CPU_CLOCK_STANDARD_LSB,
+    .d_CPU_CLOCK_STANDARD_MASK = CPU_CLOCK_STANDARD_MASK,
+    .d_LPO_CAL_ENABLE_LSB = LPO_CAL_ENABLE_LSB,
+    .d_LPO_CAL_ENABLE_MASK = LPO_CAL_ENABLE_MASK,
+    .d_CLOCK_GPIO_BT_CLK_OUT_EN_LSB = CLOCK_GPIO_BT_CLK_OUT_EN_LSB,
+    .d_CLOCK_GPIO_BT_CLK_OUT_EN_MASK = CLOCK_GPIO_BT_CLK_OUT_EN_MASK,
+    .d_ANALOG_INTF_BASE_ADDRESS = ANALOG_INTF_BASE_ADDRESS,
+    .d_GPIO_PIN9_OFFSET = GPIO_PIN9_OFFSET,
+};
+
+#endif
+
+#if MY_TARGET_BOARD_DATA_SZ > BOARD_DATA_SZ_MAX
+#error "BOARD_DATA_SZ_MAX is too small"
+#endif
+
+struct targetdef_s *MY_TARGET_DEF = &my_target_def;
+
+#else /* } { */
+
+#define RTC_SOC_BASE_ADDRESS                     (targetdef->d_RTC_SOC_BASE_ADDRESS)
+#define RTC_WMAC_BASE_ADDRESS                    (targetdef->d_RTC_WMAC_BASE_ADDRESS)
+#define SYSTEM_SLEEP_OFFSET                      (targetdef->d_SYSTEM_SLEEP_OFFSET)
+#define WLAN_SYSTEM_SLEEP_OFFSET                 (targetdef->d_WLAN_SYSTEM_SLEEP_OFFSET)
+#define WLAN_SYSTEM_SLEEP_DISABLE_LSB            (targetdef->d_WLAN_SYSTEM_SLEEP_DISABLE_LSB)
+#define WLAN_SYSTEM_SLEEP_DISABLE_MASK           (targetdef->d_WLAN_SYSTEM_SLEEP_DISABLE_MASK)
+#define CLOCK_CONTROL_OFFSET                     (targetdef->d_CLOCK_CONTROL_OFFSET)
+#define CLOCK_CONTROL_SI0_CLK_MASK               (targetdef->d_CLOCK_CONTROL_SI0_CLK_MASK)
+#define RESET_CONTROL_OFFSET                     (targetdef->d_RESET_CONTROL_OFFSET)
+#define RESET_CONTROL_MBOX_RST_MASK              (targetdef->d_RESET_CONTROL_MBOX_RST_MASK)
+#define RESET_CONTROL_SI0_RST_MASK               (targetdef->d_RESET_CONTROL_SI0_RST_MASK)
+#define WLAN_RESET_CONTROL_OFFSET                (targetdef->d_WLAN_RESET_CONTROL_OFFSET)
+#define WLAN_RESET_CONTROL_COLD_RST_MASK         (targetdef->d_WLAN_RESET_CONTROL_COLD_RST_MASK)
+#define WLAN_RESET_CONTROL_WARM_RST_MASK         (targetdef->d_WLAN_RESET_CONTROL_WARM_RST_MASK)
+#define GPIO_BASE_ADDRESS                        (targetdef->d_GPIO_BASE_ADDRESS)
+#define GPIO_PIN0_OFFSET                         (targetdef->d_GPIO_PIN0_OFFSET)
+#define GPIO_PIN1_OFFSET                         (targetdef->d_GPIO_PIN1_OFFSET)
+#define GPIO_PIN0_CONFIG_MASK                    (targetdef->d_GPIO_PIN0_CONFIG_MASK)
+#define GPIO_PIN1_CONFIG_MASK                    (targetdef->d_GPIO_PIN1_CONFIG_MASK)
+#define SI_CONFIG_BIDIR_OD_DATA_LSB              (targetdef->d_SI_CONFIG_BIDIR_OD_DATA_LSB)
+#define SI_CONFIG_BIDIR_OD_DATA_MASK             (targetdef->d_SI_CONFIG_BIDIR_OD_DATA_MASK)
+#define SI_CONFIG_I2C_LSB                        (targetdef->d_SI_CONFIG_I2C_LSB)
+#define SI_CONFIG_I2C_MASK                       (targetdef->d_SI_CONFIG_I2C_MASK)
+#define SI_CONFIG_POS_SAMPLE_LSB                 (targetdef->d_SI_CONFIG_POS_SAMPLE_LSB)
+#define SI_CONFIG_POS_SAMPLE_MASK                (targetdef->d_SI_CONFIG_POS_SAMPLE_MASK)
+#define SI_CONFIG_INACTIVE_CLK_LSB               (targetdef->d_SI_CONFIG_INACTIVE_CLK_LSB)
+#define SI_CONFIG_INACTIVE_CLK_MASK              (targetdef->d_SI_CONFIG_INACTIVE_CLK_MASK)
+#define SI_CONFIG_INACTIVE_DATA_LSB              (targetdef->d_SI_CONFIG_INACTIVE_DATA_LSB)
+#define SI_CONFIG_INACTIVE_DATA_MASK             (targetdef->d_SI_CONFIG_INACTIVE_DATA_MASK)
+#define SI_CONFIG_DIVIDER_LSB                    (targetdef->d_SI_CONFIG_DIVIDER_LSB)
+#define SI_CONFIG_DIVIDER_MASK                   (targetdef->d_SI_CONFIG_DIVIDER_MASK)
+#define SI_BASE_ADDRESS                          (targetdef->d_SI_BASE_ADDRESS)
+#define SI_CONFIG_OFFSET                         (targetdef->d_SI_CONFIG_OFFSET)
+#define SI_TX_DATA0_OFFSET                       (targetdef->d_SI_TX_DATA0_OFFSET)
+#define SI_TX_DATA1_OFFSET                       (targetdef->d_SI_TX_DATA1_OFFSET)
+#define SI_RX_DATA0_OFFSET                       (targetdef->d_SI_RX_DATA0_OFFSET)
+#define SI_RX_DATA1_OFFSET                       (targetdef->d_SI_RX_DATA1_OFFSET)
+#define SI_CS_OFFSET                             (targetdef->d_SI_CS_OFFSET)
+#define SI_CS_DONE_ERR_MASK                      (targetdef->d_SI_CS_DONE_ERR_MASK)
+#define SI_CS_DONE_INT_MASK                      (targetdef->d_SI_CS_DONE_INT_MASK)
+#define SI_CS_START_LSB                          (targetdef->d_SI_CS_START_LSB)
+#define SI_CS_START_MASK                         (targetdef->d_SI_CS_START_MASK)
+#define SI_CS_RX_CNT_LSB                         (targetdef->d_SI_CS_RX_CNT_LSB)
+#define SI_CS_RX_CNT_MASK                        (targetdef->d_SI_CS_RX_CNT_MASK)
+#define SI_CS_TX_CNT_LSB                         (targetdef->d_SI_CS_TX_CNT_LSB)
+#define SI_CS_TX_CNT_MASK                        (targetdef->d_SI_CS_TX_CNT_MASK)
+#define EEPROM_SZ                                (targetdef->d_BOARD_DATA_SZ)
+#define EEPROM_EXT_SZ                            (targetdef->d_BOARD_EXT_DATA_SZ)
+#define MBOX_BASE_ADDRESS                        (targetdef->d_MBOX_BASE_ADDRESS)
+#define LOCAL_SCRATCH_OFFSET                     (targetdef->d_LOCAL_SCRATCH_OFFSET)
+#define CPU_CLOCK_OFFSET                         (targetdef->d_CPU_CLOCK_OFFSET)
+#define LPO_CAL_OFFSET                           (targetdef->d_LPO_CAL_OFFSET)
+#define GPIO_PIN10_OFFSET                        (targetdef->d_GPIO_PIN10_OFFSET)
+#define GPIO_PIN11_OFFSET                        (targetdef->d_GPIO_PIN11_OFFSET)
+#define GPIO_PIN12_OFFSET                        (targetdef->d_GPIO_PIN12_OFFSET)
+#define GPIO_PIN13_OFFSET                        (targetdef->d_GPIO_PIN13_OFFSET)
+#define CLOCK_GPIO_OFFSET                        (targetdef->d_CLOCK_GPIO_OFFSET)
+#define CPU_CLOCK_STANDARD_LSB                   (targetdef->d_CPU_CLOCK_STANDARD_LSB)
+#define CPU_CLOCK_STANDARD_MASK                  (targetdef->d_CPU_CLOCK_STANDARD_MASK)
+#define LPO_CAL_ENABLE_LSB                       (targetdef->d_LPO_CAL_ENABLE_LSB)
+#define LPO_CAL_ENABLE_MASK                      (targetdef->d_LPO_CAL_ENABLE_MASK)
+#define CLOCK_GPIO_BT_CLK_OUT_EN_LSB             (targetdef->d_CLOCK_GPIO_BT_CLK_OUT_EN_LSB)
+#define CLOCK_GPIO_BT_CLK_OUT_EN_MASK            (targetdef->d_CLOCK_GPIO_BT_CLK_OUT_EN_MASK)
+#define ANALOG_INTF_BASE_ADDRESS                 (targetdef->d_ANALOG_INTF_BASE_ADDRESS)
+#define GPIO_PIN9_OFFSET                         (targetdef->d_GPIO_PIN9_OFFSET)
+
+/* SET macros */
+#define WLAN_SYSTEM_SLEEP_DISABLE_SET(x)         (((x) << WLAN_SYSTEM_SLEEP_DISABLE_LSB) & WLAN_SYSTEM_SLEEP_DISABLE_MASK)
+#define SI_CONFIG_BIDIR_OD_DATA_SET(x)           (((x) << SI_CONFIG_BIDIR_OD_DATA_LSB) & SI_CONFIG_BIDIR_OD_DATA_MASK)
+#define SI_CONFIG_I2C_SET(x)                     (((x) << SI_CONFIG_I2C_LSB) & SI_CONFIG_I2C_MASK)
+#define SI_CONFIG_POS_SAMPLE_SET(x)              (((x) << SI_CONFIG_POS_SAMPLE_LSB) & SI_CONFIG_POS_SAMPLE_MASK)
+#define SI_CONFIG_INACTIVE_CLK_SET(x)            (((x) << SI_CONFIG_INACTIVE_CLK_LSB) & SI_CONFIG_INACTIVE_CLK_MASK)
+#define SI_CONFIG_INACTIVE_DATA_SET(x)           (((x) << SI_CONFIG_INACTIVE_DATA_LSB) & SI_CONFIG_INACTIVE_DATA_MASK)
+#define SI_CONFIG_DIVIDER_SET(x)                 (((x) << SI_CONFIG_DIVIDER_LSB) & SI_CONFIG_DIVIDER_MASK)
+#define SI_CS_START_SET(x)                       (((x) << SI_CS_START_LSB) & SI_CS_START_MASK)
+#define SI_CS_RX_CNT_SET(x)                      (((x) << SI_CS_RX_CNT_LSB) & SI_CS_RX_CNT_MASK)
+#define SI_CS_TX_CNT_SET(x)                      (((x) << SI_CS_TX_CNT_LSB) & SI_CS_TX_CNT_MASK)
+#define LPO_CAL_ENABLE_SET(x)                    (((x) << LPO_CAL_ENABLE_LSB) & LPO_CAL_ENABLE_MASK)
+#define CPU_CLOCK_STANDARD_SET(x)                (((x) << CPU_CLOCK_STANDARD_LSB) & CPU_CLOCK_STANDARD_MASK)
+#define CLOCK_GPIO_BT_CLK_OUT_EN_SET(x)          (((x) << CLOCK_GPIO_BT_CLK_OUT_EN_LSB) & CLOCK_GPIO_BT_CLK_OUT_EN_MASK)
+extern struct targetdef_s *targetdef;
+
+#endif /* } */
+
+#endif /*TARGET_REG_TABLE_H_*/
diff --git a/host/include/testcmd.h b/host/include/testcmd.h
new file mode 100644
index 0000000..e47523c
--- /dev/null
+++ b/host/include/testcmd.h
@@ -0,0 +1,377 @@
+//------------------------------------------------------------------------------
+// <copyright file="testcmd.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef  TESTCMD_H_
+#define  TESTCMD_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef AR6002_REV2
+#define TCMD_MAX_RATES 12
+#else
+#define TCMD_MAX_RATES 28
+#endif
+
+//#define WMI_CMD_ID_SIZE   4
+//#define WMI_CMDS_SIZE_MAX 2048
+//#define TC_CMDS_GAP       16
+// should add up to the same size as buf[WMI_CMDS_SIZE_MAX]
+//#define TC_CMDS_SIZE_MAX  (WMI_CMDS_SIZE_MAX - sizeof(TC_CMDS_HDR) - WMI_CMD_ID_SIZE - TC_CMDS_GAP)
+#define TC_CMDS_SIZE_MAX  256
+
+typedef enum {
+    ZEROES_PATTERN = 0,
+    ONES_PATTERN,
+    REPEATING_10,
+    PN7_PATTERN,
+    PN9_PATTERN,
+    PN15_PATTERN
+}TX_DATA_PATTERN;
+
+/* Continous tx
+   mode : TCMD_CONT_TX_OFF - Disabling continous tx
+          TCMD_CONT_TX_SINE - Enable continuous unmodulated tx
+          TCMD_CONT_TX_FRAME- Enable continuous modulated tx
+   freq : Channel freq in Mhz. (e.g 2412 for channel 1 in 11 g)
+dataRate: 0 - 1 Mbps
+          1 - 2 Mbps
+          2 - 5.5 Mbps
+          3 - 11 Mbps
+          4 - 6 Mbps
+          5 - 9 Mbps
+          6 - 12 Mbps
+          7 - 18 Mbps
+          8 - 24 Mbps
+          9 - 36 Mbps
+         10 - 28 Mbps
+         11 - 54 Mbps
+  txPwr: twice the Tx power in dBm, actual dBm values of [5 -11] for unmod Tx,
+      [5-14] for mod Tx
+antenna:  1 - one antenna
+          2 - two antenna
+Note : Enable/disable continuous tx test cmd works only when target is awake.
+*/
+
+typedef enum {
+    TCMD_CONT_TX_OFF = 0,
+    TCMD_CONT_TX_SINE,
+    TCMD_CONT_TX_FRAME,
+    TCMD_CONT_TX_TX99,
+    TCMD_CONT_TX_TX100,
+    TCMD_CONT_TX_OFFSETTONE,
+} TCMD_CONT_TX_MODE;
+
+typedef enum {
+    TCMD_WLAN_MODE_NOHT = 0,
+    TCMD_WLAN_MODE_HT20 = 1,
+    TCMD_WLAN_MODE_HT40PLUS = 2,
+    TCMD_WLAN_MODE_HT40MINUS = 3,
+    TCMD_WLAN_MODE_CCK = 4,
+
+    TCMD_WLAN_MODE_MAX,
+    TCMD_WLAN_MODE_INVALID = TCMD_WLAN_MODE_MAX,
+
+} TCMD_WLAN_MODE;
+
+typedef enum {
+    TPC_TX_PWR = 0,
+    TPC_FORCED_GAIN,
+    TPC_TGT_PWR
+} TPC_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32                testCmdId;
+    A_UINT32                mode;
+    A_UINT32                freq;
+    A_UINT32                dataRate;
+    A_INT32                 txPwr;
+    A_UINT32                antenna;
+    A_UINT32                enANI;
+    A_UINT32                scramblerOff;
+    A_UINT32                aifsn;
+    A_UINT16                pktSz;
+    A_UINT16                txPattern;
+    A_UINT32                shortGuard;
+    A_UINT32                numPackets;
+    A_UINT32                wlanMode;
+    A_UINT32                tpcm;
+} POSTPACK TCMD_CONT_TX;
+
+#define TCMD_TXPATTERN_ZERONE                 0x1
+#define TCMD_TXPATTERN_ZERONE_DIS_SCRAMBLE    0x2
+
+/* Continuous Rx
+ act: TCMD_CONT_RX_PROMIS - promiscuous mode (accept all incoming frames)
+      TCMD_CONT_RX_FILTER - filter mode (accept only frames with dest
+                                             address equal specified
+                                             mac address (set via act =3)
+      TCMD_CONT_RX_REPORT  off mode  (disable cont rx mode and get the
+                                          report from the last cont
+                                          Rx test)
+
+     TCMD_CONT_RX_SETMAC - set MacAddr mode (sets the MAC address for the
+                                                 target. This Overrides
+                                                 the default MAC address.)
+
+*/
+typedef enum {
+    TCMD_CONT_RX_PROMIS =0,
+    TCMD_CONT_RX_FILTER,
+    TCMD_CONT_RX_REPORT,
+    TCMD_CONT_RX_SETMAC,
+    TCMD_CONT_RX_SET_ANT_SWITCH_TABLE,
+    TC_CMD_RESP,
+} TCMD_CONT_RX_ACT;
+
+typedef PREPACK struct {
+    A_UINT32        testCmdId;
+    A_UINT32        act;
+    A_UINT32        enANI;
+    PREPACK union {
+        struct PREPACK TCMD_CONT_RX_PARA {
+            A_UINT32    freq;
+            A_UINT32    antenna;
+            A_UINT32    wlanMode;
+        } POSTPACK para;
+        struct PREPACK TCMD_CONT_RX_REPORT {
+            A_UINT32    totalPkt;
+            A_INT32     rssiInDBm;
+            A_UINT32    crcErrPkt;
+            A_UINT32    secErrPkt;
+            A_UINT16    rateCnt[TCMD_MAX_RATES];
+            A_UINT16    rateCntShortGuard[TCMD_MAX_RATES];
+        } POSTPACK report;
+        struct PREPACK TCMD_CONT_RX_MAC {
+            A_UCHAR     addr[ATH_MAC_LEN];
+            A_UCHAR     btaddr[ATH_MAC_LEN];
+            A_UINT16    regDmn[2];
+            A_UINT32    otpWriteFlag;
+        } POSTPACK mac;
+        struct PREPACK TCMD_CONT_RX_ANT_SWITCH_TABLE {
+            A_UINT32                antswitch1;
+            A_UINT32                antswitch2;
+        }POSTPACK antswitchtable;
+    } POSTPACK u;
+} POSTPACK TCMD_CONT_RX;
+
+/* Force sleep/wake  test cmd
+ mode: TCMD_PM_WAKEUP - Wakeup the target
+       TCMD_PM_SLEEP - Force the target to sleep.
+ */
+typedef enum {
+    TCMD_PM_WAKEUP = 1, /* be consistent with target */
+    TCMD_PM_SLEEP,
+    TCMD_PM_DEEPSLEEP
+} TCMD_PM_MODE;
+
+typedef PREPACK struct {
+    A_UINT32  testCmdId;
+    A_UINT32  mode;
+} POSTPACK TCMD_PM;
+
+typedef enum {
+    TC_CMDS_VERSION_RESERVED=0,
+    TC_CMDS_VERSION_MDK,
+    TC_CMDS_VERSION_TS,
+    TC_CMDS_VERSION_LAST,
+} TC_CMDS_VERSION;
+
+typedef enum {
+    TC_CMDS_TS =0,
+    TC_CMDS_CAL,
+    TC_CMDS_TPCCAL = TC_CMDS_CAL,
+    TC_CMDS_TPCCAL_WITH_OTPWRITE,
+    TC_CMDS_OTPDUMP,
+    TC_CMDS_OTPSTREAMWRITE,
+    TC_CMDS_EFUSEDUMP,
+    TC_CMDS_EFUSEWRITE,
+    TC_CMDS_READTHERMAL,
+    TC_CMDS_PM_CAL,
+    TC_CMDS_PSAT_CAL,
+    TC_CMDS_PSAT_CAL_RESULT,
+    TC_CMDS_CAL_PWRS,
+    TC_CMDS_WRITE_CAL_2_OTP,
+    TC_CMDS_CHAR_PSAT,
+    TC_CMDS_CHAR_PSAT_RESULT,
+    TC_CMDS_PM_CAL_RESULT,
+    TC_CMDS_SINIT_WAIT,
+    TC_CMDS_SINIT_LOAD_AUTO,
+    TC_CMDS_COUNT
+} TC_CMDS_ACT;
+
+typedef PREPACK struct {
+    A_UINT32   testCmdId;
+    A_UINT32   act;
+    PREPACK union {
+        A_UINT32  enANI;    // to be identical to CONT_RX struct
+        struct PREPACK {
+            A_UINT16   length;
+            A_UINT8    version;
+            A_UINT8    bufLen;
+        } POSTPACK parm;
+    } POSTPACK u;
+} POSTPACK TC_CMDS_HDR;
+
+typedef PREPACK struct {
+    TC_CMDS_HDR  hdr;
+    A_UINT8      buf[TC_CMDS_SIZE_MAX];
+} POSTPACK TC_CMDS;
+
+typedef PREPACK struct {
+    A_UINT32    testCmdId;
+    A_UINT32    regAddr;
+    A_UINT32    val;
+    A_UINT16    flag;
+} POSTPACK TCMD_SET_REG;
+
+typedef enum {
+    TCMD_CONT_TX_ID,
+    TCMD_CONT_RX_ID,
+    TCMD_PM_ID,
+    TC_CMDS_ID,
+    TCMD_SET_REG_ID,
+	
+	/*For synergy purpose we added the following tcmd id but these
+	tcmd's will not go to the firmware instead we will write values 
+	to the NV area */
+	
+	TCMD_NIC_MAC = 100, 
+	TCMD_CAL_FILE_INDEX = 101,
+} TCMD_ID;
+
+typedef PREPACK struct 
+{
+    A_UINT32  testCmdId;
+    A_UINT8   mac_address[ATH_MAC_LEN];
+} POSTPACK TCMD_NIC_MAC_S;
+
+typedef PREPACK struct 
+{
+       A_UINT32  testCmdId;
+       A_UINT32   cal_file_index;
+} POSTPACK TCMD_CAL_FILE_INDEX_S;
+
+typedef PREPACK union {
+    TCMD_CONT_TX         contTx;
+    TCMD_CONT_RX         contRx;
+    TCMD_PM              pm;
+    // New test cmds from ART/MDK ...
+    TC_CMDS              tcCmds;
+    TCMD_SET_REG setReg;
+} POSTPACK TEST_CMD;
+
+typedef enum {
+    TC_MSG_RESERVED,
+    TC_MSG_PSAT_CAL_RESULTS,
+    TC_MSG_CAL_POWER,
+    TC_MSG_CHAR_PSAT_RESULTS,
+    TC_MSG_PM_CAL_RESULTS,
+    TC_MSG_PSAT_CAL_ACK,
+    TC_MSG_COUNT
+} TC_MSG_ID;
+
+typedef PREPACK struct {
+    A_INT8  olpcGainDelta_diff;
+    A_INT8  olpcGainDelta_abs;
+    A_UINT8 thermCalVal;
+    A_UINT8 numTryBF;
+    A_UINT32 cmac_olpc;
+    A_UINT32 cmac_psat;
+    A_UINT16 cmac_olpc_pcdac;
+    A_UINT16 cmac_psat_pcdac;
+    A_INT16  lineSlope;
+    A_INT16  lineVariance;
+    A_UINT16 psatParm;
+    A_UINT8  reserved[2];
+} POSTPACK OLPCGAIN_THERM_DUPLET;
+
+#if !defined(WHAL_NUM_11G_CAL_PIERS_EXT)
+#define WHAL_NUM_11G_CAL_PIERS_EXT 16
+#define WHAL_NUM_11A_CAL_PIERS_EXT 32
+#endif
+#define PSAT_WHAL_NUM_11G_CAL_PIERS_MAX 3
+#define PSAT_WHAL_NUM_11A_CAL_PIERS_MAX 5
+typedef PREPACK struct {
+    OLPCGAIN_THERM_DUPLET olpcGainTherm2G[PSAT_WHAL_NUM_11G_CAL_PIERS_MAX];
+    OLPCGAIN_THERM_DUPLET olpcGainTherm5G[PSAT_WHAL_NUM_11A_CAL_PIERS_MAX];
+} POSTPACK PSAT_CAL_RESULTS;
+
+#define _MAX_TX_GAIN_ENTRIES 32
+typedef PREPACK struct {
+    A_UINT32 cmac_i[_MAX_TX_GAIN_ENTRIES];
+    A_UINT8  pcdac[_MAX_TX_GAIN_ENTRIES];
+
+    A_UINT8  freq;
+    A_UINT8  an_txrf3_rdiv2g;
+    A_UINT8  an_txrf3_pdpredist2g;
+    A_UINT8  an_rxtx2_mxrgain;
+    A_UINT8  an_rxrf_bias1_pwd_ic25mxr2gh;
+    A_UINT8  an_bias2_pwd_ic25rxrf;
+    A_UINT8  an_bb1_i2v_curr2x;
+    A_UINT8  an_txrf3_capdiv2g;
+
+//  A_UINT32 cmac_q[_MAX_TX_GAIN_ENTRIES];
+} POSTPACK CHAR_PSAT_RESULTS;
+
+typedef PREPACK struct {
+    A_INT16  txPwr2G_t10[WHAL_NUM_11G_CAL_PIERS_EXT];
+    A_INT16  txPwr5G_t10[WHAL_NUM_11A_CAL_PIERS_EXT];
+} POSTPACK CAL_TXPWR;
+
+typedef PREPACK struct {
+    A_UINT8    thermCalVal;
+    A_UINT8    future[3];
+} POSTPACK PM_CAL_RESULTS;
+
+typedef PREPACK struct {
+    TC_MSG_ID msgId;
+    PREPACK union {
+        PSAT_CAL_RESULTS               psatCalResults;
+        CAL_TXPWR                      txPwrs;
+        CHAR_PSAT_RESULTS              psatCharResults;
+        PM_CAL_RESULTS                 pmCalResults;
+    } POSTPACK msg;
+
+} POSTPACK TC_MSG;
+
+typedef struct _psat_sweep_table {
+    A_UINT8  an_txrf3_rdiv2g;               // [0,3] _RDIV2G_MIN, _RDIV2G_MAX
+    A_UINT8  an_txrf3_pdpredist2g;          // [0,1] _PDPREDIST2G_MIN, _PDPREDIST2G_MAX
+    A_UINT8  an_rxtx2_mxrgain;              // [0,3] _MXRGAIN_MIN, _MXRGAIN_MAX
+    A_UINT8  an_rxrf_bias1_pwd_ic25mxr2gh;  // [0,3] _PWD_IC25MX2GH_MIN, _PWD_IC25MXRGH_MAX
+    A_UINT8  an_bias2_pwd_ic25rxrf;         // [0,3] _PWD_IC25RXRF_MIN, _PWD_RC25RXRF_MAX
+    A_UINT8  an_bb1_i2v_curr2x;             // [0,1] _I2V_CURR2X_MIN, _I2V_CURR2X_MAX
+    A_UINT8  an_txrf3_capdiv2g;             // [0,15] _CAPDIV2G_MIN, _CAPDIV2G_MAX
+    A_INT8   olpcPsatCmacDelta;             // olpcPsatCmacDelta 
+    A_UINT16 psatParm;
+    A_UINT16 padding2;
+} PSAT_SWEEP_TABLE;
+#define NUM_PSAT_CHAR_PARMS  7
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TESTCMD_H_ */
diff --git a/host/include/tlpm.h b/host/include/tlpm.h
new file mode 100644
index 0000000..39c5930
--- /dev/null
+++ b/host/include/tlpm.h
@@ -0,0 +1,38 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __TLPM_H__
+#define __TLPM_H__
+
+/* idle timeout in 16-bit value as in HOST_INTEREST hi_hci_uart_pwr_mgmt_params */
+#define TLPM_DEFAULT_IDLE_TIMEOUT_MS         1000
+/* hex in LSB and MSB for HCI command */
+#define TLPM_DEFAULT_IDLE_TIMEOUT_LSB        0xE8
+#define TLPM_DEFAULT_IDLE_TIMEOUT_MSB        0x3
+
+/* wakeup timeout in 8-bit value as in HOST_INTEREST hi_hci_uart_pwr_mgmt_params */
+#define TLPM_DEFAULT_WAKEUP_TIMEOUT_MS       10
+
+/* default UART FC polarity is low */
+#define TLPM_DEFAULT_UART_FC_POLARITY        0
+
+#endif
diff --git a/host/include/utils_api.h b/host/include/utils_api.h
new file mode 100644
index 0000000..d3aad4e
--- /dev/null
+++ b/host/include/utils_api.h
@@ -0,0 +1,103 @@
+//------------------------------------------------------------------------------
+// <copyright file="utils_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Utility Macros & Functions common across OS.
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_UTILS_API_H_
+#define _HOST_UTILS_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif 
+
+/* unaligned little endian access */
+#define LE_READ_2(p)                            \
+    ((A_UINT16)                            \
+     ((((A_UINT8 *)(p))[0]      ) | (((A_UINT8 *)(p))[1] <<  8)))
+
+#define LE_READ_4(p)                            \
+    ((A_UINT32)                            \
+     ((((A_UINT8 *)(p))[0]      ) | (((A_UINT8 *)(p))[1] <<  8) | \
+      (((A_UINT8 *)(p))[2] << 16) | (((A_UINT8 *)(p))[3] << 24)))
+
+#define WPA_GET_BE16(a) ((A_UINT16) (((a)[0] << 8) | (a)[1]))
+#define WPA_PUT_BE16(a, val)			\
+	do {					\
+		(a)[0] = ((A_UINT16) (val)) >> 8;	\
+		(a)[1] = ((A_UINT16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_GET_LE16(a) ((A_UINT16) (((a)[1] << 8) | (a)[0]))
+#define WPA_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((A_UINT16) (val)) >> 8;	\
+		(a)[0] = ((A_UINT16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_GET_BE24(a) ((((A_UINT32) (a)[0]) << 16) | (((A_UINT32) (a)[1]) << 8) | \
+			 ((A_UINT32) (a)[2]))
+#define WPA_PUT_BE24(a, val)					\
+	do {							\
+		(a)[0] = (A_UINT8) ((((A_UINT32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (A_UINT8) ((((A_UINT32) (val)) >> 8) & 0xff);	\
+		(a)[2] = (A_UINT8) (((A_UINT32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_GET_BE32(a) ((((A_UINT32) (a)[0]) << 24) | (((A_UINT32) (a)[1]) << 16) | \
+			 (((A_UINT32) (a)[2]) << 8) | ((A_UINT32) (a)[3]))
+#define WPA_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (A_UINT8) ((((A_UINT32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (A_UINT8) ((((A_UINT32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (A_UINT8) ((((A_UINT32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (A_UINT8) (((A_UINT32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_GET_LE32(a) ((((A_UINT32) (a)[3]) << 24) | (((A_UINT32) (a)[2]) << 16) | \
+			 (((A_UINT32) (a)[1]) << 8) | ((A_UINT32) (a)[0]))
+#define WPA_PUT_LE32(a, val)					\
+	do {							\
+		(a)[3] = (A_UINT8) ((((A_UINT32) (val)) >> 24) & 0xff);	\
+		(a)[2] = (A_UINT8) ((((A_UINT32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (A_UINT8) ((((A_UINT32) (val)) >> 8) & 0xff);	\
+		(a)[0] = (A_UINT8) (((A_UINT32) (val)) & 0xff);		\
+	} while (0)
+
+
+#define WPA_OUI             0xf25000
+
+static int __inline
+iswscoui(const A_UINT8 *frm)
+{
+    return frm[1] > 3 && LE_READ_4(frm+2) == ((0x04<<24)|WPA_OUI);
+}
+
+static inline int is_zero_mac_addr(const A_UINT8 *addr)
+{
+	return !(addr[0] | addr[1] | addr[2] | addr[3] | addr[4] | addr[5]);
+}
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _HOST_UTILS_API_H_ */
diff --git a/host/include/wac_defs.h b/host/include/wac_defs.h
new file mode 100644
index 0000000..ea695ff
--- /dev/null
+++ b/host/include/wac_defs.h
@@ -0,0 +1,56 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __WAC_API_H__
+#define __WAC_API_H__
+
+typedef enum {
+    WAC_SET,
+    WAC_GET,
+} WAC_REQUEST_TYPE;
+
+typedef enum {
+    WAC_ADD,
+    WAC_DEL,
+    WAC_GET_STATUS,
+    WAC_GET_IE,
+} WAC_COMMAND;
+
+typedef enum {
+    PRBREQ,
+    PRBRSP,
+    BEACON,
+} WAC_FRAME_TYPE;
+
+typedef enum {
+    WAC_FAILED_NO_WAC_AP = -4,
+    WAC_FAILED_LOW_RSSI = -3,
+    WAC_FAILED_INVALID_PARAM = -2,
+    WAC_FAILED_REJECTED = -1,
+    WAC_SUCCESS = 0,
+    WAC_DISABLED = 1,
+    WAC_PROCEED_FIRST_PHASE,
+    WAC_PROCEED_SECOND_PHASE,
+} WAC_STATUS;
+
+
+#endif
diff --git a/host/include/wlan_api.h b/host/include/wlan_api.h
new file mode 100644
index 0000000..15eeadf
--- /dev/null
+++ b/host/include/wlan_api.h
@@ -0,0 +1,157 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the API for the host wlan module
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_WLAN_API_H_
+#define _HOST_WLAN_API_H_
+
+#ifdef ATHR_NWIFI
+#include <ndis.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <a_osapi.h>
+
+struct ieee80211_node_table;
+struct ieee80211_frame;
+
+struct ieee80211_common_ie {
+    A_UINT16    ie_chan;
+    A_UINT8     *ie_tstamp;
+    A_UINT8     *ie_ssid;
+    A_UINT8     *ie_rates;
+    A_UINT8     *ie_xrates;
+    A_UINT8     *ie_country;
+    A_UINT8     *ie_wpa;
+    A_UINT8     *ie_rsn;
+    A_UINT8     *ie_wmm;
+    A_UINT8     *ie_ath;
+    A_UINT16    ie_capInfo;
+    A_UINT16    ie_beaconInt;
+    A_UINT8     *ie_tim;
+    A_UINT8     *ie_chswitch;
+    A_UINT8     ie_erp;
+    A_UINT8     *ie_wsc;
+    A_UINT8     *ie_htcap;
+    A_UINT8     *ie_htop;
+#ifdef HS20_ENABLE
+    A_UINT8     *ie_hs20;
+    A_UINT8     *ie_extcap;
+#endif
+#ifdef WAPI_ENABLE
+    A_UINT8     *ie_wapi;
+#endif
+
+#ifdef ATHR_NWIFI
+    A_UINT8     *ie_wsc_becon;
+    A_UINT8     *ie_wsc_probe;
+#endif
+
+};
+
+typedef struct bss {
+    A_UINT8                      ni_macaddr[6];
+    A_UINT8                      ni_snr;
+    A_INT16                      ni_rssi;
+    struct bss                   *ni_list_next;
+    struct bss                   *ni_list_prev;
+    struct bss                   *ni_hash_next;
+    struct bss                   *ni_hash_prev;
+    struct ieee80211_common_ie   ni_cie;
+#ifdef P2P
+    void                         *p2p_dev;
+#endif /* P2P */
+    A_UINT8                     *ni_buf;
+    A_UINT16                     ni_framelen;
+    A_UINT8                      ni_frametype; /* frame type in ni_buf */
+    struct ieee80211_node_table *ni_table;
+    A_UINT32                     ni_refcnt;
+    int                          ni_scangen;
+
+#ifdef ATHR_NWIFI
+    ULONGLONG                    HostTimestamp;
+#else
+    A_UINT32                     ni_tstamp;
+    A_UINT32                     ni_actcnt;
+#endif
+#ifdef OS_ROAM_MANAGEMENT
+    A_UINT32                     ni_si_gen;
+#endif
+} bss_t;
+
+typedef void wlan_node_iter_func(void *arg, bss_t *);
+
+bss_t *wlan_node_alloc(struct ieee80211_node_table *nt, int wh_size);
+void wlan_node_free(bss_t *ni);
+void wlan_setup_node(struct ieee80211_node_table *nt, bss_t *ni,
+                const A_UINT8 *macaddr);
+bss_t *wlan_find_node(struct ieee80211_node_table *nt, const A_UINT8 *macaddr);
+void wlan_node_reclaim(struct ieee80211_node_table *nt, bss_t *ni);
+A_STATUS wlan_node_buf_update(struct ieee80211_node_table *nt, bss_t *ni, A_UINT32 len);
+void wlan_free_allnodes(struct ieee80211_node_table *nt);
+void wlan_iterate_nodes(struct ieee80211_node_table *nt, wlan_node_iter_func *f,
+                        void *arg);
+
+void wlan_node_table_init(void *wmip, struct ieee80211_node_table *nt);
+void wlan_node_table_reset(struct ieee80211_node_table *nt);
+void wlan_node_table_cleanup(struct ieee80211_node_table *nt);
+
+A_STATUS wlan_parse_beacon(A_UINT8 *buf, int framelen,
+                           struct ieee80211_common_ie *cie);
+
+A_UINT16 wlan_ieee2freq(int chan);
+A_UINT32 wlan_freq2ieee(A_UINT16 freq);
+
+void wlan_set_nodeage(struct ieee80211_node_table *nt, A_UINT32 nodeAge);
+
+#ifdef ATHR_NWIFI
+void
+wlan_refresh_scan_table (struct ieee80211_node_table *nt, ULONGLONG OldestAllowedEntry);
+#else
+void
+wlan_refresh_inactive_nodes (struct ieee80211_node_table *nt);
+#endif
+
+bss_t *
+wlan_find_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
+                    A_UINT32 ssidLength, A_BOOL bIsWPA2, A_BOOL bMatchSSID);
+
+void
+wlan_node_return (struct ieee80211_node_table *nt, bss_t *ni);
+
+bss_t *wlan_node_remove(struct ieee80211_node_table *nt, A_UINT8 *bssid);
+
+bss_t *
+wlan_find_matching_Ssidnode (struct ieee80211_node_table *nt, A_UCHAR *pSsid,
+                    A_UINT32 ssidLength, A_UINT32 dot11AuthMode, A_UINT32 authMode,
+                   A_UINT32 pairwiseCryptoType, A_UINT32 grpwiseCryptoTyp);
+
+void wlan_node_update_timestamp(struct ieee80211_node_table *nt, bss_t *ni);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HOST_WLAN_API_H_ */
diff --git a/host/include/wlan_defs.h b/host/include/wlan_defs.h
new file mode 100644
index 0000000..458e96c
--- /dev/null
+++ b/host/include/wlan_defs.h
@@ -0,0 +1,88 @@
+//------------------------------------------------------------------------------
+// <copyright file="wlan_defs.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef __WLAN_DEFS_H__
+#define __WLAN_DEFS_H__
+
+/*
+ * This file contains WLAN definitions that may be used across both
+ * Host and Target software.  
+ */
+
+typedef enum {
+    MODE_11A        = 0,   /* 11a Mode */
+    MODE_11G        = 1,   /* 11b/g Mode */
+    MODE_11B        = 2,   /* 11b Mode */
+    MODE_11GONLY    = 3,   /* 11g only Mode */
+#ifdef SUPPORT_11N
+    MODE_11NA_HT20   = 4,  /* 11a HT20 mode */
+    MODE_11NG_HT20   = 5,  /* 11g HT20 mode */
+    MODE_11NA_HT40   = 6,  /* 11a HT40 mode */
+    MODE_11NG_HT40   = 7,  /* 11g HT40 mode */
+    MODE_UNKNOWN    = 8,
+    MODE_MAX        = 8
+#else
+    MODE_UNKNOWN    = 4,
+    MODE_MAX        = 4
+#endif
+} WLAN_PHY_MODE;
+
+typedef enum {
+    WLAN_11A_CAPABILITY   = 1,
+    WLAN_11G_CAPABILITY   = 2,
+    WLAN_11AG_CAPABILITY  = 3,
+}WLAN_CAPABILITY;
+
+#ifdef SUPPORT_11N
+#ifdef SUPPORT_2SS
+typedef A_UINT64 A_RATEMASK;
+#else
+typedef unsigned long A_RATEMASK;
+#endif /* SUPPORT_2SS */
+#else
+typedef unsigned short A_RATEMASK;
+#endif /* SUPPORT_11N */
+
+#ifdef SUPPORT_11N
+#define IS_MODE_11A(mode)       (((mode) == MODE_11A) || \
+                                 ((mode) == MODE_11NA_HT20) || \
+                                 ((mode) == MODE_11NA_HT40))
+#define IS_MODE_11B(mode)       ((mode) == MODE_11B)
+#define IS_MODE_11G(mode)       (((mode) == MODE_11G) || \
+                                 ((mode) == MODE_11GONLY) || \
+                                 ((mode) == MODE_11NG_HT20) || \
+                                 ((mode) == MODE_11NG_HT40))
+#define IS_MODE_11GN(mode)      (((mode) == MODE_11NG_HT20) || \
+                                 ((mode) == MODE_11NG_HT40))
+#define IS_MODE_11GONLY(mode)   ((mode) == MODE_11GONLY)
+#define IS_MODE_11AN(mode)      (((mode) == MODE_11NA_HT20) || \
+                                 ((mode) == MODE_11NA_HT40))
+#define IS_MODE_11N(mode)       ((IS_MODE_11GN(mode)) || (IS_MODE_11AN(mode)))
+#else
+#define IS_MODE_11A(mode)       ((mode) == MODE_11A)
+#define IS_MODE_11B(mode)       ((mode) == MODE_11B)
+#define IS_MODE_11G(mode)       (((mode) == MODE_11G) || \
+                                 ((mode) == MODE_11GONLY))
+#define IS_MODE_11GONLY(mode)   ((mode) == MODE_11GONLY)
+#endif /* SUPPORT_11N */
+
+#endif /* __WLANDEFS_H__ */
diff --git a/host/include/wlan_dset.h b/host/include/wlan_dset.h
new file mode 100644
index 0000000..16481e1
--- /dev/null
+++ b/host/include/wlan_dset.h
@@ -0,0 +1,33 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2007-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef __WLAN_DSET_H__
+#define __WLAN_DSET_H__
+
+typedef PREPACK struct wow_config_dset {
+
+    A_UINT8 valid_dset;
+    A_UINT8 gpio_enable;
+    A_UINT16 gpio_pin;
+} POSTPACK WOW_CONFIG_DSET;
+
+#endif
diff --git a/host/include/wmi.h b/host/include/wmi.h
new file mode 100644
index 0000000..228db7c
--- /dev/null
+++ b/host/include/wmi.h
@@ -0,0 +1,3918 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all the
+ * commands and events. Commands are messages from the host to the WM.
+ * Events and Replies are messages from the WM to the host.
+ *
+ * Ownership of correctness in regards to commands
+ * belongs to the host driver and the WMI is not required to validate
+ * parameters for value, proper range, or any other checking.
+ *
+ */
+
+#ifndef _WMI_H_
+#define _WMI_H_
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#include "wmix.h"
+#include "wlan_defs.h"
+#ifdef ATH_SUPPORT_DFS
+#include "dfs_common.h"
+#endif
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define HTC_PROTOCOL_VERSION    0x0002
+#define HTC_PROTOCOL_REVISION   0x0000
+
+#define WMI_PROTOCOL_VERSION    0x0002
+#define WMI_PROTOCOL_REVISION   0x0000
+
+#define ATH_MAC_LEN             6               /* length of mac in bytes */
+#define WMI_CMD_MAX_LEN         100
+#define WMI_CONTROL_MSG_MAX_LEN     256
+#define WMI_OPT_CONTROL_MSG_MAX_LEN 1536
+#define IS_ETHERTYPE(_typeOrLen)        ((_typeOrLen) >= 0x0600)
+#define RFC1042OUI      {0x00, 0x00, 0x00}
+
+#define IP_ETHERTYPE 0x0800
+
+#define WMI_IMPLICIT_PSTREAM 0xFF
+#define WMI_MAX_THINSTREAM 15
+
+#ifdef AR6002_REV2
+#define IBSS_MAX_NUM_STA          4
+#else
+#define IBSS_MAX_NUM_STA          8
+#endif
+
+#define COUNTRY_CODE_PRESENT      0x80
+#define SPACE                     0x20
+
+#define WMI_MODE_MAX              8
+#define WMI_MAX_RATE_MASK         2
+#define WMI_NETWORK_TYPE(networkType) ((networkType) & 0x000F)         
+#define WMI_CONNECTED_PHYMODE(networkType) (((networkType) & 0x0F00) >> 8)
+
+PREPACK struct host_app_area_s {
+    A_UINT32 wmi_protocol_ver;
+} POSTPACK;
+
+/*
+ * Data Path
+ */
+typedef PREPACK struct {
+    A_UINT8     dstMac[ATH_MAC_LEN];
+    A_UINT8     srcMac[ATH_MAC_LEN];
+    A_UINT16    typeOrLen;
+} POSTPACK ATH_MAC_HDR;
+
+typedef PREPACK struct {
+    A_UINT8     dsap;
+    A_UINT8     ssap;
+    A_UINT8     cntl;
+    A_UINT8     orgCode[3];
+    A_UINT16    etherType;
+} POSTPACK ATH_LLC_SNAP_HDR;
+
+typedef enum {
+    DATA_MSGTYPE = 0x0,
+    CNTL_MSGTYPE,
+    SYNC_MSGTYPE,
+    OPT_MSGTYPE,
+} WMI_MSG_TYPE;
+
+
+/*
+ * Macros for operating on WMI_DATA_HDR (info) field
+ */
+
+#define WMI_DATA_HDR_MSG_TYPE_MASK  0x03
+#define WMI_DATA_HDR_MSG_TYPE_SHIFT 0
+#define WMI_DATA_HDR_UP_MASK        0x07
+#define WMI_DATA_HDR_UP_SHIFT       2
+/* In AP mode, the same bit (b5) is used to indicate Power save state in
+ * the Rx dir and More data bit state in the tx direction.
+ */
+#define WMI_DATA_HDR_PS_MASK        0x1
+#define WMI_DATA_HDR_PS_SHIFT       5
+
+#define WMI_DATA_HDR_MORE_MASK      0x1
+#define WMI_DATA_HDR_MORE_SHIFT     5
+
+typedef enum {
+    WMI_DATA_HDR_DATA_TYPE_802_3 = 0,
+    WMI_DATA_HDR_DATA_TYPE_802_11,
+    WMI_DATA_HDR_DATA_TYPE_ACL,
+} WMI_DATA_HDR_DATA_TYPE;
+
+/* Bitmap of data header flags */
+typedef enum {
+    WMI_DATA_HDR_FLAGS_MORE = 0x1,
+    WMI_DATA_HDR_FLAGS_EOSP = 0x2,
+} WMI_DATA_HDR_FLAGS;
+
+#define WMI_DATA_HDR_DATA_TYPE_MASK     0x3
+#define WMI_DATA_HDR_DATA_TYPE_SHIFT    6
+
+#define WMI_DATA_HDR_SET_MORE_BIT(h) ((h)->info |= (WMI_DATA_HDR_MORE_MASK << WMI_DATA_HDR_MORE_SHIFT))
+#define WMI_DATA_HDR_HAS_MORE_BIT(h) ((h)->info & (WMI_DATA_HDR_MORE_MASK << WMI_DATA_HDR_MORE_SHIFT))
+
+#define WMI_DATA_HDR_IS_MSG_TYPE(h, t)  (((h)->info & (WMI_DATA_HDR_MSG_TYPE_MASK)) == (t))
+#define WMI_DATA_HDR_SET_MSG_TYPE(h, t) (h)->info = (((h)->info & ~(WMI_DATA_HDR_MSG_TYPE_MASK << WMI_DATA_HDR_MSG_TYPE_SHIFT)) | (t << WMI_DATA_HDR_MSG_TYPE_SHIFT))
+#define WMI_DATA_HDR_GET_UP(h)    (((h)->info >> WMI_DATA_HDR_UP_SHIFT) & WMI_DATA_HDR_UP_MASK)
+#define WMI_DATA_HDR_SET_UP(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_UP_MASK << WMI_DATA_HDR_UP_SHIFT)) | (p << WMI_DATA_HDR_UP_SHIFT))
+
+#define WMI_DATA_HDR_GET_DATA_TYPE(h)   (((h)->info >> WMI_DATA_HDR_DATA_TYPE_SHIFT) & WMI_DATA_HDR_DATA_TYPE_MASK)
+#define WMI_DATA_HDR_SET_DATA_TYPE(h, p) (h)->info = (((h)->info & ~(WMI_DATA_HDR_DATA_TYPE_MASK << WMI_DATA_HDR_DATA_TYPE_SHIFT)) | ((p) << WMI_DATA_HDR_DATA_TYPE_SHIFT))
+
+#define WMI_DATA_HDR_GET_DOT11(h)   (WMI_DATA_HDR_GET_DATA_TYPE((h)) == WMI_DATA_HDR_DATA_TYPE_802_11)
+#define WMI_DATA_HDR_SET_DOT11(h, p) WMI_DATA_HDR_SET_DATA_TYPE((h), (p))
+
+/* Macros for operating on WMI_DATA_HDR (info2) field */
+#define WMI_DATA_HDR_SEQNO_MASK     0xFFF
+#define WMI_DATA_HDR_SEQNO_SHIFT    0
+
+#define WMI_DATA_HDR_AMSDU_MASK     0x1
+#define WMI_DATA_HDR_AMSDU_SHIFT    12
+
+#define WMI_DATA_HDR_META_MASK      0x7
+#define WMI_DATA_HDR_META_SHIFT     13
+
+#define GET_SEQ_NO(_v)                  ((_v) & WMI_DATA_HDR_SEQNO_MASK)
+#define GET_ISMSDU(_v)                  ((_v) & WMI_DATA_HDR_AMSDU_MASK)
+
+#define WMI_DATA_HDR_GET_SEQNO(h)        GET_SEQ_NO((h)->info2 >> WMI_DATA_HDR_SEQNO_SHIFT)
+#define WMI_DATA_HDR_SET_SEQNO(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_SEQNO_MASK << WMI_DATA_HDR_SEQNO_SHIFT)) | (GET_SEQ_NO(_v) << WMI_DATA_HDR_SEQNO_SHIFT))
+
+#define WMI_DATA_HDR_IS_AMSDU(h)        GET_ISMSDU((h)->info2 >> WMI_DATA_HDR_AMSDU_SHIFT)
+#define WMI_DATA_HDR_SET_AMSDU(h, _v)   ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_AMSDU_MASK << WMI_DATA_HDR_AMSDU_SHIFT)) | (GET_ISMSDU(_v) << WMI_DATA_HDR_AMSDU_SHIFT))
+
+#define WMI_DATA_HDR_GET_META(h)        (((h)->info2 >> WMI_DATA_HDR_META_SHIFT) & WMI_DATA_HDR_META_MASK)
+#define WMI_DATA_HDR_SET_META(h, _v)    ((h)->info2 = ((h)->info2 & ~(WMI_DATA_HDR_META_MASK << WMI_DATA_HDR_META_SHIFT)) | ((_v) << WMI_DATA_HDR_META_SHIFT))
+
+/* Macros for operating on WMI_DATA_HDR (info3) field */
+#define WMI_DATA_HDR_DEVID_MASK      0xF
+#define WMI_DATA_HDR_DEVID_SHIFT     0
+#define GET_DEVID(_v)                ((_v) & WMI_DATA_HDR_DEVID_MASK)
+
+#define WMI_DATA_HDR_GET_DEVID(h)        (((h)->info3 >> WMI_DATA_HDR_DEVID_SHIFT) & WMI_DATA_HDR_DEVID_MASK)
+#define WMI_DATA_HDR_SET_DEVID(h, _v)   ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_DEVID_MASK << WMI_DATA_HDR_DEVID_SHIFT)) | (GET_DEVID(_v) << WMI_DATA_HDR_DEVID_SHIFT))
+
+#define WMI_DATA_HDR_TRIGGER_MASK      0x1
+#define WMI_DATA_HDR_TRIGGER_SHIFT     4
+#define WMI_DATA_HDR_SET_TRIGGER(h, _v)   ((h)->info3 = ((h)->info3 & ~(WMI_DATA_HDR_TRIGGER_MASK << WMI_DATA_HDR_TRIGGER_SHIFT)) | ((_v) << WMI_DATA_HDR_TRIGGER_SHIFT))
+#define WMI_DATA_HDR_IS_TRIGGER(h)       ((((h)->info3 >> WMI_DATA_HDR_TRIGGER_SHIFT) & WMI_DATA_HDR_TRIGGER_MASK) == WMI_DATA_HDR_TRIGGER_MASK)
+
+#define WMI_DATA_HDR_EOSP_MASK      WMI_DATA_HDR_TRIGGER_MASK
+#define WMI_DATA_HDR_EOSP_SHIFT     WMI_DATA_HDR_TRIGGER_SHIFT
+
+#define WMI_DATA_HDR_SET_EOSP_BIT(h) ((h)->info3 |= (WMI_DATA_HDR_EOSP_MASK << WMI_DATA_HDR_EOSP_SHIFT))
+#define WMI_DATA_HDR_HAS_EOSP_BIT(h) ((h)->info3 & (WMI_DATA_HDR_EOSP_MASK << WMI_DATA_HDR_EOSP_SHIFT))
+
+typedef PREPACK struct {
+    A_INT8      rssi;
+    A_UINT8     info;               /* usage of 'info' field(8-bit):
+                                     *  b1:b0       - WMI_MSG_TYPE
+                                     *  b4:b3:b2    - UP(tid)
+                                     *  b5          - Used in AP mode. More-data in tx dir, PS in rx.
+                                     *  b7:b6       -  Dot3 header(0),
+                                     *                 Dot11 Header(1),
+                                     *                 ACL data(2)
+                                     */
+
+    A_UINT16    info2;              /* usage of 'info2' field(16-bit):
+                                     * b11:b0       - seq_no
+                                     * b12          - A-MSDU?
+                                     * b15:b13      - META_DATA_VERSION 0 - 7
+                                     */
+    A_UINT16    info3;              /* b3:b2:b1:b0  - device id
+                                     * b4           - Used in AP mode. uAPSD trigger in rx, EOSP in tx
+                                     */
+} POSTPACK WMI_DATA_HDR;
+
+/*
+ *  TX META VERSION DEFINITIONS
+ */
+#define WMI_MAX_TX_META_SZ  (12)
+#define WMI_MAX_TX_META_VERSION (7)
+#define WMI_META_VERSION_1 (0x01)
+#define WMI_META_VERSION_2 (0X02)
+#define WMI_META_VERSION_3 (0x03)
+
+#define WMI_ACL_TO_DOT11_HEADROOM   36
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_TX_META_V0;
+#endif
+
+typedef PREPACK struct {
+    A_UINT8     pktID;           /* The packet ID to identify the tx request */
+    A_UINT8     ratePolicyID;    /* The rate policy to be used for the tx of this frame */
+} POSTPACK WMI_TX_META_V1;
+
+
+#define WMI_CSUM_DIR_TX (0x1)
+#define TX_CSUM_CALC_FILL (0x1)
+typedef PREPACK struct {
+    A_UINT8    csumStart;       /*Offset from start of the Payload(SNAP header) for csum calculation to begin */
+    A_UINT8    csumDest;        /*Offset from start of Payload(SNAP header) where final csum goes*/
+    A_UINT8     csumFlags;    /*Flag for check sum engine to be offloaded to device*/
+} POSTPACK WMI_TX_META_V2;
+
+/* WMI_META_TX_FLAG... are used as TX qualifiers for frames containing WMI_TX_RATE_SCHEDULE in the 
+ * meta data.  0 or more of these flags should be assigned to the flags member of the schedule. */
+#define WMI_META_TX_FLAG_ACK            0x01 // frame needs ACK response from receiver
+#define WMI_META_TX_FLAG_SET_RETRY_BIT  0x02 // device will set retry bit in MAC header for retried frames.
+#define WMI_META_TX_FLAG_SET_DURATION   0x04 // device will fill duration field in MAC header
+/* NOTE: If WMI_META_TX_FLAG_USE_PREFIX == 0 device will NOT use prefix frame.
+ *       If WMI_META_TX_FLAG_USE_PREFIX == 1 && WMI_META_TX_FLAG_PREFIX_RTS == 0 device will use CTS prefix. 
+ *       If WMI_META_TX_FLAG_USE_PREFIX == 1 && WMI_META_TX_FLAG_PREFIX_RTS == 1 device will use RTS prefix.
+ */  
+#define WMI_META_TX_FLAG_USE_PREFIX     0x08 // device will send either RTS or CTS frame prior to subject frame.
+#define WMI_META_TX_FLAG_PREFIX_RTS     0x10 // device will send RTS and wait for CTS prior to sending subject frame.
+#define WMI_META_TX_LOAD_TSF            0x20 // device will fill the TSF field during transmit procedure. <Beacons/probe responses>
+
+/* WMI_TX_RATE_SCHEDULE - Acts as a host-provided rate schedule to replace what would be normally determined
+ * by firmware.  This allows the host to specify what rates and attempts should be used to transmit the 
+ * frame. */
+typedef PREPACK struct {
+#define WMI_TX_MAX_RATE_SERIES (4)
+    A_UINT8 rateSeries[WMI_TX_MAX_RATE_SERIES]; //rate index for each series. first invalid rate terminates series.
+    A_UINT8 trySeries[WMI_TX_MAX_RATE_SERIES]; //number of tries for each series.
+    A_UINT8 flags; // combination of WMI_META_TX_FLAG...
+    A_UINT8 accessCategory; // should be WMM_AC_BE for managment frames and multicast frames.
+    //A_UINT8 keyIndex;
+    //
+}POSTPACK WMI_TX_RATE_SCHEDULE;
+
+typedef PREPACK struct {
+    WMI_TX_RATE_SCHEDULE rateSched;
+    A_UINT8     pktID;           /* The packet ID to identify the tx request */
+} POSTPACK WMI_TX_META_V3;
+
+/*
+ *  RX META VERSION DEFINITIONS
+ */
+/* if RX meta data is present at all then the meta data field
+ *  will consume WMI_MAX_RX_META_SZ bytes of space between the
+ *  WMI_DATA_HDR and the payload. How much of the available
+ *  Meta data is actually used depends on which meta data
+ *  version is active. */
+#define WMI_MAX_RX_META_SZ  (12)
+#define WMI_MAX_RX_META_VERSION (7)
+
+#define WMI_RX_STATUS_OK            0 /* success */
+#define WMI_RX_STATUS_DECRYPT_ERR   1 /* decrypt error */
+#define WMI_RX_STATUS_MIC_ERR       2 /* tkip MIC error */
+#define WMI_RX_STATUS_ERR           3 /* undefined error */
+
+#define WMI_RX_FLAGS_AGGR           0x0001 /* part of AGGR */
+#define WMI_RX_FlAGS_STBC           0x0002 /* used STBC */
+#define WMI_RX_FLAGS_SGI            0x0004 /* used SGI */
+#define WMI_RX_FLAGS_HT             0x0008 /* is HT packet */
+/* the flags field is also used to store the CRYPTO_TYPE of the frame
+ * that value is shifted by WMI_RX_FLAGS_CRYPTO_SHIFT */
+#define WMI_RX_FLAGS_CRYPTO_SHIFT   4
+#define WMI_RX_FLAGS_CRYPTO_MASK    0x1f
+#define WMI_RX_META_GET_CRYPTO(flags) (((flags) >> WMI_RX_FLAGS_CRYPTO_SHIFT) & WMI_RX_FLAGS_CRYPTO_MASK)
+
+#if 0 /* removed to prevent compile errors for WM.. */
+typedef PREPACK struct {
+/* intentionally empty. Default version is no meta data. */
+} POSTPACK WMI_RX_META_VERSION_0;
+#endif
+
+typedef PREPACK struct {
+    A_UINT8     status; /* one of WMI_RX_STATUS_... */
+    A_UINT8     rix;    /* rate index mapped to rate at which this packet was received. */
+    A_UINT8     rssi;   /* rssi of packet */
+    A_UINT8     channel;/* rf channel during packet reception */
+    A_UINT16    flags;  /* a combination of WMI_RX_FLAGS_... */
+} POSTPACK WMI_RX_META_V1;
+
+#define RX_CSUM_VALID_FLAG (0x1)
+typedef PREPACK struct {
+    A_UINT16    csum;
+    A_UINT8     csumFlags;/* bit 0 set -partial csum valid
+                             bit 1 set -test mode */
+} POSTPACK WMI_RX_META_V2;
+
+
+
+#define WMI_GET_DEVICE_ID(info1) ((info1) & 0xF)
+/* Macros for operating on WMI_CMD_HDR (info1) field */
+#define WMI_CMD_HDR_DEVID_MASK      0xF
+#define WMI_CMD_HDR_DEVID_SHIFT     0
+#define GET_CMD_DEVID(_v)           ((_v) & WMI_CMD_HDR_DEVID_MASK)
+
+#define WMI_CMD_HDR_GET_DEVID(h)        (((h)->info1 >> WMI_CMD_HDR_DEVID_SHIFT) & WMI_CMD_HDR_DEVID_MASK)
+#define WMI_CMD_HDR_SET_DEVID(h, _v)   ((h)->info1 = ((h)->info1 & ~(WMI_CMD_HDR_DEVID_MASK << WMI_CMD_HDR_DEVID_SHIFT)) | (GET_CMD_DEVID(_v) << WMI_CMD_HDR_DEVID_SHIFT))
+
+/*
+ * Control Path
+ */
+typedef PREPACK struct {
+    A_UINT16    commandId;
+/*
+ * info1 - 16 bits
+ * b03:b00 - id
+ * b15:b04 - unused
+ */
+    A_UINT16    info1;
+
+    A_UINT16    reserved;      /* For alignment */
+} POSTPACK WMI_CMD_HDR;        /* used for commands and events */
+
+/*
+ * List of Commnands
+ */
+typedef enum {
+    WMI_CONNECT_CMDID           = 0x0001,
+    WMI_RECONNECT_CMDID,
+    WMI_DISCONNECT_CMDID,
+    WMI_SYNCHRONIZE_CMDID,
+    WMI_CREATE_PSTREAM_CMDID,
+    WMI_DELETE_PSTREAM_CMDID,
+    WMI_START_SCAN_CMDID,
+    WMI_SET_SCAN_PARAMS_CMDID,
+    WMI_SET_BSS_FILTER_CMDID,
+    WMI_SET_PROBED_SSID_CMDID,               /* 10 */
+    WMI_SET_LISTEN_INT_CMDID,
+    WMI_SET_BMISS_TIME_CMDID,
+    WMI_SET_DISC_TIMEOUT_CMDID,
+    WMI_GET_CHANNEL_LIST_CMDID,
+    WMI_SET_BEACON_INT_CMDID,
+    WMI_GET_STATISTICS_CMDID,
+    WMI_SET_CHANNEL_PARAMS_CMDID,
+    WMI_SET_POWER_MODE_CMDID,
+    WMI_SET_IBSS_PM_CAPS_CMDID,
+    WMI_SET_POWER_PARAMS_CMDID,              /* 20 */
+    WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID,
+    WMI_ADD_CIPHER_KEY_CMDID,
+    WMI_DELETE_CIPHER_KEY_CMDID,
+    WMI_ADD_KRK_CMDID,
+    WMI_DELETE_KRK_CMDID,
+    WMI_SET_PMKID_CMDID,
+    WMI_SET_TX_PWR_CMDID,
+    WMI_GET_TX_PWR_CMDID,
+    WMI_SET_ASSOC_INFO_CMDID,
+    WMI_ADD_BAD_AP_CMDID,                    /* 30 */
+    WMI_DELETE_BAD_AP_CMDID,
+    WMI_SET_TKIP_COUNTERMEASURES_CMDID,
+    WMI_RSSI_THRESHOLD_PARAMS_CMDID,
+    WMI_TARGET_ERROR_REPORT_BITMASK_CMDID,
+    WMI_SET_ACCESS_PARAMS_CMDID,
+    WMI_SET_RETRY_LIMITS_CMDID,
+    WMI_RESERVED1,
+    WMI_RESERVED2,
+    WMI_SET_VOICE_PKT_SIZE_CMDID,
+    WMI_SET_MAX_SP_LEN_CMDID,                /* 40 */
+    WMI_SET_ROAM_CTRL_CMDID,
+    WMI_GET_ROAM_TBL_CMDID,
+    WMI_GET_ROAM_DATA_CMDID,
+    WMI_ENABLE_RM_CMDID,
+    WMI_SET_MAX_OFFHOME_DURATION_CMDID,
+    WMI_EXTENSION_CMDID,                        /* Non-wireless extensions */
+    WMI_SNR_THRESHOLD_PARAMS_CMDID,
+    WMI_LQ_THRESHOLD_PARAMS_CMDID,
+    WMI_SET_LPREAMBLE_CMDID,
+    WMI_SET_RTS_CMDID,                       /* 50 */
+    WMI_CLR_RSSI_SNR_CMDID,
+    WMI_SET_FIXRATES_CMDID,
+    WMI_GET_FIXRATES_CMDID,
+    WMI_SET_AUTH_MODE_CMDID,
+    WMI_SET_REASSOC_MODE_CMDID,
+    WMI_SET_WMM_CMDID,
+    WMI_SET_WMM_TXOP_CMDID,
+    WMI_TEST_CMDID,
+    /* COEX AR6002 only*/
+    WMI_SET_BT_STATUS_CMDID,
+    WMI_SET_BT_PARAMS_CMDID,                /* 60 */
+
+    WMI_SET_KEEPALIVE_CMDID,
+    WMI_GET_KEEPALIVE_CMDID,
+    WMI_SET_APPIE_CMDID,
+    WMI_GET_APPIE_CMDID,
+    WMI_SET_WSC_STATUS_CMDID,
+
+    /* Wake on Wireless */
+    WMI_SET_HOST_SLEEP_MODE_CMDID,
+    WMI_SET_WOW_MODE_CMDID,
+    WMI_GET_WOW_LIST_CMDID,
+    WMI_ADD_WOW_PATTERN_CMDID,
+    WMI_DEL_WOW_PATTERN_CMDID,               /* 70 */
+
+    WMI_SET_FRAMERATES_CMDID,
+    WMI_SET_AP_PS_CMDID,
+    WMI_SET_QOS_SUPP_CMDID,
+    /* WMI_THIN_RESERVED_... mark the start and end
+     * values for WMI_THIN_RESERVED command IDs. These
+     * command IDs can be found in wmi_thin.h */
+    WMI_THIN_RESERVED_START = 0x8000,
+    WMI_THIN_RESERVED_END = 0x8fff,
+    /*
+     * Developer commands starts at 0xF000
+     */
+    WMI_SET_BITRATE_CMDID = 0xF000,
+    WMI_GET_BITRATE_CMDID,
+    WMI_SET_WHALPARAM_CMDID,
+
+
+    /*Should add the new command to the tail for compatible with
+     * etna.
+     */
+    WMI_SET_MAC_ADDRESS_CMDID,
+    WMI_SET_AKMP_PARAMS_CMDID,
+    WMI_SET_PMKID_LIST_CMDID,
+    WMI_GET_PMKID_LIST_CMDID,
+    WMI_ABORT_SCAN_CMDID,
+    WMI_SET_TARGET_EVENT_REPORT_CMDID,
+
+    // Unused
+    WMI_UNUSED1,
+    WMI_UNUSED2,
+
+    /*
+     * AP mode commands
+     */
+    WMI_AP_HIDDEN_SSID_CMDID,   /* F00B */
+    WMI_AP_SET_NUM_STA_CMDID,
+    WMI_AP_ACL_POLICY_CMDID,
+    WMI_AP_ACL_MAC_LIST_CMDID,
+    WMI_AP_CONFIG_COMMIT_CMDID,
+    WMI_AP_SET_MLME_CMDID,    /* F010 */
+    WMI_AP_SET_PVB_CMDID,
+    WMI_AP_CONN_INACT_CMDID,
+    WMI_AP_PROT_SCAN_TIME_CMDID,
+    WMI_AP_SET_COUNTRY_CMDID,
+    WMI_AP_SET_DTIM_CMDID,
+    WMI_AP_MODE_STAT_CMDID,
+
+    WMI_SET_IP_CMDID,    /* F017 */
+    WMI_SET_PARAMS_CMDID,
+    WMI_SET_MCAST_FILTER_CMDID,
+    WMI_DEL_MCAST_FILTER_CMDID,
+
+    WMI_ALLOW_AGGR_CMDID,    /* F01B */
+    WMI_ADDBA_REQ_CMDID,
+    WMI_DELBA_REQ_CMDID,
+    WMI_SET_HT_CAP_CMDID,
+    WMI_SET_HT_OP_CMDID,
+    WMI_SET_TX_SELECT_RATES_CMDID,
+    WMI_SET_TX_SGI_PARAM_CMDID,
+    WMI_SET_RATE_POLICY_CMDID,
+
+    WMI_HCI_CMD_CMDID,    /* F023 */
+    WMI_RX_FRAME_FORMAT_CMDID,
+    WMI_SET_THIN_MODE_CMDID,
+    WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID,
+
+    WMI_AP_SET_11BG_RATESET_CMDID,     /* F027 */
+    WMI_SET_PMK_CMDID,
+    WMI_MCAST_FILTER_CMDID,
+    /* COEX CMDID AR6003*/
+    WMI_SET_BTCOEX_FE_ANT_CMDID, /* F02A */
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID,
+    WMI_SET_BTCOEX_SCO_CONFIG_CMDID,
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMDID,
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID,
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID,
+    WMI_SET_BTCOEX_DEBUG_CMDID,
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID,
+    WMI_GET_BTCOEX_STATS_CMDID,
+    WMI_GET_BTCOEX_CONFIG_CMDID,
+
+    WMI_SET_DFS_ENABLE_CMDID,   /* F034 */
+    WMI_SET_DFS_MINRSSITHRESH_CMDID,
+    WMI_SET_DFS_MAXPULSEDUR_CMDID,
+    WMI_DFS_RADAR_DETECTED_CMDID,
+
+    /* P2P CMDS */
+    WMI_P2P_SET_CONFIG_CMDID,    /* F038 */
+    WMI_WPS_SET_CONFIG_CMDID,
+    WMI_SET_REQ_DEV_ATTR_CMDID,
+    WMI_P2P_FIND_CMDID,
+    WMI_P2P_STOP_FIND_CMDID,
+    WMI_P2P_GO_NEG_START_CMDID,
+    WMI_P2P_LISTEN_CMDID,
+
+    WMI_CONFIG_TX_MAC_RULES_CMDID,
+    WMI_SET_PROMISCUOUS_MODE_CMDID,/* F040 */
+    WMI_RX_FRAME_FILTER_CMDID,
+    WMI_SET_CHANNEL_CMDID,
+
+    /* WAC commands */
+    WMI_ENABLE_WAC_CMDID,
+    WMI_WAC_SCAN_REPLY_CMDID,
+    WMI_WAC_CTRL_REQ_CMDID,
+    WMI_SET_DIV_PARAMS_CMDID,
+
+    WMI_GET_PMK_CMDID,
+    WMI_SET_PASSPHRASE_CMDID,
+    WMI_SEND_ASSOC_RES_CMDID,
+    WMI_SET_ASSOC_REQ_RELAY_CMDID,
+    WMI_GET_RFKILL_MODE_CMDID,
+    WMI_SET_RFKILL_MODE_CMDID,
+
+    /* ACS command, consists of sub-commands */
+    WMI_ACS_CTRL_CMDID,
+    
+    /* Ultra low power store / recall commands */
+    WMI_STORERECALL_CONFIGURE_CMDID,
+    WMI_STORERECALL_RECALL_CMDID,
+    WMI_STORERECALL_HOST_READY_CMDID,
+    WMI_FORCE_TARGET_ASSERT_CMDID,
+    WMI_SET_EXCESS_TX_RETRY_THRES_CMDID,
+
+    WMI_P2P_GO_NEG_REQ_RSP_CMDID,  /* F053 */
+    WMI_P2P_GRP_INIT_CMDID,
+    WMI_P2P_GRP_FORMATION_DONE_CMDID,
+    WMI_P2P_INVITE_CMDID,
+    WMI_P2P_INVITE_REQ_RSP_CMDID,
+    WMI_P2P_PROV_DISC_REQ_CMDID,
+    WMI_P2P_SET_CMDID,
+
+    WMI_AP_SET_APSD_CMDID,         /* F05A */
+    WMI_AP_APSD_BUFFERED_TRAFFIC_CMDID,
+
+    WMI_P2P_SDPD_TX_CMDID, /* F05C */
+    WMI_P2P_STOP_SDPD_CMDID,
+    WMI_P2P_CANCEL_CMDID,
+    WMI_STA_BMISS_ENHANCE_CMDID,   
+    WMI_AP_SET_IDLE_CLOSE_TIME_CMDID,
+    WMI_SEND_HS20_ACTION_CMDID,
+
+} WMI_COMMAND_ID;
+
+/*
+ * Frame Types
+ */
+typedef enum {
+    WMI_FRAME_BEACON        =   0,
+    WMI_FRAME_PROBE_REQ,
+    WMI_FRAME_PROBE_RESP,
+    WMI_FRAME_ASSOC_REQ,
+    WMI_FRAME_ASSOC_RESP,
+    WMI_NUM_MGMT_FRAME
+} WMI_MGMT_FRAME_TYPE;
+
+/*
+ * Connect Command
+ */
+typedef enum {
+    INFRA_NETWORK       = 0x01,
+    ADHOC_NETWORK       = 0x02,
+    ADHOC_CREATOR       = 0x04,
+    AP_NETWORK          = 0x10,
+} NETWORK_TYPE;
+
+typedef enum {
+    SUBTYPE_NONE,
+    SUBTYPE_BT,
+    SUBTYPE_P2PDEV,
+    SUBTYPE_P2PCLIENT,
+    SUBTYPE_P2PGO,
+} NETWORK_SUBTYPE;
+
+typedef enum {
+    OPEN_AUTH           = 0x01,
+    SHARED_AUTH         = 0x02,
+    LEAP_AUTH           = 0x04,  /* different from IEEE_AUTH_MODE definitions */
+} DOT11_AUTH_MODE;
+
+typedef enum {
+    WMI_NONE_AUTH           = 0x01,
+    WMI_WPA_AUTH            = 0x02,
+    WMI_WPA2_AUTH           = 0x04,
+    WMI_WPA_PSK_AUTH        = 0x08,
+    WMI_WPA2_PSK_AUTH       = 0x10,
+    WMI_WPA_AUTH_CCKM       = 0x20,
+    WMI_WPA2_AUTH_CCKM      = 0x40,
+} AUTH_MODE;
+
+typedef enum {
+    NONE_CRYPT          = 0x01,
+    WEP_CRYPT           = 0x02,
+    TKIP_CRYPT          = 0x04,
+    AES_CRYPT           = 0x08,
+#ifdef WAPI_ENABLE
+    WAPI_CRYPT          = 0x10,
+#endif /*WAPI_ENABLE*/
+} CRYPTO_TYPE;
+
+#define WMI_MIN_CRYPTO_TYPE NONE_CRYPT
+#define WMI_MAX_CRYPTO_TYPE (AES_CRYPT + 1)
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_CRYPTO_TYPE
+#define WMI_MAX_CRYPTO_TYPE (WAPI_CRYPT + 1)
+#endif /* WAPI_ENABLE */
+
+#ifdef WAPI_ENABLE
+#define IW_ENCODE_ALG_SM4       0x20
+/*
+ * Defined this to be some very high bit because it is less likely to be
+ * clobbered by future changes to the kernel's wireless.h file
+*/
+#define IW_AUTH_CIPHER_SMS4     0x40000000
+#endif
+
+#define WMI_MIN_KEY_INDEX   0
+#define WMI_MAX_KEY_INDEX   3
+
+#ifdef WAPI_ENABLE
+#undef WMI_MAX_KEY_INDEX
+#define WMI_MAX_KEY_INDEX   7 /* wapi grpKey 0-3, prwKey 4-7 */
+#endif /* WAPI_ENABLE */
+
+#define WMI_MAX_KEY_LEN     32
+
+#define WMI_MAX_SSID_LEN    32
+
+typedef enum {
+    CONNECT_ASSOC_POLICY_USER           = 0x0001,
+    CONNECT_SEND_REASSOC                = 0x0002,
+    CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+    CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+    CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+    CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+    CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+    CONNECT_DO_NOT_DEAUTH               = 0x0080,
+    CONNECT_WPS_FLAG                    = 0x0100,
+    CONNECT_IGNORE_BSSID_HINT           = 0x0200,
+    CONNECT_STAY_AWAKE                  = 0x0400, 
+    /* AP configuration flags */
+    AP_NO_DISASSOC_UPON_DEAUTH          = 0x10000
+} WMI_CONNECT_CTRL_FLAGS_BITS;
+
+#define DEFAULT_CONNECT_CTRL_FLAGS    (CONNECT_CSA_FOLLOW_BSS)
+
+typedef PREPACK struct {
+    A_UINT8     networkType;
+    A_UINT8     dot11AuthMode;
+    A_UINT8     authMode;
+    A_UINT8     pairwiseCryptoType;
+    A_UINT8     pairwiseCryptoLen;
+    A_UINT8     groupCryptoType;
+    A_UINT8     groupCryptoLen;
+    A_UINT8     ssidLength;
+    A_UCHAR     ssid[WMI_MAX_SSID_LEN];
+    A_UINT16    channel;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT32    ctrl_flags;
+} POSTPACK WMI_CONNECT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT32 divIdleTime;
+    A_UINT8   antRssiThresh;
+    A_UINT8   divEnable;
+    A_UINT16 active_treshold_rate;
+} POSTPACK WMI_DIV_PARAMS_CMD;
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;                    /* hint */
+    A_UINT8     bssid[ATH_MAC_LEN];         /* mandatory if set */
+} POSTPACK WMI_RECONNECT_CMD;
+
+/*
+ * WMI_SET_PMK_CMDID
+ */
+#define WMI_PMK_LEN     32
+typedef PREPACK struct {
+    A_UINT8 pmk[WMI_PMK_LEN];
+} POSTPACK WMI_SET_PMK_CMD, WMI_GET_PMK_REPLY;
+
+/*
+ * WMI_SET_PASSPHRASE_CMDID
+ */
+#define WMI_PASSPHRASE_LEN    64
+typedef PREPACK struct {
+    A_UCHAR ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 passphrase[WMI_PASSPHRASE_LEN];
+    A_UINT8 ssid_len;
+    A_UINT8 passphrase_len;
+} POSTPACK WMI_SET_PASSPHRASE_CMD;
+
+/*
+ * WMI_SET_EXCESS_TX_RETRY_THRES_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT32 threshold;
+} POSTPACK WMI_SET_EXCESS_TX_RETRY_THRES_CMD;
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+typedef enum {
+    PAIRWISE_USAGE      = 0x00,
+    GROUP_USAGE         = 0x01,
+    TX_USAGE            = 0x02,     /* default Tx Key - Static WEP only */
+} KEY_USAGE;
+
+/*
+ * Bit Flag
+ * Bit 0 - Initialise TSC - default is Initialize
+ */
+#define KEY_OP_INIT_TSC       0x01
+#define KEY_OP_INIT_RSC       0x02
+#ifdef WAPI_ENABLE
+#define KEY_OP_INIT_WAPIPN    0x10
+#endif /* WAPI_ENABLE */
+
+#define KEY_OP_INIT_VAL     0x03     /* Default Initialise the TSC & RSC */
+#define KEY_OP_VALID_MASK   0x03
+
+typedef PREPACK struct {
+    A_UINT8     keyIndex;
+    A_UINT8     keyType;
+    A_UINT8     keyUsage;           /* KEY_USAGE */
+    A_UINT8     keyLength;
+    A_UINT8     keyRSC[8];          /* key replay sequence counter */
+    A_UINT8     key[WMI_MAX_KEY_LEN];
+    A_UINT8     key_op_ctrl;       /* Additional Key Control information */
+    A_UINT8    key_macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_CIPHER_KEY_CMD;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     keyIndex;
+} POSTPACK WMI_DELETE_CIPHER_KEY_CMD;
+
+#define WMI_KRK_LEN     16
+/*
+ * WMI_ADD_KRK_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     krk[WMI_KRK_LEN];
+} POSTPACK WMI_ADD_KRK_CMD;
+
+/*
+ * WMI_SET_TKIP_COUNTERMEASURES_CMDID
+ */
+typedef enum {
+    WMI_TKIP_CM_DISABLE = 0x0,
+    WMI_TKIP_CM_ENABLE  = 0x1,
+} WMI_TKIP_CM_CONTROL;
+
+typedef PREPACK struct {
+    A_UINT8  cm_en;                     /* WMI_TKIP_CM_CONTROL */
+} POSTPACK WMI_SET_TKIP_COUNTERMEASURES_CMD;
+
+/*
+ * WMI_SET_PMKID_CMDID
+ */
+
+#define WMI_PMKID_LEN 16
+
+typedef enum {
+   PMKID_DISABLE = 0,
+   PMKID_ENABLE  = 1,
+} PMKID_ENABLE_FLG;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT8     enable;                 /* PMKID_ENABLE_FLG */
+    A_UINT8     pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_SET_PMKID_CMD;
+
+/*
+ * WMI_START_SCAN_CMD
+ */
+typedef enum {
+    WMI_LONG_SCAN  = 0,
+    WMI_SHORT_SCAN = 1,
+} WMI_SCAN_TYPE;
+
+typedef PREPACK struct {
+    A_BOOL   forceFgScan;
+    A_BOOL   isLegacy;        /* For Legacy Cisco AP compatibility */
+    A_UINT32 homeDwellTime;   /* Maximum duration in the home channel(milliseconds) */
+    A_UINT32 forceScanInterval;    /* Time interval between scans (milliseconds)*/
+    A_UINT8  scanType;           /* WMI_SCAN_TYPE */
+    A_UINT8  numChannels;            /* how many channels follow */
+    A_UINT16 channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_START_SCAN_CMD;
+
+/*
+ * WMI_SET_SCAN_PARAMS_CMDID
+ */
+#define WMI_SHORTSCANRATIO_DEFAULT      3
+/*
+ *  Warning: ScanCtrlFlag value of 0xFF is used to disable all flags in WMI_SCAN_PARAMS_CMD
+ *  Do not add any more flags to WMI_SCAN_CTRL_FLAG_BITS
+ */
+typedef enum {
+    CONNECT_SCAN_CTRL_FLAGS = 0x01,    /* set if can scan in the Connect cmd */
+    SCAN_CONNECTED_CTRL_FLAGS = 0x02,  /* set if scan for the SSID it is */
+                                       /* already connected to */
+    ACTIVE_SCAN_CTRL_FLAGS = 0x04,     /* set if enable active scan */
+    ROAM_SCAN_CTRL_FLAGS = 0x08,       /* set if enable roam scan when bmiss and lowrssi */
+    REPORT_BSSINFO_CTRL_FLAGS = 0x10,   /* set if follows customer BSSINFO reporting rule */
+    ENABLE_AUTO_CTRL_FLAGS = 0x20,      /* if disabled, target doesn't
+                                          scan after a disconnect event  */
+    ENABLE_SCAN_ABORT_EVENT = 0x40      /* Scan complete event with canceled status will be generated when a scan is prempted before it gets completed */
+} WMI_SCAN_CTRL_FLAGS_BITS;
+
+#define CAN_SCAN_IN_CONNECT(flags)      (flags & CONNECT_SCAN_CTRL_FLAGS)
+#define CAN_SCAN_CONNECTED(flags)       (flags & SCAN_CONNECTED_CTRL_FLAGS)
+#define ENABLE_ACTIVE_SCAN(flags)       (flags & ACTIVE_SCAN_CTRL_FLAGS)
+#define ENABLE_ROAM_SCAN(flags)         (flags & ROAM_SCAN_CTRL_FLAGS)
+#define CONFIG_REPORT_BSSINFO(flags)     (flags & REPORT_BSSINFO_CTRL_FLAGS)
+#define IS_AUTO_SCAN_ENABLED(flags)      (flags & ENABLE_AUTO_CTRL_FLAGS)
+#define SCAN_ABORT_EVENT_ENABLED(flags) (flags & ENABLE_SCAN_ABORT_EVENT)
+
+#define DEFAULT_SCAN_CTRL_FLAGS         (CONNECT_SCAN_CTRL_FLAGS| SCAN_CONNECTED_CTRL_FLAGS| ACTIVE_SCAN_CTRL_FLAGS| ROAM_SCAN_CTRL_FLAGS | ENABLE_AUTO_CTRL_FLAGS)
+
+
+typedef PREPACK struct {
+    A_UINT16    fg_start_period;        /* seconds */
+    A_UINT16    fg_end_period;          /* seconds */
+    A_UINT16    bg_period;              /* seconds */
+    A_UINT16    maxact_chdwell_time;    /* msec */
+    A_UINT16    pas_chdwell_time;       /* msec */
+    A_UINT8     shortScanRatio;         /* how many shorts scan for one long */
+    A_UINT8     scanCtrlFlags;
+    A_UINT16    minact_chdwell_time;    /* msec */
+    A_UINT16    maxact_scan_per_ssid;   /* max active scans per ssid */
+    A_UINT32    max_dfsch_act_time;  /* msecs */
+} POSTPACK WMI_SCAN_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT16   chan_index;
+    A_INT8    bang_radar;
+} POSTPACK WMI_RADAR_DETECTED_CMD;
+
+/*
+ * WMI_SET_BSS_FILTER_CMDID
+ */
+typedef enum {
+    NONE_BSS_FILTER = 0x0,              /* no beacons forwarded */
+    ALL_BSS_FILTER,                     /* all beacons forwarded */
+    PROFILE_FILTER,                     /* only beacons matching profile */
+    ALL_BUT_PROFILE_FILTER,             /* all but beacons matching profile */
+    CURRENT_BSS_FILTER,                 /* only beacons matching current BSS */
+    ALL_BUT_BSS_FILTER,                 /* all but beacons matching BSS */
+    PROBED_SSID_FILTER,                 /* beacons matching probed ssid */
+    LAST_BSS_FILTER,                    /* marker only */
+} WMI_BSS_FILTER;
+
+typedef PREPACK struct {
+    A_UINT8    bssFilter;                      /* see WMI_BSS_FILTER */
+    A_UINT8    reserved1;                      /* For alignment */
+    A_UINT16   reserved2;                      /* For alignment */
+    A_UINT32   ieMask;
+} POSTPACK WMI_BSS_FILTER_CMD;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   15
+
+typedef enum {
+    DISABLE_SSID_FLAG  = 0,                  /* disables entry */
+    SPECIFIC_SSID_FLAG = 0x01,               /* probes specified ssid */
+    ANY_SSID_FLAG      = 0x02,               /* probes for any ssid */
+} WMI_SSID_FLAG;
+
+typedef PREPACK struct {
+    A_UINT8     entryIndex;                     /* 0 to MAX_PROBED_SSID_INDEX */
+    A_UINT8     flag;                           /* WMI_SSID_FLG */
+    A_UINT8     ssidLength;
+    A_UINT8     ssid[32];
+} POSTPACK WMI_PROBED_SSID_CMD;
+
+/*
+ * WMI_SET_LISTEN_INT_CMDID
+ * The Listen interval is between 15 and 3000 TUs
+ */
+#define MIN_LISTEN_INTERVAL 15
+#define MAX_LISTEN_INTERVAL 5000
+#define MIN_LISTEN_BEACONS 1
+#define MAX_LISTEN_BEACONS 50
+
+typedef PREPACK struct {
+    A_UINT16     listenInterval;
+    A_UINT16     numBeacons;
+} POSTPACK WMI_LISTEN_INT_CMD;
+
+/*
+ * WMI_SET_BEACON_INT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16     beaconInterval;
+} POSTPACK WMI_BEACON_INT_CMD;
+
+/*
+ * WMI_SET_BMISS_TIME_CMDID
+ * valid values are between 1000 and 5000 TUs
+ */
+
+#define MIN_BMISS_TIME     1000
+#define MAX_BMISS_TIME     5000
+#define MIN_BMISS_BEACONS  1
+#define MAX_BMISS_BEACONS  50
+
+typedef PREPACK struct {
+    A_UINT16     bmissTime;
+    A_UINT16     numBeacons;
+} POSTPACK WMI_BMISS_TIME_CMD;
+
+/*
+ * WMI_SET_POWER_MODE_CMDID
+ */
+typedef enum {
+    REC_POWER = 0x01,
+    MAX_PERF_POWER,
+} WMI_POWER_MODE;
+
+typedef PREPACK struct {
+    A_UINT8     powerMode;      /* WMI_POWER_MODE */
+} POSTPACK WMI_POWER_MODE_CMD;
+
+typedef PREPACK struct {
+    A_INT8 status;      /* WMI_SET_PARAMS_REPLY */
+} POSTPACK WMI_SET_PARAMS_REPLY;
+
+typedef PREPACK struct {
+    A_UINT32 opcode;
+    A_UINT32 length;
+    A_CHAR buffer[1];      /* WMI_SET_PARAMS */
+} POSTPACK WMI_SET_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 multicast_mac[ATH_MAC_LEN];      /* WMI_SET_MCAST_FILTER */
+} POSTPACK WMI_SET_MCAST_FILTER_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;      /* WMI_MCAST_FILTER */
+} POSTPACK WMI_MCAST_FILTER_CMD;
+
+/*
+ * WMI_SET_POWER_PARAMS_CMDID
+ */
+typedef enum {
+    IGNORE_DTIM = 0x01,
+    NORMAL_DTIM = 0x02,
+    STICK_DTIM  = 0x03,
+    AUTO_DTIM   = 0x04,
+} WMI_DTIM_POLICY;
+
+/* Policy to determnine whether TX should wakeup WLAN if sleeping */
+typedef enum {
+    TX_WAKEUP_UPON_SLEEP = 1,
+    TX_DONT_WAKEUP_UPON_SLEEP = 2
+} WMI_TX_WAKEUP_POLICY_UPON_SLEEP;
+
+/*
+ * Policy to determnine whether power save failure event should be sent to
+ * host during scanning
+ */
+typedef enum {
+    SEND_POWER_SAVE_FAIL_EVENT_ALWAYS = 1,
+    IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN = 2,
+} POWER_SAVE_FAIL_EVENT_POLICY;
+
+typedef PREPACK struct {
+    A_UINT16    idle_period;             /* msec */
+    A_UINT16    pspoll_number;
+    A_UINT16    dtim_policy;
+    A_UINT16    tx_wakeup_policy;
+    A_UINT16    num_tx_to_wakeup;
+    A_UINT16    ps_fail_event_policy;
+} POSTPACK WMI_POWER_PARAMS_CMD;
+
+/* Adhoc power save types */
+typedef enum {
+    ADHOC_PS_DISABLE=1,
+    ADHOC_PS_ATH=2,
+    ADHOC_PS_IEEE=3,
+    ADHOC_PS_OTHER=4,
+} WMI_ADHOC_PS_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8    power_saving;
+    A_UINT8    ttl; /* number of beacon periods */
+    A_UINT16   atim_windows;          /* msec */
+    A_UINT16   timeout_value;         /* msec */
+} POSTPACK WMI_IBSS_PM_CAPS_CMD;
+
+/* AP power save types */
+typedef enum {
+    AP_PS_DISABLE=1,
+    AP_PS_ATH=2,
+} WMI_AP_PS_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32   idle_time;   /* in msec */
+    A_UINT32   ps_period;   /* in usec */
+    A_UINT8    sleep_period; /* in ps periods */
+    A_UINT8    psType;
+} POSTPACK WMI_AP_PS_CMD;
+
+/*
+ * WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID
+ */
+typedef enum {
+    IGNORE_TIM_ALL_QUEUES_APSD = 0,
+    PROCESS_TIM_ALL_QUEUES_APSD = 1,
+    IGNORE_TIM_SIMULATED_APSD = 2,
+    PROCESS_TIM_SIMULATED_APSD = 3,
+} APSD_TIM_POLICY;
+
+typedef PREPACK struct {
+    A_UINT16    psPollTimeout;          /* msec */
+    A_UINT16    triggerTimeout;         /* msec */
+    A_UINT32    apsdTimPolicy;      /* TIM behavior with  ques APSD enabled. Default is IGNORE_TIM_ALL_QUEUES_APSD */
+    A_UINT32    simulatedAPSDTimPolicy;      /* TIM behavior with  simulated APSD enabled. Default is PROCESS_TIM_SIMULATED_APSD */
+} POSTPACK WMI_POWERSAVE_TIMERS_POLICY_CMD;
+
+/*
+ * WMI_SET_VOICE_PKT_SIZE_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT16    voicePktSize;
+} POSTPACK WMI_SET_VOICE_PKT_SIZE_CMD;
+
+/*
+ * WMI_SET_MAX_SP_LEN_CMDID
+ */
+typedef enum {
+    DELIVER_ALL_PKT = 0x0,
+    DELIVER_2_PKT = 0x1,
+    DELIVER_4_PKT = 0x2,
+    DELIVER_6_PKT = 0x3,
+} APSD_SP_LEN_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8    maxSPLen;
+} POSTPACK WMI_SET_MAX_SP_LEN_CMD;
+
+/*
+ * WMI_SET_DISC_TIMEOUT_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     disconnectTimeout;          /* seconds */
+} POSTPACK WMI_DISC_TIMEOUT_CMD;
+
+typedef enum {
+    UPLINK_TRAFFIC = 0,
+    DNLINK_TRAFFIC = 1,
+    BIDIR_TRAFFIC = 2,
+} DIR_TYPE;
+
+typedef enum {
+    DISABLE_FOR_THIS_AC = 0,
+    ENABLE_FOR_THIS_AC  = 1,
+    ENABLE_FOR_ALL_AC   = 2,
+} VOICEPS_CAP_TYPE;
+
+typedef enum {
+    TRAFFIC_TYPE_APERIODIC = 0,
+    TRAFFIC_TYPE_PERIODIC = 1,
+}TRAFFIC_TYPE;
+
+/*
+ * WMI_SYNCHRONIZE_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8 dataSyncMap;
+} POSTPACK WMI_SYNC_CMD;
+
+/*
+ * WMI_CREATE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT32        minServiceInt;           /* in milli-sec */
+    A_UINT32        maxServiceInt;           /* in milli-sec */
+    A_UINT32        inactivityInt;           /* in milli-sec */
+    A_UINT32        suspensionInt;           /* in milli-sec */
+    A_UINT32        serviceStartTime;
+    A_UINT32        minDataRate;             /* in bps */
+    A_UINT32        meanDataRate;            /* in bps */
+    A_UINT32        peakDataRate;            /* in bps */
+    A_UINT32        maxBurstSize;
+    A_UINT32        delayBound;
+    A_UINT32        minPhyRate;              /* in bps */
+    A_UINT32        sba;
+    A_UINT32        mediumTime;
+    A_UINT16        nominalMSDU;             /* in octects */
+    A_UINT16        maxMSDU;                 /* in octects */
+    A_UINT8         trafficClass;
+    A_UINT8         trafficDirection;        /* DIR_TYPE */
+    A_UINT8         rxQueueNum;
+    A_UINT8         trafficType;             /* TRAFFIC_TYPE */
+    A_UINT8         voicePSCapability;       /* VOICEPS_CAP_TYPE */
+    A_UINT8         tsid;
+    A_UINT8         userPriority;            /* 802.1D user priority */
+    A_UINT8         nominalPHY;              /* nominal phy rate */
+} POSTPACK WMI_CREATE_PSTREAM_CMD;
+
+/*
+ * WMI_DELETE_PSTREAM_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;
+    A_UINT8     trafficClass;
+    A_UINT8     tsid;
+} POSTPACK WMI_DELETE_PSTREAM_CMD;
+
+/*
+ * WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+typedef enum {
+    WMI_11A_MODE  = 0x1,
+    WMI_11G_MODE  = 0x2,
+    WMI_11AG_MODE = 0x3,
+    WMI_11B_MODE  = 0x4,
+    WMI_11GONLY_MODE = 0x5,
+} WMI_PHY_MODE;
+
+#define WMI_MAX_CHANNELS        32
+
+typedef PREPACK struct {
+    A_UINT8     reserved1;
+    A_UINT8     scanParam;              /* set if enable scan */
+    A_UINT8     phyMode;                /* see WMI_PHY_MODE */
+    A_UINT8     numChannels;            /* how many channels follow */
+    A_UINT16    channelList[1];         /* channels in Mhz */
+} POSTPACK WMI_CHANNEL_PARAMS_CMD;
+
+
+/*
+ *  WMI_RSSI_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ *  Threshold values are in the ascending order, and should agree to:
+ *  (lowThreshold_lowerVal < lowThreshold_upperVal < highThreshold_lowerVal
+ *      < highThreshold_upperVal)
+ */
+
+typedef PREPACK struct WMI_RSSI_THRESHOLD_PARAMS{
+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
+    A_INT16     thresholdAbove1_Val;          /* lowest of upper */
+    A_INT16     thresholdAbove2_Val;
+    A_INT16     thresholdAbove3_Val;
+    A_INT16     thresholdAbove4_Val;
+    A_INT16     thresholdAbove5_Val;
+    A_INT16     thresholdAbove6_Val;          /* highest of upper */
+    A_INT16     thresholdBelow1_Val;         /* lowest of bellow */
+    A_INT16     thresholdBelow2_Val;
+    A_INT16     thresholdBelow3_Val;
+    A_INT16     thresholdBelow4_Val;
+    A_INT16     thresholdBelow5_Val;
+    A_INT16     thresholdBelow6_Val;         /* highest of bellow */
+    A_UINT8     weight;                  /* "alpha" */
+    A_UINT8     reserved[3];
+} POSTPACK  WMI_RSSI_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_SNR_THRESHOLD_PARAMS_CMDID
+ *  Setting the polltime to 0 would disable polling.
+ */
+
+typedef PREPACK struct WMI_SNR_THRESHOLD_PARAMS{
+    A_UINT32    pollTime;               /* Polling time as a factor of LI */
+    A_UINT8     weight;                  /* "alpha" */
+    A_UINT8     thresholdAbove1_Val;      /* lowest of uppper*/
+    A_UINT8     thresholdAbove2_Val;
+    A_UINT8     thresholdAbove3_Val;
+    A_UINT8     thresholdAbove4_Val;      /* highest of upper */
+    A_UINT8     thresholdBelow1_Val;     /* lowest of bellow */
+    A_UINT8     thresholdBelow2_Val;
+    A_UINT8     thresholdBelow3_Val;
+    A_UINT8     thresholdBelow4_Val;     /* highest of bellow */
+    A_UINT8     reserved[3];
+} POSTPACK WMI_SNR_THRESHOLD_PARAMS_CMD;
+
+/*
+ *  WMI_LQ_THRESHOLD_PARAMS_CMDID
+ */
+typedef PREPACK struct WMI_LQ_THRESHOLD_PARAMS {
+    A_UINT8     enable;
+    A_UINT8     thresholdAbove1_Val;
+    A_UINT8     thresholdAbove2_Val;
+    A_UINT8     thresholdAbove3_Val;
+    A_UINT8     thresholdAbove4_Val;
+    A_UINT8     thresholdBelow1_Val;
+    A_UINT8     thresholdBelow2_Val;
+    A_UINT8     thresholdBelow3_Val;
+    A_UINT8     thresholdBelow4_Val;
+    A_UINT8     reserved[3];
+} POSTPACK  WMI_LQ_THRESHOLD_PARAMS_CMD;
+
+typedef enum {
+    WMI_LPREAMBLE_DISABLED = 0,
+    WMI_LPREAMBLE_ENABLED
+} WMI_LPREAMBLE_STATUS;
+
+typedef enum {
+    WMI_IGNORE_BARKER_IN_ERP = 0,
+    WMI_DONOT_IGNORE_BARKER_IN_ERP
+} WMI_PREAMBLE_POLICY;
+
+typedef PREPACK struct {
+    A_UINT8     status;
+    A_UINT8     preamblePolicy;
+}POSTPACK WMI_SET_LPREAMBLE_CMD;
+
+typedef PREPACK struct {
+    A_UINT16    threshold;
+}POSTPACK WMI_SET_RTS_CMD;
+
+/*
+ *  WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ *  Sets the error reporting event bitmask in target. Target clears it
+ *  upon an error. Subsequent errors are counted, but not reported
+ *  via event, unless the bitmask is set again.
+ */
+typedef PREPACK struct {
+    A_UINT32    bitmask;
+} POSTPACK  WMI_TARGET_ERROR_REPORT_BITMASK;
+
+/*
+ * WMI_SET_TX_PWR_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     dbM;                  /* in dbM units */
+} POSTPACK WMI_SET_TX_PWR_CMD, WMI_TX_PWR_REPLY;
+
+/*
+ * WMI_SET_ASSOC_INFO_CMDID
+ *
+ * A maximum of 2 private IEs can be sent in the [Re]Assoc request.
+ * A 3rd one, the CCX version IE can also be set from the host.
+ */
+#define WMI_MAX_ASSOC_INFO_TYPE    2
+#define WMI_CCX_VER_IE             2 /* ieType to set CCX Version IE */
+
+#define WMI_MAX_ASSOC_INFO_LEN     240
+
+typedef PREPACK struct {
+    A_UINT8     ieType;
+    A_UINT8     bufferSize;
+    A_UINT8     assocInfo[1];       /* up to WMI_MAX_ASSOC_INFO_LEN */
+} POSTPACK WMI_SET_ASSOC_INFO_CMD;
+
+
+/*
+ * WMI_GET_TX_PWR_CMDID does not take any parameters
+ */
+
+/*
+ * WMI_ADD_BAD_AP_CMDID
+ */
+#define WMI_MAX_BAD_AP_INDEX      1
+
+typedef PREPACK struct {
+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_ADD_BAD_AP_CMD;
+
+/*
+ * WMI_DELETE_BAD_AP_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     badApIndex;         /* 0 to WMI_MAX_BAD_AP_INDEX */
+} POSTPACK WMI_DELETE_BAD_AP_CMD;
+
+/*
+ * WMI_SET_ACCESS_PARAMS_CMDID
+ */
+#define WMI_DEFAULT_TXOP_ACPARAM    0       /* implies one MSDU */
+#define WMI_DEFAULT_ECWMIN_ACPARAM  4       /* corresponds to CWmin of 15 */
+#define WMI_DEFAULT_ECWMAX_ACPARAM  10      /* corresponds to CWmax of 1023 */
+#define WMI_MAX_CW_ACPARAM          15      /* maximum eCWmin or eCWmax */
+#define WMI_DEFAULT_AIFSN_ACPARAM   2
+#define WMI_MAX_AIFSN_ACPARAM       15
+typedef PREPACK struct {
+    A_UINT16 txop;                      /* in units of 32 usec */
+    A_UINT8  eCWmin;
+    A_UINT8  eCWmax;
+    A_UINT8  aifsn;
+    A_UINT8  ac;
+} POSTPACK WMI_SET_ACCESS_PARAMS_CMD;
+
+
+/*
+ * WMI_SET_RETRY_LIMITS_CMDID
+ *
+ * This command is used to customize the number of retries the
+ * wlan device will perform on a given frame.
+ */
+#define WMI_MIN_RETRIES 2
+#define WMI_MAX_RETRIES 13
+typedef enum {
+    MGMT_FRAMETYPE    = 0,
+    CONTROL_FRAMETYPE = 1,
+    DATA_FRAMETYPE    = 2
+} WMI_FRAMETYPE;
+
+typedef PREPACK struct {
+    A_UINT8 frameType;                      /* WMI_FRAMETYPE */
+    A_UINT8 trafficClass;                   /* applies only to DATA_FRAMETYPE */
+    A_UINT8 maxRetries;
+    A_UINT8 enableNotify;
+} POSTPACK WMI_SET_RETRY_LIMITS_CMD;
+
+/*
+ * WMI_SET_ROAM_CTRL_CMDID
+ *
+ * This command is used to influence the Roaming behaviour
+ * Set the host biases of the BSSs before setting the roam mode as bias
+ * based.
+ */
+
+/*
+ * Different types of Roam Control
+ */
+
+typedef enum {
+        WMI_FORCE_ROAM          = 1,      /* Roam to the specified BSSID */
+        WMI_SET_ROAM_MODE       = 2,      /* default ,progd bias, no roam */
+        WMI_SET_HOST_BIAS       = 3,     /* Set the Host Bias */
+        WMI_SET_LOWRSSI_SCAN_PARAMS = 4, /* Set lowrssi Scan parameters */
+} WMI_ROAM_CTRL_TYPE;
+
+#define WMI_MIN_ROAM_CTRL_TYPE WMI_FORCE_ROAM
+#define WMI_MAX_ROAM_CTRL_TYPE WMI_SET_LOWRSSI_SCAN_PARAMS
+
+/*
+ * ROAM MODES
+ */
+
+typedef enum {
+        WMI_DEFAULT_ROAM_MODE   = 1,  /* RSSI based ROAM */
+        WMI_HOST_BIAS_ROAM_MODE = 2, /* HOST BIAS based ROAM */
+        WMI_LOCK_BSS_MODE  = 3  /* Lock to the Current BSS - no Roam */
+} WMI_ROAM_MODE;
+
+/*
+ * BSS HOST BIAS INFO
+ */
+
+typedef PREPACK struct {
+        A_UINT8 bssid[ATH_MAC_LEN];
+        A_INT8  bias;
+} POSTPACK WMI_BSS_BIAS;
+
+typedef PREPACK struct {
+        A_UINT8 numBss;
+        WMI_BSS_BIAS bssBias[1];
+} POSTPACK WMI_BSS_BIAS_INFO;
+
+typedef PREPACK struct WMI_LOWRSSI_SCAN_PARAMS {
+        A_UINT16 lowrssi_scan_period;
+        A_INT16  lowrssi_scan_threshold;
+        A_INT16  lowrssi_roam_threshold;
+        A_UINT8  roam_rssi_floor;
+        A_UINT8  reserved[1];              /* For alignment */
+} POSTPACK WMI_LOWRSSI_SCAN_PARAMS;
+
+typedef PREPACK struct {
+    PREPACK union {
+        A_UINT8 bssid[ATH_MAC_LEN]; /* WMI_FORCE_ROAM */
+        A_UINT8 roamMode;           /* WMI_SET_ROAM_MODE  */
+        WMI_BSS_BIAS_INFO bssBiasInfo; /* WMI_SET_HOST_BIAS */
+        WMI_LOWRSSI_SCAN_PARAMS lrScanParams;
+    } POSTPACK info;
+    A_UINT8   roamCtrlType ;
+} POSTPACK WMI_SET_ROAM_CTRL_CMD;
+
+/*
+ * WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID
+ */
+typedef enum {
+    BT_WLAN_CONN_PRECDENCE_WLAN=0,  /* Default */
+    BT_WLAN_CONN_PRECDENCE_PAL,
+} BT_WLAN_CONN_PRECEDENCE;
+
+typedef PREPACK struct {
+    A_UINT8 precedence;
+} POSTPACK WMI_SET_BT_WLAN_CONN_PRECEDENCE;
+
+/*
+ * WMI_ENABLE_RM_CMDID
+ */
+typedef PREPACK struct {
+        A_BOOL enable_radio_measurements;
+} POSTPACK WMI_ENABLE_RM_CMD;
+
+/*
+ * WMI_SET_MAX_OFFHOME_DURATION_CMDID
+ */
+typedef PREPACK struct {
+        A_UINT8 max_offhome_duration;
+} POSTPACK WMI_SET_MAX_OFFHOME_DURATION_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 frequency;
+    A_UINT8  threshold;
+} POSTPACK WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8     enable;
+} POSTPACK WMI_SET_DFS_CMD;
+
+
+typedef enum {
+    WMI_CCX_RM_STATUS_UNKNOWN = 0,
+    WMI_CCX_RM_REPORT_SENT,
+    WMI_CCX_RM_REFUSE_REPORT_SENT,
+    WMI_CCX_RM_STATUS_MAX
+} WMI_CCX_RM_STATUS_TYPE;
+
+/*---------------------- BTCOEX RELATED -------------------------------------*/
+/*----------------------COMMON to AR6002 and AR6003 -------------------------*/
+typedef enum {
+    BT_STREAM_UNDEF = 0,
+    BT_STREAM_SCO,             /* SCO stream */
+    BT_STREAM_A2DP,            /* A2DP stream */
+    BT_STREAM_SCAN,            /* BT Discovery or Page */
+    BT_STREAM_ESCO,
+    BT_STREAM_MAX
+} BT_STREAM_TYPE;
+
+typedef enum {
+    BT_PARAM_SCO_PSPOLL_LATENCY_ONE_FOURTH =1,
+    BT_PARAM_SCO_PSPOLL_LATENCY_HALF,
+    BT_PARAM_SCO_PSPOLL_LATENCY_THREE_FOURTH,
+} BT_PARAMS_SCO_PSPOLL_LATENCY;
+
+typedef enum {
+    BT_PARAMS_SCO_STOMP_SCO_NEVER =1,
+    BT_PARAMS_SCO_STOMP_SCO_ALWAYS,
+    BT_PARAMS_SCO_STOMP_SCO_IN_LOWRSSI,
+} BT_PARAMS_SCO_STOMP_RULES;
+
+typedef enum {
+    BT_STATUS_UNDEF = 0,
+    BT_STATUS_ON,
+    BT_STATUS_OFF,
+    BT_STATUS_MAX
+} BT_STREAM_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8 streamType;
+    A_UINT8 status;
+} POSTPACK WMI_SET_BT_STATUS_CMD;
+
+typedef enum {
+    BT_ANT_TYPE_UNDEF=0,
+    BT_ANT_TYPE_DUAL,
+    BT_ANT_TYPE_SPLITTER,
+    BT_ANT_TYPE_SWITCH,
+    BT_ANT_TYPE_HIGH_ISO_DUAL
+} BT_ANT_FRONTEND_CONFIG;
+
+typedef enum {
+    BT_COLOCATED_DEV_BTS4020=0,
+    BT_COLCATED_DEV_CSR ,
+    BT_COLOCATED_DEV_VALKYRIE
+} BT_COLOCATED_DEV_TYPE;
+
+/*********************** Applicable to AR6002 ONLY ******************************/
+
+typedef enum {
+    BT_PARAM_SCO = 1,         /* SCO stream parameters */
+    BT_PARAM_A2DP ,
+    BT_PARAM_ANTENNA_CONFIG,
+    BT_PARAM_COLOCATED_BT_DEVICE,
+    BT_PARAM_ACLCOEX,
+    BT_PARAM_11A_SEPARATE_ANT,
+    BT_PARAM_MAX
+} BT_PARAM_TYPE;
+
+
+#define BT_SCO_ALLOW_CLOSE_RANGE_OPT    (1 << 0)
+#define BT_SCO_FORCE_AWAKE_OPT          (1 << 1)
+#define BT_SCO_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_SCO_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_SCO_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_SCO_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_SCO_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_SCO_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_SCO_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_SCO_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    A_UINT32 numScoCyclesForceTrigger;  /* Number SCO cycles after which
+                                           force a pspoll. default = 10 */
+    A_UINT32 dataResponseTimeout;       /* Timeout Waiting for Downlink pkt
+                                           in response for ps-poll,
+                                           default = 10 msecs */
+    A_UINT32  stompScoRules;
+    A_UINT32 scoOptFlags;               /* SCO Options Flags :
+                                            bits:     meaning:
+                                             0        Allow Close Range Optimization
+                                             1        Force awake during close range
+                                             2        If set use host supplied RSSI for OPT
+                                             3        If set use host supplied RTS COUNT for OPT
+                                             4..7     Unused
+                                             8..15    Low Data Rate Min Cnt
+                                             16..23   Low Data Rate Max Cnt
+                                        */
+
+    A_UINT8 stompDutyCyleVal;           /* Sco cycles to limit ps-poll queuing
+                                           if stomped */
+    A_UINT8 stompDutyCyleMaxVal;        /*firm ware increases stomp duty cycle
+                                          gradually uptill this value on need basis*/
+    A_UINT8 psPollLatencyFraction;      /* Fraction of idle
+                                           period, within which
+                                           additional ps-polls
+                                           can be queued */
+    A_UINT8 noSCOSlots;                 /* Number of SCO Tx/Rx slots.
+                                           HVx, EV3, 2EV3 = 2 */
+    A_UINT8 noIdleSlots;                /* Number of Bluetooth idle slots between
+                                           consecutive SCO Tx/Rx slots
+                                           HVx, EV3 = 4
+                                           2EV3 = 10 */
+    A_UINT8 scoOptOffRssi;/*RSSI value below which we go to ps poll*/
+    A_UINT8 scoOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    A_UINT8 scoOptRtsCount;
+} POSTPACK BT_PARAMS_SCO;
+
+#define BT_A2DP_ALLOW_CLOSE_RANGE_OPT  (1 << 0)
+#define BT_A2DP_FORCE_AWAKE_OPT        (1 << 1)
+#define BT_A2DP_SET_RSSI_OVERRIDE(flags)        ((flags) |= (1 << 2))
+#define BT_A2DP_GET_RSSI_OVERRIDE(flags)        (((flags) >> 2) & 0x1)
+#define BT_A2DP_SET_RTS_OVERRIDE(flags)   ((flags) |= (1 << 3))
+#define BT_A2DP_GET_RTS_OVERRIDE(flags)   (((flags) >> 3) & 0x1)
+#define BT_A2DP_GET_MIN_LOW_RATE_CNT(flags)     (((flags) >> 8) & 0xFF)
+#define BT_A2DP_GET_MAX_LOW_RATE_CNT(flags)     (((flags) >> 16) & 0xFF)
+#define BT_A2DP_SET_MIN_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 8)
+#define BT_A2DP_SET_MAX_LOW_RATE_CNT(flags,val) (flags) |= (((val) & 0xFF) << 16)
+
+typedef PREPACK struct {
+    A_UINT32 a2dpWlanUsageLimit; /* MAX time firmware uses the medium for
+                                    wlan, after it identifies the idle time
+                                    default (30 msecs) */
+    A_UINT32 a2dpBurstCntMin;   /* Minimum number of bluetooth data frames
+                                   to replenish Wlan Usage  limit (default 3) */
+    A_UINT32 a2dpDataRespTimeout;
+    A_UINT32 a2dpOptFlags;      /* A2DP Option flags:
+                                       bits:    meaning:
+                                        0       Allow Close Range Optimization
+                                        1       Force awake during close range
+                                        2        If set use host supplied RSSI for OPT
+                                        3        If set use host supplied RTS COUNT for OPT
+                                        4..7    Unused
+                                        8..15   Low Data Rate Min Cnt
+                                        16..23  Low Data Rate Max Cnt
+                                 */
+    A_UINT8 isCoLocatedBtRoleMaster;
+    A_UINT8 a2dpOptOffRssi;/*RSSI value below which we go to ps poll*/
+    A_UINT8 a2dpOptOnRssi; /*RSSI value above which we reenter opt mode*/
+    A_UINT8 a2dpOptRtsCount;
+}POSTPACK BT_PARAMS_A2DP;
+
+/* During BT ftp/ BT OPP or any another data based acl profile on bluetooth
+   (non a2dp).*/
+typedef PREPACK struct {
+    A_UINT32 aclWlanMediumUsageTime;  /* Wlan usage time during Acl (non-a2dp)
+                                       coexistence (default 30 msecs) */
+    A_UINT32 aclBtMediumUsageTime;   /* Bt usage time during acl coexistence
+                                       (default 30 msecs)*/
+    A_UINT32 aclDataRespTimeout;
+    A_UINT32 aclDetectTimeout;      /* ACL coexistence enabled if we get
+                                       10 Pkts in X msec(default 100 msecs) */
+    A_UINT32 aclmaxPktCnt;          /* No of ACL pkts to receive before
+                                         enabling ACL coex */
+
+}POSTPACK BT_PARAMS_ACLCOEX;
+
+typedef PREPACK struct {
+    PREPACK union {
+        BT_PARAMS_SCO scoParams;
+        BT_PARAMS_A2DP a2dpParams;
+        BT_PARAMS_ACLCOEX  aclCoexParams;
+        A_UINT8 antType;         /* 0 -Disabled (default)
+                                     1 - BT_ANT_TYPE_DUAL
+                                     2 - BT_ANT_TYPE_SPLITTER
+                                     3 - BT_ANT_TYPE_SWITCH */
+        A_UINT8 coLocatedBtDev;  /* 0 - BT_COLOCATED_DEV_BTS4020 (default)
+                                     1 - BT_COLCATED_DEV_CSR
+                                     2 - BT_COLOCATED_DEV_VALKYRIe
+                                   */
+    } POSTPACK info;
+    A_UINT8 paramType ;
+} POSTPACK WMI_SET_BT_PARAMS_CMD;
+
+/************************ END AR6002 BTCOEX *******************************/
+/*-----------------------AR6003 BTCOEX -----------------------------------*/
+
+/*  ---------------WMI_SET_BTCOEX_FE_ANT_CMDID --------------------------*/
+/* Indicates front end antenna configuration. This command needs to be issued
+ * right after initialization and after WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID.
+ * AR6003 enables coexistence and antenna switching based on the configuration.
+ */
+typedef enum {
+    WMI_BTCOEX_NOT_ENABLED = 0,
+    WMI_BTCOEX_FE_ANT_SINGLE =1,
+    WMI_BTCOEX_FE_ANT_DUAL=2,
+    WMI_BTCOEX_FE_ANT_DUAL_HIGH_ISO=3,
+    WMI_BTCOEX_FE_ANT_BYPASS_MODE=4,
+    WMI_BTCOEX_FE_ANT_COMBINE_MODE=5,
+    WMI_BTCOEX_FE_ANT_TYPE_MAX
+}WMI_BTCOEX_FE_ANT_TYPE;
+
+typedef PREPACK struct {
+    A_UINT8 btcoexFeAntType; /* 1 - WMI_BTCOEX_FE_ANT_SINGLE for single antenna front end
+                                2 - WMI_BTCOEX_FE_ANT_DUAL for dual antenna front end
+                                    (for isolations less 35dB, for higher isolation there
+                                    is not need to pass this command).
+                                    (not implemented)
+                              */
+}POSTPACK WMI_SET_BTCOEX_FE_ANT_CMD;
+
+/* -------------WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID ----------------*/
+/* Indicate the bluetooth chip to the firmware. Firmware can have different algorithm based
+ * bluetooth chip type.Based on bluetooth device, different coexistence protocol would be used.
+ */
+typedef PREPACK struct {
+    A_UINT8 btcoexCoLocatedBTdev; /*1 - Qcom BT (3 -wire PTA)
+                                    2 - CSR BT  (3 wire PTA)
+                                    3 - Atheros 3001 BT (3 wire PTA)
+                                    4 - STE bluetooth (4-wire ePTA)
+                                    5 - Atheros 3002 BT (4-wire MCI)
+                                    defaults= 3 (Atheros 3001 BT )
+                                    */
+}POSTPACK WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD;
+
+/* -------------WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID ------------*/
+/* Configuration parameters during bluetooth inquiry and page. Page configuration
+ * is applicable only on interfaces which can distinguish page (applicable only for ePTA -
+ * STE bluetooth).
+ * Bluetooth inquiry start and end is indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID.
+ * During this the station will be  power-save mode.
+ */
+typedef PREPACK struct {
+    A_UINT32 btInquiryDataFetchFrequency;/* The frequency of querying the AP for data
+                                            (via pspoll) is configured by this parameter.
+                                            "default = 10 ms" */
+
+    A_UINT32 protectBmissDurPostBtInquiry;/* The firmware will continue to be in inquiry state
+                                             for configured duration, after inquiry completion
+                                             . This is to ensure other bluetooth transactions
+                                             (RDP, SDP profiles, link key exchange ...etc)
+                                             goes through smoothly without wifi stomping.
+                                             default = 10 secs*/
+
+    A_UINT32 maxpageStomp;                 /*Applicable only for STE-BT interface. Currently not
+                                             used */
+    A_UINT32 btInquiryPageFlag;           /* Not used */
+}POSTPACK WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD;
+
+/*---------------------WMI_SET_BTCOEX_SCO_CONFIG_CMDID ---------------*/
+/* Configure  SCO parameters. These parameters would be used whenever firmware is indicated
+ * of (e)SCO profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configration of BTCOEX_SCO_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between sco gaps.
+ * Opt Mode - station is in awake state and access point can send data to station any time.
+ * BTCOEX_PSPOLLMODE_SCO_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_SCO_CONFIG - Configuration applied only during opt mode.
+ */
+#define WMI_SCO_CONFIG_FLAG_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_SCO_CONFIG_FLAG_IS_EDR_CAPABLE       (1 << 1)
+#define WMI_SCO_CONFIG_FLAG_IS_BT_MASTER         (1 << 2)
+#define WMI_SCO_CONFIG_FLAG_FW_DETECT_OF_PER     (1 << 3)
+typedef PREPACK struct {
+    A_UINT32 scoSlots;                  /* Number of SCO Tx/Rx slots.
+                                           HVx, EV3, 2EV3 = 2 */
+    A_UINT32 scoIdleSlots;              /* Number of Bluetooth idle slots between
+                                           consecutive SCO Tx/Rx slots
+                                           HVx, EV3 = 4
+                                           2EV3 = 10
+                                         */
+    A_UINT32 scoFlags;                 /* SCO Options Flags :
+                                          bits:    meaning:
+                                          0   Allow Close Range Optimization
+                                          1   Is EDR capable or Not
+                                          2   IS Co-located Bt role Master
+                                          3   Firmware determines the periodicity of SCO.
+                                         */
+
+    A_UINT32 linkId;                      /* applicable to STE-BT - not used */
+}POSTPACK BTCOEX_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32  scoCyclesForceTrigger;    /* Number SCO cycles after which
+                                            force a pspoll. default = 10 */
+    A_UINT32 scoDataResponseTimeout;     /* Timeout Waiting for Downlink pkt
+                                            in response for ps-poll,
+                                            default = 20 msecs */
+
+    A_UINT32 scoStompDutyCyleVal;        /* not implemented */
+
+    A_UINT32 scoStompDutyCyleMaxVal;     /*Not implemented */
+
+    A_UINT32 scoPsPollLatencyFraction;   /* Fraction of idle
+                                            period, within which
+                                            additional ps-polls can be queued
+                                            1 - 1/4 of idle duration
+                                            2 - 1/2 of idle duration
+                                            3 - 3/4 of idle duration
+                                            default =2 (1/2)
+                                           */
+}POSTPACK BTCOEX_PSPOLLMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 scoStompCntIn100ms;/*max number of SCO stomp in 100ms allowed in
+                                   opt mode. If exceeds the configured value,
+                                   switch to ps-poll mode
+                                  default = 3 */
+
+    A_UINT32 scoContStompMax;   /* max number of continous stomp allowed in opt mode.
+                                   if excedded switch to pspoll mode
+                                    default = 3 */
+
+    A_UINT32 scoMinlowRateMbps; /* Low rate threshold */
+
+    A_UINT32 scoLowRateCnt;     /* number of low rate pkts (< scoMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+    A_UINT32 scoHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+    A_UINT32 scoMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                   Recommended value Basic rate headsets = 1, EDR (2-EV3)  =4.
+                                 */
+}POSTPACK BTCOEX_OPTMODE_SCO_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 scanInterval;
+    A_UINT32 maxScanStompCnt;
+}POSTPACK BTCOEX_WLANSCAN_SCO_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_SCO_CONFIG scoConfig;
+    BTCOEX_PSPOLLMODE_SCO_CONFIG scoPspollConfig;
+    BTCOEX_OPTMODE_SCO_CONFIG scoOptModeConfig;
+    BTCOEX_WLANSCAN_SCO_CONFIG scoWlanScanConfig;
+}POSTPACK WMI_SET_BTCOEX_SCO_CONFIG_CMD;
+
+/* ------------------WMI_SET_BTCOEX_A2DP_CONFIG_CMDID -------------------*/
+/* Configure A2DP profile parameters. These parameters would be used whenver firmware is indicated
+ * of A2DP profile on bluetooth ( via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID).
+ * Configuration of BTCOEX_A2DP_CONFIG data structure are common configuration and applies to
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data between a2dp data bursts.
+ * Opt Mode - station is in power save during a2dp bursts and awake in the gaps.
+ * BTCOEX_PSPOLLMODE_A2DP_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_A2DP_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_A2DP_CONFIG_FLAG_ALLOW_OPTIMIZATION    (1 << 0)
+#define WMI_A2DP_CONFIG_FLAG_IS_EDR_CAPABLE        (1 << 1)
+#define WMI_A2DP_CONFIG_FLAG_IS_BT_ROLE_MASTER     (1 << 2)
+#define WMI_A2DP_CONFIG_FLAG_IS_A2DP_HIGH_PRI      (1 << 3)
+#define WMI_A2DP_CONFIG_FLAG_FIND_BT_ROLE          (1 << 4)
+
+typedef PREPACK struct {
+    A_UINT32 a2dpFlags;      /* A2DP Option flags:
+                                bits:    meaning:
+                                0       Allow Close Range Optimization
+                                1       IS EDR capable
+                                2       IS Co-located Bt role Master
+                                3       a2dp traffic is high priority
+                                4       Fw detect the role of bluetooth.
+                             */
+    A_UINT32 linkId;         /* Applicable only to STE-BT - not used */
+
+}POSTPACK BTCOEX_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 a2dpWlanMaxDur; /* MAX time firmware uses the medium for
+                                wlan, after it identifies the idle time
+                                default (30 msecs) */
+
+    A_UINT32 a2dpMinBurstCnt;   /* Minimum number of bluetooth data frames
+                                to replenish Wlan Usage  limit (default 3) */
+
+    A_UINT32 a2dpDataRespTimeout; /* Max duration firmware waits for downlink
+                                     by stomping on  bluetooth
+                                     after ps-poll is acknowledged.
+                                     default = 20 ms
+                                   */
+}POSTPACK BTCOEX_PSPOLLMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 a2dpMinlowRateMbps;  /* Low rate threshold */
+
+    A_UINT32 a2dpLowRateCnt;    /* number of low rate pkts (< a2dpMinlowRateMbps) allowed in 100 ms.
+                                   If exceeded switch/stay to ps-poll mode, lower stay in opt mode.
+                                   default = 36
+                                 */
+
+    A_UINT32 a2dpHighPktRatio;   /*(Total Rx pkts in 100 ms + 1)/
+                                  ((Total tx pkts in 100 ms - No of high rate pkts in 100 ms) + 1) in 100 ms,
+                                  if exceeded switch/stay in opt mode and if lower switch/stay in  pspoll mode.
+                                  default = 5 (80% of high rates)
+                                 */
+
+    A_UINT32 a2dpMaxAggrSize;    /* Max number of Rx subframes allowed in this mode. (Firmware re-negogiates
+                                   max number of aggregates if it was negogiated to higher value
+                                   default = 1
+                                  Recommended value Basic rate headsets = 1, EDR (2-EV3)  =8.
+                                 */
+    A_UINT32 a2dpPktStompCnt;    /*number of a2dp pkts that can be stomped per burst.
+                                   default = 6*/
+
+}POSTPACK BTCOEX_OPTMODE_A2DP_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_A2DP_CONFIG a2dpConfig;
+    BTCOEX_PSPOLLMODE_A2DP_CONFIG a2dppspollConfig;
+    BTCOEX_OPTMODE_A2DP_CONFIG a2dpOptConfig;
+}POSTPACK WMI_SET_BTCOEX_A2DP_CONFIG_CMD;
+
+/*------------ WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID---------------------*/
+/* Configure non-A2dp ACL profile parameters.The starts of ACL profile can either be
+ * indicated via WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID orenabled via firmware detection
+ *  which is configured via "aclCoexFlags".
+ * Configration of BTCOEX_ACLCOEX_CONFIG data structure are common configuration and applies
+ * ps-poll mode and opt mode.
+ * Ps-poll Mode - Station is in power-save and retrieves downlink data during wlan medium.
+ * Opt Mode - station is in power save during bluetooth medium time and awake during wlan duration.
+ *             (Not implemented yet)
+ *
+ * BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG - Configuration applied only during ps-poll mode.
+ * BTCOEX_OPTMODE_ACLCOEX_CONFIG - Configuration applied only during opt mode.
+ */
+
+#define WMI_ACLCOEX_FLAGS_ALLOW_OPTIMIZATION   (1 << 0)
+#define WMI_ACLCOEX_FLAGS_DISABLE_FW_DETECTION (1 << 1)
+
+typedef PREPACK struct {
+    A_UINT32 aclWlanMediumDur;      /* Wlan usage time during Acl (non-a2dp)
+                                        coexistence (default 30 msecs)
+                                    */
+
+    A_UINT32 aclBtMediumDur;       /* Bt usage time during acl coexistence
+                                         (default 30 msecs)
+                                   */
+
+    A_UINT32 aclDetectTimeout;     /* BT activity observation time limit.
+                                      In this time duration, number of bt pkts are counted.
+                                      If the Cnt reaches "aclPktCntLowerLimit" value
+                                      for "aclIterToEnableCoex" iteration continuously,
+                                      firmware gets into ACL coexistence mode.
+                                      Similarly, if bt traffic count during ACL coexistence
+                                      has not reached "aclPktCntLowerLimit" continuously
+                                      for "aclIterToEnableCoex", then ACL coexistence is
+                                      disabled.
+                                      -default 100 msecs
+                                    */
+
+     A_UINT32 aclPktCntLowerLimit;   /* Acl Pkt Cnt to be received in duration of
+                                        "aclDetectTimeout" for
+                                        "aclIterForEnDis" times to enabling ACL coex.
+                                        Similar logic is used to disable acl coexistence.
+                                        (If "aclPktCntLowerLimit"  cnt of acl pkts
+                                         are not seen by the for "aclIterForEnDis"
+                                         then acl coexistence is disabled).
+                                        default = 10
+                                   */
+
+     A_UINT32 aclIterForEnDis;      /* number of Iteration of "aclPktCntLowerLimit" for Enabling and
+                                       Disabling Acl Coexistence.
+                                       default = 3
+                                     */
+
+     A_UINT32 aclPktCntUpperLimit; /* This is upperBound limit, if there is more than
+                                      "aclPktCntUpperLimit" seen in "aclDetectTimeout",
+                                      ACL coexistence is enabled right away.
+                                      - default 15*/
+
+    A_UINT32 aclCoexFlags;          /* A2DP Option flags:
+                                      bits:    meaning:
+                                      0       Allow Close Range Optimization
+                                      1       disable Firmware detection
+                                      (Currently supported configuration is aclCoexFlags =0)
+                                    */
+
+    A_UINT32 linkId;                /* Applicable only for STE-BT - not used */
+
+}POSTPACK BTCOEX_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 aclDataRespTimeout;   /* Max duration firmware waits for downlink
+                                      by stomping on  bluetooth
+                                      after ps-poll is acknowledged.
+                                     default = 20 ms */
+
+}POSTPACK BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG;
+
+
+/* Not implemented yet*/
+typedef PREPACK struct {
+    A_UINT32 aclCoexMinlowRateMbps;
+    A_UINT32 aclCoexLowRateCnt;
+    A_UINT32 aclCoexHighPktRatio;
+    A_UINT32 aclCoexMaxAggrSize;
+    A_UINT32 aclPktStompCnt;
+}POSTPACK BTCOEX_OPTMODE_ACLCOEX_CONFIG;
+
+typedef PREPACK struct {
+    BTCOEX_ACLCOEX_CONFIG aclCoexConfig;
+    BTCOEX_PSPOLLMODE_ACLCOEX_CONFIG aclCoexPspollConfig;
+    BTCOEX_OPTMODE_ACLCOEX_CONFIG aclCoexOptConfig;
+}POSTPACK WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD;
+
+/* -----------WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID ------------------*/
+typedef enum {
+    WMI_BTCOEX_BT_PROFILE_SCO =1,
+    WMI_BTCOEX_BT_PROFILE_A2DP,
+    WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE,
+    WMI_BTCOEX_BT_PROFILE_ACLCOEX,
+}WMI_BTCOEX_BT_PROFILE;
+
+typedef PREPACK struct {
+    A_UINT32 btProfileType;
+    A_UINT32 btOperatingStatus;
+    A_UINT32 btLinkId;
+}WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD;
+
+/*--------------------- WMI_SET_BTCOEX_DEBUG_CMDID ---------------------*/
+/* Used for firmware development and debugging */
+typedef PREPACK struct {
+    A_UINT32 btcoexDbgParam1;
+    A_UINT32 btcoexDbgParam2;
+    A_UINT32 btcoexDbgParam3;
+    A_UINT32 btcoexDbgParam4;
+    A_UINT32 btcoexDbgParam5;
+}WMI_SET_BTCOEX_DEBUG_CMD;
+
+/*---------------------WMI_GET_BTCOEX_CONFIG_CMDID --------------------- */
+/* Command to firmware to get configuration parameters of the bt profile
+ * reported via WMI_BTCOEX_CONFIG_EVENTID */
+typedef PREPACK struct {
+    A_UINT32 btProfileType; /* 1 - SCO
+                               2 - A2DP
+                               3 - INQUIRY_PAGE
+                               4 - ACLCOEX
+                            */
+    A_UINT32 linkId;    /* not used */
+}WMI_GET_BTCOEX_CONFIG_CMD;
+
+/*------------------WMI_REPORT_BTCOEX_CONFIG_EVENTID------------------- */
+/* Event from firmware to host, sent in response to WMI_GET_BTCOEX_CONFIG_CMDID
+ * */
+typedef PREPACK struct {
+    A_UINT32 btProfileType;
+    A_UINT32 linkId; /* not used */
+    PREPACK union {
+        WMI_SET_BTCOEX_SCO_CONFIG_CMD scoConfigCmd;
+        WMI_SET_BTCOEX_A2DP_CONFIG_CMD a2dpConfigCmd;
+        WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD aclcoexConfig;
+        WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD btinquiryPageConfigCmd;
+    } POSTPACK info;
+} POSTPACK WMI_BTCOEX_CONFIG_EVENT;
+
+/*------------- WMI_REPORT_BTCOEX_BTCOEX_STATS_EVENTID--------------------*/
+/* Used for firmware development and debugging*/
+typedef PREPACK struct {
+    A_UINT32 highRatePktCnt;
+    A_UINT32 firstBmissCnt;
+    A_UINT32 psPollFailureCnt;
+    A_UINT32 nullFrameFailureCnt;
+    A_UINT32 optModeTransitionCnt;
+}BTCOEX_GENERAL_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    scoStompCntAvg;
+    A_UINT32    scoStompIn100ms;
+    A_UINT32    scoMaxContStomp;
+    A_UINT32    scoAvgNoRetries;
+    A_UINT32    scoMaxNoRetriesIn100ms;
+}BTCOEX_SCO_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    a2dpBurstCnt;
+    A_UINT32    a2dpMaxBurstCnt;
+    A_UINT32    a2dpAvgIdletimeIn100ms;
+    A_UINT32    a2dpAvgStompCnt;
+}BTCOEX_A2DP_STATS;
+
+typedef PREPACK struct {
+    A_UINT32    aclPktCntInBtTime;
+    A_UINT32    aclStompCntInWlanTime;
+    A_UINT32    aclPktCntIn100ms;
+}BTCOEX_ACLCOEX_STATS;
+
+typedef PREPACK struct {
+    BTCOEX_GENERAL_STATS coexStats;
+    BTCOEX_SCO_STATS scoStats;
+    BTCOEX_A2DP_STATS a2dpStats;
+    BTCOEX_ACLCOEX_STATS aclCoexStats;
+}WMI_BTCOEX_STATS_EVENT;
+
+
+/*--------------------------END OF BTCOEX -------------------------------------*/
+
+/* WAC commands 
+ */
+
+
+typedef PREPACK struct {
+    A_UINT32    period;
+    A_UINT32    threshold;
+    A_INT32     rssi;
+    A_BOOL      enable;
+    A_CHAR      wps_pin[8];
+}WMI_WAC_ENABLE_CMD;
+
+typedef enum {
+    WAC_MORE_SCAN = -1,
+    WAC_SEND_PROBE_IDX = 0,
+}WAC_SUBCMD;
+
+typedef PREPACK struct {
+    WAC_SUBCMD  cmdid;
+}WMI_WAC_SCAN_REPLY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8     req;
+    A_UINT8     cmd;
+    A_UINT8     frame;
+    A_UINT8     ie[17];
+    A_INT32     status;
+}WMI_WAC_CTRL_REQ_CMD;
+
+/* END OF WAC */
+
+typedef PREPACK struct {
+    A_UINT32 sleepState;
+}WMI_REPORT_SLEEP_STATE_EVENT;
+
+typedef enum {
+    WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP =0,
+    WMI_REPORT_SLEEP_STATUS_IS_AWAKE
+} WMI_REPORT_SLEEP_STATUS;
+typedef enum {
+    DISCONN_EVT_IN_RECONN = 0,  /* default */
+    NO_DISCONN_EVT_IN_RECONN
+} TARGET_EVENT_REPORT_CONFIG;
+
+typedef PREPACK struct {
+    A_UINT32 evtConfig;
+} POSTPACK WMI_SET_TARGET_EVENT_REPORT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT16    cmd_buf_sz;     /* HCI cmd buffer size */
+    A_UINT8     buf[1];         /* Absolute HCI cmd */
+} POSTPACK WMI_HCI_CMD;
+
+/*
+ * Command Replies
+ */
+
+/*
+ * WMI_GET_CHANNEL_LIST_CMDID reply
+ */
+typedef PREPACK struct {
+    A_UINT8     reserved1;
+    A_UINT8     numChannels;            /* number of channels in reply */
+    A_UINT16    channelList[1];         /* channel in Mhz */
+} POSTPACK WMI_CHANNEL_LIST_REPLY;
+
+typedef enum {
+    A_SUCCEEDED = A_OK,
+    A_FAILED_DELETE_STREAM_DOESNOT_EXIST=250,
+    A_SUCCEEDED_MODIFY_STREAM=251,
+    A_FAILED_INVALID_STREAM = 252,
+    A_FAILED_MAX_THINSTREAMS = 253,
+    A_FAILED_CREATE_REMOVE_PSTREAM_FIRST = 254,
+} PSTREAM_REPLY_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8     status;                 /* PSTREAM_REPLY_STATUS */
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficClass;
+    A_UINT8     trafficDirection;       /* DIR_TYPE */
+} POSTPACK WMI_CRE_PRIORITY_STREAM_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8     status;                 /* PSTREAM_REPLY_STATUS */
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;       /* DIR_TYPE */
+    A_UINT8     trafficClass;
+} POSTPACK WMI_DEL_PRIORITY_STREAM_REPLY;
+
+/*
+ * List of Events (target to host)
+ */
+typedef enum {
+    WMI_READY_EVENTID           = 0x1001,
+    WMI_CONNECT_EVENTID,
+    WMI_DISCONNECT_EVENTID,
+    WMI_BSSINFO_EVENTID,
+    WMI_CMDERROR_EVENTID,
+    WMI_REGDOMAIN_EVENTID,
+    WMI_PSTREAM_TIMEOUT_EVENTID,
+    WMI_NEIGHBOR_REPORT_EVENTID,
+    WMI_TKIP_MICERR_EVENTID,
+    WMI_SCAN_COMPLETE_EVENTID,           /* 0x100a */
+    WMI_REPORT_STATISTICS_EVENTID,
+    WMI_RSSI_THRESHOLD_EVENTID,
+    WMI_ERROR_REPORT_EVENTID,
+    WMI_OPT_RX_FRAME_EVENTID,
+    WMI_REPORT_ROAM_TBL_EVENTID,
+    WMI_EXTENSION_EVENTID,
+    WMI_CAC_EVENTID,
+    WMI_SNR_THRESHOLD_EVENTID,
+    WMI_LQ_THRESHOLD_EVENTID,
+    WMI_TX_RETRY_ERR_EVENTID,            /* 0x1014 */
+    WMI_REPORT_ROAM_DATA_EVENTID,
+    WMI_TEST_EVENTID,
+    WMI_APLIST_EVENTID,
+    WMI_GET_WOW_LIST_EVENTID,
+    WMI_GET_PMKID_LIST_EVENTID,
+    WMI_CHANNEL_CHANGE_EVENTID,
+    WMI_PEER_NODE_EVENTID,
+    WMI_PSPOLL_EVENTID,
+    WMI_DTIMEXPIRY_EVENTID,
+    WMI_WLAN_VERSION_EVENTID,
+    WMI_SET_PARAMS_REPLY_EVENTID,
+    WMI_ADDBA_REQ_EVENTID,              /*0x1020 */
+    WMI_ADDBA_RESP_EVENTID,
+    WMI_DELBA_REQ_EVENTID,
+    WMI_TX_COMPLETE_EVENTID,
+    WMI_HCI_EVENT_EVENTID,
+    WMI_ACL_DATA_EVENTID,
+    WMI_REPORT_SLEEP_STATE_EVENTID,
+
+    WMI_WAPI_REKEY_EVENTID,
+
+    WMI_REPORT_BTCOEX_STATS_EVENTID,
+    WMI_REPORT_BTCOEX_CONFIG_EVENTID,
+    WMI_GET_PMK_EVENTID,
+
+    /* DFS Events */
+    WMI_DFS_HOST_ATTACH_EVENTID,
+    WMI_DFS_HOST_INIT_EVENTID,
+    WMI_DFS_RESET_DELAYLINES_EVENTID,
+    WMI_DFS_RESET_RADARQ_EVENTID,
+    WMI_DFS_RESET_AR_EVENTID,
+    WMI_DFS_RESET_ARQ_EVENTID,          /*0x1030*/
+    WMI_DFS_SET_DUR_MULTIPLIER_EVENTID,
+    WMI_DFS_SET_BANGRADAR_EVENTID,
+    WMI_DFS_SET_DEBUGLEVEL_EVENTID,
+    WMI_DFS_PHYERR_EVENTID,
+    /* CCX Evants */
+    WMI_CCX_RM_STATUS_EVENTID,
+
+    /* P2P Events */
+    WMI_P2P_GO_NEG_RESULT_EVENTID,
+
+    WMI_WAC_SCAN_DONE_EVENTID,
+    WMI_WAC_REPORT_BSS_EVENTID,
+    WMI_WAC_START_WPS_EVENTID,
+    WMI_WAC_CTRL_REQ_REPLY_EVENTID,
+        
+    /*RFKILL Events*/
+    WMI_RFKILL_STATE_CHANGE_EVENTID,
+    WMI_RFKILL_GET_MODE_CMD_EVENTID,
+
+    /* More P2P Events */
+    WMI_P2P_GO_NEG_REQ_EVENTID,
+    WMI_P2P_INVITE_REQ_EVENTID,
+    WMI_P2P_INVITE_RCVD_RESULT_EVENTID,
+    WMI_P2P_INVITE_SENT_RESULT_EVENTID, /*1040*/
+    WMI_P2P_PROV_DISC_RESP_EVENTID,
+    WMI_P2P_PROV_DISC_REQ_EVENTID,
+    WMI_P2P_START_SDPD_EVENTID,
+    WMI_P2P_SDPD_RX_EVENTID,
+
+    /* Special event used to notify host that AR6003
+     * has processed sleep command (needed to prevent
+     * a late incoming credit report from crashing
+     * the system)
+     */
+    WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID,
+
+    WMI_THIN_RESERVED_START_EVENTID = 0x8000,
+    /* Events in this range are reserved for thinmode
+     * See wmi_thin.h for actual definitions */
+    WMI_THIN_RESERVED_END_EVENTID = 0x8fff,
+
+    WMI_SET_CHANNEL_EVENTID,
+    WMI_ASSOC_REQ_EVENTID, 
+
+    
+    /* generic ACS event */
+    WMI_ACS_EVENTID,   
+    WMI_REPORT_WMM_PARAMS_EVENTID,
+    WMI_STORERECALL_STORE_EVENTID,
+
+    /* AP idle close time event */
+    WMI_AP_IDLE_CLOSE_TIMEOUT_EVENTID,
+    WMI_HS20_RX_EVENTID,
+} WMI_EVENT_ID;
+
+typedef enum {
+    WMI_11A_CAPABILITY   = 1,
+    WMI_11G_CAPABILITY   = 2,
+    WMI_11AG_CAPABILITY  = 3,
+    WMI_11NA_CAPABILITY  = 4,
+    WMI_11NG_CAPABILITY  = 5,
+    WMI_11NAG_CAPABILITY = 6,
+    // END CAPABILITY
+    WMI_11N_CAPABILITY_OFFSET = (WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY),
+} WMI_PHY_CAPABILITY;
+
+typedef PREPACK struct {
+    A_UINT8     macaddr[ATH_MAC_LEN];
+    A_UINT8     phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_1;
+
+typedef PREPACK struct {
+    A_UINT32    sw_version;
+    A_UINT32    abi_version;
+    A_UINT8     macaddr[ATH_MAC_LEN];
+    A_UINT8     phyCapability;              /* WMI_PHY_CAPABILITY */
+} POSTPACK WMI_READY_EVENT_2;
+
+#if defined(ATH_TARGET)
+#ifdef AR6002_REV2
+#define WMI_READY_EVENT WMI_READY_EVENT_1  /* AR6002_REV2 target code */
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2  /* AR6001, AR6002_REV4, AR6002_REV6 */
+#endif
+#else
+#define WMI_READY_EVENT WMI_READY_EVENT_2 /* host code */
+#endif
+
+
+/*
+ * Connect Event
+ *
+ * In STA mode networkType comes along with connected phy mode
+ * To get networkType, WMI_NETWORK_TYPE (networkType) 
+ * To get connected phymode, WMI_CONNECTED_PHYMODE(networkType)
+ * will give the phymode value.
+ */
+typedef PREPACK struct {
+    PREPACK union {
+        struct {
+            A_UINT16    channel;
+            A_UINT8     bssid[ATH_MAC_LEN];
+            A_UINT16    listenInterval;
+            A_UINT16    beaconInterval;
+            A_UINT32    networkType;
+        } infra_ibss_bss;
+        struct {
+            A_UINT8     phymode;
+            A_UINT8     aid;
+            A_UINT8     mac_addr[ATH_MAC_LEN];
+            A_UINT8     auth;
+            A_UINT8     keymgmt;
+            A_UINT16    cipher;
+            A_UINT8     apsd_info;
+            A_UINT8     unused[3];
+        } ap_sta;
+        struct {
+            A_UINT16    channel;
+            A_UINT8     bssid[ATH_MAC_LEN];
+            A_UINT8     unused[8];
+        } ap_bss;
+    } POSTPACK u;
+    A_UINT8     beaconIeLen;
+    A_UINT8     assocReqLen;
+    A_UINT8     assocRespLen;
+    A_UINT8     assocInfo[1];
+} POSTPACK WMI_CONNECT_EVENT;
+
+
+typedef struct {
+    A_UINT8   status;
+    A_UINT8   rspType;
+} WMI_ASSOCREQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8   host_accept;
+    A_UINT8   host_reasonCode;
+    A_UINT8   target_status;
+    A_UINT8   sta_mac_addr[ATH_MAC_LEN];
+    A_UINT8   rspType;
+} POSTPACK WMI_SEND_ASSOCRES_CMD;
+
+typedef struct {
+    A_UINT8   enable;
+} WMI_SET_ASSOCREQ_RELAY;
+
+/*
+ * Disconnect Event
+ */
+typedef enum {
+    NO_NETWORK_AVAIL   = 0x01,
+    LOST_LINK          = 0x02,     /* bmiss */
+    DISCONNECT_CMD     = 0x03,
+    BSS_DISCONNECTED   = 0x04,
+    AUTH_FAILED        = 0x05,
+    ASSOC_FAILED       = 0x06,
+    NO_RESOURCES_AVAIL = 0x07,
+    CSERV_DISCONNECT   = 0x08,
+    INVALID_PROFILE    = 0x0a,
+    DOT11H_CHANNEL_SWITCH = 0x0b,
+    PROFILE_MISMATCH   = 0x0c,
+    CONNECTION_EVICTED = 0x0d,
+    IBSS_MERGE         = 0x0e,
+    EXCESS_TX_RETRY    = 0x0f,     /* TX frames failed after excessive retries */
+} WMI_DISCONNECT_REASON;
+
+typedef PREPACK struct {
+    A_UINT16    protocolReasonStatus;  /* reason code, see 802.11 spec. */
+    A_UINT8     bssid[ATH_MAC_LEN];    /* set if known */
+    A_UINT8     disconnectReason ;      /* see WMI_DISCONNECT_REASON */
+    A_UINT8     assocRespLen;
+    A_UINT8     assocInfo[1];
+} POSTPACK WMI_DISCONNECT_EVENT;
+
+/*
+ * BSS Info Event.
+ * Mechanism used to inform host of the presence and characteristic of
+ * wireless networks present.  Consists of bss info header followed by
+ * the beacon or probe-response frame body.  The 802.11 header is not included.
+ */
+typedef enum {
+    BEACON_FTYPE = 0x1,
+    PROBERESP_FTYPE,
+    ACTION_MGMT_FTYPE,
+    PROBEREQ_FTYPE,
+} WMI_BI_FTYPE;
+
+enum {
+    BSS_ELEMID_CHANSWITCH = 0x01,
+    BSS_ELEMID_ATHEROS = 0x02,
+};
+
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_BI_FTYPE */
+    A_UINT8     snr;
+    A_INT16     rssi;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT32    ieMask;
+} POSTPACK WMI_BSS_INFO_HDR;
+
+/*
+ * BSS INFO HDR version 2.0
+ * With 6 bytes HTC header and 6 bytes of WMI header
+ * WMI_BSS_INFO_HDR cannot be accomodated in the removed 802.11 management
+ * header space.
+ * - Reduce the ieMask to 2 bytes as only two bit flags are used
+ * - Remove rssi and compute it on the host. rssi = snr - 95
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_BI_FTYPE */
+    A_UINT8     snr;
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT16    ieMask;
+} POSTPACK WMI_BSS_INFO_HDR2;
+
+typedef PREPACK struct {
+    A_UINT8    bssid[ATH_MAC_LEN];
+    A_UINT8    pin[8];
+} POSTPACK WMI_WPS_PIN_INFO;
+
+typedef PREPACK struct {
+    PREPACK union {
+        A_UINT8 ie[17];
+        A_INT32 wac_status;
+    } POSTPACK info;
+} POSTPACK WMI_GET_WAC_INFO;
+
+/*
+ * Command Error Event
+ */
+typedef enum {
+    INVALID_PARAM  = 0x01,
+    ILLEGAL_STATE  = 0x02,
+    INTERNAL_ERROR = 0x03,
+    DFS_CHANNEL    = 0x04,
+} WMI_ERROR_CODE;
+
+typedef PREPACK struct {
+    A_UINT16    commandId;
+    A_UINT8     errorCode;
+} POSTPACK WMI_CMD_ERROR_EVENT;
+
+/*
+ * New Regulatory Domain Event
+ */
+typedef PREPACK struct {
+    A_UINT32    regDomain;
+} POSTPACK WMI_REG_DOMAIN_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8     txQueueNumber;
+    A_UINT8     rxQueueNumber;
+    A_UINT8     trafficDirection;
+    A_UINT8     trafficClass;
+} POSTPACK WMI_PSTREAM_TIMEOUT_EVENT;
+
+/*
+ * The WMI_NEIGHBOR_REPORT Event is generated by the target to inform
+ * the host of BSS's it has found that matches the current profile.
+ * It can be used by the host to cache PMKs and/to initiate pre-authentication
+ * if the BSS supports it.  The first bssid is always the current associated
+ * BSS.
+ * The bssid and bssFlags information repeats according to the number
+ * or APs reported.
+ */
+typedef enum {
+    WMI_DEFAULT_BSS_FLAGS   = 0x00,
+    WMI_PREAUTH_CAPABLE_BSS = 0x01,
+    WMI_PMKID_VALID_BSS     = 0x02,
+} WMI_BSS_FLAGS;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT8     bssFlags;            /* see WMI_BSS_FLAGS */
+} POSTPACK WMI_NEIGHBOR_INFO;
+
+typedef PREPACK struct {
+    A_INT8      numberOfAps;
+    WMI_NEIGHBOR_INFO neighbor[1];
+} POSTPACK WMI_NEIGHBOR_REPORT_EVENT;
+
+/*
+ * TKIP MIC Error Event
+ */
+typedef PREPACK struct {
+    A_UINT8 keyid;
+    A_UINT8 ismcast;
+} POSTPACK WMI_TKIP_MICERR_EVENT;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID - no parameters (old), staus parameter (new)
+ */
+typedef PREPACK struct {
+    A_INT32 status;
+} POSTPACK WMI_SCAN_COMPLETE_EVENT;
+
+typedef PREPACK struct {
+    A_INT32 rm_type;
+    A_INT32 status;
+} POSTPACK WMI_CCX_RM_STATUS_EVENT;
+
+#define MAX_OPT_DATA_LEN 1400
+
+/*
+ * WMI_SET_ADHOC_BSSID_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_SET_ADHOC_BSSID_CMD;
+
+/*
+ * Special frame receive Event.
+ * Mechanism used to inform host of the receiption of the special frames.
+ * Consists of special frame info header followed by special frame body.
+ * The 802.11 header is not included.
+ */
+typedef PREPACK struct {
+    A_UINT16    channel;
+    A_UINT8     frameType;          /* see WMI_OPT_FTYPE */
+    A_INT8      snr;
+    A_UINT8     srcAddr[ATH_MAC_LEN];
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_OPT_RX_INFO_HDR;
+
+/*
+ * Reporting statistics.
+ */
+typedef PREPACK struct {
+    A_UINT32   tx_packets;
+    A_UINT32   tx_bytes;
+    A_UINT32   tx_unicast_pkts;
+    A_UINT32   tx_unicast_bytes;
+    A_UINT32   tx_multicast_pkts;
+    A_UINT32   tx_multicast_bytes;
+    A_UINT32   tx_broadcast_pkts;
+    A_UINT32   tx_broadcast_bytes;
+    A_UINT32   tx_rts_success_cnt;
+    A_UINT32   tx_packet_per_ac[4];
+    A_UINT32   tx_errors_per_ac[4];
+
+    A_UINT32   tx_errors;
+    A_UINT32   tx_failed_cnt;
+    A_UINT32   tx_retry_cnt;
+    A_UINT32   tx_mult_retry_cnt;
+    A_UINT32   tx_rts_fail_cnt;
+    A_INT32    tx_unicast_rate;
+}POSTPACK tx_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   rx_packets;
+    A_UINT32   rx_bytes;
+    A_UINT32   rx_unicast_pkts;
+    A_UINT32   rx_unicast_bytes;
+    A_UINT32   rx_multicast_pkts;
+    A_UINT32   rx_multicast_bytes;
+    A_UINT32   rx_broadcast_pkts;
+    A_UINT32   rx_broadcast_bytes;
+    A_UINT32   rx_fragment_pkt;
+
+    A_UINT32   rx_errors;
+    A_UINT32   rx_crcerr;
+    A_UINT32   rx_key_cache_miss;
+    A_UINT32   rx_decrypt_err;
+    A_UINT32   rx_duplicate_frames;
+    A_INT32    rx_unicast_rate;
+}POSTPACK rx_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   tkip_local_mic_failure;
+    A_UINT32   tkip_counter_measures_invoked;
+    A_UINT32   tkip_replays;
+    A_UINT32   tkip_format_errors;
+    A_UINT32   ccmp_format_errors;
+    A_UINT32   ccmp_replays;
+}POSTPACK tkip_ccmp_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32   power_save_failure_cnt;
+    A_UINT16   stop_tx_failure_cnt;
+    A_UINT16   atim_tx_failure_cnt;
+    A_UINT16   atim_rx_failure_cnt;
+    A_UINT16   bcn_rx_failure_cnt;
+}POSTPACK pm_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    cs_bmiss_cnt;
+    A_UINT32    cs_lowRssi_cnt;
+    A_UINT16    cs_connect_cnt;
+    A_UINT16    cs_disconnect_cnt;
+    A_INT16     cs_aveBeacon_rssi;
+    A_UINT16    cs_roam_count;
+    A_INT16     cs_rssi;
+    A_UINT8     cs_snr;
+    A_UINT8     cs_aveBeacon_snr;
+    A_UINT8     cs_lastRoam_msec;
+} POSTPACK cserv_stats_t;
+
+typedef PREPACK struct {
+    tx_stats_t          tx_stats;
+    rx_stats_t          rx_stats;
+    tkip_ccmp_stats_t   tkipCcmpStats;
+}POSTPACK wlan_net_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    arp_received;
+    A_UINT32    arp_matched;
+    A_UINT32    arp_replied;
+} POSTPACK arp_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32    wow_num_pkts_dropped;
+    A_UINT16    wow_num_events_discarded;
+    A_UINT8     wow_num_host_pkt_wakeups;
+    A_UINT8     wow_num_host_event_wakeups;
+} POSTPACK wlan_wow_stats_t;
+
+typedef PREPACK struct {
+    A_UINT32            lqVal;
+    A_INT32             noise_floor_calibation;
+    pm_stats_t          pmStats;
+    wlan_net_stats_t    txrxStats;
+    wlan_wow_stats_t    wowStats;
+    arp_stats_t         arpStats;
+    cserv_stats_t       cservStats;
+} POSTPACK WMI_TARGET_STATS;
+
+/*
+ * WMI_RSSI_THRESHOLD_EVENTID.
+ * Indicate the RSSI events to host. Events are indicated when we breach a
+ * thresold value.
+ */
+typedef enum{
+    WMI_RSSI_THRESHOLD1_ABOVE = 0,
+    WMI_RSSI_THRESHOLD2_ABOVE,
+    WMI_RSSI_THRESHOLD3_ABOVE,
+    WMI_RSSI_THRESHOLD4_ABOVE,
+    WMI_RSSI_THRESHOLD5_ABOVE,
+    WMI_RSSI_THRESHOLD6_ABOVE,
+    WMI_RSSI_THRESHOLD1_BELOW,
+    WMI_RSSI_THRESHOLD2_BELOW,
+    WMI_RSSI_THRESHOLD3_BELOW,
+    WMI_RSSI_THRESHOLD4_BELOW,
+    WMI_RSSI_THRESHOLD5_BELOW,
+    WMI_RSSI_THRESHOLD6_BELOW
+}WMI_RSSI_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_INT16 rssi;
+    A_UINT8 range;
+}POSTPACK WMI_RSSI_THRESHOLD_EVENT;
+
+/*
+ *  WMI_ERROR_REPORT_EVENTID
+ */
+typedef enum{
+    WMI_TARGET_PM_ERR_FAIL      = 0x00000001,
+    WMI_TARGET_KEY_NOT_FOUND    = 0x00000002,
+    WMI_TARGET_DECRYPTION_ERR   = 0x00000004,
+    WMI_TARGET_BMISS            = 0x00000008,
+    WMI_PSDISABLE_NODE_JOIN     = 0x00000010,
+    WMI_TARGET_COM_ERR          = 0x00000020,
+    WMI_TARGET_FATAL_ERR        = 0x00000040,
+    WMI_TARGET_BCN_FOUND        = 0x00000080
+} WMI_TARGET_ERROR_VAL;
+
+typedef PREPACK struct {
+    A_UINT32 errorVal;
+}POSTPACK  WMI_TARGET_ERROR_REPORT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 retrys;
+}POSTPACK  WMI_TX_RETRY_ERR_EVENT;
+
+typedef enum{
+    WMI_SNR_THRESHOLD1_ABOVE = 1,
+    WMI_SNR_THRESHOLD1_BELOW,
+    WMI_SNR_THRESHOLD2_ABOVE,
+    WMI_SNR_THRESHOLD2_BELOW,
+    WMI_SNR_THRESHOLD3_ABOVE,
+    WMI_SNR_THRESHOLD3_BELOW,
+    WMI_SNR_THRESHOLD4_ABOVE,
+    WMI_SNR_THRESHOLD4_BELOW
+} WMI_SNR_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_UINT8 range;  /* WMI_SNR_THRESHOLD_VAL */
+    A_UINT8 snr;
+}POSTPACK  WMI_SNR_THRESHOLD_EVENT;
+
+typedef enum{
+    WMI_LQ_THRESHOLD1_ABOVE = 1,
+    WMI_LQ_THRESHOLD1_BELOW,
+    WMI_LQ_THRESHOLD2_ABOVE,
+    WMI_LQ_THRESHOLD2_BELOW,
+    WMI_LQ_THRESHOLD3_ABOVE,
+    WMI_LQ_THRESHOLD3_BELOW,
+    WMI_LQ_THRESHOLD4_ABOVE,
+    WMI_LQ_THRESHOLD4_BELOW
+} WMI_LQ_THRESHOLD_VAL;
+
+typedef PREPACK struct {
+    A_INT32 lq;
+    A_UINT8 range;  /* WMI_LQ_THRESHOLD_VAL */
+}POSTPACK  WMI_LQ_THRESHOLD_EVENT;
+/*
+ * WMI_REPORT_ROAM_TBL_EVENTID
+ */
+#define MAX_ROAM_TBL_CAND   5
+
+typedef PREPACK struct {
+    A_INT32 roam_util;
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_INT8  rssi;
+    A_INT8  rssidt;
+    A_INT8  last_rssi;
+    A_INT8  util;
+    A_INT8  bias;
+    A_UINT8 reserved; /* For alignment */
+} POSTPACK WMI_BSS_ROAM_INFO;
+
+
+typedef PREPACK struct {
+    A_UINT16  roamMode;
+    A_UINT16  numEntries;
+    WMI_BSS_ROAM_INFO bssRoamInfo[1];
+} POSTPACK WMI_TARGET_ROAM_TBL;
+
+/*
+ * WMI_HCI_EVENT_EVENTID
+ */
+typedef PREPACK struct {
+    A_UINT16    evt_buf_sz;     /* HCI event buffer size */
+    A_UINT8     buf[1];         /* HCI  event */
+} POSTPACK WMI_HCI_EVENT;
+
+/*
+ *  WMI_CAC_EVENTID
+ */
+typedef enum {
+    CAC_INDICATION_ADMISSION = 0x00,
+    CAC_INDICATION_ADMISSION_RESP = 0x01,
+    CAC_INDICATION_DELETE = 0x02,
+    CAC_INDICATION_NO_RESP = 0x03,
+}CAC_INDICATION;
+
+#define WMM_TSPEC_IE_LEN   63
+
+typedef PREPACK struct {
+    A_UINT8 ac;
+    A_UINT8 cac_indication;
+    A_UINT8 statusCode;
+    A_UINT8 tspecSuggestion[WMM_TSPEC_IE_LEN];
+}POSTPACK  WMI_CAC_EVENT;
+
+/*
+ * WMI_APLIST_EVENTID
+ */
+
+typedef enum {
+    APLIST_VER1 = 1,
+} APLIST_VER;
+
+typedef PREPACK struct {
+    A_UINT8     bssid[ATH_MAC_LEN];
+    A_UINT16    channel;
+} POSTPACK  WMI_AP_INFO_V1;
+
+typedef PREPACK union {
+    WMI_AP_INFO_V1  apInfoV1;
+} POSTPACK WMI_AP_INFO;
+
+typedef PREPACK struct {
+    A_UINT8     apListVer;
+    A_UINT8     numAP;
+    WMI_AP_INFO apList[1];
+} POSTPACK WMI_APLIST_EVENT;
+
+/*
+ * developer commands
+ */
+
+/*
+ * WMI_SET_BITRATE_CMDID
+ *
+ * Get bit rate cmd uses same definition as set bit rate cmd
+ */
+typedef enum {
+    RATE_AUTO   = -1,
+    RATE_1Mb    = 0,
+    RATE_2Mb    = 1,
+    RATE_5_5Mb  = 2,
+    RATE_11Mb   = 3,
+    RATE_6Mb    = 4,
+    RATE_9Mb    = 5,
+    RATE_12Mb   = 6,
+    RATE_18Mb   = 7,
+    RATE_24Mb   = 8,
+    RATE_36Mb   = 9,
+    RATE_48Mb   = 10,
+    RATE_54Mb   = 11,
+    RATE_MCS_0_20 = 12,
+    RATE_MCS_1_20 = 13,
+    RATE_MCS_2_20 = 14,
+    RATE_MCS_3_20 = 15,
+    RATE_MCS_4_20 = 16,
+    RATE_MCS_5_20 = 17,
+    RATE_MCS_6_20 = 18,
+    RATE_MCS_7_20 = 19,
+    RATE_MCS_0_40 = 20,
+    RATE_MCS_1_40 = 21,
+    RATE_MCS_2_40 = 22,
+    RATE_MCS_3_40 = 23,
+    RATE_MCS_4_40 = 24,
+    RATE_MCS_5_40 = 25,
+    RATE_MCS_6_40 = 26,
+    RATE_MCS_7_40 = 27,
+} WMI_BIT_RATE;
+
+typedef PREPACK struct {
+    A_INT8      rateIndex;          /* see WMI_BIT_RATE */
+    A_INT8      mgmtRateIndex;
+    A_INT8      ctlRateIndex;
+} POSTPACK WMI_BIT_RATE_CMD;
+
+
+typedef PREPACK struct {
+    A_INT8      rateIndex;          /* see WMI_BIT_RATE */
+} POSTPACK  WMI_BIT_RATE_REPLY;
+
+
+/*
+ * WMI_SET_FIXRATES_CMDID
+ *
+ * Get fix rates cmd uses same definition as set fix rates cmd
+ */
+#define FIX_RATE_1Mb            ((A_UINT32)0x1)
+#define FIX_RATE_2Mb            ((A_UINT32)0x2)
+#define FIX_RATE_5_5Mb          ((A_UINT32)0x4)
+#define FIX_RATE_11Mb           ((A_UINT32)0x8)
+#define FIX_RATE_6Mb            ((A_UINT32)0x10)
+#define FIX_RATE_9Mb            ((A_UINT32)0x20)
+#define FIX_RATE_12Mb           ((A_UINT32)0x40)
+#define FIX_RATE_18Mb           ((A_UINT32)0x80)
+#define FIX_RATE_24Mb           ((A_UINT32)0x100)
+#define FIX_RATE_36Mb           ((A_UINT32)0x200)
+#define FIX_RATE_48Mb           ((A_UINT32)0x400)
+#define FIX_RATE_54Mb           ((A_UINT32)0x800)
+#define FIX_RATE_MCS_0_20       ((A_UINT32)0x1000)
+#define FIX_RATE_MCS_1_20       ((A_UINT32)0x2000)
+#define FIX_RATE_MCS_2_20       ((A_UINT32)0x4000)
+#define FIX_RATE_MCS_3_20       ((A_UINT32)0x8000)
+#define FIX_RATE_MCS_4_20       ((A_UINT32)0x10000)
+#define FIX_RATE_MCS_5_20       ((A_UINT32)0x20000)
+#define FIX_RATE_MCS_6_20       ((A_UINT32)0x40000)
+#define FIX_RATE_MCS_7_20       ((A_UINT32)0x80000)
+#define FIX_RATE_MCS_0_40       ((A_UINT32)0x100000)
+#define FIX_RATE_MCS_1_40       ((A_UINT32)0x200000)
+#define FIX_RATE_MCS_2_40       ((A_UINT32)0x400000)
+#define FIX_RATE_MCS_3_40       ((A_UINT32)0x800000)
+#define FIX_RATE_MCS_4_40       ((A_UINT32)0x1000000)
+#define FIX_RATE_MCS_5_40       ((A_UINT32)0x2000000)
+#define FIX_RATE_MCS_6_40       ((A_UINT32)0x4000000)
+#define FIX_RATE_MCS_7_40       ((A_UINT32)0x8000000)
+
+typedef PREPACK struct {
+    A_UINT32      fixRateMask[WMI_MAX_RATE_MASK];          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FIX_RATES_CMD, WMI_FIX_RATES_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8      bEnableMask;
+    A_UINT8      frameType;              /* type and subtype */
+    A_UINT8      reserved[2];            /* for alignment    */
+    A_UINT32     frameRateMask[WMI_MAX_RATE_MASK];          /* see WMI_BIT_RATE */
+} POSTPACK WMI_FRAME_RATES_CMD, WMI_FRAME_RATES_REPLY;
+
+/*
+ * WMI_SET_RECONNECT_AUTH_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    RECONN_DO_AUTH = 0x00,
+    RECONN_NOT_AUTH = 0x01
+} WMI_AUTH_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 mode;
+} POSTPACK WMI_SET_AUTH_MODE_CMD;
+
+/*
+ * WMI_SET_REASSOC_MODE_CMDID
+ *
+ * Set authentication mode
+ */
+typedef enum {
+    REASSOC_DO_DISASSOC = 0x00,
+    REASSOC_DONOT_DISASSOC = 0x01
+} WMI_REASSOC_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 mode;
+}POSTPACK WMI_SET_REASSOC_MODE_CMD;
+
+typedef enum {
+    ROAM_DATA_TIME = 1,            /* Get The Roam Time Data */
+} ROAM_DATA_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32        disassoc_time;
+    A_UINT32        no_txrx_time;
+    A_UINT32        assoc_time;
+    A_UINT32        allow_txrx_time;
+    A_UINT8         disassoc_bssid[ATH_MAC_LEN];
+    A_INT8          disassoc_bss_rssi;
+    A_UINT8         assoc_bssid[ATH_MAC_LEN];
+    A_INT8          assoc_bss_rssi;
+} POSTPACK WMI_TARGET_ROAM_TIME;
+
+typedef PREPACK struct {
+    PREPACK union {
+        WMI_TARGET_ROAM_TIME roamTime;
+    } POSTPACK u;
+    A_UINT8 roamDataType ;
+} POSTPACK WMI_TARGET_ROAM_DATA;
+
+typedef enum {
+    WMI_WMM_DISABLED = 0,
+    WMI_WMM_ENABLED
+} WMI_WMM_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8    status;
+}POSTPACK WMI_SET_WMM_CMD;
+
+typedef PREPACK struct {
+    A_UINT8    status;
+}POSTPACK WMI_SET_QOS_SUPP_CMD;
+
+typedef enum {
+    WMI_TXOP_DISABLED = 0,
+    WMI_TXOP_ENABLED
+} WMI_TXOP_CFG;
+
+typedef PREPACK struct {
+    A_UINT8    txopEnable;
+}POSTPACK WMI_SET_WMM_TXOP_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 keepaliveInterval;
+} POSTPACK WMI_SET_KEEPALIVE_CMD;
+
+typedef PREPACK struct {
+    A_BOOL configured;
+    A_UINT8 keepaliveInterval;
+} POSTPACK WMI_GET_KEEPALIVE_CMD;
+
+/*
+ * Add Application specified IE to a management frame
+ */
+#define WMI_MAX_IE_LEN  255
+
+typedef PREPACK struct {
+    A_UINT8 mgmtFrmType;  /* one of WMI_MGMT_FRAME_TYPE */
+    A_UINT8 ieLen;    /* Length  of the IE that should be added to the MGMT frame */
+    A_UINT8 ieInfo[1];
+} POSTPACK WMI_SET_APPIE_CMD;
+
+/*
+ * Add Application specified IE to a management frame
+ */
+typedef PREPACK struct {
+    A_UINT8 ieInfo[1];
+} POSTPACK WMI_SEND_ACTION_CMD;
+
+/*
+ * Notify the WSC registration status to the target
+ */
+#define WSC_REG_ACTIVE     1
+#define WSC_REG_INACTIVE   0
+/* Generic Hal Interface for setting hal paramters. */
+/* Add new Set HAL Param cmdIds here for newer params */
+typedef enum {
+   WHAL_SETCABTO_CMDID = 1,
+}WHAL_CMDID;
+
+typedef PREPACK struct {
+    A_UINT8 cabTimeOut;
+} POSTPACK WHAL_SETCABTO_PARAM;
+
+typedef PREPACK struct {
+    A_UINT8  whalCmdId;
+    A_UINT8 data[1];
+} POSTPACK WHAL_PARAMCMD;
+
+
+#define WOW_MAX_FILTER_LISTS 2 /*4*/
+#define WOW_MAX_FILTERS_PER_LIST 4
+#define WOW_PATTERN_SIZE 64
+#define WOW_MASK_SIZE 64
+
+#define MAC_MAX_FILTERS_PER_LIST 7
+
+typedef PREPACK struct {
+    A_UINT8 wow_valid_filter;
+    A_UINT8 wow_filter_id;
+    A_UINT8 wow_filter_size;
+    A_UINT8 wow_filter_offset;
+    A_UINT8 wow_filter_mask[WOW_MASK_SIZE];
+    A_UINT8 wow_filter_pattern[WOW_PATTERN_SIZE];
+} POSTPACK WOW_FILTER;
+
+
+typedef PREPACK struct {
+    A_UINT8 wow_valid_list;
+    A_UINT8 wow_list_id;
+    A_UINT8 wow_num_filters;
+    A_UINT8 wow_total_list_size;
+    WOW_FILTER list[WOW_MAX_FILTERS_PER_LIST];
+} POSTPACK WOW_FILTER_LIST;
+
+typedef PREPACK struct {
+    A_UINT8 valid_filter;
+    A_UINT8 mac_addr[ATH_MAC_LEN];
+} POSTPACK MAC_FILTER;
+
+
+typedef PREPACK struct {
+    A_UINT8 total_list_size;
+    A_UINT8 enable;
+    MAC_FILTER list[MAC_MAX_FILTERS_PER_LIST];
+} POSTPACK MAC_FILTER_LIST;
+
+#define MAX_IP_ADDRS  2
+typedef PREPACK struct {
+    A_UINT32 ips[MAX_IP_ADDRS];  /* IP in Network Byte Order */
+} POSTPACK WMI_SET_IP_CMD;
+
+typedef PREPACK struct {
+    A_BOOL awake;
+    A_BOOL asleep;
+} POSTPACK WMI_SET_HOST_SLEEP_MODE_CMD;
+
+typedef enum {
+    WOW_FILTER_SSID = 0x1
+} WMI_WOW_FILTER;
+
+typedef PREPACK struct {
+    A_BOOL enable_wow;
+    WMI_WOW_FILTER filter;
+    A_UINT16 hostReqDelay;
+} POSTPACK WMI_SET_WOW_MODE_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 filter_list_id;
+} POSTPACK WMI_GET_WOW_LIST_CMD;
+
+/*
+ * WMI_GET_WOW_LIST_CMD reply
+ */
+typedef PREPACK struct {
+    A_UINT8     num_filters;     /* number of patterns in reply */
+    A_UINT8     this_filter_num; /*  this is filter # x of total num_filters */
+    A_UINT8     wow_mode;
+    A_UINT8     host_mode;
+    WOW_FILTER  wow_filters[1];
+} POSTPACK WMI_GET_WOW_LIST_REPLY;
+
+typedef PREPACK struct {
+    A_UINT8 filter_list_id;
+    A_UINT8 filter_size;
+    A_UINT8 filter_offset;
+    A_UINT8 filter[1];
+} POSTPACK WMI_ADD_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 filter_list_id;
+    A_UINT16 filter_id;
+} POSTPACK WMI_DEL_WOW_PATTERN_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 macaddr[ATH_MAC_LEN];
+} POSTPACK WMI_SET_MAC_ADDRESS_CMD;
+
+/*
+ * WMI_SET_AKMP_PARAMS_CMD
+ */
+
+#define WMI_AKMP_MULTI_PMKID_EN   0x000001
+
+typedef PREPACK struct {
+    A_UINT32    akmpInfo;
+} POSTPACK WMI_SET_AKMP_PARAMS_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 pmkid[WMI_PMKID_LEN];
+} POSTPACK WMI_PMKID;
+
+/*
+ * WMI_SET_PMKID_LIST_CMD
+ */
+#define WMI_MAX_PMKID_CACHE   8
+
+typedef PREPACK struct {
+    A_UINT32    numPMKID;
+    WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+} POSTPACK WMI_SET_PMKID_LIST_CMD;
+
+/*
+ * WMI_GET_PMKID_LIST_CMD  Reply
+ * Following the Number of PMKIDs is the list of PMKIDs
+ */
+typedef PREPACK struct {
+    A_UINT32    numPMKID;
+    A_UINT8     bssidList[ATH_MAC_LEN][1];
+    WMI_PMKID   pmkidList[1];
+} POSTPACK WMI_PMKID_LIST_REPLY;
+
+typedef PREPACK struct {
+    A_UINT16 oldChannel;
+    A_UINT32 newChannel;
+} POSTPACK WMI_CHANNEL_CHANGE_EVENT;
+
+typedef PREPACK struct {
+    A_UINT32 version;
+} POSTPACK WMI_WLAN_VERSION_EVENT;
+
+
+/* WMI_ADDBA_REQ_EVENTID */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     win_sz;
+    A_UINT16    st_seq_no;
+    A_UINT8     status;         /* f/w response for ADDBA Req; OK(0) or failure(!=0) */
+} POSTPACK WMI_ADDBA_REQ_EVENT;
+
+/* WMI_ADDBA_RESP_EVENTID */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     status;         /* OK(0), failure (!=0) */
+    A_UINT16    amsdu_sz;       /* Three values: Not supported(0), 3839, 8k */
+} POSTPACK WMI_ADDBA_RESP_EVENT;
+
+/* WMI_DELBA_EVENTID
+ * f/w received a DELBA for peer and processed it.
+ * Host is notified of this
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     is_peer_initiator;
+    A_UINT16    reason_code;
+} POSTPACK WMI_DELBA_EVENT;
+
+
+#ifdef WAPI_ENABLE
+#define WAPI_REKEY_UCAST    1
+#define WAPI_REKEY_MCAST    2
+typedef PREPACK struct {
+    A_UINT8     type;
+    A_UINT8     macAddr[ATH_MAC_LEN];
+} POSTPACK WMI_WAPIREKEY_EVENT;
+#endif
+
+
+/* WMI_ALLOW_AGGR_CMDID
+ * Configures tid's to allow ADDBA negotiations
+ * on each tid, in each direction
+ */
+typedef PREPACK struct {
+    A_UINT16    tx_allow_aggr;  /* 16-bit mask to allow uplink ADDBA negotiation - bit position indicates tid*/
+    A_UINT16    rx_allow_aggr;  /* 16-bit mask to allow donwlink ADDBA negotiation - bit position indicates tid*/
+} POSTPACK WMI_ALLOW_AGGR_CMD;
+
+/* WMI_ADDBA_REQ_CMDID
+ * f/w starts performing ADDBA negotiations with peer
+ * on the given tid
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+} POSTPACK WMI_ADDBA_REQ_CMD;
+
+/* WMI_DELBA_REQ_CMDID
+ * f/w would teardown BA with peer.
+ * is_send_initiator indicates if it's or tx or rx side
+ */
+typedef PREPACK struct {
+    A_UINT8     tid;
+    A_UINT8     is_sender_initiator;
+
+} POSTPACK WMI_DELBA_REQ_CMD;
+
+#define PEER_NODE_JOIN_EVENT 0x00
+#define PEER_NODE_LEAVE_EVENT 0x01
+#define PEER_FIRST_NODE_JOIN_EVENT 0x10
+#define PEER_LAST_NODE_LEAVE_EVENT 0x11
+typedef PREPACK struct {
+    A_UINT8 eventCode;
+    A_UINT8 peerMacAddr[ATH_MAC_LEN];
+} POSTPACK WMI_PEER_NODE_EVENT;
+
+#define IEEE80211_FRAME_TYPE_MGT          0x00
+#define IEEE80211_FRAME_TYPE_CTL          0x04
+
+typedef PREPACK struct {
+    A_UINT32    rules; /* combination of WMI_WRT_... values */
+} POSTPACK WMI_CONFIG_TX_MAC_RULES_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;     /* 1 == device operates in promiscuous mode , 0 == normal mode <default> */
+} POSTPACK WMI_SET_PROMISCUOUS_MODE_CMD;
+
+typedef enum {
+    RADIO_STATE_OFF     = 0x1,
+    RADIO_STATE_ON      = 0x2,
+    RADIO_STATE_INVALID = 0xFF
+}RFKILL_RADIO_STATE;
+
+typedef PREPACK struct {
+    A_UINT8  GPIOPinNumber;
+    A_UINT8  IntrType;
+    A_UINT8  RadioState;
+} POSTPACK WMI_RFKILL_MODE_CMD;
+
+/*
+ * Transmit complete event data structure(s)
+ */
+
+
+typedef PREPACK struct {
+#define TX_COMPLETE_STATUS_SUCCESS 0
+#define TX_COMPLETE_STATUS_RETRIES 1
+#define TX_COMPLETE_STATUS_NOLINK  2
+#define TX_COMPLETE_STATUS_TIMEOUT 3
+#define TX_COMPLETE_STATUS_OTHER   4
+
+    A_UINT8 status; /* one of TX_COMPLETE_STATUS_... */
+    A_UINT8 pktID; /* packet ID to identify parent packet */
+    A_UINT8 rateIdx; /* rate index on successful transmission */
+    A_UINT8 ackFailures; /* number of ACK failures in tx attempt */
+#if 0 /* optional params currently ommitted. */
+    A_UINT32 queueDelay; // usec delay measured Tx Start time - host delivery time
+    A_UINT32 mediaDelay; // usec delay measured ACK rx time - host delivery time
+#endif
+} POSTPACK TX_COMPLETE_MSG_V1; /* version 1 of tx complete msg */
+
+typedef PREPACK struct {
+    A_UINT8 numMessages; /* number of tx comp msgs following this struct */
+    A_UINT8 msgLen; /* length in bytes for each individual msg following this struct */
+    A_UINT8 msgType; /* version of tx complete msg data following this struct */
+    A_UINT8 reserved; /* individual messages follow this header */
+} POSTPACK WMI_TX_COMPLETE_EVENT;
+
+#define WMI_TXCOMPLETE_VERSION_1 (0x01)
+
+
+/*
+ * ------- AP Mode definitions --------------
+ */
+
+/*
+ * !!! Warning !!!
