Merge branch 'jb-mr1-release' of https://android.googlesource.com/platform/hardware/broadcom/wlan into HEAD

44 files changed, 3192 insertions, 658 deletions

diff --git a/bcm4329/config/Android.mk b/bcm4329/config/Android.mk
index 6f96d82..60ee9ff 100644
--- a/bcm4329/config/Android.mk
+++ b/bcm4329/config/Android.mk
@@ -19,7 +19,6 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := dhcpcd.conf
-LOCAL_MODULE_TAGS := user
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/dhcpcd
 LOCAL_SRC_FILES := android_dhcpcd.conf
diff --git a/bcmdhd/bcmdhd_net_iface/Android.mk b/bcmdhd/bcmdhd_net_iface/Android.mk
new file mode 100644
index 0000000..be22624
--- /dev/null
+++ b/bcmdhd/bcmdhd_net_iface/Android.mk
@@ -0,0 +1,30 @@
+#
+# Copyright (C) 2012 Google, inc.
+#
+# $Id: Android.mk,v 2.6 2009-05-07 18:25:15 hharte Exp $
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+
+#
+# lib_net_iface_cmd
+#
+
+LOCAL_PATH := $(call my-dir)
+include $(CLEAR_VARS)
+LOCAL_SRC_FILES := bcmdhd_net_iface.c
+LOCAL_MODULE := libnetcmdiface
+LOCAL_CFLAGS := -mabi=aapcs-linux
+LOCAL_MODULE_TAGS := optional
+LOCAL_ALLOW_UNDEFINED_SYMBOLS := true
+include $(BUILD_SHARED_LIBRARY)
diff --git a/bcmdhd/bcmdhd_net_iface/bcmdhd_net_iface.c b/bcmdhd/bcmdhd_net_iface/bcmdhd_net_iface.c
new file mode 100644
index 0000000..b724fdb
--- /dev/null
+++ b/bcmdhd/bcmdhd_net_iface/bcmdhd_net_iface.c
@@ -0,0 +1,83 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <net/if.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <cutils/log.h>
+#include <netutils/ifc.h>
+#include <private/android_filesystem_config.h>
+
+#define INTERFACE_MAX_BUFFER_SIZE 4096
+
+typedef struct android_wifi_priv_cmd {
+	char *buf;
+	int used_len;
+	int total_len;
+} android_wifi_priv_cmd;
+
+static struct net_if_snd_cmd_state {
+	int sock;
+	char cmd[INTERFACE_MAX_BUFFER_SIZE];
+	char ibuf[INTERFACE_MAX_BUFFER_SIZE];
+} state;
+
+int net_iface_send_command_init(void) {
+	state.sock = socket(AF_INET, SOCK_DGRAM, 0);
+	if (state.sock < 0) {
+		return -ENOTCONN;
+	} else {
+		return 0;
+	}
+}
+
+/*
+ * Arguments:
+ *	  argv[2] - wlan interface
+ *	  argv[3] - command
+ *	  argv[4] - argument
+ */
+int net_iface_send_command(int argc, char *argv[], char **rbuf) {
+	int ret, i;
+	size_t bc = 0;
+	struct ifreq ifr;
+	android_wifi_priv_cmd priv_cmd;
+
+	if (argc < 3) {
+		return -EINVAL;
+	}
+	for (i = 3; i < argc; i++) {
+		bc += snprintf(&state.cmd[bc], sizeof(state.cmd) - bc, "%s ", argv[i]);
+		if (bc >= sizeof(state.cmd)) {
+			return -ENOBUFS;
+		}
+	}
+	state.cmd[bc] = '\0';
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, argv[2], IFNAMSIZ);
+	strncpy(state.ibuf, state.cmd, INTERFACE_MAX_BUFFER_SIZE);
+
+	priv_cmd.buf = state.ibuf;
+	priv_cmd.used_len = INTERFACE_MAX_BUFFER_SIZE;
+	priv_cmd.total_len = INTERFACE_MAX_BUFFER_SIZE;
+
+	ifr.ifr_data = &priv_cmd;
+
+	if ((ret = ioctl(state.sock, SIOCDEVPRIVATE + 1, &ifr)) < 0) {
+		return ret;
+	}
+
+	if (rbuf)
+		*rbuf = state.ibuf;
+	else
+		ret = -EFAULT;
+
+	return ret;
+}
diff --git a/bcmdhd/config/Android.mk b/bcmdhd/config/Android.mk
index 7e898dd..b125897 100644
--- a/bcmdhd/config/Android.mk
+++ b/bcmdhd/config/Android.mk
@@ -19,7 +19,6 @@ LOCAL_PATH := $(call my-dir)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := dhcpcd.conf
-LOCAL_MODULE_TAGS := user
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/dhcpcd
 LOCAL_SRC_FILES := android_dhcpcd.conf
diff --git a/bcmdhd/config/android_dhcpcd.conf b/bcmdhd/config/android_dhcpcd.conf
index 54006c7..e6b4414 100644
--- a/bcmdhd/config/android_dhcpcd.conf
+++ b/bcmdhd/config/android_dhcpcd.conf
@@ -1,6 +1,9 @@
 # dhcpcd configuration for Android Wi-Fi interface
 # See dhcpcd.conf(5) for details.
 
+# Disable solicitation of IPv6 Router Advertisements
+noipv6rs
+
 interface wlan0
 # dhcpcd-run-hooks uses these options.
 option subnet_mask, routers, domain_name_servers
diff --git a/bcmdhd/dhdutil/bcmutils.c b/bcmdhd/dhdutil/bcmutils.c
index 65ca89d..7ecea8e 100644
--- a/bcmdhd/dhdutil/bcmutils.c
+++ b/bcmdhd/dhdutil/bcmutils.c
@@ -1,8 +1,8 @@
 /*
  * Driver O/S-independent utility routines
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,18 +15,17 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmutils.c,v 1.277.2.18 2011-01-26 02:32:08 Exp $
+ * $Id: bcmutils.c 312855 2012-02-04 02:01:18Z $
  */
 
+#include <bcm_cfg.h>
 #include <typedefs.h>
 #include <bcmdefs.h>
 #include <stdarg.h>
-
 #ifdef BCMDRIVER
 
 #include <osl.h>
 #include <bcmutils.h>
-#include <siutils.h>
 
 #else /* !BCMDRIVER */
 
@@ -48,9 +47,9 @@
 #include <proto/bcmip.h>
 #include <proto/802.1d.h>
 #include <proto/802.11.h>
-
 void *_bcmutils_dummy_fn = NULL;
 
+
 #ifdef BCMDRIVER
 
 
@@ -62,7 +61,7 @@ pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf)
 	uint n, ret = 0;
 
 	if (len < 0)
-		len = 4096; /* "infinite" */
+		len = 4096;	/* "infinite" */
 
 	/* skip 'offset' bytes */
 	for (; p && offset; p = PKTNEXT(osh, p)) {
@@ -123,10 +122,14 @@ uint BCMFASTPATH
 pkttotlen(osl_t *osh, void *p)
 {
 	uint total;
+	int len;
 
 	total = 0;
-	for (; p; p = PKTNEXT(osh, p))
-		total += PKTLEN(osh, p);
+	for (; p; p = PKTNEXT(osh, p)) {
+		len = PKTLEN(osh, p);
+		total += len;
+	}
+
 	return (total);
 }
 