+ * -Changing the following values needs compilation of both driver and firmware
+ */
+#ifdef AR6002_REV2
+#define AP_MAX_NUM_STA          4
+#else
+#define AP_MAX_NUM_STA          10
+#endif
+
+/*Maximum no. of virtual interface supported*/
+#define NUM_DEV     3
+#define NUM_CONN    (AP_MAX_NUM_STA + NUM_DEV)
+
+#define AP_ACL_SIZE             10
+#define IEEE80211_MAX_IE        256
+#define MCAST_AID               0xFF /* Spl. AID used to set DTIM flag in the beacons */
+#define DEF_AP_COUNTRY_CODE     "US "
+#define DEF_AP_WMODE_G          WMI_11G_MODE
+#define DEF_AP_WMODE_AG         WMI_11AG_MODE
+#define DEF_AP_DTIM             5
+#define DEF_BEACON_INTERVAL     100
+
+/* ACS scan policy */
+
+typedef enum {
+    AP_ACS_NORMAL = 0,      /* 1, 6, 11 */
+    AP_ACS_DISABLE_CH11,    /* 1, 6 */
+    AP_ACS_INCLUDE_CH13,    /* 1, 5, 9, 13 */
+    AP_ACS_DISABLE_CH1,     /* dont use 1 */
+    AP_ACS_DISABLE_CH1_6,   /* dont use 1 & 6 */
+    AP_ACS_POLICY_MAX
+}WMI_AP_ACS_POLICY_LIST;
+
+/* AP mode disconnect reasons */
+#define AP_DISCONNECT_STA_LEFT      101
+#define AP_DISCONNECT_FROM_HOST     102
+#define AP_DISCONNECT_COMM_TIMEOUT  103
+#define AP_DISCONNECT_MAX_STA       104
+#define AP_DISCONNECT_ACL           105
+#define AP_DISCONNECT_STA_ROAM      106
+#define AP_DISCONNECT_DFS_CHANNEL   107 
+/*
+ * Used with WMI_AP_HIDDEN_SSID_CMDID
+ */
+#define HIDDEN_SSID_FALSE   0
+#define HIDDEN_SSID_TRUE    1
+typedef PREPACK struct {
+    A_UINT8     hidden_ssid;
+} POSTPACK WMI_AP_HIDDEN_SSID_CMD;
+
+/*
+ * Used with WMI_AP_ACL_POLICY_CMDID
+ */
+#define AP_ACL_DISABLE          0x00
+#define AP_ACL_ALLOW_MAC        0x01
+#define AP_ACL_DENY_MAC         0x02
+#define AP_ACL_RETAIN_LIST_MASK 0x80
+typedef PREPACK struct {
+    A_UINT8     policy;
+} POSTPACK WMI_AP_ACL_POLICY_CMD;
+
+/*
+ * Used with WMI_AP_ACL_MAC_LIST_CMDID
+ */
+#define ADD_MAC_ADDR    1
+#define DEL_MAC_ADDR    2
+typedef PREPACK struct {
+    A_UINT8     action;
+    A_UINT8     index;
+    A_UINT8     mac[ATH_MAC_LEN];
+    A_UINT8     wildcard;
+} POSTPACK WMI_AP_ACL_MAC_CMD;
+
+typedef PREPACK struct {
+    A_UINT16    index;
+    A_UINT8     acl_mac[AP_ACL_SIZE][ATH_MAC_LEN];
+    A_UINT8     wildcard[AP_ACL_SIZE];
+    A_UINT8     policy;
+} POSTPACK WMI_AP_ACL;
+
+/*
+ * Used with WMI_AP_SET_NUM_STA_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8     num_sta;
+} POSTPACK WMI_AP_NUM_STA_CMD;
+
+/*
+ * Used with WMI_AP_SET_MLME_CMDID
+ */
+typedef PREPACK struct {
+    A_UINT8    mac[ATH_MAC_LEN];
+    A_UINT16   reason;              /* 802.11 reason code */
+    A_UINT8    cmd;                 /* operation to perform */
+/* MLME Commands */
+#define WMI_AP_MLME_ASSOC       1   /* associate station */
+#define WMI_AP_DISASSOC         2   /* disassociate station */
+#define WMI_AP_DEAUTH           3   /* deauthenticate station */
+#define WMI_AP_MLME_AUTHORIZE   4   /* authorize station */
+#define WMI_AP_MLME_UNAUTHORIZE 5   /* unauthorize station */
+} POSTPACK WMI_AP_SET_MLME_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 period;
+} POSTPACK WMI_AP_CONN_INACT_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 period_min;
+    A_UINT32 dwell_ms;
+} POSTPACK WMI_AP_PROT_SCAN_TIME_CMD;
+
+typedef PREPACK struct {
+    A_BOOL flag;
+    A_UINT16 rsvd;
+    A_UINT16 aid;
+} POSTPACK WMI_AP_SET_PVB_CMD;
+
+#define WMI_DISABLE_REGULATORY_CODE "FF"
+
+typedef PREPACK struct {
+    A_UCHAR countryCode[3];
+} POSTPACK WMI_AP_SET_COUNTRY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 dtim;
+} POSTPACK WMI_AP_SET_DTIM_CMD;
+
+typedef PREPACK struct {
+    A_UINT8  band; /* specifies which band to apply these values */
+    A_UINT8  enable; /* allows 11n to be disabled on a per band basis */
+    A_UINT8  chan_width_40M_supported;
+    A_UINT8  short_GI_20MHz;
+    A_UINT8  short_GI_40MHz;
+    A_UINT8  intolerance_40MHz;
+    A_UINT8  max_ampdu_len_exp;
+} POSTPACK WMI_SET_HT_CAP_CMD;
+
+typedef PREPACK struct {
+    A_UINT8   sta_chan_width;
+} POSTPACK WMI_SET_HT_OP_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 rateMasks[WMI_MODE_MAX*WMI_MAX_RATE_MASK];
+} POSTPACK WMI_SET_TX_SELECT_RATES_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    sgiMask[WMI_MAX_RATE_MASK];
+    A_UINT8     sgiPERThreshold;
+} POSTPACK WMI_SET_TX_SGI_PARAM_CMD;
+
+#define DEFAULT_SGI_MASK_L32 0x08080000
+#define DEFAULT_SGI_MASK_U32 0x00000000
+#define DEFAULT_SGI_PER 10
+
+typedef PREPACK struct {
+    A_UINT32 rateField[WMI_MAX_RATE_MASK]; /* 1 bit per rate corresponding to index */
+#define WMI_RATE_POLICY_ID_MAX 5    
+    A_UINT8 id; /* valid values == 1->WMI_RATE_POLICY_ID_MAX */    
+    A_UINT8 shortTrys;
+    A_UINT8 longTrys;
+    A_UINT8 reserved; /* padding */
+} POSTPACK WMI_SET_RATE_POLICY_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 metaVersion; /* version of meta data for rx packets <0 = default> (0-7 = valid) */
+    A_UINT8 dot11Hdr; /* 1 == leave .11 header intact , 0 == replace .11 header with .3 <default> */
+    A_UINT8 defragOnHost; /* 1 == defragmentation is performed by host, 0 == performed by target <default> */
+    A_UINT8 reserved[1]; /* alignment */
+} POSTPACK WMI_RX_FRAME_FORMAT_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT8 enable;     /* 1 == device operates in thin mode , 0 == normal mode <default> */
+    A_UINT8 reserved[3];
+} POSTPACK WMI_SET_THIN_MODE_CMD;
+
+
+typedef PREPACK struct {
+    A_UINT16    channel; /* frequency in Mhz */
+    //A_UINT8 mode; // HT20 or HT40
+    //A_UINT8 secondary; // if mode == HT40 secondary channel above | below
+} POSTPACK WMI_SET_CHANNEL_CMD;
+
+
+typedef enum {
+    WMI_SET_CHANNEL_RES_SUCCESS = 0, // device has joined the network
+    WMI_SET_CHANNEL_RES_FAIL, // device failed for unspecified reason   
+}WMI_SET_CHANNEL_RESULT;
+
+typedef PREPACK struct {
+    A_UINT8 result; /* the result of the join cmd. one of WMI_THIN_JOIN_RESULT */
+    A_UINT8 reserved[3]; /* alignment */
+} POSTPACK WMI_SET_CHANNEL_EVENT; 
+
+typedef enum {
+    WMI_FILTERMASK_MGMT=0,
+    WMI_FILTERMASK_CTRL,
+    WMI_FILTERMASK_DATA,
+    WMI_FILTERMASK_MAX
+}WMI_FILTERMASK_INDEX;
+
+typedef PREPACK struct {
+    A_UINT16 filtermask[WMI_FILTERMASK_MAX];     
+    A_UINT16 reserved; /* alignment */
+} POSTPACK WMI_RX_FRAME_FILTER_CMD;
+
+/* AP mode events */
+/* WMI_PS_POLL_EVENT */
+typedef PREPACK struct {
+    A_UINT16 aid;
+} POSTPACK WMI_PSPOLL_EVENT;
+
+typedef PREPACK struct {
+    A_UINT32 tx_bytes;
+    A_UINT32 tx_pkts;
+    A_UINT32 tx_error;
+    A_UINT32 tx_discard;
+    A_UINT32 rx_bytes;
+    A_UINT32 rx_pkts;
+    A_UINT32 rx_error;
+    A_UINT32 rx_discard;
+    A_UINT32 aid;
+} POSTPACK WMI_PER_STA_STAT;
+
+#define AP_GET_STATS    0
+#define AP_CLEAR_STATS  1
+
+typedef PREPACK struct {
+    A_UINT32            action;
+    WMI_PER_STA_STAT    sta[AP_MAX_NUM_STA];
+} POSTPACK WMI_AP_MODE_STAT;
+
+#define AP_11BG_RATESET1        1
+#define AP_11BG_RATESET2        2
+#define DEF_AP_11BG_RATESET     AP_11BG_RATESET1
+typedef PREPACK struct {
+    A_UINT8 rateset;
+} POSTPACK WMI_AP_SET_11BG_RATESET_CMD;
+/*
+ * End of AP mode definitions
+ */
+
+struct _wmm_params {
+    A_UINT8     acm;           /* ACM parameter */
+    A_UINT8     aifsn;         /* AIFSN parameters */
+    A_UINT8     logcwmin;      /* cwmin in exponential form */
+    A_UINT8     logcwmax;      /* cwmax in exponential form */
+    A_UINT16    txopLimit;     /* txopLimit */
+};
+
+/* WMI_REPORT_WMM_PARAMS_EVENT */
+typedef PREPACK struct {
+    struct _wmm_params wmm_params[4];
+} POSTPACK WMI_REPORT_WMM_PARAMS_EVENT;
+
+/* P2P module definitions */
+
+/* P2P module commands */
+typedef PREPACK struct {
+    A_UINT8 go_intent;
+    A_UINT8 country[3];
+    A_UINT8 reg_class;
+    A_UINT8 listen_channel;
+    A_UINT8 op_reg_class;
+    A_UINT8 op_channel;
+    A_UINT16 config_methods;
+} POSTPACK WMI_P2P_SET_CONFIG_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 categ;
+    A_UINT16 sub_categ;
+} POSTPACK device_type_tuple;
+
+typedef PREPACK struct {
+    device_type_tuple pri_dev_type;
+    //A_UINT8 pri_device_type[8];
+#define MAX_P2P_SEC_DEVICE_TYPES 5
+    device_type_tuple sec_dev_type[MAX_P2P_SEC_DEVICE_TYPES];
+#define WPS_UUID_LEN 16
+    A_UINT8 uuid[WPS_UUID_LEN];
+#define WPS_MAX_DEVNAME_LEN 32
+    A_UINT8 device_name[WPS_MAX_DEVNAME_LEN];
+    A_UINT8 dev_name_len;
+} POSTPACK WMI_WPS_SET_CONFIG_CMD;
+
+typedef PREPACK struct {
+    device_type_tuple pri_dev_type;
+    device_type_tuple sec_dev_type[MAX_P2P_SEC_DEVICE_TYPES];
+    A_UINT8  device_addr[ATH_MAC_LEN];
+} POSTPACK WMI_SET_REQ_DEV_ATTR_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 ssidLength;
+    A_UINT8 ssid[WMI_MAX_SSID_LEN];
+} POSTPACK P2P_SSID;
+
+typedef enum wmi_p2p_discovery_type {
+    WMI_P2P_FIND_START_WITH_FULL,
+    WMI_P2P_FIND_ONLY_SOCIAL,
+    WMI_P2P_FIND_PROGRESSIVE
+} WMI_P2P_DISC_TYPE;
+
+typedef PREPACK struct {
+    A_UINT32 timeout;
+    WMI_P2P_DISC_TYPE type;
+} POSTPACK WMI_P2P_FIND_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT16 go_oper_freq;
+    A_UINT8  dialog_token;
+    A_UINT8  peer_addr[ATH_MAC_LEN];
+    A_UINT8  own_interface_addr[ATH_MAC_LEN];
+    A_UINT8  member_in_go_dev[ATH_MAC_LEN];
+    A_UINT8  go_dev_dialog_token;
+    P2P_SSID peer_go_ssid;
+    A_UINT8  wps_method;
+    A_UINT8 dev_capab;
+    A_INT8  go_intent;
+    A_UINT8 persistent_grp;
+} POSTPACK WMI_P2P_GO_NEG_START_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 persistent_group;
+    A_UINT8 group_formation;
+} POSTPACK WMI_P2P_GRP_INIT_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT8 grp_formation_status;
+} POSTPACK WMI_P2P_GRP_FORMATION_DONE_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 timeout;
+}POSTPACK WMI_P2P_LISTEN_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT8 status;
+    A_INT8 go_intent;
+    A_UINT8 wps_buf[512];
+    A_UINT16 wps_buflen;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 dialog_token;
+    A_UINT8 wps_method;
+    A_UINT8 persistent_grp;
+    A_UINT8 sa[ATH_MAC_LEN];
+}POSTPACK WMI_P2P_GO_NEG_REQ_RSP_CMD;
+
+typedef enum {
+    WMI_P2P_INVITE_ROLE_GO,
+    WMI_P2P_INVITE_ROLE_ACTIVE_GO,
+    WMI_P2P_INVITE_ROLE_CLIENT,
+} WMI_P2P_INVITE_ROLE;
+
+typedef PREPACK struct {
+    WMI_P2P_INVITE_ROLE role;
+    A_UINT16 listen_freq;
+    A_UINT16 force_freq;
+    A_UINT8 dialog_token;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 is_persistent;
+    A_UINT8 wps_method;
+}POSTPACK WMI_P2P_INVITE_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 force_freq;
+    A_UINT8 status;
+    A_UINT8 dialog_token;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 is_go;
+    A_UINT8 group_bssid[ATH_MAC_LEN];
+}POSTPACK WMI_P2P_INVITE_REQ_RSP_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 wps_method;
+    A_UINT16 listen_freq;
+    A_UINT8 dialog_token;
+    A_UINT8 peer[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID go_oper_ssid;
+}POSTPACK WMI_P2P_PROV_DISC_REQ_CMD;
+
+typedef enum {
+    WMI_P2P_CONFID_LISTEN_CHANNEL=1,
+    WMI_P2P_CONFID_CROSS_CONNECT=2,
+    WMI_P2P_CONFID_SSID_POSTFIX=3,
+    WMI_P2P_CONFID_INTRA_BSS=4,
+    WMI_P2P_CONFID_CONCURRENT_MODE=5,
+    WMI_P2P_CONFID_GO_INTENT=6,
+    WMI_P2P_CONFID_DEV_NAME=7,
+
+} WMI_P2P_CONF_ID;
+
+typedef PREPACK struct {
+    A_UINT8 reg_class;
+    A_UINT8 listen_channel;
+}POSTPACK WMI_P2P_LISTEN_CHANNEL;
+
+typedef PREPACK struct {
+    A_UINT8 flag;
+}POSTPACK WMI_P2P_SET_CROSS_CONNECT;
+
+typedef PREPACK struct {
+    A_UINT8 flag;
+}POSTPACK WMI_P2P_SET_CONCURRENT_MODE;
+
+typedef PREPACK struct {
+    A_UINT8 ssid_postfix[WMI_MAX_SSID_LEN-9];
+    A_UINT8 ssid_postfix_len;
+}POSTPACK WMI_P2P_SET_SSID_POSTFIX;
+
+typedef PREPACK struct {
+    A_UINT8 value;
+}POSTPACK WMI_P2P_SET_GO_INTENT;
+
+typedef PREPACK struct {
+    A_UINT8 dev_name[WPS_MAX_DEVNAME_LEN];
+    A_UINT8 dev_name_len;
+}POSTPACK WMI_P2P_SET_DEV_NAME;
+
+typedef PREPACK struct {
+    A_UINT8 flag;
+}POSTPACK WMI_P2P_SET_INTRA_BSS;
+
+typedef PREPACK struct {
+    A_UINT8 config_id;    /* set to one of WMI_P2P_CONF_ID */
+    PREPACK union {
+        WMI_P2P_LISTEN_CHANNEL listen_ch;
+        WMI_P2P_SET_CROSS_CONNECT cross_conn;
+        WMI_P2P_SET_SSID_POSTFIX ssid_postfix;
+        WMI_P2P_SET_INTRA_BSS intra_bss;
+        WMI_P2P_SET_CONCURRENT_MODE concurrent_mode;
+        WMI_P2P_SET_GO_INTENT go_intent;
+        WMI_P2P_SET_DEV_NAME device_name;
+    }POSTPACK val;
+}POSTPACK WMI_P2P_SET_CMD;
+
+#define WMI_P2P_MAX_TLV_LEN 1024
+typedef enum {
+    WMI_P2P_SD_TYPE_GAS_INITIAL_REQ     = 0x1,
+    WMI_P2P_SD_TYPE_GAS_INITIAL_RESP    = 0x2,
+    WMI_P2P_SD_TYPE_GAS_COMEBACK_REQ    = 0x3,
+    WMI_P2P_SD_TYPE_GAS_COMEBACK_RESP   = 0x4,
+    WMI_P2P_PD_TYPE_RESP                = 0x5,
+    WMI_P2P_SD_TYPE_STATUS_IND          = 0x6,
+} WMI_P2P_SDPD_TYPE;
+
+typedef enum {
+    WMI_P2P_SDPD_TRANSACTION_PENDING = 0x1,
+    WMI_P2P_SDPD_TRANSACTION_COMP = 0x2,
+} WMI_P2P_SDPD_TRANSACTION_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8 type;
+    A_UINT8 dialog_token;
+    A_UINT8 frag_id;
+    A_UINT8 reserved1;          /* alignment */
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT16 freq;
+    A_UINT16 status_code;
+    A_UINT16 comeback_delay;
+    A_UINT16 tlv_length; 
+    A_UINT16 update_indic;
+    A_UINT16 total_length;
+    A_UINT16 reserved2;         /* future */
+    A_UINT8  tlv[WMI_P2P_MAX_TLV_LEN];
+} POSTPACK WMI_P2P_SDPD_TX_CMD;
+
+/* P2P module events */
+
+typedef PREPACK struct {
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 wps_buf[512];
+    A_UINT16 wps_buflen;
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 dialog_token;
+}POSTPACK WMI_P2P_GO_NEG_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT16 freq;
+    A_INT8 status;
+    A_UINT8 role_go;
+    A_UINT8 ssid[WMI_MAX_SSID_LEN];
+    A_UINT8 ssid_len;
+#define WMI_MAX_PASSPHRASE_LEN 9
+    A_CHAR pass_phrase[WMI_MAX_PASSPHRASE_LEN];
+    A_UINT8 peer_device_addr[ATH_MAC_LEN];
+    A_UINT8 peer_interface_addr[ATH_MAC_LEN];
+    A_UINT8 wps_method;
+    A_UINT8 persistent_grp;
+} POSTPACK WMI_P2P_GO_NEG_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 p2p_buf[512];
+    A_UINT16 p2p_buflen;
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 is_persistent;
+    A_UINT8 dialog_token;
+} POSTPACK WMI_P2P_INVITE_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT16 oper_freq;
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 is_bssid_valid;
+    A_UINT8 go_dev_addr[ATH_MAC_LEN];
+    P2P_SSID ssid;
+    A_UINT8 status;
+} POSTPACK WMI_P2P_INVITE_RCVD_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 status;
+    A_UINT8 bssid[ATH_MAC_LEN];
+    A_UINT8 is_bssid_valid;
+} POSTPACK WMI_P2P_INVITE_SENT_RESULT_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 sa[ATH_MAC_LEN];
+    A_UINT16 wps_config_method;
+    A_UINT8 dev_addr[ATH_MAC_LEN];
+#define WPS_DEV_TYPE_LEN 8
+    A_UINT8 pri_dev_type[WPS_DEV_TYPE_LEN];
+    A_UINT8 device_name[WPS_MAX_DEVNAME_LEN];
+    A_UINT8 dev_name_len;
+    A_UINT16 dev_config_methods;
+    A_UINT8 device_capab;
+    A_UINT8 group_capab;
+} POSTPACK WMI_P2P_PROV_DISC_REQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 peer[ATH_MAC_LEN];
+    A_UINT16 config_methods;
+} POSTPACK WMI_P2P_PROV_DISC_RESP_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8 type;
+    A_UINT8 transaction_status;
+    A_UINT8 dialog_token;
+    A_UINT8 frag_id;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+    A_UINT16 freq;
+    A_UINT16 status_code;
+    A_UINT16 comeback_delay;
+    A_UINT16 tlv_length; 
+    A_UINT16 update_indic;
+//  Variable length TLV will be placed after the event  
+} POSTPACK WMI_P2P_SDPD_RX_EVENT;
+
+typedef PREPACK struct {
+    A_UINT16 tlv_length; 
+//  Variable length TLV will be placed after the event  
+} POSTPACK WMI_HS20_RX_EVENT;
+
+typedef PREPACK struct {
+    A_UINT8    event_id;    /* event identifier  */
+    A_UINT8    length;      /* number of bytes of data that follows */
+    A_UINT8    data[1];     /* start of event data */
+} POSTPACK WMI_ACS_EVENT_MSG;
+
+#define WMI_ACS_EVENT_HDR_LEN  (sizeof(WMI_ACS_EVENT_MSG) - sizeof(A_UINT8))
+
+typedef PREPACK struct {
+    A_UINT8    ctrl_id;     /* control identifier */
+    A_UINT8    length;      /* number of bytes of data to follow */
+    A_UINT8    data[1];     /* start of control data */
+} POSTPACK WMI_ACS_CTRL_MSG;
+
+#define WMI_ACS_CTRL_HDR_LEN  (sizeof(WMI_ACS_CTRL_MSG) - sizeof(A_UINT8))
+
+/* STORE / RECALL Commands AND Events DEFINITION START */
+typedef PREPACK struct {
+    A_UINT8 enable;
+#define STRRCL_RECIPIENT_HOST 1    
+    A_UINT8 recipient;
+} POSTPACK WMI_STORERECALL_CONFIGURE_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 length; /* number of bytes of data to follow */
+    A_UINT8  data[1]; /* start of data */
+} POSTPACK WMI_STORERECALL_RECALL_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 sleep_msec;
+    A_UINT8 store_after_tx_empty;
+    A_UINT8 store_after_fresh_beacon_rx;    
+} POSTPACK WMI_STORERECALL_HOST_READY_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    msec_sleep; /* time between power off/on */
+    A_UINT32    length; /* length of following data */
+    A_UINT8     data[1]; /* start of data */
+} POSTPACK WMI_STORERECALL_STORE_EVENT;
+
+/* STORE / RECALL Commands AND Events DEFINITION END */
+
+typedef enum {
+    WMI_AP_APSD_DISABLED = 0,
+    WMI_AP_APSD_ENABLED
+} WMI_AP_APSD_STATUS;
+
+typedef PREPACK struct {
+    A_UINT8    enable;
+} POSTPACK WMI_AP_SET_APSD_CMD;
+
+typedef enum {
+    WMI_AP_APSD_NO_DELIVERY_FRAMES_FOR_THIS_TRIGGER =  0x1,
+} WMI_AP_APSD_BUFFERED_TRAFFIC_FLAGS;
+
+typedef PREPACK struct {
+    A_UINT16   aid;
+    A_UINT16   bitmap;
+    A_UINT32   flags;
+} POSTPACK WMI_AP_APSD_BUFFERED_TRAFFIC_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 enable;
+} POSTPACK WMI_STA_BMISS_ENHANCE_CMD;
+
+typedef PREPACK struct {
+    A_UINT16    freq;
+} POSTPACK WMI_LTE_FREQ_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    time_val_sec;
+} POSTPACK  WMI_AP_IDLE_CLOSE_TIME_CMD;
+
+/*
+ * These constants are used with A_WLAN_BAND_SET.
+ */ 
+#define A_BAND_24GHZ           0
+#define A_BAND_5GHZ            1
+#define A_NUM_BANDS            2
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_H_ */
diff --git a/host/include/wmi_api.h b/host/include/wmi_api.h
new file mode 100644
index 0000000..57177f9
--- /dev/null
+++ b/host/include/wmi_api.h
@@ -0,0 +1,582 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_api.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the definitions for the Wireless Module Interface (WMI).
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _WMI_API_H_
+#define _WMI_API_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+    /* WMI converts a dix frame with an ethernet payload (up to 1500 bytes)
+     * to an 802.3 frame (adds SNAP header) and adds on a WMI data header */
+#define WMI_MAX_TX_DATA_FRAME_LENGTH (1500 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+
+    /* A normal WMI data frame */
+#define WMI_MAX_NORMAL_RX_DATA_FRAME_LENGTH (1500 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+
+    /* An AMSDU frame */ /* The MAX AMSDU length of AR6003 is 3839 */
+#define WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH  (3840 + sizeof(WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))
+
+/*
+ * IP QoS Field definitions according to 802.1p
+ */
+#define BEST_EFFORT_PRI         0
+#define BACKGROUND_PRI          1
+#define EXCELLENT_EFFORT_PRI    3
+#define CONTROLLED_LOAD_PRI     4
+#define VIDEO_PRI               5
+#define VOICE_PRI               6
+#define NETWORK_CONTROL_PRI     7
+#define MAX_NUM_PRI             8
+
+#define UNDEFINED_PRI           (0xff)
+
+#define WMI_IMPLICIT_PSTREAM_INACTIVITY_INT 5000 /* 5 seconds */
+
+#define A_ROUND_UP(x, y)  ((((x) + ((y) - 1)) / (y)) * (y))
+
+typedef enum {
+    ATHEROS_COMPLIANCE = 0x1,
+}TSPEC_PARAM_COMPLIANCE;
+
+struct wmi_t;
+
+void *wmi_init(void *devt, int devid);
+
+void wmi_qos_state_init(struct wmi_t *wmip);
+void wmi_shutdown(struct wmi_t *wmip);
+HTC_ENDPOINT_ID wmi_get_control_ep(struct wmi_t * wmip);
+void wmi_set_control_ep(struct wmi_t * wmip, HTC_ENDPOINT_ID eid);
+void wmi_set_host_sleep_mode_event_fn_ptr(struct wmi_t *wmip,
+        void (*host_sleep_mode_event_fn)(void *), void *host_sleep_mode_event_fn_arg);
+A_UINT16  wmi_get_mapped_qos_queue(struct wmi_t *, A_UINT8);
+A_STATUS wmi_dix_2_dot3(struct wmi_t *wmip, void *osbuf);
+A_STATUS wmi_data_hdr_add(struct wmi_t *wmip, void *osbuf, A_UINT8 msgType, A_UINT32 flags , WMI_DATA_HDR_DATA_TYPE data_type,A_UINT8 metaVersion, void *pTxMetaS);
+A_STATUS wmi_dot3_2_dix(void *osbuf);
+
+A_STATUS wmi_dot11_hdr_remove (struct wmi_t *wmip, void *osbuf);
+A_STATUS wmi_dot11_hdr_add(struct wmi_t *wmip, void *osbuf, NETWORK_TYPE mode);
+
+A_STATUS wmi_data_hdr_remove(struct wmi_t *wmip, void *osbuf);
+A_STATUS wmi_syncpoint(struct wmi_t *wmip);
+A_STATUS wmi_syncpoint_reset(struct wmi_t *wmip);
+A_UINT8 wmi_implicit_create_pstream(struct wmi_t *wmip, void *osbuf, A_UINT32 layer2Priority, A_BOOL wmmEnabled);
+
+A_UINT8 wmi_determine_userPriority (A_UINT8 *pkt, A_UINT32 layer2Pri);
+
+A_STATUS wmi_control_rx(struct wmi_t *wmip, void *osbuf);
+void wmi_iterate_nodes(struct wmi_t *wmip, wlan_node_iter_func *f, void *arg);
+void wmi_scan_report_lock(struct wmi_t *wmip);
+void wmi_scan_report_unlock(struct wmi_t *wmip);
+void wmi_free_allnodes(struct wmi_t *wmip);
+bss_t *wmi_find_node(struct wmi_t *wmip, const A_UINT8 *macaddr);
+void wmi_free_node(struct wmi_t *wmip, const A_UINT8 *macaddr);
+
+
+typedef enum {
+    NO_SYNC_WMIFLAG = 0,
+    SYNC_BEFORE_WMIFLAG,            /* transmit all queued data before cmd */
+    SYNC_AFTER_WMIFLAG,             /* any new data waits until cmd execs */
+    SYNC_BOTH_WMIFLAG,
+    END_WMIFLAG                     /* end marker */
+} WMI_SYNC_FLAG;
+
+A_STATUS wmi_cmd_send(struct wmi_t *wmip, void *osbuf, WMI_COMMAND_ID cmdId,
+                      WMI_SYNC_FLAG flag);
+
+A_STATUS wmi_connect_cmd(struct wmi_t *wmip,
+                         NETWORK_TYPE netType,
+                         DOT11_AUTH_MODE dot11AuthMode,
+                         AUTH_MODE authMode,
+                         CRYPTO_TYPE pairwiseCrypto,
+                         A_UINT8 pairwiseCryptoLen,
+                         CRYPTO_TYPE groupCrypto,
+                         A_UINT8 groupCryptoLen,
+                         int ssidLength,
+                         A_UCHAR *ssid,
+                         A_UINT8 *bssid,
+                         A_UINT16 channel,
+                         A_UINT32 ctrl_flags);
+
+A_STATUS wmi_set_div_param_cmd(struct wmi_t *wmip, A_UINT32 divIdleTime,
+                A_UINT8   antRssiThresh, A_UINT8 divEnable, A_UINT16 active_treshold_rate);
+
+
+A_STATUS wmi_reconnect_cmd(struct wmi_t *wmip,
+                           A_UINT8 *bssid,
+                           A_UINT16 channel);
+A_STATUS wmi_disconnect_cmd(struct wmi_t *wmip);
+A_STATUS wmi_getrev_cmd(struct wmi_t *wmip);
+A_STATUS wmi_startscan_cmd(struct wmi_t *wmip, WMI_SCAN_TYPE scanType,
+                           A_BOOL forceFgScan, A_BOOL isLegacy,
+                           A_UINT32 homeDwellTime, A_UINT32 forceScanInterval,
+                           A_INT8 numChan, A_UINT16 *channelList);
+A_STATUS wmi_scanparams_cmd(struct wmi_t *wmip, A_UINT16 fg_start_sec,
+                            A_UINT16 fg_end_sec, A_UINT16 bg_sec,
+                            A_UINT16 minact_chdw_msec,
+                            A_UINT16 maxact_chdw_msec, A_UINT16 pas_chdw_msec,
+                            A_UINT8 shScanRatio, A_UINT8 scanCtrlFlags,
+                            A_UINT32 max_dfsch_act_time,
+                            A_UINT16 maxact_scan_per_ssid);
+A_STATUS wmi_bssfilter_cmd(struct wmi_t *wmip, A_UINT8 filter, A_UINT32 ieMask);
+A_STATUS wmi_probedSsid_cmd(struct wmi_t *wmip, A_UINT8 index, A_UINT8 flag,
+                            A_UINT8 ssidLength, A_UCHAR *ssid);
+A_STATUS wmi_listeninterval_cmd(struct wmi_t *wmip, A_UINT16 listenInterval, A_UINT16 listenBeacons);
+A_STATUS wmi_bmisstime_cmd(struct wmi_t *wmip, A_UINT16 bmisstime, A_UINT16 bmissbeacons);
+A_STATUS wmi_associnfo_cmd(struct wmi_t *wmip, A_UINT8 ieType,
+                           A_UINT8 ieLen, A_UINT8 *ieInfo);
+A_STATUS wmi_powermode_cmd(struct wmi_t *wmip, A_UINT8 powerMode);
+A_STATUS wmi_powermode_cmd_w_psminfo(struct wmi_t *wmip, A_UINT8 _psm_info,A_UINT8 _default);
+A_STATUS wmi_ibsspmcaps_cmd(struct wmi_t *wmip, A_UINT8 pmEnable, A_UINT8 ttl,
+                            A_UINT16 atim_windows, A_UINT16 timeout_value);
+A_STATUS wmi_apps_cmd(struct wmi_t *wmip, A_UINT8 psType, A_UINT32 idle_time,
+                   A_UINT32 ps_period, A_UINT8 sleep_period);
+A_STATUS wmi_pmparams_cmd(struct wmi_t *wmip, A_UINT16 idlePeriod,
+                           A_UINT16 psPollNum, A_UINT16 dtimPolicy,
+                           A_UINT16 wakup_tx_policy, A_UINT16 num_tx_to_wakeup,
+                           A_UINT16 ps_fail_event_policy);
+A_STATUS wmi_disctimeout_cmd(struct wmi_t *wmip, A_UINT8 timeout);
+A_STATUS wmi_sync_cmd(struct wmi_t *wmip, A_UINT8 syncNumber);
+A_STATUS wmi_create_pstream_cmd(struct wmi_t *wmip, WMI_CREATE_PSTREAM_CMD *pstream);
+A_STATUS wmi_delete_pstream_cmd(struct wmi_t *wmip, A_UINT8 trafficClass, A_UINT8 streamID);
+A_STATUS wmi_set_framerate_cmd(struct wmi_t *wmip, A_UINT8 bEnable, A_UINT8 type, A_UINT8 subType, A_UINT16 rateMask);
+A_STATUS wmi_set_bitrate_cmd(struct wmi_t *wmip, A_INT32 dataRate, A_INT32 mgmtRate, A_INT32 ctlRate);
+A_STATUS wmi_get_bitrate_cmd(struct wmi_t *wmip);
+A_INT8   wmi_validate_bitrate(struct wmi_t *wmip, A_INT32 rate, A_INT8 *rate_idx);
+A_STATUS wmi_get_regDomain_cmd(struct wmi_t *wmip);
+A_STATUS wmi_get_channelList_cmd(struct wmi_t *wmip);
+A_STATUS wmi_set_channelParams_cmd(struct wmi_t *wmip, A_UINT8 scanParam,
+                                   WMI_PHY_MODE mode, A_INT8 numChan,
+                                   A_UINT16 *channelList);
+
+A_STATUS wmi_set_snr_threshold_params(struct wmi_t *wmip,
+                                       WMI_SNR_THRESHOLD_PARAMS_CMD *snrCmd);
+A_STATUS wmi_set_rssi_threshold_params(struct wmi_t *wmip,
+                                        WMI_RSSI_THRESHOLD_PARAMS_CMD *rssiCmd);
+A_STATUS wmi_clr_rssi_snr(struct wmi_t *wmip);
+A_STATUS wmi_set_lq_threshold_params(struct wmi_t *wmip,
+                                      WMI_LQ_THRESHOLD_PARAMS_CMD *lqCmd);
+A_STATUS wmi_set_rts_cmd(struct wmi_t *wmip, A_UINT16 threshold);
+A_STATUS wmi_set_lpreamble_cmd(struct wmi_t *wmip, A_UINT8 status, A_UINT8 preamblePolicy);
+
+A_STATUS wmi_set_error_report_bitmask(struct wmi_t *wmip, A_UINT32 bitmask);
+
+A_STATUS wmi_get_challenge_resp_cmd(struct wmi_t *wmip, A_UINT32 cookie,
+                                    A_UINT32 source);
+
+A_STATUS wmi_config_debug_module_cmd(struct wmi_t *wmip, A_UINT16 mmask,
+                                     A_UINT16 tsr, A_BOOL rep, A_UINT16 size,
+                                     A_UINT32 valid);
+
+A_STATUS wmi_get_stats_cmd(struct wmi_t *wmip);
+
+A_STATUS wmi_addKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex,
+                        CRYPTO_TYPE keyType, A_UINT8 keyUsage,
+                        A_UINT8 keyLength,A_UINT8 *keyRSC,
+                        A_UINT8 *keyMaterial, A_UINT8 key_op_ctrl, A_UINT8 *mac,
+                        WMI_SYNC_FLAG sync_flag);
+A_STATUS wmi_add_krk_cmd(struct wmi_t *wmip, A_UINT8 *krk);
+A_STATUS wmi_delete_krk_cmd(struct wmi_t *wmip);
+A_STATUS wmi_deleteKey_cmd(struct wmi_t *wmip, A_UINT8 keyIndex);
+A_STATUS wmi_set_akmp_params_cmd(struct wmi_t *wmip,
+                                 WMI_SET_AKMP_PARAMS_CMD *akmpParams);
+A_STATUS wmi_get_pmkid_list_cmd(struct wmi_t *wmip);
+A_STATUS wmi_set_pmkid_list_cmd(struct wmi_t *wmip,
+                                WMI_SET_PMKID_LIST_CMD *pmkInfo);
+A_STATUS wmi_abort_scan_cmd(struct wmi_t *wmip);
+A_STATUS wmi_set_txPwr_cmd(struct wmi_t *wmip, A_UINT8 dbM);
+A_STATUS wmi_get_txPwr_cmd(struct wmi_t *wmip);
+A_STATUS wmi_addBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex, A_UINT8 *bssid);
+A_STATUS wmi_deleteBadAp_cmd(struct wmi_t *wmip, A_UINT8 apIndex);
+A_STATUS wmi_set_tkip_countermeasures_cmd(struct wmi_t *wmip, A_BOOL en);
+A_STATUS wmi_setPmkid_cmd(struct wmi_t *wmip, A_UINT8 *bssid, A_UINT8 *pmkId,
+                          A_BOOL set);
+A_STATUS wmi_set_access_params_cmd(struct wmi_t *wmip, A_UINT8 ac, A_UINT16 txop,
+                                   A_UINT8 eCWmin, A_UINT8 eCWmax,
+                                   A_UINT8 aifsn);
+A_STATUS wmi_set_retry_limits_cmd(struct wmi_t *wmip, A_UINT8 frameType,
+                                  A_UINT8 trafficClass, A_UINT8 maxRetries,
+                                  A_UINT8 enableNotify);
+
+void wmi_get_current_bssid(struct wmi_t *wmip, A_UINT8 *bssid);
+
+A_STATUS wmi_get_roam_tbl_cmd(struct wmi_t *wmip);
+A_STATUS wmi_get_roam_data_cmd(struct wmi_t *wmip, A_UINT8 roamDataType);
+A_STATUS wmi_set_roam_ctrl_cmd(struct wmi_t *wmip, WMI_SET_ROAM_CTRL_CMD *p,
+                               A_UINT8 size);
+A_STATUS wmi_set_powersave_timers_cmd(struct wmi_t *wmip,
+                            WMI_POWERSAVE_TIMERS_POLICY_CMD *pCmd,
+                            A_UINT8 size);
+
+A_STATUS wmi_set_opt_mode_cmd(struct wmi_t *wmip, A_UINT8 optMode);
+A_STATUS wmi_opt_tx_frame_cmd(struct wmi_t *wmip,
+                              A_UINT8 frmType,
+                              A_UINT8 *dstMacAddr,
+                              A_UINT8 *bssid,
+                              A_UINT16 optIEDataLen,
+                              A_UINT8 *optIEData);
+
+A_STATUS wmi_set_adhoc_bconIntvl_cmd(struct wmi_t *wmip, A_UINT16 intvl);
+A_STATUS wmi_set_voice_pkt_size_cmd(struct wmi_t *wmip, A_UINT16 voicePktSize);
+A_STATUS wmi_set_max_sp_len_cmd(struct wmi_t *wmip, A_UINT8 maxSpLen);
+A_UINT8  convert_userPriority_to_trafficClass(A_UINT8 userPriority);
+A_UINT8 wmi_get_power_mode_cmd(struct wmi_t *wmip);
+A_STATUS wmi_verify_tspec_params(WMI_CREATE_PSTREAM_CMD *pCmd, A_BOOL tspecCompliance);
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+A_STATUS wmi_test_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT32  len);
+#endif
+
+A_STATUS wmi_set_bt_status_cmd(struct wmi_t *wmip, A_UINT8 streamType, A_UINT8 status);
+A_STATUS wmi_set_bt_params_cmd(struct wmi_t *wmip, WMI_SET_BT_PARAMS_CMD* cmd);
+
+A_STATUS wmi_set_btcoex_fe_ant_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_FE_ANT_CMD * cmd);
+
+A_STATUS wmi_set_btcoex_colocated_bt_dev_cmd(struct wmi_t *wmip,
+                                        WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD * cmd);
+
+A_STATUS wmi_set_btcoex_btinquiry_page_config_cmd(struct wmi_t *wmip,
+                                        WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *cmd);
+
+A_STATUS wmi_set_btcoex_sco_config_cmd(struct wmi_t *wmip,
+                                      WMI_SET_BTCOEX_SCO_CONFIG_CMD * cmd);
+
+A_STATUS wmi_set_btcoex_a2dp_config_cmd(struct wmi_t *wmip,
+                                         WMI_SET_BTCOEX_A2DP_CONFIG_CMD* cmd);
+
+
+A_STATUS wmi_set_btcoex_aclcoex_config_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD* cmd);
+
+A_STATUS wmi_set_btcoex_debug_cmd(struct wmi_t *wmip, WMI_SET_BTCOEX_DEBUG_CMD * cmd);
+
+A_STATUS wmi_set_btcoex_bt_operating_status_cmd(struct wmi_t * wmip,
+                            WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD * cmd);
+
+A_STATUS wmi_get_btcoex_config_cmd(struct wmi_t * wmip, WMI_GET_BTCOEX_CONFIG_CMD * cmd);
+
+A_STATUS wmi_get_btcoex_stats_cmd(struct wmi_t * wmip);
+
+A_STATUS wmi_SGI_cmd(struct wmi_t *wmip, A_UINT32 *sgiMask, A_UINT8 sgiPERThreshold);
+
+/*
+ *  This function is used to configure the fix rates mask to the target.
+ */
+A_STATUS wmi_set_fixrates_cmd(struct wmi_t *wmip, A_UINT32 *fixRatesMask);
+A_STATUS wmi_get_ratemask_cmd(struct wmi_t *wmip);
+
+A_STATUS wmi_set_authmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
+
+A_STATUS wmi_set_reassocmode_cmd(struct wmi_t *wmip, A_UINT8 mode);
+
+A_STATUS wmi_set_qos_supp_cmd(struct wmi_t *wmip,A_UINT8 status);
+A_STATUS wmi_set_wmm_cmd(struct wmi_t *wmip, WMI_WMM_STATUS status);
+A_STATUS wmi_set_wmm_txop(struct wmi_t *wmip, WMI_TXOP_CFG txEnable);
+A_STATUS wmi_set_country(struct wmi_t *wmip, A_UCHAR *countryCode);
+
+A_STATUS wmi_get_keepalive_configured(struct wmi_t *wmip);
+A_UINT8 wmi_get_keepalive_cmd(struct wmi_t *wmip);
+A_STATUS wmi_set_keepalive_cmd(struct wmi_t *wmip, A_UINT8 keepaliveInterval);
+
+A_STATUS wmi_set_appie_cmd(struct wmi_t *wmip, A_UINT8 mgmtFrmType,
+                           A_UINT8 ieLen,A_UINT8 *ieInfo);
+
+A_STATUS wmi_send_action_frame_cmd(struct wmi_t *wmip, A_UINT16 ieLen, 
+                                       A_UINT8 *ieInfo);
+
+A_STATUS wmi_set_halparam_cmd(struct wmi_t *wmip, A_UINT8 *cmd, A_UINT16 dataLen);
+
+A_INT32 wmi_get_rate(A_INT8 rateindex);
+
+A_STATUS wmi_set_ip_cmd(struct wmi_t *wmip, WMI_SET_IP_CMD *cmd);
+
+/*Wake on Wireless WMI commands*/
+A_STATUS wmi_set_host_sleep_mode_cmd(struct wmi_t *wmip, WMI_SET_HOST_SLEEP_MODE_CMD *cmd);
+A_STATUS wmi_set_wow_mode_cmd(struct wmi_t *wmip, WMI_SET_WOW_MODE_CMD *cmd);
+A_STATUS wmi_get_wow_list_cmd(struct wmi_t *wmip, WMI_GET_WOW_LIST_CMD *cmd);
+A_STATUS wmi_add_wow_pattern_cmd(struct wmi_t *wmip,
+                                 WMI_ADD_WOW_PATTERN_CMD *cmd, A_UINT8* pattern, A_UINT8* mask, A_UINT8 pattern_size);
+A_STATUS wmi_del_wow_pattern_cmd(struct wmi_t *wmip,
+                                 WMI_DEL_WOW_PATTERN_CMD *cmd);
+A_STATUS wmi_set_wsc_status_cmd(struct wmi_t *wmip, A_UINT32 status);
+
+A_STATUS
+wmi_set_params_cmd(struct wmi_t *wmip, A_UINT32 opcode, A_UINT32 length, A_CHAR* buffer);
+
+A_STATUS
+wmi_set_mcast_filter_cmd(struct wmi_t *wmip, A_UINT8 *filter);
+
+A_STATUS
+wmi_del_mcast_filter_cmd(struct wmi_t *wmip, A_UINT8 *filter);
+
+A_STATUS
+wmi_mcast_filter_cmd(struct wmi_t *wmip, A_UINT8 enable);
+
+bss_t *
+wmi_find_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
+                   A_UINT32 ssidLength, A_BOOL bIsWPA2, A_BOOL bMatchSSID);
+
+#ifdef ATHR_NWIFI
+void
+wmi_refresh_scan_table (struct wmi_t *wmip, ULONGLONG OldestAllowedEntry);
+#endif
+
+void
+wmi_node_return (struct wmi_t *wmip, bss_t *bss);
+
+void
+wmi_node_update_timestamp(struct wmi_t *wmip, bss_t *bss);
+
+void wmi_setup_node(struct wmi_t *wmip, bss_t *bss, const A_UINT8 *bssid);
+
+bss_t *wmi_node_alloc(struct wmi_t *wmip, A_UINT8 len);
+
+void
+wmi_set_nodeage(struct wmi_t *wmip, A_UINT32 nodeAge);
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+A_STATUS wmi_prof_cfg_cmd(struct wmi_t *wmip, A_UINT32 period, A_UINT32 nbins);
+A_STATUS wmi_prof_addr_set_cmd(struct wmi_t *wmip, A_UINT32 addr);
+A_STATUS wmi_prof_start_cmd(struct wmi_t *wmip);
+A_STATUS wmi_prof_stop_cmd(struct wmi_t *wmip);
+A_STATUS wmi_prof_count_get_cmd(struct wmi_t *wmip);
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+#ifdef OS_ROAM_MANAGEMENT
+void wmi_scan_indication (struct wmi_t *wmip);
+#endif
+
+A_STATUS
+wmi_set_target_event_report_cmd(struct wmi_t *wmip, WMI_SET_TARGET_EVENT_REPORT_CMD* cmd);
+
+bss_t   *wmi_rm_current_bss (struct wmi_t *wmip, A_UINT8 *id);
+A_STATUS wmi_add_current_bss (struct wmi_t *wmip, A_UINT8 *id, bss_t *bss);
+
+
+/*
+ * AP mode
+ */
+A_STATUS
+wmi_ap_profile_commit(struct wmi_t *wmip, WMI_CONNECT_CMD *p);
+
+A_STATUS
+wmi_ap_set_hidden_ssid(struct wmi_t *wmip, A_UINT8 hidden_ssid);
+
+A_STATUS
+wmi_ap_set_num_sta(struct wmi_t *wmip, A_UINT8 num_sta);
+
+A_STATUS
+wmi_ap_set_dfs(struct wmi_t *wmip, A_UINT8 enable);
+
+A_STATUS
+wmi_ap_set_acl_policy(struct wmi_t *wmip, A_UINT8 policy);
+
+A_STATUS
+wmi_ap_acl_mac_list(struct wmi_t *wmip, WMI_AP_ACL_MAC_CMD *a);
+
+A_UINT8
+acl_add_del_mac(WMI_AP_ACL *a, WMI_AP_ACL_MAC_CMD *acl);
+
+A_STATUS
+wmi_ap_set_mlme(struct wmi_t *wmip, A_UINT8 cmd, A_UINT8 *mac, A_UINT16 reason);
+
+A_STATUS
+wmi_set_pvb_cmd(struct wmi_t *wmip, A_UINT16 aid, A_BOOL flag);
+
+A_STATUS
+wmi_ap_conn_inact_time(struct wmi_t *wmip, A_UINT32 period);
+
+A_STATUS
+wmi_ap_bgscan_time(struct wmi_t *wmip, A_UINT32 period, A_UINT32 dwell);
+
+A_STATUS
+wmi_ap_set_dtim(struct wmi_t *wmip, A_UINT8 dtim);
+
+A_STATUS
+wmi_ap_set_rateset(struct wmi_t *wmip, A_UINT8 rateset);
+
+A_STATUS
+wmi_set_ht_cap_cmd(struct wmi_t *wmip, WMI_SET_HT_CAP_CMD *cmd);
+
+A_STATUS
+wmi_get_ht_cap_cmd(struct wmi_t *wmip, WMI_SET_HT_CAP_CMD *cmd);
+
+A_STATUS
+wmi_set_ht_op_cmd(struct wmi_t *wmip, A_UINT8 sta_chan_width);
+
+A_STATUS
+wmi_send_hci_cmd(struct wmi_t *wmip, A_UINT8 *buf, A_UINT16 sz);
+
+A_STATUS
+wmi_set_tx_select_rates_cmd(struct wmi_t *wmip, A_UINT32 *pMaskArray);
+
+A_STATUS
+wmi_setup_aggr_cmd(struct wmi_t *wmip, A_UINT8 tid);
+
+A_STATUS
+wmi_delete_aggr_cmd(struct wmi_t *wmip, A_UINT8 tid, A_UINT8 uplink);
+
+A_STATUS
+wmi_allow_aggr_cmd(struct wmi_t *wmip, A_UINT16 tx_tidmask, A_UINT16 rx_tidmask);
+
+A_STATUS
+wmi_set_rx_frame_format_cmd(struct wmi_t *wmip, A_UINT8 rxMetaVersion, A_BOOL rxDot11Hdr, A_BOOL defragOnHost);
+
+A_STATUS
+wmi_set_thin_mode_cmd(struct wmi_t *wmip, A_BOOL bThinMode);
+
+A_STATUS
+wmi_set_wlan_conn_precedence_cmd(struct wmi_t *wmip, BT_WLAN_CONN_PRECEDENCE precedence);
+
+A_STATUS
+wmi_set_pmk_cmd(struct wmi_t *wmip, A_UINT8 *pmk);
+
+A_STATUS
+wmi_set_passphrase_cmd(struct wmi_t *wmip, WMI_SET_PASSPHRASE_CMD *cmd);
+
+A_STATUS
+wmi_set_excess_tx_retry_thres_cmd(struct wmi_t *wmip, WMI_SET_EXCESS_TX_RETRY_THRES_CMD *cmd);
+
+A_STATUS
+wmi_assoc_req_enable_cmd(struct wmi_t *wmip, A_UINT8 enable);
+
+A_STATUS
+wmi_assoc_req_report_cmd (struct wmi_t *wmip, A_UINT8 host_accept, A_UINT8 host_reaspncode, A_UINT8 target_status, A_UINT8 *sta_mac_addr, A_UINT8 rspType);
+
+#ifdef P2P
+A_STATUS
+wmi_p2p_discover(struct wmi_t *wmip, WMI_P2P_FIND_CMD *find_param);
+
+A_STATUS
+wmi_p2p_stop_find(struct wmi_t *wmip);
+
+A_STATUS
+wmi_p2p_cancel(struct wmi_t *wmip);
+
+A_STATUS
+wmi_p2p_listen(struct wmi_t *wmip, A_UINT32 timeout);
+
+A_STATUS
+wmi_p2p_go_neg_start(struct wmi_t *wmip, WMI_P2P_GO_NEG_START_CMD *go_param);
+
+A_STATUS wmi_p2p_sdpd_tx_cmd(struct wmi_t *wmip, WMI_P2P_SDPD_TX_CMD *buf);
+
+A_STATUS wmi_p2p_stop_sdpd(struct wmi_t *wmip);
+
+A_STATUS wmi_p2p_go_neg_rsp_cmd(struct wmi_t *wmip, A_UINT8 status,
+     A_UINT8 go_intent, A_UINT32 wps_method, A_UINT16 listen_freq,
+     A_UINT8 *wpsbuf, A_UINT32 wpslen, A_UINT8 *p2pbuf, A_UINT32 p2plen,
+     A_UINT8 dialog_token, A_UINT8 persistent_grp, A_UINT8 *sa);
+
+A_STATUS
+wmi_p2p_set_config(struct wmi_t *wmip, WMI_P2P_SET_CONFIG_CMD *config);
+
+A_STATUS
+wmi_wps_set_config(struct wmi_t *wmip, WMI_WPS_SET_CONFIG_CMD *wps_config);
+
+A_STATUS wmi_p2p_grp_init_cmd(struct wmi_t *wmip, WMI_P2P_GRP_INIT_CMD *buf);
+
+A_STATUS wmi_p2p_grp_done_cmd(struct wmi_t *wmip,
+                                 WMI_P2P_GRP_FORMATION_DONE_CMD *buf);
+
+A_STATUS wmi_p2p_invite_cmd(struct wmi_t *wmip, WMI_P2P_INVITE_CMD *buf);
+
+A_STATUS wmi_p2p_invite_req_rsp_cmd(struct wmi_t *wmip, A_UINT8 status,
+        A_INT8 is_go, A_UINT8 *grp_bssid, A_UINT8 *p2pbuf,
+            A_UINT8 p2plen, A_UINT8 dialog_token);
+
+A_STATUS wmi_p2p_prov_disc_cmd(struct wmi_t *wmip,
+                        WMI_P2P_PROV_DISC_REQ_CMD *buf);
+
+A_STATUS wmi_p2p_set_cmd(struct wmi_t *wmip, WMI_P2P_SET_CMD *buf);
+
+#endif /* P2P */
+
+A_UINT16
+wmi_ieee2freq (int chan);
+
+A_UINT32
+wmi_freq2ieee (A_UINT16 freq);
+
+bss_t *
+wmi_find_matching_Ssidnode (struct wmi_t *wmip, A_UCHAR *pSsid,
+                   A_UINT32 ssidLength,
+                   A_UINT32 dot11AuthMode, A_UINT32 authMode,
+                   A_UINT32 pairwiseCryptoType, A_UINT32 grpwiseCryptoTyp);
+
+A_STATUS
+wmi_radarDetected_cmd(struct wmi_t *wmip, A_INT16 chan_index, A_INT8 bang_radar);
+
+A_STATUS
+wmi_set_dfs_maxpulsedur_cmd(struct wmi_t *wmip, A_UINT32 value);
+
+A_STATUS
+wmi_set_dfs_minrssithresh_cmd(struct wmi_t *wmip, A_INT32 rssi);
+
+A_STATUS
+wmi_beacon2bssnode (struct wmi_t *wmip, A_UINT8 *datap, int len, A_UINT8 *bssid, A_UINT16 channel);
+
+A_STATUS
+wmi_set_tx_mac_rules_cmd (struct wmi_t *wmip, A_UINT32 rules);
+
+A_STATUS
+wmi_set_promiscuous_mode_cmd (struct wmi_t *wmip, A_BOOL bMode);
+
+//WAC
+A_STATUS wmi_wac_enable_cmd(struct wmi_t *wmip, WMI_WAC_ENABLE_CMD *param);
+
+A_STATUS
+wmi_wac_scan_reply_cmd(struct wmi_t *wmip, WAC_SUBCMD param);
+
+A_STATUS
+wmi_wac_ctrl_req_cmd(struct wmi_t *wmip, WMI_WAC_CTRL_REQ_CMD *param);
+
+#ifdef CONFIG_WLAN_RFKILL
+A_STATUS
+wmi_get_rfkill_mode_cmd(struct wmi_t *wmip);
+
+A_STATUS
+wmi_set_rfkill_mode_cmd(struct wmi_t *wmip,WMI_RFKILL_MODE_CMD *pCmd);
+
+#endif
+
+A_STATUS
+wmi_force_target_assert(struct wmi_t *wmip);
+
+A_STATUS
+wmi_ap_set_apsd(struct wmi_t *wmip, A_UINT8 enable);
+
+A_STATUS
+wmi_set_apsd_buffered_traffic_cmd(struct wmi_t *wmip, A_UINT16 aid, A_UINT16 bitmap, A_UINT32 flags);
+
+A_STATUS
+wmi_sta_bmiss_enhance_cmd(struct wmi_t *wmip, A_UINT8 enable);
+
+A_STATUS
+wmi_ap_set_idle_close_time(struct wmi_t *wmip, A_UINT32 time_val_sec);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_API_H_ */
diff --git a/host/include/wmi_host.h b/host/include/wmi_host.h
new file mode 100644
index 0000000..06d8e4d
--- /dev/null
+++ b/host/include/wmi_host.h
@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_host.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains local definitios for the wmi host module.
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _WMI_HOST_H_
+#define _WMI_HOST_H_
+
+#include "roaming.h"
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct wmi_stats {
+    A_UINT32    cmd_len_err;
+    A_UINT32    cmd_id_err;
+};
+
+#define LE_READ_4(p)                            \
+    ((A_UINT32)                            \
+     ((((A_UINT8 *)(p))[0]      ) | (((A_UINT8 *)(p))[1] <<  8) | \
+      (((A_UINT8 *)(p))[2] << 16) | (((A_UINT8 *)(p))[3] << 24)))
+
+
+#define SSID_IE_LEN_INDEX 13
+
+
+/* Host side link management data structures */
+#define SIGNAL_QUALITY_THRESHOLD_LEVELS 6
+#define SIGNAL_QUALITY_UPPER_THRESHOLD_LEVELS SIGNAL_QUALITY_THRESHOLD_LEVELS
+#define SIGNAL_QUALITY_LOWER_THRESHOLD_LEVELS SIGNAL_QUALITY_THRESHOLD_LEVELS
+typedef struct sq_threshold_params_s {
+    A_INT16 upper_threshold[SIGNAL_QUALITY_UPPER_THRESHOLD_LEVELS];
+    A_INT16 lower_threshold[SIGNAL_QUALITY_LOWER_THRESHOLD_LEVELS];
+    A_UINT32 upper_threshold_valid_count;
+    A_UINT32 lower_threshold_valid_count;
+    A_UINT32 polling_interval;
+    A_UINT8 weight;
+    A_UINT8  last_rssi; //normally you would expect this to be bss specific but we keep only one instance because its only valid when the device is in a connected state. Not sure if it belongs to host or target.
+    A_UINT8  last_rssi_poll_event; //Not sure if it belongs to host or target
+} SQ_THRESHOLD_PARAMS;
+
+/*
+ * Virtual device specific wmi_t data structure
+ */
+
+struct wmi_t {
+    void                           *wmi_devt;
+    struct ieee80211_node_table     wmi_scan_table;
+    A_UINT8                         wmi_bssid[ATH_MAC_LEN];
+    A_UINT8                         wmi_powerMode;
+    A_UINT8                         wmi_phyMode;
+    A_UINT8                         wmi_keepaliveInterval;
+    SQ_THRESHOLD_PARAMS             wmi_SqThresholdParams[SIGNAL_QUALITY_METRICS_NUM_MAX];
+    CRYPTO_TYPE                     wmi_pair_crypto_type;
+    CRYPTO_TYPE                     wmi_grp_crypto_type;
+    WMI_SET_HT_CAP_CMD              wmi_ht_cap[A_NUM_BANDS];
+    A_BOOL                          wmi_is_wmm_enabled;
+    A_UINT8                         wmi_dev_index;
+    struct wmi_stats                wmi_stats;
+    A_UINT8                         wmi_user_phy;
+    A_UINT8                         wmi_user_ht[A_NUM_BANDS];
+    void                            (* host_sleep_mode_event_fn)(void *);
+    void                           *host_sleep_mode_event_fn_arg;
+};
+
+/*
+ * Virtual device independent wmi data structure
+ */
+
+struct wmi_priv_t {
+    A_BOOL                          wmi_ready;
+    A_BOOL                          wmi_numQoSStream;
+    A_UINT8                         wmi_fatPipeExists;
+    A_UINT16                        wmi_streamExistsForAC[WMM_NUM_AC];
+    HTC_ENDPOINT_ID                 wmi_endpoint_id;
+    A_MUTEX_T                       wmi_lock;
+};
+#define LOCK_WMI(w)     A_MUTEX_LOCK(&(w)->wmi_lock);
+#define UNLOCK_WMI(w)   A_MUTEX_UNLOCK(&(w)->wmi_lock);
+
+int
+iswmmoui(const A_UINT8 *frm);
+
+int
+iswmmparam(const A_UINT8 *frm);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_HOST_H_ */
diff --git a/host/include/wmi_parser.h b/host/include/wmi_parser.h
new file mode 100644
index 0000000..da78b28
--- /dev/null
+++ b/host/include/wmi_parser.h
@@ -0,0 +1,39 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_parser.h" company="Atheros">
+//    Copyright (c) 2011 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+// 
+// <summary>
+// 	WMI Command/Event Parser
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifndef _WMI_PARSER_
+#define _WMI_PARSER_
+
+void wmi_cmd_decode(WMI_COMMAND_ID cmdId);
+
+#endif
+
+
+
+
diff --git a/host/include/wmi_thin.h b/host/include/wmi_thin.h
new file mode 100644
index 0000000..2495e08
--- /dev/null
+++ b/host/include/wmi_thin.h
@@ -0,0 +1,371 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmi_thin.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all the
+ * commands and events. Commands are messages from the host to the WM.
+ * Events and Replies are messages from the WM to the host.
+ *
+ * Ownership of correctness in regards to WMI commands
+ * belongs to the host driver and the WM is not required to validate
+ * parameters for value, proper range, or any other checking.
+ *
+ */
+
+#ifndef _WMI_THIN_H_
+#define _WMI_THIN_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+typedef enum {
+    WMI_THIN_CONFIG_CMDID =  0x8000, // WMI_THIN_RESERVED_START 
+    WMI_THIN_SET_MIB_CMDID,
+    WMI_THIN_GET_MIB_CMDID,
+    WMI_THIN_JOIN_CMDID,
+    WMI_THIN_CONNECT_CMDID,
+    WMI_THIN_RESET_CMDID,
+    /* add new CMDID's here */
+    WMI_THIN_RESERVED_END_CMDID = 0x8fff // WMI_THIN_RESERVED_END
+} WMI_THIN_COMMAND_ID;
+
+typedef enum{
+    TEMPLATE_FRM_FIRST = 0,
+    TEMPLATE_FRM_PROBE_REQ =TEMPLATE_FRM_FIRST,
+    TEMPLATE_FRM_BEACON,
+    TEMPLATE_FRM_PROBE_RESP,
+    TEMPLATE_FRM_NULL,
+    TEMPLATE_FRM_QOS_NULL,
+    TEMPLATE_FRM_PSPOLL,
+    TEMPLATE_FRM_MAX
+}WMI_TEMPLATE_FRM_TYPE;
+
+/* TEMPLATE_FRM_LEN... represent the maximum allowable
+ * data lengths (bytes) for each frame type */
+#define TEMPLATE_FRM_LEN_PROBE_REQ  (256) /* Symbian dictates a minimum of 256 for these 3 frame types */
+#define TEMPLATE_FRM_LEN_BEACON     (256)
+#define TEMPLATE_FRM_LEN_PROBE_RESP (256)
+#define TEMPLATE_FRM_LEN_NULL       (32)
+#define TEMPLATE_FRM_LEN_QOS_NULL   (32)
+#define TEMPLATE_FRM_LEN_PSPOLL     (32)
+#define TEMPLATE_FRM_LEN_SUM (TEMPLATE_FRM_LEN_PROBE_REQ + TEMPLATE_FRM_LEN_BEACON + TEMPLATE_FRM_LEN_PROBE_RESP + \
+            TEMPLATE_FRM_LEN_NULL + TEMPLATE_FRM_LEN_QOS_NULL + TEMPLATE_FRM_LEN_PSPOLL)
+
+
+/* MAC Header Build Rules */
+/*  These values allow the host to configure the 
+ *  target code that is responsible for constructing
+ *  the MAC header.  In cases where the MAC header
+ *  is provided by the host framework, the target
+ *  has a diminished responsibility over what fields
+ *  it must write. This will vary from framework to framework.
+ *  Symbian requires different behavior from MAC80211 which
+ *  requires different behavior from MS Native Wifi. */
+#define WMI_WRT_VER_TYPE    0x00000001
+#define WMI_WRT_DURATION    0x00000002
+#define WMI_WRT_DIRECTION   0x00000004
+#define WMI_WRT_POWER       0x00000008
+#define WMI_WRT_WEP         0x00000010
+#define WMI_WRT_MORE        0x00000020
+#define WMI_WRT_BSSID       0x00000040
+#define WMI_WRT_QOS         0x00000080
+#define WMI_WRT_SEQNO       0x00000100
+#define WMI_GUARD_TX        0x00000200 /* prevents TX ops that are not allowed for a current state */
+#define WMI_WRT_DEFAULT_CONFIG  (WMI_WRT_VER_TYPE | WMI_WRT_DURATION | WMI_WRT_DIRECTION | \
+                                 WMI_WRT_POWER | WMI_WRT_MORE | WMI_WRT_WEP | WMI_WRT_BSSID | \
+                                 WMI_WRT_QOS | WMI_WRT_SEQNO | WMI_GUARD_TX)
+
+/* WMI_THIN_CONFIG_TXCOMPLETE -- Used to configure the params and content for 
+ *  TX Complete messages the will come from the Target.  these messages are 
+ *  disabled by default but can be enabled using this structure and the 
+ *  WMI_THIN_CONFIG_CMDID. */
+typedef PREPACK struct {
+    A_UINT8     version; /* the versioned type of messages to use or 0 to disable */
+    A_UINT8     countThreshold; /* msg count threshold triggering a tx complete message */
+    A_UINT16    timeThreshold; /* timeout interval in MSEC triggering a tx complete message */       
+} POSTPACK WMI_THIN_CONFIG_TXCOMPLETE;
+
+/* WMI_THIN_CONFIG_DECRYPT_ERR -- Used to configure behavior for received frames 
+ *  that have decryption errors.  The default behavior is to discard the frame
+ *  without notification. Alternately, the MAC Header is forwarded to the host 
+ *  with the failed status. */
+typedef PREPACK struct {
+    A_UINT8     enable; /* 1 == send decrypt errors to the host, 0 == don't */
+    A_UINT8     reserved[3]; /* align padding */
+} POSTPACK WMI_THIN_CONFIG_DECRYPT_ERR;
+
+/* WMI_THIN_CONFIG_TX_MAC_RULES -- Used to configure behavior for transmitted
+ *  frames that require partial MAC header construction. These rules 
+ *  are used by the target to indicate which fields need to be written. */
+typedef PREPACK struct {
+    A_UINT32    rules; /* combination of WMI_WRT_... values */     
+} POSTPACK WMI_THIN_CONFIG_TX_MAC_RULES;
+
+/* WMI_THIN_CONFIG_RX_FILTER_RULES -- Used to configure behavior for received
+ *  frames as to which frames should get forwarded to the host and which
+ *  should get processed internally. */
+typedef PREPACK struct {
+    A_UINT32    rules; /* combination of WMI_FILT_... values */     
+} POSTPACK WMI_THIN_CONFIG_RX_FILTER_RULES;
+
+
+/* WMI_THIN_CONFIG_CIPHER_ENCAP -- Used to configure behavior for both
+ * TX and RX frames regarding security cipher encapsulation. The host may specify 
+ * whether or not the firmware is responsible for cipher 
+ * encapsulation.  If the firmware is responsible it will add the security header
+ * and trailer for TX frames and remove the header and trailer for Rx frames. Also,
+ * the firmware will examine the resource counter if any and behave appropriately when
+ * a bad value is detected.  If the host indicates responsibility for encapsulation 
+ * then it is responsible for all aspects of encapsulation, however the device will 
+ * still perform the encryption and decryption of the frame payload if a key has 
+ * been provided. */
+typedef PREPACK struct {
+    A_UINT8     enable; /* enables/disables firmware cipher encapsulation */     
+    A_UINT8     reserved[3]; /* align padding */
+} POSTPACK WMI_THIN_CONFIG_CIPHER_ENCAP;
+
+/* WMI_THIN_CONFIG_CMD -- Used to contain some combination of the above
+ *  WMI_THIN_CONFIG_... structures. The actual combination is indicated 
+ *  by the value of cfgField. Each bit in this field corresponds to 
+ *  one of the above structures. */
+typedef PREPACK struct {
+#define WMI_THIN_CFG_TXCOMP         0x00000001
+#define WMI_THIN_CFG_DECRYPT        0x00000002
+#define WMI_THIN_UNUSED1            0x00000004  /* used to be WMI_THIN_CFG_MAC_RULES */
+#define WMI_THIN_CFG_FILTER_RULES   0x00000008
+#define WMI_THIN_CFG_CIPHER_ENCAP   0x00000010
+    A_UINT32    cfgField;   /* combination of WMI_THIN_CFG_... describes contents of config command */
+    A_UINT16    length;     /* length in bytes of appended sub-commands */        
+    A_UINT8     reserved[2];   /* align padding */
+} POSTPACK WMI_THIN_CONFIG_CMD;
+
+/* MIB Access Identifiers tailored for Symbian. */
+enum {
+    MIB_ID_STA_MAC = 1,             // [READONLY]
+    MIB_ID_RX_LIFE_TIME,            // [NOT IMPLEMENTED]
+    MIB_ID_SLOT_TIME,               // [READ/WRITE]
+    MIB_ID_RTS_THRESHOLD,           // [READ/WRITE]
+    MIB_ID_CTS_TO_SELF,             // [READ/WRITE]
+    MIB_ID_TEMPLATE_FRAME,          // [WRITE ONLY]
+    MIB_ID_RXFRAME_FILTER,          // [READ/WRITE]
+    MIB_ID_BEACON_FILTER_TABLE,     // [WRITE ONLY]
+    MIB_ID_BEACON_FILTER,           // [READ/WRITE]
+    MIB_ID_BEACON_LOST_COUNT,       // [WRITE ONLY]
+    MIB_ID_RSSI_THRESHOLD,          // [WRITE ONLY]
+    MIB_ID_HT_CAP,                  // [NOT IMPLEMENTED]
+    MIB_ID_HT_OP,                   // [NOT IMPLEMENTED]
+    MIB_ID_HT_2ND_BEACON,           // [NOT IMPLEMENTED]
+    MIB_ID_HT_BLOCK_ACK,            // [NOT IMPLEMENTED]
+    MIB_ID_PREAMBLE,                // [READ/WRITE]
+    /*MIB_ID_GROUP_ADDR_TABLE,*/
+    /*MIB_ID_WEP_DEFAULT_KEY_ID */  // satisfied by wmi_addKey_cmd()
+    /*MIB_ID_TX_POWER */
+    /*MIB_ID_ARP_IP_TABLE */
+    /*MIB_ID_SLEEP_MODE */
+    /*MIB_ID_WAKE_INTERVAL*/
+    /*MIB_ID_STAT_TABLE*/
+    /*MIB_ID_IBSS_PWR_SAVE*/
+    /*MIB_ID_COUNTERS_TABLE*/
+    /*MIB_ID_ETHERTYPE_FILTER*/
+    /*MIB_ID_BC_UDP_FILTER*/
+       
+};
+
+typedef PREPACK struct {
+    A_UINT8 addr[ATH_MAC_LEN];
+} POSTPACK WMI_THIN_MIB_STA_MAC;
+
+typedef PREPACK struct {
+    A_UINT32 time; // units == msec
+} POSTPACK WMI_THIN_MIB_RX_LIFE_TIME;
+
+typedef PREPACK struct {
+    A_UINT8 enable; //1 = on, 0 = off
+} POSTPACK WMI_THIN_MIB_CTS_TO_SELF;
+
+typedef PREPACK struct {
+    A_UINT32 time; // units == usec
+} POSTPACK WMI_THIN_MIB_SLOT_TIME;
+
+typedef PREPACK struct {
+    A_UINT16 length; //units == bytes
+} POSTPACK WMI_THIN_MIB_RTS_THRESHOLD;
+
+typedef PREPACK struct {
+    A_UINT8 type; // type of frame
+    A_UINT8 rate; // tx rate to be used (one of WMI_BIT_RATE)
+    A_UINT16 length; // num bytes following this structure as the template data
+} POSTPACK WMI_THIN_MIB_TEMPLATE_FRAME;
+
+typedef PREPACK struct {
+#define FRAME_FILTER_PROMISCUOUS 0x00000001
+#define FRAME_FILTER_BSSID       0x00000002
+    A_UINT32 filterMask; 
+} POSTPACK WMI_THIN_MIB_RXFRAME_FILTER;
+
+
+#define IE_FILTER_TREATMENT_CHANGE 1
+#define IE_FILTER_TREATMENT_APPEAR 2
+
+typedef PREPACK struct {
+    A_UINT8 ie;
+    A_UINT8 treatment;
+} POSTPACK WMI_THIN_MIB_BEACON_FILTER_TABLE;
+
+typedef PREPACK struct {
+    A_UINT8 ie;
+    A_UINT8 treatment;
+    A_UINT8 oui[3];
+    A_UINT8 type;
+    A_UINT16 version;
+} POSTPACK WMI_THIN_MIB_BEACON_FILTER_TABLE_OUI;
+
+typedef PREPACK struct {
+    A_UINT16 numElements;
+    A_UINT8 entrySize; // sizeof(WMI_THIN_MIB_BEACON_FILTER_TABLE) on host cpu may be 2 may be 4
+    A_UINT8 reserved;
+} POSTPACK WMI_THIN_MIB_BEACON_FILTER_TABLE_HEADER; 
+
+typedef PREPACK struct {
+    A_UINT32 count; /* num beacons between deliveries */
+    A_UINT8 enable;
+    A_UINT8 reserved[3];
+} POSTPACK WMI_THIN_MIB_BEACON_FILTER;
+
+typedef PREPACK struct {
+    A_UINT32 count; /* num consec lost beacons after which send event */
+} POSTPACK WMI_THIN_MIB_BEACON_LOST_COUNT;
+
+typedef PREPACK struct {
+    A_UINT8 rssi; /* the low threshold which can trigger an event warning */
+    A_UINT8 tolerance; /* the range above and below the threshold to prevent event flooding to the host. */
+    A_UINT8 count; /* the sample count of consecutive frames necessary to trigger an event. */
+    A_UINT8 reserved[1]; /* padding */
+} POSTPACK WMI_THIN_MIB_RSSI_THRESHOLD;
+
+
+typedef PREPACK struct {
+    A_UINT32 cap;
+    A_UINT32 rxRateField;
+    A_UINT32 beamForming;
+    A_UINT8 addr[ATH_MAC_LEN];
+    A_UINT8 enable;        
+    A_UINT8 stbc;
+    A_UINT8 maxAMPDU;    
+    A_UINT8 msduSpacing;
+    A_UINT8 mcsFeedback;   
+    A_UINT8 antennaSelCap;    
+} POSTPACK WMI_THIN_MIB_HT_CAP;
+
+typedef PREPACK struct {
+    A_UINT32 infoField;
+    A_UINT32 basicRateField;
+    A_UINT8 protection;
+    A_UINT8 secondChanneloffset;
+    A_UINT8 channelWidth;
+    A_UINT8 reserved;
+} POSTPACK WMI_THIN_MIB_HT_OP;
+
+typedef PREPACK struct {
+#define SECOND_BEACON_PRIMARY   1
+#define SECOND_BEACON_EITHER    2
+#define SECOND_BEACON_SECONDARY 3
+    A_UINT8 cfg;
+    A_UINT8 reserved[3]; /* padding */
+} POSTPACK WMI_THIN_MIB_HT_2ND_BEACON;
+
+typedef PREPACK struct {
+    A_UINT8 txTIDField;
+    A_UINT8 rxTIDField;
+    A_UINT8 reserved[2]; /* padding */
+} POSTPACK WMI_THIN_MIB_HT_BLOCK_ACK;
+
+typedef PREPACK struct {
+    A_UINT8 enableLong; // 1 == long preamble, 0 == short preamble
+    A_UINT8 reserved[3];
+} POSTPACK WMI_THIN_MIB_PREAMBLE;
+
+typedef PREPACK struct {    
+    A_UINT16    length;     /* the length in bytes of the appended MIB data */
+    A_UINT8     mibID;      /* the ID of the MIB element being set */
+    A_UINT8     reserved; /* align padding */
+} POSTPACK WMI_THIN_SET_MIB_CMD;
+
+typedef PREPACK struct {    
+    A_UINT8     mibID;      /* the ID of the MIB element being set */
+    A_UINT8     reserved[3]; /* align padding */
+} POSTPACK WMI_THIN_GET_MIB_CMD;
+
+typedef PREPACK struct {
+    A_UINT32    basicRateMask; /* bit mask of basic rates */
+    A_UINT32    beaconIntval; /* TUs */
+    A_UINT16    atimWindow; /* TUs */
+    A_UINT16    channel; /* frequency in Mhz */
+    A_UINT8     networkType; /* INFRA_NETWORK | ADHOC_NETWORK */
+    A_UINT8     ssidLength; /* 0 - 32 */
+    A_UINT8     probe;      /* != 0 : issue probe req at start */
+    A_UINT8     reserved;   /* alignment */    
+    A_UCHAR     ssid[WMI_MAX_SSID_LEN];    
+    A_UINT8     bssid[ATH_MAC_LEN];
+} POSTPACK WMI_THIN_JOIN_CMD;
+
+typedef PREPACK struct {
+    A_UINT16 dtim; /* dtim interval in num beacons */
+    A_UINT16 aid; /* 80211 association ID from Assoc resp */   
+} POSTPACK WMI_THIN_CONNECT_CMD;
+
+typedef PREPACK struct {
+    A_UINT8 reserved[4];
+} POSTPACK WMI_THIN_RESET_CMD;
+
+typedef enum {
+    WMI_THIN_EVENTID_RESERVED_START           = 0x8000,
+    WMI_THIN_GET_MIB_EVENTID,
+    WMI_THIN_JOIN_EVENTID,
+    
+    /* Add new THIN EVENTID's here */
+    WMI_THIN_EVENTID_RESERVED_END           = 0x8fff    
+} WMI_THIN_EVENT_ID;
+
+/* Possible values for WMI_THIN_JOIN_EVENT.result */
+typedef enum {
+    WMI_THIN_JOIN_RES_SUCCESS = 0, // device has joined the network
+    WMI_THIN_JOIN_RES_FAIL, // device failed for unspecified reason
+    WMI_THIN_JOIN_RES_TIMEOUT, // device failed due to no beacon rx in time limit
+    WMI_THIN_JOIN_RES_BAD_PARAM, // device failed due to bad cmd param.
+    WMI_THIN_JOIN_RES_IBSS_START, // device started new IBSS network.
+}WMI_THIN_JOIN_RESULT;
+
+typedef PREPACK struct {
+    A_UINT8 result; /* the result of the join cmd. one of WMI_THIN_JOIN_RESULT */
+    A_UINT8 reserved[3]; /* alignment */
+} POSTPACK WMI_THIN_JOIN_EVENT;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMI_THIN_H_ */
diff --git a/host/include/wmix.h b/host/include/wmix.h
new file mode 100644
index 0000000..50ccd55
--- /dev/null
+++ b/host/include/wmix.h
@@ -0,0 +1,280 @@
+//------------------------------------------------------------------------------
+// <copyright file="wmix.h" company="Atheros">
+//    Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	Wifi driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+
+/*
+ * This file contains extensions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI).  It includes definitions of all
+ * extended commands and events.  Extensions include useful commands
+ * that are not directly related to wireless activities.  They may
+ * be hardware-specific, and they might not be supported on all
+ * implementations.
+ *
+ * Extended WMIX commands are encapsulated in a WMI message with
+ * cmd=WMI_EXTENSION_CMD.
+ */
+
+#ifndef _WMIX_H_
+#define _WMIX_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef ATH_TARGET
+#include "athstartpack.h"
+#endif
+
+#include "dbglog.h"
+
+/*
+ * Extended WMI commands are those that are needed during wireless
+ * operation, but which are not really wireless commands.  This allows,
+ * for instance, platform-specific commands.  Extended WMI commands are
+ * embedded in a WMI command message with WMI_COMMAND_ID=WMI_EXTENSION_CMDID.
+ * Extended WMI events are similarly embedded in a WMI event message with
+ * WMI_EVENT_ID=WMI_EXTENSION_EVENTID.
+ */
+typedef PREPACK struct {
+    A_UINT32    commandId;
+} POSTPACK WMIX_CMD_HDR;
+
+typedef enum {
+    WMIX_DSETOPEN_REPLY_CMDID           = 0x2001,
+    WMIX_DSETDATA_REPLY_CMDID,
+    WMIX_GPIO_OUTPUT_SET_CMDID,
+    WMIX_GPIO_INPUT_GET_CMDID,
+    WMIX_GPIO_REGISTER_SET_CMDID,
+    WMIX_GPIO_REGISTER_GET_CMDID,
+    WMIX_GPIO_INTR_ACK_CMDID,
+    WMIX_HB_CHALLENGE_RESP_CMDID,
+    WMIX_DBGLOG_CFG_MODULE_CMDID,
+    WMIX_PROF_CFG_CMDID,                 /* 0x200a */
+    WMIX_PROF_ADDR_SET_CMDID,
+    WMIX_PROF_START_CMDID,
+    WMIX_PROF_STOP_CMDID,
+    WMIX_PROF_COUNT_GET_CMDID,
+} WMIX_COMMAND_ID;
+
+typedef enum {
+    WMIX_DSETOPENREQ_EVENTID            = 0x3001,
+    WMIX_DSETCLOSE_EVENTID,
+    WMIX_DSETDATAREQ_EVENTID,
+    WMIX_GPIO_INTR_EVENTID,
+    WMIX_GPIO_DATA_EVENTID,
+    WMIX_GPIO_ACK_EVENTID,
+    WMIX_HB_CHALLENGE_RESP_EVENTID,
+    WMIX_DBGLOG_EVENTID,
+    WMIX_PROF_COUNT_EVENTID,
+} WMIX_EVENT_ID;
+
+/*
+ * =============DataSet support=================
+ */
+
+/*
+ * WMIX_DSETOPENREQ_EVENTID
+ * DataSet Open Request Event
+ */
+typedef PREPACK struct {
+    A_UINT32 dset_id;
+    A_UINT32 targ_dset_handle;  /* echo'ed, not used by Host, */
+    A_UINT32 targ_reply_fn;     /* echo'ed, not used by Host, */
+    A_UINT32 targ_reply_arg;    /* echo'ed, not used by Host, */
+} POSTPACK WMIX_DSETOPENREQ_EVENT;
+
+/*
+ * WMIX_DSETCLOSE_EVENTID
+ * DataSet Close Event
+ */
+typedef PREPACK struct {
+    A_UINT32 access_cookie;
+} POSTPACK WMIX_DSETCLOSE_EVENT;
+
+/*
+ * WMIX_DSETDATAREQ_EVENTID
+ * DataSet Data Request Event
+ */
+typedef PREPACK struct {
+    A_UINT32 access_cookie;
+    A_UINT32 offset;
+    A_UINT32 length;
+    A_UINT32 targ_buf;         /* echo'ed, not used by Host, */
+    A_UINT32 targ_reply_fn;    /* echo'ed, not used by Host, */
+    A_UINT32 targ_reply_arg;   /* echo'ed, not used by Host, */
+} POSTPACK WMIX_DSETDATAREQ_EVENT;
+
+typedef PREPACK struct {
+    A_UINT32              status;
+    A_UINT32              targ_dset_handle;
+    A_UINT32              targ_reply_fn;
+    A_UINT32              targ_reply_arg;
+    A_UINT32              access_cookie;
+    A_UINT32              size;
+    A_UINT32              version;
+} POSTPACK WMIX_DSETOPEN_REPLY_CMD;
+
+typedef PREPACK struct {
+    A_UINT32              status;
+    A_UINT32              targ_buf;
+    A_UINT32              targ_reply_fn;
+    A_UINT32              targ_reply_arg;
+    A_UINT32              length;
+    A_UINT8               buf[1];
+} POSTPACK WMIX_DSETDATA_REPLY_CMD;
+
+
+/* 
+ * =============GPIO support=================
+ * NB: Some of the WMIX APIs use a 32-bit mask.  On Targets that support
+ * more than 32 GPIO pins, those APIs only support the first 32 GPIO pins.
+ */
+
+#include "gpio.h"
+
+/*
+ * Set GPIO pin output state.
+ * In order for output to be driven, a pin must be enabled for output.
+ * This can be done during initialization through the GPIO Configuration
+ * DataSet, or during operation with the enable_mask.
+ *
+ * If a request is made to simultaneously set/clear or set/disable or
+ * clear/disable or disable/enable, results are undefined.
+ */
+typedef PREPACK struct {
+    A_UINT32              set_mask;             /* pins to set */
+    A_UINT32              clear_mask;           /* pins to clear */
+    A_UINT32              enable_mask;          /* pins to enable for output */
+    A_UINT32              disable_mask;         /* pins to disable/tristate */
+} POSTPACK WMIX_GPIO_OUTPUT_SET_CMD;
+
+/* 
+ * Set a GPIO register.  For debug/exceptional cases.
+ * Values for gpioreg_id are GPIO_ID_*, defined in a
+ * platform-dependent header, gpio.h.
+ */
+typedef PREPACK struct {
+    A_UINT32              gpioreg_id;           /* GPIO register ID */
+    A_UINT32              value;                /* value to write */
+} POSTPACK WMIX_GPIO_REGISTER_SET_CMD;
+
+/* Get a GPIO register.  For debug/exceptional cases. */
+typedef PREPACK struct {
+    A_UINT32              gpioreg_id;           /* GPIO register to read */
+} POSTPACK WMIX_GPIO_REGISTER_GET_CMD;
+
+/*
+ * Host acknowledges and re-arms GPIO interrupts.  A single
+ * message should be used to acknowledge all interrupts that
+ * were delivered in an earlier WMIX_GPIO_INTR_EVENT message.
+ */
+typedef PREPACK struct {
+    A_UINT32              ack_mask;             /* interrupts to acknowledge */
+} POSTPACK WMIX_GPIO_INTR_ACK_CMD;
+
+/*
+ * Target informs Host of GPIO interrupts that have ocurred since the
+ * last WMIX_GIPO_INTR_ACK_CMD was received.  Additional information --
+ * the current GPIO input values is provided -- in order to support
+ * use of a GPIO interrupt as a Data Valid signal for other GPIO pins.
+ */
+typedef PREPACK struct {
+    A_UINT32              intr_mask;            /* pending GPIO interrupts */
+    A_UINT32              input_values;         /* recent GPIO input values */
+} POSTPACK WMIX_GPIO_INTR_EVENT;
+
+/*
+ * Target responds to Host's earlier WMIX_GPIO_INPUT_GET_CMDID request
+ * using a GPIO_DATA_EVENT with
+ *   value set to the mask of GPIO pin inputs and
+ *   reg_id set to GPIO_ID_NONE
+ * 
+ *
+ * Target responds to Hosts's earlier WMIX_GPIO_REGISTER_GET_CMDID request
+ * using a GPIO_DATA_EVENT with
+ *   value set to the value of the requested register and
+ *   reg_id identifying the register (reflects the original request)
+ * NB: reg_id supports the future possibility of unsolicited
+ * WMIX_GPIO_DATA_EVENTs (for polling GPIO input), and it may
+ * simplify Host GPIO support.
+ */
+typedef PREPACK struct {
+    A_UINT32              value;
+    A_UINT32              reg_id;
+} POSTPACK WMIX_GPIO_DATA_EVENT;
+
+/*
+ * =============Error Detection support=================
+ */
+
+/*
+ * WMIX_HB_CHALLENGE_RESP_CMDID
+ * Heartbeat Challenge Response command
+ */
+typedef PREPACK struct {
+    A_UINT32              cookie;
+    A_UINT32              source;
+} POSTPACK WMIX_HB_CHALLENGE_RESP_CMD;
+
+/*
+ * WMIX_HB_CHALLENGE_RESP_EVENTID
+ * Heartbeat Challenge Response Event
+ */
+#define WMIX_HB_CHALLENGE_RESP_EVENT WMIX_HB_CHALLENGE_RESP_CMD
+
+typedef PREPACK struct {
+    struct dbglog_config_s config;
+} POSTPACK WMIX_DBGLOG_CFG_MODULE_CMD;
+
+/*
+ * =============Target Profiling support=================
+ */
+
+typedef PREPACK struct {
+    A_UINT32 period; /* Time (in 30.5us ticks) between samples */
+    A_UINT32 nbins;
+} POSTPACK WMIX_PROF_CFG_CMD;
+
+typedef PREPACK struct {
+    A_UINT32 addr;
+} POSTPACK WMIX_PROF_ADDR_SET_CMD;
+
+/*
+ * Target responds to Hosts's earlier WMIX_PROF_COUNT_GET_CMDID request
+ * using a WMIX_PROF_COUNT_EVENT with
+ *   addr set to the next address
+ *   count set to the corresponding count
+ */
+typedef PREPACK struct {
+    A_UINT32              addr;
+    A_UINT32              count;
+} POSTPACK WMIX_PROF_COUNT_EVENT;
+
+#ifndef ATH_TARGET
+#include "athendpack.h"
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WMIX_H_ */
diff --git a/host/os/linux/Makefile b/host/os/linux/Makefile
new file mode 100644
index 0000000..66728d4
--- /dev/null
+++ b/host/os/linux/Makefile
@@ -0,0 +1,312 @@
+#------------------------------------------------------------------------------
+# <copyright file="makefile" company="Atheros">
+#    Copyright (c) 2005-2010 Atheros Corporation.  All rights reserved.
+# 
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+#
+#------------------------------------------------------------------------------
+#==============================================================================
+# Author(s): ="Atheros"
+#==============================================================================
+#######################################################################################
+#  AR6K Kernel Module makefile.
+#
+#    This makefile is invoked by the master makefile in the linux kernel, the linux kernel
+#    source must be initially compiled.  The top level make will invoke the main linux kernel
+#    makefile which will subsequently pick up this makefile.
+#
+#######################################################################################
+
+
+REV ?= 2
+
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/include
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/../include
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/wlan/include
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/os/linux/include
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/os/
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/bmi/include
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/../include/AR6002
+
+EXTRA_CFLAGS += -DLINUX -D__KERNEL__ \
+                -DTCMD -DSEND_EVENT_TO_APP -DUSER_KEYS \
+                -DNO_SYNC_FLUSH  -DHTC_EP_STAT_PROFILING -DWLAN_HEADERS\
+                -DATH_AR6K_11N_SUPPORT \
+                -DSUPPORT_11N \
+		-DWAPI_ENABLE \
+                -DHS20_ENABLE   #\
+                -DMULTIPLE_FRAMES_PER_INTERRUPT -DAR6000REV$(REV) \
+                -DBLOCK_TX_PATH_FLAG -DCHECKSUM_OFFLOAD \
+
+ifeq ($(ATH_BUILD_BTFILTER),yes)
+   EXTRA_CFLAGS += -DBTCOEX
+   EXTRA_CFLAGS += -DCONFIG_BT
+endif
+
+ifeq ($(ATH_BMISS_ENHANCEMENT),yes)
+   EXTRA_CFLAGS += -DBMISS_ENHANCEMENT
+endif
+
+ 
+ifeq ($(ATH_CFG80211_ENV),yes)
+   EXTRA_CFLAGS += -DATH6K_CONFIG_CFG80211
+ #  EXTRA_CFLAGS += -DCFG80211_WAPI_ENABLE
+endif
+
+ifeq ($(ATH_INIT_MODE_DRV_ENABLED), yes)
+ifeq ($(ATH_AR600x_WB31_XXX),yes)
+EXTRA_CFLAGS += -DAR600x_WB31_XXX
+else
+ifeq ($(ATH_AR600x_SD32_XXX),yes)
+EXTRA_CFLAGS += -DAR600x_SD32_XXX
+else
+EXTRA_CFLAGS += -DAR600x_SD31_XXX
+endif
+endif
+EXTRA_CFLAGS += -DINIT_MODE_DRV_ENABLED -DBMIENABLE_SET
+endif
+
+ifeq ($(ATH_ANDROID_ENV),yes)
+    EXTRA_CFLAGS += -DANDROID_ENV -D__linux__ $(ATH_ANDROID_BUILD_FLAGS)
+    EXTRA_CFLAGS += -DINIT_MODE_DRV_ENABLED -DBMIENABLE_SET -DAR600x_SD31_XXX \
+                    -DATH6KL_CONFIG_HIF_VIRTUAL_SCATTER \
+                    -DCONFIG_AP_VIRTUAL_ADAPTER_SUPPORT
+ifeq ($(ATH_AR6K_HCI_BRIDGE),yes)
+    EXTRA_CFLAGS += -DSETUPHCI_ENABLED -DSETUPBTDEV_ENABLED \
+                    -DATH6KL_CONFIG_GPIO_BT_RESET -DAR600x_BT_AR3001
+endif
+endif
+
+ifeq ($(ATH_AR6K_HCI_PAL),yes)
+    EXTRA_CFLAGS += -DSETUPHCIPAL_ENABLED
+ifeq ($(ATH_AR6K_DEBUG_HCI_PAL),yes)
+    EXTRA_CFLAGS += -DHCIPAL_DEBUG
+endif
+endif
+
+ifeq ($(ATH_SOFTMAC_FILE_USED),yes)
+    EXTRA_CFLAGS += -DSOFTMAC_FILE_USED
+endif
+
+ifeq ($(ATH_AR6K_OTA_TEST_MODE),yes)
+    EXTRA_CFLAGS += -DATH6K_CONFIG_OTA_MODE
+endif
+
+ifeq ($(ATH_AR6K_HCI_BRIDGE),yes)
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/miscdrv/ar3kps
+EXTRA_CFLAGS += -I$(ATH_SRC_BASE)/../include/AR6002/hw4.0
+
+EXTRA_CFLAGS += -DATH_AR6K_ENABLE_GMBOX \
+                -DHCI_TRANSPORT_SDIO
+
+ifeq ($(ATH_AR6K_BUILTIN_HCI_TRANSPORT),no)
+EXTRA_CFLAGS += -DEXPORT_HCI_BRIDGE_INTERFACE
+endif
+endif
+
+
+ifeq ($(ATH_HTC_RAW_INT_ENV),yes)
+  EXTRA_CFLAGS += -DHTC_RAW_INTERFACE
+endif
+
+ifeq ($(ATH_DEBUG_DRIVER),yes)
+   EXTRA_CFLAGS += -DDEBUG -DATH_DEBUG_MODULE
+endif
+
+ifeq ($(ATH_USE_PREALLOC_BUFFER),yes)
+   EXTRA_CFLAGS += -DUSE_PREALLOC_BUFFER
+endif
+
+ifeq ($(ATH_BUILD_P2P),yes)
+   EXTRA_CFLAGS += -DP2P
+endif
+
+ifeq ($(AR6002_REV),4)
+   EXTRA_CFLAGS += -DAR6002_REV4
+endif
+
+ifneq ("$(wildcard $(ATH_SRC_BASE)/../include/AR6002/hw2.0)","")
+   EXTRA_CFLAGS += -DAR6002_HEADERS_DEF
+endif
+
+ifneq ("$(wildcard $(ATH_SRC_BASE)/../include/AR6002/hw4.0)","")
+   EXTRA_CFLAGS += -DAR6003_HEADERS_DEF
+endif
+
+ifneq ("$(wildcard $(ATH_SRC_BASE)/../include/AR6002/hw6.0)","")
+   EXTRA_CFLAGS += -DMCKINLEY_HEADERS_DEF
+endif
+
+ifneq ($(ATH_OS_SUB_TYPE),linux_2_4)
+# linux 2.6 and higher kernel module build settings
+EXTRA_CFLAGS += -DKERNEL_2_6
+obj-m += ar6000.o
+ifeq ($(ATH_AR6K_BUILTIN_HCI_TRANSPORT),no)
+obj-m += bt_hci_sdio.o
+endif
+-include $(ATH_SRC_BASE)/hif/$(ATH_HIF_TYPE)/Makefile
+
+ifneq ($(ATH_HIF_MESSAGE_BASED),yes)
+ar6000-objs += ../../htc2/AR6000/ar6k.o        \
+			   ../../htc2/AR6000/ar6k_events.o \
+               ../../htc2/htc_send.o       \
+               ../../htc2/htc_recv.o       \
+               ../../htc2/htc_services.o   \
+               ../../htc2/htc.o     	   
+endif
+
+ifeq ($(ATH_HIF_MESSAGE_BASED),yes)
+ar6000-objs += ../../htc_thin/htc_send.o       \
+               ../../htc_thin/htc_recv.o       \
+               ../../htc_thin/htc_services.o   \
+               ../../htc_thin/htc.o     	   
+endif               
+                        
+               
+ar6000-objs += ../../bmi/src/bmi.o              \
+               ar6000_drv.o           			\
+               ar6000_pm.o           			\
+               ar6000_raw_if.o					\
+               netbuf.o							\
+               wireless_ext.o					\
+               ioctl.o							\
+               ../../miscdrv/common_drv.o		\
+               ../../miscdrv/credit_dist.o		\
+               ../../wmi/wmi.o                       \
+               ../../reorder/rcv_aggr.o              \
+               ../../wlan/src/wlan_node.o            \
+               ../../wlan/src/wlan_recv_beacon.o     \
+               ../../wlan/src/wlan_utils.o \
+               ../../regtable/regtable.o  \
+               ../../regtable/AR6003def.o
+
+ifeq ($(ATH_BUILD_P2P),yes)
+ar6000-objs += ../../p2p/p2p_main.o
+endif
+
+ifeq ($(ATH_HIF_TYPE),sdio)
+ar6000-objs += ../../hif/common/hif_bmi_reg_access.o  \
+			   ../../hif/common/hif_diag_reg_access.o
+
+endif
+
+ifeq ($(ATH_CFG80211_ENV),yes)
+ar6000-objs += cfg80211.o
+endif
+
+ifneq ($(ATH_AR6K_BUILTIN_HCI_TRANSPORT),no)
+ar6000-objs += hci_bridge.o
+endif
+
+ifneq ($(ATH_AR6K_BUILTIN_HCI_PAL),no)
+ar6000-objs += ar6k_pal.o
+else
+obj-m += ar6k_pal.o
+endif
+
+ifeq ($(ATH_AR6K_HCI_BRIDGE),yes)
+ar6000-objs += ../../htc2/AR6000/ar6k_gmbox.o          \
+			   ../../htc2/AR6000/ar6k_gmbox_hciuart.o
+ifneq ($(ATH_AR6K_BUILTIN_HCI_TRANSPORT),no)
+ar6000-objs += ../../miscdrv/ar3kconfig.o				\
+               ../../miscdrv/ar3kps/ar3kpsconfig.o		\
+               ../../miscdrv/ar3kps/ar3kpsparser.o
+else
+ar6000-objs += export_hci_transport.o
+endif
+
+ifeq ($(ATH_AR6K_BUILTIN_HCI_TRANSPORT),no)
+bt_hci_sdio-objs += hci_bridge.o        \
+                ../../miscdrv/ar3kconfig.o				\
+                ../../miscdrv/ar3kps/ar3kpsconfig.o		\
+                ../../miscdrv/ar3kps/ar3kpsparser.o
+endif
+endif
+
+ifeq ($(ATH_ANDROID_ENV),yes)
+   ar6000-objs += ar6000_android.o
+endif
+
+ifeq ($(ATH_AR6K_DEBUG_ALLOC),yes)
+    EXTRA_CFLAGS += -DAR6K_ALLOC_DEBUG
+    ar6000-objs += ar6k_mem_debug.o
+endif
+
+endif
+
+ifeq ($(ATH_OS_SUB_TYPE),linux_2_4)
+# linux 2.4 kernel module build settings
+EXTRA_CFLAGS += -DKERNEL_2_4
+
+O_TARGET := ar6000.o
+# need export line for module export
+export-objs := ar6000_drv.o
+-include $(ATH_SRC_BASE)/hif/$(ATH_HIF_TYPE)/Makefile
+obj-y += $(ATH_SRC_BASE)/htc2/htc.o \
+         $(ATH_SRC_BASE)/htc2/htc_send.o \
+         $(ATH_SRC_BASE)/htc2/htc_recv.o  \
+         $(ATH_SRC_BASE)/htc2/htc_services.o \
+         $(ATH_SRC_BASE)/htc2/AR6000/ar6k.o  \
+         $(ATH_SRC_BASE)/htc2/AR6000/ar6k_events.o  \
+         $(ATH_SRC_BASE)/bmi/src/bmi.o \
+         $(ATH_SRC_BASE)/wmi/wmi.o \
+         $(ATH_SRC_BASE)/reorder/rcv_aggr.o \
+         $(ATH_SRC_BASE)/wlan/src/wlan_node.o \
+         $(ATH_SRC_BASE)/wlan/src/wlan_recv_beacon.o \
+         $(ATH_SRC_BASE)/wlan/src/wlan_utils.o \
+         $(ATH_SRC_BASE)/os/linux/ar6000_drv.o \
+         $(ATH_SRC_BASE)/os/linux/ar6000_raw_if.o \
+         $(ATH_SRC_BASE)/os/linux/wireless_ext.o \
+         $(ATH_SRC_BASE)/os/linux/ioctl.o 		\
+         $(ATH_SRC_BASE)/os/linux/netbuf.o     \
+         $(ATH_SRC_BASE)/miscdrv/common_drv.o   \
+         $(ATH_SRC_BASE)/miscdrv/credit_dist.o
+
+ifeq ($(ATH_HIF_TYPE),SPI2)
+obj-y += $(ATH_SRC_BASE)/hif/common/hif_bmi_reg_access.o \
+         $(ATH_SRC_BASE)/hif/common/hif_diag_reg_access.o
+         
+endif
+
+obj-m += htc.o \
+         htc_send.o \
+         htc_recv.o \
+         htc_services.o  \
+         ar6k_events.o \
+         ar6k.o \
+         hif.o  \
+         bmi.o  \
+         wmi.o  \
+         wlan_node.o \
+         wlan_recv_beacon.o \
+         wlan_utils.o \
+         ar6000_drv.o \
+         ar6000_raw_if.o \
+         common_drv.o \
+         credit_dist.o \
+         netbuf.o     \
+         wireless_ext.o \
+         rcv_aggr.o        \
+         ioctl.o        \
+         ar6000.o
+
+ifeq ($(ATH_HIF_TYPE),SPI2)
+obj-m += hif_bmi_reg_access.o \
+		 hif_diag_reg_access.o
+
+endif
+             
+include $(ATH_LINUXPATH)/Rules.make
+endif
diff --git a/host/os/linux/ar6000_android.c b/host/os/linux/ar6000_android.c
new file mode 100644
index 0000000..1b526e3
--- /dev/null
+++ b/host/os/linux/ar6000_android.c
@@ -0,0 +1,1213 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+#include "ar6000_drv.h"
+#include "htc.h"
+#include <linux/vmalloc.h>
+#include <linux/fs.h>
+
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+#ifdef CONFIG_HAS_EARLYSUSPEND
+#include <linux/earlysuspend.h>
+#endif
+
+#ifdef CONFIG_MMC_MSM
+A_BOOL enable_mmc_host_detect_change = 1;
+#else
+A_BOOL enable_mmc_host_detect_change = 0;
+#endif
+static void ar6000_enable_mmchost_detect_change(int enable);
+
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM7X27) && defined(CONFIG_MSM_SOC_REV_A)
+
+#include <linux/device.h>
+#include <mach/vreg.h>
+#include <linux/gpio.h>
+#include <mach/rpc_pmapp.h>
+#include <linux/err.h>
+
+
+#define WLAN_GPIO_EXT_POR_N     134
+#define A0_CLOCK
+
+static const char *id = "WLAN";
+
+enum {
+        WLAN_VREG_L17 = 0,
+        WLAN_VREG_L19
+};
+
+struct wlan_vreg_info {
+        const char *vreg_id;
+        unsigned int vreg_level;
+        unsigned int pmapp_id;
+        unsigned int is_vreg_pin_controlled;
+        struct vreg *vreg;
+};
+
+
+static struct wlan_vreg_info vreg_info[] = {
+        {"bt", 3300, 21, 1, NULL},
+        {"wlan4", 1800, 23, 1, NULL},
+};
+
+
+void msm7x27a_wifi_power(bool on);
+#endif /* CONFIG_MMC_MSM */
+
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+#ifndef KERNEL_VERSION_ANDROID
+char fwpath[256] = "/lib/firmware/atheros/target/AR6003_844";
+#else
+char fwpath[256] = "/system/wifi";
+#endif /*KERNEL_VERSION_ANDROID*/
+
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) */
+int wowledon;
+unsigned int enablelogcat;
+
+extern int bmienable;
+extern struct net_device *ar6000_devices[];
+extern char ifname[IFNAMSIZ];
+
+#ifdef CONFIG_HAS_WAKELOCK
+extern struct wake_lock ar6k_wow_wake_lock;
+struct wake_lock ar6k_init_wake_lock;
+#endif
+extern int num_device;
+
+const char def_ifname[] = "wlan0";
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param_string(fwpath, fwpath, sizeof(fwpath), 0644);
+module_param(enablelogcat, uint, 0644);
+module_param(wowledon, int, 0644);
+#else
+#define __user
+/* for linux 2.4 and lower */
+MODULE_PARAM(wowledon,"i");
+#endif 
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+static int screen_is_off;
+static struct early_suspend ar6k_early_suspend;
+#endif
+
+static A_STATUS (*ar6000_avail_ev_p)(void *, void *);
+
+#if defined(ANDROID_ENV) && defined(CONFIG_ANDROID_LOGGER) && (!defined(CONFIG_MMC_MSM) || LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,32))
+int logger_write(const enum logidx index,
+                const unsigned char prio,
+                const char __kernel * const tag,
+                const char __kernel * const fmt,
+                ...)
+{
+    int ret = 0;
+    va_list vargs;
+    struct file *filp = (struct file *)-ENOENT;
+    mm_segment_t oldfs;
+    struct iovec vec[3];
+    int tag_bytes = strlen(tag) + 1, msg_bytes;
+    char *msg;      
+    va_start(vargs, fmt);
+    msg = kvasprintf(GFP_ATOMIC, fmt, vargs);
+    va_end(vargs);
+    if (!msg)
+        return -ENOMEM;
+    if (in_interrupt()) {
+        /* we have no choice since aio_write may be blocked */
+        printk(KERN_ALERT "%s", msg);
+        goto out_free_message;
+    }
+    msg_bytes = strlen(msg) + 1;
+    if (msg_bytes <= 1) /* empty message? */
+        goto out_free_message; /* don't bother, then */
+    if ((msg_bytes + tag_bytes + 1) > 2048) {
+        ret = -E2BIG;
+        goto out_free_message;
+    }
+            
+    vec[0].iov_base  = (unsigned char *) &prio;
+    vec[0].iov_len    = 1;
+    vec[1].iov_base   = (void *) tag;
+    vec[1].iov_len    = strlen(tag) + 1;
+    vec[2].iov_base   = (void *) msg;
+    vec[2].iov_len    = strlen(msg) + 1; 
+
+    oldfs = get_fs();
+    set_fs(KERNEL_DS);
+    do {
+        filp = filp_open("/dev/log/main", O_WRONLY, S_IRUSR);
+        if (IS_ERR(filp) || !filp->f_op) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: filp_open /dev/log/main error\n", __FUNCTION__));
+            ret = -ENOENT;
+            break;
+        }
+
+        if (filp->f_op->aio_write) {
+            int nr_segs = sizeof(vec) / sizeof(vec[0]);
+            int len = vec[0].iov_len + vec[1].iov_len + vec[2].iov_len;
+            struct kiocb kiocb;
+            init_sync_kiocb(&kiocb, filp);
+            kiocb.ki_pos = 0;
+            kiocb.ki_left = len;
+            kiocb.ki_nbytes = len;
+            ret = filp->f_op->aio_write(&kiocb, vec, nr_segs, kiocb.ki_pos);
+        }
+        
+    } while (0);
+
+    if (!IS_ERR(filp)) {
+        filp_close(filp, NULL);
+    }
+    set_fs(oldfs);
+out_free_message:
+    if (msg) {
+        kfree(msg);
+    }
+    return ret;
+}
+#endif
+
+int android_logger_lv(void *module, int mask)
+{
+    switch (mask) {
+    case ATH_DEBUG_ERR:
+        return 6;
+    case ATH_DEBUG_INFO:
+        return 4;
+    case ATH_DEBUG_WARN:
+        return 5; 
+    case ATH_DEBUG_TRC:        
+        return 3; 
+    default:
+#ifdef DEBUG
+        if (!module) {
+            return 3;
+        } else if (module == &GET_ATH_MODULE_DEBUG_VAR_NAME(driver)) {
+            return (mask <=ATH_DEBUG_MAKE_MODULE_MASK(3)) ? 3 : 2;
+        } else if (module == &GET_ATH_MODULE_DEBUG_VAR_NAME(htc)) {
+            return 2;
+        } else {
+            return 3;
+        }
+#else
+        return 3; /* DEBUG */
+#endif
+    }
+}
+
+int android_readwrite_file(const A_CHAR *filename, A_CHAR *rbuf, const A_CHAR *wbuf, size_t length)
+{
+    int ret = 0;
+    struct file *filp = (struct file *)-ENOENT;
+    mm_segment_t oldfs;
+    oldfs = get_fs();
+    set_fs(KERNEL_DS);
+    do {
+        int mode = (wbuf) ? O_RDWR : O_RDONLY;
+        filp = filp_open(filename, mode, S_IRUSR);
+        if (IS_ERR(filp) || !filp->f_op) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: file %s filp_open error\n", __FUNCTION__, filename));
+            ret = -ENOENT;
+            break;
+        }
+    
+        if (length==0) {
+            /* Read the length of the file only */
+            struct inode    *inode;
+
+            inode = GET_INODE_FROM_FILEP(filp);
+            if (!inode) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Get inode from %s failed\n", __FUNCTION__, filename));
+                ret = -ENOENT;
+                break;
+            }
+            ret = i_size_read(inode->i_mapping->host);
+            break;
+        }
+
+        if (wbuf) {
+            if ( (ret=filp->f_op->write(filp, wbuf, length, &filp->f_pos)) < 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Write %u bytes to file %s error %d\n", __FUNCTION__, 
+                                length, filename, ret));
+                break;
+            }
+        } else {
+            if ( (ret=filp->f_op->read(filp, rbuf, length, &filp->f_pos)) < 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Read %u bytes from file %s error %d\n", __FUNCTION__,
+                                length, filename, ret));
+                break;
+            }
+        }
+    } while (0);
+
+    if (!IS_ERR(filp)) {
+        filp_close(filp, NULL);
+    }
+    set_fs(oldfs);
+
+    return ret;
+}
+
+int android_request_firmware(const struct firmware **firmware_p, const char *name,
+                     struct device *device)
+{
+    int ret = 0;
+    struct firmware *firmware;
+    char filename[256];
+    const char *raw_filename = name;
+	*firmware_p = firmware = A_MALLOC(sizeof(*firmware));
+    if (!firmware) 
+		return -ENOMEM;
+    A_MEMZERO(firmware, sizeof(*firmware));
+    do {
+        size_t length, bufsize, bmisize;
+
+        if (snprintf(filename, sizeof(filename), "%s/%s", fwpath, 
+                                      raw_filename) >= sizeof(filename)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("snprintf: %s/%s\n", fwpath, raw_filename));
+            ret = -1;
+            break;
+        }
+        if ( (ret=android_readwrite_file(filename, NULL, NULL, 0)) < 0) {
+            break;
+        } else {
+            length = ret;
+        }
+
+        if (strcmp(raw_filename, "softmac") == 0) {
+            bufsize = length = 17;
+        } else {
+            bufsize = ALIGN(length, PAGE_SIZE);
+            bmisize = A_ROUND_UP(length, 4);
+            bufsize = max(bmisize, bufsize);
+        }
+        firmware->data = vmalloc(bufsize);
+        firmware->size = length;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("AR6K: %s(): raw_filename=%s, bufsize=%d\n", __FUNCTION__, raw_filename, bufsize));
+
+        if (!firmware->data) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: Cannot allocate buffer for firmware\n", __FUNCTION__));
+            ret = -ENOMEM;
+            break;
+        }
+    
+        if ( (ret=android_readwrite_file(filename, (char*)firmware->data, NULL, length)) != length) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: file read error, ret %d request %d\n", __FUNCTION__, ret, length));
+            ret = -1;
+            break;
+        }
+    
+    } while (0);
+
+    if (ret<0) {
+        if (firmware) {
+            if (firmware->data)
+                vfree(firmware->data);
+            A_FREE(firmware);
+        }
+        *firmware_p = NULL;
+    } else {
+        ret = 0;
+    }
+    return ret;    
+}
+
+void android_release_firmware(const struct firmware *firmware)
+{
+	if (firmware) {
+        if (firmware->data)
+            vfree(firmware->data);
+        kfree(firmware);
+    }
+}
+
+static A_STATUS ar6000_android_avail_ev(void *context, void *hif_handle)
+{
+    A_STATUS ret;    
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock(&ar6k_init_wake_lock);
+#endif
+    ar6000_enable_mmchost_detect_change(0);
+    ret = ar6000_avail_ev_p(context, hif_handle);
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_unlock(&ar6k_init_wake_lock);
+#endif
+    return ret;
+}
+
+static int android_do_ioctl_direct(struct net_device *dev, int cmd, struct ifreq *ifr, void *data)
+{
+    int ret = -EIO;
+    int  (*do_ioctl)(struct net_device *, struct ifreq *, int);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)    
+    do_ioctl =  dev->do_ioctl;
+#else   
+    do_ioctl = dev->netdev_ops->ndo_do_ioctl;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29) */
+
+    ifr->ifr_ifru.ifru_data = (__force void __user *)data;
+    
+    if (do_ioctl) {
+        mm_segment_t oldfs = get_fs();
+        set_fs(KERNEL_DS);
+        ret = do_ioctl(dev, ifr, cmd);
+        set_fs(oldfs);
+    }
+    return ret;
+}
+
+static int ar6000_cscan(struct net_device *dev, struct iw_point *data, char *cmdbuf)
+{
+	char *ptr = cmdbuf;
+	int iocmd = SIOCSIWSCAN - SIOCSIWCOMMIT;
+	const iw_handler setScan = dev->wireless_handlers->standard[iocmd];
+	A_INT32 home_dwell=0, pas_dwell=0, act_dwell=0;
+	A_UCHAR ssid[IW_ESSID_MAX_SIZE+1] = { 0 };       
+	A_INT32 ssid_len = 0, ie_len;
+	A_UINT8 index = 1; /* reserve index 0 for wext */
+	A_INT32 ch = 0,len=data->length ;
+	A_CHAR nprobe, scantype;
+	struct iw_freq chList[IW_MAX_FREQUENCIES];
+	A_UCHAR *scanBuf = (A_UCHAR*)(ptr+ 12);
+	A_UCHAR *scanEnd = (A_UCHAR*)(ptr + len);
+	A_BOOL broadcastSsid = FALSE;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+
+	while ( scanBuf < scanEnd ) 
+	{
+		A_UCHAR *sp = scanBuf;
+		switch (*scanBuf) 
+		{
+			case 'S': /* SSID section */
+				if (ssid_len > 0 && index < MAX_PROBED_SSID_INDEX) {
+					/* setup the last parsed ssid, reserve index 0 for wext */
+					if (wmi_probedSsid_cmd(arPriv->arWmi, index,
+                                           SPECIFIC_SSID_FLAG, ssid_len, ssid) == A_OK) {
+                        ++index;
+                        if (arSta->scanSpecificSsid<index) {
+                            arSta->scanSpecificSsid = index;
+                        }
+                    }
+                }
+                ie_len = ((scanBuf + 1) < scanEnd) ? ((A_INT32)*(scanBuf+1) + 1) : 0;
+                if ((scanBuf+ie_len) < scanEnd ) {
+                    ssid_len = *(scanBuf+1);
+                    if (ssid_len == 0) {
+                        broadcastSsid = TRUE;
+                    } else {
+                        A_MEMCPY(ssid, scanBuf+2, ssid_len);
+                        ssid[ssid_len] = '\0';
+                    }
+                }
+                scanBuf += 1 + ie_len;
+                break;
+            case 'C': /* Channel section */
+                if (scanBuf+1 < scanEnd) {
+                    int value = *(scanBuf+1);
+                    if (value == 0) {
+                        ch = 0; /* scan for all channels */
+                    } else if (ch < IW_MAX_FREQUENCIES) {
+                        if (value>1000) {
+                            chList[ch].e = 1;
+                            chList[ch].m = value * 100000;
+                        } else {
+                            chList[ch].e = 0;
+                            chList[ch].m = value;
+                        }
+                        ++ch;
+                    }
+                }
+                scanBuf += 2;
+                break;
+            case 'P': /* Passive dwell section */
+                if (scanBuf+2 < scanEnd) {
+                    pas_dwell = *(scanBuf+1) + (*(scanBuf+2) << 8);
+                }
+                scanBuf += 3;
+                break;
+            case 'H': /* Home dwell section */
+                if (scanBuf+2 < scanEnd) {
+                    home_dwell = *(scanBuf+1) + (*(scanBuf+2) << 8);
+                }
+                scanBuf += 3;
+                break;
+            case 'N': /* Number of probe section */
+                if (scanBuf+1 < scanEnd) {
+                    nprobe = *(scanBuf+1);
+                }
+                scanBuf += 2;
+                break;
+            case 'A': /* Active dwell section */
+                if (scanBuf+2 < scanEnd) {
+                    act_dwell = *(scanBuf+1) + (*(scanBuf+2) << 8);
+                }
+                scanBuf += 3;
+                break;
+            case 'T': /* Scan active type section */
+                if (scanBuf+1 < scanEnd) {
+                    scantype = *(scanBuf+1);
+                }
+                scanBuf += 2;
+                break;
+            default:
+                break;
+		} /* switch */
+            if (sp == scanBuf) {
+                return -1; /* parsing error */
+            }
+	}/* while */
+
+	if (ssid_len>0) 
+	{
+		A_UINT8 idx; /* Clean up the last specific scan items */
+		for (idx=index; idx<arSta->scanSpecificSsid; ++idx) {
+			wmi_probedSsid_cmd(arPriv->arWmi, idx, DISABLE_SSID_FLAG, 0, NULL);
+		}
+		arSta->scanSpecificSsid = index;
+		/* 
+		* There is no way to know when we need to send broadcast probe in current Android wpa_supplicant_6 
+		* combo scan implemenation. Always force to sent it here uniti future Android version will set
+		* the broadcast flags for combo scan.
+		*/
+#if 0
+		if (broadcastSsid)
+#endif
+		{
+			/* setup the last index as broadcast SSID for combo scan */
+			++arSta->scanSpecificSsid;
+			wmi_probedSsid_cmd(arPriv->arWmi, index, ANY_SSID_FLAG, 0, NULL);
+		}
+	}
+
+	if (pas_dwell>0) {
+		/* TODO: Should we change our passive dwell? There may be some impact for bt-coex */
+	}
+
+	if (home_dwell>0) {
+		/* TODO: Should we adjust home_dwell? How to pass it to wext handler? */
+	}
+
+	if (setScan) {
+		union iwreq_data miwr;
+		struct iw_request_info minfo;
+		struct iw_scan_req scanreq, *pScanReq = NULL;
+
+		A_MEMZERO(&minfo, sizeof(minfo));
+		A_MEMZERO(&miwr, sizeof(miwr));            
+		A_MEMZERO(&scanreq, sizeof(scanreq));
+
+		if (ssid_len > 0) {
+			pScanReq = &scanreq;
+			memcpy(scanreq.essid, ssid, ssid_len);
+			scanreq.essid_len = ssid_len;
+			miwr.data.flags |= IW_SCAN_THIS_ESSID;
+		}
+		if (ch > 0) {
+			pScanReq = &scanreq;
+			scanreq.num_channels = ch;
+			memcpy(scanreq.channel_list, chList, ch * sizeof(chList[0]));
+			miwr.data.flags |= IW_SCAN_THIS_FREQ;
+		}
+		if (pScanReq) {
+			miwr.data.pointer = (__force void __user *)&scanreq;
+			miwr.data.length = sizeof(scanreq);
+		}
+		minfo.cmd = SIOCSIWSCAN;
+		return setScan(dev, &minfo, &miwr, (char*)pScanReq);
+	}
+	return -1;
+}
+
+int android_ioctl_siwpriv(struct net_device *dev,
+              struct iw_request_info *__info,
+              struct iw_point *data, char *__extra)
+{
+    char cmd[32]; /* assume that android command will not excess 32 */
+    char buf[32];
+    char *cmdbuf;
+    int len = sizeof(cmd)-1;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+
+    if (!data->pointer) {
+        return -EOPNOTSUPP;
+    }
+    if (data->length < len) {
+        len = data->length;
+    }
+    if (copy_from_user(cmd, data->pointer, len)) {
+        return -EIO;
+    }
+    cmd[len] = 0;
+
+    if (strcasecmp(cmd, "RSSI")==0 || strcasecmp(cmd, "RSSI-APPROX") == 0) {
+        int rssi = -200;
+        struct iw_statistics *iwStats;
+        struct iw_statistics* (*get_iwstats)(struct net_device *);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
+        get_iwstats = dev->get_wireless_stats;
+#else
+        get_iwstats = dev->wireless_handlers->get_wireless_stats;
+#endif
+        if (get_iwstats && arPriv->arConnected) {
+            iwStats = get_iwstats(dev);
+            if (iwStats) {
+                rssi = iwStats->qual.qual;          
+                if (rssi == 255)
+                    rssi = -200;
+                else
+                    rssi += (161 - 256);                
+            }
+        }
+        len = snprintf(buf, data->length, "SSID rssi %d\n", rssi) + 1;
+        return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;
+    } else if (strcasecmp(cmd, "LINKSPEED")==0) {
+        /* We skip to use SIOCGIWRATE since Android always asked LINKSPEED just after RSSI*/
+        unsigned int speed_mbps;
+        if (arPriv->arConnected) {
+            speed_mbps = arPriv->arTargetStats.tx_unicast_rate / 1000;
+        } else {
+            speed_mbps = 1;
+        }
+        len = snprintf(buf, data->length, "LinkSpeed %u\n", speed_mbps) + 1;
+        return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;
+    } else if (memcmp(cmd, "CSCAN S\x01\x00\x00S\x00", 12)==0) {
+
+		int ret=0;
+
+        if (!(cmdbuf = A_MALLOC(data->length)))
+            return -ENOMEM;
+
+        if (copy_from_user(cmdbuf, data->pointer, data->length)) {
+            A_FREE(cmdbuf);
+            return -EFAULT;
+        }
+
+        ret = ar6000_cscan(dev,data, cmdbuf);
+
+        A_FREE(cmdbuf);
+        return ret;
+        
+    } else if (strcasecmp(cmd, "MACADDR")==0) {
+        /* reply comes back in the form "Macaddr = XX:XX:XX:XX:XX:XX" where XX */
+        A_UCHAR *mac = dev->dev_addr;
+        len = snprintf(buf, data->length, "Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n",
+                        mac[0], mac[1], mac[2],
+                        mac[3], mac[4], mac[5]) + 1;
+        return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;
+    } else if (strcasecmp(cmd, "SCAN-ACTIVE")==0) {
+        return 0; /* unsupport function. Suppress the error */
+    } else if (strcasecmp(cmd, "SCAN-PASSIVE")==0) {
+        return 0; /* unsupport function. Suppress the error */
+    } else if (strcasecmp(cmd, "START")==0 || strcasecmp(cmd, "STOP")==0) {
+        struct ifreq ifr;
+        char userBuf[16];
+        int ex_arg = (strcasecmp(cmd, "START")==0) ? WLAN_ENABLED : WLAN_DISABLED;
+        int ret;
+        A_MEMZERO(userBuf, sizeof(userBuf));
+        ((int *)userBuf)[0] = AR6000_XIOCTRL_WMI_SET_WLAN_STATE;
+        ((int *)userBuf)[1] = ex_arg;
+        ret = android_do_ioctl_direct(dev, AR6000_IOCTL_EXTENDED, &ifr, userBuf);
+        if (ret==0) {
+            /* Send wireless event which need by android supplicant */
+            union iwreq_data wrqu;
+            A_MEMZERO(&wrqu, sizeof(wrqu));
+            wrqu.data.length = strlen(cmd);
+            wireless_send_event(dev, IWEVCUSTOM, &wrqu, cmd);
+        }
+        return ret;
+    } else if (strncasecmp(cmd, "POWERMODE ", 10)==0) {
+        int mode;
+        if (sscanf(cmd, "%*s %d", &mode) == 1) {
+            int iocmd = SIOCSIWPOWER - SIOCSIWCOMMIT;
+            iw_handler setPower = dev->wireless_handlers->standard[iocmd];
+            if (setPower) {
+                union iwreq_data miwr;
+                struct iw_request_info minfo;
+                A_MEMZERO(&minfo, sizeof(minfo));
+                A_MEMZERO(&miwr, sizeof(miwr));
+                minfo.cmd = SIOCSIWPOWER;
+                if (mode == 0 /* auto */)
+                    miwr.power.disabled = 0;
+                else if (mode == 1 /* active */)
+                    miwr.power.disabled = 1;
+                else
+                    return -1;
+                return setPower(dev, &minfo, &miwr, NULL);
+            }
+        }
+        return -1;
+    } else if (strcasecmp(cmd, "GETPOWER")==0) {
+        struct ifreq ifr;
+        int userBuf[2];
+        A_MEMZERO(userBuf, sizeof(userBuf));
+        ((int *)userBuf)[0] = AR6000_XIOCTRL_WMI_GET_POWER_MODE;
+        if (android_do_ioctl_direct(dev, AR6000_IOCTL_EXTENDED, &ifr, userBuf)>=0) {
+            WMI_POWER_MODE_CMD *getPowerMode = (WMI_POWER_MODE_CMD *)userBuf;
+            len = snprintf(buf, data->length, "powermode = %u\n", 
+                           (getPowerMode->powerMode==MAX_PERF_POWER) ? 1/*active*/ : 0/*auto*/) + 1;
+            return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;        
+        }
+        return -1;
+    } else if (strcasecmp(cmd, "GETBAND")==0) {
+        int band; /*0: auto, 1: 5GHz only, 2: 2.4GHz Only*/
+        switch (arPriv->arPhyCapability) {
+        case WMI_11A_CAPABILITY:
+        case WMI_11NA_CAPABILITY:
+            band = 1;
+            break;
+        case WMI_11NG_CAPABILITY:
+        case WMI_11G_CAPABILITY:
+            band = 2;
+            break;
+        case WMI_11AG_CAPABILITY:
+        case WMI_11NAG_CAPABILITY:
+        default:
+            band = 0;
+            break;
+        }
+        len = snprintf(buf, data->length, "Band %d\n", band) + 1;
+        return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;    
+    } else if (strncasecmp(cmd, "SETBAND ", 8)==0) {
+        int band;
+        if (sscanf(cmd, "%*s %d", &band) == 1) {
+            switch (band) {
+            case 1: /* 5GHz Only*/
+                /* TODO: Using WMI_CHANNEL_PARAMS_CMD to disable all 5GHz channels? */
+                break;
+            case 2: /* 5GHz Only*/
+                /* TODO: Using WMI_CHANNEL_PARAMS_CMD to disable all 2.4GHz channels? */
+                break;
+            case 0: /* auto */
+            default:
+                break;
+            }
+            return 0;
+        }
+        return -1;
+    } else if (strncasecmp(cmd, "SETSUSPENDOPT ", 14)==0) {
+        int enable;
+        if (sscanf(cmd, "%*s %d", &enable)==1) {
+            /* 
+             * We set our suspend mode by wlan_config.h now. 
+             * Should we follow Android command?? TODO
+             */
+            return 0;
+        }
+        return -1;
+    } else if (strcasecmp(cmd, "SCAN-CHANNELS")==0) {
+        // reply comes back in the form "Scan-Channels = X" where X is the number of channels        
+        int iocmd = SIOCGIWRANGE - SIOCSIWCOMMIT;
+        iw_handler getRange = dev->wireless_handlers->standard[iocmd];            
+        if (getRange) {
+            union iwreq_data miwr;
+            struct iw_request_info minfo;
+            struct iw_range range;
+            A_MEMZERO(&minfo, sizeof(minfo));
+            A_MEMZERO(&miwr, sizeof(miwr));
+            A_MEMZERO(&range, sizeof(range));
+            minfo.cmd = SIOCGIWRANGE;
+            miwr.data.pointer = (__force void __user *) &range;
+            miwr.data.length = sizeof(range);
+            getRange(dev, &minfo, &miwr, (char*)&range);
+        }
+        if (arSta->arNumChannels!=-1) {
+            len = snprintf(buf, data->length, "Scan-Channels = %d\n", arSta->arNumChannels) + 1;
+            return (copy_to_user(data->pointer, buf, len)==0) ? len : -1;
+        }
+        return -1;
+    } else if (strncasecmp(cmd, "SCAN-CHANNELS ", 14)==0 || 
+               strncasecmp(cmd, "COUNTRY ", 8)==0) {
+        /* 
+         * Set the available channels with WMI_SET_CHANNELPARAMS cmd
+         * However, the channels will be limited by the eeprom regulator domain
+         * Try to use a regulator domain which will not limited the channels range.
+         */
+        int i;
+        int chan = 0;
+        A_UINT16 *clist;
+        struct ifreq ifr; 
+        char ioBuf[256];
+        WMI_CHANNEL_PARAMS_CMD *chParamCmd = (WMI_CHANNEL_PARAMS_CMD *)ioBuf;
+        if (strncasecmp(cmd, "COUNTRY ", 8)==0) {
+            char *country = cmd + 8;
+            if (strcasecmp(country, "US")==0) {
+                chan = 11;
+            } else if (strcasecmp(country, "JP")==0) {
+                chan = 14;
+            } else if (strcasecmp(country, "EU")==0) {
+                chan = 13;
+            }
+        } else if (sscanf(cmd, "%*s %d", &chan) != 1) {
+            return -1;
+        }
+        if ( (chan != 11) && (chan != 13) && (chan != 14)) {
+            return -1;
+        }
+        if (arPriv->arNextMode == AP_NETWORK) {
+            return -1;
+        }
+        A_MEMZERO(&ifr, sizeof(ifr));
+        A_MEMZERO(ioBuf, sizeof(ioBuf));
+
+        chParamCmd->phyMode = WMI_11G_MODE;
+        clist = chParamCmd->channelList;
+        chParamCmd->numChannels = chan;
+        chParamCmd->scanParam = 1;        
+        for (i = 0; i < chan; i++) {
+            clist[i] = wlan_ieee2freq(i + 1);
+        }
+        
+        return android_do_ioctl_direct(dev, AR6000_IOCTL_WMI_SET_CHANNELPARAMS, &ifr, ioBuf);
+    } else if (strncasecmp(cmd, "BTCOEXMODE ", 11)==0) {
+        int mode;
+        if (sscanf(cmd, "%*s %d", &mode)==1) {
+            /* 
+            * Android disable BT-COEX when obtaining dhcp packet except there is headset is connected 
+             * It enable the BT-COEX after dhcp process is finished
+             * We ignore since we have our way to do bt-coex during dhcp obtaining.
+             */
+            switch (mode) {
+            case 1: /* Disable*/
+                break;
+            case 0: /* Enable */
+                /* fall through */
+            case 2: /* Sense*/
+                /* fall through */
+            default:
+                break;
+            }
+            return 0; /* ignore it */
+        }
+        return -1;
+    } else if (strcasecmp(cmd, "BTCOEXSCAN-START")==0) {
+        /* Android enable or disable Bluetooth coexistence scan mode. When this mode is on,
+         * some of the low-level scan parameters used by the driver are changed to
+         * reduce interference with A2DP streaming.
+         */
+        return 0; /* ignore it since we have btfilter  */
+    } else if (strcasecmp(cmd, "BTCOEXSCAN-STOP")==0) {
+        return 0; /* ignore it since we have btfilter  */
+    } else if (strncasecmp(cmd, "RXFILTER-ADD ", 13)==0) {
+        return 0; /* ignore it */
+    } else if (strncasecmp(cmd, "RXFILTER-REMOVE ", 16)==0) {
+        return 0; /* ignoret it */
+    } else if (strcasecmp(cmd, "RXFILTER-START")==0 || strcasecmp(cmd, "RXFILTER-STOP")==0) {
+        unsigned int flags = dev->flags;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+        int mc_count = dev->mc_count;   
+#else
+        int mc_count = netdev_mc_count(dev);
+#endif
+        if (strcasecmp(cmd, "RXFILTER-START")==0) {
+            if (mc_count > 0 || (flags & IFF_MULTICAST) ) {
+                flags &= ~IFF_MULTICAST;
+            }
+        } else {
+            flags |= IFF_MULTICAST;
+        }
+        if (flags != dev->flags) {
+            dev_change_flags(dev, flags);
+        }
+        return 0;
+    }
+
+    return -EOPNOTSUPP;
+}
+
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM7X27) && defined(CONFIG_MSM_SOC_REV_A)
+void msm7x27a_wifi_power(bool on)
+{
+
+	int rc = 0, index = 0;
+	static int resultFlag = 0, flag = 1;
+
+	for (index = 0; index < ARRAY_SIZE(vreg_info); index++) {
+		vreg_info[index].vreg = vreg_get(NULL,
+						vreg_info[index].vreg_id);
+		if (IS_ERR(vreg_info[index].vreg)) {
+			pr_err("%s:%s vreg get failed %ld\n",
+				__func__, vreg_info[index].vreg_id,
+				PTR_ERR(vreg_info[index].vreg));
+			rc = PTR_ERR(vreg_info[index].vreg);
+			if (on)
+				goto vreg_fail;
+			else
+				continue;
+		}
+	
+		if (on) {
+			rc = vreg_set_level(vreg_info[index].vreg,
+					 vreg_info[index].vreg_level);
+			if (rc) {
+				pr_err("%s:%s vreg set level failed %d\n",
+					__func__, vreg_info[index].vreg_id, rc);
+				goto vreg_fail;
+			}
+
+			rc = vreg_enable(vreg_info[index].vreg);
+			if (rc) {
+				pr_err("%s:%s vreg enable failed %d\n",
+					__func__,
+					vreg_info[index].vreg_id, rc);
+				goto vreg_fail;
+			}
+
+			if (vreg_info[index].is_vreg_pin_controlled) {
+				rc = pmapp_vreg_lpm_pincntrl_vote(id,
+					 vreg_info[index].pmapp_id,
+					 PMAPP_CLOCK_ID_A0, 1);
+				if (rc) {
+					pr_err("%s:%s pmapp_vreg_lpm_pincntrl_vote"
+						" for enable failed %d\n",
+						__func__,
+						vreg_info[index].vreg_id, rc);
+					goto vreg_fail;
+				}
+			} 
+		
+
+                        if (index == WLAN_VREG_L17)
+                                usleep(5);
+                        else if (index == WLAN_VREG_L19)
+                                usleep(10);
+                        
+			printk("\n vote for %s vreg. \n",vreg_info[index].vreg_id);
+
+		} else {
+			if (vreg_info[index].is_vreg_pin_controlled) {
+				rc = pmapp_vreg_lpm_pincntrl_vote(id,
+						 vreg_info[index].pmapp_id,
+						 PMAPP_CLOCK_ID_A0, 0);
+				if (rc) {
+					pr_err("%s:%s pmapp_vreg_lpm_pincntrl_vote"
+						" for disable failed %d\n",
+						__func__,
+						vreg_info[index].vreg_id, rc);
+				}
+			} 
+			rc = vreg_disable(vreg_info[index].vreg);
+			if (rc) {
+				pr_err("%s:%s vreg disable failed %d\n",
+					__func__,
+					vreg_info[index].vreg_id, rc);
+			}
+	
+                        printk("\n vote against %s vreg. \n",vreg_info[index].vreg_id);
+		}
+	}
+
+	if (on) {
+                rc = gpio_request(WLAN_GPIO_EXT_POR_N, "WLAN_DEEP_SLEEP_N");
+                if (rc) {
+                        pr_err("WLAN reset GPIO %d request failed %d\n",
+                        WLAN_GPIO_EXT_POR_N, rc);
+                        goto fail;
+                }
+		if(flag)
+		{
+			flag=0;
+	                rc = gpio_direction_output(WLAN_GPIO_EXT_POR_N, 1);
+        	        if (rc < 0) {
+	        	        pr_err("WLAN reset GPIO %d set direction failed %d\n",
+	                	WLAN_GPIO_EXT_POR_N, rc);
+		                goto fail_gpio_dir_out;
+        	        }
+		}
+
+#ifdef	A0_CLOCK 
+                rc = pmapp_clock_vote(id, PMAPP_CLOCK_ID_A0, PMAPP_CLOCK_VOTE_ON);
+		printk("\nVote for A0 clock done\n");
+
+		rc = pmapp_clock_vote(id, PMAPP_CLOCK_ID_A0, PMAPP_CLOCK_VOTE_PIN_CTRL);
+                if (rc) {
+                         pr_err("%s: Configuring A0 clock to Pin controllable failed %d\n",
+                                    __func__, rc);
+                }
+#else
+
+                rc = pmapp_clock_vote(id, PMAPP_CLOCK_ID_A0, PMAPP_CLOCK_VOTE_OFF);
+		 printk("\nVote against A0 clock done\n");
+#endif
+                if (rc) {
+                        pr_err("%s: Configuring A0 to turn off"
+                        " failed %d\n", __func__, rc);
+                } 
+                printk("\n vote for WLAN GPIO 134 done. \n");
+
+	} else {
+
+		if(!resultFlag){
+                	gpio_set_value_cansleep(WLAN_GPIO_EXT_POR_N, 0); 
+			rc = gpio_direction_input(WLAN_GPIO_EXT_POR_N);
+			if (rc) {
+                	        pr_err("WLAN reset GPIO %d set direction failed %d\n",
+                        	WLAN_GPIO_EXT_POR_N, rc);
+                	}
+	                gpio_free(WLAN_GPIO_EXT_POR_N);
+        	        printk("\n vote against WLAN GPIO 134 done. \n");
+		}
+		rc = pmapp_clock_vote(id, PMAPP_CLOCK_ID_A0,
+ 					PMAPP_CLOCK_VOTE_OFF);
+ 		if (rc) {
+ 			pr_err("%s: Configuring A0 to turn OFF"
+ 			" failed %d\n", __func__, rc);
+ 		}
+	}
+
+	printk("Interface %s success \n",on?"initialization":"deinitialization");
+	resultFlag = 0;
+	return;
+
+fail_gpio_dir_out:
+	gpio_free(WLAN_GPIO_EXT_POR_N);
+vreg_fail:
+	index--;
+	while (index > 0) {
+		rc = vreg_disable(vreg_info[index].vreg);
+		if (rc) {
+			pr_err("%s:%s vreg disable failed %d\n",
+				__func__, vreg_info[index].vreg_id, rc);
+		}
+		index--;
+	}
+	if (!on)
+		goto fail;
+fail:
+	resultFlag = 1;
+        printk("Interface %s failed \n",on?"initialization":"deinitialization");
+	return;
+}
+#endif
+
+/* Useful for qualcom platform to detect our wlan card for mmc stack */
+static void ar6000_enable_mmchost_detect_change(int enable)
+{
+#ifdef CONFIG_MMC_MSM
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM7X27) && defined(CONFIG_MSM_SOC_REV_A)
+#define MMC_MSM_DEV "msm_sdcc.2"
+#else
+#define MMC_MSM_DEV "msm_sdcc.1"
+#endif
+    char buf[3];
+    int length;
+
+    if (!enable_mmc_host_detect_change) {
+        return;
+    }
+    length = snprintf(buf, sizeof(buf), "%d\n", enable ? 1 : 0);
+    android_readwrite_file("/sys/devices/platform/" MMC_MSM_DEV "/polling", NULL, buf, length);
+    A_MDELAY(50);
+#endif
+}
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+static void android_early_suspend(struct early_suspend *h)
+{
+    screen_is_off = 1;
+}
+
+static void android_late_resume(struct early_suspend *h)
+{
+    screen_is_off = 0;
+}
+#endif
+
+void android_module_init(OSDRV_CALLBACKS *osdrvCallbacks)
+{
+    bmienable = 1;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+    if (ifname[0] == '\0') {
+       if (strlcpy(ifname, def_ifname, sizeof(ifname)) >= sizeof(ifname)) {
+           AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("strlcpy: def_ifname %s\n", def_ifname));
+           return;
+        }
+    }
+#endif 
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock_init(&ar6k_init_wake_lock, WAKE_LOCK_SUSPEND, "ar6k_init");
+#endif
+#ifdef CONFIG_HAS_EARLYSUSPEND
+    ar6k_early_suspend.suspend = android_early_suspend;
+    ar6k_early_suspend.resume  = android_late_resume;
+    ar6k_early_suspend.level   = EARLY_SUSPEND_LEVEL_BLANK_SCREEN;
+    register_early_suspend(&ar6k_early_suspend);
+#endif
+
+    ar6000_avail_ev_p = osdrvCallbacks->deviceInsertedHandler;
+    osdrvCallbacks->deviceInsertedHandler = ar6000_android_avail_ev;
+
+    ar6000_enable_mmchost_detect_change(1);
+}
+
+void android_module_exit(void)
+{
+#ifdef CONFIG_HAS_EARLYSUSPEND
+    unregister_early_suspend(&ar6k_early_suspend);
+#endif
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock_destroy(&ar6k_init_wake_lock);
+#endif
+    ar6000_enable_mmchost_detect_change(1);
+    /* disable polling again after we remove our wlan card */
+    ar6000_enable_mmchost_detect_change(0);
+}
+
+#ifdef CONFIG_PM
+void android_ar6k_check_wow_status(AR_SOFTC_T *ar, struct sk_buff *skb, A_BOOL isEvent)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+    unsigned long wake_timeout = 5; /* 50 milli seconds for normal window's ping test */
+#endif
+    AR_SOFTC_DEV_T *arPriv;
+    A_UINT8  i; 
+    A_BOOL needWake = FALSE;
+    for(i = 0; i < num_device; i++) 
+    {
+        arPriv = ar->arDev[i];
+        if (
+#ifdef CONFIG_HAS_EARLYSUSPEND
+            screen_is_off && 
+#endif
+                skb && arPriv->arConnected) {
+            if (isEvent) {
+                if (A_NETBUF_LEN(skb) >= sizeof(A_UINT16)) {
+                    A_UINT16 cmd = *(const A_UINT16 *)A_NETBUF_DATA(skb);
+                    switch (cmd) {
+                    case WMI_CONNECT_EVENTID:
+#ifdef CONFIG_HAS_WAKELOCK
+                         wake_timeout = 5;
+#endif
+                         needWake = TRUE;
+                         break;
+                    default:
+                        /* dont wake lock the system for other event */
+                         break;
+                    }
+                }
+            } else if (A_NETBUF_LEN(skb) >= sizeof(ATH_MAC_HDR)) {
+                ATH_MAC_HDR *datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+                if (!IEEE80211_IS_MULTICAST(datap->dstMac)) {
+                    switch (A_BE2CPU16(datap->typeOrLen)) {
+                    case 0x0800: /* IP */
+                        if (A_NETBUF_LEN(skb)>=24 &&
+                            *((A_UCHAR*)A_NETBUF_DATA(skb)+23)==0x11) {
+                            A_UCHAR *udpPkt = (A_UCHAR*)A_NETBUF_DATA(skb)+14;
+                            A_UINT8 ihl = (*udpPkt & 0x0f) * sizeof(A_UINT32);
+                            const A_UCHAR ipsec_keepalive[] = { 
+                                0x11, 0x94, 0x11, 0x94, 0x00, 0x09, 0x00, 0x00, 0xff
+                            };
+                            udpPkt += ihl;
+                            if (A_NETBUF_LEN(skb)>=14+ihl+sizeof(ipsec_keepalive) &&
+                                    !memcmp(udpPkt, ipsec_keepalive, sizeof(ipsec_keepalive)-3) &&
+                                    udpPkt[8]==0xff) {
+                                /* 
+                                 * RFC 3948 UDP Encapsulation of IPsec ESP Packets
+                                 * Source and Destination port must be 4500
+                                 * Receivers MUST NOT depend upon the UDP checksum being zero 
+                                 * Sender must use 1 byte payload with 0xff
+                                 * Receiver SHOULD ignore a received NAT-keepalive packet
+                                 *
+                                 * IPSec over UDP NAT keepalive packet. Just ignore
+                                 */
+                                break;
+                            }
+                        }
+                    case 0x888e: /* EAPOL */
+                    case 0x88c7: /* RSN_PREAUTH */
+                    case 0x88b4: /* WAPI */
+                         needWake = TRUE;
+                         break;
+                    case 0x0806: /* ARP is not important to hold wake lock */
+                        needWake = (arPriv->arNetworkType==AP_NETWORK);
+                        break;
+                    default:
+                         break;
+                    }
+                } else if ( !IEEE80211_IS_BROADCAST(datap->dstMac) ) {
+                    if (A_NETBUF_LEN(skb)>=14+20 ) {
+					    /* check if it is mDNS packets */
+                        A_UINT8 *dstIpAddr = (A_UINT8*)(A_NETBUF_DATA(skb)+14+20-4);                    
+                        struct net_device *ndev = arPriv->arNetDev;
+                        needWake = ((dstIpAddr[3] & 0xf8) == 0xf8) &&
+                                (arPriv->arNetworkType==AP_NETWORK || 
+                                (ndev->flags & IFF_ALLMULTI || ndev->flags & IFF_MULTICAST));
+                    }
+                }else if (arPriv->arNetworkType==AP_NETWORK) {
+                    switch (A_BE2CPU16(datap->typeOrLen)) {
+                    case 0x0800: /* IP */
+                        if (A_NETBUF_LEN(skb)>=14+20+2) {
+                            A_UINT16 dstPort = *(A_UINT16*)(A_NETBUF_DATA(skb)+14+20);
+                            dstPort = A_BE2CPU16(dstPort);
+                            needWake = (dstPort == 0x43); /* dhcp request */
+                        }
+                        break;
+                    case 0x0806: 
+                        needWake = TRUE;
+                    default:
+                        break;
+                    }
+                }
+             }
+         }
+    }
+    if (needWake) {
+#ifdef CONFIG_HAS_WAKELOCK
+        /* keep host wake up if there is any event and packate comming in*/
+        wake_lock_timeout(&ar6k_wow_wake_lock, wake_timeout);
+#endif
+        if (wowledon) {
+            char buf[32];
+            int len = 0;
+            if ((len = snprintf(buf, sizeof(buf), "on")) >= sizeof(buf)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("snprintf: on\n"));
+                return;
+            }
+            android_readwrite_file("/sys/power/state", NULL, buf, len);
+
+            if ((len = snprintf(buf, sizeof(buf), "%d", 127)) >= sizeof(buf)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("snprintf: unable to write 127\n"));
+                return;
+            }
+            android_readwrite_file("/sys/class/leds/lcd-backlight/brightness",
+                                   NULL, buf,len);
+        }
+    }
+}
+#endif /* CONFIG_PM */
+
+void android_send_reload_event(AR_SOFTC_DEV_T *arPriv)
+{
+    struct net_device *ndev = arPriv->arNetDev;
+    union iwreq_data wrqu;
+    const char reloadEvt[] = "HANG";
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = strlen(reloadEvt);
+    wireless_send_event(ndev, IWEVCUSTOM, &wrqu, reloadEvt);
+}
diff --git a/host/os/linux/ar6000_drv.c b/host/os/linux/ar6000_drv.c
new file mode 100644
index 0000000..b0c32c1
--- /dev/null
+++ b/host/os/linux/ar6000_drv.c
@@ -0,0 +1,9504 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+/*
+ * This driver is a pseudo ethernet driver to access the Atheros AR6000
+ * WLAN Device
+ */
+#include <linux/vmalloc.h>
+#include "ar6000_drv.h"
+#ifdef ATH6K_CONFIG_CFG80211
+#include "cfg80211.h"
+#endif /* ATH6K_CONFIG_CFG80211 */
+#include "htc.h"
+#include "wmi_filter_linux.h"
+#include "epping_test.h"
+#include "wlan_config.h"
+#include "ar3kconfig.h"
+#ifdef ATH_SUPPORT_DFS
+#include "dfs_host.h"
+#endif
+#include "ar6k_pal.h"
+#include "AR6002/addrs.h"
+#include "target_reg_table.h"
+#ifdef P2P
+#include "p2p_api.h"
+#endif
+#include "a_drv_api.h"
+
+#ifdef CONFIG_PLAT_AMBARELLA
+#include <mach/board.h>
+#include <plat/sd.h>
+#endif
+
+/* LINUX_HACK_FUDGE_FACTOR -- this is used to provide a workaround for linux behavior.  When
+ * the meta data was added to the header it was found that linux did not correctly provide
+ * enough headroom.  However when more headroom was requested beyond what was truly needed
+ * Linux gave the requested headroom. Therefore to get the necessary headroom from Linux
+ *  the driver requests more than is needed by the amount = LINUX_HACK_FUDGE_FACTOR */
+#define LINUX_HACK_FUDGE_FACTOR 16
+#define BDATA_BDADDR_OFFSET     28
+
+A_UINT8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+A_UINT8 null_mac[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+
+#ifdef DEBUG
+
+#define  ATH_DEBUG_DBG_LOG       ATH_DEBUG_MAKE_MODULE_MASK(0)
+#define  ATH_DEBUG_WLAN_CONNECT  ATH_DEBUG_MAKE_MODULE_MASK(1)
+#define  ATH_DEBUG_WLAN_SCAN     ATH_DEBUG_MAKE_MODULE_MASK(2)
+#define  ATH_DEBUG_WLAN_TX       ATH_DEBUG_MAKE_MODULE_MASK(3)
+#define  ATH_DEBUG_WLAN_RX       ATH_DEBUG_MAKE_MODULE_MASK(4)
+#define  ATH_DEBUG_HTC_RAW       ATH_DEBUG_MAKE_MODULE_MASK(5)
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+
+static ATH_DEBUG_MASK_DESCRIPTION driver_debug_desc[] = {
+    { ATH_DEBUG_DBG_LOG      , "Target Debug Logs"},
+    { ATH_DEBUG_WLAN_CONNECT , "WLAN connect"},
+    { ATH_DEBUG_WLAN_SCAN    , "WLAN scan"},
+    { ATH_DEBUG_WLAN_TX      , "WLAN Tx"},
+    { ATH_DEBUG_WLAN_RX      , "WLAN Rx"},
+    { ATH_DEBUG_HTC_RAW      , "HTC Raw IF tracing"},
+    { ATH_DEBUG_HCI_BRIDGE   , "HCI Bridge Setup"},
+    { ATH_DEBUG_HCI_RECV     , "HCI Recv tracing"},
+    { ATH_DEBUG_HCI_DUMP     , "HCI Packet dumps"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(driver,
+                                 "driver",
+                                 "Linux Driver Interface",
+                                 ATH_DEBUG_MASK_DEFAULTS | ATH_DEBUG_WLAN_SCAN |
+                                 ATH_DEBUG_HCI_BRIDGE,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(driver_debug_desc),
+                                 driver_debug_desc);
+
+#endif
+
+
+#define IS_MAC_NULL(mac)  (mac[0]==0 && mac[1]==0 && mac[2]==0 && mac[3]==0 && mac[4]==0 && mac[5]==0)
+#define IS_MAC_BCAST(mac) (*mac==0xff)
+
+#define DESCRIPTION "Driver to access the AR600x Device, version " __stringify(__VER_MAJOR_) "." __stringify(__VER_MINOR_) "." __stringify(__VER_PATCH_) "." __stringify(__BUILD_NUMBER_)
+
+MODULE_AUTHOR("Qualcomm Atheros");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_LICENSE("Dual BSD/GPL");
+
+#ifndef REORG_APTC_HEURISTICS
+#undef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+#endif /* REORG_APTC_HEURISTICS */
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+A_TIMER aptcTimer[NUM_DEV];
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+// callbacks registered by HCI transport driver
+HCI_TRANSPORT_CALLBACKS ar6kHciTransCallbacks = { NULL };
+#endif
+
+unsigned int processDot11Hdr = 0;
+char targetconf[10]={0,};
+int bmienable = BMIENABLE_DEFAULT;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+char ifname[IFNAMSIZ] = {0,};
+char devmode[32] ={0,};
+char submode[32] ={0,};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) */
+
+int regcode = 0;
+int wlaninitmode = WLAN_INIT_MODE_DEFAULT;
+unsigned int bypasswmi = 0;
+unsigned int debuglevel = 0;
+int tspecCompliance = ATHEROS_COMPLIANCE;
+unsigned int busspeedlow = 0;
+unsigned int onebitmode = 0;
+unsigned int skipflash = 0;
+unsigned int wmitimeout = 2;
+unsigned int wlanNodeCaching = 1;
+unsigned int enableuartprint = ENABLEUARTPRINT_DEFAULT;
+unsigned int logWmiRawMsgs = 0;
+unsigned int enabletimerwar = 0;
+unsigned int fwmode = 1;
+unsigned int fwsubmode = 0;
+unsigned int mbox_yield_limit = 99;
+unsigned int enablerssicompensation = 0;
+int reduce_credit_dribble = 1 + HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_ONE_HALF;
+int allow_trace_signal = 0;
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+unsigned int testmode =0;
+#endif
+unsigned int firmware_bridge = 0;
+
+unsigned int irqprocmode = HIF_DEVICE_IRQ_SYNC_ONLY;//HIF_DEVICE_IRQ_ASYNC_SYNC;
+unsigned int panic_on_assert = 1;
+unsigned int nohifscattersupport = NOHIFSCATTERSUPPORT_DEFAULT;
+
+unsigned int setuphci = SETUPHCI_DEFAULT;
+unsigned int setuphcipal = SETUPHCIPAL_DEFAULT;
+unsigned int loghci = 0;
+unsigned int setupbtdev = SETUPBTDEV_DEFAULT;
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+unsigned int ar3khcibaud = AR3KHCIBAUD_DEFAULT;
+unsigned int hciuartscale = HCIUARTSCALE_DEFAULT;
+unsigned int hciuartstep = HCIUARTSTEP_DEFAULT;
+#endif
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+unsigned int csumOffload=0;
+unsigned int csumOffloadTest=0;
+#endif
+unsigned int eppingtest=0;
+unsigned int regscanmode=0;
+unsigned int num_device=1;
+unsigned char ar6k_init=FALSE;
+unsigned int rtc_reset_only_on_exit=0;
+unsigned int mac_addr_method=0;
+A_BOOL avail_ev_called=FALSE;
+
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM7X27) && defined(CONFIG_MSM_SOC_REV_A)
+unsigned int refClock = 19200000;
+#else
+unsigned int refClock = 26000000;
+#endif
+
+unsigned int max_psq_depth = MAX_DEFAULT_PS_QUEUE_DEPTH;
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param_string(ifname, ifname, sizeof(ifname), 0644);
+module_param(regcode, int, 0644);
+module_param(wlaninitmode, int, 0644);
+module_param(bmienable, int, 0644);
+module_param(bypasswmi, uint, 0644);
+module_param(debuglevel, uint, 0644);
+module_param(tspecCompliance, int, 0644);
+module_param(onebitmode, uint, 0644);
+module_param(busspeedlow, uint, 0644);
+module_param(skipflash, uint, 0644);
+module_param(wmitimeout, uint, 0644);
+module_param(wlanNodeCaching, uint, 0644);
+module_param(logWmiRawMsgs, uint, 0644);
+module_param(enableuartprint, uint, 0644);
+module_param(enabletimerwar, uint, 0644);
+module_param(mbox_yield_limit, uint, 0644);
+module_param(reduce_credit_dribble, int, 0644);
+module_param(allow_trace_signal, int, 0644);
+module_param(enablerssicompensation, uint, 0644);
+module_param(processDot11Hdr, uint, 0644);
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+module_param(csumOffload, uint, 0644);
+#endif
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+module_param(testmode, uint, 0644);
+#endif
+module_param(firmware_bridge, uint, 0644);
+module_param(irqprocmode, uint, 0644);
+module_param(nohifscattersupport, uint, 0644);
+module_param(panic_on_assert, uint, 0644);
+module_param(setuphci, uint, 0644);
+module_param(setuphcipal, uint, 0644);
+module_param(loghci, uint, 0644);
+module_param(setupbtdev, uint, 0644);
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+module_param(ar3khcibaud, uint, 0644);
+module_param(hciuartscale, uint, 0644);
+module_param(hciuartstep, uint, 0644);
+#endif
+module_param(eppingtest, uint, 0644);
+module_param(regscanmode, uint, 0644);
+module_param_string(devmode, devmode, sizeof(devmode), 0644);
+module_param_string(submode, submode, sizeof(submode), 0644);
+module_param_string(targetconf, targetconf, sizeof(targetconf), 0644);
+module_param(rtc_reset_only_on_exit, uint, 0644);
+module_param(mac_addr_method, uint, 0644);
+module_param(refClock, uint, 0644);
+module_param(max_psq_depth, uint, 0644);
+#else
+
+#define __user
+/* for linux 2.4 and lower */
+MODULE_PARM(bmienable,"i");
+MODULE_PARM(wlaninitmode,"i");
+MODULE_PARM(bypasswmi,"i");
+MODULE_PARM(debuglevel, "i");
+MODULE_PARM(onebitmode,"i");
+MODULE_PARM(busspeedlow, "i");
+MODULE_PARM(skipflash, "i");
+MODULE_PARM(wmitimeout, "i");
+MODULE_PARM(wlanNodeCaching, "i");
+MODULE_PARM(enableuartprint,"i");
+MODULE_PARM(logWmiRawMsgs, "i");
+MODULE_PARM(enabletimerwar,"i");
+MODULE_PARM(mbox_yield_limit,"i");
+MODULE_PARM(reduce_credit_dribble,"i");
+MODULE_PARM(allow_trace_signal,"i");
+MODULE_PARM(enablerssicompensation,"i");
+MODULE_PARM(processDot11Hdr,"i");
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+MODULE_PARM(csumOffload,"i");
+#endif
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+MODULE_PARM(testmode, "i");
+#endif
+MODULE_PARM(irqprocmode, "i");
+MODULE_PARM(nohifscattersupport, "i");
+MODULE_PARM(panic_on_assert, "i");
+MODULE_PARM(setuphci, "i");
+MODULE_PARM(setuphcipal, "i");
+MODULE_PARM(loghci, "i");
+MODULE_PARM(regscanmode, "i");
+MODULE_PARM(rtc_reset_only_on_exit, "i");
+MODULE_PARM(mac_addr_method, "i");
+MODULE_PARM(refClock, "i");
+MODULE_PARM(max_psq_depth, "i");
+#endif
+
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+unsigned int first_scan_2g_only = WLAN_CONFIG_FIRST_SCAN_2G_ONLY;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param(first_scan_2g_only, uint, 0644);
+#else
+MODULE_PARM(first_scan_2g_only, "i");
+#endif
+#endif
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
+/* in 2.6.10 and later this is now a pointer to a uint */
+unsigned int _mboxnum = HTC_MAILBOX_NUM_MAX;
+#define mboxnum &_mboxnum
+#else
+unsigned int mboxnum = HTC_MAILBOX_NUM_MAX;
+#endif
+
+#ifdef DEBUG
+A_UINT32 g_dbg_flags = DBG_DEFAULTS;
+unsigned int debugflags = 0;
+int debugdriver = 0;
+unsigned int debughtc = 0;
+unsigned int debugbmi = 0;
+unsigned int debughif = 0;
+unsigned int txcreditsavailable[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditsconsumed[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditintrenable[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int txcreditintrenableaggregate[HTC_MAILBOX_NUM_MAX] = {0};
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param(debugflags, uint, 0644);
+module_param(debugdriver, int, 0644);
+module_param(debughtc, uint, 0644);
+module_param(debugbmi, uint, 0644);
+module_param(debughif, uint, 0644);
+module_param_array(txcreditsavailable, uint, mboxnum, 0644);
+module_param_array(txcreditsconsumed, uint, mboxnum, 0644);
+module_param_array(txcreditintrenable, uint, mboxnum, 0644);
+module_param_array(txcreditintrenableaggregate, uint, mboxnum, 0644);
+#else
+/* linux 2.4 and lower */
+MODULE_PARM(debugflags,"i");
+MODULE_PARM(debugdriver, "i");
+MODULE_PARM(debughtc, "i");
+MODULE_PARM(debugbmi, "i");
+MODULE_PARM(debughif, "i");
+MODULE_PARM(txcreditsavailable, "0-3i");
+MODULE_PARM(txcreditsconsumed, "0-3i");
+MODULE_PARM(txcreditintrenable, "0-3i");
+MODULE_PARM(txcreditintrenableaggregate, "0-3i");
+#endif
+
+#endif /* DEBUG */
+
+unsigned int resetok = 1;
+unsigned int tx_attempt[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int tx_post[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int tx_complete[HTC_MAILBOX_NUM_MAX] = {0};
+unsigned int hifBusRequestNumMax = 40;
+unsigned int war23838_disabled = 0;
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+unsigned int enableAPTCHeuristics = 1;
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+unsigned int psm_info = 99;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param_array(tx_attempt, uint, mboxnum, 0644);
+module_param_array(tx_post, uint, mboxnum, 0644);
+module_param_array(tx_complete, uint, mboxnum, 0644);
+module_param(hifBusRequestNumMax, uint, 0644);
+module_param(war23838_disabled, uint, 0644);
+module_param(resetok, uint, 0644);
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+module_param(enableAPTCHeuristics, uint, 0644);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+module_param(psm_info, uint, 0444);
+#else
+MODULE_PARM(tx_attempt, "0-3i");
+MODULE_PARM(tx_post, "0-3i");
+MODULE_PARM(tx_complete, "0-3i");
+MODULE_PARM(hifBusRequestNumMax, "i");
+MODULE_PARM(war23838_disabled, "i");
+MODULE_PARM(resetok, "i");
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+MODULE_PARM(enableAPTCHeuristics, "i");
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+MODULE_PARM(psm_info, "i");
+#endif
+
+#ifdef BLOCK_TX_PATH_FLAG
+int blocktx = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param(blocktx, int, 0644);
+#else
+MODULE_PARM(blocktx, "i");
+#endif
+#endif /* BLOCK_TX_PATH_FLAG */
+
+static A_INT16 rssi_compensation_table[NUM_DEV][96];
+
+int reconnect_flag = 0;
+static ar6k_pal_config_t ar6k_pal_config_g;
+
+// Load unload synchronization
+DECLARE_WAIT_QUEUE_HEAD(load_complete);
+DECLARE_WAIT_QUEUE_HEAD(scan_complete);
+
+// Indicates if the module load completed
+static int mod_loaded = FALSE;
+
+/* Function declarations */
+static int ar6000_init_module(void);
+static void ar6000_cleanup_module(void);
+
+struct completion avail_ev_completion;
+
+int ar6000_init(struct net_device *dev);
+static int ar6000_open(struct net_device *dev);
+static int ar6000_close(struct net_device *dev);
+static int ar6000_init_control_info(AR_SOFTC_DEV_T *arPriv);
+static int ar6000_data_tx(struct sk_buff *skb, struct net_device *dev);
+
+void ar6000_destroy(struct net_device *dev, unsigned int unregister);
+void ar6000_cleanup(AR_SOFTC_T *ar);
+static void ar6000_detect_error(unsigned long ptr);
+static void ar6000_set_multicast_list(struct net_device *dev);
+static struct net_device_stats *ar6000_get_stats(struct net_device *dev);
+static struct iw_statistics *ar6000_get_iwstats(struct net_device * dev);
+
+static void disconnect_timer_handler(unsigned long ptr);
+
+void read_rssi_compensation_param(AR_SOFTC_T *ar);
+void target_register_tbl_attach(A_UINT32 target_type);
+static void ar6000_uapsd_trigger_frame_rx(AR_SOFTC_DEV_T *arPriv, conn_t *conn);
+static void delba_timer_callback(unsigned long ptr);
+static int ar6000_check_hold_conn_status(AR_SOFTC_DEV_T *arPriv, A_UINT8 conn_status);
+
+extern int android_readwrite_file(const A_CHAR *filename, A_CHAR *rbuf, const A_CHAR *wbuf, size_t length);
+    /* for android builds we call external APIs that handle firmware download and configuration */
+#ifdef ANDROID_ENV
+/* !!!! Interim android support to make it easier to patch the default driver for
+ * android use. You must define an external source file ar6000_android.c that handles the following
+ * APIs */
+extern void android_module_init(OSDRV_CALLBACKS *osdrvCallbacks);
+extern void android_module_exit(void);
+extern void android_send_reload_event(AR_SOFTC_DEV_T *arPriv);
+#define ANDROID_RELOAD_THRESHOLD_FOR_EP_FULL 5
+static int android_epfull_cnt;
+#endif
+/*
+ * HTC service connection handlers
+ */
+static A_STATUS ar6000_avail_ev(void *context, void *hif_handle);
+
+static A_STATUS ar6000_unavail_ev(void *context, void *hif_handle);
+
+A_STATUS ar6000_configure_target(AR_SOFTC_T *ar);
+
+static void ar6000_target_failure(void *Instance, A_STATUS Status);
+
+static void ar6000_rx(void *Context, HTC_PACKET *pPacket);
+
+static void ar6000_rx_refill(void *Context,HTC_ENDPOINT_ID Endpoint);
+
+static void ar6000_tx_complete(void *Context, HTC_PACKET_QUEUE *pPackets);
+
+static HTC_SEND_FULL_ACTION ar6000_tx_queue_full(void *Context, HTC_PACKET *pPacket);
+
+#ifdef ATH_AR6K_11N_SUPPORT
+static void ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, A_UINT16 num);
+#endif
+static void ar6000_deliver_frames_to_nw_stack(void * dev, void *osbuf);
+//static void ar6000_deliver_frames_to_bt_stack(void * dev, void *osbuf);
+
+static HTC_PACKET *ar6000_alloc_amsdu_rxbuf(void *Context, HTC_ENDPOINT_ID Endpoint, int Length);
+
+static void ar6000_refill_amsdu_rxbufs(AR_SOFTC_T *ar, int Count);
+
+static void ar6000_cleanup_amsdu_rxbufs(AR_SOFTC_T *ar);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+static ssize_t
+ar6000_sysfs_bmi_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count);
+
+static ssize_t
+ar6000_sysfs_bmi_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count);
+#else
+static ssize_t
+ar6000_sysfs_bmi_read(struct file *fp, struct kobject *kobj,
+                      struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count);
+
+static ssize_t
+ar6000_sysfs_bmi_write(struct file *fp, struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count);
+#endif
+
+static A_STATUS
+ar6000_sysfs_bmi_init(AR_SOFTC_T *ar);
+
+/* HCI PAL callback function declarations */
+A_STATUS ar6k_setup_hci_pal(AR_SOFTC_DEV_T *ar);
+void ar6k_cleanup_hci_pal(AR_SOFTC_DEV_T *ar);
+
+static void
+ar6000_sysfs_bmi_deinit(AR_SOFTC_T *ar);
+
+A_STATUS
+ar6000_sysfs_bmi_get_config(AR_SOFTC_T *ar, A_UINT32 mode);
+
+/*
+ * Static variables
+ */
+
+struct net_device *ar6000_devices[NUM_DEV];
+extern struct iw_handler_def ath_iw_handler_def;
+static void ar6000_cookie_init(AR_SOFTC_T *ar);
+static void ar6000_cookie_cleanup(AR_SOFTC_T *ar);
+static void ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie);
+static struct ar_cookie *ar6000_alloc_cookie(AR_SOFTC_T *ar);
+
+#ifdef USER_KEYS
+static A_STATUS ar6000_reinstall_keys(AR_SOFTC_DEV_T *arPriv,A_UINT8 key_op_ctrl);
+#endif
+
+
+static struct ar_cookie s_ar_cookie_mem[MAX_COOKIE_NUM];
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,29)
+static struct net_device_ops ar6000_netdev_ops = {
+    .ndo_init               = NULL,
+    .ndo_open               = ar6000_open,
+    .ndo_stop               = ar6000_close,
+    .ndo_get_stats          = ar6000_get_stats,
+    .ndo_do_ioctl           = ar6000_ioctl,
+    .ndo_start_xmit         = ar6000_data_tx,
+    .ndo_set_multicast_list = ar6000_set_multicast_list,
+    .ndo_change_mtu         = eth_change_mtu,
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,29) */
+
+/* Debug log support */
+
+/*
+ * Flag to govern whether the debug logs should be parsed in the kernel
+ * or reported to the application.
+ */
+#define REPORT_DEBUG_LOGS_TO_APP
+
+A_STATUS
+ar6000_set_host_app_area(AR_SOFTC_T *ar)
+{
+    A_UINT32 address, data;
+    struct host_app_area_s host_app_area;
+
+    /* Fetch the address of the host_app_area_s instance in the host interest area */
+    address = TARG_VTOP(ar->arTargetType, HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_app_host_interest));
+    if (ar6000_ReadRegDiag(ar->arHifDevice, &address, &data) != A_OK) {
+        return A_ERROR;
+    }
+    address = TARG_VTOP(ar->arTargetType, data);
+    host_app_area.wmi_protocol_ver = WMI_PROTOCOL_VERSION;
+    if (ar6000_WriteDataDiag(ar->arHifDevice, address,
+                             (A_UCHAR *)&host_app_area,
+                             sizeof(struct host_app_area_s)) != A_OK)
+    {
+        return A_ERROR;
+    }
+
+    return A_OK;
+}
+
+A_UINT32
+dbglog_get_debug_hdr_ptr(AR_SOFTC_T *ar)
+{
+    A_UINT32 param;
+    A_UINT32 address;
+    A_STATUS status;
+
+    address = TARG_VTOP(ar->arTargetType, HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_dbglog_hdr));
+    if ((status = ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                      (A_UCHAR *)&param, 4)) != A_OK)
+    {
+        param = 0;
+    }
+
+    return param;
+}
+
+/*
+ * The dbglog module has been initialized. Its ok to access the relevant
+ * data stuctures over the diagnostic window.
+ */
+void
+ar6000_dbglog_init_done(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    ar->dbglog_init_done = TRUE;
+}
+
+A_UINT32
+dbglog_get_debug_fragment(A_INT8 *datap, A_UINT32 len, A_UINT32 limit)
+{
+    A_INT32 *buffer;
+    A_UINT32 count;
+    A_UINT32 numargs;
+    A_UINT32 length;
+    A_UINT32 fraglen;
+
+    count = fraglen = 0;
+    buffer = (A_INT32 *)datap;
+    length = (limit >> 2);
+
+    if (len <= limit) {
+        fraglen = len;
+    } else {
+        while (count < length) {
+            numargs = DBGLOG_GET_NUMARGS(buffer[count]);
+            fraglen = (count << 2);
+            count += numargs + 1;
+        }
+    }
+
+    return fraglen;
+}
+
+void
+dbglog_parse_debug_logs(A_INT8 *datap, A_UINT32 len)
+{
+    A_INT32 *buffer;
+    A_UINT32 count;
+    A_UINT32 timestamp;
+    A_UINT32 debugid;
+    A_UINT32 moduleid;
+    A_UINT32 numargs;
+    A_UINT32 length;
+
+    count = 0;
+    buffer = (A_INT32 *)datap;
+    length = (len >> 2);
+    while (count < length) {
+        debugid = DBGLOG_GET_DBGID(buffer[count]);
+        moduleid = DBGLOG_GET_MODULEID(buffer[count]);
+        numargs = DBGLOG_GET_NUMARGS(buffer[count]);
+        timestamp = DBGLOG_GET_TIMESTAMP(buffer[count]);
+        switch (numargs) {
+        case 0:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d)\n", moduleid, debugid, timestamp));
+            break;
+
+        case 1:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d): 0x%x\n", moduleid, debugid,
+                            timestamp, buffer[count+1]));
+            break;
+
+        case 2:
+            AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("%d %d (%d): 0x%x, 0x%x\n", moduleid, debugid,
+                            timestamp, buffer[count+1], buffer[count+2]));
+            break;
+
+        default:
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid args: %d\n", numargs));
+        }
+        count += numargs + 1;
+    }
+}
+
+int
+ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar)
+{
+    struct dbglog_hdr_s debug_hdr;
+    struct dbglog_buf_s debug_buf;
+    A_UINT32 address;
+    A_UINT32 length;
+    A_UINT32 dropped;
+    A_UINT32 firstbuf;
+    A_UINT32 debug_hdr_ptr;
+
+    if (!ar->dbglog_init_done) return A_ERROR;
+
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if (ar->dbgLogFetchInProgress) {
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        return A_EBUSY;
+    }
+
+    /* block out others */
+    ar->dbgLogFetchInProgress = TRUE;
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    debug_hdr_ptr = dbglog_get_debug_hdr_ptr(ar);
+    printk("debug_hdr_ptr: 0x%x\n", debug_hdr_ptr);
+
+    /* Get the contents of the ring buffer */
+    if (debug_hdr_ptr) {
+        address = TARG_VTOP(ar->arTargetType, debug_hdr_ptr);
+        length = sizeof(struct dbglog_hdr_s);
+        ar6000_ReadDataDiag(ar->arHifDevice, address,
+                            (A_UCHAR *)&debug_hdr, length);
+        address = TARG_VTOP(ar->arTargetType, (A_UINT32)debug_hdr.dbuf);
+        firstbuf = address;
+        dropped = debug_hdr.dropped;
+        length = sizeof(struct dbglog_buf_s);
+        ar6000_ReadDataDiag(ar->arHifDevice, address,
+                            (A_UCHAR *)&debug_buf, length);
+
+        do {
+            address = TARG_VTOP(ar->arTargetType, (A_UINT32)debug_buf.buffer);
+            length = debug_buf.length;
+            if ((length) && (debug_buf.length <= debug_buf.bufsize)) {
+                /* Rewind the index if it is about to overrun the buffer */
+                if (ar->log_cnt > (DBGLOG_HOST_LOG_BUFFER_SIZE - length)) {
+                    ar->log_cnt = 0;
+                }
+                if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                    (A_UCHAR *)&ar->log_buffer[ar->log_cnt], length))
+                {
+                    break;
+                }
+                ar6000_dbglog_event(ar->arDev[0], dropped, (A_INT8*)&ar->log_buffer[ar->log_cnt], length);
+                ar->log_cnt += length;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_DBG_LOG,("Length: %d (Total size: %d)\n",
+                                debug_buf.length, debug_buf.bufsize));
+            }
+
+            address = TARG_VTOP(ar->arTargetType, (A_UINT32)debug_buf.next);
+            length = sizeof(struct dbglog_buf_s);
+            if(A_OK != ar6000_ReadDataDiag(ar->arHifDevice, address,
+                                (A_UCHAR *)&debug_buf, length))
+            {
+                break;
+            }
+
+        } while (address != firstbuf);
+    }
+
+    ar->dbgLogFetchInProgress = FALSE;
+
+    return A_OK;
+}
+
+void
+ar6000_dbglog_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 dropped,
+                    A_INT8 *buffer, A_UINT32 length)
+{
+#ifdef REPORT_DEBUG_LOGS_TO_APP
+    #define MAX_WIRELESS_EVENT_SIZE 252
+    /*
+     * Break it up into chunks of MAX_WIRELESS_EVENT_SIZE bytes of messages.
+     * There seems to be a limitation on the length of message that could be
+     * transmitted to the user app via this mechanism.
+     */
+    A_UINT32 send, sent;
+
+    sent = 0;
+    send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
+                                     MAX_WIRELESS_EVENT_SIZE);
+    while (send) {
+        ar6000_send_event_to_app(arPriv, WMIX_DBGLOG_EVENTID, (A_UINT8*)&buffer[sent], send);
+        sent += send;
+        send = dbglog_get_debug_fragment(&buffer[sent], length - sent,
+                                         MAX_WIRELESS_EVENT_SIZE);
+    }
+#else
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Dropped logs: 0x%x\nDebug info length: %d\n",
+                    dropped, length));
+
+    /* Interpret the debug logs */
+    dbglog_parse_debug_logs((A_INT8*)buffer, length);
+#endif /* REPORT_DEBUG_LOGS_TO_APP */
+}
+
+void
+ar6000_parse_dev_mode(A_CHAR *mode)
+{
+    A_UINT8 i, match = FALSE, mode_len;
+#ifdef P2P
+    A_UINT8 val_mode, val_submode;
+#endif
+    A_UINT8 num_submode;
+
+    char *valid_modes[] = { "sta",
+                            "ap",
+                            "ibss",
+                            "bt30amp",
+                            "sta,ap",
+                            "ap,sta",
+                            "ap,ap",
+                            "sta,sta",
+                            "sta,bt30amp",
+                            "sta,ap,ap"
+                    };
+#ifdef P2P
+    char *valid_submodes[] = { "none",
+                               "p2pdev",
+                               /*"p2pclient",*/ //persistent p2p support
+                               /*"p2pgo", */ // persistent p2p support
+                               "none,none",
+                               "none,none,none",
+                               "none,p2pdev",
+                               "p2pdev,none",
+                               /*"none,p2pclient",*/ //persistent p2p support
+                               /*"none,p2pgo"*/ // persistent p2p support
+                    };
+#endif
+    A_CHAR *dev_mode;
+    A_CHAR *str;
+    A_UINT32 host_int = 0;
+
+    dev_mode = mode;
+    str = mode;
+    num_device = 0;
+    fwmode = 0;
+
+    mode_len = strlen(dev_mode);
+    for (i=0; i <= 9; i++) {
+        if ((mode_len == strlen(valid_modes[i])) && (strcmp(dev_mode,valid_modes[i]))==0) {
+            match = TRUE;
+            break;
+        }
+    }
+
+    if(!match) {
+        num_device = fwmode = 1;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ERROR: Wrong mode. using default (single device STA mode).\n"));
+        return;
+    }
+
+    do
+    {
+        str++;
+        if(*str == ',' || *str == '\0') {
+            num_device++;
+            if(strncmp(dev_mode,"ap",2) == 0) {
+                host_int = HI_OPTION_FW_MODE_AP;
+            }
+            else if(strncmp(dev_mode,"sta",3) == 0) {
+                host_int = HI_OPTION_FW_MODE_BSS_STA;
+            }
+            else if(strncmp(dev_mode,"ibss",4) == 0 ) {
+                host_int = HI_OPTION_FW_MODE_IBSS;
+            } else if(strncmp(dev_mode,"bt30amp",7) == 0) {
+                host_int = HI_OPTION_FW_MODE_BT30AMP;
+            }
+
+            fwmode |= (host_int << ((num_device -1) * HI_OPTION_FW_MODE_BITS));
+            dev_mode = ++str;
+        }
+    }while(*dev_mode != '\0');
+
+    /* Validate submode if present */
+    if (!submode[0]) {
+        /* default "none" submode for all devices */
+        fwsubmode = 0;
+        return;
+    }
+
+    dev_mode = submode;
+    str = submode;
+    num_submode = 0;
+    fwsubmode = 0;
+    match = FALSE;
+
+#ifdef P2P
+    mode_len = strlen(dev_mode);
+    for (i=0; i<6; i++) {
+        if ((mode_len == strlen(valid_submodes[i])) && (strcmp(dev_mode,valid_submodes[i]))==0) {
+            match = TRUE;
+            break;
+        }
+    }
+
+    if (!match) {
+        fwsubmode = 0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ERROR: Wrong submode. using default (none for all devs).\n"));
+        return;
+    }
+
+    do
+    {
+        str++;
+        if(*str == ',' || *str == '\0') {
+            num_submode++;
+            if(strncmp(dev_mode,"none",4) == 0) {
+                host_int = HI_OPTION_FW_SUBMODE_NONE;
+            }
+            else if(strncmp(dev_mode,"p2pdev",6) == 0) {
+                host_int = HI_OPTION_FW_SUBMODE_P2PDEV;
+            }
+            else if(strncmp(dev_mode,"p2pclient",9) == 0 ) {
+                host_int = HI_OPTION_FW_SUBMODE_P2PCLIENT;
+            } else if(strncmp(dev_mode,"p2pgo",5) == 0 ) {
+                host_int = HI_OPTION_FW_SUBMODE_P2PGO;
+            }
+            fwsubmode |= (host_int << ((num_submode -1) * HI_OPTION_FW_SUBMODE_BITS));
+            dev_mode = ++str;
+        }
+    }while(*dev_mode != '\0');
+
+    /* Validate if the subopmode is specified for all the devs.
+     */
+    if (num_device != num_submode) {
+        /* default to "none" submode for all devices */
+        fwsubmode = 0;
+        return;
+    }
+
+    /* Validate if the submode specified is appropriate for the device modes
+     * specified for each device. The following is the validation recipe.
+     * fwmode        fwsubmode
+     * -----------------------
+     * IBSS          none
+     * STA           none,p2pdev,p2pclient
+     * AP            none,p2pgo
+     */
+    for (i=0; i<num_device; i++) {
+        val_mode = (fwmode >> (i * HI_OPTION_FW_MODE_BITS)) &
+                                              HI_OPTION_FW_MODE_MASK;
+        val_submode = (fwsubmode >> (i * HI_OPTION_FW_SUBMODE_BITS)) &
+                                              HI_OPTION_FW_SUBMODE_MASK;
+        switch (val_mode) {
+        case HI_OPTION_FW_MODE_IBSS:
+            if (val_submode != HI_OPTION_FW_SUBMODE_NONE) {
+                /* set submode to none */
+                fwsubmode &= ~(HI_OPTION_FW_SUBMODE_MASK << (i*HI_OPTION_FW_SUBMODE_BITS));
+                fwsubmode |= (HI_OPTION_FW_SUBMODE_NONE << (i * HI_OPTION_FW_SUBMODE_BITS));
+            }
+            break;
+
+        case HI_OPTION_FW_MODE_BSS_STA:
+            if (val_submode == HI_OPTION_FW_SUBMODE_P2PGO) {
+                /* set submode to none */
+                fwsubmode &= ~(HI_OPTION_FW_SUBMODE_MASK << (i*HI_OPTION_FW_SUBMODE_BITS));
+                fwsubmode |= (HI_OPTION_FW_SUBMODE_NONE << (i * HI_OPTION_FW_SUBMODE_BITS));
+            }
+
+            break;
+        case HI_OPTION_FW_MODE_AP:
+            if (val_submode == HI_OPTION_FW_SUBMODE_P2PDEV ||
+                  val_submode == HI_OPTION_FW_SUBMODE_P2PCLIENT) {
+                /* set submode to none */
+                fwsubmode &= ~(HI_OPTION_FW_SUBMODE_MASK << (i*HI_OPTION_FW_SUBMODE_BITS));
+                fwsubmode |= (HI_OPTION_FW_SUBMODE_NONE << (i * HI_OPTION_FW_SUBMODE_BITS));
+            }
+            break;
+
+        default:
+            break;
+        }
+    }
+#endif
+    return;
+}
+
+static int __init
+ar6000_init_module(void)
+{
+    static int probed = 0;
+    A_STATUS status;
+    OSDRV_CALLBACKS osdrvCallbacks;
+
+    a_module_debug_support_init();
+    printk("init-AR6003-driver 844\n");
+
+#ifdef DEBUG
+    /* check for debug mask overrides */
+    if (debughtc != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(htc,debughtc);
+    }
+    if (debugbmi != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(bmi,debugbmi);
+    }
+    if (debughif != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(hif,debughif);
+    }
+    if (debugdriver != 0) {
+        ATH_DEBUG_SET_DEBUG_MASK(driver,debugdriver);
+    }
+
+#endif
+
+    A_REGISTER_MODULE_DEBUG_INFO(driver);
+    ar6k_init = FALSE;
+    A_MEMZERO(&osdrvCallbacks,sizeof(osdrvCallbacks));
+    osdrvCallbacks.deviceInsertedHandler = ar6000_avail_ev;
+    osdrvCallbacks.deviceRemovedHandler = ar6000_unavail_ev;
+
+#ifdef CONFIG_PM
+    osdrvCallbacks.deviceSuspendHandler = ar6000_suspend_ev;
+    osdrvCallbacks.deviceResumeHandler = ar6000_resume_ev;
+    osdrvCallbacks.devicePowerChangeHandler = ar6000_power_change_ev;
+#endif
+
+    init_completion(&avail_ev_completion);
+
+    ar6000_pm_init();
+    if(devmode[0])
+        ar6000_parse_dev_mode(devmode);
+
+#ifdef ANDROID_ENV
+    android_module_init(&osdrvCallbacks);
+#endif
+
+#ifdef DEBUG
+    /* Set the debug flags if specified at load time */
+    if(debugflags != 0)
+    {
+        g_dbg_flags = debugflags;
+    }
+#endif
+
+    if (probed) {
+        return -ENODEV;
+    }
+    probed++;
+
+#ifdef CONFIG_HOST_GPIO_SUPPORT
+    ar6000_gpio_init();
+#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
+    status = HIFInit(&osdrvCallbacks);
+    if(status != A_OK)
+        return -ENODEV;
+
+    return 0;
+}
+
+#define AR6K_AVAIL_EV_COMPLETION_TIMEOUT    (60 * HZ)
+
+static void __exit
+ar6000_cleanup_module(void)
+{
+    int i = 0;
+    struct net_device *ar6000_netdev;
+    AR_SOFTC_T *ar;
+    AR_SOFTC_DEV_T *arPriv = NULL;
+    unsigned long tmo = AR6K_AVAIL_EV_COMPLETION_TIMEOUT;
+
+    if (!wait_event_interruptible_timeout(load_complete, mod_loaded != FALSE, 5 * HZ)) {
+        printk(KERN_ERR "Load did not complete. Unload did not proceed\n");
+        return;
+    } 
+    A_PRINTF("\nAR6K: %s()\n", __func__);
+
+    tmo = wait_for_completion_timeout(&avail_ev_completion, tmo);
+    if (tmo == 0) {
+        A_PRINTF("AR6K: wait for avail_ev_completion %d sec timeout\n",
+                  AR6K_AVAIL_EV_COMPLETION_TIMEOUT / HZ);
+    }
+
+    if (ar6000_devices[0] != NULL) {
+        arPriv = (AR_SOFTC_DEV_T *) ar6k_priv(ar6000_devices[0]);
+        ar = arPriv->arSoftc;
+        ar6000_cleanup(ar);
+    }
+    for (i=0; i < num_device; i++) {
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+        /* Delete the Adaptive Power Control timer */
+        if (timer_pending(&aptcTimer[i])) {
+            del_timer_sync(&aptcTimer[i]);
+        }
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+        if (ar6000_devices[i] != NULL) {
+            arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+            if (arPriv) {
+                A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+            }
+            ar6000_netdev = ar6000_devices[i];
+            ar6000_devices[i] = NULL;
+            ar6000_destroy(ar6000_netdev, 1);
+        }
+    }
+#ifdef P2P
+    p2p_deinit();
+#endif /* P2P */
+
+    HIFShutDownDevice(NULL);
+
+    a_module_debug_support_cleanup();
+
+    ar6000_pm_exit();
+
+
+#ifdef ANDROID_ENV
+    android_module_exit();
+#endif
+    a_meminfo_report(TRUE);
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_cleanup: success\n"));
+}
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+void
+aptcTimerHandler(unsigned long arg)
+{
+    A_UINT32 numbytes;
+    A_UINT32 throughput;
+    AR_SOFTC_T *ar;
+    A_STATUS status;
+    APTC_TRAFFIC_RECORD *aptcTR;
+    A_UNIT8 i;
+
+    ar = (AR_SOFTC_T *)arg;
+    A_ASSERT(ar != NULL);
+
+    for(i = 0; i < num_device; i++) {
+        aptcTR = ar->arDev[i].aptcTR;
+        A_ASSERT(!timer_pending(&aptcTimer[i]));
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+        /* Get the number of bytes transferred */
+        numbytes = aptcTR->bytesTransmitted + aptcTR->bytesReceived;
+        aptcTR->bytesTransmitted = aptcTR->bytesReceived = 0;
+
+        /* Calculate and decide based on throughput thresholds */
+        throughput = ((numbytes * 8)/APTC_TRAFFIC_SAMPLING_INTERVAL); /* Kbps */
+        if (throughput < APTC_LOWER_THROUGHPUT_THRESHOLD) {
+            /* Enable Sleep and delete the timer */
+            A_ASSERT(ar->arWmiReady == TRUE);
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            status = wmi_powermode_cmd(ar->arWmi, REC_POWER);
+            AR6000_SPIN_LOCK(&ar->arLock, 0);
+            A_ASSERT(status == A_OK);
+            aptcTR->timerScheduled = FALSE;
+        } else {
+            A_TIMEOUT_MS(&aptcTimer[i], APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
+        }
+
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+    }
+}
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+#ifdef ATH_AR6K_11N_SUPPORT
+static void
+ar6000_alloc_netbufs(A_NETBUF_QUEUE_T *q, A_UINT16 num)
+{
+    void * osbuf;
+
+    while(num) {
+        if((osbuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE))) {
+            A_NETBUF_ENQUEUE(q, osbuf);
+        } else {
+            break;
+        }
+        num--;
+    }
+
+    if(num) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s(), allocation of netbuf failed", __func__));
+    }
+}
+#endif
+
+static struct bin_attribute bmi_attr = {
+    .attr = {.name = "bmi", .mode = 0600},
+    .read = ar6000_sysfs_bmi_read,
+    .write = ar6000_sysfs_bmi_write,
+};
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+static ssize_t
+ar6000_sysfs_bmi_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count)
+#else
+static ssize_t
+ar6000_sysfs_bmi_read(struct file *fp, struct kobject *kobj,
+                      struct bin_attribute *bin_attr,
+                      char *buf, loff_t pos, size_t count)
+#endif
+{
+    int index;
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_T *ar = NULL;
+    HIF_DEVICE_OS_DEVICE_INFO *osDevInfo;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Read %d bytes\n", count));
+    for (index=0; index < num_device; index++) {
+        arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[index]);
+        ar = arPriv->arSoftc;
+        osDevInfo = &ar->osDevInfo;
+        if (kobj == (&(((struct device *)osDevInfo->pOSDevice)->kobj))) {
+            break;
+        }
+    }
+
+    if (ar == NULL) return 0;
+    if (index == num_device) return 0;
+
+    if ((BMIRawRead(ar->arHifDevice, (A_UCHAR*)buf, count, TRUE)) != A_OK) {
+        return 0;
+    }
+
+    return count;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+static ssize_t
+ar6000_sysfs_bmi_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count)
+#else
+static ssize_t
+ar6000_sysfs_bmi_write(struct file *fp, struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t pos, size_t count)
+#endif
+{
+    int index;
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_T *ar = NULL;
+    HIF_DEVICE_OS_DEVICE_INFO *osDevInfo;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Write %d bytes\n", count));
+    for (index=0; index < num_device; index++) {
+        arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[index]);
+        ar = arPriv->arSoftc;
+        osDevInfo = &ar->osDevInfo;
+        if (kobj == (&(((struct device *)osDevInfo->pOSDevice)->kobj))) {
+            break;
+        }
+    }
+
+    if (ar == NULL) return 0;
+    if (index == num_device) return 0;
+
+    if ((BMIRawWrite(ar->arHifDevice, (A_UCHAR*)buf, count)) != A_OK) {
+        return 0;
+    }
+
+    return count;
+}
+
+static A_STATUS
+ar6000_sysfs_bmi_init(AR_SOFTC_T *ar)
+{
+    A_STATUS status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Creating sysfs entry\n"));
+    A_MEMZERO(&ar->osDevInfo, sizeof(HIF_DEVICE_OS_DEVICE_INFO));
+
+    /* Get the underlying OS device */
+    status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_GET_OS_DEVICE,
+                                &ar->osDevInfo,
+                                sizeof(HIF_DEVICE_OS_DEVICE_INFO));
+
+    if (A_FAILED(status)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI: Failed to get OS device info from HIF\n"));
+        return A_ERROR;
+    }
+
+    /* Create a bmi entry in the sysfs filesystem */
+    if ((sysfs_create_bin_file(&(((struct device *)ar->osDevInfo.pOSDevice)->kobj), &bmi_attr)) < 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMI: Failed to create entry for bmi in sysfs filesystem\n"));
+        return A_ERROR;
+    }
+
+    return A_OK;
+}
+
+static void
+ar6000_sysfs_bmi_deinit(AR_SOFTC_T *ar)
+{
+    if (ar->osDevInfo.pOSDevice) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Deleting sysfs entry\n"));
+        sysfs_remove_bin_file(&(((struct device *)ar->osDevInfo.pOSDevice)->kobj), &bmi_attr);
+        ar->osDevInfo.pOSDevice = NULL;
+    }
+}
+
+#define bmifn(fn) do { \
+    if ((fn) < A_OK) { \
+        A_PRINTF("BMI operation failed: %d\n", __LINE__); \
+        return A_ERROR; \
+    } \
+} while(0)
+
+#ifdef INIT_MODE_DRV_ENABLED
+
+#define MCKINLEY_MAC_ADDRESS_OFFSET   0x16
+static
+void calculate_crc(A_UINT32 TargetType, A_UCHAR *eeprom_data, size_t eeprom_size)
+{
+    A_UINT16 *ptr_crc;
+    A_UINT16 *ptr16_eeprom;
+    A_UINT16 checksum;
+    A_UINT32 i;
+
+    if (TargetType == TARGET_TYPE_AR6001)
+    {
+        ptr_crc = (A_UINT16 *)eeprom_data;
+    }
+    else if (TargetType == TARGET_TYPE_AR6003)
+    {
+        ptr_crc = (A_UINT16 *)((A_UCHAR *)eeprom_data + 0x04);
+    }
+    else if (TargetType == TARGET_TYPE_MCKINLEY)
+    {
+        eeprom_size = 1024;
+        ptr_crc = (A_UINT16 *)((A_UCHAR *)eeprom_data + 0x04);
+    }
+    else
+    {
+        ptr_crc = (A_UINT16 *)((A_UCHAR *)eeprom_data + 0x04);
+    }
+
+
+    // Clear the crc
+    *ptr_crc = 0;
+
+    // Recalculate new CRC
+    checksum = 0;
+    ptr16_eeprom = (A_UINT16 *)eeprom_data;
+    for (i = 0;i < eeprom_size; i += 2)
+    {
+        checksum = checksum ^ (*ptr16_eeprom);
+        ptr16_eeprom++;
+    }
+    checksum = 0xFFFF ^ checksum;
+    *ptr_crc = checksum;
+}
+
+#ifdef SOFTMAC_USED
+#define AR6002_MAC_ADDRESS_OFFSET     0x0A
+#define AR6003_MAC_ADDRESS_OFFSET     0x16
+
+static void
+ar6000_softmac(AR_SOFTC_T *ar, A_UCHAR *eeprom_data, size_t eeprom_size)
+{
+    A_UCHAR *ptr_mac;
+    switch (ar->arTargetType) {
+    case TARGET_TYPE_AR6002:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + AR6002_MAC_ADDRESS_OFFSET);
+        break;
+    case TARGET_TYPE_AR6003:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + AR6003_MAC_ADDRESS_OFFSET);
+        break;
+    case TARGET_TYPE_MCKINLEY:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + MCKINLEY_MAC_ADDRESS_OFFSET);
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Target Type \n"));
+        return;
+    }
+    ptr_mac[0] = ambarella_board_generic.wifi0_mac[0];
+    ptr_mac[1] = ambarella_board_generic.wifi0_mac[1];
+    ptr_mac[2] = ambarella_board_generic.wifi0_mac[2];
+    ptr_mac[3] = ambarella_board_generic.wifi0_mac[3];
+    ptr_mac[4] = ambarella_board_generic.wifi0_mac[4];
+    ptr_mac[5] = ambarella_board_generic.wifi0_mac[5];
+
+    if (0==memcmp(ptr_mac, "\0\0\0\0\0\0",6)) {
+        ptr_mac[0] = 0x00;
+        ptr_mac[1] = 0x03;
+        ptr_mac[2] = 0x7F;
+        ptr_mac[3] = random32() & 0xff;
+        ptr_mac[4] = random32() & 0xff;
+        ptr_mac[5] = random32() & 0xff;
+        //memcpy(ptr_mac+3, "\3\4\5", 3);
+
+        ambarella_board_generic.wifi0_mac[0] = ptr_mac[0];
+        ambarella_board_generic.wifi0_mac[1] = ptr_mac[1];
+        ambarella_board_generic.wifi0_mac[2] = ptr_mac[2];
+        ambarella_board_generic.wifi0_mac[3] = ptr_mac[3];
+        ambarella_board_generic.wifi0_mac[4] = ptr_mac[4];
+        ambarella_board_generic.wifi0_mac[5] = ptr_mac[5];
+    }
+
+    calculate_crc(ar->arTargetType, eeprom_data, eeprom_size);
+}
+#endif
+
+#ifdef SOFTMAC_FILE_USED
+#define AR6002_MAC_ADDRESS_OFFSET     0x0A
+#define AR6003_MAC_ADDRESS_OFFSET     0x16
+static void
+ar6000_softmac_update(AR_SOFTC_T *ar, A_UCHAR *eeprom_data, size_t eeprom_size)
+{
+    /* We need to store the MAC, which comes either from the softmac file or is
+     * randomly generated, because we do not want to load a new MAC address
+     * if the chip goes into suspend and then is resumed later on.  We ONLY
+     * want to load a new MAC  if the driver is unloaded and then reloaded
+     */
+    static A_UCHAR random_mac[6];
+    const char *source = "random generated";
+    const struct firmware *softmac_entry;
+    A_UCHAR *ptr_mac;
+    switch (ar->arTargetType) {
+    case TARGET_TYPE_AR6002:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + AR6002_MAC_ADDRESS_OFFSET);
+        break;
+    case TARGET_TYPE_AR6003:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + AR6003_MAC_ADDRESS_OFFSET);
+        break;
+    case TARGET_TYPE_MCKINLEY:
+        ptr_mac = (A_UINT8 *)((A_UCHAR *)eeprom_data + MCKINLEY_MAC_ADDRESS_OFFSET);
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Target Type \n"));
+        return;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                ("MAC from EEPROM %02X:%02X:%02X:%02X:%02X:%02X\n",
+                ptr_mac[0], ptr_mac[1], ptr_mac[2],
+                ptr_mac[3], ptr_mac[4], ptr_mac[5]));
+
+    if (memcmp(random_mac, "\0\0\0\0\0\0", 6)!=0) {
+        memcpy(ptr_mac, random_mac, 6);
+    } else {
+        /* create a random MAC in case we cannot read file from system */
+        ptr_mac[0] = random_mac[0] = 2; /* locally administered */
+        ptr_mac[1] = random_mac[1] = 0x03;
+        ptr_mac[2] = random_mac[2] = 0x7F;
+        ptr_mac[3] = random_mac[3] = random32() & 0xff;
+        ptr_mac[4] = random_mac[4] = random32() & 0xff;
+        ptr_mac[5] = random_mac[5] = random32() & 0xff;
+    }
+#if defined(CONFIG_ARCH_MSM9615)
+    if ((A_REQUEST_FIRMWARE(&softmac_entry, "ath6k/AR6003/hw2.1.1/softmac", ((struct device *)ar->osDevInfo.pOSDevice))) == 0)
+#else
+    if ((A_REQUEST_FIRMWARE(&softmac_entry, "softmac", ((struct device *)ar->osDevInfo.pOSDevice))) == 0)
+#endif
+    {
+        A_CHAR *macbuf = A_MALLOC_NOWAIT(softmac_entry->size+1);
+        if (macbuf) {
+            unsigned int softmac[6];
+            memcpy(macbuf, softmac_entry->data, softmac_entry->size);
+            macbuf[softmac_entry->size] = '\0';
+            if (sscanf(macbuf, "%02x:%02x:%02x:%02x:%02x:%02x",
+                        &softmac[0], &softmac[1], &softmac[2],
+                        &softmac[3], &softmac[4], &softmac[5])==6) {
+                int i;
+                for (i=0; i<6; ++i) {
+                    ptr_mac[i] = softmac[i] & 0xff;
+                }
+                source = "softmac file";
+                A_MEMZERO(random_mac, sizeof(random_mac));
+            }
+            A_FREE(macbuf);
+        }
+        A_RELEASE_FIRMWARE(softmac_entry);
+    }
+
+    if (memcmp(random_mac, "\0\0\0\0\0\0", 6)!=0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Warning! Random MAC address is just for testing purpose\n"));
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN,
+                    ("MAC from %s %02X:%02X:%02X:%02X:%02X:%02X\n",  source,
+                     ptr_mac[0], ptr_mac[1], ptr_mac[2],
+                     ptr_mac[3], ptr_mac[4], ptr_mac[5]));
+    calculate_crc(ar->arTargetType, eeprom_data, eeprom_size);
+}
+#endif /* SOFTMAC_FILE_USED */
+
+static void
+ar6000_reg_update(AR_SOFTC_T *ar, A_UCHAR *eeprom_data, size_t eeprom_size, int regCode)
+{
+    A_UCHAR *ptr_reg;
+    switch (ar->arTargetType) {
+    case TARGET_TYPE_AR6002:
+        ptr_reg = (A_UINT8 *)((A_UCHAR *)eeprom_data + 8);
+        break;
+    case TARGET_TYPE_AR6003:
+        ptr_reg = (A_UINT8 *)((A_UCHAR *)eeprom_data + 12);
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Invalid Target Type \n"));
+        return;
+    }
+
+    ptr_reg[0] = (A_UCHAR)(regCode&0xFF);
+    ptr_reg[1] = (A_UCHAR)((regCode>>8)&0xFF);
+    calculate_crc(ar->arTargetType, eeprom_data, eeprom_size);
+}
+
+#ifdef ANDROID_ENV
+static void
+ar6000_psminfo_update(void)
+{
+	char psm_filename[256];
+
+    do {
+        int ret = 0;
+        size_t length;
+        u8 *pdata = NULL;
+
+        snprintf(psm_filename, sizeof(psm_filename), "/data/.psm.info");
+
+		if ( (ret = android_readwrite_file(psm_filename, NULL, NULL, 0)) < 0) {
+            break;
+        } else {
+            length = ret;
+        }
+        pdata = vmalloc(length);
+        if (!pdata) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: Cannot allocate buffer for psm_info (%d)\n", __FUNCTION__,length));
+            break;
+        }
+
+		if ( android_readwrite_file(psm_filename, (char*)pdata, NULL, length) != length) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: file read error, length %d\n", __FUNCTION__, length));
+            vfree(pdata);
+            break;
+        }
+        psm_info = *pdata - '0';
+		AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s: psm_info is %d\n", __FUNCTION__, psm_info));
+        vfree(pdata);
+    } while (0);
+}
+#endif
+
+
+static A_STATUS
+ar6000_transfer_bin_file(AR_SOFTC_T *ar, AR6K_BIN_FILE file, A_UINT32 address, A_BOOL compressed)
+{
+    A_STATUS status;
+    const char *filename;
+    const struct firmware *fw_entry;
+    A_UINT32 fw_entry_size;
+    A_UCHAR *tempEeprom;
+    A_UINT32 board_data_size;
+
+    switch (file) {
+    case AR6K_OTP_FILE:
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            filename = AR6003_REV2_OTP_FILE;
+        } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+            filename = AR6003_REV3_OTP_FILE;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+            return A_ERROR;
+        }
+        break;
+
+    case AR6K_FIRMWARE_FILE:
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            filename = AR6003_REV2_FIRMWARE_FILE;
+        } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+		if(ar->arVersion.targetconf_ver == AR6003_SUBVER_ROUTER)
+                filename = AR6003_REV3_ROUTER_FIRMWARE_FILE;
+            else if (ar->arVersion.targetconf_ver == AR6003_SUBVER_MOBILE)
+                filename = AR6003_REV3_MOBILE_FIRMWARE_FILE;
+            else if (ar->arVersion.targetconf_ver == AR6003_SUBVER_TABLET)
+                filename = AR6003_REV3_TABLET_FIRMWARE_FILE;
+            else
+                filename = AR6003_REV3_DEFAULT_FIRMWARE_FILE;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+            return A_ERROR;
+        }
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s firmware will be loaded\n", filename));
+
+
+        if (eppingtest) {
+            bypasswmi = TRUE;
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_EPPING_FIRMWARE_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                filename = AR6003_REV3_EPPING_FIRMWARE_FILE;
+            } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("eppingtest : unsupported firmware revision: %d\n",
+                        ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            compressed = 0;
+        }
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+            if(testmode == 1) {
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_TCMD_FIRMWARE_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                filename = AR6003_REV3_TCMD_FIRMWARE_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            compressed = 0;
+        }
+#endif
+#ifdef HTC_RAW_INTERFACE
+        if (!eppingtest && bypasswmi) {
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_ART_FIRMWARE_FILE;
+            } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                filename = AR6003_REV3_ART_FIRMWARE_FILE;
+            } else {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+                return A_ERROR;
+            }
+            compressed = 0;
+        }
+#endif
+        break;
+
+    case AR6K_PATCH_FILE:
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            filename = AR6003_REV2_PATCH_FILE;
+        } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+            filename = AR6003_REV3_PATCH_FILE;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+            return A_ERROR;
+        }
+        break;
+
+    case AR6K_BOARD_DATA_FILE:
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            filename = AR6003_REV2_BOARD_DATA_FILE;
+        } else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                filename = AR6003_REV3_BOARD_DATA_FILE;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown firmware revision: %d\n", ar->arVersion.target_ver));
+            return A_ERROR;
+        }
+        break;
+
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown file type: %d\n", file));
+        return A_ERROR;
+    }
+    if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+        return A_ENOENT;
+    }
+
+    fw_entry_size = fw_entry->size;
+    tempEeprom = NULL;
+
+    /* Load extended board data for AR6003 */
+    if ((file==AR6K_BOARD_DATA_FILE) && (fw_entry->data)) {
+        A_UINT32 board_ext_address;
+        A_INT32 board_ext_data_size;
+
+        tempEeprom = A_MALLOC_NOWAIT(fw_entry->size);
+        if (!tempEeprom) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Memory allocation failed\n"));
+            A_RELEASE_FIRMWARE(fw_entry);
+            return A_ERROR;
+        }
+
+        board_data_size = (((ar)->arTargetType == TARGET_TYPE_AR6002) ? AR6002_BOARD_DATA_SZ : \
+                          (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_BOARD_DATA_SZ : 0));
+
+        board_ext_data_size = 0;
+        if (ar->arTargetType == TARGET_TYPE_AR6002) {
+            board_ext_data_size = AR6002_BOARD_EXT_DATA_SZ;
+        } else if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                board_ext_data_size = AR6003_VER2_BOARD_EXT_DATA_SZ;
+            } else {
+                board_ext_data_size = AR6003_BOARD_EXT_DATA_SZ;
+            }
+        }
+
+        /* AR6003 2.1.1 support 1792 bytes and 2048 bytes board file */
+        if ((board_ext_data_size) &&
+            (fw_entry->size < (board_data_size + board_ext_data_size)))
+        {
+            board_ext_data_size = fw_entry->size - board_data_size;
+            if (board_ext_data_size < 0) {
+                board_ext_data_size = 0;
+            }
+        }
+
+        A_MEMCPY(tempEeprom, (A_UCHAR *)fw_entry->data, fw_entry->size);
+
+#ifdef SOFTMAC_FILE_USED
+        ar6000_softmac_update(ar, tempEeprom, board_data_size);
+#endif
+#ifdef SOFTMAC_USED
+        ar6000_softmac(ar, tempEeprom, board_data_size);
+#endif
+
+        if (regcode!=0) {
+            ar6000_reg_update(ar, tempEeprom, board_data_size, regcode);
+        }
+
+#ifdef ANDROID_ENV
+        ar6000_psminfo_update();
+#endif
+        /* Determine where in Target RAM to write Board Data */
+        bmifn(BMIReadMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_ext_data), (A_UCHAR *)&board_ext_address, 4));
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board extended Data download address: 0x%x\n", board_ext_address));
+
+        /* check whether the target has allocated memory for extended board data and file contains extended board data */
+        if ((board_ext_address) && (fw_entry->size == (board_data_size + board_ext_data_size))) {
+            A_UINT32 param;
+
+            status = BMIWriteMemory(ar->arHifDevice, board_ext_address, (A_UCHAR *)(((A_UINT32)tempEeprom) + board_data_size), board_ext_data_size);
+
+            if (status != A_OK) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+                A_RELEASE_FIRMWARE(fw_entry);
+                return A_ERROR;
+            }
+
+            /* Record the fact that extended board Data IS initialized */
+            param = (board_ext_data_size << 16) | 1;
+            bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_ext_data_config), (A_UCHAR *)&param, 4));
+        }
+        fw_entry_size = board_data_size;
+    }
+
+    if (compressed) {
+        status = BMIFastDownload(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry_size);
+    } else {
+        if (file==AR6K_BOARD_DATA_FILE && fw_entry->data)
+        {
+            status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)tempEeprom, fw_entry_size);
+        }
+        else
+        {
+        status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry_size);
+        }
+    }
+
+    if (tempEeprom) {
+        A_FREE(tempEeprom);
+    }
+
+    if (status != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI operation failed: %d\n", __LINE__));
+        A_RELEASE_FIRMWARE(fw_entry);
+        return A_ERROR;
+    }
+    A_RELEASE_FIRMWARE(fw_entry);
+    return A_OK;
+}
+#endif /* INIT_MODE_DRV_ENABLED */
+
+A_STATUS
+ar6000_update_bdaddr(AR_SOFTC_T *ar)
+{
+
+    if (setupbtdev != 0) {
+        A_UINT32 address;
+
+           if (BMIReadMemory(ar->arHifDevice,
+           	HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_data), (A_UCHAR *)&address, 4) != A_OK)
+           {
+    	      	AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for hi_board_data failed\n"));
+            return A_ERROR;
+        }
+
+           if (BMIReadMemory(ar->arHifDevice, address + BDATA_BDADDR_OFFSET, (A_UCHAR *)ar->bdaddr, 6) != A_OK)
+           {
+    	    	AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for BD address failed\n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BDADDR 0x%x:0x%x:0x%x:0x%x:0x%x:0x%x\n", ar->bdaddr[0],
+                        ar->bdaddr[1], ar->bdaddr[2], ar->bdaddr[3],
+                        ar->bdaddr[4], ar->bdaddr[5]));
+    }
+
+return A_OK;
+}
+
+A_STATUS
+ar6000_sysfs_bmi_get_config(AR_SOFTC_T *ar, A_UINT32 mode)
+{
+#if defined(INIT_MODE_DRV_ENABLED) && defined(CONFIG_HOST_TCMD_SUPPORT)
+    const char *filename;
+    const struct firmware *fw_entry;
+#endif
+
+	AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("BMI: Requesting device specific configuration\n"));
+
+    if (mode == WLAN_INIT_MODE_UDEV) {
+        A_CHAR version[16];
+        const struct firmware *fw_entry;
+
+        /* Get config using udev through a script in user space */
+        if (snprintf(version, sizeof(version), "%2.2x", 
+                       ar->arVersion.target_ver) >= sizeof(version)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("snprintf: Target version-%2.2x\n",
+                       ar->arVersion.target_ver));
+            return A_ERROR;
+        } 
+        if ((A_REQUEST_FIRMWARE(&fw_entry, version, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("BMI: Failure to get configuration for target version: %s\n", version));
+            return A_ERROR;
+        }
+
+        A_RELEASE_FIRMWARE(fw_entry);
+#ifdef INIT_MODE_DRV_ENABLED
+    } else {
+        /* The config is contained within the driver itself */
+        A_STATUS status;
+        A_UINT32 param, options, sleep, address;
+
+        /* Temporarily disable system sleep */
+        address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_OFFSET;
+        bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+        options = param;
+        param |= AR6K_OPTION_SLEEP_DISABLE;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        address = RTC_WMAC_BASE_ADDRESS + WLAN_SYSTEM_SLEEP_OFFSET;
+        bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+        sleep = param;
+        param |= WLAN_SYSTEM_SLEEP_DISABLE_SET(1);
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("old options: %d, old sleep: %d\n", options, sleep));
+
+        if (ar->arTargetType == TARGET_TYPE_MCKINLEY) {
+            /* Run at 40/44MHz by default */
+            param = CPU_CLOCK_STANDARD_SET(0);
+        } else if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            /* Program analog PLL register */
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, ANALOG_INTF_BASE_ADDRESS + 0x284, 0xF9104001));
+            /* Run at 80/88MHz by default */
+            param = CPU_CLOCK_STANDARD_SET(1);
+        } else {
+            /* Run at 40/44MHz by default */
+            param = CPU_CLOCK_STANDARD_SET(0);
+        }
+        address = RTC_SOC_BASE_ADDRESS + CPU_CLOCK_OFFSET;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        param = 0;
+        if (ar->arTargetType == TARGET_TYPE_AR6002) {
+            bmifn(BMIReadMemory(ar->arHifDevice,
+                                HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_ext_clk_detected),
+                                (A_UCHAR *)&param, 4));
+        }
+
+        /* LPO_CAL.ENABLE = 1 if no external clk is detected */
+        if (param != 1) {
+            address = RTC_SOC_BASE_ADDRESS + LPO_CAL_OFFSET;
+            param = LPO_CAL_ENABLE_SET(1);
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+
+        /* Venus2.0: Lower SDIO pad drive strength */
+        if ((ar->arVersion.target_ver == AR6003_REV2_VERSION) ||
+            (ar->arVersion.target_ver == AR6003_REV3_VERSION))
+        {
+            param = 0x28;
+            address = GPIO_BASE_ADDRESS + GPIO_PIN9_OFFSET;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            param = 0x20;
+            address = GPIO_BASE_ADDRESS + GPIO_PIN10_OFFSET;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN11_OFFSET;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN12_OFFSET;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+            address = GPIO_BASE_ADDRESS + GPIO_PIN13_OFFSET;
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+
+        /* Change the clock with module parameter refclock Mhz */
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, 0x540678, refClock));
+
+#ifdef FORCE_INTERNAL_CLOCK
+        /* Ignore external clock, if any, and force use of internal clock */
+        if (ar->arTargetType == TARGET_TYPE_AR6003 || ar->arTargetType == TARGET_TYPE_MCKINLEY) {
+            /* hi_ext_clk_detected = 0 */
+            param = 0;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+                                 HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_ext_clk_detected),
+                                 (A_UCHAR *)&param, 4));
+
+            /* CLOCK_CONTROL &= ~LF_CLK32 */
+            address = RTC_BASE_ADDRESS + CLOCK_CONTROL_ADDRESS;
+            bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+            param &= (~CLOCK_CONTROL_LF_CLK32_SET(1));
+            bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+        }
+#endif /* FORCE_INTERNAL_CLOCK */
+
+        /* Transfer Board Data from Target EEPROM to Target RAM */
+        if (ar->arTargetType == TARGET_TYPE_AR6003 || ar->arTargetType == TARGET_TYPE_MCKINLEY) {
+            /* Determine where in Target RAM to write Board Data */
+            bmifn(BMIReadMemory(ar->arHifDevice,
+                                HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_data),
+                                (A_UCHAR *)&address, 4));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Board Data download address: 0x%x\n", address));
+
+            /* Write EEPROM data to Target RAM */
+            if ((status=ar6000_transfer_bin_file(ar, AR6K_BOARD_DATA_FILE, address, FALSE)) != A_OK) {
+                return A_ERROR;
+            }
+
+            /* Record the fact that Board Data IS initialized */
+            param = 1;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+                                 HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_data_initialized),
+                                 (A_UCHAR *)&param, 4));
+
+            /* Transfer One time Programmable data */
+            AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+            if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                address = BMI_SEGMENTED_WRITE_ADDR;
+            }
+            status = ar6000_transfer_bin_file(ar, AR6K_OTP_FILE, address, TRUE);
+            if (status == A_OK) {
+                /* Execute the OTP code */
+#ifdef SOFTMAC_FILE_USED
+                param = 1;
+#else
+                param = 0;
+#endif
+
+#ifdef SOFTMAC_USED
+                param = 1;
+#else
+                param = 0;
+#endif
+
+                if (regcode != 0)
+                    param |= 0x2;
+                AR6K_APP_START_OVERRIDE_ADDRESS(address, ar->arVersion.target_ver);
+                bmifn(BMIExecute(ar->arHifDevice, address, &param));
+            } else if (status != A_ENOENT) {
+                return A_ERROR;
+            }
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Programming of board data for chip %d not supported\n", ar->arTargetType));
+            return A_ERROR;
+        }
+
+        /* Download Target firmware */
+        AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+        if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+            address = BMI_SEGMENTED_WRITE_ADDR;
+        }
+        if ((ar6000_transfer_bin_file(ar, AR6K_FIRMWARE_FILE, address, TRUE)) != A_OK) {
+            return A_ERROR;
+        }
+
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION)
+        {
+            /* Set starting address for firmware */
+            AR6K_APP_START_OVERRIDE_ADDRESS(address, ar->arVersion.target_ver);
+            bmifn(BMISetAppStart(ar->arHifDevice, address));
+        }
+
+        /* Apply the patches */
+        if (ar->arTargetType == TARGET_TYPE_AR6003) {
+            AR6K_DATASET_PATCH_ADDRESS(address, ar->arVersion.target_ver);
+            if ((ar6000_transfer_bin_file(ar, AR6K_PATCH_FILE, address, FALSE)) != A_OK) {
+                return A_ERROR;
+            }
+            param = address;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+                             HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_dset_list_head),
+                             (A_UCHAR *)&param, 4));
+        }
+
+        /* Restore system sleep */
+        address = RTC_WMAC_BASE_ADDRESS + WLAN_SYSTEM_SLEEP_OFFSET;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, sleep));
+
+        address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_OFFSET;
+        param = options | 0x20;
+        bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+        if (ar->arTargetType == TARGET_TYPE_AR6003 || ar->arTargetType == TARGET_TYPE_MCKINLEY) {
+            /* Configure GPIO AR6003 UART */
+#ifndef CONFIG_AR600x_DEBUG_UART_TX_PIN
+#define CONFIG_AR600x_DEBUG_UART_TX_PIN 8
+#endif
+            param = CONFIG_AR600x_DEBUG_UART_TX_PIN;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+                                 HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_dbg_uart_txpin),
+                                 (A_UCHAR *)&param, 4));
+
+#if (CONFIG_AR600x_DEBUG_UART_TX_PIN == 23)
+            if (ATH_REGISTER_SUPPORTED_BY_TARGET(CLOCK_GPIO_OFFSET)) {
+                address = GPIO_BASE_ADDRESS + CLOCK_GPIO_OFFSET;
+                bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+                param |= CLOCK_GPIO_BT_CLK_OUT_EN_SET(1);
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+            } else {
+                /* AR6004 has no need for a CLOCK_GPIO register */
+            }
+#endif
+
+            /* Configure GPIO for BT Reset */
+#ifdef ATH6KL_CONFIG_GPIO_BT_RESET
+#define CONFIG_AR600x_BT_RESET_PIN  0x16
+            param = CONFIG_AR600x_BT_RESET_PIN;
+            bmifn(BMIWriteMemory(ar->arHifDevice,
+                                 HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_hci_uart_support_pins),
+                                 (A_UCHAR *)&param, 4));
+#endif /* ATH6KL_CONFIG_GPIO_BT_RESET */
+
+            /* Configure UART flow control polarity */
+#ifndef CONFIG_ATH6KL_BT_UART_FC_POLARITY
+#define CONFIG_ATH6KL_BT_UART_FC_POLARITY 0
+#endif
+
+#if (CONFIG_ATH6KL_BT_UART_FC_POLARITY == 1)
+            if ((ar->arVersion.target_ver == AR6003_REV2_VERSION) ||
+                (ar->arVersion.target_ver == AR6003_REV3_VERSION))
+            {
+                param = ((CONFIG_ATH6KL_BT_UART_FC_POLARITY << 1) & 0x2);
+                bmifn(BMIWriteMemory(ar->arHifDevice, HOST_INTEREST_ITEM_ADDRESS(ar, hi_hci_uart_pwr_mgmt_params), (A_UCHAR *)&param, 4));
+            }
+#endif /* CONFIG_ATH6KL_BT_UART_FC_POLARITY */
+        }
+#ifdef HTC_RAW_INTERFACE
+        if (!eppingtest && bypasswmi) {
+            /* Don't run BMIDone for ART mode and force resetok=0 */
+            resetok = 0;
+            msleep(1000);
+            param = 1;
+            status = BMIWriteMemory(ar->arHifDevice,
+                                    HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_data_initialized),
+                                    (A_UCHAR *)&param, 4);
+        }
+#endif /* HTC_RAW_INTERFACE */
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+        if (testmode == 2) {
+            if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+                filename = AR6003_REV2_UTF_FIRMWARE_FILE;
+                if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+                    return A_ENOENT;
+                }
+                /* Download Target firmware */
+                AR6K_APP_LOAD_ADDRESS(address, ar->arVersion.target_ver);
+                status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry->size);
+
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_end_RAM_reserve_sz);
+                param = 11008;
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+                address = 0x57D884;
+                filename = AR6003_REV2_TESTSCRIPT_FILE;
+                if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+                    return A_ENOENT;
+                }
+                status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry->size);
+
+                param = 0x57D884;
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_ota_testscript);
+                bmifn(BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)&param, 4));
+
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_test_apps_related);
+                bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+                param |= 1;
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+                A_RELEASE_FIRMWARE(fw_entry);
+            }
+	    else if (ar->arVersion.target_ver == AR6003_REV3_VERSION) {
+                filename = AR6003_REV3_UTF_FIRMWARE_FILE;
+                if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+                    return A_ENOENT;
+                }
+                /* Download Target firmware */
+                address = BMI_SEGMENTED_WRITE_ADDR;
+                status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry->size);
+
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_end_RAM_reserve_sz);
+                param = 4096;
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+                address = 0x57EF74;
+                filename = AR6003_REV3_TESTSCRIPT_FILE;
+                if ((A_REQUEST_FIRMWARE(&fw_entry, filename, ((struct device *)ar->osDevInfo.pOSDevice))) != 0)
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get %s\n", filename));
+                    return A_ENOENT;
+                }
+                status = BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)fw_entry->data, fw_entry->size);
+
+                param = 0x57EF74;
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_ota_testscript);
+                bmifn(BMIWriteMemory(ar->arHifDevice, address, (A_UCHAR *)&param, 4));
+
+                address = HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_test_apps_related);
+                bmifn(BMIReadSOCRegister(ar->arHifDevice, address, &param));
+                param |= 1;
+                bmifn(BMIWriteSOCRegister(ar->arHifDevice, address, param));
+
+                A_RELEASE_FIRMWARE(fw_entry);
+            }
+        }
+#endif
+#endif /* INIT_MODE_DRV_ENABLED */
+    }
+
+    return A_OK;
+}
+
+A_STATUS
+ar6000_configure_target(AR_SOFTC_T *ar)
+{
+    A_UINT32 param;
+    if (enableuartprint) {
+        param = 1;
+        if (BMIWriteMemory(ar->arHifDevice,
+                           HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_serial_enable),
+                           (A_UCHAR *)&param,
+                           4)!= A_OK)
+        {
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for enableuartprint failed \n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Serial console prints enabled\n"));
+    }
+
+    /* Tell target which HTC version it is used*/
+    param = HTC_PROTOCOL_VERSION;
+    if (BMIWriteMemory(ar->arHifDevice,
+                       HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_app_host_interest),
+                       (A_UCHAR *)&param,
+                       4)!= A_OK)
+    {
+         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for htc version failed \n"));
+        return A_ERROR;
+    }
+
+    if (enabletimerwar) {
+        A_UINT32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4)!= A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for enabletimerwar failed \n"));
+            return A_ERROR;
+        }
+
+        param |= HI_OPTION_TIMER_WAR;
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for enabletimerwar failed \n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Timer WAR enabled\n"));
+    }
+
+    /* set the firmware mode to STA/IBSS/AP */
+    {
+        A_UINT32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4)!= A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for setting fwmode failed \n"));
+            return A_ERROR;
+        }
+
+        param |= (num_device << HI_OPTION_NUM_DEV_SHIFT);
+        param |= (fwmode << HI_OPTION_FW_MODE_SHIFT);
+        param |= (mac_addr_method << HI_OPTION_MAC_ADDR_METHOD_SHIFT);
+        param |= (firmware_bridge << HI_OPTION_FW_BRIDGE_SHIFT);
+        param |= (fwsubmode << HI_OPTION_FW_SUBMODE_SHIFT);
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("NUM_DEV=%d FWMODE=0x%x FWSUBMODE=0x%x FWBR_BUF %d\n",
+                            num_device, fwmode, fwsubmode, firmware_bridge));
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for setting fwmode failed \n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Firmware mode set\n"));
+    }
+#ifdef ATH6KL_DISABLE_TARGET_DBGLOGS
+     {
+        A_UINT32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4)!= A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for disabling debug logs failed\n"));
+            return A_ERROR;
+        }
+
+        param |= HI_OPTION_DISABLE_DBGLOG;
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for HI_OPTION_DISABLE_DBGLOG\n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Firmware mode set\n"));
+    }
+#endif /* ATH6KL_DISABLE_TARGET_DBGLOGS */
+
+    if (regscanmode) {
+        A_UINT32 param;
+
+        if (BMIReadMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4)!= A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIReadMemory for setting regscanmode failed\n"));
+            return A_ERROR;
+        }
+
+        if (regscanmode == 1) {
+            param |= HI_OPTION_SKIP_REG_SCAN;
+        } else if (regscanmode == 2) {
+            param |= HI_OPTION_INIT_REG_SCAN;
+        }
+
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_option_flag),
+            (A_UCHAR *)&param,
+            4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for setting regscanmode failed\n"));
+            return A_ERROR;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Regulatory scan mode set\n"));
+    }
+
+    /*
+     * Hardcode the address use for the extended board data
+     * Ideally this should be pre-allocate by the OS at boot time
+     * But since it is a new feature and board data is loaded
+     * at init time, we have to workaround this from host.
+     * It is difficult to patch the firmware boot code,
+     * but possible in theory.
+     */
+    if (ar->arTargetType == TARGET_TYPE_AR6003) {
+        A_UINT32 ramReservedSz;
+        if (ar->arVersion.target_ver == AR6003_REV2_VERSION) {
+            param = AR6003_REV2_BOARD_EXT_DATA_ADDRESS;
+            ramReservedSz = AR6003_REV2_RAM_RESERVE_SIZE;
+        } else {
+            param = AR6003_REV3_BOARD_EXT_DATA_ADDRESS;
+            if (testmode) {
+                ramReservedSz = AR6003_REV3_RAM_RESERVE_SIZE_TCMD;
+            } else {
+            ramReservedSz = AR6003_REV3_RAM_RESERVE_SIZE;
+        }
+        }
+        if (BMIWriteMemory(ar->arHifDevice,
+            HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_board_ext_data),
+            (A_UCHAR *)&param,
+            4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for hi_board_ext_data failed \n"));
+            return A_ERROR;
+        }
+        if (BMIWriteMemory(ar->arHifDevice,
+              HOST_INTEREST_ITEM_ADDRESS(ar->arTargetType, hi_end_RAM_reserve_sz),
+              (A_UCHAR *)&ramReservedSz, 4) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BMIWriteMemory for hi_end_RAM_reserve_sz failed \n"));
+            return A_ERROR;
+        }
+    }
+
+
+    /* since BMIInit is called in the driver layer, we have to set the block
+     * size here for the target */
+
+    if (A_FAILED(ar6000_set_htc_params(ar->arHifDevice,
+                                       ar->arTargetType,
+                                       mbox_yield_limit,
+                                       0 /* use default number of control buffers */
+                                       ))) {
+        return A_ERROR;
+    }
+
+    if (setupbtdev != 0) {
+        if (A_FAILED(ar6000_set_hci_bridge_flags(ar->arHifDevice,
+                                                 ar->arTargetType,
+                                                 setupbtdev))) {
+            return A_ERROR;
+        }
+    }
+
+    return A_OK;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void ar6000_ethtool_get_drvinfo(struct net_device *dev,
+                                    struct ethtool_drvinfo *info)
+{
+    A_STATUS status;
+    HIF_DEVICE_OS_DEVICE_INFO osDevInfo;
+    AR_SOFTC_T *ar;
+    AR_SOFTC_DEV_T *arPriv;
+    struct ar6000_version *revinfo;
+    if((dev == NULL) || ((arPriv = ar6k_priv(dev)) == NULL)) {
+        return;
+    }
+    ar = arPriv->arSoftc;
+    revinfo = &ar->arVersion;
+    strcpy(info->driver, "AR6000");
+    snprintf(info->version, sizeof(info->version), "%u.%u.%u.%u",
+             ((revinfo->host_ver)&0xf0000000)>>28,
+             ((revinfo->host_ver)&0x0f000000)>>24,
+             ((revinfo->host_ver)&0x00ff0000)>>16,
+             ((revinfo->host_ver)&0x0000ffff));
+    snprintf(info->fw_version, sizeof(info->fw_version), "%u.%u.%u.%u",
+             ((revinfo->wlan_ver)&0xf0000000)>>28,
+             ((revinfo->wlan_ver)&0x0f000000)>>24,
+             ((revinfo->wlan_ver)&0x00ff0000)>>16,
+             ((revinfo->wlan_ver)&0x0000ffff));
+
+    status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_GET_OS_DEVICE,
+                                &osDevInfo,
+                                sizeof(HIF_DEVICE_OS_DEVICE_INFO));
+    if (A_SUCCESS(status) && osDevInfo.pOSDevice) {
+        struct device *dev = (struct device*)osDevInfo.pOSDevice;
+        if (dev->bus && dev->bus->name) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+            const char *dinfo = dev_name(dev);
+#else
+            const char *dinfo = kobject_name(&dev->kobj);
+#endif
+            snprintf(info->bus_info, sizeof(info->bus_info), dinfo);
+        }
+    }
+}
+
+static u32 ar6000_ethtool_get_link(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv;
+    return ((arPriv = ar6k_priv(dev))!=NULL) ? arPriv->arConnected : 0;
+}
+
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+static u32 ar6000_ethtool_get_rx_csum(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv;
+    if((dev == NULL) || ((arPriv = ar6k_priv(dev)) == NULL)) {
+        return 0;
+    }
+    return (arPriv->arSoftc->rxMetaVersion==WMI_META_VERSION_2);
+}
+
+static int ar6000_ethtool_set_rx_csum(struct net_device *dev, u32 enable)
+{
+    AR_SOFTC_T *ar;
+    AR_SOFTC_DEV_T *arPriv;
+    A_UINT8 metaVersion;
+    if((dev == NULL) || ((arPriv = ar6k_priv(dev)) == NULL)) {
+        return -EIO;
+    }
+    ar = arPriv->arSoftc;
+    if (ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+    metaVersion = (enable) ? WMI_META_VERSION_2 : 0;
+    if ((wmi_set_rx_frame_format_cmd(arPriv->arWmi, metaVersion, processDot11Hdr, processDot11Hdr)) != A_OK) {
+        return -EFAULT;
+    }
+    ar->rxMetaVersion = metaVersion;
+    return 0;
+}
+
+static u32 ar6000_ethtool_get_tx_csum(struct net_device *dev)
+{
+    return csumOffload;
+}
+
+static int ar6000_ethtool_set_tx_csum(struct net_device *dev, u32 enable)
+{
+    csumOffload = enable;
+    if(enable){
+        dev->features |= NETIF_F_IP_CSUM;
+    } else {
+        dev->features &= ~NETIF_F_IP_CSUM;
+    }
+    return 0;
+}
+#endif /* CONFIG_CHECKSUM_OFFLOAD */
+
+static const struct ethtool_ops ar6000_ethtool_ops = {
+    .get_drvinfo = ar6000_ethtool_get_drvinfo,
+    .get_link = ar6000_ethtool_get_link,
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+    .get_rx_csum = ar6000_ethtool_get_rx_csum,
+    .set_rx_csum = ar6000_ethtool_set_rx_csum,
+    .get_tx_csum = ar6000_ethtool_get_tx_csum,
+    .set_tx_csum = ar6000_ethtool_set_tx_csum,
+#endif /* CONFIG_CHECKSUM_OFFLOAD */
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+/*
+ * HTC Event handlers
+ */
+static A_STATUS
+ar6000_avail_ev(void *context, void *hif_handle)
+{
+    int i;
+    struct net_device *dev;
+    void *ar_netif;
+    AR_SOFTC_T *ar=NULL;
+    AR_SOFTC_DEV_T *arPriv;
+    int device_index = 0;
+    HTC_INIT_INFO htcInfo;
+#ifdef ATH6K_CONFIG_CFG80211
+    struct wireless_dev *wdev;
+#endif /* ATH6K_CONFIG_CFG80211 */
+    A_STATUS init_status = A_OK;
+    unsigned char devnum = 0;
+    unsigned char cnt = 0;
+#ifdef SET_NETDEV_DEV
+    HIF_DEVICE_OS_DEVICE_INFO osDevInfo;
+    A_MEMZERO(&osDevInfo, sizeof(osDevInfo));
+    if (A_OK != HIFConfigureDevice(hif_handle, HIF_DEVICE_GET_OS_DEVICE,
+                                   &osDevInfo, sizeof(osDevInfo))) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: Failed to get OS device instance\n",
+                                       __func__));
+        return A_ERROR;
+    }
+#endif
+    /*
+     * If ar6000_avail_ev is called more than once, this means that
+     * multiple AR600x devices have been inserted into the system.
+     * We do not support more than one AR600x device at this time.
+     */
+    if (avail_ev_called) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ERROR: More than one AR600x device not supported by driver\n"));
+        complete(&avail_ev_completion);
+        return A_ERROR;
+    }
+
+    avail_ev_called = TRUE;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_available\n"));
+
+
+
+    ar = A_MALLOC(sizeof(AR_SOFTC_T));
+
+    if (ar == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AR_SOFTC: can not allocate\n"));
+        complete(&avail_ev_completion);
+        return A_ERROR;
+    }
+    A_MEMZERO(ar, sizeof(AR_SOFTC_T));
+
+#ifdef ATH_AR6K_11N_SUPPORT
+    if(aggr_init(ar6000_alloc_netbufs, ar6000_deliver_frames_to_nw_stack) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize aggr.\n", __func__));
+        init_status = A_ERROR;
+        goto avail_ev_failed;
+    }
+#endif
+
+    A_MEMZERO((A_UINT8 *)ar->connTbl, NUM_CONN * sizeof(conn_t));
+    /* Init the PS queues */
+    for (i=0; i < NUM_CONN ; i++) {
+#ifdef ATH_AR6K_11N_SUPPORT
+        if ((ar->connTbl[i].conn_aggr = aggr_init_conn()) == NULL) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s() Failed to initialize aggr.\n", __func__));
+            A_FREE(ar);
+            complete(&avail_ev_completion);
+            return A_ERROR;
+        }
+#endif
+        A_MUTEX_INIT(&ar->connTbl[i].psqLock);
+        A_NETBUF_QUEUE_INIT(&ar->connTbl[i].psq);
+        A_NETBUF_QUEUE_INIT(&ar->connTbl[i].apsdq);
+    }
+    if (ifname[0] == '\0')
+        strcpy(ifname, "wlan0");
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+    if(ifname[0]) {
+        for(i = 0; i < strlen(ifname); i++) {
+           if(ifname[i] >= '0' && ifname[i] <= '9' ) {
+                devnum = (devnum * 10) + (ifname[i] - '0');
+           }
+           else {
+                cnt++;
+            }
+        }
+        ifname[cnt]='\0';
+    }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) */
+    ar->arConfNumDev = num_device;
+    for (i=0; i < num_device; i++) {
+
+        if (ar6000_devices[i] != NULL) {
+            break;
+        }
+
+        /* Save this. It gives a bit better readability especially since */
+        /* we use another local "i" variable below.                      */
+        device_index = i;
+
+#ifdef ATH6K_CONFIG_CFG80211
+#ifdef SET_NETDEV_DEV
+        wdev = ar6k_cfg80211_init(osDevInfo.pOSDevice);
+#else
+        wdev = ar6k_cfg80211_init(NULL);
+#endif
+
+        if (IS_ERR(wdev)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ar6k_cfg80211_init failed\n", __func__));
+            complete(&avail_ev_completion);
+            return A_ERROR;
+        }
+        ar_netif = wdev_priv(wdev);
+#else
+        dev = alloc_etherdev(sizeof(AR_SOFTC_DEV_T));
+        if (dev == NULL) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_available: can't alloc etherdev\n"));
+            A_FREE(ar);
+            complete(&avail_ev_completion);
+            return A_ERROR;
+        }
+        ether_setup(dev);
+        ar_netif = ar6k_priv(dev);
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+        if (ar_netif == NULL) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Can't allocate ar6k priv memory\n", __func__));
+            A_FREE(ar);
+            complete(&avail_ev_completion);
+            return A_ERROR;
+        }
+
+        A_MEMZERO(ar_netif, sizeof(AR_SOFTC_DEV_T));
+        arPriv = (AR_SOFTC_DEV_T *)ar_netif;
+
+#ifdef ATH6K_CONFIG_CFG80211
+        arPriv->wdev = wdev;
+        wdev->iftype = NL80211_IFTYPE_STATION;
+
+        dev = alloc_netdev_mq(0, "wlan%d", ether_setup, NUM_SUBQUEUE);
+        if (!dev) {
+            printk(KERN_CRIT "AR6K: no memory for network device instance\n");
+            ar6k_cfg80211_deinit(arPriv);
+            A_FREE(ar);
+            return A_ERROR;
+        }
+
+        dev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(dev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = dev;
+        arPriv->arNetworkType = INFRA_NETWORK;
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+        if (ifname[0])
+        {
+             sprintf(dev->name, "%s%d", ifname,(devnum + device_index));
+        }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0) */
+
+#ifdef SET_MODULE_OWNER
+        SET_MODULE_OWNER(dev);
+#endif
+
+#ifdef SET_NETDEV_DEV
+#if 0
+        if (ar_netif) {
+            HIF_DEVICE_OS_DEVICE_INFO osDevInfo;
+            A_MEMZERO(&osDevInfo, sizeof(osDevInfo));
+            if ( A_SUCCESS( HIFConfigureDevice(hif_handle, HIF_DEVICE_GET_OS_DEVICE,
+                            &osDevInfo, sizeof(osDevInfo))) ) {
+                SET_NETDEV_DEV(dev, osDevInfo.pOSDevice);
+            }
+        }
+#endif
+#endif
+
+        arPriv->arNetDev = dev;
+        ar6000_devices[device_index] = dev;
+        arPriv->arSoftc = ar;
+        ar->arDev[device_index] = arPriv;
+        ar->arWlanState = WLAN_ENABLED;
+        arPriv->arDeviceIndex = device_index;
+
+        ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+
+#ifndef ATH6K_CONFIG_CFG80211
+#ifdef SET_NETDEV_DEV
+        SET_NETDEV_DEV(dev, osDevInfo.pOSDevice);
+#endif
+#endif
+
+        if(ar6000_init_control_info(arPriv) != A_OK) {
+            init_status = A_ERROR;
+            goto avail_ev_failed;
+        }
+        init_waitqueue_head(&arPriv->arEvent);
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+        A_INIT_TIMER(&aptcTimer[i], aptcTimerHandler, ar);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+        spin_lock_init(&arPriv->arPrivLock);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
+        dev->open = &ar6000_open;
+        dev->stop = &ar6000_close;
+        dev->hard_start_xmit = &ar6000_data_tx;
+        dev->get_stats = &ar6000_get_stats;
+
+        /* dev->tx_timeout = ar6000_tx_timeout; */
+        dev->do_ioctl = &ar6000_ioctl;
+        dev->set_multicast_list = &ar6000_set_multicast_list;
+#else
+        dev->netdev_ops = &ar6000_netdev_ops;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29) */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+        dev->ethtool_ops = &ar6000_ethtool_ops;
+#endif
+        dev->watchdog_timeo = AR6000_TX_TIMEOUT;
+        dev->wireless_handlers = &ath_iw_handler_def;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
+        dev->get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
+#else
+        ath_iw_handler_def.get_wireless_stats = ar6000_get_iwstats; /*Displayed via proc fs */
+#endif
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+        if(csumOffload){
+
+            dev->features |= NETIF_F_IP_CSUM;/*advertise kernel capability
+                                             to do TCP/UDP CSUM offload for IPV4*/
+        }
+#endif
+        if (processDot11Hdr) {
+            dev->hard_header_len = sizeof(struct ieee80211_qosframe) + sizeof(ATH_LLC_SNAP_HDR) + sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN + WMI_MAX_TX_META_SZ + LINUX_HACK_FUDGE_FACTOR;
+        } else {
+            /*
+             * We need the OS to provide us with more headroom in order to
+             * perform dix to 802.3, WMI header encap, and the HTC header
+             */
+            dev->hard_header_len = ETH_HLEN + sizeof(ATH_LLC_SNAP_HDR) +
+                sizeof(WMI_DATA_HDR) + HTC_HEADER_LEN + WMI_MAX_TX_META_SZ + LINUX_HACK_FUDGE_FACTOR;
+        }
+
+       if (!bypasswmi && !eppingtest)
+       {
+            /* Indicate that WMI is enabled (although not ready yet) */
+            arPriv->arWmiEnabled = TRUE;
+           if ((arPriv->arWmi = wmi_init((void *) arPriv,arPriv->arDeviceIndex)) == NULL)
+           {
+               AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize WMI.\n", __func__));
+                init_status = A_ERROR;
+                goto avail_ev_failed;
+            }
+
+           AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s() Got WMI @ 0x%08x.\n", __func__,
+               (unsigned int) arPriv->arWmi));
+        }
+#ifdef P2P
+        /* Allocate P2P module context if this dev is in any of the P2P modes.
+         * For non-P2P devices, this may be allocated just in time when the
+         * device assumes a P2P submode. This may be needed when we do
+         * mode switch between none and P2P submodes. For later enhancement.
+         */
+        if (arPriv->arNetworkSubType == SUBTYPE_P2PDEV ||
+            arPriv->arNetworkSubType == SUBTYPE_P2PCLIENT ||
+            arPriv->arNetworkSubType == SUBTYPE_P2PGO) {
+            arPriv->p2p_ctx = p2p_init(arPriv);
+            if (arPriv->p2p_ctx == NULL) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize p2p_ctx.\n", __func__));
+                init_status = A_ERROR;
+                goto avail_ev_failed;
+            }
+            p2p_update_capability(A_WMI_GET_P2P_CTX(arPriv),arPriv->arNetworkSubType,num_device);
+        }
+#endif /* P2P */
+    }
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    if(testmode) {
+        ar->arTargetMode = AR6000_TCMD_MODE;
+    }else {
+        ar->arTargetMode = AR6000_WLAN_MODE;
+    }
+#endif
+    ar->arWlanOff = FALSE;   /* We are in ON state */
+#ifdef CONFIG_PM
+    ar->arWowState = WLAN_WOW_STATE_NONE;
+    ar->arBTOff = TRUE;   /* BT chip assumed to be OFF */
+    ar->arBTSharing = WLAN_CONFIG_BT_SHARING;
+    ar->arWlanOffConfig = WLAN_CONFIG_WLAN_OFF;
+    ar->arSuspendConfig = WLAN_CONFIG_PM_SUSPEND;
+    ar->arWow2Config = WLAN_CONFIG_PM_WOW2;
+#endif /* CONFIG_PM */
+
+    A_INIT_TIMER(&ar->arHBChallengeResp.timer, ar6000_detect_error, ar);
+    ar->arHBChallengeResp.seqNum = 0;
+    ar->arHBChallengeResp.outstanding = FALSE;
+    ar->arHBChallengeResp.missCnt = 0;
+    ar->arHBChallengeResp.frequency = AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT;
+    ar->arHBChallengeResp.missThres = AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT;
+    ar->arHifDevice = hif_handle;
+    sema_init(&ar->arSem, 1);
+    ar->bIsDestroyProgress = FALSE;
+
+    ar->delbaState = REASON_DELBA_INIT;
+    ar->IsdelbaTimerInitialized = FALSE;
+    A_INIT_TIMER (&ar->delbaTimer, delba_timer_callback, ar); 
+
+    ar->isHostAsleep = 0;
+
+    INIT_HTC_PACKET_QUEUE(&ar->amsdu_rx_buffer_queue);
+    /*
+     * If requested, perform some magic which requires no cooperation from
+     * the Target.  It causes the Target to ignore flash and execute to the
+     * OS from ROM.
+     *
+     * This is intended to support recovery from a corrupted flash on Targets
+     * that support flash.
+     */
+    if (skipflash)
+    {
+        //ar6000_reset_device_skipflash(ar->arHifDevice);
+    }
+
+    BMIInit();
+
+    if (bmienable) {
+        ar6000_sysfs_bmi_init(ar);
+    }
+
+    {
+        struct bmi_target_info targ_info;
+        A_MEMZERO(&targ_info, sizeof(targ_info));
+        if (BMIGetTargetInfo(ar->arHifDevice, &targ_info) != A_OK) {
+            init_status = A_ERROR;
+            goto avail_ev_failed;
+        }
+
+        ar->arVersion.target_ver = targ_info.target_ver;
+        ar->arTargetType = targ_info.target_type;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s() TARGET TYPE: %d\n", __func__,ar->arTargetType));
+        target_register_tbl_attach(ar->arTargetType);
+
+        /* do any target-specific preparation that can be done through BMI */
+        if (ar6000_prepare_target(ar->arHifDevice,
+                                  targ_info.target_type,
+                                  targ_info.target_ver) != A_OK) {
+            init_status = A_ERROR;
+            goto avail_ev_failed;
+        }
+
+    }
+    if (ar6000_configure_target(ar) != A_OK) {
+        init_status = A_ERROR;
+        goto avail_ev_failed;
+    }
+
+    A_MEMZERO(&htcInfo,sizeof(htcInfo));
+    htcInfo.pContext = ar;
+    htcInfo.TargetFailure = ar6000_target_failure;
+
+    ar->arHtcTarget = HTCCreate(ar->arHifDevice,&htcInfo);
+
+    if (ar->arHtcTarget == NULL) {
+        init_status = A_ERROR;
+        goto avail_ev_failed;
+    }
+
+    spin_lock_init(&ar->arLock);
+
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+    if(csumOffload){
+
+        ar->rxMetaVersion=WMI_META_VERSION_2;/*if external frame work is also needed, change and use an extended rxMetaVerion*/
+    }
+#endif
+
+    HIFClaimDevice(ar->arHifDevice, ar);
+
+    if (bmienable)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("BMI enabled: %d\n", wlaninitmode));
+        if ((wlaninitmode == WLAN_INIT_MODE_UDEV) ||
+            (wlaninitmode == WLAN_INIT_MODE_DRV))
+        {
+            A_STATUS status = A_OK;
+            do {
+                if ((status = ar6000_sysfs_bmi_get_config(ar, wlaninitmode)) != A_OK)
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_sysfs_bmi_get_config failed\n"));
+                    break;
+                }
+
+                dev = ar6000_devices[0];
+#ifdef HTC_RAW_INTERFACE
+                if (!eppingtest && bypasswmi) {
+                    break; /* Don't call ar6000_init for ART */
+                }
+#endif
+              status = (ar6000_init(dev)==0) ? A_OK : A_ERROR;
+              if (status != A_OK) {
+                 AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_init\n"));
+                }
+            } while (FALSE);
+
+            if (status != A_OK) {
+                init_status = status;
+                goto avail_ev_failed;
+            }
+        }
+    }
+#ifdef CONFIG_PM
+      init_waitqueue_head(&ar->sleep_mode_cmd_completed_event);
+#endif
+   for (i=0; i < num_device; i++)
+   {
+        dev = ar6000_devices[i];
+        arPriv = ar6k_priv(dev);
+        ar = arPriv->arSoftc;
+
+        /* Don't install the init function if BMI is requested */
+        if (!bmienable) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
+            dev->init = ar6000_init;
+#else
+            ar6000_netdev_ops.ndo_init = ar6000_init;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29) */
+        }
+
+        /* This runs the init function if registered */
+        if (register_netdev(dev)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("ar6000_avail: register_netdev failed\n"));
+            ar6000_cleanup(ar);
+            ar6000_devices[i] = NULL;
+            ar6000_destroy(dev, 0);
+              complete(&avail_ev_completion);
+            return A_ERROR;
+        }
+      AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_avail: name=%s hifdevice=0x%lx, dev=0x%lx (%d), ar=0x%lx\n",
+                    dev->name, (unsigned long)ar->arHifDevice, (unsigned long)dev, device_index,
+                    (unsigned long)ar));
+
+    }
+
+avail_ev_failed :
+    if (A_FAILED(init_status)) {
+        if (bmienable) {
+            ar6000_sysfs_bmi_deinit(ar);
+        }
+       for (i=0; i < num_device; i++)
+       {
+            dev = ar6000_devices[i];
+         arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+         if(arPriv->arWmiEnabled == TRUE)
+         {
+                wmi_shutdown(arPriv->arWmi);
+                arPriv->arWmiEnabled = FALSE;
+            }
+            ar6000_devices[i] = NULL;
+        }
+        A_FREE(ar);
+    }
+	complete(&avail_ev_completion);
+
+    mod_loaded = TRUE;
+    wake_up_interruptible(&load_complete);
+
+    printk("Completed loading the module %s\n", __func__);
+    return init_status;
+}
+
+static void ar6000_target_failure(void *Instance, A_STATUS Status)
+{
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)Instance;
+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
+    static A_BOOL sip = FALSE;
+    A_UINT8 i;
+
+    if (Status != A_OK) {
+
+        printk(KERN_ERR "ar6000_target_failure: target asserted \n");
+
+        if (timer_pending(&ar->arHBChallengeResp.timer)) {
+            A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
+        }
+
+        /* try dumping target assertion information (if any) */
+        ar6000_dump_target_assert_info(ar->arHifDevice,ar->arTargetType);
+
+        /*
+         * Fetch the logs from the target via the diagnostic
+         * window.
+         */
+        ar6000_dbglog_get_debug_logs(ar);
+
+        /* Report the error only once */
+        if (!sip) {
+            sip = TRUE;
+            errEvent.errorVal = WMI_TARGET_COM_ERR |
+                                WMI_TARGET_FATAL_ERR;
+            for(i = 0; i < num_device; i++)
+            {
+
+                ar6000_send_event_to_app(ar->arDev[i], WMI_ERROR_REPORT_EVENTID,
+                                         (A_UINT8 *)&errEvent,
+                                         sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
+
+            }
+        }
+    }
+}
+
+static A_STATUS
+ar6000_unavail_ev(void *context, void *hif_handle)
+{
+    unsigned int old_reset_ok = resetok;
+    A_UINT8 i;
+    struct net_device *ar6000_netdev;
+    AR_SOFTC_T *ar = (AR_SOFTC_T*)context;
+    resetok = 0; /* card is remove, don't reset */
+    ar6000_cleanup(ar);
+    resetok = old_reset_ok;
+    /* NULL out it's entry in the global list */
+    for(i = 0; i < num_device; i++) {
+        ar6000_netdev = ar6000_devices[i];
+        ar6000_devices[i] = NULL;
+        ar6000_destroy(ar6000_netdev, 1);
+    }
+
+    return A_OK;
+}
+
+/*
+ * EV93295 Kernel panic "cannot create duplicate filename 'bmi'"
+ */
+A_BOOL restart_endpoint_called = FALSE;
+
+void
+ar6000_restart_endpoint(AR_SOFTC_T *ar)
+{
+    A_STATUS status = A_OK;
+    AR_SOFTC_DEV_T *arPriv;
+    struct net_device *dev;
+    A_UINT8 i = 0;
+
+	if(restart_endpoint_called) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6K: %s() already called.\n", __func__));
+        dump_stack();
+        return;
+    }
+    restart_endpoint_called = TRUE;
+
+    /*
+     * Call wmi_init for each device.  This must be done BEFORE ar6000_init() is
+     * called, or we will get a null pointer exception in the wmi code.  We must
+     * also set the arWmiEnabled flag for each device.
+     */
+    for(i = 0; i < num_device; i++) {
+        arPriv = ar->arDev[i];
+        arPriv->arWmiEnabled = TRUE;
+        if ((arPriv->arWmi = wmi_init((void *) arPriv,arPriv->arDeviceIndex)) == NULL)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() Failed to initialize WMI.\n", __func__));
+            status = A_ERROR;
+            goto exit;
+        }
+    }
+
+    BMIInit();
+    if (bmienable) {
+        ar6000_sysfs_bmi_init(ar);
+    }
+    do {
+        if ( (status=ar6000_configure_target(ar))!=A_OK)
+            break;
+        if ( (status=ar6000_sysfs_bmi_get_config(ar, wlaninitmode)) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_avail: ar6000_sysfs_bmi_get_config failed\n"));
+            break;
+        }
+    } while(0);
+
+    dev = ar6000_devices[0];
+    status = (ar6000_init(dev)==0) ? A_OK : A_ERROR;
+
+    if (status != A_OK) {
+        goto exit;
+    }
+
+
+    for(i = 0; i < num_device; i++) {
+        arPriv = ar->arDev[i];
+        if (arPriv->arDoConnectOnResume &&
+            arPriv->arSsidLen &&
+            ar->arWlanState == WLAN_ENABLED)
+        {
+            ar6000_connect_to_ap(arPriv);
+        }
+    }
+
+    if (status == A_OK) {
+        restart_endpoint_called = FALSE;
+        return;
+    }
+
+exit:
+    for(i = 0; i < num_device; i++) {
+        arPriv = ar->arDev[i];
+        ar6000_devices[i] = NULL;
+        ar6000_destroy(arPriv->arNetDev, 1);
+    }
+    restart_endpoint_called = FALSE;
+}
+
+void
+ar6000_stop_endpoint(AR_SOFTC_T *ar, A_BOOL keepprofile, A_BOOL getdbglogs)
+{
+
+    AR_SOFTC_DEV_T *arPriv ;
+    A_UINT8 i;
+    A_UINT8 ctr;
+    AR_SOFTC_STA_T *arSta;
+
+    for(i = 0; i < num_device; i++)
+    {
+        arPriv = ar->arDev[i];
+        arSta = &arPriv->arSta;
+        /* Stop the transmit queues */
+        netif_stop_queue(arPriv->arNetDev);
+
+        /* Disable the target and the interrupts associated with it */
+        if (ar->arWmiReady == TRUE)
+        {
+            if (!bypasswmi) {
+                A_BOOL disconnectIssued;
+
+                arPriv->arDoConnectOnResume = arPriv->arConnected;
+
+                A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+                A_UNTIMEOUT(&ar->ap_reconnect_timer);
+// AP + BTCOEX State variables resetted here.
+                ar->IsdelbaTimerInitialized = FALSE;
+                A_UNTIMEOUT(&ar->delbaTimer);
+                ar->delbaState = REASON_DELBA_INIT;
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+                /* Delete the Adaptive Power Control timer */
+                if (timer_pending(&aptcTimer[i])) {
+                    del_timer_sync(&aptcTimer[i]);
+                }
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+#ifdef ATH_AR6K_11N_SUPPORT
+                for (ctr=0; ctr < NUM_CONN ; ctr++) {
+                    aggr_module_destroy_timers(ar->connTbl[ctr].conn_aggr);
+                }
+#endif
+
+                if (!wait_event_interruptible_timeout(scan_complete, !arSta->scan_triggered, 2 * HZ)) {
+                    printk(KERN_ERR "scan complete not received\n");
+                }
+
+                disconnectIssued = (arPriv->arConnected) || (arPriv->arSta.arConnectPending);
+                ar6000_disconnect(arPriv);
+                if (!keepprofile) {
+                    ar6000_init_profile_info(arPriv);
+                }
+                if (getdbglogs) {
+                    ar6000_dbglog_get_debug_logs(ar);
+                }
+                ar->arWmiReady = FALSE;
+                arPriv->arWmiEnabled = FALSE;
+                wmi_shutdown(arPriv->arWmi);
+                arPriv->arWmi = NULL;
+                /*
+                 * After wmi_shudown all WMI events will be dropped.
+                 * We need to cleanup the buffers allocated in AP mode
+                 * and give disconnect notification to stack, which usually
+                 * happens in the disconnect_event.
+                 * Simulate the disconnect_event by calling the function directly.
+                 * Sometimes disconnect_event will be received when the debug logs
+                 * are collected.
+                 */
+                if (disconnectIssued) {
+                    if(arPriv->arNetworkType & AP_NETWORK) {
+                        ar6000_disconnect_event(arPriv, DISCONNECT_CMD, bcast_mac, 0, NULL, 0);
+                    } else {
+                        ar6000_disconnect_event(arPriv, DISCONNECT_CMD, arPriv->arBssid, 0, NULL, 0);
+                    }
+                }
+#ifdef USER_KEYS
+                arPriv->arSta.user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+                arPriv->arSta.user_key_ctrl = 0;
+#endif
+            }
+             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): WMI stopped\n", __func__));
+        }
+        else
+        {
+             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): WMI not ready 0x%lx 0x%lx\n",
+                 __func__, (unsigned long) ar, (unsigned long) arPriv->arWmi));
+            /* Shut down WMI if we have started it */
+            if(arPriv->arWmiEnabled == TRUE)
+            {
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s(): Shut down WMI\n", __func__));
+                arPriv->arWmiEnabled = FALSE;
+                wmi_shutdown(arPriv->arWmi);
+                arPriv->arWmi = NULL;
+            }
+        }
+        /* cleanup hci pal driver data structures */
+        if (setuphcipal && (arPriv->isBt30amp == TRUE)) {
+            ar6k_cleanup_hci_pal(arPriv);
+        }
+    }
+
+    if (ar->arHtcTarget != NULL) {
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        if (NULL != ar6kHciTransCallbacks.cleanupTransport) {
+            ar6kHciTransCallbacks.cleanupTransport(NULL);
+        }
+#else
+        // FIXME: workaround to reset BT's UART baud rate to default
+        if (NULL != ar->exitCallback) {
+            AR3K_CONFIG_INFO ar3kconfig;
+            A_STATUS status;
+
+           A_MEMZERO(&ar3kconfig,sizeof(ar3kconfig));
+           ar6000_set_default_ar3kconfig(ar, (void *)&ar3kconfig);
+            status = ar->exitCallback(&ar3kconfig);
+            if (A_OK != status) {
+               AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to reset AR3K baud rate! \n"));
+            }
+        }
+        // END workaround
+        if (setuphci)
+            ar6000_cleanup_hci(ar);
+#endif
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Shutting down HTC .... \n"));
+        /* stop HTC */
+        HTCStop(ar->arHtcTarget);
+        ar6k_init = FALSE;
+    }
+
+    if (resetok) {
+        /* try to reset the device if we can
+         * The driver may have been configure NOT to reset the target during
+         * a debug session */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,(" Attempting to reset target on instance destroy.... \n"));
+        if (ar->arHifDevice != NULL) {
+#if defined(CONFIG_MMC_MSM) || defined(CONFIG_MMC_SDHCI_S3C)
+            A_BOOL coldReset = ((ar->arTargetType == TARGET_TYPE_AR6003)|| (ar->arTargetType == TARGET_TYPE_MCKINLEY)) ? TRUE: FALSE;
+#else
+            A_BOOL coldReset = (ar->arTargetType == TARGET_TYPE_MCKINLEY) ? TRUE: FALSE;
+#endif
+            ar6000_reset_device(ar->arHifDevice, ar->arTargetType, TRUE, coldReset);
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" Host does not want target reset. \n"));
+    }
+    /* Done with cookies */
+    ar6000_cookie_cleanup(ar);
+
+    /* cleanup any allocated AMSDU buffers */
+    ar6000_cleanup_amsdu_rxbufs(ar);
+
+    if (bmienable) {
+        ar6000_sysfs_bmi_deinit(ar);
+    }
+}
+
+void ar6000_cleanup(AR_SOFTC_T *ar)
+{
+    A_UINT8 ctr;
+    ar->bIsDestroyProgress = TRUE;
+
+    if (down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s(): down_interruptible failed \n", __func__));
+        return;
+    }
+
+    if (ar->arWlanPowerState != WLAN_POWER_STATE_CUT_PWR) {
+        /* only stop endpoint if we are not stop it in suspend_ev */
+        ar6000_stop_endpoint(ar, FALSE, TRUE);
+    } else {
+        /* clear up the platform power state before rmmod */
+        plat_setup_power(ar, 1, 0);
+        ar->arPlatPowerOff = FALSE;
+    }
+
+#ifdef ATH_AR6K_11N_SUPPORT
+    for (ctr=0; ctr < NUM_CONN ; ctr++) {
+        aggr_module_destroy_conn(ar->connTbl[ctr].conn_aggr);
+    }
+    aggr_module_destroy();
+#endif
+
+    ar->arWlanState = WLAN_DISABLED;
+
+    up(&ar->arSem);
+
+    if (ar->arHtcTarget != NULL) {
+        /* destroy HTC */
+        HTCDestroy(ar->arHtcTarget);
+    }
+    if (ar->arHifDevice != NULL) {
+        /*release the device so we do not get called back on remove incase we
+         * we're explicity destroyed by module unload */
+        HIFReleaseDevice(ar->arHifDevice);
+        HIFShutDownDevice(ar->arHifDevice);
+    }
+    /* Done with cookies */
+    ar6000_cookie_cleanup(ar);
+
+    /* cleanup any allocated AMSDU buffers */
+    ar6000_cleanup_amsdu_rxbufs(ar);
+
+    if (bmienable) {
+        ar6000_sysfs_bmi_deinit(ar);
+    }
+
+    /* Cleanup BMI */
+    BMICleanup();
+
+    /* Clear the tx counters */
+    memset(tx_attempt, 0, sizeof(tx_attempt));
+    memset(tx_post, 0, sizeof(tx_post));
+    memset(tx_complete, 0, sizeof(tx_complete));
+
+#ifdef HTC_RAW_INTERFACE
+    if (ar->arRawHtc) {
+        A_FREE(ar->arRawHtc);
+        ar->arRawHtc = NULL;
+    }
+#endif
+    A_UNTIMEOUT(&ar->ap_reconnect_timer);
+    A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
+// AP + BTCOEX State variables resetted here.
+    ar->IsdelbaTimerInitialized = FALSE;
+    A_UNTIMEOUT(&ar->delbaTimer);
+    ar->delbaState = REASON_DELBA_INIT;
+    A_FREE(ar);
+
+}
+/*
+ * We need to differentiate between the surprise and planned removal of the
+ * device because of the following consideration:
+ * - In case of surprise removal, the hcd already frees up the pending
+ *  for the device and hence there is no need to unregister the function
+ *  driver inorder to get these requests. For planned removal, the function
+ *  driver has to explictly unregister itself to have the hcd return all the
+ *  pending requests before the data structures for the devices are freed up.
+ *  Note that as per the current implementation, the function driver will
+ *  end up releasing all the devices since there is no API to selectively
+ *  release a particular device.
+ * - Certain commands issued to the target can be skipped for surprise
+ *  removal since they will anyway not go through.
+ */
+void
+ar6000_destroy(struct net_device *dev, unsigned int unregister)
+{
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_AP_T *arAp;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("+ar6000_destroy \n"));
+
+    if((dev == NULL) || ((arPriv = ar6k_priv(dev)) == NULL))
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s(): Failed to get device structure.\n", __func__));
+        return;
+    }
+
+    aggr_module_destroy_conn(arPriv->conn_aggr);
+
+    if(arPriv->arNetworkType == AP_NETWORK)
+    {
+        arAp = &arPriv->arAp;
+
+#ifdef ATH_SUPPORT_DFS
+        dfs_detach_host(arAp->pDfs);
+#endif
+    }
+#ifdef P2P
+    A_FREE(arPriv->p2p_ctx);
+#endif /* P2P */
+    ar6k_init = FALSE;
+    /* Free up the device data structure */
+    if (unregister) {
+        unregister_netdev(dev);
+    }
+#ifndef HAVE_FREE_NETDEV
+    kfree(dev);
+#else
+    free_netdev(dev);
+#endif
+
+#ifdef ATH6K_CONFIG_CFG80211
+    ar6k_cfg80211_deinit(arPriv);
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("-ar6000_destroy \n"));
+}
+
+static void delba_timer_callback(unsigned long ptr)
+{
+    AR_SOFTC_T *ar= (AR_SOFTC_T *)ptr;
+    do
+    {
+        if (NULL != ar)
+        {
+            if (!ar->IsdelbaTimerInitialized)
+            {
+                break;
+            }
+
+            ar->IsdelbaTimerInitialized = FALSE;
+            A_UNTIMEOUT (&ar->delbaTimer);
+
+            ar6000_send_delba (ar, REASON_DELBA_TIMEOUT);
+            ar->delbaState = REASON_DELBA_INIT;
+        }
+
+    }while (FALSE);
+
+}
+
+static void ap_reconnect_timer_handler(unsigned long ptr)
+{
+    AR_SOFTC_T *ar= (AR_SOFTC_T *)ptr;
+    AR_SOFTC_DEV_T *arTempPriv = NULL;
+    A_UINT8 i=0;
+    A_UNTIMEOUT(&ar->ap_reconnect_timer);
+
+    if(ar->arHoldConnection){
+        for(i=0;i<ar->arConfNumDev;i++){
+            arTempPriv = ar->arDev[i];
+            if((AP_NETWORK == arTempPriv->arNetworkType) &&
+               (ar->arHoldConnection & (1<<arTempPriv->arDeviceIndex))){
+                ar->arHoldConnection &= ~(1<<arTempPriv->arDeviceIndex);
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ap_reconnect_timer_handler: starting AP %d", arTempPriv->arDeviceIndex));
+                ar6000_ap_mode_profile_commit(arTempPriv);
+                break;
+            }
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000_reconnect_timer_handler : no"
+                                       " device pending for connect\n"));
+    }
+}
+static void disconnect_timer_handler(unsigned long ptr)
+{
+    struct net_device *dev = (struct net_device *)ptr;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+
+    ar6000_init_profile_info(arPriv);
+
+    ar6000_disconnect(arPriv);
+}
+
+static void ar6000_detect_error(unsigned long ptr)
+{
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)ptr;
+    A_UINT8 i;
+    WMI_TARGET_ERROR_REPORT_EVENT errEvent;
+
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    if (ar->arHBChallengeResp.outstanding) {
+        ar->arHBChallengeResp.missCnt++;
+    } else {
+        ar->arHBChallengeResp.missCnt = 0;
+    }
+
+    if (ar->arHBChallengeResp.missCnt > ar->arHBChallengeResp.missThres) {
+        /* Send Error Detect event to the application layer and do not reschedule the error detection module timer */
+        ar->arHBChallengeResp.missCnt = 0;
+        ar->arHBChallengeResp.seqNum = 0;
+        errEvent.errorVal = WMI_TARGET_COM_ERR | WMI_TARGET_FATAL_ERR;
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        for(i = 0; i < num_device; i++)
+        {
+            ar6000_send_event_to_app(ar->arDev[i], WMI_ERROR_REPORT_EVENTID,
+                                     (A_UINT8 *)&errEvent,
+                                     sizeof(WMI_TARGET_ERROR_REPORT_EVENT));
+        }
+        return;
+    }
+
+    /* Generate the sequence number for the next challenge */
+    ar->arHBChallengeResp.seqNum++;
+    ar->arHBChallengeResp.outstanding = TRUE;
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    /* Send the challenge on the control channel */
+    if (wmi_get_challenge_resp_cmd(ar->arDev[0]->arWmi, ar->arHBChallengeResp.seqNum, DRV_HB_CHALLENGE) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to send heart beat challenge\n"));
+    }
+
+
+    /* Reschedule the timer for the next challenge */
+    A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
+}
+
+void ar6000_init_profile_info(AR_SOFTC_DEV_T *arPriv)
+{
+    A_UINT8 mode = 0;
+#ifdef P2P
+    A_UINT8 submode = 0;
+#endif    
+    mode = ((fwmode >> (arPriv->arDeviceIndex * HI_OPTION_FW_MODE_BITS)) & (HI_OPTION_FW_MODE_MASK ));
+
+    switch(mode) {
+    case HI_OPTION_FW_MODE_IBSS:
+        arPriv->arNetworkType = arPriv->arNextMode = ADHOC_NETWORK;
+        break;
+    case HI_OPTION_FW_MODE_BSS_STA:
+        arPriv->arNetworkType = arPriv->arNextMode = INFRA_NETWORK;
+        break;
+    case HI_OPTION_FW_MODE_AP:
+        arPriv->arNetworkType = arPriv->arNextMode = AP_NETWORK;
+        break;
+    case HI_OPTION_FW_MODE_BT30AMP:
+        arPriv->arNetworkType = arPriv->arNextMode = INFRA_NETWORK;
+        arPriv->isBt30amp = TRUE;
+        break;
+    }
+
+#ifdef P2P
+    /* Initialize firware sub mode
+     */
+    submode = ((fwsubmode>>(arPriv->arDeviceIndex * HI_OPTION_FW_SUBMODE_BITS))
+                   & (HI_OPTION_FW_SUBMODE_MASK));
+
+    switch(submode) {
+    case HI_OPTION_FW_SUBMODE_NONE:
+        arPriv->arNetworkSubType = SUBTYPE_NONE;
+        break;
+    case HI_OPTION_FW_SUBMODE_P2PDEV:
+        arPriv->arNetworkSubType = SUBTYPE_P2PDEV;
+        break;
+    case HI_OPTION_FW_SUBMODE_P2PCLIENT:
+        arPriv->arNetworkSubType = SUBTYPE_P2PCLIENT;
+        break;
+    case HI_OPTION_FW_SUBMODE_P2PGO:
+        arPriv->arNetworkSubType = SUBTYPE_P2PGO;
+        break;
+    }
+#endif
+
+    ar6000_init_mode_info(arPriv);
+}
+
+static int
+ar6000_init_control_info(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    arPriv->arWmiEnabled = FALSE;
+    ar->arVersion.host_ver = AR6K_SW_VERSION;
+
+    if(!(strcmp(targetconf,"mobile")))
+        ar->arVersion.targetconf_ver = AR6003_SUBVER_MOBILE;
+    else if(!(strcmp(targetconf,"tablet")))
+        ar->arVersion.targetconf_ver = AR6003_SUBVER_TABLET;
+    else if(!(strcmp(targetconf,"router")))
+        ar->arVersion.targetconf_ver = AR6003_SUBVER_ROUTER;
+    else
+        ar->arVersion.targetconf_ver = AR6003_SUBVER_DEFAULT;
+
+    ar6000_init_profile_info(arPriv);
+
+    if((arPriv->conn_aggr = aggr_init_conn()) == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+             ("%s() Failed to initialize aggr.\n", __func__));
+        return A_ERROR;
+    }
+    return A_OK;
+}
+
+static int
+ar6000_open(struct net_device *dev)
+{
+    unsigned long  flags;
+    AR_SOFTC_DEV_T    *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    spin_lock_irqsave(&arPriv->arPrivLock, flags);
+
+#ifdef ATH6K_CONFIG_CFG80211
+    if(arPriv->arSoftc->arWlanState == WLAN_DISABLED) {
+        arPriv->arSoftc->arWlanState = WLAN_ENABLED;
+    }
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    if( arPriv->arConnected || bypasswmi) {
+        netif_carrier_on(dev);
+        /* Wake up the queues */
+        netif_wake_queue(dev);
+    }
+    else
+        netif_carrier_off(dev);
+
+    spin_unlock_irqrestore(&arPriv->arPrivLock, flags);
+    return 0;
+}
+
+static int
+ar6000_close(struct net_device *dev)
+{
+#ifdef ATH6K_CONFIG_CFG80211
+    AR_SOFTC_DEV_T    *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+#endif /* ATH6K_CONFIG_CFG80211 */
+    netif_stop_queue(dev);
+
+#ifdef ATH6K_CONFIG_CFG80211
+    ar6000_disconnect(arPriv);
+
+    if(arPriv->arSoftc->arWmiReady == TRUE) {
+        if (wmi_scanparams_cmd(arPriv->arWmi, 0xFFFF, 0,
+                               0, 0, 0, 0, 0, 0, 0, 0) != A_OK) {
+            return -EIO;
+        }
+        arPriv->arSoftc->arWlanState = WLAN_DISABLED;
+    }
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    return 0;
+}
+
+/* connect to a service */
+static A_STATUS ar6000_connectservice(AR_SOFTC_DEV_T           *arPriv,
+                                      HTC_SERVICE_CONNECT_REQ  *pConnect,
+                                      char                     *pDesc)
+{
+    A_STATUS status;
+    HTC_SERVICE_CONNECT_RESP response;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    do {
+
+        A_MEMZERO(&response,sizeof(response));
+
+        status = HTCConnectService(ar->arHtcTarget,
+                                   pConnect,
+                                   &response);
+
+        if (A_FAILED(status)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" Failed to connect to %s service status:%d \n",
+                              pDesc, status));
+            break;
+        }
+        switch (pConnect->ServiceID) {
+        case WMI_CONTROL_SVC :
+                if(!bypasswmi)
+                {
+                /* set control endpoint for WMI use */
+                wmi_set_control_ep(arPriv->arWmi, response.Endpoint);
+                /* save EP for fast lookup */
+                ar->arControlEp = response.Endpoint;
+            }
+            break;
+        case WMI_DATA_BE_SVC :
+            arSetAc2EndpointIDMap(ar, WMM_AC_BE, response.Endpoint);
+            break;
+        case WMI_DATA_BK_SVC :
+            arSetAc2EndpointIDMap(ar, WMM_AC_BK, response.Endpoint);
+            break;
+        case WMI_DATA_VI_SVC :
+            arSetAc2EndpointIDMap(ar, WMM_AC_VI, response.Endpoint);
+            break;
+        case WMI_DATA_VO_SVC :
+            arSetAc2EndpointIDMap(ar, WMM_AC_VO, response.Endpoint);
+            break;
+        default:
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ServiceID not mapped %d\n", pConnect->ServiceID));
+            status = A_EINVAL;
+            break;
+        }
+
+    } while (FALSE);
+
+    return status;
+}
+
+void ar6000_TxDataCleanup(AR_SOFTC_T *ar)
+{
+    /* flush all the data (non-control) streams
+     * we only flush packets that are tagged as data, we leave any control packets that
+     * were in the TX queues alone */
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_BE),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_BK),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_VI),
+                     AR6K_DATA_PKT_TAG);
+    HTCFlushEndpoint(ar->arHtcTarget,
+                     arAc2EndpointID(ar, WMM_AC_VO),
+                     AR6K_DATA_PKT_TAG);
+}
+
+HTC_ENDPOINT_ID
+ar6000_ac2_endpoint_id ( void * devt, A_UINT8 ac)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *) devt;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    return(arAc2EndpointID(ar, ac));
+}
+
+A_UINT8
+ar6000_endpoint_id2_ac(void * devt, HTC_ENDPOINT_ID ep )
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *) devt;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    return(arEndpoint2Ac(ar, ep ));
+}
+
+
+/* This function does one time initialization for the lifetime of the device */
+int ar6000_init(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_T *ar;
+    int ret = 0;
+    int i = 0;
+    int j = 0;
+    A_STATUS status;
+    A_INT32 timeleft;
+#if defined(INIT_MODE_DRV_ENABLED) && defined(ENABLE_COEXISTENCE)
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD sbcb_cmd;
+    WMI_SET_BTCOEX_FE_ANT_CMD sbfa_cmd;
+#endif /* INIT_MODE_DRV_ENABLED && ENABLE_COEXISTENCE */
+
+    dev_hold(dev);
+
+    if(ar6k_init)
+    {
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6000 Initialised\n"));
+        goto ar6000_init_done;
+    }
+
+    ar6k_init = TRUE;
+    if((arPriv = ar6k_priv(dev)) == NULL)
+    {
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    ar = arPriv->arSoftc;
+
+    if (wlaninitmode == WLAN_INIT_MODE_USR || wlaninitmode == WLAN_INIT_MODE_DRV) {
+
+        ar6000_update_bdaddr(ar);
+    }
+
+    if (enablerssicompensation) {
+        ar6000_copy_cust_data_from_target(ar->arHifDevice, ar->arTargetType);
+        read_rssi_compensation_param(ar);
+       for(j=0; j<num_device; j++) {
+           for (i=-95; i<=0; i++) {
+               rssi_compensation_table[j][0-i] = rssi_compensation_calc(ar->arDev[j],i);
+            }
+        }
+    }
+
+    /* Do we need to finish the BMI phase */
+
+    if ((wlaninitmode==WLAN_INIT_MODE_USR || wlaninitmode==WLAN_INIT_MODE_DRV) &&
+       (BMIDone(ar->arHifDevice) != A_OK))
+    {
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    do {
+        HTC_SERVICE_CONNECT_REQ connect;
+
+        /* the reason we have to wait for the target here is that the driver layer
+         * has to init BMI in order to set the host block size,
+         */
+        status = HTCWaitTarget(ar->arHtcTarget);
+
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        A_MEMZERO(&connect,sizeof(connect));
+        /* meta data is unused for now */
+        connect.pMetaData = NULL;
+        connect.MetaDataLength = 0;
+        /* these fields are the same for all service endpoints */
+        connect.EpCallbacks.pContext = ar;
+        connect.EpCallbacks.EpTxCompleteMultiple = ar6000_tx_complete;
+        connect.EpCallbacks.EpRecv = ar6000_rx;
+        connect.EpCallbacks.EpRecvRefill = ar6000_rx_refill;
+        connect.EpCallbacks.EpSendFull = ar6000_tx_queue_full;
+        /* set the max queue depth so that our ar6000_tx_queue_full handler gets called.
+         * Linux has the peculiarity of not providing flow control between the
+         * NIC and the network stack. There is no API to indicate that a TX packet
+         * was sent which could provide some back pressure to the network stack.
+         * Under linux you would have to wait till the network stack consumed all sk_buffs
+         * before any back-flow kicked in. Which isn't very friendly.
+         * So we have to manage this ourselves */
+        connect.MaxSendQueueDepth = MAX_DEFAULT_SEND_QUEUE_DEPTH;
+        connect.EpCallbacks.RecvRefillWaterMark = AR6000_MAX_RX_BUFFERS / 4; /* set to 25 % */
+        if (0 == connect.EpCallbacks.RecvRefillWaterMark) {
+            connect.EpCallbacks.RecvRefillWaterMark++;
+        }
+        /* connect to control service */
+        connect.ServiceID = WMI_CONTROL_SVC;
+        status = ar6000_connectservice(arPriv,
+                                       &connect,
+                                       "WMI CONTROL");
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        connect.LocalConnectionFlags |= HTC_LOCAL_CONN_FLAGS_ENABLE_SEND_BUNDLE_PADDING;
+        /* limit the HTC message size on the send path, although we can receive A-MSDU frames of
+         * 4K, we will only send ethernet-sized (802.3) frames on the send path. */
+        connect.MaxSendMsgSize = WMI_MAX_TX_DATA_FRAME_LENGTH;
+
+        /* to reduce the amount of committed memory for larger A_MSDU frames, use the recv-alloc threshold
+         * mechanism for larger packets */
+        connect.EpCallbacks.RecvAllocThreshold = AR6000_BUFFER_SIZE;
+        connect.EpCallbacks.EpRecvAllocThresh = ar6000_alloc_amsdu_rxbuf;
+
+        /* for the remaining data services set the connection flag to reduce dribbling,
+         * if configured to do so */
+        if (reduce_credit_dribble) {
+            connect.ConnectionFlags |= HTC_CONNECT_FLAGS_REDUCE_CREDIT_DRIBBLE;
+            /* the credit dribble trigger threshold is (reduce_credit_dribble - 1) for a value
+             * of 0-3 */
+            connect.ConnectionFlags &= ~HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
+            connect.ConnectionFlags |=
+                        ((A_UINT16)reduce_credit_dribble - 1) & HTC_CONNECT_FLAGS_THRESHOLD_LEVEL_MASK;
+        }
+        /* connect to best-effort service */
+        connect.ServiceID = WMI_DATA_BE_SVC;
+
+        status = ar6000_connectservice(arPriv,
+                                       &connect,
+                                       "WMI DATA BE");
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        /* connect to back-ground
+         * map this to WMI LOW_PRI */
+        connect.ServiceID = WMI_DATA_BK_SVC;
+        status = ar6000_connectservice(arPriv,
+                                       &connect,
+                                       "WMI DATA BK");
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        /* connect to Video service, map this to
+         * to HI PRI */
+        connect.ServiceID = WMI_DATA_VI_SVC;
+        status = ar6000_connectservice(arPriv,
+                                       &connect,
+                                       "WMI DATA VI");
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        /* connect to VO service, this is currently not
+         * mapped to a WMI priority stream due to historical reasons.
+         * WMI originally defined 3 priorities over 3 mailboxes
+         * We can change this when WMI is reworked so that priorities are not
+         * dependent on mailboxes */
+        connect.ServiceID = WMI_DATA_VO_SVC;
+        status = ar6000_connectservice(arPriv,
+                                       &connect,
+                                       "WMI DATA VO");
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_BE) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_BK) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_VI) != 0);
+        A_ASSERT(arAc2EndpointID(ar,WMM_AC_VO) != 0);
+
+        /* setup access class priority mappings */
+        ar->arAcStreamPriMap[WMM_AC_BK] = 0; /* lowest  */
+        ar->arAcStreamPriMap[WMM_AC_BE] = 1; /*         */
+        ar->arAcStreamPriMap[WMM_AC_VI] = 2; /*         */
+        ar->arAcStreamPriMap[WMM_AC_VO] = 3; /* highest */
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        if (setuphci && (NULL != ar6kHciTransCallbacks.setupTransport)) {
+            HCI_TRANSPORT_MISC_HANDLES hciHandles;
+
+            hciHandles.netDevice = ar->arNetDev;
+            hciHandles.hifDevice = ar->arHifDevice;
+            hciHandles.htcHandle = ar->arHtcTarget;
+            status = (A_STATUS)(ar6kHciTransCallbacks.setupTransport(&hciHandles));
+        }
+#else
+        if (setuphci) {
+            /* setup HCI */
+            status = ar6000_setup_hci(ar);
+        }
+#endif
+
+    } while (FALSE);
+
+    if (A_FAILED(status)) {
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    /*
+     * give our connected endpoints some buffers
+     */
+
+    ar6000_rx_refill(ar, ar->arControlEp);
+    ar6000_rx_refill(ar, arAc2EndpointID(ar,WMM_AC_BE));
+
+    /*
+     * We will post the receive buffers only for SPE or endpoint ping testing so we are
+     * making it conditional on the 'bypasswmi' flag.
+     */
+    if (bypasswmi) {
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_BK));
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_VI));
+        ar6000_rx_refill(ar,arAc2EndpointID(ar,WMM_AC_VO));
+    }
+
+    /* allocate some buffers that handle larger AMSDU frames */
+    ar6000_refill_amsdu_rxbufs(ar,AR6000_MAX_AMSDU_RX_BUFFERS);
+
+    /* setup credit distribution */
+    ar6000_setup_credit_dist(ar->arHtcTarget, &ar->arCreditStateInfo);
+
+    /* Since cookies are used for HTC transports, they should be */
+    /* initialized prior to enabling HTC.                        */
+    ar6000_cookie_init(ar);
+
+    /* Initialize the control cookie counter to 0 */
+    ar->arControlCookieCount = 0;
+
+    /* start HTC */
+    status = HTCStart(ar->arHtcTarget);
+    if (status != A_OK) {
+        for(i = 0; i < num_device; i++)
+        {
+            if (ar->arDev[i]->arWmiEnabled == TRUE) {
+                wmi_shutdown(ar->arDev[i]->arWmi);
+                ar->arDev[i]->arWmiEnabled = FALSE;
+                ar->arDev[i]->arWmi = NULL;
+            }
+        }
+        ar6000_cookie_cleanup(ar);
+        ret = -EIO;
+        goto ar6000_init_done;
+    }
+
+    if (!bypasswmi) {
+        /* Wait for Wmi event to be ready */
+        timeleft = wait_event_interruptible_timeout(ar->arDev[0]->arEvent,
+            (ar->arWmiReady == TRUE), wmitimeout * HZ);
+
+        if (ar->arVersion.abi_ver != AR6K_ABI_VERSION) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ABI Version mismatch: Host(0x%x), Target(0x%x)\n", AR6K_ABI_VERSION, ar->arVersion.abi_ver));
+#ifndef ATH6KL_SKIP_ABI_VERSION_CHECK
+            ret = -EIO;
+            goto ar6000_init_done;
+#endif /* ATH6KL_SKIP_ABI_VERSION_CHECK */
+        }
+
+        if(!timeleft || signal_pending(current))
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI is not ready or wait was interrupted\n"));
+            ret = -EIO;
+            goto ar6000_init_done;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%s() WMI is ready\n", __func__));
+
+        /* init PAL driver after WMI is ready */
+
+        if(setuphcipal) {
+            A_BOOL bt30ampDevFound = FALSE;
+            for (i=0; i < num_device; i++) {
+                if ( ar->arDev[i]->isBt30amp == TRUE ) {
+                    status = ar6k_setup_hci_pal(ar->arDev[i]);
+                    bt30ampDevFound = TRUE;
+                }
+
+            }
+        }
+
+        /* Communicate the wmi protocol verision to the target */
+        if ((ar6000_set_host_app_area(ar)) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set the host app area\n"));
+        }
+
+        /* configure the device for rx dot11 header rules 0,0 are the default values
+         * therefore this command can be skipped if the inputs are 0,FALSE,FALSE.Required
+         if checksum offload is needed. Set RxMetaVersion to 2*/
+        if ((wmi_set_rx_frame_format_cmd(arPriv->arWmi,ar->rxMetaVersion, processDot11Hdr, processDot11Hdr)) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set the rx frame format.\n"));
+        }
+
+#if defined(INIT_MODE_DRV_ENABLED) && defined(ENABLE_COEXISTENCE)
+        /* Configure the type of BT collocated with WLAN */
+        A_MEMZERO(&sbcb_cmd, sizeof(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD));
+#ifdef CONFIG_AR600x_BT_QCOM
+        sbcb_cmd.btcoexCoLocatedBTdev = 1;
+#elif defined(CONFIG_AR600x_BT_CSR)
+        sbcb_cmd.btcoexCoLocatedBTdev = 2;
+#elif defined(CONFIG_AR600x_BT_AR3001)
+        sbcb_cmd.btcoexCoLocatedBTdev = 3;
+#else
+#error Unsupported Bluetooth Type
+#endif /* Collocated Bluetooth Type */
+
+        if ((wmi_set_btcoex_colocated_bt_dev_cmd(arPriv->arWmi, &sbcb_cmd)) != A_OK)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set collocated BT type\n"));
+        }
+
+        /* Configure the type of BT collocated with WLAN */
+        A_MEMZERO(&sbfa_cmd, sizeof(WMI_SET_BTCOEX_FE_ANT_CMD));
+#ifdef CONFIG_AR600x_DUAL_ANTENNA
+        sbfa_cmd.btcoexFeAntType = 2;
+#elif defined(CONFIG_AR600x_SINGLE_ANTENNA)
+        sbfa_cmd.btcoexFeAntType = 1;
+#else
+#error Unsupported Front-End Antenna Configuration
+#endif /* AR600x Front-End Antenna Configuration */
+
+        if ((wmi_set_btcoex_fe_ant_cmd(arPriv->arWmi, &sbfa_cmd)) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to set fornt end antenna configuration\n"));
+        }
+#endif /* INIT_MODE_DRV_ENABLED && ENABLE_COEXISTENCE */
+    }
+
+    ar->arNumDataEndPts = 1;
+
+    if (bypasswmi) {
+        /* for tests like endpoint ping, the MAC address needs to be non-zero otherwise
+         * the data path through a raw socket is disabled */
+        dev->dev_addr[0] = 0x00;
+        dev->dev_addr[1] = 0x01;
+        dev->dev_addr[2] = 0x02;
+        dev->dev_addr[3] = 0xAA;
+        dev->dev_addr[4] = 0xBB;
+        dev->dev_addr[5] = 0xCC;
+    }
+
+
+ar6000_init_done:
+    dev_put(dev);
+
+    return ret;
+
+}
+
+
+void
+ar6000_bitrate_rx(void *devt, A_INT32 rateKbps)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    arPriv->arBitRate = rateKbps;
+    wake_up(&arPriv->arEvent);
+}
+
+void
+ar6000_ratemask_rx(void *devt, A_UINT32 *ratemask)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    arPriv->arRateMask[0] = ratemask[0];
+    arPriv->arRateMask[1] = ratemask[1];
+    wake_up(&arPriv->arEvent);
+}
+
+void
+ar6000_txPwr_rx(void *devt, A_UINT8 txPwr)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    arPriv->arTxPwr = txPwr;
+    wake_up(&arPriv->arEvent);
+}
+
+
+void
+ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    A_MEMCPY(arPriv->arSta.arChannelList, chanList, numChan * sizeof (A_UINT16));
+    arPriv->arSta.arNumChannels = numChan;
+
+    wake_up(&arPriv->arEvent);
+}
+
+A_UINT8
+ar6000_ibss_map_epid(struct sk_buff *skb, struct net_device *dev, A_UINT32 * mapNo)
+{
+    AR_SOFTC_DEV_T  *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT8 *datap;
+    ATH_MAC_HDR *macHdr;
+    A_UINT32 i, eptMap;
+
+    (*mapNo) = 0;
+    datap = A_NETBUF_DATA(skb);
+    macHdr = (ATH_MAC_HDR *)(datap + sizeof(WMI_DATA_HDR));
+    if (IEEE80211_IS_MULTICAST(macHdr->dstMac)) {
+        return ENDPOINT_2;
+    }
+
+    eptMap = -1;
+    for (i = 0; i < arSta->arNodeNum; i ++) {
+        if (IEEE80211_ADDR_EQ(macHdr->dstMac, arSta->arNodeMap[i].macAddress)) {
+            (*mapNo) = i + 1;
+            arSta->arNodeMap[i].txPending ++;
+            return arSta->arNodeMap[i].epId;
+        }
+
+        if ((eptMap == -1) && !arSta->arNodeMap[i].txPending) {
+            eptMap = i;
+        }
+    }
+
+    if (eptMap == -1) {
+        eptMap = arSta->arNodeNum;
+        arSta->arNodeNum ++;
+        A_ASSERT(arSta->arNodeNum <= MAX_NODE_NUM);
+    }
+
+    A_MEMCPY(arSta->arNodeMap[eptMap].macAddress, macHdr->dstMac, IEEE80211_ADDR_LEN);
+
+    for (i = ENDPOINT_2; i <= ENDPOINT_5; i ++) {
+        if (!ar->arTxPending[i]) {
+            arSta->arNodeMap[eptMap].epId = i;
+            break;
+        }
+        // No free endpoint is available, start redistribution on the inuse endpoints.
+        if (i == ENDPOINT_5) {
+            arSta->arNodeMap[eptMap].epId = arSta->arNexEpId;
+            arSta->arNexEpId ++;
+            if (arSta->arNexEpId > ENDPOINT_5) {
+                arSta->arNexEpId = ENDPOINT_2;
+            }
+        }
+    }
+
+    (*mapNo) = eptMap + 1;
+    arSta->arNodeMap[eptMap].txPending ++;
+
+    return arSta->arNodeMap[eptMap].epId;
+}
+
+#ifdef DEBUG
+static void ar6000_dump_skb(struct sk_buff *skb)
+{
+   u_char *ch;
+   for (ch = A_NETBUF_DATA(skb);
+        (A_UINT32)ch < ((A_UINT32)A_NETBUF_DATA(skb) +
+        A_NETBUF_LEN(skb)); ch++)
+    {
+         AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("%2.2x ", *ch));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("\n"));
+}
+#endif
+
+#ifdef HTC_TEST_SEND_PKTS
+static void DoHTCSendPktsTest(AR_SOFTC_T *ar, int MapNo, HTC_ENDPOINT_ID eid, struct sk_buff *skb);
+#endif
+
+static int
+ar6000_data_tx(struct sk_buff *skb, struct net_device *dev)
+{
+#define AC_NOT_MAPPED   99
+    AR_SOFTC_DEV_T     *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+    AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+    A_UINT8 ac = AC_NOT_MAPPED;
+    HTC_ENDPOINT_ID eid = ENDPOINT_UNUSED;
+    A_UINT32 mapNo = 0;
+    int len;
+    struct ar_cookie *cookie;
+    A_BOOL checkAdHocPsMapping = FALSE;
+    HTC_TX_TAG htc_tag = AR6K_DATA_PKT_TAG;
+    A_UINT8 dot11Hdr = processDot11Hdr;
+    conn_t *conn = NULL;
+    A_UINT32 wmiDataFlags = 0;
+
+#ifdef AR6K_ALLOC_DEBUG
+    A_NETBUF_CHECK(skb);
+#endif
+
+#ifdef CONFIG_PM
+    if ((ar->arWowState != WLAN_WOW_STATE_NONE) || (ar->arWlanState == WLAN_DISABLED)) {
+        A_NETBUF_FREE(skb);
+        return 0;
+    }
+#endif /* CONFIG_PM */
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,13)
+    skb->list = NULL;
+#endif
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar6000_data_tx start - skb=0x%x, data=0x%x, len=0x%x\n",
+                     (A_UINT32)skb, (A_UINT32)A_NETBUF_DATA(skb),
+                     A_NETBUF_LEN(skb)));
+
+    /* If target is not associated */
+    if( (!arPriv->arConnected && !bypasswmi)
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+     /* TCMD doesnt support any data, free the buf and return */
+    || (ar->arTargetMode == AR6000_TCMD_MODE)
+#endif
+       ) {
+        A_NETBUF_FREE(skb);
+        return 0;
+    }
+
+    do {
+
+        if (ar->arWmiReady == FALSE && bypasswmi == 0) {
+            break;
+        }
+
+#ifdef BLOCK_TX_PATH_FLAG
+        if (blocktx) {
+            break;
+        }
+#endif /* BLOCK_TX_PATH_FLAG */
+
+        /* AP mode Power save processing */
+        /* If the dst STA is in sleep state, queue the pkt in its PS queue */
+
+        if (arPriv->arNetworkType == AP_NETWORK) {
+            ATH_MAC_HDR *datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+            struct sk_buff *skb_to_drop = NULL;
+
+            /* If the dstMac is a Multicast address & atleast one of the
+             * associated STA is in PS mode, then queue the pkt to the
+             * mcastq
+             */
+            if (IEEE80211_IS_MULTICAST(datap->dstMac)) {
+                A_UINT8 ctr=0;
+                A_BOOL qMcast=FALSE;
+
+                for (ctr=0; ctr<NUM_CONN; ctr++) {
+                    if(ar->connTbl[ctr].arPriv == arPriv) {
+                        if (STA_IS_PWR_SLEEP((&ar->connTbl[ctr]))) {
+                            qMcast = TRUE;
+                        }
+                    }
+                }
+                if(qMcast) {
+                    /* If this transmit is not because of a Dtim Expiry q it */
+                    if (arAp->DTIMExpired == FALSE) {
+                        A_BOOL isMcastqEmpty = FALSE;
+
+                        A_MUTEX_LOCK(&arAp->mcastpsqLock);
+
+                        /* Check for queue depth, if overflowing then dequeue a
+                         * packet so that there is room for new one
+                         */
+                        if (max_psq_depth != 0 &&
+                                A_NETBUF_QUEUE_SIZE(&arAp->mcastpsq) >= max_psq_depth) {
+                            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                                    ("TX Mcast PS queue is full, Depth:%d, Max:%d \n",
+                                     A_NETBUF_QUEUE_SIZE(&arAp->mcastpsq), max_psq_depth));
+
+                            skb_to_drop = A_NETBUF_DEQUEUE(&arAp->mcastpsq);
+                        }
+
+                        isMcastqEmpty = A_NETBUF_QUEUE_EMPTY(&arAp->mcastpsq);
+                        A_NETBUF_ENQUEUE(&arAp->mcastpsq, skb);
+                        A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+
+                        /* Free the SKB outside the lock */
+                        if (skb_to_drop != NULL) {
+                            A_NETBUF_FREE(skb_to_drop);
+                        }
+
+                        /* If this is the first Mcast pkt getting queued
+                         * indicate to the target to set the BitmapControl LSB
+                         * of the TIM IE.
+                         */
+                        if (isMcastqEmpty) {
+                            wmi_set_pvb_cmd(arPriv->arWmi, MCAST_AID, 1);
+                        }
+                        return 0;
+                    } else {
+                        /* This transmit is because of Dtim expiry. Determine if
+                         * MoreData bit has to be set.
+                         */
+                        A_MUTEX_LOCK(&arAp->mcastpsqLock);
+                         if(!A_NETBUF_QUEUE_EMPTY(&arAp->mcastpsq)) {
+                            wmiDataFlags |= WMI_DATA_HDR_FLAGS_MORE;
+                        }
+                        A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+                    }
+                }
+            } else {
+                conn = ieee80211_find_conn(arPriv, datap->dstMac);
+                if (conn) {
+                    if (STA_IS_PWR_SLEEP(conn)) {
+                        /* If this transmit is not because of a PsPoll q it*/
+                        if (!(STA_IS_PS_POLLED(conn) || STA_IS_APSD_TRIGGER(conn))) {
+                            A_BOOL trigger = FALSE;
+                            A_UINT32 cur_psq_len = 0;
+
+                            if (conn->apsd_info) {
+                                A_UINT8 up = 0;
+                                A_UINT8 trafficClass;
+
+                                if (arPriv->arWmmEnabled) {
+                                    A_UINT16 ipType = IP_ETHERTYPE;
+                                    A_UINT16 etherType;
+                                    A_UINT8 *ipHdr;
+
+                                    etherType = datap->typeOrLen;
+                                    if (IS_ETHERTYPE(A_BE2CPU16(etherType))) {
+                                        /* packet is in DIX format  */
+                                        ipHdr = (A_UINT8 *)(datap + 1);
+                                    } else {
+                                        /* packet is in 802.3 format */
+                                        ATH_LLC_SNAP_HDR *llcHdr;
+
+                                        llcHdr = (ATH_LLC_SNAP_HDR *)(datap + 1);
+                                        etherType = llcHdr->etherType;
+                                        ipHdr = (A_UINT8 *)(llcHdr + 1);
+                                    }
+
+                                    if (etherType == A_CPU2BE16(ipType)) {
+                                        up = wmi_determine_userPriority (ipHdr, 0);
+                                    }
+                                }
+                                trafficClass = convert_userPriority_to_trafficClass(up);
+                                if (conn->apsd_info & (1 << trafficClass)) {
+                                    trigger = TRUE;
+                                }
+                            }
+
+
+                            if (trigger) {
+                                A_BOOL isApsdqEmpty;
+                                /* Queue the frames if the STA is sleeping */
+                                A_MUTEX_LOCK(&conn->psqLock);
+
+                                /* If max_psq_depth is 0 then no limit to queue size */
+                                if (max_psq_depth != 0) {
+
+                                    /* APSD queue depth + PS queue depth should
+                                     * not be more than MAX PS queue depth
+                                     */
+                                    cur_psq_len = A_NETBUF_QUEUE_SIZE(&conn->apsdq) +
+                                        A_NETBUF_QUEUE_SIZE(&conn->psq);
+
+                                    /* Check for queue depth, if overflowing then
+                                     * dequeue a packet so that there is room for
+                                     * new one
+                                     */
+                                    if (cur_psq_len >= max_psq_depth) {
+                                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                                                ("TX STA PS(APSD) queue is full, Depth:%d, Max:%d \n",
+                                                 cur_psq_len, max_psq_depth));
+
+                                        skb_to_drop = A_NETBUF_DEQUEUE(&conn->apsdq);
+                                    }
+                                }
+
+                                isApsdqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->apsdq);
+                                A_NETBUF_ENQUEUE(&conn->apsdq, skb);
+                                A_MUTEX_UNLOCK(&conn->psqLock);
+
+                                /* Free the SKB outside the lock */
+                                if (skb_to_drop != NULL) {
+                                    A_NETBUF_FREE(skb_to_drop);
+                                }
+
+                                /* If this is the first pkt getting queued
+                                * for this STA, update the PVB for this STA
+                                */
+                                if (isApsdqEmpty) {
+                                    wmi_set_apsd_buffered_traffic_cmd(arPriv->arWmi, conn->aid, 1, 0);
+                                }
+                            } else {
+                                A_BOOL isPsqEmpty = FALSE;
+                                /* Queue the frames if the STA is sleeping */
+                                A_MUTEX_LOCK(&conn->psqLock);
+
+                                /* If max_psq_depth is 0 then no limit to queue size */
+                                if (max_psq_depth != 0) {
+
+                                    /* APSD queue depth + PS queue depth should
+                                     * not be more than MAX PS queue depth
+                                     */
+                                    cur_psq_len = A_NETBUF_QUEUE_SIZE(&conn->apsdq) +
+                                        A_NETBUF_QUEUE_SIZE(&conn->psq);
+
+                                    /* Check for queue depth, if overflowing then
+                                     * dequeue a packet so that there is room for
+                                     * new one
+                                     */
+                                    if (cur_psq_len >= max_psq_depth) {
+                                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                                                ("TX STA PS queue is full, Depth:%d, Max:%d \n",
+                                                 cur_psq_len, max_psq_depth));
+
+                                        skb_to_drop = A_NETBUF_DEQUEUE(&conn->psq);
+                                    }
+                                }
+
+                                /* Free the SKB outside the lock */
+                                if (skb_to_drop != NULL) {
+                                    A_NETBUF_FREE(skb_to_drop);
+                                }
+                                isPsqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+                                A_NETBUF_ENQUEUE(&conn->psq, skb);
+                                A_MUTEX_UNLOCK(&conn->psqLock);
+
+                                /* If this is the first pkt getting queued
+                                * for this STA, update the PVB for this STA
+                                */
+                                if (isPsqEmpty) {
+                                    wmi_set_pvb_cmd(arPriv->arWmi, conn->aid, 1);
+                                }
+                            }
+
+                            return 0;
+                        } else {
+                            /*
+                             * This tx is because of a PsPoll or trigger. Determine if
+                             * MoreData bit has to be set
+                             */
+                            A_MUTEX_LOCK(&conn->psqLock);
+                            if (STA_IS_PS_POLLED(conn)) {
+                                if (!A_NETBUF_QUEUE_EMPTY(&conn->psq)) {
+                                    wmiDataFlags |= WMI_DATA_HDR_FLAGS_MORE;
+                                }
+                            } else {
+                                /*
+                                 * This tx is because of a uAPSD trigger, determine
+                                 * more and EOSP bit. Set EOSP is queue is empty
+                                 * or sufficient frames is delivered for this trigger
+                                 */
+                                if (!A_NETBUF_QUEUE_EMPTY(&conn->apsdq)) {
+                                    wmiDataFlags |= WMI_DATA_HDR_FLAGS_MORE;
+                                }
+                                if (STA_IS_APSD_EOSP(conn)) {
+                                    wmiDataFlags |= WMI_DATA_HDR_FLAGS_EOSP;
+                                }
+                            }
+                            A_MUTEX_UNLOCK(&conn->psqLock);
+                        }
+                    }
+                } else {
+
+                    /* non existent STA. drop the frame */
+                    A_NETBUF_FREE(skb);
+                    return 0;
+                }
+            }
+        }
+
+        if (arPriv->arWmiEnabled) {
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+        A_UINT8 csumStart=0;
+        A_UINT8 csumDest=0;
+        A_UINT8 csum=skb->ip_summed;
+        if(csumOffload && (csum==CHECKSUM_PARTIAL)){
+            csumStart=skb->csum_start-(skb->network_header-skb->head)+sizeof(ATH_LLC_SNAP_HDR);
+            csumDest=skb->csum_offset+csumStart;
+            }
+#endif
+            if (A_NETBUF_HEADROOM(skb) < dev->hard_header_len - LINUX_HACK_FUDGE_FACTOR) {
+                struct sk_buff *newbuf;
+
+                /*
+                 * We really should have gotten enough headroom but sometimes
+                 * we still get packets with not enough headroom.  Copy the packet.
+                 */
+                len = A_NETBUF_LEN(skb);
+                newbuf = A_NETBUF_ALLOC(len);
+                if (newbuf == NULL) {
+                    break;
+                }
+                A_NETBUF_PUT(newbuf, len);
+                A_MEMCPY(A_NETBUF_DATA(newbuf), A_NETBUF_DATA(skb), len);
+                A_NETBUF_FREE(skb);
+                skb = newbuf;
+                /* fall through and assemble header */
+            }
+
+            if (dot11Hdr) {
+                if (wmi_dot11_hdr_add(arPriv->arWmi,skb,arPriv->arNetworkType) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx-wmi_dot11_hdr_add failed\n"));
+                    break;
+                }
+            } else {
+                if (wmi_dix_2_dot3(arPriv->arWmi, skb) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_dix_2_dot3 failed\n"));
+                    break;
+                }
+            }
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+            if(csumOffload && (csum ==CHECKSUM_PARTIAL)){
+                WMI_TX_META_V2 metaV2;
+                metaV2.csumStart =csumStart;
+                metaV2.csumDest = csumDest;
+                metaV2.csumFlags = 0x1;/*instruct target to calculate checksum*/
+                if (wmi_data_hdr_add(arPriv->arWmi, skb, DATA_MSGTYPE, wmiDataFlags, dot11Hdr,
+                                        WMI_META_VERSION_2,&metaV2) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_data_hdr_add failed\n"));
+                    break;
+                }
+
+            }
+            else
+#endif
+            {
+                if (wmi_data_hdr_add(arPriv->arWmi, skb, DATA_MSGTYPE, wmiDataFlags, dot11Hdr,0,NULL) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000_data_tx - wmi_data_hdr_add failed\n"));
+                    break;
+                }
+            }
+
+
+            if ((arPriv->arNetworkType == ADHOC_NETWORK) &&
+                arSta->arIbssPsEnable && arPriv->arConnected) {
+                /* flag to check adhoc mapping once we take the lock below: */
+                checkAdHocPsMapping = TRUE;
+
+            } else {
+                A_UINT32 layer2Priority = 0;
+                /* 256->263 are magic values in Linux for passing directly
+                 * 802.1d priority from VLAN tags, etc
+                 */
+                if (skb->priority >= 256 && skb->priority <= 263) {
+                    layer2Priority = skb->priority - 256;
+                }
+                /* get the stream mapping */
+                ac = wmi_implicit_create_pstream(arPriv->arWmi, skb, layer2Priority, arPriv->arWmmEnabled);
+            }
+
+        } else {
+            EPPING_HEADER *eppingHdr;
+
+            eppingHdr = A_NETBUF_DATA(skb);
+
+            if (IS_EPPING_PACKET(eppingHdr)) {
+                /* the stream ID is mapped to an access class */
+                ac = eppingHdr->StreamNo_h;
+                /* some EPPING packets cannot be dropped no matter what access class it was
+                 * sent on.  We can change the packet tag to guarantee it will not get dropped */
+                if (IS_EPING_PACKET_NO_DROP(eppingHdr)) {
+                    htc_tag = AR6K_CONTROL_PKT_TAG;
+                }
+
+                if (ac == HCI_TRANSPORT_STREAM_NUM) {
+                    /* pass this to HCI */
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+                    if (A_SUCCESS(hci_test_send(ar,skb))) {
+                        return 0;
+                    }
+#endif
+                    /* set AC to discard this skb */
+                    ac = AC_NOT_MAPPED;
+                } else {
+                    /* a quirk of linux, the payload of the frame is 32-bit aligned and thus the addition
+                     * of the HTC header will mis-align the start of the HTC frame, so we add some
+                     * padding which will be stripped off in the target */
+                    if (EPPING_ALIGNMENT_PAD > 0) {
+                        A_NETBUF_PUSH(skb, EPPING_ALIGNMENT_PAD);
+                    }
+                }
+
+            } else {
+                /* not a ping packet, drop it */
+                ac = AC_NOT_MAPPED;
+            }
+        }
+
+    } while (FALSE);
+
+    /* did we succeed ? */
+    if ((ac == AC_NOT_MAPPED) && !checkAdHocPsMapping) {
+        /* cleanup and exit */
+        A_NETBUF_FREE(skb);
+        AR6000_STAT_INC(arPriv, tx_dropped);
+        AR6000_STAT_INC(arPriv, tx_aborted_errors);
+        return 0;
+    }
+
+    cookie = NULL;
+
+    /* take the lock to protect driver data */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    do {
+
+        if (checkAdHocPsMapping) {
+            eid = ar6000_ibss_map_epid(skb, dev, &mapNo);
+        }else {
+            eid = arAc2EndpointID (ar, ac);
+        }
+        /* validate that the endpoint is connected */
+        if (eid == 0 || eid == ENDPOINT_UNUSED ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" eid %d is NOT mapped!\n", eid));
+            break;
+        }
+        /* allocate resource for this packet */
+        cookie = ar6000_alloc_cookie(ar);
+
+        if (cookie != NULL) {
+            /* update counts while the lock is held */
+            ar->arTxPending[eid]++;
+            ar->arTotalTxDataPending++;
+            if (htc_tag == AR6K_CONTROL_PKT_TAG) {
+                /* This cookie allocated for a control packet, update count */
+                ar->arControlCookieCount++;
+        }
+        }
+
+    } while (FALSE);
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    if (cookie != NULL) {
+        cookie->arc_bp[0] = (A_UINT32)skb;
+        cookie->arc_bp[1] = mapNo;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(skb),
+                               A_NETBUF_LEN(skb),
+                               eid,
+                               htc_tag);
+
+#ifdef DEBUG
+        if (debugdriver >= 3) {
+            ar6000_dump_skb(skb);
+        }
+#endif
+#ifdef HTC_TEST_SEND_PKTS
+        DoHTCSendPktsTest(ar,mapNo,eid,skb);
+#endif
+        /* HTC interface is asynchronous, if this fails, cleanup will happen in
+         * the ar6000_tx_complete callback */
+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+    } else {
+        /* no packet to send, cleanup */
+        A_NETBUF_FREE(skb);
+        AR6000_STAT_INC(arPriv, tx_dropped);
+        AR6000_STAT_INC(arPriv, tx_aborted_errors);
+    }
+
+    return 0;
+}
+
+int
+ar6000_acl_data_tx(struct sk_buff *skb, AR_SOFTC_DEV_T *arPriv)
+{
+    struct ar_cookie *cookie;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    HTC_ENDPOINT_ID eid = ENDPOINT_UNUSED;
+
+    cookie = NULL;
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    /* For now we send ACL on BE endpoint: We can also have a dedicated EP */
+        eid = arAc2EndpointID (ar, 0);
+    /* allocate resource for this packet */
+    cookie = ar6000_alloc_cookie(ar);
+
+    if (cookie != NULL) {
+        /* update counts while the lock is held */
+        ar->arTxPending[eid]++;
+        ar->arTotalTxDataPending++;
+    }
+
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    if (cookie != NULL) {
+            cookie->arc_bp[0] = (A_UINT32)skb;
+        cookie->arc_bp[1] = 0;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                            cookie,
+                            A_NETBUF_DATA(skb),
+                            A_NETBUF_LEN(skb),
+                            eid,
+                            AR6K_DATA_PKT_TAG);
+
+        /* HTC interface is asynchronous, if this fails, cleanup will happen in
+         * the ar6000_tx_complete callback */
+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+    } else {
+        /* no packet to send, cleanup */
+        A_NETBUF_FREE(skb);
+        AR6000_STAT_INC(arPriv, tx_dropped);
+        AR6000_STAT_INC(arPriv, tx_aborted_errors);
+    }
+    return 0;
+}
+
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+static void
+tvsub(register struct timeval *out, register struct timeval *in)
+{
+    if((out->tv_usec -= in->tv_usec) < 0) {
+        out->tv_sec--;
+        out->tv_usec += 1000000;
+    }
+    out->tv_sec -= in->tv_sec;
+}
+
+void
+applyAPTCHeuristics(AR_SOFTC_DEV_T *arPriv)
+{
+    A_UINT32 duration;
+    A_UINT32 numbytes;
+    A_UINT32 throughput;
+    struct timeval ts;
+    A_STATUS status;
+    APTC_TRAFFIC_RECORD *aptcTR;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    aptcTR = arPriv->aptcTR;
+
+    AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+
+    if ((enableAPTCHeuristics) && (!aptcTR->timerScheduled)) {
+        do_gettimeofday(&ts);
+        tvsub(&ts, &aptcTR->samplingTS);
+        duration = ts.tv_sec * 1000 + ts.tv_usec / 1000; /* ms */
+        numbytes = aptcTR->bytesTransmitted + aptcTR->bytesReceived;
+
+        if (duration > APTC_TRAFFIC_SAMPLING_INTERVAL) {
+            /* Initialize the time stamp and byte count */
+            aptcTR->bytesTransmitted = aptcTR->bytesReceived = 0;
+            do_gettimeofday(&aptcTR->samplingTS);
+
+            /* Calculate and decide based on throughput thresholds */
+            throughput = ((numbytes * 8) / duration);
+            if (throughput > APTC_UPPER_THROUGHPUT_THRESHOLD) {
+                /* Disable Sleep and schedule a timer */
+                A_ASSERT(ar->arWmiReady == TRUE);
+                AR6000_SPIN_UNLOCK(&arPriv->ariPrivLock, 0);
+                status = wmi_powermode_cmd(arPriv->arWmi, MAX_PERF_POWER);
+                AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                A_TIMEOUT_MS(&aptcTimer[arPriv->arDeviceIndex], APTC_TRAFFIC_SAMPLING_INTERVAL, 0);
+                aptcTR->timerScheduled = TRUE;
+            }
+        }
+    }
+
+    AR6000_SPIN_UNLOCK(&arPriv->arLock, 0);
+}
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+static HTC_SEND_FULL_ACTION ar6000_tx_queue_full(void *Context, HTC_PACKET *pPacket)
+{
+    AR_SOFTC_T     *ar = (AR_SOFTC_T *)Context;
+    HTC_SEND_FULL_ACTION action = HTC_SEND_FULL_KEEP;
+    A_BOOL stopNet = FALSE;
+    HTC_ENDPOINT_ID Endpoint = HTC_GET_ENDPOINT_FROM_PKT(pPacket);
+    A_UINT8 i;
+    AR_SOFTC_DEV_T *arPriv;
+    A_UINT32 controlCookieThreshold, highPriorityCookieThreshold;
+
+    do {
+
+        if (bypasswmi) {
+            int accessClass;
+
+            if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_CONTROL_PKT_TAG) {
+                /* don't drop special control packets */
+                break;
+            }
+
+            accessClass = arEndpoint2Ac(ar,Endpoint);
+            /* for endpoint ping testing drop Best Effort and Background */
+            if ((accessClass == WMM_AC_BE) || (accessClass == WMM_AC_BK)) {
+                action = HTC_SEND_FULL_DROP;
+                stopNet = FALSE;
+            } else {
+                /* keep but stop the netqueues */
+                stopNet = TRUE;
+            }
+            break;
+        }
+
+        if (Endpoint == ar->arControlEp) {
+            /* under normal WMI if this is getting full, then something is running rampant
+             * the host should not be exhausting the WMI queue with too many commands
+             * the only exception to this is during testing using endpointping */
+            AR6000_SPIN_LOCK(&ar->arLock, 0);
+            /* set flag to handle subsequent messages */
+            ar->arWMIControlEpFull = TRUE;
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI Control Endpoint is FULL!!! \n"));
+            /* no need to stop the network */
+            stopNet = FALSE;
+            break;
+        }
+
+        /* if we get here, we are dealing with data endpoints getting full */
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        controlCookieThreshold = MAX_CONTROL_COOKIE_NUM - ar->arControlCookieCount;
+        highPriorityCookieThreshold = controlCookieThreshold + MAX_HIGH_PRIORITY_COOKIE_NUM;
+
+        if (ar->arCookieCount <= controlCookieThreshold) {
+            /* the last few cookies are reserved exclusively for sending
+             * control messages on the 4 data endpoints and the control endpoint.  Each of
+             * the 4 data endpoints could need up to 2 sync messages (if we are using
+             * SYNC_BOTH_WMIFLAG) so we need to reserve 11 cookies (2*WMM_NUM_AC=2*4=8)
+             * for the data endpoints and 3 for the control endpoint (one WMI_ADD_CIPHER_CMDID
+             * command and two WMI_SYNCHRONIZE_CMDID commands).  This is why we MUST reserve
+             * some cookies for control messages; SYNC messages are important and dropping
+             * these would effectively make the WiFi connection useless because the AP would be
+             * using a different encryption key.  So, we reserve 11 cookies for sending SYNC
+             * messages, plus one additional (just in case someone happens to issue a wmi command
+             * during the rekey process)
+             */
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_CONTROL_PKT_TAG) {
+            /* don't drop control packets issued on ANY data endpoint */
+            break;
+            } else {
+                /* If cookie count is below controlCookieThreshold and this is NOT a control
+                 * message, stop it from being sent.
+                 */
+                action = HTC_SEND_FULL_DROP;
+                stopNet = FALSE;
+                break;
+        }
+        }
+
+        /* the last highPriorityCookieThreshold "batch" of cookies (except for the last
+         * controlCookieThreshold cookies which are captured by the statement above)
+         * are reserved for the highest priority active stream */
+        if (ar->arAcStreamPriMap[arEndpoint2Ac(ar,Endpoint)] < ar->arHiAcStreamActivePri &&
+            ar->arCookieCount <= highPriorityCookieThreshold) {
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            /* this stream's priority is less than the highest active priority, we
+             * give preference to the highest priority stream by directing
+             * HTC to drop the packet that overflowed */
+            action = HTC_SEND_FULL_DROP;
+            /* since we are dropping packets, no need to stop the network */
+            stopNet = FALSE;
+            break;
+        }
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+    } while (FALSE);
+
+    if (stopNet) {
+        for(i = 0; i < num_device; i++)
+        {
+            arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+            AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+            arPriv->arNetQueueStopped = TRUE;
+            AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+            /* one of the data endpoints queues is getting full..need to stop network stack
+             * the queue will resume in ar6000_tx_complete() */
+            netif_stop_queue(ar6000_devices[i]);
+        }
+    }
+    else
+    {
+        /* in adhoc mode, we cannot differentiate traffic priorities so there is no need to
+        * continue, however we should stop the network */
+        for(i = 0; i < num_device; i++)
+        {
+            arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+            if(arPriv->arNetworkType == ADHOC_NETWORK) {
+                AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                arPriv->arNetQueueStopped = TRUE;
+                AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+                /* one of the data endpoints queues is getting full..need to stop network stack
+                * the queue will resume in ar6000_tx_complete() */
+                netif_stop_queue(ar6000_devices[i]);
+            }
+        }
+    }
+    return action;
+}
+
+
+static void
+ar6000_tx_complete(void *Context, HTC_PACKET_QUEUE *pPacketQueue)
+{
+    AR_SOFTC_T     *ar = (AR_SOFTC_T *)Context;
+    A_UINT32 mapNo = 0;
+    A_STATUS status;
+    struct ar_cookie * ar_cookie;
+    HTC_ENDPOINT_ID eid;
+    A_BOOL wakeEvent = FALSE;
+    struct sk_buff_head skb_queue;
+    HTC_PACKET *pPacket;
+    struct sk_buff *pktSkb;
+    A_BOOL flushing[NUM_DEV];
+    A_INT8 devid = -1;
+    AR_SOFTC_DEV_T *arPriv = NULL;
+    AR_SOFTC_STA_T *arSta;
+    A_UINT8 i;
+
+    skb_queue_head_init(&skb_queue);
+
+    /* lock the driver as we update internal state */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    /* reap completed packets */
+    while (!HTC_QUEUE_EMPTY(pPacketQueue)) {
+
+        pPacket = HTC_PACKET_DEQUEUE(pPacketQueue);
+
+        ar_cookie = (struct ar_cookie *)pPacket->pPktContext;
+        A_ASSERT(ar_cookie);
+
+        status = pPacket->Status;
+        pktSkb = (struct sk_buff *)ar_cookie->arc_bp[0];
+        eid = pPacket->Endpoint;
+        mapNo = ar_cookie->arc_bp[1];
+
+        if(pktSkb == NULL || pPacket->pBuffer != A_NETBUF_DATA(pktSkb))
+        {
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            return;
+        }
+
+        A_ASSERT(pktSkb);
+        A_ASSERT(pPacket->pBuffer == A_NETBUF_DATA(pktSkb));
+
+        /* add this to the list, use faster non-lock API */
+        __skb_queue_tail(&skb_queue,pktSkb);
+
+        if (A_SUCCESS(status)) {
+            A_ASSERT(pPacket->ActualLength == A_NETBUF_LEN(pktSkb));
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar6000_tx_complete skb=0x%x data=0x%x len=0x%x eid=%d ",
+                         (A_UINT32)pktSkb, (A_UINT32)pPacket->pBuffer,
+                         pPacket->ActualLength,
+                         eid));
+
+        ar->arTxPending[eid]--;
+
+        if(!bypasswmi)
+        {
+
+            if (eid != ar->arControlEp) {
+                WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(pktSkb);
+                ar->arTotalTxDataPending--;
+                devid = WMI_DATA_HDR_GET_DEVID(dhdr);
+                arPriv = ar->arDev[devid];
+            }
+
+            if (eid == ar->arControlEp)
+            {
+                WMI_CMD_HDR *cmhdr = (WMI_CMD_HDR*)A_NETBUF_DATA(pktSkb);
+                if (ar->arWMIControlEpFull) {
+                    /* since this packet completed, the WMI EP is no longer full */
+                    ar->arWMIControlEpFull = FALSE;
+#ifdef ANDROID_ENV
+                    android_epfull_cnt = 0;
+#endif
+                }
+
+                if (ar->arTxPending[eid] == 0) {
+                    wakeEvent = TRUE;
+                }
+                devid = WMI_CMD_HDR_GET_DEVID(cmhdr);
+                arPriv = ar->arDev[devid];
+            }
+        }
+        else
+        {
+            devid = 0;
+            arPriv = ar->arDev[devid];
+        }
+
+
+        if (A_FAILED(status)) {
+            if (status == A_ECANCELED || status == A_ECOMM ) {
+                /* a packet was flushed  */
+                flushing[devid] = TRUE;
+            }
+            AR6000_STAT_INC(arPriv, tx_errors);
+            if (status != A_NO_RESOURCE && status != A_ECOMM ) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s() -TX ERROR, status: 0x%x\n", __func__,
+                            status));
+            }
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("OK\n"));
+            flushing[devid] = FALSE;
+            AR6000_STAT_INC(arPriv, tx_packets);
+            arPriv->arNetStats.tx_bytes += A_NETBUF_LEN(pktSkb);
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+            arPriv->aptcTR.bytesTransmitted += a_netbuf_to_len(pktSkb);
+            applyAPTCHeuristics(arPriv);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+        }
+
+        // TODO this needs to be looked at
+        if (arPriv->arNetworkType == ADHOC_NETWORK)
+        {
+            arSta = &arPriv->arSta;
+            if((arSta->arIbssPsEnable && (eid != ar->arControlEp) && mapNo))
+            {
+                mapNo --;
+                arSta->arNodeMap[mapNo].txPending --;
+
+                if (!arSta->arNodeMap[mapNo].txPending && (mapNo == (arSta->arNodeNum - 1))) {
+                    A_UINT32 i;
+                    for (i = arSta->arNodeNum; i > 0; i --) {
+                        if (!arSta->arNodeMap[i - 1].txPending) {
+                            A_MEMZERO(&arSta->arNodeMap[i - 1], sizeof(struct ar_node_mapping));
+                            arSta->arNodeNum --;
+                        } else {
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        ar6000_free_cookie(ar, ar_cookie);
+        if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_CONTROL_PKT_TAG) {
+            /* If we just freed a control packet, update the count */
+            ar->arControlCookieCount--;
+        }
+
+        if (arPriv->arNetQueueStopped) {
+            arPriv->arNetQueueStopped = FALSE;
+        }
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    /* lock is released, we can freely call other kernel APIs */
+
+    /* free all skbs in our local list */
+    while (!skb_queue_empty(&skb_queue)) {
+        /* use non-lock version */
+        pktSkb = __skb_dequeue(&skb_queue);
+        A_NETBUF_FREE(pktSkb);
+    }
+    for(i = 0; i < num_device; i++) {
+        arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+        if (((arPriv->arNetworkType == INFRA_NETWORK ) && (arPriv->arConnected == TRUE))
+                || (bypasswmi)) {
+            if (!flushing[i]) {
+                /* don't wake the queue if we are flushing, other wise it will just
+                 * keep queueing packets, which will keep failing */
+
+                netif_wake_queue(arPriv->arNetDev);
+            }
+        }
+
+        if (wakeEvent) {
+            wake_up(&arPriv->arEvent);
+        }
+    }
+
+}
+
+conn_t *
+ieee80211_find_conn(AR_SOFTC_DEV_T *arPriv, A_UINT8 *node_addr)
+{
+    conn_t *conn = NULL;
+    A_UINT8 i;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (IS_MAC_NULL(node_addr)) {
+        return NULL;
+    }
+
+    for (i = 0; i < NUM_CONN; i++) {
+        if (IEEE80211_ADDR_EQ(node_addr, ar->connTbl[i].mac)) {
+            conn = &ar->connTbl[i];
+            break;
+        }
+    }
+
+    return conn;
+}
+
+conn_t *ieee80211_find_conn_for_aid(AR_SOFTC_DEV_T *arPriv, A_UINT8 aid)
+{
+    conn_t *conn = NULL;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (arPriv->arNetworkType != AP_NETWORK) {
+        conn = NULL;
+    } else if( (aid > 0) && (aid < NUM_CONN) ) {
+        if (ar->connTbl[aid-1].aid == aid) {
+            conn = &ar->connTbl[aid-1];
+        }
+    }
+    return conn;
+}
+
+void *get_aggr_ctx(AR_SOFTC_DEV_T *arPriv, conn_t *conn)
+{
+    if (arPriv->arNetworkType != AP_NETWORK) {
+        return (arPriv->conn_aggr);
+    } else {
+        return (conn->conn_aggr);
+    }
+}
+
+/*
+ * Receive event handler.  This is called by HTC when a packet is received
+ */
+int pktcount;
+static void
+ar6000_rx(void *Context, HTC_PACKET *pPacket)
+{
+    AR_SOFTC_T *ar = NULL;
+    struct sk_buff *skb = NULL;
+    int minHdrLen;
+    A_UINT8 containsDot11Hdr = 0;
+    A_STATUS status;
+    HTC_ENDPOINT_ID ept;
+    conn_t *conn = NULL;
+    AR_SOFTC_DEV_T *arPriv = NULL;
+    A_UINT8 devid ;
+    ATH_MAC_HDR *multicastcheck_datap = NULL;
+
+	if(Context == NULL || pPacket == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY, ("AR6K: Context is null or pPacket is null\n"));
+        goto rx_done;
+    }
+	ar = (AR_SOFTC_T *)Context;
+	skb = (struct sk_buff *)pPacket->pPktContext;
+    status = pPacket->Status;
+    ept = pPacket->Endpoint;
+
+    A_ASSERT((status != A_OK) ||
+             (pPacket->pBuffer == (A_NETBUF_DATA(skb) + HTC_HEADER_LEN)));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_rx ar=0x%x eid=%d, skb=0x%x, data=0x%x, len=0x%x status:%d",
+                    (A_UINT32)ar, ept, (A_UINT32)skb, (A_UINT32)pPacket->pBuffer,
+                    pPacket->ActualLength, status));
+
+    if (status != A_OK) {
+        if (status != A_ECANCELED) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("RX ERR (%d) \n",status));
+        }
+        A_NETBUF_FREE(skb);
+        goto rx_done;
+    }
+
+    /* take lock to protect buffer counts
+     * and adaptive power throughput state */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+    A_NETBUF_PUT(skb, pPacket->ActualLength + HTC_HEADER_LEN);
+    A_NETBUF_PULL(skb, HTC_HEADER_LEN);
+
+    if(!bypasswmi)
+    {
+        if(ept == ar->arControlEp) {
+             WMI_CMD_HDR *cmhdr = (WMI_CMD_HDR*)A_NETBUF_DATA(skb);
+            devid = WMI_CMD_HDR_GET_DEVID(cmhdr);
+            arPriv = ar->arDev[devid];
+        }
+        else {
+             WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
+            devid = WMI_DATA_HDR_GET_DEVID(dhdr);
+            arPriv = ar->arDev[devid];
+        }
+    }
+    else
+    {
+        devid = 0;
+        arPriv = ar->arDev[devid];
+    }
+
+    if (A_SUCCESS(status)) {
+        AR6000_STAT_INC(arPriv, rx_packets);
+        arPriv->arNetStats.rx_bytes += pPacket->ActualLength;
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+        arPriv->aptcTR.bytesReceived += pPacket->ActualLength;
+        applyAPTCHeuristics(arPriv);
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+
+#ifdef DEBUG
+        if (debugdriver >= 2) {
+            ar6000_dump_skb(skb);
+        }
+#endif /* DEBUG */
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    skb->dev = arPriv->arNetDev;
+    if (status != A_OK) {
+        AR6000_STAT_INC(arPriv, rx_errors);
+        A_NETBUF_FREE(skb);
+    } else if (arPriv->arWmiEnabled == TRUE) {
+        if (ept == ar->arControlEp) {
+            /*
+             * this is a wmi control msg
+             */
+#ifdef CONFIG_PM
+            ar6000_check_wow_status(ar, skb, TRUE);
+#endif /* CONFIG_PM */
+            wmi_control_rx(arPriv->arWmi, skb);
+        } else {
+                WMI_DATA_HDR *dhdr = (WMI_DATA_HDR *)A_NETBUF_DATA(skb);
+            A_UINT8 is_amsdu, tid, is_acl_data_frame;
+            is_acl_data_frame = WMI_DATA_HDR_GET_DATA_TYPE(dhdr) == WMI_DATA_HDR_DATA_TYPE_ACL;
+#ifdef CONFIG_PM
+            ar6000_check_wow_status(ar, NULL, FALSE);
+#endif /* CONFIG_PM */
+            /*
+             * this is a wmi data packet
+             */
+            // NWF
+
+            if (processDot11Hdr) {
+                minHdrLen = sizeof(WMI_DATA_HDR) + sizeof(struct ieee80211_frame) + sizeof(ATH_LLC_SNAP_HDR);
+            } else {
+                    minHdrLen = sizeof (WMI_DATA_HDR) + sizeof(ATH_MAC_HDR) +
+                          sizeof(ATH_LLC_SNAP_HDR);
+            }
+
+            /* In the case of AP mode we may receive NULL data frames
+             * that do not have LLC hdr. They are 16 bytes in size.
+             * Allow these frames in the AP mode.
+             * ACL data frames don't follow ethernet frame bounds for
+             * min length
+             */
+                if (arPriv->arNetworkType != AP_NETWORK &&  !is_acl_data_frame &&
+                    ((pPacket->ActualLength < minHdrLen) ||
+                    (pPacket->ActualLength > AR6000_MAX_RX_MESSAGE_SIZE)))
+                {
+                /*
+                 * packet is too short or too long
+                 */
+                    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("TOO SHORT or TOO LONG\n"));
+                AR6000_STAT_INC(arPriv, rx_errors);
+                AR6000_STAT_INC(arPriv, rx_length_errors);
+                A_NETBUF_FREE(skb);
+            } else {
+                A_UINT16 seq_no;
+                A_UINT8 meta_type;
+
+#if 0
+                    /* Access RSSI values here */
+                    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("RSSI %d\n",
+                        ((WMI_DATA_HDR *) A_NETBUF_DATA(skb))->rssi));
+#endif
+                /* Get the Power save state of the STA */
+                if (arPriv->arNetworkType == AP_NETWORK) {
+                        A_UINT8 psState=0,prevPsState;
+                        ATH_MAC_HDR *datap=NULL;
+                    A_UINT16 offset;
+                    A_UINT8 triggerState;
+
+                    meta_type = WMI_DATA_HDR_GET_META(dhdr);
+
+                        psState = (((WMI_DATA_HDR *)A_NETBUF_DATA(skb))->info
+                                     >> WMI_DATA_HDR_PS_SHIFT) & WMI_DATA_HDR_PS_MASK;
+                    triggerState = WMI_DATA_HDR_IS_TRIGGER(dhdr);
+
+
+                    offset = sizeof(WMI_DATA_HDR);
+
+                    switch (meta_type) {
+                    case 0:
+                        break;
+                    case WMI_META_VERSION_1:
+                        offset += sizeof(WMI_RX_META_V1);
+                        break;
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+                    case WMI_META_VERSION_2:
+                        offset += sizeof(WMI_RX_META_V2);
+                        break;
+#endif
+                    default:
+                        break;
+                    }
+#ifdef DIX_RX_OFFLOAD
+#define SKIP_LLC_LEN 8
+                    /*DIX to ETHERNET hdr conversion is offloaded to firmware */
+                    /*Empty LLC header is moved to get ethernet header*/
+                        A_UINT32 datalen = (A_UINT32)A_NETBUF_LEN(skb)-offset;
+
+                    is_amsdu = WMI_DATA_HDR_IS_AMSDU(dhdr);
+                    containsDot11Hdr = WMI_DATA_HDR_GET_DOT11(dhdr);
+                        if(!containsDot11Hdr && !is_amsdu && !is_acl_data_frame
+                            && datalen >= (sizeof(ATH_MAC_HDR) + sizeof(ATH_LLC_SNAP_HDR))) {
+                            datap = (ATH_MAC_HDR *)((A_INT8*)A_NETBUF_DATA(skb)+offset+SKIP_LLC_LEN);
+                        }
+                        else {
+                            datap = (ATH_MAC_HDR *)((A_INT8*)A_NETBUF_DATA(skb)+offset);
+                    }
+
+#else
+                        datap = (ATH_MAC_HDR *)(A_NETBUF_DATA(skb)+offset);
+#endif
+                    conn = ieee80211_find_conn(arPriv, datap->srcMac);
+
+                    if (conn) {
+                        /* if there is a change in PS state of the STA,
+                         * take appropriate steps.
+                         * 1. If Sleep-->Awake, flush the psq for the STA
+                        *    Clear the PVB for the STA.
+                         * 2. If Awake-->Sleep, Starting queueing frames
+                         * the STA.
+                         */
+                        prevPsState = STA_IS_PWR_SLEEP(conn);
+                        if (psState) {
+                            STA_SET_PWR_SLEEP(conn);
+                        } else {
+                            STA_CLR_PWR_SLEEP(conn);
+                        }
+
+                        if (STA_IS_PWR_SLEEP(conn)) {
+                            /* Accept trigger only when the station is in sleep */
+                            if (triggerState) {
+                                ar6000_uapsd_trigger_frame_rx(arPriv, conn);
+                            }
+                        }
+
+                        if (prevPsState ^ STA_IS_PWR_SLEEP(conn)) {
+                            A_BOOL isApsdqEmptyAtStart;
+
+                            if (!STA_IS_PWR_SLEEP(conn)) {
+
+                                A_MUTEX_LOCK(&conn->psqLock);
+
+                                while (!A_NETBUF_QUEUE_EMPTY(&conn->psq)) {
+                                        struct sk_buff *skb=NULL;
+
+                                    skb = A_NETBUF_DEQUEUE(&conn->psq);
+                                    A_MUTEX_UNLOCK(&conn->psqLock);
+                                        ar6000_data_tx(skb,arPriv->arNetDev);
+                                    A_MUTEX_LOCK(&conn->psqLock);
+                                }
+
+                                isApsdqEmptyAtStart = A_NETBUF_QUEUE_EMPTY(&conn->apsdq);
+
+                                while (!A_NETBUF_QUEUE_EMPTY(&conn->apsdq)) {
+                                        struct sk_buff *skb=NULL;
+
+                                    skb = A_NETBUF_DEQUEUE(&conn->apsdq);
+                                    A_MUTEX_UNLOCK(&conn->psqLock);
+                                        ar6000_data_tx(skb,arPriv->arNetDev);
+                                    A_MUTEX_LOCK(&conn->psqLock);
+                                }
+
+                                A_MUTEX_UNLOCK(&conn->psqLock);
+
+                                /* Clear the APSD buffered bitmap for this STA */
+                                if (!isApsdqEmptyAtStart) {
+                                    wmi_set_apsd_buffered_traffic_cmd(arPriv->arWmi, conn->aid, 0, 0);
+                                }
+
+                                /* Clear the PVB for this STA */
+                                wmi_set_pvb_cmd(arPriv->arWmi, conn->aid, 0);
+                            }
+                        }
+
+                    } else {
+                        /* This frame is from a STA that is not associated*/
+                        A_NETBUF_FREE(skb);
+                        goto rx_done;
+                    }
+
+                    /* Drop NULL data frames here */
+                        if((pPacket->ActualLength < minHdrLen) ||
+                                (pPacket->ActualLength > AR6000_MAX_RX_MESSAGE_SIZE)) {
+                        A_NETBUF_FREE(skb);
+                        goto rx_done;
+                    }
+                }
+
+                is_amsdu = WMI_DATA_HDR_IS_AMSDU(dhdr);
+                tid = WMI_DATA_HDR_GET_UP(dhdr);
+                seq_no = WMI_DATA_HDR_GET_SEQNO(dhdr);
+                meta_type = WMI_DATA_HDR_GET_META(dhdr);
+                containsDot11Hdr = WMI_DATA_HDR_GET_DOT11(dhdr);
+
+                wmi_data_hdr_remove(arPriv->arWmi, skb);
+
+                switch (meta_type) {
+                case WMI_META_VERSION_1:
+                     {
+                                WMI_RX_META_V1 *pMeta = (WMI_RX_META_V1 *)A_NETBUF_DATA(skb);
+                                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("META %d %d %d %d %x\n", pMeta->status, pMeta->rix, pMeta->rssi, pMeta->channel, pMeta->flags));
+                                A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V1));
+                        break;
+                    }
+#ifdef CONFIG_CHECKSUM_OFFLOAD
+                case WMI_META_VERSION_2:
+                     {
+                                WMI_RX_META_V2 *pMeta = (WMI_RX_META_V2 *)A_NETBUF_DATA(skb);
+                                if(pMeta->csumFlags & 0x1){
+                                    skb->ip_summed=CHECKSUM_COMPLETE;
+                                    skb->csum=(pMeta->csum);
+                        }
+                                A_NETBUF_PULL((void*)skb, sizeof(WMI_RX_META_V2));
+                        break;
+                    }
+#endif
+                default:
+                    break;
+                }
+
+                A_ASSERT(status == A_OK);
+
+                /* NWF: print the 802.11 hdr bytes */
+                    if(containsDot11Hdr) {
+                        status = wmi_dot11_hdr_remove(arPriv->arWmi,skb);
+                    } else if(!is_amsdu && !is_acl_data_frame) {
+#ifdef DIX_RX_OFFLOAD
+                    /*Skip the conversion its offloaded to firmware*/
+                        if(A_NETBUF_PULL(skb, sizeof(ATH_LLC_SNAP_HDR)) != A_OK) {
+                        status = A_NO_MEMORY;
+                        }
+                        else {
+                        status = A_OK;
+                    }
+#else
+                    status = wmi_dot3_2_dix(skb);
+#endif
+                }
+
+                if (status != A_OK) {
+                    /* Drop frames that could not be processed (lack of memory, etc.) */
+                    A_NETBUF_FREE(skb);
+                    goto rx_done;
+                }
+
+                if (is_acl_data_frame) {
+                    A_NETBUF_PUSH(skb, sizeof(int));
+                        *((short *)A_NETBUF_DATA(skb)) = WMI_ACL_DATA_EVENTID;
+                    /* send the data packet to PAL driver */
+                        if(ar6k_pal_config_g.fpar6k_pal_recv_pkt) {
+                            if((*ar6k_pal_config_g.fpar6k_pal_recv_pkt)(arPriv->hcipal_info, skb) == TRUE)
+                            goto rx_done;
+                    }
+                }
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
+                /*
+                 * extra push and memcpy, for eth_type_trans() of 2.4 kernel
+                 * will pull out hard_header_len bytes of the skb.
+                 */
+                A_NETBUF_PUSH(skb, sizeof(WMI_DATA_HDR) + sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN);
+                    A_MEMCPY(A_NETBUF_DATA(skb), A_NETBUF_DATA(skb) + sizeof(WMI_DATA_HDR) +
+                             sizeof(ATH_LLC_SNAP_HDR) + HTC_HEADER_LEN, sizeof(ATH_MAC_HDR));
+#endif
+
+#ifdef ATH_AR6K_11N_SUPPORT
+                multicastcheck_datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+                /*
+                 * Do not pass multicast/bcast data packets to aggregation module
+                 * incase of STA mode
+                 */
+                if (!(((IEEE80211_IS_MULTICAST(multicastcheck_datap->dstMac))) && (arPriv->arNetworkType == INFRA_NETWORK))){
+                    aggr_process_recv_frm(get_aggr_ctx(arPriv, conn), tid, seq_no, is_amsdu, (void **)&skb);
+                }
+#endif
+                    ar6000_deliver_frames_to_nw_stack((void *) arPriv->arNetDev, (void *)skb);
+            }
+        }
+    } else {
+        if (EPPING_ALIGNMENT_PAD > 0) {
+            A_NETBUF_PULL(skb, EPPING_ALIGNMENT_PAD);
+        }
+        ar6000_deliver_frames_to_nw_stack((void *)arPriv->arNetDev, (void *)skb);
+    }
+
+rx_done:
+
+    return;
+}
+
+static void
+ar6000_deliver_frames_to_nw_stack(void *dev, void *osbuf)
+{
+    struct sk_buff *skb = (struct sk_buff *)osbuf;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if(skb) {
+        skb->dev = dev;
+        if ((skb->dev->flags & IFF_UP) == IFF_UP) {
+
+            if (arPriv->arNetworkType == AP_NETWORK) {
+
+                struct sk_buff *skb1 = NULL;
+                ATH_MAC_HDR *datap;
+                struct net_device *net_dev = arPriv->arNetDev;
+
+#ifdef CONFIG_PM
+                ar6000_check_wow_status(ar, skb, FALSE);
+#endif /* CONFIG_PM */
+
+
+                datap = (ATH_MAC_HDR *)A_NETBUF_DATA(skb);
+
+                if (IEEE80211_IS_MULTICAST(datap->dstMac)) {
+
+                    /* Bcast/Mcast frames should be sent to the OS
+                     * stack as well as on the air.
+                     */
+                    skb1 = skb_copy(skb,GFP_ATOMIC);
+                } else {
+
+                    /* Search for a connected STA with dstMac as
+                     * the Mac address. If found send the frame to
+                     * it on the air else send the frame up the stack
+                     */
+
+                    AR_SOFTC_DEV_T *to_arPriv = NULL;
+                    A_UINT8 is_forward = 0;
+                    conn_t *to_conn = NULL;
+
+                    to_conn = ieee80211_find_conn(arPriv, datap->dstMac);
+
+                    if (to_conn) {
+                        to_arPriv   = (AR_SOFTC_DEV_T *)to_conn->arPriv;
+                        /* Forward data within BSS */
+                        if(arPriv == to_arPriv) {
+                            is_forward = arPriv->arAp.intra_bss;
+                        } else {
+                            /* Forward data within mBSS */
+                            is_forward = ar->inter_bss;
+                            net_dev = to_arPriv->arNetDev;
+                        }
+                         if(is_forward && net_dev) {
+                            skb1 = skb;
+                            skb = NULL;
+                        } else {
+                            A_NETBUF_FREE(skb);
+                            skb = NULL;
+                            return;
+                        }
+                    }
+
+                }
+
+                if (skb1) {
+                    ar6000_data_tx(skb1, net_dev);
+                    if (!skb)
+                        return;
+                }
+            }
+
+#ifdef CONFIG_PM
+            ar6000_check_wow_status(ar, skb, FALSE);
+#endif /* CONFIG_PM */
+            skb->protocol = eth_type_trans(skb, skb->dev);
+            /*
+             * If this routine is called on a ISR (Hard IRQ) or DSR (Soft IRQ)
+             * or tasklet use the netif_rx to deliver the packet to the stack
+             * netif_rx will queue the packet onto the receive queue and mark
+             * the softirq thread has a pending action to complete. Kernel will
+             * schedule the softIrq kernel thread after processing the DSR.
+             *
+             * If this routine is called on a process context, use netif_rx_ni
+             * which will schedle the softIrq kernel thread after queuing the packet.
+             */
+            if (in_interrupt()) {
+                A_NETIF_RX(skb);
+            } else {
+                A_NETIF_RX_NI(skb);
+            }
+        } else {
+            A_NETBUF_FREE(skb);
+        }
+    }
+}
+
+#if 0
+static void
+ar6000_deliver_frames_to_bt_stack(void *dev, void *osbuf)
+{
+    struct sk_buff *skb = (struct sk_buff *)osbuf;
+
+    if(skb) {
+        skb->dev = dev;
+        if ((skb->dev->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = htons(ETH_P_CONTROL);
+            netif_rx(skb);
+        } else {
+            A_NETBUF_FREE(skb);
+        }
+    }
+}
+#endif
+
+static void
+ar6000_rx_refill(void *Context, HTC_ENDPOINT_ID Endpoint)
+{
+    AR_SOFTC_T  *ar = (AR_SOFTC_T *)Context;
+    void *osBuf;
+    int RxBuffers;
+    int buffersToRefill;
+    HTC_PACKET *pPacket;
+    HTC_PACKET_QUEUE queue;
+
+    buffersToRefill = (int)AR6000_MAX_RX_BUFFERS -
+                                    HTCGetNumRecvBuffers(ar->arHtcTarget, Endpoint);
+
+    if (buffersToRefill <= 0) {
+        /* fast return, nothing to fill */
+        return;
+    }
+
+    INIT_HTC_PACKET_QUEUE(&queue);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_rx_refill: providing htc with %d buffers at eid=%d\n",
+                    buffersToRefill, Endpoint));
+
+    for (RxBuffers = 0; RxBuffers < buffersToRefill; RxBuffers++) {
+        osBuf = A_NETBUF_ALLOC(AR6000_BUFFER_SIZE);
+        if (NULL == osBuf) {
+            break;
+        }
+        /* the HTC packet wrapper is at the head of the reserved area
+         * in the skb */
+        pPacket = (HTC_PACKET *)(A_NETBUF_HEAD(osBuf));
+        /* set re-fill info */
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_BUFFER_SIZE,Endpoint);
+        /* add to queue */
+        HTC_PACKET_ENQUEUE(&queue,pPacket);
+    }
+
+    if (!HTC_QUEUE_EMPTY(&queue)) {
+        /* add packets */
+        HTCAddReceivePktMultiple(ar->arHtcTarget, &queue);
+    }
+
+}
+
+  /* clean up our amsdu buffer list */
+static void ar6000_cleanup_amsdu_rxbufs(AR_SOFTC_T *ar)
+{
+    HTC_PACKET *pPacket;
+    void *osBuf;
+
+    /* empty AMSDU buffer queue and free OS bufs */
+    while (TRUE) {
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        pPacket = HTC_PACKET_DEQUEUE(&ar->amsdu_rx_buffer_queue);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == pPacket) {
+            break;
+        }
+
+        osBuf = pPacket->pPktContext;
+        if (NULL == osBuf) {
+            A_ASSERT(FALSE);
+            break;
+        }
+
+        A_NETBUF_FREE(osBuf);
+    }
+
+}
+
+
+    /* refill the amsdu buffer list */
+static void ar6000_refill_amsdu_rxbufs(AR_SOFTC_T *ar, int Count)
+{
+    HTC_PACKET *pPacket;
+    void *osBuf;
+
+    while (Count > 0) {
+        osBuf = A_NETBUF_ALLOC(AR6000_AMSDU_BUFFER_SIZE);
+        if (NULL == osBuf) {
+            break;
+        }
+        /* the HTC packet wrapper is at the head of the reserved area
+         * in the skb */
+        pPacket = (HTC_PACKET *)(A_NETBUF_HEAD(osBuf));
+        /* set re-fill info */
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),AR6000_AMSDU_BUFFER_SIZE,0);
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        /* put it in the list */
+        HTC_PACKET_ENQUEUE(&ar->amsdu_rx_buffer_queue,pPacket);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        Count--;
+    }
+
+}
+
+    /* callback to allocate a large receive buffer for a pending packet.  This function is called when
+ * an HTC packet arrives whose length exceeds a threshold value
+ *
+ * We use a pre-allocated list of buffers of maximum AMSDU size (4K).  Under linux it is more optimal to
+ * keep the allocation size the same to optimize cached-slab allocations.
+ *
+ * */
+static HTC_PACKET *ar6000_alloc_amsdu_rxbuf(void *Context, HTC_ENDPOINT_ID Endpoint, int Length)
+{
+    HTC_PACKET *pPacket = NULL;
+    AR_SOFTC_T  *ar = (AR_SOFTC_T *)Context;
+    int refillCount = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_RX,("ar6000_alloc_amsdu_rxbuf: eid=%d, Length:%d\n",Endpoint,Length));
+
+    do {
+
+        if (Length <= AR6000_BUFFER_SIZE) {
+            /* shouldn't be getting called on normal sized packets */
+            A_ASSERT(FALSE);
+            break;
+        }
+
+        if (Length > AR6000_AMSDU_BUFFER_SIZE) {
+            A_ASSERT(FALSE);
+            break;
+        }
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        /* allocate a packet from the list */
+        pPacket = HTC_PACKET_DEQUEUE(&ar->amsdu_rx_buffer_queue);
+        /* see if we need to refill again */
+        refillCount = AR6000_MAX_AMSDU_RX_BUFFERS - HTC_PACKET_QUEUE_DEPTH(&ar->amsdu_rx_buffer_queue);
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == pPacket) {
+            break;
+        }
+        /* set actual endpoint ID */
+        pPacket->Endpoint = Endpoint;
+
+    } while (FALSE);
+
+    if (refillCount >= AR6000_AMSDU_REFILL_THRESHOLD) {
+        ar6000_refill_amsdu_rxbufs(ar,refillCount);
+    }
+
+    return pPacket;
+}
+
+static void
+ar6000_set_multicast_list(struct net_device *dev)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
+    int mc_count = dev->mc_count;
+    struct dev_mc_list *mc;
+    int j;
+#else
+    int mc_count = netdev_mc_count(dev);
+    struct netdev_hw_addr *ha;
+#endif
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    int i;
+    A_BOOL enableAll, disableAll;
+    enum {
+        IGNORE = 0,
+        MATCH = 1,
+        ADD = 2,
+        DELETE = 3
+    } action[MAC_MAX_FILTERS_PER_LIST];
+    A_BOOL mcValid;
+    A_UINT8 *mac;
+    A_UINT8 *filter;
+    A_BOOL filterValid;
+
+    if (ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED)
+        return;
+
+    enableAll = FALSE;
+    disableAll = FALSE;
+
+    /*
+    *  Enable receive all multicast, if
+     * 1. promiscous mode,
+     * 2. Allow all multicast
+     * 3. H/W supported filters is less than application requested filter
+     */
+    if ((dev->flags & IFF_PROMISC) ||
+        (dev->flags & IFF_ALLMULTI) ||
+        (mc_count > MAC_MAX_FILTERS_PER_LIST))
+    {
+        enableAll = TRUE;
+    } else {
+        /* Disable all multicast if interface has multicast disable or list is empty */
+        if ((!(dev->flags & IFF_MULTICAST)) || (!mc_count)) {
+            disableAll = TRUE;
+        }
+    }
+
+    /*
+     * Firmware behaviour
+     * enableAll - set filter to enable and delete valid filters
+     * disableAll - set filter to disable and delete valid filers
+     * filter - set valid filters
+     */
+
+    /*
+    *  Pass 1: Mark all the valid filters to delete
+     */
+    for (i=0; i<MAC_MAX_FILTERS_PER_LIST; i++) {
+        filter = arPriv->mcast_filters[i];
+        filterValid = (filter[1] || filter[2]);
+        if (filterValid) {
+            action[i] = DELETE;
+        } else {
+            action[i] = IGNORE;
+        }
+    }
+
+    if ((!enableAll) && (!disableAll)) {
+        /*
+        *  Pass 2: Mark all filters which match the previous ones
+         */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+ 		for (j = 0, mc = dev->mc_list; mc && (j < dev->mc_count);
+ 			    j++, mc = mc->next) {
+            mac = mc->dmi_addr;
+#else
+        netdev_for_each_mc_addr(ha, dev) {
+            mac = ha->addr;
+#endif
+
+            mcValid = (mac[2] || mac[3] || mac[4] || mac[5]);
+            if (mcValid) {
+                for (i=0; i<MAC_MAX_FILTERS_PER_LIST; i++) {
+                    filter = arPriv->mcast_filters[i];
+                    if ((A_MEMCMP(filter, &mac[0], AR_MCAST_FILTER_MAC_ADDR_SIZE)) == 0) {
+                        action[i] = MATCH;
+                        break;
+                    }
+                }
+            }
+        }
+
+        /*
+         * Delete old entries and free-up space for new additions
+         */
+        for (i = 0; i < MAC_MAX_FILTERS_PER_LIST; i++) {
+            filter = arPriv->mcast_filters[i];
+            if (action[i] == DELETE) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Delete Filter %d = %02x:%02x:%02x:%02x:%02x:%02x\n",
+                        i, filter[0], filter[1], filter[2], filter[3], filter[4], filter[5]));
+                wmi_del_mcast_filter_cmd(arPriv->arWmi, filter);
+                A_MEMZERO(filter, AR_MCAST_FILTER_MAC_ADDR_SIZE);
+                /* Make this available for further additions */
+                action[i] = IGNORE;
+            }
+        }
+
+        /*
+        *  Pass 3: Add new filters to empty slots
+         */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+ 		for (j = 0, mc = dev->mc_list; mc && (j < dev->mc_count);
+ 			    j++, mc = mc->next) {
+#else
+        netdev_for_each_mc_addr(ha, dev) {
+
+#endif
+            A_BOOL match;
+            A_INT32 free;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+            mac = mc->dmi_addr;
+#else
+            mac = ha->addr;
+#endif
+            mcValid = (mac[2] || mac[3] || mac[4] || mac[5]);
+            if (mcValid) {
+                match = FALSE;
+                free = -1;
+                for (i=0; i<MAC_MAX_FILTERS_PER_LIST; i++) {
+                    A_UINT8 *filter = arPriv->mcast_filters[i];
+                    if ((A_MEMCMP(filter, &mac[0], AR_MCAST_FILTER_MAC_ADDR_SIZE)) == 0) {
+                        match = TRUE;
+                        break;
+                    } else if (action[i] != MATCH && action[i] != ADD) {
+                        if (free == -1) {
+                            free = i;   // Mark the first free index
+                        }
+                    }
+                }
+                if ((!match) && (free != -1)) {
+                    filter = arPriv->mcast_filters[free];
+                    A_MEMCPY(filter, &mac[0], AR_MCAST_FILTER_MAC_ADDR_SIZE);
+                    action[free] = ADD;
+                }
+            }
+        }
+    }
+
+
+    for (i=0; i<MAC_MAX_FILTERS_PER_LIST; i++) {
+        filter = arPriv->mcast_filters[i];
+        if (action[i] == DELETE) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Delete Filter %d = %02x:%02x:%02x:%02x:%02x:%02x\n",
+                    i, filter[0], filter[1], filter[2], filter[3], filter[4], filter[5]));
+            wmi_del_mcast_filter_cmd(arPriv->arWmi, filter);
+            A_MEMZERO(filter, AR_MCAST_FILTER_MAC_ADDR_SIZE);
+        } else if (action[i] == ADD) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Add Filter %d = %02x:%02x:%02x:%02x:%02x:%02x\n",
+                    i, filter[0], filter[1], filter[2], filter[3],filter[4],filter[5]));
+            wmi_set_mcast_filter_cmd(arPriv->arWmi, filter);
+        } else if (action[i] == MATCH) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Keep Filter %d = %02x:%02x:%02x:%02x:%02x:%02x\n",
+                    i, filter[0], filter[1], filter[2], filter[3],filter[4],filter[5]));
+        }
+    }
+
+    if (enableAll) {
+        /* target allow all multicast packets if fitler enable and fitler list is zero */
+        wmi_mcast_filter_cmd(arPriv->arWmi, TRUE);
+    } else if (disableAll) {
+        /* target drop multicast packets if fitler disable and fitler list is zero */
+        wmi_mcast_filter_cmd(arPriv->arWmi, FALSE);
+    }
+}
+
+static struct net_device_stats *
+ar6000_get_stats(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    return &arPriv->arNetStats;
+}
+
+static struct iw_statistics *
+ar6000_get_iwstats(struct net_device * dev)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    TARGET_STATS *pStats = &arPriv->arTargetStats;
+    struct iw_statistics * pIwStats = &arPriv->arIwStats;
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    if (ar->bIsDestroyProgress || ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED || testmode)
+#else
+        if (ar->bIsDestroyProgress || ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED)
+#endif
+        {
+            pIwStats->status = 0;
+            pIwStats->qual.qual = 0;
+        pIwStats->qual.level =0;
+            pIwStats->qual.noise = 0;
+        pIwStats->discard.code =0;
+        pIwStats->discard.retries=0;
+        pIwStats->miss.beacon =0;
+            return pIwStats;
+        }
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+    /*
+     * The in_atomic function is used to determine if the scheduling is
+     * allowed in the current context or not. This was introduced in 2.6
+     * From what I have read on the differences between 2.4 and 2.6, the
+     * 2.4 kernel did not support preemption and so this check might not
+     * be required for 2.4 kernels.
+     */
+    if (in_atomic())
+    {
+        if (wmi_get_stats_cmd(arPriv->arWmi) == A_OK) {
+        }
+
+        pIwStats->status = 1 ;
+        pIwStats->qual.qual = pStats->cs_aveBeacon_rssi - 161;
+        pIwStats->qual.level =pStats->cs_aveBeacon_rssi; /* noise is -95 dBm */
+        pIwStats->qual.noise = pStats->noise_floor_calibation;
+        pIwStats->discard.code = pStats->rx_decrypt_err;
+        pIwStats->discard.retries = pStats->tx_retry_cnt;
+        pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
+        return pIwStats;
+    }
+#endif /* LINUX_VERSION_CODE */
+    dev_hold(dev);
+
+    pIwStats->status = 0;
+
+    if (down_interruptible(&ar->arSem)) {
+        goto err_exit;
+    }
+
+    do {
+
+        if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+            break;
+        }
+
+        arPriv->statsUpdatePending = TRUE;
+
+        if(wmi_get_stats_cmd(arPriv->arWmi) != A_OK) {
+            break;
+        }
+
+        wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+        if (signal_pending(current)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000 : WMI get stats timeout \n"));
+            break;
+        }
+        pIwStats->status = 1 ;
+        pIwStats->qual.qual = pStats->cs_aveBeacon_rssi - 161;
+        pIwStats->qual.level =pStats->cs_aveBeacon_rssi;  /* noise is -95 dBm */
+        pIwStats->qual.noise = pStats->noise_floor_calibation;
+        pIwStats->discard.code = pStats->rx_decrypt_err;
+        pIwStats->discard.retries = pStats->tx_retry_cnt;
+        pIwStats->miss.beacon = pStats->cs_bmiss_cnt;
+    } while (0);
+    up(&ar->arSem);
+
+err_exit:
+
+    dev_put(dev);
+    return pIwStats;
+}
+
+void
+ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap, A_UINT32 sw_ver, A_UINT32 abi_ver)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+    struct net_device *dev;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT8 i, j, k;
+    AR_SOFTC_STA_T *arSta;
+
+        ar->arWmiReady = TRUE;
+        ar->arVersion.wlan_ver = sw_ver;
+        ar->arVersion.abi_ver = abi_ver;
+        wake_up(&arPriv->arEvent);
+
+    for(i = 0; i < num_device ; i++) {
+            dev = ar6000_devices[i];
+            arPriv = ar->arDev[i];
+            arPriv->arPhyCapability = phyCap;
+        if (arPriv->arPhyCapability == WMI_11NAG_CAPABILITY){
+                arPriv->phymode = DEF_AP_WMODE_AG;
+            } else {
+                arPriv->phymode = DEF_AP_WMODE_G;
+            }
+            A_MEMCPY(dev->dev_addr, datap, AR6000_ETH_ADDR_LEN);
+
+            if (i > 0) {
+            if(mac_addr_method) {
+                    k = dev->dev_addr[5];
+                    dev->dev_addr[5] += i;
+                for(j=5; j>3; j--) {
+                    if(dev->dev_addr[j] > k) {
+                            break;
+                        }
+                    k = dev->dev_addr[j-1];
+                    dev->dev_addr[j-1]++;
+                    }
+                } else {
+                    dev->dev_addr[0] = (((dev->dev_addr[0]) ^ (1 << i))) | 0x02;
+                }
+            }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("DEV%d mac address = %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
+            i, dev->dev_addr[0], dev->dev_addr[1],
+                           dev->dev_addr[2], dev->dev_addr[3],
+                           dev->dev_addr[4], dev->dev_addr[5]));
+
+#ifdef AR6K_ENABLE_HCI_PAL
+        ar6k_hci_pal_info_t *pHciPalInfo = (ar6k_hci_pal_info_t *)ar->hcipal_info;
+        pHciPalInfo->hdev->bdaddr.b[0]=dev->dev_addr[5];
+        pHciPalInfo->hdev->bdaddr.b[1]=dev->dev_addr[4];
+        pHciPalInfo->hdev->bdaddr.b[2]=dev->dev_addr[3];
+        pHciPalInfo->hdev->bdaddr.b[3]=dev->dev_addr[2];
+        pHciPalInfo->hdev->bdaddr.b[4]=dev->dev_addr[1];
+        pHciPalInfo->hdev->bdaddr.b[5]=dev->dev_addr[0];
+
+#endif
+
+#if (WLAN_CONFIG_PSPOLL_NUM) || (WLAN_CONFIG_DTIM_POLICY) || \
+    (WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN)
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+            ("AR6K: %s: PSPOLL_NUM = %d, DTIM_POLICY = %d, PS_FAIL_EVENT_POLICY = %d\n",
+             __FUNCTION__, WLAN_CONFIG_PSPOLL_NUM, WLAN_CONFIG_DTIM_POLICY,
+             WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN));
+
+        wmi_pmparams_cmd(arPriv->arWmi,
+            0,                          /* idlePeriod */
+            WLAN_CONFIG_PSPOLL_NUM,     /* psPollNum */
+            WLAN_CONFIG_DTIM_POLICY,    /* dtimPolicy */
+            0,                          /* tx_wakeup_policy */
+            1,                          /* num_tx_to_wakeup */
+            WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN /* ps_fail_event_policy */ );
+#endif
+#if WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP
+            wmi_set_lpreamble_cmd(arPriv->arWmi, 0, WMI_DONOT_IGNORE_BARKER_IN_ERP);
+#endif
+
+            wmi_set_keepalive_cmd(arPriv->arWmi, WLAN_CONFIG_KEEP_ALIVE_INTERVAL);
+
+#ifdef BMISS_ENHANCEMENT
+            /* This code has been added to enable the new algorithm to prevent BMISS 
+             * Enabling this right now only for single dev opertaing mode */   
+            if (num_device == 1) {
+                wmi_sta_bmiss_enhance_cmd(arPriv->arWmi, 1);
+            }
+#endif
+
+            /* BG scan should be enabled for p2p operation */
+            A_PRINTF("AR6K: targetconf_ver : %d\n", ar->arVersion.targetconf_ver);
+            if (ar->arVersion.targetconf_ver == AR6003_SUBVER_DEFAULT) {
+                WMI_SET_ROAM_CTRL_CMD roamCtrl;
+
+                if (arPriv->arNetworkType != AP_NETWORK) {
+                    arSta = &arPriv->arSta;
+
+                    /* if psm_info is 0, disable background scan for OTA */
+                    if (!psm_info) {
+                        arSta->scParams.bg_period = 65535;
+                    }
+
+                    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6K: bg scan interval = %d, active dwell time = %d passive dwell time = %d\n",
+                             arSta->scParams.bg_period, arSta->scParams.maxact_chdwell_time,
+                             arSta->scParams.pas_chdwell_time));
+
+                    wmi_scanparams_cmd(arPriv->arWmi,
+                                   arSta->scParams.fg_start_period,
+                                   arSta->scParams.fg_end_period,
+                                   arSta->scParams.bg_period,
+                                   arSta->scParams.minact_chdwell_time,
+                                   arSta->scParams.maxact_chdwell_time,
+                                   arSta->scParams.pas_chdwell_time,
+                                   arSta->scParams.shortScanRatio,
+                                   arSta->scParams.scanCtrlFlags,
+                                   arSta->scParams.max_dfsch_act_time,
+                                   arSta->scParams.maxact_scan_per_ssid);
+                }
+
+                A_MEMZERO(&roamCtrl, sizeof(roamCtrl));
+                roamCtrl.roamCtrlType = WMI_SET_LOWRSSI_SCAN_PARAMS;
+                roamCtrl.info.lrScanParams.lowrssi_scan_period = 65535; //low rssi scanning disabled
+                wmi_set_roam_ctrl_cmd(arPriv->arWmi, &roamCtrl, sizeof(roamCtrl));
+            }
+
+
+#if WLAN_CONFIG_DISABLE_11N
+             {
+                WMI_SET_HT_CAP_CMD htCap;
+
+                A_MEMZERO(&htCap, sizeof(WMI_SET_HT_CAP_CMD));
+                htCap.band = 0;
+                wmi_set_ht_cap_cmd(arPriv->arWmi, &htCap);
+
+                htCap.band = 1;
+                wmi_set_ht_cap_cmd(arPriv->arWmi, &htCap);
+            }
+#endif /* WLAN_CONFIG_DISABLE_11N */
+
+#ifdef ATH6K_CONFIG_OTA_MODE
+            wmi_powermode_cmd(arPriv->arWmi, MAX_PERF_POWER);
+#else
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6K: %s: psm.info is %d (0: MAX_PERF_POWER, 1:REC_POWER)\n", __FUNCTION__, psm_info));
+            wmi_powermode_cmd_w_psminfo(arPriv->arWmi, psm_info, 0);
+#endif
+            wmi_disctimeout_cmd(arPriv->arWmi, WLAN_CONFIG_DISCONNECT_TIMEOUT);
+        }
+}
+
+A_STATUS
+ar6000_ap_mode_probe_rx(AR_SOFTC_DEV_T *arPriv, A_UINT8 *datap, int len)
+{
+    struct sk_buff *skb;
+    WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
+    A_UINT8 *buf = NULL;
+
+    if((arPriv->arNetworkType != AP_NETWORK) ||
+       (arPriv->arNetworkSubType != SUBTYPE_NONE)) {
+        return A_ERROR;
+    }
+
+    buf = datap + sizeof(WMI_BSS_INFO_HDR);
+    len -= sizeof(WMI_BSS_INFO_HDR);
+    len += 6; /* For adding MAC addr */
+    if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
+        A_NETBUF_PUT(skb, len);
+        A_MEMCPY(A_NETBUF_DATA(skb), bih->bssid, 6);
+        A_MEMCPY(A_NETBUF_DATA(skb)+6, buf, len-6);
+        skb->dev = arPriv->arNetDev;
+        skb_reset_mac_header(skb);
+        skb->ip_summed = CHECKSUM_NONE;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = __constant_htons(0x0019);
+        A_NETIF_RX(skb);
+    }
+    return A_OK;
+}
+#ifdef P2P
+A_UINT8 get_connected_sta_cnt(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT8 i, cnt=0;
+    for(i=0;i<NUM_CONN;i++) {
+        if(ar->connTbl[i].arPriv == arPriv) {
+            cnt++;
+        }
+    }
+    return cnt;
+}
+#endif
+void
+add_new_sta(AR_SOFTC_DEV_T *arPriv, A_UINT8 *mac, A_UINT16 aid, A_UINT8 *wpaie,
+            A_UINT8 ielen, A_UINT8 keymgmt, A_UINT8 ucipher, A_UINT8 auth, A_UINT8 wmode, A_UINT8 apsd_info,
+	    A_UINT8 HT_present)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+    A_UINT8    free_slot=aid-1;
+
+    A_MEMCPY(ar->connTbl[free_slot].mac, mac, ATH_MAC_LEN);
+    A_MEMCPY(ar->connTbl[free_slot].wpa_ie, wpaie, ielen);
+    ar->connTbl[free_slot].arPriv = arPriv;
+    ar->connTbl[free_slot].aid = aid;
+    ar->connTbl[free_slot].keymgmt = keymgmt;
+    ar->connTbl[free_slot].ucipher = ucipher;
+    ar->connTbl[free_slot].auth = auth;
+    ar->connTbl[free_slot].wmode = wmode;
+    ar->connTbl[free_slot].apsd_info= apsd_info;
+    ar->connTbl[free_slot].HT_present = HT_present;
+    ar->connTbl[free_slot].flags = 0;
+    ar->arAPStats[free_slot].aid = aid;
+    arAp->sta_list_index = arAp->sta_list_index | (1 << free_slot);
+    aggr_reset_state(ar->connTbl[free_slot].conn_aggr, (void *) arPriv->arNetDev);
+#ifdef P2P
+     if((arPriv->arNetworkSubType == SUBTYPE_P2PGO) && (arPriv->num_sta == get_connected_sta_cnt(arPriv))) {
+        p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_GROUP_LIMIT,1);
+    }
+#endif
+}
+
+void
+ar6000_connect_event(AR_SOFTC_DEV_T *arPriv, WMI_CONNECT_EVENT *pEvt)
+{
+    union iwreq_data wrqu;
+    int i, beacon_ie_pos, assoc_resp_ie_pos, assoc_req_ie_pos;
+    static const char *tag1 = "ASSOCINFO(ReqIEs=";
+    static const char *tag2 = "ASSOCRESPIE=";
+    static const char *beaconIetag = "BEACONIE=";
+    char buf[WMI_CONTROL_MSG_MAX_LEN * 2 + strlen(tag1) + 1];
+    char *pos;
+    A_UINT8 key_op_ctrl;
+    unsigned long flags;
+    struct ieee80211req_key *ik;
+    CRYPTO_TYPE keyType = NONE_CRYPT;
+    AR_SOFTC_STA_T *arSta;
+    struct ieee80211_frame *wh;
+    A_UINT8 *frm, *efrm, *ssid, *rates, *xrates, *wpaie, wpaLen=0;
+    A_UINT16 subtype;
+    A_UINT8 beaconIeLen;
+    A_UINT8 assocReqLen;
+    A_UINT8 assocRespLen;
+    A_UINT8 *assocInfo;
+    A_UINT8 *bssid;
+    A_INT8 rate_idx;
+    A_UINT8 HT_present = 0;
+
+    beaconIeLen = pEvt->beaconIeLen;
+    assocReqLen = pEvt->assocReqLen;
+    assocRespLen = pEvt->assocRespLen;
+    assocInfo = pEvt->assocInfo;
+
+    /* BSSID and MAC_ADDR is in the same location for all modes */
+    bssid = pEvt->u.infra_ibss_bss.bssid;
+
+    if(arPriv->arNetworkType & AP_NETWORK) {
+        struct net_device *dev = arPriv->arNetDev;
+        AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+        A_UINT8 aid, wmode, keymgmt, auth_alg;
+
+        if(A_MEMCMP(dev->dev_addr, bssid, ATH_MAC_LEN)==0) {
+            ik = &arAp->ap_mode_bkey;
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AP%d: [UP] SSID %s MAC %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
+                arPriv->arDeviceIndex, arPriv->arSsid,
+                bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]));
+
+            arPriv->arChannelHint   = pEvt->u.ap_bss.channel;
+            arPriv->arBssChannel    = arPriv->arChannelHint;
+            arPriv->arConnected     = TRUE;
+
+            A_MEMCPY(arPriv->arAp.ap_country_code, pEvt->u.ap_sta.unused,
+                     sizeof(arPriv->arAp.ap_country_code));
+
+            /* Concurrency: Process the pending connect of the other virtual device(s)  */
+            ar6000_check_hold_conn_status(arPriv, TRUE);
+#ifdef P2P
+            if(arPriv->arNetworkSubType == SUBTYPE_P2PDEV) {
+                arPriv->arNetworkSubType = SUBTYPE_P2PGO;
+                p2p_update_capability(A_WMI_GET_P2P_CTX(arPriv),arPriv->arNetworkSubType,num_device);
+                p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_GROUP_LIMIT,0);
+            }
+#endif
+
+
+#ifdef WAPI_ENABLE
+            if( (arPriv->arAuthMode == WMI_NONE_AUTH) && 
+                (arPriv->arPairwiseCrypto == WAPI_CRYPT) ) {
+                ap_set_wapi_key(arPriv, ik);
+            }
+#endif
+            if(arPriv->arAuthMode & 
+              (WMI_WPA_PSK_AUTH|WMI_WPA2_PSK_AUTH|WMI_WPA_AUTH|WMI_WPA2_AUTH)) 
+            {
+                switch (ik->ik_type) {
+                case IEEE80211_CIPHER_TKIP:
+                    keyType = TKIP_CRYPT;
+                    break;
+                case IEEE80211_CIPHER_AES_CCM:
+                    keyType = AES_CRYPT;
+                    break;
+                default:
+                    goto skip_key;
+                }
+
+                wmi_addKey_cmd(arPriv->arWmi, ik->ik_keyix, keyType, GROUP_USAGE,
+                                ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
+                                ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
+                                SYNC_BOTH_WMIFLAG);
+            }
+skip_key:
+            wmi_bssfilter_cmd(arPriv->arWmi, NONE_BSS_FILTER, 0);
+
+            arPriv->arConnected = TRUE;
+            return;
+        }
+
+        wh = (struct ieee80211_frame *) (assocInfo + beaconIeLen);
+        subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+        frm     = (A_UINT8 *)&wh[1];
+        efrm = assocInfo + beaconIeLen + assocReqLen;
+
+        /* capability information */
+        frm += 2;
+
+        /* listen int */
+        frm += 2;
+
+        /* Reassoc will have current AP addr field */
+        if(subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
+            frm += 6;
+        }
+
+        ssid = rates = xrates = wpaie = NULL;
+        while (frm < efrm) {
+            switch (*frm) {
+/* currently unused */
+/*
+            case IEEE80211_ELEMID_SSID:
+                ssid = frm;
+                break;
+            case IEEE80211_ELEMID_RATES:
+                rates = frm;
+                break;
+            case IEEE80211_ELEMID_XRATES:
+                xrates = frm;
+                break;
+*/
+            case IEEE80211_ELEMID_VENDOR:
+                    if( (frm[1] > 3) && (frm[2] == 0x00) && (frm[3] == 0x50) &&
+                        (frm[4] == 0xF2) && ((frm[5] == 0x01) || (frm[5] == 0x04)) )
+                    {
+                    wpaie = frm;
+                        wpaLen = wpaie[1]+2;
+                }
+                break;
+            case IEEE80211_ELEMID_RSN:
+                wpaie = frm;
+                    wpaLen = wpaie[1]+2;
+                break;
+#ifdef WAPI_ENABLE
+            case IEEE80211_ELEMID_WAPI:
+                wpaie = frm;
+                    wpaLen = wpaie[1]+2;
+                break;
+#endif
+                case IEEE80211_ELEMID_HTCAP_ANA:
+                     HT_present = 1;
+                     break;
+            }
+            frm += frm[1] + 2;
+        }
+
+        aid = pEvt->u.ap_sta.aid;
+        wmode = pEvt->u.ap_sta.phymode;
+        keymgmt = pEvt->u.ap_sta.keymgmt;
+        auth_alg = pEvt->u.ap_sta.auth;
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("NEW STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x \n "
+            " AID=%d AUTH=%d WMODE=%d KEYMGMT=%d CIPHER=%d APSD=%x\n",
+            pEvt->u.ap_sta.mac_addr[0], pEvt->u.ap_sta.mac_addr[1], pEvt->u.ap_sta.mac_addr[2],
+            pEvt->u.ap_sta.mac_addr[3], pEvt->u.ap_sta.mac_addr[4], pEvt->u.ap_sta.mac_addr[5],
+            aid, auth_alg, wmode, keymgmt, pEvt->u.ap_sta.cipher, pEvt->u.ap_sta.apsd_info));
+
+        add_new_sta(arPriv, pEvt->u.ap_sta.mac_addr, aid, wpaie, wpaLen, keymgmt,
+                pEvt->u.ap_sta.cipher, auth_alg, wmode, pEvt->u.ap_sta.apsd_info,HT_present);
+
+        /* Send event to application */
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        A_MEMCPY(wrqu.addr.sa_data, pEvt->u.ap_sta.mac_addr, ATH_MAC_LEN);
+        wireless_send_event(arPriv->arNetDev, IWEVREGISTERED, &wrqu, NULL);
+        /* In case the queue is stopped when we switch modes, this will
+         * wake it up
+         */
+        netif_wake_queue(arPriv->arNetDev);
+        return;
+    }
+#ifdef ATH6K_CONFIG_CFG80211
+    ar6k_cfg80211_connect_event(arPriv, pEvt->u.infra_ibss_bss.channel, bssid,
+                                pEvt->u.infra_ibss_bss.listenInterval, pEvt->u.infra_ibss_bss.beaconInterval,
+                                pEvt->u.infra_ibss_bss.networkType, beaconIeLen,
+                                assocReqLen, assocRespLen,
+                                assocInfo);
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    arPriv->arChannelHint   = pEvt->u.infra_ibss_bss.channel;
+    arPriv->arBssChannel    = arPriv->arChannelHint;
+    arPriv->arConnected     = TRUE;
+    arSta                   = &arPriv->arSta;
+    arSta->arConnectPending = FALSE; 
+
+    /* Concurrency: Process the pending connect of the other virtual device(s)  */
+    ar6000_check_hold_conn_status(arPriv, TRUE);
+
+    A_MEMCPY(arPriv->arBssid, bssid, sizeof(arPriv->arBssid));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 connected event on freq %d ", pEvt->u.infra_ibss_bss.channel));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("with bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
+            " listenInterval=%d, beaconInterval = %d, beaconIeLen = %d assocReqLen=%d"
+            " assocRespLen =%d\n",
+             bssid[0], bssid[1], bssid[2],
+             bssid[3], bssid[4], bssid[5],
+             pEvt->u.infra_ibss_bss.listenInterval, pEvt->u.infra_ibss_bss.beaconInterval,
+             beaconIeLen, assocReqLen, assocRespLen));
+    if (pEvt->u.infra_ibss_bss.networkType & ADHOC_NETWORK) {
+        /* Disable BG Scan for ADHOC NETWORK */
+        wmi_scanparams_cmd(arPriv->arWmi, 0, 0,
+                               0xFFFF, 0, 0, 0, WMI_SHORTSCANRATIO_DEFAULT,DEFAULT_SCAN_CTRL_FLAGS, 0, 0);
+        if (pEvt->u.infra_ibss_bss.networkType & ADHOC_CREATOR) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Network: Adhoc (Creator)\n"));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Network: Adhoc (Joiner)\n"));
+        }
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Network: Infrastructure\n"));
+    }
+
+    if ((arPriv->arNetworkType == INFRA_NETWORK)) {
+        if (arSta->arConnectPending) {
+            wmi_listeninterval_cmd(arPriv->arWmi, arSta->arListenIntervalT, arSta->arListenIntervalB);
+        }
+        if (arPriv->arBitRate != -1) {
+            if ((wmi_validate_bitrate(arPriv->arWmi, arPriv->arBitRate, &rate_idx)) != A_OK){
+                printk("User set rate cannot be used\n");
+                arPriv->arBitRate = -1;
+            }
+        }
+    }
+#ifdef P2P
+    if(arPriv->arNetworkSubType == SUBTYPE_P2PDEV) {
+        arPriv->arNetworkSubType = SUBTYPE_P2PCLIENT;
+        p2p_update_capability(A_WMI_GET_P2P_CTX(arPriv),arPriv->arNetworkSubType,num_device);
+    }
+#endif
+
+    if (beaconIeLen && (sizeof(buf) > (9 + beaconIeLen * 2))) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nBeaconIEs= "));
+
+        beacon_ie_pos = 0;
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", beaconIetag);
+        pos = buf + 9;
+        for (i = beacon_ie_pos; i < beacon_ie_pos + beaconIeLen; i++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        if (wrqu.data.length <= IW_CUSTOM_MAX) {
+            wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Fail to send BeaconIEs to upper layer\n"));
+        }
+    }
+
+    if (assocRespLen && (sizeof(buf) > (12 + (assocRespLen * 2))))
+    {
+        assoc_resp_ie_pos = beaconIeLen + assocReqLen +
+                            sizeof(A_UINT16)  +  /* capinfo*/
+        sizeof(A_UINT16) +    /* status Code */
+        sizeof(A_UINT16)  ;  /* associd */
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", tag2);
+        pos = buf + 12;
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nAssocRespIEs= "));
+        /*
+         * The Association Response Frame w.o. the WLAN header is delivered to
+         * the host, so skip over to the IEs
+         */
+        for (i = assoc_resp_ie_pos; i < assoc_resp_ie_pos + assocRespLen - 6; i++)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        if (wrqu.data.length <= IW_CUSTOM_MAX) {
+            wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+        } else {
+#if (WIRELESS_EXT >= 18)
+            wrqu.data.length = (assocRespLen - 6);
+            wireless_send_event(arPriv->arNetDev, IWEVASSOCRESPIE, &wrqu, &assocInfo[assoc_resp_ie_pos]);
+#else
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Fail to send Association Response to upper layer\n"));
+#endif
+        }
+    }
+
+    if (assocReqLen && (sizeof(buf) > (17 + (assocReqLen * 2)))) {
+        /*
+         * assoc Request includes capability and listen interval. Skip these.