@@ -153,6 +156,56 @@ pktsegcnt(osl_t *osh, void *p)
 }
 
 
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt_war(osl_t *osh, void *p)
+{
+	uint cnt;
+	uint8 *pktdata;
+	uint len, remain, align64;
+
+	for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+		cnt++;
+		len = PKTLEN(osh, p);
+		if (len > 128) {
+			pktdata = (uint8 *)PKTDATA(osh, p);	/* starting address of data */
+			/* Check for page boundary straddle (2048B) */
+			if (((uintptr)pktdata & ~0x7ff) != ((uintptr)(pktdata+len) & ~0x7ff))
+				cnt++;
+
+			align64 = (uint)((uintptr)pktdata & 0x3f);	/* aligned to 64B */
+			align64 = (64 - align64) & 0x3f;
+			len -= align64;		/* bytes from aligned 64B to end */
+			/* if aligned to 128B, check for MOD 128 between 1 to 4B */
+			remain = len % 128;
+			if (remain > 0 && remain <= 4)
+				cnt++;		/* add extra seg */
+		}
+	}
+
+	return cnt;
+}
+
+uint8 * BCMFASTPATH
+pktoffset(osl_t *osh, void *p,  uint offset)
+{
+	uint total = pkttotlen(osh, p);
+	uint pkt_off = 0, len = 0;
+	uint8 *pdata = (uint8 *) PKTDATA(osh, p);
+
+	if (offset > total)
+		return NULL;
+
+	for (; p; p = PKTNEXT(osh, p)) {
+		pdata = (uint8 *) PKTDATA(osh, p);
+		pkt_off = offset - len;
+		len += PKTLEN(osh, p);
+		if (len > offset)
+			break;
+	}
+	return (uint8*) (pdata+pkt_off);
+}
+
 /*
  * osl multiple-precedence packet queue
  * hi_prec is always >= the number of the highest non-empty precedence
@@ -240,6 +293,32 @@ pktq_pdeq(struct pktq *pq, int prec)
 }
 
 void * BCMFASTPATH
+pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p)
+{
+	struct pktq_prec *q;
+	void *p;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+
+	if (prev_p == NULL)
+		return NULL;
+
+	if ((p = PKTLINK(prev_p)) == NULL)
+		return NULL;
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(prev_p, PKTLINK(p));
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
 pktq_pdeq_tail(struct pktq *pq, int prec)
 {
 	struct pktq_prec *q;
@@ -351,6 +430,15 @@ pktq_init(struct pktq *pq, int num_prec, int max_len)
 		pq->q[prec].max = pq->max;
 }
 
+void
+pktq_set_max_plen(struct pktq *pq, int prec, int max_len)
+{
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	if (prec < pq->num_prec)
+		pq->q[prec].max = (uint16)max_len;
+}
+
 void * BCMFASTPATH
 pktq_deq(struct pktq *pq, int *prec_out)
 {
@@ -463,6 +551,14 @@ void
 pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg)
 {
 	int prec;
+
+	/* Optimize flush, if pktq len = 0, just return.
+	 * pktq len of 0 means pktq's prec q's are all empty.
+	 */
+	if (pq->len == 0) {
+		return;
+	}
+
 	for (prec = 0; prec < pq->num_prec; prec++)
 		pktq_pflush(osh, pq, prec, dir, fn, arg);
 	if (fn == NULL)
@@ -484,6 +580,35 @@ pktq_mlen(struct pktq *pq, uint prec_bmp)
 	return len;
 }
 
+/* Priority peek from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+	struct pktq_prec *q;
+	void *p;
+	int prec;
+
+	if (pq->len == 0)
+	{
+		return NULL;
+	}
+	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+		pq->hi_prec--;
+
+	while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+		if (prec-- == 0)
+			return NULL;
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	return p;
+}
 /* Priority dequeue from a specific set of precedences */
 void * BCMFASTPATH
 pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
@@ -498,7 +623,7 @@ pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
 	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
 		pq->hi_prec--;
 
-	while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+	while ((pq->q[prec].head == NULL) || ((prec_bmp & (1 << prec)) == 0))
 		if (prec-- == 0)
 			return NULL;
 
@@ -526,43 +651,43 @@ pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
 
 const unsigned char bcm_ctype[] = {
 
-	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 0-7 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 0-7 */
 	_BCM_C, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C,
-	_BCM_C, /* 8-15 */
-	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 16-23 */
-	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,            /* 24-31 */
-	_BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,        /* 32-39 */
-	_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 40-47 */
-	_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,            /* 48-55 */
-	_BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 56-63 */
+	_BCM_C,	/* 8-15 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 16-23 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 24-31 */
+	_BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,		/* 32-39 */
+	_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 40-47 */
+	_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,			/* 48-55 */
+	_BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 56-63 */
 	_BCM_P, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X,
 	_BCM_U|_BCM_X, _BCM_U, /* 64-71 */
-	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,            /* 72-79 */
-	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,            /* 80-87 */
-	_BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,            /* 88-95 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 72-79 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 80-87 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 88-95 */
 	_BCM_P, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X,
 	_BCM_L|_BCM_X, _BCM_L, /* 96-103 */
 	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 104-111 */
 	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 112-119 */
 	_BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C, /* 120-127 */
-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,     /* 128-143 */
-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,     /* 144-159 */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,		/* 128-143 */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,		/* 144-159 */
 	_BCM_S|_BCM_SP, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
-	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 160-175 */
+	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,	/* 160-175 */
 	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
-	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 176-191 */
+	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,	/* 176-191 */
 	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,
-	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, /* 192-207 */
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,	/* 192-207 */
 	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_P, _BCM_U, _BCM_U, _BCM_U,
-	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L, /* 208-223 */
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L,	/* 208-223 */
 	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,
-	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, /* 224-239 */
+	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,	/* 224-239 */
 	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_P, _BCM_L, _BCM_L, _BCM_L,
 	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L /* 240-255 */
 };
 
 ulong
-bcm_strtoul(char *cp, char **endp, uint base)
+bcm_strtoul(const char *cp, char **endp, uint base)
 {
 	ulong result, last_result = 0, value;
 	bool minus;
@@ -597,8 +722,7 @@ bcm_strtoul(char *cp, char **endp, uint base)
 	result = 0;
 
 	while (bcm_isxdigit(*cp) &&
-		(value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base)
-	{
+	       (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base) {
 		result = result*base + value;
 		/* Detected overflow */
 		if (result < last_result && !minus)
@@ -611,37 +735,37 @@ bcm_strtoul(char *cp, char **endp, uint base)
 		result = (ulong)(-(long)result);
 
 	if (endp)
-		*endp = (char *)cp;
+		*endp = DISCARD_QUAL(cp, char);
 
 	return (result);
 }
 
 int
-bcm_atoi(char *s)
+bcm_atoi(const char *s)
 {
 	return (int)bcm_strtoul(s, NULL, 10);
 }
 
 /* return pointer to location of substring 'needle' in 'haystack' */
-char*
-bcmstrstr(char *haystack, char *needle)
+char *
+bcmstrstr(const char *haystack, const char *needle)
 {
 	int len, nlen;
 	int i;
 
 	if ((haystack == NULL) || (needle == NULL))
-		return (haystack);
+		return DISCARD_QUAL(haystack, char);
 
 	nlen = strlen(needle);
 	len = strlen(haystack) - nlen + 1;
 
 	for (i = 0; i < len; i++)
 		if (memcmp(needle, &haystack[i], nlen) == 0)
-			return (&haystack[i]);
+			return DISCARD_QUAL(&haystack[i], char);
 	return (NULL);
 }
 