+         */
+        assoc_req_ie_pos =  beaconIeLen +
+                            sizeof(A_UINT16)  +  /* capinfo*/
+        sizeof(A_UINT16);    /* listen interval */
+
+        A_MEMZERO(buf, sizeof(buf));
+        sprintf(buf, "%s", tag1);
+        pos = buf + 17;
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("AssocReqIEs= "));
+        for (i = assoc_req_ie_pos; i < assoc_req_ie_pos + assocReqLen - 4; i++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+            sprintf(pos, "%2.2x", assocInfo[i]);
+            pos += 2;;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.data.length = strlen(buf);
+        if (wrqu.data.length <= IW_CUSTOM_MAX) {
+            wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+        } else {
+#if (WIRELESS_EXT >= 18)
+            wrqu.data.length = (assocReqLen - 4);
+            wireless_send_event(arPriv->arNetDev, IWEVASSOCREQIE, &wrqu, &assocInfo[assoc_req_ie_pos]);
+#else
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Fail to send Association Request to upper layer\n"));
+#endif
+        }
+    }
+
+#ifdef USER_KEYS
+    if (arSta->user_savedkeys_stat == USER_SAVEDKEYS_STAT_RUN &&
+        arSta->user_saved_keys.keyOk == TRUE)
+    {
+        key_op_ctrl = KEY_OP_VALID_MASK & ~KEY_OP_INIT_TSC;
+
+        if (arSta->user_key_ctrl & AR6000_USER_SETKEYS_RSC_UNCHANGED) {
+            key_op_ctrl &= ~KEY_OP_INIT_RSC;
+        } else {
+            key_op_ctrl |= KEY_OP_INIT_RSC;
+        }
+        ar6000_reinstall_keys(arPriv, key_op_ctrl);
+    }
+#endif /* USER_KEYS */
+
+    netif_wake_queue(arPriv->arNetDev);
+
+    /* For CFG80211 the key configuration and the default key comes in after connect so no point in plumbing invalid keys */
+#ifndef ATH6K_CONFIG_CFG80211
+    if ((pEvt->u.infra_ibss_bss.networkType & ADHOC_NETWORK) &&
+        (OPEN_AUTH == arPriv->arDot11AuthMode) &&
+        (WMI_NONE_AUTH == arPriv->arAuthMode) &&
+        (WEP_CRYPT == arPriv->arPairwiseCrypto)) 
+    {
+        if (!arPriv->arConnected) {
+            wmi_addKey_cmd(arPriv->arWmi,
+                           arPriv->arDefTxKeyIndex,
+                           WEP_CRYPT,
+                           GROUP_USAGE | TX_USAGE,
+                           arPriv->arWepKeyList[arPriv->arDefTxKeyIndex].arKeyLen,
+                           NULL,
+                           arPriv->arWepKeyList[arPriv->arDefTxKeyIndex].arKey, KEY_OP_INIT_VAL, NULL,
+                           NO_SYNC_WMIFLAG);
+        }
+    }
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    /* Update connect & link status atomically */
+    spin_lock_irqsave(&arPriv->arPrivLock, flags);
+    netif_carrier_on(arPriv->arNetDev);
+    spin_unlock_irqrestore(&arPriv->arPrivLock, flags);
+    /* reset the rx aggr state */
+    aggr_reset_state(arPriv->conn_aggr, (void *) arPriv->arNetDev);
+    reconnect_flag = 0;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    A_MEMCPY(wrqu.addr.sa_data, bssid, IEEE80211_ADDR_LEN);
+    wrqu.addr.sa_family = ARPHRD_ETHER;
+    wireless_send_event(arPriv->arNetDev, SIOCGIWAP, &wrqu, NULL);
+    if ((arPriv->arNetworkType == ADHOC_NETWORK) && arSta->arIbssPsEnable) {
+        A_MEMZERO(arSta->arNodeMap, sizeof(arSta->arNodeMap));
+        arSta->arNodeNum = 0;
+        arSta->arNexEpId = ENDPOINT_2;
+    }
+    if (!arSta->arUserBssFilter) {
+        wmi_bssfilter_cmd(arPriv->arWmi, NONE_BSS_FILTER, 0);
+    }
+}
+
+void ar6000_set_numdataendpts(AR_SOFTC_DEV_T *arPriv, A_UINT32 num)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_ASSERT(num <= (HTC_MAILBOX_NUM_MAX - 1));
+    ar->arNumDataEndPts = num;
+}
+
+void
+sta_cleanup(AR_SOFTC_DEV_T *arPriv, A_UINT8 i)
+{
+    struct sk_buff *skb;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+
+    /* empty the queued pkts in the PS queue if any */
+    A_MUTEX_LOCK(&ar->connTbl[i].psqLock);
+    while (!A_NETBUF_QUEUE_EMPTY(&ar->connTbl[i].psq)) {
+        skb = A_NETBUF_DEQUEUE(&ar->connTbl[i].psq);
+        A_NETBUF_FREE(skb);
+    }
+    while (!A_NETBUF_QUEUE_EMPTY(&ar->connTbl[i].apsdq)) {
+        skb = A_NETBUF_DEQUEUE(&ar->connTbl[i].apsdq);
+        A_NETBUF_FREE(skb);
+    }
+    A_MUTEX_UNLOCK(&ar->connTbl[i].psqLock);
+#ifdef P2P
+    if((arPriv->arNetworkSubType == SUBTYPE_P2PGO) && (arPriv->num_sta <= get_connected_sta_cnt(arPriv))) {
+        p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_GROUP_LIMIT,0);
+    }
+#endif
+
+    /* Zero out the state fields */
+    A_MEMZERO(&ar->arAPStats[i], sizeof(WMI_PER_STA_STAT));
+    A_MEMZERO(&ar->connTbl[i].mac, ATH_MAC_LEN);
+    A_MEMZERO(&ar->connTbl[i].wpa_ie, IEEE80211_MAX_IE);
+    ar->connTbl[i].aid = 0;
+    ar->connTbl[i].flags = 0;
+    ar->connTbl[i].arPriv = NULL;
+    ar->connTbl[i].HT_present = 0;
+
+    arAp->sta_list_index =arAp->sta_list_index & ~(1 << i);
+    aggr_reset_state(ar->connTbl[i].conn_aggr, NULL);
+}
+
+void
+ar6000_ap_cleanup(AR_SOFTC_DEV_T *arPriv)
+{
+    A_UINT8 ctr;
+    struct sk_buff *skb;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("DEL ALL STA\n"));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AP%d: [DOWN] SSID %s\n", arPriv->arDeviceIndex, arPriv->arSsid));
+
+// AP + BTCOEX State variables resetted here.
+    ar->IsdelbaTimerInitialized = FALSE;
+    A_UNTIMEOUT(&ar->delbaTimer);
+    ar->delbaState = REASON_DELBA_INIT;
+
+    for (ctr=0; ctr < NUM_CONN; ctr++) {
+        if(ar->connTbl[ctr].arPriv == arPriv) {
+            remove_sta(arPriv, ar->connTbl[ctr].mac, 0);
+        }
+    }
+    A_MUTEX_LOCK(&arAp->mcastpsqLock);
+    while (!A_NETBUF_QUEUE_EMPTY(&arAp->mcastpsq)) {
+        skb = A_NETBUF_DEQUEUE(&arAp->mcastpsq);
+        A_NETBUF_FREE(skb);
+    }
+    A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+    arPriv->arConnected = FALSE;
+    arPriv->arTxPwr = 0;
+    arPriv->arTxPwrSet = FALSE;
+}
+
+A_UINT8
+remove_sta(AR_SOFTC_DEV_T *arPriv, A_UINT8 *mac, A_UINT16 reason)
+{
+    A_UINT8 i, removed=0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    union iwreq_data wrqu;
+    struct sk_buff *skb;
+
+    if(IS_MAC_NULL(mac)) {
+        return removed;
+    }
+
+    if(reason == AP_DISCONNECT_MAX_STA) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("MAX STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n", mac[0],
+            mac[1], mac[2], mac[3], mac[4], mac[5]));
+        return removed;
+    } else if(reason == AP_DISCONNECT_ACL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ACL STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n", mac[0],
+            mac[1], mac[2], mac[3], mac[4], mac[5]));
+        return removed;
+    }
+
+    for(i=0; i < NUM_CONN; i++) {
+        if(A_MEMCMP(ar->connTbl[i].mac, mac, ATH_MAC_LEN)==0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("DEL STA %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x "
+            " aid=%d REASON=%d\n", mac[0], mac[1], mac[2],
+             mac[3], mac[4], mac[5], ar->connTbl[i].aid, reason));
+
+            sta_cleanup(arPriv, i);
+            removed = 1;
+
+            /* Send event to application */
+            A_MEMZERO(&wrqu, sizeof(wrqu));
+            A_MEMCPY(wrqu.addr.sa_data, mac, ATH_MAC_LEN);
+            wireless_send_event(arPriv->arNetDev, IWEVEXPIRED, &wrqu, NULL);
+
+            break;
+        }
+    }
+
+    /* If there are no more associated STAs, empty the mcast PS q */
+    if (arPriv->arAp.sta_list_index == 0) {
+        A_MUTEX_LOCK(&arPriv->arAp.mcastpsqLock);
+        while (!A_NETBUF_QUEUE_EMPTY(&arPriv->arAp.mcastpsq)) {
+            skb = A_NETBUF_DEQUEUE(&arPriv->arAp.mcastpsq);
+            A_NETBUF_FREE(skb);
+        }
+        A_MUTEX_UNLOCK(&arPriv->arAp.mcastpsqLock);
+
+        /* Clear the LSB of the BitMapCtl field of the TIM IE */
+        if (ar->arWmiReady) {
+            wmi_set_pvb_cmd(arPriv->arWmi, MCAST_AID, 0);
+        }
+    }
+
+    return removed;
+}
+
+void
+ar6000_disconnect_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 reason, A_UINT8 *bssid,
+                        A_UINT8 assocRespLen, A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus)
+{
+    A_UINT8 i;
+    unsigned long flags;
+    union iwreq_data wrqu;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_BOOL bt30Devfound = FALSE;
+#ifdef P2P
+        if((arPriv->arNetworkSubType == SUBTYPE_P2PCLIENT) || (arPriv->arNetworkSubType == SUBTYPE_P2PGO)
+            || (arPriv->arNetworkSubType == SUBTYPE_P2PDEV)){
+            if(!(IS_MAC_BCAST(bssid)))
+            p2p_clear_group_peer(arPriv->p2p_ctx);
+    }
+#endif
+
+    if(arPriv->arNetworkType & AP_NETWORK) {
+        if(IS_MAC_BCAST(bssid)) {
+            A_UINT32 tmp_regCode;
+
+            tmp_regCode = arPriv->arRegCode;
+            if(protocolReasonStatus != AP_DISCONNECT_STA_ROAM) {
+                arPriv->arBssChannel = 0;
+                arPriv->arChannelHint = 0;
+            } else {
+                arPriv->is_sta_roaming = TRUE;
+            }
+            ar6000_ap_cleanup(arPriv);
+            arPriv->arRegCode = tmp_regCode;
+
+            /* Concurrency: Process the pending connect of the other virtual device(s)  */
+            ar6000_check_hold_conn_status(arPriv, FALSE);
+
+            if ((protocolReasonStatus == AP_DISCONNECT_STA_ROAM) || (protocolReasonStatus == AP_DISCONNECT_DFS_CHANNEL)) {
+                ar->arHoldConnection     |= (1<<arPriv->arDeviceIndex);
+                arPriv->ap_profile_flag = TRUE;
+            }
+
+#ifdef P2P
+            if(arPriv->arNetworkSubType == SUBTYPE_P2PGO) {
+                arPriv->arNextMode = INFRA_NETWORK;
+                ar6000_init_mode_info(arPriv);
+                arPriv->arNetworkType = INFRA_NETWORK;
+                arPriv->arNetworkSubType = SUBTYPE_P2PDEV;
+                p2p_update_capability(A_WMI_GET_P2P_CTX(arPriv),arPriv->arNetworkSubType,num_device);
+            }
+#endif
+        } else {
+            remove_sta(arPriv, bssid, protocolReasonStatus);
+        }
+        return;
+    }
+
+#ifdef ATH6K_CONFIG_CFG80211
+    ar6k_cfg80211_disconnect_event(arPriv, reason, bssid,
+                                   assocRespLen, assocInfo,
+                                   protocolReasonStatus);
+#endif /* ATH6K_CONFIG_CFG80211 */
+    /*Skip DISCONNECT event for host intaitated Diconnect cmd*/
+    if((!arPriv->arSta.arHostDisconnect) || (protocolReasonStatus != 0)) {
+        /* Send disconnect event to supplicant */
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wrqu.addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(arPriv->arNetDev, SIOCGIWAP, &wrqu, NULL);
+    }
+
+    /* it is necessary to clear the host-side rx aggregation state */
+    aggr_reset_state(arPriv->conn_aggr, NULL);
+
+    A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 disconnected"));
+    if (bssid[0] || bssid[1] || bssid[2] || bssid[3] || bssid[4] || bssid[5]) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" from %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
+                        bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]));
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Disconnect Reason is %d, Status Code is %d", reason, protocolReasonStatus));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nDisconnect Reason is %d", reason));
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nProtocol Reason/Status Code is %d", protocolReasonStatus));
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\nAssocResp Frame = %s",
+                    assocRespLen ? " " : "NULL"));
+    for (i = 0; i < assocRespLen; i++) {
+        if (!(i % 0x10)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("%2.2x ", assocInfo[i]));
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("\n"));
+    /*
+     * If the event is due to disconnect cmd from the host, only they the target
+     * would stop trying to connect. Under any other condition, target would
+     * keep trying to connect.
+     *
+     */
+    if( reason == DISCONNECT_CMD)
+    {
+        if ((!arPriv->arSta.arUserBssFilter) && (ar->arWmiReady) && (ar->arWlanState != WLAN_DISABLED)) {
+            wmi_bssfilter_cmd(arPriv->arWmi, NONE_BSS_FILTER, 0);
+        }
+    } else {
+        arPriv->arSta.arConnectPending = TRUE;
+        if (((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x11)) ||
+            ((reason == ASSOC_FAILED) && (protocolReasonStatus == 0x0) && (reconnect_flag == 1))) {
+            arPriv->arConnected = TRUE;
+            return;
+        }
+    }
+
+    /* In the case of p2p-client, if we get a NO_NETWORK_AVAIL or LOST_LINK reason from the
+     * firmware, issue a wmi_disconnect_cmd to the firmware to reset the firmware back to p2p-dev
+     * state.
+     */
+#ifdef P2P
+    if ((arPriv->arNetworkSubType == SUBTYPE_P2PCLIENT) &&
+             (reason == NO_NETWORK_AVAIL || reason == LOST_LINK) ) {
+        ar6000_disconnect(arPriv);
+    }
+#endif /* P2P */
+
+    if (((reason == NO_NETWORK_AVAIL) || (reason == LOST_LINK)) && (ar->arWmiReady))
+    {
+        bss_t *pWmiSsidnode = NULL;
+        wmi_scan_report_lock(arPriv->arWmi);
+        /* remove the current associated bssid node */
+        wmi_free_node (arPriv->arWmi, bssid);
+
+        /*
+         * In case any other same SSID nodes are present
+         * remove it, since those nodes also not available now
+         */
+        do
+        {
+            /*
+             * Find the nodes based on SSID and remove it
+             * NOTE :: This case will not work out for Hidden-SSID
+             */
+            pWmiSsidnode = wmi_find_Ssidnode (arPriv->arWmi, arPriv->arSsid, arPriv->arSsidLen, FALSE, TRUE);
+
+            if (pWmiSsidnode)
+            {
+                wmi_free_node (arPriv->arWmi, pWmiSsidnode->ni_macaddr);
+            }
+
+        }while (pWmiSsidnode);
+        wmi_scan_report_unlock(arPriv->arWmi);
+
+        ar6000_init_profile_info(arPriv);
+        wmi_disconnect_cmd(arPriv->arWmi);
+    }
+
+    /* Update connect & link status atomically */
+    spin_lock_irqsave(&arPriv->arPrivLock, flags);
+
+    netif_carrier_off(arPriv->arNetDev);
+    spin_unlock_irqrestore(&arPriv->arPrivLock, flags);
+#ifdef P2P
+        if(arPriv->arNetworkSubType == SUBTYPE_P2PCLIENT) {
+        arPriv->arNextMode = INFRA_NETWORK;
+        ar6000_init_mode_info(arPriv);
+        arPriv->arNetworkType = INFRA_NETWORK;
+        arPriv->arNetworkSubType = SUBTYPE_P2PDEV;
+            p2p_update_capability(A_WMI_GET_P2P_CTX(arPriv),arPriv->arNetworkSubType,num_device);
+    }
+#endif
+
+    if( (reason != CSERV_DISCONNECT) || (reconnect_flag != 1) ) {
+        reconnect_flag = 0;
+    }
+
+#ifdef USER_KEYS
+    if (reason != CSERV_DISCONNECT)
+    {
+        arPriv->arSta.user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+        arPriv->arSta.user_key_ctrl = 0;
+    }
+#endif /* USER_KEYS */
+
+    netif_stop_queue(arPriv->arNetDev);
+    A_MEMZERO(arPriv->arBssid, sizeof(arPriv->arBssid));
+    arPriv->arBssChannel = 0;
+    arPriv->arSta.arBeaconInterval = 0;
+    arPriv->arConnected = FALSE;    
+    arPriv->arChannelHint = 0;
+    arPriv->arTxPwr = 0;
+    arPriv->arTxPwrSet = FALSE;
+
+    /* Concurrency: Process the pending connect of the other virtual device(s)  */
+    ar6000_check_hold_conn_status(arPriv, FALSE);
+
+    for (i=0; i < num_device; i++) {
+        AR_SOFTC_DEV_T *temparPriv;
+        temparPriv = ar->arDev[i];
+        if (temparPriv->isBt30amp == TRUE) {
+            bt30Devfound = TRUE;
+        }
+    }
+    if (bt30Devfound == FALSE) {
+        ar6000_TxDataCleanup(ar);
+    }
+
+    if (arPriv->arNetworkType == ADHOC_NETWORK){
+        /* Reset Scan params to default */
+        wmi_scanparams_cmd(arPriv->arWmi, 0, 0,
+		    60, 0, 0, 0, WMI_SHORTSCANRATIO_DEFAULT,DEFAULT_SCAN_CTRL_FLAGS, 0, 0);
+    }
+}
+
+void
+ar6000_regDomain_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 regCode)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 Reg Code = 0x%x\n", regCode));
+    arPriv->arRegCode = regCode;
+}
+
+#ifdef ATH_AR6K_11N_SUPPORT
+#define BA_EVT_GET_CONNID(a)    ((a)>>4)
+#define BA_EVT_GET_TID(b)       ((b)&0xF)
+
+void
+ar6000_aggr_rcv_addba_req_evt(AR_SOFTC_DEV_T *arPriv, WMI_ADDBA_REQ_EVENT *evt)
+{
+    A_UINT8 connid = BA_EVT_GET_CONNID(evt->tid);
+    A_UINT8 tid = BA_EVT_GET_TID(evt->tid);
+    conn_t *conn = ieee80211_find_conn_for_aid(arPriv, connid);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ADDBA REQ: tid=%d, connid=%d, status=%d, win_sz=%d\n", tid, connid, evt->status, evt->win_sz));
+    if(((arPriv->arNetworkType == INFRA_NETWORK) || (conn != NULL)) && evt->status == 0) {
+        aggr_recv_addba_req_evt(get_aggr_ctx(arPriv, conn), tid, evt->st_seq_no, evt->win_sz);
+    }
+}
+
+void
+ar6000_aggr_rcv_addba_resp_evt(AR_SOFTC_DEV_T *arPriv, WMI_ADDBA_RESP_EVENT *evt)
+{
+    A_UINT8 connid = BA_EVT_GET_CONNID(evt->tid);
+    A_UINT8 tid = BA_EVT_GET_TID(evt->tid);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ADDBA RSP: tid=%d, connid=%d, status=%d, sz=%d\n", tid, connid, evt->status, evt->amsdu_sz));
+    if(evt->status == 0) {
+    }
+}
+
+void
+ar6000_aggr_rcv_delba_req_evt(AR_SOFTC_DEV_T *arPriv, WMI_DELBA_EVENT *evt)
+{
+    A_UINT8 connid = BA_EVT_GET_CONNID(evt->tid);
+    A_UINT8 tid = BA_EVT_GET_TID(evt->tid);
+    conn_t *conn = ieee80211_find_conn_for_aid(arPriv, connid);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("DELBA REQ: tid=%d, connid=%d\n", tid, connid));
+    if(((arPriv->arNetworkType == INFRA_NETWORK) || (conn != NULL)) && (!evt->is_peer_initiator)) {
+        aggr_recv_delba_req_evt(get_aggr_ctx(arPriv, conn), tid);
+    }
+}
+#endif
+
+void register_pal_cb(ar6k_pal_config_t *palConfig_p)
+{
+    ar6k_pal_config_g = *palConfig_p;
+}
+
+void
+ar6000_hci_event_rcv_evt(AR_SOFTC_DEV_T *arPriv, WMI_HCI_EVENT *cmd)
+{
+    void *osbuf = NULL;
+    A_INT8 i;
+    A_UINT8 size, *buf;
+    A_STATUS ret = A_OK;
+
+    size = cmd->evt_buf_sz + 4;
+    osbuf = A_NETBUF_ALLOC(size);
+    if (osbuf == NULL) {
+        ret = A_NO_MEMORY;
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Error in allocating netbuf \n"));
+        return;
+    }
+
+    A_NETBUF_PUT(osbuf, size);
+    buf = (A_UINT8 *)A_NETBUF_DATA(osbuf);
+    /* First 2-bytes carry HCI event/ACL data type
+     * the next 2 are free
+     */
+    *((short *)buf) = WMI_HCI_EVENT_EVENTID;
+    buf += sizeof(int);
+    A_MEMCPY(buf, cmd->buf, cmd->evt_buf_sz);
+
+    if(ar6k_pal_config_g.fpar6k_pal_recv_pkt)
+    {
+        /* pass the cmd packet to PAL driver */
+      if((*ar6k_pal_config_g.fpar6k_pal_recv_pkt)(arPriv->hcipal_info, osbuf) == TRUE)
+            return;
+    }
+    ar6000_deliver_frames_to_nw_stack(arPriv->arNetDev, osbuf);
+    if(loghci) {
+        A_PRINTF_LOG("HCI Event From PAL <-- \n");
+        for(i = 0; i < cmd->evt_buf_sz; i++) {
+            A_PRINTF_LOG("0x%02x ", cmd->buf[i]);
+           if((i % 10) == 0) {
+                A_PRINTF_LOG("\n");
+            }
+        }
+        A_PRINTF_LOG("\n");
+        A_PRINTF_LOG("==================================\n");
+    }
+}
+
+void
+ar6000_neighborReport_event(AR_SOFTC_DEV_T *arPriv, int numAps, WMI_NEIGHBOR_INFO *info)
+{
+#if WIRELESS_EXT >= 18
+    struct iw_pmkid_cand *pmkcand;
+#else /* WIRELESS_EXT >= 18 */
+    static const char *tag = "PRE-AUTH";
+    char buf[128];
+#endif /* WIRELESS_EXT >= 18 */
+
+    union iwreq_data wrqu;
+    int i;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 Neighbor Report Event\n"));
+    for (i=0; i < numAps; info++, i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",
+                        info->bssid[0], info->bssid[1], info->bssid[2],
+                        info->bssid[3], info->bssid[4], info->bssid[5]));
+        if (info->bssFlags & WMI_PREAUTH_CAPABLE_BSS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("preauth-cap"));
+        }
+        if (info->bssFlags & WMI_PMKID_VALID_BSS) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" pmkid-valid\n"));
+            continue;           /* we skip bss if the pmkid is already valid */
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\n"));
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+#if WIRELESS_EXT >= 18
+        pmkcand = A_MALLOC_NOWAIT(sizeof(struct iw_pmkid_cand));
+        A_MEMZERO(pmkcand, sizeof(struct iw_pmkid_cand));
+        pmkcand->index = i;
+        pmkcand->flags = info->bssFlags;
+        A_MEMCPY(pmkcand->bssid.sa_data, info->bssid, ATH_MAC_LEN);
+        wrqu.data.length = sizeof(struct iw_pmkid_cand);
+        wireless_send_event(arPriv->arNetDev, IWEVPMKIDCAND, &wrqu, (char *)pmkcand);
+        A_FREE(pmkcand);
+#else /* WIRELESS_EXT >= 18 */
+        snprintf(buf, sizeof(buf), "%s%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x",
+                 tag,
+                 info->bssid[0], info->bssid[1], info->bssid[2],
+                 info->bssid[3], info->bssid[4], info->bssid[5],
+                 i, info->bssFlags);
+        wrqu.data.length = strlen(buf);
+        wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+#endif /* WIRELESS_EXT >= 18 */
+    }
+}
+
+void
+ar6000_indicate_proberesp(AR_SOFTC_DEV_T *arPriv , A_UINT8* pData , A_UINT16 len ,A_UINT8* bssid)
+{
+}
+
+void
+ar6000_indicate_beacon(AR_SOFTC_DEV_T *arPriv, A_UINT8* pData , A_UINT16 len ,A_UINT8* bssid)
+{
+}
+
+void
+ar6000_assoc_req_report_event (void *context, A_UINT8 status, A_UINT8 rspType, A_UINT8* pData, int len)
+{
+}
+
+#ifdef ATH_SUPPORT_DFS
+
+void ar6000_dfs_attach_event(AR_SOFTC_DEV_T *arPriv, WMI_DFS_HOST_ATTACH_EVENT *capinfo)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    arAp->pDfs = dfs_attach_host(arPriv, NULL, capinfo);
+    if(arAp->pDfs)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\nDFS host attached\n"));
+    }
+    else
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\nDFS host ptr NULL\n"));
+    }
+}
+
+void ar6000_dfs_init_event(AR_SOFTC_DEV_T *arPriv, WMI_DFS_HOST_INIT_EVENT *info)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_init_radar_filters_host(arAp->pDfs, info);
+}
+
+void ar6000_dfs_phyerr_event(AR_SOFTC_DEV_T *arPriv, WMI_DFS_PHYERR_EVENT *info)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_process_phyerr_host(arAp->pDfs, info);
+}
+
+void ar6000_dfs_reset_delaylines_event(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_reset_alldelaylines(arAp->pDfs);
+}
+
+void ar6000_dfs_reset_radarq_event(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_reset_radarq(arAp->pDfs);
+}
+
+void ar6000_dfs_reset_ar_event(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_reset_ar(arAp->pDfs);
+}
+
+void ar6000_dfs_reset_arq_event(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_reset_arq(arAp->pDfs);
+}
+
+void ar6000_dfs_set_dur_multiplier_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 value)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_set_dur_multiplier(arAp->pDfs, value);
+}
+
+void ar6000_dfs_set_bangradar_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 value)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_bangradar_enable(arAp->pDfs, value);
+}
+
+void ar6000_dfs_set_debuglevel_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 value)
+{
+    AR_SOFTC_AP_T *arAp=&arPriv->arAp;
+    dfs_set_debug_level_host(arAp->pDfs, value);
+}
+
+A_STATUS ar6000_dfs_set_maxpulsedur_cmd(AR_SOFTC_DEV_T *arPriv, A_UINT32 value)
+{
+    return wmi_set_dfs_maxpulsedur_cmd(arPriv->arWmi, value);
+}
+
+A_STATUS ar6000_dfs_radar_detected_cmd(AR_SOFTC_DEV_T *arPriv, A_INT16 chan_index, A_INT8 bang_radar)
+{
+    return wmi_radarDetected_cmd(arPriv->arWmi, chan_index, bang_radar);
+}
+
+A_STATUS ar6000_dfs_set_minrssithresh_cmd(AR_SOFTC_DEV_T *arPriv,  A_INT32 rssi)
+{
+    return wmi_set_dfs_minrssithresh_cmd(arPriv->arWmi, rssi);
+}
+
+#endif /* ATH_SUPPORT_DFS */
+
+void
+ar6000_tkip_micerr_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 keyid, A_BOOL ismcast)
+{
+    static const char *tag = "MLME-MICHAELMICFAILURE.indication";
+    char buf[128];
+    union iwreq_data wrqu;
+
+    /*
+     * For AP case, keyid will have aid of STA which sent pkt with
+     * MIC error. Use this aid to get MAC & send it to hostapd.
+     */
+    if (arPriv->arNetworkType == AP_NETWORK) {
+        conn_t *s = ieee80211_find_conn_for_aid(arPriv, (keyid >> 2));
+        if(!s){
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AP TKIP MIC error received from Invalid aid / STA not found =%d\n", keyid));
+            return;
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AP TKIP MIC error received from aid=%d\n", keyid));
+        snprintf(buf,sizeof(buf), "%s addr=%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
+            tag, s->mac[0],s->mac[1],s->mac[2],s->mac[3],s->mac[4],s->mac[5]);
+    } else {
+
+#ifdef ATH6K_CONFIG_CFG80211
+        ar6k_cfg80211_tkip_micerr_event(arPriv, keyid, ismcast);
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6000 TKIP MIC error received for keyid %d %scast\n",
+             keyid & 0x3, ismcast ? "multi": "uni"));
+        snprintf(buf, sizeof(buf), "%s(keyid=%d %sicast)", tag, keyid & 0x3,
+             ismcast ? "mult" : "un");
+    }
+
+    memset(&wrqu, 0, sizeof(wrqu));
+    wrqu.data.length = strlen(buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void
+ar6000_scanComplete_event(AR_SOFTC_DEV_T *arPriv, A_STATUS status)
+{
+
+#ifdef ATH6K_CONFIG_CFG80211
+    ar6k_cfg80211_scanComplete_event(arPriv, status);
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+    if ((arPriv->arSoftc->arWmiReady) && (arPriv->arWmiEnabled) && (arPriv->arSoftc->arWlanState==WLAN_ENABLED)) {
+        if (!arPriv->arSta.arUserBssFilter) {
+            wmi_bssfilter_cmd(arPriv->arWmi, NONE_BSS_FILTER, 0);
+        }
+    }
+    if (arPriv->arSta.scan_triggered) {
+        union iwreq_data wrqu;
+        A_MEMZERO(&wrqu, sizeof(wrqu));
+        wireless_send_event(arPriv->arNetDev, SIOCGIWSCAN, &wrqu, NULL);
+        arPriv->arSta.scan_triggered = 0;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,( "AR6000 scan complete: %d\n", status));
+    wake_up_interruptible(&scan_complete);
+}
+
+void
+ar6000_targetStats_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *ptr, A_UINT32 len)
+{
+    A_UINT8 ac, i;
+
+    if(arPriv->arNetworkType == AP_NETWORK) {
+        WMI_AP_MODE_STAT *p = (WMI_AP_MODE_STAT *)ptr;
+        WMI_PER_STA_STAT *ap = arPriv->arSoftc->arAPStats;
+
+        if (len < sizeof(*p)) {
+            return;
+        }
+
+        for(ac=0;ac<AP_MAX_NUM_STA;ac++) {
+            if(p->sta[ac].aid == 0) {
+                continue;
+            }
+            i = p->sta[ac].aid-1;
+
+            ap[i].tx_bytes += p->sta[ac].tx_bytes;
+            ap[i].tx_pkts += p->sta[ac].tx_pkts;
+            ap[i].tx_error += p->sta[ac].tx_error;
+            ap[i].tx_discard += p->sta[ac].tx_discard;
+            ap[i].rx_bytes += p->sta[ac].rx_bytes;
+            ap[i].rx_pkts += p->sta[ac].rx_pkts;
+            ap[i].rx_error += p->sta[ac].rx_error;
+            ap[i].rx_discard += p->sta[ac].rx_discard;
+        }
+    } else {
+        WMI_TARGET_STATS *pTarget = (WMI_TARGET_STATS *)ptr;
+        TARGET_STATS *pStats = &arPriv->arTargetStats;
+
+        if (len < sizeof(*pTarget)) {
+            return;
+        }
+
+        // Update the RSSI of the connected bss.
+        if (arPriv->arConnected) {
+            bss_t *pConnBss = NULL;
+            wmi_scan_report_lock(arPriv->arWmi);
+
+            pConnBss = wmi_find_node(arPriv->arWmi,arPriv->arBssid);
+            if (pConnBss)
+            {
+                pConnBss->ni_rssi = pTarget->cservStats.cs_aveBeacon_rssi;
+                pConnBss->ni_snr = pTarget->cservStats.cs_aveBeacon_snr;
+                wmi_node_return(arPriv->arWmi, pConnBss);
+            }
+            wmi_scan_report_unlock(arPriv->arWmi);
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 updating target stats\n"));
+        pStats->tx_packets += pTarget->txrxStats.tx_stats.tx_packets;
+        pStats->tx_bytes += pTarget->txrxStats.tx_stats.tx_bytes;
+        pStats->tx_unicast_pkts += pTarget->txrxStats.tx_stats.tx_unicast_pkts;
+        pStats->tx_unicast_bytes += pTarget->txrxStats.tx_stats.tx_unicast_bytes;
+        pStats->tx_multicast_pkts += pTarget->txrxStats.tx_stats.tx_multicast_pkts;
+        pStats->tx_multicast_bytes += pTarget->txrxStats.tx_stats.tx_multicast_bytes;
+        pStats->tx_broadcast_pkts += pTarget->txrxStats.tx_stats.tx_broadcast_pkts;
+        pStats->tx_broadcast_bytes += pTarget->txrxStats.tx_stats.tx_broadcast_bytes;
+        pStats->tx_rts_success_cnt += pTarget->txrxStats.tx_stats.tx_rts_success_cnt;
+        for(ac = 0; ac < WMM_NUM_AC; ac++)
+            pStats->tx_packet_per_ac[ac] += pTarget->txrxStats.tx_stats.tx_packet_per_ac[ac];
+        pStats->tx_errors += pTarget->txrxStats.tx_stats.tx_errors;
+        pStats->tx_failed_cnt += pTarget->txrxStats.tx_stats.tx_failed_cnt;
+        pStats->tx_retry_cnt += pTarget->txrxStats.tx_stats.tx_retry_cnt;
+        pStats->tx_mult_retry_cnt += pTarget->txrxStats.tx_stats.tx_mult_retry_cnt;
+        pStats->tx_rts_fail_cnt += pTarget->txrxStats.tx_stats.tx_rts_fail_cnt;
+        pStats->tx_unicast_rate = wmi_get_rate(pTarget->txrxStats.tx_stats.tx_unicast_rate);
+
+        pStats->rx_packets += pTarget->txrxStats.rx_stats.rx_packets;
+        pStats->rx_bytes += pTarget->txrxStats.rx_stats.rx_bytes;
+        pStats->rx_unicast_pkts += pTarget->txrxStats.rx_stats.rx_unicast_pkts;
+        pStats->rx_unicast_bytes += pTarget->txrxStats.rx_stats.rx_unicast_bytes;
+        pStats->rx_multicast_pkts += pTarget->txrxStats.rx_stats.rx_multicast_pkts;
+        pStats->rx_multicast_bytes += pTarget->txrxStats.rx_stats.rx_multicast_bytes;
+        pStats->rx_broadcast_pkts += pTarget->txrxStats.rx_stats.rx_broadcast_pkts;
+        pStats->rx_broadcast_bytes += pTarget->txrxStats.rx_stats.rx_broadcast_bytes;
+        pStats->rx_fragment_pkt += pTarget->txrxStats.rx_stats.rx_fragment_pkt;
+        pStats->rx_errors += pTarget->txrxStats.rx_stats.rx_errors;
+        pStats->rx_crcerr += pTarget->txrxStats.rx_stats.rx_crcerr;
+        pStats->rx_key_cache_miss += pTarget->txrxStats.rx_stats.rx_key_cache_miss;
+        pStats->rx_decrypt_err += pTarget->txrxStats.rx_stats.rx_decrypt_err;
+        pStats->rx_duplicate_frames += pTarget->txrxStats.rx_stats.rx_duplicate_frames;
+        pStats->rx_unicast_rate = wmi_get_rate(pTarget->txrxStats.rx_stats.rx_unicast_rate);
+
+
+        pStats->tkip_local_mic_failure
+                                += pTarget->txrxStats.tkipCcmpStats.tkip_local_mic_failure;
+        pStats->tkip_counter_measures_invoked
+                                += pTarget->txrxStats.tkipCcmpStats.tkip_counter_measures_invoked;
+        pStats->tkip_replays += pTarget->txrxStats.tkipCcmpStats.tkip_replays;
+        pStats->tkip_format_errors += pTarget->txrxStats.tkipCcmpStats.tkip_format_errors;
+        pStats->ccmp_format_errors += pTarget->txrxStats.tkipCcmpStats.ccmp_format_errors;
+        pStats->ccmp_replays += pTarget->txrxStats.tkipCcmpStats.ccmp_replays;
+
+        pStats->power_save_failure_cnt += pTarget->pmStats.power_save_failure_cnt;
+        pStats->noise_floor_calibation = pTarget->noise_floor_calibation;
+
+        pStats->cs_bmiss_cnt += pTarget->cservStats.cs_bmiss_cnt;
+        pStats->cs_lowRssi_cnt += pTarget->cservStats.cs_lowRssi_cnt;
+        pStats->cs_connect_cnt += pTarget->cservStats.cs_connect_cnt;
+        pStats->cs_disconnect_cnt += pTarget->cservStats.cs_disconnect_cnt;
+        pStats->cs_aveBeacon_snr = pTarget->cservStats.cs_aveBeacon_snr;
+        pStats->cs_aveBeacon_rssi = pTarget->cservStats.cs_aveBeacon_rssi;
+
+        if (enablerssicompensation) {
+            pStats->cs_aveBeacon_rssi =
+                    rssi_compensation_calc(arPriv, pStats->cs_aveBeacon_rssi);
+        }
+        pStats->cs_lastRoam_msec = pTarget->cservStats.cs_lastRoam_msec;
+        pStats->cs_snr = pTarget->cservStats.cs_snr;
+        pStats->cs_rssi = pTarget->cservStats.cs_rssi;
+
+        pStats->lq_val = pTarget->lqVal;
+
+        pStats->wow_num_pkts_dropped += pTarget->wowStats.wow_num_pkts_dropped;
+        pStats->wow_num_host_pkt_wakeups += pTarget->wowStats.wow_num_host_pkt_wakeups;
+        pStats->wow_num_host_event_wakeups += pTarget->wowStats.wow_num_host_event_wakeups;
+        pStats->wow_num_events_discarded += pTarget->wowStats.wow_num_events_discarded;
+        pStats->arp_received += pTarget->arpStats.arp_received;
+        pStats->arp_matched += pTarget->arpStats.arp_matched;
+        pStats->arp_replied += pTarget->arpStats.arp_replied;
+
+        if (arPriv->statsUpdatePending) {
+            arPriv->statsUpdatePending = FALSE;
+            wake_up(&arPriv->arEvent);
+        }
+    }
+}
+
+void
+ar6000_rssiThreshold_event(AR_SOFTC_DEV_T *arPriv, WMI_RSSI_THRESHOLD_VAL newThreshold, A_INT16 rssi)
+{
+    USER_RSSI_THOLD userRssiThold;
+
+    rssi = rssi + SIGNAL_QUALITY_NOISE_FLOOR;
+
+    if (enablerssicompensation) {
+        rssi = rssi_compensation_calc(arPriv, rssi);
+    }
+
+    /* Send an event to the app */
+    userRssiThold.tag = arPriv->arSta.rssi_map[newThreshold].tag;
+    userRssiThold.rssi = rssi;
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("rssi Threshold range = %d tag = %d  rssi = %d\n", newThreshold,
+             userRssiThold.tag, userRssiThold.rssi));
+
+    ar6000_send_event_to_app(arPriv, WMI_RSSI_THRESHOLD_EVENTID,(A_UINT8 *)&userRssiThold, sizeof(USER_RSSI_THOLD));
+}
+
+
+void
+ar6000_hbChallengeResp_event(AR_SOFTC_DEV_T *arPriv, A_UINT32 cookie, A_UINT32 source)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    if (source == APP_HB_CHALLENGE) {
+        /* Report it to the app in case it wants a positive acknowledgement */
+        ar6000_send_event_to_app(arPriv, WMIX_HB_CHALLENGE_RESP_EVENTID,
+                                 (A_UINT8 *)&cookie, sizeof(cookie));
+    } else {
+        /* This would ignore the replys that come in after their due time */
+        if (cookie == ar->arHBChallengeResp.seqNum) {
+            ar->arHBChallengeResp.outstanding = FALSE;
+        }
+    }
+}
+
+
+void
+ar6000_reportError_event(AR_SOFTC_DEV_T *arPriv, WMI_TARGET_ERROR_VAL errorVal)
+{
+    char *errString[] = {
+        [WMI_TARGET_PM_ERR_FAIL]    "WMI_TARGET_PM_ERR_FAIL",
+        [WMI_TARGET_KEY_NOT_FOUND]  "WMI_TARGET_KEY_NOT_FOUND",
+        [WMI_TARGET_DECRYPTION_ERR] "WMI_TARGET_DECRYPTION_ERR",
+        [WMI_TARGET_BMISS]          "WMI_TARGET_BMISS",
+        [WMI_PSDISABLE_NODE_JOIN]   "WMI_PSDISABLE_NODE_JOIN"
+    };
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6000 Error on Target. Error = 0x%x\n", errorVal));
+
+    /* One error is reported at a time, and errorval is a bitmask */
+    if(errorVal & (errorVal - 1))
+        return;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("AR6000 Error type = "));
+    switch(errorVal)
+    {
+    case WMI_TARGET_PM_ERR_FAIL:
+    case WMI_TARGET_KEY_NOT_FOUND:
+    case WMI_TARGET_DECRYPTION_ERR:
+    case WMI_TARGET_BMISS:
+    case WMI_PSDISABLE_NODE_JOIN:
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s\n", errString[errorVal]));
+        break;
+    default:
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("INVALID\n"));
+        break;
+    }
+
+}
+
+
+void
+ar6000_cac_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 ac, A_UINT8 cacIndication,
+                 A_UINT8 statusCode, A_UINT8 *tspecSuggestion)
+{
+    WMM_TSPEC_IE *tspecIe;
+
+    /*
+     * This is the TSPEC IE suggestion from AP.
+     * Suggestion provided by AP under some error
+     * cases, could be helpful for the host app.
+     * Check documentation.
+     */
+    tspecIe = (WMM_TSPEC_IE *)tspecSuggestion;
+
+    /*
+     * What do we do, if we get TSPEC rejection? One thought
+     * that comes to mind is implictly delete the pstream...
+     */
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 CAC notification. "
+                    "AC = %d, cacIndication = 0x%x, statusCode = 0x%x\n",
+                    ac, cacIndication, statusCode));
+}
+
+void
+ar6000_channel_change_event(AR_SOFTC_DEV_T *arPriv, A_UINT16 oldChannel,
+                            A_UINT16 newChannel)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Channel Change notification\nOld Channel: %d, New Channel: %d\n",
+                    oldChannel, newChannel));
+}
+
+#define AR6000_PRINT_BSSID(_pBss)  do {     \
+        A_PRINTF("%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ",\
+                 (_pBss)[0],(_pBss)[1],(_pBss)[2],(_pBss)[3],\
+                 (_pBss)[4],(_pBss)[5]);  \
+} while(0)
+
+void
+ar6000_roam_tbl_event(AR_SOFTC_DEV_T *arPriv, WMI_TARGET_ROAM_TBL *pTbl)
+{
+    A_UINT8 i;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ROAM TABLE NO OF ENTRIES is %d ROAM MODE is %d\n",
+              pTbl->numEntries, pTbl->roamMode));
+    for (i= 0; i < pTbl->numEntries; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("[%d]bssid %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x ", i,
+            pTbl->bssRoamInfo[i].bssid[0], pTbl->bssRoamInfo[i].bssid[1],
+            pTbl->bssRoamInfo[i].bssid[2],
+            pTbl->bssRoamInfo[i].bssid[3],
+            pTbl->bssRoamInfo[i].bssid[4],
+            pTbl->bssRoamInfo[i].bssid[5]));
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("RSSI %d RSSIDT %d LAST RSSI %d UTIL %d ROAM_UTIL %d"
+                 " BIAS %d\n",
+            pTbl->bssRoamInfo[i].rssi,
+            pTbl->bssRoamInfo[i].rssidt,
+            pTbl->bssRoamInfo[i].last_rssi,
+            pTbl->bssRoamInfo[i].util,
+            pTbl->bssRoamInfo[i].roam_util,
+            pTbl->bssRoamInfo[i].bias));
+    }
+}
+
+void
+ar6000_wow_list_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 num_filters, WMI_GET_WOW_LIST_REPLY *wow_reply)
+{
+    A_UINT8 i,j;
+
+    /*Each event now contains exactly one filter, see bug 26613*/
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WOW pattern %d of %d patterns\n", wow_reply->this_filter_num,                 wow_reply->num_filters));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("wow mode = %s host mode = %s\n",
+            (wow_reply->wow_mode == 0? "disabled":"enabled"),
+            (wow_reply->host_mode == 1 ? "awake":"asleep")));
+
+
+    /*If there are no patterns, the reply will only contain generic
+      WoW information. Pattern information will exist only if there are
+      patterns present. Bug 26716*/
+
+    /* If this event contains pattern information, display it*/
+    if (wow_reply->this_filter_num) {
+        i=0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("id=%d size=%d offset=%d\n",
+                    wow_reply->wow_filters[i].wow_filter_id,
+                    wow_reply->wow_filters[i].wow_filter_size,
+                    wow_reply->wow_filters[i].wow_filter_offset));
+       AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("wow pattern = "));
+       for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
+             AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%2.2x",wow_reply->wow_filters[i].wow_filter_pattern[j]));
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\nwow mask = "));
+        for (j=0; j< wow_reply->wow_filters[i].wow_filter_size; j++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%2.2x",wow_reply->wow_filters[i].wow_filter_mask[j]));
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\n"));
+    }
+}
+
+/*
+ * Report the Roaming related data collected on the target
+ */
+void
+ar6000_display_roam_time(WMI_TARGET_ROAM_TIME *p)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Disconnect Data : BSSID: "));
+    AR6000_PRINT_BSSID(p->disassoc_bssid);
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" RSSI %d DISASSOC Time %d NO_TXRX_TIME %d\n",
+             p->disassoc_bss_rssi,p->disassoc_time,
+             p->no_txrx_time));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Connect Data: BSSID: "));
+    AR6000_PRINT_BSSID(p->assoc_bssid);
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,(" RSSI %d ASSOC Time %d TXRX_TIME %d\n",
+             p->assoc_bss_rssi,p->assoc_time,
+             p->allow_txrx_time));
+}
+
+void
+ar6000_roam_data_event(AR_SOFTC_DEV_T *arPriv, WMI_TARGET_ROAM_DATA *p)
+{
+    switch (p->roamDataType) {
+    case ROAM_DATA_TIME:
+        ar6000_display_roam_time(&p->u.roamTime);
+        break;
+    default:
+        break;
+    }
+}
+
+void
+ar6000_bssInfo_event_rx(AR_SOFTC_DEV_T *arPriv, A_UINT8 *datap, int len)
+{
+    struct sk_buff *skb;
+    WMI_BSS_INFO_HDR *bih = (WMI_BSS_INFO_HDR *)datap;
+
+
+    if (!arPriv->arSta.arMgmtFilter) {
+        return;
+    }
+    if (((arPriv->arSta.arMgmtFilter & IEEE80211_FILTER_TYPE_BEACON) &&
+        (bih->frameType != BEACON_FTYPE)) ||
+        ((arPriv->arSta.arMgmtFilter & IEEE80211_FILTER_TYPE_PROBE_RESP) &&
+        (bih->frameType != PROBERESP_FTYPE)))
+    {
+        return;
+    }
+
+    if ((skb = A_NETBUF_ALLOC_RAW(len)) != NULL) {
+
+        A_NETBUF_PUT(skb, len);
+        A_MEMCPY(A_NETBUF_DATA(skb), datap, len);
+        skb->dev = arPriv->arNetDev;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+        A_MEMCPY(skb_mac_header(skb), A_NETBUF_DATA(skb), 6);
+#else
+        skb->mac.raw = A_NETBUF_DATA(skb);
+#endif
+        skb->ip_summed = CHECKSUM_NONE;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = __constant_htons(0x0019);
+        A_NETIF_RX(skb);
+    }
+}
+
+A_UINT32 wmiSendCmdNum;
+
+A_STATUS
+ar6000_control_tx(void *devt, void *osbuf, HTC_ENDPOINT_ID eid)
+{
+    AR_SOFTC_DEV_T  *arPriv = (AR_SOFTC_DEV_T *)devt;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_STATUS status = A_OK;
+    struct ar_cookie *cookie = NULL;
+    int i;
+
+#ifdef CONFIG_PM
+    if (ar->arWowState == WLAN_WOW_STATE_SUSPENDED) {
+        return A_EACCES;
+    }
+#endif /* CONFIG_PM */
+    /* take lock to protect ar6000_alloc_cookie() */
+    AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+    do {
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("ar_contrstatus = ol_tx: skb=0x%x, len=0x%x eid =%d\n",
+                         (A_UINT32)osbuf, A_NETBUF_LEN(osbuf), eid));
+
+        if (ar->arWMIControlEpFull && (eid == ar->arControlEp)) {
+            /* control endpoint is full, don't allocate resources, we
+             * are just going to drop this packet */
+            cookie = NULL;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,(" WMI Control EP full, dropping packet : 0x%X, len:%d \n",
+                    (A_UINT32)osbuf, A_NETBUF_LEN(osbuf)));
+#ifdef ANDROID_ENV
+            if (++android_epfull_cnt > ANDROID_RELOAD_THRESHOLD_FOR_EP_FULL) {
+                android_send_reload_event(arPriv);
+                android_epfull_cnt = 0;
+            }
+#endif
+        } else {
+            cookie = ar6000_alloc_cookie(ar);
+        }
+
+        if (cookie == NULL) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        if(logWmiRawMsgs) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WMI cmd send, msgNo %d :", wmiSendCmdNum));
+            for(i = 0; i < a_netbuf_to_len(osbuf); i++)
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%x ", ((A_UINT8 *)a_netbuf_to_data(osbuf))[i]));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\n"));
+        }
+
+        wmiSendCmdNum++;
+
+    } while (FALSE);
+
+    if (cookie != NULL) {
+        /* got a structure to send it out on */
+        ar->arTxPending[eid]++;
+
+        if (eid != ar->arControlEp) {
+            ar->arTotalTxDataPending++;
+        }
+
+        /* Increment number of cookies allocated for control packets */
+        ar->arControlCookieCount++;
+    }
+
+    AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    if (cookie != NULL) {
+        cookie->arc_bp[0] = (A_UINT32)osbuf;
+        cookie->arc_bp[1] = 0;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(osbuf),
+                               A_NETBUF_LEN(osbuf),
+                               eid,
+                               AR6K_CONTROL_PKT_TAG);
+        /* this interface is asynchronous, if there is an error, cleanup will happen in the
+         * TX completion callback */
+        HTCSendPkt(ar->arHtcTarget, &cookie->HtcPkt);
+        status = A_OK;
+    }
+
+    return status;
+}
+
+/* indicate tx activity or inactivity on a WMI stream */
+void ar6000_indicate_tx_activity(void *devt, A_UINT8 TrafficClass, A_BOOL Active)
+{
+    AR_SOFTC_DEV_T  *arPriv = (AR_SOFTC_DEV_T *)devt;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    HTC_ENDPOINT_ID eid ;
+    int i;
+
+    if (ar->arWmiReady) {
+        eid = arAc2EndpointID(ar, TrafficClass);
+
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+
+        ar->arAcStreamActive[TrafficClass] = Active;
+
+        if (Active) {
+            /* when a stream goes active, keep track of the active stream with the highest priority */
+
+            if (ar->arAcStreamPriMap[TrafficClass] > ar->arHiAcStreamActivePri) {
+                /* set the new highest active priority */
+                ar->arHiAcStreamActivePri = ar->arAcStreamPriMap[TrafficClass];
+            }
+
+        } else {
+            /* when a stream goes inactive, we may have to search for the next active stream
+             * that is the highest priority */
+
+            if (ar->arHiAcStreamActivePri == ar->arAcStreamPriMap[TrafficClass]) {
+
+                /* the highest priority stream just went inactive */
+
+                /* reset and search for the "next" highest "active" priority stream */
+                ar->arHiAcStreamActivePri = 0;
+                for (i = 0; i < WMM_NUM_AC; i++) {
+                    if (ar->arAcStreamActive[i]) {
+                        if (ar->arAcStreamPriMap[i] > ar->arHiAcStreamActivePri) {
+                            /* set the new highest active priority */
+                            ar->arHiAcStreamActivePri = ar->arAcStreamPriMap[i];
+                        }
+                    }
+                }
+            }
+        }
+
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+    } else {
+        /* for mbox ping testing, the traffic class is mapped directly as a stream ID,
+         * see handling of AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE in ioctl.c
+         * convert the stream ID to a endpoint */
+        eid = arAc2EndpointID(ar, TrafficClass);
+    }
+
+    /* notify HTC, this may cause credit distribution changes */
+
+    HTCIndicateActivityChange(ar->arHtcTarget,
+                              eid,
+                              Active);
+
+}
+
+void
+ar6000_btcoex_config_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *ptr, A_UINT32 len)
+{
+
+    WMI_BTCOEX_CONFIG_EVENT *pBtcoexConfig = (WMI_BTCOEX_CONFIG_EVENT *)ptr;
+    WMI_BTCOEX_CONFIG_EVENT *pArbtcoexConfig =&arPriv->arBtcoexConfig;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 BTCOEX CONFIG EVENT \n"));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("received config event\n"));
+    pArbtcoexConfig->btProfileType = pBtcoexConfig->btProfileType;
+    pArbtcoexConfig->linkId = pBtcoexConfig->linkId;
+
+    switch (pBtcoexConfig->btProfileType) {
+    case WMI_BTCOEX_BT_PROFILE_SCO:
+        A_MEMCPY(&pArbtcoexConfig->info.scoConfigCmd, &pBtcoexConfig->info.scoConfigCmd,
+                 sizeof(WMI_SET_BTCOEX_SCO_CONFIG_CMD));
+        break;
+    case WMI_BTCOEX_BT_PROFILE_A2DP:
+        A_MEMCPY(&pArbtcoexConfig->info.a2dpConfigCmd, &pBtcoexConfig->info.a2dpConfigCmd,
+                 sizeof(WMI_SET_BTCOEX_A2DP_CONFIG_CMD));
+        break;
+    case WMI_BTCOEX_BT_PROFILE_ACLCOEX:
+        A_MEMCPY(&pArbtcoexConfig->info.aclcoexConfig, &pBtcoexConfig->info.aclcoexConfig,
+                 sizeof(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD));
+        break;
+    case WMI_BTCOEX_BT_PROFILE_INQUIRY_PAGE:
+           A_MEMCPY(&pArbtcoexConfig->info.btinquiryPageConfigCmd, &pBtcoexConfig->info.btinquiryPageConfigCmd,
+                 sizeof(WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD));
+        break;
+    }
+    if (arPriv->statsUpdatePending) {
+        arPriv->statsUpdatePending = FALSE;
+        wake_up(&arPriv->arEvent);
+    }
+}
+
+void
+ar6000_btcoex_stats_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *ptr, A_UINT32 len)
+{
+    WMI_BTCOEX_STATS_EVENT *pBtcoexStats = (WMI_BTCOEX_STATS_EVENT *)ptr;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6000 BTCOEX CONFIG EVENT \n"));
+
+    A_MEMCPY(&arPriv->arBtcoexStats, pBtcoexStats, sizeof(WMI_BTCOEX_STATS_EVENT));
+
+    if (arPriv->statsUpdatePending) {
+        arPriv->statsUpdatePending = FALSE;
+        wake_up(&arPriv->arEvent);
+    }
+
+}
+
+void
+ar6000_wacinfo_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *ptr, A_UINT32 len)
+{
+#ifdef WAC
+    WMI_GET_WAC_INFO *pWacInfo = (WMI_GET_WAC_INFO *)ptr;
+
+    A_MEMCPY(&arPriv->wacInfo, pWacInfo, sizeof(WMI_GET_WAC_INFO));
+
+    if (arPriv->statsUpdatePending) {
+        arPriv->statsUpdatePending = FALSE;
+        wake_up(&arPriv->arEvent);
+    }
+#endif
+}
+
+static int __init
+__ar6000_init_module(void)
+{
+	int status = 0;
+
+	status = ar6000_init_module();
+
+#ifdef CONFIG_PLAT_AMBARELLA
+	if (!status) {
+		ambarella_detect_sd_slot(ambarella_board_generic.wifi_sd_bus,
+			ambarella_board_generic.wifi_sd_slot, 1);
+	}
+#endif
+
+	return status;
+}
+
+static void __exit
+__ar6000_cleanup_module(void)
+{
+	ar6000_cleanup_module();
+#ifdef CONFIG_PLAT_AMBARELLA
+	ambarella_detect_sd_slot(ambarella_board_generic.wifi_sd_bus,
+		ambarella_board_generic.wifi_sd_slot, 0);
+#endif
+}
+
+module_init(__ar6000_init_module);
+module_exit(__ar6000_cleanup_module);
+
+/* Init cookie queue */
+static void
+ar6000_cookie_init(AR_SOFTC_T *ar)
+{
+    A_UINT32 i;
+
+    ar->arCookieList = NULL;
+    ar->arCookieCount = 0;
+
+    A_MEMZERO(s_ar_cookie_mem, sizeof(s_ar_cookie_mem));
+
+    for (i = 0; i < MAX_COOKIE_NUM; i++) {
+        ar6000_free_cookie(ar, &s_ar_cookie_mem[i]);
+    }
+}
+
+/* cleanup cookie queue */
+static void
+ar6000_cookie_cleanup(AR_SOFTC_T *ar)
+{
+    /* It is gone .... */
+    ar->arCookieList = NULL;
+    ar->arCookieCount = 0;
+    ar->arControlCookieCount = 0;
+}
+
+/* Init cookie queue */
+static void
+ar6000_free_cookie(AR_SOFTC_T *ar, struct ar_cookie * cookie)
+{
+    /* Insert first */
+    A_ASSERT(ar != NULL);
+    A_ASSERT(cookie != NULL);
+
+    cookie->arc_list_next = ar->arCookieList;
+    ar->arCookieList = cookie;
+    ar->arCookieCount++;
+}
+
+/* cleanup cookie queue */
+static struct ar_cookie *
+ar6000_alloc_cookie(AR_SOFTC_T *ar)
+{
+    struct ar_cookie *cookie;
+
+    cookie = ar->arCookieList;
+    if(cookie != NULL)
+    {
+        ar->arCookieList = cookie->arc_list_next;
+        ar->arCookieCount--;
+    }
+
+    return cookie;
+}
+
+#ifdef SEND_EVENT_TO_APP
+/*
+ * This function is used to send event which come from taget to
+ * the application. The buf which send to application is include
+ * the event ID and event content.
+ */
+#define EVENT_ID_LEN   2
+void ar6000_send_event_to_app(AR_SOFTC_DEV_T *arPriv, A_UINT16 eventId,
+                              A_UINT8 *datap, int len)
+{
+
+#if (WIRELESS_EXT >= 15)
+
+/* note: IWEVCUSTOM only exists in wireless extensions after version 15 */
+
+    char *buf;
+    A_UINT16 size;
+    union iwreq_data wrqu;
+
+    size = len + EVENT_ID_LEN;
+
+    if (size > IW_CUSTOM_MAX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI event ID : 0x%4.4X, len = %d too big for IWEVCUSTOM (max=%d) \n",
+                        eventId, size, IW_CUSTOM_MAX));
+        return;
+    }
+
+    /*Dont send DISCONNECT event to APP for host drv  intiated Disconnect cmd*/
+    if((eventId == WMI_DISCONNECT_EVENTID) && arPriv->arSta.arHostDisconnect ) {
+        arPriv->arSta.arHostDisconnect = 0;
+    
+    }
+
+    buf = A_MALLOC_NOWAIT(size);
+    if (NULL == buf){
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: failed to allocate %d bytes\n", __func__, size));
+        return;
+    }
+
+    A_MEMZERO(buf, size);
+    A_MEMCPY(buf, &eventId, EVENT_ID_LEN);
+    A_MEMCPY(buf+EVENT_ID_LEN, datap, len);
+
+    //AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("event ID = %d,len = %d\n",*(A_UINT16*)buf, size));
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = size;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+    A_FREE(buf);
+
+#ifdef ANDROID_ENV
+    if (eventId == WMI_ERROR_REPORT_EVENTID) {
+        android_send_reload_event(arPriv);
+    }
+#endif /* ANDROID_ENV */
+
+#endif
+
+
+}
+
+/*
+ * This function is used to send events larger than 256 bytes
+ * to the application. The buf which is sent to application
+ * includes the event ID and event content.
+ */
+void ar6000_send_generic_event_to_app(AR_SOFTC_DEV_T *arPriv, A_UINT16 eventId,
+                                      A_UINT8 *datap, int len)
+{
+
+#if (WIRELESS_EXT >= 18)
+
+/* IWEVGENIE exists in wireless extensions version 18 onwards */
+
+    char *buf;
+    A_UINT16 size;
+    union iwreq_data wrqu;
+
+    size = len + EVENT_ID_LEN;
+
+    if (size > IW_GENERIC_IE_MAX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("WMI event ID : 0x%4.4X, len = %d too big for IWEVGENIE (max=%d) \n",
+                        eventId, size, IW_GENERIC_IE_MAX));
+        return;
+    }
+
+    buf = A_MALLOC_NOWAIT(size);
+    if (NULL == buf){
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("%s: failed to allocate %d bytes\n", __func__, size));
+        return;
+    }
+
+    A_MEMZERO(buf, size);
+    A_MEMCPY(buf, &eventId, EVENT_ID_LEN);
+    A_MEMCPY(buf+EVENT_ID_LEN, datap, len);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = size;
+    wireless_send_event(arPriv->arNetDev, IWEVGENIE, &wrqu, buf);
+
+    A_FREE(buf);
+
+#endif /* (WIRELESS_EXT >= 18) */
+
+}
+#endif /* SEND_EVENT_TO_APP */
+
+
+void
+ar6000_tx_retry_err_event(void *devt)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Tx retries reach maximum!\n"));
+}
+
+void
+ar6000_snrThresholdEvent_rx(void *devt, WMI_SNR_THRESHOLD_VAL newThreshold, A_UINT8 snr)
+{
+    WMI_SNR_THRESHOLD_EVENT event;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    event.range = newThreshold;
+    event.snr = snr;
+
+    ar6000_send_event_to_app(arPriv, WMI_SNR_THRESHOLD_EVENTID, (A_UINT8 *)&event,
+                             sizeof(WMI_SNR_THRESHOLD_EVENT));
+}
+
+void
+ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL newThreshold, A_UINT8 lq)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("lq threshold range %d, lq %d\n", newThreshold, lq));
+}
+
+
+
+A_UINT32
+a_copy_to_user(void *to, const void *from, A_UINT32 n)
+{
+    return(copy_to_user(to, from, n));
+}
+
+A_UINT32
+a_copy_from_user(void *to, const void *from, A_UINT32 n)
+{
+    return(copy_from_user(to, from, n));
+}
+
+
+A_STATUS
+ar6000_get_driver_cfg(struct net_device *dev,
+                        A_UINT16 cfgParam,
+                        void *result)
+{
+    A_STATUS ret = A_OK;
+
+    switch(cfgParam)
+    {
+    case AR6000_DRIVER_CFG_GET_WLANNODECACHING:
+           *((A_UINT32 *)result) = wlanNodeCaching;
+        break;
+    case AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS:
+           *((A_UINT32 *)result) = logWmiRawMsgs;
+        break;
+    default:
+        ret = A_EINVAL;
+        break;
+    }
+
+    return ret;
+}
+
+void
+ar6000_keepalive_rx(void *devt, A_UINT8 configured)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)devt;
+
+    arPriv->arSta.arKeepaliveConfigured = configured;
+    wake_up(&arPriv->arEvent);
+}
+
+void
+ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID, WMI_PMKID *pmkidList,
+                        A_UINT8 *bssidList)
+{
+    A_UINT8 i, j;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Number of Cached PMKIDs is %d\n", numPMKID));
+
+    for (i = 0; i < numPMKID; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\nBSSID %d ", i));
+        for (j = 0; j < ATH_MAC_LEN; j++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%2.2x", bssidList[j]));
+        }
+        bssidList += (ATH_MAC_LEN + WMI_PMKID_LEN);
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("\nPMKID %d ", i));
+        for (j = 0; j < WMI_PMKID_LEN; j++) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("%2.2x", pmkidList->pmkid[j]));
+        }
+        pmkidList = (WMI_PMKID *)((A_UINT8 *)pmkidList + ATH_MAC_LEN +
+                                  WMI_PMKID_LEN);
+    }
+}
+
+void ar6000_pspoll_event(AR_SOFTC_DEV_T *arPriv,A_UINT8 aid)
+{
+    conn_t *conn=NULL;
+    A_BOOL isPsqEmpty = FALSE;
+
+    conn = ieee80211_find_conn_for_aid(arPriv, aid);
+
+    if(!conn) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("PS-POLL from invalid STA\n"));
+        return;
+    }
+
+    /* If the PS q for this STA is not empty, dequeue and send a pkt from
+     * the head of the q. Also update the More data bit in the WMI_DATA_HDR
+     * if there are more pkts for this STA in the PS q. If there are no more
+     * pkts for this STA, update the PVB for this STA.
+     */
+    A_MUTEX_LOCK(&conn->psqLock);
+    isPsqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+    A_MUTEX_UNLOCK(&conn->psqLock);
+
+    if (isPsqEmpty) {
+        /* TODO:No buffered pkts for this STA. Send out a NULL data frame */
+    } else {
+        struct sk_buff *skb = NULL;
+
+        A_MUTEX_LOCK(&conn->psqLock);
+        skb = A_NETBUF_DEQUEUE(&conn->psq);
+        A_MUTEX_UNLOCK(&conn->psqLock);
+        /* Set the STA flag to PSPolled, so that the frame will go out */
+        STA_SET_PS_POLLED(conn);
+        ar6000_data_tx(skb, arPriv->arNetDev);
+        STA_CLR_PS_POLLED(conn);
+
+        A_MUTEX_LOCK(&conn->psqLock);
+        isPsqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->psq);
+        A_MUTEX_UNLOCK(&conn->psqLock);
+
+    }
+
+    /* Clear the PVB for this STA if the queue has become empty */
+    if (isPsqEmpty) {
+        wmi_set_pvb_cmd(arPriv->arWmi, conn->aid, 0);
+    }
+}
+
+void ar6000_dtimexpiry_event(AR_SOFTC_DEV_T *arPriv)
+{
+    A_BOOL isMcastQueued = FALSE;
+    struct sk_buff *skb = NULL;
+    AR_SOFTC_AP_T *arAp = &arPriv->arAp;
+
+    /* If there are no associated STAs, ignore the DTIM expiry event.
+     * There can be potential race conditions where the last associated
+     * STA may disconnect & before the host could clear the 'Indicate DTIM'
+     * request to the firmware, the firmware would have just indicated a DTIM
+     * expiry event. The race is between 'clear DTIM expiry cmd' going
+     * from the host to the firmware & the DTIM expiry event happening from
+     * the firmware to the host.
+     */
+    if (arAp->sta_list_index == 0) {
+        return;
+    }
+
+    A_MUTEX_LOCK(&arAp->mcastpsqLock);
+    isMcastQueued = A_NETBUF_QUEUE_EMPTY(&arAp->mcastpsq);
+    A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+
+    if(isMcastQueued == TRUE) {
+        return;
+    }
+
+    /* Flush the mcast psq to the target */
+    /* Set the STA flag to DTIMExpired, so that the frame will go out */
+    arAp->DTIMExpired = TRUE;
+
+    A_MUTEX_LOCK(&arAp->mcastpsqLock);
+    while (!A_NETBUF_QUEUE_EMPTY(&arAp->mcastpsq)) {
+        skb = A_NETBUF_DEQUEUE(&arAp->mcastpsq);
+        A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+
+        ar6000_data_tx(skb, arPriv->arNetDev);
+
+        A_MUTEX_LOCK(&arAp->mcastpsqLock);
+    }
+    A_MUTEX_UNLOCK(&arAp->mcastpsqLock);
+
+    /* Reset the DTIMExpired flag back to 0 */
+    arAp->DTIMExpired = FALSE;
+
+    /* Clear the LSB of the BitMapCtl field of the TIM IE */
+    wmi_set_pvb_cmd(arPriv->arWmi, MCAST_AID, 0);
+}
+
+static void ar6000_uapsd_trigger_frame_rx(AR_SOFTC_DEV_T *arPriv, conn_t *conn)
+{
+    A_BOOL isApsdqEmpty;
+    A_BOOL isApsdqEmptyAtStart;
+    A_UINT32 numFramesToDeliver;
+
+    /* If the APSD q for this STA is not empty, dequeue and send a pkt from
+     * the head of the q. Also update the More data bit in the WMI_DATA_HDR
+     * if there are more pkts for this STA in the APSD q. If there are no more
+     * pkts for this STA, update the APSD bitmap for this STA.
+     */
+
+    numFramesToDeliver = (conn->apsd_info >> 4) & 0xF;
+
+    /* Number of frames to send in a service period is indicated by the station
+     * in the QOS_INFO of the association request
+     * If it is zero, send all frames
+     */
+    if (!numFramesToDeliver) {
+        numFramesToDeliver = 0xFFFF;
+    }
+
+    A_MUTEX_LOCK(&conn->psqLock);
+    isApsdqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->apsdq);
+    A_MUTEX_UNLOCK(&conn->psqLock);
+    isApsdqEmptyAtStart = isApsdqEmpty;
+
+    while ((!isApsdqEmpty) && (numFramesToDeliver)) {
+        struct sk_buff *skb = NULL;
+
+        A_MUTEX_LOCK(&conn->psqLock);
+        skb = A_NETBUF_DEQUEUE(&conn->apsdq);
+        isApsdqEmpty = A_NETBUF_QUEUE_EMPTY(&conn->apsdq);
+        A_MUTEX_UNLOCK(&conn->psqLock);
+
+        /* Set the STA flag to Trigger delivery, so that the frame will go out */
+        STA_SET_APSD_TRIGGER(conn);
+        numFramesToDeliver--;
+
+        /* Last frame in the service period, set EOSP or queue empty */
+        if ((isApsdqEmpty) || (!numFramesToDeliver)) {
+            STA_SET_APSD_EOSP(conn);
+        }
+        ar6000_data_tx(skb, arPriv->arNetDev);
+        STA_CLR_APSD_TRIGGER(conn);
+        STA_CLR_APSD_EOSP(conn);
+    }
+
+    if (isApsdqEmpty) {
+        if (isApsdqEmptyAtStart) {
+            wmi_set_apsd_buffered_traffic_cmd(arPriv->arWmi, conn->aid, 0,
+                            WMI_AP_APSD_NO_DELIVERY_FRAMES_FOR_THIS_TRIGGER);
+        } else {
+            wmi_set_apsd_buffered_traffic_cmd(arPriv->arWmi, conn->aid, 0, 0);
+        }
+    }
+
+    return;
+}
+
+void
+read_rssi_compensation_param(AR_SOFTC_T *ar)
+{
+    A_UINT8 *cust_data_ptr;
+    USER_RSSI_CPENSATION *rssi_compensation_param;
+//#define RSSICOMPENSATION_PRINT
+#ifdef RSSICOMPENSATION_PRINT
+    A_INT16 i;
+    cust_data_ptr = ar6000_get_cust_data_buffer(ar->arTargetType);
+    for (i=0; i<16; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("cust_data_%d = %x \n", i, *(A_UINT8 *)cust_data_ptr));
+        cust_data_ptr += 1;
+    }
+#endif
+    rssi_compensation_param = &ar->rssi_compensation_param;
+    cust_data_ptr = ar6000_get_cust_data_buffer(ar->arTargetType);
+
+    rssi_compensation_param->customerID = *(A_UINT16 *)cust_data_ptr & 0xffff;
+    rssi_compensation_param->enable = *(A_UINT16 *)(cust_data_ptr+2) & 0xffff;
+    rssi_compensation_param->bg_param_a = *(A_UINT16 *)(cust_data_ptr+4) & 0xffff;
+    rssi_compensation_param->bg_param_b = *(A_UINT16 *)(cust_data_ptr+6) & 0xffff;
+    rssi_compensation_param->a_param_a = *(A_UINT16 *)(cust_data_ptr+8) & 0xffff;
+    rssi_compensation_param->a_param_b = *(A_UINT16 *)(cust_data_ptr+10) &0xffff;
+    rssi_compensation_param->reserved = *(A_UINT32 *)(cust_data_ptr+12);
+
+#ifdef RSSICOMPENSATION_PRINT
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("customerID = 0x%x \n", rssi_compensation_param->customerID));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("enable = 0x%x \n", rssi_compensation_param->enable));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("bg_param_a = 0x%x and %d \n", rssi_compensation_param->bg_param_a, rssi_compensation_param->bg_param_a));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("bg_param_b = 0x%x and %d \n", rssi_compensation_param->bg_param_b, rssi_compensation_param->bg_param_b));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("a_param_a = 0x%x and %d \n", rssi_compensation_param->a_param_a, rssi_compensation_param->a_param_a));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("a_param_b = 0x%x and %d \n", rssi_compensation_param->a_param_b, rssi_compensation_param->a_param_b));
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Last 4 bytes = 0x%x \n", rssi_compensation_param->reserved));
+#endif
+
+    if (rssi_compensation_param->enable != 0x1) {
+        rssi_compensation_param->enable = 0;
+    }
+
+    return;
+}
+
+A_INT32
+rssi_compensation_calc_tcmd(AR_SOFTC_T *ar, A_UINT32 freq, A_INT32 rssi, A_UINT32 totalPkt)
+{
+    USER_RSSI_CPENSATION *rssi_compensation_param;
+
+    rssi_compensation_param = &ar->rssi_compensation_param;
+
+    if (freq > 5000)
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d, totalPkt = %d\n", rssi,totalPkt));
+            rssi = rssi * rssi_compensation_param->a_param_a + totalPkt * rssi_compensation_param->a_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d, totalPkt = %d\n", rssi,totalPkt));
+            rssi = rssi * rssi_compensation_param->bg_param_a + totalPkt * rssi_compensation_param->bg_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+A_INT16
+rssi_compensation_calc(AR_SOFTC_DEV_T *arPriv, A_INT16 rssi)
+{
+    USER_RSSI_CPENSATION *rssi_compensation_param;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    rssi_compensation_param = &ar->rssi_compensation_param;
+
+    if (arPriv->arBssChannel > 5000)
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d\n", rssi));
+            rssi = rssi * rssi_compensation_param->a_param_a + rssi_compensation_param->a_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before compensation  = %d\n", rssi));
+            rssi = rssi * rssi_compensation_param->bg_param_a + rssi_compensation_param->bg_param_b;
+            rssi = (rssi-50) /100;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+A_INT16
+rssi_compensation_reverse_calc(AR_SOFTC_DEV_T *arPriv, A_INT16 rssi, A_BOOL Above)
+{
+    A_INT16 i;
+
+    USER_RSSI_CPENSATION *rssi_compensation_param;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    rssi_compensation_param = &ar->rssi_compensation_param;
+
+    if (arPriv->arBssChannel > 5000)
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11a\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before rev compensation  = %d\n", rssi));
+            rssi = rssi * 100;
+            rssi = (rssi - rssi_compensation_param->a_param_b) / rssi_compensation_param->a_param_a;
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after rev compensation = %d\n", rssi));
+        }
+    }
+    else
+    {
+        if (rssi_compensation_param->enable)
+        {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, (">>> 11bg\n"));
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi before rev compensation  = %d\n", rssi));
+
+            if (Above) {
+                for (i=95; i>=0; i--) {
+                    if (rssi <= rssi_compensation_table[arPriv->arDeviceIndex][i]) {
+                        rssi = 0 - i;
+                        break;
+                    }
+                }
+            } else {
+                for (i=0; i<=95; i++) {
+                    if (rssi >= rssi_compensation_table[arPriv->arDeviceIndex][i]) {
+                        rssi = 0 - i;
+                        break;
+                    }
+                }
+            }
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("rssi after rev compensation = %d\n", rssi));
+        }
+    }
+
+    return rssi;
+}
+
+#ifdef WAPI_ENABLE
+void ap_wapi_rekey_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 type, A_UINT8 *mac)
+{
+    union iwreq_data wrqu;
+    A_CHAR buf[20];
+
+    A_MEMZERO(buf, sizeof(buf));
+
+    strcpy(buf, "WAPI_REKEY");
+    buf[10] = type;
+    A_MEMCPY(&buf[11], mac, ATH_MAC_LEN);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = 10+1+ATH_MAC_LEN;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WAPI REKEY - %d - %02x:%02x\n", type, mac[4], mac[5]));
+}
+#endif
+
+#ifdef P2P
+void *get_p2p_ctx(AR_SOFTC_DEV_T *arPriv)
+{
+    return (arPriv->p2p_ctx);
+}
+
+void *get_wmi_ctx(AR_SOFTC_DEV_T *arPriv)
+{
+    return (arPriv->arWmi);
+}
+
+NETWORK_SUBTYPE get_network_subtype(AR_SOFTC_DEV_T *arPriv)
+{
+    return (arPriv->arNetworkSubType);
+}
+
+#endif /* P2P */
+
+#ifdef USER_KEYS
+static A_STATUS
+
+ar6000_reinstall_keys(AR_SOFTC_DEV_T *arPriv, A_UINT8 key_op_ctrl)
+{
+    A_STATUS status = A_OK;
+    struct ieee80211req_key *uik = &arPriv->arSta.user_saved_keys.ucast_ik;
+    struct ieee80211req_key *bik = &arPriv->arSta.user_saved_keys.bcast_ik;
+    CRYPTO_TYPE keyType = arPriv->arSta.user_saved_keys.keyType;
+
+    if (IEEE80211_CIPHER_CCKM_KRK != uik->ik_type) {
+        if (NONE_CRYPT == keyType) {
+            goto _reinstall_keys_out;
+        }
+
+        if (uik->ik_keylen) {
+            status = wmi_addKey_cmd(arPriv->arWmi, uik->ik_keyix,
+                    keyType, PAIRWISE_USAGE,
+                    uik->ik_keylen, (A_UINT8 *)&uik->ik_keyrsc,
+                    uik->ik_keydata, key_op_ctrl, uik->ik_macaddr, SYNC_BEFORE_WMIFLAG);
+        }
+
+    } else {
+        status = wmi_add_krk_cmd(arPriv->arWmi, uik->ik_keydata);
+    }
+
+    if (IEEE80211_CIPHER_CCKM_KRK != bik->ik_type) {
+        if (NONE_CRYPT == keyType) {
+            goto _reinstall_keys_out;
+        }
+
+        if (bik->ik_keylen) {
+            status = wmi_addKey_cmd(arPriv->arWmi, bik->ik_keyix,
+                    keyType, GROUP_USAGE,
+                    bik->ik_keylen, (A_UINT8 *)&bik->ik_keyrsc,
+                    bik->ik_keydata, key_op_ctrl, bik->ik_macaddr, NO_SYNC_WMIFLAG);
+        }
+    } else {
+        status = wmi_add_krk_cmd(arPriv->arWmi, bik->ik_keydata);
+    }
+
+_reinstall_keys_out:
+    arPriv->arSta.user_savedkeys_stat = USER_SAVEDKEYS_STAT_INIT;
+    arPriv->arSta.user_key_ctrl = 0;
+
+    return status;
+}
+#endif /* USER_KEYS */
+
+
+void
+ar6000_dset_open_req(
+    void *context,
+    A_UINT32 id,
+    A_UINT32 targHandle,
+    A_UINT32 targReplyFn,
+    A_UINT32 targReplyArg)
+{
+}
+
+void
+ar6000_dset_close(
+    void *context,
+    A_UINT32 access_cookie)
+{
+    return;
+}
+
+void
+ar6000_dset_data_req(
+   void *context,
+   A_UINT32 accessCookie,
+   A_UINT32 offset,
+   A_UINT32 length,
+   A_UINT32 targBuf,
+   A_UINT32 targReplyFn,
+   A_UINT32 targReplyArg)
+{
+}
+void
+ar6000_init_mode_info(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    arPriv->arDot11AuthMode = OPEN_AUTH;
+    arPriv->arAuthMode = WMI_NONE_AUTH;
+    arPriv->arPairwiseCrypto = NONE_CRYPT;
+    arPriv->arPairwiseCryptoLen = 0;
+    arPriv->arGroupCrypto = NONE_CRYPT;
+    arPriv->arGroupCryptoLen = 0;
+    arPriv->arChannelHint = 0;
+    arPriv->arDefTxKeyIndex = 0;
+    A_MEMZERO(arPriv->arBssid, sizeof(arPriv->arBssid));
+    A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+    A_MEMZERO(arPriv->arWepKeyList, sizeof(arPriv->arWepKeyList));
+    arPriv->arSsidLen = 0;
+    arPriv->arTxPwr = 0;
+    arPriv->arTxPwrSet = FALSE;
+    arPriv->arBitRate = -1;
+    arPriv->arMaxRetries = 0;
+    arPriv->arWmmEnabled = TRUE;
+    arPriv->ap_profile_flag = 0;
+    arPriv->num_sta = 0xFF;
+    ar->gNumSta = AP_MAX_NUM_STA;
+
+    if(arPriv->arNextMode == AP_NETWORK) {
+        AR_SOFTC_AP_T *arAp;
+        if(arPriv->arNetworkType != AP_NETWORK) {
+            A_MEMZERO(&arPriv->arSta,sizeof(AR_SOFTC_STA_T));
+        }
+        arAp = &arPriv->arAp;
+        arAp->intra_bss = 1;
+        ar->inter_bss = 1;
+
+        /* init the Mutexes */
+        A_NETBUF_QUEUE_INIT(&arAp->mcastpsq);
+        A_MUTEX_INIT(&arAp->mcastpsqLock);
+        A_MEMCPY(arAp->ap_country_code, DEF_AP_COUNTRY_CODE, 3);
+        if (arPriv->arPhyCapability == WMI_11NAG_CAPABILITY){
+            arPriv->phymode = DEF_AP_WMODE_AG;
+        } else {
+            arPriv->phymode = DEF_AP_WMODE_G;
+        }
+        arAp->ap_dtim_period = DEF_AP_DTIM;
+        arAp->ap_beacon_interval = DEF_BEACON_INTERVAL;
+        A_INIT_TIMER(&ar->ap_reconnect_timer,ap_reconnect_timer_handler, ar);
+    } else {
+        /*Station Mode intialisation*/
+        AR_SOFTC_STA_T *arSta;
+        if(arPriv->arNetworkType == AP_NETWORK) {
+            A_MEMZERO(&arPriv->arAp,sizeof(AR_SOFTC_AP_T));
+        }
+        arSta = &arPriv->arSta;
+        arSta->arListenIntervalT = A_DEFAULT_LISTEN_INTERVAL;
+        arSta->arListenIntervalB = 0;
+        arSta->arBmissTimeT = A_DEFAULT_BMISS_TIME;
+        arSta->arBmissTimeB = 0;
+        arSta->arRssi = 0;
+        arSta->arSkipScan = 0;
+        arSta->arBeaconInterval = 0;
+        arSta->scan_triggered = 0;
+        arSta->arConnectPending = FALSE;
+        A_MEMZERO(&arSta->scParams, sizeof(arSta->scParams));
+        arSta->scParams.shortScanRatio = WMI_SHORTSCANRATIO_DEFAULT;
+        arSta->scParams.scanCtrlFlags = DEFAULT_SCAN_CTRL_FLAGS;
+        A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+        if (!arSta->disconnect_timer_inited) {
+            A_INIT_TIMER(&arSta->disconnect_timer, disconnect_timer_handler, arPriv->arNetDev);
+            arSta->disconnect_timer_inited = 1;
+        }
+        else
+        {
+            A_UNTIMEOUT(&arSta->disconnect_timer);
+        }
+    }
+}
+
+int
+ar6000_ap_set_num_sta(AR_SOFTC_T *ar, AR_SOFTC_DEV_T *arPriv, A_UINT8 num_sta)
+{
+    int ret = A_OK;
+    A_UINT8 i, total_num_sta;
+    AR_SOFTC_DEV_T *tpriv = NULL;
+
+    if(num_sta & 0x80) {
+        total_num_sta = (num_sta & (~0x80));
+        for(i=0; i<num_device; i++) {
+            tpriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+            tpriv->num_sta = 0xFF;
+        }
+    } else {
+        total_num_sta = num_sta;
+        arPriv->num_sta = num_sta;
+        ar->gNumSta = 0xFF;
+        for(i=0; i<num_device; i++) {
+            tpriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+            if((tpriv != arPriv) && (tpriv->num_sta !=0xFF) &&
+                (tpriv->arNetworkType == AP_NETWORK)) {
+                total_num_sta += tpriv->num_sta;
+            }
+        }
+    }
+
+    if(total_num_sta > AP_MAX_NUM_STA) {
+        ret = -EINVAL;
+    } else {
+        if(num_sta & 0x80) {
+            ar->gNumSta = (num_sta & (~0x80));
+        } else {
+            arPriv->num_sta = num_sta;
+        }
+        wmi_ap_set_num_sta(arPriv->arWmi, num_sta);
+    }
+
+    return ret;
+}
+
+int
+ar6000_ap_handle_lte_freq(AR_SOFTC_T *ar, AR_SOFTC_DEV_T *arPriv, A_UINT16 lteFreq)
+{
+    A_UINT8 i = 0, prev_acs = 0;
+    AR_SOFTC_DEV_T *arTempPriv = NULL;
+    
+    for(i = 0;i < ar->arConfNumDev;i++) {
+        arTempPriv = ar->arDev[i];
+        if ((arTempPriv->arNetworkType == INFRA_NETWORK)) {
+            A_PRINTF("WLAN: Ignore LTE freq in STA mode\n");
+            return 0;
+        }
+    }
+
+    A_PRINTF("WLAN: LTE_FREQ: %d\n", lteFreq);
+    ar->lteFreq = lteFreq;
+    prev_acs = ar->arAcsPolicy;
+
+    /*
+     * Current algorithm to convert LTE freq to WLAN freq
+     *
+     * if 2496 <= f <= 2690
+     *    bad_channel_set_to_be_avoided = [10, 11, 12, 13, 14]; 
+     * elseif 2300 <= f < 2350
+     *    bad_channel_set_to_be_avoided = [1, 2, 3, 4];
+     * elseif 2350 <= f < 2370
+     *     bad_channel_set_to_be_avoided = [1,2,3,4,5,6]; 
+     * elseif 2370 <= f <=2400
+     *     bad_channel_set_to_be_avoided = [1,2,3,4,5,6,7,8,9]; 
+     * else
+     *     bad_channel_set_to_be_avoided = []; end
+     */
+
+    /* Decide ACS policy based on LTE freq */
+    if(ar->lteFreq >= 2496 &&  ar->lteFreq <= 2690) {
+        ar->arAcsPolicy = AP_ACS_DISABLE_CH11;
+    } else if(ar->lteFreq >= 2300 &&  ar->lteFreq < 2350) {
+        ar->arAcsPolicy = AP_ACS_DISABLE_CH1;
+    } else if(ar->lteFreq >= 2350 &&  ar->lteFreq < 2370) {
+        ar->arAcsPolicy = AP_ACS_DISABLE_CH1_6;
+    } else if(ar->lteFreq >= 2370 &&  ar->lteFreq <= 2400) {
+        ar->arAcsPolicy = AP_ACS_DISABLE_CH1_6;
+    } else if (ar->lteFreq) {
+        A_PRINTF("WLAN: LTE_FREQ Out of range\n");
+        ar->lteFreq = 0;
+    } else {
+        ar->arAcsPolicy = 0;
+        A_PRINTF("WLAN: LTE_FREQ Disabled\n");
+    }
+
+    if (ar->arAcsPolicy && (ar->arAcsPolicy != prev_acs)) {
+        /* Stop all running APs and switch them to ACS */
+        for(i=0;i<ar->arConfNumDev;i++) {
+            arTempPriv = ar->arDev[i];
+            if(arTempPriv->arConnected) {
+                ar6000_disconnect(arTempPriv);
+                arTempPriv->arConnected = FALSE;
+                arTempPriv->arChannelHint = 0;
+                arTempPriv->ap_profile_flag = 1;
+                arTempPriv->arBssChannel = 0;
+                ar->arHoldConnection |= (1<<arTempPriv->arDeviceIndex);
+            }
+        }
+    }
+
+    return 0;
+}
+
+/* 
+ * Check hold status of other concurrent devices during
+ * connect or disconnect of every virtual device
+ */
+static int
+ar6000_check_hold_conn_status(AR_SOFTC_DEV_T *arPriv, A_UINT8 conn_status)
+{
+    AR_SOFTC_DEV_T *arTempPriv = NULL;
+    AR_SOFTC_T     *ar         = arPriv->arSoftc;
+    A_STATUS status = A_OK;
+
+    /* Concurrency: Process the pending connect of the other virtual device(s)  */
+    if (ar->arHoldConnection) {
+        A_UINT8 connect_flag = 0, cnt = 0;
+
+        for(cnt=0;cnt<ar->arConfNumDev;cnt++) {
+            arTempPriv = ar->arDev[cnt];
+            
+            //if(arTempPriv == arPriv) continue;
+
+            if(ar->arHoldConnection & (1<<arTempPriv->arDeviceIndex)) {
+                A_STATUS status = A_OK;
+
+                /* validate channel-hint vs home-channel */
+                status = ar6000_check_connect_request(ar->arDev[cnt], FALSE); 
+                if(A_OK == status) {
+                    connect_flag = TRUE;
+                    break;
+                } else if(A_ERROR == status) {
+                    ar->arHoldConnection &= ~(1<<ar->arDev[cnt]->arDeviceIndex);
+                }
+            }
+
+            if(conn_status) arTempPriv->arChannelHint = 0;
+
+        }
+
+        if(connect_flag) {
+            /* Profile commit happens at time-out */
+            A_TIMEOUT_MS(&ar->ap_reconnect_timer, 1*1000, 0);
+        }
+        status = A_OK;
+    } else {
+        status = A_ERROR;
+    }
+
+    return status;
+}
+
+/*
+ * (1) Check the status of other devices' connection
+ * (2) If there is atleast one device up already, validate the channelHint
+ * (3) If check_pending_status is set, check whether the current device conn
+ *     needs to be kept on hold. Otherwise, do only channel validation
+ * return : A_ERROR   - one of the above failed
+ *          A_OK      - success
+ *          A_PENDING - if called during connect, the connect is kep on hold
+ *                      (assumed as success)
+ */
+A_STATUS
+ar6000_check_connect_request(AR_SOFTC_DEV_T *arPriv, A_UINT8 check_pending_status)
+{
+    A_UINT8 i;
+    A_STATUS ret_val = A_OK;
+    AR_SOFTC_DEV_T *temp_priv = NULL;
+    AR_SOFTC_STA_T *arSta     = NULL;
+    AR_SOFTC_T     *ar        = arPriv->arSoftc;
+
+    for(i=0; i<num_device; i++) {
+        temp_priv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+        arSta     = &temp_priv->arSta;
+
+        if(arPriv == temp_priv) continue;
+
+        if(arPriv->arNetworkType == AP_NETWORK && temp_priv->arConnected) {
+            if(temp_priv->arNetworkType == AP_NETWORK) {
+                if(((temp_priv->phymode == WMI_11A_MODE) && (arPriv->phymode != WMI_11A_MODE) && (arPriv->phymode != WMI_11AG_MODE)) || 
+                    ((temp_priv->phymode != WMI_11A_MODE) && (arPriv->phymode == WMI_11A_MODE ))) {
+                    A_PRINTF("ar6000_check_connect_request: One or more concurrent devices"
+                                " conneted in different phy mode\n");
+                    ret_val = A_ERROR;
+                    break;
+                }
+            }
+        }
+
+        if( check_pending_status ) {
+            if( arPriv->arNextMode == AP_NETWORK )
+            {
+                /* If connecting device is AP and pending device is STA or AP, make
+                   the connecting device's state as HOLD */
+                if( ((temp_priv->arNextMode == AP_NETWORK)    &&
+                     (temp_priv->arConnected)                 &&
+                     (!temp_priv->arBssChannel))              ||
+                    ((temp_priv->arNextMode == INFRA_NETWORK) &&
+                     (arSta->arConnectPending == TRUE))) {
+                    ar->arHoldConnection       |= (1<<arPriv->arDeviceIndex);
+                    A_PRINTF("ar6000_check_connect_request: dev %d on hold\n", arPriv->arDeviceIndex);
+
+                    /* break & return sucess. Process it later */
+                    ret_val = A_PENDING;
+                    break;
+                }
+            } else if( arPriv->arNextMode == INFRA_NETWORK ) {
+                /* If the connecting device is STA and pending device is AP,
+                   disconnect the pending device and put it in HOLD. Process it's
+                   connect during STA connect */
+                if((temp_priv->arNextMode == AP_NETWORK) &&
+                   (temp_priv->arConnected)              &&
+                   (!temp_priv->arBssChannel)) {
+                    A_PRINTF("ar6000_check_connect_request : disconnecting AP dev %d",temp_priv->arDeviceIndex);
+                    ar6000_disconnect(temp_priv);
+                    temp_priv->ap_profile_flag = 1;
+                    if(!(ar->arHoldConnection & (1<<temp_priv->arDeviceIndex))) {
+                        ar->arHoldConnection |= (1<<temp_priv->arDeviceIndex);
+                    }
+                    continue;
+                } else if((temp_priv->arNextMode == INFRA_NETWORK) &&
+                          (arSta->arConnectPending == TRUE)) {
+                    /* STA-STA conc - not handled */
+                }
+            }
+        }
+
+        /* validate 'channel-hint v home-channel' */
+        if((temp_priv->arConnected) &&
+           (arPriv->arNextMode == AP_NETWORK)) {
+            A_UINT8    prev_phy_mode = arPriv->phymode;
+
+            if(arPriv->is_sta_roaming) {
+                arPriv->arChannelHint = 0;
+                arPriv->is_sta_roaming  = FALSE;
+            }
+            if (!(((arPriv->arChannelHint >= 5180) && (temp_priv->arBssChannel >= 5180)) ||
+                  ((arPriv->arChannelHint < 5180) && (temp_priv->arBssChannel < 5180))) ||
+                   (arPriv->arChannelHint == 0)) {
+                if(prev_phy_mode && (temp_priv->arNetworkType == AP_NETWORK) && 
+                    (arPriv->arNetworkType == AP_NETWORK)) {
+                    arPriv->phymode = prev_phy_mode;
+                } else if (arPriv->arPhyCapability == WMI_11NAG_CAPABILITY){
+                    arPriv->phymode = DEF_AP_WMODE_AG;
+                } else {
+                    arPriv->phymode = DEF_AP_WMODE_G;
+                }
+            }
+
+            /* Copy station's regDomain to softAP interface */
+
+             if (temp_priv->arRegCode != arPriv->arRegCode) {
+
+                 A_MEMCPY(arPriv->arAp.ap_country_code,
+                          (A_UINT8 *)&temp_priv->arRegCode, 2);
+                 arPriv->arAp.ap_country_code[2]=COUNTRY_CODE_PRESENT;
+
+                 wmi_set_country(arPriv->arWmi,
+                                 arPriv->arAp.ap_country_code);
+             }
+
+            /* User has set the channel for this interface */
+            if(arPriv->arChannelHint) {
+                if(temp_priv->arBssChannel != arPriv->arChannelHint) {
+                    A_PRINTF("ar6000_check_connect_request: Error: Channel should be %d"
+                                             "MHz. but it is %d\n", temp_priv->arBssChannel,
+                                             arPriv->arChannelHint);
+                    arPriv->arChannelHint = 0;
+                    /* channel mismatch is an error - say so */
+                    ret_val = A_ERROR;
+                    arPriv->phymode = prev_phy_mode;
+                    break;
+                }
+            } else {
+                /* ACS is enabled for this interface */
+                if(temp_priv->arBssChannel) {
+                    arPriv->arChannelHint = temp_priv->arBssChannel;
+                    A_PRINTF("ar6000_check_connect_request:Selected Channel %d of dev %d\n",
+                                                    temp_priv->arBssChannel,
+                                                    temp_priv->arDeviceIndex);
+                    /* go ahead with the connect on the other device's channel*/
+                    ret_val = A_OK;
+                    break;
+            }
+        }
+    }
+}
+
+    return ret_val;
+}
+
+int
+ar6000_ap_mode_profile_commit(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    WMI_CONNECT_CMD p;
+    unsigned long  flags;
+
+    if (ar->isHostAsleep != 0) {
+        A_PRINTF("Cannot commit while host is in sleep mode!!!\n");
+        return -EOPNOTSUPP;
+    }
+
+    /* No change in AP's profile configuration */
+    if(arPriv->ap_profile_flag==0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("COMMIT: No change in profile!!!\n"));
+        return -ENODATA;
+    }
+
+    if(!arPriv->arSsidLen) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("SSID not set!!!\n"));
+        return -ECHRNG;
+    }
+
+    if(arPriv->arAuthMode == WMI_NONE_AUTH) {
+        if((arPriv->arPairwiseCrypto != NONE_CRYPT) &&
+#ifdef WAPI_ENABLE
+            (arPriv->arPairwiseCrypto != WAPI_CRYPT) &&
+#endif
+            (arPriv->arPairwiseCrypto != WEP_CRYPT)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Cipher not supported in AP mode Open auth\n"));
+            return -EOPNOTSUPP;
+        }
+    } else if(!(arPriv->arAuthMode & 
+             (WMI_WPA_PSK_AUTH|WMI_WPA2_PSK_AUTH|WMI_WPA_AUTH|WMI_WPA2_AUTH))) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Key mgmt type not supported in AP mode\n"));
+        return -EOPNOTSUPP;
+    }
+
+    if ((arPriv->arAuthMode == WMI_NONE_AUTH) &&
+        (arPriv->arPairwiseCrypto == WEP_CRYPT))
+    {
+        ar6000_install_static_wep_keys(arPriv);
+    }
+
+    /* Update the arNetworkType */
+    arPriv->arNetworkType = arPriv->arNextMode;
+    arPriv->arBssChannel = 0;
+
+    A_MEMZERO(&p,sizeof(p));
+    p.ssidLength = arPriv->arSsidLen;
+    A_MEMCPY(p.ssid,arPriv->arSsid,p.ssidLength);
+
+    /*
+     * p.channel == 0 [Do ACS and choose 1, 6, or 11]
+     * p.channel == 1 [Do ACS and choose 1, or 6]
+     * p.channel == xxxx [No ACS, use xxxx freq]
+     */
+    if (((arPriv->phymode != WMI_11AG_MODE && arPriv->phymode != WMI_11A_MODE) && (IS_5G_CHANNEL(arPriv->arChannelHint))) ||
+        ((arPriv->phymode == WMI_11A_MODE) && !(IS_5G_CHANNEL(arPriv->arChannelHint)) && arPriv->arChannelHint)) {
+        A_PRINTF("ar6000_ap_mode_profile_commit: Channel hint not matching with phymode\n");
+        arPriv->arChannelHint = 0;
+        return -EINVAL;  
+    }
+
+    if ((arPriv->arChannelHint == 0) && (ar->arAcsPolicy)) {
+        p.channel = ar->arAcsPolicy;
+    } else {
+        p.channel = arPriv->arChannelHint;
+        if ((arPriv->arChannelHint >= 5180) && (arPriv->arChannelHint <= 5825)) {
+            if (!(wmi_set_channelParams_cmd(arPriv->arWmi, 0, WMI_11A_MODE, 0, NULL))) {
+                arPriv->phymode = WMI_11A_MODE;
+            }
+        } else if ((arPriv->phymode == WMI_11AG_MODE)) {
+            if (!(wmi_set_channelParams_cmd(arPriv->arWmi, 0, WMI_11G_MODE, 0, NULL))) {
+                arPriv->phymode = WMI_11G_MODE;
+            }
+        }
+    }
+
+    p.networkType = arPriv->arNetworkType;
+    p.dot11AuthMode = arPriv->arDot11AuthMode;
+    p.authMode = arPriv->arAuthMode;
+    p.pairwiseCryptoType = arPriv->arPairwiseCrypto;
+    p.pairwiseCryptoLen = arPriv->arPairwiseCryptoLen;
+    p.groupCryptoType = arPriv->arGroupCrypto;
+    p.groupCryptoLen = arPriv->arGroupCryptoLen;
+    p.ctrl_flags = arPriv->arSta.arConnectCtrlFlags;
+
+#if WLAN_CONFIG_NO_DISASSOC_UPON_DEAUTH
+    p.ctrl_flags |= AP_NO_DISASSOC_UPON_DEAUTH;
+#endif
+    wmi_ap_profile_commit(arPriv->arWmi, &p);
+    spin_lock_irqsave(&arPriv->arPrivLock, flags);
+    arPriv->arConnected = TRUE;
+    netif_carrier_on(arPriv->arNetDev);
+    spin_unlock_irqrestore(&arPriv->arPrivLock, flags);
+    arPriv->ap_profile_flag = 0;
+
+    return 0;
+}
+
+A_STATUS
+ar6000_connect_to_ap(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+
+    /* The ssid length check prevents second "essid off" from the user,
+       to be treated as a connect cmd. The second "essid off" is ignored.
+    */
+    if((ar->arWmiReady == TRUE) && (arPriv->arSsidLen > 0) && arPriv->arNetworkType!=AP_NETWORK)
+    {
+        A_STATUS status;
+        if((ADHOC_NETWORK != arPriv->arNetworkType) &&
+           (WMI_NONE_AUTH==arPriv->arAuthMode)          &&
+           (WEP_CRYPT==arPriv->arPairwiseCrypto)) {
+            ar6000_install_static_wep_keys(arPriv);
+        }
+
+        if (!arSta->arUserBssFilter) {
+            if (wmi_bssfilter_cmd(arPriv->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
+                return -EIO;
+            }
+        }
+
+        /* Check for APs pending to be connected */
+        if( A_ERROR == ar6000_check_connect_request(arPriv, TRUE)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("ar6000_connect_to_ap:unknown error, hold %x",ar->arHoldConnection));
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("Connect called with authmode %d dot11 auth %d"\
+                        " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                        " GRP crypto Len %d\n",
+                        arPriv->arAuthMode, arPriv->arDot11AuthMode,
+                        arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                        arPriv->arGroupCrypto, arPriv->arGroupCryptoLen));
+        reconnect_flag = 0;
+        /* Set the listen interval into 1000TUs or more. This value will be indicated to Ap in the conn.
+           later set it back locally at the STA to 100/1000 TUs depending on the power mode */
+        if ((arPriv->arNetworkType == INFRA_NETWORK)) {
+            wmi_listeninterval_cmd(arPriv->arWmi, max(arSta->arListenIntervalT, (A_UINT16)A_MAX_WOW_LISTEN_INTERVAL), 0);
+        }
+        status = wmi_connect_cmd(arPriv->arWmi, arPriv->arNetworkType,
+                                 arPriv->arDot11AuthMode, arPriv->arAuthMode,
+                                 arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                                 arPriv->arGroupCrypto,arPriv->arGroupCryptoLen,
+                                 arPriv->arSsidLen, arPriv->arSsid,
+                                 arSta->arReqBssid, arPriv->arChannelHint,
+                                 arSta->arConnectCtrlFlags);
+        if (status != A_OK) {
+            wmi_listeninterval_cmd(arPriv->arWmi, arSta->arListenIntervalT, arSta->arListenIntervalB);
+            if (!arSta->arUserBssFilter) {
+                wmi_bssfilter_cmd(arPriv->arWmi, NONE_BSS_FILTER, 0);
+            }
+            return status;
+        }
+
+        if ((!(arSta->arConnectCtrlFlags & CONNECT_DO_WPA_OFFLOAD)) &&
+            ((WMI_WPA_PSK_AUTH == arPriv->arAuthMode) || (WMI_WPA2_PSK_AUTH == arPriv->arAuthMode)))
+        {
+            A_TIMEOUT_MS(&arSta->disconnect_timer, A_DISCONNECT_TIMER_INTERVAL, 0);
+        }
+
+        arSta->arConnectCtrlFlags &= ~CONNECT_DO_WPA_OFFLOAD;
+
+        arSta->arConnectPending = TRUE;
+        return status;
+    }
+    return A_ERROR;
+}
+
+A_STATUS
+ar6000_disconnect(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    if ((arPriv->arConnected == TRUE) || (arPriv->arSta.arConnectPending == TRUE)) {
+        wmi_disconnect_cmd(arPriv->arWmi);
+#ifdef P2P
+        if(arPriv->arNetworkSubType == SUBTYPE_P2PCLIENT) {
+            wait_event_interruptible_timeout(arPriv->arEvent, arPriv->arConnected == FALSE, wmitimeout * HZ);
+
+            if (signal_pending(current)) {
+                return -EINTR;
+            }
+        }
+#endif
+        /*
+         * Disconnect cmd is issued, clear connectPending.
+         * arConnected will be cleard in disconnect_event notification.
+         */
+        arPriv->arSta.arConnectPending = FALSE;
+    }
+    ar->arHoldConnection &= ~(1 << arPriv->arDeviceIndex);
+
+    return A_OK;
+}
+
+A_STATUS
+ar6000_ap_mode_get_wpa_ie(AR_SOFTC_DEV_T *arPriv, struct ieee80211req_wpaie *wpaie)
+{
+    conn_t *conn = NULL;
+    conn = ieee80211_find_conn(arPriv, wpaie->wpa_macaddr);
+
+    A_MEMZERO(wpaie->wpa_ie, IEEE80211_MAX_IE);
+    A_MEMZERO(wpaie->rsn_ie, IEEE80211_MAX_IE);
+
+    if(conn) {
+        A_MEMCPY(wpaie->wpa_ie, conn->wpa_ie, IEEE80211_MAX_IE);
+    }
+
+    return 0;
+}
+
+A_STATUS
+is_iwioctl_allowed(A_UINT8 mode, A_UINT16 cmd)
+{
+    if(cmd >= SIOCSIWCOMMIT && cmd <= SIOCGIWPOWER) {
+        cmd -= SIOCSIWCOMMIT;
+        if(sioctl_filter[cmd] == 0xFF) return A_OK;
+        if(sioctl_filter[cmd] & mode) return A_OK;
+    } else if(cmd >= SIOCIWFIRSTPRIV && cmd <= (SIOCIWFIRSTPRIV+30)) {
+        cmd -= SIOCIWFIRSTPRIV;
+        if(pioctl_filter[cmd] == 0xFF) return A_OK;
+        if(pioctl_filter[cmd] & mode) return A_OK;
+    } else {
+        return A_ERROR;
+    }
+    return A_ENOTSUP;
+}
+
+A_STATUS
+is_xioctl_allowed(A_UINT8 mode, A_UINT8 submode, int cmd)
+{
+    A_UINT8 mode_bits, submode_bits;
+    A_BOOL is_valid_mode=FALSE, is_valid_submode=FALSE;
+
+    if(sizeof(xioctl_filter)-1 < cmd) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Filter for this cmd=%d not defined\n",cmd));
+        return A_OK;
+    }
+
+    /* Valid for all modes/submodes */
+    if(xioctl_filter[cmd] == 0xFF) return A_OK;
+
+    /* Check if this cmd is valid for the set mode of this device.
+    */
+#define XIOCTL_FILTER_MODE_MASK 0x1F
+#define XIOCTL_FILTER_MODE_BIT_OFFSET 0x0
+    mode_bits = xioctl_filter[cmd] & XIOCTL_FILTER_MODE_MASK;
+
+    if (mode_bits & (mode << XIOCTL_FILTER_MODE_BIT_OFFSET)) {
+        /* Valid cmd for this mode */
+        is_valid_mode = TRUE;
+    }
+
+    /* Check if this cmd is valid for the set submode of this device.
+     */
+#define XIOCTL_FILTER_SUBMODE_MASK 0xE0
+#define XIOCTL_FILTER_SUBMODE_BIT_OFFSET 0x0
+    submode_bits = (xioctl_filter[cmd] & XIOCTL_FILTER_SUBMODE_MASK)>>XIOCTL_FILTER_SUBMODE_BIT_OFFSET;
+
+    if (submode == SUBTYPE_P2PDEV || submode == SUBTYPE_P2PCLIENT ||
+            submode == SUBTYPE_P2PGO) {
+        /* P2P Submode */
+        if (submode_bits & XIOCTL_FILTER_P2P_SUBMODE) {
+            is_valid_submode = TRUE;
+        }
+    } else {
+        /* Non P2P Sub mode */
+        if ((submode_bits & XIOCTL_FILTER_NONP2P_SUBMODE)) {
+            is_valid_submode = TRUE;
+        }
+    }
+
+    if (is_valid_mode && is_valid_submode) {
+        return A_OK;
+    }
+
+    return A_ERROR;
+}
+
+#ifdef WAPI_ENABLE
+int
+ap_set_wapi_key(AR_SOFTC_DEV_T *arPriv, void *ikey)
+{
+    struct ieee80211req_key *ik = (struct ieee80211req_key *)ikey;
+    KEY_USAGE keyUsage = 0;
+    A_STATUS status;
+
+    if (A_MEMCMP(ik->ik_macaddr, bcast_mac, IEEE80211_ADDR_LEN) == 0) {
+        keyUsage = GROUP_USAGE;
+    } else {
+        keyUsage = PAIRWISE_USAGE;
+    }
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WAPI_KEY: Type:%d ix:%d mac:%02x:%02x len:%d\n",
+        keyUsage, ik->ik_keyix, ik->ik_macaddr[4], ik->ik_macaddr[5],
+        ik->ik_keylen));
+
+    status = wmi_addKey_cmd(arPriv->arWmi, ik->ik_keyix, WAPI_CRYPT, keyUsage,
+                            ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
+                            ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
+                            SYNC_BOTH_WMIFLAG);
+
+    if (A_OK != status) {
+        return -EIO;
+    }
+    return 0;
+}
+#endif
+
+#ifdef P2P
+
+void ar6000_p2p_prov_disc_req_event(AR_SOFTC_DEV_T *arPriv,
+        const A_UINT8 *peer, A_UINT16 wps_config_method,
+        const A_UINT8 *dev_addr, const A_UINT8 *pri_dev_type,
+        const A_UINT8 *dev_name, A_UINT8 dev_name_len,
+        A_UINT16 supp_config_methods, A_UINT8 dev_capab, A_UINT8 group_capab)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+    A_UINT8 *pos=buf;
+
+    A_MEMZERO(pos, sizeof(buf));
+    A_MEMCPY(pos, "P2PPROVDISCREQ", 14);
+    pos += 14;
+
+    A_MEMCPY(pos, peer, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    A_MEMCPY(pos, dev_addr, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    A_MEMCPY(pos, pri_dev_type, 8);
+    pos += 8;
+
+    A_MEMCPY(pos, dev_name, dev_name_len);
+    pos += dev_name_len;
+    *pos++ = '\0';
+
+    A_MEMCPY(pos, (A_UINT8 *)&supp_config_methods, 2);
+    pos += 2;
+
+    A_MEMCPY(pos, (A_UINT8 *)&wps_config_method, 2);
+    pos += 2;
+
+    A_MEMCPY(pos, &dev_capab, 1);
+    pos++;
+
+    A_MEMCPY(pos, &group_capab, 1);
+    pos++;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = (pos-buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void ar6000_p2p_prov_disc_resp_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *peer,
+         A_UINT16 config_methods)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+    A_UINT8 *pos=buf;
+
+    A_MEMZERO(pos, sizeof(buf));
+    A_MEMCPY(pos, "P2PPROVDISCRESP", 15);
+    pos += 15;
+
+    A_MEMCPY(pos, peer, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    A_MEMCPY(pos, (A_UINT8 *)&config_methods, 2);
+    pos += 2;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = (pos-buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void ar6000_p2pdev_event(AR_SOFTC_DEV_T *arPriv, const A_UINT8 *addr,
+    const A_UINT8 *dev_addr,
+    const A_UINT8 *pri_dev_type, const A_UINT8 *dev_name,
+    A_UINT8 dev_name_len, A_UINT16 config_methods, A_UINT8 dev_capab,
+    A_UINT8 grp_capab)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+    A_UINT8 *pos=buf;
+
+    A_MEMZERO(pos, sizeof(buf));
+    A_MEMCPY(pos, "P2PDEVFOUND", 11);
+    pos += 11;
+
+    A_MEMCPY(pos, addr, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    A_MEMCPY(pos, dev_addr, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    /* Size of P2P Attributes hardcoded here. Can this be changed ?
+     */
+    A_MEMCPY(pos, pri_dev_type, 8);
+    pos += 8;
+
+    A_MEMCPY(pos, dev_name, dev_name_len);
+    pos += dev_name_len;
+    *pos++ = '\0';
+
+    A_MEMCPY(pos, (A_UINT8 *)&config_methods, 2);
+    pos += 2;
+
+    A_MEMCPY(pos, &dev_capab, 1);
+    pos++;
+
+    A_MEMCPY(pos, &grp_capab, 1);
+    pos++;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = (pos-buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+
+    return;
+}
+
+void ar6000_p2pdev_lost_event(AR_SOFTC_DEV_T *arPriv, const A_UINT8 *dev_addr) {
+    union iwreq_data wrqu;
+    A_UINT8 buf[20];
+    A_UINT8 *pos=buf;
+
+    A_MEMZERO(pos, sizeof(buf));
+    A_MEMCPY(pos, "P2PDEVLOST", 10);
+    pos += 10;
+
+    A_MEMCPY(pos, dev_addr, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = (pos-buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void ar6000_p2p_sd_rx_event(AR_SOFTC_DEV_T *arPriv, WMI_P2P_SDPD_RX_EVENT *ev)
+{
+    union iwreq_data wrqu;
+    A_UINT8 *event_ptr;
+    A_UINT8 *pos;
+    A_UINT16 size;
+
+#define P2P_SD_REQ_RESP_STR_LEN 12
+    size = P2P_SD_REQ_RESP_STR_LEN
+           + sizeof(WMI_P2P_SDPD_RX_EVENT)
+           + ev->tlv_length;
+    event_ptr = A_MALLOC_NOWAIT(size);
+    pos = event_ptr;
+    A_MEMZERO(pos, size);
+    A_MEMCPY(pos, "P2PSDREQRESP", P2P_SD_REQ_RESP_STR_LEN);
+    pos += P2P_SD_REQ_RESP_STR_LEN;
+#undef P2P_SD_REQ_RESP_STR_LEN
+
+    /* Copy the event followed by TLV, parsing will be dobe in supplicant */
+    A_MEMCPY(pos, ev, sizeof(WMI_P2P_SDPD_RX_EVENT) + ev->tlv_length);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = size;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, event_ptr);
+
+    A_FREE(event_ptr);
+    return;
+}
+
+void p2p_go_neg_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *res, A_UINT8 len)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+
+    A_MEMZERO(&buf, sizeof(buf));
+    A_MEMCPY(buf, "P2PNEGCOMPLETE",14);
+    A_MEMCPY(&buf[14], res, len);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = 14+len;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void p2p_go_neg_req_event(AR_SOFTC_DEV_T *arPriv, const A_UINT8 *sa, A_UINT16 dev_passwd_id)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+    A_UINT8 *pos=buf;
+
+    A_MEMZERO(pos, sizeof(buf));
+    A_MEMCPY(pos, "P2PNEGREQEV", 11);
+    pos += 11;
+
+    A_MEMCPY(pos, sa, IEEE80211_ADDR_LEN);
+    pos += IEEE80211_ADDR_LEN;
+
+    A_MEMCPY(pos, (A_UINT8 *)&dev_passwd_id, 2);
+    pos += 2;
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = (pos-buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+
+void p2p_invite_sent_result_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 *res,
+        A_UINT8 len)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+
+    A_MEMZERO(&buf, sizeof(buf));
+    A_MEMCPY(buf, "P2PINVITESENTRESULT", 19);
+    A_MEMCPY(&buf[19], res, len);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = 19 + len;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+void p2p_invite_rcvd_result_event(AR_SOFTC_DEV_T *arPriv,
+            A_UINT8 *res, A_UINT8 len)
+{
+    union iwreq_data wrqu;
+    A_UINT8 buf[100];
+
+    A_MEMZERO(&buf, sizeof(buf));
+    A_MEMCPY(buf, "P2PINVITERCVDRESULT", 19);
+    A_MEMCPY(&buf[19], res, len);
+
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = 19 + len;
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+#endif /* P2P */
+
+void ar6000_peer_event(
+    void *context,
+    A_UINT8 eventCode,
+    A_UINT8 *macAddr)
+{
+    A_UINT8 pos;
+
+    for (pos=0;pos<6;pos++)
+        printk("%02x: ",*(macAddr+pos));
+    printk("\n");
+}
+
+void ar6000_get_device_addr(AR_SOFTC_DEV_T *arPriv, A_UINT8 *addr)
+{
+    A_MEMCPY(addr, arPriv->arNetDev->dev_addr, IEEE80211_ADDR_LEN);
+    return;
+}
+
+#ifdef HTC_TEST_SEND_PKTS
+#define HTC_TEST_DUPLICATE 8
+static void DoHTCSendPktsTest(AR_SOFTC_T *ar, int MapNo, HTC_ENDPOINT_ID eid, struct sk_buff *dupskb)
+{
+    struct ar_cookie *cookie;
+    struct ar_cookie *cookieArray[HTC_TEST_DUPLICATE];
+    struct sk_buff *new_skb;
+    int i;
+    int pkts = 0;
+    HTC_PACKET_QUEUE pktQueue;
+    EPPING_HEADER *eppingHdr;
+
+    eppingHdr = A_NETBUF_DATA(dupskb);
+
+    if (eppingHdr->Cmd_h == EPPING_CMD_NO_ECHO) {
+        /* skip test if this is already a tx perf test */
+        return;
+    }
+
+    for (i = 0; i < HTC_TEST_DUPLICATE; i++,pkts++) {
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        cookie = ar6000_alloc_cookie(ar);
+        if (cookie != NULL) {
+            ar->arTxPending[eid]++;
+            ar->arTotalTxDataPending++;
+        }
+
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+
+        if (NULL == cookie) {
+            break;
+        }
+
+        new_skb = A_NETBUF_ALLOC(A_NETBUF_LEN(dupskb));
+
+        if (new_skb == NULL) {
+            AR6000_SPIN_LOCK(&ar->arLock, 0);
+            ar6000_free_cookie(ar,cookie);
+            AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            break;
+        }
+
+        A_NETBUF_PUT_DATA(new_skb, A_NETBUF_DATA(dupskb), A_NETBUF_LEN(dupskb));
+        cookie->arc_bp[0] = (A_UINT32)new_skb;
+        cookie->arc_bp[1] = MapNo;
+        SET_HTC_PACKET_INFO_TX(&cookie->HtcPkt,
+                               cookie,
+                               A_NETBUF_DATA(new_skb),
+                               A_NETBUF_LEN(new_skb),
+                               eid,
+                               AR6K_DATA_PKT_TAG);
+
+        cookieArray[i] = cookie;
+
+        {
+            EPPING_HEADER *pHdr = (EPPING_HEADER *)A_NETBUF_DATA(new_skb);
+            pHdr->Cmd_h = EPPING_CMD_NO_ECHO;  /* do not echo the packet */
+        }
+    }
+
+    if (pkts == 0) {
+        return;
+    }
+
+    INIT_HTC_PACKET_QUEUE(&pktQueue);
+
+    for (i = 0; i < pkts; i++) {
+        HTC_PACKET_ENQUEUE(&pktQueue,&cookieArray[i]->HtcPkt);
+    }
+
+    HTCSendPktsMultiple(ar->arHtcTarget, &pktQueue);
+
+}
+
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+EXPORT_SYMBOL(setupbtdev);
+#endif
+
+NETWORK_TYPE ar6000_get_network_type(AR_SOFTC_DEV_T *arPriv)
+{
+    return (arPriv->arNetworkType);
+}
+
diff --git a/host/os/linux/ar6000_pm.c b/host/os/linux/ar6000_pm.c
new file mode 100644
index 0000000..6a3d73e
--- /dev/null
+++ b/host/os/linux/ar6000_pm.c
@@ -0,0 +1,1359 @@
+//
+//
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+//
+//
+//
+
+/*
+ * Implementation of system power management 
+ */
+
+#include "ar6000_drv.h"
+#include <linux/inetdevice.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15)
+#include <linux/platform_device.h>
+#endif
+#include "wlan_config.h"
+
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+
+#ifdef CONFIG_PLAT_AMBARELLA
+#include <mach/board.h>
+#include <plat/sd.h>
+#endif
+
+#define WOW_ENABLE_MAX_INTERVAL 1
+#define WOW_SET_SCAN_PARAMS     1
+
+extern unsigned int wmitimeout;
+extern unsigned int num_device;
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+extern unsigned int first_scan_2g_only;
+#endif
+extern unsigned int psm_info;
+#ifdef CONFIG_PM
+struct platform_device *g_pdev = NULL;
+
+#if PLAT_WOW_GPIO_PIN || PLAT_WLAN_CHIP_PWD_PIN
+#include <linux/gpio.h>
+#endif
+
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM9615)
+#include <linux/gpio.h>
+#include <linux/regulator/consumer.h>
+#endif
+
+#if PLAT_WOW_GPIO_PIN
+static int wow_irq;
+#endif /* PLAT_WOW_GPIO_PIN */
+
+#ifdef CONFIG_HAS_WAKELOCK
+struct wake_lock ar6k_suspend_wake_lock;
+struct wake_lock ar6k_wow_wake_lock;
+#endif
+#endif /* CONFIG_PM */
+
+#ifdef ANDROID_ENV
+extern void android_ar6k_check_wow_status(AR_SOFTC_T *ar, struct sk_buff *skb, A_BOOL isEvent);
+#endif 
+#undef ATH_MODULE_NAME
+#define ATH_MODULE_NAME pm
+#define  ATH_DEBUG_PM       ATH_DEBUG_MAKE_MODULE_MASK(0)
+
+#ifdef DEBUG
+static ATH_DEBUG_MASK_DESCRIPTION pm_debug_desc[] = {
+    { ATH_DEBUG_PM     , "System power management"},
+};
+
+ATH_DEBUG_INSTANTIATE_MODULE_VAR(pm,
+                                 "pm",
+                                 "System Power Management",
+                                 ATH_DEBUG_MASK_DEFAULTS | ATH_DEBUG_PM,
+                                 ATH_DEBUG_DESCRIPTION_COUNT(pm_debug_desc),
+                                 pm_debug_desc);
+
+#endif /* DEBUG */
+
+A_STATUS ar6000_exit_cut_power_state(AR_SOFTC_T *ar);
+
+#ifdef CONFIG_PM
+static void ar6k_send_asleep_event_to_app(AR_SOFTC_DEV_T *arPriv, A_BOOL asleep)
+{
+    char buf[128];
+    union iwreq_data wrqu;
+
+    snprintf(buf, sizeof(buf), "HOST_ASLEEP=%s", asleep ? "asleep" : "awake");
+    A_MEMZERO(&wrqu, sizeof(wrqu));
+    wrqu.data.length = strlen(buf);
+    wireless_send_event(arPriv->arNetDev, IWEVCUSTOM, &wrqu, buf);
+}
+
+static void ar6000_set_host_sleep_mode_callback(void *ptr)
+{
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)ptr;
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: set host sleep mode cmd processed event arrived", __func__));
+    ar->sleep_mode_cmd_completed = TRUE;
+    wake_up(&(ar->sleep_mode_cmd_completed_event));
+}
+
+static void ar6000_wow_resume(AR_SOFTC_T *ar)
+{
+    HIF_DEVICE_POWER_CHANGE_TYPE  config;
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_STA_T *arSta;
+    A_UINT8  i;
+
+    if (ar->arWowState!= WLAN_WOW_STATE_NONE) {
+        config = HIF_DEVICE_POWER_UP;
+        HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+    }
+
+    for(i = 0; i < num_device; i++) {
+        arPriv = ar->arDev[i];
+        arSta  = &arPriv->arSta;
+
+        /*
+         * Free all wlan_nodes (scanned APs that we detected previously)
+         * because during the time we were suspended, the device may have
+         * been moved to a new location and these APs scanned for before
+         * suspend may not be valid
+         */
+        wmi_free_allnodes(arPriv->arWmi);
+
+        if (ar->arWowState!= WLAN_WOW_STATE_NONE) {
+            A_UINT16 fg_start_period = (arSta->scParams.fg_start_period==0) ? 1 : arSta->scParams.fg_start_period;
+            A_UINT16 bg_period = (arSta->scParams.bg_period==0) ? 60 : arSta->scParams.bg_period;
+            WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode = {TRUE, FALSE};
+            ar->arWowState = WLAN_WOW_STATE_NONE;
+#ifdef CONFIG_HAS_WAKELOCK
+            wake_lock_timeout(&ar6k_wow_wake_lock, 5);
+#endif
+            /*
+             * Clear the callback function.  We do not need to wait while resuming.
+             */
+            wmi_set_host_sleep_mode_event_fn_ptr(arPriv->arWmi, NULL, NULL);
+            if (wmi_set_host_sleep_mode_cmd(arPriv->arWmi, &hostSleepMode)!=A_OK) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup restore host awake\n"));
+            }
+
+            if (arPriv->arNetworkType!=AP_NETWORK) {
+#if WOW_SET_SCAN_PARAMS
+                wmi_scanparams_cmd(arPriv->arWmi, fg_start_period,
+                                       arSta->scParams.fg_end_period,
+                                       bg_period,
+                                       arSta->scParams.minact_chdwell_time,
+                                       arSta->scParams.maxact_chdwell_time,
+                                       arSta->scParams.pas_chdwell_time,
+                                       arSta->scParams.shortScanRatio,
+                                       arSta->scParams.scanCtrlFlags,
+                                       arSta->scParams.max_dfsch_act_time,
+                                       arSta->scParams.maxact_scan_per_ssid);
+#else
+               (void)fg_start_period;
+               (void)bg_period;
+#endif 
+    
+    
+#if WOW_ENABLE_MAX_INTERVAL /* we don't do it if the power consumption is already good enough. */
+                if (wmi_listeninterval_cmd(arPriv->arWmi, arSta->arListenIntervalT, arSta->arListenIntervalB) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to restore WoW listen interval %d\n", arSta->arListenIntervalT));
+                } else {
+                    if (wmi_bmisstime_cmd(arPriv->arWmi, arSta->arBmissTimeT, arSta->arBmissTimeB) != A_OK) {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to restore WoW bmiss %d\n", arSta->arBmissTimeT));
+                    }
+                    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WoW does not invoked. skip resume"));
+                }
+#endif
+            }
+            ar6k_send_asleep_event_to_app(arPriv, FALSE);
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Resume WoW successfully\n"));
+	    ar->isHostAsleep = 0;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WoW does not invoked. skip resume"));
+        }
+    }
+
+    ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+}
+
+static void ar6000_wow_suspend(AR_SOFTC_T *ar)
+{
+    struct net_device *ndev;
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_STA_T *arSta;
+    A_INT32 i, j;
+    A_STATUS status;
+    A_UINT32 timeremaining;
+#define WOW_LIST_ID 1
+    /* Setup WoW for unicast & Arp request for our own IP
+     * disable background scan. Set listen interval into 1000 TUs
+     * Enable keepliave for 110 seconds
+     */
+    struct in_ifaddr **ifap = NULL;
+    struct in_ifaddr *ifa = NULL;
+    HIF_DEVICE_POWER_CHANGE_TYPE  config;
+    struct in_device *in_dev;
+    WMI_ADD_WOW_PATTERN_CMD addWowCmd = { .filter = { 0 } };
+    WMI_DEL_WOW_PATTERN_CMD delWowCmd;
+    WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode = {FALSE, TRUE};
+    WMI_SET_WOW_MODE_CMD wowMode = {    .enable_wow = TRUE,
+                                        .hostReqDelay = 500 };/*500 ms delay*/
+
+    if (ar->arWowState!= WLAN_WOW_STATE_NONE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("System already go into wow mode!\n"));
+        return;
+    }
+
+    ar6000_TxDataCleanup(ar); /* IMPORTANT, otherwise there will be 11mA after listen interval as 1000*/
+
+    for(j = 0; j< num_device; j++) 
+    {
+        arPriv = ar->arDev[j];
+        arSta = &arPriv->arSta;
+        ndev = arPriv->arNetDev;
+        /* clear up our WoW pattern first */
+        for (i=0; i<WOW_MAX_FILTERS_PER_LIST; ++i) {
+            delWowCmd.filter_list_id = WOW_LIST_ID;
+            delWowCmd.filter_id = i;
+            wmi_del_wow_pattern_cmd(arPriv->arWmi, &delWowCmd);
+        }
+
+        if (arPriv->arNetworkType == AP_NETWORK) {
+        /* setup all unicast IP packet pattern for WoW */
+#if WLAN_CONFIG_SIMPLE_WOW_AP_MODE
+        /* IP packets except boradcast */
+        A_UINT8 allData[] = { 0x08 }; /* Either IP 0x0800, ARP 0x0806 or EAPOL-like 0x8800 */
+        A_UINT8 allMask[] = { 0x7f };
+        A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+        addWowCmd.filter_list_id = WOW_LIST_ID;
+        addWowCmd.filter_size = sizeof(allMask); 
+        addWowCmd.filter_offset = 20;
+        status = wmi_add_wow_pattern_cmd(ar->arWmi, &addWowCmd, allData, allMask, addWowCmd.filter_size);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW simple pattern for AP mode\n"));
+        }
+#else
+        /* Unicast IP, EAPOL-like and ARP packets */
+        A_UINT8 unicastData[] = { 
+            0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 
+            0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x08, };
+        A_UINT8 unicastMask[] = { 
+            0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 
+            0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f };
+        A_UINT8 discoverData[] = { 0xe0, 0x00, 0x00, 0xf8 }; 
+        A_UINT8 discoverMask[] = { 0xf0, 0x00, 0x00, 0xf8 };  
+        A_UINT8 arpData[] = { 0x08, 0x06 };
+        A_UINT8 arpMask[] = { 0xff, 0xff };
+        A_UINT8 dhcpData[] = { 
+            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 
+            0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x08, 0x00, 
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+            0x00, 0x00, 0x00, 0x43 /* port 67 */
+        };
+        A_UINT8 dhcpMask[] = {
+            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 
+            0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff, 
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+            0x00, 0x00, 0xff, 0xff /* port 67 */
+        };
+        A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+        addWowCmd.filter_list_id = WOW_LIST_ID;
+        addWowCmd.filter_size = sizeof(unicastMask); 
+        addWowCmd.filter_offset = 0;
+        status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, unicastData, unicastMask, addWowCmd.filter_size);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW unicast IP pattern for AP mode\n"));
+        }
+        /* setup all ARP packet pattern for WoW */
+        A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+        addWowCmd.filter_list_id = WOW_LIST_ID;
+        addWowCmd.filter_size = sizeof(arpMask); 
+        addWowCmd.filter_offset = 20;
+        status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, arpData, arpMask, addWowCmd.filter_size);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW ARP pattern for AP mode\n"));
+        }
+        /* Setup multicast pattern for mDNS 224.0.0.251, SSDP 239.255.255.250 and LLMNR  224.0.0.252*/
+        A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+        addWowCmd.filter_list_id = WOW_LIST_ID;
+        addWowCmd.filter_size = sizeof(discoverMask); 
+        addWowCmd.filter_offset = 38;
+        status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, discoverData, discoverMask, addWowCmd.filter_size);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add mDNS/SSDP/LLMNR pattern for AP mode WoW\n"));
+        }
+        /* setup all DHCP broadcast packet pattern for WoW */
+        A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+        addWowCmd.filter_list_id = WOW_LIST_ID;
+        addWowCmd.filter_size = sizeof(dhcpMask); 
+        addWowCmd.filter_offset = 0;
+        status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, dhcpData, dhcpMask, addWowCmd.filter_size);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW DHCP broadcast pattern for AP mode\n"));
+        }
+#endif /* WLAN_CONFIG_SIMPLE_WOW_AP_MODE */
+    } else { 
+        /* station mode */
+        A_UINT8 macMask[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+        A_UINT16 wow_listen_interval = A_MAX_WOW_LISTEN_INTERVAL;
+#if WOW_ENABLE_MAX_INTERVAL /* we don't do it if the power consumption is already good enough. */
+        if (wmi_listeninterval_cmd(arPriv->arWmi, wow_listen_interval, 0) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WoW listen interval %d\n", wow_listen_interval));
+        } else {
+            /* 
+             * The default bmiss is 1500ms when listen interval is 100ms 
+             * We set listen interval x 15 times as bmiss time here
+             */
+            A_UINT16 bmissTime = wow_listen_interval*15;
+            if (bmissTime > MAX_BMISS_TIME) {
+                bmissTime = MAX_BMISS_TIME;
+            }
+            if (wmi_bmisstime_cmd(arPriv->arWmi, bmissTime, 0) != A_OK) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WoW bmiss %d\n", bmissTime));
+            }
+        }
+#else
+        (void)wow_listen_interval;
+#endif
+
+#if WOW_SET_SCAN_PARAMS
+        status = wmi_scanparams_cmd(arPriv->arWmi, 0xFFFF, 0, 0xFFFF, 0, 0, 0, 0, 0, 0, 0);
+#endif
+        /* setup unicast packet pattern for WoW */
+        if (ndev->dev_addr[1]) {
+            A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+            addWowCmd.filter_list_id = WOW_LIST_ID;
+            addWowCmd.filter_size = 6; /* MAC address */
+            addWowCmd.filter_offset = 0;
+            status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, ndev->dev_addr, macMask, addWowCmd.filter_size);
+            if (status != A_OK) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add WoW pattern\n"));
+            }
+        }
+
+        /* Setup multicast pattern for mDNS 224.0.0.251, SSDP 239.255.255.250 and LLMNR  224.0.0.252*/
+        if ( ndev->flags & IFF_ALLMULTI || 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+                 (ndev->flags & IFF_MULTICAST && ndev->mc_count>0) )
+#else
+                 (ndev->flags & IFF_MULTICAST && netdev_mc_count(ndev)>0) )
+#endif
+        {
+            A_UINT8 discoverData[] = { 0xe0, 0x00, 0x00, 0xf8 }; 
+            A_UINT8 discoverMask[] = { 0xf0, 0x00, 0x00, 0xf8 };  
+            A_MEMZERO(&addWowCmd, sizeof(addWowCmd));
+            addWowCmd.filter_list_id = WOW_LIST_ID;
+            addWowCmd.filter_size = sizeof(discoverMask); 
+            addWowCmd.filter_offset = 38;
+            status = wmi_add_wow_pattern_cmd(arPriv->arWmi, &addWowCmd, discoverData, discoverMask, addWowCmd.filter_size);
+            if (status != A_OK) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to add mDNS/SSDP/LLMNR pattern for WoW\n"));
+            }
+        }
+
+        ar6k_send_asleep_event_to_app(arPriv, TRUE);
+    }
+
+    ar->arWowState = WLAN_WOW_STATE_SUSPENDING;
+
+    /* setup ARP request for our own IP */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15)
+    if ((in_dev = __in_dev_get_rtnl(ndev)) != NULL) {
+        for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL; ifap = &ifa->ifa_next) {
+            if (!strcmp(ndev->name, ifa->ifa_label)) {
+                break; /* found */
+            }
+        }
+    }
+#endif
+
+    if (ifa && ifa->ifa_local) {
+        WMI_SET_IP_CMD ipCmd;
+        memset(&ipCmd, 0, sizeof(ipCmd));
+        ipCmd.ips[0] = ifa->ifa_local;
+        status = wmi_set_ip_cmd(arPriv->arWmi, &ipCmd);
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup IP for ARP agent\n"));
+        }
+    }
+
+#ifndef ATH6K_CONFIG_OTA_MODE
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6K: %s: psm.info is %d (0: MAX_PERF_POWER, 1:REC_POWER)\n", __FUNCTION__, psm_info));
+    wmi_powermode_cmd_w_psminfo(arPriv->arWmi, psm_info, REC_POWER);
+#endif
+
+    status = wmi_set_wow_mode_cmd(arPriv->arWmi, &wowMode);
+    if (status != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to enable wow mode\n"));
+    }
+    /*
+     * Set the callback function for processing of the last WMI command before suspending,
+     * so that we can wait for the HTC credit report to come in before proceeding.
+     */
+    ar->sleep_mode_cmd_completed = FALSE;
+    wmi_set_host_sleep_mode_event_fn_ptr(arPriv->arWmi, ar6000_set_host_sleep_mode_callback, ar);
+    status = wmi_set_host_sleep_mode_cmd(arPriv->arWmi, &hostSleepMode);
+    if (status != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to set host asleep\n"));
+    }
+
+    /*
+     * Wait for the WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID to come in.  This is
+     * guaranteed to happen either AFTER the credit report for the
+     * WMI_SET_HOST_SLEEP_MODE_CMD arrives, or simultaneously along with the event.
+     * This should never take longer than a few ms, so if 2 seconds have elapsed and
+     * we still do not get the event, there's a problem with the WLAN chip.  Just continue,
+     * (the user will have to unload the driver manually).  It's better than taking down
+     * the entire OS.
+     */
+    timeremaining = wait_event_interruptible_timeout(ar->sleep_mode_cmd_completed_event, (ar->sleep_mode_cmd_completed == TRUE), 2*HZ);
+    if (!timeremaining) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Expected a WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED event but it never arrived\n"));
+    }
+
+    if (ar->arTxPending[ar->arControlEp]) {
+        A_UINT32 timeleft = wait_event_interruptible_timeout(arPriv->arEvent,
+        ar->arTxPending[ar->arControlEp] == 0, wmitimeout * HZ);
+        if (!timeleft || signal_pending(current)) {
+           /* what can I do? wow resume at once */
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WoW. Pending wmi control data %d\n", ar->arTxPending[ar->arControlEp]));
+        }
+    }
+    }
+
+    status = hifWaitForPendingRecv(ar->arHifDevice);
+
+    config = HIF_DEVICE_POWER_DOWN;
+    status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+    ar->arWowState = WLAN_WOW_STATE_SUSPENDED;
+    ar->arWlanPowerState = WLAN_POWER_STATE_WOW;
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Setup WoW successfully\n"));
+}
+
+A_STATUS ar6000_suspend_ev(void *context)
+{
+    A_STATUS status = A_OK;
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)context;
+    A_INT16 pmmode = ar->arSuspendConfig;
+    A_INT32 i;
+    A_BOOL needWow = FALSE;
+wow_not_connected:
+    switch (pmmode) {
+    case WLAN_SUSPEND_WOW:
+        for(i = 0; i< num_device; i++)  {
+            if (ar->arDev[i]->arConnected) {
+                needWow = TRUE;
+                break;
+            }
+        }
+        if (ar->arWmiReady && ar->arWlanState==WLAN_ENABLED && needWow) {
+            ar6000_wow_suspend(ar);
+            status = A_EBUSY;
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Suspend for wow mode %d\n", __func__, ar->arWlanPowerState));
+        } else {
+            pmmode = ar->arWow2Config;
+            goto wow_not_connected;
+        }
+        break;
+    case WLAN_SUSPEND_CUT_PWR:
+        /* fall through */
+    case WLAN_SUSPEND_CUT_PWR_IF_BT_OFF:
+        /* fall through */
+    case WLAN_SUSPEND_DEEP_SLEEP:
+        /* fall through */
+    default:
+        status = ar6000_update_wlan_pwr_state(ar, WLAN_DISABLED, TRUE);        
+        if (ar->arWlanPowerState==WLAN_POWER_STATE_ON || 
+            ar->arWlanPowerState==WLAN_POWER_STATE_WOW) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Strange suspend state for not wow mode %d", ar->arWlanPowerState));
+        }
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Suspend for %d mode pwr %d status %d\n", __func__, pmmode, ar->arWlanPowerState, status));
+        if (ar->arWlanPowerState==WLAN_POWER_STATE_CUT_PWR) {
+            status = A_OK; 
+        } else {
+            status = A_EBUSY; /* don't let mmc call sdio_init after resume */
+        } 
+        break;
+    }
+
+    for(i = 0; i < num_device; i++) {
+        AR_SOFTC_DEV_T *arPriv = ar->arDev[i];
+        AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+        if (arSta->scan_triggered) {
+            ar6000_scanComplete_event(arPriv, A_OK);
+        }
+    }
+    return status;
+}
+
+A_STATUS ar6000_resume_ev(void *context)
+{
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)context;
+    A_UINT16 powerState = ar->arWlanPowerState;
+
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock(&ar6k_suspend_wake_lock);
+#endif
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: enter previous state %d wowState %d\n", __func__, powerState, ar->arWowState));
+    switch (powerState) {
+    case WLAN_POWER_STATE_WOW:
+        ar6000_wow_resume(ar);
+        break;
+    case WLAN_POWER_STATE_CUT_PWR:
+        /* fall through */
+    case WLAN_POWER_STATE_DEEP_SLEEP:
+        ar6000_update_wlan_pwr_state(ar, WLAN_ENABLED, TRUE);
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM,("%s:Resume for %d mode pwr %d\n", __func__, powerState, ar->arWlanPowerState));
+        break;
+    case WLAN_POWER_STATE_ON:
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange SDIO bus power mode!!\n"));
+        break;
+    }
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_unlock(&ar6k_suspend_wake_lock);
+#endif
+    return A_OK;
+}
+
+void ar6000_check_wow_status(AR_SOFTC_T *ar, struct sk_buff *skb, A_BOOL isEvent)
+{
+    /* EV85521 */
+    if (in_interrupt()) {
+        if (ar->arWowState == WLAN_WOW_STATE_SUSPENDED) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("AR6K: %s called in interrupt context\n", __func__));
+        }
+        return;
+    }
+    
+    if (ar->arWowState != WLAN_WOW_STATE_NONE) {
+        if (ar->arWowState==WLAN_WOW_STATE_SUSPENDING) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM,("\n%s: Received IRQ while we are wow suspending!!!\n\n", __func__));
+            return;
+        }
+        /* Wow resume from irq interrupt */
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: WoW resume from irq thread status %d\n", __func__, ar->arWlanPowerState));
+        ar6000_wow_resume(ar);
+    } else {
+#ifdef ANDROID_ENV
+        android_ar6k_check_wow_status(ar, skb, isEvent);
+#endif 
+    }
+}
+
+A_STATUS ar6000_power_change_ev(void *context, A_UINT32 config)
+{
+    AR_SOFTC_T *ar = (AR_SOFTC_T *)context;
+    A_STATUS status = A_OK;
+  
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: power change event callback %d \n", __func__, config));
+    switch (config) {
+       case HIF_DEVICE_POWER_UP:
+            ar6000_restart_endpoint(ar);
+#ifdef ANDROID_ENV
+            ar->arResumeDone = TRUE;
+            wake_up(&(ar->arDev[0]->arEvent));
+#endif /* ANDROID_ENV */
+            status = A_OK;
+            break;
+       case HIF_DEVICE_POWER_DOWN:
+       case HIF_DEVICE_POWER_CUT:
+            status = A_OK;
+            break;
+    }
+    return status;
+}
+
+#if PLAT_WOW_GPIO_PIN
+static irqreturn_t
+ar6000_wow_irq(int irq, void *dev_id)
+{
+    gpio_clear_detect_status(wow_irq);
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock_timeout(&ar6k_wow_wake_lock, 3*HZ);
+#else
+    /* TODO: What should I do if there is no wake lock?? */
+#endif
+    return IRQ_HANDLED;
+}
+#endif /* PLAT_WOW_GPIO_PIN */
+
+#if PLAT_WLAN_CHIP_PWD_PIN
+void plat_setup_power_stub(AR_SOFTC_T *ar, int on, int detect) 
+{
+    A_BOOL chip_pwd_low_val;
+
+    if (on) {
+        chip_pwd_low_val = 1; 
+    } else {
+        chip_pwd_low_val = 0;
+    }
+    ambarella_set_gpio_output(&ambarella_board_generic.wifi_power, chip_pwd_low_val);
+
+}
+#endif /* PLAT_WLAN_CHIP_PWD_PIN */
+
+#if defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM9615)
+
+struct wlan_regulator {
+    const char *vreg_name; /* Regulator Name */
+    int min_uV; /* Minimum voltage at which AR6003 can operate */
+    int max_uV; /* Maximum voltage at which AR6003 can operate */
+    int load_uA; /* Current which will be drawn from regulator (Worst case) */
+    int delay_mT; /* Time from this operation to next */
+    struct regulator *vreg; /* Regulator Handle */
+};
+
+
+static struct wlan_regulator regulator_table[] = {
+    {"wlan_vreg", 1710000, 1890000, 86000, 5, NULL}
+};
+
+static void msm9615_wifi_power_down(struct wlan_regulator *regulators, A_UINT32 size)
+{
+    int rc = 0;
+    int i;
+
+    if (!regulators) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("msm9615_wifi_power_down: NULL pointer passed!!!\n"));
+        return;
+    }
+
+    for (i = size - 1; i >= 0; i--) {
+
+        if (!regulators[i].vreg) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("msm9615_wifi_power_down: vreg is NULL!!!\n"));
+            continue;
+        }
+
+        rc = regulator_disable(regulators[i].vreg);
+
+        if (rc) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to disable regulator: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+        }
+
+        rc = regulator_set_voltage(regulators[i].vreg, 0, regulators[i].max_uV);
+
+        if (rc) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to set regulator voltage: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+        }
+
+        rc = regulator_set_optimum_mode(regulators[i].vreg, 0);
+
+        if (rc < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to set regulator optimum mode: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+        }
+
+        regulator_put(regulators[i].vreg);
+        regulators[i].vreg = NULL;
+    }
+}
+
+static int msm9615_wifi_power_up(struct wlan_regulator *regulators, A_UINT32 size)
+{
+    int rc = 0;
+    int i = 0;
+
+    if (!g_pdev) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("msm9615_wifi_power_up: Platform device is NULL!!!\n"));
+        rc = -ENODEV;
+        goto fail;
+    }
+
+    if (!regulators) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("msm9615_wifi_power_up: NULL pointer passed!!!"));
+        rc = -EINVAL;
+        goto fail;
+    }
+
+    for (i = 0; i < size; i++) {
+
+        regulators[i].vreg = regulator_get(&g_pdev->dev, regulators[i].vreg_name);
+
+        if (!regulators[i].vreg || IS_ERR(regulators[i].vreg)) {
+            rc = PTR_ERR(regulators[i].vreg);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to get regulator: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+            regulators[i].vreg = NULL;
+            goto fail;
+        }
+
+        rc = regulator_set_voltage(regulators[i].vreg, regulators[i].min_uV, regulators[i].max_uV);
+
+        if (rc) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to set regulator voltage: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+            goto fail;
+        }
+
+        rc = regulator_set_optimum_mode(regulators[i].vreg, regulators[i].load_uA);
+
+        if (rc < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to set regulator optimum mode: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+            goto fail;
+        }
+
+        rc = regulator_enable(regulators[i].vreg);
+        if (rc) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Failed to enable regulator: %s, rc: %d\n",
+                        regulators[i].vreg_name, rc));
+            goto fail;
+        }
+
+        A_MDELAY(regulators[i].delay_mT);
+    }
+
+    return rc;
+
+fail:
+    msm9615_wifi_power_down(regulators, i + 1);
+    return rc;
+}
+
+static struct gpio wifi_gpios[] = {
+    { MSM9615_WLAN_PM_ENABLE_PIN, GPIOF_OUT_INIT_LOW, "wlan_pm_enable" },
+    { MSM9615_WLAN_CHIP_PWD_PIN, GPIOF_OUT_INIT_LOW, "wlan_chip_pwd_l" },
+};
+
+int msm9615_wifi_power(AR_SOFTC_T *ar, int on)
+{
+    int rc = 0;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("msm9615_wifi_power: %s\n", on ? "on" : "off"));
+
+    do {
+        if (on) {
+            rc = msm9615_wifi_power_up(regulator_table, ARRAY_SIZE(regulator_table));
+
+            if (rc) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("msm9615_wifi_power: Power UP failed!!!\n"));
+                break;
+            }
+
+            rc = gpio_request_array(wifi_gpios, ARRAY_SIZE(wifi_gpios));
+
+            if (rc) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Cannot request GPIO!!!"));
+
+                msm9615_wifi_power_down(regulator_table, ARRAY_SIZE(regulator_table));
+                break;
+            }
+
+            gpio_set_value(MSM9615_WLAN_PM_ENABLE_PIN, 1);
+            A_MDELAY(100);
+            gpio_set_value(MSM9615_WLAN_CHIP_PWD_PIN, 1);
+        } else {
+
+            gpio_set_value(MSM9615_WLAN_CHIP_PWD_PIN, 0);
+            gpio_set_value(MSM9615_WLAN_PM_ENABLE_PIN, 0);
+
+            gpio_free_array(wifi_gpios, ARRAY_SIZE(wifi_gpios));
+
+            msm9615_wifi_power_down(regulator_table, ARRAY_SIZE(regulator_table));
+        }
+
+    } while (0);
+
+    return rc;
+}
+#endif /* defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM9615) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15)
+static int ar6000_pm_probe(struct platform_device *pdev)
+{
+
+    g_pdev = pdev;
+
+    plat_setup_power(NULL, 1, 1);
+    return 0;
+}
+
+static int ar6000_pm_remove(struct platform_device *pdev)
+{
+    plat_setup_power(NULL, 0, 1);
+    return 0;
+}
+
+static int ar6000_pm_suspend(struct platform_device *pdev, pm_message_t state)
+{
+    return 0;
+}
+
+static int ar6000_pm_resume(struct platform_device *pdev)
+{
+    int i;
+    extern struct net_device *ar6000_devices[MAX_AR6000];
+	
+    for (i=0; ar6000_devices[i]; ++i) {
+        AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ar6000_devices[i]);
+        AR_SOFTC_T *ar = (AR_SOFTC_T *)arPriv->arSoftc;
+
+        if (ar && ar->arPlatPowerOff) {
+            A_BOOL wlanOff = ar->arWlanOff;
+            A_UINT16 powerState = ar->arWlanPowerState;
+            A_BOOL btOff = ar->arBTOff;
+
+            if (!wlanOff) {
+               if (powerState == WLAN_POWER_STATE_CUT_PWR) {
+                   plat_setup_power(ar, 1, 0);
+                   ar->arPlatPowerOff = FALSE;
+               }
+            }
+#ifdef CONFIG_PM
+           else if (wlanOff) {
+               A_BOOL allowCutPwr = ((!ar->arBTSharing) || btOff);
+               if ((powerState==WLAN_POWER_STATE_CUT_PWR) && (!allowCutPwr)) {
+                  plat_setup_power(ar, 1, 0);
+                   ar->arPlatPowerOff = FALSE;       
+               }
+           }
+#endif /* CONFIG_PM */
+        }
+    }
+    return 0;
+}
+
+static struct platform_driver ar6000_pm_device = {
+    .probe      = ar6000_pm_probe,
+    .remove     = ar6000_pm_remove,
+    .suspend    = ar6000_pm_suspend,
+    .resume     = ar6000_pm_resume,
+    .driver     = {
+        .name = "wlan_ar6000_pm_dev",
+    },
+};
+#endif 
+#endif /* CONFIG_PM */
+
+A_STATUS 
+ar6000_setup_cut_power_state(struct ar6_softc *ar,  AR6000_WLAN_STATE state)
+{
+    A_STATUS                      status = A_OK;
+    HIF_DEVICE_POWER_CHANGE_TYPE  config;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: Cut power %d %d \n", __func__,state, ar->arWlanPowerState));
+#ifdef CONFIG_PM
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Wlan OFF %d BT OFf %d \n", ar->arWlanOff, ar->arBTOff));
+#endif
+    do {
+        if (state == WLAN_ENABLED) {
+            /* Not in cut power state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_CUT_PWR) {
+                break;
+            }
+
+            if (ar->arPlatPowerOff) {
+                plat_setup_power(ar, 1, 0);
+                ar->arPlatPowerOff = FALSE;
+            }
+
+            /* Change the state to ON */
+            ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+
+#ifdef ANDROID_ENV
+            ar->arResumeDone = FALSE;
+#endif /* ANDROID_ENV */
+    
+            /* Indicate POWER_UP to HIF */
+            config = HIF_DEVICE_POWER_UP; 
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+            if (status == A_PENDING) {
+#ifdef ANDROID_ENV
+                 /* Wait for resume done event */
+                A_UINT32 timeleft = wait_event_interruptible_timeout(ar->arDev[0]->arEvent,
+                            (ar->arResumeDone == TRUE), wmitimeout * HZ);
+                if (!timeleft || signal_pending(current)) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000 : Failed to get resume done event \n"));
+                    status = A_ERROR;
+                    break;
+                }
+#endif
+                status = A_OK;
+            } else if (status == A_OK) {
+                ar6000_restart_endpoint(ar);
+#ifdef ANDROID_ENV
+                ar->arResumeDone = TRUE;
+#endif /* ANDROID_ENV */
+                status = A_OK;
+            }
+        } else if (state == WLAN_DISABLED) {
+
+
+            /* Already in cut power state.. exit */
+            if (ar->arWlanPowerState == WLAN_POWER_STATE_CUT_PWR) {
+                break;
+            }
+            ar6000_stop_endpoint(ar, TRUE, FALSE);
+
+            config = HIF_DEVICE_POWER_CUT; 
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+            plat_setup_power(ar, 0, 0);
+            ar->arPlatPowerOff = TRUE;
+
+            ar->arWlanPowerState = WLAN_POWER_STATE_CUT_PWR;
+        }
+    } while (0);
+
+    return status;
+}
+
+A_STATUS 
+ar6000_setup_deep_sleep_state(struct ar6_softc *ar, AR6000_WLAN_STATE state)
+{
+    A_STATUS status = A_OK;
+
+    HIF_DEVICE_POWER_CHANGE_TYPE  config;
+    AR_SOFTC_DEV_T *arPriv;
+    AR_SOFTC_STA_T *arSta;
+    A_UINT8 i;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("%s: Deep sleep %d %d \n", __func__,state, ar->arWlanPowerState));
+#ifdef CONFIG_PM
+    AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Wlan OFF %d BT OFf %d \n", ar->arWlanOff, ar->arBTOff));
+#endif
+    do {
+        WMI_SET_HOST_SLEEP_MODE_CMD hostSleepMode;
+
+        if (state == WLAN_ENABLED) {
+            A_UINT16 fg_start_period;
+
+            /* Not in deep sleep state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_DEEP_SLEEP) {
+                if (ar->arWlanPowerState != WLAN_POWER_STATE_ON) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange state when we resume from deep sleep %d\n", ar->arWlanPowerState));
+                }                
+                break;
+            }
+
+            /* Indicate POWER_UP to HIF */
+            config = HIF_DEVICE_POWER_UP;
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+            
+            for(i = 0; i < num_device; i++)
+            {
+                arPriv = ar->arDev[i];
+                arSta  = &arPriv->arSta;
+
+                /*
+                 * Free all wlan_nodes (scanned APs that we detected previously)
+                 * because during the time we were suspended, the device may have
+                 * been moved to a new location and these APs scanned for before
+                 * suspend may not be valid
+                 */
+                wmi_free_allnodes(arPriv->arWmi);
+
+                fg_start_period = (arSta->scParams.fg_start_period==0) ? 1 : arSta->scParams.fg_start_period;
+                hostSleepMode.awake = TRUE;
+                hostSleepMode.asleep = FALSE;
+
+                /*
+                 * Clear the callback function.  We do not need to wait while resuming.
+                 */
+                wmi_set_host_sleep_mode_event_fn_ptr(arPriv->arWmi, NULL, NULL);
+                if ((status=wmi_set_host_sleep_mode_cmd(arPriv->arWmi, &hostSleepMode)) != A_OK) {
+                    break;    
+                }
+
+                /* Change the state to ON */
+                ar->arWlanPowerState = WLAN_POWER_STATE_ON;
+
+                /* Enable foreground scanning */
+                if ((status=wmi_scanparams_cmd(arPriv->arWmi, fg_start_period,
+                                        arSta->scParams.fg_end_period,
+                                        arSta->scParams.bg_period,
+                                        arSta->scParams.minact_chdwell_time,
+                                        arSta->scParams.maxact_chdwell_time,
+                                        arSta->scParams.pas_chdwell_time,
+                                        arSta->scParams.shortScanRatio,
+                                        arSta->scParams.scanCtrlFlags,
+                                        arSta->scParams.max_dfsch_act_time,
+                                        arSta->scParams.maxact_scan_per_ssid)) != A_OK) 
+                {
+                    break;
+                }
+
+                if (arPriv->arSsidLen) {
+                    if (ar6000_connect_to_ap(arPriv) != A_OK) {
+                    /* no need to report error if connection failed */
+                        break;
+                    }
+                }
+            }
+        } else if (state == WLAN_DISABLED){
+#ifdef CONFIG_PM
+            A_UINT32 timeremaining;
+#endif
+            WMI_SET_WOW_MODE_CMD wowMode = { .enable_wow = FALSE };
+
+            /* Already in deep sleep state.. exit */
+            if (ar->arWlanPowerState != WLAN_POWER_STATE_ON) {
+                if (ar->arWlanPowerState != WLAN_POWER_STATE_DEEP_SLEEP) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Strange state when we suspend for deep sleep %d\n", ar->arWlanPowerState));
+                }    
+                break;
+            }
+
+            for(i = 0; i < num_device; i++)
+            {
+                arPriv = ar->arDev[i];
+                arSta  = &arPriv->arSta;
+                /* make sure we disable wow for deep sleep */
+                if ((status=wmi_set_wow_mode_cmd(arPriv->arWmi, &wowMode))!=A_OK) {
+                    break;
+                }
+
+                /* Disconnect from the AP and disable foreground scanning */
+                AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                if (arPriv->arConnected == TRUE || arSta->arConnectPending == TRUE) {
+                    AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+                    ar6000_disconnect(arPriv);
+                } else {
+                    AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+                }
+
+                if ((status=wmi_scanparams_cmd(arPriv->arWmi, 0xFFFF, 0, 0, 0, 0, 0, 0, 0, 0, 0)) != A_OK) {
+                    break;
+                }
+                ar6000_TxDataCleanup(ar);
+#ifndef ATH6K_CONFIG_OTA_MODE
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6K: %s: psm.info is %d (0: MAX_PERF_POWER, 1:REC_POWER)\n", __FUNCTION__, psm_info));
+                wmi_powermode_cmd_w_psminfo(arPriv->arWmi, psm_info, REC_POWER);
+#endif
+
+                hostSleepMode.awake = FALSE;
+                hostSleepMode.asleep = TRUE;
+
+#ifdef CONFIG_PM
+                /*
+                 * Set the callback function for processing of the last WMI command before suspending,
+                 * so that we can wait for the HTC credit report to come in before proceeding.
+                 */
+                ar->sleep_mode_cmd_completed = FALSE;
+                wmi_set_host_sleep_mode_event_fn_ptr(arPriv->arWmi, ar6000_set_host_sleep_mode_callback, ar);
+                if ((status=wmi_set_host_sleep_mode_cmd(arPriv->arWmi, &hostSleepMode))!=A_OK) {
+                    break;
+                }
+
+                /*
+                 * Wait for the WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID to come in.  This is
+                 * guaranteed to happen either AFTER the credit report for the
+                 * WMI_SET_HOST_SLEEP_MODE_CMD arrives, or simultaneously along with the event.
+                 * This should never take longer than a few ms, so if 2 seconds have elapsed and
+                 * we still do not get the event, there's a problem with the WLAN chip.  Just continue,
+                 * (the user will have to unload the driver manually).  It's better than taking down
+                 * the entire OS.
+                 */
+                timeremaining = wait_event_interruptible_timeout(ar->sleep_mode_cmd_completed_event, (ar->sleep_mode_cmd_completed == TRUE), 2*HZ);
+                if (!timeremaining) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Expected a WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED event but it never arrived\n"));
+                }
+
+                if (ar->arTxPending[ar->arControlEp]) {
+                   A_UINT32 timeleft = wait_event_interruptible_timeout(arPriv->arEvent,
+                                    ar->arTxPending[ar->arControlEp] == 0, wmitimeout * HZ);
+                   if (!timeleft || signal_pending(current)) {
+                        status = A_ERROR;
+                        break;
+                   }
+                }
+#endif
+            }   
+            status = hifWaitForPendingRecv(ar->arHifDevice);
+
+            config = HIF_DEVICE_POWER_DOWN;
+            status = HIFConfigureDevice(ar->arHifDevice,
+                                HIF_DEVICE_POWER_STATE_CHANGE,
+                                &config,
+                                sizeof(HIF_DEVICE_POWER_CHANGE_TYPE));
+
+            ar->arWlanPowerState = WLAN_POWER_STATE_DEEP_SLEEP;
+        }
+    } while (0);
+
+    if (status!=A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to enter/exit deep sleep %d\n", state));
+    }   
+    
+    return status;
+}
+
+A_STATUS 
+ar6000_update_wlan_pwr_state(struct ar6_softc *ar, AR6000_WLAN_STATE state, A_BOOL pmEvent)
+{
+    A_STATUS status = A_OK;
+    A_UINT16 powerState, oldPowerState;
+    AR6000_WLAN_STATE oldstate = ar->arWlanState;
+    A_BOOL wlanOff = ar->arWlanOff;
+#ifdef CONFIG_PM
+    A_BOOL btOff = ar->arBTOff;
+#endif /* CONFIG_PM */
+    A_UINT8 i;
+    AR_SOFTC_DEV_T *arPriv;
+
+    if ((state!=WLAN_DISABLED && state!=WLAN_ENABLED)) {
+        return A_ERROR;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return A_EBUSY;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return A_ERROR;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        up(&ar->arSem); 
+        return A_EBUSY;
+    }
+
+    ar->arWlanState = wlanOff ? WLAN_DISABLED : state;
+    oldPowerState = ar->arWlanPowerState;
+    if (state == WLAN_ENABLED) {
+        powerState = ar->arWlanPowerState;
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WLAN PWR set to ENABLE^^\n"));
+        if (!wlanOff) {
+            if (powerState == WLAN_POWER_STATE_DEEP_SLEEP) {
+                status = ar6000_setup_deep_sleep_state(ar, WLAN_ENABLED);
+            } else if (powerState == WLAN_POWER_STATE_CUT_PWR) {
+                status = ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+            }
+        } 
+#ifdef CONFIG_PM
+        else if (pmEvent && wlanOff) {
+            A_BOOL allowCutPwr = ((!ar->arBTSharing) || btOff);
+            if ((powerState==WLAN_POWER_STATE_CUT_PWR) && (!allowCutPwr)) {
+                /* Come out of cut power */
+                ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+                status = ar6000_setup_deep_sleep_state(ar, WLAN_DISABLED);
+            }
+        }
+#endif /* CONFIG_PM */
+    } else if (state == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("WLAN PWR set to DISABLED~\n"));
+        powerState = WLAN_POWER_STATE_DEEP_SLEEP;
+#ifdef CONFIG_PM
+        if (pmEvent) {  /* disable due to suspend */
+            A_BOOL suspendCutPwr = (ar->arSuspendConfig == WLAN_SUSPEND_CUT_PWR ||
+                                    (ar->arSuspendConfig == WLAN_SUSPEND_WOW && 
+                                        ar->arWow2Config==WLAN_SUSPEND_CUT_PWR));
+            A_BOOL suspendCutIfBtOff = ((ar->arSuspendConfig == 
+                                            WLAN_SUSPEND_CUT_PWR_IF_BT_OFF ||
+                                        (ar->arSuspendConfig == WLAN_SUSPEND_WOW && 
+                                         ar->arWow2Config==WLAN_SUSPEND_CUT_PWR_IF_BT_OFF)) &&
+                                        (!ar->arBTSharing || btOff));
+            if ((suspendCutPwr) ||
+                (suspendCutIfBtOff) ||
+                (ar->arWlanPowerState==WLAN_POWER_STATE_CUT_PWR))
+            {
+                if (!wlanOff || ar->arWlanPowerState!=WLAN_POWER_STATE_DEEP_SLEEP) {
+                    powerState = WLAN_POWER_STATE_CUT_PWR;
+                }
+            }
+        } else {
+            if ((wlanOff) && 
+                (ar->arWlanOffConfig == WLAN_OFF_CUT_PWR) &&
+                (!ar->arBTSharing || btOff)) 
+            {
+                /* For BT clock sharing designs, CUT_POWER depend on BT state */  
+                powerState = WLAN_POWER_STATE_CUT_PWR;
+            }
+        }
+#endif /* CONFIG_PM */
+
+        if (powerState == WLAN_POWER_STATE_DEEP_SLEEP) {
+            if (ar->arWlanPowerState == WLAN_POWER_STATE_CUT_PWR) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("Load firmware before set to deep sleep\n"));
+                ar6000_setup_cut_power_state(ar, WLAN_ENABLED);
+            }
+            status = ar6000_setup_deep_sleep_state(ar, WLAN_DISABLED);
+        } else if (powerState == WLAN_POWER_STATE_CUT_PWR) {
+            status = ar6000_setup_cut_power_state(ar, WLAN_DISABLED);
+        }
+
+    }
+
+    if (status!=A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Fail to setup WLAN state %d\n", ar->arWlanState));
+        ar->arWlanState = oldstate;
+    } else if (status == A_OK) {
+        WMI_REPORT_SLEEP_STATE_EVENT  wmiSleepEvent, *pSleepEvent = NULL;
+        if ((ar->arWlanPowerState == WLAN_POWER_STATE_ON) && (oldPowerState != WLAN_POWER_STATE_ON)) {
+            wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_AWAKE;
+            pSleepEvent = &wmiSleepEvent;
+        } else if ((ar->arWlanPowerState != WLAN_POWER_STATE_ON) && (oldPowerState == WLAN_POWER_STATE_ON)) {
+            wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP;
+            pSleepEvent = &wmiSleepEvent;
+        }
+        if (pSleepEvent) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("SENT WLAN Sleep Event %d\n", wmiSleepEvent.sleepState));
+            for(i = 0; i < num_device; i++)
+            {
+                arPriv = ar->arDev[i];
+                ar6000_send_event_to_app(arPriv, WMI_REPORT_SLEEP_STATE_EVENTID, (A_UINT8*)pSleepEvent, 
+                                         sizeof(WMI_REPORT_SLEEP_STATE_EVENTID));
+            }
+        }
+    }
+    up(&ar->arSem);
+    return status;
+}
+
+A_STATUS 
+ar6000_set_bt_hw_state(struct ar6_softc *ar, A_UINT32 enable)
+{
+#ifdef CONFIG_PM
+    A_BOOL off = (enable == 0);
+    A_STATUS status;
+    if (ar->arBTOff == off) {
+        return A_OK;
+    }
+    ar->arBTOff = off;
+    status = ar6000_update_wlan_pwr_state(ar, ar->arWlanOff ? WLAN_DISABLED : WLAN_ENABLED, FALSE);
+    return status;
+#else
+    return A_OK;
+#endif 
+}
+
+A_STATUS 
+ar6000_set_wlan_state(struct ar6_softc *ar, AR6000_WLAN_STATE state)
+{
+    A_INT32 i;
+    A_STATUS status;
+    A_BOOL off = (state == WLAN_DISABLED);
+    return A_OK;
+
+    if (ar->arWlanOff == off) {
+        return A_OK;
+    }
+
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+    if(!off) {
+        first_scan_2g_only = 1;
+        AR_DEBUG_PRINTF(ATH_DEBUG_PM, ("AR6K: first_scan_2g_only = 1\n"));
+    }
+#endif
+
+    ar->arWlanOff = off;
+    status = ar6000_update_wlan_pwr_state(ar, state, FALSE);
+    for(i = 0; i < num_device; i++) {
+        AR_SOFTC_DEV_T *arPriv = ar->arDev[i];
+        AR_SOFTC_STA_T *arSta = &arPriv->arSta;
+        if (arSta->scan_triggered) {
+            ar6000_scanComplete_event(arPriv, A_OK);
+        }
+    }
+    return status;
+}
+
+void ar6000_pm_init()
+{
+    A_REGISTER_MODULE_DEBUG_INFO(pm);
+#ifdef CONFIG_PM
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock_init(&ar6k_suspend_wake_lock, WAKE_LOCK_SUSPEND, "ar6k_suspend");
+    wake_lock_init(&ar6k_wow_wake_lock, WAKE_LOCK_SUSPEND, "ar6k_wow");
+#endif
+    /* 
+     * Register ar6000_pm_device into system.
+     * We should also add platform_device into the first item of array
+     * of devices[] in file arch/xxx/mach-xxx/board-xxxx.c
+     */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15)
+    if (platform_driver_register(&ar6000_pm_device)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ar6000: fail to register the power control driver.\n"));
+    }
+#endif
+
+#if PLAT_WOW_GPIO_PIN
+    wow_irq = gpio_to_irq(PLAT_WOW_GPIO_PIN);
+    if (wow_irq) {
+        int ret;
+        ret = request_irq(wow_irq, ar6000_wow_irq,
+                        IRQF_SHARED | IRQF_TRIGGER_RISING,
+                        "ar6000" "sdiowakeup", &wow_irq);
+        if (!ret) {
+            ret = enable_irq_wake(wow_irq);
+            if (ret < 0) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Couldn't enable WoW IRQ as wakeup interrupt"));
+            }
+        }
+    }
+#endif /* PLAT_WOW_GPIO_PIN */
+#endif /* CONFIG_PM */
+}
+
+void ar6000_pm_exit()
+{
+#ifdef CONFIG_PM
+#if PLAT_WOW_GPIO_PIN
+    if (wow_irq) {
+        if (disable_irq_wake(wow_irq)) {
+             AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Couldn't disable hostwake IRQ wakeup mode\n"));
+        }
+        free_irq(wow_irq, &wow_irq);
+        wow_irq = 0;
+    }
+#endif /* PLAT_WOW_GPIO_PIN */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,15)
+    platform_driver_unregister(&ar6000_pm_device);
+#endif
+#ifdef CONFIG_HAS_WAKELOCK
+    wake_lock_destroy(&ar6k_suspend_wake_lock);
+    wake_lock_destroy(&ar6k_wow_wake_lock);
+#endif
+#endif /* CONFIG_PM */
+}
+
diff --git a/host/os/linux/ar6000_raw_if.c b/host/os/linux/ar6000_raw_if.c
new file mode 100644
index 0000000..39e5823
--- /dev/null
+++ b/host/os/linux/ar6000_raw_if.c
@@ -0,0 +1,465 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include "ar6000_drv.h"
+
+#ifdef HTC_RAW_INTERFACE
+
+static void
+ar6000_htc_raw_read_cb(void *Context, HTC_PACKET *pPacket)
+{
+    AR_SOFTC_T        *ar = (AR_SOFTC_T *)Context;
+    raw_htc_buffer    *busy;
+    HTC_RAW_STREAM_ID streamID; 
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    busy = (raw_htc_buffer *)pPacket->pPktContext;
+    A_ASSERT(busy != NULL);
+
+    if (pPacket->Status == A_ECANCELED) {
+        /*
+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
+         * (probably due to a shutdown)
+         */
+        return;
+    }
+
+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+    if(streamID == HTC_RAW_STREAM_NOT_MAPPED) {
+        return; /* in case panic_on_assert==0 */
+    }
+    
+#ifdef CF
+   if (down_trylock(&arRaw->raw_htc_read_sem[streamID])) {
+#else
+    if (down_interruptible(&arRaw->raw_htc_read_sem[streamID])) {
+#endif /* CF */
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to down the semaphore\n"));
+    }
+
+    A_ASSERT((pPacket->Status != A_OK) || 
+             (pPacket->pBuffer == (busy->data + HTC_HEADER_LEN)));
+
+    busy->length = pPacket->ActualLength + HTC_HEADER_LEN;
+    busy->currPtr = HTC_HEADER_LEN;
+    arRaw->read_buffer_available[streamID] = TRUE;
+    //AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("raw read cb:  0x%X 0x%X \n", busy->currPtr,busy->length);
+    up(&arRaw->raw_htc_read_sem[streamID]);
+
+    /* Signal the waiting process */
+    AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Waking up the StreamID(%d) read process\n", streamID));
+    wake_up_interruptible(&arRaw->raw_htc_read_queue[streamID]);
+}
+
+static void
+ar6000_htc_raw_write_cb(void *Context, HTC_PACKET *pPacket)
+{
+    AR_SOFTC_T          *ar = (AR_SOFTC_T  *)Context;
+    raw_htc_buffer      *free;
+    HTC_RAW_STREAM_ID   streamID;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    
+    free = (raw_htc_buffer *)pPacket->pPktContext;
+    A_ASSERT(free != NULL);
+
+    if (pPacket->Status == A_ECANCELED) {
+        /*
+         * HTC provides A_ECANCELED status when it doesn't want to be refilled
+         * (probably due to a shutdown)
+         */
+        return;
+    }
+
+    streamID = arEndpoint2RawStreamID(ar,pPacket->Endpoint);
+    A_ASSERT(streamID != HTC_RAW_STREAM_NOT_MAPPED);
+    if(streamID == HTC_RAW_STREAM_NOT_MAPPED) {
+        return; /* in case panic_on_assert==0 */
+    }
+#ifdef CF
+    if (down_trylock(&arRaw->raw_htc_write_sem[streamID])) {
+#else
+    if (down_interruptible(&arRaw->raw_htc_write_sem[streamID])) {
+#endif
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unable to down the semaphore\n"));
+    }
+
+    A_ASSERT(pPacket->pBuffer == (free->data + HTC_HEADER_LEN));
+
+    free->length = 0;
+    arRaw->write_buffer_available[streamID] = TRUE;
+    up(&arRaw->raw_htc_write_sem[streamID]);
+
+    /* Signal the waiting process */
+    AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Waking up the StreamID(%d) write process\n", streamID));
+    wake_up_interruptible(&arRaw->raw_htc_write_queue[streamID]);
+}
+
+/* connect to a service */
+static A_STATUS ar6000_connect_raw_service(AR_SOFTC_T        *ar,
+                                           HTC_RAW_STREAM_ID StreamID)
+{
+    A_STATUS                 status;
+    HTC_SERVICE_CONNECT_RESP response;
+    A_UINT8                  streamNo;
+    HTC_SERVICE_CONNECT_REQ  connect;
+    
+    do {      
+        
+        A_MEMZERO(&connect,sizeof(connect));
+            /* pass the stream ID as meta data to the RAW streams service */
+        streamNo = (A_UINT8)StreamID;
+        connect.pMetaData = &streamNo;
+        connect.MetaDataLength = sizeof(A_UINT8);
+            /* these fields are the same for all endpoints */
+        connect.EpCallbacks.pContext = ar;
+        connect.EpCallbacks.EpTxComplete = ar6000_htc_raw_write_cb;   
+        connect.EpCallbacks.EpRecv = ar6000_htc_raw_read_cb;   
+            /* simple interface, we don't need these optional callbacks */      
+        connect.EpCallbacks.EpRecvRefill = NULL;
+        connect.EpCallbacks.EpSendFull = NULL;
+        connect.MaxSendQueueDepth = RAW_HTC_WRITE_BUFFERS_NUM;  
+        
+            /* connect to the raw streams service, we may be able to get 1 or more
+             * connections, depending on WHAT is running on the target */
+        connect.ServiceID = HTC_RAW_STREAMS_SVC;
+        
+        A_MEMZERO(&response,sizeof(response));
+        
+            /* try to connect to the raw stream, it is okay if this fails with 
+             * status HTC_SERVICE_NO_MORE_EP */
+        status = HTCConnectService(ar->arHtcTarget, 
+                                   &connect,
+                                   &response);
+        
+        if (A_FAILED(status)) {
+            if (response.ConnectRespCode == HTC_SERVICE_NO_MORE_EP) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HTC RAW , No more streams allowed \n"));
+                status = A_OK;    
+            }
+            break;    
+        }
+
+            /* set endpoint mapping for the RAW HTC streams */
+        arSetRawStream2EndpointIDMap(ar,StreamID,response.Endpoint);
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("HTC RAW : stream ID: %d, endpoint: %d\n", 
+                        StreamID, arRawStream2EndpointID(ar,StreamID)));
+        
+    } while (FALSE);
+    
+    return status;
+}
+
+int ar6000_htc_raw_open(AR_SOFTC_T *ar)
+{
+    A_STATUS status;
+    int streamID, endPt, count2;
+    raw_htc_buffer *buffer;
+    HTC_SERVICE_ID servicepriority;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    if (!arRaw) {
+        arRaw = ar->arRawHtc = A_MALLOC(sizeof(AR_RAW_HTC_T));
+        if (arRaw) {
+            A_MEMZERO(arRaw, sizeof(AR_RAW_HTC_T));
+        }
+    }
+    A_ASSERT(ar->arHtcTarget != NULL);
+    if (!arRaw) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Faile to allocate memory for HTC RAW interface\n"));
+        return -ENOMEM;
+    }
+    /* wait for target */
+    status = HTCWaitTarget(ar->arHtcTarget);
+
+    if (A_FAILED(status)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("HTCWaitTarget failed (%d)\n", status));
+        return -ENODEV;
+    }
+
+    for (endPt = 0; endPt < ENDPOINT_MAX; endPt++) {
+        arRaw->arEp2RawMapping[endPt] = HTC_RAW_STREAM_NOT_MAPPED;
+    }
+
+    for (streamID = HTC_RAW_STREAM_0; streamID < HTC_RAW_STREAM_NUM_MAX; streamID++) {
+        /* Initialize the data structures */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+        sema_init(&arRaw->raw_htc_read_sem[streamID], 1);
+        sema_init(&arRaw->raw_htc_write_sem[streamID], 1);
+#else
+        init_MUTEX(&arRaw->raw_htc_read_sem[streamID]);
+        init_MUTEX(&arRaw->raw_htc_write_sem[streamID]);
+#endif
+        init_waitqueue_head(&arRaw->raw_htc_read_queue[streamID]);
+        init_waitqueue_head(&arRaw->raw_htc_write_queue[streamID]);
+
+        /* try to connect to the raw service */
+        status = ar6000_connect_raw_service(ar,streamID);
+
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        if (arRawStream2EndpointID(ar,streamID) == 0) {
+            break;
+        }
+
+        for (count2 = 0; count2 < RAW_HTC_READ_BUFFERS_NUM; count2 ++) {
+            /* Initialize the receive buffers */
+            buffer = &arRaw->raw_htc_write_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+            buffer = &arRaw->raw_htc_read_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+
+            SET_HTC_PACKET_INFO_RX_REFILL(&buffer->HTCPacket,
+                                          buffer,
+                                          buffer->data,
+                                          HTC_RAW_BUFFER_SIZE,
+                                          arRawStream2EndpointID(ar,streamID));
+
+            /* Queue buffers to HTC for receive */
+            if ((status = HTCAddReceivePkt(ar->arHtcTarget, &buffer->HTCPacket)) != A_OK)
+            {
+                BMIInit();
+                return -EIO;
+            }
+        }
+
+        for (count2 = 0; count2 < RAW_HTC_WRITE_BUFFERS_NUM; count2 ++) {
+            /* Initialize the receive buffers */
+            buffer = &arRaw->raw_htc_write_buffer[streamID][count2];
+            memset(buffer, 0, sizeof(raw_htc_buffer));
+        }
+
+        arRaw->read_buffer_available[streamID] = FALSE;
+        arRaw->write_buffer_available[streamID] = TRUE;
+    }
+
+    if (A_FAILED(status)) {
+        return -EIO;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("HTC RAW, number of streams the target supports: %d \n", streamID));
+
+    servicepriority = HTC_RAW_STREAMS_SVC;  /* only 1 */
+
+    /* set callbacks and priority list */
+    HTCSetCreditDistribution(ar->arHtcTarget,
+                             ar,
+                             NULL,  /* use default */
+                             NULL,  /* use default */
+                             &servicepriority,
+                             1);
+
+    /* Start the HTC component */
+    if ((status = HTCStart(ar->arHtcTarget)) != A_OK) {
+        BMIInit();
+        return -EIO;
+    }
+
+    (ar)->arRawIfInit = TRUE;
+
+    return 0;
+}
+
+int ar6000_htc_raw_close(AR_SOFTC_T *ar)
+{
+    A_PRINTF("ar6000_htc_raw_close called \n");
+    HTCStop(ar->arHtcTarget);
+    
+        /* reset the device */
+    ar6000_reset_device(ar->arHifDevice, ar->arTargetType, TRUE, FALSE);
+    /* Initialize the BMI component */
+    BMIInit();
+
+    return 0;
+}
+
+raw_htc_buffer *
+get_filled_buffer(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID)
+{
+    int count;
+    raw_htc_buffer *busy;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    /* Check for data */
+    for (count = 0; count < RAW_HTC_READ_BUFFERS_NUM; count ++) {
+        busy = &arRaw->raw_htc_read_buffer[StreamID][count];
+        if (busy->length) {
+            break;
+        }
+    }
+    if (busy->length) {
+        arRaw->read_buffer_available[StreamID] = TRUE;
+    } else {
+        arRaw->read_buffer_available[StreamID] = FALSE;
+    }
+
+    return busy;
+}
+
+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID, 
+                            char __user *buffer, size_t length)
+{
+    int readPtr;
+    raw_htc_buffer *busy;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("StreamID(%d) not connected! \n", StreamID));
+        return -EFAULT;    
+    }
+    
+    if (down_interruptible(&arRaw->raw_htc_read_sem[StreamID])) {
+        return -ERESTARTSYS;
+    }
+
+    busy = get_filled_buffer(ar,StreamID);
+    while (!arRaw->read_buffer_available[StreamID]) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+
+        /* Wait for the data */
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Sleeping StreamID(%d) read process\n", StreamID));
+        if (wait_event_interruptible(arRaw->raw_htc_read_queue[StreamID],
+                                     arRaw->read_buffer_available[StreamID]))
+        {
+            return -EINTR;
+        }
+        if (down_interruptible(&arRaw->raw_htc_read_sem[StreamID])) {
+            return -ERESTARTSYS;
+        }
+        busy = get_filled_buffer(ar,StreamID);
+    }
+
+    /* Read the data */
+    readPtr = busy->currPtr;
+    if (length > busy->length - HTC_HEADER_LEN) {
+        length = busy->length - HTC_HEADER_LEN;
+    }
+    if (copy_to_user(buffer, &busy->data[readPtr], length)) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+        return -EFAULT;
+    }
+
+    busy->currPtr += length;
+        
+    if (busy->currPtr == busy->length)
+    {    
+        busy->currPtr = 0;
+        busy->length = 0;        
+        HTC_PACKET_RESET_RX(&busy->HTCPacket);                                          
+        //AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("raw read ioctl:  ep for packet:%d \n", busy->HTCPacket.Endpoint));
+        HTCAddReceivePkt(ar->arHtcTarget, &busy->HTCPacket);
+    }
+    arRaw->read_buffer_available[StreamID] = FALSE;
+    up(&arRaw->raw_htc_read_sem[StreamID]);
+
+    return length;
+}
+
+static raw_htc_buffer *
+get_free_buffer(AR_SOFTC_T *ar, HTC_ENDPOINT_ID StreamID)
+{
+    int count;
+    raw_htc_buffer *free;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+
+    free = NULL;
+    for (count = 0; count < RAW_HTC_WRITE_BUFFERS_NUM; count ++) {
+        free = &arRaw->raw_htc_write_buffer[StreamID][count];
+        if (free->length == 0) {
+            break;
+        }
+    }
+    if (!free->length) {
+        arRaw->write_buffer_available[StreamID] = TRUE;
+    } else {
+        arRaw->write_buffer_available[StreamID] = FALSE;
+    }
+
+    return free;
+}
+
+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar, HTC_RAW_STREAM_ID StreamID,
+                     char __user *buffer, size_t length)
+{
+    int writePtr;
+    raw_htc_buffer *free;
+    AR_RAW_HTC_T *arRaw = ar->arRawHtc;
+    if (arRawStream2EndpointID(ar,StreamID) == 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("StreamID(%d) not connected! \n", StreamID));
+        return -EFAULT;    
+    }
+    
+    if (down_interruptible(&arRaw->raw_htc_write_sem[StreamID])) {
+        return -ERESTARTSYS;
+    }
+
+    /* Search for a free buffer */
+    free = get_free_buffer(ar,StreamID);
+
+    /* Check if there is space to write else wait */
+    while (!arRaw->write_buffer_available[StreamID]) {
+        up(&arRaw->raw_htc_write_sem[StreamID]);
+
+        /* Wait for buffer to become free */
+        AR_DEBUG_PRINTF(ATH_DEBUG_HTC_RAW,("Sleeping StreamID(%d) write process\n", StreamID));
+        if (wait_event_interruptible(arRaw->raw_htc_write_queue[StreamID],
+                                     arRaw->write_buffer_available[StreamID]))
+        {
+            return -EINTR;
+        }
+        if (down_interruptible(&arRaw->raw_htc_write_sem[StreamID])) {
+            return -ERESTARTSYS;
+        }
+        free = get_free_buffer(ar,StreamID);
+    }
+
+    /* Send the data */
+    writePtr = HTC_HEADER_LEN;
+    if (length > (HTC_RAW_BUFFER_SIZE - HTC_HEADER_LEN)) {
+        length = HTC_RAW_BUFFER_SIZE - HTC_HEADER_LEN;
+    }
+
+    if (copy_from_user(&free->data[writePtr], buffer, length)) {
+        up(&arRaw->raw_htc_read_sem[StreamID]);
+        return -EFAULT;
+    }
+
+    free->length = length;
+        
+    SET_HTC_PACKET_INFO_TX(&free->HTCPacket,
+                           free,
+                           &free->data[writePtr],
+                           length,
+                           arRawStream2EndpointID(ar,StreamID),
+                           AR6K_DATA_PKT_TAG);
+    
+    HTCSendPkt(ar->arHtcTarget,&free->HTCPacket);
+    
+    arRaw->write_buffer_available[StreamID] = FALSE;
+    up(&arRaw->raw_htc_write_sem[StreamID]);
+
+    return length;
+}
+#endif /* HTC_RAW_INTERFACE */
diff --git a/host/os/linux/ar6k_mem_debug.c b/host/os/linux/ar6k_mem_debug.c
new file mode 100644
index 0000000..cb7cd30
--- /dev/null
+++ b/host/os/linux/ar6k_mem_debug.c
@@ -0,0 +1,246 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+//
+#include "ar6000_drv.h"
+
+#define malloc(size) kmalloc((size), GFP_ATOMIC)
+#define free(ptr) kfree((ptr))
+
+typedef struct MemInfo {
+    void *ptr; 
+    const char *caller;
+    int lineno;
+    size_t size;
+} MemInfo;
+
+
+
+typedef unsigned long hash_key;
+
+typedef struct HashItem {
+    hash_key Key;
+    struct HashItem * Next;
+} HashItem;
+
+typedef struct a_hash {
+    HashItem **Buckets;
+    size_t len;
+    int (*cmpKeyFunc)(const hash_key a, const hash_key b);
+    unsigned long (*hashFunc)(const hash_key key);
+    HashItem* (*mkNodeFunc)(hash_key key);
+} a_hash;
+
+static a_hash* gMem;
+
+static int cmpMemInfo(const hash_key a, const hash_key b)
+{
+    return((const MemInfo*)a)->ptr - ((const MemInfo*)b)->ptr;
+}
+
+static unsigned long hashMemInfo(const hash_key key)
+{
+    return(unsigned long)((const MemInfo*)key)->ptr;
+}
+
+static HashItem* mkMemInfoItem(hash_key key)
+{
+    HashItem* item;
+    item = malloc(sizeof(HashItem)+ sizeof(MemInfo));
+    item->Key = (hash_key)(item+1);
+    memcpy((void*)item->Key, (void*)key, sizeof(MemInfo));
+    return item;
+}
+
+static void rmItem(HashItem* item, void* data)
+{   /* private function, don't use !! */
+    free(item);
+}
+
+HashItem* a_hash_add(a_hash *hash, const hash_key Key)
+{
+    int hashIndex = hash->hashFunc(Key) % hash->len;
+    HashItem* item = hash->mkNodeFunc(Key);
+    item->Next = hash->Buckets[hashIndex];
+    hash->Buckets[hashIndex] = item;
+    return item;
+}
+
+void a_hash_iterate(a_hash* hash, void (*func)(HashItem*, void*), void* data)
+{
+    size_t i;
+    HashItem *p, *next;
+    for (i=0; i<hash->len; ++i) {
+        p = hash->Buckets[i];
+        while (p) {
+            next = p->Next;
+            func(p, data);
+            p = next;
+        }
+    }
+}
+
+void a_hash_clear(a_hash* hash)
+{
+    a_hash_iterate(hash, rmItem, NULL);
+    memset(hash->Buckets, 0, hash->len * sizeof(HashItem*));
+}
+
+void a_hash_destroy(a_hash* hash)
+{
+    a_hash_clear(hash);
+    free(hash);
+}
+
+static HashItem** __a_hash_find(a_hash* hash, const hash_key Key)
+{
+    int hashIndex = hash->hashFunc(Key) % hash->len;
+    HashItem** result = &hash->Buckets[hashIndex];
+    while (*result) {
+        if (hash->cmpKeyFunc((*result)->Key, Key)==0)
+            return result;
+        else
+            result = &(*result)->Next;
+    }
+    return result;
+}
+
+HashItem* a_hash_find(a_hash* hash, const hash_key Key)
+{
+    return *__a_hash_find(hash, Key);
+}
+
+HashItem* a_hash_findNext(a_hash* hash, HashItem* item)
+{
+    hash_key Key = (item) ? item->Key : 0;
+    if (item)
+        item = item->Next;
+    while (item) {
+        if (hash->cmpKeyFunc(item->Key, Key) == 0)
+            return item;
+        else
+            item = item->Next;
+    }
+    return item;
+}
+
+void a_hash_erase(a_hash* hash, const hash_key Key)
+{
+    HashItem* p;
+    HashItem** prev = __a_hash_find(hash, Key);
+    p = *prev;
+    if (p) {
+        *prev = p->Next;
+        rmItem(p, NULL);
+    }
+}
+
+void __a_meminfo_add(void *ptr, size_t msize, const char *func, int lineno)
+{
+    MemInfo info;
+    info.ptr = ptr;
+    info.lineno = lineno;
+    info.caller = func;
+    info.size = msize;
+    if (!gMem) {
+        int len = 512;
+        size_t size = sizeof(HashItem*) * len;
+        gMem = (a_hash*)malloc(sizeof(a_hash)+size);
+        memset(gMem, 0, sizeof(a_hash)+size);
+        gMem->Buckets = (HashItem**)(gMem+1);
+        gMem->len = len;
+
+        gMem->mkNodeFunc = mkMemInfoItem;
+        gMem->cmpKeyFunc = cmpMemInfo;
+        gMem->hashFunc   = hashMemInfo;
+    }
+
+    a_hash_add(gMem, (hash_key)&info);
+}
+
+void a_meminfo_del(void *ptr)
+{
+    MemInfo info;
+    info.ptr = ptr;
+    if (gMem) {
+        HashItem* p;
+        HashItem** prev = __a_hash_find(gMem, (unsigned long)&info);
+        p = *prev;
+        if (p) {
+            *prev = p->Next;
+            rmItem(p, NULL);
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Warning! memory ptr %p not found!", __func__, ptr));
+        }
+    }
+}
+
+void* a_mem_alloc(size_t msize, int type, const char *func, int lineno)
+{
+    void *ptr = kmalloc(msize, type);
+    __a_meminfo_add(ptr, msize, func, lineno);
+    return ptr;
+}
+
+void a_mem_free(void *ptr)
+{
+    a_meminfo_del(ptr);
+    kfree(ptr);   
+}
+
+static void printMemInfo(HashItem *item, void*arg)
+{
+    MemInfo *info = (MemInfo*)item->Key;
+    int *total = (int*)arg;
+    *total += info->size;
+    A_PRINTF("%s line %d size %d ptr %p\n", info->caller, info->lineno, info->size, info->ptr);
+}
+
+void a_meminfo_report(int clear)
+{
+    int total = 0;
+    A_PRINTF("AR6K Memory Report\n");
+    if (gMem) {
+        a_hash_iterate(gMem, printMemInfo, &total);
+        if (clear) {
+            a_hash_destroy(gMem);
+        }
+    }
+    A_PRINTF("Total %d bytes\n", total);
+}
+
+A_BOOL a_meminfo_find(void *ptr)   
+{
+    MemInfo info;
+    info.ptr = ptr;
+    if (gMem) {
+        HashItem* p;
+        HashItem** prev = __a_hash_find(gMem, (unsigned long)&info);
+        p = *prev;
+        if (p) {
+            return TRUE; 
+        } else {
+            return FALSE;
+        }
+    }
+}
diff --git a/host/os/linux/ar6k_pal.c b/host/os/linux/ar6k_pal.c
new file mode 100644
index 0000000..179a2f0
--- /dev/null
+++ b/host/os/linux/ar6k_pal.c
@@ -0,0 +1,471 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+/* PAL Transport driver for AR6003 */
+
+#include "ar6000_drv.h"
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <ar6k_pal.h>
+
+extern unsigned int setupbtdev;
+extern unsigned int loghci;
+
+#define bt_check_bit(val, bit) (val & bit)
+#define bt_set_bit(val, bit) (val |= bit)
+#define bt_clear_bit(val, bit) (val &= ~bit)
+
+/* export ATH_AR6K_DEBUG_HCI_PAL=yes in host/localmake.linux.inc
+ * to enable debug information */
+#ifdef HCIPAL_DEBUG
+#define PRIN_LOG(format, args...) printk(KERN_ALERT "%s:%d - %s Msg:" format "\n",__FUNCTION__, __LINE__, __FILE__, ## args)
+#else
+#define PRIN_LOG(format, args...)