-char*
+char *
 bcmstrcat(char *dest, const char *src)
 {
 	char *p;
@@ -654,7 +778,7 @@ bcmstrcat(char *dest, const char *src)
 	return (dest);
 }
 
-char*
+char *
 bcmstrncat(char *dest, const char *src, uint size)
 {
 	char *endp;
@@ -824,12 +948,14 @@ bcmstrnicmp(const char* s1, const char* s2, int cnt)
 
 /* parse a xx:xx:xx:xx:xx:xx format ethernet address */
 int
-bcm_ether_atoe(char *p, struct ether_addr *ea)
+bcm_ether_atoe(const char *p, struct ether_addr *ea)
 {
 	int i = 0;
+	char *ep;
 
 	for (;;) {
-		ea->octet[i++] = (char) bcm_strtoul(p, &p, 16);
+		ea->octet[i++] = (char) bcm_strtoul(p, &ep, 16);
+		p = ep;
 		if (!*p++ || i == 6)
 			break;
 	}
@@ -870,10 +996,23 @@ wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen)
 char *
 bcm_ether_ntoa(const struct ether_addr *ea, char *buf)
 {
-	static const char template[] = "%02x:%02x:%02x:%02x:%02x:%02x";
-	snprintf(buf, 18, template,
-		ea->octet[0]&0xff, ea->octet[1]&0xff, ea->octet[2]&0xff,
-		ea->octet[3]&0xff, ea->octet[4]&0xff, ea->octet[5]&0xff);
+	static const char hex[] =
+	  {
+		  '0', '1', '2', '3', '4', '5', '6', '7',
+		  '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+	  };
+	const uint8 *octet = ea->octet;
+	char *p = buf;
+	int i;
+
+	for (i = 0; i < 6; i++, octet++) {
+		*p++ = hex[(*octet >> 4) & 0xf];
+		*p++ = hex[*octet & 0xf];
+		*p++ = ':';
+	}
+
+	*(p-1) = '\0';
+
 	return (buf);
 }
 
@@ -881,7 +1020,7 @@ char *
 bcm_ip_ntoa(struct ipv4_addr *ia, char *buf)
 {
 	snprintf(buf, 16, "%d.%d.%d.%d",
-		ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
+	         ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
 	return (buf);
 }
 
@@ -914,7 +1053,7 @@ prpkt(const char *msg, osl_t *osh, void *p0)
 	for (p = p0; p; p = PKTNEXT(osh, p))
 		prhex(NULL, PKTDATA(osh, p), PKTLEN(osh, p));
 }
-#endif
+#endif	
 
 /* Takes an Ethernet frame and sets out-of-bound PKTPRIO.
  * Also updates the inplace vlan tag if requested.
@@ -929,7 +1068,7 @@ pktsetprio(void *pkt, bool update_vtag)
 	int priority = 0;
 	int rc = 0;
 
-	pktdata = (uint8 *) PKTDATA(NULL, pkt);
+	pktdata = (uint8 *)PKTDATA(NULL, pkt);
 	ASSERT(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
 
 	eh = (struct ether_header *) pktdata;
@@ -982,7 +1121,6 @@ pktsetprio(void *pkt, bool update_vtag)
 	return (rc | priority);
 }
 
-#ifndef BCM_BOOTLOADER
 
 static char bcm_undeferrstr[32];
 static const char *bcmerrorstrtable[] = BCMERRSTRINGTABLE;
@@ -1004,8 +1142,6 @@ bcmerrorstr(int bcmerror)
 	return bcmerrorstrtable[-bcmerror];
 }
 
-#endif /* !BCM_BOOTLOADER */
-
 
 
 /* iovar table lookup */
@@ -1079,7 +1215,7 @@ bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
 	return bcmerror;
 }
 
-#endif  /* BCMDRIVER */
+#endif	/* BCMDRIVER */
 
 
 /*******************************************************************************
@@ -1105,38 +1241,38 @@ bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
  */
 
 static const uint8 crc8_table[256] = {
-	0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
-	0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
-	0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
-	0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
-	0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
-	0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
-	0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
-	0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
-	0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
-	0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
-	0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
-	0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
-	0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
-	0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
-	0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
-	0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
-	0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
-	0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
-	0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
-	0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
-	0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
-	0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
-	0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
-	0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
-	0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
-	0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
-	0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
-	0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
-	0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
-	0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
-	0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
-	0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+    0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+    0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+    0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+    0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+    0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+    0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+    0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+    0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+    0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+    0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+    0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+    0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+    0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+    0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+    0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+    0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+    0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+    0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+    0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+    0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+    0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+    0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+    0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+    0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+    0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+    0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+    0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+    0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+    0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+    0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+    0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+    0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
 };
 
 #define CRC_INNER_LOOP(n, c, x) \
@@ -1144,9 +1280,9 @@ static const uint8 crc8_table[256] = {
 
 uint8
 hndcrc8(
-	uint8 *pdata,   /* pointer to array of data to process */
-	uint  nbytes,   /* number of input data bytes to process */
-	uint8 crc   /* either CRC8_INIT_VALUE or previous return value */
+	uint8 *pdata,	/* pointer to array of data to process */
+	uint  nbytes,	/* number of input data bytes to process */
+	uint8 crc	/* either CRC8_INIT_VALUE or previous return value */
 )
 {
 	/* hard code the crc loop instead of using CRC_INNER_LOOP macro
@@ -1181,45 +1317,45 @@ hndcrc8(
  */
 
 static const uint16 crc16_table[256] = {
-	0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
-	0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
-	0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
-	0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
-	0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
-	0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
-	0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
-	0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
-	0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
-	0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
-	0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
-	0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
-	0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
-	0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
-	0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
-	0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
-	0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
-	0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
-	0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
-	0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
-	0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
-	0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
-	0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
-	0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
-	0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
-	0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
-	0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
-	0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
-	0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
-	0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
-	0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
-	0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+    0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+    0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+    0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+    0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+    0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+    0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+    0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+    0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+    0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+    0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+    0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+    0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+    0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+    0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+    0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+    0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+    0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+    0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+    0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+    0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+    0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+    0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+    0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+    0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+    0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+    0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+    0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+    0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+    0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+    0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+    0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+    0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
 };
 
 uint16
 hndcrc16(
-	uint8 *pdata,  /* pointer to array of data to process */
-	uint nbytes, /* number of input data bytes to process */
-	uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+    uint8 *pdata,  /* pointer to array of data to process */
+    uint nbytes, /* number of input data bytes to process */
+    uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
 )
 {
 	while (nbytes-- > 0)
@@ -1228,70 +1364,70 @@ hndcrc16(
 }
 
 static const uint32 crc32_table[256] = {
-	0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
-	0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
-	0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
-	0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
-	0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
-	0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
-	0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
-	0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
-	0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
-	0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
-	0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
-	0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
-	0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
-	0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
-	0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
-	0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
-	0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
-	0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
-	0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
-	0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
-	0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
-	0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
-	0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
-	0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
-	0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
-	0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
-	0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
-	0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
-	0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
-	0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
-	0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
-	0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
-	0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
-	0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
-	0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
-	0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
-	0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
-	0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
-	0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
-	0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
-	0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
-	0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
-	0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
-	0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
-	0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
-	0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
-	0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
-	0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
-	0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
-	0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
-	0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
-	0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
-	0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
-	0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
-	0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
-	0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
-	0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
-	0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
-	0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
-	0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
-	0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
-	0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
-	0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
-	0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
 };
 