+#endif
+
+
+/*** BT Stack Entrypoints *******/
+/***************************************
+ * bt_open - open a handle to the device
+ ***************************************/
+static int bt_open(struct hci_dev *hdev)
+{
+	PRIN_LOG("HCI PAL: bt_open - enter - x\n");
+	set_bit(HCI_RUNNING, &hdev->flags);
+	set_bit(HCI_UP, &hdev->flags);
+	set_bit(HCI_INIT, &hdev->flags);
+	return 0;
+}
+
+/***************************************
+ * bt_close - close handle to the device
+ ***************************************/
+static int bt_close(struct hci_dev *hdev)
+{
+	PRIN_LOG("HCI PAL: bt_close - enter\n");
+	clear_bit(HCI_RUNNING, &hdev->flags);
+	return 0;
+}
+
+/*****************************
+ * bt_ioctl - ioctl processing
+ *****************************/
+static int bt_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
+{
+	PRIN_LOG("HCI PAL: bt_ioctl - enter\n");
+	return -ENOIOCTLCMD;
+}
+
+/**************************************
+ * bt_flush - flush outstanding packets
+ **************************************/
+static int bt_flush(struct hci_dev *hdev)
+{
+	PRIN_LOG("HCI PAL: bt_flush - enter\n");
+	return 0;
+}
+
+/***************
+ * bt_destruct
+ ***************/
+static void bt_destruct(struct hci_dev *hdev)
+{
+	PRIN_LOG("HCI PAL: bt_destruct - enter\n");
+	/* nothing to do here */
+}
+
+/****************************************************
+ * Invoked from bluetooth stack via hdev->send()
+ * to send the packet out via ar6k to PAL firmware.
+ *
+ * For HCI command packet wmi_send_hci_cmd() is invoked.
+ * wmi_send_hci_cmd adds WMI_CMD_HDR and sends the packet
+ * to PAL firmware.
+ *
+ * For HCI ACL data packet wmi_data_hdr_add is invoked
+ * to add WMI_DATA_HDR to the packet.  ar6000_acl_data_tx
+ * is then invoked to send the packet to PAL firmware.
+ ******************************************************/
+static int btpal_send_frame(struct sk_buff *skb)
+{
+	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
+	HCI_TRANSPORT_PACKET_TYPE type;
+	ar6k_hci_pal_info_t *pHciPalInfo;
+	A_STATUS status = A_OK;
+	struct sk_buff *txSkb = NULL;
+	AR_SOFTC_DEV_T *ar;
+
+	if (!hdev) {
+		PRIN_LOG("HCI PAL: btpal_send_frame - no device\n");
+		return -ENODEV;
+	}
+
+	if (!test_bit(HCI_RUNNING, &hdev->flags)) {
+		PRIN_LOG("HCI PAL: btpal_send_frame - not open\n");
+		return -EBUSY;
+	}
+
+	pHciPalInfo = (ar6k_hci_pal_info_t *)hdev->driver_data;
+	A_ASSERT(pHciPalInfo != NULL);
+	ar = pHciPalInfo->ar;
+
+	PRIN_LOG("+btpal_send_frame type: %d \n",bt_cb(skb)->pkt_type);
+	type = HCI_COMMAND_TYPE;
+
+	switch (bt_cb(skb)->pkt_type) {
+		case HCI_COMMAND_PKT:
+			type = HCI_COMMAND_TYPE;
+			hdev->stat.cmd_tx++;
+			break;
+
+		case HCI_ACLDATA_PKT:
+			type = HCI_ACL_TYPE;
+			hdev->stat.acl_tx++;
+			break;
+
+		case HCI_SCODATA_PKT:
+			/* we don't support SCO over the pal */
+			kfree_skb(skb);
+			return 0;
+		default:
+			A_ASSERT(FALSE);
+			kfree_skb(skb);
+			return 0;
+	}
+
+    	if(loghci) {
+		A_PRINTF(">>> Send HCI %s packet len: %d\n",
+				(type == HCI_COMMAND_TYPE) ? "COMMAND" : "ACL",
+				skb->len);
+		if (type == HCI_COMMAND_TYPE) {
+			A_PRINTF("HCI Command: OGF:0x%X OCF:0x%X \r\n",
+				(HCI_GET_OP_CODE(skb->data)) >> 10, 
+				(HCI_GET_OP_CODE(skb->data)) & 0x3FF);
+		}
+		DebugDumpBytes(skb->data,skb->len,"BT HCI SEND Packet Dump");
+	}
+
+	do {
+		if(type == HCI_COMMAND_TYPE)
+		{
+			PRIN_LOG("HCI command");
+
+			if (ar->arSoftc->arWmiReady == FALSE)
+			{
+				PRIN_LOG("WMI not ready ");
+				break;
+			}
+
+			if (wmi_send_hci_cmd(ar->arWmi, skb->data, skb->len) != A_OK)
+			{
+				PRIN_LOG("send hci cmd error");
+				break;
+			}
+		}
+		else if(type == HCI_ACL_TYPE)
+		{
+			void *osbuf;
+
+			PRIN_LOG("ACL data");
+			if (ar->arSoftc->arWmiReady == FALSE)
+			{
+				PRIN_LOG("WMI not ready");
+				break;
+			}
+
+			/* need to add WMI header so allocate a skb with more space */
+			txSkb = bt_skb_alloc(TX_PACKET_RSV_OFFSET + WMI_MAX_TX_META_SZ +
+					sizeof(WMI_DATA_HDR) + skb->len,
+					GFP_ATOMIC);
+
+			if (txSkb == NULL) {
+				status = A_NO_MEMORY;
+				PRIN_LOG("No memory");
+				break;
+			}
+
+			bt_cb(txSkb)->pkt_type = bt_cb(skb)->pkt_type;
+			txSkb->dev = (void *)pHciPalInfo->hdev;
+			skb_reserve(txSkb, TX_PACKET_RSV_OFFSET + WMI_MAX_TX_META_SZ + sizeof(WMI_DATA_HDR));
+			A_MEMCPY(txSkb->data, skb->data, skb->len);
+			skb_put(txSkb,skb->len);
+			/* Add WMI packet type */
+			osbuf = (void *)txSkb;
+
+			PRIN_LOG("\nAdd WMI header");
+			if (wmi_data_hdr_add(ar->arWmi, osbuf, DATA_MSGTYPE, 0, WMI_DATA_HDR_DATA_TYPE_ACL,0,NULL) != A_OK) {
+				PRIN_LOG("XIOCTL_ACL_DATA - wmi_data_hdr_add failed\n");
+			} else {
+				/* Send data buffer over HTC */
+				PRIN_LOG("acl data tx");
+				ar6000_acl_data_tx(osbuf, ar);
+			}
+			txSkb = NULL;
+		}
+	} while (FALSE);
+
+	if (txSkb != NULL) {
+		PRIN_LOG("Free skb");
+		kfree_skb(txSkb);
+	}
+	kfree_skb(skb);
+	return 0;
+}
+
+
+/***********************************************
+ * Unregister HCI device and free HCI device info
+ ***********************************************/
+static void bt_cleanup_hci_pal(ar6k_hci_pal_info_t *pHciPalInfo)
+{
+	int err;
+
+	if (bt_check_bit(pHciPalInfo->ulFlags, HCI_REGISTERED)) {
+		bt_clear_bit(pHciPalInfo->ulFlags, HCI_REGISTERED);
+		clear_bit(HCI_RUNNING, &pHciPalInfo->hdev->flags);
+		clear_bit(HCI_UP, &pHciPalInfo->hdev->flags);
+		clear_bit(HCI_INIT, &pHciPalInfo->hdev->flags);
+		A_ASSERT(pHciPalInfo->hdev != NULL);
+#ifdef CONFIG_BT
+		/* unregister */
+		PRIN_LOG("Unregister PAL device");
+		if ((err = hci_unregister_dev(pHciPalInfo->hdev)) < 0) {
+			PRIN_LOG("HCI PAL: failed to unregister with bluetooth %d\n",err);
+		}
+#else
+		(void)&err;
+#endif
+	}
+
+	if (pHciPalInfo->hdev != NULL) {
+		kfree(pHciPalInfo->hdev);
+		pHciPalInfo->hdev = NULL;
+	}
+}
+
+/*********************************************************
+ * Allocate HCI device and store in PAL private info structure.
+ *********************************************************/
+static A_STATUS bt_setup_hci_pal(ar6k_hci_pal_info_t *pHciPalInfo)
+{
+#ifdef CONFIG_BT
+	A_STATUS status = A_OK;
+	struct hci_dev *pHciDev = NULL;
+
+#if 0 //This condition is not required for PAL
+	if (!setupbtdev) {
+		return A_OK;
+	}
+#endif
+	do {
+		/* allocate a BT HCI struct for this device */
+		pHciDev = hci_alloc_dev();
+		if (NULL == pHciDev) {
+			PRIN_LOG("HCI PAL driver - failed to allocate BT HCI struct \n");
+			status = A_NO_MEMORY;
+			break;
+		}
+
+		/* save the device, we'll register this later */
+		pHciPalInfo->hdev = pHciDev;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 37)
+        SET_HCI_BUS_TYPE(pHciDev, HCI_VIRTUAL, HCI_80211);
+#else
+        SET_HCI_BUS_TYPE(pHciDev, HCI_VIRTUAL, HCI_AMP);
+#endif
+		pHciDev->driver_data = pHciPalInfo;
+		pHciDev->open     = bt_open;
+		pHciDev->close    = bt_close;
+		pHciDev->send     = btpal_send_frame;
+		pHciDev->ioctl    = bt_ioctl;
+		pHciDev->flush    = bt_flush;
+		pHciDev->destruct = bt_destruct;
+		pHciDev->owner = THIS_MODULE;
+		/* driver is running in normal BT mode */
+		PRIN_LOG("Normal mode enabled");
+		bt_set_bit(pHciPalInfo->ulFlags, HCI_NORMAL_MODE);
+
+	} while (FALSE);
+
+	if (A_FAILED(status)) {
+		bt_cleanup_hci_pal(pHciPalInfo);
+	}
+	return status;
+#else
+	(void)&bt_open;
+	(void)&bt_close;
+	(void)&btpal_send_frame;
+	(void)&bt_ioctl;
+	(void)&bt_flush;
+	(void)&bt_destruct;
+	bt_cleanup_hci_pal(pHciPalInfo);
+	return A_ENOTSUP;
+#endif
+}
+
+/**********************************************
+ * Cleanup HCI device and free HCI PAL private info
+ *********************************************/
+void ar6k_cleanup_hci_pal(void *ar_p)
+{
+	AR_SOFTC_DEV_T *ar = (AR_SOFTC_DEV_T *)ar_p;
+	ar6k_hci_pal_info_t *pHciPalInfo = (ar6k_hci_pal_info_t *)ar->hcipal_info;
+
+	if (pHciPalInfo != NULL) {
+		bt_cleanup_hci_pal(pHciPalInfo);
+		A_FREE(pHciPalInfo);
+		ar->hcipal_info = NULL;
+	}
+}
+
+/****************************
+ *  Register HCI device
+ ****************************/
+static A_BOOL ar6k_pal_transport_ready(void *pHciPal)
+{
+#ifdef CONFIG_BT
+	ar6k_hci_pal_info_t *pHciPalInfo = (ar6k_hci_pal_info_t *)pHciPal;
+
+	PRIN_LOG("HCI device transport ready");
+	if(pHciPalInfo == NULL)
+		return FALSE;
+
+	if (hci_register_dev(pHciPalInfo->hdev) < 0) {
+		PRIN_LOG("Can't register HCI device");
+		hci_free_dev(pHciPalInfo->hdev);
+		return FALSE;
+	}
+	PRIN_LOG("HCI device registered");
+	pHciPalInfo->ulFlags |= HCI_REGISTERED;
+	return TRUE;
+#else
+	return FALSE;
+#endif
+}
+
+/**************************************************
+ * Called from ar6k driver when command or ACL data
+ * packet is received. Pass the packet to bluetooth
+ * stack via hci_recv_frame.
+ **************************************************/
+A_BOOL ar6k_pal_recv_pkt(void *pHciPal, void *osbuf)
+{
+	struct sk_buff *skb = (struct sk_buff *)osbuf;
+	ar6k_hci_pal_info_t *pHciPalInfo;
+	A_BOOL success = FALSE;
+	A_UINT8 btType = 0;
+	pHciPalInfo = (ar6k_hci_pal_info_t *)pHciPal;
+
+	do {
+
+		/* if normal mode is not enabled pass on to the stack
+		 * by returning failure */
+		if(!(pHciPalInfo->ulFlags & HCI_NORMAL_MODE))
+		{
+			PRIN_LOG("Normal mode not enabled");
+			break;
+		}
+
+		if (!test_bit(HCI_RUNNING, &pHciPalInfo->hdev->flags)) {
+			PRIN_LOG("HCI PAL: HCI - not running\n");
+			break;
+		}
+
+		if(*((short *)A_NETBUF_DATA(skb)) == WMI_ACL_DATA_EVENTID)
+			btType = HCI_ACLDATA_PKT;
+		else
+			btType = HCI_EVENT_PKT;
+		/* pull 4 bytes which contains WMI packet type */
+		A_NETBUF_PULL(skb, sizeof(int));
+		bt_cb(skb)->pkt_type = btType;
+		skb->dev = (void *)pHciPalInfo->hdev;
+
+    		if(loghci) {
+			AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("<<< Recv HCI %s packet len:%d \n",
+						(btType == HCI_EVENT_TYPE) ? "EVENT" : "ACL",
+						skb->len));
+			DebugDumpBytes(skb->data, skb->len,"BT HCI RECV Packet Dump");
+		}
+		/* pass the received event packet up the stack */
+#ifdef CONFIG_BT
+		if (hci_recv_frame(skb) != 0) {
+#else
+		if (1) {
+#endif
+			PRIN_LOG("HCI PAL: hci_recv_frame failed \n");
+			break;
+		} else {
+			PRIN_LOG("HCI PAL: Indicated RCV of type:%d, Length:%d \n",HCI_EVENT_PKT, skb->len);
+		}
+		PRIN_LOG("hci recv success");
+		success = TRUE;
+	}while(FALSE);
+	return success;
+}
+
+/**********************************************************
+ * HCI PAL init function called from ar6k when it is loaded..
+ * Allocates PAL private info, stores the same in ar6k private info.
+ * Registers a HCI device.
+ * Registers packet receive callback function with ar6k
+ **********************************************************/
+A_STATUS ar6k_setup_hci_pal(void *ar_p)
+{
+	A_STATUS status = A_OK;
+	ar6k_hci_pal_info_t *pHciPalInfo;
+	ar6k_pal_config_t ar6k_pal_config;
+	AR_SOFTC_DEV_T *ar = (AR_SOFTC_DEV_T *)ar_p;
+	
+	do {
+
+		pHciPalInfo = (ar6k_hci_pal_info_t *)A_MALLOC(sizeof(ar6k_hci_pal_info_t));
+
+		if (NULL == pHciPalInfo) {
+			status = A_NO_MEMORY;
+			break;
+		}
+
+		A_MEMZERO(pHciPalInfo, sizeof(ar6k_hci_pal_info_t));
+		ar->hcipal_info = pHciPalInfo;
+		pHciPalInfo->ar = ar;
+
+		status = bt_setup_hci_pal(pHciPalInfo);
+		if (A_FAILED(status)) {
+			break;
+		}
+
+		if(bt_check_bit(pHciPalInfo->ulFlags, HCI_NORMAL_MODE))
+			PRIN_LOG("HCI PAL: running in normal mode... \n");
+		else
+			PRIN_LOG("HCI PAL: running in test mode... \n");
+
+		ar6k_pal_config.fpar6k_pal_recv_pkt = ar6k_pal_recv_pkt;
+		register_pal_cb(&ar6k_pal_config);
+		ar6k_pal_transport_ready(ar->hcipal_info);
+	} while (FALSE);
+
+	if (A_FAILED(status)) {
+		ar6k_cleanup_hci_pal(ar);
+	}
+	return status;
+}
diff --git a/host/os/linux/cfg80211.c b/host/os/linux/cfg80211.c
new file mode 100644
index 0000000..97f6979
--- /dev/null
+++ b/host/os/linux/cfg80211.c
@@ -0,0 +1,1638 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <net/cfg80211.h>
+
+#include "ar6000_drv.h"
+
+
+extern unsigned int wmitimeout;
+extern int reconnect_flag;
+
+
+#define RATETAB_ENT(_rate, _rateid, _flags) {   \
+    .bitrate    = (_rate),                  \
+    .flags      = (_flags),                 \
+    .hw_value   = (_rateid),                \
+}
+
+#define CHAN2G(_channel, _freq, _flags) {   \
+    .band           = IEEE80211_BAND_2GHZ,  \
+    .hw_value       = (_channel),           \
+    .center_freq    = (_freq),              \
+    .flags          = (_flags),             \
+    .max_antenna_gain   = 0,                \
+    .max_power      = 30,                   \
+}
+
+#define CHAN5G(_channel, _flags) {              \
+    .band           = IEEE80211_BAND_5GHZ,      \
+    .hw_value       = (_channel),               \
+    .center_freq    = 5000 + (5 * (_channel)),  \
+    .flags          = (_flags),                 \
+    .max_antenna_gain   = 0,                    \
+    .max_power      = 30,                       \
+}
+
+static struct
+ieee80211_rate ar6k_rates[] = {
+    RATETAB_ENT(10,  0x1,   0),
+    RATETAB_ENT(20,  0x2,   0),
+    RATETAB_ENT(55,  0x4,   0),
+    RATETAB_ENT(110, 0x8,   0),
+    RATETAB_ENT(60,  0x10,  0),
+    RATETAB_ENT(90,  0x20,  0),
+    RATETAB_ENT(120, 0x40,  0),
+    RATETAB_ENT(180, 0x80,  0),
+    RATETAB_ENT(240, 0x100, 0),
+    RATETAB_ENT(360, 0x200, 0),
+    RATETAB_ENT(480, 0x400, 0),
+    RATETAB_ENT(540, 0x800, 0),
+};
+
+#define ar6k_a_rates     (ar6k_rates + 4)
+#define ar6k_a_rates_size    8
+#define ar6k_g_rates     (ar6k_rates + 0)
+#define ar6k_g_rates_size    12
+
+static struct
+ieee80211_channel ar6k_2ghz_channels[] = {
+    CHAN2G(1, 2412, 0),
+    CHAN2G(2, 2417, 0),
+    CHAN2G(3, 2422, 0),
+    CHAN2G(4, 2427, 0),
+    CHAN2G(5, 2432, 0),
+    CHAN2G(6, 2437, 0),
+    CHAN2G(7, 2442, 0),
+    CHAN2G(8, 2447, 0),
+    CHAN2G(9, 2452, 0),
+    CHAN2G(10, 2457, 0),
+    CHAN2G(11, 2462, 0),
+    CHAN2G(12, 2467, 0),
+    CHAN2G(13, 2472, 0),
+    CHAN2G(14, 2484, 0),
+};
+
+static struct
+ieee80211_channel ar6k_5ghz_a_channels[] = {
+    CHAN5G(34, 0),      CHAN5G(36, 0),
+    CHAN5G(38, 0),      CHAN5G(40, 0),
+    CHAN5G(42, 0),      CHAN5G(44, 0),
+    CHAN5G(46, 0),      CHAN5G(48, 0),
+    CHAN5G(52, 0),      CHAN5G(56, 0),
+    CHAN5G(60, 0),      CHAN5G(64, 0),
+    CHAN5G(100, 0),     CHAN5G(104, 0),
+    CHAN5G(108, 0),     CHAN5G(112, 0),
+    CHAN5G(116, 0),     CHAN5G(120, 0),
+    CHAN5G(124, 0),     CHAN5G(128, 0),
+    CHAN5G(132, 0),     CHAN5G(136, 0),
+    CHAN5G(140, 0),     CHAN5G(149, 0),
+    CHAN5G(153, 0),     CHAN5G(157, 0),
+    CHAN5G(161, 0),     CHAN5G(165, 0),
+    CHAN5G(184, 0),     CHAN5G(188, 0),
+    CHAN5G(192, 0),     CHAN5G(196, 0),
+    CHAN5G(200, 0),     CHAN5G(204, 0),
+    CHAN5G(208, 0),     CHAN5G(212, 0),
+    CHAN5G(216, 0),
+};
+
+static struct
+ieee80211_supported_band ar6k_band_2ghz = {
+    .n_channels = ARRAY_SIZE(ar6k_2ghz_channels),
+    .channels = ar6k_2ghz_channels,
+    .n_bitrates = ar6k_g_rates_size,
+    .bitrates = ar6k_g_rates,
+};
+
+static struct
+ieee80211_supported_band ar6k_band_5ghz = {
+    .n_channels = ARRAY_SIZE(ar6k_5ghz_a_channels),
+    .channels = ar6k_5ghz_a_channels,
+    .n_bitrates = ar6k_a_rates_size,
+    .bitrates = ar6k_a_rates,
+};
+
+static int
+ar6k_set_wpa_version(AR_SOFTC_DEV_T *arPriv, enum nl80211_wpa_versions wpa_version)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: %u\n", __func__, wpa_version));
+
+    if (!wpa_version) {
+        arPriv->arAuthMode = WMI_NONE_AUTH;
+    } else if (wpa_version & NL80211_WPA_VERSION_1) {
+        arPriv->arAuthMode = WMI_WPA_AUTH;
+    } else if (wpa_version & NL80211_WPA_VERSION_2) {
+        arPriv->arAuthMode = WMI_WPA2_AUTH;
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: %u not spported\n", __func__, wpa_version));
+        return -ENOTSUPP;
+    }
+
+    return A_OK;
+}
+
+static int
+ar6k_set_auth_type(AR_SOFTC_DEV_T *arPriv, enum nl80211_auth_type auth_type)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: 0x%x\n", __func__, auth_type));
+
+    switch (auth_type) {
+    case NL80211_AUTHTYPE_OPEN_SYSTEM:
+        arPriv->arDot11AuthMode = OPEN_AUTH;
+        break;
+    case NL80211_AUTHTYPE_SHARED_KEY:
+        arPriv->arDot11AuthMode = SHARED_AUTH;
+        break;
+    case NL80211_AUTHTYPE_NETWORK_EAP:
+        arPriv->arDot11AuthMode = LEAP_AUTH;
+        break;
+    default:
+        arPriv->arDot11AuthMode = OPEN_AUTH;
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: 0x%x not spported\n", __func__, auth_type));
+        return -ENOTSUPP;
+    }
+
+    return A_OK;
+}
+
+static int
+ar6k_set_cipher(AR_SOFTC_DEV_T *arPriv, A_UINT32 cipher, A_BOOL ucast)
+{
+    A_UINT8  *ar_cipher = ucast ? &arPriv->arPairwiseCrypto :
+                                &arPriv->arGroupCrypto;
+    A_UINT8  *ar_cipher_len = ucast ? &arPriv->arPairwiseCryptoLen :
+                                    &arPriv->arGroupCryptoLen;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: cipher 0x%x, ucast %u\n", __func__, cipher, ucast));
+
+    switch (cipher) {
+    case 0:
+    case IW_AUTH_CIPHER_NONE:
+        *ar_cipher = NONE_CRYPT;
+        *ar_cipher_len = 0;
+        break;
+    case WLAN_CIPHER_SUITE_WEP40:
+        *ar_cipher = WEP_CRYPT;
+        *ar_cipher_len = 5;
+        break;
+    case WLAN_CIPHER_SUITE_WEP104:
+        *ar_cipher = WEP_CRYPT;
+        *ar_cipher_len = 13;
+        break;
+    case WLAN_CIPHER_SUITE_TKIP:
+#ifdef CFG80211_WAPI_ENABLE
+		*ar_cipher = WAPI_CRYPT;
+#else
+        *ar_cipher = TKIP_CRYPT;
+#endif
+        *ar_cipher_len = 0;
+        break;
+    case WLAN_CIPHER_SUITE_CCMP:
+        *ar_cipher = AES_CRYPT;
+        *ar_cipher_len = 0;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: cipher 0x%x not supported\n", __func__, cipher));
+        return -ENOTSUPP;
+    }
+
+    return A_OK;
+}
+
+static void
+ar6k_set_key_mgmt(AR_SOFTC_DEV_T *arPriv, A_UINT32 key_mgmt)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: 0x%x\n", __func__, key_mgmt));
+
+    if (WLAN_AKM_SUITE_PSK == key_mgmt) {
+        if (WMI_WPA_AUTH == arPriv->arAuthMode) {
+            arPriv->arAuthMode = WMI_WPA_PSK_AUTH;
+        } else if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+            arPriv->arAuthMode = WMI_WPA2_PSK_AUTH;
+        }
+    } else if (WLAN_AKM_SUITE_8021X != key_mgmt) {
+        arPriv->arAuthMode = WMI_NONE_AUTH;
+    }
+}
+
+static int
+ar6k_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+                      struct cfg80211_connect_params *sme)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    A_STATUS status;
+#ifdef CFG80211_WAPI_ENABLE	
+	const unsigned char wps_oui[] = { 0x00, 0x50, 0xf2, 0x04 };
+	const unsigned char wpa_oui[] = { 0x00, 0x50, 0xf2, 0x01 };
+	unsigned char *ie = sme->ie;
+#endif
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready yet\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: destroy in progress\n", __func__));
+        return -EBUSY;
+    }
+
+    if(!sme->ssid_len || IEEE80211_MAX_SSID_LEN < sme->ssid_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    if(arSta->arSkipScan == TRUE &&
+       ((sme->channel && sme->channel->center_freq == 0) ||
+        (sme->bssid && !sme->bssid[0] && !sme->bssid[1] && !sme->bssid[2] &&
+         !sme->bssid[3] && !sme->bssid[4] && !sme->bssid[5])))
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s:SkipScan: channel or bssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    if(down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+        return -ERESTARTSYS;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, destroy in progress\n", __func__));
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if(ar->arTxPending[wmi_get_control_ep(arPriv->arWmi)]) {
+        /*
+        * sleep until the command queue drains
+        */
+        wait_event_interruptible_timeout(arPriv->arEvent,
+        ar->arTxPending[wmi_get_control_ep(arPriv->arWmi)] == 0, wmitimeout * HZ);
+        if (signal_pending(current)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: cmd queue drain timeout\n", __func__));
+            up(&ar->arSem);
+            return -EINTR;
+        }
+    }
+    up(&ar->arSem);
+
+    if(down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+        return -ERESTARTSYS;
+    }
+
+    if(arPriv->arConnected == TRUE &&
+       arPriv->arSsidLen == sme->ssid_len &&
+       !A_MEMCMP(arPriv->arSsid, sme->ssid, arPriv->arSsidLen)) {
+        reconnect_flag = TRUE;
+        status = wmi_reconnect_cmd(arPriv->arWmi,
+                                   arSta->arReqBssid,
+                                   arPriv->arChannelHint);
+
+        if (status != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_reconnect_cmd failed\n", __func__));
+            return -EIO;
+        }
+        return 0;
+    } else if(arPriv->arSsidLen == sme->ssid_len &&
+              !A_MEMCMP(arPriv->arSsid, sme->ssid, arPriv->arSsidLen)) {
+	    ar6000_disconnect(arPriv);
+    }
+
+    A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+    arPriv->arSsidLen = sme->ssid_len;
+    A_MEMCPY(arPriv->arSsid, sme->ssid, sme->ssid_len);
+
+    if(sme->channel){
+        arPriv->arChannelHint = sme->channel->center_freq;
+    }
+
+    A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+    if(sme->bssid){
+        if(A_MEMCMP(&sme->bssid, bcast_mac, AR6000_ETH_ADDR_LEN)) {
+            A_MEMCPY(arSta->arReqBssid, sme->bssid, sizeof(arSta->arReqBssid));
+        }
+    }
+	
+    ar6k_set_wpa_version(arPriv, sme->crypto.wpa_versions);
+    ar6k_set_auth_type(arPriv, sme->auth_type);
+
+    if(sme->crypto.n_ciphers_pairwise) {
+        ar6k_set_cipher(arPriv, sme->crypto.ciphers_pairwise[0], true);
+    } else {
+        ar6k_set_cipher(arPriv, IW_AUTH_CIPHER_NONE, true);
+    }
+    ar6k_set_cipher(arPriv, sme->crypto.cipher_group, false);
+
+    if(sme->crypto.n_akm_suites) {
+        ar6k_set_key_mgmt(arPriv, sme->crypto.akm_suites[0]);
+    }
+
+    if((sme->key_len) &&
+       (WMI_NONE_AUTH == arPriv->arAuthMode) &&
+        (WEP_CRYPT == arPriv->arPairwiseCrypto)) {
+        struct ar_key *key = NULL;
+
+        if(sme->key_idx < WMI_MIN_KEY_INDEX || sme->key_idx > WMI_MAX_KEY_INDEX) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("%s: key index %d out of bounds\n", __func__, sme->key_idx));
+            up(&ar->arSem);
+            return -ENOENT;
+        }
+
+        key = &arPriv->keys[sme->key_idx];
+        key->key_len = sme->key_len;
+        A_MEMCPY(key->key, sme->key, key->key_len);
+        key->cipher = arPriv->arPairwiseCrypto;
+        arPriv->arDefTxKeyIndex = sme->key_idx;
+
+        wmi_addKey_cmd(arPriv->arWmi, sme->key_idx,
+                    arPriv->arPairwiseCrypto,
+                    GROUP_USAGE | TX_USAGE,
+                    key->key_len,
+                    NULL,
+                    key->key, KEY_OP_INIT_VAL, NULL,
+                    NO_SYNC_WMIFLAG);
+    }
+
+    if (!arSta->arUserBssFilter) {
+        if (wmi_bssfilter_cmd(arPriv->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Couldn't set bss filtering\n", __func__));
+            up(&ar->arSem);
+            return -EIO;
+        }
+    }
+
+    arPriv->arNetworkType = arPriv->arNextMode;
+	
+#ifdef CFG80211_WAPI_ENABLE
+/*the following codes for wps and wapi, but ONLY test wapi*/	
+	if (ie[0] == WLAN_EID_VENDOR_SPECIFIC &&
+         memcmp(ie + 2, wps_oui, sizeof(wps_oui)) == 0) {
+				/* WPS IE detected, notify target */
+				A_PRINTF("WPS IE detected -- setting WPS flag\n");
+				arPriv->arSta.arConnectCtrlFlags |= CONNECT_WPS_FLAG;
+				arPriv->arAuthMode = 0;
+    } else {
+     	if ((ie[0]==IEEE80211_ELEMID_RSN) ||
+    		(ie[0]==IEEE80211_ELEMID_VENDOR && 
+    		memcmp(&ie[2], wpa_oui, sizeof(wpa_oui))==0)) { 
+				sme->ie_len = 0; /* Firmware will set for us. Clear the previous one */
+   		}
+		/* for WAPI */
+        else if (ie[0]==IEEE80211_ELEMID_WAPI) 
+	    {
+        }
+        /************/
+		arPriv->arSta.arConnectCtrlFlags &= ~CONNECT_WPS_FLAG;
+	}
+	wmi_set_appie_cmd(arPriv->arWmi, WMI_FRAME_ASSOC_REQ, sme->ie_len, ie);
+/*********************************************************/
+#endif
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Connect called with authmode %d dot11 auth %d"\
+                    " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                    " GRP crypto Len %d channel hint %u\n",
+                    __func__, arPriv->arAuthMode, arPriv->arDot11AuthMode,
+                    arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                    arPriv->arGroupCrypto, arPriv->arGroupCryptoLen, arPriv->arChannelHint));
+    reconnect_flag = 0;
+    status = wmi_connect_cmd(arPriv->arWmi, arPriv->arNetworkType,
+                            arPriv->arDot11AuthMode, arPriv->arAuthMode,
+                            arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                            arPriv->arGroupCrypto,arPriv->arGroupCryptoLen,
+                            arPriv->arSsidLen, arPriv->arSsid,
+                            arSta->arReqBssid, arPriv->arChannelHint,
+                            arSta->arConnectCtrlFlags);
+
+    up(&ar->arSem);
+
+    if (A_EINVAL == status) {
+        A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+        arPriv->arSsidLen = 0;
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Invalid request\n", __func__));
+        return -ENOENT;
+    } else if (status != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_connect_cmd failed\n", __func__));
+        return -EIO;
+    }
+
+    if ((!(arSta->arConnectCtrlFlags & CONNECT_DO_WPA_OFFLOAD)) &&
+        ((WMI_WPA_PSK_AUTH == arPriv->arAuthMode) || (WMI_WPA2_PSK_AUTH == arPriv->arAuthMode)))
+    {
+        A_TIMEOUT_MS(&arSta->disconnect_timer, A_DISCONNECT_TIMER_INTERVAL, 0);
+    }
+
+    arSta->arConnectCtrlFlags &= ~CONNECT_DO_WPA_OFFLOAD;
+    arSta->arConnectPending = TRUE;
+
+    return 0;
+}
+
+void
+ar6k_cfg80211_connect_event(AR_SOFTC_DEV_T *arPriv, A_UINT16 channel,
+                A_UINT8 *bssid, A_UINT16 listenInterval,
+                A_UINT16 beaconInterval,NETWORK_TYPE networkType,
+                A_UINT8 beaconIeLen, A_UINT8 assocReqLen,
+                A_UINT8 assocRespLen, A_UINT8 *assocInfo)
+{
+    A_UINT16 size = 0;
+    A_UINT16 capability = 0;
+    struct cfg80211_bss *bss = NULL;
+    struct ieee80211_mgmt *mgmt = NULL;
+    struct ieee80211_channel *ibss_channel = NULL;
+    s32 signal = 50 * 100;
+    A_UINT8 ie_buf_len = 0;
+    unsigned char ie_buf[256];
+    unsigned char *ptr_ie_buf = ie_buf;
+    unsigned char *ieeemgmtbuf = NULL;
+    A_UINT8 source_mac[ATH_MAC_LEN];
+
+    A_UINT8 assocReqIeOffset = sizeof(A_UINT16)  +  /* capinfo*/
+                               sizeof(A_UINT16);    /* listen interval */
+    A_UINT8 assocRespIeOffset = sizeof(A_UINT16) +  /* capinfo*/
+                                sizeof(A_UINT16) +  /* status Code */
+                                sizeof(A_UINT16);   /* associd */
+    A_UINT8 *assocReqIe = assocInfo + beaconIeLen + assocReqIeOffset;
+    A_UINT8 *assocRespIe = assocInfo + beaconIeLen + assocReqLen + assocRespIeOffset;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    assocReqLen -= assocReqIeOffset;
+    assocRespLen -= assocRespIeOffset;
+
+    if((ADHOC_NETWORK & networkType)) {
+        if(NL80211_IFTYPE_ADHOC != arPriv->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in ibss mode\n", __func__));
+            return;
+        }
+    }
+
+    if((INFRA_NETWORK & networkType)) {
+        if(NL80211_IFTYPE_STATION != arPriv->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in station mode\n", __func__));
+            return;
+        }
+    }
+
+    /* Before informing the join/connect event, make sure that
+     * bss entry is present in scan list, if it not present
+     * construct and insert into scan list, otherwise that
+     * event will be dropped on the way by cfg80211, due to
+     * this keys will not be plumbed in case of WEP and
+     * application will not be aware of join/connect status. */
+    bss = cfg80211_get_bss(arPriv->wdev->wiphy, NULL, bssid,
+                           arPriv->wdev->ssid, arPriv->wdev->ssid_len,
+                           ((ADHOC_NETWORK & networkType) ? WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS),
+                           ((ADHOC_NETWORK & networkType) ? WLAN_CAPABILITY_IBSS : WLAN_CAPABILITY_ESS));
+
+    if(!bss) {
+        if (ADHOC_NETWORK & networkType) {
+            /* construct 802.11 mgmt beacon */
+            if(ptr_ie_buf) {
+                *ptr_ie_buf++ = WLAN_EID_SSID;
+                *ptr_ie_buf++ = arPriv->arSsidLen;
+                A_MEMCPY(ptr_ie_buf, arPriv->arSsid, arPriv->arSsidLen);
+                ptr_ie_buf +=arPriv->arSsidLen;
+
+                *ptr_ie_buf++ = WLAN_EID_IBSS_PARAMS;
+                *ptr_ie_buf++ = 2; /* length */
+                *ptr_ie_buf++ = 0; /* ATIM window */
+                *ptr_ie_buf++ = 0; /* ATIM window */
+
+                /* TODO: update ibss params and include supported rates,
+                 * DS param set, extened support rates, wmm. */
+
+                ie_buf_len = ptr_ie_buf - ie_buf;
+            }
+
+            capability |= IEEE80211_CAPINFO_IBSS;
+            if(WEP_CRYPT == arPriv->arPairwiseCrypto) {
+                capability |= IEEE80211_CAPINFO_PRIVACY;
+            }
+            A_MEMCPY(source_mac, arPriv->arNetDev->dev_addr, ATH_MAC_LEN);
+            ptr_ie_buf = ie_buf;
+        } else {
+            capability = *(A_UINT16 *)(&assocInfo[beaconIeLen]);
+            A_MEMCPY(source_mac, bssid, ATH_MAC_LEN);
+            ptr_ie_buf = assocReqIe;
+            ie_buf_len = assocReqLen;
+        }
+
+        size = offsetof(struct ieee80211_mgmt, u)
+             + sizeof(mgmt->u.beacon)
+             + ie_buf_len;
+
+        ieeemgmtbuf = A_MALLOC_NOWAIT(size);
+        if(!ieeemgmtbuf) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                            ("%s: ieeeMgmtbuf alloc error\n", __func__));
+            return;
+        }
+
+        A_MEMZERO(ieeemgmtbuf, size);
+        mgmt = (struct ieee80211_mgmt *)ieeemgmtbuf;
+        mgmt->frame_control = (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
+        A_MEMCPY(mgmt->da, bcast_mac, ATH_MAC_LEN);
+        A_MEMCPY(mgmt->sa, source_mac, ATH_MAC_LEN);
+        A_MEMCPY(mgmt->bssid, bssid, ATH_MAC_LEN);
+        mgmt->u.beacon.beacon_int = beaconInterval;
+        mgmt->u.beacon.capab_info = capability;
+        A_MEMCPY(mgmt->u.beacon.variable, ptr_ie_buf, ie_buf_len);
+
+        ibss_channel = ieee80211_get_channel(arPriv->wdev->wiphy, (int)channel);
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: inform bss with bssid %02x:%02x:%02x:%02x:%02x:%02x "\
+                         "channel %d beaconInterval %d capability 0x%x\n",
+                        __func__,
+                        mgmt->bssid[0], mgmt->bssid[1], mgmt->bssid[2],
+                        mgmt->bssid[3], mgmt->bssid[4], mgmt->bssid[5],
+                        ibss_channel->hw_value, beaconInterval, capability));
+
+        bss = cfg80211_inform_bss_frame(arPriv->wdev->wiphy,
+                                        ibss_channel, mgmt,
+                                        le16_to_cpu(size),
+                                        signal, GFP_ATOMIC);
+        A_FREE(ieeemgmtbuf);
+        cfg80211_put_bss(bss);
+    }
+
+    if((ADHOC_NETWORK & networkType)) {
+        cfg80211_ibss_joined(arPriv->arNetDev, bssid, GFP_ATOMIC);
+        return;
+    }
+
+    if (FALSE == arPriv->arConnected) {
+        /* inform connect result to cfg80211 */
+        cfg80211_connect_result(arPriv->arNetDev, bssid,
+                                assocReqIe, assocReqLen,
+                                assocRespIe, assocRespLen,
+                                WLAN_STATUS_SUCCESS, GFP_ATOMIC);
+    } else {
+        /* inform roam event to cfg80211 */
+        cfg80211_roamed(arPriv->arNetDev, bssid,
+                        assocReqIe, assocReqLen,
+                        assocRespIe, assocRespLen,
+                        GFP_ATOMIC);
+    }
+}
+
+static int
+ar6k_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+                        A_UINT16 reason_code)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: reason=%u\n", __func__, reason_code));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->bIsDestroyProgress) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, destroy in progress\n", __func__));
+        return -EBUSY;
+    }
+
+    if(down_interruptible(&ar->arSem)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: busy, couldn't get access\n", __func__));
+        return -ERESTARTSYS;
+    }
+
+    reconnect_flag = 0;
+    ar6000_disconnect(arPriv);
+    A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+    arPriv->arSsidLen = 0;
+
+    if (arPriv->arSta.arSkipScan == FALSE) {
+        A_MEMZERO(arPriv->arSta.arReqBssid, sizeof(arPriv->arSta.arReqBssid));
+    }
+
+    up(&ar->arSem);
+
+    return 0;
+}
+
+void
+ar6k_cfg80211_disconnect_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 reason,
+                               A_UINT8 *bssid, A_UINT8 assocRespLen,
+                               A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: reason=%u\n", __func__, reason));
+
+    if((ADHOC_NETWORK & arPriv->arNetworkType)) {
+        if(NL80211_IFTYPE_ADHOC != arPriv->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in ibss mode\n", __func__));
+            return;
+        }
+        A_MEMZERO(bssid, ETH_ALEN);
+        cfg80211_ibss_joined(arPriv->arNetDev, bssid, GFP_ATOMIC);
+        return;
+    }
+
+    if((INFRA_NETWORK & arPriv->arNetworkType)) {
+        if(NL80211_IFTYPE_STATION != arPriv->wdev->iftype) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                            ("%s: ath6k not in station mode\n", __func__));
+            return;
+        }
+    }
+
+    if(FALSE == arPriv->arConnected) {
+        if(NO_NETWORK_AVAIL == reason) {
+            /* connect cmd failed */
+            cfg80211_connect_result(arPriv->arNetDev, bssid,
+                                    NULL, 0,
+                                    NULL, 0,
+                                    WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                    GFP_ATOMIC);
+        }
+    } else {
+        /* connection loss due to disconnect cmd or low rssi */
+        cfg80211_disconnected(arPriv->arNetDev, reason, NULL, 0, GFP_ATOMIC);
+    }
+}
+
+void
+ar6k_cfg80211_scan_node(void *arg, bss_t *ni)
+{
+    struct wiphy *wiphy = (struct wiphy *)arg;
+    A_UINT16 size;
+    unsigned char *ieeemgmtbuf = NULL;
+    struct ieee80211_mgmt *mgmt;
+    struct ieee80211_channel *channel;
+    struct ieee80211_supported_band *band;
+    struct ieee80211_common_ie  *cie;
+    s32 signal;
+    int freq;
+
+    cie = &ni->ni_cie;
+
+#define CHAN_IS_11A(x)  (!((x >= 2412) && (x <= 2484)))
+    if(CHAN_IS_11A(cie->ie_chan)) {
+        /* 11a */
+        band = wiphy->bands[IEEE80211_BAND_5GHZ];
+    } else if((cie->ie_erp) || (cie->ie_xrates)) {
+        /* 11g */
+        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+    } else {
+        /* 11b */
+        band = wiphy->bands[IEEE80211_BAND_2GHZ];
+    }
+
+    size = ni->ni_framelen + offsetof(struct ieee80211_mgmt, u);
+    ieeemgmtbuf = A_MALLOC_NOWAIT(size);
+    if(!ieeemgmtbuf)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ieeeMgmtbuf alloc error\n", __func__));
+        return;
+    }
+
+    /* Note:
+       TODO: Update target to include 802.11 mac header while sending bss info.
+       Target removes 802.11 mac header while sending the bss info to host,
+       cfg80211 needs it, for time being just filling the da, sa and bssid fields alone.
+    */
+    mgmt = (struct ieee80211_mgmt *)ieeemgmtbuf;
+    A_MEMCPY(mgmt->da, bcast_mac, ATH_MAC_LEN);
+    A_MEMCPY(mgmt->sa, ni->ni_macaddr, ATH_MAC_LEN);
+    A_MEMCPY(mgmt->bssid, ni->ni_macaddr, ATH_MAC_LEN);
+    A_MEMCPY(ieeemgmtbuf + offsetof(struct ieee80211_mgmt, u),
+             ni->ni_buf, ni->ni_framelen);
+
+    freq    = cie->ie_chan;
+    channel = ieee80211_get_channel(wiphy, freq);
+    signal  = ni->ni_snr * 100;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: bssid %02x:%02x:%02x:%02x:%02x:%02x channel %d freq %d size %d\n",
+                   __func__,
+                   mgmt->bssid[0], mgmt->bssid[1], mgmt->bssid[2],
+                   mgmt->bssid[3], mgmt->bssid[4], mgmt->bssid[5],
+                   channel->hw_value, freq, size));
+    cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+                              le16_to_cpu(size),
+                              signal, GFP_ATOMIC);
+
+    A_FREE (ieeemgmtbuf);
+}
+
+static int
+ar6k_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+                   struct cfg80211_scan_request *request)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    int ret = 0;
+    A_BOOL forceFgScan = FALSE;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if (!arPriv->arSta.arUserBssFilter) {
+        if (wmi_bssfilter_cmd(arPriv->arWmi,
+                             (arPriv->arConnected ? ALL_BUT_BSS_FILTER : ALL_BSS_FILTER),
+                             0) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Couldn't set bss filtering\n", __func__));
+            return -EIO;
+        }
+    }
+
+    if(request->n_ssids &&
+       request->ssids[0].ssid_len) {
+        A_UINT8 i;
+
+        if(request->n_ssids > MAX_PROBED_SSID_INDEX) {
+            request->n_ssids = MAX_PROBED_SSID_INDEX;
+        }
+
+        for (i = 0; i < request->n_ssids; i++) {
+            wmi_probedSsid_cmd(arPriv->arWmi, i, SPECIFIC_SSID_FLAG,
+                               request->ssids[i].ssid_len,
+                               request->ssids[i].ssid);
+        }
+    }
+
+    if(arPriv->arConnected) {
+        forceFgScan = TRUE;
+    }
+
+    if(wmi_startscan_cmd(arPriv->arWmi, WMI_LONG_SCAN, forceFgScan, FALSE, \
+                         0, 0, 0, NULL) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_startscan_cmd failed\n", __func__));
+        ret = -EIO;
+    }
+
+    arPriv->scan_request = request;
+
+    return ret;
+}
+
+void
+ar6k_cfg80211_scanComplete_event(AR_SOFTC_DEV_T *arPriv, A_STATUS status)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: status %d\n", __func__, status));
+
+    if(arPriv->scan_request)
+    {
+        /* Translate data to cfg80211 mgmt format */
+        wmi_iterate_nodes(arPriv->arWmi, ar6k_cfg80211_scan_node, arPriv->wdev->wiphy);
+
+        cfg80211_scan_done(arPriv->scan_request,
+                          (status & A_ECANCELED) ? true : false);
+
+        if(arPriv->scan_request->n_ssids &&
+           arPriv->scan_request->ssids[0].ssid_len) {
+            A_UINT8 i;
+
+            for (i = 0; i < arPriv->scan_request->n_ssids; i++) {
+                wmi_probedSsid_cmd(arPriv->arWmi, i, DISABLE_SSID_FLAG,
+                                   0, NULL);
+            }
+        }
+        arPriv->scan_request = NULL;
+    }
+}
+
+static int
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+ar6k_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, bool pairwise, const A_UINT8 *mac_addr,
+                      struct key_params *params)
+#else
+ar6k_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, const A_UINT8 *mac_addr,
+                      struct key_params *params)
+#endif
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    struct ar_key *key = NULL;
+    A_UINT8 key_usage;
+    A_UINT8 key_type;
+    A_STATUS status = 0;
+#ifdef CFG80211_WAPI_ENABLE
+	A_UINT32    *PN;
+    A_INT32     i;
+    A_UINT8     wapiKeyRsc[16] = {0};
+	#define PN_INIT 0x5c365c36
+#endif
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s:\n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    key = &arPriv->keys[key_index];
+    A_MEMZERO(key, sizeof(struct ar_key));
+
+    if(!mac_addr || is_broadcast_ether_addr(mac_addr)) {
+        key_usage = GROUP_USAGE;
+    } else {
+        key_usage = PAIRWISE_USAGE;
+    }
+
+    if(params) {
+        if(params->key_len > WLAN_MAX_KEY_LEN ||
+            params->seq_len > IW_ENCODE_SEQ_MAX_SIZE)
+            return -EINVAL;
+
+        key->key_len = params->key_len;
+        A_MEMCPY(key->key, params->key, key->key_len);
+        key->seq_len = params->seq_len;
+        A_MEMCPY(key->seq, params->seq, key->seq_len);
+        key->cipher = params->cipher;
+    }
+
+    switch (key->cipher) {
+    case WLAN_CIPHER_SUITE_WEP40:
+    case WLAN_CIPHER_SUITE_WEP104:
+        key_type = WEP_CRYPT;
+        break;
+
+    case WLAN_CIPHER_SUITE_TKIP:
+        key_type = TKIP_CRYPT;
+        break;
+
+    case WLAN_CIPHER_SUITE_CCMP:
+        key_type = AES_CRYPT;
+        break;
+
+    default:
+        return -ENOTSUPP;
+    }
+
+    if (((WMI_WPA_PSK_AUTH == arPriv->arAuthMode) || (WMI_WPA2_PSK_AUTH == arPriv->arAuthMode)) &&
+        (GROUP_USAGE & key_usage))
+    {
+        A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: index %d, key_len %d, key_type 0x%x,"\
+                    " key_usage 0x%x, seq_len %d\n",
+                    __func__, key_index, key->key_len, key_type,
+                    key_usage, key->seq_len));
+    arPriv->arDefTxKeyIndex = key_index;
+
+#ifdef CFG80211_WAPI_ENABLE
+	key_type  = WAPI_CRYPT;
+	key_usage = 0;
+	if (is_broadcast_ether_addr(mac_addr)) {
+        key_usage |= GROUP_USAGE;
+        PN = (A_UINT32 *)wapiKeyRsc;
+        for (i = 0; i < 4; i++) {
+            PN[i] = PN_INIT;
+        }
+    } else {
+        key_usage |= PAIRWISE_USAGE;
+    }	
+    status = wmi_addKey_cmd(arPriv->arWmi, arPriv->arDefTxKeyIndex, key_type, key_usage,
+                    key->key_len, wapiKeyRsc, key->key, KEY_OP_INIT_VAL,
+                    (A_UINT8*)mac_addr, SYNC_BOTH_WMIFLAG);
+#else
+    status = wmi_addKey_cmd(arPriv->arWmi, arPriv->arDefTxKeyIndex, key_type, key_usage,
+                    key->key_len, key->seq, key->key, KEY_OP_INIT_VAL,
+                    (A_UINT8*)mac_addr, SYNC_BOTH_WMIFLAG);
+#endif
+
+
+    if(status != A_OK) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+ar6k_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, bool pairwise, const A_UINT8 *mac_addr)
+#else
+ar6k_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, const A_UINT8 *mac_addr)
+#endif
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    if(!arPriv->keys[key_index].key_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d is empty\n", __func__, key_index));
+        return 0;
+    }
+
+    arPriv->keys[key_index].key_len = 0;
+
+    return wmi_deleteKey_cmd(arPriv->arWmi, key_index);
+}
+
+
+static int
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+ar6k_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, bool pairwise, const A_UINT8 *mac_addr,
+                      void *cookie,
+                      void (*callback)(void *cookie, struct key_params*))
+#else
+ar6k_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
+                      A_UINT8 key_index, const A_UINT8 *mac_addr, void *cookie,
+                      void (*callback)(void *cookie, struct key_params*))
+#endif
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    struct ar_key *key = NULL;
+    struct key_params params;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n", __func__, key_index));
+        return -ENOENT;
+    }
+
+    key = &arPriv->keys[key_index];
+    A_MEMZERO(&params, sizeof(params));
+    params.cipher = key->cipher;
+    params.key_len = key->key_len;
+    params.seq_len = key->seq_len;
+    params.seq = key->seq;
+    params.key = key->key;
+
+    callback(cookie, &params);
+
+    return key->key_len ? 0 : -ENOENT;
+}
+
+
+static int
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)
+ar6k_cfg80211_set_default_key(struct wiphy *wiphy, struct net_device *ndev,
+                              A_UINT8 key_index,bool unicast, bool multicast)
+#else
+ar6k_cfg80211_set_default_key(struct wiphy *wiphy, struct net_device *ndev,
+                              A_UINT8 key_index)
+#endif
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    struct ar_key *key = NULL;
+    A_STATUS status = A_OK;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(key_index < WMI_MIN_KEY_INDEX || key_index > WMI_MAX_KEY_INDEX) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                        ("%s: key index %d out of bounds\n",
+                        __func__, key_index));
+        return -ENOENT;
+    }
+
+    if(!arPriv->keys[key_index].key_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: invalid key index %d\n",
+                        __func__, key_index));
+        return -EINVAL;
+    }
+
+    arPriv->arDefTxKeyIndex = key_index;
+    key = &arPriv->keys[arPriv->arDefTxKeyIndex];
+#ifdef CFG80211_WAPI_ENABLE
+	/*if WAPI enable, we donot need to set it*/
+#else
+    status = wmi_addKey_cmd(arPriv->arWmi, arPriv->arDefTxKeyIndex,
+                            arPriv->arPairwiseCrypto, GROUP_USAGE | TX_USAGE,
+                            key->key_len, key->seq, key->key, KEY_OP_INIT_VAL,
+                            NULL, SYNC_BOTH_WMIFLAG);
+    if (status != A_OK) {
+        return -EIO;
+    }
+#endif
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_default_mgmt_key(struct wiphy *wiphy, struct net_device *ndev,
+                                   A_UINT8 key_index)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: index %d\n", __func__, key_index));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+    return -ENOTSUPP;
+}
+
+void
+ar6k_cfg80211_tkip_micerr_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 keyid, A_BOOL ismcast)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO,
+                    ("%s: keyid %d, ismcast %d\n", __func__, keyid, ismcast));
+
+    cfg80211_michael_mic_failure(arPriv->arNetDev, arPriv->arBssid,
+                                 (ismcast ? NL80211_KEYTYPE_GROUP : NL80211_KEYTYPE_PAIRWISE),
+                                 keyid, NULL, GFP_KERNEL);
+}
+
+static int
+ar6k_cfg80211_set_wiphy_params(struct wiphy *wiphy, A_UINT32 changed)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)wiphy_priv(wiphy);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: changed 0x%x\n", __func__, changed));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+        if (wmi_set_rts_cmd(arPriv->arWmi,wiphy->rts_threshold) != A_OK){
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_set_rts_cmd failed\n", __func__));
+            return -EIO;
+        }
+    }
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *dev,
+                               const A_UINT8 *peer,
+                               const struct cfg80211_bitrate_mask *mask)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,34)
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_STATUS status;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: mask 0x%x\n", __func__, mask->fixed));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    status = wmi_set_fixrates_cmd(arPriv->arWmi, mask->fixed);
+
+    if(status == A_EINVAL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: invalid params\n", __func__));
+        return -EINVAL;
+    } else if(status != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_set_fixrates_cmd failed\n", __func__));
+        return -EIO;
+    }
+
+    return 0;
+#else
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Setting rates: Not supported\n"));
+    return -EIO;
+#endif
+}
+
+/* The type nl80211_tx_power_setting replaces the following data type from 2.6.36 onwards */
+static int
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+ar6k_cfg80211_set_txpower(struct wiphy *wiphy, enum nl80211_tx_power_setting type, int dbm)
+#else
+ar6k_cfg80211_set_txpower(struct wiphy *wiphy, enum tx_power_setting type, int dbm)
+#endif
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)wiphy_priv(wiphy);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_UINT8 ar_dbm;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type 0x%x, dbm %d\n", __func__, type, dbm));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    arPriv->arTxPwrSet = FALSE;
+    switch(type) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+    case NL80211_TX_POWER_AUTOMATIC:
+#else
+    case TX_POWER_AUTOMATIC:
+#endif
+        return 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)
+    case NL80211_TX_POWER_LIMITED:
+#else
+    case TX_POWER_LIMITED:
+#endif
+        arPriv->arTxPwr = ar_dbm = dbm;
+        arPriv->arTxPwrSet = TRUE;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type 0x%x not supported\n", __func__, type));
+        return -EOPNOTSUPP;
+    }
+
+    wmi_set_txPwr_cmd(arPriv->arWmi, ar_dbm);
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_get_txpower(struct wiphy *wiphy, int *dbm)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)wiphy_priv(wiphy);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if((arPriv->arConnected == TRUE)) {
+        arPriv->arTxPwr = 0;
+
+        if(wmi_get_txPwr_cmd(arPriv->arWmi) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_get_txPwr_cmd failed\n", __func__));
+            return -EIO;
+        }
+
+        wait_event_interruptible_timeout(arPriv->arEvent, arPriv->arTxPwr != 0, 5 * HZ);
+
+        if(signal_pending(current)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Target did not respond\n", __func__));
+            return -EINTR;
+        }
+    }
+
+    *dbm = arPriv->arTxPwr;
+    return 0;
+}
+
+static int
+ar6k_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+                             struct net_device *dev,
+                             bool pmgmt, int timeout)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_POWER_MODE_CMD pwrMode;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: pmgmt %d, timeout %d\n", __func__, pmgmt, timeout));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(!pmgmt) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Max Perf\n", __func__));
+        pwrMode.powerMode = MAX_PERF_POWER;
+    } else {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Rec Power\n", __func__));
+        pwrMode.powerMode = REC_POWER;
+    }
+
+    if(wmi_powermode_cmd(arPriv->arWmi, pwrMode.powerMode) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: wmi_powermode_cmd failed\n", __func__));
+        return -EIO;
+    }
+
+    return 0;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)
+struct net_device *
+ar6k_cfg80211_add_virtual_intf(struct wiphy *wiphy, char *name,
+                                            enum nl80211_iftype type, u32 *flags,
+                                            struct vif_params *params)
+#else
+static int
+ar6k_cfg80211_add_virtual_intf(struct wiphy *wiphy, char *name,
+            				    enum nl80211_iftype type, u32 *flags,
+            				    struct vif_params *params)
+#endif
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+
+    /* Multiple virtual interface is not supported.
+     * The default interface supports STA and IBSS type
+     */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)
+    return NULL;
+#else
+    return -EOPNOTSUPP;
+#endif
+}
+
+static int
+ar6k_cfg80211_del_virtual_intf(struct wiphy *wiphy, struct net_device *dev)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: not supported\n", __func__));
+
+    /* Multiple virtual interface is not supported.
+     * The default interface supports STA and IBSS type
+     */
+    return -EOPNOTSUPP;
+}
+
+static int
+ar6k_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
+                           enum nl80211_iftype type, u32 *flags,
+                           struct vif_params *params)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(ndev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    struct wireless_dev *wdev = arPriv->wdev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: type %u\n", __func__, type));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    switch (type) {
+    case NL80211_IFTYPE_STATION:
+        arPriv->arNextMode = INFRA_NETWORK;
+        break;
+    case NL80211_IFTYPE_ADHOC:
+        arPriv->arNextMode = ADHOC_NETWORK;
+        break;
+    default:
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: type %u\n", __func__, type));
+        return -EOPNOTSUPP;
+    }
+
+    wdev->iftype = type;
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+                        struct cfg80211_ibss_params *ibss_param)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta;
+    A_STATUS status;
+
+    arSta  = &arPriv->arSta;
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    if(!ibss_param->ssid_len || IEEE80211_MAX_SSID_LEN < ibss_param->ssid_len) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: ssid invalid\n", __func__));
+        return -EINVAL;
+    }
+
+    arPriv->arSsidLen = ibss_param->ssid_len;
+    A_MEMCPY(arPriv->arSsid, ibss_param->ssid, arPriv->arSsidLen);
+
+    if(ibss_param->channel) {
+        arPriv->arChannelHint = ibss_param->channel->center_freq;
+    }
+
+    if(ibss_param->channel_fixed) {
+        /* TODO: channel_fixed: The channel should be fixed, do not search for
+         * IBSSs to join on other channels. Target firmware does not support this
+         * feature, needs to be updated.*/
+    }
+
+    A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+    if(ibss_param->bssid) {
+        if(A_MEMCMP(&ibss_param->bssid, bcast_mac, AR6000_ETH_ADDR_LEN)) {
+            A_MEMCPY(arSta->arReqBssid, ibss_param->bssid, sizeof(arSta->arReqBssid));
+        }
+    }
+
+    ar6k_set_wpa_version(arPriv, 0);
+    ar6k_set_auth_type(arPriv, NL80211_AUTHTYPE_OPEN_SYSTEM);
+
+    if(ibss_param->privacy) {
+        ar6k_set_cipher(arPriv, WLAN_CIPHER_SUITE_WEP40, true);
+        ar6k_set_cipher(arPriv, WLAN_CIPHER_SUITE_WEP40, false);
+    } else {
+        ar6k_set_cipher(arPriv, IW_AUTH_CIPHER_NONE, true);
+        ar6k_set_cipher(arPriv, IW_AUTH_CIPHER_NONE, false);
+    }
+
+    arPriv->arNetworkType = arPriv->arNextMode;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: Connect called with authmode %d dot11 auth %d"\
+                    " PW crypto %d PW crypto Len %d GRP crypto %d"\
+                    " GRP crypto Len %d channel hint %u\n",
+                    __func__, arPriv->arAuthMode, arPriv->arDot11AuthMode,
+                    arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                    arPriv->arGroupCrypto, arPriv->arGroupCryptoLen, arPriv->arChannelHint));
+
+    status = wmi_connect_cmd(arPriv->arWmi, arPriv->arNetworkType,
+                            arPriv->arDot11AuthMode, arPriv->arAuthMode,
+                            arPriv->arPairwiseCrypto, arPriv->arPairwiseCryptoLen,
+                            arPriv->arGroupCrypto,arPriv->arGroupCryptoLen,
+                            arPriv->arSsidLen, arPriv->arSsid,
+                            arSta->arReqBssid, arPriv->arChannelHint,
+                            arSta->arConnectCtrlFlags);
+    arSta->arConnectPending = TRUE;
+
+    return 0;
+}
+
+static int
+ar6k_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(ar->arWmiReady == FALSE) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wmi not ready\n", __func__));
+        return -EIO;
+    }
+
+    if(ar->arWlanState == WLAN_DISABLED) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("%s: Wlan disabled\n", __func__));
+        return -EIO;
+    }
+
+    ar6000_disconnect(arPriv);
+    A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+    arPriv->arSsidLen = 0;
+
+    return 0;
+}
+
+
+static const
+A_UINT32 cipher_suites[] = {
+    WLAN_CIPHER_SUITE_WEP40,
+    WLAN_CIPHER_SUITE_WEP104,
+    WLAN_CIPHER_SUITE_TKIP,
+    WLAN_CIPHER_SUITE_CCMP,
+};
+
+static struct
+cfg80211_ops ar6k_cfg80211_ops = {
+    .change_virtual_intf = ar6k_cfg80211_change_iface,
+    .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
+    .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
+    .scan = ar6k_cfg80211_scan,
+    .connect = ar6k_cfg80211_connect,
+    .disconnect = ar6k_cfg80211_disconnect,
+    .add_key = ar6k_cfg80211_add_key,
+    .get_key = ar6k_cfg80211_get_key,
+    .del_key = ar6k_cfg80211_del_key,
+    .set_default_key = ar6k_cfg80211_set_default_key,
+    .set_default_mgmt_key = ar6k_cfg80211_set_default_mgmt_key,
+    .set_wiphy_params = ar6k_cfg80211_set_wiphy_params,
+    .set_bitrate_mask = ar6k_cfg80211_set_bitrate_mask,
+    .set_tx_power = ar6k_cfg80211_set_txpower,
+    .get_tx_power = ar6k_cfg80211_get_txpower,
+    .set_power_mgmt = ar6k_cfg80211_set_power_mgmt,
+    .join_ibss = ar6k_cfg80211_join_ibss,
+    .leave_ibss = ar6k_cfg80211_leave_ibss,
+};
+
+struct wireless_dev *
+ar6k_cfg80211_init(struct device *dev)
+{
+    int ret = 0;
+    struct wireless_dev *wdev;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+    if(!wdev) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't allocate wireless device\n", __func__));
+        return ERR_PTR(-ENOMEM);
+    }
+
+    /* create a new wiphy for use with cfg80211 */
+    wdev->wiphy = wiphy_new(&ar6k_cfg80211_ops, sizeof(AR_SOFTC_T));
+    if(!wdev->wiphy) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't allocate wiphy device\n", __func__));
+        kfree(wdev);
+        return ERR_PTR(-ENOMEM);
+    }
+
+    /* set device pointer for wiphy */
+    set_wiphy_dev(wdev->wiphy, dev);
+
+    wdev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                   BIT(NL80211_IFTYPE_ADHOC);
+    /* max num of ssids that can be probed during scanning */
+    wdev->wiphy->max_scan_ssids = MAX_PROBED_SSID_INDEX;
+    wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &ar6k_band_2ghz;
+    wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &ar6k_band_5ghz;
+    wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+    wdev->wiphy->cipher_suites = cipher_suites;
+    wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+    ret = wiphy_register(wdev->wiphy);
+    if(ret < 0) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                        ("%s: Couldn't register wiphy device\n", __func__));
+        wiphy_free(wdev->wiphy);
+        return ERR_PTR(ret);
+    }
+
+    return wdev;
+}
+
+void
+ar6k_cfg80211_deinit(AR_SOFTC_DEV_T *arPriv)
+{
+    struct wireless_dev *wdev = arPriv->wdev;
+
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("%s: \n", __func__));
+
+    if(arPriv->scan_request) {
+        cfg80211_scan_done(arPriv->scan_request, true);
+        arPriv->scan_request = NULL;
+    }
+
+    if(!wdev)
+        return;
+
+    wiphy_unregister(wdev->wiphy);
+    wiphy_free(wdev->wiphy);
+    kfree(wdev);
+}
+
+
+
+
+
+
+
diff --git a/host/os/linux/eeprom.c b/host/os/linux/eeprom.c
new file mode 100644
index 0000000..fb086b4
--- /dev/null
+++ b/host/os/linux/eeprom.c
@@ -0,0 +1,572 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+
+#include "ar6000_drv.h"
+#include "htc.h"
+#include <linux/fs.h>
+
+#include "target_reg_table.h"
+#include "host_reg_table.h
+//
+// defines
+//
+
+#define MAX_FILENAME 1023
+#define EEPROM_WAIT_LIMIT 16 
+
+#define EEPROM_SZ 768
+
+/* soft mac */
+#define ATH_MAC_LEN                         6
+#define ATH_SOFT_MAC_TMP_BUF_LEN            64
+unsigned char mac_addr[ATH_MAC_LEN];
+unsigned char soft_mac_tmp_buf[ATH_SOFT_MAC_TMP_BUF_LEN];
+char *p_mac = NULL;
+/* soft mac */
+
+//
+// static variables
+//
+
+static A_UCHAR eeprom_data[EEPROM_SZ];
+static A_UINT32 sys_sleep_reg;
+static HIF_DEVICE *p_bmi_device;
+
+//
+// Functions
+//
+
+/* soft mac */
+static int
+wmic_ether_aton(const char *orig, A_UINT8 *eth)
+{
+  const char *bufp;
+  int i;
+
+  i = 0;
+  for(bufp = orig; *bufp != '\0'; ++bufp) {
+    unsigned int val;
+    unsigned char c = *bufp++;
+    if (c >= '0' && c <= '9') val = c - '0';
+    else if (c >= 'a' && c <= 'f') val = c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val = c - 'A' + 10;
+    else {
+        printk("%s: MAC value is invalid\n", __FUNCTION__);
+        break;
+    }
+
+    val <<= 4;
+    c = *bufp++;
+    if (c >= '0' && c <= '9') val |= c - '0';
+    else if (c >= 'a' && c <= 'f') val |= c - 'a' + 10;
+    else if (c >= 'A' && c <= 'F') val |= c - 'A' + 10;
+    else {
+        printk("%s: MAC value is invalid\n", __FUNCTION__);
+        break;
+    }
+
+    eth[i] = (unsigned char) (val & 0377);
+    if(++i == ATH_MAC_LEN) {
+	    /* That's it.  Any trailing junk? */
+	    if (*bufp != '\0') {
+		    return 0;
+	    }
+	    return 1;
+    }
+    if (*bufp != ':')
+	    break;
+  }
+  return 0;
+}
+
+static void
+update_mac(unsigned char* eeprom, int size, unsigned char* macaddr)
+{
+	int i;
+	A_UINT16* ptr = (A_UINT16*)(eeprom+4);
+	A_UINT16  checksum = 0;
+
+	memcpy(eeprom+10,macaddr,6);
+
+	*ptr = 0;
+	ptr = (A_UINT16*)eeprom;
+
+	for (i=0; i<size; i+=2) {
+		checksum ^= *ptr++;
+	}
+	checksum = ~checksum;
+
+	ptr = (A_UINT16*)(eeprom+4);
+	*ptr = checksum;
+	return;
+}
+/* soft mac */
+
+/* Read a Target register and return its value. */
+inline void
+BMI_read_reg(A_UINT32 address, A_UINT32 *pvalue)
+{
+    BMIReadSOCRegister(p_bmi_device, address, pvalue);
+}
+
+/* Write a value to a Target register. */
+inline void
+BMI_write_reg(A_UINT32 address, A_UINT32 value)
+{
+    BMIWriteSOCRegister(p_bmi_device, address, value);
+}
+
+/* Read Target memory word and return its value. */
+inline void
+BMI_read_mem(A_UINT32 address, A_UINT32 *pvalue)
+{
+    BMIReadMemory(p_bmi_device, address, (A_UCHAR*)(pvalue), 4);
+}
+
+/* Write a word to a Target memory. */
+inline void
+BMI_write_mem(A_UINT32 address, A_UINT8 *p_data, A_UINT32 sz)
+{
+    BMIWriteMemory(p_bmi_device, address, (A_UCHAR*)(p_data), sz); 
+}
+
+/*
+ * Enable and configure the Target's Serial Interface
+ * so we can access the EEPROM.
+ */
+static void
+enable_SI(HIF_DEVICE *p_device)
+{
+    A_UINT32 regval;
+
+    printk("%s\n", __FUNCTION__);
+
+    p_bmi_device = p_device;
+
+    BMI_read_reg(RTC_WMAC_BASE_ADDRESS+WLAN_SYSTEM_SLEEP_OFFSET, &sys_sleep_reg);
+    BMI_write_reg(RTC_WMAC_BASE_ADDRESS+WLAN_SYSTEM_SLEEP_OFFSET, SYSTEM_SLEEP_DISABLE_SET(1)); //disable system sleep temporarily
+
+    BMI_read_reg(RTC_SOC_BASE_ADDRESS+CLOCK_CONTROL_OFFSET, &regval);
+    regval &= ~CLOCK_CONTROL_SI0_CLK_MASK;
+    BMI_write_reg(RTC_SOC_BASE_ADDRESS+CLOCK_CONTROL_OFFSET, regval);
+
+    BMI_read_reg(RTC_SOC_BASE_ADDRESS+RESET_CONTROL_OFFSET, &regval);
+    regval &= ~RESET_CONTROL_SI0_RST_MASK;
+    BMI_write_reg(RTC_SOC_BASE_ADDRESS+RESET_CONTROL_OFFSET, regval);
+
+
+    BMI_read_reg(GPIO_BASE_ADDRESS+GPIO_PIN0_OFFSET, &regval);
+    regval &= ~GPIO_PIN0_CONFIG_MASK;
+    BMI_write_reg(GPIO_BASE_ADDRESS+GPIO_PIN0_OFFSET, regval);
+
+    BMI_read_reg(GPIO_BASE_ADDRESS+GPIO_PIN1_OFFSET, &regval);
+    regval &= ~GPIO_PIN1_CONFIG_MASK;
+    BMI_write_reg(GPIO_BASE_ADDRESS+GPIO_PIN1_OFFSET, regval);
+
+    /* SI_CONFIG = 0x500a6; */
+    regval =    SI_CONFIG_BIDIR_OD_DATA_SET(1)  |
+                SI_CONFIG_I2C_SET(1)            |
+                SI_CONFIG_POS_SAMPLE_SET(1)     |
+                SI_CONFIG_INACTIVE_CLK_SET(1)   |
+                SI_CONFIG_INACTIVE_DATA_SET(1)   |
+                SI_CONFIG_DIVIDER_SET(6);
+    BMI_write_reg(SI_BASE_ADDRESS+SI_CONFIG_OFFSET, regval);
+    
+}
+
+static void
+disable_SI(void)
+{
+    A_UINT32 regval;
+    
+    printk("%s\n", __FUNCTION__);
+
+    BMI_write_reg(RTC_SOC_BASE_ADDRESS+RESET_CONTROL_OFFSET, RESET_CONTROL_SI0_RST_MASK);
+    BMI_read_reg(RTC_SOC_BASE_ADDRESS+CLOCK_CONTROL_OFFSET, &regval);
+    regval |= CLOCK_CONTROL_SI0_CLK_MASK;
+    BMI_write_reg(RTC_SOC_BASE_ADDRESS+CLOCK_CONTROL_OFFSET, regval);//Gate SI0 clock
+    BMI_write_reg(RTC_WMAC_BASE_ADDRESS+WLAN_SYSTEM_SLEEP_OFFSET, sys_sleep_reg); //restore system sleep setting
+}
+
+/*
+ * Tell the Target to start an 8-byte read from EEPROM,
+ * putting the results in Target RX_DATA registers.
+ */
+static void
+request_8byte_read(int offset)
+{
+    A_UINT32 regval;
+
+//    printk("%s: request_8byte_read from offset 0x%x\n", __FUNCTION__, offset);
+
+    
+    /* SI_TX_DATA0 = read from offset */
+        regval =(0xa1<<16)|
+                ((offset & 0xff)<<8)    |
+                (0xa0 | ((offset & 0xff00)>>7));
+    
+        BMI_write_reg(SI_BASE_ADDRESS+SI_TX_DATA0_OFFSET, regval);
+
+        regval = SI_CS_START_SET(1)      |
+                SI_CS_RX_CNT_SET(8)     |
+                SI_CS_TX_CNT_SET(3);
+        BMI_write_reg(SI_BASE_ADDRESS+SI_CS_OFFSET, regval);
+}
+
+/*
+ * Tell the Target to start a 4-byte write to EEPROM,
+ * writing values from Target TX_DATA registers.
+ */
+static void
+request_4byte_write(int offset, A_UINT32 data)
+{
+    A_UINT32 regval;
+
+    printk("%s: request_4byte_write (0x%x) to offset 0x%x\n", __FUNCTION__, data, offset);
+
+        /* SI_TX_DATA0 = write data to offset */
+        regval =    ((data & 0xffff) <<16)    |
+                ((offset & 0xff)<<8)    |
+                (0xa0 | ((offset & 0xff00)>>7));
+        BMI_write_reg(SI_BASE_ADDRESS+SI_TX_DATA0_OFFSET, regval);
+
+        regval =    data >> 16;
+        BMI_write_reg(SI_BASE_ADDRESS+SI_TX_DATA1_OFFSET, regval);
+
+        regval =    SI_CS_START_SET(1)      |
+                SI_CS_RX_CNT_SET(0)     |
+                SI_CS_TX_CNT_SET(6);
+        BMI_write_reg(SI_BASE_ADDRESS+SI_CS_OFFSET, regval);
+}
+
+/*
+ * Check whether or not an EEPROM request that was started
+ * earlier has completed yet.
+ */
+static A_BOOL
+request_in_progress(void)
+{
+    A_UINT32 regval;
+
+    /* Wait for DONE_INT in SI_CS */
+    BMI_read_reg(SI_BASE_ADDRESS+SI_CS_OFFSET, &regval);
+
+//    printk("%s: request in progress SI_CS=0x%x\n", __FUNCTION__, regval);
+    if (regval & SI_CS_DONE_ERR_MASK) {
+        printk("%s: EEPROM signaled ERROR (0x%x)\n", __FUNCTION__, regval);
+    }
+
+    return (!(regval & SI_CS_DONE_INT_MASK));
+}
+
+/*
+ * try to detect the type of EEPROM,16bit address or 8bit address
+ */
+
+static void eeprom_type_detect(void)
+{
+    A_UINT32 regval;
+    A_UINT8 i = 0;
+
+    request_8byte_read(0x100);
+   /* Wait for DONE_INT in SI_CS */
+    do{
+        BMI_read_reg(SI_BASE_ADDRESS+SI_CS_OFFSET, &regval);
+        if (regval & SI_CS_DONE_ERR_MASK) {
+            printk("%s: ERROR : address type was wrongly set\n", __FUNCTION__);     
+            break;
+        }
+        if (i++ == EEPROM_WAIT_LIMIT) {
+            printk("%s: EEPROM not responding\n", __FUNCTION__);
+        }
+    } while(!(regval & SI_CS_DONE_INT_MASK));
+}
+
+/*
+ * Extract the results of a completed EEPROM Read request
+ * and return them to the caller.
+ */
+inline void
+read_8byte_results(A_UINT32 *data)
+{
+    /* Read SI_RX_DATA0 and SI_RX_DATA1 */
+    BMI_read_reg(SI_BASE_ADDRESS+SI_RX_DATA0_OFFSET, &data[0]);
+    BMI_read_reg(SI_BASE_ADDRESS+SI_RX_DATA1_OFFSET, &data[1]);
+}
+
+
+/*
+ * Wait for a previously started command to complete.
+ * Timeout if the command is takes "too long".
+ */
+static void
+wait_for_eeprom_completion(void)
+{
+    int i=0;
+
+    while (request_in_progress()) {
+        if (i++ == EEPROM_WAIT_LIMIT) {
+            printk("%s: EEPROM not responding\n", __FUNCTION__);
+        }
+    }
+}
+
+/*
+ * High-level function which starts an 8-byte read,
+ * waits for it to complete, and returns the result.
+ */
+static void
+fetch_8bytes(int offset, A_UINT32 *data)
+{
+    request_8byte_read(offset);
+    wait_for_eeprom_completion();
+    read_8byte_results(data);
+
+    /* Clear any pending intr */
+    BMI_write_reg(SI_BASE_ADDRESS+SI_CS_OFFSET, SI_CS_DONE_INT_MASK);
+}
+
+/*
+ * High-level function which starts a 4-byte write,
+ * and waits for it to complete.
+ */
+inline void
+commit_4bytes(int offset, A_UINT32 data)
+{
+    request_4byte_write(offset, data);
+    wait_for_eeprom_completion();
+}
+/* ATHENV */
+#ifdef ANDROID_ENV
+void eeprom_ar6000_transfer(HIF_DEVICE *device, char *fake_file, char *p_mac)
+{
+    A_UINT32 first_word;
+    A_UINT32 board_data_addr;
+    int i;
+
+    printk("%s: Enter\n", __FUNCTION__);
+
+    enable_SI(device);
+    eeprom_type_detect();
+
+    if (fake_file) {
+        /*
+         * Transfer from file to Target RAM.
+         * Fetch source data from file.
+         */
+        mm_segment_t		oldfs;
+        struct file		*filp;
+        struct inode		*inode = NULL;
+        int			length;
+
+        /* open file */
+        oldfs = get_fs();
+        set_fs(KERNEL_DS);
+        filp = filp_open(fake_file, O_RDONLY, S_IRUSR);
+
+        if (IS_ERR(filp)) {
+            printk("%s: file %s filp_open error\n", __FUNCTION__, fake_file);
+            set_fs(oldfs);
+            return;
+        }
+
+        if (!filp->f_op) {
+            printk("%s: File Operation Method Error\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+
+        inode = GET_INODE_FROM_FILEP(filep);
+        if (!inode) {
+            printk("%s: Get inode from filp failed\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+
+        printk("%s file offset opsition: %xh\n", __FUNCTION__, (unsigned)filp->f_pos);
+
+        /* file's size */
+        length = i_size_read(inode->i_mapping->host);
+        printk("%s: length=%d\n", __FUNCTION__, length);
+        if (length != EEPROM_SZ) {
+            printk("%s: The file's size is not as expected\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+
+        /* read data */
+        if (filp->f_op->read(filp, eeprom_data, length, &filp->f_pos) != length) {
+            printk("%s: file read error\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+
+        /* read data out successfully */
+        filp_close(filp, NULL);
+        set_fs(oldfs);
+    } else {
+        /*
+         * Read from EEPROM to file OR transfer from EEPROM to Target RAM.
+         * Fetch EEPROM_SZ Bytes of Board Data, 8 bytes at a time.
+         */
+
+        fetch_8bytes(0, (A_UINT32 *)(&eeprom_data[0]));
+
+        /* Check the first word of EEPROM for validity */
+        first_word = *((A_UINT32 *)eeprom_data);
+
+        if ((first_word == 0) || (first_word == 0xffffffff)) {
+            printk("Did not find EEPROM with valid Board Data.\n");
+        }
+
+        for (i=8; i<EEPROM_SZ; i+=8) {
+            fetch_8bytes(i, (A_UINT32 *)(&eeprom_data[i]));
+        }
+    }
+
+    /* soft mac */
+    if (p_mac) {
+
+        mm_segment_t		oldfs;
+        struct file		*filp;
+        struct inode		*inode = NULL;
+        int			length;
+        
+        /* open file */
+        oldfs = get_fs();
+        set_fs(KERNEL_DS);
+        filp = filp_open(p_mac, O_RDONLY, S_IRUSR);
+        
+        printk("%s try to open file %s\n", __FUNCTION__, p_mac);
+
+        if (IS_ERR(filp)) {
+            printk("%s: file %s filp_open error\n", __FUNCTION__, p_mac);
+            set_fs(oldfs);
+            return;
+        }
+        
+        if (!filp->f_op) {
+            printk("%s: File Operation Method Error\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+        
+        inode = GET_INODE_FROM_FILEP(filep);
+        if (!inode) {
+            printk("%s: Get inode from filp failed\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+        
+        printk("%s file offset opsition: %xh\n", __FUNCTION__, (unsigned)filp->f_pos);
+        
+        /* file's size */
+        length = i_size_read(inode->i_mapping->host);
+        printk("%s: length=%d\n", __FUNCTION__, length);
+        if (length > ATH_SOFT_MAC_TMP_BUF_LEN) {
+            printk("%s: MAC file's size is not as expected\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+        
+        /* read data */
+        if (filp->f_op->read(filp, soft_mac_tmp_buf, length, &filp->f_pos) != length) {
+            printk("%s: file read error\n", __FUNCTION__);
+            filp_close(filp, NULL);
+            set_fs(oldfs);
+            return;
+        }
+
+#if 0
+        /* the data we just read */
+        printk("%s: mac address from the file:\n", __FUNCTION__);
+        for (i = 0; i < length; i++)
+            printk("[%c(0x%x)],", soft_mac_tmp_buf[i], soft_mac_tmp_buf[i]);
+        printk("\n");
+#endif
+
+        /* read data out successfully */
+        filp_close(filp, NULL);
+        set_fs(oldfs);
+
+        /* convert mac address */
+        if (!wmic_ether_aton(soft_mac_tmp_buf, mac_addr)) {
+            printk("%s: convert mac value fail\n", __FUNCTION__);
+            return;
+        }
+
+#if 0
+        /* the converted mac address */
+        printk("%s: the converted mac value\n", __FUNCTION__);
+        for (i = 0; i < ATH_MAC_LEN; i++)
+            printk("[0x%x],", mac_addr[i]);
+        printk("\n");
+#endif
+    }
+    /* soft mac */
+
+    /* Determine where in Target RAM to write Board Data */
+    BMI_read_mem( AR6002_HOST_INTEREST_ITEM_ADDRESS(hi_board_data), &board_data_addr);
+    if (board_data_addr == 0) {
+        printk("hi_board_data is zero\n");
+    }
+
+    /* soft mac */
+#if 1
+    /* Update MAC address in RAM */
+    if (p_mac) {
+	    update_mac(eeprom_data, EEPROM_SZ, mac_addr);
+    }
+#endif
+#if 0
+    /* mac address in eeprom array */
+    printk("%s: mac values in eeprom array\n", __FUNCTION__);
+    for (i = 10; i < 10 + 6; i++)
+        printk("[0x%x],", eeprom_data[i]);
+    printk("\n");
+#endif
+    /* soft mac */
+
+    /* Write EEPROM data to Target RAM */
+    BMI_write_mem(board_data_addr, ((A_UINT8 *)eeprom_data), EEPROM_SZ);
+
+    /* Record the fact that Board Data IS initialized */
+    {
+       A_UINT32 one = 1;
+       BMI_write_mem(AR6002_HOST_INTEREST_ITEM_ADDRESS(hi_board_data_initialized),
+                     (A_UINT8 *)&one, sizeof(A_UINT32));
+    }
+
+    disable_SI();
+}
+#endif
+/* ATHENV */
+
diff --git a/host/os/linux/export_hci_transport.c b/host/os/linux/export_hci_transport.c
new file mode 100644
index 0000000..c44311b
--- /dev/null
+++ b/host/os/linux/export_hci_transport.c
@@ -0,0 +1,122 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_types.h"
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "a_drv.h"
+#include "hif.h"
+#include "common_drv.h"
+#include "a_debug.h"
+#include "hci_transport_api.h"
+
+
+HCI_TRANSPORT_HANDLE (*_HCI_TransportAttach)(void *HTCHandle, HCI_TRANSPORT_CONFIG_INFO *pInfo);
+void (*_HCI_TransportDetach)(HCI_TRANSPORT_HANDLE HciTrans);
+A_STATUS    (*_HCI_TransportAddReceivePkts)(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET_QUEUE *pQueue);
+A_STATUS    (*_HCI_TransportSendPkt)(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET *pPacket, A_BOOL Synchronous);
+void        (*_HCI_TransportStop)(HCI_TRANSPORT_HANDLE HciTrans);
+A_STATUS    (*_HCI_TransportStart)(HCI_TRANSPORT_HANDLE HciTrans);
+A_STATUS    (*_HCI_TransportEnableDisableAsyncRecv)(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+A_STATUS    (*_HCI_TransportRecvHCIEventSync)(HCI_TRANSPORT_HANDLE HciTrans, 
+                                          HTC_PACKET           *pPacket,
+                                          int                  MaxPollMS);
+A_STATUS    (*_HCI_TransportSetBaudRate)(HCI_TRANSPORT_HANDLE HciTrans, A_UINT32 Baud);
+A_STATUS    (*_HCI_TransportEnablePowerMgmt)(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+
+extern HCI_TRANSPORT_CALLBACKS ar6kHciTransCallbacks;
+
+A_STATUS ar6000_register_hci_transport(HCI_TRANSPORT_CALLBACKS *hciTransCallbacks)
+{
+    ar6kHciTransCallbacks = *hciTransCallbacks;
+
+    _HCI_TransportAttach = HCI_TransportAttach;
+    _HCI_TransportDetach = HCI_TransportDetach;
+    _HCI_TransportAddReceivePkts = HCI_TransportAddReceivePkts;
+    _HCI_TransportSendPkt = HCI_TransportSendPkt;
+    _HCI_TransportStop = HCI_TransportStop;
+    _HCI_TransportStart = HCI_TransportStart;
+    _HCI_TransportEnableDisableAsyncRecv = HCI_TransportEnableDisableAsyncRecv;
+    _HCI_TransportRecvHCIEventSync = HCI_TransportRecvHCIEventSync;
+    _HCI_TransportSetBaudRate = HCI_TransportSetBaudRate;
+    _HCI_TransportEnablePowerMgmt = HCI_TransportEnablePowerMgmt;
+
+    return A_OK;
+}
+
+A_STATUS
+ar6000_get_hif_dev(HIF_DEVICE *device, void *config)
+{
+    A_STATUS status;
+
+    status = HIFConfigureDevice(device,
+                                HIF_DEVICE_GET_OS_DEVICE,
+                                (HIF_DEVICE_OS_DEVICE_INFO *)config, 
+                                sizeof(HIF_DEVICE_OS_DEVICE_INFO));
+    return status;
+}
+
+A_STATUS ar6000_set_uart_config(HIF_DEVICE *hifDevice, 
+                                A_UINT32 scale, 
+                                A_UINT32 step)
+{
+    A_UINT32 regAddress;
+    A_UINT32 regVal;
+    A_STATUS status;
+
+    regAddress = WLAN_UART_BASE_ADDRESS | UART_CLKDIV_ADDRESS;
+    regVal = ((A_UINT32)scale << 16) | step;
+    /* change the HCI UART scale/step values through the diagnostic window */
+    status = ar6000_WriteRegDiag(hifDevice, &regAddress, &regVal);                     
+
+    return status;
+}
+
+A_STATUS ar6000_get_core_clock_config(HIF_DEVICE *hifDevice, A_UINT32 *data)
+{
+    A_UINT32 regAddress;
+    A_STATUS status;
+
+    regAddress = WLAN_RTC_BASE_ADDRESS | WLAN_CPU_CLOCK_ADDRESS;
+    /* read CPU clock settings*/
+    status = ar6000_ReadRegDiag(hifDevice, &regAddress, data);
+
+    return status;
+}
+
+EXPORT_SYMBOL(ar6000_register_hci_transport);
+EXPORT_SYMBOL(ar6000_get_hif_dev);
+EXPORT_SYMBOL(ar6000_set_uart_config);
+EXPORT_SYMBOL(ar6000_get_core_clock_config);
+EXPORT_SYMBOL(_HCI_TransportAttach);
+EXPORT_SYMBOL(_HCI_TransportDetach);
+EXPORT_SYMBOL(_HCI_TransportAddReceivePkts);
+EXPORT_SYMBOL(_HCI_TransportSendPkt);
+EXPORT_SYMBOL(_HCI_TransportStop);
+EXPORT_SYMBOL(_HCI_TransportStart);
+EXPORT_SYMBOL(_HCI_TransportEnableDisableAsyncRecv);
+EXPORT_SYMBOL(_HCI_TransportRecvHCIEventSync);
+EXPORT_SYMBOL(_HCI_TransportSetBaudRate);
+EXPORT_SYMBOL(_HCI_TransportEnablePowerMgmt);
diff --git a/host/os/linux/hci_bridge.c b/host/os/linux/hci_bridge.c
new file mode 100644
index 0000000..a81b383
--- /dev/null
+++ b/host/os/linux/hci_bridge.c
@@ -0,0 +1,1174 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+#include <linux/etherdevice.h>
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_types.h"
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include "a_drv.h"
+#include "hif.h"
+#include "common_drv.h"
+#include "a_debug.h"
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+#define  ATH_DEBUG_HCI_RECV      ATH_DEBUG_MAKE_MODULE_MASK(7)
+#define  ATH_DEBUG_HCI_SEND      ATH_DEBUG_MAKE_MODULE_MASK(8)
+#define  ATH_DEBUG_HCI_DUMP      ATH_DEBUG_MAKE_MODULE_MASK(9)
+#else
+#include "ar6000_drv.h"
+#endif  /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+#ifdef ATH_AR6K_ENABLE_GMBOX
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+#include "export_hci_transport.h"
+#else
+#include "hci_transport_api.h"
+#endif
+#include "epping_test.h"
+#include "gmboxif.h"
+#include "ar3kconfig.h"
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25)
+    /* only build on newer kernels which have BT configured */
+#if defined(CONFIG_BT_MODULE) || defined(CONFIG_BT)
+#define CONFIG_BLUEZ_HCI_BRIDGE
+#endif
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+unsigned int ar3khcibaud = 0;
+unsigned int hciuartscale = 0;
+unsigned int hciuartstep = 0;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+module_param(ar3khcibaud, int, 0644);
+module_param(hciuartscale, int, 0644);
+module_param(hciuartstep, int, 0644);
+#else
+
+#define __user
+/* for linux 2.4 and lower */
+MODULE_PARM(ar3khcibaud, "i");
+MODULE_PARM(hciuartscale, "i");
+MODULE_PARM(hciuartstep, "i");
+#endif
+#else
+extern unsigned int ar3khcibaud;
+extern unsigned int hciuartscale;
+extern unsigned int hciuartstep;
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+typedef struct {
+    void                    *pHCIDev;          /* HCI bridge device */
+    HCI_TRANSPORT_PROPERTIES HCIProps;         /* HCI bridge props */
+    struct hci_dev          *pBtStackHCIDev;   /* BT Stack HCI dev */
+    A_BOOL                  HciNormalMode;     /* Actual HCI mode enabled (non-TEST)*/
+    A_BOOL                  HciRegistered;     /* HCI device registered with stack */
+    HTC_PACKET_QUEUE        HTCPacketStructHead;
+    A_UINT8                 *pHTCStructAlloc;
+    spinlock_t              BridgeLock;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    HCI_TRANSPORT_MISC_HANDLES    HCITransHdl;
+#else
+    AR_SOFTC_T              *ar;
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+} AR6K_HCI_BRIDGE_INFO;
+
+#define MAX_ACL_RECV_BUFS           16
+#define MAX_EVT_RECV_BUFS           8
+#define MAX_HCI_WRITE_QUEUE_DEPTH   32
+#define MAX_ACL_RECV_LENGTH         1200
+#define MAX_EVT_RECV_LENGTH         257
+#define TX_PACKET_RSV_OFFSET        32
+#define NUM_HTC_PACKET_STRUCTS     ((MAX_ACL_RECV_BUFS + MAX_EVT_RECV_BUFS + MAX_HCI_WRITE_QUEUE_DEPTH) * 2)
+
+#define HCI_GET_OP_CODE(p)          (((A_UINT16)((p)[1])) << 8) | ((A_UINT16)((p)[0]))
+
+extern unsigned int setupbtdev;
+AR3K_CONFIG_INFO      ar3kconfig;
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+AR6K_HCI_BRIDGE_INFO *g_pHcidevInfo;
+#endif
+
+static A_STATUS bt_setup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo);
+static void     bt_cleanup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo);
+static A_STATUS bt_register_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo);
+static A_BOOL   bt_indicate_recv(AR6K_HCI_BRIDGE_INFO      *pHcidevInfo,
+                                 HCI_TRANSPORT_PACKET_TYPE Type,
+                                 struct sk_buff            *skb);
+static struct sk_buff *bt_alloc_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, int Length);
+static void     bt_free_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, struct sk_buff *skb);
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+A_STATUS ar6000_setup_hci(void *ar);
+void     ar6000_cleanup_hci(void *ar);
+A_STATUS hci_test_send(void *ar, struct sk_buff *skb);
+#else
+A_STATUS ar6000_setup_hci(AR_SOFTC_T *ar);
+void     ar6000_cleanup_hci(AR_SOFTC_T *ar);
+/* HCI bridge testing */
+A_STATUS hci_test_send(AR_SOFTC_T *ar, struct sk_buff *skb);
+#endif /* EXPORT_HCI_BRIDGE_INTERFACE */
+
+#define LOCK_BRIDGE(dev)   spin_lock_bh(&(dev)->BridgeLock)
+#define UNLOCK_BRIDGE(dev) spin_unlock_bh(&(dev)->BridgeLock)
+
+static inline void FreeBtOsBuf(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, void *osbuf)
+{
+    if (pHcidevInfo->HciNormalMode) {
+        bt_free_buffer(pHcidevInfo, (struct sk_buff *)osbuf);
+    } else {
+            /* in test mode, these are just ordinary netbuf allocations */
+        A_NETBUF_FREE(osbuf);
+    }
+}
+
+static void FreeHTCStruct(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, HTC_PACKET *pPacket)
+{
+    LOCK_BRIDGE(pHcidevInfo);
+    HTC_PACKET_ENQUEUE(&pHcidevInfo->HTCPacketStructHead,pPacket);
+    UNLOCK_BRIDGE(pHcidevInfo);
+}
+
+static HTC_PACKET * AllocHTCStruct(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    HTC_PACKET  *pPacket = NULL;
+    LOCK_BRIDGE(pHcidevInfo);
+    pPacket = HTC_PACKET_DEQUEUE(&pHcidevInfo->HTCPacketStructHead);
+    UNLOCK_BRIDGE(pHcidevInfo);
+    return pPacket;
+}
+
+#define BLOCK_ROUND_UP_PWR2(x, align)    (((int) (x) + ((align)-1)) & ~((align)-1))
+
+static void RefillRecvBuffers(AR6K_HCI_BRIDGE_INFO      *pHcidevInfo,
+                              HCI_TRANSPORT_PACKET_TYPE Type,
+                              int                       NumBuffers)
+{
+    int                 length, i;
+    void                *osBuf = NULL;
+    HTC_PACKET_QUEUE    queue;
+    HTC_PACKET          *pPacket;
+
+    INIT_HTC_PACKET_QUEUE(&queue);
+
+    if (Type == HCI_ACL_TYPE) {
+        if (pHcidevInfo->HciNormalMode) {
+            length = HCI_MAX_FRAME_SIZE;
+        } else {
+            length = MAX_ACL_RECV_LENGTH;
+        }
+    } else {
+        length = MAX_EVT_RECV_LENGTH;
+    }
+
+        /* add on transport head and tail room */
+    length += pHcidevInfo->HCIProps.HeadRoom + pHcidevInfo->HCIProps.TailRoom;
+        /* round up to the required I/O padding */
+    length = BLOCK_ROUND_UP_PWR2(length,pHcidevInfo->HCIProps.IOBlockPad);
+
+    for (i = 0; i < NumBuffers; i++) {
+
+        if (pHcidevInfo->HciNormalMode) {
+            osBuf = bt_alloc_buffer(pHcidevInfo,length);
+        } else {
+            osBuf = A_NETBUF_ALLOC(length);
+        }
+
+        if (NULL == osBuf) {
+            break;
+        }
+
+        pPacket = AllocHTCStruct(pHcidevInfo);
+        if (NULL == pPacket) {
+            FreeBtOsBuf(pHcidevInfo,osBuf);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to alloc HTC struct \n"));
+            break;
+        }
+
+        SET_HTC_PACKET_INFO_RX_REFILL(pPacket,osBuf,A_NETBUF_DATA(osBuf),length,Type);
+            /* add to queue */
+        HTC_PACKET_ENQUEUE(&queue,pPacket);
+    }
+
+    if (i > 0) {
+        HCI_TransportAddReceivePkts(pHcidevInfo->pHCIDev, &queue);
+    }
+}
+
+static A_STATUS ar6000_hci_transport_ready(HCI_TRANSPORT_HANDLE     HCIHandle,
+                                           HCI_TRANSPORT_PROPERTIES *pProps,
+                                           void                     *pContext)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+    A_STATUS              status;
+    AR_SOFTC_DEV_T *arDev = pHcidevInfo->ar->arDev[0];
+
+
+    pHcidevInfo->pHCIDev = HCIHandle;
+
+    A_MEMCPY(&pHcidevInfo->HCIProps,pProps,sizeof(*pProps));
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE,("HCI ready (hci:0x%lX, headroom:%d, tailroom:%d blockpad:%d) \n",
+            (unsigned long)HCIHandle,
+            pHcidevInfo->HCIProps.HeadRoom,
+            pHcidevInfo->HCIProps.TailRoom,
+            pHcidevInfo->HCIProps.IOBlockPad));
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    A_ASSERT((pProps->HeadRoom + pProps->TailRoom) <= (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice)->hard_header_len);
+#else
+    A_ASSERT((pProps->HeadRoom + pProps->TailRoom) <= arDev->arNetDev->hard_header_len);
+#endif
+
+        /* provide buffers */
+    RefillRecvBuffers(pHcidevInfo, HCI_ACL_TYPE, MAX_ACL_RECV_BUFS);
+    RefillRecvBuffers(pHcidevInfo, HCI_EVENT_TYPE, MAX_EVT_RECV_BUFS);
+
+    do {
+            /* start transport */
+        status = HCI_TransportStart(pHcidevInfo->pHCIDev);
+
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        if (!pHcidevInfo->HciNormalMode) {
+                /* in test mode, no need to go any further */
+            break;
+        }
+
+        // The delay is required when AR6K is driving the BT reset line
+        // where time is needed after the BT chip is out of reset (HCI_TransportStart)
+        // and before the first HCI command is issued (AR3KConfigure)
+        // FIXME
+        // The delay should be configurable and be only applied when AR6K driving the BT
+        // reset line. This could be done by some module parameter or based on some HW config
+        // info. For now apply 100ms delay blindly
+        A_MDELAY(100);
+
+        A_MEMZERO(&ar3kconfig,sizeof(ar3kconfig));
+        ar3kconfig.pHCIDev = pHcidevInfo->pHCIDev;
+        ar3kconfig.pHCIProps = &pHcidevInfo->HCIProps;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        ar3kconfig.pHIFDevice = (HIF_DEVICE *)(pHcidevInfo->HCITransHdl.hifDevice);
+#else
+        ar3kconfig.pHIFDevice = pHcidevInfo->ar->arHifDevice;
+#endif
+        ar3kconfig.pBtStackHCIDev = pHcidevInfo->pBtStackHCIDev;
+
+        if (ar3khcibaud != 0) {
+                /* user wants ar3k baud rate change */
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_SET_AR3K_BAUD;
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_AR3K_BAUD_CHANGE_DELAY;
+            ar3kconfig.AR3KBaudRate = ar3khcibaud;
+        }
+
+        if ((hciuartscale != 0) || (hciuartstep != 0)) {
+                /* user wants to tune HCI bridge UART scale/step values */
+            ar3kconfig.AR6KScale = (A_UINT16)hciuartscale;
+            ar3kconfig.AR6KStep = (A_UINT16)hciuartstep;
+            ar3kconfig.Flags |= AR3K_CONFIG_FLAG_SET_AR6K_SCALE_STEP;
+        }
+
+            /* configure the AR3K device */
+		memcpy(ar3kconfig.bdaddr,pHcidevInfo->ar->bdaddr,6);
+        status = AR3KConfigure(&ar3kconfig);
+        if (A_FAILED(status)) {
+            extern unsigned int setuphci;
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: Fail to configure AR3K. No device? Cleanup HCI\n"));
+            pHcidevInfo->ar->exitCallback = NULL;
+            ar6000_cleanup_hci(pHcidevInfo->ar);
+            setuphci = 0;
+            pHcidevInfo->ar->arBTSharing = 0;
+            break;
+        }
+
+        /* Make sure both AR6K and AR3K have power management enabled */
+        if (ar3kconfig.PwrMgmtEnabled) {
+            A_UINT32 address, hci_uart_pwr_mgmt_params;
+            /* Fetch the address of the hi_hci_uart_pwr_mgmt_params instance in the host interest area */
+            address = TARG_VTOP(pHcidevInfo->ar->arTargetType,
+                                HOST_INTEREST_ITEM_ADDRESS(pHcidevInfo->ar->arTargetType, hi_hci_uart_pwr_mgmt_params));
+            status = ar6000_ReadRegDiag(pHcidevInfo->ar->arHifDevice, &address, &hci_uart_pwr_mgmt_params);
+            hci_uart_pwr_mgmt_params &= 0xFFFF;
+            /* wakeup timeout is [31:16] */
+            hci_uart_pwr_mgmt_params |= (ar3kconfig.WakeupTimeout << 16);
+            status |= ar6000_WriteRegDiag(pHcidevInfo->ar->arHifDevice, &address, &hci_uart_pwr_mgmt_params);
+            if (A_OK != status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to write hci_uart_pwr_mgmt_params!\n"));
+            }
+
+            /* Fetch the address of the hi_hci_uart_pwr_mgmt_params_ext instance in the host interest area */
+            address = TARG_VTOP(pHcidevInfo->ar->arTargetType,
+                                HOST_INTEREST_ITEM_ADDRESS(pHcidevInfo->ar->arTargetType, hi_hci_uart_pwr_mgmt_params_ext));
+            status = ar6000_WriteRegDiag(pHcidevInfo->ar->arHifDevice, &address, &ar3kconfig.IdleTimeout);
+            if (A_OK != status) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to write hci_uart_pwr_mgmt_params_ext!\n"));
+            }
+
+            status = HCI_TransportEnablePowerMgmt(pHcidevInfo->pHCIDev, TRUE);
+            if (A_FAILED(status)) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to enable TLPM for AR6K! \n"));
+            }
+        }
+
+        status = bt_register_hci(pHcidevInfo);
+
+    } while (FALSE);
+
+    return status;
+}
+
+static void ar6000_hci_transport_failure(void *pContext, A_STATUS Status)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: transport failure! \n"));
+
+    if (pHcidevInfo->HciNormalMode) {
+        /* TODO .. */
+    }
+}
+
+static void ar6000_hci_transport_removed(void *pContext)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: transport removed. \n"));
+
+    A_ASSERT(pHcidevInfo->pHCIDev != NULL);
+
+    HCI_TransportDetach(pHcidevInfo->pHCIDev);
+    bt_cleanup_hci(pHcidevInfo);
+    pHcidevInfo->pHCIDev = NULL;
+}
+
+static void ar6000_hci_send_complete(void *pContext, HTC_PACKET *pPacket)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+    void                 *osbuf = pPacket->pPktContext;
+    A_ASSERT(osbuf != NULL);
+    A_ASSERT(pHcidevInfo != NULL);
+
+    if (A_FAILED(pPacket->Status)) {
+        if ((pPacket->Status != A_ECANCELED) && (pPacket->Status != A_NO_RESOURCE)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: Send Packet Failed: %d \n",pPacket->Status));
+        }
+    }
+
+    FreeHTCStruct(pHcidevInfo,pPacket);
+    FreeBtOsBuf(pHcidevInfo,osbuf);
+
+}
+
+static void ar6000_hci_pkt_recv(void *pContext, HTC_PACKET *pPacket)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+    struct sk_buff       *skb;
+    AR_SOFTC_DEV_T *arDev = pHcidevInfo->ar->arDev[0];
+
+    A_ASSERT(pHcidevInfo != NULL);
+    skb = (struct sk_buff *)pPacket->pPktContext;
+    A_ASSERT(skb != NULL);
+
+    do {
+
+        if (A_FAILED(pPacket->Status)) {
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV,
+                        ("HCI Bridge, packet received type : %d len:%d \n",
+                        HCI_GET_PACKET_TYPE(pPacket),pPacket->ActualLength));
+
+            /* set the actual buffer position in the os buffer, HTC recv buffers posted to HCI are set
+             * to fill the front of the buffer */
+        A_NETBUF_PUT(skb,pPacket->ActualLength + pHcidevInfo->HCIProps.HeadRoom);
+        A_NETBUF_PULL(skb,pHcidevInfo->HCIProps.HeadRoom);
+
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_DUMP)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("<<< Recv HCI %s packet len:%d \n",
+                        (HCI_GET_PACKET_TYPE(pPacket) == HCI_EVENT_TYPE) ? "EVENT" : "ACL",
+                        skb->len));
+            AR_DEBUG_PRINTBUF(skb->data, skb->len,"BT HCI RECV Packet Dump");
+        }
+
+        if (pHcidevInfo->HciNormalMode) {
+                /* indicate the packet */
+            if (bt_indicate_recv(pHcidevInfo,HCI_GET_PACKET_TYPE(pPacket),skb)) {
+                    /* bt stack accepted the packet */
+                skb = NULL;
+            }
+            break;
+        }
+
+            /* for testing, indicate packet to the network stack */
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        skb->dev = (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice);
+        if ((((struct net_device *)pHcidevInfo->HCITransHdl.netDevice)->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = eth_type_trans(skb, (struct net_device *)(pHcidevInfo->HCITransHdl.netDevice));
+#else
+        skb->dev = arDev->arNetDev;
+        if ((arDev->arNetDev->flags & IFF_UP) == IFF_UP) {
+            skb->protocol = eth_type_trans(skb, arDev->arNetDev);
+#endif
+            A_NETIF_RX(skb);
+            skb = NULL;
+        }
+
+    } while (FALSE);
+
+    FreeHTCStruct(pHcidevInfo,pPacket);
+
+    if (skb != NULL) {
+            /* packet was not accepted, free it */
+        FreeBtOsBuf(pHcidevInfo,skb);
+    }
+
+}
+
+static void  ar6000_hci_pkt_refill(void *pContext, HCI_TRANSPORT_PACKET_TYPE Type, int BuffersAvailable)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+    int                  refillCount;
+
+    if (Type == HCI_ACL_TYPE) {
+        refillCount =  MAX_ACL_RECV_BUFS - BuffersAvailable;
+    } else {
+        refillCount =  MAX_EVT_RECV_BUFS - BuffersAvailable;
+    }
+
+    if (refillCount > 0) {
+        RefillRecvBuffers(pHcidevInfo,Type,refillCount);
+    }
+
+}
+
+static HCI_SEND_FULL_ACTION  ar6000_hci_pkt_send_full(void *pContext, HTC_PACKET *pPacket)
+{
+    AR6K_HCI_BRIDGE_INFO    *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)pContext;
+    HCI_SEND_FULL_ACTION    action = HCI_SEND_FULL_KEEP;
+
+    if (!pHcidevInfo->HciNormalMode) {
+            /* for epping testing, check packet tag, some epping packets are
+             * special and cannot be dropped */
+        if (HTC_GET_TAG_FROM_PKT(pPacket) == AR6K_DATA_PKT_TAG) {
+            action = HCI_SEND_FULL_DROP;
+        }
+    }
+
+    return action;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+A_STATUS ar6000_setup_hci(void *ar)
+#else
+A_STATUS ar6000_setup_hci(AR_SOFTC_T *ar)
+#endif
+{
+    HCI_TRANSPORT_CONFIG_INFO config;
+    A_STATUS                  status = A_OK;
+    int                       i;
+    HTC_PACKET                *pPacket;
+    AR6K_HCI_BRIDGE_INFO      *pHcidevInfo;
+
+
+    do {
+
+        pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)A_MALLOC(sizeof(AR6K_HCI_BRIDGE_INFO));
+
+        if (NULL == pHcidevInfo) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        A_MEMZERO(pHcidevInfo, sizeof(AR6K_HCI_BRIDGE_INFO));
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        g_pHcidevInfo = pHcidevInfo;
+        pHcidevInfo->HCITransHdl = *(HCI_TRANSPORT_MISC_HANDLES *)ar;
+#else
+        ar->hcidev_info = pHcidevInfo;
+        pHcidevInfo->ar = ar;
+#endif
+        spin_lock_init(&pHcidevInfo->BridgeLock);
+        INIT_HTC_PACKET_QUEUE(&pHcidevInfo->HTCPacketStructHead);
+
+        ar->exitCallback = AR3KConfigureExit;
+
+        status = bt_setup_hci(pHcidevInfo);
+        if (A_FAILED(status)) {
+            break;
+        }
+
+        if (pHcidevInfo->HciNormalMode) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: running in normal mode... \n"));
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: running in test mode... \n"));
+        }
+
+        pHcidevInfo->pHTCStructAlloc = (A_UINT8 *)A_MALLOC((sizeof(HTC_PACKET)) * NUM_HTC_PACKET_STRUCTS);
+
+        if (NULL == pHcidevInfo->pHTCStructAlloc) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        pPacket = (HTC_PACKET *)pHcidevInfo->pHTCStructAlloc;
+        for (i = 0; i < NUM_HTC_PACKET_STRUCTS; i++,pPacket++) {
+            FreeHTCStruct(pHcidevInfo,pPacket);
+        }
+
+        A_MEMZERO(&config,sizeof(HCI_TRANSPORT_CONFIG_INFO));
+        config.ACLRecvBufferWaterMark = MAX_ACL_RECV_BUFS / 2;
+        config.EventRecvBufferWaterMark = MAX_EVT_RECV_BUFS / 2;
+        config.MaxSendQueueDepth = MAX_HCI_WRITE_QUEUE_DEPTH;
+        config.pContext = pHcidevInfo;
+        config.TransportFailure = ar6000_hci_transport_failure;
+        config.TransportReady = ar6000_hci_transport_ready;
+        config.TransportRemoved = ar6000_hci_transport_removed;
+        config.pHCISendComplete = ar6000_hci_send_complete;
+        config.pHCIPktRecv = ar6000_hci_pkt_recv;
+        config.pHCIPktRecvRefill = ar6000_hci_pkt_refill;
+        config.pHCISendFull = ar6000_hci_pkt_send_full;
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        pHcidevInfo->pHCIDev = HCI_TransportAttach(pHcidevInfo->HCITransHdl.htcHandle, &config);
+#else
+        pHcidevInfo->pHCIDev = HCI_TransportAttach(ar->arHtcTarget, &config);
+#endif
+
+        if (NULL == pHcidevInfo->pHCIDev) {
+            status = A_ERROR;
+        }
+
+    } while (FALSE);
+
+    if (A_FAILED(status)) {
+        if (pHcidevInfo != NULL) {
+            if (NULL == pHcidevInfo->pHCIDev) {
+                /* GMBOX may not be present in older chips */
+                /* just return success */
+                status = A_OK;
+            }
+        }
+        ar6000_cleanup_hci(ar);
+    }
+
+    return status;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+void  ar6000_cleanup_hci(void *ar)
+#else
+void  ar6000_cleanup_hci(AR_SOFTC_T *ar)
+#endif
+{
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = g_pHcidevInfo;
+#else
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)ar->hcidev_info;
+#endif
+
+    if (pHcidevInfo != NULL) {
+        bt_cleanup_hci(pHcidevInfo);
+
+        if (pHcidevInfo->pHCIDev != NULL) {
+            HCI_TransportStop(pHcidevInfo->pHCIDev);
+            HCI_TransportDetach(pHcidevInfo->pHCIDev);
+            pHcidevInfo->pHCIDev = NULL;
+        }
+
+        if (pHcidevInfo->pHTCStructAlloc != NULL) {
+            A_FREE(pHcidevInfo->pHTCStructAlloc);
+            pHcidevInfo->pHTCStructAlloc = NULL;
+        }
+
+        A_FREE(pHcidevInfo);
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+        ar->hcidev_info = NULL;
+        ar->exitCallback = NULL;
+#endif
+    }
+
+
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+A_STATUS hci_test_send(void *ar, struct sk_buff *skb)
+#else
+A_STATUS hci_test_send(AR_SOFTC_T *ar, struct sk_buff *skb)
+#endif
+{
+    int              status = A_OK;
+    int              length;
+    EPPING_HEADER    *pHeader;
+    HTC_PACKET       *pPacket;
+    HTC_TX_TAG       htc_tag = AR6K_DATA_PKT_TAG;
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = g_pHcidevInfo;
+#else
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)ar->hcidev_info;
+#endif
+
+    do {
+
+        if (NULL == pHcidevInfo) {
+            status = A_ERROR;
+            break;
+        }
+
+        if (NULL == pHcidevInfo->pHCIDev) {
+            status = A_ERROR;
+            break;
+        }
+
+        if (pHcidevInfo->HciNormalMode) {
+                /* this interface cannot run when normal WMI is running */
+            status = A_ERROR;
+            break;
+        }
+
+        pHeader = (EPPING_HEADER *)A_NETBUF_DATA(skb);
+
+        if (!IS_EPPING_PACKET(pHeader)) {
+            status = A_EINVAL;
+            break;
+        }
+
+        if (IS_EPING_PACKET_NO_DROP(pHeader)) {
+            htc_tag = AR6K_CONTROL_PKT_TAG;
+        }
+
+        length = sizeof(EPPING_HEADER) + pHeader->DataLength;
+
+        pPacket = AllocHTCStruct(pHcidevInfo);
+        if (NULL == pPacket) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        SET_HTC_PACKET_INFO_TX(pPacket,
+                               skb,
+                               A_NETBUF_DATA(skb),
+                               length,
+                               HCI_ACL_TYPE,  /* send every thing out as ACL */
+                               htc_tag);
+
+        HCI_TransportSendPkt(pHcidevInfo->pHCIDev,pPacket,FALSE);
+        pPacket = NULL;
+
+    } while (FALSE);
+
+    return status;
+}
+
+void ar6000_set_default_ar3kconfig(AR_SOFTC_T *ar, void *ar3kconfig)
+{
+    AR6K_HCI_BRIDGE_INFO *pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)ar->hcidev_info;
+    AR3K_CONFIG_INFO *config = (AR3K_CONFIG_INFO *)ar3kconfig;
+
+    config->pHCIDev = pHcidevInfo->pHCIDev;
+    config->pHCIProps = &pHcidevInfo->HCIProps;
+    config->pHIFDevice = ar->arHifDevice;
+    config->pBtStackHCIDev = pHcidevInfo->pBtStackHCIDev;
+    config->Flags |= AR3K_CONFIG_FLAG_SET_AR3K_BAUD;
+    config->AR3KBaudRate = 115200;
+}
+
+#ifdef CONFIG_BLUEZ_HCI_BRIDGE
+/*** BT Stack Entrypoints *******/
+
+/*
+ * bt_open - open a handle to the device
+*/
+static int bt_open(struct hci_dev *hdev)
+{
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_open - enter - x\n"));
+    set_bit(HCI_RUNNING, &hdev->flags);
+    set_bit(HCI_UP, &hdev->flags);
+    set_bit(HCI_INIT, &hdev->flags);
+    return 0;
+}
+
+/*
+ * bt_close - close handle to the device
+*/
+static int bt_close(struct hci_dev *hdev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_close - enter\n"));
+    clear_bit(HCI_RUNNING, &hdev->flags);
+    return 0;
+}
+
+/*
+ * bt_send_frame - send data frames
+*/
+static int bt_send_frame(struct sk_buff *skb)
+{
+    struct hci_dev             *hdev = (struct hci_dev *)skb->dev;
+    HCI_TRANSPORT_PACKET_TYPE  type;
+    AR6K_HCI_BRIDGE_INFO       *pHcidevInfo;
+    HTC_PACKET                 *pPacket;
+    A_STATUS                   status = A_OK;
+    struct sk_buff             *txSkb = NULL;
+
+    if (!hdev) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("HCI Bridge: bt_send_frame - no device\n"));
+        return -ENODEV;
+    }
+
+    if (!test_bit(HCI_RUNNING, &hdev->flags)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_send_frame - not open\n"));
+        return -EBUSY;
+    }
+
+    pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)hdev->driver_data;
+    A_ASSERT(pHcidevInfo != NULL);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("+bt_send_frame type: %d \n",bt_cb(skb)->pkt_type));
+    type = HCI_COMMAND_TYPE;
+
+    switch (bt_cb(skb)->pkt_type) {
+        case HCI_COMMAND_PKT:
+            type = HCI_COMMAND_TYPE;
+            hdev->stat.cmd_tx++;
+            break;
+
+        case HCI_ACLDATA_PKT:
+            type = HCI_ACL_TYPE;
+            hdev->stat.acl_tx++;
+            break;
+
+        case HCI_SCODATA_PKT:
+            /* we don't support SCO over the bridge */
+            kfree_skb(skb);
+            return 0;
+        default:
+            A_ASSERT(FALSE);
+            kfree_skb(skb);
+            return 0;
+    }
+
+    if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_DUMP)) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ANY,(">>> Send HCI %s packet len: %d\n",
+                        (type == HCI_COMMAND_TYPE) ? "COMMAND" : "ACL",
+                        skb->len));
+        if (type == HCI_COMMAND_TYPE) {
+            A_UINT16 opcode = HCI_GET_OP_CODE(skb->data);
+            AR_DEBUG_PRINTF(ATH_DEBUG_ANY,("    HCI Command: OGF:0x%X OCF:0x%X \r\n",
+                  opcode >> 10, opcode & 0x3FF));
+        }
+        AR_DEBUG_PRINTBUF(skb->data,skb->len,"BT HCI SEND Packet Dump");
+    }
+
+    do {
+
+        txSkb = bt_skb_alloc(TX_PACKET_RSV_OFFSET + pHcidevInfo->HCIProps.HeadRoom +
+                             pHcidevInfo->HCIProps.TailRoom + skb->len,
+                             GFP_ATOMIC);
+
+        if (txSkb == NULL) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        bt_cb(txSkb)->pkt_type = bt_cb(skb)->pkt_type;
+        txSkb->dev = (void *)pHcidevInfo->pBtStackHCIDev;
+        skb_reserve(txSkb, TX_PACKET_RSV_OFFSET + pHcidevInfo->HCIProps.HeadRoom);
+        A_MEMCPY(txSkb->data, skb->data, skb->len);
+        skb_put(txSkb,skb->len);
+
+        pPacket = AllocHTCStruct(pHcidevInfo);
+        if (NULL == pPacket) {
+            status = A_NO_MEMORY;
+            break;
+        }
+
+        /* HCI packet length here doesn't include the 1-byte transport header which
+         * will be handled by the HCI transport layer. Enough headroom has already
+         * been reserved above for the transport header
+         */
+        SET_HTC_PACKET_INFO_TX(pPacket,
+                               txSkb,
+                               txSkb->data,
+                               txSkb->len,
+                               type,
+                               AR6K_CONTROL_PKT_TAG); /* HCI packets cannot be dropped */
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("HCI Bridge: bt_send_frame skb:0x%lX \n",(unsigned long)txSkb));
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("HCI Bridge: type:%d, Total Length:%d Bytes \n",
+                                      type, txSkb->len));
+
+        status = HCI_TransportSendPkt(pHcidevInfo->pHCIDev,pPacket,FALSE);
+        pPacket = NULL;
+        txSkb = NULL;
+
+    } while (FALSE);
+
+    if (txSkb != NULL) {
+        kfree_skb(txSkb);
+    }
+
+    kfree_skb(skb);
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_HCI_SEND, ("-bt_send_frame  \n"));
+    return 0;
+}
+
+/*
+ * bt_ioctl - ioctl processing
+*/
+static int bt_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_ioctl - enter\n"));
+    return -ENOIOCTLCMD;
+}
+
+/*
+ * bt_flush - flush outstandingbpackets
+*/
+static int bt_flush(struct hci_dev *hdev)
+{
+    AR6K_HCI_BRIDGE_INFO    *pHcidevInfo;
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_flush - enter\n"));
+
+    pHcidevInfo = (AR6K_HCI_BRIDGE_INFO *)hdev->driver_data;
+
+    /* TODO??? */
+
+    return 0;
+}
+
+
+/*
+ * bt_destruct -
+*/
+static void bt_destruct(struct hci_dev *hdev)
+{
+    AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("HCI Bridge: bt_destruct - enter\n"));
+    /* nothing to do here */
+}
+
+static A_STATUS bt_setup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    A_STATUS                    status = A_OK;
+    struct hci_dev              *pHciDev = NULL;
+    HIF_DEVICE_OS_DEVICE_INFO   osDevInfo;
+
+    if (!setupbtdev) {
+        return A_OK;
+    }
+
+    do {
+
+        A_MEMZERO(&osDevInfo,sizeof(osDevInfo));
+            /* get the underlying OS device */
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+        status = ar6000_get_hif_dev((HIF_DEVICE *)(pHcidevInfo->HCITransHdl.hifDevice),
+                                    &osDevInfo);
+#else
+        status = HIFConfigureDevice(pHcidevInfo->ar->arHifDevice,
+                                    HIF_DEVICE_GET_OS_DEVICE,
+                                    &osDevInfo,
+                                    sizeof(osDevInfo));
+#endif
+
+        if (A_FAILED(status)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to OS device info from HIF\n"));
+            break;
+        }
+
+            /* allocate a BT HCI struct for this device */
+        pHciDev = hci_alloc_dev();
+        if (NULL == pHciDev) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge - failed to allocate bt struct \n"));
+            status = A_NO_MEMORY;
+            break;
+        }
+            /* save the device, we'll register this later */
+        pHcidevInfo->pBtStackHCIDev = pHciDev;
+        SET_HCIDEV_DEV(pHciDev,osDevInfo.pOSDevice);
+        SET_HCI_BUS_TYPE(pHciDev, HCI_VIRTUAL, HCI_BREDR);
+        pHciDev->driver_data = pHcidevInfo;
+        pHciDev->open     = bt_open;
+        pHciDev->close    = bt_close;
+        pHciDev->send     = bt_send_frame;
+        pHciDev->ioctl    = bt_ioctl;
+        pHciDev->flush    = bt_flush;
+        pHciDev->destruct = bt_destruct;
+        pHciDev->owner = THIS_MODULE;
+            /* driver is running in normal BT mode */
+        pHcidevInfo->HciNormalMode = TRUE;
+
+    } while (FALSE);
+
+    if (A_FAILED(status)) {
+        bt_cleanup_hci(pHcidevInfo);
+    }
+
+    return status;
+}
+
+static void bt_cleanup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    int   err;
+
+    if (pHcidevInfo->HciRegistered) {
+        pHcidevInfo->HciRegistered = FALSE;
+        clear_bit(HCI_RUNNING, &pHcidevInfo->pBtStackHCIDev->flags);
+        clear_bit(HCI_UP, &pHcidevInfo->pBtStackHCIDev->flags);
+        clear_bit(HCI_INIT, &pHcidevInfo->pBtStackHCIDev->flags);
+        A_ASSERT(pHcidevInfo->pBtStackHCIDev != NULL);
+            /* unregister */
+        if ((err = hci_unregister_dev(pHcidevInfo->pBtStackHCIDev)) < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to unregister with bluetooth %d\n",err));
+        }
+    }
+
+    if (pHcidevInfo->pBtStackHCIDev != NULL) {
+        kfree(pHcidevInfo->pBtStackHCIDev);
+        pHcidevInfo->pBtStackHCIDev = NULL;
+    }
+}
+
+static A_STATUS bt_register_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    int       err;
+    A_STATUS  status = A_OK;
+
+    do {
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: registering HCI... \n"));
+        A_ASSERT(pHcidevInfo->pBtStackHCIDev != NULL);
+             /* mark that we are registered */
+        pHcidevInfo->HciRegistered = TRUE;
+        if ((err = hci_register_dev(pHcidevInfo->pBtStackHCIDev)) < 0) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: failed to register with bluetooth %d\n",err));
+            pHcidevInfo->HciRegistered = FALSE;
+            status = A_ERROR;
+            break;
+        }
+
+        AR_DEBUG_PRINTF(ATH_DEBUG_HCI_BRIDGE, ("HCI Bridge: HCI registered \n"));
+
+    } while (FALSE);
+
+    return status;
+}
+
+static A_BOOL bt_indicate_recv(AR6K_HCI_BRIDGE_INFO      *pHcidevInfo,
+                               HCI_TRANSPORT_PACKET_TYPE Type,
+                               struct                    sk_buff *skb)
+{
+    A_UINT8               btType;
+    int                   len;
+    A_BOOL                success = FALSE;
+    BT_HCI_EVENT_HEADER   *pEvent;
+
+    do {
+
+        if (!test_bit(HCI_RUNNING, &pHcidevInfo->pBtStackHCIDev->flags)) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WARN, ("HCI Bridge: bt_indicate_recv - not running\n"));
+            break;
+        }
+
+        switch (Type) {
+            case HCI_ACL_TYPE:
+                btType = HCI_ACLDATA_PKT;
+                break;
+            case HCI_EVENT_TYPE:
+                btType = HCI_EVENT_PKT;
+                break;
+            default:
+                btType = 0;
+                A_ASSERT(FALSE);
+                break;
+        }
+
+        if (0 == btType) {
+            break;
+        }
+
+            /* set the final type */
+        bt_cb(skb)->pkt_type = btType;
+            /* set dev */
+        skb->dev = (void *)pHcidevInfo->pBtStackHCIDev;
+        len = skb->len;
+
+        if (AR_DEBUG_LVL_CHECK(ATH_DEBUG_HCI_RECV)) {
+            if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
+                pEvent = (BT_HCI_EVENT_HEADER *)skb->data;
+                AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV, ("BT HCI EventCode: %d, len:%d \n",
+                        pEvent->EventCode, pEvent->ParamLength));
+            }
+        }
+
+        /* pass receive packet up the stack */
+#ifdef CONFIG_BT
+        if (hci_recv_frame(skb) != 0) {
+#else
+        if (1) {
+#endif
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("HCI Bridge: hci_recv_frame failed \n"));
+            break;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_HCI_RECV,
+                    ("HCI Bridge: Indicated RCV of type:%d, Length:%d \n",btType,len));
+        }
+
+        success = TRUE;
+
+    } while (FALSE);
+
+    return success;
+}
+
+static struct sk_buff* bt_alloc_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, int Length)
+{
+    struct sk_buff *skb;
+        /* in normal HCI mode we need to alloc from the bt core APIs */
+    skb = bt_skb_alloc(Length, GFP_ATOMIC);
+    if (NULL == skb) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Failed to alloc bt sk_buff \n"));
+    }
+    return skb;
+}
+
+static void bt_free_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, struct sk_buff *skb)
+{
+    kfree_skb(skb);
+}
+
+#else // { CONFIG_BLUEZ_HCI_BRIDGE
+
+    /* stubs when we only want to test the HCI bridging Interface without the HT stack */
+static A_STATUS bt_setup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    return A_OK;
+}
+static void bt_cleanup_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+
+}
+static A_STATUS bt_register_hci(AR6K_HCI_BRIDGE_INFO *pHcidevInfo)
+{
+    A_ASSERT(FALSE);
+    return A_ERROR;
+}
+
+static A_BOOL bt_indicate_recv(AR6K_HCI_BRIDGE_INFO      *pHcidevInfo,
+                               HCI_TRANSPORT_PACKET_TYPE Type,
+                               struct                    sk_buff *skb)
+{
+    A_ASSERT(FALSE);
+    return FALSE;
+}
+
+static struct sk_buff* bt_alloc_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, int Length)
+{
+    A_ASSERT(FALSE);
+    return NULL;
+}
+static void bt_free_buffer(AR6K_HCI_BRIDGE_INFO *pHcidevInfo, struct sk_buff *skb)
+{
+    A_ASSERT(FALSE);
+}
+
+#endif // } CONFIG_BLUEZ_HCI_BRIDGE
+
+#else  // { ATH_AR6K_ENABLE_GMBOX
+
+    /* stubs when GMBOX support is not needed */
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+A_STATUS ar6000_setup_hci(void *ar)
+#else
+A_STATUS ar6000_setup_hci(AR_SOFTC_T *ar)
+#endif
+{
+    return A_OK;
+}
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+void ar6000_cleanup_hci(void *ar)
+#else
+void ar6000_cleanup_hci(AR_SOFTC_T *ar)
+#endif
+{
+    return;
+}
+
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+void ar6000_set_default_ar3kconfig(AR_SOFTC_T *ar, void *ar3kconfig)
+{
+    return;
+}
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+int hci_test_send(void *ar, struct sk_buff *skb)
+#else
+int hci_test_send(AR_SOFTC_T *ar, struct sk_buff *skb)
+#endif
+{
+    return -EOPNOTSUPP;
+}
+
+#endif // } ATH_AR6K_ENABLE_GMBOX
+
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+static int __init
+hcibridge_init_module(void)
+{
+    A_STATUS status;
+    HCI_TRANSPORT_CALLBACKS hciTransCallbacks;
+
+    hciTransCallbacks.setupTransport = ar6000_setup_hci;
+    hciTransCallbacks.cleanupTransport = ar6000_cleanup_hci;
+
+    status = ar6000_register_hci_transport(&hciTransCallbacks);
+    if(status != A_OK)
+        return -ENODEV;
+
+    return 0;
+}
+
+static void __exit
+hcibridge_cleanup_module(void)
+{
+}
+
+module_init(hcibridge_init_module);
+module_exit(hcibridge_cleanup_module);
+MODULE_LICENSE("Dual BSD/GPL");
+#endif
diff --git a/host/os/linux/include/ar6000_drv.h b/host/os/linux/include/ar6000_drv.h
new file mode 100644
index 0000000..0996e5a
--- /dev/null
+++ b/host/os/linux/include/ar6000_drv.h
@@ -0,0 +1,1008 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6000_H_
+#define _AR6000_H_
+
+#include <linux/version.h>
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
+#include <linux/config.h>
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)
+#include <linux/autoconf.h>
+#else
+#include <generated/autoconf.h>
+#endif
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/if_ether.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <linux/if_arp.h>
+#include <linux/ip.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
+#include <asm/semaphore.h>
+#else
+#include <linux/semaphore.h>
+#endif
+#include <linux/wireless.h>
+#ifdef ATH6K_CONFIG_CFG80211
+#include <net/cfg80211.h>
+#endif /* ATH6K_CONFIG_CFG80211 */
+#include <linux/module.h>
+#include <asm/io.h>
+
+#include <a_config.h>
+#include <athdefs.h>
+#include "a_types.h"
+#include "a_osapi.h"
+#include "htc_api.h"
+#include "wmi.h"
+#include "a_drv.h"
+#include "bmi.h"
+#include <ieee80211.h>
+#include <ieee80211_ioctl.h>
+#include <wlan_api.h>
+#include <wmi_api.h>
+#include "gpio_api.h"
+#include "gpio.h"
+#include "pkt_log.h"
+#include "aggr_recv_api.h"
+#include <host_version.h>
+#include <linux/rtnetlink.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
+#include <asm/uaccess.h>
+#else
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#endif
+#include "ar6000_api.h"
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+#include <testcmd.h>
+#endif
+#include <linux/firmware.h>
+
+#include "targaddrs.h"
+#include "dbglog_api.h"
+#include "ar6000_diag.h"
+#include "common_drv.h"
+#include "roaming.h"
+#include "hci_transport_api.h"
+#define ATH_MODULE_NAME driver
+#include "a_debug.h"
+
+#define  ATH_DEBUG_DBG_LOG       ATH_DEBUG_MAKE_MODULE_MASK(0)
+#define  ATH_DEBUG_WLAN_CONNECT  ATH_DEBUG_MAKE_MODULE_MASK(1)
+#define  ATH_DEBUG_WLAN_SCAN     ATH_DEBUG_MAKE_MODULE_MASK(2)
+#define  ATH_DEBUG_WLAN_TX       ATH_DEBUG_MAKE_MODULE_MASK(3)
+#define  ATH_DEBUG_WLAN_RX       ATH_DEBUG_MAKE_MODULE_MASK(4)
+#define  ATH_DEBUG_HTC_RAW       ATH_DEBUG_MAKE_MODULE_MASK(5)
+#define  ATH_DEBUG_HCI_BRIDGE    ATH_DEBUG_MAKE_MODULE_MASK(6)
+#define  ATH_DEBUG_HCI_RECV      ATH_DEBUG_MAKE_MODULE_MASK(7)
+#define  ATH_DEBUG_HCI_SEND      ATH_DEBUG_MAKE_MODULE_MASK(8)
+#define  ATH_DEBUG_HCI_DUMP      ATH_DEBUG_MAKE_MODULE_MASK(9)
+
+#ifndef  __dev_put
+#define  __dev_put(dev) dev_put(dev)
+#endif
+
+
+
+#ifdef ATH6K_CONFIG_CFG80211
+#define NUM_SUBQUEUE		     1
+#endif
+
+#ifdef USER_KEYS
+
+#define USER_SAVEDKEYS_STAT_INIT     0
+#define USER_SAVEDKEYS_STAT_RUN      1
+
+// TODO this needs to move into the AR_SOFTC struct
+struct USER_SAVEDKEYS {
+    struct ieee80211req_key   ucast_ik;
+    struct ieee80211req_key   bcast_ik;
+    CRYPTO_TYPE               keyType;
+    A_BOOL                    keyOk;
+};
+#endif
+
+#define DBG_INFO        0x00000001
+#define DBG_ERROR       0x00000002
+#define DBG_WARNING     0x00000004
+#define DBG_SDIO        0x00000008
+#define DBG_HIF         0x00000010
+#define DBG_HTC         0x00000020
+#define DBG_WMI         0x00000040
+#define DBG_WMI2        0x00000080
+#define DBG_DRIVER      0x00000100
+
+#define DBG_DEFAULTS    (DBG_ERROR|DBG_WARNING)
+
+
+A_STATUS ar6000_ReadRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+A_STATUS ar6000_WriteRegDiag(HIF_DEVICE *hifDevice, A_UINT32 *address, A_UINT32 *data);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MAX_AR6000                        1
+#define AR6000_MAX_RX_BUFFERS             16
+#define AR6000_BUFFER_SIZE                1664
+#define AR6000_MAX_AMSDU_RX_BUFFERS       4
+#define AR6000_AMSDU_REFILL_THRESHOLD     3
+#define AR6000_AMSDU_BUFFER_SIZE          (WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH + 128)
+#define AR6000_MAX_RX_MESSAGE_SIZE        (max(WMI_MAX_NORMAL_RX_DATA_FRAME_LENGTH,WMI_MAX_AMSDU_RX_DATA_FRAME_LENGTH))
+
+#define AR6000_TX_TIMEOUT                 10
+#define AR6000_ETH_ADDR_LEN               6
+#define AR6000_MAX_ENDPOINTS              4
+#define MAX_NODE_NUM                      15
+/* MAX_HI_COOKIE_NUM are reserved for high priority traffic */
+#define MAX_DEF_COOKIE_NUM                150
+#define MAX_HIGH_PRIORITY_COOKIE_NUM      15 /* 10% of MAX_COOKIE_NUM (for high priority traffic) */
+#define MAX_CONTROL_COOKIE_NUM            WMM_NUM_AC*2 + 3 + 1 /* Number of cookies reserved for control packets ONLY */
+#define MAX_HI_COOKIE_NUM                 MAX_HIGH_PRIORITY_COOKIE_NUM + MAX_CONTROL_COOKIE_NUM
+                                          /* Number of cookies reserved for both
+                                           * high priority data + control packets
+                                           */
+#define MAX_COOKIE_NUM                    (MAX_DEF_COOKIE_NUM + MAX_HI_COOKIE_NUM)
+
+/*
+ * MAX_DEFAULT_PS_QUEUE_DEPTH is used to set the default queue depth for
+ * Power Save queue maintained for each station. This settings is used only for
+ * AP mode. This queue depth is also used for multicast PS queue.
+ * To disable this feature or have unlimited queue size pass 0 as module
+ * parameter.
+ */
+#define MAX_DEFAULT_PS_QUEUE_DEPTH      128
+
+/* MAX_DEFAULT_SEND_QUEUE_DEPTH is used to set the default queue depth for the
+ * WMM send queues.  If a queue exceeds this depth htc will query back to the
+ * OS specific layer by calling EpSendFull().  This gives the OS layer the
+ * opportunity to drop the packet if desired.  Therefore changing
+ * MAX_DEFAULT_SEND_QUEUE_DEPTH does not affect resource utilization but
+ * does impact the threshold used to identify if a packet should be
+ * dropped. */
+// #define MAX_DEFAULT_SEND_QUEUE_DEPTH      (MAX_DEF_COOKIE_NUM / WMM_NUM_AC)
+
+// Host Queue depth has been increased during performace chariot endpoint runs. Host may not pump
+// as fast as host application expected, due to that panic/packet loss / chariot error happens
+// adjusting queue depth size resolve this issue
+#define MAX_DEFAULT_SEND_QUEUE_DEPTH     64
+
+#define AR6000_HB_CHALLENGE_RESP_FREQ_DEFAULT        1
+#define AR6000_HB_CHALLENGE_RESP_MISS_THRES_DEFAULT  1
+#define A_DISCONNECT_TIMER_INTERVAL       12 * 1000
+#define A_DEFAULT_LISTEN_INTERVAL         100
+#define A_DEFAULT_BMISS_TIME              1500
+#define A_MAX_WOW_LISTEN_INTERVAL         300
+#define A_MAX_WOW_BMISS_TIME              4500
+
+#define IS_5G_CHANNEL(channel)   ((channel >= 5180 && channel <= 5825) ? TRUE : FALSE)
+
+enum {
+    DRV_HB_CHALLENGE = 0,
+    APP_HB_CHALLENGE
+};
+
+enum {
+    WLAN_INIT_MODE_NONE = 0,
+    WLAN_INIT_MODE_USR,
+    WLAN_INIT_MODE_UDEV,
+    WLAN_INIT_MODE_DRV
+};
+
+/* Suspend - configuration */
+enum {
+    WLAN_SUSPEND_CUT_PWR = 0,
+    WLAN_SUSPEND_DEEP_SLEEP,
+    WLAN_SUSPEND_WOW,
+    WLAN_SUSPEND_CUT_PWR_IF_BT_OFF
+};
+
+/* WiFi OFF - configuration */
+enum {
+    WLAN_OFF_CUT_PWR = 0,
+    WLAN_OFF_DEEP_SLEEP,
+};
+
+/* WLAN low power state */
+enum {
+    WLAN_POWER_STATE_ON = 0,
+    WLAN_POWER_STATE_CUT_PWR = 1,
+    WLAN_POWER_STATE_DEEP_SLEEP,
+    WLAN_POWER_STATE_WOW
+};
+
+/* WLAN WoW State */
+enum {
+    WLAN_WOW_STATE_NONE = 0,
+    WLAN_WOW_STATE_SUSPENDING,
+    WLAN_WOW_STATE_SUSPENDED
+};
+
+
+typedef enum _AR6K_BIN_FILE {
+    AR6K_OTP_FILE,
+    AR6K_FIRMWARE_FILE,
+    AR6K_PATCH_FILE,
+    AR6K_BOARD_DATA_FILE,
+} AR6K_BIN_FILE;
+
+#define REASON_DELBA_INIT    0
+#define REASON_TEAR_DOWN     1
+#define REASON_DELBA_TIMEOUT 2
+
+#define DELBA_TIMEOUT        2000
+
+#ifdef SETUPHCI_ENABLED
+#define SETUPHCI_DEFAULT           1
+#else
+#define SETUPHCI_DEFAULT           0
+#endif /* SETUPHCI_ENABLED */
+
+#ifdef SETUPHCIPAL_ENABLED
+#define SETUPHCIPAL_DEFAULT           1
+#else
+#define SETUPHCIPAL_DEFAULT           0
+#endif /* SETUPHCIPAL_ENABLED */
+
+#ifdef SETUPBTDEV_ENABLED
+#define SETUPBTDEV_DEFAULT         1
+#else
+#define SETUPBTDEV_DEFAULT         0
+#endif /* SETUPBTDEV_ENABLED */
+
+#ifdef BMIENABLE_SET
+#define BMIENABLE_DEFAULT          1
+#else
+#define BMIENABLE_DEFAULT          0
+#endif /* BMIENABLE_SET */
+
+#ifdef ENABLEUARTPRINT_SET
+#define ENABLEUARTPRINT_DEFAULT    1
+#else
+#define ENABLEUARTPRINT_DEFAULT    0
+#endif /* ENABLEARTPRINT_SET */
+
+#ifdef ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER
+#define NOHIFSCATTERSUPPORT_DEFAULT    1
+#else /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
+#define NOHIFSCATTERSUPPORT_DEFAULT    0
+#endif /* ATH6KL_CONFIG_HIF_VIRTUAL_SCATTER */
+
+#ifdef AR600x_BT_AR3001
+#define AR3KHCIBAUD_DEFAULT        3000000
+#define HCIUARTSCALE_DEFAULT       1
+#define HCIUARTSTEP_DEFAULT        8937
+#else
+#define AR3KHCIBAUD_DEFAULT        0
+#define HCIUARTSCALE_DEFAULT       0
+#define HCIUARTSTEP_DEFAULT        0
+#endif /* AR600x_BT_AR3001 */
+
+#ifdef INIT_MODE_DRV_ENABLED
+#define WLAN_INIT_MODE_DEFAULT     WLAN_INIT_MODE_DRV
+#else
+#define WLAN_INIT_MODE_DEFAULT     WLAN_INIT_MODE_USR
+#endif /* INIT_MODE_DRV_ENABLED */
+
+#define AR6K_DATASET_PATCH_ADDRESS(_param, _ver) do { \
+    if ((_ver) == AR6003_REV2_VERSION) { \
+        (_param) = AR6003_REV2_DATASET_PATCH_ADDRESS; \
+    } else if ((_ver) == AR6003_REV3_VERSION) { \
+        (_param) = AR6003_REV3_DATASET_PATCH_ADDRESS; \
+    } else { \
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+       A_ASSERT(0); \
+    } \
+} while (0)
+
+#define AR6K_APP_LOAD_ADDRESS(_param, _ver) do { \
+    if ((_ver) == AR6003_REV2_VERSION) { \
+        (_param) = AR6003_REV2_APP_LOAD_ADDRESS; \
+    } else if ((_ver) == AR6003_REV3_VERSION) { \
+        (_param) = AR6003_REV3_APP_LOAD_ADDRESS; \
+    } else { \
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+       A_ASSERT(0); \
+    } \
+} while (0)
+
+#define AR6K_APP_START_OVERRIDE_ADDRESS(_param, _ver) do { \
+    if ((_ver) == AR6003_REV2_VERSION) { \
+        (_param) = AR6003_REV2_APP_START_OVERRIDE; \
+    } else if ((_ver) == AR6003_REV3_VERSION) { \
+        (_param) = AR6003_REV3_APP_START_OVERRIDE; \
+    } else { \
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("Unknown Version: %d\n", _ver)); \
+       A_ASSERT(0); \
+    } \
+} while (0)
+
+#define AR6003_SUBVER_DEFAULT               1
+#define AR6003_SUBVER_ROUTER                2
+#define AR6003_SUBVER_MOBILE                3
+#define AR6003_SUBVER_TABLET                4
+
+/* AR6003 2.0 definitions */
+#define AR6003_REV2_VERSION                 0x30000384
+#ifdef KERNEL_VERSION_ANDROID
+
+#define AR6003_REV2_OTP_FILE                "ath6k/AR6003/hw2.0/otp.bin.z77"
+#define AR6003_REV2_FIRMWARE_FILE           "ath6k/AR6003/hw2.0/athwlan.bin.z77"
+#define AR6003_REV2_TCMD_FIRMWARE_FILE      "ath6k/AR6003/hw2.0/athtcmd_ram.bin"
+#define AR6003_REV2_TESTSCRIPT_FILE			"ath6k/AR6003/hw2.0/testflow.bin"
+#define AR6003_REV2_UTF_FIRMWARE_FILE	    "ath6k/AR6003/hw2.0/utf.bin"
+#define AR6003_REV2_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.0/device.bin"
+#define AR6003_REV2_PATCH_FILE              "ath6k/AR6003/hw2.0/data.patch.hw2_0.bin"
+#define AR6003_REV2_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw2.0/endpointping.bin"
+#ifdef AR600x_SD31_XXX
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD31.bin"
+#elif defined(AR600x_SD32_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.SD32.bin"
+#elif defined(AR600x_WB31_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.WB31.bin"
+#else
+#define AR6003_REV2_BOARD_DATA_FILE         "ath6k/AR6003/hw2.0/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+#else /* KERNEL_VERSION_ANDROID*/
+
+#define AR6003_REV2_OTP_FILE                "hw2.0/bin/otp.bin.z77"
+#define AR6003_REV2_FIRMWARE_FILE           "hw2.0/bin/athwlan.bin.z77"
+#define AR6003_REV2_TCMD_FIRMWARE_FILE      "hw2.0/bin/athtcmd_ram.bin"
+#define AR6003_REV2_TESTSCRIPT_FILE         "hw2.0/bin/testflow.bin"
+#define AR6003_REV2_UTF_FIRMWARE_FILE       "hw2.0/bin/utf.bin"
+#define AR6003_REV2_ART_FIRMWARE_FILE       "hw2.0/bin/device.bin"
+#define AR6003_REV2_PATCH_FILE              "hw2.0/bin/data.patch.hw2_0.bin"
+#define AR6003_REV2_EPPING_FIRMWARE_FILE    "hw2.0/bin/endpointping.bin"
+#ifdef AR600x_SD31_XXX
+#define AR6003_REV2_BOARD_DATA_FILE         "hw2.0/bin/bdata.SD31.bin"
+#elif defined(AR600x_SD32_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "hw2.0/bin/bdata.SD32.bin"
+#elif defined(AR600x_WB31_XXX)
+#define AR6003_REV2_BOARD_DATA_FILE         "hw2.0/bin/bdata.WB31.bin"
+#else
+#define AR6003_REV2_BOARD_DATA_FILE         "hw2.0/bin/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+#endif /* KERNEL_VERSION_ANDROID*/
+
+
+/* AR6003 3.0 definitions */
+#define AR6003_REV3_VERSION                 0x30000582
+#ifdef KERNEL_VERSION_ANDROID
+#define AR6003_REV3_OTP_FILE                "ath6k/AR6003/hw2.1.1/otp.bin"
+#define AR6003_REV3_DEFAULT_FIRMWARE_FILE   "ath6k/AR6003/hw2.1.1/athwlan.bin"
+#define AR6003_REV3_ROUTER_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/athwlan_router.bin"
+#define AR6003_REV3_MOBILE_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/athwlan_mobile.bin"
+#define AR6003_REV3_TABLET_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/athwlan_tablet.bin"
+#define AR6003_REV3_TCMD_FIRMWARE_FILE      "ath6k/AR6003/hw2.1.1/athtcmd_ram.bin"
+#define AR6003_REV3_TESTSCRIPT_FILE			"ath6k/AR6003/hw2.1.1/testflow.bin"
+#define AR6003_REV3_UTF_FIRMWARE_FILE	    "ath6k/AR6003/hw2.1.1/utf.bin"
+#define AR6003_REV3_ART_FIRMWARE_FILE       "ath6k/AR6003/hw2.1.1/device.bin"
+#define AR6003_REV3_PATCH_FILE              "ath6k/AR6003/hw2.1.1/data.patch.hw3_0.bin"
+#define AR6003_REV3_EPPING_FIRMWARE_FILE    "ath6k/AR6003/hw2.1.1/endpointping.bin"
+#ifdef AR600x_SD31_XXX
+#define AR6003_REV3_BOARD_DATA_FILE         "ath6k/AR6003/hw2.1.1/bdata.SD31.bin"
+#elif defined(AR600x_SD32_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE         "ath6k/AR6003/hw2.1.1/bdata.SD32.bin"
+#elif defined(AR600x_WB31_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE         "ath6k/AR6003/hw2.1.1/bdata.WB31.bin"
+#else
+#define AR6003_REV3_BOARD_DATA_FILE         "ath6k/AR6003/hw2.1.1/bdata.CUSTOM.bin"
+#endif /* Board Data File */
+
+#else  /* KERNEL_VERSION_ANDROID*/
+#define AR6003_REV3_OTP_FILE                "hw2.1.1/bin/otp.bin"
+#define AR6003_REV3_DEFAULT_FIRMWARE_FILE   "hw2.1.1/bin/athwlan.bin"
+#define AR6003_REV3_ROUTER_FIRMWARE_FILE    "hw2.1.1/bin/athwlan_router.bin"
+#define AR6003_REV3_MOBILE_FIRMWARE_FILE    "hw2.1.1/bin/athwlan_mobile.bin"
+#define AR6003_REV3_TABLET_FIRMWARE_FILE    "hw2.1.1/bin/athwlan_tablet.bin"
+#define AR6003_REV3_TCMD_FIRMWARE_FILE      "hw2.1.1/bin/athtcmd_ram.bin"
+#define AR6003_REV3_TESTSCRIPT_FILE                     "hw2.1.1/bin/testflow.bin"
+#define AR6003_REV3_UTF_FIRMWARE_FILE       "hw2.1.1/bin/utf.bin"
+#define AR6003_REV3_ART_FIRMWARE_FILE       "hw2.1.1/bin/device.bin"
+#define AR6003_REV3_PATCH_FILE              "hw2.1.1/bin/data.patch.hw3_0.bin"
+#define AR6003_REV3_EPPING_FIRMWARE_FILE    "hw2.1.1/bin/endpointping.bin"
+#ifdef AR600x_SD31_XXX
+#define AR6003_REV3_BOARD_DATA_FILE         "hw2.1.1/bin/bdata.SD31.bin"
+#elif defined(AR600x_SD32_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE         "hw2.1.1/bin/bdata.SD32.bin"
+#elif defined(AR600x_WB31_XXX)
+#define AR6003_REV3_BOARD_DATA_FILE         "hw2.1.1/bin/bdata.WB31.bin"
+#else
+#define AR6003_REV3_BOARD_DATA_FILE         "hw2.1.1/bin/bdata.CUSTOM.bin"
+#endif /* Board */
+
+
+#endif  /* KERNEL_VERSION_ANDROID*/
+
+/* AP-STA Concurrency */
+#define GET_CONN_AP_PRIV(_ar,_priv) do { \
+    int i; \
+    AR_SOFTC_DEV_T *tDev =NULL; \
+    for(i=0;i<_ar->arConfNumDev;i++) { \
+        tDev = _ar->arDev[i]; \
+        if((tDev->arNetworkType == AP_NETWORK) && \
+           (tDev->arConnected)) { \
+       _priv = tDev; \
+           break; \
+        } \
+    } \
+}while(0);
+
+/* Power states */
+enum {
+    WLAN_PWR_CTRL_UP = 0,
+    WLAN_PWR_CTRL_CUT_PWR,
+    WLAN_PWR_CTRL_DEEP_SLEEP,
+    WLAN_PWR_CTRL_WOW,
+    WLAN_PWR_CTRL_DEEP_SLEEP_DISABLED
+};
+
+/* HTC RAW streams */
+typedef enum _HTC_RAW_STREAM_ID {
+    HTC_RAW_STREAM_NOT_MAPPED = -1,
+    HTC_RAW_STREAM_0 = 0,
+    HTC_RAW_STREAM_1 = 1,
+    HTC_RAW_STREAM_2 = 2,
+    HTC_RAW_STREAM_3 = 3,
+    HTC_RAW_STREAM_NUM_MAX
+} HTC_RAW_STREAM_ID;
+
+#define RAW_HTC_READ_BUFFERS_NUM    4
+#define RAW_HTC_WRITE_BUFFERS_NUM   4
+
+#define HTC_RAW_BUFFER_SIZE  1664
+
+typedef struct {
+    int currPtr;
+    int length;
+    A_UINT8       _Pad1[A_CACHE_LINE_PAD];	
+    unsigned char data[HTC_RAW_BUFFER_SIZE];
+    A_UINT8       _Pad2[A_CACHE_LINE_PAD];	
+    HTC_PACKET    HTCPacket;
+} raw_htc_buffer;
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+/*
+ *  add TCMD_MODE besides wmi and bypasswmi
+ *  in TCMD_MODE, only few TCMD releated wmi commands
+ *  counld be hanlder
+ */
+enum {
+    AR6000_WMI_MODE = 0,
+    AR6000_BYPASS_MODE,
+    AR6000_TCMD_MODE,
+    AR6000_WLAN_MODE
+};
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+struct ar_wep_key {
+    A_UINT8                 arKeyIndex;
+    A_UINT8                 arKeyLen;
+    A_UINT8                 arKey[64];
+} ;
+
+#ifdef ATH6K_CONFIG_CFG80211
+struct ar_key {
+    A_UINT8     key[WLAN_MAX_KEY_LEN];
+    A_UINT8     key_len;
+    A_UINT8     seq[IW_ENCODE_SEQ_MAX_SIZE];
+    A_UINT8     seq_len;
+    A_UINT32    cipher;
+};
+#endif /* ATH6K_CONFIG_CFG80211 */
+
+
+struct ar_node_mapping {
+    A_UINT8                 macAddress[6];
+    A_UINT8                 epId;
+    A_UINT8                 txPending;
+};
+
+struct ar_cookie {
+    unsigned long          arc_bp[2];    /* Must be first field */
+    HTC_PACKET             HtcPkt;       /* HTC packet wrapper */
+    struct ar_cookie *arc_list_next;
+};
+
+struct ar_hb_chlng_resp {
+    A_TIMER                 timer;
+    A_UINT32                frequency;
+    A_UINT32                seqNum;
+    A_BOOL                  outstanding;
+    A_UINT8                 missCnt;
+    A_UINT8                 missThres;
+};
+
+/* Per STA data, used in AP mode */
+/*TODO: All this should move to OS independent dir */
+
+#define STA_PWR_MGMT_MASK   0x1
+#define STA_PWR_MGMT_SHIFT  0x0
+#define STA_PWR_MGMT_AWAKE  0x0
+#define STA_PWR_MGMT_SLEEP  0x1
+
+#define STA_SET_PWR_SLEEP(sta) (sta->flags |= (STA_PWR_MGMT_MASK << STA_PWR_MGMT_SHIFT))
+#define STA_CLR_PWR_SLEEP(sta) (sta->flags &= ~(STA_PWR_MGMT_MASK << STA_PWR_MGMT_SHIFT))
+#define STA_IS_PWR_SLEEP(sta) ((sta->flags >> STA_PWR_MGMT_SHIFT) & STA_PWR_MGMT_MASK)
+
+#define STA_PS_POLLED_MASK  0x1
+#define STA_PS_POLLED_SHIFT 0x1
+
+#define STA_SET_PS_POLLED(sta) (sta->flags |= (STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+#define STA_CLR_PS_POLLED(sta) (sta->flags &= ~(STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+#define STA_IS_PS_POLLED(sta) (sta->flags & (STA_PS_POLLED_MASK << STA_PS_POLLED_SHIFT))
+
+#define STA_APSD_TRIGGER_MASK  0x1
+#define STA_APSD_TRIGGER_SHIFT 0x2
+#define STA_APSD_EOSP_MASK     0x1
+#define STA_APSD_EOSP_SHIFT    0x3
+
+#define STA_SET_APSD_TRIGGER(sta) (sta->flags |= (STA_APSD_TRIGGER_MASK << STA_APSD_TRIGGER_SHIFT))
+#define STA_CLR_APSD_TRIGGER(sta) (sta->flags &= ~(STA_APSD_TRIGGER_MASK << STA_APSD_TRIGGER_SHIFT))
+#define STA_IS_APSD_TRIGGER(sta)  (sta->flags & (STA_APSD_TRIGGER_MASK << STA_APSD_TRIGGER_SHIFT))
+
+#define STA_SET_APSD_EOSP(sta) (sta->flags |= (STA_APSD_EOSP_MASK << STA_APSD_EOSP_SHIFT))
+#define STA_CLR_APSD_EOSP(sta) (sta->flags &= ~(STA_APSD_EOSP_MASK << STA_APSD_EOSP_SHIFT))
+#define STA_IS_APSD_EOSP(sta)  (sta->flags & (STA_APSD_EOSP_MASK << STA_APSD_EOSP_SHIFT))
+
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+#define APTC_TRAFFIC_SAMPLING_INTERVAL     100  /* msec */
+#define APTC_UPPER_THROUGHPUT_THRESHOLD    3000 /* Kbps */
+#define APTC_LOWER_THROUGHPUT_THRESHOLD    2000 /* Kbps */
+
+
+typedef struct aptc_traffic_record {
+    A_BOOL timerScheduled;
+    struct timeval samplingTS;
+    unsigned long bytesReceived;
+    unsigned long bytesTransmitted;
+} APTC_TRAFFIC_RECORD;
+
+#endif /* ADAPTIVE_POWER_THROUGHPUT_CONTROL */
+
+typedef struct user_rssi_compensation_t {
+    A_UINT16         customerID;
+    union {
+    A_UINT16         a_enable;
+    A_UINT16         bg_enable;
+    A_UINT16         enable;
+    };
+    A_INT16          bg_param_a;
+    A_INT16          bg_param_b;
+    A_INT16          a_param_a;
+    A_INT16          a_param_b;
+    A_UINT32         reserved;
+} USER_RSSI_CPENSATION;
+
+
+
+typedef struct {
+    A_UINT16                flags;
+    A_UINT8                 mac[ATH_MAC_LEN];
+    A_UINT8                 aid;
+    A_UINT8                 keymgmt;
+    A_UINT8                 ucipher;
+    A_UINT8                 auth;
+    A_UINT8                 wmode;
+    A_UINT8                 wpa_ie[IEEE80211_MAX_IE];
+    A_UINT8                 apsd_info;
+    A_NETBUF_QUEUE_T        psq;        /* power save q */
+    A_NETBUF_QUEUE_T        apsdq;      /* APSD delivery enabled q */
+    A_MUTEX_T               psqLock;
+    void                    *conn_aggr;
+    void                    *arPriv;
+    A_UINT8                 HT_present;
+} conn_t;
+
+typedef struct ar6_raw_htc {
+    HTC_ENDPOINT_ID         arRaw2EpMapping[HTC_RAW_STREAM_NUM_MAX];
+    HTC_RAW_STREAM_ID       arEp2RawMapping[ENDPOINT_MAX];
+    struct semaphore        raw_htc_read_sem[HTC_RAW_STREAM_NUM_MAX];
+    struct semaphore        raw_htc_write_sem[HTC_RAW_STREAM_NUM_MAX];
+    wait_queue_head_t       raw_htc_read_queue[HTC_RAW_STREAM_NUM_MAX];
+    wait_queue_head_t       raw_htc_write_queue[HTC_RAW_STREAM_NUM_MAX];
+    raw_htc_buffer          raw_htc_read_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_READ_BUFFERS_NUM];
+    raw_htc_buffer          raw_htc_write_buffer[HTC_RAW_STREAM_NUM_MAX][RAW_HTC_WRITE_BUFFERS_NUM];
+    A_BOOL                  write_buffer_available[HTC_RAW_STREAM_NUM_MAX];
+    A_BOOL                  read_buffer_available[HTC_RAW_STREAM_NUM_MAX];
+} AR_RAW_HTC_T;
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+typedef struct {
+    A_UINT16                len;
+    A_UINT8                 ver;
+    A_UINT8                 reserved;
+    A_UINT8                 buf[TC_CMDS_SIZE_MAX];
+} AR_TCMD_RESP;
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+typedef struct ar6_softc {
+    spinlock_t              arLock;
+    struct semaphore        arSem;
+    A_BOOL                  arWmiReady;
+    int                     arTxPending[ENDPOINT_MAX];
+    int                     arTotalTxDataPending;
+    A_UINT8                 arNumDataEndPts;
+    HTC_HANDLE              arHtcTarget;
+    void                    *arHifDevice;
+    struct ar6000_version   arVersion;
+    A_UINT32                arTargetType;
+    AR6000_WLAN_STATE       arWlanState;
+    struct ar_cookie        *arCookieList;
+    A_UINT32                arCookieCount;
+    A_UINT32                arControlCookieCount;
+    struct ar_hb_chlng_resp arHBChallengeResp;
+    HTC_ENDPOINT_ID         arAc2EpMapping[WMM_NUM_AC];
+    A_BOOL                  arAcStreamActive[WMM_NUM_AC];
+    A_UINT8                 arAcStreamPriMap[WMM_NUM_AC];
+    A_UINT8                 arHiAcStreamActivePri;
+    A_UINT8                 arEp2AcMapping[ENDPOINT_MAX];
+    HTC_ENDPOINT_ID         arControlEp;
+#ifdef HTC_RAW_INTERFACE
+    AR_RAW_HTC_T            *arRawHtc;
+#endif
+    A_BOOL                  arRawIfInit;
+    COMMON_CREDIT_STATE_INFO arCreditStateInfo;
+    A_BOOL                  arWMIControlEpFull;
+    A_BOOL                  dbgLogFetchInProgress;
+    A_UCHAR                 log_buffer[DBGLOG_HOST_LOG_BUFFER_SIZE];
+    A_UINT32                log_cnt;
+    A_UINT32                dbglog_init_done;
+    HTC_PACKET_QUEUE        amsdu_rx_buffer_queue;
+    A_BOOL                  bIsDestroyProgress; /* flag to indicate ar6k destroy is in progress */
+    A_UINT8                 rxMetaVersion;
+    A_INT32                 (*exitCallback)(void *config);  /* generic callback at AR6K exit */
+    HIF_DEVICE_OS_DEVICE_INFO   osDevInfo;
+    A_UINT16                arWlanPowerState;
+    A_BOOL                  arPlatPowerOff;
+    USER_RSSI_CPENSATION    rssi_compensation_param;
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+    A_UINT8                 tcmdRxReport;
+    A_UINT32                tcmdRxTotalPkt;
+    A_INT32                 tcmdRxRssi;
+    A_UINT32                tcmdPm;
+    A_UINT32                arTargetMode;
+    A_UINT32                tcmdRxcrcErrPkt;
+    A_UINT32                tcmdRxsecErrPkt;
+    A_UINT16                tcmdRateCnt[TCMD_MAX_RATES];
+    A_UINT16                tcmdRateCntShortGuard[TCMD_MAX_RATES];
+    AR_TCMD_RESP            tcmdResp;
+#endif
+    A_BOOL                  arWlanOff;
+#ifdef CONFIG_PM
+    A_UINT16                arWowState;
+    A_BOOL                  arBTOff;
+    A_BOOL                  arBTSharing;
+    A_UINT16                arSuspendCutPwrConfig;
+    A_UINT16                arSuspendConfig;
+    A_UINT16                arWlanOffConfig;
+    A_UINT16                arWow2Config;
+#endif
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+    void                    *hcidev_info;
+#endif
+    conn_t                  connTbl[NUM_CONN]; /* AP mode */
+    WMI_PER_STA_STAT        arAPStats[NUM_CONN]; /* AP mode */
+    A_UINT8                 inter_bss;   /* enable/disable inter bss data forward */
+    A_UINT8                 arAcsPolicy;
+    /* Concurrency */
+    A_UINT8                 arConfNumDev;
+    A_UINT8                 arHoldConnection;
+    A_TIMER                 ap_reconnect_timer;
+    A_UINT8                 gNumSta;
+    struct ar6_softc_dev    *arDev[NUM_DEV];
+    A_BOOL                  arResumeDone;
+    /* Bluetooth Address to be read from OTP */
+    A_UINT8                 bdaddr[6];
+/* AP+ BTCOEX - Variables declared for Maintaining States */ 
+    A_TIMER                 delbaTimer;
+    A_BOOL                  IsdelbaTimerInitialized;
+    A_UINT8                 delbaState;
+    A_UINT16                lteFreq;
+    A_UINT8                 isHostAsleep;
+#ifdef CONFIG_PM
+    A_BOOL                  sleep_mode_cmd_completed;
+    wait_queue_head_t       sleep_mode_cmd_completed_event;
+#endif
+} AR_SOFTC_T;
+
+typedef struct ar6_softc_ap {
+    WMI_AP_ACL              g_acl;              /* AP mode */
+    A_UINT8                 sta_list_index;     /* AP mode */
+    struct ieee80211req_key ap_mode_bkey;           /* AP mode */
+    A_NETBUF_QUEUE_T        mcastpsq;    /* power save q for Mcast frames */
+    A_MUTEX_T               mcastpsqLock;
+    A_BOOL                  DTIMExpired; /* flag to indicate DTIM expired */
+    A_UINT8                 intra_bss;   /* enable/disable intra bss data forward */
+    A_UINT8                 ap_hidden_ssid;
+    A_UINT8                 ap_country_code[3];
+    A_UINT8                 ap_dtim_period;
+    A_UINT16                ap_beacon_interval;
+    A_UINT16                arRTS;
+    void                    *pDfs;  /* Pointer to DFS state structure */
+    A_BOOL                  deKeySet;
+}AR_SOFTC_AP_T;
+
+typedef struct ar6_softc_sta {
+    A_BOOL                  arConnectPending;
+    A_UINT8                 arReqBssid[ATH_MAC_LEN];
+    A_UINT16                arListenIntervalB;
+    A_UINT16                arListenIntervalT;
+    A_UINT16                arBmissTimeB;
+    A_UINT16                arBmissTimeT;
+    A_INT8                  arRssi;
+    A_UINT8                 arSkipScan;
+    A_UINT16                arBeaconInterval;
+    A_UINT8                 arKeepaliveConfigured;
+    A_UINT8                 arIbssPsEnable;
+    A_UINT32                arMgmtFilter;
+    struct ar_node_mapping  arNodeMap[MAX_NODE_NUM];
+    A_UINT8                 arNodeNum;
+    A_UINT8                 arNexEpId;
+    A_UINT32                arConnectCtrlFlags;
+#ifdef USER_KEYS
+    A_INT32                 user_savedkeys_stat;
+    A_UINT32                user_key_ctrl;
+    struct USER_SAVEDKEYS   user_saved_keys;
+#endif
+    USER_RSSI_THOLD         rssi_map[12];
+    A_TIMER                 disconnect_timer;
+    A_UINT8                 arUserBssFilter;
+    A_INT8                  arNumChannels;
+    A_UINT16                arChannelList[WMI_MAX_CHANNELS];
+    A_UINT8                 scan_triggered;
+    WMI_SCAN_PARAMS_CMD     scParams;
+    A_UINT8                 scanSpecificSsid;
+    A_BOOL                  wpaOffloadEnabled;
+    A_BOOL                  disconnect_timer_inited;
+    A_UINT8                 arHostDisconnect;
+}AR_SOFTC_STA_T;
+
+typedef struct ar6_softc_dev {
+    struct net_device       *arNetDev;    /* net_device pointer */
+    void                    *arWmi;
+    A_BOOL                  arWmiEnabled;
+    wait_queue_head_t       arEvent;
+    spinlock_t              arPrivLock;
+    A_INT8                  arMaxRetries;
+    A_BOOL                  statsUpdatePending;
+    A_UINT8                 arPhyCapability;
+    A_UINT16                arChannelHint;
+    A_UINT16                arBssChannel;
+    A_BOOL                  arConnected;
+    int                     arSsidLen;
+    u_char                  arSsid[WMI_MAX_SSID_LEN];
+    A_UINT8                 arNextMode;
+    A_UINT8                 arNetworkType;
+    A_UINT8                 arNetworkSubType;
+    A_UINT8                 arDot11AuthMode;
+    A_UINT8                 arAuthMode;
+    A_UINT8                 arPairwiseCrypto;
+    A_UINT8                 arPairwiseCryptoLen;
+    A_UINT8                 arGroupCrypto;
+    A_UINT8                 arGroupCryptoLen;
+    A_UINT8                 arDefTxKeyIndex;
+    struct ar_wep_key       arWepKeyList[WMI_MAX_KEY_INDEX + 1];
+    A_UINT8                 arBssid[ATH_MAC_LEN];
+    A_UINT8                 arTxPwr;
+    A_BOOL                  arTxPwrSet;
+    A_INT32                 arBitRate;
+    struct net_device_stats arNetStats;
+    struct iw_statistics    arIwStats;
+    A_UINT32                arRateMask[WMI_MAX_RATE_MASK];
+    A_BOOL                  arNetQueueStopped;
+    A_UINT8                 arDeviceIndex;
+    A_BOOL                  arWmmEnabled;
+    A_UINT32                arRegCode;
+    A_UINT16                ap_profile_flag;    /* AP mode */
+    WMI_BTCOEX_CONFIG_EVENT arBtcoexConfig;
+    WMI_BTCOEX_STATS_EVENT  arBtcoexStats;
+    WMI_GET_WAC_INFO        wacInfo;
+#define AR_MCAST_FILTER_MAC_ADDR_SIZE  6
+    A_UINT8                 mcast_filters[MAC_MAX_FILTERS_PER_LIST][AR_MCAST_FILTER_MAC_ADDR_SIZE];
+    A_UINT8                 bdaddr[ATH_MAC_LEN];
+#ifdef ADAPTIVE_POWER_THROUGHPUT_CONTROL
+    APTC_TRAFFIC_RECORD     aptcTR;
+#endif
+#ifdef ATH6K_CONFIG_CFG80211
+    struct wireless_dev             *wdev;
+    struct cfg80211_scan_request    *scan_request;
+    struct ar_key                   keys[WMI_MAX_KEY_INDEX + 1];
+#endif /* ATH6K_CONFIG_CFG80211 */
+    TARGET_STATS            arTargetStats;
+    void                    *conn_aggr;
+    void                    *p2p_ctx;
+    AR_SOFTC_AP_T           arAp;
+    AR_SOFTC_STA_T          arSta;
+    AR_SOFTC_T              *arSoftc;
+    A_BOOL                  arDoConnectOnResume;
+    A_UINT8                 num_sta;
+    void                    *hcipal_info;
+    A_BOOL                  isBt30amp;
+    A_UINT8                 phymode;
+    A_BOOL                  is_sta_roaming;
+    A_UINT8                 PreAuthMode;
+    A_UINT8                 PreAuthKeyMgmt;
+}AR_SOFTC_DEV_T;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
+/* Looks like we need this for 2.4 kernels */
+static inline void *ar6k_priv(struct net_device *dev)
+{
+    return(dev->priv);
+}
+#else
+#ifdef ATH6K_CONFIG_CFG80211
+static inline void *ar6k_priv(struct net_device *dev)
+{
+    return (wdev_priv(dev->ieee80211_ptr));
+}
+#else
+#define ar6k_priv   netdev_priv
+#endif /* ATH6K_CONFIG_CFG80211 */
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,34)
+#define SET_HCI_BUS_TYPE(pHciDev, __bus, __type) do { \
+    (pHciDev)->type = (__bus); \
+} while(0)
+#else
+#define SET_HCI_BUS_TYPE(pHciDev, __bus, __type) do { \
+    (pHciDev)->bus = (__bus); \
+    (pHciDev)->dev_type = (__type); \
+} while(0)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+#define GET_INODE_FROM_FILEP(filp) \
+    (filp)->f_path.dentry->d_inode
+#else
+#define GET_INODE_FROM_FILEP(filp) \
+    (filp)->f_dentry->d_inode
+#endif
+
+#define arAc2EndpointID(ar,ac)          (ar)->arAc2EpMapping[(ac)]
+#define arSetAc2EndpointIDMap(ar,ac,ep)  \
+{  (ar)->arAc2EpMapping[(ac)] = (ep); \
+   (ar)->arEp2AcMapping[(ep)] = (ac); }
+#define arEndpoint2Ac(ar,ep)           (ar)->arEp2AcMapping[(ep)]
+
+#define arRawIfEnabled(ar) (ar)->arRawIfInit
+#define arRawStream2EndpointID(ar,raw)          (ar)->arRawHtc->arRaw2EpMapping[(raw)]
+#define arSetRawStream2EndpointIDMap(ar,raw,ep)  \
+{  (ar)->arRawHtc->arRaw2EpMapping[(raw)] = (ep); \
+   (ar)->arRawHtc->arEp2RawMapping[(ep)] = (raw); }
+#define arEndpoint2RawStreamID(ar,ep)           (ar)->arRawHtc->arEp2RawMapping[(ep)]
+
+struct ar_giwscan_param {
+    char    *current_ev;
+    char    *end_buf;
+    A_UINT32 bytes_needed;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+    struct iw_request_info *info;
+#endif
+};
+
+#define AR6000_STAT_INC(ar, stat)       (ar->arNetStats.stat++)
+
+#define AR6000_SPIN_LOCK(lock, param)   do {                            \
+    if (irqs_disabled()) {                                              \
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("IRQs disabled:AR6000_LOCK\n"));                 \
+    }                                                                   \
+    spin_lock_bh(lock);                                                 \
+} while (0)
+
+#define AR6000_SPIN_UNLOCK(lock, param) do {                            \
+    if (irqs_disabled()) {                                              \
+        AR_DEBUG_PRINTF(ATH_DEBUG_TRC,("IRQs disabled: AR6000_UNLOCK\n"));              \
+    }                                                                   \
+    spin_unlock_bh(lock);                                               \
+} while (0)
+
+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+int ar6000_ioctl_dispatcher(struct net_device *dev, struct ifreq *rq, int cmd);
+void ar6000_gpio_init(void);
+void ar6000_init_profile_info(AR_SOFTC_DEV_T *arPriv);
+void ar6000_install_static_wep_keys(AR_SOFTC_DEV_T *arPriv);
+int ar6000_init(struct net_device *dev);
+int ar6000_dbglog_get_debug_logs(AR_SOFTC_T *ar);
+void ar6000_TxDataCleanup(AR_SOFTC_T *ar);
+int ar6000_acl_data_tx(struct sk_buff *skb, AR_SOFTC_DEV_T *arPriv);
+void ar6000_restart_endpoint(AR_SOFTC_T *ar);
+void ar6000_stop_endpoint(AR_SOFTC_T *ar, A_BOOL keepprofile, A_BOOL getdbglogs);
+
+#ifdef HTC_RAW_INTERFACE
+
+#ifndef __user
+#define __user
+#endif
+
+int ar6000_htc_raw_open(AR_SOFTC_T *ar);
+int ar6000_htc_raw_close(AR_SOFTC_T *ar);
+ssize_t ar6000_htc_raw_read(AR_SOFTC_T *ar,
+                            HTC_RAW_STREAM_ID StreamID,
+                            char __user *buffer, size_t count);
+ssize_t ar6000_htc_raw_write(AR_SOFTC_T *ar,
+                             HTC_RAW_STREAM_ID StreamID,
+                             char __user *buffer, size_t count);
+
+#endif /* HTC_RAW_INTERFACE */
+
+/* AP mode */
+/*TODO: These routines should be moved to a file that is common across OS */
+conn_t *
+ieee80211_find_conn(AR_SOFTC_DEV_T *arPriv, A_UINT8 *node_addr);
+
+conn_t *
+ieee80211_find_conn_for_aid(AR_SOFTC_DEV_T *arPriv, A_UINT8 aid);
+
+A_UINT8
+remove_sta(AR_SOFTC_DEV_T *arPriv, A_UINT8 *mac, A_UINT16 reason);
+
+void
+ar6000_ap_cleanup(AR_SOFTC_DEV_T *arPriv);
+
+int
+ar6000_ap_set_num_sta(AR_SOFTC_T *ar, AR_SOFTC_DEV_T *arPriv, A_UINT8 num_sta);
+
+int
+ar6000_ap_handle_lte_freq(AR_SOFTC_T *ar, AR_SOFTC_DEV_T *arPriv, A_UINT16 lteFreq);
+
+void
+ar6000_send_delba (void *context, A_UINT8 reasonCode);
+/* HCI support */
+
+#ifndef EXPORT_HCI_BRIDGE_INTERFACE
+A_STATUS ar6000_setup_hci(AR_SOFTC_T *ar);
+void     ar6000_cleanup_hci(AR_SOFTC_T *ar);
+void     ar6000_set_default_ar3kconfig(AR_SOFTC_T *ar, void *ar3kconfig);
+
+/* HCI bridge testing */
+A_STATUS hci_test_send(AR_SOFTC_T *ar, struct sk_buff *skb);
+#endif
+void ar6000_init_mode_info(AR_SOFTC_DEV_T *arPriv);
+ATH_DEBUG_DECLARE_EXTERN(htc);
+ATH_DEBUG_DECLARE_EXTERN(wmi);
+ATH_DEBUG_DECLARE_EXTERN(bmi);
+ATH_DEBUG_DECLARE_EXTERN(hif);
+ATH_DEBUG_DECLARE_EXTERN(wlan);
+ATH_DEBUG_DECLARE_EXTERN(misc);
+
+extern A_UINT8 bcast_mac[];
+extern A_UINT8 null_mac[];
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _AR6000_H_ */
diff --git a/host/os/linux/include/ar6k_pal.h b/host/os/linux/include/ar6k_pal.h
new file mode 100644
index 0000000..98eb1db
--- /dev/null
+++ b/host/os/linux/include/ar6k_pal.h
@@ -0,0 +1,47 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+// The software source and binaries included in this development package are
+// licensed, not sold. You, or your company, received the package under one
+// or more license agreements. The rights granted to you are specifically
+// listed in these license agreement(s). All other rights remain with Atheros
+// Communications, Inc., its subsidiaries, or the respective owner including
+// those listed on the included copyright notices.  Distribution of any
+// portion of this package must be in strict compliance with the license
+// agreement(s) terms.