 /*
@@ -1302,44 +1438,17 @@ uint32
 hndcrc32(uint8 *pdata, uint nbytes, uint32 crc)
 {
 	uint8 *pend;
-#ifdef __mips__
-	uint8 tmp[4];
-	ulong *tptr = (ulong *)tmp;
-
-	/* in case the beginning of the buffer isn't aligned */
-	pend = (uint8 *)((uint)(pdata + 3) & 0xfffffffc);
-	nbytes -= (pend - pdata);
-	while (pdata < pend)
-		CRC_INNER_LOOP(32, crc, *pdata++);
-
-	/* handle bulk of data as 32-bit words */
-	pend = pdata + (nbytes & 0xfffffffc);
-	while (pdata < pend) {
-		*tptr = *(ulong *)pdata;
-		pdata += sizeof(ulong *);
-		CRC_INNER_LOOP(32, crc, tmp[0]);
-		CRC_INNER_LOOP(32, crc, tmp[1]);
-		CRC_INNER_LOOP(32, crc, tmp[2]);
-		CRC_INNER_LOOP(32, crc, tmp[3]);
-	}
-
-	/* 1-3 bytes at end of buffer */
-	pend = pdata + (nbytes & 0x03);
-	while (pdata < pend)
-		CRC_INNER_LOOP(32, crc, *pdata++);
-#else
 	pend = pdata + nbytes;
 	while (pdata < pend)
 		CRC_INNER_LOOP(32, crc, *pdata++);
-#endif /* __mips__ */
 
 	return crc;
 }
 
 #ifdef notdef
-#define CLEN    1499    /*  CRC Length */
-#define CBUFSIZ     (CLEN+4)
-#define CNBUFS      5 /* # of bufs */
+#define CLEN 	1499 	/*  CRC Length */
+#define CBUFSIZ 	(CLEN+4)
+#define CNBUFS		5 /* # of bufs */
 
 void
 testcrc32(void)
@@ -1392,7 +1501,7 @@ bcm_next_tlv(bcm_tlv_t *elt, int *buflen)
 	/* advance to next elt */
 	len = elt->len;
 	elt = (bcm_tlv_t*)(elt->data + len);
-	*buflen -= (2 + len);
+	*buflen -= (TLV_HDR_LEN + len);
 
 	/* validate next elt */
 	if (!bcm_valid_tlv(elt, *buflen))
@@ -1416,15 +1525,16 @@ bcm_parse_tlvs(void *buf, int buflen, uint key)
 	totlen = buflen;
 
 	/* find tagged parameter */
-	while (totlen >= 2) {
+	while (totlen >= TLV_HDR_LEN) {
 		int len = elt->len;
 
 		/* validate remaining totlen */
-		if ((elt->id == key) && (totlen >= (len + 2)))
+		if ((elt->id == key) &&
+		    (totlen >= (len + TLV_HDR_LEN)))
 			return (elt);
 
-		elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
-		totlen -= (len + 2);
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+		totlen -= (len + TLV_HDR_LEN);
 	}
 
 	return NULL;
@@ -1446,7 +1556,7 @@ bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
 	totlen = buflen;
 
 	/* find tagged parameter */
-	while (totlen >= 2) {
+	while (totlen >= TLV_HDR_LEN) {
 		uint id = elt->id;
 		int len = elt->len;
 
@@ -1455,11 +1565,12 @@ bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
 			return (NULL);
 
 		/* validate remaining totlen */
-		if ((id == key) && (totlen >= (len + 2)))
+		if ((id == key) &&
+		    (totlen >= (len + TLV_HDR_LEN)))
 			return (elt);
 
-		elt = (bcm_tlv_t*)((uint8*)elt + (len + 2));
-		totlen -= (len + 2);
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+		totlen -= (len + TLV_HDR_LEN);
 	}
 	return NULL;
 }
@@ -1488,7 +1599,7 @@ bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
 			/* print any unnamed bits */
 			snprintf(hexstr, 16, "0x%X", flags);
 			name = hexstr;
-			flags = 0;  /* exit loop */
+			flags = 0;	/* exit loop */
 		} else if ((flags & bit) == 0)
 			continue;
 		flags &= ~bit;
@@ -1506,22 +1617,18 @@ bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
 		/* copy btwn flag space and NULL char */
 		if (flags != 0)
 			p += snprintf(p, 2, " ");
-		len -= slen;
 	}
 
 	/* indicate the str was too short */
 	if (flags != 0) {
 		if (len < 2)
-			p -= 2 - len;   /* overwrite last char */
+			p -= 2 - len;	/* overwrite last char */
 		p += snprintf(p, 2, ">");
 	}
 
 	return (int)(p - buf);
 }
-#endif
 
-#if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
-	defined(DHD_DEBUG) || defined(WLMEDIA_PEAKRATE)
 /* print bytes formatted as hex to a string. return the resulting string length */
 int
 bcm_format_hex(char *str, const void *bytes, int len)
@@ -1536,7 +1643,7 @@ bcm_format_hex(char *str, const void *bytes, int len)
 	}
 	return (int)(p - str);
 }
-#endif
+#endif 
 
 /* pretty hex print a contiguous buffer */
 void
@@ -1553,7 +1660,7 @@ prhex(const char *msg, uchar *buf, uint nbytes)
 	p = line;
 	for (i = 0; i < nbytes; i++) {
 		if (i % 16 == 0) {
-			nchar = snprintf(p, len, "  %04d: ", i);    /* line prefix */
+			nchar = snprintf(p, len, "  %04d: ", i);	/* line prefix */
 			p += nchar;
 			len -= nchar;
 		}
@@ -1564,7 +1671,7 @@ prhex(const char *msg, uchar *buf, uint nbytes)
 		}
 
 		if (i % 16 == 15) {
-			printf("%s\n", line);       /* flush line */
+			printf("%s\n", line);		/* flush line */
 			p = line;
 			len = sizeof(line);
 		}
@@ -1587,6 +1694,9 @@ static const char *crypto_algo_names[] = {
 	"UNDEF",
 	"UNDEF",
 	"UNDEF",
+#ifdef BCMWAPI_WPI
+	"WAPI",
+#endif /* BCMWAPI_WPI */
 	"UNDEF"
 };
 
@@ -1662,7 +1772,7 @@ bcmdumpfields(bcmutl_rdreg_rtn read_rtn, void *arg0, uint arg1, struct fielddesc
 		if (cur_ptr->nameandfmt == NULL)
 			break;
 		len = snprintf(buf, bufsize, cur_ptr->nameandfmt,
-			read_rtn(arg0, arg1, cur_ptr->offset));
+		               read_rtn(arg0, arg1, cur_ptr->offset));
 		/* check for snprintf overflow or error */
 		if (len < 0 || (uint32)len >= bufsize)
 			len = bufsize - 1;
@@ -1699,8 +1809,8 @@ bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint buflen)
  * a uint16.
  */
 
-#define QDBM_OFFSET 153     /* Offset for first entry */
-#define QDBM_TABLE_LEN 40   /* Table size */
+#define QDBM_OFFSET 153		/* Offset for first entry */
+#define QDBM_TABLE_LEN 40	/* Table size */
 
 /* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
  * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
@@ -1714,12 +1824,12 @@ bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint buflen)
 #define QDBM_TABLE_HIGH_BOUND 64938 /* High bound */
 
 static const uint16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
-/* qdBm:    +0  +1  +2  +3  +4  +5  +6  +7 */
-/* 153: */      6683,   7079,   7499,   7943,   8414,   8913,   9441,   10000,
-/* 161: */      10593,  11220,  11885,  12589,  13335,  14125,  14962,  15849,
-/* 169: */      16788,  17783,  18836,  19953,  21135,  22387,  23714,  25119,
-/* 177: */      26607,  28184,  29854,  31623,  33497,  35481,  37584,  39811,
-/* 185: */      42170,  44668,  47315,  50119,  53088,  56234,  59566,  63096
+/* qdBm: 	+0 	+1 	+2 	+3 	+4 	+5 	+6 	+7 */
+/* 153: */      6683,	7079,	7499,	7943,	8414,	8913,	9441,	10000,
+/* 161: */      10593,	11220,	11885,	12589,	13335,	14125,	14962,	15849,
+/* 169: */      16788,	17783,	18836,	19953,	21135,	22387,	23714,	25119,
+/* 177: */      26607,	28184,	29854,	31623,	33497,	35481,	37584,	39811,
+/* 185: */      42170,	44668,	47315,	50119,	53088,	56234,	59566,	63096
 };
 
 uint16
@@ -1769,9 +1879,8 @@ bcm_mw_to_qdbm(uint16 mw)
 
 	for (qdbm = 0; qdbm < QDBM_TABLE_LEN-1; qdbm++) {
 		boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm+1] -
-			nqdBm_to_mW_map[qdbm])/2;
-		if (mw_uint < boundary)
-			break;
+		                                    nqdBm_to_mW_map[qdbm])/2;
+		if (mw_uint < boundary) break;
 	}
 
 	qdbm += (uint8)offset;
@@ -1813,13 +1922,17 @@ bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
 	int r;
 
 	va_start(ap, fmt);
+
 	r = vsnprintf(b->buf, b->size, fmt, ap);
 
 	/* Non Ansi C99 compliant returns -1,
 	 * Ansi compliant return r >= b->size,
 	 * bcmstdlib returns 0, handle all
 	 */
-	if ((r == -1) || (r >= (int)b->size) || (r == 0)) {
+	/* r == 0 is also the case when strlen(fmt) is zero.
+	 * typically the case when "" is passed as argument.
+	 */
+	if ((r == -1) || (r >= (int)b->size)) {
 		b->size = 0;
 	} else {
 		b->size -= r;
@@ -1832,6 +1945,19 @@ bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
 }
 
 void
+bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, uint8 *buf, int len)
+{
+	int i;
+
+	if (msg != NULL && msg[0] != '\0')
+		bcm_bprintf(b, "%s", msg);
+	for (i = 0; i < len; i ++)
+		bcm_bprintf(b, "%02X", buf[i]);
+	if (newline)
+		bcm_bprintf(b, "\n");
+}
+
+void
 bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
 {
 	int i;
@@ -1845,7 +1971,7 @@ bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
 }
 
 int
-bcm_cmp_bytes(uchar *arg1, uchar *arg2, uint8 nbytes)
+bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes)
 {
 	int i;
 
@@ -1857,7 +1983,7 @@ bcm_cmp_bytes(uchar *arg1, uchar *arg2, uint8 nbytes)
 }
 
 void
-bcm_print_bytes(char *name, const uchar *data, int len)
+bcm_print_bytes(const char *name, const uchar *data, int len)
 {
 	int i;
 	int per_line = 0;
@@ -1875,7 +2001,7 @@ bcm_print_bytes(char *name, const uchar *data, int len)
 }
 #if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
 	defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
-#define SSID_FMT_BUF_LEN    ((4 * DOT11_MAX_SSID_LEN) + 1)
+#define SSID_FMT_BUF_LEN	((4 * DOT11_MAX_SSID_LEN) + 1)
 
 int
 bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
@@ -1902,7 +2028,7 @@ bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
 
 	return (int)(p - buf);
 }
-#endif
+#endif 
 
 #endif /* BCMDRIVER */
 
diff --git a/bcmdhd/dhdutil/dhdu.c b/bcmdhd/dhdutil/dhdu.c
index c20cef0..5de111a 100644
--- a/bcmdhd/dhdutil/dhdu.c
+++ b/bcmdhd/dhdutil/dhdu.c
@@ -1,7 +1,7 @@
 /*
  * Common code for DHD command-line utility
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu.c,v 1.88.2.19 2011-01-19 23:47:10 Exp $
+ * $Id: dhdu.c 355225 2012-09-05 22:35:10Z $
  */
 
 /* For backwards compatibility, the absence of the define 'BWL_NO_FILESYSTEM_SUPPORT'
@@ -25,7 +25,9 @@
 #define BWL_FILESYSTEM_SUPPORT
 #endif
 
+#ifndef PROP_TXSTATUS
 #define PROP_TXSTATUS
+#endif
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -42,17 +44,24 @@
 #include <bcmendian.h>
 #include "dhdu.h"
 #include "miniopt.h"
+/* #include <usbrdl.h> */
 #include <proto/bcmip.h>
 #define IPV4_ADDR_LEN 4
+#ifdef WLBTAMP
 #include <proto/bt_amp_hci.h>
+#endif
 
 #include <errno.h>
 
 #include <trxhdr.h>
+/* #include "ucode_download.h"  Greg */
 
 #define stricmp strcasecmp
 #define strnicmp strncasecmp
 
+#ifndef RDL_CHUNK
+#define RDL_CHUNK	1500
+#endif
 
 static cmd_func_t dhd_var_void;
 static cmd_func_t dhd_varint, dhd_varstr;
@@ -72,6 +81,8 @@ static cmd_func_t dhd_membytes, dhd_download, dhd_dldn,
 	dhd_upload, dhd_vars, dhd_idleclock, dhd_idletime;
 static cmd_func_t dhd_logstamp;
 
+static cmd_func_t dhd_hostreorder_flows;
+
 #ifdef PROP_TXSTATUS
 static cmd_func_t dhd_proptxstatusenable;
 static cmd_func_t dhd_proptxstatusmode;
@@ -89,8 +100,10 @@ static int file_size(char *fname);
 static int read_vars(char *fname, char *buf, int buf_maxlen);
 #endif
 
+#ifdef WLBTAMP
 static cmd_func_t wl_HCI_cmd;
 static cmd_func_t wl_HCI_ACL_data;
+#endif
 