+// </copyright>
+// 
+// <summary>
+// 	PAL driver for AR6003
+// </summary>
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HCI_PAL_H_
+#define _HCI_PAL_H_
+#define HCI_GET_OP_CODE(p)          (((A_UINT16)((p)[1])) << 8) | ((A_UINT16)((p)[0]))
+#define TX_PACKET_RSV_OFFSET        32
+/* pal specific config structure */
+typedef A_BOOL (*ar6k_pal_recv_pkt_t)(void *pHciPalInfo, void *skb);
+typedef struct ar6k_pal_config_s
+{
+	ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
+}ar6k_pal_config_t;
+
+/**********************************
+ * HCI PAL private info structure
+ *********************************/
+typedef struct ar6k_hci_pal_info_s{
+
+        unsigned long ulFlags;
+#define HCI_NORMAL_MODE (1)
+#define HCI_REGISTERED (1<<1)
+        struct hci_dev *hdev;            /* BT Stack HCI dev */
+        AR_SOFTC_DEV_T *ar;
+
+}ar6k_hci_pal_info_t;
+
+void register_pal_cb(ar6k_pal_config_t *palConfig_p);
+#endif /* _HCI_PAL_H_ */
diff --git a/host/os/linux/include/ar6xapi_linux.h b/host/os/linux/include/ar6xapi_linux.h
new file mode 100644
index 0000000..8db0d64
--- /dev/null
+++ b/host/os/linux/include/ar6xapi_linux.h
@@ -0,0 +1,252 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6XAPI_LINUX_H
+#define _AR6XAPI_LINUX_H
+
+#include <wmi.h>
+#ifdef ATH_SUPPORT_DFS
+#include <dfs_common.h>
+#endif
+#include <htc_packet.h>
+#include <athdrv_linux.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct ar6_softc;
+struct ar6_softc_dev;
+
+#ifdef ATH_SUPPORT_DFS
+void ar6000_dfs_attach_event(struct ar6_softc_dev *arPriv, WMI_DFS_HOST_ATTACH_EVENT *capinfo);
+void ar6000_dfs_init_event(struct ar6_softc_dev *arPriv, WMI_DFS_HOST_INIT_EVENT *info);
+void ar6000_dfs_reset_delaylines_event(struct ar6_softc_dev *arPriv);
+void ar6000_dfs_reset_radarq_event(struct ar6_softc_dev *arPriv);
+void ar6000_dfs_reset_ar_event(struct ar6_softc_dev *arPriv);
+void ar6000_dfs_reset_arq_event(struct ar6_softc_dev *arPriv);
+void ar6000_dfs_set_dur_multiplier_event(struct ar6_softc_dev *arPriv, A_UINT32 value);
+void ar6000_dfs_set_debuglevel_event(struct ar6_softc_dev *arPriv, A_UINT32 value);
+void ar6000_dfs_set_bangradar_event(struct ar6_softc_dev *arPriv, A_UINT32 value);
+A_STATUS ar6000_dfs_set_maxpulsedur_cmd(struct ar6_softc_dev *arPriv, A_UINT32 value);
+A_STATUS ar6000_dfs_radar_detected_cmd(struct ar6_softc_dev *arPriv, A_INT16 chan_index, A_INT8 bang_radar);
+A_STATUS ar6000_dfs_set_minrssithresh_cmd(struct ar6_softc_dev *arPriv,  A_INT32 rssi);
+void ar6000_dfs_phyerr_event(struct ar6_softc_dev *arPriv, WMI_DFS_PHYERR_EVENT *info);
+#endif
+
+void ar6000_ready_event(void *devt, A_UINT8 *datap, A_UINT8 phyCap,
+                        A_UINT32 sw_ver, A_UINT32 abi_ver);
+A_STATUS ar6000_control_tx(void *devt, void *osbuf, HTC_ENDPOINT_ID eid);
+void ar6000_connect_event(struct ar6_softc_dev *arPriv, WMI_CONNECT_EVENT *pEvt);
+void ar6000_disconnect_event(struct ar6_softc_dev *arPriv, A_UINT8 reason,
+                             A_UINT8 *bssid, A_UINT8 assocRespLen,
+                             A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus);
+void ar6000_tkip_micerr_event(struct ar6_softc_dev *arPriv, A_UINT8 keyid,
+                              A_BOOL ismcast);
+void ar6000_bitrate_rx(void *devt, A_INT32 rateKbps);
+void ar6000_channelList_rx(void *devt, A_INT8 numChan, A_UINT16 *chanList);
+void ar6000_regDomain_event(struct ar6_softc_dev *arPriv, A_UINT32 regCode);
+void ar6000_txPwr_rx(void *devt, A_UINT8 txPwr);
+void ar6000_keepalive_rx(void *devt, A_UINT8 configured);
+void ar6000_neighborReport_event(struct ar6_softc_dev *arPriv, int numAps,
+                                 WMI_NEIGHBOR_INFO *info);
+void ar6000_set_numdataendpts(struct ar6_softc_dev *arPriv, A_UINT32 num);
+void ar6000_scanComplete_event(struct ar6_softc_dev *arPriv, A_STATUS status);
+void ar6000_targetStats_event(struct ar6_softc_dev *arPriv,  A_UINT8 *ptr, A_UINT32 len);
+void ar6000_rssiThreshold_event(struct ar6_softc_dev *arPriv,
+                                WMI_RSSI_THRESHOLD_VAL newThreshold,
+                                A_INT16 rssi);
+void ar6000_reportError_event(struct ar6_softc_dev *, WMI_TARGET_ERROR_VAL errorVal);
+void ar6000_cac_event(struct ar6_softc_dev *arPriv, A_UINT8 ac, A_UINT8 cac_indication,
+                                A_UINT8 statusCode, A_UINT8 *tspecSuggestion);
+void ar6000_channel_change_event(struct ar6_softc_dev *arPriv, A_UINT16 oldChannel, A_UINT16 newChannel);
+void ar6000_hbChallengeResp_event(struct ar6_softc_dev *arPriv, A_UINT32 cookie, A_UINT32 source);
+void
+ar6000_roam_tbl_event(struct ar6_softc_dev *arPriv, WMI_TARGET_ROAM_TBL *pTbl);
+
+void
+ar6000_roam_data_event(struct ar6_softc_dev *arPriv, WMI_TARGET_ROAM_DATA *p);
+
+void
+ar6000_wow_list_event(struct ar6_softc_dev *ar, A_UINT8 num_filters,
+                      WMI_GET_WOW_LIST_REPLY *wow_reply);
+
+void ar6000_pmkid_list_event(void *devt, A_UINT8 numPMKID,
+                             WMI_PMKID *pmkidList, A_UINT8 *bssidList);
+
+void ar6000_gpio_intr_rx(struct ar6_softc_dev *arPriv, A_UINT32 intr_mask, A_UINT32 input_values);
+void ar6000_gpio_data_rx(struct ar6_softc_dev *arPriv, A_UINT32 reg_id, A_UINT32 value);
+void ar6000_gpio_ack_rx(struct ar6_softc_dev *arPriv);
+
+A_INT32 rssi_compensation_calc_tcmd(struct ar6_softc *ar, A_UINT32 freq, A_INT32 rssi, A_UINT32 totalPkt);
+A_INT16 rssi_compensation_calc(struct ar6_softc_dev *arPriv, A_INT16 rssi);
+A_INT16 rssi_compensation_reverse_calc(struct ar6_softc_dev *arPriv, A_INT16 rssi, A_BOOL Above);
+
+void ar6000_dbglog_init_done(struct ar6_softc_dev *arPriv);
+
+void ar6000_wacinfo_event(struct ar6_softc_dev *ar,  A_UINT8 *ptr, A_UINT32 len);
+
+#ifdef SEND_EVENT_TO_APP
+void ar6000_send_event_to_app(struct ar6_softc_dev *arPriv, A_UINT16 eventId, A_UINT8 *datap, int len);
+void ar6000_send_generic_event_to_app(struct ar6_softc_dev *arPriv, A_UINT16 eventId, A_UINT8 *datap, int len);
+#endif
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+void ar6000_tcmd_rx_report_event(struct ar6_softc_dev *arPriv, A_UINT8 * results, int len);
+#endif
+
+void ar6000_tx_retry_err_event(void *devt);
+
+void ar6000_snrThresholdEvent_rx(void *devt,
+                                 WMI_SNR_THRESHOLD_VAL newThreshold,
+                                 A_UINT8 snr);
+
+void ar6000_lqThresholdEvent_rx(void *devt, WMI_LQ_THRESHOLD_VAL range, A_UINT8 lqVal);
+
+
+void ar6000_ratemask_rx(void *devt, A_UINT32 *ratemask);
+
+A_STATUS ar6000_get_driver_cfg(struct net_device *dev,
+                                A_UINT16 cfgParam,
+                                void *result);
+void ar6000_bssInfo_event_rx(struct ar6_softc_dev *arPriv, A_UINT8 *data, int len);
+A_STATUS ar6000_ap_mode_probe_rx(struct ar6_softc_dev *arPriv, A_UINT8 *data, int len);
+
+void ar6000_dbglog_event(struct ar6_softc_dev *arPriv, A_UINT32 dropped,
+                         A_INT8 *buffer, A_UINT32 length);
+
+int ar6000_dbglog_get_debug_logs(struct ar6_softc *ar);
+
+void ar6000_peer_event(void *devt, A_UINT8 eventCode, A_UINT8 *bssid);
+
+void ar6000_indicate_tx_activity(void *devt, A_UINT8 trafficClass, A_BOOL Active);
+HTC_ENDPOINT_ID  ar6000_ac2_endpoint_id ( void * devt, A_UINT8 ac);
+A_UINT8 ar6000_endpoint_id2_ac (void * devt, HTC_ENDPOINT_ID ep );
+
+void ar6000_btcoex_config_event(struct ar6_softc_dev *arPriv,  A_UINT8 *ptr, A_UINT32 len);
+
+void ar6000_btcoex_stats_event(struct ar6_softc_dev *arPriv,  A_UINT8 *ptr, A_UINT32 len) ;
+
+void ar6000_dset_open_req(void *devt,
+                          A_UINT32 id,
+                          A_UINT32 targ_handle,
+                          A_UINT32 targ_reply_fn,
+                          A_UINT32 targ_reply_arg);
+void ar6000_dset_close(void *devt, A_UINT32 access_cookie);
+void ar6000_dset_data_req(void *devt,
+                          A_UINT32 access_cookie,
+                          A_UINT32 offset,
+                          A_UINT32 length,
+                          A_UINT32 targ_buf,
+                          A_UINT32 targ_reply_fn,
+                          A_UINT32 targ_reply_arg);
+
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+void prof_count_rx(unsigned int addr, unsigned int count);
+#endif
+
+A_UINT32 ar6000_getnodeAge (void);
+
+A_UINT32 ar6000_getclkfreq (void);
+
+int ar6000_ap_mode_profile_commit(struct ar6_softc_dev *arPriv);
+
+A_STATUS ar6000_check_connect_request(struct ar6_softc_dev *arPriv, A_UINT8 check_pending_status);
+
+struct ieee80211req_wpaie;
+A_STATUS
+ar6000_ap_mode_get_wpa_ie(struct ar6_softc_dev *arPriv, struct ieee80211req_wpaie *wpaie);
+
+A_STATUS is_iwioctl_allowed(A_UINT8 mode, A_UINT16 cmd);
+
+A_STATUS is_xioctl_allowed(A_UINT8 mode, A_UINT8 submode, int cmd);
+
+void ar6000_pspoll_event(struct ar6_softc_dev *arPriv,A_UINT8 aid);
+
+void ar6000_dtimexpiry_event(struct ar6_softc_dev *arPriv);
+
+void ar6000_aggr_rcv_addba_req_evt(struct ar6_softc_dev *arPriv, WMI_ADDBA_REQ_EVENT *cmd);
+void ar6000_aggr_rcv_addba_resp_evt(struct ar6_softc_dev *arPriv, WMI_ADDBA_RESP_EVENT *cmd);
+void ar6000_aggr_rcv_delba_req_evt(struct ar6_softc_dev *arPriv, WMI_DELBA_EVENT *cmd);
+void ar6000_hci_event_rcv_evt(struct ar6_softc_dev *arPriv, WMI_HCI_EVENT *cmd);
+
+#ifdef WAPI_ENABLE
+int ap_set_wapi_key(struct ar6_softc_dev *arPriv, void *ik);
+void ap_wapi_rekey_event(struct ar6_softc_dev *arPriv, A_UINT8 type, A_UINT8 *mac);
+#endif
+
+#ifdef P2P
+void ar6000_p2pdev_event(struct ar6_softc_dev *arPriv, const A_UINT8 *addr,
+        const A_UINT8 *dev_addr,
+        const A_UINT8 *pri_dev_type, const A_UINT8 *dev_name,
+        A_UINT8 dev_name_len, A_UINT16 config_methods,
+        A_UINT8 dev_capab, A_UINT8 grp_capab);
+void p2p_go_neg_event(struct ar6_softc_dev *arPriv, A_UINT8 *res, A_UINT8 len);
+void p2p_go_neg_req_event(struct ar6_softc_dev *arPriv, const A_UINT8 *sa, A_UINT16 dev_passwd_id);
+void p2p_invite_sent_result_event(struct ar6_softc_dev *arPriv, A_UINT8 *res,
+            A_UINT8 len);
+void p2p_invite_rcvd_result_event(struct ar6_softc_dev *arPriv, A_UINT8 *res,
+            A_UINT8 len);
+void ar6000_p2p_prov_disc_req_event(struct ar6_softc_dev *arPriv,
+        const A_UINT8 *peer, A_UINT16 wps_config_method,
+        const A_UINT8 *dev_addr, const A_UINT8 *pri_dev_type,
+        const A_UINT8 *dev_name, A_UINT8 dev_name_len,
+        A_UINT16 supp_config_methods, A_UINT8 dev_capab, A_UINT8 group_capab);
+void ar6000_p2p_prov_disc_resp_event(struct ar6_softc_dev *arPriv,
+     A_UINT8 *peer, A_UINT16 config_methods);
+void *get_p2p_ctx(struct ar6_softc_dev *arPriv);
+void *get_wmi_ctx(struct ar6_softc_dev *arPriv);
+NETWORK_SUBTYPE get_network_subtype(struct ar6_softc_dev *arPriv);
+void ar6000_p2p_sd_rx_event(struct ar6_softc_dev *arPriv, WMI_P2P_SDPD_RX_EVENT *ev);
+void ar6000_p2pdev_lost_event(struct ar6_softc_dev *arPriv, const A_UINT8 *dev_addr);
+#endif
+
+A_STATUS ar6000_connect_to_ap(struct ar6_softc_dev *arPriv);
+A_STATUS ar6000_disconnect(struct ar6_softc_dev *arPriv);
+A_STATUS ar6000_update_wlan_pwr_state(struct ar6_softc *ar, AR6000_WLAN_STATE state, A_BOOL suspending);
+
+A_STATUS ar6000_set_wlan_state(struct ar6_softc *ar, AR6000_WLAN_STATE state);
+A_STATUS ar6000_set_bt_hw_state(struct ar6_softc *ar, A_UINT32 state);
+
+#ifdef CONFIG_PM
+A_STATUS ar6000_suspend_ev(void *context);
+A_STATUS ar6000_resume_ev(void *context);
+A_STATUS ar6000_power_change_ev(void *context, A_UINT32 config);
+void ar6000_check_wow_status(struct ar6_softc *ar, struct sk_buff *skb, A_BOOL isEvent);
+#endif
+
+void ar6000_pm_init(void);
+void ar6000_pm_exit(void);
+
+void ar6000_indicate_proberesp(struct ar6_softc_dev *arPriv , A_UINT8* pData , A_UINT16 len ,A_UINT8* bssid);
+void ar6000_indicate_beacon(struct ar6_softc_dev *arPriv , A_UINT8* pData , A_UINT16 len ,A_UINT8* bssid);
+void ar6000_assoc_req_report_event (void *context, A_UINT8 status, A_UINT8 rspType, A_UINT8* pData, int len);
+void ar6000_get_device_addr(struct ar6_softc_dev *arPriv, A_UINT8 *addr);
+NETWORK_TYPE ar6000_get_network_type(struct ar6_softc_dev *arPriv);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/host/os/linux/include/athdrv_linux.h b/host/os/linux/include/athdrv_linux.h
new file mode 100644
index 0000000..8ece7c7
--- /dev/null
+++ b/host/os/linux/include/athdrv_linux.h
@@ -0,0 +1,1482 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _ATHDRV_LINUX_H
+#define _ATHDRV_LINUX_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/*
+ * There are two types of ioctl's here: Standard ioctls and
+ * eXtended ioctls.  All extended ioctls (XIOCTL) are multiplexed
+ * off of the single ioctl command, AR6000_IOCTL_EXTENDED.  The
+ * arguments for every XIOCTL starts with a 32-bit command word
+ * that is used to select which extended ioctl is in use.  After
+ * the command word are command-specific arguments.
+ */
+
+/* Linux standard Wireless Extensions, private ioctl interfaces */
+#define IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)
+#define IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+1)
+#define IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+2)
+#define IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+3)
+#define IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+4)
+#define IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+5)
+//#define IEEE80211_IOCTL_GETPARAM             (SIOCIWFIRSTPRIV+6)
+//#define IEEE80211_IOCTL_SETWMMPARAMS         (SIOCIWFIRSTPRIV+7)
+//#define IEEE80211_IOCTL_GETWMMPARAMS         (SIOCIWFIRSTPRIV+8)
+//#define IEEE80211_IOCTL_GETOPTIE             (SIOCIWFIRSTPRIV+9)
+//#define IEEE80211_IOCTL_SETAUTHALG           (SIOCIWFIRSTPRIV+10)
+#define IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+10)
+
+
+
+/*                      ====WMI Ioctls====                                    */
+/*
+ *
+ * Many ioctls simply provide WMI services to application code:
+ * an application makes such an ioctl call with a set of arguments
+ * that are packaged into the corresponding WMI message, and sent
+ * to the Target.
+ */
+
+#define AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+11)
+/*
+ * arguments:
+ *   ar6000_version *revision
+ */
+
+#define AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+12)
+/*
+ * arguments:
+ *   WMI_POWER_MODE_CMD pwrModeCmd (see include/wmi.h)
+ * uses: WMI_SET_POWER_MODE_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+13)
+/*
+ * arguments:
+ *   WMI_SCAN_PARAMS_CMD scanParams (see include/wmi.h)
+ * uses: WMI_SET_SCAN_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+14)
+/*
+ * arguments:
+ *   UINT32 listenInterval
+ * uses: WMI_SET_LISTEN_INT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+15)
+/*
+ * arguments:
+ *   WMI_BSS_FILTER filter (see include/wmi.h)
+ * uses: WMI_SET_BSS_FILTER_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)
+/*
+ * arguments:
+ *   WMI_CHANNEL_PARAMS_CMD chParams
+ * uses: WMI_SET_CHANNEL_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)
+/*
+ * arguments:
+ *   WMI_PROBED_SSID_CMD probedSsids (see include/wmi.h)
+ * uses: WMI_SETPROBED_SSID_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)
+/*
+ * arguments:
+ *   WMI_POWER_PARAMS_CMD powerParams (see include/wmi.h)
+ * uses: WMI_SET_POWER_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)
+/*
+ * arguments:
+ *   WMI_ADD_BAD_AP_CMD badAPs (see include/wmi.h)
+ * uses: WMI_ADD_BAD_AP_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)
+/*
+ * arguments:
+ *   ar6000_queuereq queueRequest (see below)
+ */
+
+#define AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)
+/*
+ * arguments:
+ *   WMI_CREATE_PSTREAM createPstreamCmd (see include/wmi.h)
+ * uses: WMI_CREATE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)
+/*
+ * arguments:
+ *   WMI_DELETE_PSTREAM_CMD deletePstreamCmd (see include/wmi.h)
+ * uses: WMI_DELETE_PSTREAM_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_SNRTHRESHOLD   (SIOCIWFIRSTPRIV+23)
+/*
+ * arguments:
+ *   WMI_SNR_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+ * uses: WMI_SNR_THRESHOLD_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)
+/*
+ * arguments:
+ *   WMI_TARGET_ERROR_REPORT_BITMASK errorReportBitMask (see include/wmi.h)
+ * uses: WMI_TARGET_ERROR_REPORT_BITMASK_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)
+/*
+ * arguments:
+ *   TARGET_STATS *targetStats (see below)
+ * uses: WMI_GET_STATISTICS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)
+/*
+ * arguments:
+ *   WMI_SET_ASSOC_INFO_CMD setAssocInfoCmd
+ * uses: WMI_SET_ASSOC_INFO_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)
+/*
+ * arguments:
+ *   WMI_SET_ACCESS_PARAMS_CMD setAccessParams (see include/wmi.h)
+ * uses: WMI_SET_ACCESS_PARAMS_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)
+/*
+ * arguments:
+ *   UINT32 beaconMissTime
+ * uses: WMI_SET_BMISS_TIME_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)
+/*
+ * arguments:
+ *   WMI_DISC_TIMEOUT_CMD disconnectTimeoutCmd (see include/wmi.h)
+ * uses: WMI_SET_DISC_TIMEOUT_CMDID
+ */
+
+#define AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)
+/*
+ * arguments:
+ *   WMI_IBSS_PM_CAPS_CMD ibssPowerMgmtCapsCmd
+ * uses: WMI_SET_IBSS_PM_CAPS_CMDID
+ */
+
+/*
+ * There is a very small space available for driver-private
+ * wireless ioctls.  In order to circumvent this limitation,
+ * we multiplex a bunch of ioctls (XIOCTLs) on top of a
+ * single AR6000_IOCTL_EXTENDED ioctl.
+ */
+#define AR6000_IOCTL_EXTENDED                (SIOCIWFIRSTPRIV+31)
+
+typedef enum {
+    AR6000_XIOCTL_BMI_DONE = 1,
+    AR6000_XIOCTL_BMI_READ_MEMORY,
+    AR6000_XIOCTL_BMI_WRITE_MEMORY,
+    AR6000_XIOCTL_BMI_EXECUTE,
+    AR6000_XIOCTL_BMI_SET_APP_START,
+    AR6000_XIOCTL_BMI_READ_SOC_REGISTER,
+    AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER,
+    AR6000_XIOCTL_BMI_TEST,
+    AR6000_XIOCTL_UNUSED9,
+    AR6000_XIOCTL_UNUSED10, /* 10 */
+    AR6000_XIOCTL_UNUSED11,
+    AR6000_XIOCTL_FORCE_TARGET_RESET,
+    AR6000_XIOCTL_HTC_RAW_OPEN,
+    AR6000_XIOCTL_HTC_RAW_CLOSE,
+    AR6000_XIOCTL_HTC_RAW_READ,
+    AR6000_XIOCTL_HTC_RAW_WRITE,
+    AR6000_XIOCTL_CHECK_TARGET_READY,
+    AR6000_XIOCTL_GPIO_OUTPUT_SET,
+    AR6000_XIOCTL_GPIO_INPUT_GET,
+    AR6000_XIOCTL_GPIO_REGISTER_SET,  /* 20 */
+    AR6000_XIOCTL_GPIO_REGISTER_GET,
+    AR6000_XIOCTL_GPIO_INTR_ACK,
+    AR6000_XIOCTL_GPIO_INTR_WAIT,
+    AR6000_XIOCTL_SET_ADHOC_BSSID,
+    AR6000_XIOCTL_UNUSED25,
+    AR6000_XIOCTL_UNUSED26,
+    AR6000_XIOCTL_SET_BEACON_INTVAL,
+    IEEE80211_IOCTL_SETAUTHALG,
+    AR6000_XIOCTL_SET_VOICE_PKT_SIZE,
+    AR6000_XIOCTL_SET_MAX_SP,   /* 30 */
+    AR6000_XIOCTL_WMI_GET_ROAM_TBL,
+    AR6000_XIOCTL_WMI_SET_ROAM_CTRL,
+    AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS,
+    AR6000_XIOCTRL_WMI_GET_POWER_MODE,
+    AR6000_XIOCTRL_WMI_SET_WLAN_STATE,
+    AR6000_XIOCTL_WMI_GET_ROAM_DATA,
+    AR6000_XIOCTL_WMI_SETRETRYLIMITS,
+    AR6000_XIOCTL_TCMD_CONT_TX,
+    AR6000_XIOCTL_TCMD_CONT_RX,
+    AR6000_XIOCTL_TCMD_PM,  /* 40 */
+    AR6000_XIOCTL_WMI_STARTSCAN,
+    AR6000_XIOCTL_WMI_SETFIXRATES,
+    AR6000_XIOCTL_WMI_GETFIXRATES,
+    AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD,
+    AR6000_XIOCTL_WMI_CLR_RSSISNR,                   
+    AR6000_XIOCTL_WMI_SET_LQTHRESHOLD,               
+    AR6000_XIOCTL_WMI_SET_RTS,
+    AR6000_XIOCTL_WMI_SET_LPREAMBLE,
+    AR6000_XIOCTL_WMI_SET_AUTHMODE,
+    AR6000_XIOCTL_WMI_SET_REASSOCMODE, /* 50 */
+    AR6000_XIOCTL_WMI_SET_WMM,
+    AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS,
+    AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP,
+    AR6000_XIOCTL_WMI_GET_RD,
+    AR6000_XIOCTL_DIAG_READ,
+    AR6000_XIOCTL_DIAG_WRITE,
+    AR6000_XIOCTL_WMI_SET_TXOP,
+    AR6000_XIOCTL_USER_SETKEYS,
+    AR6000_XIOCTL_WMI_SET_KEEPALIVE,
+    AR6000_XIOCTL_WMI_GET_KEEPALIVE, /* 60 */
+    AR6000_XIOCTL_BMI_ROMPATCH_INSTALL,
+    AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL,
+    AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE,
+    AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE,
+    AR6000_XIOCTL_WMI_SET_APPIE,
+    AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER,
+    AR6000_XIOCTL_DBGLOG_CFG_MODULE,
+    AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS,
+    AR6000_XIOCTL_WMI_SET_WSC_STATUS = 70,  /* 70 */
+    AR6000_XIOCTL_WMI_SET_BT_STATUS,
+    AR6000_XIOCTL_WMI_SET_BT_PARAMS,
+    AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE,
+    AR6000_XIOCTL_WMI_SET_WOW_MODE,
+    AR6000_XIOCTL_WMI_GET_WOW_LIST,
+    AR6000_XIOCTL_WMI_ADD_WOW_PATTERN,
+    AR6000_XIOCTL_WMI_DEL_WOW_PATTERN,
+    AR6000_XIOCTL_TARGET_INFO,
+    AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE,
+    AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE,  /* 80 */
+    AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS,
+    AR6000_XIOCTL_WMI_SET_AKMP_PARAMS,
+    AR6000_XIOCTL_WMI_GET_PMKID_LIST,
+    AR6000_XIOCTL_WMI_SET_PMKID_LIST,
+    AR6000_XIOCTL_WMI_SET_PARAMS,
+    AR6000_XIOCTL_WMI_SET_MCAST_FILTER,
+    AR6000_XIOCTL_WMI_DEL_MCAST_FILTER,
+    AR6000_XIOCTL_UNUSED90 = 90,  /* 90 */
+    AR6000_XIOCTL_BMI_LZ_STREAM_START,
+    AR6000_XIOCTL_BMI_LZ_DATA,
+    AR6000_XIOCTL_PROF_CFG,
+    AR6000_XIOCTL_PROF_ADDR_SET,
+    AR6000_XIOCTL_PROF_START,
+    AR6000_XIOCTL_PROF_STOP,
+    AR6000_XIOCTL_PROF_COUNT_GET,
+    AR6000_XIOCTL_WMI_ABORT_SCAN,
+    AR6000_XIOCTL_AP_GET_STA_LIST,
+    AR6000_XIOCTL_AP_HIDDEN_SSID, /* 100 */
+    AR6000_XIOCTL_AP_SET_NUM_STA,
+    AR6000_XIOCTL_AP_SET_ACL_MAC,
+    AR6000_XIOCTL_AP_GET_ACL_LIST,
+    AR6000_XIOCTL_AP_COMMIT_CONFIG,
+    IEEE80211_IOCTL_GETWPAIE,
+    AR6000_XIOCTL_AP_CONN_INACT_TIME,
+    AR6000_XIOCTL_AP_PROT_SCAN_TIME,
+    AR6000_XIOCTL_AP_SET_COUNTRY,
+    AR6000_XIOCTL_AP_SET_DTIM,
+    AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT, /* 110 */
+    AR6000_XIOCTL_SET_IP,
+    AR6000_XIOCTL_AP_SET_ACL_POLICY,
+    AR6000_XIOCTL_AP_CTRL_BSS_COMM,
+    AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO,
+    AR6000_XIOCTL_MODULE_DEBUG_SET_MASK,
+    AR6000_XIOCTL_MODULE_DEBUG_GET_MASK,
+    AR6000_XIOCTL_DUMP_RCV_AGGR_STATS,
+    AR6000_XIOCTL_SET_HT_CAP,
+    AR6000_XIOCTL_SET_HT_OP,
+    AR6000_XIOCTL_AP_GET_STAT, /* 120 */
+    AR6000_XIOCTL_SET_TX_SELECT_RATES,
+    AR6000_XIOCTL_SETUP_AGGR,
+    AR6000_XIOCTL_ALLOW_AGGR,
+    AR6000_XIOCTL_AP_GET_HIDDEN_SSID,
+    AR6000_XIOCTL_AP_GET_COUNTRY,
+    AR6000_XIOCTL_AP_GET_WMODE,
+    AR6000_XIOCTL_AP_GET_DTIM,
+    AR6000_XIOCTL_AP_GET_BINTVL,
+    AR6000_XIOCTL_AP_GET_RTS,
+    AR6000_XIOCTL_DELE_AGGR, /* 130 */
+    AR6000_XIOCTL_FETCH_TARGET_REGS,
+    AR6000_XIOCTL_HCI_CMD,
+    AR6000_XIOCTL_ACL_DATA,
+    AR6000_XIOCTL_WLAN_CONN_PRECEDENCE,
+    AR6000_XIOCTL_AP_SET_11BG_RATESET,
+    AR6000_XIOCTL_WMI_SET_AP_PS,
+    AR6000_XIOCTL_WMI_MCAST_FILTER,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG, /* 140 */
+    AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG,
+    AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG,
+    AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS,
+    AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG,
+    AR6000_XIOCTL_WMI_GET_BTCOEX_STATS,
+    AR6000_XIOCTL_WMI_SET_QOS_SUPP,
+    AR6000_XIOCTL_AP_SET_DFS,
+    AR6000_XIOCTL_WMI_P2P_DISCOVER, /* 150 */
+    AR6000_XIOCTL_WMI_P2P_STOP_FIND,
+    AR6000_XIOCTL_WMI_P2P_CANCEL,
+    AR6000_XIOCTL_WMI_P2P_LISTEN,
+    AR6000_XIOCTL_WMI_P2P_GO_NEG,
+    AR6000_XIOCTL_WMI_P2P_AUTH_GO_NEG,
+    AR6000_XIOCTL_WMI_P2P_REJECT,
+    AR6000_XIOCTL_WMI_P2P_CONFIG,
+    AR6000_XIOCTL_WMI_WPS_CONFIG,
+    AR6000_XIOCTL_WMI_P2P_FINDNODE,
+    AR6000_XIOCTL_WMI_P2P_GRP_INIT, /* 160 */
+    AR6000_XIOCTL_WMI_P2P_GRP_FORMATION_DONE,
+    AR6000_XIOCTL_WMI_P2P_INVITE,
+    AR6000_XIOCTL_WMI_P2P_PROV_DISC,
+    AR6000_XIOCTL_WMI_P2P_SET,
+    AR6000_XIOCTL_WMI_P2P_PEER,
+    AR6000_XIOCTL_WMI_P2P_FLUSH,
+    AR6000_XIOCTL_WMI_GET_GO_PARAMS,
+    AR6000_XIOCTL_P2P_AUTH_INVITE,
+    AR6000_XIOCTL_WMI_P2P_GET_IF_ADDR,
+    AR6000_XIOCTL_WMI_P2P_GET_DEV_ADDR, /* 170 */
+    AR6000_XIOCTL_WMI_P2P_SDPD_TX_CMD,
+    AR6000_XIOTCL_WMI_P2P_SD_CANCEL_REQUEST,
+    AR6000_XIOCTL_SET_BT_HW_POWER_STATE,
+    AR6000_XIOCTL_GET_BT_HW_POWER_STATE,
+    AR6000_XIOCTL_GET_WLAN_SLEEP_STATE,
+    AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM,
+    AR6000_XIOCTL_WMI_ENABLE_WAC_PARAM,
+    AR6000_XIOCTL_WAC_SCAN_REPLY,
+    AR6000_XIOCTL_WMI_WAC_CTRL_REQ,
+    AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE, /* 180 */
+    AR6000_XIOCTL_WMI_SET_PASSPHRASE,
+    AR6000_XIOCTL_BMI_NVRAM_PROCESS,
+    AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM,
+    AR6000_XIOCTL_WMI_FORCE_ASSERT,
+    AR6000_XIOCTL_WMI_ENABLE_PKTLOG,
+    AR6000_XIOCTL_WMI_DISABLE_PKTLOG,
+    AR6000_XIOCTL_WMI_GET_PKTLOG,
+    AR6000_XIOCTL_AP_ACS_POLICY,
+    AR6000_XIOCTL_TCMD_CMDS,
+    AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES, /* 190 */
+    AR6000_XIOCTL_AP_GET_NUM_STA,
+    AR6000_XIOCTL_SUSPEND_DRIVER,
+    AR6000_XIOCTL_RESUME_DRIVER,
+    AR6000_XIOCTL_GET_SUBMODE,
+    AR6000_XIOCTL_WMI_AP_SET_APSD,
+    AR6000_XIOCTL_TCMD_SETREG, 
+    AR6000_XIOCTL_GET_HT_CAP,
+    AR6000_XIOCTL_WMI_GET_P2P_IE, 
+    AR6000_XIOCTL_WMI_P2P_GET_OWN_INFO,
+    AR6000_XIOCTL_WMI_LTE_FREQ,   /* 200 */
+    AR6000_XIOCTL_WMI_AP_IDLE_CLOSE_TIME,
+    AR6000_XIOCTL_WMI_SEND_FRAME,
+    AR6000_XIOCTL_WMI_GET_WMM,
+} XTND_IOCLTS; 
+
+
+
+///*                         ====BMI Extended Ioctls====                        */
+//
+//#define AR6000_XIOCTL_BMI_DONE                                  1
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_DONE)
+// * uses: BMI_DONE
+// */
+//
+//#define AR6000_XIOCTL_BMI_READ_MEMORY                           2
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_MEMORY)
+// *       UINT32 address
+// *       UINT32 length
+// *     }
+// *     char results[length]
+// *   }
+// * uses: BMI_READ_MEMORY
+// */
+//
+//#define AR6000_XIOCTL_BMI_WRITE_MEMORY                          3
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_MEMORY)
+// *   UINT32 address
+// *   UINT32 length
+// *   char data[length]
+// * uses: BMI_WRITE_MEMORY
+// */
+//
+//#define AR6000_XIOCTL_BMI_EXECUTE                               4
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_EXECUTE)
+// *   UINT32 TargetAddress
+// *   UINT32 parameter
+// * uses: BMI_EXECUTE
+// */
+//
+//#define AR6000_XIOCTL_BMI_SET_APP_START                         5
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_SET_APP_START)
+// *   UINT32 TargetAddress
+// * uses: BMI_SET_APP_START
+// */
+//
+//#define AR6000_XIOCTL_BMI_READ_SOC_REGISTER                     6
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_READ_SOC_REGISTER)
+// *       UINT32 TargetAddress, 32-bit aligned
+// *     }
+// *     UINT32 result
+// *   }
+// * uses: BMI_READ_SOC_REGISTER
+// */
+//
+//#define AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER                    7
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER)
+// *       UINT32 TargetAddress, 32-bit aligned
+// *       UINT32 newValue
+// *     }
+// * uses: BMI_WRITE_SOC_REGISTER
+// */
+//
+//#define AR6000_XIOCTL_BMI_TEST                                  8
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_TEST)
+// *   UINT32 address
+// *   UINT32 length
+// *   UINT32 count
+// */
+//
+//
+//
+///* Historical Host-side DataSet support */
+//#define AR6000_XIOCTL_UNUSED9                                   9
+//#define AR6000_XIOCTL_UNUSED10                                  10
+//#define AR6000_XIOCTL_UNUSED11                                  11
+//
+///*                      ====Misc Extended Ioctls====                          */
+//
+//#define AR6000_XIOCTL_FORCE_TARGET_RESET                        12
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_FORCE_TARGET_RESET)
+// */
+//
+//
+//#ifdef HTC_RAW_INTERFACE
+///* HTC Raw Interface Ioctls */
+//#define AR6000_XIOCTL_HTC_RAW_OPEN                              13
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_OPEN)
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_CLOSE                             14
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_CLOSE)
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_READ                              15
+///*
+// * arguments:
+// *   union {
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_HTC_RAW_READ)
+// *       UINT32 mailboxID
+// *       UINT32 length
+// *     }
+// *     results[length]
+// *   }
+// */
+//
+//#define AR6000_XIOCTL_HTC_RAW_WRITE                             16
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_HTC_RAW_WRITE)
+// *   UINT32 mailboxID
+// *   UINT32 length
+// *   char buffer[length]
+// */
+//#endif /* HTC_RAW_INTERFACE */
+//
+//#define AR6000_XIOCTL_CHECK_TARGET_READY                        17
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_CHECK_TARGET_READY)
+// */
+//
+//
+//
+///*                ====GPIO (General Purpose I/O) Extended Ioctls====          */
+//
+//#define AR6000_XIOCTL_GPIO_OUTPUT_SET                           18
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_OUTPUT_SET)
+// *   ar6000_gpio_output_set_cmd_s (see below)
+// * uses: WMIX_GPIO_OUTPUT_SET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INPUT_GET                            19
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INPUT_GET)
+// * uses: WMIX_GPIO_INPUT_GET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_REGISTER_SET                         20
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_SET)
+// *   ar6000_gpio_register_cmd_s (see below)
+// * uses: WMIX_GPIO_REGISTER_SET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_REGISTER_GET                         21
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_REGISTER_GET)
+// *   ar6000_gpio_register_cmd_s (see below)
+// * uses: WMIX_GPIO_REGISTER_GET_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INTR_ACK                             22
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_ACK)
+// *   ar6000_cpio_intr_ack_cmd_s (see below)
+// * uses: WMIX_GPIO_INTR_ACK_CMDID
+// */
+//
+//#define AR6000_XIOCTL_GPIO_INTR_WAIT                            23
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_GPIO_INTR_WAIT)
+// */
+//
+//
+//
+///*                    ====more wireless commands====                          */
+//
+//#define AR6000_XIOCTL_SET_ADHOC_BSSID                           24
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_ADHOC_BSSID)
+// *   WMI_SET_ADHOC_BSSID_CMD setAdHocBssidCmd (see include/wmi.h)
+// */
+//
+//#define AR6000_XIOCTL_SET_OPT_MODE                              25
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_OPT_MODE)
+// *   WMI_SET_OPT_MODE_CMD setOptModeCmd (see include/wmi.h)
+// * uses: WMI_SET_OPT_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_OPT_SEND_FRAME                            26
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_OPT_SEND_FRAME)
+// *   WMI_OPT_TX_FRAME_CMD optTxFrameCmd (see include/wmi.h)
+// * uses: WMI_OPT_TX_FRAME_CMDID
+// */
+//
+//#define AR6000_XIOCTL_SET_BEACON_INTVAL                         27
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_BEACON_INTVAL)
+// *   WMI_BEACON_INT_CMD beaconIntCmd (see include/wmi.h)
+// * uses: WMI_SET_BEACON_INT_CMDID
+// */
+//
+//
+//#define IEEE80211_IOCTL_SETAUTHALG                              28
+//
+//
+//#define AR6000_XIOCTL_SET_VOICE_PKT_SIZE                        29
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_VOICE_PKT_SIZE)
+// *   WMI_SET_VOICE_PKT_SIZE_CMD setVoicePktSizeCmd (see include/wmi.h)
+// * uses: WMI_SET_VOICE_PKT_SIZE_CMDID
+// */
+//
+//
+//#define AR6000_XIOCTL_SET_MAX_SP                                30
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_SET_MAX_SP)
+// *   WMI_SET_MAX_SP_LEN_CMD maxSPLen(see include/wmi.h)
+// * uses: WMI_SET_MAX_SP_LEN_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_ROAM_TBL                          31
+//
+//#define AR6000_XIOCTL_WMI_SET_ROAM_CTRL                         32
+//
+//#define AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS                 33
+//
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS)
+// *   WMI_SET_POWERSAVE_TIMERS_CMD powerSaveTimers(see include/wmi.h)
+// *   WMI_SET_POWERSAVE_TIMERS_CMDID
+// */
+//
+//#define AR6000_XIOCTRL_WMI_GET_POWER_MODE                        34
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTRL_WMI_GET_POWER_MODE)
+// */
+//
+//#define AR6000_XIOCTRL_WMI_SET_WLAN_STATE                       35
+
+typedef enum {
+    WLAN_DISABLED,
+    WLAN_ENABLED
+} AR6000_WLAN_STATE;
+
+///*
+// * arguments:
+// * enable/disable
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_ROAM_DATA                         36
+//
+//#define AR6000_XIOCTL_WMI_SETRETRYLIMITS                37
+///*
+// * arguments:
+// *   WMI_SET_RETRY_LIMITS_CMD ibssSetRetryLimitsCmd
+// * uses: WMI_SET_RETRY_LIMITS_CMDID
+// */
+//
+//#ifdef CONFIG_HOST_TCMD_SUPPORT
+///*       ====extended commands for radio test ====                          */
+//
+//#define AR6000_XIOCTL_TCMD_CONT_TX                      38
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_TX)
+// *   WMI_TCMD_CONT_TX_CMD contTxCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CONT_TX_CMDID
+// */
+//
+//#define AR6000_XIOCTL_TCMD_CONT_RX                      39
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CONT_RX)
+// *   WMI_TCMD_CONT_RX_CMD rxCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CONT_RX_CMDID
+// */
+//
+//#define AR6000_XIOCTL_TCMD_PM                           40
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_PM)
+// *   WMI_TCMD_PM_CMD pmCmd (see include/wmi.h)
+// * uses: WMI_TCMD_PM_CMDID
+// */
+//
+//#endif /* CONFIG_HOST_TCMD_SUPPORT */
+//
+//#define AR6000_XIOCTL_WMI_STARTSCAN                     41
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_STARTSCAN)
+// *   UINT8  scanType
+// *   UINT8  scanConnected
+// *   A_BOOL forceFgScan
+// * uses: WMI_START_SCAN_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SETFIXRATES                   42
+//
+//#define AR6000_XIOCTL_WMI_GETFIXRATES                   43
+//
+//
+//#define AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44
+///*
+// * arguments:
+// *   WMI_RSSI_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_RSSI_THRESHOLD_PARAMS_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_CLR_RSSISNR                   45
+///*
+// * arguments:
+// *   WMI_CLR_RSSISNR_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_CLR_RSSISNR_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46
+///*
+// * arguments:
+// *   WMI_LQ_THRESHOLD_PARAMS_CMD thresholdParams (see include/wmi.h)
+// * uses: WMI_LQ_THRESHOLD_PARAMS_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_RTS                        47
+///*
+// * arguments:
+// *   WMI_SET_RTS_MODE_CMD (see include/wmi.h)
+// * uses: WMI_SET_RTS_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48
+//
+//#define AR6000_XIOCTL_WMI_SET_AUTHMODE                  49
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_AUTHMODE)
+// *   UINT8  mode
+// * uses: WMI_SET_RECONNECT_AUTH_MODE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_REASSOCMODE               50
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_WMM)
+// *   UINT8  mode
+// * uses: WMI_SET_WMM_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_WMM                       51
+//
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS)
+// * UINT32 frequency
+// * UINT8  threshold
+// */
+//#define AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52
+//
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP)
+// * UINT32 cookie
+// */
+//#define AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_GET_RD)
+// *   UINT32 regDomain
+// */
+//#define AR6000_XIOCTL_WMI_GET_RD                        54
+//
+//#define AR6000_XIOCTL_DIAG_READ                         55
+//
+//#define AR6000_XIOCTL_DIAG_WRITE                        56
+//
+///*
+// * arguments cmd (AR6000_XIOCTL_SET_TXOP)
+// * WMI_TXOP_CFG  txopEnable
+// */
+//#define AR6000_XIOCTL_WMI_SET_TXOP                      57
+//
+//#ifdef USER_KEYS
+///*
+// * arguments:
+// * UINT32 cmd (AR6000_XIOCTL_USER_SETKEYS)
+// * UINT32 keyOpCtrl
+// * uses AR6000_USER_SETKEYS_INFO
+// */
+//#define AR6000_XIOCTL_USER_SETKEYS                      58
+//#endif /* USER_KEYS */
+//
+//#define AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59
+///*
+// * arguments:
+// *   UINT8 cmd (AR6000_XIOCTL_WMI_SET_KEEPALIVE)
+// *   UINT8 keepaliveInterval
+// * uses: WMI_SET_KEEPALIVE_CMDID
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60
+///*
+// * arguments:
+// *   UINT8 cmd (AR6000_XIOCTL_WMI_GET_KEEPALIVE)
+// *   UINT8 keepaliveInterval
+// *   A_BOOL configured
+// * uses: WMI_GET_KEEPALIVE_CMDID
+// */
+//
+///*               ====ROM Patching Extended Ioctls====                       */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61
+///*
+// * arguments:
+// *     union {
+// *       struct {
+// *         UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_INSTALL)
+// *         UINT32 ROM Address
+// *         UINT32 RAM Address
+// *         UINT32 number of bytes
+// *         UINT32 activate? (0 or 1)
+// *       }
+// *       A_UINT32 resulting rompatch ID
+// *     }
+// * uses: BMI_ROMPATCH_INSTALL
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL)
+// *       UINT32 rompatch ID
+// *     }
+// * uses: BMI_ROMPATCH_UNINSTALL
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE)
+// *       UINT32 rompatch count
+// *       UINT32 rompatch IDs[rompatch count]
+// *     }
+// * uses: BMI_ROMPATCH_ACTIVATE
+// */
+//
+//#define AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64
+///*
+// * arguments:
+// *     struct {
+// *       UINT32 cmd (AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE)
+// *       UINT32 rompatch count
+// *       UINT32 rompatch IDs[rompatch count]
+// *     }
+// * uses: BMI_ROMPATCH_DEACTIVATE
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_APPIE             65
+///*
+// * arguments:
+// *      struct {
+// *          UINT32 cmd (AR6000_XIOCTL_WMI_SET_APPIE)
+// *          UINT32  app_frmtype;
+// *          UINT32  app_buflen;
+// *          UINT8   app_buf[];
+// *      }
+// */
+//#define AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER    66
+///*
+// * arguments:
+// *      A_UINT32 filter_type;
+// */
+//
+//#define AR6000_XIOCTL_DBGLOG_CFG_MODULE             67
+//
+//#define AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS         68
+//
+//#define AR6000_XIOCTL_WMI_SET_WSC_STATUS            70
+///*
+// * arguments:
+// *      A_UINT32 wsc_status;
+// *            (WSC_REG_INACTIVE or WSC_REG_ACTIVE)
+// */
+//
+///*
+// * arguments:
+// *      struct {
+// *          A_UINT8 streamType;
+// *          A_UINT8 status;
+// *      }
+// * uses: WMI_SET_BT_STATUS_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_BT_STATUS             71
+//
+///*
+// * arguments:
+// *      struct {
+// *           A_UINT8 paramType;
+// *           union {
+// *               A_UINT8 noSCOPkts;
+// *               BT_PARAMS_A2DP a2dpParams;
+// *               BT_COEX_REGS regs;
+// *           };
+// *      }
+// * uses: WMI_SET_BT_PARAM_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_BT_PARAMS             72
+//
+//#define AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE       73
+//#define AR6000_XIOCTL_WMI_SET_WOW_MODE              74
+//#define AR6000_XIOCTL_WMI_GET_WOW_LIST              75
+//#define AR6000_XIOCTL_WMI_ADD_WOW_PATTERN           76
+//#define AR6000_XIOCTL_WMI_DEL_WOW_PATTERN           77
+//
+//
+//
+//#define AR6000_XIOCTL_TARGET_INFO                   78
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TARGET_INFO)
+// *   A_UINT32 TargetVersion (returned)
+// *   A_UINT32 TargetType    (returned)
+// * (See also bmi_msg.h target_ver and target_type)
+// */
+//
+//#define AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE         79
+///*
+// * arguments:
+// *      none
+// */
+//
+//#define AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE       80
+///*
+// * This ioctl is used to emulate traffic activity
+// * timeouts.  Activity/inactivity will trigger the driver
+// * to re-balance credits.
+// *
+// * arguments:
+// *      ar6000_traffic_activity_change
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS    81
+///*
+// * This ioctl is used to set the connect control flags
+// *
+// * arguments:
+// *      A_UINT32 connectCtrlFlags
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_AKMP_PARAMS              82
+///*
+// * This IOCTL sets any Authentication,Key Management and Protection
+// * related parameters. This is used along with the information set in
+// * Connect Command.
+// * Currently this enables Multiple PMKIDs to an AP.
+// *
+// * arguments:
+// *      struct {
+// *          A_UINT32    akmpInfo;
+// *      }
+// * uses: WMI_SET_AKMP_PARAMS_CMD
+// */
+//
+//#define AR6000_XIOCTL_WMI_GET_PMKID_LIST            83
+//
+//#define AR6000_XIOCTL_WMI_SET_PMKID_LIST            84
+///*
+// * This IOCTL is used to set a list of PMKIDs. This list of
+// * PMKIDs is used in the [Re]AssocReq Frame. This list is used
+// * only if the MultiPMKID option is enabled via the
+// * AR6000_XIOCTL_WMI_SET_AKMP_PARAMS  IOCTL.
+// *
+// * arguments:
+// *      struct {
+// *          A_UINT32    numPMKID;
+// *          WMI_PMKID   pmkidList[WMI_MAX_PMKID_CACHE];
+// *      }
+// * uses: WMI_SET_PMKIDLIST_CMD
+// */
+//
+//#define AR6000_XIOCTL_WMI_SET_PARAMS                85
+//#define AR6000_XIOCTL_WMI_SET_MCAST_FILTER     86
+//#define AR6000_XIOCTL_WMI_DEL_MCAST_FILTER     87
+//
+//
+///* Historical DSETPATCH support for INI patches */
+//#define AR6000_XIOCTL_UNUSED90                      90
+//
+//
+///* Support LZ-compressed firmware download */
+//#define AR6000_XIOCTL_BMI_LZ_STREAM_START           91
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_STREAM_START)
+// *   UINT32 address
+// * uses: BMI_LZ_STREAM_START
+// */
+//
+//#define AR6000_XIOCTL_BMI_LZ_DATA                   92
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_LZ_DATA)
+// *   UINT32 length
+// *   char data[length]
+// * uses: BMI_LZ_DATA
+// */
+//
+//#define AR6000_XIOCTL_PROF_CFG                      93
+///*
+// * arguments:
+// *   A_UINT32 period
+// *   A_UINT32 nbins
+// */
+//
+//#define AR6000_XIOCTL_PROF_ADDR_SET                 94
+///*
+// * arguments:
+// *   A_UINT32 Target address
+// */
+//
+//#define AR6000_XIOCTL_PROF_START                    95
+//
+//#define AR6000_XIOCTL_PROF_STOP                     96
+//
+//#define AR6000_XIOCTL_PROF_COUNT_GET                97
+//
+//#define AR6000_XIOCTL_WMI_ABORT_SCAN                98
+//
+///*
+// * AP mode
+// */
+//#define AR6000_XIOCTL_AP_GET_STA_LIST               99
+//
+//#define AR6000_XIOCTL_AP_HIDDEN_SSID                100
+//
+//#define AR6000_XIOCTL_AP_SET_NUM_STA                101
+//
+//#define AR6000_XIOCTL_AP_SET_ACL_MAC                102
+//
+//#define AR6000_XIOCTL_AP_GET_ACL_LIST               103
+//
+//#define AR6000_XIOCTL_AP_COMMIT_CONFIG              104
+//
+//#define IEEE80211_IOCTL_GETWPAIE                    105
+//
+//#define AR6000_XIOCTL_AP_CONN_INACT_TIME            106
+//
+//#define AR6000_XIOCTL_AP_PROT_SCAN_TIME             107
+//
+//#define AR6000_XIOCTL_AP_SET_COUNTRY                108
+//
+//#define AR6000_XIOCTL_AP_SET_DTIM                   109
+//
+//
+//
+//
+//#define AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT       110
+//
+//#define AR6000_XIOCTL_SET_IP                        111
+//
+//#define AR6000_XIOCTL_AP_SET_ACL_POLICY             112
+//
+//#define AR6000_XIOCTL_AP_CTRL_BSS_COMM              113
+//
+//#define AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO        114
+//
+//#define AR6000_XIOCTL_MODULE_DEBUG_SET_MASK         115
+//
+//#define AR6000_XIOCTL_MODULE_DEBUG_GET_MASK         116
+//
+//#define AR6000_XIOCTL_DUMP_RCV_AGGR_STATS           117
+//
+//#define AR6000_XIOCTL_SET_HT_CAP                    118
+//
+//#define AR6000_XIOCTL_SET_HT_OP                     119
+//
+//#define AR6000_XIOCTL_AP_GET_STAT                   120
+//
+//#define AR6000_XIOCTL_SET_TX_SELECT_RATES           121
+//
+//#define AR6000_XIOCTL_SETUP_AGGR                    122
+//
+//#define AR6000_XIOCTL_ALLOW_AGGR                    123
+//
+//#define AR6000_XIOCTL_AP_GET_HIDDEN_SSID            124
+//
+//#define AR6000_XIOCTL_AP_GET_COUNTRY                125
+//
+//#define AR6000_XIOCTL_AP_GET_WMODE                  126
+//
+//#define AR6000_XIOCTL_AP_GET_DTIM                   127
+//
+//#define AR6000_XIOCTL_AP_GET_BINTVL                 128
+//
+//#define AR6000_XIOCTL_AP_GET_RTS                    129
+//
+//#define AR6000_XIOCTL_DELE_AGGR                     130
+//
+//#define AR6000_XIOCTL_FETCH_TARGET_REGS             131
+//
+//#define AR6000_XIOCTL_HCI_CMD                       132
+//
+//#define AR6000_XIOCTL_ACL_DATA                      133
+//
+//#define AR6000_XIOCTL_WLAN_CONN_PRECEDENCE          134
+//
+//#define AR6000_XIOCTL_AP_SET_11BG_RATESET           135
+//
+//#define AR6000_XIOCTL_WMI_SET_AP_PS                 136
+//
+//#define AR6000_XIOCTL_WMI_MCAST_FILTER              137
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT                 138
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV           139
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG  140
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG             141
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG                142
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG         143
+//
+//#define AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG                      144
+//
+//#define AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS               145
+//
+//#define AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG                 146
+//
+//#define AR6000_XIOCTL_WMI_GET_BTCOEX_STATS                      147
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_WMI_SET_QOS_SUPP)
+// *   UINT8  mode
+// * uses: WMI_SET_QOS_SUPP_CMDID
+// */
+//#define AR6000_XIOCTL_WMI_SET_QOS_SUPP                  148 
+//
+//#define AR6000_XIOCTL_AP_SET_DFS                        149
+//
+//#ifdef P2P
+//#define AR6000_XIOCTL_WMI_P2P_DISCOVER            150
+//#define AR6000_XIOCTL_WMI_P2P_LISTEN              151
+//#define AR6000_XIOCTL_WMI_P2P_GO_NEG              152
+//#define AR6000_XIOCTL_WMI_P2P_CONFIG              153
+//#define AR6000_XIOCTL_WMI_WPS_CONFIG              154
+//#define AR6000_XIOCTL_WMI_P2P_FINDNODE            155
+//#endif
+//#define AR6000_XIOCTL_SET_BT_HW_POWER_STATE             156 
+//#define AR6000_XIOCTL_GET_BT_HW_POWER_STATE             157 
+//#define AR6000_XIOCTL_GET_WLAN_SLEEP_STATE              158
+//#define AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM              159
+///*
+// * arguments:
+// *   WMI_AP_PS_CMD apPsCmd
+// * uses: WMI_AP_PS_CMDID
+// */
+//
+//
+//// WAC
+//#define AR6000_XIOCTL_WMI_ENABLE_WAC_PARAM              160
+//
+//#define AR6000_XIOCTL_WAC_SCAN_REPLY                    161
+//
+//#define AR6000_XIOCTL_WMI_WAC_CTRL_REQ                  162
+//
+//#define AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE         163
+//
+//#define AR6000_XIOCTL_WMI_SET_PASSPHRASE                164
+//
+//#define AR6000_XIOCTL_BMI_NVRAM_PROCESS                 165
+//
+//#define AR6000_XIOCTL_AP_ACS_POLICY                     166
+//
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_BMI_NVRAM_PROCESS)
+// *   UINT8  name[BMI_NVRAM_SEG_NAME_SZ]
+// * uses: BMI_NVRAM_PROCESS
+// */
+//
+//
+//#ifdef CONFIG_HOST_TCMD_SUPPORT
+///*       ====additional extended commands for radio test ====                          */
+//
+//#define AR6000_XIOCTL_TCMD_CMDS                          167
+///*
+// * arguments:
+// *   UINT32 cmd (AR6000_XIOCTL_TCMD_CMDS)
+// *   WMI_TCMD_CMDS_CMD cmdsCmd (see include/wmi.h)
+// * uses: WMI_TCMD_CMDS_CMDID
+// */
+//
+//#endif //ifdef CONFIG_HOST_TCMD_SUPPORT
+//
+//#define AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM           168
+//
+//#define AR6000_XIOCTL_WMI_FORCE_ASSERT                  169
+//
+//#define AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES     170
+//
+//#define AR6000_XIOCTL_AP_GET_NUM_STA                    171
+//
+//#define AR6000_XIOCTL_SUSPEND_DRIVER                    172
+//
+//#define AR6000_XIOCTL_RESUME_DRIVER                     173
+
+/* used by AR6000_IOCTL_WMI_GETREV */
+struct ar6000_version {
+    A_UINT32        host_ver;
+    A_UINT32        target_ver;
+    A_UINT32        wlan_ver;
+    A_UINT32        abi_ver;
+    A_UINT32        targetconf_ver;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_QOS_QUEUE */
+struct ar6000_queuereq {
+    A_UINT8         trafficClass;
+    A_UINT16        activeTsids;
+};
+
+/* used by AR6000_IOCTL_WMI_GET_TARGET_STATS */
+typedef struct targetStats_t {
+    A_UINT64    tx_packets;
+    A_UINT64    tx_bytes;
+    A_UINT64    tx_unicast_pkts;
+    A_UINT64    tx_unicast_bytes;
+    A_UINT64    tx_multicast_pkts;
+    A_UINT64    tx_multicast_bytes;
+    A_UINT64    tx_broadcast_pkts;
+    A_UINT64    tx_broadcast_bytes;
+    A_UINT64    tx_rts_success_cnt;
+    A_UINT64    tx_packet_per_ac[4];
+
+    A_UINT64    tx_errors;
+    A_UINT64    tx_failed_cnt;
+    A_UINT64    tx_retry_cnt;
+    A_UINT64    tx_mult_retry_cnt;
+    A_UINT64    tx_rts_fail_cnt;
+
+    A_UINT64    rx_packets;
+    A_UINT64    rx_bytes;
+    A_UINT64    rx_unicast_pkts;
+    A_UINT64    rx_unicast_bytes;
+    A_UINT64    rx_multicast_pkts;
+    A_UINT64    rx_multicast_bytes;
+    A_UINT64    rx_broadcast_pkts;
+    A_UINT64    rx_broadcast_bytes;
+    A_UINT64    rx_fragment_pkt;
+
+    A_UINT64    rx_errors;
+    A_UINT64    rx_crcerr;
+    A_UINT64    rx_key_cache_miss;
+    A_UINT64    rx_decrypt_err;
+    A_UINT64    rx_duplicate_frames;
+
+    A_UINT64    tkip_local_mic_failure;
+    A_UINT64    tkip_counter_measures_invoked;
+    A_UINT64    tkip_replays;
+    A_UINT64    tkip_format_errors;
+    A_UINT64    ccmp_format_errors;
+    A_UINT64    ccmp_replays;
+
+    A_UINT64    power_save_failure_cnt;
+
+    A_UINT64    cs_bmiss_cnt;
+    A_UINT64    cs_lowRssi_cnt;
+    A_UINT64    cs_connect_cnt;
+    A_UINT64    cs_disconnect_cnt;
+
+    A_INT32     tx_unicast_rate;
+    A_INT32     rx_unicast_rate;
+
+    A_UINT32    lq_val;
+
+    A_UINT32    wow_num_pkts_dropped;
+    A_UINT16    wow_num_events_discarded;
+
+    A_INT16     noise_floor_calibation;
+    A_INT16     cs_rssi;
+    A_INT16     cs_aveBeacon_rssi;
+    A_UINT8     cs_aveBeacon_snr;
+    A_UINT8     cs_lastRoam_msec;
+    A_UINT8     cs_snr;
+
+    A_UINT8     wow_num_host_pkt_wakeups;
+    A_UINT8     wow_num_host_event_wakeups;
+
+    A_UINT32   arp_received;
+    A_UINT32   arp_matched;
+    A_UINT32   arp_replied;
+}TARGET_STATS;
+
+typedef struct targetStats_cmd_t {
+    TARGET_STATS targetStats;
+    int clearStats;
+} TARGET_STATS_CMD;
+
+/* used by AR6000_XIOCTL_USER_SETKEYS */
+
+/*
+ * Setting this bit to 1 doesnot initialize the RSC on the firmware
+ */
+#define AR6000_XIOCTL_USER_SETKEYS_RSC_CTRL    1
+#define AR6000_USER_SETKEYS_RSC_UNCHANGED     0x00000002
+
+typedef struct {
+    A_UINT32  keyOpCtrl;  /* Bit Map of Key Mgmt Ctrl Flags */
+} AR6000_USER_SETKEYS_INFO;
+
+
+/* used by AR6000_XIOCTL_GPIO_OUTPUT_SET */
+struct ar6000_gpio_output_set_cmd_s {
+    A_UINT32 set_mask;
+    A_UINT32 clear_mask;
+    A_UINT32 enable_mask;
+    A_UINT32 disable_mask;
+};
+
+/*
+ * used by AR6000_XIOCTL_GPIO_REGISTER_GET and AR6000_XIOCTL_GPIO_REGISTER_SET
+ */
+struct ar6000_gpio_register_cmd_s {
+    A_UINT32 gpioreg_id;
+    A_UINT32 value;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_ACK */
+struct ar6000_gpio_intr_ack_cmd_s {
+    A_UINT32 ack_mask;
+};
+
+/* used by AR6000_XIOCTL_GPIO_INTR_WAIT */
+struct ar6000_gpio_intr_wait_cmd_s {
+    A_UINT32 intr_mask;
+    A_UINT32 input_values;
+};
+
+/* used by the AR6000_XIOCTL_DBGLOG_CFG_MODULE */
+typedef struct ar6000_dbglog_module_config_s {
+    A_UINT32 valid;
+    A_UINT16 mmask;
+    A_UINT16 tsr;
+    A_BOOL   rep;
+    A_UINT16 size;
+} DBGLOG_MODULE_CONFIG;
+
+typedef struct user_rssi_thold_t {
+    A_INT16     tag;
+    A_INT16     rssi;
+} USER_RSSI_THOLD;
+
+typedef struct user_rssi_params_t {
+    A_UINT8            weight;
+    A_UINT32           pollTime;
+    USER_RSSI_THOLD    tholds[12];
+} USER_RSSI_PARAMS;
+
+typedef struct ar6000_get_btcoex_config_cmd_t{
+    A_UINT32 btProfileType;
+    A_UINT32 linkId;
+ }AR6000_GET_BTCOEX_CONFIG_CMD;
+
+typedef struct ar6000_btcoex_config_t {
+    AR6000_GET_BTCOEX_CONFIG_CMD  configCmd;
+    A_UINT32 * configEvent;
+} AR6000_BTCOEX_CONFIG;
+
+typedef struct ar6000_btcoex_stats_t {
+    A_UINT32 * statsEvent;
+ }AR6000_BTCOEX_STATS;
+/*
+ * Host driver may have some config parameters. Typically, these
+ * config params are one time config parameters. These could
+ * correspond to any of the underlying modules. Host driver exposes
+ * an api for the underlying modules to get this config.
+ */
+#define AR6000_DRIVER_CFG_BASE                  0x8000
+
+/* Should driver perform wlan node caching? */
+#define AR6000_DRIVER_CFG_GET_WLANNODECACHING   0x8001
+/*Should we log raw WMI msgs */
+#define AR6000_DRIVER_CFG_LOG_RAW_WMI_MSGS      0x8002
+
+/* used by AR6000_XIOCTL_DIAG_READ & AR6000_XIOCTL_DIAG_WRITE */
+struct ar6000_diag_window_cmd_s {
+    unsigned int addr;
+    unsigned int value;
+};
+
+
+struct ar6000_traffic_activity_change {
+    A_UINT32    StreamID;   /* stream ID to indicate activity change */
+    A_UINT32    Active;     /* active (1) or inactive (0) */
+};
+
+/* Used with AR6000_XIOCTL_PROF_COUNT_GET */
+struct prof_count_s {
+    A_UINT32    addr;       /* bin start address */
+    A_UINT32    count;      /* hit count */
+};
+
+
+/* used by AR6000_XIOCTL_MODULE_DEBUG_SET_MASK */
+/*         AR6000_XIOCTL_MODULE_DEBUG_GET_MASK */
+/*         AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO */
+struct drv_debug_module_s {
+    A_CHAR      modulename[128];   /* name of module */
+    A_UINT32    mask;              /* new mask to set .. or .. current mask */
+};
+
+/* used by AR6000_XIOCTL_P2P_AUTH_INVITE */
+#define ATH_MAC_LEN 6
+typedef PREPACK struct {
+    A_UINT32 auth;
+    A_UINT8 peer_addr[ATH_MAC_LEN];
+}POSTPACK P2P_AUTH_INVITE_CMD;
+
+/* All HCI related rx events are sent up to the host app
+ * via a wmi event id. It can contain ACL data or HCI event, 
+ * based on which it will be de-multiplexed.
+ */
+typedef enum {
+    PAL_HCI_EVENT = 0,
+    PAL_HCI_RX_DATA,
+} WMI_PAL_EVENT_INFO;
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/host/os/linux/include/athendpack_linux.h b/host/os/linux/include/athendpack_linux.h
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/host/os/linux/include/athendpack_linux.h
diff --git a/host/os/linux/include/athstartpack_linux.h b/host/os/linux/include/athstartpack_linux.h
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/host/os/linux/include/athstartpack_linux.h
diff --git a/host/os/linux/include/athtypes_linux.h b/host/os/linux/include/athtypes_linux.h
new file mode 100644
index 0000000..b008fef
--- /dev/null
+++ b/host/os/linux/include/athtypes_linux.h
@@ -0,0 +1,53 @@
+//------------------------------------------------------------------------------
+//
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _ATHTYPES_LINUX_H_
+#define _ATHTYPES_LINUX_H_
+
+#ifdef __KERNEL__
+#include <linux/types.h>
+#else
+#include <sys/types.h>
+#endif
+
+typedef int8_t      A_INT8;
+typedef int16_t     A_INT16;
+typedef int32_t     A_INT32;
+typedef int64_t     A_INT64;
+
+typedef u_int8_t     A_UINT8;
+typedef u_int16_t    A_UINT16;
+typedef u_int32_t    A_UINT32;
+typedef u_int64_t    A_UINT64;
+
+typedef int             A_BOOL;
+typedef char            A_CHAR;
+typedef unsigned char   A_UCHAR;
+typedef unsigned long   A_ATH_TIMER;
+
+#endif /* _ATHTYPES_LINUX_H_ */
+
diff --git a/host/os/linux/include/cfg80211.h b/host/os/linux/include/cfg80211.h
new file mode 100644
index 0000000..eeab404
--- /dev/null
+++ b/host/os/linux/include/cfg80211.h
@@ -0,0 +1,50 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _AR6K_CFG80211_H_
+#define _AR6K_CFG80211_H_
+
+struct wireless_dev *ar6k_cfg80211_init(struct device *dev);
+void ar6k_cfg80211_deinit(AR_SOFTC_DEV_T *arPriv);
+
+void ar6k_cfg80211_scanComplete_event(AR_SOFTC_DEV_T *arPriv, A_STATUS status);
+
+void ar6k_cfg80211_connect_event(AR_SOFTC_DEV_T *arPriv, A_UINT16 channel,
+                                A_UINT8 *bssid, A_UINT16 listenInterval,
+                                A_UINT16 beaconInterval,NETWORK_TYPE networkType,
+                                A_UINT8 beaconIeLen, A_UINT8 assocReqLen,
+                                A_UINT8 assocRespLen, A_UINT8 *assocInfo);
+
+void ar6k_cfg80211_disconnect_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 reason,
+                                    A_UINT8 *bssid, A_UINT8 assocRespLen,
+                                    A_UINT8 *assocInfo, A_UINT16 protocolReasonStatus);
+
+void ar6k_cfg80211_tkip_micerr_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 keyid, A_BOOL ismcast);
+
+#endif /* _AR6K_CFG80211_H_ */
+
+
+
+
+
+
diff --git a/host/os/linux/include/config_linux.h b/host/os/linux/include/config_linux.h
new file mode 100644
index 0000000..872f31e
--- /dev/null
+++ b/host/os/linux/include/config_linux.h
@@ -0,0 +1,71 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _CONFIG_LINUX_H_
+#define _CONFIG_LINUX_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <linux/version.h>
+
+/*
+ * Host-side GPIO support is optional.
+ * If run-time access to GPIO pins is not required, then
+ * this should be changed to #undef.
+ */
+#define CONFIG_HOST_GPIO_SUPPORT
+
+/*
+ * Host side Test Command support
+ * Note: when HCI SDIO is enabled, a low stack IRQ or statck overflow is
+ *       hit on FC10. So with HCI SDIO, minimize the stack allocation by 
+ *       mutually exclude TCMD_SUPPORT, which allocates large buffers 
+ *       in AR_TCMD_RESP in AR_SOFTC_T
+ *
+ */
+#ifndef HCI_TRANSPORT_SDIO
+#define CONFIG_HOST_TCMD_SUPPORT
+#endif
+
+/* Host-side support for Target-side profiling */
+#undef CONFIG_TARGET_PROFILE_SUPPORT
+/*DIX OFFLOAD SUPPORT*/
+/*#define DIX_RX_OFFLOAD*/
+/*#define DIX_TX_OFFLOAD*/
+
+/* IP/TCP checksum offload */
+/* Checksum offload is currently not supported for 64 bit platforms */
+#ifndef __LP64__
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25)
+#define CONFIG_CHECKSUM_OFFLOAD
+#endif
+#endif /* __LP64__ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
diff --git a/host/os/linux/include/debug_linux.h b/host/os/linux/include/debug_linux.h
new file mode 100644
index 0000000..c9ee7f2
--- /dev/null
+++ b/host/os/linux/include/debug_linux.h
@@ -0,0 +1,51 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _DEBUG_LINUX_H_
+#define _DEBUG_LINUX_H_
+
+    /* macro to remove parens */
+#define ATH_PRINTX_ARG(arg...) arg
+
+#ifdef DEBUG
+    /* NOTE: the AR_DEBUG_PRINTF macro is defined here to handle special handling of variable arg macros
+     * which may be compiler dependent. */
+#define AR_DEBUG_PRINTF(mask, args) do {        \
+    if (GET_ATH_MODULE_DEBUG_VAR_MASK(ATH_MODULE_NAME) & (mask)) {                    \
+        A_LOGGER(mask, ATH_MODULE_NAME, ATH_PRINTX_ARG args);    \
+    }                                            \
+} while (0)
+#else
+    /* on non-debug builds, keep in error and warning messages in the driver, all other
+     * message tracing will get compiled out */
+#define AR_DEBUG_PRINTF(mask, args) \
+    if ((mask) & (ATH_DEBUG_ERR | ATH_DEBUG_WARN)) { A_PRINTF(ATH_PRINTX_ARG args); }
+
+#endif
+
+    /* compile specific macro to get the function name string */
+#define _A_FUNCNAME_  __func__
+
+
+#endif /* _DEBUG_LINUX_H_ */
+
diff --git a/host/os/linux/include/export_hci_transport.h b/host/os/linux/include/export_hci_transport.h
new file mode 100644
index 0000000..c150680
--- /dev/null
+++ b/host/os/linux/include/export_hci_transport.h
@@ -0,0 +1,76 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2009-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// HCI bridge implementation
+//
+// Author(s): ="Atheros"
+//==============================================================================
+
+#include "hci_transport_api.h"
+#include "common_drv.h"
+
+extern HCI_TRANSPORT_HANDLE (*_HCI_TransportAttach)(void *HTCHandle, HCI_TRANSPORT_CONFIG_INFO *pInfo);
+extern void (*_HCI_TransportDetach)(HCI_TRANSPORT_HANDLE HciTrans);
+extern A_STATUS    (*_HCI_TransportAddReceivePkts)(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET_QUEUE *pQueue);
+extern A_STATUS    (*_HCI_TransportSendPkt)(HCI_TRANSPORT_HANDLE HciTrans, HTC_PACKET *pPacket, A_BOOL Synchronous);
+extern void        (*_HCI_TransportStop)(HCI_TRANSPORT_HANDLE HciTrans);
+extern A_STATUS    (*_HCI_TransportStart)(HCI_TRANSPORT_HANDLE HciTrans);
+extern A_STATUS    (*_HCI_TransportEnableDisableAsyncRecv)(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+extern A_STATUS    (*_HCI_TransportRecvHCIEventSync)(HCI_TRANSPORT_HANDLE HciTrans, 
+                                          HTC_PACKET           *pPacket,
+                                          int                  MaxPollMS);
+extern A_STATUS    (*_HCI_TransportSetBaudRate)(HCI_TRANSPORT_HANDLE HciTrans, A_UINT32 Baud);
+extern A_STATUS    (*_HCI_TransportEnablePowerMgmt)(HCI_TRANSPORT_HANDLE HciTrans, A_BOOL Enable);
+
+
+#define HCI_TransportAttach(HTCHandle, pInfo)   \
+            _HCI_TransportAttach((HTCHandle), (pInfo))
+#define HCI_TransportDetach(HciTrans)    \
+            _HCI_TransportDetach(HciTrans)
+#define HCI_TransportAddReceivePkts(HciTrans, pQueue)   \
+            _HCI_TransportAddReceivePkts((HciTrans), (pQueue))
+#define HCI_TransportSendPkt(HciTrans, pPacket, Synchronous)  \
+            _HCI_TransportSendPkt((HciTrans), (pPacket), (Synchronous))
+#define HCI_TransportStop(HciTrans)  \
+            _HCI_TransportStop((HciTrans))
+#define HCI_TransportStart(HciTrans)  \
+            _HCI_TransportStart((HciTrans))
+#define HCI_TransportEnableDisableAsyncRecv(HciTrans, Enable)   \
+            _HCI_TransportEnableDisableAsyncRecv((HciTrans), (Enable))
+#define HCI_TransportRecvHCIEventSync(HciTrans, pPacket, MaxPollMS)   \
+            _HCI_TransportRecvHCIEventSync((HciTrans), (pPacket), (MaxPollMS))
+#define HCI_TransportSetBaudRate(HciTrans, Baud)    \
+            _HCI_TransportSetBaudRate((HciTrans), (Baud))
+#define HCI_TransportEnablePowerMgmt(HciTrans, Enable)    \
+            _HCI_TransportEnablePowerMgmt((HciTrans), (Enable))
+
+
+extern A_STATUS ar6000_register_hci_transport(HCI_TRANSPORT_CALLBACKS *hciTransCallbacks);
+
+extern A_STATUS ar6000_get_hif_dev(HIF_DEVICE *device, void *config);
+
+extern A_STATUS ar6000_set_uart_config(HIF_DEVICE *hifDevice, A_UINT32 scale, A_UINT32 step);
+
+/* get core clock register settings
+ * data: 0 - 40/44MHz
+ *       1 - 80/88MHz
+ *       where (5G band/2.4G band)
+ * assume 2.4G band for now
+ */
+extern A_STATUS ar6000_get_core_clock_config(HIF_DEVICE *hifDevice, A_UINT32 *data);
diff --git a/host/os/linux/include/ieee80211_ioctl.h b/host/os/linux/include/ieee80211_ioctl.h
new file mode 100644
index 0000000..7144412
--- /dev/null
+++ b/host/os/linux/include/ieee80211_ioctl.h
@@ -0,0 +1,181 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _IEEE80211_IOCTL_H_
+#define _IEEE80211_IOCTL_H_
+
+#include <linux/version.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Extracted from the MADWIFI net80211/ieee80211_ioctl.h
+ */
+
+/*
+ * WPA/RSN get/set key request.  Specify the key/cipher
+ * type and whether the key is to be used for sending and/or
+ * receiving.  The key index should be set only when working
+ * with global keys (use IEEE80211_KEYIX_NONE for ``no index'').
+ * Otherwise a unicast/pairwise key is specified by the bssid
+ * (on a station) or mac address (on an ap).  They key length
+ * must include any MIC key data; otherwise it should be no
+ more than IEEE80211_KEYBUF_SIZE.
+ */
+struct ieee80211req_key {
+    u_int8_t    ik_type;    /* key/cipher type */
+    u_int8_t    ik_pad;
+    u_int16_t   ik_keyix;   /* key index */
+    u_int8_t    ik_keylen;  /* key length in bytes */
+    u_int8_t    ik_flags;
+#define IEEE80211_KEY_XMIT  0x01
+#define IEEE80211_KEY_RECV  0x02
+#define IEEE80211_KEY_DEFAULT   0x80    /* default xmit key */
+    u_int8_t    ik_macaddr[IEEE80211_ADDR_LEN];
+    u_int64_t   ik_keyrsc;  /* key receive sequence counter */
+    u_int64_t   ik_keytsc;  /* key transmit sequence counter */
+    u_int8_t    ik_keydata[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
+};
+/*
+ * Delete a key either by index or address.  Set the index
+ * to IEEE80211_KEYIX_NONE when deleting a unicast key.
+ */
+struct ieee80211req_del_key {
+    u_int8_t    idk_keyix;  /* key index */
+    u_int8_t    idk_macaddr[IEEE80211_ADDR_LEN];
+};
+/*
+ * MLME state manipulation request.  IEEE80211_MLME_ASSOC
+ * only makes sense when operating as a station.  The other
+ * requests can be used when operating as a station or an
+ * ap (to effect a station).
+ */
+struct ieee80211req_mlme {
+    u_int8_t    im_op;      /* operation to perform */
+#define IEEE80211_MLME_ASSOC        1   /* associate station */
+#define IEEE80211_MLME_DISASSOC     2   /* disassociate station */
+#define IEEE80211_MLME_DEAUTH       3   /* deauthenticate station */
+#define IEEE80211_MLME_AUTHORIZE    4   /* authorize station */
+#define IEEE80211_MLME_UNAUTHORIZE  5   /* unauthorize station */
+    u_int16_t   im_reason;  /* 802.11 reason code */
+    u_int8_t    im_macaddr[IEEE80211_ADDR_LEN];
+};
+
+struct ieee80211req_addpmkid {
+    u_int8_t    pi_bssid[IEEE80211_ADDR_LEN];
+    u_int8_t    pi_enable;
+    u_int8_t    pi_pmkid[16];
+};
+
+#define AUTH_ALG_OPEN_SYSTEM    0x01
+#define AUTH_ALG_SHARED_KEY 0x02
+#define AUTH_ALG_LEAP       0x04
+
+struct ieee80211req_authalg {
+   u_int8_t auth_alg;
+};  
+
+/* 
+ * Request to add an IE to a Management Frame
+ */
+enum{
+    IEEE80211_APPIE_FRAME_BEACON     = 0,
+    IEEE80211_APPIE_FRAME_PROBE_REQ  = 1,
+    IEEE80211_APPIE_FRAME_PROBE_RESP = 2,
+    IEEE80211_APPIE_FRAME_ASSOC_REQ  = 3,
+    IEEE80211_APPIE_FRAME_ASSOC_RESP = 4,
+    IEEE80211_APPIE_NUM_OF_FRAME     = 5
+};
+
+/*
+ * The Maximum length of the IE that can be added to a Management frame
+ */
+#define IEEE80211_APPIE_FRAME_MAX_LEN  200
+
+struct ieee80211req_getset_appiebuf {
+    u_int32_t app_frmtype; /* management frame type for which buffer is added */
+    u_int32_t app_buflen;  /*application supplied buffer length */
+    u_int8_t  app_buf[];
+};
+
+/* 
+ * The following definitions are used by an application to set filter
+ * for receiving management frames 
+ */
+enum {
+     IEEE80211_FILTER_TYPE_BEACON      =   0x1,
+     IEEE80211_FILTER_TYPE_PROBE_REQ   =   0x2,
+     IEEE80211_FILTER_TYPE_PROBE_RESP  =   0x4,
+     IEEE80211_FILTER_TYPE_ASSOC_REQ   =   0x8,
+     IEEE80211_FILTER_TYPE_ASSOC_RESP  =   0x10,
+     IEEE80211_FILTER_TYPE_AUTH        =   0x20,
+     IEEE80211_FILTER_TYPE_DEAUTH      =   0x40,
+     IEEE80211_FILTER_TYPE_DISASSOC    =   0x80,
+     IEEE80211_FILTER_TYPE_ALL         =   0xFF  /* used to check the valid filter bits */
+};
+
+struct ieee80211req_set_filter {
+      u_int32_t app_filterype; /* management frame filter type */
+};
+
+enum {
+    IEEE80211_PARAM_AUTHMODE = 3,   /* Authentication Mode */
+    IEEE80211_PARAM_MCASTCIPHER = 5,
+    IEEE80211_PARAM_MCASTKEYLEN = 6,    /* multicast key length */
+    IEEE80211_PARAM_UCASTCIPHER = 8,
+    IEEE80211_PARAM_UCASTKEYLEN = 9,    /* unicast key length */
+    IEEE80211_PARAM_WPA     = 10,   /* WPA mode (0,1,2) */
+    IEEE80211_PARAM_ROAMING     = 12,   /* roaming mode */
+    IEEE80211_PARAM_PRIVACY     = 13,   /* privacy invoked */
+    IEEE80211_PARAM_COUNTERMEASURES = 14,   /* WPA/TKIP countermeasures */
+    IEEE80211_PARAM_DROPUNENCRYPTED = 15,   /* discard unencrypted frames */
+    IEEE80211_PARAM_WAPI = 16,   /* WAPI policy from wapid */        
+};
+
+/*
+ * Values for IEEE80211_PARAM_WPA
+ */
+#define WPA_MODE_WPA1   1
+#define WPA_MODE_WPA2   2
+#define WPA_MODE_AUTO   3
+#define WPA_MODE_NONE   4
+
+struct ieee80211req_wpaie {
+    u_int8_t    wpa_macaddr[IEEE80211_ADDR_LEN];
+    u_int8_t    wpa_ie[IEEE80211_MAX_IE];
+    u_int8_t    rsn_ie[IEEE80211_MAX_IE];
+};
+
+#ifndef IW_ENCODE_ALG_PMK
+#define IW_ENCODE_ALG_PMK       4
+#endif
+#ifndef IW_ENCODE_ALG_KRK
+#define IW_ENCODE_ALG_KRK       6
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _IEEE80211_IOCTL_H_ */
diff --git a/host/os/linux/include/osapi_linux.h b/host/os/linux/include/osapi_linux.h
new file mode 100644
index 0000000..bd42ad7
--- /dev/null
+++ b/host/os/linux/include/osapi_linux.h
@@ -0,0 +1,446 @@
+//------------------------------------------------------------------------------
+// This file contains the definitions of the basic atheros data types.
+// It is used to map the data types in atheros files to a platform specific
+// type.
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _OSAPI_LINUX_H_
+#define _OSAPI_LINUX_H_
+
+#ifdef __KERNEL__
+
+#include <linux/version.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/device.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+#include <linux/ethtool.h>
+#endif
+/*************************************/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
+#include <linux/jiffies.h>
+#endif
+#include <linux/semaphore.h>
+#include <linux/sched.h>
+
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/wait.h>
+#ifdef KERNEL_2_4
+#include <asm/arch/irq.h>
+#include <asm/irq.h>
+#endif
+
+#include <linux/cache.h>
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+/*
+ * Endianes macros
+ */
+#define A_BE2CPU8(x)       ntohb(x)
+#define A_BE2CPU16(x)      ntohs(x)
+#define A_BE2CPU32(x)      ntohl(x)
+
+#define A_LE2CPU8(x)       (x)
+#define A_LE2CPU16(x)      (x)
+#define A_LE2CPU32(x)      (x)
+
+#define A_CPU2BE8(x)       htonb(x)
+#define A_CPU2BE16(x)      htons(x)
+#define A_CPU2BE32(x)      htonl(x)
+
+#define A_MEMCPY(dst, src, len)         memcpy((A_UINT8 *)(dst), (src), (len))
+#define A_MEMZERO(addr, len)            memset(addr, 0, len)
+#define A_MEMCMP(addr1, addr2, len)     memcmp((addr1), (addr2), (len))
+
+#ifdef AR6K_ALLOC_DEBUG
+#define a_meminfo_add(p, s)  __a_meminfo_add(p, s, __func__, __LINE)
+void __a_meminfo_add(void *ptr, size_t msize, const char *func, int lineno);
+void  a_meminfo_del(void *ptr);
+void* a_mem_alloc(size_t msize, int type, const char *func, int lineno);
+void a_mem_free(void *ptr);
+void a_meminfo_report(int clear);
+A_BOOL a_meminfo_find(void *ptr);
+#define A_MALLOC(size)                  a_mem_alloc((size), GFP_KERNEL, __func__, __LINE__)
+#define A_MALLOC_NOWAIT(size)           a_mem_alloc((size), GFP_ATOMIC, __func__, __LINE__)
+#define A_FREE(addr)                    a_mem_free(addr)
+#define A_FREE_NOWAIT(addr)             a_mem_free(addr)
+#define A_NETIF_RX(skb)                 do { a_meminfo_del(skb);  netif_rx(skb); } while (0)
+#define A_NETIF_RX_NI(skb)              do { a_meminfo_del(skb);  netif_rx_ni(skb); } while (0)
+#define A_MEM_HELPER_INIT(void)
+#define A_MEM_HELPER_DESTROY(void)
+#else
+#define a_meminfo_report(_c)
+#define A_MALLOC(size)                  kmalloc((size), GFP_KERNEL)
+#define A_MALLOC_NOWAIT(size)           kmalloc((size), GFP_ATOMIC)
+#define A_FREE(addr)                    kfree(addr);addr=NULL;
+#define A_FREE_NOWAIT(addr)             kfree(addr);addr=NULL;
+#define A_NETIF_RX(skb)                 netif_rx(skb)
+#define A_NETIF_RX_NI(skb)              netif_rx_ni(skb)
+#endif
+
+#if defined(ANDROID_ENV) && defined(CONFIG_ANDROID_LOGGER)
+extern unsigned int enablelogcat;
+extern int android_logger_lv(void* module, int mask);
+enum logidx { LOG_MAIN_IDX = 0 };
+extern int logger_write(const enum logidx idx, 
+                const unsigned char prio,
+                const char __kernel * const tag,
+                const char __kernel * const fmt,
+                ...);
+#define A_ANDROID_PRINTF(mask, module, tags, args...) do {  \
+    if (enablelogcat) \
+        logger_write(LOG_MAIN_IDX, android_logger_lv(module, mask), tags, args); \
+    else \
+        printk(KERN_ALERT args); \
+} while (0)
+#ifdef DEBUG
+#define A_LOGGER_MODULE_NAME(x) #x
+#define A_LOGGER(mask, mod, args...) \
+    A_ANDROID_PRINTF(mask, &GET_ATH_MODULE_DEBUG_VAR_NAME(mod), "ar6k_" A_LOGGER_MODULE_NAME(mod), args);
+#endif 
+#define A_PRINTF(args...) A_ANDROID_PRINTF(ATH_DEBUG_INFO, NULL, "ar6k_driver", args)
+#else
+#define A_LOGGER(mask, mod, args...)    printk(KERN_ALERT args)
+#define A_PRINTF(args...)               printk(KERN_ALERT args)
+#endif /* ANDROID */
+#define A_PRINTF_LOG(args...)           printk(args)
+#define A_SPRINTF(buf, args...)			sprintf (buf, args)
+
+/* Mutual Exclusion */
+typedef spinlock_t                      A_MUTEX_T;
+#define A_MUTEX_INIT(mutex)             spin_lock_init(mutex)
+#define A_MUTEX_LOCK(mutex)             spin_lock_bh(mutex)
+#define A_MUTEX_UNLOCK(mutex)           spin_unlock_bh(mutex)
+#define A_IS_MUTEX_VALID(mutex)         TRUE  /* okay to return true, since A_MUTEX_DELETE does nothing */
+#define A_MUTEX_DELETE(mutex)           /* spin locks are not kernel resources so nothing to free.. */
+
+/* Get current time in ms adding a constant offset (in ms) */
+#define A_GET_MS(offset)    \
+	(((jiffies / HZ) * 1000) + (offset))
+
+/*
+ * Timer Functions
+ */
+#define A_MDELAY(msecs)                 mdelay(msecs)
+typedef struct timer_list               A_TIMER;
+
+#define A_INIT_TIMER(pTimer, pFunction, pArg) do {              \
+    init_timer(pTimer);                                         \
+    (pTimer)->function = (pFunction);                           \
+    (pTimer)->data   = (unsigned long)(pArg);                   \
+} while (0)
+
+/*
+ * Start a Timer that elapses after 'periodMSec' milli-seconds
+ * Support is provided for a one-shot timer. The 'repeatFlag' is
+ * ignored.
+ */
+#define A_TIMEOUT_MS(pTimer, periodMSec, repeatFlag) do {                   \
+    if (repeatFlag) {                                                       \
+        printk("\n" __FILE__ ":%d: Timer Repeat requested\n",__LINE__);     \
+        panic("Timer Repeat");                                              \
+    }                                                                       \
+    mod_timer((pTimer), jiffies + HZ * (periodMSec) / 1000);                \
+} while (0)
+
+/*
+ * Cancel the Timer. 
+ */
+#define A_UNTIMEOUT(pTimer) do {                                \
+    del_timer((pTimer));                                        \
+} while (0)
+
+#define A_DELETE_TIMER(pTimer) do {                             \
+} while (0)
+
+/*
+ * Wait Queue related functions
+ */
+typedef wait_queue_head_t               A_WAITQUEUE_HEAD;
+#define A_INIT_WAITQUEUE_HEAD(head)     init_waitqueue_head(head)
+#ifndef wait_event_interruptible_timeout
+#define __wait_event_interruptible_timeout(wq, condition, ret)          \
+do {                                                                    \
+        wait_queue_t __wait;                                            \
+        init_waitqueue_entry(&__wait, current);                         \
+                                                                        \
+        add_wait_queue(&wq, &__wait);                                   \
+        for (;;) {                                                      \
+                set_current_state(TASK_INTERRUPTIBLE);                  \
+                if (condition)                                          \
+                        break;                                          \
+                if (!signal_pending(current)) {                         \
+                        ret = schedule_timeout(ret);                    \
+                        if (!ret)                                       \
+                                break;                                  \
+                        continue;                                       \
+                }                                                       \
+                ret = -ERESTARTSYS;                                     \
+                break;                                                  \
+        }                                                               \
+        current->state = TASK_RUNNING;                                  \
+        remove_wait_queue(&wq, &__wait);                                \
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)        \
+({                                                                      \
+        long __ret = timeout;                                           \
+        if (!(condition))                                               \
+                __wait_event_interruptible_timeout(wq, condition, __ret); \
+        __ret;                                                          \
+})
+#endif /* wait_event_interruptible_timeout */
+
+#define A_WAIT_EVENT_INTERRUPTIBLE_TIMEOUT(head, condition, timeout) do { \
+    wait_event_interruptible_timeout(head, condition, timeout); \
+} while (0)
+
+#define A_WAKE_UP(head)                 wake_up(head)
+
+#ifdef DEBUG
+extern unsigned int panic_on_assert;
+#define A_ASSERT(expr)  \
+    if (!(expr)) {   \
+        printk(KERN_ALERT"Debug Assert Caught, File %s, Line: %d, Test:%s \n",__FILE__, __LINE__,#expr); \
+        if (panic_on_assert) panic(#expr);                                                               \
+    }
+#else
+#define A_ASSERT(expr)
+#endif /* DEBUG */
+
+#ifdef ANDROID_ENV
+struct firmware;
+int android_request_firmware(const struct firmware **firmware_p, const char *filename,
+                     struct device *device);
+void android_release_firmware(const struct firmware *firmware);
+#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) android_request_firmware(_ppf, _pfile, _dev)
+#define A_RELEASE_FIRMWARE(_pf) android_release_firmware(_pf)
+#else
+struct firmware;
+int android_request_firmware(const struct firmware **firmware_p, const char *filename,
+                     struct device *device);
+void android_release_firmware(const struct firmware *firmware);
+#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) android_request_firmware(_ppf, _pfile, _dev)
+#define A_RELEASE_FIRMWARE(_pf) android_release_firmware(_pf)
+
+//#define A_REQUEST_FIRMWARE(_ppf, _pfile, _dev) request_firmware(_ppf, _pfile, _dev)
+//#define A_RELEASE_FIRMWARE(_pf) release_firmware(_pf)
+#endif 
+
+/*
+ * Initialization of the network buffer subsystem
+ */
+#define A_NETBUF_INIT()
+
+/*
+ * Network buffer queue support
+ */
+typedef struct sk_buff_head A_NETBUF_QUEUE_T;
+
+#define A_NETBUF_QUEUE_INIT(q)  \
+    a_netbuf_queue_init(q)
+
+#define A_NETBUF_ENQUEUE(q, pkt) \
+    a_netbuf_enqueue((q), (pkt))
+#define A_NETBUF_PREQUEUE(q, pkt) \
+    a_netbuf_prequeue((q), (pkt))
+#define A_NETBUF_DEQUEUE(q) \
+    (a_netbuf_dequeue(q))
+#define A_NETBUF_QUEUE_SIZE(q)  \
+    a_netbuf_queue_size(q)
+#define A_NETBUF_QUEUE_EMPTY(q) \
+    a_netbuf_queue_empty(q)
+
+/*
+ * Network buffer support
+ */
+#ifdef AR6K_ALLOC_DEBUG
+#define A_NETBUF_ALLOC(size) \
+    a_netbuf_alloc(size, __func__, __LINE__)
+#define A_NETBUF_ALLOC_RAW(size) \
+    a_netbuf_alloc_raw(size, __func__, __LINE__)
+#define A_NETBUF_CHECK(bufPtr) \
+    a_netbuf_check(bufPtr, __func__, __LINE__)
+#else
+#define A_NETBUF_ALLOC(size) \
+    a_netbuf_alloc(size)
+#define A_NETBUF_ALLOC_RAW(size) \
+    a_netbuf_alloc_raw(size)
+#endif /* AR6K_ALLOC_DEBUG */
+#define A_NETBUF_FREE(bufPtr) \
+    a_netbuf_free(bufPtr)
+#define A_NETBUF_DATA(bufPtr) \
+    a_netbuf_to_data(bufPtr)
+#define A_NETBUF_LEN(bufPtr) \
+    a_netbuf_to_len(bufPtr)
+#define A_NETBUF_PUSH(bufPtr, len) \
+    a_netbuf_push(bufPtr, len)
+#define A_NETBUF_PUT(bufPtr, len) \
+    a_netbuf_put(bufPtr, len)
+#define A_NETBUF_TRIM(bufPtr,len) \
+    a_netbuf_trim(bufPtr, len)
+#define A_NETBUF_PULL(bufPtr, len) \
+    a_netbuf_pull(bufPtr, len)
+#define A_NETBUF_HEADROOM(bufPtr)\
+    a_netbuf_headroom(bufPtr)
+#define A_NETBUF_SETLEN(bufPtr,len) \
+    a_netbuf_setlen(bufPtr, len)
+
+/* Add data to end of a buffer  */
+#define A_NETBUF_PUT_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_put_data(bufPtr, srcPtr, len) 
+
+/* Add data to start of the  buffer */
+#define A_NETBUF_PUSH_DATA(bufPtr, srcPtr,  len) \
+    a_netbuf_push_data(bufPtr, srcPtr, len) 
+
+/* Remove data at start of the buffer */
+#define A_NETBUF_PULL_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_pull_data(bufPtr, dstPtr, len) 
+
+/* Remove data from the end of the buffer */
+#define A_NETBUF_TRIM_DATA(bufPtr, dstPtr, len) \
+    a_netbuf_trim_data(bufPtr, dstPtr, len) 
+
+/* View data as "size" contiguous bytes of type "t" */
+#define A_NETBUF_VIEW_DATA(bufPtr, t, size) \
+    (t )( ((struct skbuf *)(bufPtr))->data)
+
+/* return the beginning of the headroom for the buffer */
+#define A_NETBUF_HEAD(bufPtr) \
+        ((((struct sk_buff *)(bufPtr))->head))
+    
+/*
+ * OS specific network buffer access routines
+ */
+#ifdef AR6K_ALLOC_DEBUG
+void *a_netbuf_alloc(int size, const char *func, int lineno);
+void *a_netbuf_alloc_raw(int size, const char *func, int lineno);
+void a_netbuf_check(void *bufPtr, const char *func, int lineno); 
+#else
+void *a_netbuf_alloc(int size);
+void *a_netbuf_alloc_raw(int size);
+#endif
+void a_netbuf_free(void *bufPtr);
+void *a_netbuf_to_data(void *bufPtr);
+A_UINT32 a_netbuf_to_len(void *bufPtr);
+A_STATUS a_netbuf_push(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len);
+A_STATUS a_netbuf_put(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len);
+A_STATUS a_netbuf_pull(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len);
+A_STATUS a_netbuf_trim(void *bufPtr, A_INT32 len);
+A_STATUS a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len);
+A_STATUS a_netbuf_setlen(void *bufPtr, A_INT32 len);
+A_INT32 a_netbuf_headroom(void *bufPtr);
+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt);
+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt);
+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q);
+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q);
+
+/*
+ * Kernel v.s User space functions
+ */
+A_UINT32 a_copy_to_user(void *to, const void *from, A_UINT32 n);
+A_UINT32 a_copy_from_user(void *to, const void *from, A_UINT32 n);
+
+/* In linux, WLAN Rx and Tx run in different contexts, so no need to check
+ * for any commands/data queued for WLAN */
+#define A_CHECK_DRV_TX()   
+             
+#define A_GET_CACHE_LINE_BYTES()    L1_CACHE_BYTES
+
+#define A_CACHE_LINE_PAD            128
+
+static inline void *A_ALIGN_TO_CACHE_LINE(void *ptr) {   
+    return (void *)L1_CACHE_ALIGN((unsigned long)ptr);
+}
+   
+#else /* __KERNEL__ */
+
+#ifdef __GNUC__
+#define __ATTRIB_PACK           __attribute__ ((packed))
+#define __ATTRIB_PRINTF         __attribute__ ((format (printf, 1, 2)))
+#define __ATTRIB_NORETURN       __attribute__ ((noreturn))
+#ifndef INLINE
+#define INLINE                  __inline__
+#endif
+#else /* Not GCC */
+#define __ATTRIB_PACK
+#define __ATTRIB_PRINTF
+#define __ATTRIB_NORETURN
+#ifndef INLINE
+#define INLINE                  __inline
+#endif
+#endif /* End __GNUC__ */
+
+#define PREPACK
+#define POSTPACK                __ATTRIB_PACK
+
+#define A_MEMCPY(dst, src, len)         memcpy((dst), (src), (len))
+#define A_MEMZERO(addr, len)            memset((addr), 0, (len))
+#define A_MEMCMP(addr1, addr2, len)     memcmp((addr1), (addr2), (len))
+#define A_MALLOC(size)                  malloc(size)
+#define A_FREE(addr)                    free(addr)
+
+#ifdef ANDROID
+#ifndef err
+#include <errno.h>
+#define err(_s, args...) do { \
+    fprintf(stderr, "%s: line %d ", __FILE__, __LINE__); \
+    fprintf(stderr, args); fprintf(stderr, ": %d\n", errno); \
+    exit(_s); } while (0)
+#endif
+#else
+#include <err.h>
+#endif
+
+#endif /* __KERNEL__ */
+
+#endif /* _OSAPI_LINUX_H_ */
diff --git a/host/os/linux/include/wlan_config.h b/host/os/linux/include/wlan_config.h
new file mode 100644
index 0000000..e357131
--- /dev/null
+++ b/host/os/linux/include/wlan_config.h
@@ -0,0 +1,179 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Corporation.  All rights reserved.
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//------------------------------------------------------------------------------
+//==============================================================================
+// This file contains the tunable configuration items for the WLAN module
+//
+// Author(s): ="Atheros"
+//==============================================================================
+#ifndef _HOST_WLAN_CONFIG_H_
+#define _HOST_WLAN_CONFIG_H_
+
+/* Include definitions here that can be used to tune the WLAN module behavior.
+ * Different customers can tune the behavior as per their needs, here. 
+ */
+
+/* This configuration item when defined will consider the barker preamble 
+ * mentioned in the ERP IE of the beacons from the AP to determine the short 
+ * preamble support sent in the (Re)Assoc request frames.
+ */
+#define WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP 0
+
+/* This config item when defined will not send the power module state transition
+ * failure events that happen during scan, to the host. 
+ */
+#define WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN 0
+
+/* This config item disables sending a DisAssoc frame prior to sending a 
+ * DeAuth frame.
+ */
+#define WLAN_CONFIG_NO_DISASSOC_UPON_DEAUTH 0
+
+/*
+ * This configuration item enable/disable keepalive support.
+ * Keepalive support: In the absence of any data traffic to AP, null 
+ * frames will be sent to the AP at periodic interval, to keep the association
+ * active. This configuration item defines the periodic interval.
+ * Use value of zero to disable keepalive support
+ * Default: 60 seconds
+ */
+#define WLAN_CONFIG_KEEP_ALIVE_INTERVAL 60 
+
+/*
+ * This configuration item sets the value of disconnect timeout
+ * Firmware delays sending the disconnec event to the host for this
+ * timeout after is gets disconnected from the current AP.
+ * If the firmware successly roams within the disconnect timeout
+ * it sends a new connect event
+ */
+#ifdef ANDROID_ENV
+#define WLAN_CONFIG_DISCONNECT_TIMEOUT 3
+#else
+#define WLAN_CONFIG_DISCONNECT_TIMEOUT 10
+#endif /* ANDROID_ENV */ 
+
+/*
+ * This configuration item enable BT clock sharing support
+ * 1 - Enable
+ * 0 - Disable (Default)
+ */
+#define WLAN_CONFIG_BT_SHARING          0
+
+/*
+ * This configuration item sets WIFI OFF policy
+ * 0 - CUT_POWER
+ * 1 - DEEP_SLEEP (Default)
+ */
+#define WLAN_CONFIG_WLAN_OFF                1
+
+/*
+ * This configuration item disables 11n support. 
+ * 0 - Enable
+ * 1 - Disable
+ */
+#define WLAN_CONFIG_DISABLE_11N         0
+
+/*
+ * This configuration item sets suspend policy
+ * 0 - CUT_POWER (Default)
+ * 1 - DEEP_SLEEP
+ * 2 - WoW
+ * 3 - CUT_POWER if BT OFF (clock sharing designs only)
+ */
+#define WLAN_CONFIG_PM_SUSPEND              0
+
+/*
+ * This configuration item sets suspend policy to use if PM_SUSPEND is
+ * set to WoW and device is not connected at the time of suspend
+ * 0 - CUT_POWER (Default)
+ * 1 - DEEP_SLEEP
+ * 2 - WoW
+ * 3 - CUT_POWER if BT OFF (clock sharing designs only)
+ */
+#define WLAN_CONFIG_PM_WOW2                 1
+
+/* 
+ * Define GPIO number for WoW in your platform other than zero 
+ * Wake lock will be called when GPIO asserted. 
+ */
+#define PLAT_WOW_GPIO_PIN                  0
+
+/*
+ * This configuration item for the WOW patterns in AP mode
+ * 0 - Wake up host only if any unicast IP, EAPOL-like and ARP, broadcast dhcp and ARP packets. (default)
+ * 1 - Wake up host if any unicast/broadcast/multicast packets
+ */
+#define WLAN_CONFIG_SIMPLE_WOW_AP_MODE      0
+
+/*
+ * set to 1 to let STA do 2.4GHz band scan on 1st scan after 
+ * either insmod or wmiconfig --wlan enable
+ *
+ * set to 0 to disable this feature
+ */
+#define WLAN_CONFIG_FIRST_SCAN_2G_ONLY      0
+
+/* 
+ *   1: to disable sending ps-poll in TIM interrupt
+ *   0: to send one ps-poll (the default)
+ *    
+ */
+#define WLAN_CONFIG_PSPOLL_NUM              0
+
+/*
+ *  0: to use the default (NORMAL_DTIM)
+ *  1: to use IGNORE_DTIM
+ *  2: to use NORMAL_DTIM
+ *  3: to use STICK_DTIM
+ *  4: to use AUTO_DTIM
+ */
+#define WLAN_CONFIG_DTIM_POLICY             0
+
+
+/* 
+ * Define the GPIO number for WLAN CHIP_PWD PIN other than zero
+ * Only use when you define plat_setup_power as plat_setup_power_stub
+ */
+
+#define PLAT_WLAN_CHIP_PWD_PIN              1
+
+/*
+ * Platform specific function to power ON/OFF AR6000 with CHIP_PWD PIN
+ * and enable/disable SDIO card detection
+ *
+ * Either implement wlan CHIP_PWD PIN and power GPIO control into 
+ * plat_setup_power_stub(..) place holder in ar6000_pm.c 
+ * or redefine plat_setup_power(..) into your export funciton. 
+ */
+
+#if PLAT_WLAN_CHIP_PWD_PIN
+extern void plat_setup_power_stub(struct ar6_softc *ar, int on, int detect); 
+#define plat_setup_power(ar, on, detect) plat_setup_power_stub(ar, on, detect)
+#elif defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM7X27) && defined(CONFIG_MSM_SOC_REV_A) 
+extern void msm7x27a_wifi_power(bool on);
+#define plat_setup_power(ar, on, detect) msm7x27a_wifi_power(on) 
+#elif defined(CONFIG_MMC_MSM) && defined(CONFIG_ARCH_MSM9615)
+#define MSM9615_WLAN_CHIP_PWD_PIN               21
+#define MSM9615_WLAN_PM_ENABLE_PIN              2
+extern int msm9615_wifi_power(AR_SOFTC_T *ar, int on);
+#define plat_setup_power(ar, on, detect) msm9615_wifi_power(ar, on)
+#else
+#define plat_setup_power(ar, on, detect) /* define as your function */
+#endif 
+
+#endif /* _HOST_WLAN_CONFIG_H_ */
diff --git a/host/os/linux/include/wmi_filter_linux.h b/host/os/linux/include/wmi_filter_linux.h
new file mode 100644
index 0000000..dc81b83
--- /dev/null
+++ b/host/os/linux/include/wmi_filter_linux.h
@@ -0,0 +1,351 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#ifndef _WMI_FILTER_LINUX_H_
+#define  _WMI_FILTER_LINUX_H_
+
+/*
+ * sioctl_filter - Standard ioctl
+ * pioctl_filter - Priv ioctl
+ * xioctl_filter - eXtended ioctl
+ *
+ * ---- Possible values for the WMI filter ---------------
+ * (0) - Block this cmd always (or) not implemented
+ * (INFRA_NETWORK) - Allow this cmd only in STA mode
+ * (ADHOC_NETWORK) - Allow this cmd only in IBSS mode
+ * (AP_NETWORK) -    Allow this cmd only in AP mode
+ * (INFRA_NETWORK | ADHOC_NETWORK) - Block this cmd in AP mode
+ * (ADHOC_NETWORK | AP_NETWORK) -    Block this cmd in STA mode
+ * (INFRA_NETWORK | AP_NETWORK) -    Block this cmd in IBSS mode
+ * (INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK)- allow only when mode is set
+ * (0xFF) - Allow this cmd always irrespective of mode
+ */
+
+A_UINT8 sioctl_filter[] = {
+(AP_NETWORK),                                   /* SIOCSIWCOMMIT   0x8B00   */
+(0xFF),                                         /* SIOCGIWNAME     0x8B01   */
+(0),                                            /* SIOCSIWNWID     0x8B02   */
+(0),                                            /* SIOCGIWNWID     0x8B03   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWFREQ     0x8B04   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWFREQ     0x8B05   */
+(0xFF),                                         /* SIOCSIWMODE     0x8B06   */
+(0xFF),                                         /* SIOCGIWMODE     0x8B07   */
+(0),                                            /* SIOCSIWSENS     0x8B08   */
+(0),                                            /* SIOCGIWSENS     0x8B09   */
+(0),                                            /* SIOCSIWRANGE    0x8B0A   */
+(0xFF),                                         /* SIOCGIWRANGE    0x8B0B   */
+(0),                                            /* SIOCSIWPRIV     0x8B0C   */
+(0),                                            /* SIOCGIWPRIV     0x8B0D   */
+(0),                                            /* SIOCSIWSTATS    0x8B0E   */
+(0),                                            /* SIOCGIWSTATS    0x8B0F   */
+(0),                                            /* SIOCSIWSPY      0x8B10   */
+(0),                                            /* SIOCGIWSPY      0x8B11   */
+(0),                                            /* SIOCSIWTHRSPY   0x8B12   */
+(0),                                            /* SIOCGIWTHRSPY   0x8B13   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWAP       0x8B14   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWAP       0x8B15   */
+#if (WIRELESS_EXT >= 18)
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWMLME     0X8B16   */
+#else
+(0),                                            /* Dummy           0        */
+#endif /* WIRELESS_EXT */
+(0),                                            /* SIOCGIWAPLIST   0x8B17   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWSCAN     0x8B18   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCGIWSCAN     0x8B19   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWESSID    0x8B1A   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWESSID    0x8B1B   */
+(0),                                            /* SIOCSIWNICKN    0x8B1C   */
+(0),                                            /* SIOCGIWNICKN    0x8B1D   */
+(0),                                            /* Dummy           0        */
+(0),                                            /* Dummy           0        */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWRATE     0x8B20   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWRATE     0x8B21   */
+(0),                                            /* SIOCSIWRTS      0x8B22   */
+(0),                                            /* SIOCGIWRTS      0x8B23   */
+(0),                                            /* SIOCSIWFRAG     0x8B24   */
+(0),                                            /* SIOCGIWFRAG     0x8B25   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWTXPOW    0x8B26   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWTXPOW    0x8B27   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCSIWRETRY    0x8B28   */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* SIOCGIWRETRY    0x8B29   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWENCODE   0x8B2A   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWENCODE   0x8B2B   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCSIWPOWER    0x8B2C   */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* SIOCGIWPOWER    0x8B2D   */
+};
+
+
+
+A_UINT8 pioctl_filter[] = {
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETPARAM             (SIOCIWFIRSTPRIV+0)     */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETKEY               (SIOCIWFIRSTPRIV+1)     */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_DELKEY               (SIOCIWFIRSTPRIV+2)     */
+(AP_NETWORK),                                   /* IEEE80211_IOCTL_SETMLME              (SIOCIWFIRSTPRIV+3)     */
+(INFRA_NETWORK),                                /* IEEE80211_IOCTL_ADDPMKID             (SIOCIWFIRSTPRIV+4)     */
+(0),                                            /* IEEE80211_IOCTL_SETOPTIE             (SIOCIWFIRSTPRIV+5)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+6)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+7)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+8)     */
+(0),                                            /*                                      (SIOCIWFIRSTPRIV+9)     */
+(0),                                            /* IEEE80211_IOCTL_LASTONE              (SIOCIWFIRSTPRIV+10)    */
+(0xFF),                                         /* AR6000_IOCTL_WMI_GETREV              (SIOCIWFIRSTPRIV+11)    */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_IOCTL_WMI_SETPWR              (SIOCIWFIRSTPRIV+12)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETSCAN             (SIOCIWFIRSTPRIV+13)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETLISTENINT        (SIOCIWFIRSTPRIV+14)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SETBSSFILTER        (SIOCIWFIRSTPRIV+15)    */
+(INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_IOCTL_WMI_SET_CHANNELPARAMS   (SIOCIWFIRSTPRIV+16)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_PROBEDSSID      (SIOCIWFIRSTPRIV+17)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_PMPARAMS        (SIOCIWFIRSTPRIV+18)    */
+(INFRA_NETWORK),                                /* AR6000_IOCTL_WMI_SET_BADAP           (SIOCIWFIRSTPRIV+19)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_GET_QOS_QUEUE       (SIOCIWFIRSTPRIV+20)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_CREATE_QOS          (SIOCIWFIRSTPRIV+21)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_DELETE_QOS          (SIOCIWFIRSTPRIV+22)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_SNRTHRESHOLD    (SIOCIWFIRSTPRIV+23)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK (SIOCIWFIRSTPRIV+24)*/
+(0xFF),                                         /* AR6000_IOCTL_WMI_GET_TARGET_STATS    (SIOCIWFIRSTPRIV+25)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ASSOC_INFO      (SIOCIWFIRSTPRIV+26)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_ACCESS_PARAMS   (SIOCIWFIRSTPRIV+27)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_BMISS_TIME      (SIOCIWFIRSTPRIV+28)    */
+(INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_IOCTL_WMI_SET_DISC_TIMEOUT    (SIOCIWFIRSTPRIV+29)    */
+(ADHOC_NETWORK),                                /* AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS    (SIOCIWFIRSTPRIV+30)    */
+};
+
+/* Submode for the sake of filtering XIOCTLs are broadly set to 2 types.
+ * P2P Submode & Non-P2P submode. IOCLT cmds can be marked to be valid only in 
+ * P2P Submode or Non-P2P submode or both. The bits- b5,b6,b7 are used to encode
+ * this information in the IOCTL filters. The LSBits b0-b4 are used to encode
+ * the mode information.
+ */
+#define XIOCTL_FILTER_P2P_SUBMODE 0x20
+#define XIOCTL_FILTER_NONP2P_SUBMODE 0x40
+#define XIOCTL_FILTER_SUBMODE_DONTCARE \
+             (XIOCTL_FILTER_P2P_SUBMODE | XIOCTL_FILTER_NONP2P_SUBMODE)
+
+A_UINT8 xioctl_filter[] = {
+(0xFF),                                         /* Dummy                                           0    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_DONE                          1    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_READ_MEMORY                   2    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_WRITE_MEMORY                  3    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_EXECUTE                       4    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_SET_APP_START                 5    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_READ_SOC_REGISTER             6    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER            7    */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_TEST                          8    */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED9                           9    */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED10                          10   */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED11                          11   */
+(0xFF),                                         /* AR6000_XIOCTL_FORCE_TARGET_RESET                12   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_OPEN                      13   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_CLOSE                     14   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_READ                      15   */
+(0xFF),                                         /* AR6000_XIOCTL_HTC_RAW_WRITE                     16   */
+(0xFF),                                         /* AR6000_XIOCTL_CHECK_TARGET_READY                17   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_OUTPUT_SET                   18   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INPUT_GET                    19   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_REGISTER_SET                 20   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_REGISTER_GET                 21   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INTR_ACK                     22   */
+(0xFF),                                         /* AR6000_XIOCTL_GPIO_INTR_WAIT                    23   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_ADHOC_BSSID                   24   */
+(0x00),                                                                        /*AR6000_XIOCTL_UNUSED                             25   */
+(0x00),                                                                        /*AR6000_XIOCTL_UNUSED                             26   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | ADHOC_NETWORK | AP_NETWORK),                   /* AR6000_XIOCTL_SET_BEACON_INTVAL                 27   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* IEEE80211_IOCTL_SETAUTHALG                      28   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_VOICE_PKT_SIZE                29   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_SET_MAX_SP                        30   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_ROAM_TBL                  31   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_ROAM_CTRL                 32   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS         33   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTRL_WMI_GET_POWER_MODE               34   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTRL_WMI_SET_WLAN_STATE               35   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_ROAM_DATA                 36   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SETRETRYLIMITS                37   */
+(0xFF),          /* AR6000_XIOCTL_TCMD_CONT_TX                      38   */
+(0xFF),          /* AR6000_XIOCTL_TCMD_CONT_RX                      39   */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_PM                           40   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_STARTSCAN                     41   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SETFIXRATES                   42   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GETFIXRATES                   43   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD             44   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_CLR_RSSISNR                   45   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_LQTHRESHOLD               46   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_RTS                       47   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_LPREAMBLE                 48   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_AUTHMODE                  49   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_REASSOCMODE               50   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_WMM                       51   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS  52   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP         53   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_RD                        54   */
+(0xFF),                                         /* AR6000_XIOCTL_DIAG_READ                         55   */
+(0xFF),                                         /* AR6000_XIOCTL_DIAG_WRITE                        56   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_TXOP                      57   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK),                                /* AR6000_XIOCTL_USER_SETKEYS                      58   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK),                                /* AR6000_XIOCTL_WMI_SET_KEEPALIVE                 59   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK),                                /* AR6000_XIOCTL_WMI_GET_KEEPALIVE                 60   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_INSTALL              61   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL            62   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE             63   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE           64   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_APPIE                     65   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER        66   */
+(0xFF),                                         /* AR6000_XIOCTL_DBGLOG_CFG_MODULE                 67   */
+(0xFF),                                         /* AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS             68   */
+(0xFF),                                         /* Dummy                                           69   */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_WSC_STATUS                70   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BT_STATUS                 71   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_BT_PARAMS                 72   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE           73   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_WOW_MODE                  74   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_WOW_LIST                  75   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_ADD_WOW_PATTERN               76   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_DEL_WOW_PATTERN               77   */
+(0xFF),                                         /* AR6000_XIOCTL_TARGET_INFO                       78   */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE             79   */
+(0xFF),                                         /* AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE           80   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS        81   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_AKMP_PARAMS               82   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_GET_PMKID_LIST                83   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_PMKID_LIST                84   */
+(0xFF),                                         /* Dummy                                           85   */
+(0xFF),                                         /* Dummy                                           86   */
+(0xFF),                                         /* Dummy                                           87   */
+(0xFF),                                         /* Dummy                                           88   */
+(0xFF),                                         /* Dummy                                           89   */
+(0xFF),                                         /* AR6000_XIOCTL_UNUSED90                          90   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_LZ_STREAM_START               91   */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_LZ_DATA                       92   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_CFG                          93   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_ADDR_SET                     94   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_START                        95   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_STOP                         96   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_PROF_COUNT_GET                    97   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_ABORT_SCAN                    98   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_STA_LIST                   99   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_HIDDEN_SSID                    100  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_NUM_STA                    101  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_ACL_MAC                    102  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_ACL_LIST                   103  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_COMMIT_CONFIG                  104  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* IEEE80211_IOCTL_GETWPAIE                        105  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_CONN_INACT_TIME                106  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_PROT_SCAN_TIME                 107  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_WMI_SET_COUNTRY                   108  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_DTIM                       109  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT           110  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),    /* AR6000_XIOCTL_SET_IP                            111  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_ACL_POLICY                 112  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_CTRL_BSS_COMM                  113  */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO            114  */
+(0xFF),                                         /* AR6000_XIOCTL_MODULE_DEBUG_SET_MASK             115  */
+(0xFF),                                         /* AR6000_XIOCTL_MODULE_DEBUG_GET_MASK             116  */
+(0xFF),                                         /* AR6000_XIOCTL_DUMP_RCV_AGGR_STATS               117  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_HT_CAP                        118  */
+(0xFF),                                         /* AR6000_XIOCTL_SET_HT_OP                         119  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_STAT                       120  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_SET_TX_SELECT_RATES               121  */
+(0xFF),                                         /* AR6000_XIOCTL_SETUP_AGGR                        122  */
+(0xFF),                                         /* AR6000_XIOCTL_ALLOW_AGGR                        123  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_HIDDEN_SSID                124  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_COUNTRY                    125  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_WMODE                      126  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_DTIM                       127  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK | ADHOC_NETWORK),                   /* AR6000_XIOCTL_AP_GET_BINTVL                     128  */
+(0xFF),                                         /* AR6000_XIOCTL_AP_GET_RTS                        129  */
+(0xFF),                                         /* AR6000_XIOCTL_DELE_AGGR                         130  */
+(0xFF),                                         /* AR6000_XIOCTL_FETCH_TARGET_REGS                 131  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_HCI_CMD                           132  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_ACL_DATA                          133  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_WLAN_CONN_PRECEDENCE              134  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_11BG_RATESET               135  */
+(0xFF),
+(0xFF),
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT             138  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV   139  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG  140  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG         141  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG        142  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG     143  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG              144  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS       145  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG             146  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_BTCOEX_GET_STATS          147  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_QOS_SUPP                  148  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_SET_DFS                        149  */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* P2P CMDS BEGIN  AR6000_XIOCTL_WMI_P2P_DISCOVER    150 */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_STOP_FIND */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_CANCEL */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_LISTEN */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_GO_NEG */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_AUTH_GO_NEG */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_REJECT */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_CONFIG */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_WPS_CONFIG */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_FINDNODE */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_GRP_INIT              160 */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_GRP_FORMATION_DONE */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_INVITE */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_PROV_DISC */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_SET */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_PEER */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_FLUSH */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_GO_PARAMS */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_P2P_AUTH_INVITE */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_GET_IF_ADDR */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_GET_DEV_ADDR   170 */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_P2P_SDPD_TX_CMD */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),   /* AR6000_XIOTCL_WMI_P2P_SD_CANCEL_REQUEST */
+(0xFF),                                         /* AR6000_XIOCTL_SET_BT_HW_POWER_STATE             173  */
+(0xFF),                                         /* AR6000_XIOCTL_GET_BT_HW_POWER_STATE             174  */
+(0xFF),                                         /* AR6000_XIOCTL_GET_WLAN_SLEEP_STATE              175  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM              176  */
+(0xFF),                                         /* R6000_XIOCTL_WMI_ENABLE_WAC_PARAM               177 */
+(0xFF),                                         /* AR6000_XIOCTL_WAC_SCAN_REPLY                    178 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_WAC_CTRL_REQ                  179 */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE         180  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_PASSPHRASE                181  */
+(0xFF),                                         /* AR6000_XIOCTL_BMI_NVRAM_PROCESS                 182  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM           183  */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_FORCE_ASSERT                  184 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_ENABLE_PKTLOG                 185 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_DISABLE_PKTLOG                186 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_GET_PKTLOG                    187 */
+(XIOCTL_FILTER_NONP2P_SUBMODE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_ACS_DISABLE_HI_CHANNELS        188  */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_CMDS                         189  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK),                /* AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES     190  */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                   /* AR6000_XIOCTL_AP_GET_NUM_STA                    191  */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_SUSPEND_DRIVER                    192   */
+(XIOCTL_FILTER_NONP2P_SUBMODE | 0x1F),                                         /* AR6000_XIOCTL_RESUME_DRIVER                     193   */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),  /* AR6000_XIOCTL_GET_SUBMODE                     194 */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | AP_NETWORK),                                  /* AR6000_XIOCTL_WMI_AP_APSD                     195 */
+(0xFF),                                         /* AR6000_XIOCTL_TCMD_SETREG                       196  */
+(0xFF),                                         /* AR6000_XIOCTL_GET_HT_CAP         197  */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK), /* AR6000_XIOCTL_WMI_GET_P2P_IE  198 */
+(XIOCTL_FILTER_P2P_SUBMODE | INFRA_NETWORK | AP_NETWORK),  /*AR6000_XIOCTL_WMI_P2P_GET_OWN_INFO 199 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_LTE_FREQ                    200 */
+(0xFF),                                         /* AR6000_XIOCTL_WMI_IDLE_CLOSE_TIME             201 */
+(XIOCTL_FILTER_SUBMODE_DONTCARE | INFRA_NETWORK), /* AR6000_XIOCTL_WMI_SEND_FRAME 202 */
+(XIOCTL_FILTER_NONP2P_SUBMODE | INFRA_NETWORK | ADHOC_NETWORK | AP_NETWORK),   /* AR6000_XIOCTL_WMI_GET_WMM                       203   */
+};
+
+#endif /*_WMI_FILTER_LINUX_H_*/
diff --git a/host/os/linux/ioctl.c b/host/os/linux/ioctl.c
new file mode 100644
index 0000000..f8db5c4
--- /dev/null
+++ b/host/os/linux/ioctl.c
@@ -0,0 +1,5951 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include "ar6000_drv.h"
+#include "a_drv_api.h"
+#include "ieee80211_ioctl.h"
+#include "ar6kap_common.h"
+#include "targaddrs.h"
+#include "wlan_config.h"
+
+#ifdef BTCOEX
+#include "a_hci.h"
+#endif
+
+#ifdef WAC
+#include "wac_defs.h"
+#endif
+
+#ifdef P2P
+#include "p2p_api.h"
+#endif /* P2P */
+
+extern int enablerssicompensation;
+A_UINT32 tcmdRxFreq;
+extern unsigned int wmitimeout;
+extern int tspecCompliance;
+extern int bmienable;
+extern int bypasswmi;
+#ifdef BTCOEX
+extern int loghci;
+#endif
+static int
+ar6000_ioctl_get_roam_tbl(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if(wmi_get_roam_tbl_cmd(arPriv->arWmi) != A_OK) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+ar6000_ioctl_get_roam_data(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    /* currently assume only roam times are required */
+    if(wmi_get_roam_data_cmd(arPriv->arWmi, ROAM_DATA_TIME) != A_OK) {
+        return -EIO;
+    }
+
+
+    return 0;
+}
+
+static int
+ar6000_ioctl_set_roam_ctrl(struct net_device *dev, char *userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_ROAM_CTRL_CMD cmd;
+    A_UINT8 size = sizeof(cmd);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, size)) {
+        return -EFAULT;
+    }
+
+    if (cmd.roamCtrlType == WMI_SET_HOST_BIAS) {
+        if (cmd.info.bssBiasInfo.numBss > 1) {
+            size += (cmd.info.bssBiasInfo.numBss - 1) * sizeof(WMI_BSS_BIAS);
+        }
+    }
+
+    if (copy_from_user(&cmd, userdata, size)) {
+        return -EFAULT;
+    }
+
+    if(wmi_set_roam_ctrl_cmd(arPriv->arWmi, &cmd, size) != A_OK) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+ar6000_ioctl_set_powersave_timers(struct net_device *dev, char *userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_POWERSAVE_TIMERS_POLICY_CMD cmd;
+    A_UINT8 size = sizeof(cmd);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, size)) {
+        return -EFAULT;
+    }
+
+    if (copy_from_user(&cmd, userdata, size)) {
+        return -EFAULT;
+    }
+
+    if(wmi_set_powersave_timers_cmd(arPriv->arWmi, &cmd, size) != A_OK) {
+        return -EIO;
+    }
+
+    return 0;
+}
+
+static int
+ar6000_ioctl_set_qos_supp(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_QOS_SUPP_CMD cmd;
+    A_STATUS ret;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(cmd)))
+    {
+        return -EFAULT;
+    }
+
+    ret = wmi_set_qos_supp_cmd(arPriv->arWmi, cmd.status);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+static int
+ar6000_ioctl_get_wmm(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+ 
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_to_user(rq->ifr_data, &arPriv->arWmmEnabled, sizeof(A_BOOL)))
+        return -EFAULT;
+    return 0;
+}
+
+static int
+ar6000_ioctl_set_wmm(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_WMM_CMD cmd;
+    A_STATUS ret;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(cmd)))
+    {
+        return -EFAULT;
+    }
+
+    if (cmd.status == WMI_WMM_ENABLED) {
+        arPriv->arWmmEnabled = TRUE;
+    } else {
+        arPriv->arWmmEnabled = FALSE;
+    }
+
+    ret = wmi_set_wmm_cmd(arPriv->arWmi, cmd.status);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+static int
+ar6000_ioctl_set_txop(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_WMM_TXOP_CMD cmd;
+    A_STATUS ret;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(cmd)))
+    {
+        return -EFAULT;
+    }
+
+    ret = wmi_set_wmm_txop(arPriv->arWmi, cmd.txopEnable);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+static int
+ar6000_ioctl_get_rd(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    A_STATUS ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if(copy_to_user((char *)((unsigned int*)rq->ifr_data + 1),
+                            &arPriv->arRegCode, sizeof(arPriv->arRegCode)))
+        ret = -EFAULT;
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_set_country(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_AP_SET_COUNTRY_CMD cmd;
+    A_STATUS ret;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(cmd)))
+    {
+        return -EFAULT;
+    }
+
+    arPriv->ap_profile_flag = 1; /* There is a change in profile */
+
+    ret = wmi_set_country(arPriv->arWmi, cmd.countryCode);
+    A_MEMCPY(arPriv->arAp.ap_country_code, cmd.countryCode, 3);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+
+/* Get power mode command */
+static int
+ar6000_ioctl_get_power_mode(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_POWER_MODE_CMD power_mode;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    power_mode.powerMode = wmi_get_power_mode_cmd(arPriv->arWmi);
+    if (copy_to_user(rq->ifr_data, &power_mode, sizeof(WMI_POWER_MODE_CMD))) {
+        ret = -EFAULT;
+    }
+
+    return ret;
+}
+
+
+static int
+ar6000_ioctl_set_channelParams(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_CHANNEL_PARAMS_CMD cmd, *cmdp;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+  
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if( (arPriv->arNextMode == AP_NETWORK) && (cmd.numChannels || cmd.scanParam) ) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ERROR: Only wmode is allowed in AP mode\n"));
+        return -EIO;
+    }
+
+    if (cmd.numChannels > 1) {
+        cmdp = A_MALLOC(130);
+        if (copy_from_user(cmdp, rq->ifr_data,
+                           sizeof (*cmdp) +
+                           ((cmd.numChannels - 1) * sizeof(A_UINT16))))
+        {
+            A_FREE(cmdp);
+            return -EFAULT;
+        }
+    } else {
+        cmdp = &cmd;
+    }
+
+    if ((arPriv->arPhyCapability == WMI_11NG_CAPABILITY) &&
+        ((cmdp->phyMode == WMI_11A_MODE) || (cmdp->phyMode == WMI_11AG_MODE)))
+    {
+        ret = -EINVAL;
+    }
+
+    if (!ret &&
+        (wmi_set_channelParams_cmd(arPriv->arWmi, cmdp->scanParam, cmdp->phyMode,
+                                   cmdp->numChannels, cmdp->channelList)
+         != A_OK))
+    {
+        ret = -EIO;
+    }
+
+   if (!ret)
+    arPriv->phymode = cmdp->phyMode;
+
+    if (cmd.numChannels > 1) {
+        A_FREE(cmdp);
+    }
+
+    /* Set the profile change flag to allow a commit cmd */
+    if (!ret)
+    arPriv->ap_profile_flag = 1;
+
+    return ret;
+}
+
+
+static int
+ar6000_ioctl_set_snr_threshold(struct net_device *dev, struct ifreq *rq)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SNR_THRESHOLD_PARAMS_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if( wmi_set_snr_threshold_params(arPriv->arWmi, &cmd) != A_OK ) {
+        ret = -EIO;
+    }
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_set_rssi_threshold(struct net_device *dev, struct ifreq *rq)
+{
+#define SWAP_THOLD(thold1, thold2) do { \
+    USER_RSSI_THOLD tmpThold;           \
+    tmpThold.tag = thold1.tag;          \
+    tmpThold.rssi = thold1.rssi;        \
+    thold1.tag = thold2.tag;            \
+    thold1.rssi = thold2.rssi;          \
+    thold2.tag = tmpThold.tag;          \
+    thold2.rssi = tmpThold.rssi;        \
+} while (0)
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_RSSI_THRESHOLD_PARAMS_CMD cmd;
+    USER_RSSI_PARAMS rssiParams;
+    A_INT32 i, j;
+    int ret = 0;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user((char *)&rssiParams, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(USER_RSSI_PARAMS))) {
+        return -EFAULT;
+    }
+    cmd.weight = rssiParams.weight;
+    cmd.pollTime = rssiParams.pollTime;
+
+    A_MEMCPY(arSta->rssi_map, &rssiParams.tholds, sizeof(arSta->rssi_map));
+    /*
+     *  only 6 elements, so use bubble sorting, in ascending order
+     */
+    for (i = 5; i > 0; i--) {
+        for (j = 0; j < i; j++) { /* above tholds */
+            if (arSta->rssi_map[j+1].rssi < arSta->rssi_map[j].rssi) {
+                SWAP_THOLD(arSta->rssi_map[j+1], arSta->rssi_map[j]);
+            } else if (arSta->rssi_map[j+1].rssi == arSta->rssi_map[j].rssi) {
+                return EFAULT;
+            }
+        }
+    }
+    for (i = 11; i > 6; i--) {
+        for (j = 6; j < i; j++) { /* below tholds */
+            if (arSta->rssi_map[j+1].rssi < arSta->rssi_map[j].rssi) {
+                SWAP_THOLD(arSta->rssi_map[j+1], arSta->rssi_map[j]);
+            } else if (arSta->rssi_map[j+1].rssi == arSta->rssi_map[j].rssi) {
+                return EFAULT;
+            }
+        }
+    }
+
+#ifdef DEBUG
+    for (i = 0; i < 12; i++) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("thold[%d].tag: %d, thold[%d].rssi: %d \n",
+                i, arSta->rssi_map[i].tag, i, arSta->rssi_map[i].rssi));
+    }
+#endif
+
+    if (enablerssicompensation) {
+        for (i = 0; i < 6; i++)
+            arSta->rssi_map[i].rssi = rssi_compensation_reverse_calc(arPriv, arSta->rssi_map[i].rssi, TRUE);
+        for (i = 6; i < 12; i++)
+            arSta->rssi_map[i].rssi = rssi_compensation_reverse_calc(arPriv, arSta->rssi_map[i].rssi, FALSE);
+    }
+
+    cmd.thresholdAbove1_Val = arSta->rssi_map[0].rssi;
+    cmd.thresholdAbove2_Val = arSta->rssi_map[1].rssi;
+    cmd.thresholdAbove3_Val = arSta->rssi_map[2].rssi;
+    cmd.thresholdAbove4_Val = arSta->rssi_map[3].rssi;
+    cmd.thresholdAbove5_Val = arSta->rssi_map[4].rssi;
+    cmd.thresholdAbove6_Val = arSta->rssi_map[5].rssi;
+    cmd.thresholdBelow1_Val = arSta->rssi_map[6].rssi;
+    cmd.thresholdBelow2_Val = arSta->rssi_map[7].rssi;
+    cmd.thresholdBelow3_Val = arSta->rssi_map[8].rssi;
+    cmd.thresholdBelow4_Val = arSta->rssi_map[9].rssi;
+    cmd.thresholdBelow5_Val = arSta->rssi_map[10].rssi;
+    cmd.thresholdBelow6_Val = arSta->rssi_map[11].rssi;
+    
+    if( wmi_set_rssi_threshold_params(arPriv->arWmi, &cmd) != A_OK ) {
+        ret = -EIO;
+    }
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_set_lq_threshold(struct net_device *dev, struct ifreq *rq)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_LQ_THRESHOLD_PARAMS_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, (char *)((unsigned int *)rq->ifr_data + 1), sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if( wmi_set_lq_threshold_params(arPriv->arWmi, &cmd) != A_OK ) {
+        ret = -EIO;
+    }
+
+    return ret;
+}
+
+
+static int
+ar6000_ioctl_set_probedSsid(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_PROBED_SSID_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_probedSsid_cmd(arPriv->arWmi, cmd.entryIndex, cmd.flag, cmd.ssidLength,
+                                  cmd.ssid) != A_OK)
+    {
+        ret = -EIO;
+    }
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_set_badAp(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_ADD_BAD_AP_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (cmd.badApIndex > WMI_MAX_BAD_AP_INDEX) {
+        return -EIO;
+    }
+
+    if (A_MEMCMP(cmd.bssid, null_mac, AR6000_ETH_ADDR_LEN) == 0) {
+        /*
+         * This is a delete badAP.
+         */
+        if (wmi_deleteBadAp_cmd(arPriv->arWmi, cmd.badApIndex) != A_OK) {
+            ret = -EIO;
+        }
+    } else {
+        if (wmi_addBadAp_cmd(arPriv->arWmi, cmd.badApIndex, cmd.bssid) != A_OK) {
+            ret = -EIO;
+        }
+    }
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_create_qos(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_CREATE_PSTREAM_CMD cmd;
+    A_STATUS ret;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    ret = wmi_verify_tspec_params(&cmd, tspecCompliance);
+    if (ret == A_OK)
+        ret = wmi_create_pstream_cmd(arPriv->arWmi, &cmd);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+static int
+ar6000_ioctl_delete_qos(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_DELETE_PSTREAM_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    ret = wmi_delete_pstream_cmd(arPriv->arWmi, cmd.trafficClass, cmd.tsid);
+
+    switch (ret) {
+        case A_OK:
+            return 0;
+        case A_EBUSY :
+            return -EBUSY;
+        case A_NO_MEMORY:
+            return -ENOMEM;
+        case A_EINVAL:
+        default:
+            return -EFAULT;
+    }
+}
+
+static int
+ar6000_ioctl_get_qos_queue(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    struct ar6000_queuereq qreq;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if( copy_from_user(&qreq, rq->ifr_data,
+                  sizeof(struct ar6000_queuereq)))
+        return -EFAULT;
+
+    qreq.activeTsids = wmi_get_mapped_qos_queue(arPriv->arWmi, qreq.trafficClass);
+
+    if (copy_to_user(rq->ifr_data, &qreq,
+                 sizeof(struct ar6000_queuereq)))
+    {
+        ret = -EFAULT;
+    }
+
+    return ret;
+}
+
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+static A_STATUS
+ar6000_ioctl_tcmd_cmd_resp(struct net_device *dev, struct ifreq *rq, A_UINT8 *data, A_UINT32 len)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT8    buf[4+TC_CMDS_SIZE_MAX];
+    int ret = 0;
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    ar->tcmdRxReport = 0;
+    if (wmi_test_cmd(arPriv->arWmi, data, len) != A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    wait_event_interruptible_timeout(arPriv->arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+        ret = -EINTR;
+    }
+
+    *(A_UINT16*)&(buf[0]) = ar->tcmdResp.len;
+    buf[2] = ar->tcmdResp.ver;
+    A_MEMCPY((buf+4), ar->tcmdResp.buf, sizeof(ar->tcmdResp.buf));
+
+    if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
+        ret = -EFAULT;
+    }
+
+    up(&ar->arSem);
+
+    return ret;
+}
+
+static A_STATUS
+ar6000_ioctl_tcmd_get_rx_report(struct net_device *dev,
+                                 struct ifreq *rq, A_UINT8 *data, A_UINT32 len)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT32    buf[4+TCMD_MAX_RATES];
+    int ret = 0;
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    ar->tcmdRxReport = 0;
+    if (wmi_test_cmd(arPriv->arWmi, data, len) != A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    wait_event_interruptible_timeout(arPriv->arEvent, ar->tcmdRxReport != 0, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+        ret = -EINTR;
+    }
+
+    buf[0] = ar->tcmdRxTotalPkt;
+    buf[1] = ar->tcmdRxRssi;
+    buf[2] = ar->tcmdRxcrcErrPkt;
+    buf[3] = ar->tcmdRxsecErrPkt;
+    A_MEMCPY(((A_UCHAR *)buf)+(4*sizeof(A_UINT32)), ar->tcmdRateCnt, sizeof(ar->tcmdRateCnt));
+    A_MEMCPY(((A_UCHAR *)buf)+(4*sizeof(A_UINT32))+(TCMD_MAX_RATES *sizeof(A_UINT16)), ar->tcmdRateCntShortGuard, sizeof(ar->tcmdRateCntShortGuard));
+
+    if (!ret && copy_to_user(rq->ifr_data, buf, sizeof(buf))) {
+        ret = -EFAULT;
+    }
+
+    up(&ar->arSem);
+
+    return ret;
+}
+
+void
+ar6000_tcmd_rx_report_event(AR_SOFTC_DEV_T *arPriv, A_UINT8 * results, int len)
+{
+    
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    TCMD_CONT_RX * rx_rep = (TCMD_CONT_RX *)results;
+
+    if (TC_CMD_RESP == rx_rep->act) {
+        TC_CMDS *tCmd = (TC_CMDS *)results;
+        ar->tcmdResp.len = tCmd->hdr.u.parm.length;
+        ar->tcmdResp.ver = tCmd->hdr.u.parm.version;
+        A_MEMZERO(ar->tcmdResp.buf, sizeof(ar->tcmdResp.buf));
+        A_MEMCPY(ar->tcmdResp.buf, tCmd->buf, sizeof(ar->tcmdResp.buf));
+        ar->tcmdRxReport = 1;
+    }
+    else { /*(rx_rep->act == TCMD_CONT_RX_REPORT) */ 
+    if (enablerssicompensation) {
+        rx_rep->u.report.rssiInDBm = rssi_compensation_calc_tcmd(ar, tcmdRxFreq, rx_rep->u.report.rssiInDBm,rx_rep->u.report.totalPkt);
+    }
+
+
+    ar->tcmdRxTotalPkt = rx_rep->u.report.totalPkt;
+    ar->tcmdRxRssi = rx_rep->u.report.rssiInDBm;
+    ar->tcmdRxcrcErrPkt = rx_rep->u.report.crcErrPkt;
+    ar->tcmdRxsecErrPkt = rx_rep->u.report.secErrPkt;
+    ar->tcmdRxReport = 1;
+    A_MEMZERO(ar->tcmdRateCnt,  sizeof(ar->tcmdRateCnt));
+    A_MEMZERO(ar->tcmdRateCntShortGuard,  sizeof(ar->tcmdRateCntShortGuard));
+    A_MEMCPY(ar->tcmdRateCnt, rx_rep->u.report.rateCnt, sizeof(ar->tcmdRateCnt));
+    A_MEMCPY(ar->tcmdRateCntShortGuard, rx_rep->u.report.rateCntShortGuard, sizeof(ar->tcmdRateCntShortGuard));
+    }
+
+    wake_up(&arPriv->arEvent);
+}
+#endif /* CONFIG_HOST_TCMD_SUPPORT*/
+
+static int
+ar6000_ioctl_set_error_report_bitmask(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_TARGET_ERROR_REPORT_BITMASK cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    ret = wmi_set_error_report_bitmask(arPriv->arWmi, cmd.bitmask);
+
+    return  (ret==0 ? ret : -EINVAL);
+}
+
+static int
+ar6000_clear_target_stats(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    TARGET_STATS *pStats = &arPriv->arTargetStats;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+    A_MEMZERO(pStats, sizeof(TARGET_STATS));
+    AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+    return ret;
+}
+
+static int
+ar6000_ioctl_get_target_stats(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar    = arPriv->arSoftc;
+    TARGET_STATS_CMD *pcmd;
+    TARGET_STATS *pStats = &arPriv->arTargetStats;
+    int ret = 0;
+
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+    pcmd = (TARGET_STATS_CMD *) A_MALLOC(sizeof(TARGET_STATS_CMD));
+
+    if (pcmd == NULL) {
+        return -ENOMEM;
+    }
+    if (copy_from_user(pcmd, rq->ifr_data, sizeof(*pcmd))) {
+        A_FREE(pcmd);
+        return -EFAULT;
+    }
+    if (down_interruptible(&ar->arSem)) {
+        A_FREE(pcmd);
+        return -ERESTARTSYS;
+    }
+    if (ar->bIsDestroyProgress) {
+        up(&ar->arSem);
+        A_FREE(pcmd);
+        return -EBUSY;
+    }
+
+    arPriv->statsUpdatePending = TRUE;
+
+    if(wmi_get_stats_cmd(arPriv->arWmi) != A_OK) {
+        up(&ar->arSem);
+        A_FREE(pcmd);
+        return -EIO;
+    }
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+        ret = -EINTR;
+    }
+
+    if (!ret && copy_to_user(rq->ifr_data, pStats, sizeof(*pStats))) {
+        ret = -EFAULT;
+    }
+
+    if (pcmd->clearStats == 1) {
+        ret = ar6000_clear_target_stats(dev);
+    }
+
+    up(&ar->arSem);
+
+    a_meminfo_report(FALSE);
+    A_FREE(pcmd);
+
+    return ret;
+}
+
+static int
+ar6000_ioctl_get_ap_stats(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    A_UINT32 action; /* Allocating only the desired space on the frame. Declaring is as a WMI_AP_MODE_STAT variable results in exceeding the compiler imposed limit on the maximum frame size */
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    WMI_PER_STA_STAT *pStats = ar->arAPStats;
+    WMI_AP_MODE_STAT *pret_stat;
+    A_UINT8 i, j=0;
+        
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&action, (char *)((unsigned int*)rq->ifr_data + 1),
+                                sizeof(A_UINT32)))
+    {
+        return -EFAULT;
+    }
+    if (action == AP_CLEAR_STATS) {
+        AR6000_SPIN_LOCK(&ar->arLock, 0);
+        for(i = 0; i < NUM_CONN; i++) {
+            if(ar->connTbl[i].arPriv == arPriv) {
+                pStats[i].tx_bytes = 0;
+                pStats[i].tx_pkts = 0;
+                pStats[i].tx_error = 0;
+                pStats[i].tx_discard = 0;
+                pStats[i].rx_bytes = 0;
+                pStats[i].rx_pkts = 0;
+                pStats[i].rx_error = 0;
+                pStats[i].rx_discard = 0;
+            }
+        }
+        AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+        return ret;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    arPriv->statsUpdatePending = TRUE;
+
+    if(wmi_get_stats_cmd(arPriv->arWmi) != A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+        ret = -EINTR;
+    }
+    
+    pret_stat = (WMI_AP_MODE_STAT *) A_MALLOC(sizeof(WMI_AP_MODE_STAT));
+    if (pret_stat == NULL) {
+        return -ENOMEM;
+    }
+    A_MEMZERO(pret_stat, sizeof(*pret_stat));
+    for(i = 0; i < NUM_CONN; i++) {
+        if(ar->connTbl[i].arPriv == arPriv) {
+            pret_stat->sta[j].aid          = pStats[i].aid;
+            pret_stat->sta[j].tx_bytes     = pStats[i].tx_bytes;
+            pret_stat->sta[j].tx_pkts      = pStats[i].tx_pkts;
+            pret_stat->sta[j].tx_error     = pStats[i].tx_error;
+            pret_stat->sta[j].tx_discard   = pStats[i].tx_discard;
+            pret_stat->sta[j].rx_bytes     = pStats[i].rx_bytes;
+            pret_stat->sta[j].rx_pkts      = pStats[i].rx_pkts;
+            pret_stat->sta[j].rx_error     = pStats[i].rx_error;
+            pret_stat->sta[j].rx_discard   = pStats[i].rx_discard;
+            j++;
+        }
+    }
+    
+    if (!ret && copy_to_user(rq->ifr_data, pret_stat, sizeof(*pret_stat))) {
+        ret = -EFAULT;
+    }
+
+    up(&ar->arSem);
+    A_FREE(pret_stat);
+    return ret;
+}
+
+static int
+ar6000_ioctl_set_access_params(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_ACCESS_PARAMS_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_access_params_cmd(arPriv->arWmi, cmd.ac, cmd.txop, cmd.eCWmin, cmd.eCWmax,
+                                  cmd.aifsn) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return (ret);
+}
+
+static int
+ar6000_ioctl_set_disconnect_timeout(struct net_device *dev, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_DISC_TIMEOUT_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, rq->ifr_data, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_disctimeout_cmd(arPriv->arWmi, cmd.disconnectTimeout) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return (ret);
+}
+
+static int
+ar6000_xioctl_set_voice_pkt_size(struct net_device *dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_VOICE_PKT_SIZE_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_voice_pkt_size_cmd(arPriv->arWmi, cmd.voicePktSize) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+
+    return (ret);
+}
+
+static int
+ar6000_xioctl_set_max_sp_len(struct net_device *dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_MAX_SP_LEN_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_max_sp_len_cmd(arPriv->arWmi, cmd.maxSPLen) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return (ret);
+}
+
+#ifdef BTCOEX
+static int
+ar6000_xioctl_set_bt_status_cmd(struct net_device *dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BT_STATUS_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_bt_status_cmd(arPriv->arWmi, cmd.streamType, cmd.status) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return (ret);
+}
+
+static int
+ar6000_xioctl_set_bt_params_cmd(struct net_device *dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BT_PARAMS_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_bt_params_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return (ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_fe_ant_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_FE_ANT_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_fe_ant_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_colocated_bt_dev_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_colocated_bt_dev_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_btinquiry_page_config_cmd(struct net_device * dev,  char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_btinquiry_page_config_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_sco_config_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_SCO_CONFIG_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_sco_config_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_a2dp_config_cmd(struct net_device * dev,
+                                                        char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_A2DP_CONFIG_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_a2dp_config_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_aclcoex_config_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_aclcoex_config_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar60000_xioctl_set_btcoex_debug_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_DEBUG_CMD cmd;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_btcoex_debug_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    return(ret);
+}
+
+static int
+ar6000_xioctl_set_btcoex_bt_operating_status_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD cmd;
+    int ret = 0;
+    A_UINT32 btProfileType;
+    A_UINT32 btOperatingStatus;
+    
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+    return -EFAULT;
+    }
+   
+    btProfileType = cmd.btProfileType;
+    btOperatingStatus = cmd.btOperatingStatus; 
+
+    if (BT_STREAM_SCAN != btProfileType   &&
+        BT_STATUS_ON   == btOperatingStatus &&
+        arPriv->arNetworkType == AP_NETWORK)
+    {
+        switch (ar->delbaState)
+        {
+            case REASON_DELBA_INIT:
+                ar6000_send_delba (ar, REASON_TEAR_DOWN);
+                ar->delbaState = REASON_TEAR_DOWN;
+                break;
+            case REASON_TEAR_DOWN:
+                break;
+            case REASON_DELBA_TIMEOUT:
+                //
+                // Uninitialize timer, and keep the state as TEAR_DOWN for rearm the timer
+                //
+                ar->IsdelbaTimerInitialized = FALSE;
+                A_UNTIMEOUT (&ar->delbaTimer);
+                ar->delbaState = REASON_TEAR_DOWN;
+                break;
+        }
+
+    }
+ 
+    if (wmi_set_btcoex_bt_operating_status_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+
+    if (BT_STREAM_SCAN != btProfileType   &&
+        BT_STATUS_OFF  == btOperatingStatus &&
+        arPriv->arNetworkType == AP_NETWORK)
+    {
+        switch (ar->delbaState)
+        {
+            case REASON_DELBA_INIT:
+                break;
+            case REASON_TEAR_DOWN:
+                ar->delbaState = REASON_DELBA_TIMEOUT;
+
+                // Initiate A_TIMER
+                ar->IsdelbaTimerInitialized = TRUE;
+                A_TIMEOUT_MS (&ar->delbaTimer, DELBA_TIMEOUT, 0);
+                break;
+
+            case REASON_DELBA_TIMEOUT:
+                break;
+        }
+    }
+    
+    return(ret);
+}
+
+static int
+ar6000_xioctl_get_btcoex_config_cmd(struct net_device * dev, char * userdata,
+                                            struct ifreq *rq)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR6000_BTCOEX_CONFIG btcoexConfig;
+    WMI_BTCOEX_CONFIG_EVENT *pbtcoexConfigEv = &arPriv->arBtcoexConfig;
+
+    int ret = 0;
+
+    if (ar->bIsDestroyProgress) {
+            return -EBUSY;
+    }
+    if (ar->arWmiReady == FALSE) {
+            return -EIO;
+    }
+    if (copy_from_user(&btcoexConfig.configCmd, userdata, sizeof(AR6000_BTCOEX_CONFIG))) {
+        return -EFAULT;
+    }
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (wmi_get_btcoex_config_cmd(arPriv->arWmi, (WMI_GET_BTCOEX_CONFIG_CMD *)&btcoexConfig.configCmd) != A_OK)
+    {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    arPriv->statsUpdatePending = TRUE;
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+       ret = -EINTR;
+    }
+
+    if (!ret && copy_to_user(btcoexConfig.configEvent, pbtcoexConfigEv, sizeof(WMI_BTCOEX_CONFIG_EVENT))) {
+            ret = -EFAULT;
+    }
+    up(&ar->arSem);
+    return ret;
+}
+
+static int
+ar6000_xioctl_get_btcoex_stats_cmd(struct net_device * dev, char * userdata, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR6000_BTCOEX_STATS btcoexStats;
+    WMI_BTCOEX_STATS_EVENT *pbtcoexStats = &arPriv->arBtcoexStats;
+    int ret = 0;
+
+    if (ar->bIsDestroyProgress) {
+            return -EBUSY;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+            return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (copy_from_user(&btcoexStats.statsEvent, userdata, sizeof(AR6000_BTCOEX_CONFIG))) {
+        return -EFAULT;
+    }
+
+    if (wmi_get_btcoex_stats_cmd(arPriv->arWmi) != A_OK)
+    {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    arPriv->statsUpdatePending = TRUE;
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+       ret = -EINTR;
+    }
+
+    if (!ret && copy_to_user(btcoexStats.statsEvent, pbtcoexStats, sizeof(WMI_BTCOEX_STATS_EVENT))) {
+            ret = -EFAULT;
+    }
+
+
+    up(&ar->arSem);
+
+    return(ret);
+}
+#endif
+
+static int
+ar6000_xioctl_set_excess_tx_retry_thres_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_SET_EXCESS_TX_RETRY_THRES_CMD cmd;
+    int ret = 0;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+        return -EFAULT;
+    }
+
+    if (wmi_set_excess_tx_retry_thres_cmd(arPriv->arWmi, &cmd) != A_OK)
+    {
+        ret = -EINVAL;
+    }
+    return(ret);
+}
+
+#ifdef WAC
+static int
+ar6000_xioctl_wac_ctrl_req_get_cmd(struct net_device * dev, char * userdata, struct ifreq *rq)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_WAC_CTRL_REQ_CMD cmd;
+    int ret = 0;
+
+    if (ar->bIsDestroyProgress) {
+            return -EBUSY;
+    }
+    if (ar->arWmiReady == FALSE) {
+            return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(WMI_WAC_CTRL_REQ_CMD))) {
+        return -EFAULT;
+    }
+
+    if (wmi_wac_ctrl_req_cmd(arPriv->arWmi, &cmd) != A_OK)
+    {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    arPriv->statsUpdatePending = TRUE;
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->statsUpdatePending == FALSE, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+       ret = -EINTR;
+    }
+
+    if (!ret && copy_to_user(rq->ifr_data, &arPriv->wacInfo, sizeof(WMI_GET_WAC_INFO))) {
+            ret = -EFAULT;
+    }
+
+    up(&ar->arSem);
+
+    return(ret);
+}
+#endif
+
+static int
+ar6000_xioctl_set_passphrase_cmd(struct net_device * dev, char * userdata)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    WMI_SET_PASSPHRASE_CMD cmd;
+    int ret = 0;
+
+    if (ar->arWmiReady == FALSE) {
+    return -EIO;
+    }
+
+    if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+    return -EFAULT;
+    }
+
+    if (wmi_set_passphrase_cmd(arPriv->arWmi, &cmd) == A_OK)
+    {
+        /* enable WPA offload */
+        arSta->arConnectCtrlFlags |= CONNECT_DO_WPA_OFFLOAD;
+        ret = 0;
+    } else {
+        ret = -EINVAL;
+    }
+    return(ret);
+}
+
+#ifdef CONFIG_HOST_GPIO_SUPPORT
+struct ar6000_gpio_intr_wait_cmd_s  gpio_intr_results;
+/* gpio_reg_results and gpio_data_available are protected by arSem */
+static struct ar6000_gpio_register_cmd_s gpio_reg_results;
+static A_BOOL gpio_data_available; /* Requested GPIO data available */
+static A_BOOL gpio_intr_available; /* GPIO interrupt info available */
+static A_BOOL gpio_ack_received;   /* GPIO ack was received */
+
+/* Host-side initialization for General Purpose I/O support */
+void ar6000_gpio_init(void)
+{
+    gpio_intr_available = FALSE;
+    gpio_data_available = FALSE;
+    gpio_ack_received   = FALSE;
+}
+
+/*
+ * Called when a GPIO interrupt is received from the Target.
+ * intr_values shows which GPIO pins have interrupted.
+ * input_values shows a recent value of GPIO pins.
+ */
+void
+ar6000_gpio_intr_rx(AR_SOFTC_DEV_T *arPriv, A_UINT32 intr_mask, A_UINT32 input_values)
+{
+    gpio_intr_results.intr_mask = intr_mask;
+    gpio_intr_results.input_values = input_values;
+    *((volatile A_BOOL *)&gpio_intr_available) = TRUE;
+    wake_up(&arPriv->arEvent);
+}
+
+/*
+ * This is called when a response is received from the Target
+ * for a previous or ar6000_gpio_input_get or ar6000_gpio_register_get
+ * call.
+ */
+void
+ar6000_gpio_data_rx(AR_SOFTC_DEV_T *arPriv, A_UINT32 reg_id, A_UINT32 value)
+{
+    gpio_reg_results.gpioreg_id = reg_id;
+    gpio_reg_results.value = value;
+    *((volatile A_BOOL *)&gpio_data_available) = TRUE;
+    wake_up(&arPriv->arEvent);
+}
+
+/*
+ * This is called when an acknowledgement is received from the Target
+ * for a previous or ar6000_gpio_output_set or ar6000_gpio_register_set
+ * call.
+ */
+void
+ar6000_gpio_ack_rx(AR_SOFTC_DEV_T *arPriv)
+{
+    gpio_ack_received = TRUE;
+    wake_up(&arPriv->arEvent);
+}
+
+A_STATUS
+ar6000_gpio_output_set(struct net_device *dev,
+                       A_UINT32 set_mask,
+                       A_UINT32 clear_mask,
+                       A_UINT32 enable_mask,
+                       A_UINT32 disable_mask)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    gpio_ack_received = FALSE;
+    return wmi_gpio_output_set(arPriv->arWmi,
+                set_mask, clear_mask, enable_mask, disable_mask);
+}
+
+static A_STATUS
+ar6000_gpio_input_get(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    *((volatile A_BOOL *)&gpio_data_available) = FALSE;
+    return wmi_gpio_input_get(arPriv->arWmi);
+}
+
+static A_STATUS
+ar6000_gpio_register_set(struct net_device *dev,
+                         A_UINT32 gpioreg_id,
+                         A_UINT32 value)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    gpio_ack_received = FALSE;
+    return wmi_gpio_register_set(arPriv->arWmi, gpioreg_id, value);
+}
+
+static A_STATUS
+ar6000_gpio_register_get(struct net_device *dev,
+                         A_UINT32 gpioreg_id)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    *((volatile A_BOOL *)&gpio_data_available) = FALSE;
+    return wmi_gpio_register_get(arPriv->arWmi, gpioreg_id);
+}
+
+static A_STATUS
+ar6000_gpio_intr_ack(struct net_device *dev,
+                     A_UINT32 ack_mask)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    gpio_intr_available = FALSE;
+    return wmi_gpio_intr_ack(arPriv->arWmi, ack_mask);
+}
+#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+static struct prof_count_s prof_count_results;
+static A_BOOL prof_count_available; /* Requested GPIO data available */
+
+static A_STATUS
+prof_count_get(struct net_device *dev)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+
+    *((volatile A_BOOL *)&prof_count_available) = FALSE;
+    return wmi_prof_count_get_cmd(arPriv->arWmi);
+}
+
+/*
+ * This is called when a response is received from the Target
+ * for a previous prof_count_get call.
+ */
+void
+prof_count_rx(A_UINT32 addr, A_UINT32 count)
+{
+    prof_count_results.addr = addr;
+    prof_count_results.count = count;
+    *((volatile A_BOOL *)&prof_count_available) = TRUE;
+    wake_up(&arEvent);
+}
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+#ifdef BTCOEX
+static A_STATUS
+ar6000_create_acl_data_osbuf(struct net_device *dev, A_UINT8 *userdata, void **p_osbuf)
+{
+    void *osbuf = NULL;
+    A_UINT8 tmp_space[8];
+    HCI_ACL_DATA_PKT *acl;
+    A_UINT8 hdr_size, *datap=NULL;
+    A_STATUS ret = A_OK;
+
+    /* ACL is in data path. There is a need to create pool
+     * mechanism for allocating and freeing NETBUFs - ToDo later.
+     */
+
+    *p_osbuf = NULL;
+    acl = (HCI_ACL_DATA_PKT *)tmp_space;
+    hdr_size = sizeof(acl->hdl_and_flags) + sizeof(acl->data_len);
+
+    do {
+        if (a_copy_from_user(acl, userdata, hdr_size)) {
+            ret = A_EFAULT;
+            break;
+        }
+
+        osbuf = A_NETBUF_ALLOC(hdr_size + acl->data_len);
+        if (osbuf == NULL) {
+           ret = A_NO_MEMORY;
+           break;
+        }
+        A_NETBUF_PUT(osbuf, hdr_size + acl->data_len);
+        datap = (A_UINT8 *)A_NETBUF_DATA(osbuf);
+
+        /* Real copy to osbuf */
+        acl = (HCI_ACL_DATA_PKT *)(datap);
+        A_MEMCPY(acl, tmp_space, hdr_size);
+        if (a_copy_from_user(acl->data, userdata + hdr_size, acl->data_len)) {
+            ret = A_EFAULT;
+            break;
+        }
+    } while(FALSE);
+
+    if (ret == A_OK) {
+        *p_osbuf = osbuf;
+    } else {
+        A_NETBUF_FREE(osbuf);
+    }
+    return ret;
+}
+#endif
+
+int
+ar6000_ioctl_ap_setparam(AR_SOFTC_DEV_T *arPriv, int param, int value)
+{
+    int ret=0;
+
+    switch(param) {
+        case IEEE80211_PARAM_WPA:
+            switch (value) {
+                case WPA_MODE_WPA1:
+                    arPriv->arAuthMode = WMI_WPA_AUTH;
+                    break;
+                case WPA_MODE_WPA2:
+                    arPriv->arAuthMode = WMI_WPA2_AUTH;
+                    break;
+                case WPA_MODE_AUTO:
+                    arPriv->arAuthMode = WMI_WPA_AUTH | WMI_WPA2_AUTH;
+                    break;
+                case WPA_MODE_NONE:
+                    arPriv->arAuthMode = WMI_NONE_AUTH;
+                    break;
+            }
+            break;
+        case IEEE80211_PARAM_AUTHMODE:
+            if(value == IEEE80211_AUTH_WPA_PSK) {
+                if (WMI_WPA_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA_PSK_AUTH;
+                } else if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA2_PSK_AUTH;
+                } else if ((WMI_WPA_AUTH | WMI_WPA2_AUTH) == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA_PSK_AUTH | WMI_WPA2_PSK_AUTH;
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Error -  Setting PSK "\
+                        "mode when WPA param was set to %d\n",
+                        arPriv->arAuthMode));
+                    ret = -EIO;
+                }
+            }
+            break;
+        case IEEE80211_PARAM_UCASTCIPHER:
+            arPriv->arPairwiseCrypto = 0;
+            if(value & (1<<IEEE80211_CIPHER_AES_CCM)) {
+                arPriv->arPairwiseCrypto |= AES_CRYPT;
+            }
+            if(value & (1<<IEEE80211_CIPHER_TKIP)) {
+                arPriv->arPairwiseCrypto |= TKIP_CRYPT;
+            }
+            if(!arPriv->arPairwiseCrypto) {
+                AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
+                           ("Error - Invalid cipher in WPA \n"));
+                ret = -EIO;
+            }
+            break;
+        case IEEE80211_PARAM_PRIVACY:
+            if(value == 0) {
+                arPriv->arDot11AuthMode      = OPEN_AUTH;
+                arPriv->arAuthMode           = WMI_NONE_AUTH;
+                arPriv->arPairwiseCrypto     = NONE_CRYPT;
+                arPriv->arPairwiseCryptoLen  = 0;
+                arPriv->arGroupCrypto        = NONE_CRYPT;
+                arPriv->arGroupCryptoLen     = 0;
+            }
+            break;
+#ifdef WAPI_ENABLE
+        case IEEE80211_PARAM_WAPI:
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WAPI Policy: %d\n", value));
+            arPriv->arDot11AuthMode      = OPEN_AUTH;
+            arPriv->arAuthMode           = WMI_NONE_AUTH;
+            if(value & 0x1) {
+                arPriv->arPairwiseCrypto     = WAPI_CRYPT;
+                arPriv->arGroupCrypto        = WAPI_CRYPT;
+            } else {
+                arPriv->arPairwiseCrypto     = NONE_CRYPT;
+                arPriv->arGroupCrypto        = NONE_CRYPT;
+            }
+            break;
+#endif
+    }
+    return ret;
+}
+
+int
+ar6000_ioctl_setparam(AR_SOFTC_DEV_T *arPriv, int param, int value)
+{
+    A_BOOL profChanged = FALSE;
+    int ret=0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if(arPriv->arNextMode == AP_NETWORK) {
+        arPriv->ap_profile_flag = 1; /* There is a change in profile */
+        switch (param) {
+            case IEEE80211_PARAM_WPA:
+            case IEEE80211_PARAM_AUTHMODE:
+            case IEEE80211_PARAM_UCASTCIPHER:
+            case IEEE80211_PARAM_PRIVACY:
+            case IEEE80211_PARAM_WAPI:
+                ret = ar6000_ioctl_ap_setparam(arPriv, param, value);
+                return ret;
+        }
+    }
+
+    switch (param) {
+        case IEEE80211_PARAM_WPA:
+            switch (value) {
+                case WPA_MODE_WPA1:
+                    arPriv->arAuthMode = WMI_WPA_AUTH;
+                    profChanged    = TRUE;
+                    break;
+                case WPA_MODE_WPA2:
+                    arPriv->arAuthMode = WMI_WPA2_AUTH;
+                    profChanged    = TRUE;
+                    break;
+                case WPA_MODE_NONE:
+                    arPriv->arAuthMode = WMI_NONE_AUTH;
+                    profChanged    = TRUE;
+                    break;
+            }
+            break;
+        case IEEE80211_PARAM_AUTHMODE:
+            switch(value) {
+                case IEEE80211_AUTH_WPA_PSK:
+                    if (WMI_WPA_AUTH == arPriv->arAuthMode) {
+                        arPriv->arAuthMode = WMI_WPA_PSK_AUTH;
+                        profChanged    = TRUE;
+                    } else if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+                        arPriv->arAuthMode = WMI_WPA2_PSK_AUTH;
+                        profChanged    = TRUE;
+                    } else {
+                        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Error -  Setting PSK "\
+                            "mode when WPA param was set to %d\n",
+                            arPriv->arAuthMode));
+                        ret = -EIO;
+                    }
+                    break;
+                case IEEE80211_AUTH_WPA_CCKM:
+                    if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+                        arPriv->arAuthMode = WMI_WPA2_AUTH_CCKM;
+                    } else {
+                        arPriv->arAuthMode = WMI_WPA_AUTH_CCKM;
+                    }
+                    break;
+                default:
+                    break;
+            }
+            break;
+        case IEEE80211_PARAM_UCASTCIPHER:
+            switch (value) {
+                case IEEE80211_CIPHER_AES_CCM:
+                    arPriv->arPairwiseCrypto = AES_CRYPT;
+                    profChanged          = TRUE;
+                    break;
+                case IEEE80211_CIPHER_TKIP:
+                    arPriv->arPairwiseCrypto = TKIP_CRYPT;
+                    profChanged          = TRUE;
+                    break;
+                case IEEE80211_CIPHER_WEP:
+                    arPriv->arPairwiseCrypto = WEP_CRYPT;
+                    profChanged          = TRUE;
+                    break;
+                case IEEE80211_CIPHER_NONE:
+                    arPriv->arPairwiseCrypto = NONE_CRYPT;
+                    profChanged          = TRUE;
+                    break;
+            }
+            break;
+        case IEEE80211_PARAM_UCASTKEYLEN:
+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
+                ret = -EIO;
+            } else {
+                arPriv->arPairwiseCryptoLen = value;
+            }
+            break;
+        case IEEE80211_PARAM_MCASTCIPHER:
+            switch (value) {
+                case IEEE80211_CIPHER_AES_CCM:
+                    arPriv->arGroupCrypto = AES_CRYPT;
+                    profChanged       = TRUE;
+                    break;
+                case IEEE80211_CIPHER_TKIP:
+                    arPriv->arGroupCrypto = TKIP_CRYPT;
+                    profChanged       = TRUE;
+                    break;
+                case IEEE80211_CIPHER_WEP:
+                    arPriv->arGroupCrypto = WEP_CRYPT;
+                    profChanged       = TRUE;
+                    break;
+                case IEEE80211_CIPHER_NONE:
+                    arPriv->arGroupCrypto = NONE_CRYPT;
+                    profChanged       = TRUE;
+                    break;
+            }
+            break;
+        case IEEE80211_PARAM_MCASTKEYLEN:
+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(value)) {
+                ret = -EIO;
+            } else {
+                arPriv->arGroupCryptoLen = value;
+            }
+            break;
+        case IEEE80211_PARAM_COUNTERMEASURES:
+            if (ar->arWmiReady == FALSE) {
+                return -EIO;
+            }
+            wmi_set_tkip_countermeasures_cmd(arPriv->arWmi, value);
+            break;
+        default:
+            break;
+    }
+    if ((arPriv->arNextMode != AP_NETWORK) && (profChanged == TRUE)) {
+        /*
+         * profile has changed.  Erase ssid to signal change
+         */
+        A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+    }
+
+    return ret;
+}
+
+int
+ar6000_sendkey(AR_SOFTC_DEV_T *arPriv, struct ieee80211req_key *ik, KEY_USAGE keyUsage)
+{
+    A_STATUS status;
+    CRYPTO_TYPE keyType = NONE_CRYPT;
+   
+    switch (ik->ik_type) {
+        case IEEE80211_CIPHER_WEP:
+            keyType = WEP_CRYPT;
+            break;
+        case IEEE80211_CIPHER_TKIP:
+            keyType = TKIP_CRYPT;
+            break;
+        case IEEE80211_CIPHER_AES_CCM:
+            keyType = AES_CRYPT;
+            break;
+        default:
+            break;
+    }
+    
+    if (IEEE80211_CIPHER_CCKM_KRK != ik->ik_type) {
+        if (NONE_CRYPT == keyType) {
+            return A_ERROR;
+        }
+
+        if ((WEP_CRYPT == keyType)&&(!arPriv->arConnected)) {
+             int index = ik->ik_keyix;
+
+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(ik->ik_keylen)) {
+                return A_ERROR;
+            }
+
+            A_MEMZERO(arPriv->arWepKeyList[index].arKey,
+                            sizeof(arPriv->arWepKeyList[index].arKey));
+            A_MEMCPY(arPriv->arWepKeyList[index].arKey, ik->ik_keydata, ik->ik_keylen);
+            arPriv->arWepKeyList[index].arKeyLen = ik->ik_keylen;
+
+            if(ik->ik_flags & IEEE80211_KEY_DEFAULT){
+                arPriv->arDefTxKeyIndex = index;
+            }
+
+            return A_OK;
+        }
+
+        status = wmi_addKey_cmd(arPriv->arWmi, ik->ik_keyix, keyType, keyUsage,
+                                ik->ik_keylen, (A_UINT8 *)&ik->ik_keyrsc,
+                                ik->ik_keydata, KEY_OP_INIT_VAL, ik->ik_macaddr,
+                                SYNC_BOTH_WMIFLAG);
+
+    } else {
+        status = wmi_add_krk_cmd(arPriv->arWmi, ik->ik_keydata);
+    }
+    
+    return status;
+}
+
+int
+ar6000_ioctl_setkey(AR_SOFTC_DEV_T *arPriv, struct ieee80211req_key *ik)
+{
+    KEY_USAGE keyUsage;
+    A_STATUS status;
+    CRYPTO_TYPE keyType = NONE_CRYPT;
+
+    if ( (0 == memcmp(ik->ik_macaddr, null_mac, IEEE80211_ADDR_LEN)) ||
+         (0 == memcmp(ik->ik_macaddr, bcast_mac, IEEE80211_ADDR_LEN)) ) {
+        keyUsage = GROUP_USAGE;
+    } else {
+        keyUsage = PAIRWISE_USAGE;
+    }
+
+    if(arPriv->arNextMode == AP_NETWORK) {
+        AR_SOFTC_AP_T   *arAp = &arPriv->arAp;
+        
+        if (keyUsage == GROUP_USAGE) {
+            A_MEMCPY(&arAp->ap_mode_bkey, ik, sizeof(struct ieee80211req_key));
+        }
+
+#ifdef WAPI_ENABLE
+        if(arPriv->arPairwiseCrypto == WAPI_CRYPT) {
+            return ap_set_wapi_key(arPriv, ik);
+        }
+#endif
+
+        status = ar6000_sendkey(arPriv, ik, keyUsage);
+        
+    } else {
+        AR_SOFTC_STA_T   *arSta = &arPriv->arSta;
+        
+        #ifdef USER_KEYS
+        arSta->user_saved_keys.keyOk = FALSE;
+        arSta->user_saved_keys.keyType = keyType;
+        if (keyUsage == GROUP_USAGE) {
+            A_MEMCPY(&arSta->user_saved_keys.bcast_ik, ik,
+                     sizeof(struct ieee80211req_key));
+        } else {
+            A_MEMCPY(&arSta->user_saved_keys.ucast_ik, ik,
+                     sizeof(struct ieee80211req_key));
+        }
+        #endif
+        
+        if (((WMI_WPA_PSK_AUTH == arPriv->arAuthMode) || 
+            (WMI_WPA2_PSK_AUTH == arPriv->arAuthMode)) &&
+            (GROUP_USAGE & keyUsage))
+        {
+            A_UNTIMEOUT(&arSta->disconnect_timer);
+        }
+        
+        status = ar6000_sendkey(arPriv, ik, keyUsage);
+        
+        #ifdef USER_KEYS
+        if (status == A_OK) {
+            arSta->user_saved_keys.keyOk = TRUE;
+        }
+        #endif
+    }
+
+    if (status != A_OK) {
+        return -EIO;
+    }
+
+    return 0;
+}
+int ar6000_xioctl_add_wowptn(AR_SOFTC_DEV_T *arPriv, char *userdata)
+{
+#define WOW_PATTERN_SIZE 64
+#define WOW_MASK_SIZE 64
+    WMI_ADD_WOW_PATTERN_CMD cmd;
+    AR_SOFTC_T *ar=arPriv->arSoftc;
+    int ret = 0;
+    A_UINT8 *pmask_data;
+    A_UINT8 *ppattern_data;
+    pmask_data = (A_UINT8 *) A_MALLOC(WOW_MASK_SIZE * sizeof(A_UINT8));
+    if (pmask_data == NULL) {
+        return -ENOMEM;
+    }
+    ppattern_data = (A_UINT8 *) A_MALLOC(WOW_PATTERN_SIZE * sizeof(A_UINT8));
+    if (ppattern_data == NULL) {
+        A_FREE(pmask_data);
+        return -ENOMEM;
+    }
+    A_MEMZERO(pmask_data, WOW_MASK_SIZE * sizeof(A_UINT8));
+    A_MEMZERO(ppattern_data, WOW_PATTERN_SIZE * sizeof(A_UINT8)); 
+
+    do {
+        if (ar->arWmiReady == FALSE) {
+            ret = -EIO;
+            break;        
+        } 
+        if(copy_from_user(&cmd, userdata,
+                          sizeof(WMI_ADD_WOW_PATTERN_CMD)))
+        {
+            ret = -EFAULT;
+            break;        
+        }
+        if (copy_from_user(ppattern_data,
+                           userdata + 3,
+                           cmd.filter_size)) 
+        {
+            ret = -EFAULT;
+            break;        
+        }
+        if (copy_from_user(pmask_data,
+                           (userdata + 3 + cmd.filter_size),
+                           cmd.filter_size))
+        {
+            ret = -EFAULT;
+            break;
+        }
+        if (wmi_add_wow_pattern_cmd(arPriv->arWmi,
+                                    &cmd, ppattern_data, pmask_data,
+                                    cmd.filter_size) != A_OK)
+        {
+        ret = -EIO;
+        }
+    } while(FALSE);
+    A_FREE(pmask_data);
+    A_FREE(ppattern_data);
+    return ret;
+#undef WOW_PATTERN_SIZE
+#undef WOW_MASK_SIZE
+}
+
+int ar6000_xioctl_dump_htccredit(AR_SOFTC_DEV_T *arPriv)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    int ret = 0;
+    if (ar->arHtcTarget != NULL) {
+#ifdef ATH_DEBUG_MODULE
+        HTCDumpCreditStates(ar->arHtcTarget);
+#endif /* ATH_DEBUG_MODULE */
+#ifdef HTC_EP_STAT_PROFILING
+        {
+            HTC_ENDPOINT_STATS *pstats;
+            int i;
+            pstats = (HTC_ENDPOINT_STATS *) A_MALLOC(sizeof(HTC_ENDPOINT_STATS));
+            if (pstats == NULL) {
+                return -ENOMEM;
+            }
+
+            for (i = 0; i < 5; i++) {
+                if (HTCGetEndpointStatistics(ar->arHtcTarget,
+                                             i,
+                                             HTC_EP_STAT_SAMPLE_AND_CLEAR,
+                                             pstats)) {
+                    A_PRINTF(KERN_ALERT"------- Profiling Endpoint : %d \n", i);
+                    A_PRINTF(KERN_ALERT"TxCreditLowIndications : %d \n", pstats->TxCreditLowIndications);
+                    A_PRINTF(KERN_ALERT"TxIssued : %d \n", pstats->TxIssued);
+                    A_PRINTF(KERN_ALERT"TxDropped: %d \n", pstats->TxDropped);
+                    A_PRINTF(KERN_ALERT"TxPacketsBundled : %d \n", pstats->TxPacketsBundled);
+                    A_PRINTF(KERN_ALERT"TxBundles : %d \n", pstats->TxBundles);
+                    A_PRINTF(KERN_ALERT"TxCreditRpts : %d \n", pstats->TxCreditRpts);
+                    A_PRINTF(KERN_ALERT"TxCreditsRptsFromRx : %d \n", pstats->TxCreditRptsFromRx);
+                    A_PRINTF(KERN_ALERT"TxCreditsRptsFromOther : %d \n", pstats->TxCreditRptsFromOther);
+                    A_PRINTF(KERN_ALERT"TxCreditsRptsFromEp0 : %d \n", pstats->TxCreditRptsFromEp0);
+                    A_PRINTF(KERN_ALERT"TxCreditsFromRx : %d \n", pstats->TxCreditsFromRx);
+                    A_PRINTF(KERN_ALERT"TxCreditsFromOther : %d \n", pstats->TxCreditsFromOther);
+                    A_PRINTF(KERN_ALERT"TxCreditsFromEp0 : %d \n", pstats->TxCreditsFromEp0);
+                    A_PRINTF(KERN_ALERT"TxCreditsConsummed : %d \n", pstats->TxCreditsConsummed);
+                    A_PRINTF(KERN_ALERT"TxCreditsReturned : %d \n", pstats->TxCreditsReturned);
+                    A_PRINTF(KERN_ALERT"RxReceived : %d \n", pstats->RxReceived);
+                    A_PRINTF(KERN_ALERT"RxPacketsBundled : %d \n", pstats->RxPacketsBundled);
+                    A_PRINTF(KERN_ALERT"RxLookAheads : %d \n", pstats->RxLookAheads);
+                    A_PRINTF(KERN_ALERT"RxBundleLookAheads : %d \n", pstats->RxBundleLookAheads);
+                    A_PRINTF(KERN_ALERT"RxBundleIndFromHdr : %d \n", pstats->RxBundleIndFromHdr);
+                    A_PRINTF(KERN_ALERT"RxAllocThreshHit : %d \n", pstats->RxAllocThreshHit);
+                    A_PRINTF(KERN_ALERT"RxAllocThreshBytes : %d \n", pstats->RxAllocThreshBytes);
+                    A_PRINTF(KERN_ALERT"---- \n");
+                }
+            }
+            A_FREE(pstats);
+                   
+        }
+#endif
+    }
+    return ret;
+}
+
+int ar6000_ioctl_get_wpaie(AR_SOFTC_DEV_T *arPriv, char *userdata)
+{
+    struct ieee80211req_wpaie *pwpaie;
+    int ret = 0;
+    AR_SOFTC_T *ar=arPriv->arSoftc;
+
+    pwpaie = (struct ieee80211req_wpaie *) A_MALLOC(sizeof(struct ieee80211req_wpaie));
+    if (pwpaie == NULL) {
+        return -ENOMEM;
+    }
+            
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(pwpaie, userdata, sizeof(*pwpaie))) {
+        ret = -EFAULT;
+    } else if (ar6000_ap_mode_get_wpa_ie(arPriv, pwpaie)) {
+        ret = -EFAULT;
+    } else if(copy_to_user(userdata, pwpaie, sizeof(*pwpaie))) {
+        ret = -EFAULT;
+    }
+    A_FREE(pwpaie);
+    return ret;
+
+}
+
+#ifdef BTCOEX
+int ar6000_xioctl_hci_cmd(AR_SOFTC_DEV_T *arPriv, char *userdata)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    char tmp_buf[512];
+    A_INT8 i;
+    WMI_HCI_CMD *cmd = (WMI_HCI_CMD *)tmp_buf;
+    A_UINT8 size;
+    int ret = 0;
+
+    size = sizeof(cmd->cmd_buf_sz);
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(cmd, userdata, size)) {
+        ret = -EFAULT;
+    } else if(copy_from_user(cmd->buf, userdata + size, cmd->cmd_buf_sz)) {
+        ret = -EFAULT;
+    } else {
+        if (wmi_send_hci_cmd(arPriv->arWmi, cmd->buf, cmd->cmd_buf_sz) != A_OK) {
+            ret = -EIO;
+        } else if(loghci) {
+            A_PRINTF_LOG("HCI Command To PAL --> \n");
+            for(i = 0; i < cmd->cmd_buf_sz; i++) {
+                A_PRINTF_LOG("0x%02x ",cmd->buf[i]);
+                if((i % 10) == 0) {
+                    A_PRINTF_LOG("\n");
+                }
+            }
+            A_PRINTF_LOG("\n");
+            A_PRINTF_LOG("==================================\n");
+        }
+    }
+    return ret;
+}
+#endif
+
+int ar6000_xioctl_fetch_targ_regs(AR_SOFTC_DEV_T *arPriv, struct ifreq *rq, HIF_DEVICE *hifDevice)
+{
+    int ret = 0;
+    AR_SOFTC_T *ar=arPriv->arSoftc;
+    A_UINT32 targregs[AR6003_FETCH_TARG_REGS_COUNT];
+
+    if (ar->arTargetType == TARGET_TYPE_AR6003) {
+        ar6k_FetchTargetRegs(hifDevice, targregs);
+        if (copy_to_user((A_UINT32 *)rq->ifr_data, &targregs, sizeof(targregs)))
+        {
+            ret = -EFAULT;
+        }
+    } else {
+        ret = -EOPNOTSUPP;
+    }
+    return ret;
+
+}
+
+#ifdef P2P
+int ar6000_xioctl_wmi_p2p_peer(AR_SOFTC_DEV_T *arPriv, char *userdata, struct ifreq *rq)
+{
+    A_UINT8 buf[12];
+    const A_UINT8 zero_mac[] = {0,0,0,0,0,0};
+
+    A_UINT8 peer_info_buf[900];
+    A_UINT32 peer_info_buf_used;
+
+    int first_element;
+    int ret = 0;
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(buf, userdata, 12)) {
+        ret = -EFAULT;
+    } else {
+        /*
+         * Check the "next" value set in driver_ar6003.c of the supplicant.
+         * This determines whether we have a "P2P_PEER FIRST" (if = 1) or
+         * "P2P_PEER NEXT-<addr>" (if = 2) command, or just a plain p2p_peer <addr>
+         * command (if = 0)
+         */
+         if (buf[6] != 0) {
+             if (buf[6] == 1) {
+                 first_element = 1;
+             } else {
+                 first_element = 0;
+             }
+             peer_info_buf_used = p2p_get_next_addr(A_WMI_GET_P2P_CTX(arPriv),
+                                                    buf, peer_info_buf,
+                                                    sizeof(peer_info_buf),
+                                                    first_element);
+             if (peer_info_buf_used == 0) {
+                 ret = -ENODEV;
+             }
+             *((A_UINT32 *)rq->ifr_data) = peer_info_buf_used;
+             if(copy_to_user(((A_UINT32 *)(rq->ifr_data)+1),
+                             peer_info_buf, peer_info_buf_used)) {
+                 ret = -EFAULT;
+             }
+         } else {
+             if (p2p_peer(A_WMI_GET_P2P_CTX(arPriv),
+                          buf, *(buf+6)) == A_OK) {
+                 peer_info_buf_used = p2p_get_peer_info(                                                                       A_WMI_GET_P2P_CTX(arPriv), buf,
+                                               peer_info_buf,
+                                               sizeof(peer_info_buf));
+                 *((A_UINT32 *)rq->ifr_data) = peer_info_buf_used;
+                 if(copy_to_user(((A_UINT32 *)(rq->ifr_data)+1),
+                     peer_info_buf, peer_info_buf_used)) {
+                     ret = -EFAULT;
+                 }
+             } else {
+                 if(copy_to_user((A_UINT16 *)rq->ifr_data,
+                                 zero_mac, IEEE80211_ADDR_LEN)) {
+                     ret = -EFAULT;
+                 }
+             }
+         }
+    }
+
+    return ret;
+}
+
+int ar6000_xioctl_wmi_p2p_provdisc(AR_SOFTC_DEV_T *arPriv, char *userdata)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    A_UINT8 peer[IEEE80211_ADDR_LEN];
+    A_UINT16 wps_method;
+    A_UINT8 buf[8];
+    int ret = 0;
+
+    A_MEMZERO(peer, IEEE80211_ADDR_LEN);
+
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(buf, userdata, 8)) {
+        ret = -EFAULT;
+    } else { 
+        A_MEMCPY(peer, buf, IEEE80211_ADDR_LEN);
+        wps_method = (*(A_UINT16 *)(&buf[6]));
+
+        if (p2p_prov_disc_req(A_WMI_GET_P2P_CTX(arPriv),
+                              peer, wps_method) != A_OK) {
+            ret = -EFAULT;
+        }
+    }
+    return ret;
+}
+
+int ar6000_xioctl_wmi_p2p_set(AR_SOFTC_DEV_T *arPriv, char *userdata)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    int ret = 0;
+    WMI_P2P_SET_CMD set_p2p_config;
+    A_MEMZERO(&set_p2p_config, sizeof(WMI_P2P_SET_CMD));
+
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(&set_p2p_config, userdata,
+                              sizeof(WMI_P2P_SET_CMD))) {
+        ret = -EFAULT;
+    } else {
+        if (set_p2p_config.config_id == WMI_P2P_CONFID_CROSS_CONNECT) {
+            p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv),
+                                     P2P_GROUP_CAPAB_CROSS_CONN,
+                                     set_p2p_config.val.cross_conn.flag);
+        } else if(set_p2p_config.config_id == WMI_P2P_CONFID_CONCURRENT_MODE) {
+            p2p_set_device_capability(A_WMI_GET_P2P_CTX(arPriv),
+                                      P2P_DEV_CAPAB_CONCURRENT_OPER,
+                                      set_p2p_config.val.concurrent_mode.flag);
+        }
+
+        wmi_p2p_set_cmd(arPriv->arWmi, &set_p2p_config);
+    }
+    return ret;
+
+}
+
+int ar6000_xioctl_wmi_p2p_sdpdtx(AR_SOFTC_DEV_T *arPriv, char *userdata, struct ifreq *rq)
+{
+    AR_SOFTC_T *ar = arPriv->arSoftc;
+    WMI_P2P_SDPD_TX_CMD *psdpd_tx_cmd;
+    A_UINT32 qid = 0;
+    int ret = 0;
+    psdpd_tx_cmd = (WMI_P2P_SDPD_TX_CMD *) A_MALLOC(sizeof(WMI_P2P_SDPD_TX_CMD));
+    if (psdpd_tx_cmd == NULL) {
+        return -ENOMEM;
+    }
+    A_MEMZERO(psdpd_tx_cmd, sizeof(WMI_P2P_SDPD_TX_CMD));
+
+    if (ar->arWmiReady == FALSE) {
+        ret = -EIO;
+    } else if (copy_from_user(psdpd_tx_cmd, userdata,
+                              sizeof(WMI_P2P_SDPD_TX_CMD))) {
+        ret = -EFAULT;
+    } else {
+        if (p2p_sdpd_tx_cmd(A_WMI_GET_P2P_CTX(arPriv),
+                            psdpd_tx_cmd, &qid) !=
+                            A_OK) {
+            ret = -EFAULT;
+        } else {
+            if(copy_to_user((A_UINT8 *)rq->ifr_data,
+                            (void *)&qid, sizeof(A_UINT32))) {
+                ret = -EFAULT;
+            }
+        }
+    }
+    A_FREE(psdpd_tx_cmd);
+    return ret;
+}
+
+#endif /* P2P */
+
+int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar         =  arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta      = &arPriv->arSta;
+    AR_SOFTC_AP_T  *arAp       = &arPriv->arAp;  
+    HIF_DEVICE *hifDevice = ar->arHifDevice;
+    int ret = 0, param;
+    unsigned int address = 0;
+    unsigned int length = 0;
+    unsigned char *buffer;
+    char *userdata;
+
+    /*
+     * ioctl operations may have to wait for the Target, so we cannot hold rtnl.
+     * Prevent the device from disappearing under us and release the lock during
+     * the ioctl operation.
+     */
+    dev_hold(dev);
+    rtnl_unlock();
+
+    if (cmd == AR6000_IOCTL_EXTENDED) {
+        /*
+         * This allows for many more wireless ioctls than would otherwise
+         * be available.  Applications embed the actual ioctl command in
+         * the first word of the parameter block, and use the command
+         * AR6000_IOCTL_EXTENDED_CMD on the ioctl call.
+         */
+        get_user(cmd, (int *)rq->ifr_data);
+        userdata = (char *)(((unsigned int *)rq->ifr_data)+1);
+        if(is_xioctl_allowed(arPriv->arNextMode,
+                    arPriv->arNetworkSubType, cmd) != A_OK) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("xioctl: cmd=%d not allowed in this mode\n",cmd));
+            ret = -EOPNOTSUPP;
+            goto ioctl_done;
+        }
+    } else {
+        A_STATUS ret = is_iwioctl_allowed(arPriv->arNextMode, cmd);
+        if(ret == A_ENOTSUP) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("iwioctl: cmd=0x%x not allowed in this mode\n", cmd));
+            ret = -EOPNOTSUPP;
+            goto ioctl_done;
+        } else if (ret == A_ERROR) {
+            /* It is not our ioctl (out of range ioctl) */
+            ret = -EOPNOTSUPP;
+            goto ioctl_done;
+        }
+        userdata = (char *)rq->ifr_data;
+    }
+
+    if ((ar->arWlanState == WLAN_DISABLED) &&
+        ((cmd != AR6000_XIOCTRL_WMI_SET_WLAN_STATE) &&
+         (cmd != AR6000_XIOCTL_GET_WLAN_SLEEP_STATE) &&
+         (cmd != AR6000_XIOCTL_DIAG_READ) &&
+         (cmd != AR6000_XIOCTL_DIAG_WRITE) &&
+         (cmd != AR6000_XIOCTL_SET_BT_HW_POWER_STATE) &&
+         (cmd != AR6000_XIOCTL_GET_BT_HW_POWER_STATE) &&
+         (cmd != AR6000_IOCTL_WMI_GETREV) &&
+         (cmd != AR6000_XIOCTL_RESUME_DRIVER)))
+    {
+        ret = -EIO;
+        goto ioctl_done;
+    }
+
+
+    ret = 0;
+    switch(cmd)
+    {
+        case IEEE80211_IOCTL_SETPARAM:
+        {
+            int param, value;
+            int *ptr = (int *)rq->ifr_ifru.ifru_newname;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else {
+                param = *ptr++;
+                value = *ptr;
+                ret = ar6000_ioctl_setparam(arPriv,param,value);
+            }
+            break;
+        }
+        case IEEE80211_IOCTL_SETKEY:
+        {
+            struct ieee80211req_key keydata;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&keydata, userdata,
+                            sizeof(struct ieee80211req_key))) {
+                ret = -EFAULT;
+            } else {
+                ar6000_ioctl_setkey(arPriv, &keydata);
+            }
+            break;
+        }
+        case IEEE80211_IOCTL_DELKEY:
+        case IEEE80211_IOCTL_SETOPTIE:
+        {
+            //ret = -EIO;
+            break;
+        }
+        case IEEE80211_IOCTL_SETMLME:
+        {
+            struct ieee80211req_mlme mlme;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&mlme, userdata,
+                            sizeof(struct ieee80211req_mlme))) {
+                ret = -EFAULT;
+            } else {
+                switch (mlme.im_op) {
+                    case IEEE80211_MLME_AUTHORIZE:
+                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("setmlme AUTHORIZE %02X:%02X\n",
+                            mlme.im_macaddr[4], mlme.im_macaddr[5]));
+                        break;
+                    case IEEE80211_MLME_UNAUTHORIZE:
+                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("setmlme UNAUTHORIZE %02X:%02X\n",
+                            mlme.im_macaddr[4], mlme.im_macaddr[5]));
+                        break;
+                    case IEEE80211_MLME_DEAUTH:
+                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("setmlme DEAUTH %02X:%02X\n",
+                            mlme.im_macaddr[4], mlme.im_macaddr[5]));
+                        //remove_sta(ar, mlme.im_macaddr);
+                        break;
+                    case IEEE80211_MLME_DISASSOC:
+                        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("setmlme DISASSOC %02X:%02X\n",
+                            mlme.im_macaddr[4], mlme.im_macaddr[5]));
+                        //remove_sta(ar, mlme.im_macaddr);
+                        break;
+                    default:
+                        ret = 0;
+                        goto ioctl_done;
+                }
+
+                wmi_ap_set_mlme(arPriv->arWmi, mlme.im_op, mlme.im_macaddr,
+                                mlme.im_reason);
+            }
+            break;
+        }
+        case IEEE80211_IOCTL_ADDPMKID:
+        {
+            struct ieee80211req_addpmkid  req;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&req, userdata, sizeof(struct ieee80211req_addpmkid))) {
+                ret = -EFAULT;
+            } else {
+                A_STATUS status;
+
+                AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("Add pmkid for %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x en=%d\n",
+                    req.pi_bssid[0], req.pi_bssid[1], req.pi_bssid[2],
+                    req.pi_bssid[3], req.pi_bssid[4], req.pi_bssid[5],
+                    req.pi_enable));
+
+                status = wmi_setPmkid_cmd(arPriv->arWmi, req.pi_bssid, req.pi_pmkid,
+                              req.pi_enable);
+
+                if (status != A_OK) {
+                    ret = -EIO;
+                    goto ioctl_done;
+                }
+            }
+            break;
+        }
+#ifdef CONFIG_HOST_TCMD_SUPPORT
+        case AR6000_XIOCTL_TCMD_CONT_TX:
+            {
+                TCMD_CONT_TX txCmd;
+
+                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
+                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Can NOT send tx tcmd when target is asleep! \n"));
+                    ret = -EOPNOTSUPP;
+                    goto ioctl_done;
+                }
+
+                if(copy_from_user(&txCmd, userdata, sizeof(TCMD_CONT_TX))) {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                } else {
+                    wmi_test_cmd(arPriv->arWmi,(A_UINT8 *)&txCmd, sizeof(TCMD_CONT_TX));
+                }
+            }
+            break;
+        case AR6000_XIOCTL_TCMD_CONT_RX:
+            {
+                TCMD_CONT_RX rxCmd;
+
+                if ((ar->tcmdPm == TCMD_PM_SLEEP) ||
+                    (ar->tcmdPm == TCMD_PM_DEEPSLEEP))
+                {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Can NOT send rx tcmd when target is asleep! \n"));
+                    ret = -EOPNOTSUPP;
+                    goto ioctl_done;
+                }
+                if(copy_from_user(&rxCmd, userdata, sizeof(TCMD_CONT_RX))) {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                }
+
+                switch(rxCmd.act)
+                {
+                    case TCMD_CONT_RX_PROMIS:
+                    case TCMD_CONT_RX_FILTER:
+                    case TCMD_CONT_RX_SETMAC:
+                    case TCMD_CONT_RX_SET_ANT_SWITCH_TABLE:
+                         wmi_test_cmd(arPriv->arWmi,(A_UINT8 *)&rxCmd,
+                                                sizeof(TCMD_CONT_RX));
+                         tcmdRxFreq = rxCmd.u.para.freq;
+                         break;
+                    case TCMD_CONT_RX_REPORT:
+                         ar6000_ioctl_tcmd_get_rx_report(dev, rq,
+                         (A_UINT8 *)&rxCmd, sizeof(TCMD_CONT_RX));
+                         break;
+                    default:
+                         AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("Unknown Cont Rx mode: %d\n",rxCmd.act));
+                         ret = -EINVAL;
+                         goto ioctl_done;
+                }
+            }
+            break;
+        case AR6000_XIOCTL_TCMD_PM:
+            {
+                TCMD_PM pmCmd;
+
+                if(copy_from_user(&pmCmd, userdata, sizeof(TCMD_PM))) {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                }
+                ar->tcmdPm = pmCmd.mode;
+                wmi_test_cmd(arPriv->arWmi, (A_UINT8*)&pmCmd, sizeof(TCMD_PM));
+            }
+            break;
+          
+        case AR6000_XIOCTL_TCMD_CMDS:
+            {
+                TC_CMDS cmdsCmd;
+                if(copy_from_user(&cmdsCmd, userdata, sizeof(TC_CMDS))) {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                }
+                ar6000_ioctl_tcmd_cmd_resp(dev, rq, (A_UINT8 *)&cmdsCmd, sizeof(TC_CMDS));
+#if 0
+                wmi_test_cmd(arPriv->arWmi, (A_UINT8*)&cmdsCmd, sizeof(TC_CMDS));
+#endif
+            }
+            break;
+
+        case AR6000_XIOCTL_TCMD_SETREG:
+            {
+                TCMD_SET_REG setRegCmd;
+
+                if(copy_from_user(&setRegCmd, userdata, sizeof(TCMD_SET_REG))) {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                }
+                wmi_test_cmd(arPriv->arWmi, (A_UINT8*)&setRegCmd, sizeof(TCMD_SET_REG));
+            }
+            break;             
+#endif /* CONFIG_HOST_TCMD_SUPPORT */
+
+        case AR6000_XIOCTL_BMI_DONE:
+            if(bmienable)
+            {
+                rtnl_lock(); /* ar6000_init expects to be called holding rtnl lock */
+                ret = ar6000_init(dev);
+                rtnl_unlock();
+            }
+            else
+            {
+                ret = BMIDone(hifDevice);
+            }
+            break;
+
+        case AR6000_XIOCTL_BMI_READ_MEMORY:
+            get_user(address, (unsigned int *)userdata);
+            get_user(length, (unsigned int *)userdata + 1);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Read Memory (address: 0x%x, length: %d)\n",
+                             address, length));
+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
+                A_MEMZERO(buffer, length);
+                ret = BMIReadMemory(hifDevice, address, buffer, length);
+                if (copy_to_user(rq->ifr_data, buffer, length)) {
+                    ret = -EFAULT;
+                }
+                A_FREE(buffer);
+            } else {
+                ret = -ENOMEM;
+            }
+            break;
+
+        case AR6000_XIOCTL_BMI_WRITE_MEMORY:
+            get_user(address, (unsigned int *)userdata);
+            get_user(length, (unsigned int *)userdata + 1);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Write Memory (address: 0x%x, length: %d)\n",
+                             address, length));
+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
+                A_MEMZERO(buffer, length);
+                if (copy_from_user(buffer, &userdata[sizeof(address) +
+                                   sizeof(length)], length))
+                {
+                    ret = -EFAULT;
+                } else {
+                    ret = BMIWriteMemory(hifDevice, address, buffer, length);
+                }
+                A_FREE(buffer);
+            } else {
+                ret = -ENOMEM;
+            }
+            break;
+
+        case AR6000_XIOCTL_BMI_TEST:
+           AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("No longer supported\n"));
+           ret = -EOPNOTSUPP;
+           break;
+
+        case AR6000_XIOCTL_BMI_EXECUTE:
+            get_user(address, (unsigned int *)userdata);
+            get_user(param, (unsigned int *)userdata + 1);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Execute (address: 0x%x, param: %d)\n",
+                             address, param));
+            ret = BMIExecute(hifDevice, address, (A_UINT32*)&param);
+            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
+            break;
+
+        case AR6000_XIOCTL_BMI_SET_APP_START:
+            get_user(address, (unsigned int *)userdata);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Set App Start (address: 0x%x)\n", address));
+            ret = BMISetAppStart(hifDevice, address);
+            break;
+
+        case AR6000_XIOCTL_BMI_READ_SOC_REGISTER:
+            get_user(address, (unsigned int *)userdata);
+            ret = BMIReadSOCRegister(hifDevice, address, (A_UINT32*)&param);
+            put_user(param, (unsigned int *)rq->ifr_data); /* return value */
+            break;
+
+        case AR6000_XIOCTL_BMI_WRITE_SOC_REGISTER:
+            get_user(address, (unsigned int *)userdata);
+            get_user(param, (unsigned int *)userdata + 1);
+            ret = BMIWriteSOCRegister(hifDevice, address, param);
+            break;
+
+#ifdef HTC_RAW_INTERFACE
+        case AR6000_XIOCTL_HTC_RAW_OPEN:
+            ret = A_OK;
+            if (!arRawIfEnabled(ar)) {
+                /* make sure block size is set in case the target was reset since last
+                  * BMI phase (i.e. flashup downloads) */
+                ret = ar6000_set_htc_params(ar->arHifDevice,
+                                            ar->arTargetType,
+                                            0,  /* use default yield */
+                                            0   /* use default number of HTC ctrl buffers */
+                                            );
+                if (A_FAILED(ret)) {
+                    break;
+                }
+                /* Terminate the BMI phase */
+                ret = BMIDone(hifDevice);
+                if (ret == A_OK) {
+                    ret = ar6000_htc_raw_open(ar);
+                }
+            }
+            break;
+
+        case AR6000_XIOCTL_HTC_RAW_CLOSE:
+            if (arRawIfEnabled(ar)) {
+                ret = ar6000_htc_raw_close(ar);
+                arRawIfEnabled(ar) = FALSE;
+            } else {
+                ret = A_ERROR;
+            }
+            break;
+
+        case AR6000_XIOCTL_HTC_RAW_READ:
+            if (arRawIfEnabled(ar)) {
+                unsigned int streamID;
+                get_user(streamID, (unsigned int *)userdata);
+                get_user(length, (unsigned int *)userdata + 1);
+                buffer = (unsigned char*)rq->ifr_data + sizeof(length);
+                ret = ar6000_htc_raw_read(ar, (HTC_RAW_STREAM_ID)streamID,
+                                          (char*)buffer, length);
+                put_user(ret, (unsigned int *)rq->ifr_data);
+            } else {
+                ret = A_ERROR;
+            }
+            break;
+
+        case AR6000_XIOCTL_HTC_RAW_WRITE:
+            if (arRawIfEnabled(ar)) {
+                unsigned int streamID;
+                get_user(streamID, (unsigned int *)userdata);
+                get_user(length, (unsigned int *)userdata + 1);
+                buffer = (unsigned char*)userdata + sizeof(streamID) + sizeof(length);
+                ret = ar6000_htc_raw_write(ar, (HTC_RAW_STREAM_ID)streamID,
+                                           (char*)buffer, length);
+                put_user(ret, (unsigned int *)rq->ifr_data);
+            } else {
+                ret = A_ERROR;
+            }
+            break;
+#endif /* HTC_RAW_INTERFACE */
+
+        case AR6000_XIOCTL_BMI_LZ_STREAM_START:
+            get_user(address, (unsigned int *)userdata);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Start Compressed Stream (address: 0x%x)\n", address));
+            ret = BMILZStreamStart(hifDevice, address);
+            break;
+
+        case AR6000_XIOCTL_BMI_LZ_DATA:
+            get_user(length, (unsigned int *)userdata);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Send Compressed Data (length: %d)\n", length));
+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
+                A_MEMZERO(buffer, length);
+                if (copy_from_user(buffer, &userdata[sizeof(length)], length))
+                {
+                    ret = -EFAULT;
+                } else {
+                    ret = BMILZData(hifDevice, buffer, length);
+                }
+                A_FREE(buffer);
+            } else {
+                ret = -ENOMEM;
+            }
+            break;
+
+#if defined(CONFIG_TARGET_PROFILE_SUPPORT)
+        /*
+         * Optional support for Target-side profiling.
+         * Not needed in production.
+         */
+
+        /* Configure Target-side profiling */
+        case AR6000_XIOCTL_PROF_CFG:
+        {
+            A_UINT32 period;
+            A_UINT32 nbins;
+            get_user(period, (unsigned int *)userdata);
+            get_user(nbins, (unsigned int *)userdata + 1);
+
+            if (wmi_prof_cfg_cmd(arPriv->arWmi, period, nbins) != A_OK) {
+                ret = -EIO;
+            }
+
+            break;
+        }
+
+        /* Start a profiling bucket/bin at the specified address */
+        case AR6000_XIOCTL_PROF_ADDR_SET:
+        {
+            A_UINT32 addr;
+            get_user(addr, (unsigned int *)userdata);
+
+            if (wmi_prof_addr_set_cmd(arPriv->arWmi, addr) != A_OK) {
+                ret = -EIO;
+            }
+
+            break;
+        }
+
+        /* START Target-side profiling */
+        case AR6000_XIOCTL_PROF_START:
+            wmi_prof_start_cmd(arPriv->arWmi);
+            break;
+
+        /* STOP Target-side profiling */
+        case AR6000_XIOCTL_PROF_STOP:
+            wmi_prof_stop_cmd(arPriv->arWmi);
+            break;
+        case AR6000_XIOCTL_PROF_COUNT_GET:
+        {
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            prof_count_available = FALSE;
+            ret = prof_count_get(dev);
+            if (ret != A_OK) {
+                up(&ar->arSem);
+                ret = -EIO;
+                goto ioctl_done;
+            }
+
+            /* Wait for Target to respond. */
+            wait_event_interruptible(arPriv->arEvent, prof_count_available);
+            if (signal_pending(current)) {
+                ret = -EINTR;
+            } else {
+                if (copy_to_user(userdata, &prof_count_results,
+                                 sizeof(prof_count_results)))
+                {
+                    ret = -EFAULT;
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+#endif /* CONFIG_TARGET_PROFILE_SUPPORT */
+
+        case AR6000_IOCTL_WMI_GETREV:
+        {
+            if (copy_to_user(rq->ifr_data, &ar->arVersion,
+                             sizeof(ar->arVersion)))
+            {
+                ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SETPWR:
+        {
+            WMI_POWER_MODE_CMD pwrModeCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&pwrModeCmd, userdata,
+                                   sizeof(pwrModeCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_powermode_cmd(arPriv->arWmi, pwrModeCmd.powerMode)
+                       != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_IBSS_PM_CAPS:
+        {
+            WMI_IBSS_PM_CAPS_CMD ibssPmCaps;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&ibssPmCaps, userdata,
+                                   sizeof(ibssPmCaps)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_ibsspmcaps_cmd(arPriv->arWmi, ibssPmCaps.power_saving, ibssPmCaps.ttl,
+                    ibssPmCaps.atim_windows, ibssPmCaps.timeout_value) != A_OK)
+                {
+                    ret = -EIO;
+                }
+                AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                arPriv->arSta.arIbssPsEnable = ibssPmCaps.power_saving;
+                AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_AP_PS:
+        {
+            WMI_AP_PS_CMD apPsCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&apPsCmd, userdata,
+                                   sizeof(apPsCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_apps_cmd(arPriv->arWmi, apPsCmd.psType, apPsCmd.idle_time,
+                    apPsCmd.ps_period, apPsCmd.sleep_period) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_PMPARAMS:
+        {
+            WMI_POWER_PARAMS_CMD pmParams;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&pmParams, userdata,
+                                      sizeof(pmParams)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_pmparams_cmd(arPriv->arWmi, pmParams.idle_period,
+                                     pmParams.pspoll_number,
+                                     pmParams.dtim_policy,
+                                     pmParams.tx_wakeup_policy,
+                                     pmParams.num_tx_to_wakeup,
+#if WLAN_CONFIG_IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN
+                                     IGNORE_POWER_SAVE_FAIL_EVENT_DURING_SCAN 
+#else
+                                     SEND_POWER_SAVE_FAIL_EVENT_ALWAYS
+#endif
+                                     ) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SETSCAN:
+        {
+           if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&arSta->scParams, userdata,
+                                      sizeof(arSta->scParams)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (CAN_SCAN_IN_CONNECT(arSta->scParams.scanCtrlFlags)) {
+                    arSta->arSkipScan = FALSE;
+                } else {
+                    arSta->arSkipScan = TRUE;
+                }
+
+                if (wmi_scanparams_cmd(arPriv->arWmi, arSta->scParams.fg_start_period,
+                                       arSta->scParams.fg_end_period,
+                                       arSta->scParams.bg_period,
+                                       arSta->scParams.minact_chdwell_time,
+                                       arSta->scParams.maxact_chdwell_time,
+                                       arSta->scParams.pas_chdwell_time,
+                                       arSta->scParams.shortScanRatio,
+                                       arSta->scParams.scanCtrlFlags,
+                                       arSta->scParams.max_dfsch_act_time,
+                                       arSta->scParams.maxact_scan_per_ssid) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SETLISTENINT:
+        {
+            WMI_LISTEN_INT_CMD listenCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&listenCmd, userdata,
+                                      sizeof(listenCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                    if (wmi_listeninterval_cmd(arPriv->arWmi, listenCmd.listenInterval, listenCmd.numBeacons) != A_OK) {
+                        ret = -EIO;
+                    } else {
+                        AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                        arSta->arListenIntervalT = listenCmd.listenInterval;
+                        arSta->arListenIntervalB = listenCmd.numBeacons;
+                        AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+                    }
+
+                }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_BMISS_TIME:
+        {
+            WMI_BMISS_TIME_CMD bmissCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&bmissCmd, userdata,
+                                      sizeof(bmissCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_bmisstime_cmd(arPriv->arWmi, bmissCmd.bmissTime, bmissCmd.numBeacons) != A_OK) {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SETBSSFILTER:
+        {
+            WMI_BSS_FILTER_CMD filt;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&filt, userdata,
+                                   sizeof(filt)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_bssfilter_cmd(arPriv->arWmi, filt.bssFilter, filt.ieMask)
+                        != A_OK) {
+                    ret = -EIO;
+                } else {
+                    arSta->arUserBssFilter = filt.bssFilter;
+                }
+            }
+            break;
+        }
+
+        case AR6000_IOCTL_WMI_SET_SNRTHRESHOLD:
+        {
+            ret = ar6000_ioctl_set_snr_threshold(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_RSSITHRESHOLD:
+        {
+            ret = ar6000_ioctl_set_rssi_threshold(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_CLR_RSSISNR:
+        {
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            }
+            ret = wmi_clr_rssi_snr(arPriv->arWmi);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_LQTHRESHOLD:
+        {
+            ret = ar6000_ioctl_set_lq_threshold(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_LPREAMBLE:
+        {
+            WMI_SET_LPREAMBLE_CMD setLpreambleCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setLpreambleCmd, userdata,
+                                   sizeof(setLpreambleCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_lpreamble_cmd(arPriv->arWmi, setLpreambleCmd.status,
+#if WLAN_CONFIG_DONOT_IGNORE_BARKER_IN_ERP 
+                           WMI_DONOT_IGNORE_BARKER_IN_ERP
+#else
+                           WMI_IGNORE_BARKER_IN_ERP
+#endif
+                ) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_RTS:
+        {
+            WMI_SET_RTS_CMD rtsCmd;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&rtsCmd, userdata,
+                                   sizeof(rtsCmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if(arPriv->arNetworkType == AP_NETWORK) {
+                    arAp->arRTS = rtsCmd.threshold;
+                }
+                if (wmi_set_rts_cmd(arPriv->arWmi, rtsCmd.threshold)
+                       != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_WMM:
+        {
+            ret = ar6000_ioctl_get_wmm(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_WMM:
+        {
+            ret = ar6000_ioctl_set_wmm(dev, rq);
+            break;
+        }
+       case AR6000_XIOCTL_WMI_SET_QOS_SUPP:
+        {
+            ret = ar6000_ioctl_set_qos_supp(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_TXOP:
+        {
+            ret = ar6000_ioctl_set_txop(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_RD:
+        {
+            ret = ar6000_ioctl_get_rd(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_CHANNELPARAMS:
+        {
+            ret = ar6000_ioctl_set_channelParams(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_PROBEDSSID:
+        {
+            ret = ar6000_ioctl_set_probedSsid(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_BADAP:
+        {
+            ret = ar6000_ioctl_set_badAp(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_CREATE_QOS:
+        {
+            ret = ar6000_ioctl_create_qos(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_DELETE_QOS:
+        {
+            ret = ar6000_ioctl_delete_qos(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_GET_QOS_QUEUE:
+        {
+            ret = ar6000_ioctl_get_qos_queue(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_GET_TARGET_STATS:
+        {
+            ret = ar6000_ioctl_get_target_stats(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_ERROR_REPORT_BITMASK:
+        {
+            ret = ar6000_ioctl_set_error_report_bitmask(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_ASSOC_INFO:
+        {
+            WMI_SET_ASSOC_INFO_CMD cmd;
+            A_UINT8 assocInfo[WMI_MAX_ASSOC_INFO_LEN];
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else {
+                get_user(cmd.ieType, userdata);
+                if (cmd.ieType >= WMI_MAX_ASSOC_INFO_TYPE) {
+                    ret = -EIO;
+                } else {
+                    get_user(cmd.bufferSize, userdata + 1);
+                    if (cmd.bufferSize > WMI_MAX_ASSOC_INFO_LEN) {
+                        ret = -EFAULT;
+                        break;
+                    }
+                    if (copy_from_user(assocInfo, userdata + 2,
+                                       cmd.bufferSize))
+                    {
+                        ret = -EFAULT;
+                    } else {
+                        if (wmi_associnfo_cmd(arPriv->arWmi, cmd.ieType,
+                                                 cmd.bufferSize,
+                                                 assocInfo) != A_OK)
+                        {
+                            ret = -EIO;
+                        }
+                    }
+                }
+            }
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_ACCESS_PARAMS:
+        {
+            ret = ar6000_ioctl_set_access_params(dev, rq);
+            break;
+        }
+        case AR6000_IOCTL_WMI_SET_DISC_TIMEOUT:
+        {
+            ret = ar6000_ioctl_set_disconnect_timeout(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_FORCE_TARGET_RESET:
+        {
+            if (ar->arHtcTarget)
+            {
+//                HTCForceReset(htcTarget);
+            }
+            else
+            {
+                AR_DEBUG_PRINTF(ATH_DEBUG_WARN,("ar6000_ioctl cannot attempt reset.\n"));
+            }
+            break;
+        }
+        case AR6000_XIOCTL_TARGET_INFO:
+        case AR6000_XIOCTL_CHECK_TARGET_READY: /* backwards compatibility */
+        {
+            /* If we made it to here, then the Target exists and is ready. */
+
+            if (cmd == AR6000_XIOCTL_TARGET_INFO) {
+                if (copy_to_user((A_UINT32 *)rq->ifr_data, &ar->arVersion.target_ver,
+                                 sizeof(ar->arVersion.target_ver)))
+                {
+                    ret = -EFAULT;
+                }
+                if (copy_to_user(((A_UINT32 *)rq->ifr_data)+1, &ar->arTargetType,
+                                 sizeof(ar->arTargetType)))
+                {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_HB_CHALLENGE_RESP_PARAMS:
+        {
+            WMI_SET_HB_CHALLENGE_RESP_PARAMS_CMD hbparam;
+
+            if (copy_from_user(&hbparam, userdata, sizeof(hbparam)))
+            {
+                ret = -EFAULT;
+            } else {
+                AR6000_SPIN_LOCK(&ar->arLock, 0);
+                /* Start a cyclic timer with the parameters provided. */
+                if (hbparam.frequency) {
+                    ar->arHBChallengeResp.frequency = hbparam.frequency;
+                }
+                if (hbparam.threshold) {
+                    ar->arHBChallengeResp.missThres = hbparam.threshold;
+                }
+
+                /* Delete the pending timer and start a new one */
+                if (timer_pending(&ar->arHBChallengeResp.timer)) {
+                    A_UNTIMEOUT(&ar->arHBChallengeResp.timer);
+                }
+                A_TIMEOUT_MS(&ar->arHBChallengeResp.timer, ar->arHBChallengeResp.frequency * 1000, 0);
+                AR6000_SPIN_UNLOCK(&ar->arLock, 0);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_HB_CHALLENGE_RESP:
+        {
+            A_UINT32 cookie;
+
+            if (copy_from_user(&cookie, userdata, sizeof(cookie))) {
+                ret = -EFAULT;
+                goto ioctl_done;
+            }
+
+            /* Send the challenge on the control channel */
+            if (wmi_get_challenge_resp_cmd(arPriv->arWmi, cookie, APP_HB_CHALLENGE) != A_OK) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            break;
+        }
+#ifdef USER_KEYS
+        case AR6000_XIOCTL_USER_SETKEYS:
+        {
+
+            arSta->user_savedkeys_stat = USER_SAVEDKEYS_STAT_RUN;
+
+            if (copy_from_user(&arSta->user_key_ctrl, userdata,
+                               sizeof(arSta->user_key_ctrl)))
+            {
+                ret = -EFAULT;
+                goto ioctl_done;
+            }
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("ar6000 USER set key %x\n", arSta->user_key_ctrl));
+            break;
+        }
+#endif /* USER_KEYS */
+
+#ifdef CONFIG_HOST_GPIO_SUPPORT
+        case AR6000_XIOCTL_GPIO_OUTPUT_SET:
+        {
+            struct ar6000_gpio_output_set_cmd_s gpio_output_set_cmd;
+
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            if (copy_from_user(&gpio_output_set_cmd, userdata,
+                                sizeof(gpio_output_set_cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                ret = ar6000_gpio_output_set(dev,
+                                             gpio_output_set_cmd.set_mask,
+                                             gpio_output_set_cmd.clear_mask,
+                                             gpio_output_set_cmd.enable_mask,
+                                             gpio_output_set_cmd.disable_mask);
+                if (ret != A_OK) {
+                    ret = EIO;
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_GPIO_INPUT_GET:
+        {
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            ret = ar6000_gpio_input_get(dev);
+            if (ret != A_OK) {
+                up(&ar->arSem);
+                ret = -EIO;
+                goto ioctl_done;
+            }
+
+            /* Wait for Target to respond. */
+            wait_event_interruptible(arPriv->arEvent, gpio_data_available);
+            if (signal_pending(current)) {
+                ret = -EINTR;
+            } else {
+                A_ASSERT(gpio_reg_results.gpioreg_id == GPIO_ID_NONE);
+
+                if (copy_to_user(userdata, &gpio_reg_results.value,
+                                 sizeof(gpio_reg_results.value)))
+                {
+                    ret = -EFAULT;
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_GPIO_REGISTER_SET:
+        {
+            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
+
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            if (copy_from_user(&gpio_register_cmd, userdata,
+                                sizeof(gpio_register_cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                ret = ar6000_gpio_register_set(dev,
+                                               gpio_register_cmd.gpioreg_id,
+                                               gpio_register_cmd.value);
+                if (ret != A_OK) {
+                    ret = EIO;
+                }
+
+                /* Wait for acknowledgement from Target */
+                wait_event_interruptible(arPriv->arEvent, gpio_ack_received);
+                if (signal_pending(current)) {
+                    ret = -EINTR;
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_GPIO_REGISTER_GET:
+        {
+            struct ar6000_gpio_register_cmd_s gpio_register_cmd;
+
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            if (copy_from_user(&gpio_register_cmd, userdata,
+                                sizeof(gpio_register_cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                ret = ar6000_gpio_register_get(dev, gpio_register_cmd.gpioreg_id);
+                if (ret != A_OK) {
+                    up(&ar->arSem);
+                    ret = -EIO;
+                    goto ioctl_done;
+                }
+
+                /* Wait for Target to respond. */
+                wait_event_interruptible(arPriv->arEvent, gpio_data_available);
+                if (signal_pending(current)) {
+                    ret = -EINTR;
+                } else {
+                    A_ASSERT(gpio_register_cmd.gpioreg_id == gpio_reg_results.gpioreg_id);
+                    if (copy_to_user(userdata, &gpio_reg_results,
+                                     sizeof(gpio_reg_results)))
+                    {
+                        ret = -EFAULT;
+                    }
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_GPIO_INTR_ACK:
+        {
+            struct ar6000_gpio_intr_ack_cmd_s gpio_intr_ack_cmd;
+
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+
+            if (copy_from_user(&gpio_intr_ack_cmd, userdata,
+                                sizeof(gpio_intr_ack_cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                ret = ar6000_gpio_intr_ack(dev, gpio_intr_ack_cmd.ack_mask);
+                if (ret != A_OK) {
+                    ret = EIO;
+                }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_GPIO_INTR_WAIT:
+        {
+            /* Wait for Target to report an interrupt. */
+            wait_event_interruptible(arPriv->arEvent, gpio_intr_available);
+
+            if (signal_pending(current)) {
+                ret = -EINTR;
+            } else {
+                if (copy_to_user(userdata, &gpio_intr_results,
+                                 sizeof(gpio_intr_results)))
+                {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+#endif /* CONFIG_HOST_GPIO_SUPPORT */
+
+        case AR6000_XIOCTL_DBGLOG_CFG_MODULE:
+        {
+            struct ar6000_dbglog_module_config_s config;
+
+            if (copy_from_user(&config, userdata, sizeof(config))) {
+                ret = -EFAULT;
+                goto ioctl_done;
+            }
+
+            /* Send the challenge on the control channel */
+            if (wmi_config_debug_module_cmd(arPriv->arWmi, config.mmask,
+                                            config.tsr, config.rep,
+                                            config.size, config.valid) != A_OK)
+            {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_DBGLOG_GET_DEBUG_LOGS:
+        {
+            /* Send the challenge on the control channel */
+            if (ar6000_dbglog_get_debug_logs(ar) != A_OK)
+            {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_SET_ADHOC_BSSID:
+        {
+            WMI_SET_ADHOC_BSSID_CMD adhocBssid;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&adhocBssid, userdata,
+                                      sizeof(adhocBssid)))
+            {
+                ret = -EFAULT;
+            } else if (A_MEMCMP(adhocBssid.bssid, bcast_mac,
+                                AR6000_ETH_ADDR_LEN) == 0)
+            {
+                ret = -EFAULT;
+            } else {
+
+                A_MEMCPY(arSta->arReqBssid, adhocBssid.bssid, sizeof(arSta->arReqBssid));
+        }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_SETRETRYLIMITS:
+        {
+            WMI_SET_RETRY_LIMITS_CMD setRetryParams;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setRetryParams, userdata,
+                                      sizeof(setRetryParams)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_retry_limits_cmd(arPriv->arWmi, setRetryParams.frameType,
+                                          setRetryParams.trafficClass,
+                                          setRetryParams.maxRetries,
+                                          setRetryParams.enableNotify) != A_OK)
+                {
+                    ret = -EIO;
+                }
+                AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+                arPriv->arMaxRetries = setRetryParams.maxRetries;
+                AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_SET_BEACON_INTVAL:
+        {
+            WMI_BEACON_INT_CMD bIntvlCmd;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&bIntvlCmd, userdata,
+                       sizeof(bIntvlCmd)))
+            {
+                ret = -EFAULT;
+            } else if (wmi_set_adhoc_bconIntvl_cmd(arPriv->arWmi, bIntvlCmd.beaconInterval)
+                        != A_OK)
+            {
+                ret = -EIO;
+            }
+            if(ret == 0) {
+                arAp->ap_beacon_interval = bIntvlCmd.beaconInterval;
+                arPriv->ap_profile_flag = 1; /* There is a change in profile */
+            }
+            break;
+        }
+        case IEEE80211_IOCTL_SETAUTHALG:
+        {
+            struct ieee80211req_authalg req;
+
+           if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&req, userdata,
+                       sizeof(struct ieee80211req_authalg)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (req.auth_alg & AUTH_ALG_OPEN_SYSTEM) {
+                    arPriv->arDot11AuthMode  |= OPEN_AUTH;
+                    arPriv->arPairwiseCrypto  = NONE_CRYPT;
+                    arPriv->arGroupCrypto     = NONE_CRYPT;
+                }
+                if (req.auth_alg & AUTH_ALG_SHARED_KEY) {
+                    arPriv->arDot11AuthMode  |= SHARED_AUTH;
+                    arPriv->arPairwiseCrypto  = WEP_CRYPT;
+                    arPriv->arGroupCrypto     = WEP_CRYPT;
+                    arPriv->arAuthMode        = WMI_NONE_AUTH;
+                }
+                if (req.auth_alg == AUTH_ALG_LEAP) {
+                    arPriv->arDot11AuthMode   = LEAP_AUTH;
+                }
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_SET_VOICE_PKT_SIZE:
+            ret = ar6000_xioctl_set_voice_pkt_size(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_SET_MAX_SP:
+            ret = ar6000_xioctl_set_max_sp_len(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_GET_ROAM_TBL:
+            ret = ar6000_ioctl_get_roam_tbl(dev, rq);
+            break;
+        case AR6000_XIOCTL_WMI_SET_ROAM_CTRL:
+            ret = ar6000_ioctl_set_roam_ctrl(dev, userdata);
+            break;
+        case AR6000_XIOCTRL_WMI_SET_POWERSAVE_TIMERS:
+            ret = ar6000_ioctl_set_powersave_timers(dev, userdata);
+            break;
+        case AR6000_XIOCTRL_WMI_GET_POWER_MODE:
+            ret = ar6000_ioctl_get_power_mode(dev, rq);
+            break;
+
+        case AR6000_XIOCTRL_WMI_SET_WLAN_STATE:
+        {
+            AR6000_WLAN_STATE state;
+            get_user(state, (unsigned int *)userdata);
+            if (ar6000_set_wlan_state(ar, state)!=A_OK) {
+                ret = -EIO;
+            }       
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_GET_ROAM_DATA:
+            ret = ar6000_ioctl_get_roam_data(dev, rq);
+            break;
+
+#ifdef BTCOEX
+        case AR6000_XIOCTL_WMI_SET_BT_STATUS:
+            ret = ar6000_xioctl_set_bt_status_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BT_PARAMS:
+            ret = ar6000_xioctl_set_bt_params_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_FE_ANT:
+            ret = ar6000_xioctl_set_btcoex_fe_ant_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_COLOCATED_BT_DEV:
+            ret = ar6000_xioctl_set_btcoex_colocated_bt_dev_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG:
+            ret = ar6000_xioctl_set_btcoex_btinquiry_page_config_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_SCO_CONFIG:
+            ret = ar6000_xioctl_set_btcoex_sco_config_cmd( dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_A2DP_CONFIG:
+            ret = ar6000_xioctl_set_btcoex_a2dp_config_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_ACLCOEX_CONFIG:
+            ret = ar6000_xioctl_set_btcoex_aclcoex_config_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BTCOEX_DEBUG:
+            ret = ar60000_xioctl_set_btcoex_debug_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_SET_BT_OPERATING_STATUS:
+            ret = ar6000_xioctl_set_btcoex_bt_operating_status_cmd(dev, userdata);
+            break;
+
+        case AR6000_XIOCTL_WMI_GET_BTCOEX_CONFIG:
+            ret = ar6000_xioctl_get_btcoex_config_cmd(dev, userdata, rq);
+            break;
+
+        case AR6000_XIOCTL_WMI_GET_BTCOEX_STATS:
+            ret = ar6000_xioctl_get_btcoex_stats_cmd(dev, userdata, rq);
+            break;
+#endif
+        case AR6000_XIOCTL_WMI_STARTSCAN:
+        {
+            WMI_START_SCAN_CMD setStartScanCmd, *cmdp;
+
+            if (ar->arWmiReady == FALSE) {
+                    ret = -EIO;
+                } else if (copy_from_user(&setStartScanCmd, userdata,
+                                          sizeof(setStartScanCmd)))
+                {
+                    ret = -EFAULT;
+                } else {
+                    if (setStartScanCmd.numChannels > 1) {
+                        cmdp = A_MALLOC(130);
+                        if (copy_from_user(cmdp, userdata,
+                                           sizeof (*cmdp) +
+                                           ((setStartScanCmd.numChannels - 1) *
+                                           sizeof(A_UINT16))))
+                        {
+                            A_FREE(cmdp);
+                            ret = -EFAULT;
+                            goto ioctl_done;
+                        }
+                    } else {
+                        cmdp = &setStartScanCmd;
+                    }
+
+                    if (wmi_startscan_cmd(arPriv->arWmi, cmdp->scanType,
+                                          cmdp->forceFgScan,
+                                          cmdp->isLegacy,
+                                          cmdp->homeDwellTime,
+                                          cmdp->forceScanInterval,
+                                          cmdp->numChannels,
+                                          cmdp->channelList) != A_OK)
+                    {
+                        ret = -EIO;
+                    }
+                    if (setStartScanCmd.numChannels > 1) {
+                        A_FREE(cmdp);
+                    }
+                }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SETFIXRATES:
+        {
+            WMI_FIX_RATES_CMD setFixRatesCmd;
+            A_STATUS returnStatus;
+
+            if (ar->arWmiReady == FALSE) {
+                    ret = -EIO;
+                } else if (copy_from_user(&setFixRatesCmd, userdata,
+                                          sizeof(setFixRatesCmd)))
+                {
+                    ret = -EFAULT;
+                } else {
+                    returnStatus = wmi_set_fixrates_cmd(arPriv->arWmi, setFixRatesCmd.fixRateMask);
+                    if (returnStatus == A_EINVAL) {
+                        ret = -EINVAL;
+                    } else if(returnStatus != A_OK) {
+                        ret = -EIO;
+                    } else {
+                        arPriv->ap_profile_flag = 1; /* There is a change in profile */
+                    }
+                }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_GETFIXRATES:
+        {
+            WMI_FIX_RATES_CMD getFixRatesCmd;
+            int ret = 0;
+
+            if (ar->bIsDestroyProgress) {
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            /* Used copy_from_user/copy_to_user to access user space data */
+            if (copy_from_user(&getFixRatesCmd, userdata, sizeof(getFixRatesCmd))) {
+                ret = -EFAULT;
+            } else {
+                arPriv->arRateMask[0] = 0xFFFFFFFF;
+                arPriv->arRateMask[1] = 0xFFFFFFFF;
+
+                if (wmi_get_ratemask_cmd(arPriv->arWmi) != A_OK) {
+                    up(&ar->arSem);
+                    ret = -EIO;
+                    goto ioctl_done;
+                }
+
+                wait_event_interruptible_timeout(arPriv->arEvent, (arPriv->arRateMask[0] != 0xFFFFFFFF) && 
+                                             (arPriv->arRateMask[1] != 0xFFFFFFFF), wmitimeout * HZ);
+
+                if (signal_pending(current)) {
+                    ret = -EINTR;
+                }
+
+                if (!ret) {
+                    getFixRatesCmd.fixRateMask[0] = arPriv->arRateMask[0];
+                    getFixRatesCmd.fixRateMask[1] = arPriv->arRateMask[1];
+                }
+
+                if(copy_to_user(userdata, &getFixRatesCmd, sizeof(getFixRatesCmd))) {
+                   ret = -EFAULT;
+                }
+
+                up(&ar->arSem);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_AUTHMODE:
+        {
+            WMI_SET_AUTH_MODE_CMD setAuthMode;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setAuthMode, userdata,
+                                      sizeof(setAuthMode))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_authmode_cmd(arPriv->arWmi, setAuthMode.mode) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_REASSOCMODE:
+        {
+            WMI_SET_REASSOC_MODE_CMD setReassocMode;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setReassocMode, userdata,
+                                      sizeof(setReassocMode))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_reassocmode_cmd(arPriv->arWmi, setReassocMode.mode) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_DIAG_READ:
+        {
+            A_UINT32 addr, data;
+            get_user(addr, (unsigned int *)userdata);
+            addr = TARG_VTOP(ar->arTargetType, addr);
+            if (ar6000_ReadRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
+                ret = -EIO;
+            }
+            put_user(data, (unsigned int *)userdata + 1);
+            break;
+        }
+        case AR6000_XIOCTL_DIAG_WRITE:
+        {
+            A_UINT32 addr, data;
+            get_user(addr, (unsigned int *)userdata);
+            get_user(data, (unsigned int *)userdata + 1);
+            addr = TARG_VTOP(ar->arTargetType, addr);
+            if (ar6000_WriteRegDiag(ar->arHifDevice, &addr, &data) != A_OK) {
+                ret = -EIO;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_KEEPALIVE:
+        {
+             WMI_SET_KEEPALIVE_CMD setKeepAlive;
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+                 goto ioctl_done;
+             } else if (copy_from_user(&setKeepAlive, userdata,
+                        sizeof(setKeepAlive))){
+                 ret = -EFAULT;
+             } else {
+                 if (wmi_set_keepalive_cmd(arPriv->arWmi, setKeepAlive.keepaliveInterval) != A_OK) {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_WMI_SET_PARAMS:
+        {
+             WMI_SET_PARAMS_CMD cmd;
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+                 goto ioctl_done;
+             } else if (copy_from_user(&cmd, userdata,
+                        sizeof(cmd))){
+                 ret = -EFAULT;
+             } else if (copy_from_user(&cmd, userdata,
+                        sizeof(cmd) + cmd.length))
+            {
+                ret = -EFAULT;
+            } else {
+                 if (wmi_set_params_cmd(arPriv->arWmi, cmd.opcode, cmd.length, cmd.buffer) != A_OK) {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_WMI_SET_MCAST_FILTER:
+        {
+             WMI_SET_MCAST_FILTER_CMD cmd;
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+                 goto ioctl_done;
+             } else if (copy_from_user(&cmd, userdata,
+                        sizeof(cmd))){
+                 ret = -EFAULT;
+             } else {
+                 if (wmi_set_mcast_filter_cmd(arPriv->arWmi, &cmd.multicast_mac[0]) != A_OK) {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_WMI_DEL_MCAST_FILTER:
+        {
+             WMI_SET_MCAST_FILTER_CMD cmd;
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+                 goto ioctl_done;
+             } else if (copy_from_user(&cmd, userdata,
+                        sizeof(cmd))){
+                 ret = -EFAULT;
+             } else {
+                 if (wmi_del_mcast_filter_cmd(arPriv->arWmi, &cmd.multicast_mac[0]) != A_OK) {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_WMI_MCAST_FILTER:
+        {
+             WMI_MCAST_FILTER_CMD cmd;
+             if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+                 goto ioctl_done;
+             } else if (copy_from_user(&cmd, userdata,
+                        sizeof(cmd))){
+                 ret = -EFAULT;
+             } else {
+                 if (wmi_mcast_filter_cmd(arPriv->arWmi, cmd.enable)  != A_OK) {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_WMI_GET_KEEPALIVE:
+        {
+            WMI_GET_KEEPALIVE_CMD getKeepAlive;
+            int ret = 0;
+            if (ar->bIsDestroyProgress) {
+                ret =-EBUSY;
+                goto ioctl_done;
+            }
+            if (ar->arWmiReady == FALSE) {
+               ret = -EIO;
+               goto ioctl_done;
+            }
+            if (down_interruptible(&ar->arSem)) {
+                ret = -ERESTARTSYS;
+                goto ioctl_done;
+            }
+            if (ar->bIsDestroyProgress) {
+                up(&ar->arSem);
+                ret = -EBUSY;
+                goto ioctl_done;
+            }
+            if (copy_from_user(&getKeepAlive, userdata,sizeof(getKeepAlive))) {
+               ret = -EFAULT;
+            } else {
+            getKeepAlive.keepaliveInterval = wmi_get_keepalive_cmd(arPriv->arWmi);
+            arSta->arKeepaliveConfigured = 0xFF;
+            if (wmi_get_keepalive_configured(arPriv->arWmi) != A_OK){
+                up(&ar->arSem);
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            wait_event_interruptible_timeout(arPriv->arEvent, arSta->arKeepaliveConfigured != 0xFF, wmitimeout * HZ);
+            if (signal_pending(current)) {
+                ret = -EINTR;
+            }
+
+            if (!ret) {
+                getKeepAlive.configured = arSta->arKeepaliveConfigured;
+            }
+            if (copy_to_user(userdata, &getKeepAlive, sizeof(getKeepAlive))) {
+               ret = -EFAULT;
+            }
+            }
+            up(&ar->arSem);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_APPIE:
+        {
+            WMI_SET_APPIE_CMD appIEcmd;
+            A_UINT8           appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
+            A_UINT32            fType,ieLen;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            get_user(fType, (A_UINT32 *)userdata);
+            appIEcmd.mgmtFrmType = fType;
+            if (appIEcmd.mgmtFrmType >= IEEE80211_APPIE_NUM_OF_FRAME) {
+                ret = -EIO;
+            } else {
+                get_user(ieLen, (A_UINT32 *)(userdata + 4));
+                appIEcmd.ieLen = ieLen;
+                AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WPSIE: Type-%d, Len-%d\n",appIEcmd.mgmtFrmType, appIEcmd.ieLen));
+                if (appIEcmd.ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
+                    ret = -EIO;
+                    break;
+                }
+                if (copy_from_user(appIeInfo, userdata + 8, appIEcmd.ieLen)) {
+                    ret = -EFAULT;
+                } else {
+                    if (wmi_set_appie_cmd(arPriv->arWmi, appIEcmd.mgmtFrmType,
+                                          appIEcmd.ieLen,  appIeInfo) != A_OK)
+                    {
+                        ret = -EIO;
+                    }
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_MGMT_FRM_RX_FILTER:
+        {
+            WMI_BSS_FILTER_CMD cmd;
+            A_UINT32    filterType;
+
+            if (copy_from_user(&filterType, userdata, sizeof(A_UINT32)))
+            {
+                ret = -EFAULT;
+                goto ioctl_done;
+            }
+            if (filterType & (IEEE80211_FILTER_TYPE_BEACON |
+                                    IEEE80211_FILTER_TYPE_PROBE_RESP))
+            {
+                cmd.bssFilter = ALL_BSS_FILTER;
+            } else {
+                cmd.bssFilter = NONE_BSS_FILTER;
+            }
+            if (wmi_bssfilter_cmd(arPriv->arWmi, cmd.bssFilter, 0) != A_OK) {
+                ret = -EIO;
+            } else {
+                arSta->arUserBssFilter = cmd.bssFilter;
+            }
+
+            AR6000_SPIN_LOCK(&arPriv->arPrivLock, 0);
+            arSta->arMgmtFilter = filterType;
+            AR6000_SPIN_UNLOCK(&arPriv->arPrivLock, 0);
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_WSC_STATUS:
+        {
+            A_UINT32    wsc_status;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            } else if (copy_from_user(&wsc_status, userdata, sizeof(A_UINT32))) {
+                ret = -EFAULT;
+                goto ioctl_done;
+            }
+            if (wmi_set_wsc_status_cmd(arPriv->arWmi, wsc_status) != A_OK) {
+                ret = -EIO;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_BMI_ROMPATCH_INSTALL:
+        {
+            A_UINT32 ROM_addr;
+            A_UINT32 RAM_addr;
+            A_UINT32 nbytes;
+            A_UINT32 do_activate;
+            A_UINT32 rompatch_id;
+
+            get_user(ROM_addr, (A_UINT32 *)userdata);
+            get_user(RAM_addr, (A_UINT32 *)userdata + 1);
+            get_user(nbytes, (A_UINT32 *)userdata + 2);
+            get_user(do_activate, (A_UINT32 *)userdata + 3);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Install rompatch from ROM: 0x%x to RAM: 0x%x  length: %d\n",
+                             ROM_addr, RAM_addr, nbytes));
+            ret = BMIrompatchInstall(hifDevice, ROM_addr, RAM_addr,
+                                        nbytes, do_activate, &rompatch_id);
+            if (ret == A_OK) {
+                put_user(rompatch_id, (unsigned int *)rq->ifr_data); /* return value */
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_BMI_ROMPATCH_UNINSTALL:
+        {
+            A_UINT32 rompatch_id;
+
+            get_user(rompatch_id, (A_UINT32 *)userdata);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("UNinstall rompatch_id %d\n", rompatch_id));
+            ret = BMIrompatchUninstall(hifDevice, rompatch_id);
+            break;
+        }
+
+        case AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE:
+        case AR6000_XIOCTL_BMI_ROMPATCH_DEACTIVATE:
+        {
+            A_UINT32 rompatch_count;
+
+            get_user(rompatch_count, (A_UINT32 *)userdata);
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Change rompatch activation count=%d\n", rompatch_count));
+            length = sizeof(A_UINT32) * rompatch_count;
+            if ((buffer = (unsigned char *)A_MALLOC(length)) != NULL) {
+                A_MEMZERO(buffer, length);
+                if (copy_from_user(buffer, &userdata[sizeof(rompatch_count)], length))
+                {
+                    ret = -EFAULT;
+                } else {
+                    if (cmd == AR6000_XIOCTL_BMI_ROMPATCH_ACTIVATE) {
+                        ret = BMIrompatchActivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
+                    } else {
+                        ret = BMIrompatchDeactivate(hifDevice, rompatch_count, (A_UINT32 *)buffer);
+                    }
+                }
+                A_FREE(buffer);
+            } else {
+                ret = -ENOMEM;
+            }
+
+            break;
+        }
+        case AR6000_XIOCTL_SET_IP:
+        {
+            WMI_SET_IP_CMD setIP;
+           if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setIP, userdata,
+                                      sizeof(setIP))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_ip_cmd(arPriv->arWmi,
+                                &setIP) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_SET_HOST_SLEEP_MODE:
+        {
+            WMI_SET_HOST_SLEEP_MODE_CMD setHostSleepMode;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setHostSleepMode, userdata,
+                                      sizeof(setHostSleepMode))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_host_sleep_mode_cmd(arPriv->arWmi,
+                                &setHostSleepMode) != A_OK)
+                {
+                    ret = -EIO;
+                } else {
+		    if (setHostSleepMode.asleep) {
+		        ar->isHostAsleep = 1;
+	            } else {
+		        ar->isHostAsleep = 0;
+	            }
+		}
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_SET_WOW_MODE:
+        {
+            WMI_SET_WOW_MODE_CMD setWowMode;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&setWowMode, userdata,
+                                      sizeof(setWowMode))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_set_wow_mode_cmd(arPriv->arWmi,
+                                &setWowMode) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_WOW_LIST:
+        {
+            WMI_GET_WOW_LIST_CMD getWowList;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&getWowList, userdata,
+                                      sizeof(getWowList))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_get_wow_list_cmd(arPriv->arWmi,
+                                &getWowList) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_ADD_WOW_PATTERN:
+        ret = ar6000_xioctl_add_wowptn(arPriv, userdata);
+        break;
+
+        case AR6000_XIOCTL_WMI_DEL_WOW_PATTERN:
+        {
+            WMI_DEL_WOW_PATTERN_CMD delWowPattern;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&delWowPattern, userdata,
+                                      sizeof(delWowPattern))) {
+                ret = -EFAULT;
+            } else {
+                if (wmi_del_wow_pattern_cmd(arPriv->arWmi,
+                                &delWowPattern) != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_DUMP_HTC_CREDIT_STATE:
+        ret = ar6000_xioctl_dump_htccredit(arPriv);
+        break;
+
+        case AR6000_XIOCTL_TRAFFIC_ACTIVITY_CHANGE:
+            if (ar->arHtcTarget != NULL) {
+                struct ar6000_traffic_activity_change data;
+
+                if (copy_from_user(&data, userdata, sizeof(data)))
+                {
+                    ret = -EFAULT;
+                    goto ioctl_done;
+                }
+                    /* note, this is used for testing (mbox ping testing), indicate activity
+                     * change using the stream ID as the traffic class */
+                ar6000_indicate_tx_activity(arPriv,
+                                            (A_UINT8)data.StreamID,
+                                            data.Active ? TRUE : FALSE);
+            }
+            break;
+        case AR6000_XIOCTL_WMI_SET_CONNECT_CTRL_FLAGS:
+            {
+                A_UINT32 connectCtrlFlags;
+                if (ar->arWmiReady == FALSE) {
+                    ret = -EIO;
+                } else if (copy_from_user(&connectCtrlFlags, userdata,
+                                      sizeof(connectCtrlFlags)))
+                {
+                    ret = -EFAULT;
+                } else {
+                    arSta->arConnectCtrlFlags = connectCtrlFlags;
+                }
+            }
+            break;
+        case AR6000_XIOCTL_WMI_SET_AKMP_PARAMS:
+            {
+                WMI_SET_AKMP_PARAMS_CMD  akmpParams;
+            
+                if (ar->arWmiReady == FALSE) {
+                    ret = -EIO;
+                } else if (copy_from_user(&akmpParams, userdata,
+                                      sizeof(WMI_SET_AKMP_PARAMS_CMD)))
+                {
+                    ret = -EFAULT;
+                } else {
+                    if (wmi_set_akmp_params_cmd(arPriv->arWmi, &akmpParams) != A_OK) {
+                        ret = -EIO;
+                    }
+                }
+                break;
+            }
+        case AR6000_XIOCTL_WMI_SET_PMKID_LIST:
+            {
+                WMI_SET_PMKID_LIST_CMD   pmkidInfo;
+                if (ar->arWmiReady == FALSE) {
+                   ret = -EIO;
+                   break;
+                } 
+                if (copy_from_user(&pmkidInfo.numPMKID, userdata,
+                                      sizeof(pmkidInfo.numPMKID))) {
+                    ret = -EFAULT;
+                    break;
+                }
+                if (copy_from_user(&pmkidInfo.pmkidList,
+                                   userdata + sizeof(pmkidInfo.numPMKID),
+                                   pmkidInfo.numPMKID * sizeof(WMI_PMKID)))
+                {
+                    ret = -EFAULT;
+                    break;
+                }
+                if (wmi_set_pmkid_list_cmd(arPriv->arWmi, &pmkidInfo) != A_OK) {
+                    ret = -EIO;
+                }
+                break;
+            }
+        case AR6000_XIOCTL_WMI_GET_PMKID_LIST:
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (wmi_get_pmkid_list_cmd(arPriv->arWmi) != A_OK) {
+                    ret = -EIO;
+                }
+            break;
+        case AR6000_XIOCTL_WMI_ABORT_SCAN:
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            }
+            ret = wmi_abort_scan_cmd(arPriv->arWmi);
+            break;
+        case AR6000_XIOCTL_AP_HIDDEN_SSID:
+        {
+            A_UINT8    hidden_ssid;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&hidden_ssid, userdata, sizeof(hidden_ssid))) {
+                ret = -EFAULT;
+            } else {
+                wmi_ap_set_hidden_ssid(arPriv->arWmi, hidden_ssid);
+                arAp->ap_hidden_ssid = hidden_ssid;
+                arPriv->ap_profile_flag = 1; /* There is a change in profile */
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_STA_LIST:
+        {
+            WMI_SET_HT_CAP_CMD htCap;
+            
+            htCap.band = A_BAND_24GHZ;
+            if(arPriv->phymode == WMI_11A_MODE) {
+                htCap.band = A_BAND_5GHZ;
+            }            
+            wmi_get_ht_cap_cmd(arPriv->arWmi, &htCap);
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else {
+                A_UINT8 i, j=0;
+                ap_get_sta_t temp;
+                A_MEMZERO(&temp, sizeof(temp));
+                for(i=0;i<NUM_CONN;i++) {
+                    if(ar->connTbl[i].arPriv == arPriv) {
+                        A_MEMCPY(temp.sta[j].mac, ar->connTbl[i].mac, ATH_MAC_LEN);
+                        temp.sta[j].aid     = ar->connTbl[i].aid;
+                        temp.sta[j].keymgmt = ar->connTbl[i].keymgmt;
+                        temp.sta[j].ucipher = ar->connTbl[i].ucipher;
+                        temp.sta[j].auth    = ar->connTbl[i].auth;
+                        temp.sta[j].wmode   = ar->connTbl[i].wmode;
+                        if(htCap.enable == 2) {
+                            /* Set MSB to indicate 11n-only mode */
+                            temp.sta[j].wmode |= 0x80;
+                        }
+                        j++;
+                    }
+                }
+                if(copy_to_user((ap_get_sta_t *)rq->ifr_data, &temp, sizeof(temp))) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_SET_NUM_STA:
+        {
+            A_UINT8    num_sta;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&num_sta, userdata, sizeof(num_sta))) {
+                ret = -EFAULT;
+            } else {
+                ret = ar6000_ap_set_num_sta(ar, arPriv, num_sta);
+                printk("ar6000_ap_set_num_sta %d ret %d \n",num_sta,ret);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_SET_DFS:
+        {
+#ifdef ATH_SUPPORT_DFS
+            A_UINT8    enable;
+            if (copy_from_user(&enable, userdata, sizeof(enable))) {
+                ret = -EFAULT;
+            } else {
+                wmi_ap_set_dfs(arPriv->arWmi, enable);
+            }
+#else
+            ret = -EIO;
+#endif
+            break;
+        }
+ 
+        case AR6000_XIOCTL_AP_SET_ACL_POLICY:
+        {
+            A_UINT8    policy;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&policy, userdata, sizeof(policy))) {
+                ret = -EFAULT;
+            } else {
+                if(!(policy & AP_ACL_RETAIN_LIST_MASK)) {
+                    /* clear ACL list */
+                    memset(&arAp->g_acl,0,sizeof(WMI_AP_ACL));
+                }
+                arAp->g_acl.policy = policy;
+                wmi_ap_set_acl_policy(arPriv->arWmi, policy);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_SET_ACL_MAC:
+        {
+            WMI_AP_ACL_MAC_CMD    acl;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&acl, userdata, sizeof(acl))) {
+                ret = -EFAULT;
+            } else {
+                if(acl_add_del_mac(&arAp->g_acl, &acl)) {
+                    wmi_ap_acl_mac_list(arPriv->arWmi, &acl);
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("ACL list error\n"));
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_ACL_LIST:
+        {
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_AP_ACL *)rq->ifr_data, &arAp->g_acl,
+                                 sizeof(WMI_AP_ACL))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_COMMIT_CONFIG:
+        {
+            A_STATUS status = ar6000_check_connect_request(arPriv, TRUE);
+            if( A_OK == status ) {
+                ret = ar6000_ap_mode_profile_commit(arPriv);
+            } else if (A_ERROR == status){
+                ret = -EINVAL;
+            }
+            else {
+                ret = 0;
+            }
+            break;
+        }
+        case IEEE80211_IOCTL_GETWPAIE:
+        ret = ar6000_ioctl_get_wpaie(arPriv, userdata);
+        break;
+
+        case AR6000_XIOCTL_AP_CONN_INACT_TIME:
+        {
+            A_UINT32    period;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&period, userdata, sizeof(period))) {
+                ret = -EFAULT;
+            } else {
+                wmi_ap_conn_inact_time(arPriv->arWmi, period);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_PROT_SCAN_TIME:
+        {
+            WMI_AP_PROT_SCAN_TIME_CMD  bgscan;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&bgscan, userdata, sizeof(bgscan))) {
+                ret = -EFAULT;
+            } else {
+                wmi_ap_bgscan_time(arPriv->arWmi, bgscan.period_min, bgscan.dwell_ms);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_SET_COUNTRY:
+        {
+            ret = ar6000_ioctl_set_country(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_AP_SET_DTIM:
+        {
+            WMI_AP_SET_DTIM_CMD  d;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&d, userdata, sizeof(d))) {
+                ret = -EFAULT;
+            } else {
+                if(d.dtim > 0 && d.dtim < 11) {
+                    arAp->ap_dtim_period = d.dtim;
+                    wmi_ap_set_dtim(arPriv->arWmi, d.dtim);
+                    arPriv->ap_profile_flag = 1; /* There is a change in profile */
+                } else {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("DTIM out of range. Valid range is [1-10]\n"));
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_TARGET_EVENT_REPORT:
+        {
+            WMI_SET_TARGET_EVENT_REPORT_CMD evtCfgCmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            }
+            if (copy_from_user(&evtCfgCmd, userdata,
+                               sizeof(evtCfgCmd))) {
+                ret = -EFAULT;
+                break;
+            }
+            ret = wmi_set_target_event_report_cmd(arPriv->arWmi, &evtCfgCmd);
+            break;
+        }
+        case AR6000_XIOCTL_AP_CTRL_BSS_COMM:
+        {
+            A_UINT8    intra=0;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&intra, userdata, sizeof(intra))) {
+                ret = -EFAULT;
+            } else {
+                if(intra & 0x80) { /* interbss */
+                    ar->inter_bss = ( (intra & 0xF) ? 1 : 0 );
+                } else {
+                    arAp->intra_bss = ( intra ? 1 : 0 );
+                }
+            }
+#ifdef P2P
+            /* If P2P is enabled on this device, also indicate intra_bss setting to the firmware
+             * so that it can be reflected in the Group Capability bit of the p2p-go.
+             */
+            {
+                NETWORK_SUBTYPE networkSubType = arPriv->arNetworkSubType;
+
+                if (networkSubType == SUBTYPE_P2PDEV ||
+                    networkSubType == SUBTYPE_P2PCLIENT ||
+                    networkSubType == SUBTYPE_P2PGO) {
+
+                    WMI_P2P_SET_CMD set_p2p_config;
+                    A_MEMZERO(&set_p2p_config, sizeof(WMI_P2P_SET_CMD));
+
+                    set_p2p_config.config_id = WMI_P2P_CONFID_INTRA_BSS; 
+                    set_p2p_config.val.intra_bss.flag = intra;
+                    p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_INTRA_BSS_DIST, intra);
+                    wmi_p2p_set_cmd(arPriv->arWmi, &set_p2p_config);
+                }
+            }
+#endif /* P2P */
+            break;
+        }
+        case AR6000_XIOCTL_DUMP_MODULE_DEBUG_INFO:
+        {
+            struct drv_debug_module_s moduleinfo;
+
+            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            a_dump_module_debug_info_by_name(moduleinfo.modulename);
+            ret = 0;
+            break;
+        }
+        case AR6000_XIOCTL_MODULE_DEBUG_SET_MASK:
+        {
+            struct drv_debug_module_s moduleinfo;
+
+            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            if (A_FAILED(a_set_module_mask(moduleinfo.modulename, moduleinfo.mask))) {
+                ret = -EFAULT;
+            }
+
+            break;
+        }
+        case AR6000_XIOCTL_MODULE_DEBUG_GET_MASK:
+        {
+            struct drv_debug_module_s moduleinfo;
+
+            if (copy_from_user(&moduleinfo, userdata, sizeof(moduleinfo))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            if (A_FAILED(a_get_module_mask(moduleinfo.modulename, &moduleinfo.mask))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            if (copy_to_user(userdata, &moduleinfo, sizeof(moduleinfo))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            break;
+        }
+#ifdef ATH_AR6K_11N_SUPPORT
+        case AR6000_XIOCTL_DUMP_RCV_AGGR_STATS:
+        {
+            PACKET_LOG *copy_of_pkt_log;
+
+            aggr_dump_stats(ar->connTbl[0].conn_aggr, &copy_of_pkt_log);
+            if (copy_to_user(rq->ifr_data, copy_of_pkt_log, sizeof(PACKET_LOG))) {
+                ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_SETUP_AGGR:
+        {
+            WMI_ADDBA_REQ_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+                ret = -EFAULT;
+            } else {
+                wmi_setup_aggr_cmd(arPriv->arWmi, cmd.tid);
+            }
+        }
+        break;
+
+        case AR6000_XIOCTL_DELE_AGGR:
+        {
+            WMI_DELBA_REQ_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+                ret = -EFAULT;
+            } else {
+                wmi_delete_aggr_cmd(arPriv->arWmi, cmd.tid, cmd.is_sender_initiator);
+            }
+        }
+        break;
+
+        case AR6000_XIOCTL_ALLOW_AGGR:
+        {
+            WMI_ALLOW_AGGR_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+                ret = -EFAULT;
+            } else {
+                wmi_allow_aggr_cmd(arPriv->arWmi, cmd.tx_allow_aggr, cmd.rx_allow_aggr);
+            }
+        }
+        break;
+
+        case AR6000_XIOCTL_SET_HT_CAP:
+        {
+            WMI_SET_HT_CAP_CMD htCap;
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&htCap, userdata, sizeof(htCap))) {
+                ret = -EFAULT;
+            } else if (wmi_set_ht_cap_cmd(arPriv->arWmi, &htCap) != A_OK) {
+                    ret = -EIO;
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_GET_HT_CAP:
+        {
+            WMI_SET_HT_CAP_CMD htCap;
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&htCap, userdata, sizeof(htCap))) {
+                ret = -EFAULT;
+            } else if (wmi_get_ht_cap_cmd(arPriv->arWmi, &htCap) != A_OK) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_SET_HT_CAP_CMD *)rq->ifr_data, 
+                            &htCap, sizeof(htCap))) {
+                ret = -EFAULT;
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_SET_HT_OP:
+        {
+            WMI_SET_HT_OP_CMD htOp;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&htOp, userdata,
+                                      sizeof(htOp))){
+                 ret = -EFAULT;
+             } else {
+
+                if (wmi_set_ht_op_cmd(arPriv->arWmi, htOp.sta_chan_width) != A_OK)
+                {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+#endif
+
+#ifdef BTCOEX
+        case AR6000_XIOCTL_ACL_DATA:
+        {
+            void *osbuf = NULL;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (ar6000_create_acl_data_osbuf(dev, (A_UINT8*)userdata, &osbuf) != A_OK) {
+                     ret = -EIO;
+            } else {
+                if (wmi_data_hdr_add(arPriv->arWmi, osbuf, DATA_MSGTYPE, 0, WMI_DATA_HDR_DATA_TYPE_ACL,0,NULL) != A_OK) {
+                    AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("XIOCTL_ACL_DATA - wmi_data_hdr_add failed\n"));
+                } else {
+                    /* Send data buffer over HTC */
+                    ar6000_acl_data_tx(osbuf, arPriv);
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_HCI_CMD:
+        ret = ar6000_xioctl_hci_cmd(arPriv, userdata);
+        break;
+
+        case AR6000_XIOCTL_WLAN_CONN_PRECEDENCE:
+        {
+            WMI_SET_BT_WLAN_CONN_PRECEDENCE cmd;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd))) {
+                ret = -EFAULT;
+            } else {
+                if (cmd.precedence == BT_WLAN_CONN_PRECDENCE_WLAN ||
+                            cmd.precedence == BT_WLAN_CONN_PRECDENCE_PAL) {
+                    if ( wmi_set_wlan_conn_precedence_cmd(arPriv->arWmi, cmd.precedence) != A_OK) {
+                        ret = -EIO;
+                    }
+                } else {
+                    ret = -EINVAL;
+                }
+            }
+            break;
+        }
+#endif
+        case AR6000_XIOCTL_AP_GET_STAT:
+        {
+            ret = ar6000_ioctl_get_ap_stats(dev, rq);
+            break;
+        }
+        case AR6000_XIOCTL_SET_TX_SELECT_RATES:
+        {
+            WMI_SET_TX_SELECT_RATES_CMD masks;
+
+             if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&masks, userdata,
+                                      sizeof(masks))) {
+                 ret = -EFAULT;
+             } else {
+
+                if (wmi_set_tx_select_rates_cmd(arPriv->arWmi, masks.rateMasks) != A_OK)
+                {
+                     ret = -EIO;
+               }
+             }
+             break;
+        }
+        case AR6000_XIOCTL_AP_GET_HIDDEN_SSID:
+        {
+            WMI_AP_HIDDEN_SSID_CMD ssid;
+            ssid.hidden_ssid = arAp->ap_hidden_ssid;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_AP_HIDDEN_SSID_CMD *)rq->ifr_data,
+                                    &ssid, sizeof(WMI_AP_HIDDEN_SSID_CMD))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_COUNTRY:
+        {
+            WMI_AP_SET_COUNTRY_CMD cty;
+            A_MEMCPY(cty.countryCode, arAp->ap_country_code, 3);
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_AP_SET_COUNTRY_CMD *)rq->ifr_data,
+                                    &cty, sizeof(WMI_AP_SET_COUNTRY_CMD))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_WMODE:
+        {
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((A_UINT8 *)rq->ifr_data,
+				    &arPriv->phymode, sizeof(A_UINT8))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_DTIM:
+        {
+            WMI_AP_SET_DTIM_CMD dtim;
+            dtim.dtim = arAp->ap_dtim_period;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_AP_SET_DTIM_CMD *)rq->ifr_data,
+                                    &dtim, sizeof(WMI_AP_SET_DTIM_CMD))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_BINTVL:
+        {
+            WMI_BEACON_INT_CMD bi;
+            bi.beaconInterval = arAp->ap_beacon_interval;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_BEACON_INT_CMD *)rq->ifr_data,
+                                    &bi, sizeof(WMI_BEACON_INT_CMD))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_RTS:
+        {
+            WMI_SET_RTS_CMD rts;
+            rts.threshold = arAp->arRTS;
+         
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if(copy_to_user((WMI_SET_RTS_CMD *)rq->ifr_data,
+                                    &rts, sizeof(WMI_SET_RTS_CMD))) {
+                    ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_FETCH_TARGET_REGS:
+        ret = ar6000_xioctl_fetch_targ_regs(arPriv, rq, hifDevice);
+        break;
+
+        case AR6000_XIOCTL_AP_SET_11BG_RATESET:
+        {
+            WMI_AP_SET_11BG_RATESET_CMD  rate;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&rate, userdata, sizeof(rate))) {
+                ret = -EFAULT;
+            } else {
+                wmi_ap_set_rateset(arPriv->arWmi, rate.rateset);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_GET_WLAN_SLEEP_STATE:
+        {
+            WMI_REPORT_SLEEP_STATE_EVENT  wmiSleepEvent ;
+
+            if (ar->arWlanState == WLAN_ENABLED) {
+                wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_AWAKE;
+            } else {
+                wmiSleepEvent.sleepState = WMI_REPORT_SLEEP_STATUS_IS_DEEP_SLEEP;
+            }
+            rq->ifr_ifru.ifru_ivalue = ar->arWlanState; /* return value */
+            ar6000_send_event_to_app(arPriv, WMI_REPORT_SLEEP_STATE_EVENTID, (A_UINT8*)&wmiSleepEvent,
+                                     sizeof(WMI_REPORT_SLEEP_STATE_EVENTID));
+            break;
+        }
+#ifdef P2P
+        case AR6000_XIOCTL_WMI_P2P_DISCOVER:
+        {
+            WMI_BSS_FILTER_CMD filt;
+
+            /*Issue the WMI_FIND CMD*/
+            WMI_P2P_FIND_CMD find_param;
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                break;
+            }
+            A_MEMZERO(&filt, sizeof(WMI_BSS_FILTER_CMD));
+            /*Set BSS filter to ALL*/
+            filt.bssFilter = ALL_BSS_FILTER;
+
+            if (wmi_bssfilter_cmd(arPriv->arWmi, filt.bssFilter, filt.ieMask)
+                    != A_OK) {
+                ret = -EIO;
+            } else {
+                arSta->arUserBssFilter = filt.bssFilter;
+                if (copy_from_user(&find_param, userdata, sizeof(WMI_P2P_FIND_CMD))) {
+                    ret = -EFAULT;
+                } else {
+                    p2p_clear_peers_reported_flag(A_WMI_GET_P2P_CTX(arPriv));
+                    wmi_p2p_discover(arPriv->arWmi, &find_param);
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_STOP_FIND:
+        {
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else {
+                wmi_p2p_stop_find(arPriv->arWmi);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_CANCEL:
+        {
+            wmi_p2p_cancel(arPriv->arWmi);
+            p2p_clear_group_peer(A_WMI_GET_P2P_CTX(arPriv));
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_LISTEN:
+        {
+            A_UINT32 timeout;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&timeout, userdata, sizeof(timeout))) {
+                ret = -EFAULT;
+            } else {
+                wmi_p2p_listen(arPriv->arWmi, timeout);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_GO_NEG:
+        {
+            /*Issue the WMI_GO_NEG CMD*/
+            WMI_P2P_GO_NEG_START_CMD go_param;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&go_param, userdata, sizeof(WMI_P2P_GO_NEG_START_CMD))) {
+                ret = -EFAULT;
+            } else { 
+                if (p2p_go_neg_start(A_WMI_GET_P2P_CTX(arPriv), &go_param)
+                        != A_OK) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_AUTH_GO_NEG:
+        {
+            WMI_P2P_GO_NEG_START_CMD go_neg_auth_param;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&go_neg_auth_param, userdata, sizeof(WMI_P2P_GO_NEG_START_CMD))) {
+                ret = -EFAULT;
+            } else { 
+                if (p2p_auth_go_neg(A_WMI_GET_P2P_CTX(arPriv),
+                            &go_neg_auth_param) != A_OK) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_REJECT:
+        {
+            A_UINT8 p2p_reject_peer[IEEE80211_ADDR_LEN];
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(p2p_reject_peer, userdata,
+                            IEEE80211_ADDR_LEN)) {
+                ret = -EFAULT;
+            } else { 
+                if (p2p_peer_reject(A_WMI_GET_P2P_CTX(arPriv),
+                         p2p_reject_peer) != A_OK) {
+                ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_CONFIG:
+        {
+            WMI_P2P_SET_CONFIG_CMD set_p2p_config;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&set_p2p_config, userdata, sizeof(WMI_P2P_SET_CONFIG_CMD))) {
+                ret = -EFAULT;
+            } else { 
+                wmi_p2p_set_config(arPriv->arWmi, &set_p2p_config);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_WPS_CONFIG:
+        {
+            WMI_WPS_SET_CONFIG_CMD set_wps_config;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&set_wps_config, userdata, sizeof(WMI_WPS_SET_CONFIG_CMD))) {
+                ret = -EFAULT;
+            } else {
+                wmi_wps_set_config(arPriv->arWmi, &set_wps_config);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_FINDNODE:
+        {
+            A_UINT8 macaddr[AR6000_ETH_ADDR_LEN];
+            bss_t *ni;
+            if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+            } else if (copy_from_user(macaddr, userdata,AR6000_ETH_ADDR_LEN)) {
+                 ret = -EFAULT;
+            } else {
+                 ni = wmi_find_node(arPriv->arWmi, macaddr);
+                 if (ni) {
+                     if(copy_to_user((A_UINT16 *)rq->ifr_data, 
+                                    &ni->ni_cie.ie_chan, sizeof(A_UINT16))) {
+                         ret = -EFAULT;
+                     }
+                 }
+                 else {
+                       ret = -EFAULT;
+                 }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_GRP_INIT:
+        {
+            WMI_P2P_GRP_INIT_CMD p2p_grp_init_cmd;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&p2p_grp_init_cmd, userdata,
+                                sizeof(WMI_P2P_GRP_INIT_CMD))) {
+                ret = -EFAULT;
+            } else {
+                p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_GROUP_FORMATION, 
+                                         p2p_grp_init_cmd.group_formation);
+                p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_PERSISTENT_GROUP, 
+                                         p2p_grp_init_cmd.persistent_group);
+                wmi_p2p_grp_init_cmd(arPriv->arWmi, &p2p_grp_init_cmd);
+		
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_GRP_FORMATION_DONE:
+        {
+            WMI_P2P_GRP_FORMATION_DONE_CMD p2p_grp_done_cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&p2p_grp_done_cmd, userdata,
+                                sizeof(WMI_P2P_GRP_FORMATION_DONE_CMD))) {
+                ret = -EFAULT;
+            } else {
+                p2p_set_group_capability(A_WMI_GET_P2P_CTX(arPriv), P2P_GROUP_CAPAB_GROUP_FORMATION, 
+                                         0);
+                wmi_p2p_grp_done_cmd(arPriv->arWmi, &p2p_grp_done_cmd);
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_INVITE:
+        {
+            WMI_P2P_INVITE_CMD p2p_invite_param;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&p2p_invite_param, userdata,
+                                 sizeof(WMI_P2P_INVITE_CMD))) {
+                ret = -EFAULT;
+            } else {
+                if (p2p_invite_cmd(A_WMI_GET_P2P_CTX(arPriv), &p2p_invite_param)
+                    != A_OK) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_PROV_DISC:
+        ret = ar6000_xioctl_wmi_p2p_provdisc(arPriv, userdata);
+        break;
+
+        case AR6000_XIOCTL_WMI_P2P_GET_IF_ADDR:
+        {
+            A_UINT8 buf[12];
+            const A_UINT8 zero_mac[] = {0,0,0,0,0,0};
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(buf, userdata, 12)) {
+                ret = -EFAULT;
+            } else {
+                if (p2p_get_ifaddr(A_WMI_GET_P2P_CTX(arPriv),
+                        buf) == A_OK) {
+                    if(copy_to_user((A_UINT8 *)rq->ifr_data, 
+                                buf+6, IEEE80211_ADDR_LEN)) {
+                        ret = -EFAULT;
+                    }
+                } else {
+                    if(copy_to_user((A_UINT8 *)rq->ifr_data, 
+                                zero_mac, IEEE80211_ADDR_LEN)) {
+                        ret = -EFAULT;
+                    }
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_GET_DEV_ADDR:
+        {
+            A_UINT8 buf[12];
+            const A_UINT8 zero_mac[] = {0,0,0,0,0,0};
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(buf, userdata, 12)) {
+                ret = -EFAULT;
+            } else {
+                if (p2p_get_devaddr(A_WMI_GET_P2P_CTX(arPriv),
+                        buf) == A_OK) {
+                    if(copy_to_user((A_UINT8 *)rq->ifr_data, 
+                                buf+6, IEEE80211_ADDR_LEN)) {
+                        ret = -EFAULT;
+                    }
+                } else {
+                    if(copy_to_user((A_UINT8 *)rq->ifr_data, 
+                                zero_mac, IEEE80211_ADDR_LEN)) {
+                        ret = -EFAULT;
+                    }
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_SET:
+        ret = ar6000_xioctl_wmi_p2p_set(arPriv, userdata);
+        break;
+
+        case AR6000_XIOCTL_WMI_P2P_PEER:
+        ret = ar6000_xioctl_wmi_p2p_peer(arPriv, userdata, rq);
+        break;
+
+        case AR6000_XIOCTL_WMI_P2P_FLUSH:
+        {
+            p2p_free_all_devices(A_WMI_GET_P2P_CTX(arPriv));
+            p2p_free_all_sd_queries(A_WMI_GET_P2P_CTX(arPriv));
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_GO_PARAMS:
+        {
+            A_UINT8 go_dev_addr[AR6000_ETH_ADDR_LEN];
+            struct {
+                A_UINT16 oper_freq;
+                A_UINT8 ssid[WMI_MAX_SSID_LEN];
+                A_UINT8 ssid_len;
+            } go_params;
+
+            A_MEMZERO(&go_params, sizeof(go_params));
+
+            if (ar->arWmiReady == FALSE) {
+                 ret = -EIO;
+            } else if (copy_from_user(go_dev_addr,
+                         userdata, AR6000_ETH_ADDR_LEN)) {
+                 ret = -EFAULT;
+            } else {
+                 if (wmi_p2p_get_go_params(A_WMI_GET_P2P_CTX(arPriv),
+                     go_dev_addr, &go_params.oper_freq, go_params.ssid,
+                          &go_params.ssid_len) == A_OK) {
+                     if(copy_to_user((A_UINT16 *)rq->ifr_data, 
+                                    &go_params, sizeof(go_params))) {
+                         ret = -EFAULT;
+                     }
+                 } else {
+                       ret = -EFAULT;
+                 }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_P2P_AUTH_INVITE:
+        {
+            P2P_AUTH_INVITE_CMD auth_invite_cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&auth_invite_cmd, userdata,sizeof(P2P_AUTH_INVITE_CMD))) {
+                ret = -EFAULT;
+            } else {
+                if (p2p_auth_invite(A_WMI_GET_P2P_CTX(arPriv),
+                                    auth_invite_cmd.auth,
+                                    (A_UINT8 *)&(auth_invite_cmd.peer_addr)) != A_OK) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_SDPD_TX_CMD:
+        ret = ar6000_xioctl_wmi_p2p_sdpdtx(arPriv, userdata, rq);
+        break;
+
+        case AR6000_XIOTCL_WMI_P2P_SD_CANCEL_REQUEST:
+        {
+            A_UINT32 qid;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&qid, userdata, sizeof(qid))) {
+                ret = -EFAULT;
+            } else if (p2p_sd_cancel_request(A_WMI_GET_P2P_CTX(arPriv),qid) !=
+                        A_OK) {
+                ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_GET_P2P_IE:
+        {
+            A_UINT8 buf[12];
+            const A_UINT8 zero_mac[] = {0,0,0,0,0,0};
+            A_UINT8 * p2p_buf = NULL;
+            A_UINT8  p2p_buf_len = 0;
+
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(buf, userdata, 12)) {
+                ret = -EFAULT;
+            } else {
+
+                if (p2p_peer(A_WMI_GET_P2P_CTX(arPriv),
+                        buf, *(buf+6)) == A_OK) {
+             
+                     p2p_get_device_p2p_buf(A_WMI_GET_P2P_CTX(arPriv),buf, &p2p_buf, &p2p_buf_len);
+
+                    if(p2p_buf) {
+                        *((A_UINT8 *)rq->ifr_data) = p2p_buf_len;
+
+                        if(copy_to_user(((A_UINT8 *)(rq->ifr_data)+1),
+                                        p2p_buf, p2p_buf_len)) {
+                            ret = -EFAULT;
+                        }
+                    }
+                } else {
+                    if(copy_to_user((A_UINT16 *)rq->ifr_data, 
+                                zero_mac, IEEE80211_ADDR_LEN)) {
+                        ret = -EFAULT;
+                    }
+                }
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_P2P_GET_OWN_INFO:
+        {
+            A_UINT8 buf[200];
+            A_UINT8 buf_len = 0;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else {
+                buf_len = p2p_get_own_info(A_WMI_GET_P2P_CTX(arPriv),buf, sizeof(buf));
+                *((A_UINT8 *)rq->ifr_data) = buf_len;
+                if(copy_to_user(((A_UINT8 *)(rq->ifr_data)+1),
+                                buf, buf_len)) {
+                    ret = -EFAULT;
+                }
+                
+            }
+            break;
+        }
+#endif /* P2P */
+
+#ifdef CONFIG_PM
+        case AR6000_XIOCTL_SET_BT_HW_POWER_STATE:
+        {
+            unsigned int state;
+            get_user(state, (unsigned int *)userdata);
+            if (ar6000_set_bt_hw_state(ar, state)!=A_OK) {
+                ret = -EIO;
+            }       
+            break;
+        }
+        case AR6000_XIOCTL_GET_BT_HW_POWER_STATE:
+            rq->ifr_ifru.ifru_ivalue = !ar->arBTOff; /* return value */
+            break;
+#endif
+
+    case AR6000_XIOCTL_WMI_SET_TX_SGI_PARAM:
+    {   
+            WMI_SET_TX_SGI_PARAM_CMD SGICmd;
+        
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&SGICmd, userdata,
+                                      sizeof(SGICmd))){
+                ret = -EFAULT;
+            } else{
+                    if (wmi_SGI_cmd(arPriv->arWmi, SGICmd.sgiMask, SGICmd.sgiPERThreshold) != A_OK) {
+                        ret = -EIO;
+                    }
+
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_SET_PASSPHRASE:
+        {
+            ret = ar6000_xioctl_set_passphrase_cmd(dev, userdata);
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_SET_EXCESS_TX_RETRY_THRES:
+        {
+            ret = ar6000_xioctl_set_excess_tx_retry_thres_cmd(dev, userdata);
+            break;
+        }
+#ifdef WAC
+        case AR6000_XIOCTL_WMI_ENABLE_WAC_PARAM:
+        {
+            WMI_WAC_ENABLE_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if ( cmd.enable & 0x80 ) {
+                    cmd.enable &= ~0x80;
+                    ar6000_send_generic_event_to_app(arPriv, WMI_ENABLE_WAC_CMDID, 
+                                                    (A_UINT8*)&cmd, sizeof(WMI_WAC_ENABLE_CMD));
+                }
+                else {
+                    if (wmi_wac_enable_cmd(arPriv->arWmi, &cmd)
+                           != A_OK)
+                    {
+                        ret = -EIO;
+                    }
+                }
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_WAC_SCAN_REPLY:
+        {
+            WMI_WAC_SCAN_REPLY_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if (wmi_wac_scan_reply_cmd(arPriv->arWmi, cmd.cmdid)
+                       != A_OK)
+                {
+                    ret = -EIO;
+                }
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_WAC_CTRL_REQ:
+        {
+            WMI_WAC_CTRL_REQ_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd)))
+            {
+                ret = -EFAULT;
+            } else {
+                if ( WAC_SET == cmd.req ) {
+                    if (wmi_wac_ctrl_req_cmd(arPriv->arWmi, &cmd)
+                           != A_OK)
+                    {
+                        ret = -EIO;
+                    }
+                }
+                else if ( WAC_GET == cmd.req ) {
+                    ret = ar6000_xioctl_wac_ctrl_req_get_cmd(dev, userdata, rq);
+                }
+            }
+            break;
+        }
+#endif
+        case AR6000_XIOCTL_WMI_SET_WPA_OFFLOAD_STATE:
+        {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+            A_UINT8 wpaOffloadState = 0;
+
+            if (copy_from_user(&wpaOffloadState, userdata, sizeof(A_UINT8))) {
+                ret = -EFAULT;
+            } else {
+                arSta->wpaOffloadEnabled = (wpaOffloadState) ? TRUE : FALSE;
+            }
+#else
+            ret = -EOPNOTSUPP;
+#endif /* LINUX_VERSION_CODE >= 2.6.27 */
+            break;
+        }
+        case AR6000_XIOCTL_BMI_NVRAM_PROCESS:
+        {
+            A_UCHAR seg_name[BMI_NVRAM_SEG_NAME_SZ+1];
+            A_UINT32 rv = 0;
+
+            if (copy_from_user(seg_name, userdata, sizeof(seg_name))) {
+                ret = -EFAULT;
+                break;
+            }
+
+            seg_name[BMI_NVRAM_SEG_NAME_SZ] = '\0';
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("Process NVRAM segment: %s\n", seg_name));
+
+            if (BMInvramProcess(hifDevice, seg_name, &rv) != A_OK) {
+                ret = -EIO;
+            }
+            put_user(rv, (unsigned int *)rq->ifr_data); /* return value */
+
+            break;
+        }
+
+        case AR6000_XIOCTL_AP_ACS_POLICY:
+        {
+            A_UINT32    acs;
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&acs, userdata, sizeof(acs))) {
+                ret = -EFAULT;
+            } else {
+                ar->arAcsPolicy = acs;
+            }
+            break;
+        }
+
+        case AR6000_XIOCTL_WMI_FORCE_ASSERT:
+        {
+            if (wmi_force_target_assert(arPriv->arWmi) != A_OK)
+            {
+                    ret = -EIO;
+            }
+            break;
+        }
+        
+        case AR6000_XIOCTL_WMI_SET_DIVERSITY_PARAM:
+        {
+            WMI_DIV_PARAMS_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(cmd)))
+            {
+                ret = -EFAULT;
+            } else 
+            {
+                   if (wmi_set_div_param_cmd(arPriv->arWmi, cmd.divIdleTime, cmd.antRssiThresh, cmd.divEnable, cmd.active_treshold_rate)
+                           != A_OK)
+                    {
+                        ret = -EIO;
+                    }
+
+            }
+            break;
+        }
+        case AR6000_XIOCTL_AP_GET_NUM_STA:
+        {
+            A_UINT8    num_sta, ret_num_sta;
+            
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&num_sta, userdata, sizeof(num_sta))) {
+                ret = -EFAULT;
+            } else {
+                if(num_sta & 0x80) {
+                    ret_num_sta = ar->gNumSta;
+                } else {
+                    ret_num_sta = arPriv->num_sta;
+                }
+                if(copy_to_user((A_UINT8 *)rq->ifr_data,
+                                    &ret_num_sta, sizeof(A_UINT8))) {
+                    ret = -EFAULT;
+                }
+            }
+            break;
+        }
+#ifdef CONFIG_PM
+        case AR6000_XIOCTL_SUSPEND_DRIVER:
+        {
+            ar6000_suspend_ev(ar);
+            break;
+        }
+        case AR6000_XIOCTL_RESUME_DRIVER:
+        {
+            ar6000_resume_ev(ar);
+            break;
+        }
+#endif
+        case AR6000_XIOCTL_GET_SUBMODE:
+        {
+            if (copy_to_user((A_UINT8 *)rq->ifr_data, &arPriv->arNetworkSubType,
+                             sizeof(A_UINT8)))
+            {
+                ret = -EFAULT;
+            }
+            break;
+        }
+        case AR6000_XIOCTL_WMI_AP_SET_APSD:
+        {
+            WMI_AP_SET_APSD_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(WMI_AP_SET_APSD_CMD))) {
+                ret = -EFAULT;
+            } else  { 
+                  if(wmi_ap_set_apsd(arPriv->arWmi, cmd.enable) != A_OK) {
+                      ret = -EIO;
+                  } else {
+                      arPriv->ap_profile_flag = 1; /* There is a change in profile */
+                  }
+            } 
+            break;
+        }
+        case AR6000_XIOCTL_WMI_LTE_FREQ:
+        {
+            WMI_LTE_FREQ_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(WMI_LTE_FREQ_CMD))) {
+                ret = -EFAULT;
+            } else  {
+                ar6000_ap_handle_lte_freq(ar, arPriv, cmd.freq);
+            } 
+            break;
+        }
+        case AR6000_XIOCTL_WMI_AP_IDLE_CLOSE_TIME:
+        {
+            WMI_AP_IDLE_CLOSE_TIME_CMD cmd;
+
+            if (ar->arWmiReady == FALSE) {
+                ret = -EIO;
+            } else if (copy_from_user(&cmd, userdata, sizeof(WMI_AP_IDLE_CLOSE_TIME_CMD))) {
+                ret = -EFAULT;
+            } else  {
+                wmi_ap_set_idle_close_time(arPriv->arWmi, cmd.time_val_sec);
+            } 
+            break;
+        }
+#ifdef HS20_ENABLE
+        case AR6000_XIOCTL_WMI_SEND_FRAME:
+        {
+            A_UINT8           appIeInfo[IEEE80211_APPIE_FRAME_MAX_LEN];
+            A_UINT16          ieLen;
+
+            if(ar->arWmiReady == FALSE) {
+                ret = -EIO;
+                goto ioctl_done;
+            }
+            get_user(ieLen, (A_UINT16 *)(userdata));
+            ieLen += 8;
+
+            AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("HS20IE: Len-%d\n", ieLen));
+            if (ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
+                ret = -EIO;
+                break;
+            }
+            if (copy_from_user(appIeInfo, userdata, ieLen)) {
+                ret = -EFAULT;
+            }
+ 
+            if (wmi_send_action_frame_cmd(arPriv->arWmi,
+                                 ieLen, appIeInfo) != A_OK) {
+                ret = -EIO;
+            }
+            break;
+        }
+#endif        
+        default:
+            ret = -EOPNOTSUPP;
+    }
+
+ioctl_done:
+    rtnl_lock(); /* restore rtnl state */
+    dev_put(dev);
+
+    return ret;
+}
+
+A_UINT8 mac_cmp_wild(A_UINT8 *mac, A_UINT8 *new_mac, A_UINT8 wild, A_UINT8 new_wild)
+{
+    A_UINT8 i;
+
+    for(i=0;i<ATH_MAC_LEN;i++) {
+        if((wild & 1<<i) && (new_wild & 1<<i)) continue;
+        if(mac[i] != new_mac[i]) return 1;
+    }
+    if((A_MEMCMP(new_mac, null_mac, 6)==0) && new_wild &&
+        (wild != new_wild)) {
+        return 1;
+    }
+
+    return 0;
+}
+
+A_UINT8    acl_add_del_mac(WMI_AP_ACL *a, WMI_AP_ACL_MAC_CMD *acl)
+{
+    A_INT8    already_avail=-1, free_slot=-1, i;
+
+    /* To check whether this mac is already there in our list */
+    for(i=AP_ACL_SIZE-1;i>=0;i--)
+    {
+        if(mac_cmp_wild(a->acl_mac[i], acl->mac, a->wildcard[i],
+            acl->wildcard)==0)
+                already_avail = i;
+
+        if(!((1 << i) & a->index))
+            free_slot = i;
+    }
+
+    if(acl->action == ADD_MAC_ADDR)
+    {
+        /* Dont add mac if it is already available */
+        if((already_avail >= 0) || (free_slot == -1))
+            return 0;
+
+        A_MEMCPY(a->acl_mac[free_slot], acl->mac, ATH_MAC_LEN);
+        a->index = a->index | (1 << free_slot);
+        acl->index = free_slot;
+        a->wildcard[free_slot] = acl->wildcard;
+        return 1;
+    }
+    else if(acl->action == DEL_MAC_ADDR)
+    {
+        if(acl->index >= AP_ACL_SIZE)
+            return 0;
+
+        if(!(a->index & (1 << acl->index)))
+            return 0;
+
+        A_MEMZERO(a->acl_mac[acl->index],ATH_MAC_LEN);
+        a->index = a->index & ~(1 << acl->index);
+        a->wildcard[acl->index] = 0;
+        return 1;
+    }
+
+    return 0;
+}
+
+void
+ar6000_send_delba (void *context, A_UINT8 reasonCode)
+{       
+    AR_SOFTC_T *ar= (AR_SOFTC_T *)context;
+    AR_SOFTC_DEV_T *arTempPriv = NULL;
+    A_UINT8 i=0;
+
+    if (ar == NULL) {
+        return;
+     }
+    
+    for(i=0;i<ar->arConfNumDev;i++){
+         arTempPriv = ar->arDev[i];
+         if(AP_NETWORK == arTempPriv->arNetworkType) {
+            break; 
+          }
+     }	    
+    
+    if (REASON_TEAR_DOWN == reasonCode)
+    {
+        wmi_allow_aggr_cmd (arTempPriv->arWmi, 0xFF, 0);
+    }
+    
+    if (REASON_DELBA_TIMEOUT == reasonCode)
+    {
+        wmi_allow_aggr_cmd (arTempPriv->arWmi, 0xFF, 0xFF);
+    }
+        
+    for (i = 0; i < NUM_CONN; i++)
+    {
+        if (NULL != ar->connTbl[i].conn_aggr && arTempPriv == ar->connTbl[i].arPriv 
+	    && ar->connTbl[i].HT_present)
+        {
+            aggr_delba_request (ar->connTbl[i].conn_aggr, (struct wmi_t *)arTempPriv->arWmi, ar->connTbl[i].aid, reasonCode);
+        }
+    }
+
+}
+
diff --git a/host/os/linux/netbuf.c b/host/os/linux/netbuf.c
new file mode 100644
index 0000000..963b99e
--- /dev/null
+++ b/host/os/linux/netbuf.c
@@ -0,0 +1,272 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+#include <linux/kernel.h>
+#include <linux/skbuff.h>
+#include <a_config.h>
+#include "athdefs.h"
+#include "a_types.h"
+#include "a_osapi.h"
+#include "htc_packet.h"
+
+#define AR6000_DATA_OFFSET    64
+
+void a_netbuf_enqueue(A_NETBUF_QUEUE_T *q, void *pkt)
+{
+    skb_queue_tail((struct sk_buff_head *) q, (struct sk_buff *) pkt);
+}
+
+void a_netbuf_prequeue(A_NETBUF_QUEUE_T *q, void *pkt)
+{
+    skb_queue_head((struct sk_buff_head *) q, (struct sk_buff *) pkt);
+}
+
+void *a_netbuf_dequeue(A_NETBUF_QUEUE_T *q)
+{
+    return((void *) skb_dequeue((struct sk_buff_head *) q));
+}
+
+int a_netbuf_queue_size(A_NETBUF_QUEUE_T *q)
+{
+    return(skb_queue_len((struct sk_buff_head *) q));
+}
+
+int a_netbuf_queue_empty(A_NETBUF_QUEUE_T *q)
+{
+    return(skb_queue_empty((struct sk_buff_head *) q));
+}
+
+void a_netbuf_queue_init(A_NETBUF_QUEUE_T *q)
+{
+    skb_queue_head_init((struct sk_buff_head *) q);
+}
+
+#ifdef AR6K_ALLOC_DEBUG
+void *
+a_netbuf_alloc(int size, const char *func, int lineno)
+#else
+void *
+a_netbuf_alloc(int size)
+#endif
+{
+    struct sk_buff *skb;
+    size += 2 * (A_GET_CACHE_LINE_BYTES()); /* add some cacheline space at front and back of buffer */
+    skb = dev_alloc_skb(AR6000_DATA_OFFSET + sizeof(HTC_PACKET) + size);
+    if (skb) {
+        skb_reserve(skb, AR6000_DATA_OFFSET + sizeof(HTC_PACKET) + A_GET_CACHE_LINE_BYTES());    
+#ifdef AR6K_ALLOC_DEBUG
+        __a_meminfo_add(skb, size, func, lineno);
+#endif
+    }
+    return ((void *)skb);
+}
+
+/*
+ * Allocate an SKB w.o. any encapsulation requirement.
+ */
+#ifdef AR6K_ALLOC_DEBUG
+void *
+a_netbuf_alloc_raw(int size, const char *func, int lineno)
+#else
+void *
+a_netbuf_alloc_raw(int size)
+#endif
+{
+    struct sk_buff *skb;
+
+    skb = dev_alloc_skb(size);
+#ifdef AR6K_ALLOC_DEBUG
+    __a_meminfo_add(skb, size, func, lineno);
+#endif
+    return ((void *)skb);
+}
+
+void
+a_netbuf_free(void *bufPtr)
+{
+    struct sk_buff *skb = (struct sk_buff *)bufPtr;
+#ifdef AR6K_ALLOC_DEBUG
+    a_meminfo_del(bufPtr);
+#endif
+    dev_kfree_skb(skb);
+}
+
+A_UINT32
+a_netbuf_to_len(void *bufPtr)
+{
+    return (((struct sk_buff *)bufPtr)->len);
+}
+
+void *
+a_netbuf_to_data(void *bufPtr)
+{
+    return (((struct sk_buff *)bufPtr)->data);
+}
+
+/*
+ * Add len # of bytes to the beginning of the network buffer
+ * pointed to by bufPtr
+ */
+A_STATUS
+a_netbuf_push(void *bufPtr, A_INT32 len)
+{
+    skb_push((struct sk_buff *)bufPtr, len);
+
+    return A_OK;
+}
+
+/*
+ * Add len # of bytes to the beginning of the network buffer
+ * pointed to by bufPtr and also fill with data
+ */
+A_STATUS
+a_netbuf_push_data(void *bufPtr, char *srcPtr, A_INT32 len)
+{
+    skb_push((struct sk_buff *) bufPtr, len);
+    A_MEMCPY(((struct sk_buff *)bufPtr)->data, srcPtr, len);
+
+    return A_OK;
+}
+
+/*
+ * Add len # of bytes to the end of the network buffer
+ * pointed to by bufPtr
+ */
+A_STATUS
+a_netbuf_put(void *bufPtr, A_INT32 len)
+{
+    skb_put((struct sk_buff *)bufPtr, len);
+
+    return A_OK;
+}
+
+/*
+ * Add len # of bytes to the end of the network buffer
+ * pointed to by bufPtr and also fill with data
+ */
+A_STATUS
+a_netbuf_put_data(void *bufPtr, char *srcPtr, A_INT32 len)
+{
+    char *start = (char*)(((struct sk_buff *)bufPtr)->data +
+        ((struct sk_buff *)bufPtr)->len);
+    skb_put((struct sk_buff *)bufPtr, len);
+    A_MEMCPY(start, srcPtr, len);
+
+    return A_OK;
+}
+
+
+/*
+ * Trim the network buffer pointed to by bufPtr to len # of bytes 
+ */
+A_STATUS
+a_netbuf_setlen(void *bufPtr, A_INT32 len)
+{
+    skb_trim((struct sk_buff *)bufPtr, len);
+
+    return A_OK;
+}
+
+/*
+ * Chop of len # of bytes from the end of the buffer.
+ */
+A_STATUS
+a_netbuf_trim(void *bufPtr, A_INT32 len)
+{
+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
+    return A_OK;
+}
+
+/*
+ * Chop of len # of bytes from the end of the buffer and return the data.
+ */
+A_STATUS
+a_netbuf_trim_data(void *bufPtr, char *dstPtr, A_INT32 len)
+{
+    char *start = (char*)(((struct sk_buff *)bufPtr)->data +
+        (((struct sk_buff *)bufPtr)->len - len));
+    
+    A_MEMCPY(dstPtr, start, len);
+    skb_trim((struct sk_buff *)bufPtr, ((struct sk_buff *)bufPtr)->len - len);
+
+    return A_OK;
+}
+
+
+/*
+ * Returns the number of bytes available to a a_netbuf_push()
+ */
+A_INT32
+a_netbuf_headroom(void *bufPtr)
+{
+    return (skb_headroom((struct sk_buff *)bufPtr));
+}
+
+/*
+ * Removes specified number of bytes from the beginning of the buffer
+ */
+A_STATUS
+a_netbuf_pull(void *bufPtr, A_INT32 len)
+{
+    skb_pull((struct sk_buff *)bufPtr, len);
+
+    return A_OK;
+}
+
+/*
+ * Removes specified number of bytes from the beginning of the buffer
+ * and return the data
+ */
+A_STATUS
+a_netbuf_pull_data(void *bufPtr, char *dstPtr, A_INT32 len)
+{
+    A_MEMCPY(dstPtr, ((struct sk_buff *)bufPtr)->data, len);
+    skb_pull((struct sk_buff *)bufPtr, len);
+
+    return A_OK;
+}
+
+
+#ifdef AR6K_ALLOC_DEBUG
+void a_netbuf_check(void *bufPtr, const char *func, int lineno)
+{
+    struct sk_buff *skb = (struct sk_buff *)bufPtr;
+    A_UINT32 len;
+    A_BOOL found = FALSE; 
+    found = a_meminfo_find(skb); 
+
+    if (found == FALSE) 
+    {
+        len = A_NETBUF_LEN(skb);
+        __a_meminfo_add(skb, len, func, lineno);
+    }
+}
+#endif
+
+#ifdef EXPORT_HCI_BRIDGE_INTERFACE
+EXPORT_SYMBOL(a_netbuf_to_data);
+EXPORT_SYMBOL(a_netbuf_put);
+EXPORT_SYMBOL(a_netbuf_pull);
+EXPORT_SYMBOL(a_netbuf_alloc);
+EXPORT_SYMBOL(a_netbuf_free);
+#endif
diff --git a/host/os/linux/wireless_ext.c b/host/os/linux/wireless_ext.c
new file mode 100644
index 0000000..571ec02
--- /dev/null
+++ b/host/os/linux/wireless_ext.c
@@ -0,0 +1,3389 @@
+//------------------------------------------------------------------------------
+// Copyright (c) 2004-2010 Atheros Communications Inc.
+// All rights reserved.
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+//
+// Author(s): ="Atheros"
+//------------------------------------------------------------------------------
+
+#include "ar6000_drv.h"
+#include "wlan_config.h"
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+#define IWE_STREAM_ADD_EVENT(p1, p2, p3, p4, p5) \
+    iwe_stream_add_event((p1), (p2), (p3), (p4), (p5))
+#else
+#define IWE_STREAM_ADD_EVENT(p1, p2, p3, p4, p5) \
+    iwe_stream_add_event((p2), (p3), (p4), (p5))
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+#define IWE_STREAM_ADD_POINT(p1, p2, p3, p4, p5) \
+    iwe_stream_add_point((p1), (p2), (p3), (p4), (p5))
+#else
+#define IWE_STREAM_ADD_POINT(p1, p2, p3, p4, p5) \
+    iwe_stream_add_point((p2), (p3), (p4), (p5))
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+#define IWE_STREAM_ADD_VALUE(p1, p2, p3, p4, p5, p6) \
+    iwe_stream_add_value((p1), (p2), (p3), (p4), (p5), (p6))
+#else
+#define IWE_STREAM_ADD_VALUE(p1, p2, p3, p4, p5, p6) \
+    iwe_stream_add_value((p2), (p3), (p4), (p5), (p6))
+#endif
+
+static void ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi);
+extern unsigned int wmitimeout;
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+extern unsigned int first_scan_2g_only;
+#endif
+extern unsigned int psm_info;
+
+#if WIRELESS_EXT > 14
+/*
+ * Encode a WPA or RSN information element as a custom
+ * element using the hostap format.
+ */
+static u_int
+encode_ie(void *buf, size_t bufsize,
+    const u_int8_t *ie, size_t ielen,
+    const char *leader, size_t leader_len)
+{
+    u_int8_t *p;
+    int i;
+
+    if (bufsize < leader_len)
+        return 0;
+    p = buf;
+    memcpy(p, leader, leader_len);
+    bufsize -= leader_len;
+    p += leader_len;
+    for (i = 0; i < ielen && bufsize > 2; i++)
+    {
+        p += snprintf((char*)p, bufsize, "%02x", ie[i]);
+        bufsize -= 2;
+    }
+    return (i == ielen ? p - (u_int8_t *)buf : 0);
+}
+#endif /* WIRELESS_EXT > 14 */
+
+static A_UINT8
+get_bss_phy_capability(bss_t *bss)
+{
+    A_UINT8 capability = 0;
+    struct ieee80211_common_ie *cie = &bss->ni_cie;
+#define CHAN_IS_11A(x)              (!((x >= 2412) && (x <= 2484)))
+    if (CHAN_IS_11A(cie->ie_chan)) {
+        if (cie->ie_htcap) {
+            capability = WMI_11NA_CAPABILITY;
+        } else {
+            capability = WMI_11A_CAPABILITY;
+        }
+    } else if ((cie->ie_erp) || (cie->ie_xrates)) {
+        if (cie->ie_htcap) {
+            capability = WMI_11NG_CAPABILITY;
+        } else {
+            capability = WMI_11G_CAPABILITY;
+        }
+    }
+    return capability;
+}
+
+void
+ar6000_scan_node(void *arg, bss_t *ni)
+{
+    struct iw_event iwe;
+#if WIRELESS_EXT > 14
+    char buf[256];
+#endif
+    struct ar_giwscan_param *param;
+    A_CHAR *current_ev;
+    A_CHAR *end_buf;
+    struct ieee80211_common_ie  *cie;
+    A_CHAR *current_val;
+    A_INT32 j;
+    A_UINT32 rate_len, data_len = 0;
+
+    /* Node table now contains entries from P2P Action frames and Probe Request also. Return
+     * if the frame type is an action frame/ Probe request.
+     */
+    if ((ni->ni_frametype == ACTION_MGMT_FTYPE) ||  (ni->ni_frametype == PROBEREQ_FTYPE) || (ni->ni_buf == NULL)) {
+        return;
+    }
+
+    param = (struct ar_giwscan_param *)arg;
+
+    current_ev = param->current_ev;
+    end_buf = param->end_buf;
+
+    cie = &ni->ni_cie;
+    if (cie == NULL) {
+        return;
+    }
+
+    if ((end_buf - current_ev) > IW_EV_ADDR_LEN)
+    {
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = SIOCGIWAP;
+        iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+        A_MEMCPY(iwe.u.ap_addr.sa_data, ni->ni_macaddr, 6);
+        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
+                                          &iwe, IW_EV_ADDR_LEN);
+    }
+    param->bytes_needed += IW_EV_ADDR_LEN;
+
+    /* EV92904 cie->ie_ssid can be NULL */
+    if (cie->ie_ssid) {
+    data_len = cie->ie_ssid[1] + IW_EV_POINT_LEN;
+    } else {
+        data_len = IW_EV_POINT_LEN;
+    }
+
+    if ((end_buf - current_ev) > data_len)
+    {
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = SIOCGIWESSID;
+        iwe.u.data.flags = 1;
+        if (cie->ie_ssid) {
+        iwe.u.data.length = cie->ie_ssid[1];
+        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                          &iwe, (char*)&cie->ie_ssid[2]);
+        } else {
+            iwe.u.data.length = 0;
+            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                              &iwe, (char*)"");
+        }
+    }
+    param->bytes_needed += data_len;
+
+    if (cie->ie_capInfo & (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) {
+        if ((end_buf - current_ev) > IW_EV_UINT_LEN)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = SIOCGIWMODE;
+            iwe.u.mode = cie->ie_capInfo & IEEE80211_CAPINFO_ESS ?
+                         IW_MODE_MASTER : IW_MODE_ADHOC;
+            current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
+                                              &iwe, IW_EV_UINT_LEN);
+        }
+        param->bytes_needed += IW_EV_UINT_LEN;
+    }
+
+    if ((end_buf - current_ev) > IW_EV_FREQ_LEN)
+    {
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = cie->ie_chan * 100000;
+        iwe.u.freq.e = 1;
+        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
+                                          &iwe, IW_EV_FREQ_LEN);
+    }
+    param->bytes_needed += IW_EV_FREQ_LEN;
+
+    if ((end_buf - current_ev) > IW_EV_QUAL_LEN)
+    {
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = IWEVQUAL;
+        ar6000_set_quality(&iwe.u.qual, ni->ni_snr);
+        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
+                                          &iwe, IW_EV_QUAL_LEN);
+    }
+    param->bytes_needed += IW_EV_QUAL_LEN;
+
+    if ((end_buf - current_ev) > IW_EV_POINT_LEN)
+    {
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = SIOCGIWENCODE;
+        if (cie->ie_capInfo & IEEE80211_CAPINFO_PRIVACY) {
+            iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+        } else {
+            iwe.u.data.flags = IW_ENCODE_DISABLED;
+        }
+        iwe.u.data.length = 0;
+        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                          &iwe, "");
+    }
+    param->bytes_needed += IW_EV_POINT_LEN;
+
+    /* supported bit rate */
+    if ((cie->ie_rates != NULL) || (cie->ie_xrates != NULL)) {
+    A_MEMZERO(&iwe, sizeof(iwe));
+    iwe.cmd = SIOCGIWRATE;
+    iwe.u.bitrate.fixed = 0;
+    iwe.u.bitrate.disabled = 0;
+    iwe.u.bitrate.value = 0;
+    current_val = current_ev + IW_EV_LCP_LEN;
+    param->bytes_needed += IW_EV_LCP_LEN;
+
+    if (cie->ie_rates != NULL) {
+        rate_len = cie->ie_rates[1];
+        data_len = (rate_len * (IW_EV_PARAM_LEN - IW_EV_LCP_LEN));
+        if ((end_buf - current_ev) > data_len)
+        {
+            for (j = 0; j < rate_len; j++) {
+                    unsigned char val;
+                    val = cie->ie_rates[2 + j];
+                    iwe.u.bitrate.value =
+                        (val >= 0x80)? ((val - 0x80) * 500000): (val * 500000);
+                    current_val = IWE_STREAM_ADD_VALUE(param->info, current_ev,
+                                                       current_val, end_buf,
+                                                       &iwe, IW_EV_PARAM_LEN);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+
+    if (cie->ie_xrates != NULL) {
+        rate_len = cie->ie_xrates[1];
+        data_len = (rate_len * (IW_EV_PARAM_LEN - IW_EV_LCP_LEN));
+        if ((end_buf - current_ev) > data_len)
+        {
+            for (j = 0; j < rate_len; j++) {
+                    unsigned char val;
+                    val = cie->ie_xrates[2 + j];
+                    iwe.u.bitrate.value =
+                        (val >= 0x80)? ((val - 0x80) * 500000): (val * 500000);
+                    current_val = IWE_STREAM_ADD_VALUE(param->info, current_ev,
+                                                       current_val, end_buf,
+                                                       &iwe, IW_EV_PARAM_LEN);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+    /* remove fixed header if no rates were added */
+    if ((current_val - current_ev) > IW_EV_LCP_LEN)
+        current_ev = current_val;
+    }
+
+#if WIRELESS_EXT >= 18
+    /* IE */
+    if (cie->ie_wpa != NULL) {
+        data_len = cie->ie_wpa[1] + 2 + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVGENIE;
+            iwe.u.data.length = cie->ie_wpa[1] + 2;
+            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                              &iwe, (char*)cie->ie_wpa);
+        }
+        param->bytes_needed += data_len;
+    }
+
+    if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
+        data_len = cie->ie_rsn[1] + 2 + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVGENIE;
+            iwe.u.data.length = cie->ie_rsn[1] + 2;
+            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                              &iwe, (char*)cie->ie_rsn);
+        }
+        param->bytes_needed += data_len;
+    }
+
+#endif /* WIRELESS_EXT >= 18 */
+
+    if ((end_buf - current_ev) > IW_EV_CHAR_LEN)
+    {
+        /* protocol */
+        A_MEMZERO(&iwe, sizeof(iwe));
+        iwe.cmd = SIOCGIWNAME;
+        switch (get_bss_phy_capability(ni)) {
+        case WMI_11A_CAPABILITY:
+            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11a");
+            break;
+        case WMI_11G_CAPABILITY:
+            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
+            break;
+        case WMI_11NA_CAPABILITY:
+            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11na");
+            break;
+        case WMI_11NG_CAPABILITY:
+            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11ng");
+            break;
+        default:
+            snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
+            break;
+        }
+        current_ev = IWE_STREAM_ADD_EVENT(param->info, current_ev, end_buf,
+                                          &iwe, IW_EV_CHAR_LEN);
+    }
+    param->bytes_needed += IW_EV_CHAR_LEN;
+
+#if WIRELESS_EXT > 14
+    A_MEMZERO(&iwe, sizeof(iwe));
+    iwe.cmd = IWEVCUSTOM;
+    iwe.u.data.length = snprintf(buf, sizeof(buf), "bcn_int=%d", cie->ie_beaconInt);
+    data_len = iwe.u.data.length + IW_EV_POINT_LEN;
+    if ((end_buf - current_ev) > data_len)
+    {
+        current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                          &iwe, buf);
+    }
+    param->bytes_needed += data_len;
+
+#if WIRELESS_EXT < 18
+    if (cie->ie_wpa != NULL) {
+        static const char wpa_leader[] = "wpa_ie=";
+        data_len = (sizeof(wpa_leader) - 1) + ((cie->ie_wpa[1]+2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wpa,
+                                          cie->ie_wpa[1]+2,
+                                          wpa_leader, sizeof(wpa_leader)-1);
+
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, 
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+
+    if (cie->ie_rsn != NULL && cie->ie_rsn[0] == IEEE80211_ELEMID_RSN) {
+        static const char rsn_leader[] = "rsn_ie=";
+        data_len = (sizeof(rsn_leader) - 1) + ((cie->ie_rsn[1]+2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_rsn,
+                                          cie->ie_rsn[1]+2,
+                                          rsn_leader, sizeof(rsn_leader)-1);
+
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, 
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+#endif /* WIRELESS_EXT < 18 */
+
+    if (cie->ie_wmm != NULL) {
+        static const char wmm_leader[] = "wmm_ie=";
+        data_len = (sizeof(wmm_leader) - 1) + ((cie->ie_wmm[1]+2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wmm,
+                                          cie->ie_wmm[1]+2,
+                                          wmm_leader, sizeof(wmm_leader)-1);
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+
+    if (cie->ie_ath != NULL) {
+        static const char ath_leader[] = "ath_ie=";
+        data_len = (sizeof(ath_leader) - 1) + ((cie->ie_ath[1]+2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_ath,
+                                          cie->ie_ath[1]+2,
+                                          ath_leader, sizeof(ath_leader)-1);
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+
+#ifdef WAPI_ENABLE
+    if (cie->ie_wapi != NULL) {
+        static const char wapi_leader[] = "wapi_ie=";
+        data_len = (sizeof(wapi_leader) - 1) + ((cie->ie_wapi[1] + 2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len) {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_wapi,
+                                      cie->ie_wapi[1] + 2,
+                                      wapi_leader, sizeof(wapi_leader) - 1);
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+#endif /* WAPI_ENABLE */
+
+#ifdef HS20_ENABLE
+    if (cie->ie_hs20 != NULL) {
+        static const char hs20_leader[] = "hs20_ie=";
+        data_len = (sizeof(hs20_leader) - 1) + ((cie->ie_hs20[1] + 2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len) {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_hs20,
+                                      cie->ie_hs20[1] + 2,
+                                      hs20_leader, sizeof(hs20_leader) - 1);
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+    if (cie->ie_extcap != NULL) {
+        static const char extcap_leader[] = "extcap_ie=";
+        data_len = (sizeof(extcap_leader) - 1) + ((cie->ie_extcap[1] + 2) * 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len) {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVCUSTOM;
+            iwe.u.data.length = encode_ie(buf, sizeof(buf), cie->ie_extcap,
+                                      cie->ie_extcap[1] + 2,
+                                      extcap_leader, sizeof(extcap_leader) - 1);
+            if (iwe.u.data.length != 0) {
+                current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev,
+                                                  end_buf, &iwe, buf);
+            }
+        }
+        param->bytes_needed += data_len;
+    }
+#endif
+#endif /* WIRELESS_EXT > 14 */
+
+#if WIRELESS_EXT >= 18
+    if (cie->ie_wsc != NULL) {
+        data_len = (cie->ie_wsc[1] + 2) + IW_EV_POINT_LEN;
+        if ((end_buf - current_ev) > data_len)
+        {
+            A_MEMZERO(&iwe, sizeof(iwe));
+            iwe.cmd = IWEVGENIE;
+            iwe.u.data.length = cie->ie_wsc[1] + 2;
+            current_ev = IWE_STREAM_ADD_POINT(param->info, current_ev, end_buf,
+                                              &iwe, (char*)cie->ie_wsc);
+        }
+        param->bytes_needed += data_len;
+    }
+#endif /* WIRELESS_EXT >= 18 */
+
+    param->current_ev = current_ev;
+}
+
+int
+ar6000_ioctl_giwscan(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_point *data, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    struct ar_giwscan_param param;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    param.current_ev = extra;
+    param.end_buf = extra + data->length;
+    param.bytes_needed = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+    param.info = info;
+#endif
+
+wmi_scan_report_lock(arPriv->arWmi);
+
+    /* Translate data to WE format */
+    wmi_iterate_nodes(arPriv->arWmi, ar6000_scan_node, &param);
+
+wmi_scan_report_unlock(arPriv->arWmi);
+
+    /* check if bytes needed is greater than bytes consumed */
+    if (data->length == 65535) {
+        param.bytes_needed = param.current_ev - extra;
+    } else {	
+        if (param.bytes_needed > data->length)
+    {
+        /* Request one byte more than needed, because when "data->length" equals bytes_needed,
+        it is not possible to add the last event data as all iwe_stream_add_xxxxx() functions
+        checks whether (cur_ptr + ev_len) < end_ptr, due to this one more retry would happen*/
+        data->length = param.bytes_needed + 1;
+
+        up(&ar->arSem);
+        return -E2BIG;
+    }
+    }
+
+    up(&ar->arSem);
+    return 0;
+}
+
+extern int reconnect_flag;
+/* SIOCSIWESSID */
+static int
+ar6000_ioctl_siwessid(struct net_device *dev,
+                     struct iw_request_info *info,
+                     struct iw_point *data, char *ssid)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_DEV_T *arTempPriv = NULL;
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    A_STATUS status;
+    A_UINT8     i=0;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+
+#if defined(WIRELESS_EXT)
+    if (WIRELESS_EXT > 20) {
+        data->length += 1;
+    }
+#endif
+    /* Handling AP-STA Concurrency */ 
+    if((ar->arConfNumDev > 1)) {
+        if ((data->flags) && 
+            (arPriv->arNetworkType == INFRA_NETWORK) && 
+            ((arPriv->arSsidLen != (data->length - 1)) ||
+                 (A_MEMCMP(arPriv->arSsid, ssid, arPriv->arSsidLen) != 0))){
+            for(i=0;i<ar->arConfNumDev;i++) {
+                arTempPriv = ar->arDev[i];
+                if((AP_NETWORK == arTempPriv->arNetworkType) &&
+                        (arTempPriv->arConnected) &&
+                        (arTempPriv->arNetworkSubType != SUBTYPE_NONE)) { 
+                         ar6000_disconnect(arPriv);
+                         /*Disconnect AP only in P2P mode*/
+                }
+            }
+        }
+    }
+    /*
+     * iwconfig passes a null terminated string with length including this
+     * so we need to account for this
+     */
+    if (data->flags && (!data->length || (data->length == 1) ||
+        ((data->length - 1) > sizeof(arPriv->arSsid))))
+    {
+        /*
+         * ssid is invalid
+         */
+        up(&ar->arSem);         
+        return -EINVAL;
+    }
+
+    if (arPriv->arNetworkType == AP_NETWORK) {
+        if(!data->flags) {
+            /* stop AP */
+			ar6000_disconnect(arPriv);
+            if(arPriv->arNetworkSubType == SUBTYPE_P2PGO) {
+                wait_event_interruptible_timeout(arPriv->arEvent, arPriv->arConnected == FALSE, wmitimeout * HZ);
+                if (signal_pending(current)) {
+                    return -EINTR;
+                }
+            }
+
+        } else if(A_MEMCMP(arPriv->arSsid,ssid,32) != 0) {
+            /* SSID change for AP network - Will take effect on commit */
+            arPriv->arSsidLen = data->length - 1;
+            A_MEMZERO(arPriv->arSsid, WMI_MAX_SSID_LEN);
+            A_MEMCPY(arPriv->arSsid, ssid, arPriv->arSsidLen);
+        }
+        arPriv->ap_profile_flag = 1; /* There is a change in profile */
+        arPriv->arConnected = FALSE;
+        up(&ar->arSem);
+        return 0;
+    }
+   
+    /* Added for bug 25178, return an IOCTL error instead of target returning
+       Illegal parameter error when either the BSSID or channel is missing
+       and we cannot scan during connect.
+     */
+    if (data->flags) {
+        if (arSta->arSkipScan == TRUE &&
+            (arPriv->arChannelHint == 0 ||
+             (!arSta->arReqBssid[0] && !arSta->arReqBssid[1] && !arSta->arReqBssid[2] &&
+              !arSta->arReqBssid[3] && !arSta->arReqBssid[4] && !arSta->arReqBssid[5])))
+        {
+            up(&ar->arSem);        
+            return -EINVAL;
+        }
+    }
+
+
+    if (ar->arTxPending[wmi_get_control_ep(arPriv->arWmi)]) {
+        /*
+         * sleep until the command queue drains
+         */
+        wait_event_interruptible_timeout(arPriv->arEvent,
+            ar->arTxPending[wmi_get_control_ep(arPriv->arWmi)] == 0, wmitimeout * HZ);
+        if (signal_pending(current)) {
+            up(&ar->arSem);
+            return -EINTR;
+        }
+    }
+
+  
+    if (!data->flags) {
+#ifdef ATH6K_CONFIG_CFG80211
+        if (arPriv->arConnected) {
+#endif /* ATH6K_CONFIG_CFG80211 */
+            ar6000_init_mode_info(arPriv);
+#ifdef ATH6K_CONFIG_CFG80211
+        }
+#endif /* ATH6K_CONFIG_CFG80211 */
+    }
+
+    if (((arPriv->arSsidLen) || 
+        ((arPriv->arSsidLen == 0) && (arPriv->arConnected || arSta->arConnectPending)) || 
+        (!data->flags)))
+    {
+        if ((!data->flags) ||
+            (A_MEMCMP(arPriv->arSsid, ssid, arPriv->arSsidLen) != 0) ||
+            (arPriv->arSsidLen != (data->length - 1)))
+        {
+            /*
+             * SSID set previously or essid off has been issued.
+             *
+             * Disconnect Command is issued in two cases after wmi is ready
+             * (1) ssid is different from the previous setting
+             * (2) essid off has been issued
+             *
+             */
+            if (ar->arWmiReady == TRUE) {
+                reconnect_flag = 0;
+                status = wmi_setPmkid_cmd(arPriv->arWmi, arPriv->arBssid, NULL, 0);
+                if(data->length) {
+                    /*AR6000 intiated disconnect due to profile change*/
+                    arPriv->arSta.arHostDisconnect = 1;
+                }
+                ar6000_disconnect(arPriv);
+                A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+                arPriv->arSsidLen = 0;
+                if (arSta->arSkipScan == FALSE) {
+                    A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+                }
+                if (!data->flags) {
+                    up(&ar->arSem);
+                    return 0;
+                }
+            } else {
+                 up(&ar->arSem);
+                 return -EIO;
+            }
+        }
+        else
+        {
+            /*
+             * SSID is same, so we assume profile hasn't changed.
+             * If the interface is up and wmi is ready, we issue
+             * a reconnect cmd. Issue a reconnect only we are already
+             * connected.
+             */
+            if((arPriv->arConnected == TRUE) && (ar->arWmiReady == TRUE))
+            {
+                reconnect_flag = TRUE;
+                status = wmi_reconnect_cmd(arPriv->arWmi,arSta->arReqBssid,
+                                           arPriv->arChannelHint);
+                up(&ar->arSem);
+                if (status != A_OK) {
+                    return -EIO;
+                }
+                return 0;
+            }
+            else{
+                /*
+                 * Dont return if connect is pending.
+                 */
+                if(!(arSta->arConnectPending)) {
+                    up(&ar->arSem);
+                    return 0;
+                }
+            }
+        }
+    }
+
+    arPriv->arSsidLen = data->length - 1;
+    A_MEMCPY(arPriv->arSsid, ssid, arPriv->arSsidLen);
+
+    if (ar6000_connect_to_ap(arPriv)!= A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }else{
+      up(&ar->arSem);
+    }
+    return 0;
+}
+
+/* SIOCGIWESSID */
+static int
+ar6000_ioctl_giwessid(struct net_device *dev,
+                     struct iw_request_info *info,
+                     struct iw_point *data, char *essid)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (!arPriv->arSsidLen) {
+        return -EINVAL;
+    }
+
+    data->flags = 1;
+    data->length = arPriv->arSsidLen;
+    A_MEMCPY(essid, arPriv->arSsid, arPriv->arSsidLen);
+
+    return 0;
+}
+
+
+void ar6000_install_static_wep_keys(AR_SOFTC_DEV_T *arPriv)
+{
+    A_UINT8 index;
+    A_UINT8 keyUsage;
+    AR_SOFTC_AP_T  *ap = &arPriv->arAp;
+
+    for (index = WMI_MIN_KEY_INDEX; index <= WMI_MAX_KEY_INDEX; index++) {
+        if (arPriv->arWepKeyList[index].arKeyLen) {
+            keyUsage = GROUP_USAGE;
+            if (index == arPriv->arDefTxKeyIndex) {
+                keyUsage |= TX_USAGE;
+            }
+            wmi_addKey_cmd(arPriv->arWmi,
+                           index,
+                           WEP_CRYPT,
+                           keyUsage,
+                           arPriv->arWepKeyList[index].arKeyLen,
+                           NULL,
+                           arPriv->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
+                           NO_SYNC_WMIFLAG);
+        }
+    }
+    ap->deKeySet = FALSE;
+}
+
+/*
+ * SIOCSIWRATE
+ */
+int
+ar6000_ioctl_siwrate(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    A_UINT32  kbps;
+    A_INT8  rate_idx;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if (rrq->fixed) {
+        kbps = rrq->value / 1000;           /* rrq->value is in bps */
+    } else {
+        kbps = -1;                          /* -1 indicates auto rate */
+    }
+    if(kbps != -1 && wmi_validate_bitrate(arPriv->arWmi, kbps, &rate_idx) != A_OK)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("BitRate is not Valid %d\n", kbps));
+        up(&ar->arSem);
+        return -EINVAL;
+    }
+    arPriv->arBitRate = kbps;
+    if(ar->arWmiReady == TRUE)
+    {
+        if (wmi_set_bitrate_cmd(arPriv->arWmi, kbps, -1, -1) != A_OK) {
+            up(&ar->arSem);
+            return -EINVAL;
+        }
+    }
+
+    up(&ar->arSem);	
+    return 0;
+}
+
+/*
+ * SIOCGIWRATE
+ */
+int
+ar6000_ioctl_giwrate(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    
+    int ret = 0;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if ((arPriv->arNextMode != AP_NETWORK && !arPriv->arConnected) || ar->arWmiReady == FALSE) {
+        rrq->value = 1000 * 1000;       
+        return 0;
+    }
+
+    if (arPriv->arBitRate!=-1 && arPriv->arBitRate!=0xFFFF) {
+        rrq->fixed = TRUE;
+        rrq->value = arPriv->arBitRate * 1000;
+        return 0;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    arPriv->arBitRate = 0xFFFF;
+    if (wmi_get_bitrate_cmd(arPriv->arWmi) != A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }
+    wait_event_interruptible_timeout(arPriv->arEvent, arPriv->arBitRate != 0xFFFF, wmitimeout * HZ);
+    if (signal_pending(current)) {
+        ret = -EINTR;
+    }
+    /* If the interface is down or wmi is not ready or the target is not
+       connected - return the value stored in the device structure */
+    if (!ret) {
+        if (arPriv->arBitRate == -1) {
+            rrq->fixed = TRUE;
+            rrq->value = 0;
+        } else {
+            rrq->fixed = FALSE;
+            rrq->value = arPriv->arBitRate * 1000;
+        }
+        arPriv->arBitRate = -1; /* clean it up for next query */
+    }
+
+    up(&ar->arSem);
+
+    return ret;
+}
+
+/*
+ * SIOCSIWTXPOW
+ */
+static int
+ar6000_ioctl_siwtxpow(struct net_device *dev,
+             struct iw_request_info *info,
+             struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    A_UINT8 dbM;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if (rrq->disabled) {
+        up(&ar->arSem);		
+        return -EOPNOTSUPP;
+    }
+
+    if (rrq->fixed) {
+        if (rrq->flags != IW_TXPOW_DBM) {
+            up(&ar->arSem);			
+            return -EOPNOTSUPP;
+        }
+        arPriv->arTxPwr= dbM = rrq->value;
+        arPriv->arTxPwrSet = TRUE;
+    } else {
+        arPriv->arTxPwr = dbM = 0;
+        arPriv->arTxPwrSet = FALSE;
+    }
+    if(ar->arWmiReady == TRUE)
+    {
+        AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_TX,("Set tx pwr cmd %d dbM\n", dbM));
+        wmi_set_txPwr_cmd(arPriv->arWmi, dbM);
+    }
+
+    up(&ar->arSem);	
+    return 0;
+}
+
+/*
+ * SIOCGIWTXPOW
+ */
+int
+ar6000_ioctl_giwtxpow(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    int ret = 0;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if((ar->arWmiReady == TRUE) && (arPriv->arConnected == TRUE))
+    {
+        arPriv->arTxPwr = 0;
+
+        if (wmi_get_txPwr_cmd(arPriv->arWmi) != A_OK) {
+            up(&ar->arSem);
+            return -EIO;
+        }
+
+        wait_event_interruptible_timeout(arPriv->arEvent, arPriv->arTxPwr != 0, wmitimeout * HZ);
+
+        if (signal_pending(current)) {
+            ret = -EINTR;
+         }
+    }
+   /* If the interace is down or wmi is not ready or target is not connected
+      then return value stored in the device structure */
+
+    if (!ret) {
+         if (arPriv->arTxPwrSet == TRUE) {
+            rrq->fixed = TRUE;
+        }
+        rrq->value = arPriv->arTxPwr;
+        rrq->flags = IW_TXPOW_DBM;
+        //
+        // IWLIST need this flag to get TxPower
+        //
+        rrq->disabled = 0;
+    }
+
+    up(&ar->arSem);
+
+    return ret;
+}
+
+/*
+ * SIOCSIWRETRY
+ * since iwconfig only provides us with one max retry value, we use it
+ * to apply to data frames of the BE traffic class.
+ */
+static int
+ar6000_ioctl_siwretry(struct net_device *dev,
+             struct iw_request_info *info,
+             struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if (rrq->disabled) {
+        up(&ar->arSem);		
+        return -EOPNOTSUPP;
+    }
+
+    if ((rrq->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT) {
+        up(&ar->arSem);		
+        return -EOPNOTSUPP;
+    }
+
+    if ( !(rrq->value >= WMI_MIN_RETRIES) || !(rrq->value <= WMI_MAX_RETRIES)) {
+            up(&ar->arSem);		
+            return - EINVAL;
+    }
+    if(ar->arWmiReady == TRUE)
+    {
+        if (wmi_set_retry_limits_cmd(arPriv->arWmi, DATA_FRAMETYPE, WMM_AC_BE,
+                                     rrq->value, 0) != A_OK){
+            up(&ar->arSem);
+            return -EINVAL;
+        }
+    }
+    arPriv->arMaxRetries = rrq->value;
+
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCGIWRETRY
+ */
+static int
+ar6000_ioctl_giwretry(struct net_device *dev,
+             struct iw_request_info *info,
+             struct iw_param *rrq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    rrq->disabled = 0;
+    switch (rrq->flags & IW_RETRY_TYPE) {
+    case IW_RETRY_LIFETIME:
+        return -EOPNOTSUPP;
+        break;
+    case IW_RETRY_LIMIT:
+        rrq->flags = IW_RETRY_LIMIT;
+        switch (rrq->flags & IW_RETRY_MODIFIER) {
+        case IW_RETRY_MIN:
+            rrq->flags |= IW_RETRY_MIN;
+            rrq->value = WMI_MIN_RETRIES;
+            break;
+        case IW_RETRY_MAX:
+            rrq->flags |= IW_RETRY_MAX;
+            rrq->value = arPriv->arMaxRetries;
+            break;
+        }
+        break;
+    }
+    return 0;
+}
+
+/*
+ * SIOCSIWENCODE
+ */
+static int
+ar6000_ioctl_siwencode(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *keybuf)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_AP_T  *ap     = &arPriv->arAp;
+
+    int index;
+    A_INT32 auth = 0;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if(arPriv->arNextMode != AP_NETWORK) {
+    /*
+     *  Static WEP Keys should be configured before setting the SSID
+     */
+    if (arPriv->arSsid[0] && erq->length) {
+        return -EIO;
+    }
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    index = erq->flags & IW_ENCODE_INDEX;
+
+    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
+                  ((index - 1) > WMI_MAX_KEY_INDEX)))
+    {
+        up(&ar->arSem);    
+        return -EIO;
+    }
+
+    if (erq->flags & IW_ENCODE_DISABLED) {
+        /*
+         * Encryption disabled
+         */
+        if (index) {
+            /*
+             * If key index was specified then clear the specified key
+             */
+            index--;
+            A_MEMZERO(arPriv->arWepKeyList[index].arKey,
+                      sizeof(arPriv->arWepKeyList[index].arKey));
+            arPriv->arWepKeyList[index].arKeyLen = 0;
+        }
+        arPriv->arDot11AuthMode       = OPEN_AUTH;
+        arPriv->arPairwiseCrypto      = NONE_CRYPT;
+        arPriv->arGroupCrypto         = NONE_CRYPT;
+        arPriv->arAuthMode            = WMI_NONE_AUTH;
+    } else {
+        /*
+         * Enabling WEP encryption
+         */
+        if (index) {
+            index--;                /* keyindex is off base 1 in iwconfig */
+        }
+
+        if (erq->flags & IW_ENCODE_OPEN) {
+            auth |= OPEN_AUTH;
+        }
+        if (erq->flags & IW_ENCODE_RESTRICTED) {
+            auth |= SHARED_AUTH;
+        }
+
+        if (!auth) {
+            auth = OPEN_AUTH;
+        }
+
+        if (!ap->deKeySet) {
+            arPriv->arDefTxKeyIndex = index;
+        }
+
+        if (erq->length) {
+            if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(erq->length)) {
+                up(&ar->arSem);
+                return -EIO;
+            }
+
+            A_MEMZERO(arPriv->arWepKeyList[index].arKey,
+                      sizeof(arPriv->arWepKeyList[index].arKey));
+            A_MEMCPY(arPriv->arWepKeyList[index].arKey, keybuf, erq->length);
+            arPriv->arWepKeyList[index].arKeyLen = erq->length;
+            arPriv->arDot11AuthMode       = auth;
+        } else {
+            if (arPriv->arWepKeyList[index].arKeyLen == 0) {
+                up(&ar->arSem);
+                return -EIO;
+            }
+            arPriv->arDefTxKeyIndex = index;
+
+            if(arPriv->arSsidLen && arPriv->arWepKeyList[index].arKeyLen) {
+                wmi_addKey_cmd(arPriv->arWmi,
+                               index,
+                               WEP_CRYPT,
+                               GROUP_USAGE | TX_USAGE,
+                               arPriv->arWepKeyList[index].arKeyLen,
+                               NULL,
+                               arPriv->arWepKeyList[index].arKey, KEY_OP_INIT_VAL, NULL,
+                               NO_SYNC_WMIFLAG);
+            }
+            ap->deKeySet = TRUE;
+        }
+
+        arPriv->arPairwiseCrypto      = WEP_CRYPT;
+        arPriv->arGroupCrypto         = WEP_CRYPT;
+        arPriv->arAuthMode            = WMI_NONE_AUTH;
+    }
+
+    if(arPriv->arNextMode != AP_NETWORK) {
+    /*
+     * profile has changed.  Erase ssid to signal change
+     */
+        A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+        arPriv->arSsidLen = 0;
+    }
+    arPriv->ap_profile_flag = 1; /* There is a change in profile */
+    up(&ar->arSem);
+    return 0;
+}
+
+static int
+ar6000_ioctl_giwencode(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *key)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    A_UINT8 keyIndex;
+    struct ar_wep_key *wk;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+
+    if (arPriv->arPairwiseCrypto == NONE_CRYPT) {
+        erq->length = 0;
+        erq->flags = IW_ENCODE_DISABLED;
+    } else {
+        if (arPriv->arPairwiseCrypto == WEP_CRYPT) {
+            /* get the keyIndex */
+            keyIndex = erq->flags & IW_ENCODE_INDEX;
+            if (0 == keyIndex) {
+                keyIndex = arPriv->arDefTxKeyIndex;
+            } else if ((keyIndex - 1 < WMI_MIN_KEY_INDEX) ||
+                       (keyIndex - 1 > WMI_MAX_KEY_INDEX))
+            {
+                keyIndex = WMI_MIN_KEY_INDEX;
+            } else {
+                keyIndex--;
+            }
+            erq->flags = keyIndex + 1;
+            erq->flags &= ~IW_ENCODE_DISABLED;
+            wk = &arPriv->arWepKeyList[keyIndex];
+            if (erq->length > wk->arKeyLen) {
+                erq->length = wk->arKeyLen;
+            }
+            if (wk->arKeyLen) {
+                A_MEMCPY(key, wk->arKey, erq->length);
+            }
+        } else {
+            erq->flags &= ~IW_ENCODE_DISABLED;
+            if (arPriv->arSta.user_saved_keys.keyOk) {
+                erq->length = arPriv->arSta.user_saved_keys.ucast_ik.ik_keylen;
+                if (erq->length) {
+                    A_MEMCPY(key, arPriv->arSta.user_saved_keys.ucast_ik.ik_keydata, erq->length);
+                }
+            } else {
+                erq->length = 1;    // not really printing any key but let iwconfig know enc is on
+            }
+        }
+
+        if (arPriv->arDot11AuthMode & OPEN_AUTH) {
+            erq->flags |= IW_ENCODE_OPEN;
+        }
+        if (arPriv->arDot11AuthMode & SHARED_AUTH) {
+            erq->flags |= IW_ENCODE_RESTRICTED;
+        }
+    }
+
+    up(&ar->arSem);
+    return 0;
+}
+
+#if WIRELESS_EXT >= 18
+static bool is_wpa_ie(const u8 *pos)
+{
+        return pos[0] == IEEE80211_ELEMID_VENDOR && pos[1] >= 4 &&
+                pos[2] == 0x00 && pos[3] == 0x50 &&
+                pos[4] == 0xf2 && pos[5] == 0x01;
+}
+
+static bool is_rsn_ie(const u8 *pos)
+{
+        return pos[0] == IEEE80211_ELEMID_RSN;
+}
+
+static bool is_wps_ie(const u8 *pos)
+{
+        return (pos[0] == IEEE80211_ELEMID_VENDOR &&
+                pos[1] >= 4 &&
+                pos[2] == 0x00 && pos[3] == 0x50 && pos[4] == 0xf2 &&
+                pos[5] == 0x04);
+}
+/*
+ * SIOCSIWGENIE
+ */
+static int
+ar6000_ioctl_siwgenie(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_UCHAR *ie = extra;
+    A_UINT16   ieLen = erq->length;
+    const A_UCHAR *pos;
+    A_UCHAR *buf = NULL;
+    int len = 0;
+
+    if (ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+    if (ieLen > IEEE80211_APPIE_FRAME_MAX_LEN) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    arPriv->arSta.arConnectCtrlFlags &= ~CONNECT_WPS_FLAG;
+
+    if (ie && ieLen) {
+    	buf = kmalloc(ieLen, GFP_KERNEL);
+    	if (buf == NULL){
+	   up(&ar->arSem);
+	   return -ENOMEM;
+	}
+	pos = ie;
+
+	while (pos + 1 < ie + ieLen) {
+		if (pos + 2 + pos[1] > ie + ieLen)
+			break;
+		if (!(is_wpa_ie(pos) || is_rsn_ie(pos))) {
+			memcpy(buf + len, pos, 2 + pos[1]);
+				len += 2 + pos[1];
+		}
+
+		if (is_wps_ie(pos)){
+			/* WPS IE detected, notify target */
+			AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("WPS IE detected -- setting WPS flag\n"));
+			arPriv->arSta.arConnectCtrlFlags |= CONNECT_WPS_FLAG;
+		}
+
+		pos += 2 + pos[1];
+	}
+    }
+
+    wmi_set_appie_cmd(arPriv->arWmi, WMI_FRAME_ASSOC_REQ, len, buf);
+    kfree(buf);
+    up(&ar->arSem);
+    return 0;
+}
+
+
+
+/*
+ * SIOCGIWGENIE
+ */
+static int
+ar6000_ioctl_giwgenie(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+    erq->length = 0;
+    erq->flags = 0;
+
+    return 0;
+}
+
+/*
+ * SIOCSIWAUTH
+ */
+static int
+ar6000_ioctl_siwauth(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_param *data, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+
+    A_BOOL profChanged;
+    A_UINT16 param;
+    A_INT32 ret;
+    A_INT32 value;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    param = data->flags & IW_AUTH_INDEX;
+    value = data->value;
+    profChanged = TRUE;
+    ret = 0;
+
+    switch (param) {
+        case IW_AUTH_WPA_VERSION:
+            if (value & IW_AUTH_WPA_VERSION_DISABLED) {
+                arPriv->arAuthMode = WMI_NONE_AUTH;
+            } else if (value & IW_AUTH_WPA_VERSION_WPA) {
+                arPriv->arAuthMode = WMI_WPA_AUTH;
+            } else if (value & IW_AUTH_WPA_VERSION_WPA2) {
+                arPriv->arAuthMode = WMI_WPA2_AUTH;
+            } else {
+                ret = -1;
+                profChanged    = FALSE;
+            }
+            if(!ret) {
+                if(arPriv->PreAuthMode == arPriv->arAuthMode) {
+                    profChanged = FALSE;
+                }
+                arPriv->PreAuthMode = arPriv->arAuthMode;
+            }
+            break;
+        case IW_AUTH_CIPHER_PAIRWISE:
+            if (value & IW_AUTH_CIPHER_NONE) {
+                if(arPriv->arPairwiseCrypto == NONE_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = NONE_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_WEP40) {
+                if(arPriv->arPairwiseCrypto == WEP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = WEP_CRYPT;
+                arPriv->arPairwiseCryptoLen = 5;
+            } else if (value & IW_AUTH_CIPHER_TKIP) {
+                if(arPriv->arPairwiseCrypto == TKIP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = TKIP_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_CCMP) {
+                if(arPriv->arPairwiseCrypto == AES_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = AES_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_WEP104) {
+                if(arPriv->arPairwiseCrypto == WEP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = WEP_CRYPT;
+                arPriv->arPairwiseCryptoLen = 13;
+#ifdef WAPI_ENABLE
+            } else if (value & IW_AUTH_CIPHER_SMS4) {
+                if(arPriv->arPairwiseCrypto == WAPI_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arPairwiseCrypto = WAPI_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+#endif
+            } else {
+                ret = -1;
+                profChanged    = FALSE;
+            }
+            break;
+        case IW_AUTH_CIPHER_GROUP:
+            if (value & IW_AUTH_CIPHER_NONE) {
+                if(arPriv->arGroupCrypto == NONE_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = NONE_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_WEP40) {
+                if(arPriv->arGroupCrypto == WEP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = WEP_CRYPT;
+                arPriv->arGroupCryptoLen = 5;
+            } else if (value & IW_AUTH_CIPHER_TKIP) {
+                if(arPriv->arGroupCrypto == TKIP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = TKIP_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_CCMP) {
+                if(arPriv->arGroupCrypto == AES_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = AES_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+            } else if (value & IW_AUTH_CIPHER_WEP104) {
+                if(arPriv->arGroupCrypto == WEP_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = WEP_CRYPT;
+                arPriv->arGroupCryptoLen = 13;
+#ifdef WAPI_ENABLE
+            } else if (value & IW_AUTH_CIPHER_SMS4) {
+               if(arPriv->arGroupCrypto == WAPI_CRYPT) {
+                    profChanged = FALSE;
+                }
+                arPriv->arGroupCrypto = WAPI_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+#endif
+            } else {
+                ret = -1;
+                profChanged    = FALSE;
+            }
+            break;
+        case IW_AUTH_KEY_MGMT:
+            if (value & IW_AUTH_KEY_MGMT_PSK) {
+                if (WMI_WPA_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA_PSK_AUTH;
+                } else if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA2_PSK_AUTH;
+                } else {
+                    ret = -1;
+                }
+#define IW_AUTH_KEY_MGMT_CCKM       8
+            } else if (value & IW_AUTH_KEY_MGMT_CCKM) {
+                if (WMI_WPA_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA_AUTH_CCKM;
+                } else if (WMI_WPA2_AUTH == arPriv->arAuthMode) {
+                    arPriv->arAuthMode = WMI_WPA2_AUTH_CCKM;
+                } else {
+                    ret = -1;
+                }
+            } else if (!(value & IW_AUTH_KEY_MGMT_802_1X)) {
+                arPriv->arAuthMode = WMI_NONE_AUTH;
+            }
+            if(!ret) {
+                if(arPriv->PreAuthKeyMgmt == arPriv->arAuthMode) {
+                    profChanged = FALSE;
+                }
+                arPriv->PreAuthKeyMgmt = arPriv->arAuthMode;
+            }
+            break;
+        case IW_AUTH_TKIP_COUNTERMEASURES:
+            wmi_set_tkip_countermeasures_cmd(arPriv->arWmi, value);
+            profChanged    = FALSE;
+            break;
+        case IW_AUTH_DROP_UNENCRYPTED:
+            profChanged    = FALSE;
+            break;
+        case IW_AUTH_80211_AUTH_ALG:
+            if (value & IW_AUTH_ALG_OPEN_SYSTEM) {
+                if((arPriv->arDot11AuthMode & OPEN_AUTH)) {
+                    profChanged    = FALSE;
+                }
+                arPriv->arDot11AuthMode = OPEN_AUTH;
+            }
+            if (value & IW_AUTH_ALG_SHARED_KEY) {
+                if((arPriv->arDot11AuthMode & SHARED_AUTH)) {
+                    profChanged    = FALSE;
+                }
+                arPriv->arDot11AuthMode = SHARED_AUTH;
+            }
+            if (value & IW_AUTH_ALG_LEAP) {
+                if((arPriv->arDot11AuthMode & LEAP_AUTH)) {
+                    profChanged    = FALSE;
+                }
+                arPriv->arDot11AuthMode = LEAP_AUTH;
+            }
+            if((value & (IW_AUTH_ALG_OPEN_SYSTEM | IW_AUTH_ALG_SHARED_KEY |IW_AUTH_ALG_LEAP))==0){
+                ret = -1;
+                profChanged    = FALSE;
+            }
+            break;
+        case IW_AUTH_WPA_ENABLED:
+            profChanged = FALSE;
+            if (!value) {
+                arPriv->arAuthMode = WMI_NONE_AUTH;
+                /* when the supplicant is stopped, it calls this
+                 * handler with value=0. The followings need to be
+                 * reset if the STA were to connect again
+                 * without security
+                 */
+                arPriv->arDot11AuthMode = OPEN_AUTH;
+                arPriv->arPairwiseCrypto = NONE_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+                arPriv->arGroupCrypto = NONE_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+            }
+            break;
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+            profChanged    = FALSE;
+            break;
+        case IW_AUTH_ROAMING_CONTROL:
+            profChanged    = FALSE;
+            break;
+        case IW_AUTH_PRIVACY_INVOKED:
+            profChanged = FALSE;
+            if (!value) {
+                arPriv->arPairwiseCrypto = NONE_CRYPT;
+                arPriv->arPairwiseCryptoLen = 0;
+                arPriv->arGroupCrypto = NONE_CRYPT;
+                arPriv->arGroupCryptoLen = 0;
+            }
+            break;
+        default:
+           ret = -1;
+           profChanged    = FALSE;
+           break;
+    }
+
+    if (profChanged == TRUE) {
+        /*
+         * profile has changed.  Erase ssid to signal change
+         */
+        A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+        arPriv->arSsidLen = 0;
+    }
+
+    up(&ar->arSem);
+    return ret;
+}
+
+
+/*
+ * SIOCGIWAUTH
+ */
+static int
+ar6000_ioctl_giwauth(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_param *data, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    A_UINT16 param;
+    A_INT32 ret;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    param = data->flags & IW_AUTH_INDEX;
+    ret = 0;
+    data->value = 0;
+
+
+    switch (param) {
+        case IW_AUTH_WPA_VERSION:
+            if (arPriv->arAuthMode == WMI_NONE_AUTH) {
+                data->value |= IW_AUTH_WPA_VERSION_DISABLED;
+            } else if (arPriv->arAuthMode == WMI_WPA_AUTH) {
+                data->value |= IW_AUTH_WPA_VERSION_WPA;
+            } else if (arPriv->arAuthMode == WMI_WPA2_AUTH) {
+                data->value |= IW_AUTH_WPA_VERSION_WPA2;
+            } else {
+                ret = -1;
+            }
+            break;
+        case IW_AUTH_CIPHER_PAIRWISE:
+            if (arPriv->arPairwiseCrypto == NONE_CRYPT) {
+                data->value |= IW_AUTH_CIPHER_NONE;
+            } else if (arPriv->arPairwiseCrypto == WEP_CRYPT) {
+                if (arPriv->arPairwiseCryptoLen == 13) {
+                    data->value |= IW_AUTH_CIPHER_WEP104;
+                } else {
+                    data->value |= IW_AUTH_CIPHER_WEP40;
+                }
+            } else if (arPriv->arPairwiseCrypto == TKIP_CRYPT) {
+                data->value |= IW_AUTH_CIPHER_TKIP;
+            } else if (arPriv->arPairwiseCrypto == AES_CRYPT) {
+                data->value |= IW_AUTH_CIPHER_CCMP;
+            } else {
+                ret = -1;
+            }
+            break;
+        case IW_AUTH_CIPHER_GROUP:
+            if (arPriv->arGroupCrypto == NONE_CRYPT) {
+                    data->value |= IW_AUTH_CIPHER_NONE;
+            } else if (arPriv->arGroupCrypto == WEP_CRYPT) {
+                if (arPriv->arGroupCryptoLen == 13) {
+                    data->value |= IW_AUTH_CIPHER_WEP104;
+                } else {
+                    data->value |= IW_AUTH_CIPHER_WEP40;
+                }
+            } else if (arPriv->arGroupCrypto == TKIP_CRYPT) {
+                data->value |= IW_AUTH_CIPHER_TKIP;
+            } else if (arPriv->arGroupCrypto == AES_CRYPT) {
+                data->value |= IW_AUTH_CIPHER_CCMP;
+            } else {
+                ret = -1;
+            }
+            break;
+        case IW_AUTH_KEY_MGMT:
+            if ((arPriv->arAuthMode == WMI_WPA_PSK_AUTH) ||
+                (arPriv->arAuthMode == WMI_WPA2_PSK_AUTH)) {
+                data->value |= IW_AUTH_KEY_MGMT_PSK;
+            } else if ((arPriv->arAuthMode == WMI_WPA_AUTH) ||
+                       (arPriv->arAuthMode == WMI_WPA2_AUTH)) {
+                data->value |= IW_AUTH_KEY_MGMT_802_1X;
+            }
+            break;
+        case IW_AUTH_TKIP_COUNTERMEASURES:
+            // TODO. Save countermeassure enable/disable
+            data->value = 0;
+            break;
+        case IW_AUTH_DROP_UNENCRYPTED:
+            break;
+        case IW_AUTH_80211_AUTH_ALG:
+            if (arPriv->arDot11AuthMode == OPEN_AUTH) {
+                data->value |= IW_AUTH_ALG_OPEN_SYSTEM;
+            } else if (arPriv->arDot11AuthMode == SHARED_AUTH) {
+                data->value |= IW_AUTH_ALG_SHARED_KEY;
+            } else if (arPriv->arDot11AuthMode == LEAP_AUTH) {
+                data->value |= IW_AUTH_ALG_LEAP;
+            } else {
+                ret = -1;
+            }
+            break;
+        case IW_AUTH_WPA_ENABLED:
+            if (arPriv->arAuthMode == WMI_NONE_AUTH) {
+                data->value = 0;
+            } else {
+                data->value = 1;
+            }
+            break;
+        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+            break;
+        case IW_AUTH_ROAMING_CONTROL:
+            break;
+        case IW_AUTH_PRIVACY_INVOKED:
+            if (arPriv->arPairwiseCrypto == NONE_CRYPT) {
+                data->value = 0;
+            } else {
+                data->value = 1;
+            }
+            break;
+        default:
+           ret = -1;
+           break;
+    }
+
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCSIWPMKSA
+ */
+static int
+ar6000_ioctl_siwpmksa(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *data, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_INT32 ret;
+    A_STATUS status;
+    struct iw_pmksa *pmksa;
+
+    pmksa = (struct iw_pmksa *)extra;
+
+    if (ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    ret = 0;
+    status = A_OK;
+
+    switch (pmksa->cmd) {
+        case IW_PMKSA_ADD:
+            status = wmi_setPmkid_cmd(arPriv->arWmi, (A_UINT8*)pmksa->bssid.sa_data, pmksa->pmkid, TRUE);
+            break;
+        case IW_PMKSA_REMOVE:
+            status = wmi_setPmkid_cmd(arPriv->arWmi, (A_UINT8*)pmksa->bssid.sa_data, pmksa->pmkid, FALSE);
+            break;
+        case IW_PMKSA_FLUSH:
+            if (arPriv->arConnected == TRUE) {
+                status = wmi_setPmkid_cmd(arPriv->arWmi, arPriv->arBssid, NULL, 0);
+            }
+            break;
+        default:
+            ret=-1;
+            break;
+    }
+    if (status != A_OK) {
+        ret = -1;
+    }
+
+    up(&ar->arSem);
+    return ret;
+}
+
+#ifdef WAPI_ENABLE
+
+#define PN_INIT 0x5c365c36
+
+static int ar6000_set_wapi_key(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+    KEY_USAGE   keyUsage = 0;
+    A_INT32     keyLen;
+    A_UINT8     *keyData;
+    A_INT32     index;
+    A_UINT32    *PN;
+    A_INT32     i;
+    A_STATUS    status;
+    A_UINT8     wapiKeyRsc[16];
+    CRYPTO_TYPE keyType = WAPI_CRYPT;
+    const A_UINT8 broadcastMac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+    index = erq->flags & IW_ENCODE_INDEX;
+    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
+                ((index - 1) > WMI_MAX_KEY_INDEX))) {
+        return -EIO;
+    }
+
+    index--;
+    if (index < 0 || index > 4) {
+        return -EIO;
+    }
+    keyData = (A_UINT8 *)(ext + 1);
+    keyLen = erq->length - sizeof(struct iw_encode_ext);
+    A_MEMCPY(wapiKeyRsc, ext->tx_seq, sizeof(wapiKeyRsc));
+
+    if (A_MEMCMP(ext->addr.sa_data, broadcastMac, sizeof(broadcastMac)) == 0) {
+        keyUsage |= GROUP_USAGE;
+        PN = (A_UINT32 *)wapiKeyRsc;
+        for (i = 0; i < 4; i++) {
+            PN[i] = PN_INIT;
+        }
+    } else {
+        keyUsage |= PAIRWISE_USAGE;
+    }
+    status = wmi_addKey_cmd(arPriv->arWmi,
+                            index,
+                            keyType,
+                            keyUsage,
+                            keyLen,
+                            wapiKeyRsc,
+                            keyData,
+                            KEY_OP_INIT_WAPIPN,
+                            NULL,
+                            SYNC_BEFORE_WMIFLAG);
+    if (A_OK != status) {
+        return -EIO;
+    }
+    return 0;
+}
+
+#endif
+
+/*
+ * SIOCSIWENCODEEXT
+ */
+static int
+ar6000_ioctl_siwencodeext(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_INT32 index;
+    struct iw_encode_ext *ext;
+    KEY_USAGE keyUsage;
+    A_INT32 keyLen;
+    A_UINT8 *keyData;
+    A_UINT8 keyRsc[8];
+    A_STATUS status;
+    CRYPTO_TYPE keyType;
+    A_UINT32 returnValue = -EIO;
+#ifdef USER_KEYS
+    struct ieee80211req_key ik;
+#endif /* USER_KEYS */
+    AR_SOFTC_AP_T   *arAp = &arPriv->arAp;
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+#ifdef USER_KEYS
+        arPriv->arSta.user_saved_keys.keyOk = FALSE;
+#endif /* USER_KEYS */
+
+    index = erq->flags & IW_ENCODE_INDEX;
+
+    if (index && (((index - 1) < WMI_MIN_KEY_INDEX) ||
+                  ((index - 1) > WMI_MAX_KEY_INDEX)))
+    {
+        up(&ar->arSem);    
+        return -EIO;
+    }
+
+    ext = (struct iw_encode_ext *)extra;
+    if (erq->flags & IW_ENCODE_DISABLED) {
+        /*
+         * Encryption disabled
+         */
+        if (index) {
+            /*
+             * If key index was specified then clear the specified key
+             */
+            index--;
+            A_MEMZERO(arPriv->arWepKeyList[index].arKey,
+                      sizeof(arPriv->arWepKeyList[index].arKey));
+            arPriv->arWepKeyList[index].arKeyLen = 0;
+        }
+    } else {
+        /*
+         * Enabling WEP encryption
+         */
+        if (index) {
+            index--;                /* keyindex is off base 1 in iwconfig */
+        }
+
+        keyUsage = 0;
+        keyLen = erq->length - sizeof(struct iw_encode_ext);
+
+        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+            keyUsage = TX_USAGE;
+            arPriv->arDefTxKeyIndex = index;
+            // Just setting the key index
+            if (keyLen == 0) {
+                up(&ar->arSem);
+                return 0;
+            }
+        }
+
+        if (keyLen <= 0) {
+            if (ext->alg == IW_ENCODE_ALG_KRK) {
+                wmi_delete_krk_cmd(arPriv->arWmi);
+            }
+            up(&ar->arSem);
+            return -EIO;
+        }
+
+        /* key follows iw_encode_ext */
+        keyData = (A_UINT8 *)(ext + 1);
+
+        switch (ext->alg) {
+            case IW_ENCODE_ALG_WEP:
+                keyType = WEP_CRYPT;
+#ifdef USER_KEYS
+                ik.ik_type = IEEE80211_CIPHER_WEP;
+#endif /* USER_KEYS */
+                if(arPriv->arNextMode == AP_NETWORK) {
+                    arAp->ap_mode_bkey.ik_type = IEEE80211_CIPHER_WEP;
+                }
+                if (!IEEE80211_IS_VALID_WEP_CIPHER_LEN(keyLen)) {
+                    up(&ar->arSem);
+                    return -EIO;
+                }
+
+                /* Check whether it is static wep. */
+                if (!arPriv->arConnected) {
+                    A_MEMZERO(arPriv->arWepKeyList[index].arKey,
+                          sizeof(arPriv->arWepKeyList[index].arKey));
+                    A_MEMCPY(arPriv->arWepKeyList[index].arKey, keyData, keyLen);
+                    arPriv->arWepKeyList[index].arKeyLen = keyLen;
+
+                    up(&ar->arSem);
+                    return 0;
+                }
+                break;
+            case IW_ENCODE_ALG_TKIP:
+                keyType = TKIP_CRYPT;
+#ifdef USER_KEYS
+                ik.ik_type = IEEE80211_CIPHER_TKIP;
+#endif /* USER_KEYS */
+                if(arPriv->arNextMode == AP_NETWORK) {
+                    arAp->ap_mode_bkey.ik_type = IEEE80211_CIPHER_TKIP;
+                }
+                break;
+            case IW_ENCODE_ALG_CCMP:
+                keyType = AES_CRYPT;
+#ifdef USER_KEYS
+                ik.ik_type = IEEE80211_CIPHER_AES_CCM;
+#endif /* USER_KEYS */
+                if(arPriv->arNextMode == AP_NETWORK) {
+                    arAp->ap_mode_bkey.ik_type = IEEE80211_CIPHER_AES_CCM;
+                }
+                break;
+#ifdef WAPI_ENABLE
+            case IW_ENCODE_ALG_SM4:
+                {
+                 returnValue = ar6000_set_wapi_key(dev, info, erq, extra);
+                 up(&ar->arSem);
+                 return returnValue;
+                }
+#endif
+            case IW_ENCODE_ALG_PMK:
+                arPriv->arSta.arConnectCtrlFlags |= CONNECT_DO_WPA_OFFLOAD;
+                returnValue = wmi_set_pmk_cmd(arPriv->arWmi, keyData);
+                up(&ar->arSem);	
+                return returnValue;
+            case IW_ENCODE_ALG_KRK:
+                returnValue = wmi_add_krk_cmd(arPriv->arWmi, keyData);
+                up(&ar->arSem);
+                return returnValue;
+            default:
+                up(&ar->arSem);				
+                return -EIO;
+        }
+
+
+        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+            keyUsage |= GROUP_USAGE;
+            if(arPriv->arNextMode == AP_NETWORK) {
+                keyUsage &= ~TX_USAGE; 
+                arAp->ap_mode_bkey.ik_keyix = index;
+                arAp->ap_mode_bkey.ik_keylen = keyLen;
+                memcpy(arAp->ap_mode_bkey.ik_keydata, keyData, keyLen);
+                memcpy(&arAp->ap_mode_bkey.ik_keyrsc, keyRsc, sizeof(keyRsc));
+                memcpy(arAp->ap_mode_bkey.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
+            }
+        } else {
+            keyUsage |= PAIRWISE_USAGE;
+        }
+
+        if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+            A_MEMCPY(keyRsc, ext->rx_seq, sizeof(keyRsc));
+        } else {
+            A_MEMZERO(keyRsc, sizeof(keyRsc));
+        }
+
+        if (((WMI_WPA_PSK_AUTH == arPriv->arAuthMode) || (WMI_WPA2_PSK_AUTH == arPriv->arAuthMode)) &&
+            (GROUP_USAGE & keyUsage))
+        {   
+                A_UNTIMEOUT(&arPriv->arSta.disconnect_timer);
+        }
+
+         status = wmi_addKey_cmd(arPriv->arWmi, index, keyType, keyUsage,
+                            keyLen, keyRsc,
+                            keyData, KEY_OP_INIT_VAL,
+                            (A_UINT8*)ext->addr.sa_data,
+                            SYNC_BOTH_WMIFLAG);
+         if (status != A_OK) {
+            up(&ar->arSem);	
+            return -EIO;
+         }
+
+#ifdef USER_KEYS
+        ik.ik_keyix = index;
+        ik.ik_keylen = keyLen;
+        memcpy(ik.ik_keydata, keyData, keyLen);
+        memcpy(&ik.ik_keyrsc, keyRsc, sizeof(keyRsc));
+        memcpy(ik.ik_macaddr, ext->addr.sa_data, ETH_ALEN);
+        if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+            memcpy(&arPriv->arSta.user_saved_keys.bcast_ik, &ik,
+                       sizeof(struct ieee80211req_key));
+        } else {
+            memcpy(&arPriv->arSta.user_saved_keys.ucast_ik, &ik,
+                      sizeof(struct ieee80211req_key));
+        }
+        arPriv->arSta.user_saved_keys.keyOk = TRUE;
+#endif /* USER_KEYS */
+    }
+
+    up(&ar->arSem);	
+    return 0;
+}
+
+/*
+ * SIOCGIWENCODEEXT
+ */
+static int
+ar6000_ioctl_giwencodeext(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *erq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (arPriv->arPairwiseCrypto == NONE_CRYPT) {
+        erq->length = 0;
+        erq->flags = IW_ENCODE_DISABLED;
+    } else {
+        erq->length = 0;
+    }
+
+    return 0;
+}
+#endif // WIRELESS_EXT >= 18
+
+#if WIRELESS_EXT > 20
+static int ar6000_ioctl_siwpower(struct net_device *dev,
+                 struct iw_request_info *info,
+                 union iwreq_data *wrqu, char *extra)
+{
+#ifndef ATH6K_CONFIG_OTA_MODE
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_POWER_MODE power_mode;
+
+	if(psm_info == 1 || psm_info == 0)
+    {
+	    return 0;
+    }
+	
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if (wrqu->power.disabled)
+        power_mode = MAX_PERF_POWER;
+    else
+        power_mode = REC_POWER;
+
+    if (wmi_powermode_cmd(arPriv->arWmi, power_mode) < 0)
+    {
+        up(&ar->arSem);
+        return -EIO;
+    }
+#endif
+    up(&ar->arSem);
+    return 0;
+}
+
+static int ar6000_ioctl_giwpower(struct net_device *dev,
+                 struct iw_request_info *info,
+                 union iwreq_data *wrqu, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    WMI_POWER_MODE power_mode;
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    power_mode = wmi_get_power_mode_cmd(arPriv->arWmi);
+
+    if (power_mode == MAX_PERF_POWER)
+        wrqu->power.disabled = 1;
+    else
+        wrqu->power.disabled = 0;
+
+    up(&ar->arSem);
+    return 0;
+}
+#endif // WIRELESS_EXT > 20
+
+/*
+ * SIOCGIWNAME
+ */
+int
+ar6000_ioctl_giwname(struct net_device *dev,
+           struct iw_request_info *info,
+           char *name, char *extra)
+{
+    A_UINT8 capability;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    capability = arPriv->arPhyCapability;
+    if(arPriv->arNetworkType == INFRA_NETWORK && arPriv->arConnected) {
+        bss_t *bss;
+        wmi_scan_report_lock(arPriv->arWmi);		
+        bss = wmi_find_node(arPriv->arWmi, arPriv->arBssid);
+        if (bss) {
+            capability = get_bss_phy_capability(bss);
+            wmi_node_return(arPriv->arWmi, bss);
+        }
+        wmi_scan_report_unlock(arPriv->arWmi);
+    }
+    switch (capability) {
+    case (WMI_11A_CAPABILITY):
+        if (strlcpy(name, "AR6000 802.11a", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11a\n"));
+            return -1;
+        }
+        break;
+    case (WMI_11G_CAPABILITY):
+        if (strlcpy(name, "AR6000 802.11g", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11g\n"));
+            return -1;
+        }
+        break;
+    case (WMI_11AG_CAPABILITY):
+        if (strlcpy(name, "AR6000 802.11ag", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11ag\n"));
+            return -1;
+        }
+        break;
+    case (WMI_11NA_CAPABILITY):
+        if (strlcpy(name, "AR6000 802.11na", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11na\n"));
+            return -1;
+        }
+        break;
+    case (WMI_11NG_CAPABILITY):
+        if (strlcpy(name, "AR6000 802.11ng", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11ng\n"));
+            return -1;
+        }
+        break;
+    case (WMI_11NAG_CAPABILITY):
+        if (strlcpy(name, "AR6K 802.11nag", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6000 802.11nag\n"));
+            return -1;
+        }
+        break;
+    default:
+        if (strlcpy(name, "AR6000 802.11b", IFNAMSIZ) >= IFNAMSIZ) {
+            AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("strlcpy: AR6003 802.11b\n"));
+            return -1;
+        }
+        break;
+    }
+
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCSIWFREQ
+ */
+int
+ar6000_ioctl_siwfreq(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_freq *freq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    /*
+     * We support limiting the channels via wmiconfig.
+     *
+     * We use this command to configure the channel hint for the connect cmd
+     * so it is possible the target will end up connecting to a different
+     * channel.
+     */
+    if (freq->e > 1) {
+        up(&ar->arSem);
+        return -EINVAL;
+    } else if (freq->e == 1) {
+         if ((arPriv->arPhyCapability == WMI_11NG_CAPABILITY) && (((freq->m / 100000) >= 5180) && ((freq->m / 100000) <= 5825))) {
+            up(&ar->arSem);
+            return -EINVAL;
+         }
+         arPriv->arChannelHint = freq->m / 100000;
+    } else if(freq->m > 0) {
+         if ((arPriv->arPhyCapability == WMI_11NG_CAPABILITY) && ((wlan_ieee2freq(freq->m) >=5180) && (wlan_ieee2freq(freq->m) <= 5825))) {
+            up(&ar->arSem);
+            return -EINVAL;
+         }
+            arPriv->arChannelHint = wlan_ieee2freq(freq->m);
+    } else {
+            /* Auto Channel Selection */
+            arPriv->arChannelHint = 0;
+    }
+    
+    if(ar->lteFreq && arPriv->arChannelHint && arPriv->arNetworkType == AP_NETWORK) {
+        A_PRINTF("LTE coex enabled. Ignore channel set to %d\n", arPriv->arChannelHint);
+        arPriv->arChannelHint = 0;
+    } else {
+        arPriv->ap_profile_flag = 1; /* There is a change in profile */
+        A_PRINTF("channel hint set to %d\n", arPriv->arChannelHint);
+    }
+    
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCGIWFREQ
+ */
+int
+ar6000_ioctl_giwfreq(struct net_device *dev,
+                struct iw_request_info *info,
+                struct iw_freq *freq, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    if (arPriv->arNetworkType == AP_NETWORK) {
+        if(arPriv->arChannelHint) {
+            freq->m = arPriv->arChannelHint * 100000;
+        } else if(arPriv->arBssChannel) {
+            freq->m = arPriv->arBssChannel * 100000;
+        } else {
+            up(&ar->arSem);
+            return -EINVAL;
+        }
+    } else {
+        if (arPriv->arConnected != TRUE) {
+            up(&ar->arSem);
+            return -EINVAL;
+        } else {
+            freq->m = arPriv->arBssChannel * 100000;
+        }
+    }
+
+    freq->e = 1;
+
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCSIWMODE
+ */
+int
+ar6000_ioctl_siwmode(struct net_device *dev,
+            struct iw_request_info *info,
+            __u32 *mode, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+#if 0
+    /*
+     * clear SSID during mode switch in connected state
+     */
+    if(!(arPriv->arNetworkType == (((*mode) == IW_MODE_INFRA) ? INFRA_NETWORK : ADHOC_NETWORK)) 
+                  && (arPriv->arConnected == TRUE) ){
+        A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+        arPriv->arSsidLen = 0;
+    }
+#endif
+
+    switch (*mode) {
+    case IW_MODE_INFRA:
+        arPriv->arNextMode = INFRA_NETWORK;
+        break;
+    case IW_MODE_ADHOC:
+        arPriv->arNextMode = ADHOC_NETWORK;
+        break;
+    case IW_MODE_MASTER:
+        arPriv->arNextMode = AP_NETWORK;
+        break;
+    default:
+        up(&ar->arSem);
+        return -EINVAL;
+    }
+
+    if (arPriv->arNetworkType != arPriv->arNextMode) {
+        ar6000_init_mode_info(arPriv);
+    }
+
+    /* Update the arNetworkType */
+    arPriv->arNetworkType = arPriv->arNextMode;
+
+    up(&ar->arSem);
+    return 0;
+}
+
+/*
+ * SIOCGIWMODE
+ */
+int
+ar6000_ioctl_giwmode(struct net_device *dev,
+            struct iw_request_info *info,
+            __u32 *mode, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    switch (arPriv->arNetworkType) {
+    case INFRA_NETWORK:
+        *mode = IW_MODE_INFRA;
+        break;
+    case ADHOC_NETWORK:
+        *mode = IW_MODE_ADHOC;
+        break;
+    case AP_NETWORK:
+        *mode = IW_MODE_MASTER;
+        break;
+    default:
+        return -EIO;
+    }
+    return 0;
+}
+
+/*
+ * SIOCSIWSENS
+ */
+int
+ar6000_ioctl_siwsens(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_param *sens, char *extra)
+{
+    return 0;
+}
+
+/*
+ * SIOCGIWSENS
+ */
+int
+ar6000_ioctl_giwsens(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_param *sens, char *extra)
+{
+    sens->value = 0;
+    sens->fixed = 1;
+
+    return 0;
+}
+
+/*
+ * SIOCGIWRANGE
+ */
+int
+ar6000_ioctl_giwrange(struct net_device *dev,
+             struct iw_request_info *info,
+             struct iw_point *data, char *extra)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    struct iw_range *range = (struct iw_range *) extra;
+    int i, j, ret = 0;
+    const A_INT32 rateTable[] = { 
+        1000, 2000, 5500, 11000,
+        6000, 9000, 12000, 18000, 24000, 36000, 48000, 54000,
+        6500, 13000, 19500, 26000, 39000, 52000, 58500, 65000 };
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWmiReady == FALSE || ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    arSta->arNumChannels = -1;
+    A_MEMZERO(arSta->arChannelList, sizeof (arSta->arChannelList));
+
+    if (wmi_get_channelList_cmd(arPriv->arWmi) != A_OK) {
+        up(&ar->arSem);
+        return -EIO;
+    }
+
+    wait_event_interruptible_timeout(arPriv->arEvent, arSta->arNumChannels != -1, wmitimeout * HZ);
+
+    if (signal_pending(current)) {
+        up(&ar->arSem);
+        return -EINTR;
+    }
+
+    data->length = sizeof(struct iw_range);
+    A_MEMZERO(range, sizeof(struct iw_range));
+
+    range->enc_capa |= IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2;
+    range->enc_capa |= IW_ENC_CAPA_CIPHER_TKIP|IW_ENC_CAPA_CIPHER_CCMP;
+    /* Event capability (kernel + driver) */
+    range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
+                            IW_EVENT_CAPA_MASK(SIOCGIWAP) |
+                            IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
+    range->event_capa[1] = IW_EVENT_CAPA_K_1;
+    range->event_capa[4] = (IW_EVENT_CAPA_MASK(IWEVCUSTOM) |
+                            IW_EVENT_CAPA_MASK(IWEVREGISTERED) |
+                            IW_EVENT_CAPA_MASK(IWEVEXPIRED) |
+#if WIRELESS_EXT >= 18
+                            IW_EVENT_CAPA_MASK(IWEVPMKIDCAND) |
+                            IW_EVENT_CAPA_MASK(IWEVASSOCRESPIE) |
+                            IW_EVENT_CAPA_MASK(IWEVASSOCREQIE) |
+                            IW_EVENT_CAPA_MASK(IWEVGENIE) |
+#endif
+                            0);
+
+    range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_CHANNEL;
+    
+    range->txpower_capa = 0;
+
+    range->min_pmp = 1 * 1024;
+    range->max_pmp = 65535 * 1024;
+    range->min_pmt = 1 * 1024;
+    range->max_pmt = 1000 * 1024;
+    range->pmp_flags = IW_POWER_PERIOD;
+    range->pmt_flags = IW_POWER_TIMEOUT;
+    range->pm_capa = 0;
+
+    range->we_version_compiled = WIRELESS_EXT;
+    range->we_version_source = 13;
+
+    range->retry_capa = IW_RETRY_LIMIT;
+    range->retry_flags = IW_RETRY_LIMIT;
+    range->min_retry = 0;
+    range->max_retry = 255;
+
+    range->num_frequency = range->num_channels = arSta->arNumChannels;
+    for (i = 0; i < arSta->arNumChannels; i++) {
+        range->freq[i].i = wlan_freq2ieee(arSta->arChannelList[i]);
+        range->freq[i].m = arSta->arChannelList[i] * 100000;
+        range->freq[i].e = 1;
+         /*
+         * Linux supports max of 32 channels, bail out once you
+         * reach the max.
+         */
+        if (i == IW_MAX_FREQUENCIES) {
+            break;
+        }
+    }
+
+    /* Max quality is max field value minus noise floor */
+    range->max_qual.qual  = 0xff - 161;
+
+    /*
+     * In order to use dBm measurements, 'level' must be lower
+     * than any possible measurement (see iw_print_stats() in
+     * wireless tools).  It's unclear how this is meant to be
+     * done, but setting zero in these values forces dBm and
+     * the actual numbers are not used.
+     */
+    range->max_qual.level = 0;
+    range->max_qual.noise = 0;
+
+    range->sensitivity = 3;
+
+    range->max_encoding_tokens = 4;
+    /* XXX query driver to find out supported key sizes */
+    range->num_encoding_sizes = 3;
+    range->encoding_size[0] = 5;        /* 40-bit */
+    range->encoding_size[1] = 13;       /* 104-bit */
+    range->encoding_size[2] = 16;       /* 128-bit */
+
+    for (i=0, j=0; i<sizeof(rateTable)/sizeof(rateTable[0]) && j<IW_MAX_BITRATES; ++i) {
+        A_INT8 rateIdx;
+        if (wmi_validate_bitrate(arPriv->arWmi, rateTable[i], &rateIdx)==A_OK) {
+            range->bitrate[j] = wmi_get_rate(i) * 1000;
+            ++j;            
+        }
+    }
+    range->num_bitrates = j;
+
+    /* estimated maximum TCP throughput values (bps) */
+    range->throughput = 22000000;
+
+    range->min_rts = 0;
+    range->max_rts = 2347;
+    range->min_frag = 256;
+    range->max_frag = 2346;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+    if (arSta->wpaOffloadEnabled) {
+        range->enc_capa |= IW_ENC_CAPA_4WAY_HANDSHAKE;
+    }
+#endif /* LINUX_VERSION_CODE >= 2.6.27 */
+
+    up(&ar->arSem);
+
+    return ret;
+}
+
+/*
+ * SIOCSIWPRIV
+ *
+ */
+int
+ar6000_ioctl_siwpriv(struct net_device *dev,
+              struct iw_request_info *info,
+              struct iw_point *data, char *extra)
+{
+    int ret = -EOPNOTSUPP;
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar = arPriv->arSoftc;
+#ifdef ANDROID_ENV
+    extern int android_ioctl_siwpriv(struct net_device *, struct iw_request_info *, struct iw_point *, char*);
+    char cmd[5];
+    if (data->pointer) {
+        if (copy_from_user(cmd, data->pointer, sizeof(cmd))) 
+            return -EIO;
+    }
+#endif
+
+    if (!ar || 
+            ( (!ar->arWmiReady || (ar->arWlanState != WLAN_ENABLED))
+#ifdef ANDROID_ENV
+            && (!data->pointer || strncasecmp(cmd, "START", 5)!=0)
+#endif
+            )
+        ) {
+        return -EIO;
+    }
+
+#ifdef ANDROID_ENV
+    ret = android_ioctl_siwpriv(dev, info, data, extra);
+    if (ret!=-EOPNOTSUPP) {
+        return ret;
+    }
+#endif
+    return ret;
+}
+
+/*
+ * SIOCSIWAP
+ * This ioctl is used to set the desired bssid for the connect command.