 /* dword align allocation */
 static union {
@@ -167,16 +180,17 @@ cmd_t dhd_cmds[] = {
 	{ "memsize", dhd_varint, DHD_GET_VAR, -1,
 	"display size of onchip SOCRAM"},
 	{ "membytes", dhd_membytes, DHD_GET_VAR, DHD_SET_VAR,
-	"membytes [-h | -r | -i] <address> <length> [<bytes>]\n"
+	"membytes [-h | -r | -i] <address> <length> [<data>]\n"
 	"\tread or write data in the dongle ram\n"
-	"\t-h   <bytes> is a sequence of hex digits, else a char string\n"
-	"\t-r   output as a raw write rather than hexdump display\n"},
+	"\t-h   <data> is a sequence of hex digits rather than a char string\n"
+	"\t-r   output binary to stdout rather hex\n"},
 	{ "download", dhd_download, -1, DHD_SET_VAR,
-	"download [-a <address>] [--noreset] [--norun] <binfile> [<varsfile>]\n"
+	"download [-a <address>] [--noreset] [--norun] [--verify] <binfile> [<varsfile>]\n"
 	"\tdownload file to specified dongle ram address and start CPU\n"
 	"\toptional vars file will replace vars parsed from the CIS\n"
 	"\t--noreset    do not reset SOCRAM core before download\n"
 	"\t--norun      do not start dongle CPU after download\n"
+	"\t--verify     do readback verify \n"
 	"\tdefault <address> is 0\n"},
 	{ "dldn", dhd_dldn, -1, DHD_SET_VAR,
 	"download <binfile>\n"
@@ -197,6 +211,12 @@ cmd_t dhd_cmds[] = {
 	"\t  -c means write regardless of crc"},
 	{ "sleep", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"enter/exit simulated host sleep (bus powerdown w/OOB wakeup)"},
+	{ "kso", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"keep sdio on"},
+	{ "devcap", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"brcm device capabilities"},
+	{ "devsleep", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"Sleep CMD14"},
 #ifdef SDTEST
 	{ "extloop", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"external loopback: convert all tx data to echo test frames"},
@@ -271,12 +291,14 @@ cmd_t dhd_cmds[] = {
 	"Move device into or out of reset state (1/reset, or 0/operational)"},
 	{ "ioctl_timeout", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"IOCTL response timeout (milliseconds)."},
+#ifdef WLBTAMP
 	{ "HCI_cmd", wl_HCI_cmd, -1, DHD_SET_VAR,
 	"carries HCI commands to the driver\n"
 	"\tusage: dhd HCI_cmd <command> <args>\n" },
 	{ "HCI_ACL_data", wl_HCI_ACL_data, -1, DHD_SET_VAR,
 	"carries HCI ACL data packet to the driver\n"
 	"\tusage: dhd HCI_ACL_data <logical link handle> <data>\n" },
+#endif
 #ifdef PROP_TXSTATUS
 	{ "proptx", dhd_proptxstatusenable, DHD_GET_VAR, DHD_SET_VAR,
 	"enable/disable the proptxtstatus feature\n"
@@ -290,17 +312,12 @@ cmd_t dhd_cmds[] = {
 #endif
 	{ "sd_uhsimode", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
 	"g/set UHSI Mode"},
-#ifdef WLMEDIA_HTSF
-	{ "pktdlystatsz", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
-	"Specify the size of the delay statistics buffer\n"
-	"0 - disable"},
-#endif
-	{ "hsicsleep", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
-	"sleep/wake HSIC bus"},
-	{ "changemtu", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
-	"change the size of the mtu during runtime <1500-1752> Bytes\n"},
-	{ "hsicautosleep", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
-	"Enable/Disable HSIC bus automatic sleep/resume feature"},
+	{ "host_reorder_flows", dhd_hostreorder_flows, DHD_GET_VAR, -1,
+	"get host reorder flows "},
+	{ "txglomsize", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"max glom size for sdio tx\n"},
+	{ "txglommode", dhd_varint, DHD_GET_VAR, DHD_SET_VAR,
+	"glom mode for sdio tx 0- copy, 1- multidescriptor\n"},
 	{ NULL, NULL, 0, 0, NULL }
 };
 
@@ -963,17 +980,18 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 	/* arg count */
 	for (argc = 0; argv[argc]; argc++);
 
-	/* required args: address size [<bytes>]] */
+	/* required args: address size [<data>]] */
 	if (argc < 2) {
-		fprintf(stderr, "required args: address size [<bytes>]\n");
+		fprintf(stderr, "required args: address size [<data>]\n");
 		return USAGE_ERROR;
 	}
+
 	if (argc < 3 && hexin) {
-		fprintf(stderr, "missing <bytes> arg implies by -h\n");
+		fprintf(stderr, "missing <data> required by -h\n");
 		return USAGE_ERROR;
 	}
 	if ((argc > 2) && (rawout)) {
-		fprintf(stderr, "can't have input <bytes> arg with -r or -i\n");
+		fprintf(stderr, "can't have <data> arg with -r\n");
 		return USAGE_ERROR;
 	}
 
@@ -999,10 +1017,12 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 
 	/* get can just use utility function, set must copy custom buffer */
 	if (argc == 2) {
+		/* Read */
 		uint chunk = DHD_IOCTL_MAXLEN;
 		for (addr -= align, len += align; len; addr += chunk, len -= chunk, align = 0) {
 			chunk = MIN(chunk, len);
-			params[0] = addr; params[1] = ROUNDUP(chunk, 4);
+			params[0] = addr;
+			params[1] = ROUNDUP(chunk, 4);
 			ret = dhd_var_getbuf(dhd, "membytes",
 			                     params, (2 * sizeof(int)), (void**)&ptr);
 			if (ret < 0)
@@ -1015,6 +1035,7 @@ dhd_membytes(void *dhd, cmd_t *cmd, char **argv)
 			}
 		}
 	} else {
+		/* Write */
 		uint patlen = strlen(argv[2]);
 		uint chunk, maxchunk;
 		char *sptr;
@@ -1487,7 +1508,39 @@ dhd_vars(void *dhd, cmd_t *cmd, char **argv)
 
 #if defined(BWL_FILESYSTEM_SUPPORT)
 static int
-dhd_load_file_bytes(void *dhd, cmd_t *cmd, FILE *fp, int fsize, int start)
+dhd_verify_file_bytes(void *dhd, uint8 *memblock, int start, uint len)
+{
+	int ret = 0;
+	uint i = 0;
+	char *ptr;
+	int params[2];
+	uint8 *src, *dst;
+
+	params[0] = start;
+	params[1] = len;
+	ret = dhd_var_getbuf(dhd, "membytes", params, 2 * sizeof(int), (void**)&ptr);
+	if (ret) {
+		fprintf(stderr, "%s: failed reading %d membytes from 0x%08x\n",
+		__FUNCTION__, len, start);
+		return -1;
+	}
+
+	src = (uint8 *)memblock;
+	dst = (uint8 *)ptr;
+	while (i < len) {
+		if (src[i] != dst[i]) {
+			fprintf(stderr, "   0x%x: exp[0x%02X] != got[0x%02X]\n",
+				start+i, src[i], dst[i]);
+			ret = -1;
+		}
+		i++;
+	}
+
+	return ret;
+}
+
+static int
+dhd_load_file_bytes(void *dhd, cmd_t *cmd, FILE *fp, int fsize, int start, uint blk_sz, bool verify)
 {
 	int tot_len = 0;
 	uint read_len;
@@ -1495,19 +1548,32 @@ dhd_load_file_bytes(void *dhd, cmd_t *cmd, FILE *fp, int fsize, int start)
 	uint len;
 	uint8 memblock[MEMBLOCK];
 	int ret;
+	int retry;
 
 	UNUSED_PARAMETER(cmd);
 
+	if (!fsize || !fp)
+		return -1;
+
+	assert(blk_sz <= MEMBLOCK);
+
 	while (tot_len < fsize) {
 		read_len = fsize - tot_len;
-		if (read_len >= MEMBLOCK)
-			read_len = MEMBLOCK;
+		if (read_len >= blk_sz) {
+			read_len = blk_sz;
+
+			if (!ISALIGNED(start, MEMBLOCK))
+				read_len = ROUNDUP(start, MEMBLOCK) - start;
+		}
+
 		len = fread(memblock, sizeof(uint8), read_len, fp);
 		if ((len < read_len) && !feof(fp)) {
 			fprintf(stderr, "%s: error reading file\n", __FUNCTION__);
 			return -1;
 
 		}
+		retry = 0;
+failed_retry:
 
 		bufp = buf;
 		memset(bufp, 0, DHD_IOCTL_MAXLEN);
@@ -1526,6 +1592,21 @@ dhd_load_file_bytes(void *dhd, cmd_t *cmd, FILE *fp, int fsize, int start)
 			        __FUNCTION__, ret, len, start);
 			return -1;
 		}
+
+		if (verify == TRUE) {
+			if (len & 1)
+				len = ROUNDUP(len, 2);
+
+			if (dhd_verify_file_bytes(dhd, memblock, start, len) != 0) {
+				if (retry++ < 5000)
+				{
+					fprintf(stderr, "%s: verify failed %d membytes "
+						"from 0x%08x\n", __FUNCTION__, len, start);
+					goto failed_retry;
+				}
+			}
+		}
+
 		start += len;
 		tot_len += len;
 	}
@@ -1575,21 +1656,29 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 #else
 	bool reset = TRUE;
 	bool run = TRUE;
+	bool verify = FALSE;
 	char *fname = NULL;
 	char *vname = NULL;
 	uint32 start = 0;
 	int ret = 0;
 	int fsize;
+	uint32 bustype;
+	long filepos;
+
 	FILE *fp = NULL;
 	uint32 memsize;
 	char *memszargs[] = { "memsize", NULL };
+
 	char *bufp;
+
 	miniopt_t opts;
 	int opt_err;
 	uint nvram_len;
 	struct trx_header trx_hdr;
+	uint32 trx_hdr_len;
 	bool trx_file = FALSE;
-	bool overlays = FALSE;
+	uint memblock_sz = MEMBLOCK;
+	bool embedded_ucode = FALSE;
 
 	UNUSED_PARAMETER(cmd);
 
@@ -1628,6 +1717,8 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 				reset = FALSE;
 			} else if (!strcmp(opts.key, "norun")) {
 				run = FALSE;
+			} else if (!strcmp(opts.key, "verify")) {
+				verify = TRUE;
 			} else {
 				fprintf(stderr, "unrecognized option %s\n", opts.valstr);
 				ret = -1;
@@ -1662,18 +1753,13 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 	/* Verify the file is a regular bin file or trx file */
 	{
 		uint32 tmp_len;
-		uint32 trx_hdr_len = sizeof(struct trx_header);
+		trx_hdr_len = sizeof(struct trx_header);
 		tmp_len = fread(&trx_hdr, sizeof(uint8), trx_hdr_len, fp);
 		if (tmp_len == trx_hdr_len) {
 			if (trx_hdr.magic == TRX_MAGIC) {
 				trx_file = TRUE;
-				if (trx_hdr.flag_version & TRX_OVERLAYS) {
-					fprintf(stderr, "Image contains overlays but overlays "
-					        "not supported by this command\n");
-					ret = BCME_UNSUPPORTED;
-					goto exit;
-				} else {
-				}
+				if (trx_hdr.flag_version & TRX_EMBED_UCODE)
+					embedded_ucode = TRUE;
 			}
 			else
 				fseek(fp, 0, SEEK_SET);
@@ -1682,37 +1768,63 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 			fseek(fp, 0, SEEK_SET);
 	}
 
-	if ((ret = dhd_var_get(dhd, NULL, memszargs))) {
-		fprintf(stderr, "%s: error obtaining memsize\n", __FUNCTION__);
-		goto exit;
+	/* Check on which bus the dhd driver is sitting. Downloading methodology differs from
+	 * USB to SDIO.
+	 */
+	{
+		char* bustype_args[] = {"bustype", NULL};
+
+		/* Read the bus type the DHD driver is associated to */
+		if ((ret = dhd_var_get(dhd, NULL, bustype_args))) {
+			fprintf(stderr, "%s: error obtaining bustype\n", __FUNCTION__);
+			goto exit;
+		}
+
+		bustype = *(uint32*)buf;
 	}
 
-	memsize = *(uint32*)buf;
+	if (trx_file)
+		fsize = (int)(trx_hdr.offsets[0]);
 
-#ifdef PART_OF_RAM_AS_ROMSIM
-	/* only useful for cases where you want to sim some RAM as ROM */
-	if (memsize && ((uint32)fsize > memsize)) {
-		fprintf(stderr, "%s: file %s too large (%d > %d)\n",
-		        __FUNCTION__, fname, fsize, memsize);
-		ret = -1;
-		goto exit;
+	if (bustype == BUS_TYPE_SDIO) {
+		if ((ret = dhd_var_get(dhd, NULL, memszargs))) {
+			fprintf(stderr, "%s: error obtaining memsize\n", __FUNCTION__);
+			goto exit;
+		}
+		memsize = *(uint32*)buf;
 	}
-#endif /* PART_OF_RAM_AS_ROMSIM */
+
+
+	BCM_REFERENCE(memsize);
 
 	/* do the download reset if not suppressed */
 	if (reset) {
-		if ((ret = dhd_iovar_setint(dhd, "download", TRUE))) {
+		if ((ret = dhd_iovar_setint(dhd, "dwnldstate", TRUE))) {
 			fprintf(stderr, "%s: failed to put dongle in download mode\n",
 			        __FUNCTION__);
 			goto exit;
 		}
 	}
 
-	if (trx_file)
-		fsize = trx_hdr.offsets[0];
+	if (BUS_TYPE_USB == bustype) {
+		/* store the cur pos pointing to base image which should be written */
+		filepos = ftell(fp);
+		if (filepos == -1) {
+			fprintf(stderr, "%s: ftell failed.\n", __FUNCTION__);
+		}
+
+		/* In case of USB, we need to write header information also to dongle. */
+		fseek(fp, 0, SEEK_SET);
+
+		/* The file size is "base_image + TRX_Header_size" */
+		fsize = (int)(trx_hdr.offsets[0] + sizeof(struct trx_header));
+
+		memblock_sz = RDL_CHUNK;
+	}
+
 
 	/* Load the ram image */
-	if (dhd_load_file_bytes(dhd, cmd, fp, fsize, start)) {
+	if (dhd_load_file_bytes(dhd, cmd, fp, fsize, start, memblock_sz, verify)) {
 		fprintf(stderr, "%s: error loading the ramimage at addr 0x%x\n",
 		        __FUNCTION__, start);
 		ret = -1;
@@ -1720,8 +1832,14 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 	}
 
 	if (trx_file) {
-		if (overlays) {
-		} else {
+
+		filepos = ftell(fp);
+		if (filepos == -1) {
+			fprintf(stderr, "%s: ftell failed.\n", __FUNCTION__);
+		}
+
+		if (BUS_TYPE_SDIO == bustype) {
+
 		}
 	}
 
@@ -1754,18 +1872,30 @@ dhd_download(void *dhd, cmd_t *cmd, char **argv)
 