+ */
+int
+ar6000_ioctl_siwap(struct net_device *dev,
+              struct iw_request_info *info,
+              struct sockaddr *ap_addr, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_STA_T *arSta     = &arPriv->arSta;
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (ap_addr->sa_family != ARPHRD_ETHER) {
+        return -EIO;
+    }
+
+    if (A_MEMCMP(&ap_addr->sa_data, bcast_mac, AR6000_ETH_ADDR_LEN) == 0) {
+        A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+    } else {
+        A_MEMCPY(arSta->arReqBssid, &ap_addr->sa_data,  sizeof(arSta->arReqBssid));
+    }
+
+    return 0;
+}
+
+/*
+ * SIOCGIWAP
+ */
+int
+ar6000_ioctl_giwap(struct net_device *dev,
+              struct iw_request_info *info,
+              struct sockaddr *ap_addr, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (arPriv->arNetworkType == AP_NETWORK) {
+        A_MEMCPY(&ap_addr->sa_data, dev->dev_addr, ATH_MAC_LEN);
+        ap_addr->sa_family = ARPHRD_ETHER;
+        return 0;
+    }
+
+    if (arPriv->arConnected != TRUE) {
+        return -EINVAL;
+    }
+
+    A_MEMCPY(&ap_addr->sa_data, arPriv->arBssid, sizeof(arPriv->arBssid));
+    ap_addr->sa_family = ARPHRD_ETHER;
+
+    return 0;
+}
+
+#if (WIRELESS_EXT >= 18)
+/*
+ * SIOCSIWMLME
+ */
+int
+ar6000_ioctl_siwmlme(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_point *data, char *extra)
+{
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->bIsDestroyProgress) {
+        return -EBUSY;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+
+    if (data->pointer && data->length == sizeof(struct iw_mlme)) {
+
+        A_UINT8 arNetworkType;
+        struct iw_mlme mlme;
+
+        if (copy_from_user(&mlme, data->pointer, sizeof(struct iw_mlme))) {
+            up(&ar->arSem);
+            return -EIO;
+        }
+
+        switch (mlme.cmd) {
+
+            case IW_MLME_DEAUTH:
+                /* fall through */
+            case IW_MLME_DISASSOC:
+                if ((arPriv->arConnected != TRUE) ||
+                    (memcmp(arPriv->arBssid, mlme.addr.sa_data, 6) != 0)) {
+
+                    up(&ar->arSem);
+                    return -EINVAL;
+                }
+                wmi_setPmkid_cmd(arPriv->arWmi, arPriv->arBssid, NULL, 0);
+                arNetworkType = arPriv->arNetworkType;
+                ar6000_init_profile_info(arPriv);
+                arPriv->arNetworkType = arNetworkType;
+                reconnect_flag = 0;
+                ar6000_disconnect(arPriv);
+                A_MEMZERO(arPriv->arSsid, sizeof(arPriv->arSsid));
+                arPriv->arSsidLen = 0;
+                if (arSta->arSkipScan == FALSE) {
+                    A_MEMZERO(arSta->arReqBssid, sizeof(arSta->arReqBssid));
+                }
+                break;
+
+            case IW_MLME_AUTH:
+                /* fall through */
+            case IW_MLME_ASSOC:
+                /* fall through */
+            default:
+                up(&ar->arSem);
+                return -EOPNOTSUPP;
+        }
+    }
+
+    up(&ar->arSem);
+    return 0;
+}
+#endif /* WIRELESS_EXT >= 18 */
+
+/*
+ * SIOCGIWAPLIST
+ */
+int
+ar6000_ioctl_iwaplist(struct net_device *dev,
+            struct iw_request_info *info,
+            struct iw_point *data, char *extra)
+{
+    return -EIO;            /* for now */
+}
+
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+static A_UINT16 channelList2G[] = {
+    2412, 2417, 2422, 2427, 2432, 2437, 2442,
+    2447, 2452, 2457, 2462, 2467, 2472, 2484
+};
+#endif
+
+/*
+ * SIOCSIWSCAN
+ */
+int
+ar6000_ioctl_siwscan(struct net_device *dev,
+                     struct iw_request_info *info,
+                     struct iw_point *data, char *extra)
+{
+#define ACT_DWELLTIME_DEFAULT   105
+#define HOME_TXDRAIN_TIME       100
+#define SCAN_INT                HOME_TXDRAIN_TIME + ACT_DWELLTIME_DEFAULT
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    AR_SOFTC_STA_T *arSta  = &arPriv->arSta;
+    int ret = 0;
+    struct iw_scan_req *req = (struct iw_scan_req *) extra;
+    A_INT8 numChan = 0;
+    A_UINT16 channelList[IW_MAX_FREQUENCIES], *pChannelList = NULL;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+
+    if (data->length < sizeof(struct iw_scan_req)) {
+        req = NULL;
+    }
+
+    /* If scan is issued in the middle of ongoing scan or connect,
+       dont issue another one */
+    if ( arSta->scan_triggered > 0 ) {
+        ++arSta->scan_triggered;
+        if (arSta->scan_triggered < 5) {
+            up(&ar->arSem);
+            return 0;
+        } else {
+            AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_SCAN,("Scan request is triggered over 5 times. Not scan complete event\n"));
+        }
+    } 
+
+    if (!arSta->arUserBssFilter) {
+        if (wmi_bssfilter_cmd(arPriv->arWmi, ALL_BSS_FILTER, 0) != A_OK) {
+            up(&ar->arSem);
+            return -EIO;
+        }
+    }
+
+    if (arPriv->arConnected) {
+        if  (wmi_get_stats_cmd(arPriv->arWmi) != A_OK) {
+            up(&ar->arSem);
+            return -EIO;
+        }
+    }
+
+#if WIRELESS_EXT >= 18
+    if ( req && (data->flags & IW_SCAN_THIS_ESSID) == IW_SCAN_THIS_ESSID ) {   
+        if (wmi_probedSsid_cmd(arPriv->arWmi, 0,
+             SPECIFIC_SSID_FLAG, req->essid_len, req->essid) == A_OK) {
+            if (!arSta->scanSpecificSsid) {
+                arSta->scanSpecificSsid = 1;
+            }
+        }
+    } else {
+        A_UINT8 idx;
+        for (idx=0; idx<arSta->scanSpecificSsid; ++idx) {
+            /* index 0 always reserves for broadcast SSID*/
+            A_UINT8 flag = (idx==0) ? ANY_SSID_FLAG : DISABLE_SSID_FLAG;
+            wmi_probedSsid_cmd(arPriv->arWmi, idx, flag, 0, NULL);
+        }
+        arSta->scanSpecificSsid = 0;
+    }
+
+    if ( req && (data->flags & IW_SCAN_THIS_FREQ) == IW_SCAN_THIS_FREQ && req->num_channels>0) {
+        A_UINT8 i;        
+        for (i=0; i<req->num_channels; ++i) {
+            struct iw_freq *freq = &req->channel_list[i];
+            A_UINT16 *dst = &channelList[numChan];
+            if (freq->e == 1) {
+                /* freq->m == (Freq HZ value) divided by (10 ^ freq->e) */
+                *dst = freq->m / 100000;
+                ++numChan;
+            } else if (freq->e < 1 && freq->m)  {
+                /* It is a channel number if freq->e == 0 */
+                *dst = wlan_ieee2freq(freq->m);
+                ++numChan;
+            }
+        }
+        if (numChan > 0) {
+            pChannelList = channelList;
+        }
+    }
+#endif /* WIRELESS_EXT >= 18 */
+
+#if WLAN_CONFIG_FIRST_SCAN_2G_ONLY
+    /* 
+     * EV93646: Required to reduce connection time to an AP
+     * To reduce connection time after turn on, scan only 2.4G band for the first scan
+     */
+    if (first_scan_2g_only && pChannelList == NULL) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_INFO,("AR6K: scan 2.4GHz band only\n"));
+
+        pChannelList = channelList2G;
+        numChan = ARRAY_SIZE(channelList2G);
+        first_scan_2g_only = 0;
+         }
+#endif
+
+        if (wmi_startscan_cmd(arPriv->arWmi, WMI_LONG_SCAN, FALSE, FALSE, \
+                    0, 0, numChan, pChannelList) != A_OK) {
+
+            ret = -EIO;
+        }
+    if (ret == 0) {
+        arSta->scan_triggered = 1;
+    }
+
+    up(&ar->arSem);
+    return ret;
+#undef  ACT_DWELLTIME_DEFAULT
+#undef HOME_TXDRAIN_TIME
+#undef SCAN_INT
+}
+
+
+/*
+ * Units are in db above the noise floor. That means the
+ * rssi values reported in the tx/rx descriptors in the
+ * driver are the SNR expressed in db.
+ *
+ * If you assume that the noise floor is -95, which is an
+ * excellent assumption 99.5 % of the time, then you can
+ * derive the absolute signal level (i.e. -95 + rssi).
+ * There are some other slight factors to take into account
+ * depending on whether the rssi measurement is from 11b,
+ * 11g, or 11a.   These differences are at most 2db and
+ * can be documented.
+ *
+ * NB: various calculations are based on the orinoco/wavelan
+ *     drivers for compatibility
+ */
+static void
+ar6000_set_quality(struct iw_quality *iq, A_INT8 rssi)
+{
+    if (rssi < 0) {
+        iq->qual = 0;
+    } else {
+        iq->qual = rssi;
+    }
+
+    /* NB: max is 94 because noise is hardcoded to 161 */
+    if (iq->qual > 94)
+        iq->qual = 94;
+
+    iq->noise = 161;        /* -95dBm */
+    iq->level = iq->noise + iq->qual;
+    iq->updated = 7;
+}
+
+
+int
+ar6000_ioctl_siwcommit(struct net_device *dev,
+                     struct iw_request_info *info,
+                     struct iw_point *data, char *extra)
+{
+
+    AR_SOFTC_DEV_T *arPriv = (AR_SOFTC_DEV_T *)ar6k_priv(dev);
+    AR_SOFTC_T     *ar     = arPriv->arSoftc;
+    A_STATUS       status  = A_OK;
+    int            ret     = 0;
+
+    if (is_iwioctl_allowed(arPriv->arNextMode, info->cmd) != A_OK) {
+        AR_DEBUG_PRINTF(ATH_DEBUG_ERR,("wext_ioctl: cmd=0x%x not allowed in this mode\n", info->cmd));
+        return -EOPNOTSUPP;
+    }
+
+    if (ar->arWmiReady == FALSE) {
+        return -EIO;
+    }
+
+    if (ar->arWlanState == WLAN_DISABLED) {
+        return -EIO;
+    }
+
+    if (down_interruptible(&ar->arSem)) {
+        return -ERESTARTSYS;
+    }
+
+    if (ar->bIsDestroyProgress || ar->arWlanState == WLAN_DISABLED) {
+        up(&ar->arSem);
+        return -EBUSY;
+    }
+
+    AR_DEBUG_PRINTF(ATH_DEBUG_WLAN_CONNECT,("AP: SSID %s freq %d authmode %d dot11 auth %d"\
+                    " PW crypto %d GRP crypto %d\n",
+                    arPriv->arSsid, arPriv->arChannelHint,
+                    arPriv->arAuthMode, arPriv->arDot11AuthMode,
+                    arPriv->arPairwiseCrypto, arPriv->arGroupCrypto));
+
+    /* Stop getting pkts from upper stack */
+    netif_stop_queue(arPriv->arNetDev);
+    /* Flush the Tx queues */
+    ar6000_TxDataCleanup(ar);
+    /* Start getting pkts from upper stack */
+    netif_wake_queue(arPriv->arNetDev);
+
+    status = ar6000_check_connect_request(arPriv, TRUE);
+    if(A_OK == status)
+        ret = ar6000_ap_mode_profile_commit(arPriv);
+    else if(A_ERROR == status)
+        ret = -EINVAL;
+
+    up(&ar->arSem);
+    return ret;
+}
+
+#define W_PROTO(_x) wait_ ## _x
+#define WAIT_HANDLER_IMPL(_x, type) \
+int wait_ ## _x (struct net_device *dev, struct iw_request_info *info, type wrqu, char *extra) {\
+    int ret; \
+    dev_hold(dev); \
+    ret = _x(dev, info, wrqu, extra); \
+    dev_put(dev); \
+    return ret;\
+}
+
+WAIT_HANDLER_IMPL(ar6000_ioctl_siwessid, struct iw_point *)
+WAIT_HANDLER_IMPL(ar6000_ioctl_giwrate, struct iw_param *)
+WAIT_HANDLER_IMPL(ar6000_ioctl_giwtxpow, struct iw_param *)
+WAIT_HANDLER_IMPL(ar6000_ioctl_giwrange, struct iw_point*)
+
+/* Structures to export the Wireless Handlers */
+static const iw_handler ath_handlers[] = {
+    (iw_handler) ar6000_ioctl_siwcommit,        /* SIOCSIWCOMMIT */
+    (iw_handler) ar6000_ioctl_giwname,          /* SIOCGIWNAME */
+    (iw_handler) NULL,                          /* SIOCSIWNWID */
+    (iw_handler) NULL,                          /* SIOCGIWNWID */
+    (iw_handler) ar6000_ioctl_siwfreq,          /* SIOCSIWFREQ */
+    (iw_handler) ar6000_ioctl_giwfreq,          /* SIOCGIWFREQ */
+    (iw_handler) ar6000_ioctl_siwmode,          /* SIOCSIWMODE */
+    (iw_handler) ar6000_ioctl_giwmode,          /* SIOCGIWMODE */
+    (iw_handler) ar6000_ioctl_siwsens,          /* SIOCSIWSENS */
+    (iw_handler) ar6000_ioctl_giwsens,          /* SIOCGIWSENS */
+    (iw_handler) NULL /* not _used */,          /* SIOCSIWRANGE */
+    (iw_handler) W_PROTO(ar6000_ioctl_giwrange),/* SIOCGIWRANGE */
+    (iw_handler) ar6000_ioctl_siwpriv,         /* SIOCSIWPRIV */
+    (iw_handler) NULL /* kernel code */,        /* SIOCGIWPRIV */
+    (iw_handler) NULL /* not used */,           /* SIOCSIWSTATS */
+    (iw_handler) NULL /* kernel code */,        /* SIOCGIWSTATS */
+    (iw_handler) NULL,                          /* SIOCSIWSPY */
+    (iw_handler) NULL,                          /* SIOCGIWSPY */
+    (iw_handler) NULL,                          /* SIOCSIWTHRSPY */
+    (iw_handler) NULL,                          /* SIOCGIWTHRSPY */
+    (iw_handler) ar6000_ioctl_siwap,            /* SIOCSIWAP */
+    (iw_handler) ar6000_ioctl_giwap,            /* SIOCGIWAP */
+#if (WIRELESS_EXT >= 18)
+    (iw_handler) ar6000_ioctl_siwmlme,          /* SIOCSIWMLME */
+#else
+    (iw_handler) NULL,                          /* -- hole -- */
+#endif  /* WIRELESS_EXT >= 18 */
+    (iw_handler) ar6000_ioctl_iwaplist,         /* SIOCGIWAPLIST */
+    (iw_handler) ar6000_ioctl_siwscan,          /* SIOCSIWSCAN */
+    (iw_handler) ar6000_ioctl_giwscan,          /* SIOCGIWSCAN */
+    (iw_handler) W_PROTO(ar6000_ioctl_siwessid),/* SIOCSIWESSID */
+    (iw_handler) ar6000_ioctl_giwessid,         /* SIOCGIWESSID */
+    (iw_handler) NULL,                          /* SIOCSIWNICKN */
+    (iw_handler) NULL,                          /* SIOCGIWNICKN */
+    (iw_handler) NULL,                          /* -- hole -- */
+    (iw_handler) NULL,                          /* -- hole -- */
+    (iw_handler) ar6000_ioctl_siwrate,          /* SIOCSIWRATE */
+    (iw_handler) W_PROTO(ar6000_ioctl_giwrate), /* SIOCGIWRATE */
+    (iw_handler) NULL,                          /* SIOCSIWRTS */
+    (iw_handler) NULL,                          /* SIOCGIWRTS */
+    (iw_handler) NULL,                          /* SIOCSIWFRAG */
+    (iw_handler) NULL,                          /* SIOCGIWFRAG */
+    (iw_handler) ar6000_ioctl_siwtxpow,         /* SIOCSIWTXPOW */
+    (iw_handler) W_PROTO(ar6000_ioctl_giwtxpow),/* SIOCGIWTXPOW */
+    (iw_handler) ar6000_ioctl_siwretry,         /* SIOCSIWRETRY */
+    (iw_handler) ar6000_ioctl_giwretry,         /* SIOCGIWRETRY */
+    (iw_handler) ar6000_ioctl_siwencode,        /* SIOCSIWENCODE */
+    (iw_handler) ar6000_ioctl_giwencode,        /* SIOCGIWENCODE */
+#if WIRELESS_EXT > 20
+    (iw_handler) ar6000_ioctl_siwpower,         /* SIOCSIWPOWER */
+    (iw_handler) ar6000_ioctl_giwpower,         /* SIOCGIWPOWER */
+#endif // WIRELESS_EXT > 20
+#if WIRELESS_EXT >= 18
+    (iw_handler) NULL,                          /* -- hole -- */
+    (iw_handler) NULL,                          /* -- hole -- */
+    (iw_handler) ar6000_ioctl_siwgenie,         /* SIOCSIWGENIE */
+    (iw_handler) ar6000_ioctl_giwgenie,         /* SIOCGIWGENIE */
+    (iw_handler) ar6000_ioctl_siwauth,          /* SIOCSIWAUTH */
+    (iw_handler) ar6000_ioctl_giwauth,          /* SIOCGIWAUTH */
+    (iw_handler) ar6000_ioctl_siwencodeext,     /* SIOCSIWENCODEEXT */
+    (iw_handler) ar6000_ioctl_giwencodeext,     /* SIOCGIWENCODEEXT */
+    (iw_handler) ar6000_ioctl_siwpmksa,         /* SIOCSIWPMKSA */
+#endif // WIRELESS_EXT >= 18
+};
+
+struct iw_handler_def ath_iw_handler_def = {
+    .standard         = (iw_handler *)ath_handlers,
+    .num_standard     = ARRAY_SIZE(ath_handlers),
+    .private          = NULL,
+    .num_private      = 0,
+};
diff --git a/host/tools/dbgParser/COPYING b/host/tools/dbgParser/COPYING
new file mode 100644
index 0000000..ee0d2e3
--- /dev/null
+++ b/host/tools/dbgParser/COPYING
@@ -0,0 +1,14 @@
+Copyright (c) 2006 Atheros Communications Inc.
+All rights reserved.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/host/tools/dbgParser/Makefile b/host/tools/dbgParser/Makefile
new file mode 100644
index 0000000..944600e
--- /dev/null
+++ b/host/tools/dbgParser/Makefile
@@ -0,0 +1,17 @@
+CC := $(ATH_CROSS_COMPILE_TYPE)gcc
+KERNEL_SRC :=$(ATH_LINUXPATH)
+
+PREFIX ?= /usr
+SBINDIR ?= $(PREFIX)/sbin
+INSTALL ?= install
+
+override CFLAGS += -Wall -I./ -I../../include -I../../../include -I../../wlan/include -I../../os/linux/include
+
+dbgParser: dbgFormatter.c dbgParser.c
+	$(CC) $(CFLAGS) -o $@ $^ $(LDLIBS)
+
+install: dbgParser
+	install -m 755 dbgParser $(DESTDIR)$(SBINDIR)
+
+clean:
+	rm -f dbgParser
diff --git a/host/tools/dbgParser/dbgFormatter.c b/host/tools/dbgParser/dbgFormatter.c
new file mode 100644
index 0000000..36794ac
--- /dev/null
+++ b/host/tools/dbgParser/dbgFormatter.c
@@ -0,0 +1,1827 @@
+//
+// Copyright (c) 2006 Atheros Communications Inc.
+// All rights reserved.
+// 
+//
+// 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+// 
+//
+
+/* This tool parses the recevent logs stored in the binary format 
+   by the wince athsrc */
+#define WAPI_ENABLE
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <a_config.h>
+#include <a_osapi.h>
+#include <a_types.h>
+#include <athdefs.h>
+#include <ieee80211.h>
+#include <wmi.h>
+#include <athdrv_linux.h>
+#include <dbglog_api.h>
+#include <dbglog_id.h>
+
+#include "dbg_cmd_evt.h"
+
+typedef int (*DbgCmdFormatter)(char *output, size_t len, const A_UINT8 *);
+typedef int (*DbgLogFormatter)(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer);
+
+struct dbglog_desc {
+    A_INT32 oid;
+    const char *desc;
+    DbgLogFormatter formatter;
+};
+
+struct module_desc {
+    int module;
+    const char *name;
+    struct dbglog_desc *descs;
+    size_t len;
+    int bsearch;
+};
+
+struct wmi_id_desc {
+    A_INT32 oid;
+    const char *desc;
+    DbgCmdFormatter formatter;
+    size_t cmdSize;
+};
+
+#define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
+#define CASE_STR_CONST(_s, _n, _val) case _n: (_val) = #_s; break
+#define CASE_STR(_x, _val) case _x: (_val) = #_x; break
+#define CASE_DEF_STR(_val) default: (_val) = "Unknown"; break
+#define BIT_STR(_b, _l, _r, _s, _c, _v) if (((_v) & (_c)) == (_c)) (_r) += snprintf((_b)+(_r), (_l)-(_r), _s)
+
+#define DBG_DESC(_x) { _x, #_x, NULL }
+#define DBG_DESC_FMT(_x) { _x, #_x, _x ## _fmt }
+
+#define WM_ID_DESC(_x) { _x, #_x, NULL, 0 }
+#define WM_ID_DESC_FMT(_x, s) { _x, #_x, _x ## _fmt, s }
+
+#define MODULE_DESC(_x, _d) { DBGLOG_MODULEID_ ## _x, #_x, _d, ARRAY_SIZE(_d),0}
+
+extern A_CHAR dbglog_id_tag[DBGLOG_MODULEID_NUM_MAX][DBGLOG_DBGID_NUM_MAX][DBGLOG_DBGID_DEFINITION_LEN_MAX];
+static int check_ids;
+
+static const char *pmmode2text(A_INT32 mode)
+{
+    const char *pm;
+    switch (mode) {
+    case 1: pm = "sleep"; break;
+    case 2: pm = "awake"; break;
+    case 3: pm = "fake_sleep"; break;
+    default: pm = "unknown"; break;
+    }
+    return pm;
+}
+
+#if 0
+static const char *module2text(A_INT32 moduleid)
+{
+    const char *msg;
+    switch (moduleid) {
+    CASE_STR_CONST(INF, DBGLOG_MODULEID_INF, msg);
+    CASE_STR_CONST(WMI, DBGLOG_MODULEID_WMI, msg);
+    CASE_STR_CONST(MISC, DBGLOG_MODULEID_MISC, msg);
+    CASE_STR_CONST(PM, DBGLOG_MODULEID_PM, msg);
+    CASE_STR_CONST(MGMTBUF, DBGLOG_MODULEID_TXRX_MGMTBUF, msg);
+    CASE_STR_CONST(TXBUF, DBGLOG_MODULEID_TXRX_TXBUF, msg);
+    CASE_STR_CONST(RXBUF, DBGLOG_MODULEID_TXRX_RXBUF, msg);
+    CASE_STR_CONST(WOW, DBGLOG_MODULEID_WOW, msg);
+    CASE_STR_CONST(WHAL, DBGLOG_MODULEID_WHAL, msg);
+    CASE_STR_CONST(DC, DBGLOG_MODULEID_DC, msg);
+    CASE_STR_CONST(CO, DBGLOG_MODULEID_CO, msg);
+    CASE_STR_CONST(RO, DBGLOG_MODULEID_RO, msg);
+    CASE_STR_CONST(CM, DBGLOG_MODULEID_CM, msg);
+    CASE_STR_CONST(MGMT, DBGLOG_MODULEID_MGMT, msg);
+    CASE_STR_CONST(TMR, DBGLOG_MODULEID_TMR, msg);
+    CASE_STR_CONST(BTCOEX, DBGLOG_MODULEID_BTCOEX, msg);
+    CASE_DEF_STR(msg);
+    }
+    return msg;
+}
+#endif
+
+static const char *pmmodule2text(A_INT32 moduleid)
+{
+    const char *msg;
+    switch (moduleid) {
+    CASE_STR_CONST(CSERV, 1, msg);
+    CASE_STR_CONST(MLME   , 2, msg);
+    CASE_STR_CONST(TXRX   , 3, msg);
+    CASE_STR_CONST(PM     , 4, msg);
+    CASE_STR_CONST(BT_COEX, 5, msg);
+    CASE_STR_CONST(CO     , 6, msg);
+    CASE_STR_CONST(DC     , 7, msg);
+    CASE_STR_CONST(RO     , 8, msg);
+    CASE_STR_CONST(CM     , 9, msg);
+    CASE_STR_CONST(RRM    , 10, msg);
+    CASE_STR_CONST(AP     , 11, msg);
+    CASE_STR_CONST(KEYMGMT, 12, msg);
+    CASE_STR_CONST(CCX    , 13, msg);
+    CASE_STR_CONST(MISC   , 14, msg);
+    CASE_STR_CONST(DFS    , 15, msg);
+    CASE_STR_CONST(TIMER  , 16, msg);
+    CASE_DEF_STR(msg);
+    }
+    return msg;
+}
+
+static const char *status2text(A_STATUS status)
+{
+    const char *msg;
+    switch (status) {
+    CASE_STR(A_ERROR, msg);
+    CASE_STR(A_OK, msg);                   /* success */
+                                /* Following values start at 1 */
+    CASE_STR(A_DEVICE_NOT_FOUND, msg);         /* not able to find PCI device */
+    CASE_STR(A_NO_MEMORY, msg);                /* not able to allocate memory, msg); not available */
+    CASE_STR(A_MEMORY_NOT_AVAIL, msg);         /* memory region is not free for mapping */
+    CASE_STR(A_NO_FREE_DESC, msg);             /* no free descriptors available */
+    CASE_STR(A_BAD_ADDRESS, msg);              /* address does not match descriptor */
+    CASE_STR(A_WIN_DRIVER_ERROR, msg);         /* used in NT_HW version, msg); if problem at init */
+    CASE_STR(A_REGS_NOT_MAPPED, msg);          /* registers not correctly mapped */
+    CASE_STR(A_EPERM, msg);                    /* Not superuser */
+    CASE_STR(A_EACCES, msg);                   /* Access denied */
+    CASE_STR(A_ENOENT, msg);                   /* No such entry, msg); search failed, msg); etc. */
+    CASE_STR(A_EEXIST, msg);                   /* The object already exists (can't create) */
+    CASE_STR(A_EFAULT, msg);                   /* Bad address fault */
+    CASE_STR(A_EBUSY, msg);                    /* Object is busy */
+    CASE_STR(A_EINVAL, msg);                   /* Invalid parameter */
+    CASE_STR(A_EMSGSIZE, msg);                 /* Inappropriate message buffer length */
+    CASE_STR(A_ECANCELED, msg);                /* Operation canceled */
+    CASE_STR(A_ENOTSUP, msg);                  /* Operation not supported */
+    CASE_STR(A_ECOMM, msg);                    /* Communication error on send */
+    CASE_STR(A_EPROTO, msg);                   /* Protocol error */
+    CASE_STR(A_ENODEV, msg);                   /* No such device */
+    CASE_STR(A_EDEVNOTUP, msg);                /* device is not UP */
+    CASE_STR(A_NO_RESOURCE, msg);              /* No resources for requested operation */
+    CASE_STR(A_HARDWARE, msg);                 /* Hardware failure */
+    CASE_STR(A_PENDING, msg);                  /* Asynchronous routine; will send up results la
+ter (typically in callback) */
+    CASE_STR(A_EBADCHANNEL, msg);              /* The channel cannot be used */
+    CASE_STR(A_DECRYPT_ERROR, msg);            /* Decryption error */
+    CASE_STR(A_PHY_ERROR, msg);                /* RX PHY error */
+    CASE_STR(A_CONSUMED, msg);                    /* Object was consumed */
+    CASE_DEF_STR(msg);
+    }
+    return msg;
+}
+
+static const char *btStatus2text(A_INT32 status)
+{
+    const char *btState;
+    switch (status) {
+    CASE_STR_CONST(BT_UNDEF, 1, btState);
+    CASE_STR_CONST(BT_ON, 2, btState);
+    CASE_STR_CONST(BT_OFF, 3, btState); 
+    CASE_STR_CONST(BT_IGNORE, 4, btState);    
+    CASE_DEF_STR(btState);
+    }
+    return btState;
+}
+
+static int cipher2text(char *buf, size_t len, A_UINT8 cipher)
+{
+    int ret = 0;
+    BIT_STR(buf, len, ret, "none ", NONE_CRYPT, cipher);
+    BIT_STR(buf, len, ret, "wep ", WEP_CRYPT, cipher);
+    BIT_STR(buf, len, ret, "tkip ", TKIP_CRYPT, cipher);
+    BIT_STR(buf, len, ret, "aes ", AES_CRYPT, cipher);
+    buf[(ret>0) ? --ret : ret] = 0;
+    return ret;
+}
+
+static const char* enable2text(A_INT32 enable)
+{
+    return enable ? "ENABLE" : "DISABLE";
+}
+
+static const char* txrxstatus2text(A_INT32 status)
+{
+    const char *txstatus;
+    switch (status) {
+    CASE_STR_CONST(TXRX_ERROR, -1, txstatus);
+    CASE_STR_CONST(TXRX_OK                 ,  0, txstatus);
+    CASE_STR_CONST(TXRX_FAILED             ,  1, txstatus);
+    CASE_STR_CONST(TXRX_Q_IS_EMPTY         ,  2, txstatus);
+    CASE_STR_CONST(TXRX_Q_NOT_DRAINED      ,  3, txstatus);
+    CASE_STR_CONST(TXRX_Q_DRAINED_ALL      ,  4, txstatus);
+    CASE_STR_CONST(TXRX_Q_DRAIN_PENDING    ,  5, txstatus);
+    CASE_STR_CONST(TXRX_IS_MGMT_PKT        ,  6, txstatus);
+    CASE_STR_CONST(TXRX_IS_DATA_PKT        ,  7, txstatus);
+    CASE_STR_CONST(TXRX_SAVED_AS_FRAG      ,  8, txstatus);
+    CASE_STR_CONST(TXRX_Q_IS_PAUSED        ,  9, txstatus);
+    CASE_STR_CONST(TXRX_RX_SEND_TO_HOST    , 10, txstatus);
+    CASE_STR_CONST(TXRX_ERROR_PKT_DRAINED  , 11, txstatus);
+    CASE_STR_CONST(TXRX_EOL_EXPIRED        , 12, txstatus);
+    CASE_STR_CONST(TXRX_PS_FILTERED        , 13,  txstatus);
+    CASE_STR_CONST(TXRX_RX_SEND_TO_TX      , 14,  txstatus);
+    CASE_DEF_STR(txstatus);
+    }
+    return txstatus;
+}
+
+static int rxfilter2text(char *buf, size_t blen, A_INT32 rxfilter)
+{
+    int ret = 0;  
+    BIT_STR(buf, blen, ret, "UCAST "    , 0x00000001, rxfilter);
+    BIT_STR(buf, blen, ret, "MCAST "    , 0x00000002, rxfilter);
+    BIT_STR(buf, blen, ret, "BCAST "   , 0x00000004, rxfilter);
+    BIT_STR(buf, blen, ret, "CONTROL "  , 0x00000008, rxfilter);
+    BIT_STR(buf, blen, ret, "BEACON "  , 0x00000010, rxfilter);
+    BIT_STR(buf, blen, ret, "PROM "    , 0x00000020, rxfilter);
+    BIT_STR(buf, blen, ret, "PROBEREQ ", 0x00000080, rxfilter);
+    BIT_STR(buf, blen, ret, "MYBEACON ", 0x00000200, rxfilter);
+    BIT_STR(buf, blen, ret, "COMP_BAR ", 0x00000400, rxfilter);
+    BIT_STR(buf, blen, ret, "COMP_BA " , 0x00000800, rxfilter);
+    BIT_STR(buf, blen, ret, "UNCOMP_BA_BAR " , 0x00001000, rxfilter);
+    BIT_STR(buf, blen, ret, "PS_POLL " , 0x00004000, rxfilter);
+    BIT_STR(buf, blen, ret, "MCAST_BCAST_ALL " , 0x00008000, rxfilter);
+    BIT_STR(buf, blen, ret, "FROM_TO_DS "      , 0x00020000, rxfilter);
+    buf[(ret>0) ? --ret : ret] = 0;
+    return ret;
+}
+
+static int btState2text(char *buf, size_t blen, A_INT32 btState)
+{
+    int bret = 0;
+    BIT_STR(buf, blen, bret, "SCO ", (1<<1), btState);
+    BIT_STR(buf, blen, bret, "A2DP ", (1<<2), btState);
+    BIT_STR(buf, blen, bret, "SCAN ", (1<<3), btState);
+    BIT_STR(buf, blen, bret, "ESCO ", (1<<4), btState);
+    buf[(bret>0) ? --bret : bret] = 0;
+    return bret;
+}
+
+static int btcoexFlags2text(char *buf, size_t blen, A_INT32 btCoexFlags)
+{
+    int bret = 0;
+    BIT_STR(buf, blen, bret, "SCO_ON ", 0x0001, btCoexFlags);
+    BIT_STR(buf, blen, bret, "A2DP_ON ", 0x0002, btCoexFlags);
+    BIT_STR(buf, blen, bret, "ACL_ON ", 0x0004, btCoexFlags);
+    BIT_STR(buf, blen, bret, "INQUIRY_ON ", 0x0008, btCoexFlags);
+    BIT_STR(buf, blen, bret, "VOIP ", 0x0010, btCoexFlags);
+    BIT_STR(buf, blen, bret, "RXDATA_PENDING ", 0x0020, btCoexFlags);
+    BIT_STR(buf, blen, bret, "SLEEP_PENDING ", 0x0040, btCoexFlags);
+    BIT_STR(buf, blen, bret, "FAKESLEEP_ON ", 0x0080, btCoexFlags);
+    BIT_STR(buf, blen, bret, "ADD_BA_PENDING ", 0x0100, btCoexFlags);
+    BIT_STR(buf, blen, bret, "WAKEUP_TIM_INTR ", 0x0200, btCoexFlags);
+    BIT_STR(buf, blen, bret, "OPT_MODE ", 0x0400, btCoexFlags);
+    BIT_STR(buf, blen, bret, "FIRST_BMISS ", 0x0800, btCoexFlags);
+    BIT_STR(buf, blen, bret, "BEACON_PROTECION_ON ", 0x1000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "WAIT_FOR_NULL_COMP ", 0x4000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "PROTECT_POST_INQUIRY ", 0x8000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "DUAL_ANT_ACTIVE ", 0x10000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "DUAL_ANT_WAKEUP_TIM ", 0x20000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "STOMP_FOR_DTIM_RECV ", 0x40000, btCoexFlags);
+    BIT_STR(buf, blen, bret, "ENABLE_COEX_ON_BCN_RECV ", 0x80000, btCoexFlags);
+    buf[(bret>0) ? --bret : bret] = 0;
+    return bret;
+}
+
+static int WMI_SET_MCAST_FILTER_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_SET_MCAST_FILTER_CMD *cmd = (WMI_SET_MCAST_FILTER_CMD*)cmdbuf;
+    return snprintf(output, len, "%02X:%02X:%02X:%02X:%02X:%02X",
+                    cmd->multicast_mac[0], cmd->multicast_mac[1], cmd->multicast_mac[2], 
+                    cmd->multicast_mac[3], cmd->multicast_mac[4], cmd->multicast_mac[5]);
+}
+
+static int WMI_DEL_MCAST_FILTER_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    return WMI_SET_MCAST_FILTER_CMDID_fmt(output, len, cmdbuf);
+}
+
+static int WMI_MCAST_FILTER_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_MCAST_FILTER_CMD *cmd = (WMI_MCAST_FILTER_CMD*)cmdbuf;
+    return snprintf(output, len, "%s", enable2text(cmd->enable));
+}
+
+static int WMI_START_SCAN_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    int i;
+    int ret = 0;
+    WMI_START_SCAN_CMD *cmd = (WMI_START_SCAN_CMD*)cmdbuf;
+    const char *scanType = (cmd->scanType == WMI_SHORT_SCAN) ? "short" : "long";
+    if (cmd->forceFgScan) {
+        ret += snprintf(output+ret, len-ret, "forceFg ");
+    }
+    ret += snprintf(output+ret, len-ret, "hmdwell %u ", cmd->homeDwellTime);
+    ret += snprintf(output+ret, len-ret, "fscanint %u ", cmd->forceScanInterval);
+    ret += snprintf(output+ret, len-ret, "%s ", scanType);
+    for (i=0; i<cmd->numChannels; ++i) {
+        ret += snprintf(output+ret, len-ret, "%d ", cmd->channelList[i]);
+    }
+    return ret;
+}
+
+static int WMI_CONNECT_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_CONNECT_CMD *cmd = (WMI_CONNECT_CMD*)cmdbuf;
+    char ssid[33];
+    char pairwise[128], group[128];
+    const char *dot11Auth, *authMode;
+    memcpy(ssid, cmd->ssid, 32);
+    ssid[cmd->ssidLength] = 0;
+    cipher2text(pairwise, sizeof(pairwise), cmd->pairwiseCryptoType);
+    cipher2text(group, sizeof(group), cmd->groupCryptoType);
+
+    switch (cmd->dot11AuthMode) {
+    CASE_STR(OPEN_AUTH, dot11Auth);
+    CASE_STR(SHARED_AUTH, dot11Auth);
+    CASE_STR(LEAP_AUTH, dot11Auth);
+    CASE_DEF_STR(dot11Auth);
+    }
+
+    switch (cmd->authMode) {
+    CASE_STR(WMI_NONE_AUTH, authMode);
+    CASE_STR(WMI_WPA_AUTH, authMode);
+    CASE_STR(WMI_WPA2_AUTH, authMode);
+    CASE_STR(WMI_WPA_PSK_AUTH, authMode);
+    CASE_STR(WMI_WPA2_PSK_AUTH, authMode);
+    CASE_STR(WMI_WPA_AUTH_CCKM, authMode);
+    CASE_STR(WMI_WPA2_AUTH_CCKM, authMode);
+    CASE_DEF_STR(authMode);
+    }
+    return snprintf(output, len, "'%s' ch %d %s %s uni:%s grp:%s %02X:%02X:%02X:%02X:%02X:%02X ctrl 0x%x",
+        ssid, cmd->channel, 
+        dot11Auth, authMode, pairwise, group,
+        cmd->bssid[0], cmd->bssid[1], cmd->bssid[2], 
+        cmd->bssid[3], cmd->bssid[4], cmd->bssid[5], 
+        cmd->ctrl_flags);
+}
+
+static int WMI_SET_BTCOEX_FE_ANT_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_SET_BTCOEX_FE_ANT_CMD *cmd = (WMI_SET_BTCOEX_FE_ANT_CMD*)cmdbuf;
+    const char *fe;
+    switch (cmd->btcoexFeAntType) {
+    CASE_STR(WMI_BTCOEX_NOT_ENABLED, fe);
+    CASE_STR(WMI_BTCOEX_FE_ANT_SINGLE, fe);
+    CASE_STR(WMI_BTCOEX_FE_ANT_DUAL, fe);
+    CASE_STR(WMI_BTCOEX_FE_ANT_DUAL_HIGH_ISO, fe);
+    CASE_DEF_STR(fe);
+    }
+    return snprintf(output, len, "%s", fe);
+}
+
+static int WMI_SET_BTCOEX_SCO_CONFIG_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_SET_BTCOEX_SCO_CONFIG_CMD *cmd = (WMI_SET_BTCOEX_SCO_CONFIG_CMD*)cmdbuf;
+    char scoFlags[512];
+    int blen = sizeof(scoFlags);
+    int bret = 0;
+    BIT_STR(scoFlags, blen, bret, "OPT ", (1<<0), cmd->scoConfig.scoFlags);
+    BIT_STR(scoFlags, blen, bret, "EDR ", (1<<1), cmd->scoConfig.scoFlags);   
+    BIT_STR(scoFlags, blen, bret, "MASTER ", (1<<2), cmd->scoConfig.scoFlags);
+    BIT_STR(scoFlags, blen, bret, "FRM ", (1<<3), cmd->scoConfig.scoFlags);
+    scoFlags[(bret>0) ? --bret : bret] = 0;
+
+    return snprintf(output, len, "%d/%d slots [%s] ps %u-%u-%u opt %u-%u-%u-%u-%u-%u scan %u/%u", 
+                    cmd->scoConfig.scoSlots, cmd->scoConfig.scoIdleSlots, scoFlags,
+
+                    cmd->scoPspollConfig.scoCyclesForceTrigger,
+                    cmd->scoPspollConfig.scoDataResponseTimeout,
+                    cmd->scoPspollConfig.scoPsPollLatencyFraction,
+
+                    cmd->scoOptModeConfig.scoStompCntIn100ms,
+	                cmd->scoOptModeConfig.scoContStompMax,
+	                cmd->scoOptModeConfig.scoMinlowRateMbps,
+	                cmd->scoOptModeConfig.scoLowRateCnt,
+	                cmd->scoOptModeConfig.scoHighPktRatio,
+	                cmd->scoOptModeConfig.scoMaxAggrSize,
+
+                    cmd->scoWlanScanConfig.scanInterval,
+                    cmd->scoWlanScanConfig.maxScanStompCnt);
+}
+
+static int WMI_SET_BTCOEX_A2DP_CONFIG_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    return 0;
+}
+
+static int WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    return 0;
+}
+
+static int WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD *cmd = (WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD*)cmdbuf;
+    return snprintf(output, len, "pspoll every %u inquiry duration %u",
+                    cmd->btInquiryDataFetchFrequency,
+                    cmd->protectBmissDurPostBtInquiry);
+}
+
+static int WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD *cmd = (WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD*)cmdbuf;
+    const char *profile;
+    const char *op = (cmd->btOperatingStatus==1) ? "START" : "STOP";
+    switch (cmd->btProfileType) {
+    CASE_STR_CONST(SCO, 1, profile);
+    CASE_STR_CONST(A2DP, 2, profile);
+    CASE_STR_CONST(Inquiry, 3, profile);
+    CASE_STR_CONST(ACL, 4, profile);
+    CASE_DEF_STR(profile);
+    }
+    return snprintf(output, len, "%s %s", profile, op);
+}
+
+static int WMI_SET_LISTEN_INT_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_LISTEN_INT_CMD *cmd = (WMI_LISTEN_INT_CMD*)cmdbuf;
+    return snprintf(output, len, "interval %d numBeacons %d", cmd->listenInterval, cmd->numBeacons);
+}
+
+static int WMI_SET_BSS_FILTER_CMDID_fmt(char *output, size_t len, const A_UINT8 *cmdbuf)
+{
+    WMI_BSS_FILTER_CMD *cmd = (WMI_BSS_FILTER_CMD*)cmdbuf;
+    const char *filter;
+    switch (cmd->bssFilter) {
+    CASE_STR(NONE_BSS_FILTER, filter);
+    CASE_STR(ALL_BSS_FILTER, filter);
+    CASE_STR(PROFILE_FILTER, filter);
+    CASE_STR(ALL_BUT_PROFILE_FILTER, filter);
+    CASE_STR(CURRENT_BSS_FILTER, filter);
+    CASE_STR(ALL_BUT_BSS_FILTER, filter);
+    CASE_STR(PROBED_SSID_FILTER, filter);
+    CASE_STR(LAST_BSS_FILTER, filter);
+    CASE_DEF_STR(filter);
+    }
+    return snprintf(output, len, "[%s]", filter);
+}
+
+static int CO_CHANGE_CHANNEL_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 freq = buffer[1];
+    A_INT32 duration = buffer[2];
+    return snprintf(output, len, "freq %d duration %d", freq, duration);
+}
+
+static int CO_CHANGE_STATE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 stateLog = (numargs==1) ? buffer[1] : buffer[2];
+    int op = stateLog & 0xff;
+    const char *opstr = op ? "set" : "clr";
+    int opState = (stateLog >> 8) & 0xff;
+    int oldState = stateLog >> 16;
+    int newState = (op) ? (oldState | opState) : (oldState & ~(opState));
+    char state[256];
+    size_t blen = sizeof(state);
+    int ret = 0;
+    BIT_STR(state, blen, ret, "DRAIN_IN_PROGRESS ", 0x01, newState);
+    BIT_STR(state, blen, ret, "FAKE_SLEEP_ENABLE_IN_PROGRESS ", 0x02, newState);
+    BIT_STR(state, blen, ret, "FAKE_SLEEP_ENABLED ", 0x04, newState);
+    BIT_STR(state, blen, ret, "TXQ_PAUSED ", 0x08, newState);
+    BIT_STR(state, blen, ret, "CHANNEL_CHANGE_IN_PROGRESS ", 0x10, newState);
+    state[(ret>0) ? --ret : ret] = 0;
+
+    ret = 0;
+    if (numargs==2) {
+        ret = snprintf(output+ret, len-ret, "dev %d ", buffer[1]);
+    }
+    ret += snprintf(output+ret, len-ret, "0x%x %s 0x%x->0x%x [%s]",
+                    oldState, opstr, opState, newState, state);
+    return ret;
+}
+
+static int TXRX_MGMTBUF_WLAN_RESET_ON_ERROR_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    if (numargs==1) {
+        char buf[512];
+        A_INT32 rxfilter = buffer[1];
+        rxfilter2text(buf, sizeof(buf),rxfilter);
+        return snprintf(output, len, "rxfilter:[%s]", buf);
+    } else if (numargs==2) {
+        return snprintf(output, len, "rstCnt %d caller %p", 
+                        buffer[1], (void*)buffer[2]);
+    } else {
+        return 0;
+    }
+}
+static int TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *mid;
+    switch (buffer[2]) {
+    CASE_STR_CONST(CO, 0x001, mid);
+    CASE_STR_CONST(PM, 0x002, mid);
+    CASE_STR_CONST(BTCOEX, 0x004, mid);
+    CASE_DEF_STR(mid);
+    }
+    return snprintf(output, len, "wait drain %d ms %s ", buffer[1], mid);
+}
+
+static int TXRX_MGMTBUF_REAPED_BUF_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *txstatus = txrxstatus2text(buffer[2]);
+    return snprintf(output, len, "mgt %p %s", (void*)buffer[1], txstatus);
+}
+
+static int TXRX_MGMTBUF_DRAINQ_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 hwq = buffer[1];
+    A_INT32 depth = buffer[2];
+    return snprintf(output, len, "hwq 0x%x depth 0x%x", hwq, depth);
+}
+
+static int DC_RECEIVED_ANY_BEACON_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    if (numargs==1) {
+        A_INT32 addr3 = buffer[1];
+        return snprintf(output, len, "addr3 ??:??:%02X:%02X:%02X:%02X",
+                 (addr3 & 0xff), ((addr3>>8)&0xff), ((addr3>>16)&0xff), ((addr3>>24)&0xff));
+    } else if (numargs==2) {
+        A_UINT64 tsf;
+        A_UINT8 ie_tstamp[8];
+        ie_tstamp[4] = buffer[1] & 0xff;
+        ie_tstamp[5] = (buffer[1]>>8) & 0xff;
+        ie_tstamp[6] = (buffer[1]>>16) & 0xff;
+        ie_tstamp[7] = (buffer[1]>>24) & 0xff;
+        ie_tstamp[0] = buffer[2] & 0xff;
+        ie_tstamp[1] = (buffer[2]>>8) & 0xff;
+        ie_tstamp[2] = (buffer[2]>>16) & 0xff;
+        ie_tstamp[3] = (buffer[2]>>24) & 0xff;
+        A_MEMCPY((A_UINT8 *)&tsf, ie_tstamp, sizeof(ie_tstamp));
+        return snprintf(output, len, "ie_tsf %llu", tsf);
+    }
+    return 0;
+}
+
+static int DC_SET_POWER_MODE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *pm = pmmode2text(buffer[1]);
+    return snprintf(output, len, "%s caller %p", pm, (void*)buffer[2]);
+}
+
+static int DC_SSID_PROBE_CB_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *txstatus = txrxstatus2text(buffer[1]);
+    return snprintf(output, len, "%s", txstatus);
+}
+
+static int DC_SEARCH_OPPORTUNITY_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *opt;
+    switch (buffer[1]) {
+    CASE_STR_CONST(SCAN_IN_PROGRESS, 1, opt);
+    CASE_STR_CONST(NOT_SCAN_IN_PROGRESS,  0, opt);
+    CASE_DEF_STR(opt);
+    }
+    return snprintf(output, len, "%s", opt);
+}
+
+static int DC_SEND_NEXT_SSID_PROBE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *flags;
+    switch (buffer[2]) {
+    CASE_STR(DISABLE_SSID_FLAG, flags);
+    CASE_STR(SPECIFIC_SSID_FLAG, flags);
+    CASE_STR(ANY_SSID_FLAG, flags);
+    CASE_DEF_STR(flags);
+    }  
+    return snprintf(output, len, "idx %d %s", buffer[1], flags);
+}
+
+static int DC_SCAN_CHAN_FINISH_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_UINT16 freq = buffer[1] & 0xffff;
+    A_UINT16 status = (buffer[1] >> 16) & 0xffff;
+    A_INT32 rxfilter = buffer[2];   
+    char rxfilterMsg[1024];
+    rxfilter2text(rxfilterMsg, sizeof(rxfilterMsg), rxfilter);
+    return snprintf(output, len, "freq %d status %s(%d), %s", 
+                    freq, status2text(status), status, rxfilterMsg);
+}
+
+static int DC_SCAN_CHAN_START_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 rxfilter = buffer[2];   
+    char rxfilterMsg[1024];
+    A_UINT16 freq;
+    A_UINT16 attrib;
+    const char *probed;
+    rxfilter2text(rxfilterMsg, sizeof(rxfilterMsg), rxfilter);
+    freq = buffer[1] & 0xffff;
+    attrib = (buffer[1] >> 16) & 0xffff;
+    probed = ((attrib & (0x0100|0x10))==(0x0100|0x10)) && !(attrib &  0x0800) ? "allow" : "not allow";
+
+    return snprintf(output, len, "freq %d attrib %d probed %s %s", 
+                    freq, attrib, probed, rxfilterMsg);
+}
+
+static int DC_START_SEARCH_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    if (numargs==1) {
+        return snprintf(output, len, "devid %d", buffer[1]);
+    } else {
+        A_INT32 stype = buffer[1];
+        int ret = 0;  
+        char buf[1024];
+        size_t blen = sizeof(buf);
+        if (stype == 0) {
+            BIT_STR(buf, blen, ret, "RESET "                     , 0, stype);
+        }
+        BIT_STR(buf, blen, ret, "ALL "                      , (0x01|0x02|0x04|0x08), stype);
+        if (((0x01|0x02|0x04|0x08)& stype)!=(0x01|0x02|0x04|0x08)) {
+            BIT_STR(buf, blen, ret, "POPULAR "                   , (0x02 | 0x04 | 0x08), stype);
+            if (((0x02|0x04|0x08)& stype)!=(0x02|0x04|0x08)) {
+                BIT_STR(buf, blen, ret, "SSIDS "                     , (0x04 | 0x08), stype);
+                if (((0x04|0x08)& stype)!=(0x04|0x08)) {
+                    BIT_STR(buf, blen, ret, "PROF_MASK "                 , (0x08), stype);
+                }
+            }
+        }
+
+        BIT_STR(buf, blen, ret, "MULTI_CHANNEL "             , 0x000100, stype);
+        BIT_STR(buf, blen, ret, "DETERMINISTIC "             , 0x000200, stype);
+        BIT_STR(buf, blen, ret, "PROFILE_MATCH_TERMINATED "  , 0x000400, stype);
+        BIT_STR(buf, blen, ret, "HOME_CHANNEL_SKIP "         , 0x000800, stype);
+        BIT_STR(buf, blen, ret, "CHANNEL_LIST_CONTINUE "     , 0x001000, stype);
+        BIT_STR(buf, blen, ret, "CURRENT_SSID_SKIP "         , 0x002000, stype);
+        BIT_STR(buf, blen, ret, "ACTIVE_PROBE_DISABLE "      , 0x004000, stype);
+        BIT_STR(buf, blen, ret, "CHANNEL_HINT_ONLY "         , 0x008000, stype);
+        BIT_STR(buf, blen, ret, "ACTIVE_CHANNELS_ONLY "      , 0x010000, stype);
+        BIT_STR(buf, blen, ret, "UNUSED1 "                   , 0x020000, stype);
+        BIT_STR(buf, blen, ret, "PERIODIC "                  , 0x040000, stype);
+        BIT_STR(buf, blen, ret, "FIXED_DURATION "            , 0x080000, stype);
+        BIT_STR(buf, blen, ret, "AP_ASSISTED "               , 0x100000, stype);
+        buf[(ret>0) ? --ret : ret] = 0;
+        return snprintf(output, len, "%s cb 0x%x", buf, buffer[2]);
+    }
+}
+
+static int PM_CHAN_OP_REQ_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *start = (buffer[1]==1) ? "start" : "stop";
+    A_INT32 chanOpReq = buffer[2];
+    return snprintf(output, len, "%s chan OpReq %d", start, chanOpReq);
+}
+
+static int PM_SET_ALL_BEACON_POLICY_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *policyMsg;
+    A_UINT16 policy = buffer[1];
+    A_UINT32 cnt = buffer[2];
+    switch (policy) {
+    CASE_STR_CONST(disallow, 1, policyMsg);
+    CASE_STR_CONST(allow, 2, policyMsg);
+    CASE_DEF_STR(policyMsg);
+    }
+    return snprintf(output, len, "%s beacons filterCnt %d", policyMsg, cnt);
+}
+
+static int PM_SET_MY_BEACON_POLICY_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *policyMsg;
+    A_UINT16 policy = buffer[1] & 0xff;
+    A_UINT32 bMiss = (buffer[1] >> 8);
+    A_UINT32 myBeaconCnt = buffer[2];
+    switch (policy) {
+    CASE_STR_CONST(disallow, 1, policyMsg);
+    CASE_STR_CONST(allow, 2, policyMsg);
+    CASE_DEF_STR(policyMsg);
+    }
+    return snprintf(output, len, "bmiss %d %s during sleep filterCnt %d", bMiss, policyMsg, myBeaconCnt);
+}
+
+
+static int PM_SET_STATE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT16 pmStateWakeupCount = (buffer[1] >> 16) & 0xffff;
+    A_INT16 pmState = buffer[1] & 0xffff;
+    A_INT16 pmAwakeCount = (buffer[2] >> 16) & 0xffff;
+    A_INT8 pmSleepCount = (buffer[2] >> 8) & 0xff;
+    A_INT8 pmOldState = buffer[2] & 0xff;
+    return snprintf(output, len, "StateWakeupCnt %d AwakeCnt %d, SleepCnt %d, %s to %s",
+                    pmStateWakeupCount, pmAwakeCount, pmSleepCount, 
+                    pmmode2text(pmOldState), pmmode2text(pmState));
+}
+
+static int PM_SET_POWERMODE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_UINT16 wcnt = buffer[1] >> 16;
+    A_UINT16 fakeSleep = buffer[1] & 0xffff;
+    A_UINT16 oldPowerMode = buffer[2] >> 16;
+    A_UINT8 powerMode = (buffer[2] >> 8) & 0xff;
+    A_UINT8 moduleId = buffer[2] & 0xff;
+    return snprintf(output, len, "wakeCnt %d fakeSleep %d %s(%d)=>%s(%d) %s(%d)",
+         wcnt, fakeSleep, pmmode2text(oldPowerMode), oldPowerMode, pmmode2text(powerMode), powerMode, pmmodule2text(moduleId), moduleId);
+}
+
+static int PM_FAKE_SLEEP_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT16 enable = (buffer[1] >> 16) & 0xffff;
+    const char *state = enable2text(enable);
+    A_INT8 pmFakeSleepCount = (buffer[1] >> 8) & 0xff;
+    A_INT8 fakeSleepEnable = (buffer[1] & 0xff);
+    A_INT16 forceAwake = (buffer[2] >> 16) & 0xffff;
+    A_INT8 dontWaitForDrain = (buffer[2] >> 8) & 0xff;
+    A_INT8 module = buffer[2] & 0xff;
+    return snprintf(output, len, "%s cnt %d hasCnt %d forceAwake %d dontWaitDrain %d %s(%d)",
+            state, pmFakeSleepCount, fakeSleepEnable, forceAwake, dontWaitForDrain, pmmodule2text(module), module);
+}
+
+static int BTCOEX_DBG_pmwakeupcnt_flags(char *output, size_t len, A_INT32 pmWakeupCnt, A_INT32 btCoexFlags)
+{
+    int ret = 0;
+    ret += snprintf(output+ret, len-ret, "coexPmWakeupCnt %d", pmWakeupCnt);
+    if (btCoexFlags!=-1) {
+        char buf[512];
+        btcoexFlags2text(buf, sizeof(buf), btCoexFlags);
+        ret += snprintf(output+ret, len-ret, " coex [%s]", buf);
+    }
+    return ret;
+}
+
+static int BTCOEX_ACL_COEX_STATUS_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 btStatus = (buffer[1] >> 16) & 0xffff;
+    A_INT32 redoAggr = buffer[1] & 0xffff;
+    return snprintf(output, len, "%s redoAggr %d", btStatus2text(btStatus), redoAggr);
+}
+
+static int BTCOEX_DBG_PM_SLEEP_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 pmWakeupCnt = buffer[1];
+    A_INT32 btCoexFlags = buffer[2];
+    return BTCOEX_DBG_pmwakeupcnt_flags(output,len,pmWakeupCnt,btCoexFlags); 
+}
+
+static int BTCOEX_PSPOLL_QUEUED_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT16 isEolEnabled = (buffer[1] >> 16) & 0xffff;
+    A_INT8 bSendAtLowestRate = (buffer[1] >>8) & 0xff;
+    A_INT8 isPmSleep = (buffer[1]) & 0xff;
+    return snprintf(output, len, "Eol:%s LowestRate:%s PmSleep:%s", 
+                    enable2text(isEolEnabled), enable2text(bSendAtLowestRate),
+                    enable2text(isPmSleep));
+}
+
+static int BTCOEX_PSPOLL_COMPLETE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    return snprintf(output, len, "%s", txrxstatus2text(buffer[1]));
+}
+
+static int BTCOEX_DBG_PM_AWAKE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    return BTCOEX_DBG_PM_SLEEP_fmt(output,len,numargs,buffer);
+}
+
+static int BTCOEX_DBG_GO_TO_SLEEP_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    return BTCOEX_DBG_pmwakeupcnt_flags(output,len,buffer[1],-1);
+}
+
+static int BTCOEX_WAKEUP_ON_DATA_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    return BTCOEX_DBG_pmwakeupcnt_flags(output,len,buffer[2], buffer[1]);
+}
+
+static int BTCOEX_TIM_NOTIFICATION_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    int ret = 0;
+    A_INT32 btCoexFlags = buffer[1];
+    A_INT32 btStatus = (buffer[2]>>16) & 0xffff;
+    A_INT32 pmWakeupCnt = (buffer[2] & 0xffff);
+    ret = BTCOEX_DBG_pmwakeupcnt_flags(output,len, pmWakeupCnt, btCoexFlags);
+    ret += snprintf(output+ret, len-ret, " %s", btStatus2text(btStatus));
+    return ret;
+}
+
+static int BTCOEX_DBG_ALLOW_SCAN_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    char buf[512];
+    A_INT32 retStatus = buffer[2];
+    A_INT32 btState = buffer[1];
+    btState2text(buf, sizeof(buf), btState);
+    return snprintf(output, len, "state: [%s] allow:%d", buf, retStatus);
+}
+
+static int BTCOEX_DBG_SCAN_REQUEST_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    char buf[512];
+    A_INT32 scanReqEnabled = buffer[2];
+    A_INT32 btState = buffer[1];
+    btState2text(buf, sizeof(buf), btState);
+    return snprintf(output, len, "state: [%s] scanReqEnabled:%d", buf, scanReqEnabled);
+}
+
+static int BTCOEX_DBG_SET_WLAN_STATE_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 btCoexFlags = buffer[2];
+    char buf[512];
+    const char *wlanState;
+    switch (buffer[1]) {
+    CASE_STR_CONST(IDLE     , 1, wlanState);
+    CASE_STR_CONST(CONNECTED , 2, wlanState);
+    CASE_STR_CONST(SCAN_START  , 3, wlanState);
+    CASE_STR_CONST(CONNECT_START ,4, wlanState);
+    CASE_STR_CONST(SCAN_END    , 5, wlanState);
+    CASE_STR_CONST(APMODE_STA_CONNECTED , 6, wlanState);
+    CASE_STR_CONST(APMODE_IDLE , 7, wlanState);
+    CASE_STR_CONST(APMODE_SWITCH , 8, wlanState);
+    CASE_STR_CONST(APMODE_TEARDOWN , 9, wlanState);
+    CASE_DEF_STR(wlanState);
+    }
+    btcoexFlags2text(buf, sizeof(buf), btCoexFlags);
+    return snprintf(output, len, "wlan %s coex [%s]", wlanState, buf);
+}
+
+static int BTCOEX_DBG_BT_INQUIRY_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *btState = btStatus2text(buffer[1]);
+    A_INT32 btCoexFlags = buffer[2];
+    char buf[512];
+    btcoexFlags2text(buf, sizeof(buf), btCoexFlags);
+    return snprintf(output, len, "%s coex [%s]", btState, buf);
+}
+
+static int BTCOEX_SET_WEIGHTS_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *weights;
+    switch (buffer[1]) {
+    CASE_STR_CONST(ALL_BT_TRAFFIC,1,weights);
+    CASE_STR_CONST(ONLY_HIGH_PRI_BT_TRAFFIC,2,weights);
+    CASE_STR_CONST(STOMP_ALL_BT_TRAFFIC,3,weights);
+    CASE_STR_CONST(ONLY_A2DP_TRAFFIC,4,weights);
+    CASE_STR_CONST(ONLY_HIGH_PRIO_AND_A2DP,5,weights);
+    CASE_STR_CONST(A2DP_STOMPED,6,weights);
+    CASE_STR_CONST(ALL_BT_TRAFFIC_WTX,7,weights);
+    CASE_STR_CONST(ALL_BT_TRAFFIC_WTX_HIGHISO_TXRX,8,weights);
+    CASE_STR_CONST(HIGH_PRI_TRAFFIC_WTX,9,weights);
+    CASE_STR_CONST(HIGH_PRI_TRAFFIC_WTX_HIGHISO_TXRX,0xa,weights);
+    CASE_STR_CONST(MCI_TEST,0xb,weights);
+    CASE_DEF_STR(weights);
+    }
+
+    return snprintf(output, len, "%s val 0x%x", weights, buffer[2]);    
+}
+
+static int BTCOEX_PM_FAKE_SLEEP_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *enable = enable2text(buffer[1]);
+    A_STATUS status = buffer[2];
+    return snprintf(output, len, "%s -> %s", enable, status2text(status));
+}
+
+static const struct wmi_id_desc evt_desc[] = {
+    WM_ID_DESC(WMI_READY_EVENTID), 
+    WM_ID_DESC(WMI_CONNECT_EVENTID),
+    WM_ID_DESC(WMI_DISCONNECT_EVENTID),
+    WM_ID_DESC(WMI_BSSINFO_EVENTID),
+    WM_ID_DESC(WMI_CMDERROR_EVENTID),
+    WM_ID_DESC(WMI_REGDOMAIN_EVENTID),
+    WM_ID_DESC(WMI_PSTREAM_TIMEOUT_EVENTID),
+    WM_ID_DESC(WMI_NEIGHBOR_REPORT_EVENTID),
+    WM_ID_DESC(WMI_TKIP_MICERR_EVENTID),
+    WM_ID_DESC(WMI_SCAN_COMPLETE_EVENTID),           /* 0x100a */
+    WM_ID_DESC(WMI_REPORT_STATISTICS_EVENTID),
+    WM_ID_DESC(WMI_RSSI_THRESHOLD_EVENTID),
+    WM_ID_DESC(WMI_ERROR_REPORT_EVENTID),
+    WM_ID_DESC(WMI_OPT_RX_FRAME_EVENTID),
+    WM_ID_DESC(WMI_REPORT_ROAM_TBL_EVENTID),
+    WM_ID_DESC(WMI_EXTENSION_EVENTID),
+    WM_ID_DESC(WMI_CAC_EVENTID),
+    WM_ID_DESC(WMI_SNR_THRESHOLD_EVENTID),
+    WM_ID_DESC(WMI_LQ_THRESHOLD_EVENTID),
+    WM_ID_DESC(WMI_TX_RETRY_ERR_EVENTID),            /* 0x1014 */
+    WM_ID_DESC(WMI_REPORT_ROAM_DATA_EVENTID),
+    WM_ID_DESC(WMI_TEST_EVENTID),
+    WM_ID_DESC(WMI_APLIST_EVENTID),
+    WM_ID_DESC(WMI_GET_WOW_LIST_EVENTID),
+    WM_ID_DESC(WMI_GET_PMKID_LIST_EVENTID),
+    WM_ID_DESC(WMI_CHANNEL_CHANGE_EVENTID),
+    WM_ID_DESC(WMI_PEER_NODE_EVENTID),
+    WM_ID_DESC(WMI_PSPOLL_EVENTID),
+    WM_ID_DESC(WMI_DTIMEXPIRY_EVENTID),
+    WM_ID_DESC(WMI_WLAN_VERSION_EVENTID),
+    WM_ID_DESC(WMI_SET_PARAMS_REPLY_EVENTID),
+    WM_ID_DESC(WMI_ADDBA_REQ_EVENTID),              /*0x1020 */
+    WM_ID_DESC(WMI_ADDBA_RESP_EVENTID),
+    WM_ID_DESC(WMI_DELBA_REQ_EVENTID),
+    WM_ID_DESC(WMI_TX_COMPLETE_EVENTID),
+    WM_ID_DESC(WMI_HCI_EVENT_EVENTID),
+    WM_ID_DESC(WMI_ACL_DATA_EVENTID),
+    WM_ID_DESC(WMI_REPORT_SLEEP_STATE_EVENTID),
+
+    WM_ID_DESC(WMI_WAPI_REKEY_EVENTID),
+
+    WM_ID_DESC(WMI_REPORT_BTCOEX_STATS_EVENTID),
+    WM_ID_DESC(WMI_REPORT_BTCOEX_CONFIG_EVENTID),
+    WM_ID_DESC(WMI_GET_PMK_EVENTID),
+
+    /* DFS Events */
+    WM_ID_DESC(WMI_DFS_HOST_ATTACH_EVENTID),
+    WM_ID_DESC(WMI_DFS_HOST_INIT_EVENTID),
+    WM_ID_DESC(WMI_DFS_RESET_DELAYLINES_EVENTID),
+    WM_ID_DESC(WMI_DFS_RESET_RADARQ_EVENTID),
+    WM_ID_DESC(WMI_DFS_RESET_AR_EVENTID),
+    WM_ID_DESC(WMI_DFS_RESET_ARQ_EVENTID),          /*0x1030*/
+    WM_ID_DESC(WMI_DFS_SET_DUR_MULTIPLIER_EVENTID),
+    WM_ID_DESC(WMI_DFS_SET_BANGRADAR_EVENTID),
+    WM_ID_DESC(WMI_DFS_SET_DEBUGLEVEL_EVENTID),
+    WM_ID_DESC(WMI_DFS_PHYERR_EVENTID),
+    /* CCX Evants */
+    WM_ID_DESC(WMI_CCX_RM_STATUS_EVENTID),
+
+    /* P2P Events */
+    WM_ID_DESC(WMI_P2P_GO_NEG_RESULT_EVENTID),
+
+    WM_ID_DESC(WMI_WAC_SCAN_DONE_EVENTID),
+    WM_ID_DESC(WMI_WAC_REPORT_BSS_EVENTID),
+    WM_ID_DESC(WMI_WAC_START_WPS_EVENTID),
+    WM_ID_DESC(WMI_WAC_CTRL_REQ_REPLY_EVENTID),
+        
+    /*RFKILL Events*/
+    WM_ID_DESC(WMI_RFKILL_STATE_CHANGE_EVENTID),
+    WM_ID_DESC(WMI_RFKILL_GET_MODE_CMD_EVENTID),
+
+    /* More P2P Events */
+    WM_ID_DESC(WMI_P2P_GO_NEG_REQ_EVENTID),
+    WM_ID_DESC(WMI_P2P_INVITE_REQ_EVENTID),
+    WM_ID_DESC(WMI_P2P_INVITE_RCVD_RESULT_EVENTID),
+    WM_ID_DESC(WMI_P2P_INVITE_SENT_RESULT_EVENTID), /*1040*/
+    WM_ID_DESC(WMI_P2P_PROV_DISC_RESP_EVENTID),
+    WM_ID_DESC(WMI_P2P_PROV_DISC_REQ_EVENTID),
+    WM_ID_DESC(WMI_P2P_START_SDPD_EVENTID),
+    WM_ID_DESC(WMI_P2P_SDPD_RX_EVENTID),
+
+    /* Special event to notify host that cmd is processed and credit report is returned */
+    WM_ID_DESC(WMI_SET_HOST_SLEEP_MODE_CMD_PROCESSED_EVENTID),
+};
+
+static const struct wmi_id_desc cmds_desc[] = {
+    WM_ID_DESC_FMT(WMI_CONNECT_CMDID, sizeof(WMI_CONNECT_CMD)),
+    WM_ID_DESC(WMI_RECONNECT_CMDID),
+    WM_ID_DESC(WMI_DISCONNECT_CMDID),
+    WM_ID_DESC(WMI_SYNCHRONIZE_CMDID),
+    WM_ID_DESC(WMI_CREATE_PSTREAM_CMDID),
+    WM_ID_DESC(WMI_DELETE_PSTREAM_CMDID),
+    WM_ID_DESC_FMT(WMI_START_SCAN_CMDID, sizeof(WMI_START_SCAN_CMD)),
+    WM_ID_DESC(WMI_SET_SCAN_PARAMS_CMDID),
+    WM_ID_DESC_FMT(WMI_SET_BSS_FILTER_CMDID, sizeof(WMI_BSS_FILTER_CMD)),
+    WM_ID_DESC(WMI_SET_PROBED_SSID_CMDID),               /* 10 */
+    WM_ID_DESC_FMT(WMI_SET_LISTEN_INT_CMDID, sizeof(WMI_LISTEN_INT_CMD)),
+    WM_ID_DESC(WMI_SET_BMISS_TIME_CMDID),
+    WM_ID_DESC(WMI_SET_DISC_TIMEOUT_CMDID),
+    WM_ID_DESC(WMI_GET_CHANNEL_LIST_CMDID),
+    WM_ID_DESC(WMI_SET_BEACON_INT_CMDID),
+    WM_ID_DESC(WMI_GET_STATISTICS_CMDID),
+    WM_ID_DESC(WMI_SET_CHANNEL_PARAMS_CMDID),
+    WM_ID_DESC(WMI_SET_POWER_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_IBSS_PM_CAPS_CMDID),
+    WM_ID_DESC(WMI_SET_POWER_PARAMS_CMDID),              /* 20 */
+    WM_ID_DESC(WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID),
+    WM_ID_DESC(WMI_ADD_CIPHER_KEY_CMDID),
+    WM_ID_DESC(WMI_DELETE_CIPHER_KEY_CMDID),
+    WM_ID_DESC(WMI_ADD_KRK_CMDID),
+    WM_ID_DESC(WMI_DELETE_KRK_CMDID),
+    WM_ID_DESC(WMI_SET_PMKID_CMDID),
+    WM_ID_DESC(WMI_SET_TX_PWR_CMDID),
+    WM_ID_DESC(WMI_GET_TX_PWR_CMDID),
+    WM_ID_DESC(WMI_SET_ASSOC_INFO_CMDID),
+    WM_ID_DESC(WMI_ADD_BAD_AP_CMDID),                    /* 30 */
+    WM_ID_DESC(WMI_DELETE_BAD_AP_CMDID),
+    WM_ID_DESC(WMI_SET_TKIP_COUNTERMEASURES_CMDID),
+    WM_ID_DESC(WMI_RSSI_THRESHOLD_PARAMS_CMDID),
+    WM_ID_DESC(WMI_TARGET_ERROR_REPORT_BITMASK_CMDID),
+    WM_ID_DESC(WMI_SET_ACCESS_PARAMS_CMDID),
+    WM_ID_DESC(WMI_SET_RETRY_LIMITS_CMDID),
+    WM_ID_DESC(WMI_RESERVED1),
+    WM_ID_DESC(WMI_RESERVED2),
+    WM_ID_DESC(WMI_SET_VOICE_PKT_SIZE_CMDID),
+    WM_ID_DESC(WMI_SET_MAX_SP_LEN_CMDID),                /* 40 */
+    WM_ID_DESC(WMI_SET_ROAM_CTRL_CMDID),
+    WM_ID_DESC(WMI_GET_ROAM_TBL_CMDID),
+    WM_ID_DESC(WMI_GET_ROAM_DATA_CMDID),
+    WM_ID_DESC(WMI_ENABLE_RM_CMDID),
+    WM_ID_DESC(WMI_SET_MAX_OFFHOME_DURATION_CMDID),
+    WM_ID_DESC(WMI_EXTENSION_CMDID),                        /* Non-wireless extensions */
+    WM_ID_DESC(WMI_SNR_THRESHOLD_PARAMS_CMDID),
+    WM_ID_DESC(WMI_LQ_THRESHOLD_PARAMS_CMDID),
+    WM_ID_DESC(WMI_SET_LPREAMBLE_CMDID),
+    WM_ID_DESC(WMI_SET_RTS_CMDID),                       /* 50 */
+    WM_ID_DESC(WMI_CLR_RSSI_SNR_CMDID),
+    WM_ID_DESC(WMI_SET_FIXRATES_CMDID),
+    WM_ID_DESC(WMI_GET_FIXRATES_CMDID),
+    WM_ID_DESC(WMI_SET_AUTH_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_REASSOC_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_WMM_CMDID),
+    WM_ID_DESC(WMI_SET_WMM_TXOP_CMDID),
+    WM_ID_DESC(WMI_TEST_CMDID),
+    /* COEX AR6002 only*/
+    WM_ID_DESC(WMI_SET_BT_STATUS_CMDID),                
+    WM_ID_DESC(WMI_SET_BT_PARAMS_CMDID),                /* 60 */
+
+    WM_ID_DESC(WMI_SET_KEEPALIVE_CMDID),
+    WM_ID_DESC(WMI_GET_KEEPALIVE_CMDID),
+    WM_ID_DESC(WMI_SET_APPIE_CMDID),
+    WM_ID_DESC(WMI_GET_APPIE_CMDID),
+    WM_ID_DESC(WMI_SET_WSC_STATUS_CMDID),
+
+    /* Wake on Wireless */
+    WM_ID_DESC(WMI_SET_HOST_SLEEP_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_WOW_MODE_CMDID),
+    WM_ID_DESC(WMI_GET_WOW_LIST_CMDID),
+    WM_ID_DESC(WMI_ADD_WOW_PATTERN_CMDID),
+    WM_ID_DESC(WMI_DEL_WOW_PATTERN_CMDID),               /* 70 */
+
+    WM_ID_DESC(WMI_SET_FRAMERATES_CMDID),
+    WM_ID_DESC(WMI_SET_AP_PS_CMDID),
+    WM_ID_DESC(WMI_SET_QOS_SUPP_CMDID),
+};
+
+static const struct wmi_id_desc cmdxs_desc[] = {
+    WM_ID_DESC(WMI_SET_BITRATE_CMDID),
+    WM_ID_DESC(WMI_GET_BITRATE_CMDID),
+    WM_ID_DESC(WMI_SET_WHALPARAM_CMDID),
+
+
+    /*Should add the new command to the tail for compatible with
+     * etna.
+     */
+    WM_ID_DESC(WMI_SET_MAC_ADDRESS_CMDID),
+    WM_ID_DESC(WMI_SET_AKMP_PARAMS_CMDID),
+    WM_ID_DESC(WMI_SET_PMKID_LIST_CMDID),
+    WM_ID_DESC(WMI_GET_PMKID_LIST_CMDID),
+    WM_ID_DESC(WMI_ABORT_SCAN_CMDID),
+    WM_ID_DESC(WMI_SET_TARGET_EVENT_REPORT_CMDID),
+
+    /* Unused */
+    WM_ID_DESC(WMI_UNUSED1),
+    WM_ID_DESC(WMI_UNUSED2),
+
+    /*
+     * AP mode commands
+     */
+    WM_ID_DESC(WMI_AP_HIDDEN_SSID_CMDID),
+    WM_ID_DESC(WMI_AP_SET_NUM_STA_CMDID),
+    WM_ID_DESC(WMI_AP_ACL_POLICY_CMDID),
+    WM_ID_DESC(WMI_AP_ACL_MAC_LIST_CMDID),
+    WM_ID_DESC(WMI_AP_CONFIG_COMMIT_CMDID),
+    WM_ID_DESC(WMI_AP_SET_MLME_CMDID),
+    WM_ID_DESC(WMI_AP_SET_PVB_CMDID),
+    WM_ID_DESC(WMI_AP_CONN_INACT_CMDID),
+    WM_ID_DESC(WMI_AP_PROT_SCAN_TIME_CMDID),
+    WM_ID_DESC(WMI_AP_SET_COUNTRY_CMDID),
+    WM_ID_DESC(WMI_AP_SET_DTIM_CMDID),
+    WM_ID_DESC(WMI_AP_MODE_STAT_CMDID),
+
+    WM_ID_DESC(WMI_SET_IP_CMDID),
+    WM_ID_DESC(WMI_SET_PARAMS_CMDID),
+    WM_ID_DESC_FMT(WMI_SET_MCAST_FILTER_CMDID, sizeof(WMI_SET_MCAST_FILTER_CMD)),
+    WM_ID_DESC_FMT(WMI_DEL_MCAST_FILTER_CMDID, sizeof(WMI_SET_MCAST_FILTER_CMD)),
+
+    WM_ID_DESC(WMI_ALLOW_AGGR_CMDID),
+    WM_ID_DESC(WMI_ADDBA_REQ_CMDID),
+    WM_ID_DESC(WMI_DELBA_REQ_CMDID),
+    WM_ID_DESC(WMI_SET_HT_CAP_CMDID),
+    WM_ID_DESC(WMI_SET_HT_OP_CMDID),
+    WM_ID_DESC(WMI_SET_TX_SELECT_RATES_CMDID),
+    WM_ID_DESC(WMI_SET_TX_SGI_PARAM_CMDID),
+    WM_ID_DESC(WMI_SET_RATE_POLICY_CMDID),
+
+    WM_ID_DESC(WMI_HCI_CMD_CMDID),
+    WM_ID_DESC(WMI_RX_FRAME_FORMAT_CMDID),
+    WM_ID_DESC(WMI_SET_THIN_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID),
+
+    WM_ID_DESC(WMI_AP_SET_11BG_RATESET_CMDID),
+    WM_ID_DESC(WMI_SET_PMK_CMDID),
+    WM_ID_DESC_FMT(WMI_MCAST_FILTER_CMDID, sizeof(WMI_MCAST_FILTER_CMD)),
+	/* COEX CMDID AR6003*/
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_FE_ANT_CMDID, sizeof(WMI_SET_BTCOEX_FE_ANT_CMD)),
+	WM_ID_DESC(WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID),
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_SCO_CONFIG_CMDID, sizeof(WMI_SET_BTCOEX_SCO_CONFIG_CMD)),
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_A2DP_CONFIG_CMDID, sizeof(WMI_SET_BTCOEX_A2DP_CONFIG_CMD)),
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID, sizeof(WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMD)),
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID, sizeof(WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMD)),
+	WM_ID_DESC(WMI_SET_BTCOEX_DEBUG_CMDID),
+	WM_ID_DESC_FMT(WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID, sizeof(WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMD)),
+	WM_ID_DESC(WMI_GET_BTCOEX_STATS_CMDID),
+	WM_ID_DESC(WMI_GET_BTCOEX_CONFIG_CMDID),
+
+    WM_ID_DESC(WMI_SET_DFS_ENABLE_CMDID),   /* F034 */
+    WM_ID_DESC(WMI_SET_DFS_MINRSSITHRESH_CMDID),
+    WM_ID_DESC(WMI_SET_DFS_MAXPULSEDUR_CMDID),
+    WM_ID_DESC(WMI_DFS_RADAR_DETECTED_CMDID),
+
+    /* P2P CMDS */
+    WM_ID_DESC(WMI_P2P_SET_CONFIG_CMDID),    /* F038 */
+    WM_ID_DESC(WMI_WPS_SET_CONFIG_CMDID),
+    WM_ID_DESC(WMI_SET_REQ_DEV_ATTR_CMDID),
+    WM_ID_DESC(WMI_P2P_FIND_CMDID),
+    WM_ID_DESC(WMI_P2P_STOP_FIND_CMDID),
+    WM_ID_DESC(WMI_P2P_GO_NEG_START_CMDID),
+    WM_ID_DESC(WMI_P2P_LISTEN_CMDID),
+
+    WM_ID_DESC(WMI_CONFIG_TX_MAC_RULES_CMDID),
+    WM_ID_DESC(WMI_SET_PROMISCUOUS_MODE_CMDID),/* F040 */
+    WM_ID_DESC(WMI_RX_FRAME_FILTER_CMDID),
+    WM_ID_DESC(WMI_SET_CHANNEL_CMDID),
+
+    /* WAC commands */
+    WM_ID_DESC(WMI_ENABLE_WAC_CMDID),
+    WM_ID_DESC(WMI_WAC_SCAN_REPLY_CMDID),
+    WM_ID_DESC(WMI_WAC_CTRL_REQ_CMDID),
+    WM_ID_DESC(WMI_SET_DIV_PARAMS_CMDID),
+
+    WM_ID_DESC(WMI_GET_PMK_CMDID),
+    WM_ID_DESC(WMI_SET_PASSPHRASE_CMDID),
+    WM_ID_DESC(WMI_SEND_ASSOC_RES_CMDID),
+    WM_ID_DESC(WMI_SET_ASSOC_REQ_RELAY_CMDID),
+    WM_ID_DESC(WMI_GET_RFKILL_MODE_CMDID),
+    WM_ID_DESC(WMI_SET_RFKILL_MODE_CMDID),
+
+    /* ACS command, consists of sub-commands */
+    WM_ID_DESC(WMI_ACS_CTRL_CMDID),
+    
+    /* Ultra low power store / recall commands */
+    WM_ID_DESC(WMI_STORERECALL_CONFIGURE_CMDID),
+    WM_ID_DESC(WMI_STORERECALL_RECALL_CMDID),
+    WM_ID_DESC(WMI_STORERECALL_HOST_READY_CMDID),
+    WM_ID_DESC(WMI_FORCE_TARGET_ASSERT_CMDID),
+    WM_ID_DESC(WMI_SET_EXCESS_TX_RETRY_THRES_CMDID),
+
+    WM_ID_DESC(WMI_P2P_GO_NEG_REQ_RSP_CMDID),  /* F053 */
+    WM_ID_DESC(WMI_P2P_GRP_INIT_CMDID),
+    WM_ID_DESC(WMI_P2P_GRP_FORMATION_DONE_CMDID),
+    WM_ID_DESC(WMI_P2P_INVITE_CMDID),
+    WM_ID_DESC(WMI_P2P_INVITE_REQ_RSP_CMDID),
+    WM_ID_DESC(WMI_P2P_PROV_DISC_REQ_CMDID),
+    WM_ID_DESC(WMI_P2P_SET_CMDID),
+
+    WM_ID_DESC(WMI_AP_SET_APSD_CMDID),         /* F05A */
+    WM_ID_DESC(WMI_AP_APSD_BUFFERED_TRAFFIC_CMDID),
+
+    WM_ID_DESC(WMI_P2P_SDPD_TX_CMDID), /* F05C */
+    WM_ID_DESC(WMI_P2P_STOP_SDPD_CMDID),
+    WM_ID_DESC(WMI_P2P_CANCEL_CMDID),
+};
+
+static int dbg_wmi_cmd_params_pos, dbg_wmi_cmd_params_cmdid;
+static A_UINT8 *dbg_wmi_cmd_params_buf;
+
+static int WMI_EVENT_SEND_XTND_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    const char *txt;
+    A_INT32 evt = buffer[1];
+    switch (evt) {
+    CASE_STR(WMIX_DSETOPENREQ_EVENTID, txt);
+    CASE_STR(WMIX_DSETCLOSE_EVENTID, txt);
+    CASE_STR(WMIX_DSETDATAREQ_EVENTID, txt);
+    CASE_STR(WMIX_GPIO_INTR_EVENTID, txt);
+    CASE_STR(WMIX_GPIO_DATA_EVENTID, txt);
+    CASE_STR(WMIX_GPIO_ACK_EVENTID, txt);
+    CASE_STR(WMIX_HB_CHALLENGE_RESP_EVENTID, txt);
+    CASE_STR(WMIX_DBGLOG_EVENTID, txt);
+    CASE_STR(WMIX_PROF_COUNT_EVENTID, txt);
+    CASE_DEF_STR(txt);
+    }
+    return snprintf(output, len, "%s", txt);
+}
+
+static int WMI_EVENT_SEND_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 idx = buffer[1];
+    A_INT32 sidx;
+    if (idx>=(A_INT32)WMI_READY_EVENTID && 
+            idx<(A_INT32)(WMI_READY_EVENTID+ARRAY_SIZE(evt_desc))) {
+        sidx = idx - WMI_READY_EVENTID;
+        return snprintf(output, len, "%s", evt_desc[sidx].desc);
+    } else if (idx>=(A_INT32)WMI_SET_BITRATE_CMDID && 
+            idx<(A_INT32)(WMI_SET_BITRATE_CMDID+ARRAY_SIZE(cmdxs_desc))) {
+        sidx = idx - WMI_SET_BITRATE_CMDID;
+        return snprintf(output, len, "%s", cmdxs_desc[sidx].desc);
+    }
+    return 0;
+}
+
+
+static int WMI_CMD_RX_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 idx = buffer[1];
+    A_INT32 length = buffer[2];
+    A_INT32 sidx;
+    if (idx>=(A_INT32)WMI_CONNECT_CMDID && 
+            idx<(A_INT32)(WMI_CONNECT_CMDID+ARRAY_SIZE(cmds_desc))) {
+        sidx = idx-WMI_CONNECT_CMDID;
+        return snprintf(output, len, "%s, len %d", 
+                       cmds_desc[sidx].desc, length);
+    } else if (idx>=(A_INT32)WMI_SET_BITRATE_CMDID && 
+            idx<(A_INT32)(WMI_SET_BITRATE_CMDID+ARRAY_SIZE(cmdxs_desc))) {
+        sidx = idx - WMI_SET_BITRATE_CMDID;
+        return snprintf(output, len, "%s, len %d", 
+                       cmdxs_desc[sidx].desc, length);
+    }
+    return 0;
+}
+
+static int WMI_CMD_PARAMS_DUMP_START_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    A_INT32 paramslen = buffer[2];
+    paramslen += (sizeof(A_INT32) * 2); /* adding pad */
+    dbg_wmi_cmd_params_pos = 0;
+    dbg_wmi_cmd_params_cmdid = buffer[1];
+    dbg_wmi_cmd_params_buf = (paramslen>0) ? malloc(paramslen) : NULL;
+    return 0;
+}
+
+static int WMI_CMD_PARAMS_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    if (dbg_wmi_cmd_params_buf == NULL) {
+        /* partial debug log where there is no START. Skip it*/
+        return 0;
+    }   
+    memcpy(&dbg_wmi_cmd_params_buf[dbg_wmi_cmd_params_pos], &buffer[1], sizeof(A_INT32));
+    memcpy(&dbg_wmi_cmd_params_buf[dbg_wmi_cmd_params_pos+4], &buffer[2], sizeof(A_INT32));
+    dbg_wmi_cmd_params_pos += (sizeof(A_INT32) * 2);
+    return 0;
+}
+
+static int WMI_CMD_PARAMS_DUMP_END_fmt(char *output, size_t len, A_UINT32 numargs, A_INT32 *buffer)
+{
+    int ret = 0;
+    A_INT32 idx = dbg_wmi_cmd_params_cmdid;
+    DbgCmdFormatter cmdFormatter = NULL;
+    size_t cmdSize;
+    if (dbg_wmi_cmd_params_buf == NULL) {
+        /* partial debug log where there is no START. Skip it*/
+        return 0;
+    }   
+    if (idx>=(A_INT32)WMI_CONNECT_CMDID && 
+            idx<(A_INT32)(WMI_CONNECT_CMDID+ARRAY_SIZE(cmds_desc)) ) {
+        cmdFormatter = cmds_desc[idx-WMI_CONNECT_CMDID].formatter;
+        cmdSize = cmds_desc[idx-WMI_CONNECT_CMDID].cmdSize;
+    } else if (idx>=(A_INT32)WMI_SET_BITRATE_CMDID && 
+            idx<(A_INT32)(WMI_SET_BITRATE_CMDID+ARRAY_SIZE(cmdxs_desc))) {
+        cmdFormatter = cmdxs_desc[idx-WMI_SET_BITRATE_CMDID].formatter;
+        cmdSize = cmdxs_desc[idx-WMI_SET_BITRATE_CMDID].cmdSize;
+    }
+    if (cmdFormatter) {
+        ret += snprintf(output+ret, len-ret, " ");
+        if (dbg_wmi_cmd_params_pos>=cmdSize) {
+            ret += cmdFormatter(output+ret, len-ret, dbg_wmi_cmd_params_buf);
+        } else {
+            ret += snprintf(output+ret, len-ret, "malformed cmd. size too small %d < %d",
+                    dbg_wmi_cmd_params_pos, cmdSize);
+        }
+    }
+    dbg_wmi_cmd_params_pos = 0;
+    dbg_wmi_cmd_params_cmdid = 0;
+    free(dbg_wmi_cmd_params_buf);
+    dbg_wmi_cmd_params_buf = NULL;
+    return ret;
+}
+
+static struct dbglog_desc wmi_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC(WMI_CMD_RX_XTND_PKT_TOO_SHORT),
+    DBG_DESC(WMI_EXTENDED_CMD_NOT_HANDLED),
+    DBG_DESC(WMI_CMD_RX_PKT_TOO_SHORT),
+    DBG_DESC(WMI_CALLING_WMI_EXTENSION_FN),
+    DBG_DESC(WMI_CMD_NOT_HANDLED),
+    DBG_DESC(WMI_IN_SYNC),
+    DBG_DESC(WMI_TARGET_WMI_SYNC_CMD),
+    DBG_DESC(WMI_SET_SNR_THRESHOLD_PARAMS),
+    DBG_DESC(WMI_SET_RSSI_THRESHOLD_PARAMS),
+    DBG_DESC(WMI_SET_LQ_TRESHOLD_PARAMS),
+    DBG_DESC(WMI_TARGET_CREATE_PSTREAM_CMD),
+    DBG_DESC(WMI_WI_DTM_INUSE),
+    DBG_DESC(WMI_TARGET_DELETE_PSTREAM_CMD),
+    DBG_DESC(WMI_TARGET_IMPLICIT_DELETE_PSTREAM_CMD),
+    DBG_DESC(WMI_TARGET_GET_BIT_RATE_CMD),
+    DBG_DESC(WMI_GET_RATE_MASK_CMD_FIX_RATE_MASK_IS),
+    DBG_DESC(WMI_TARGET_GET_AVAILABLE_CHANNELS_CMD),
+    DBG_DESC(WMI_TARGET_GET_TX_PWR_CMD),
+    DBG_DESC(WMI_FREE_EVBUF_WMIBUF),
+    DBG_DESC(WMI_FREE_EVBUF_DATABUF),
+    DBG_DESC(WMI_FREE_EVBUF_BADFLAG),
+    DBG_DESC(WMI_HTC_RX_ERROR_DATA_PACKET),
+    DBG_DESC(WMI_HTC_RX_SYNC_PAUSING_FOR_MBOX),
+    DBG_DESC(WMI_INCORRECT_WMI_DATA_HDR_DROPPING_PKT),
+    DBG_DESC(WMI_SENDING_READY_EVENT),
+    DBG_DESC(WMI_SETPOWER_MDOE_TO_MAXPERF),
+    DBG_DESC(WMI_SETPOWER_MDOE_TO_REC),
+    DBG_DESC(WMI_BSSINFO_EVENT_FROM),
+    DBG_DESC(WMI_TARGET_GET_STATS_CMD),
+    DBG_DESC(WMI_SENDING_SCAN_COMPLETE_EVENT),
+    DBG_DESC(WMI_SENDING_RSSI_INDB_THRESHOLD_EVENT),
+    DBG_DESC(WMI_SENDING_RSSI_INDBM_THRESHOLD_EVENT),
+    DBG_DESC(WMI_SENDING_LINK_QUALITY_THRESHOLD_EVENT),
+    DBG_DESC(WMI_SENDING_ERROR_REPORT_EVENT),
+    DBG_DESC(WMI_SENDING_CAC_EVENT),
+    DBG_DESC(WMI_TARGET_GET_ROAM_TABLE_CMD),
+    DBG_DESC(WMI_TARGET_GET_ROAM_DATA_CMD),
+    DBG_DESC(WMI_SENDING_GPIO_INTR_EVENT),
+    DBG_DESC(WMI_SENDING_GPIO_ACK_EVENT),
+    DBG_DESC(WMI_SENDING_GPIO_DATA_EVENT),
+    DBG_DESC_FMT(WMI_CMD_RX),
+    DBG_DESC(WMI_CMD_RX_XTND),
+    DBG_DESC_FMT(WMI_EVENT_SEND),
+    DBG_DESC_FMT(WMI_EVENT_SEND_XTND),
+    DBG_DESC_FMT(WMI_CMD_PARAMS_DUMP_START),
+    DBG_DESC_FMT(WMI_CMD_PARAMS_DUMP_END),
+    DBG_DESC_FMT(WMI_CMD_PARAMS),
+};
+
+static struct dbglog_desc co_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC(CO_INIT),
+    DBG_DESC(CO_ACQUIRE_LOCK),
+    DBG_DESC(CO_START_OP1),
+    DBG_DESC(CO_START_OP2),
+    DBG_DESC(CO_DRAIN_TX_COMPLETE_CB),
+    DBG_DESC(CO_CHANGE_CHANNEL_CB),
+    DBG_DESC(CO_RETURN_TO_HOME_CHANNEL),
+    DBG_DESC(CO_FINISH_OP_TIMEOUT),
+    DBG_DESC(CO_OP_END),
+    DBG_DESC(CO_CANCEL_OP),
+    DBG_DESC_FMT(CO_CHANGE_CHANNEL),
+    DBG_DESC(CO_RELEASE_LOCK),
+    DBG_DESC_FMT(CO_CHANGE_STATE),
+};
+
+static struct dbglog_desc mgmtbuf_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC(TXRX_MGMTBUF_ALLOCATE_BUF),
+    DBG_DESC(TXRX_MGMTBUF_ALLOCATE_SM_BUF),
+    DBG_DESC(TXRX_MGMTBUF_ALLOCATE_RMBUF),
+    DBG_DESC(TXRX_MGMTBUF_GET_BUF),
+    DBG_DESC(TXRX_MGMTBUF_GET_SM_BUF),
+    DBG_DESC(TXRX_MGMTBUF_QUEUE_BUF_TO_TXQ),
+    DBG_DESC_FMT(TXRX_MGMTBUF_REAPED_BUF),
+    DBG_DESC(TXRX_MGMTBUF_REAPED_SM_BUF),
+    DBG_DESC_FMT(TXRX_MGMTBUF_WAIT_FOR_TXQ_DRAIN),
+    DBG_DESC(TXRX_MGMTBUF_WAIT_FOR_TXQ_SFQ_DRAIN),
+    DBG_DESC(TXRX_MGMTBUF_ENQUEUE_INTO_DATA_SFQ),
+    DBG_DESC(TXRX_MGMTBUF_DEQUEUE_FROM_DATA_SFQ),
+    DBG_DESC(TXRX_MGMTBUF_PAUSE_DATA_TXQ),
+    DBG_DESC(TXRX_MGMTBUF_RESUME_DATA_TXQ),
+    DBG_DESC(TXRX_MGMTBUF_WAIT_FORTXQ_DRAIN_TIMEOUT),
+    DBG_DESC_FMT(TXRX_MGMTBUF_DRAINQ),
+    DBG_DESC(TXRX_MGMTBUF_INDICATE_Q_DRAINED),
+    DBG_DESC(TXRX_MGMTBUF_ENQUEUE_INTO_HW_SFQ),
+    DBG_DESC(TXRX_MGMTBUF_DEQUEUE_FROM_HW_SFQ),
+    DBG_DESC(TXRX_MGMTBUF_PAUSE_HW_TXQ),
+    DBG_DESC(TXRX_MGMTBUF_RESUME_HW_TXQ),
+    DBG_DESC(TXRX_MGMTBUF_TEAR_DOWN_BA),
+    DBG_DESC(TXRX_MGMTBUF_PROCESS_ADDBA_REQ),
+    DBG_DESC(TXRX_MGMTBUF_PROCESS_DELBA),
+    DBG_DESC(TXRX_MGMTBUF_PERFORM_BA),
+    DBG_DESC_FMT(TXRX_MGMTBUF_WLAN_RESET_ON_ERROR),
+};
+
+static struct dbglog_desc dc_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC_FMT(DC_SCAN_CHAN_START),
+    DBG_DESC_FMT(DC_SCAN_CHAN_FINISH),
+    DBG_DESC(DC_BEACON_RECEIVE7),
+    DBG_DESC_FMT(DC_SSID_PROBE_CB),
+    DBG_DESC_FMT(DC_SEND_NEXT_SSID_PROBE),
+    DBG_DESC_FMT(DC_START_SEARCH),
+    DBG_DESC(DC_CANCEL_SEARCH_CB),
+    DBG_DESC(DC_STOP_SEARCH),
+    DBG_DESC(DC_END_SEARCH),
+    DBG_DESC(DC_MIN_CHDWELL_TIMEOUT),
+    DBG_DESC(DC_START_SEARCH_CANCELED),
+    DBG_DESC_FMT(DC_SET_POWER_MODE),
+    DBG_DESC(DC_INIT),
+    DBG_DESC_FMT(DC_SEARCH_OPPORTUNITY),
+    DBG_DESC_FMT(DC_RECEIVED_ANY_BEACON),
+    DBG_DESC(DC_RECEIVED_MY_BEACON),
+    DBG_DESC(DC_PROFILE_IS_ADHOC_BUT_BSS_IS_INFRA),
+    DBG_DESC(DC_PS_ENABLED_BUT_ATHEROS_IE_ABSENT),
+    DBG_DESC(DC_BSS_ADHOC_CHANNEL_NOT_ALLOWED),
+    DBG_DESC(DC_SET_BEACON_UPDATE),
+    DBG_DESC(DC_BEACON_UPDATE_COMPLETE),
+    DBG_DESC(DC_END_SEARCH_BEACON_UPDATE_COMP_CB),
+    DBG_DESC(DC_BSSINFO_EVENT_DROPPED),
+    DBG_DESC(DC_IEEEPS_ENABLED_BUT_ATIM_ABSENT),
+};
+
+static struct dbglog_desc btcoex_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC(BTCOEX_STATUS_CMD),
+    DBG_DESC(BTCOEX_PARAMS_CMD),
+    DBG_DESC(BTCOEX_ANT_CONFIG),
+    DBG_DESC(BTCOEX_COLOCATED_BT_DEVICE),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_SCO_ON),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_SCO_OFF),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_A2DP_ON),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_A2DP_OFF),
+    DBG_DESC(BTCOEX_A2DP_PROTECT_ON),
+    DBG_DESC(BTCOEX_A2DP_PROTECT_OFF),
+    DBG_DESC(BTCOEX_SCO_PROTECT_ON),
+    DBG_DESC(BTCOEX_SCO_PROTECT_OFF),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_DETECTOR_START),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_DETECTOR_STOP),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_TOGGLE),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_TOGGLE_RSSI_LRCNT),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_RSSI_THRESH),
+    DBG_DESC(BTCOEX_CLOSE_RANGE_LOW_RATE_THRESH),
+    DBG_DESC(BTCOEX_PTA_PRI_INTR_HANDLER),
+    DBG_DESC_FMT(BTCOEX_PSPOLL_QUEUED),
+    DBG_DESC_FMT(BTCOEX_PSPOLL_COMPLETE),
+    DBG_DESC_FMT(BTCOEX_DBG_PM_AWAKE),
+    DBG_DESC_FMT(BTCOEX_DBG_PM_SLEEP),
+    DBG_DESC(BTCOEX_DBG_SCO_COEX_ON),
+    DBG_DESC(BTCOEX_SCO_DATARECEIVE),
+    DBG_DESC(BTCOEX_INTR_INIT),
+    DBG_DESC(BTCOEX_PTA_PRI_DIFF),
+    DBG_DESC_FMT(BTCOEX_TIM_NOTIFICATION),
+    DBG_DESC(BTCOEX_SCO_WAKEUP_ON_DATA),
+    DBG_DESC(BTCOEX_SCO_SLEEP),
+    DBG_DESC_FMT(BTCOEX_SET_WEIGHTS),
+    DBG_DESC(BTCOEX_SCO_DATARECEIVE_LATENCY_VAL),
+    DBG_DESC(BTCOEX_SCO_MEASURE_TIME_DIFF),
+    DBG_DESC(BTCOEX_SET_EOL_VAL),
+    DBG_DESC(BTCOEX_OPT_DETECT_HANDLER),
+    DBG_DESC(BTCOEX_SCO_TOGGLE_STATE),
+    DBG_DESC(BTCOEX_SCO_STOMP),
+    DBG_DESC(BTCOEX_NULL_COMP_CALLBACK),
+    DBG_DESC(BTCOEX_RX_INCOMING),
+    DBG_DESC(BTCOEX_RX_INCOMING_CTL),
+    DBG_DESC(BTCOEX_RX_INCOMING_MGMT),
+    DBG_DESC(BTCOEX_RX_INCOMING_DATA),
+    DBG_DESC(BTCOEX_RTS_RECEPTION),
+    DBG_DESC(BTCOEX_FRAME_PRI_LOW_RATE_THRES),
+    DBG_DESC_FMT(BTCOEX_PM_FAKE_SLEEP),
+    DBG_DESC_FMT(BTCOEX_ACL_COEX_STATUS),
+    DBG_DESC(BTCOEX_ACL_COEX_DETECTION),
+    DBG_DESC(BTCOEX_A2DP_COEX_STATUS),
+    DBG_DESC(BTCOEX_SCO_STATUS),
+    DBG_DESC_FMT(BTCOEX_WAKEUP_ON_DATA),
+    DBG_DESC(BTCOEX_DATARECEIVE),
+    DBG_DESC(0),
+    DBG_DESC(BTCOEX_GET_MAX_AGGR_SIZE),
+    DBG_DESC(BTCOEX_MAX_AGGR_AVAIL_TIME),
+    DBG_DESC(BTCOEX_DBG_WBTIMER_INTR),
+    DBG_DESC(0),
+    DBG_DESC(BTCOEX_DBG_SCO_SYNC),
+    DBG_DESC(0),
+    DBG_DESC(BTCOEX_UPLINK_QUEUED_RATE),
+    DBG_DESC(BTCOEX_DBG_UPLINK_ENABLE_EOL),
+    DBG_DESC(BTCOEX_UPLINK_FRAME_DURATION),
+    DBG_DESC(BTCOEX_UPLINK_SET_EOL),
+    DBG_DESC(BTCOEX_DBG_EOL_EXPIRED),
+    DBG_DESC(BTCOEX_DBG_DATA_COMPLETE),
+    DBG_DESC(BTCOEX_UPLINK_QUEUED_TIMESTAMP),
+    DBG_DESC(BTCOEX_DBG_DATA_COMPLETE_TIME),
+    DBG_DESC(BTCOEX_DBG_A2DP_ROLE_IS_SLAVE),
+    DBG_DESC(BTCOEX_DBG_A2DP_ROLE_IS_MASTER),
+    DBG_DESC(BTCOEX_DBG_UPLINK_SEQ_NUM),
+    DBG_DESC(BTCOEX_UPLINK_AGGR_SEQ),
+    DBG_DESC(BTCOEX_DBG_TX_COMP_SEQ_NO),
+    DBG_DESC(BTCOEX_DBG_MAX_AGGR_PAUSE_STATE),
+    DBG_DESC(BTCOEX_DBG_ACL_TRAFFIC),
+    DBG_DESC(BTCOEX_CURR_AGGR_PROP),
+    DBG_DESC(BTCOEX_DBG_SCO_GET_PER_TIME_DIFF),
+    DBG_DESC(BTCOEX_PSPOLL_PROCESS),
+    DBG_DESC(BTCOEX_RETURN_FROM_MAC),
+    DBG_DESC(BTCOEX_FREED_REQUEUED_CNT),
+    DBG_DESC(BTCOEX_DBG_TOGGLE_LOW_RATES),
+    DBG_DESC(BTCOEX_MAC_GOES_TO_SLEEP),
+    DBG_DESC(BTCOEX_DBG_A2DP_NO_SYNC),
+    DBG_DESC(BTCOEX_RETURN_FROM_MAC_HOLD_Q_INFO),
+    DBG_DESC(BTCOEX_RETURN_FROM_MAC_AC),
+    DBG_DESC(BTCOEX_DBG_DTIM_RECV),
+    DBG_DESC(0),
+    DBG_DESC(BTCOEX_IS_PRE_UPDATE),
+    DBG_DESC(BTCOEX_ENQUEUED_BIT_MAP),
+    DBG_DESC(BTCOEX_TX_COMPLETE_FIRST_DESC_STATS),
+    DBG_DESC(BTCOEX_UPLINK_DESC),
+    DBG_DESC(BTCOEX_SCO_GET_PER_FIRST_FRM_TIMESTAMP),
+    DBG_DESC(0), DBG_DESC(0), DBG_DESC(0),
+    DBG_DESC(BTCOEX_DBG_RECV_ACK),
+    DBG_DESC(BTCOEX_DBG_ADDBA_INDICATION),
+    DBG_DESC(BTCOEX_TX_COMPLETE_EOL_FAILED),
+    DBG_DESC(BTCOEX_DBG_A2DP_USAGE_COMPLETE),
+    DBG_DESC(BTCOEX_DBG_A2DP_STOMP_FOR_BCN_HANDLER),
+    DBG_DESC(BTCOEX_DBG_A2DP_SYNC_INTR),
+    DBG_DESC(BTCOEX_DBG_A2DP_STOMP_FOR_BCN_RECEPTION),
+    DBG_DESC(BTCOEX_FORM_AGGR_CURR_AGGR),
+    DBG_DESC(BTCOEX_DBG_TOGGLE_A2DP_BURST_CNT),
+    DBG_DESC(BTCOEX_DBG_BT_TRAFFIC),
+    DBG_DESC(BTCOEX_DBG_STOMP_BT_TRAFFIC),
+    DBG_DESC(BTCOEX_RECV_NULL),
+    DBG_DESC(BTCOEX_DBG_A2DP_MASTER_BT_END),
+    DBG_DESC(BTCOEX_DBG_A2DP_BT_START),
+    DBG_DESC(BTCOEX_DBG_A2DP_SLAVE_BT_END),
+    DBG_DESC(BTCOEX_DBG_A2DP_STOMP_BT),
+    DBG_DESC_FMT(BTCOEX_DBG_GO_TO_SLEEP),
+    DBG_DESC(BTCOEX_DBG_A2DP_PKT),
+    DBG_DESC(BTCOEX_DBG_A2DP_PSPOLL_DATA_RECV),
+    DBG_DESC(BTCOEX_DBG_A2DP_NULL),
+    DBG_DESC(BTCOEX_DBG_UPLINK_DATA),
+    DBG_DESC(BTCOEX_DBG_A2DP_STOMP_LOW_PRIO_NULL),
+    DBG_DESC(BTCOEX_DBG_ADD_BA_RESP_TIMEOUT),
+    DBG_DESC(BTCOEX_DBG_TXQ_STATE),
+    DBG_DESC_FMT(BTCOEX_DBG_ALLOW_SCAN),
+    DBG_DESC_FMT(BTCOEX_DBG_SCAN_REQUEST),
+    DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), DBG_DESC(0),
+    DBG_DESC(BTCOEX_A2DP_SLEEP),
+    DBG_DESC(BTCOEX_DBG_DATA_ACTIV_TIMEOUT),
+    DBG_DESC(BTCOEX_DBG_SWITCH_TO_PSPOLL_ON_MODE),
+    DBG_DESC(BTCOEX_DBG_SWITCH_TO_PSPOLL_OFF_MODE),
+    DBG_DESC(BTCOEX_DATARECEIVE_AGGR),
+    DBG_DESC(BTCOEX_DBG_DATA_RECV_SLEEPING_PENDING),
+    DBG_DESC(BTCOEX_DBG_DATARESP_TIMEOUT),
+    DBG_DESC(BTCOEX_BDG_BMISS),
+    DBG_DESC(BTCOEX_DBG_DATA_RECV_WAKEUP_TIM),
+    DBG_DESC(BTCOEX_DBG_SECOND_BMISS),
+    DBG_DESC(0), 
+    DBG_DESC_FMT(BTCOEX_DBG_SET_WLAN_STATE),
+    DBG_DESC(BTCOEX_BDG_FIRST_BMISS),
+    DBG_DESC(BTCOEX_DBG_A2DP_CHAN_OP),
+    DBG_DESC(BTCOEX_DBG_A2DP_INTR),
+    DBG_DESC_FMT(BTCOEX_DBG_BT_INQUIRY),
+    DBG_DESC(BTCOEX_DBG_BT_INQUIRY_DATA_FETCH),
+    DBG_DESC(BTCOEX_DBG_POST_INQUIRY_FINISH),
+    DBG_DESC(BTCOEX_DBG_SCO_OPT_MODE_TIMER_HANDLER),
+    DBG_DESC(BTCOEX_DBG_NULL_FRAME_SLEEP),
+    DBG_DESC(BTCOEX_DBG_NULL_FRAME_AWAKE),
+    DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), DBG_DESC(0), 
+    DBG_DESC(BTCOEX_DBG_SET_AGGR_SIZE),
+    DBG_DESC(BTCOEX_DBG_TEAR_BA_TIMEOUT),
+    DBG_DESC(BTCOEX_DBG_MGMT_FRAME_SEQ_NO),
+    DBG_DESC(BTCOEX_DBG_SCO_STOMP_HIGH_PRI),
+    DBG_DESC(BTCOEX_DBG_COLOCATED_BT_DEV),
+    DBG_DESC(BTCOEX_DBG_FE_ANT_TYPE),
+    DBG_DESC(BTCOEX_DBG_BT_INQUIRY_CMD),
+    DBG_DESC(BTCOEX_DBG_SCO_CONFIG),
+    DBG_DESC(BTCOEX_DBG_SCO_PSPOLL_CONFIG),
+    DBG_DESC(BTCOEX_DBG_SCO_OPTMODE_CONFIG),
+    DBG_DESC(BTCOEX_DBG_A2DP_CONFIG),
+    DBG_DESC(BTCOEX_DBG_A2DP_PSPOLL_CONFIG),
+    DBG_DESC(BTCOEX_DBG_A2DP_OPTMODE_CONFIG),
+    DBG_DESC(BTCOEX_DBG_ACLCOEX_CONFIG),
+    DBG_DESC(BTCOEX_DBG_ACLCOEX_PSPOLL_CONFIG),
+    DBG_DESC(BTCOEX_DBG_ACLCOEX_OPTMODE_CONFIG),
+    DBG_DESC(BTCOEX_DBG_DEBUG_CMD),
+    DBG_DESC(BTCOEX_DBG_SET_BT_OPERATING_STATUS),
+    DBG_DESC(BTCOEX_DBG_GET_CONFIG),
+    DBG_DESC(BTCOEX_DBG_GET_STATS),
+    DBG_DESC(BTCOEX_DBG_BT_OPERATING_STATUS),
+    DBG_DESC(BTCOEX_DBG_PERFORM_RECONNECT),
+    DBG_DESC(0), 
+    DBG_DESC(BTCOEX_DBG_ACL_WLAN_MED),
+    DBG_DESC(BTCOEX_DBG_ACL_BT_MED),
+    DBG_DESC(BTCOEX_DBG_WLAN_CONNECT),
+    DBG_DESC(BTCOEX_DBG_A2DP_DUAL_START),
+    DBG_DESC(BTCOEX_DBG_PMAWAKE_NOTIFY),
+    DBG_DESC(BTCOEX_DBG_BEACON_SCAN_ENABLE),
+    DBG_DESC(BTCOEX_DBG_BEACON_SCAN_DISABLE),
+    DBG_DESC(BTCOEX_DBG_RX_NOTIFY),
+    DBG_DESC(BTCOEX_SCO_GET_PER_SECOND_FRM_TIMESTAMP),
+    DBG_DESC(BTCOEX_DBG_TXQ_DETAILS),
+    DBG_DESC(BTCOEX_DBG_SCO_STOMP_LOW_PRI),
+    DBG_DESC(BTCOEX_DBG_A2DP_FORCE_SCAN),
+    DBG_DESC(BTCOEX_DBG_DTIM_STOMP_COMP),
+    DBG_DESC(BTCOEX_ACL_PRESENCE_TIMER),
+    DBG_DESC(BTCOEX_DBG_QUEUE_SELF_CTS),
+    DBG_DESC(BTCOEX_DBG_SELF_CTS_COMP),
+    DBG_DESC(BTCOEX_DBG_APMODE_WAIT_FOR_CTS_COMP_FAILED),
+    DBG_DESC(BTCOEX_DBG_APMODE_A2DP_MED_TO_BT),
+    DBG_DESC(BTCOEX_DBG_APMODE_SET_BTSTATE),
+    DBG_DESC(BTCOEX_DBG_APMODE_A2DP_STATUS),
+    DBG_DESC(BTCOEX_DBG_APMODE_SCO_CTS_HANDLER),
+    DBG_DESC(BTCOEX_DBG_APMODE_SCO_STATUS),
+    DBG_DESC(BTCOEX_DBG_APMODE_TXQ_DRAINED),
+    DBG_DESC(BTCOEX_DBG_APMODE_SCO_ARM_TIMER),
+    DBG_DESC(BTCOEX_DBG_APMODE_SWITCH_MED_TO_WLAN),
+    DBG_DESC(BTCOEX_APMODE_BCN_TX_HANDLER),
+    DBG_DESC(BTCOEX_APMODE_BCN_TX),
+    DBG_DESC(BTCOEX_APMODE_SCO_RTS_HANDLER),
+};
+
+static struct dbglog_desc pm_desc[] = {
+    DBG_DESC(0),
+    DBG_DESC(PM_INIT), 
+    DBG_DESC(PM_ENABLE),
+    DBG_DESC_FMT(PM_SET_STATE),
+    DBG_DESC_FMT(PM_SET_POWERMODE),
+    DBG_DESC(PM_CONN_NOTIFY),
+    DBG_DESC(PM_REF_COUNT_NEGATIVE),
+    DBG_DESC(PM_INFRA_STA_APSD_ENABLE),
+    DBG_DESC(PM_INFRA_STA_UPDATE_APSD_STATE),
+    DBG_DESC_FMT(PM_CHAN_OP_REQ),
+    DBG_DESC_FMT(PM_SET_MY_BEACON_POLICY),
+    DBG_DESC_FMT(PM_SET_ALL_BEACON_POLICY),
+    DBG_DESC(PM_INFRA_STA_SET_PM_PARAMS1),
+    DBG_DESC(PM_INFRA_STA_SET_PM_PARAMS2),
+    DBG_DESC(PM_ADHOC_SET_PM_CAPS_FAIL),
+    DBG_DESC(PM_ADHOC_UNKNOWN_IBSS_ATTRIB_ID),
+    DBG_DESC(PM_ADHOC_SET_PM_PARAMS),
+    DBG_DESC(0),
+    DBG_DESC(PM_ADHOC_STATE1),
+    DBG_DESC(PM_ADHOC_STATE2),
+    DBG_DESC(PM_ADHOC_CONN_MAP),
+    DBG_DESC_FMT(PM_FAKE_SLEEP),
+    DBG_DESC(PM_AP_STATE1),
+    DBG_DESC(PM_AP_SET_PM_PARAMS),
+    DBG_DESC(PM_P2P_STATE1),
+};
+
+static struct dbglog_desc dummy_desc[] = {
+    DBG_DESC(0),
+};
+
+static struct module_desc modules[] = {
+    MODULE_DESC(INF, dummy_desc),
+    MODULE_DESC(WMI, wmi_desc),
+    MODULE_DESC(MISC, dummy_desc),
+    MODULE_DESC(PM, pm_desc),
+    MODULE_DESC(TXRX_MGMTBUF, mgmtbuf_desc),
+    MODULE_DESC(TXRX_TXBUF, dummy_desc),
+    MODULE_DESC(TXRX_RXBUF, dummy_desc),
+    MODULE_DESC(WOW, dummy_desc),
+    MODULE_DESC(WHAL, dummy_desc),
+    MODULE_DESC(DC, dc_desc),
+    MODULE_DESC(CO, co_desc),
+    MODULE_DESC(RO, dummy_desc),
+    MODULE_DESC(CM, dummy_desc),
+    MODULE_DESC(MGMT, dummy_desc),
+    MODULE_DESC(TMR, dummy_desc),
+    MODULE_DESC(BTCOEX, btcoex_desc),
+};
+
+static int compOid(const void *a, const void *b)
+{
+    return *(A_INT32*)a  - *(A_INT32*)b;
+}
+
+static void do_check_ids(void)
+{
+    size_t m, d, td;
+    for (m = 0; m < DBGLOG_MODULEID_NUM_MAX; ++m) {
+        size_t mlen;
+        struct dbglog_desc *dlog;
+        if (m >= ARRAY_SIZE(modules)) {
+            printf("module id %d does not matched\n", m);
+            break;
+        }
+        dlog = modules[m].descs;
+        mlen = modules[m].len;
+        d=td=1;
+        while (dlog && (d<mlen||dbglog_id_tag[m][td][0]!='\0')) {       
+            if (d>=mlen) {
+                if (dlog != dummy_desc) {
+                    printf("m %s dbgid %s(%d) is larger than max internal table %d host/firmware mismatch?\n", 
+                            modules[m].name, dbglog_id_tag[m][td], td, mlen);
+                }                
+                break;
+            }
+
+            if (dbglog_id_tag[m][td][0]=='\0' && dlog[d].oid!=0) {
+                for (;td < DBGLOG_DBGID_NUM_MAX && dbglog_id_tag[m][td][0]=='\0'; ++td);
+            }
+            if (strcmp(dbglog_id_tag[m][td], dlog[d].desc)!=0 && dlog[d].oid!=0) {
+                printf("debug id does not matched '%s' <> '%s'\n", dbglog_id_tag[m][td], dlog[d].desc);
+                break;
+            } else {
+                if (td!=d && !modules[m].bsearch) {                    
+                    printf("Module %s debugid %s(%d) mismatched. using binary search for debugid",
+                           modules[m].name, dbglog_id_tag[m][td], td); 
+                    modules[m].bsearch = 1;
+                }
+            }
+            ++d; ++td;
+        }
+        if (modules[m].bsearch && dlog) {
+            qsort(dlog, mlen, sizeof(dlog[0]), compOid);
+        }
+    }
+    check_ids = 1;
+}
+
+static DbgLogFormatter getFormatter(A_INT32 moduleid, A_INT32 debugid)
+{
+    if (!check_ids) {
+        do_check_ids();
+    }
+
+    if ( moduleid < ARRAY_SIZE(modules)) {
+        const struct module_desc *m = &modules[moduleid];
+        if (m->descs ) {
+            if (m->bsearch){
+                struct dbglog_desc *d;
+                d = (struct dbglog_desc*)bsearch(&debugid, m->descs, m->len, sizeof(m->descs[0]), compOid);
+                return d ? d->formatter : NULL;
+            } else if (debugid>0 && debugid<m->len) {
+                return m->descs[debugid].formatter;   
+            }
+        }
+    }
+    return NULL;
+}
+
+int dbg_formater(int lv, char *output, size_t len, A_UINT32 ts, A_INT32 *logbuf)
+{
+    int ret = 0;
+	A_UINT32 idx, last_idx;
+    A_UINT32 debugid = DBGLOG_GET_DBGID(logbuf[0]);
+    A_UINT32 moduleid = DBGLOG_GET_MODULEID(logbuf[0]);
+    A_UINT32 numargs = DBGLOG_GET_NUMARGS(logbuf[0]);
+    A_UINT32 timestamp = DBGLOG_GET_TIMESTAMP(logbuf[0]);
+    DbgLogFormatter dbgFormatter = NULL;
+
+    if (numargs>2) {
+        return ret;
+    }
+
+    if (lv > 0) {
+        dbgFormatter = getFormatter(moduleid, debugid);
+    }
+
+    if (ts>0) {
+        if (lv == 0) {
+            ret += snprintf(output+ret, len-ret, "%8d: ", ts);
+        } else {
+            ret += strftime(output+ret, len-ret, "%m-%d %H:%M:%S ", gmtime((time_t*)&ts));
+        }
+    }
+    ret += snprintf(output+ret, len-ret, "(%05d) %s", timestamp, dbglog_id_tag[moduleid][debugid]);
+    if (lv>1 || lv == 0 || !dbgFormatter) {
+
+        if(numargs == 1 && !strcmp(dbglog_id_tag[moduleid][debugid], "WMI_EVENT_SEND"))
+        {
+            idx = 0;
+            last_idx = ARRAY_SIZE(dbg_wmi_event_str);
+            for(idx = 0 ; idx < last_idx ; idx++) {
+                if(dbg_wmi_event_str[idx].id == logbuf[1]) {
+                    break;
+                }
+            }
+            if(idx < last_idx) {
+                ret += snprintf(output+ret, len-ret, ": 0x%04x\t\t--- %s",
+                                logbuf[1], dbg_wmi_event_str[idx].str );
+            } else {
+            	ret += snprintf(output+ret, len-ret, ": 0x%04x", logbuf[1]);
+            }
+        } else if(numargs == 2 && !strcmp(dbglog_id_tag[moduleid][debugid], "WMI_CMD_RX")) {
+            idx = 0;
+            last_idx = ARRAY_SIZE(dbg_wmi_cmd_str);
+            for(idx = 0 ; idx < last_idx ; idx++) {
+                if(dbg_wmi_cmd_str[idx].id == logbuf[1])
+                    break;
+            }
+            if(idx < last_idx) {
+                ret += snprintf(output+ret, len-ret, ": 0x%02x, 0x%02x\t\t+++ %s",
+                                logbuf[1], logbuf[2], dbg_wmi_cmd_str[idx].str );
+            } else {
+            	ret += snprintf(output+ret, len-ret, ": 0x%02x, 0x%02x", 
+            	                logbuf[1], logbuf[2]);
+            }
+        } else {
+	        if (numargs>0) {
+	            ret += snprintf(output+ret, len-ret, ": 0x%x", logbuf[1]);
+	        }
+	        if (numargs>1) {
+	            ret += snprintf(output+ret, len-ret, ", 0x%x", logbuf[2]);
+	        }
+	        if (dbgFormatter && numargs>0 && lv > 0) {
+	            ret += snprintf(output+ret, len-ret, ", ");
+	        }
+        }
+    } else {
+        ret += snprintf(output+ret, len-ret, ": ");
+    }
+
+    if (dbgFormatter && lv > 0) {
+        int pos = ret;
+        int addlen;
+        addlen = dbgFormatter(output+ret, len-ret, numargs, logbuf);
+        if (addlen>0) {
+            ret += addlen;
+        } else if (lv<=1) {
+            /* skip this message */
+            (void)pos;
+            return 0;
+        }
+    }
+    ret += snprintf(output+ret, len-ret, "\n");
+    return ret;
+}
+
diff --git a/host/tools/dbgParser/dbgParser b/host/tools/dbgParser/dbgParser
new file mode 100755
index 0000000..5a9ed9e
--- /dev/null
+++ b/host/tools/dbgParser/dbgParser
Binary files differ
diff --git a/host/tools/dbgParser/dbgParser.c b/host/tools/dbgParser/dbgParser.c
new file mode 100644
index 0000000..f499dcb
--- /dev/null
+++ b/host/tools/dbgParser/dbgParser.c
@@ -0,0 +1,502 @@
+/*
+ * Copyright (c) 2006 Atheros Communications Inc.
+ * All rights reserved.
+ * 
+ *
+ * 
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+//
+ * 
+ */
+
+/* This tool parses the recevent logs stored in the binary format 
+   by the wince athsrc */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <getopt.h>
+#include <time.h>
+#include <asm/types.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#include <linux/types.h>
+#include <linux/if.h>
+#include <linux/wireless.h>
+#include <a_config.h>
+#include <a_osapi.h>
+#include <a_types.h>
+#include <athdefs.h>
+#include <ieee80211.h>
+#include <wmi.h>
+#include <athdrv_linux.h>
+#include <dbglog_api.h>
+
+#undef DEBUG
+#undef DBGLOG_DEBUG
+
+#define ID_LEN                         2
+#define FILENAME_LENGTH_MAX            128
+#define DBGLOG_FILE                    "dbglog.h"
+#define DBGLOGID_FILE                  "dbglog_id.h"
+#define DBGLOG_OUTPUT_FILE             "dbglog.out"
+
+const A_CHAR *progname;
+A_CHAR dbglogfile[FILENAME_LENGTH_MAX];
+A_CHAR dbglogidfile[FILENAME_LENGTH_MAX];
+A_CHAR dbglogoutfile[FILENAME_LENGTH_MAX];
+A_CHAR dbgloginfile[FILENAME_LENGTH_MAX];
+FILE *fpout;
+FILE *fpin;
+int fmtlv;
+int outfmt; /* 0: raw, 1: html 2: RTF */
+int headerlen;
+int noSystime;
+
+A_CHAR dbglog_id_tag[DBGLOG_MODULEID_NUM_MAX][DBGLOG_DBGID_NUM_MAX][DBGLOG_DBGID_DEFINITION_LEN_MAX];
+
+#define AR6K_MAX_DBG_BUFFER_SIZE 1500
+
+struct dbg_binary_record {
+    A_UINT32 ts;
+    A_UINT32 length;
+    A_UINT8  log[AR6K_MAX_DBG_BUFFER_SIZE];
+};
+
+struct dbg_binary_header {
+    A_UINT8     sig;
+    A_UINT8     ver;
+    A_UINT16    len;
+    A_UINT32    reserved;
+};
+
+
+#ifdef DEBUG
+A_INT32 debugRecEvent = 0;
+#define RECEVENT_DEBUG_PRINTF(args...)        if (debugRecEvent) printf(args);
+#else
+#define RECEVENT_DEBUG_PRINTF(args...)
+#endif
+
+static const A_CHAR htmlHeader[] = "<br/><style type='text/css'>\
+.m0 { color:#ff0000; }\
+.m1 { color:#0000FF; }\
+.m2 { color:#8d8d8d; }\
+.m3 { color:#000000; }\
+.m4 { color:#a11693; }\
+.m5 { color:#b452ab; }\
+.m6 { color:#d18eca; }\
+.m7 { color:#ff3205; }\
+.m8 { color:#ff2428; }\
+.m9 { color:#d700b4; }\
+.m10 { color:#ffe20e; }\
+.m11 { color:#ff0072; }\
+.m12 { color:#00a700; }\
+.m13 { color:#437197; }\
+.m14 { color:#e64248; }\
+.m15 { color:#5a1484; }\
+</style>\n";
+
+static const A_CHAR htmlFooter[] = "";
+
+static const A_CHAR rtfHeader[] = "{\\rtf1\\ansi\\deff0{\\fonttbl\\f0\\fswiss Helvetica;}\n\
+{\\colortbl \\red255\\green0\\blue0;\
+\\red0\\green0\\blue255;\
+\\red141\\green141\\blue141;\
+\\red0\\green0\\blue0;\
+\\red161\\green22\\blue147;\
+\\red180\\green82\\blue171;\
+\\red209\\green142\\blue202;\
+\\red255\\green50\\blue5;\
+\\red255\\green36\\blue40;\
+\\red215\\green0\\blue180;\
+\\red255\\green226\\blue14;\
+\\red255\\green0\\blue114;\
+\\red0\\green167\\blue0;\
+\\red67\\green113\\blue151;\
+\\red230\\green66\\blue72;\
+\\red90\\green20\\blue132;\
+}\\f0\\cf3 ";
+
+static const A_CHAR rtfFooter[] = "}";
+
+A_INT32
+string_search(FILE *fp, A_CHAR *string)
+{
+    A_CHAR str[DBGLOG_DBGID_DEFINITION_LEN_MAX];
+
+    rewind(fp);
+    memset(str, 0, DBGLOG_DBGID_DEFINITION_LEN_MAX);
+    while (!feof(fp)) {
+        if (fgets(str, sizeof(str), fp)) {
+            if (strstr(str, string)) return 1;
+        }
+    }
+
+    return 0;
+}
+
+void
+get_module_name(A_CHAR *string, A_CHAR *dest)
+{
+    A_CHAR *str1, *str2;
+    A_CHAR str[DBGLOG_DBGID_DEFINITION_LEN_MAX];
+
+    memset(str, 0, DBGLOG_DBGID_DEFINITION_LEN_MAX);
+    strcpy(str, string);
+    str1 = strtok(str, "_");
+    while ((str2 = strtok(NULL, "_"))) {
+        str1 = str2;
+    }
+
+    strcpy(dest, str1);
+}
+
+#ifdef DBGLOG_DEBUG
+void
+dbglog_print_id_tags(void)
+{
+    A_INT32 i, j;
+
+    for (i = 0; i < DBGLOG_MODULEID_NUM_MAX; i++) {
+        for (j = 0; j < DBGLOG_DBGID_NUM_MAX; j++) {
+            printf("[%d][%d]: %s\n", i, j, dbglog_id_tag[i][j]);
+        }
+    }
+}
+#endif /* DBGLOG_DEBUG */
+
+A_INT32
+dbglog_generate_id_tags(void)
+{
+    A_INT32 id1, id2;
+    FILE *fp1, *fp2;
+    A_CHAR str1[DBGLOG_DBGID_DEFINITION_LEN_MAX];
+    A_CHAR str2[DBGLOG_DBGID_DEFINITION_LEN_MAX];
+    A_CHAR str3[DBGLOG_DBGID_DEFINITION_LEN_MAX];
+
+    if (!(fp1 = fopen(dbglogfile, "r"))) {
+        perror(dbglogfile);
+        return -1;
+    }
+
+    if (!(fp2 = fopen(dbglogidfile, "r"))) {
+        fclose(fp1);
+        perror(dbglogidfile);
+        return -1;
+    }
+
+    memset(dbglog_id_tag, 0, sizeof(dbglog_id_tag));
+    if (string_search(fp1, "DBGLOG_MODULEID_START")) {
+        int ret = fscanf(fp1, "%s %s %d", str1, str2, &id1);
+        do {
+            memset(str3, 0, DBGLOG_DBGID_DEFINITION_LEN_MAX);
+            get_module_name(str2, str3);
+            strcat(str3, "_DBGID_DEFINITION_START");
+            if (string_search(fp2, str3)) {
+                memset(str3, 0, DBGLOG_DBGID_DEFINITION_LEN_MAX);
+                get_module_name(str2, str3);
+                strcat(str3, "_DBGID_DEFINITION_END");
+                ret = fscanf(fp2, "%s %s %d", str1, str2, &id2);
+                while (!(strstr(str2, str3))) {
+                    strcpy((A_CHAR *)&dbglog_id_tag[id1][id2], str2);
+                    ret= fscanf(fp2, "%s %s %d", str1, str2, &id2);
+                }
+            }
+            ret = fscanf(fp1, "%s %s %d", str1, str2, &id1);
+        } while (!(strstr(str2, "DBGLOG_MODULEID_END")));
+    }
+
+    fclose(fp2);
+    fclose(fp1);
+
+    return 0;
+}
+
+static void
+usage(void)
+{
+const char options[] = 
+"Options:\n\
+-d, --srcdir=<Directory containing the dbglog header files> [Optional]\n\
+-f, --fileformat 0:plain text, 1:HTML, 2:RTF \n\
+-s, --nosystime Don't print out system time\n\
+-t, --format 0:Raw, 1:brief, 2:full [0 by default]\n";
+
+    fprintf(stderr, "usage:\n%s [options] <input log file> <output file>\n", progname);
+    fprintf(stderr, "%s", options);
+    exit(-1);
+}
+
+static A_INT32 
+decode_debug_rec(struct dbg_binary_record *dbg_rec)
+{
+#define BUF_SIZE    512
+    A_UINT32 count;
+    A_UINT32 numargs;
+    A_INT32 *buffer;
+    A_UINT32 length;
+    A_CHAR buf[BUF_SIZE];
+    A_UINT32 curpos;
+    static A_INT32 numOfRec = 0;
+    A_INT32 len;
+    char outputBuf[2048];
+
+#ifdef DBGLOG_DEBUG
+    RECEVENT_DEBUG_PRINTF("Application received target debug event: %d\n", len);
+#endif /* DBGLOG_DEBUG */
+    count = 0;
+    len = dbg_rec->length;
+    length = (len >> 2);
+    buffer = (A_INT32 *)dbg_rec->log;
+
+    while (count < length) {
+        A_INT32 lret, oret;
+        A_UINT32 moduleid = DBGLOG_GET_MODULEID(buffer[count]);
+        numargs = DBGLOG_GET_NUMARGS(buffer[count]);
+        oret = 0;
+        if (outfmt==1) {
+            oret += snprintf(outputBuf+oret, sizeof(outputBuf)-oret,
+                             "<span class='m%d'>", moduleid);
+        } else if (outfmt==2) {
+            oret += snprintf(outputBuf+oret, sizeof(outputBuf)-oret,
+                             "\\cf%d ", moduleid);
+        }
+        lret=dbg_formater(fmtlv, outputBuf+oret, sizeof(outputBuf)-oret,
+                         noSystime ? 0 : dbg_rec->ts, &buffer[count]);
+        if ( lret > 0) {            
+#ifdef DBGLOG_DEBUG
+            RECEVENT_DEBUG_PRINTF("%s", outputBuf+oret);
+#endif /* DBGLOG_DEBUG */
+
+            oret += lret;
+            if (outfmt==1) {
+                oret += snprintf(outputBuf+oret, sizeof(outputBuf)-oret, "</span><br/>");
+            } else if (outfmt==2) {
+                oret += snprintf(outputBuf+oret, sizeof(outputBuf)-oret, "\\par");
+            }
+            fprintf(fpout, "%s", outputBuf);
+        }
+        count += (numargs + 1);
+
+        numOfRec++;
+    }
+
+    /* Update the last rec at the top of file */
+    curpos = ftell(fpout);
+    if( fgets(buf, BUF_SIZE, fpout) ) {
+        buf[BUF_SIZE - 1] = 0;  /* In case string is longer from logs */
+        length = strlen(buf);
+        memset(buf, ' ', length-1);
+        buf[length] = 0;
+        fseek(fpout, curpos, SEEK_SET);
+        fprintf(fpout, "%s", buf);
+    }
+
+    rewind(fpout);
+    /* Update last record */
+    fseek(fpout, headerlen, SEEK_SET);
+    fprintf(fpout, "%08d\n", numOfRec);
+    fseek(fpout, curpos, SEEK_SET);
+    fflush(fpout);
+
+#undef BUF_SIZE
+    return 0;
+}
+
+A_INT32 main(A_INT32 argc, A_CHAR** argv)
+{
+    A_CHAR *workarea = NULL;
+    struct dbg_binary_record dbg_rec;
+    A_UINT32 min_ts;
+    A_INT32 min_rec_num;
+    A_UINT32 rec_num;
+    A_INT32 i;
+    struct dbg_binary_header dbg_header;
+    A_UINT16 dbg_rec_len;
+    A_UINT16 dbg_header_len;
+
+    progname = argv[0];
+    memset(dbgloginfile, 0, FILENAME_LENGTH_MAX);
+    memset(dbglogoutfile, 0, FILENAME_LENGTH_MAX);
+
+    while (1) {
+        int option_index = 0;
+        int c;
+        static struct option long_options[] = {
+            {"srcdir", 1, NULL, 'd'},
+            {"format", 1, NULL, 't'},
+            {"fileformat",  1, NULL, 'f'},
+            {"nosystime", 0, NULL, 's'},
+            {0, 0, 0, 0}
+        };
+        c = getopt_long (argc, argv, "d:t:f:s", long_options, &option_index);
+        if (c == -1) break;
+
+        switch (c) {
+            case 'd':
+                workarea = optarg;
+                break;
+            case 't':
+                fmtlv = atoi(optarg);
+                break;
+            case 'f':
+                outfmt = atoi(optarg);
+                break;
+            case 's':
+                noSystime = 1;
+                break;
+            default:
+                usage();
+        }
+    }
+
+    if (!workarea) {
+        workarea = getenv("WORKAREA");
+    }
+
+    if (workarea == NULL) {
+        printf("export WORKAREA or use -d option\n");
+        return -1;
+    }
+    if ((argc - optind)<2) {
+        usage();
+        return -1;
+    }
+    /* Get the file name for dbglog header file */
+    memset(dbglogfile, 0, FILENAME_LENGTH_MAX);
+    strcpy(dbglogfile, workarea);
+    strcat(dbglogfile, "/include/");
+    strcat(dbglogfile, DBGLOG_FILE);
+
+    /* Get the file name for dbglog id header file */
+    memset(dbglogidfile, 0, FILENAME_LENGTH_MAX);
+    strcpy(dbglogidfile, workarea);
+    strcat(dbglogidfile, "/include/");
+    strcat(dbglogidfile, DBGLOGID_FILE);
+
+    /* Get the file name for dbglog input file */
+    memset(dbgloginfile, 0, FILENAME_LENGTH_MAX);
+    strcpy(dbgloginfile, argv[optind]);
+    if (!(fpin = fopen(dbgloginfile, "rb"))) {
+        perror(dbgloginfile);
+        return -1;
+    }
+
+    /* Get the file name for dbglog output file */
+    memset(dbglogoutfile, 0, FILENAME_LENGTH_MAX);
+    strcpy(dbglogoutfile, argv[optind+1]);
+    if (!(fpout = fopen(dbglogoutfile, "w+"))) {
+        perror(dbglogoutfile);
+        return -1;
+    }
+
+
+    /* first 8 bytes are to indicate the last record */
+    switch (outfmt) {
+    case 1:
+        headerlen = strlen(htmlHeader);
+        break;
+    case 2:
+        headerlen = strlen(rtfHeader);
+        break;
+    default:
+        headerlen = 0;
+        break;
+    }
+    if (outfmt==1) {
+        fprintf(fpout, "%s", htmlHeader);
+    } else if (outfmt==2) {
+        fprintf(fpout, "%s", rtfHeader);
+    }
+    fseek(fpout, headerlen + 8, SEEK_SET);
+    fprintf(fpout, "\n");
+
+    dbglog_generate_id_tags();
+#ifdef DBGLOG_DEBUG
+    dbglog_print_id_tags();
+#endif /* DBGLOG_DEBUG */
+
+    /* first 8 bytes are header */  
+    if (fread(&dbg_header, sizeof(struct dbg_binary_header), 1, fpin)!=1) {
+        perror("dbg_header mismatch\n");
+        return -1;
+    }
+
+    /* check header signature */
+    dbg_rec_len = sizeof(A_UINT32) * 2;
+    if (dbg_header.sig == 0xDB) {
+        dbg_rec_len += dbg_header.len;
+        dbg_header_len = 8;
+    } else {
+        /* header not present; assume max size */ 
+        dbg_rec_len += AR6K_MAX_DBG_BUFFER_SIZE;
+        dbg_header_len = 0;
+    }
+
+    /* go past header */
+    fseek(fpin, dbg_header_len , SEEK_SET);
+
+    min_ts = 0xFFFFFFFF;
+    rec_num = 0;
+    min_rec_num = 0;
+    while (!feof(fpin)) {
+        if (fread (&dbg_rec, dbg_rec_len, 1, fpin)) {
+            if (dbg_rec.ts < min_ts) {
+                min_ts = dbg_rec.ts;
+                min_rec_num = rec_num;
+            }
+            rec_num++;
+        }
+    }
+
+    /* go past header */
+    fseek(fpin, dbg_header_len , SEEK_SET);
+
+    // Goto the first min record
+    fseek(fpin, min_rec_num * dbg_rec_len , SEEK_CUR);
+    while (!feof(fpin)) {
+        if (fread (&dbg_rec, dbg_rec_len, 1, fpin)) {
+            decode_debug_rec(&dbg_rec);
+        }
+    }
+
+    /* go past header */
+    fseek(fpin, dbg_header_len , SEEK_SET);
+
+    for (i=0;i<min_rec_num;i++) {
+        if (fread (&dbg_rec, dbg_rec_len, 1, fpin)) {
+            decode_debug_rec(&dbg_rec);
+        } else {
+            break;
+        }
+    }
+
+    if (outfmt==1) {
+        fprintf(fpout, "%s", htmlFooter);
+    } else if (outfmt==2) {
+        fprintf(fpout, "%s", rtfFooter);
+    }
+
+    fclose(fpin);
+    fclose(fpout);
+    return 0;
+}
+
diff --git a/host/tools/dbgParser/dbg_cmd_evt.h b/host/tools/dbgParser/dbg_cmd_evt.h
new file mode 100644
index 0000000..bc1ec06
--- /dev/null
+++ b/host/tools/dbgParser/dbg_cmd_evt.h
@@ -0,0 +1,264 @@
+#ifndef _DBG_CMD_EVT_H_
+#define _DBG_CMD_EVT_H_
+
+#include <wmi.h>
+
+struct dbg_id_str_entry {
+    A_UINT16 id;
+    A_CHAR  *str;
+};
+
+static struct dbg_id_str_entry dbg_wmi_cmd_str[] = {
+    {WMI_CONNECT_CMDID, "CONNECT"},
+    {WMI_RECONNECT_CMDID, "RECONNECT"},
+    {WMI_DISCONNECT_CMDID, "DISCONNECT"},
+    {WMI_SYNCHRONIZE_CMDID, "SYNCHRONIZE"},
+    {WMI_CREATE_PSTREAM_CMDID, "CREATE_PSTREAM"},
+    {WMI_DELETE_PSTREAM_CMDID, "DELETE_PSTREAM"},
+    {WMI_START_SCAN_CMDID, "START_SCAN"},
+    {WMI_SET_SCAN_PARAMS_CMDID, "SET_SCAN_PARAMS"},
+    {WMI_SET_BSS_FILTER_CMDID, "SET_BSS_FILTER"},
+    {WMI_SET_PROBED_SSID_CMDID, "SET_PROBE_SSID"},
+    {WMI_SET_LISTEN_INT_CMDID, "SET_LISTEN_INT"},
+    {WMI_SET_BMISS_TIME_CMDID, "SET_BMISS_TIME"},
+    {WMI_SET_DISC_TIMEOUT_CMDID, "SET_DISC_TIMEOUT"},
+    {WMI_GET_CHANNEL_LIST_CMDID, "GET_CHANNEL_LIST"},
+    {WMI_SET_BEACON_INT_CMDID, "SET_BEACON_INT"},
+    {WMI_GET_STATISTICS_CMDID, "GET_STATISTICS"},
+    {WMI_SET_CHANNEL_PARAMS_CMDID, "SET_CHANNEL_PARAMS"},
+    {WMI_SET_POWER_MODE_CMDID, "SET_POWER_MODE"},
+    {WMI_SET_IBSS_PM_CAPS_CMDID, "IBSS_PM_CAPS"},
+    {WMI_SET_POWER_PARAMS_CMDID, "SET_POWER_PARAMS"},
+    {WMI_SET_POWERSAVE_TIMERS_POLICY_CMDID, "SET_POWERSAVE_TIMERS_POLICY"},
+    {WMI_ADD_CIPHER_KEY_CMDID, "ADD_CIPHER_KEY"},
+    {WMI_DELETE_CIPHER_KEY_CMDID, "DELETE_CIPHER_KEY"},
+    {WMI_ADD_KRK_CMDID, "ADD_KRK"},
+    {WMI_DELETE_KRK_CMDID, "DELETE_KRK"},
+    {WMI_SET_PMKID_CMDID, "SET_PMKID"},
+    {WMI_SET_TX_PWR_CMDID, "SET_TX_PWR"},
+    {WMI_GET_TX_PWR_CMDID, "GET_TX_PWR"},
+    {WMI_SET_ASSOC_INFO_CMDID, "SET_ASSOC_INFO"},
+    {WMI_ADD_BAD_AP_CMDID, "ADD_BAD_AP"},
+    {WMI_DELETE_BAD_AP_CMDID, "DELETE_BAD_AP"},
+    {WMI_SET_TKIP_COUNTERMEASURES_CMDID, "SET_TKIP_COUNTERMEASURESS"},
+    {WMI_RSSI_THRESHOLD_PARAMS_CMDID, "RSSI_THRESHOLD_PARAMS"},
+    {WMI_TARGET_ERROR_REPORT_BITMASK_CMDID, "TARGET_ERROR_REPORT_BITMASK"},
+    {WMI_SET_ACCESS_PARAMS_CMDID, "SET_ACCESS_PARAMS"},
+    {WMI_SET_RETRY_LIMITS_CMDID, "SET_RETRY_LIMITS"},
+    {WMI_RESERVED1, "SET_OPT_MODE"},
+    {WMI_RESERVED2, "OPT_TX_FRAME"},
+    {WMI_SET_VOICE_PKT_SIZE_CMDID, "SET_VOICE_PKT_SIZE"},
+    {WMI_SET_MAX_SP_LEN_CMDID, "SET_MAX_SP_LEN"},
+    {WMI_SET_ROAM_CTRL_CMDID, "SET_ROAM_CTRL"},
+    {WMI_GET_ROAM_TBL_CMDID, "GET_ROAM_TBL"},
+    {WMI_GET_ROAM_DATA_CMDID, "GET_ROAM_DATA"},
+    {WMI_ENABLE_RM_CMDID, "ENABLE_RM"},
+    {WMI_SET_MAX_OFFHOME_DURATION_CMDID, "SET_MAX_OFFHOME_DURATION"},
+    {WMI_EXTENSION_CMDID, "EXTENSION"},
+    {WMI_SNR_THRESHOLD_PARAMS_CMDID, "SNR_THRESHOLD_PARAMS"},
+    {WMI_LQ_THRESHOLD_PARAMS_CMDID, "LQ_THRESHOLD_PARAMS"},
+    {WMI_SET_LPREAMBLE_CMDID, "SET_LPREAMBLE"},
+    {WMI_SET_RTS_CMDID, "SET_RTS"},
+    {WMI_CLR_RSSI_SNR_CMDID, "CLR_RSSI_SNR"},
+    {WMI_SET_FIXRATES_CMDID, "SET_FIXRATES"},
+    {WMI_GET_FIXRATES_CMDID, "GET_FIXRATES"},
+    {WMI_SET_AUTH_MODE_CMDID, "SET_AUTH_MODE"},
+    {WMI_SET_REASSOC_MODE_CMDID, "SET_REASSOC_MODE"},
+    {WMI_SET_WMM_CMDID, "SET_WMM"},
+    {WMI_SET_WMM_TXOP_CMDID, "SET_WMM_TXOP"},
+    {WMI_TEST_CMDID, "TEST"},
+    {WMI_SET_BT_STATUS_CMDID, "SET_BT_STATUS"},
+    {WMI_SET_BT_PARAMS_CMDID, "SET_BT_PARAMS"},
+    {WMI_SET_KEEPALIVE_CMDID, "SET_KEEPALIVE"},
+    {WMI_GET_KEEPALIVE_CMDID, "GET_KEEPALIVE"},
+    {WMI_SET_APPIE_CMDID, "SET_APPIE"},
+    {WMI_GET_APPIE_CMDID, "GET_APPIE"},
+    {WMI_SET_WSC_STATUS_CMDID, "SET_WSC_STATUS"},
+    {WMI_SET_HOST_SLEEP_MODE_CMDID, "SET_HOST_SLEEP_MODE"},
+    {WMI_SET_WOW_MODE_CMDID, "SET_WOW_MODE"},
+    {WMI_GET_WOW_LIST_CMDID, "GET_WOW_LIST"},
+    {WMI_ADD_WOW_PATTERN_CMDID, "ADD_WOW_PATTERN"},
+    {WMI_DEL_WOW_PATTERN_CMDID, "DEL_WOW_PATTERN"},
+    {WMI_SET_FRAMERATES_CMDID, "SET_FRAMERATES"},
+    {WMI_SET_AP_PS_CMDID, "SET_AP_PS"},
+    {WMI_SET_QOS_SUPP_CMDID, "SET_QOS_SUPP"},
+    {WMI_THIN_RESERVED_START, "THIN_RESERVED_START"},
+    {WMI_THIN_RESERVED_END, "THIN_RESERVED_END"},
+    {WMI_SET_BITRATE_CMDID, "SET_BITRATE"},
+    {WMI_GET_BITRATE_CMDID, "GET_BITRATE"},
+    {WMI_SET_WHALPARAM_CMDID, "SET_WHALPARAM"},
+    {WMI_SET_MAC_ADDRESS_CMDID, "SET_MAC_ADDRESS"},
+    {WMI_SET_AKMP_PARAMS_CMDID, "SET_AKMP_PARAMS"},
+    {WMI_SET_PMKID_LIST_CMDID, "SET_PMKID_LIST"},
+    {WMI_GET_PMKID_LIST_CMDID, "GET_PMKID_LIST"},
+    {WMI_ABORT_SCAN_CMDID, "ABORT_SCAN"},
+    {WMI_SET_TARGET_EVENT_REPORT_CMDID, "SET_TARGET_EVENT_REPORT"},
+    {WMI_UNUSED1, "UNUSED1"},
+    {WMI_UNUSED2, "UNUSED2"},
+    {WMI_AP_HIDDEN_SSID_CMDID, "AP_HIDDEN_SSID"},
+    {WMI_AP_SET_NUM_STA_CMDID, "AP_SET_NUM_STA"},
+    {WMI_AP_ACL_POLICY_CMDID, "AP_ACL_POLICY"},
+    {WMI_AP_ACL_MAC_LIST_CMDID, "AP_ACL_MAC_LIST"},
+    {WMI_AP_CONFIG_COMMIT_CMDID, "AP_CONFIG_COMMIT"},
+    {WMI_AP_SET_MLME_CMDID, "AP_SET_MLME"},
+    {WMI_AP_SET_PVB_CMDID, "AP_SET_PVB"},
+    {WMI_AP_CONN_INACT_CMDID, "AP_CONN_INACT"},
+    {WMI_AP_PROT_SCAN_TIME_CMDID, "AP_PROT_SCAN_TIME"},
+    {WMI_AP_SET_COUNTRY_CMDID, "AP_SET_COUNTRY"},
+    {WMI_AP_SET_DTIM_CMDID, "AP_SET_DTIM"},
+    {WMI_AP_MODE_STAT_CMDID, "AP_MODE_STAT"},
+    {WMI_SET_IP_CMDID, "SET_IP"},
+    {WMI_SET_PARAMS_CMDID, "SET_PARAMS"},
+    {WMI_SET_MCAST_FILTER_CMDID, "SET_MCAST_FILTER"},
+    {WMI_DEL_MCAST_FILTER_CMDID, "DEL_MCAST_FILTER"},
+    {WMI_ALLOW_AGGR_CMDID, "ALLOW_AGGR"},
+    {WMI_ADDBA_REQ_CMDID, "ADDBA_REQ"},
+    {WMI_DELBA_REQ_CMDID, "DELBA_REQ"},
+    {WMI_SET_HT_CAP_CMDID, "SET_HT_CAP"},
+    {WMI_SET_HT_OP_CMDID, "SET_HT_OP"},
+    {WMI_SET_TX_SELECT_RATES_CMDID, "SET_TX_SELECT_RATES"},
+    {WMI_SET_TX_SGI_PARAM_CMDID, "SET_TX_SGI_PARAM"},
+    {WMI_SET_RATE_POLICY_CMDID, "SET_RATE_POLICY"},
+    {WMI_HCI_CMD_CMDID, "HCI_CMD"},
+    {WMI_RX_FRAME_FORMAT_CMDID, "RX_FRAME_FORMAT"},
+    {WMI_SET_THIN_MODE_CMDID, "SET_THIN_MODE"},
+    {WMI_SET_BT_WLAN_CONN_PRECEDENCE_CMDID, "SET_BT_WLAN_CONN_PRECEDENCE"},
+    {WMI_AP_SET_11BG_RATESET_CMDID, "AP_SET_11BG_RATESET"},
+    {WMI_SET_PMK_CMDID, "SET_PMK"},
+    {WMI_MCAST_FILTER_CMDID, "MCAST_FILTER"},
+    {WMI_SET_BTCOEX_FE_ANT_CMDID, "SET_BTCOEX_FE_ANT"},
+    {WMI_SET_BTCOEX_COLOCATED_BT_DEV_CMDID, "SET_BTCOEX_COLOCATED_BT_DEV"},
+    {WMI_SET_BTCOEX_SCO_CONFIG_CMDID, "SET_BTCOEX_SCO_CONFIG"},
+    {WMI_SET_BTCOEX_A2DP_CONFIG_CMDID, "SET_BTCOEX_A2DP_CONFIG"},
+    {WMI_SET_BTCOEX_ACLCOEX_CONFIG_CMDID, "SET_BTCOEX_ACLCOEX_CONFIG"},
+    {WMI_SET_BTCOEX_BTINQUIRY_PAGE_CONFIG_CMDID, "SET_BTCOEX_BTINQUIRY_PAGE_CONFIG"},
+    {WMI_SET_BTCOEX_DEBUG_CMDID, "SET_BTCOEX_DEBUG"},
+    {WMI_SET_BTCOEX_BT_OPERATING_STATUS_CMDID, "SET_BTCOEX_BT_OPERATING_STATUS"},
+    {WMI_GET_BTCOEX_STATS_CMDID, "GET_BTCOEX_STATS"},
+    {WMI_GET_BTCOEX_CONFIG_CMDID, "GET_BTCOEX_CONFIG"},
+    {WMI_SET_DFS_ENABLE_CMDID, "SET_DFS_ENABLE"},
+    {WMI_SET_DFS_MINRSSITHRESH_CMDID, "SET_DFS_MINRSSITHRESH"},
+    {WMI_SET_DFS_MAXPULSEDUR_CMDID, "SET_DFS_MAXPULSEDUR"},
+    {WMI_DFS_RADAR_DETECTED_CMDID, "DFS_RADAR_DETECTED"},
+    {WMI_P2P_SET_CONFIG_CMDID, "P2P_SET_CONFIG"},
+    {WMI_WPS_SET_CONFIG_CMDID, "WPS_SET_CONFIG"},
+    {WMI_SET_REQ_DEV_ATTR_CMDID, "SET_REQ_DEV_ATTR"},
+    {WMI_P2P_FIND_CMDID, "P2P_FIND"},
+    {WMI_P2P_STOP_FIND_CMDID, "P2P_STOP_FIND"},
+    {WMI_P2P_GO_NEG_START_CMDID, "P2P_GO_NEG_START"},
+    {WMI_P2P_LISTEN_CMDID, "P2P_LISTEN"},
+    {WMI_CONFIG_TX_MAC_RULES_CMDID, "CONFIG_TX_MAC_RULES"},
+    {WMI_SET_PROMISCUOUS_MODE_CMDID, "SET_PROMISCUOUS_MODE"},
+    {WMI_RX_FRAME_FILTER_CMDID, "RX_FRAME_FILTER"},
+    {WMI_SET_CHANNEL_CMDID, "SET_CHANNEL"},
+    {WMI_ENABLE_WAC_CMDID, "ENABLE_WAC"},
+    {WMI_WAC_SCAN_REPLY_CMDID, "WAC_SCAN_REPLY"},
+    {WMI_WAC_CTRL_REQ_CMDID, "WAC_CTRL_REQ"},
+    {WMI_SET_DIV_PARAMS_CMDID, "SET_DIV_PARAMS"},
+    {WMI_GET_PMK_CMDID, "GET_PMK"},
+    {WMI_SET_PASSPHRASE_CMDID, "SET_PASSPHRASE"},
+    {WMI_SEND_ASSOC_RES_CMDID, "SEND_ASSOC_RES"},
+    {WMI_SET_ASSOC_REQ_RELAY_CMDID, "SET_ASSOC_REQ_RELAY"},
+    {WMI_GET_RFKILL_MODE_CMDID, "GET_RFKILL_MODE"},
+    {WMI_SET_RFKILL_MODE_CMDID, "SET_RFKILL_MODE"},
+    {WMI_ACS_CTRL_CMDID, "ACS_CTRL"},
+    {WMI_STORERECALL_CONFIGURE_CMDID, "STORERECALL_CONFIGURE"},
+    {WMI_STORERECALL_RECALL_CMDID, "STORERECALL_RECALL"},
+    {WMI_STORERECALL_HOST_READY_CMDID, "STORERECALL_HOST_READY"},
+    {WMI_FORCE_TARGET_ASSERT_CMDID, "FORCE_TARGET_ASSERT"},
+    {WMI_SET_EXCESS_TX_RETRY_THRES_CMDID, "SET_EXCESS_TX_RETRY_THRES"},
+    {WMI_P2P_GO_NEG_REQ_RSP_CMDID, "P2P_GO_NEG_REQ_RSP"},
+    {WMI_P2P_GRP_INIT_CMDID, "P2P_GRP_INIT"},
+    {WMI_P2P_GRP_FORMATION_DONE_CMDID, "P2P_GRP_FORMATION_DONE"},
+    {WMI_P2P_INVITE_CMDID, "P2P_INVITE"},
+    {WMI_P2P_INVITE_REQ_RSP_CMDID, "P2P_INVITE_REQ_RSP"},
+    {WMI_P2P_PROV_DISC_REQ_CMDID, "P2P_PROV_DISC_REQ"},
+    {WMI_P2P_SET_CMDID, "P2P_SET"},
+    {WMI_AP_SET_APSD_CMDID, "AP_SET_APSD"},
+    {WMI_AP_APSD_BUFFERED_TRAFFIC_CMDID, "AP_APSD_BUFFERED_TRAFFIC"},
+    {WMI_P2P_SDPD_TX_CMDID, "P2P_SDPD_TX"},
+    {WMI_P2P_STOP_SDPD_CMDID, "P2P_STOP_SDPD"},
+    {WMI_P2P_CANCEL_CMDID, "P2P_CANCEL_CMDID"},
+};
+
+static struct dbg_id_str_entry dbg_wmi_event_str[] = {
+    {WMI_GET_CHANNEL_LIST_CMDID, "GET_CHANNEL_LIST"},
+    {WMI_READY_EVENTID, "READY"},
+    {WMI_CONNECT_EVENTID, "CONNECT"},
+    {WMI_DISCONNECT_EVENTID, "DISCONNECT"},
+    {WMI_BSSINFO_EVENTID, "BSSINFO"},
+    {WMI_CMDERROR_EVENTID, "CMDERROR"},
+    {WMI_REGDOMAIN_EVENTID, "REGDOMAIN"},
+    {WMI_PSTREAM_TIMEOUT_EVENTID, "PSTREAM_TIMEOUT"},
+    {WMI_NEIGHBOR_REPORT_EVENTID, "NEIGHBOR_REPORT"},
+    {WMI_TKIP_MICERR_EVENTID, "TKIP_MICERR"},
+    {WMI_SCAN_COMPLETE_EVENTID, "SCAN_COMPLETE"},
+    {WMI_REPORT_STATISTICS_EVENTID, "REPORT_STATISTICS"},
+    {WMI_RSSI_THRESHOLD_EVENTID, "RSSI_THRESHOLD"},
+    {WMI_ERROR_REPORT_EVENTID, "ERROR_REPORT"},
+    {WMI_OPT_RX_FRAME_EVENTID, "OPT_RX_FRAME"},
+    {WMI_REPORT_ROAM_TBL_EVENTID, "REPORT_ROAM_TBL"},
+    {WMI_EXTENSION_EVENTID, "EXTENSION"},
+    {WMI_CAC_EVENTID, "CAC"},
+    {WMI_SNR_THRESHOLD_EVENTID, "SNR_THRESHOLD"},
+    {WMI_LQ_THRESHOLD_EVENTID, "LQ_THRESHOLD"},
+    {WMI_TX_RETRY_ERR_EVENTID, "TX_RETRY_ROAM_DATA"},
+    {WMI_REPORT_ROAM_DATA_EVENTID, "REPORT_ROAM_DATA"},
+    {WMI_TEST_EVENTID, "TEST"},
+    {WMI_APLIST_EVENTID, "APLIST"},
+    {WMI_GET_WOW_LIST_EVENTID, "GET_WOR_LIST"},
+    {WMI_GET_PMKID_LIST_EVENTID, "GET_PMKID_LIST"},
+    {WMI_CHANNEL_CHANGE_EVENTID, "CHANNEL_CHANGE"},
+    {WMI_PEER_NODE_EVENTID, "PEER_NODE"},
+    {WMI_PSPOLL_EVENTID, "PSPOLL"},
+    {WMI_DTIMEXPIRY_EVENTID, "DTIMEXPIRY"},
+    {WMI_WLAN_VERSION_EVENTID, "WLAN_VERSION"},
+    {WMI_SET_PARAMS_REPLY_EVENTID, "SET_PARAMS_REPLY"},
+    {WMI_ADDBA_REQ_EVENTID, "ADDBA_REQ"},
+    {WMI_ADDBA_RESP_EVENTID, "ADDBA_RESP"},
+    {WMI_DELBA_REQ_EVENTID, "DELBA_REQ"},
+    {WMI_TX_COMPLETE_EVENTID, "TX_COMPLETE"},
+    {WMI_HCI_EVENT_EVENTID, "HCI_EVENT"},
+    {WMI_ACL_DATA_EVENTID, "ACL_DATA"},
+    {WMI_REPORT_SLEEP_STATE_EVENTID, "REPORT_SLEEP_STATE"},
+    {WMI_WAPI_REKEY_EVENTID, "WAPI_REKEY"},
+    {WMI_REPORT_BTCOEX_STATS_EVENTID, "REPORT_BTCOEX_STATS"},
+    {WMI_REPORT_BTCOEX_CONFIG_EVENTID, "REPORT_BTCOEX_CONFIG"},
+    {WMI_GET_PMK_EVENTID, "GET_PMK"},
+    {WMI_DFS_HOST_ATTACH_EVENTID, "DFS_HOST_ATTACH"},
+    {WMI_DFS_HOST_INIT_EVENTID, "DFS_HOST_INIT"},
+    {WMI_DFS_RESET_DELAYLINES_EVENTID, "DFS_RESET_DELAYLINES"},
+    {WMI_DFS_RESET_RADARQ_EVENTID, "DFS_RESET_RADARQ"},
+    {WMI_DFS_RESET_AR_EVENTID, "DFS_RESET_AR"},
+    {WMI_DFS_RESET_ARQ_EVENTID, "DFS_RESET_ARQ"},
+    {WMI_DFS_SET_DUR_MULTIPLIER_EVENTID, "DFS_SET_DUR_MULTIPLIER"},
+    {WMI_DFS_SET_BANGRADAR_EVENTID, "DFS_SET_BANGRADAR"},
+    {WMI_DFS_SET_DEBUGLEVEL_EVENTID, "DFS_SET_DEBUGLEVEL"},
+    {WMI_DFS_PHYERR_EVENTID, "DFS_PHYERR"},
+    {WMI_CCX_RM_STATUS_EVENTID, "CCX_RM_STATUS"},
+    {WMI_P2P_GO_NEG_RESULT_EVENTID, "P2P_GO_NEG_RESULT"},
+    {WMI_WAC_SCAN_DONE_EVENTID, "WAC_SCAN_DONE"},
+    {WMI_WAC_REPORT_BSS_EVENTID, "WAC_REPORT_BSS"},
+    {WMI_WAC_START_WPS_EVENTID, "WAC_START_WPS"},
+    {WMI_WAC_CTRL_REQ_REPLY_EVENTID, "WAC_CTRL_REQ_REPLY"},
+    {WMI_RFKILL_STATE_CHANGE_EVENTID, "RFKILL_STATE_CHANGE"},
+    {WMI_RFKILL_GET_MODE_CMD_EVENTID, "RFKILL_GET_MODE_CMD"},
+    {WMI_P2P_GO_NEG_REQ_EVENTID, "P2P_GO_NEG_REQ"},
+    {WMI_P2P_INVITE_REQ_EVENTID, "P2P_INVITE_REQ"},
+    {WMI_P2P_INVITE_RCVD_RESULT_EVENTID, "P2P_INVITE_RCVD_RESULT"},
+    {WMI_P2P_INVITE_SENT_RESULT_EVENTID, "P2P_INVITE_SENT_RESULT"},
+    {WMI_P2P_PROV_DISC_RESP_EVENTID, "P2P_PROV_DISC_RESP"},
+    {WMI_P2P_PROV_DISC_REQ_EVENTID, "P2P_PROV_DISC_REQ"},
+    {WMI_P2P_START_SDPD_EVENTID, "P2P_START_SDPD"},
+    {WMI_P2P_SDPD_RX_EVENTID, "P2P_SDPD_RX"},
+    {WMI_THIN_RESERVED_START_EVENTID, "THIN_RESERVED_START"},
+    {WMI_THIN_RESERVED_END_EVENTID, "THIN_RESERVED_END"},
+    {WMI_SET_CHANNEL_EVENTID, "SET_CHANNEL"},
+    {WMI_ASSOC_REQ_EVENTID, "ASSOC_REQ"},
+    {WMI_ACS_EVENTID, "ACS"},
+    {WMI_REPORT_WMM_PARAMS_EVENTID, "REPORT_WMM_PARAMS"},
+    {WMI_STORERECALL_STORE_EVENTID, "STORERECALL_STORE"},
+};
+
+#endif /* _DBG_CMD_EVT_H_ */
+
diff --git a/libtcmd/Android.mk b/libtcmd/Android.mk
new file mode 100755
index 0000000..d89c1ab
--- /dev/null
+++ b/libtcmd/Android.mk
@@ -0,0 +1,33 @@
+LOCAL_PATH:=$(call my-dir)
+
+# Build libtcmd =========================
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := libtcmd
+LOCAL_SRC_FILES:= \
+    nl80211.c \
+    libtcmd.c \
+    os.c
+
+LOCAL_CFLAGS += -include bionic/libc/kernel/arch-arm/asm/posix_types.h
+LOCAL_CFLAGS += -include bionic/libc/kernel/arch-arm/asm/byteorder.h
+LOCAL_CFLAGS += -include bionic/libc/kernel/common/linux/posix_types.h
+LOCAL_CFLAGS += -include bionic/libc/kernel/common/linux/types.h
+LOCAL_CFLAGS += -include bionic/libc/kernel/common/linux/socket.h
+LOCAL_CFLAGS += -include bionic/libc/kernel/common/linux/in.h
+
+LOCAL_C_INCLUDES += external/libnl-headers
+LOCAL_C_INCLUDES += $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr/include
+LOCAL_ADDITIONAL_DEPENDENCIES := $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr
+
+LOCAL_COPY_HEADERS_TO := libtcmd
+LOCAL_COPY_HEADERS := libtcmd.h
+
+LOCAL_CFLAGS += \
+	-DWLAN_API_NL80211 \
+	-DANDROID \
+	-DLIBNL_2 \
+
+# ICS ships with libnl 2.0
+LOCAL_SHARED_LIBRARIES := libnl_2
+include $(BUILD_STATIC_LIBRARY)
diff --git a/libtcmd/Makefile b/libtcmd/Makefile
new file mode 100644
index 0000000..3b441b1
--- /dev/null
+++ b/libtcmd/Makefile
@@ -0,0 +1,21 @@
+CC = gcc
+CFLAGS = -Wall -g
+
+NLLIBNAME = libnl-1
+WLAN_API = WLAN_API_NL80211
+WLAN_API_SRCS = nl80211.c
+
+SRCS = os.c $(WLAN_API_SRCS) libtcmd.c
+OBJS = $(SRCS:.c=.o)
+
+override LDLIBS += $(shell pkg-config --libs $(NLLIBNAME)) -lrt
+override CFLAGS += $(shell pkg-config --cflags $(NLLIBNAME)) -D$(WLAN_API)
+
+libtcmd.a: $(SRCS) $(OBJS)
+	$(AR) rcs $@ $(OBJS)
+
+$(OBJS): $(SRCS)
+	$(CC) $(CFLAGS) -c $(@:.o=.c) -o $@ $(LDLIBS)
+
+clean:
+	rm -f *.a *.o
diff --git a/libtcmd/libtcmd.c b/libtcmd/libtcmd.c
new file mode 100644
index 0000000..4601456
--- /dev/null
+++ b/libtcmd/libtcmd.c
@@ -0,0 +1,86 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include "string.h"
+#include "libtcmd.h"
+#include "os.h"
+
+int tcmd_tx(void *buf, int len, bool resp)
+{
+	int err = 0;
+
+	/* XXX: just call nl80211 directly for now */
+#ifdef WLAN_API_NL80211
+	if ((err = nl80211_tcmd_tx(&tcmd_cfg, buf, len)))
+		goto err_out;
+#endif
+	if (resp)
+#ifdef WLAN_API_NL80211
+		err = nl80211_tcmd_rx(&tcmd_cfg);
+#endif
+
+	return err;
+err_out:
+	A_DBG("tcmd_tx failed: %s\n", strerror(-err));
+	return err;
+}
+
+static void tcmd_expire(union sigval sig)
+{
+	/* tcmd expired, do something */
+	A_DBG("timer expired\n");
+	tcmd_cfg.timeout = true;
+}
+
+/* get driver ep from tcmd ep */
+static int tcmd_set_ep(uint32_t *driv_ep, enum tcmd_ep ep)
+{
+#ifdef WLAN_API_NL80211
+	return nl80211_set_ep(driv_ep, ep);
+#endif
+}
+int tcmd_init(char *iface, void (*rx_cb)(void *buf, int len), ...)
+{
+	int err;
+	enum tcmd_ep ep;
+	va_list ap;
+	va_start(ap, rx_cb);
+	ep = va_arg(ap, enum tcmd_ep);
+	va_end(ap);
+
+	strcpy(tcmd_cfg.iface, iface);
+	tcmd_cfg.rx_cb = rx_cb;
+	if ((err = tcmd_set_ep(&tcmd_cfg.ep, ep)))
+		return err;
+
+	tcmd_cfg.sev.sigev_notify = SIGEV_THREAD;
+	tcmd_cfg.sev.sigev_notify_function = tcmd_expire;
+	timer_create(CLOCK_REALTIME, &tcmd_cfg.sev, &tcmd_cfg.timer);
+
+#ifdef WLAN_API_NL80211
+	if ((err = nl80211_init(&tcmd_cfg))) {
+                A_DBG("couldn't init nl80211!: %s\n", strerror(-err));
+		return err;
+	}
+#endif
+
+	return 0;
+}
+
+int tcmd_tx_init(char *iface, void (*rx_cb)(void *buf, int len))
+{
+	return tcmd_init(iface, rx_cb, TCMD_EP_TCMD);
+}
diff --git a/libtcmd/libtcmd.h b/libtcmd/libtcmd.h
new file mode 100644
index 0000000..353f25b
--- /dev/null
+++ b/libtcmd/libtcmd.h
@@ -0,0 +1,78 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef _LIBTCMD_H_
+#define _LIBTCMD_H_
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <net/if.h>
+#include <signal.h>
+#include <time.h>
+#include <stdarg.h>
+
+#define A_ERR(ret, args...) printf(args); exit(ret);
+#define A_DBG(args...) fprintf(stderr, args);
+
+#define TCMD_TIMEOUT 2	/* s */
+
+enum tcmd_ep {
+	TCMD_EP_TCMD,
+	TCMD_EP_WMI,
+};
+
+struct tcmd_cfg {
+	char iface[100];
+	void (*rx_cb)(void *buf, int len);
+	uint32_t ep;
+#ifdef WLAN_API_NL80211
+/* XXX: eventually default to libnl-2.0 API */
+#ifdef LIBNL_2
+#define nl_handle nl_sock
+#endif
+	struct nl_handle *nl_handle;
+	int nl_id;
+#endif
+	struct sigevent sev;
+	timer_t timer;
+	bool timeout;
+} tcmd_cfg;
+
+/* WLAN API */
+#ifdef WLAN_API_NL80211
+#include "nl80211_drv.h"
+#endif
+
+/* send tcmd in buffer buf of length len. resp == true if a response by the FW
+ * is required.  Returns: 0 on success, -ETIMEOUT on timeout
+ */
+int tcmd_tx(void *buf, int len, bool resp);
+
+/* Initialize tcmd transport layer on given iface. Call given rx_cb on tcmd
+ * response */
+int tcmd_tx_init(char *iface, void (*rx_cb)(void *buf, int len));
+/* same as above, but takes optional testmode endpoint (e.g. WMI vs. TCMD) */
+int tcmd_init(char *iface, void (*rx_cb)(void *buf, int len), ...);
+#endif /* _LIBTCMD_H_ */
diff --git a/libtcmd/nl80211.c b/libtcmd/nl80211.c
new file mode 100644
index 0000000..ec44a68
--- /dev/null
+++ b/libtcmd/nl80211.c
@@ -0,0 +1,416 @@
+/*
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc. All Rights Reserved.
+ * Qualcomm Atheros Proprietary and Confidential.
+ */
+
+#include "libtcmd.h"
+#include "os.h"
+
+int cb_ret;
+
+#ifdef LIBNL_2
+static inline struct nl_sock *nl_handle_alloc(void)
+{
+	return nl_socket_alloc();
+}
+
+static inline void nl_handle_destroy(struct nl_handle *h)
+{
+	nl_socket_free(h);
+}
+
+#define nl_disable_sequence_check nl_socket_disable_seq_check
+#endif
+
+/* copied from ath6kl */
+enum ar6k_testmode_attr {
+	__AR6K_TM_ATTR_INVALID	= 0,
+	AR6K_TM_ATTR_CMD	= 1,
+	AR6K_TM_ATTR_DATA	= 2,
+	AR6K_TM_ATTR_STREAM_ID	= 3,
+
+	/* keep last */
+	__AR6K_TM_ATTR_AFTER_LAST,
+	AR6K_TM_ATTR_MAX	= __AR6K_TM_ATTR_AFTER_LAST - 1
+};
+
+enum ar6k_testmode_cmd {
+	AR6K_TM_CMD_TCMD		= 0,
+	AR6K_TM_CMD_WMI_CMD		= 0xF000,
+};
+
+int nl80211_rx_cb(struct nl_msg *msg, void *arg);
+
+static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
+			 void *arg)
+{
+	int *ret = arg;
+	*ret = err->error;
+	return NL_STOP;
+}
+
+static int finish_handler(struct nl_msg *msg, void *arg)
+{
+	int *ret = arg;
+	*ret = 0;
+	return NL_SKIP;
+}
+
+static int ack_handler(struct nl_msg *msg, void *arg)
+{
+	int *ret = arg;
+	*ret = 0;
+	return NL_STOP;
+}
+
+#ifdef ANDROID
+#include "netlink-types.h"
+/* android's libnl_2 does not include this, define it here */
+static int android_genl_ctrl_resolve(struct nl_handle *handle,
+				     const char *name)
+{
+	/*
+	 * Android ICS has very minimal genl_ctrl_resolve() implementation, so
+	 * need to work around that.
+	 */
+	struct nl_cache *cache = NULL;
+	struct genl_family *nl80211 = NULL;
+	int id = -1;
+
+	if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
+		A_DBG("nl80211: Failed to allocate generic "
+				"netlink cache");
+		goto fail;
+	}
+
+	nl80211 = genl_ctrl_search_by_name(cache, name);
+	if (nl80211 == NULL)
+		goto fail;
+
+	id = genl_family_get_id(nl80211);
+
+fail:
+	if (nl80211)
+		genl_family_put(nl80211);
+	if (cache)
+		nl_cache_free(cache);
+
+	return id;
+}
+#define genl_ctrl_resolve android_genl_ctrl_resolve
+
+#define nl_socket_get_cb nl_sk_get_cb
+struct nl_cb *nl_socket_get_cb(const struct nl_sock *sk)
+{
+	return nl_cb_get(sk->s_cb);
+}
+
+#define nl_socket_enable_msg_peek nl_sk_enable_msg_peek
+void nl_socket_enable_msg_peek(struct nl_sock *sk)
+{
+	sk->s_flags |= NL_MSG_PEEK;
+}
+
+#define nl_socket_set_nonblocking nl_sk_set_nb
+int nl_socket_set_nonblocking(const struct nl_sock *sk)
+{
+	fcntl(sk->s_fd, F_SETFL, O_NONBLOCK);
+	return 0;
+}
+
+static int seq_ok(struct nl_msg *msg, void *arg)
+{
+	return NL_OK;
+}
+
+#define nl_socket_disable_seq_check disable_seq_check
+static inline void disable_seq_check(struct nl_handle *handle)
+{
+	nl_cb_set(nl_socket_get_cb(handle), NL_CB_SEQ_CHECK,
+		  NL_CB_CUSTOM, seq_ok, NULL);
+}
+#endif
+
+struct handler_args {
+	const char *group;
+	int id;
+};
+
+static int family_handler(struct nl_msg *msg, void *arg)
+{
+	struct handler_args *grp = arg;
+	struct nlattr *tb[CTRL_ATTR_MAX + 1];
+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+	struct nlattr *mcgrp;
+	int rem_mcgrp;
+
+	nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+		  genlmsg_attrlen(gnlh, 0), NULL);
+
+	if (!tb[CTRL_ATTR_MCAST_GROUPS])
+		return NL_SKIP;
+
+	nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], rem_mcgrp) {
+		struct nlattr *tb_mcgrp[CTRL_ATTR_MCAST_GRP_MAX + 1];
+
+		nla_parse(tb_mcgrp, CTRL_ATTR_MCAST_GRP_MAX,
+			  nla_data(mcgrp), nla_len(mcgrp), NULL);
+
+		if (!tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME] ||
+		    !tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID])
+			continue;
+		if (strncmp(nla_data(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME]),
+			    grp->group, nla_len(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME])))
+			continue;
+		grp->id = nla_get_u32(tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID]);
+		break;
+	}
+
+	return NL_SKIP;
+}
+
+int nl_get_multicast_id(struct nl_handle *sock, const char *family, const char *group)
+{
+	struct nl_msg *msg;
+	struct nl_cb *cb;
+	int ret, ctrlid;
+	struct handler_args grp = {
+		.group = group,
+		.id = -ENOENT,
+	};
+
+	msg = nlmsg_alloc();
+	if (!msg)
+		return -ENOMEM;
+
+	cb = nl_cb_alloc(NL_CB_DEFAULT);
+	if (!cb) {
+		ret = -ENOMEM;
+		goto out_fail_cb;
+	}
+
+	ctrlid = genl_ctrl_resolve(sock, "nlctrl");
+
+#ifdef ANDROID
+	genlmsg_put(msg, NL_AUTO_PID, NL_AUTO_SEQ, GENL_ID_CTRL, 0, 0, CTRL_CMD_GETFAMILY, 1);
+#else
+	genlmsg_put(msg, 0, 0, ctrlid, 0, 0, CTRL_CMD_GETFAMILY, 0);
+#endif
+
+	ret = -ENOBUFS;
+	NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
+
+	ret = nl_send_auto_complete(sock, msg);
+	if (ret < 0)
+		goto out;
+
+	ret = 1;
+
+	nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &ret);
+	nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &ret);
+	nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &ret);
+	nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, family_handler, &grp);
+
+	while (ret > 0)
+		nl_recvmsgs(sock, cb);
+
+	if (ret == 0)
+		ret = grp.id;
+ nla_put_failure:
+ out:
+	nl_cb_put(cb);
+ out_fail_cb:
+	nlmsg_free(msg);
+	return ret;
+}
+
+int nl80211_set_ep(uint32_t *driv_ep, enum tcmd_ep ep)
+{
+	switch(ep) {
+	case TCMD_EP_TCMD:
+		*driv_ep = AR6K_TM_CMD_TCMD;
+	break;
+	case TCMD_EP_WMI:
+		*driv_ep = AR6K_TM_CMD_WMI_CMD;
+	break;
+	default:
+		fprintf(stderr, "nl80211: unknown ep!");
+		return -1;
+	}
+	return 0;
+}
+int nl80211_init(struct tcmd_cfg *cfg)
+{
+	struct nl_cb *cb;
+	int err;
+
+	cfg->nl_handle = nl_handle_alloc();
+	if (!cfg->nl_handle) {
+		A_DBG("Failed to allocate netlink socket.\n");
+		return -ENOMEM;
+	}
+
+	if (genl_connect(cfg->nl_handle)) {
+		A_DBG("Failed to connect to generic netlink.\n");
+		err = -ENOLINK;
+		goto out_handle_destroy;
+	}
+
+	cfg->nl_id = genl_ctrl_resolve(cfg->nl_handle, "nl80211");
+	if (cfg->nl_id < 0) {
+		A_DBG("nl80211 not found.\n");
+		err = -ENOENT;
+		goto out_handle_destroy;
+	}
+
+	/* replace this with genl_ctrl_resolve_grp() once we move to libnl3 */
+	err = nl_get_multicast_id(cfg->nl_handle, "nl80211", "testmode");
+	if (err >= 0) {
+		err = nl_socket_add_membership(cfg->nl_handle, err);
+		if (err) {
+			A_DBG("failed to join testmode group!\n");
+			goto out_handle_destroy;
+		}
+	}
+	else
+		goto out_handle_destroy;
+	/*
+	 * Enable peek mode so drivers can send large amounts
+	 * of data in blobs without problems.
+	 */
+	nl_socket_enable_msg_peek(cfg->nl_handle);
+
+	/*
+	 * disable sequence checking to handle events.
+	 */
+	nl_disable_sequence_check(cfg->nl_handle);
+
+	cb = nl_socket_get_cb(cfg->nl_handle);
+#ifdef ANDROID
+	/* libnl_2 does not provide default handlers */
+	nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &cb_ret);
+	nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &cb_ret);
+	nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &cb_ret);
+#endif
+	nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, nl80211_rx_cb, NULL);
+
+	/* so we can handle timeouts properly */
+	nl_socket_set_nonblocking(cfg->nl_handle);
+
+	return 0;
+
+ out_handle_destroy:
+	nl_handle_destroy(cfg->nl_handle);
+	return err;
+}
+
+int nl80211_tcmd_tx(struct tcmd_cfg *cfg, void *buf, int len)
+{
+	struct nl_msg *msg;
+	struct nlattr *nest;
+	int devidx, err = 0;
+
+	/* CHANGE HERE: you may need to allocate larger messages! */
+	msg = nlmsg_alloc();
+	if (!msg) {
+		A_DBG("failed to allocate netlink message\n");
+		return 2;
+	}
+
+	genlmsg_put(msg, 0, 0, cfg->nl_id, 0,
+		    0, NL80211_CMD_TESTMODE, 0);
+
+	devidx = if_nametoindex(cfg->iface);
+	if (devidx) {
+		NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, devidx);
+	} else {
+		A_DBG("Device not found\n");
+		err = -ENOENT;
+		goto out_free_msg;
+	}
+
+	nest = nla_nest_start(msg, NL80211_ATTR_TESTDATA);
+	if (!nest) {
+		A_DBG("failed to nest\n");
+		err = -1;
+		goto out_free_msg;
+	}
+
+	NLA_PUT_U32(msg, AR6K_TM_ATTR_CMD, cfg->ep);
+	NLA_PUT(msg, AR6K_TM_ATTR_DATA, len, buf);
+
+	nla_nest_end(msg, nest);
+
+	A_DBG("nl80211: sending message\n");
+	nl_send_auto_complete(cfg->nl_handle, msg);
+
+ out_free_msg:
+	nlmsg_free(msg);
+	return err;
+
+ nla_put_failure:
+	A_DBG("building message failed\n");
+	return 2;
+}
+
+int nl80211_tcmd_rx(struct tcmd_cfg *cfg)
+{
+	struct nl_cb *cb;
+	int err = 0;
+
+	cb = nl_socket_get_cb(cfg->nl_handle);
+	if (!cb) {
+		fprintf(stderr, "failed to allocate netlink callbacks\n");
+		err = 2;
+		goto out;
+	}
+
+	err = tcmd_set_timer(cfg);
+	if (err)
+		goto out;
+
+	A_DBG("nl80211: waiting for response\n");
+	while (!cfg->timeout)
+		nl_recvmsgs(cfg->nl_handle, cb);
+
+	return tcmd_reset_timer(cfg);
+out:
+	return err;
+}
+
+/* tcmd rx_cb wrapper to "unpack" the nl80211 msg and call the "real" cb */
+int nl80211_rx_cb(struct nl_msg *msg, void *arg)
+{
+	struct nlattr *tb[NL80211_ATTR_MAX + 1];
+	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+	struct nlattr *td[AR6K_TM_ATTR_MAX + 1];
+	void *buf;
+	int len;
+
+	A_DBG("nl80211: cb wrapper called\n");
+	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+		  genlmsg_attrlen(gnlh, 0), NULL);
+
+	if (!tb[NL80211_ATTR_TESTDATA] || !tb[NL80211_ATTR_WIPHY]) {
+		printf("no data!\n");
+		return NL_SKIP;
+	}
+
+	nla_parse(td, AR6K_TM_ATTR_MAX, nla_data(tb[NL80211_ATTR_TESTDATA]),
+		  nla_len(tb[NL80211_ATTR_TESTDATA]), NULL);
+
+	if (!td[AR6K_TM_ATTR_DATA]) {
+		printf("no data in reply\n");
+		return NL_SKIP;
+	}
+
+	buf = nla_data(td[AR6K_TM_ATTR_DATA]);
+	len = nla_len(td[AR6K_TM_ATTR_DATA]);
+
+	A_DBG("nl80211: resp received, calling custom cb\n");
+	tcmd_cfg.rx_cb(buf, len);
+	/* trip waiting thread */
+	tcmd_cfg.timeout = true;
+
+	return NL_SKIP;
+}
diff --git a/libtcmd/nl80211_drv.h b/libtcmd/nl80211_drv.h
new file mode 100644
index 0000000..773011d
--- /dev/null
+++ b/libtcmd/nl80211_drv.h
@@ -0,0 +1,34 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef _NL80211_DRV_H_
+#define _NL80211_DRV_H_
+
+#include <netlink/genl/genl.h>
+#include <netlink/genl/family.h>
+#include <netlink/genl/ctrl.h>
+#include <netlink/msg.h>
+#include <netlink/attr.h>
+#include <netlink/socket.h>
+
+#include <linux/nl80211.h>
+#include "libtcmd.h"
+
+int nl80211_init(struct tcmd_cfg *cfg);
+int nl80211_tcmd_tx(struct tcmd_cfg *cfg, void *buf, int len);
+int nl80211_tcmd_rx(struct tcmd_cfg *cfg);
+int nl80211_set_ep(uint32_t *driv_ep, enum tcmd_ep ep);
+#endif /* _NL80211_DRV_H_ */
diff --git a/libtcmd/os.c b/libtcmd/os.c
new file mode 100644
index 0000000..e52cfea
--- /dev/null
+++ b/libtcmd/os.c
@@ -0,0 +1,53 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include "libtcmd.h"
+#include  "os.h"
+
+int tcmd_set_timer(struct tcmd_cfg *cfg)
+{
+	struct itimerspec exp_time;
+	int err;
+
+	A_DBG("setting timer\n");
+	bzero(&exp_time, sizeof(exp_time));
+	exp_time.it_value.tv_sec = TCMD_TIMEOUT;
+	err = timer_settime(cfg->timer, 0, &exp_time, NULL);
+	cfg->timeout = false;
+	if (err < 0)
+		return errno;
+	return 0;
+}
+
+int tcmd_reset_timer(struct tcmd_cfg *cfg)
+{
+	struct itimerspec curr_time;
+	int err;
+
+	err = timer_gettime(cfg->timer, &curr_time);
+	if (err < 0)
+		return errno;
+
+	if (!curr_time.it_value.tv_sec && !curr_time.it_value.tv_nsec)
+		return -ETIMEDOUT;
+
+	A_DBG("resetting timer\n");
+	bzero(&curr_time, sizeof(curr_time));
+	err = timer_settime(cfg->timer, 0, &curr_time, NULL);
+	if (err < 0)
+		return errno;
+	return 0;
+}
diff --git a/libtcmd/os.h b/libtcmd/os.h
new file mode 100644
index 0000000..1b1c8dc
--- /dev/null
+++ b/libtcmd/os.h
@@ -0,0 +1,21 @@
+/*
+* Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+*
+* Permission to use, copy, modify, and/or distribute this software for any
+* purpose with or without fee is hereby granted, provided that the above
+* copyright notice and this permission notice appear in all copies.
+*
+* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+/* private, os-specific things go here */
+int tcmd_set_timer(struct tcmd_cfg *cfg);
+/* reset timer and return 0 if still running, return -ETIMEDOUT if the tcmd
+ * timer timed out */
+int tcmd_reset_timer(struct tcmd_cfg *cfg);