 	/* start running the downloaded code if not suppressed */
 	if (run) {
-		if ((ret = dhd_iovar_setint(dhd, "download", FALSE))) {
+		if ((ret = dhd_iovar_setint(dhd, "dwnldstate", FALSE))) {
+
 			fprintf(stderr, "%s: failed to take dongle out of download mode\n",
 			        __FUNCTION__);
+			/* USB Error return values */
+			if (BUS_TYPE_USB == bustype) {
+				if (ret == -1)
+					fprintf(stderr, "%s: CPU is not in RUNNABLE State\n",
+						__FUNCTION__);
+				else
+					fprintf(stderr, "%s: Error in setting CPU to RUN mode.\n",
+						__FUNCTION__);
+			}
 			goto exit;
 		}
 	}
+	if (embedded_ucode) {
+/* GREG remove */	
+	}
 
 exit:
 	if (fp)
 		fclose(fp);
 
-
 	return ret;
 #endif /* BWL_FILESYSTEM_SUPPORT */
 }
@@ -2140,6 +2270,9 @@ static dbg_msg_t dhd_msgs[] = {
 	{DHD_GLOM_VAL,	"glom"},
 	{DHD_EVENT_VAL,	"event"},
 	{DHD_BTA_VAL,	"bta"},
+	{DHD_ISCAN_VAL,	"iscan"},
+	{DHD_ARPOE_VAL,	"arpoe"},
+	{DHD_REORDER_VAL, "reorder"},
 	{0,		NULL}
 };
 
@@ -2531,6 +2664,33 @@ dhd_varstr(void *dhd, cmd_t *cmd, char **argv)
 }
 
 
+static int
+dhd_hostreorder_flows(void *dhd, cmd_t *cmd, char **argv)
+{
+	int ret, count, i = 0;
+	void *ptr;
+	uint8 *flow_id;
+
+
+	if ((ret = dhd_var_getbuf(dhd, cmd->name, NULL, 0, &ptr)) < 0) {
+		printf("error getting reorder flows from the host\n");
+		return ret;
+	}
+	flow_id = (uint8 *)ptr;
+	count = *flow_id;
+	if (!count)
+		printf("there are no active flows\n");
+	else {
+		printf("flows(%d): \t", count);
+		while (i++ < count)
+			printf("%d  ", *flow_id++);
+		printf("\n");
+	}
+	return 0;
+}
+
+
+#ifdef WLBTAMP
 
 #define MATCH_OP(op, opstr)	(strlen(op) == strlen(opstr) && strncmp(op, opstr, strlen(op)) == 0)
 
@@ -2627,16 +2787,18 @@ wl_HCI_cmd(void *wl, cmd_t *cmd, char **argv)
 	return dhd_var_setbuf(wl, cmd->name, cpkt, HCI_CMD_PREAMBLE_SIZE + plen);
 }
 
+typedef union {
+	uint8 buf[HCI_ACL_DATA_PREAMBLE_SIZE + 2048];
+	uint32 alignme;
+} g_hci_dbuf_t;
+
 static int
 wl_HCI_ACL_data(void *wl, cmd_t *cmd, char **argv)
 {
 	/* Align struct. Also declare static so that large array isn't allocated
 	 * from the stack.
 	 */
-	static union {
-		uint8 buf[HCI_ACL_DATA_PREAMBLE_SIZE + 2048];
-		uint32 alignme;
-	} g_hci_dbuf;
+	static g_hci_dbuf_t g_hci_dbuf;
 
 	amp_hci_ACL_data_t *dpkt = (amp_hci_ACL_data_t *)&g_hci_dbuf.buf[0];
 	uint16 dlen;
@@ -2657,6 +2819,7 @@ wl_HCI_ACL_data(void *wl, cmd_t *cmd, char **argv)
 
 	return dhd_var_setbuf(wl, cmd->name, dpkt, HCI_ACL_DATA_PREAMBLE_SIZE + dlen);
 }
+#endif /* WLBTAMP */
 
 /* These two utility functions are used by dhdu_linux.c
  * The code is taken from wlu.c.
diff --git a/bcmdhd/dhdutil/dhdu.h b/bcmdhd/dhdutil/dhdu.h
index 84d7e1f..dbda436 100644
--- a/bcmdhd/dhdutil/dhdu.h
+++ b/bcmdhd/dhdutil/dhdu.h
@@ -1,8 +1,8 @@
 /*
  * Definitions for DHD command-line utility
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
- *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu.h,v 1.7 2009-05-22 19:23:29 Exp $
+ * $Id: dhdu.h 294362 2011-11-06 22:26:56Z $
  */
 
 #ifndef _dhdu_h_
@@ -45,8 +45,6 @@ extern int dhd_check(void *dhd);
 struct ipv4_addr;
 int dhd_ether_atoe(const char *a, struct ether_addr *n);
 int dhd_atoip(const char *a, struct ipv4_addr *n);
-/* useful macros */
-#define ARRAYSIZE(a)  (sizeof(a)/sizeof(a[0]))
 
 #define USAGE_ERROR    -1	/* Error code for Usage */
 #define IOCTL_ERROR    -2	/* Error code for ioctl failure */
diff --git a/bcmdhd/dhdutil/dhdu_cmd.h b/bcmdhd/dhdutil/dhdu_cmd.h
index 571f8b9..74c6304 100644
--- a/bcmdhd/dhdutil/dhdu_cmd.h
+++ b/bcmdhd/dhdutil/dhdu_cmd.h
@@ -1,8 +1,8 @@
 /*
- * Command structure for dhd command line utility.
- *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Command structure for dhd command line utility, copied from wl utility
  *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu_cmd.h,v 1.6 2008-06-05 00:36:42 Exp $
+ * $Id: dhdu_cmd.h 241182 2011-02-17 21:50:03Z $
  */
 
 #ifndef _dhdu_cmd_h_
diff --git a/bcmdhd/dhdutil/dhdu_common.h b/bcmdhd/dhdutil/dhdu_common.h
index d1a70f0..6ea2ca2 100644
--- a/bcmdhd/dhdutil/dhdu_common.h
+++ b/bcmdhd/dhdutil/dhdu_common.h
@@ -1,7 +1,7 @@
 /*
- * Common code for dhd command line utility.
+ * Linux port of dhd command line utility, hacked from wl utility.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu_common.h,v 1.4.34.1 2011-02-05 00:43:28 Exp $
+ * $Id: dhdu_common.h 308298 2012-01-14 01:35:34Z $
  */
 
 /* Common header file for dhdu_linux.c and dhdu_ndis.c */
@@ -23,15 +23,66 @@
 #ifndef _dhdu_common_h
 #define _dhdu_common_h
 
+#if !defined(RWL_WIFI) && !defined(RWL_SOCKET) && !defined(RWL_SERIAL)
+
+#define NO_REMOTE       0
+#define REMOTE_SERIAL 	1
+#define REMOTE_SOCKET 	2
+#define REMOTE_WIFI     3
+#define REMOTE_DONGLE   4
+
+/* For cross OS support */
+#define LINUX_OS  	1
+#define WIN32_OS  	2
+#define MAC_OSX		3
+#define BACKLOG 	4
+#define WINVISTA_OS	5
+#define INDONGLE	6
+
+#define RWL_WIFI_ACTION_CMD   		"wifiaction"
+#define RWL_WIFI_GET_ACTION_CMD         "rwlwifivsaction"
+#define RWL_DONGLE_SET_CMD		"dongleset"
+
+#define SUCCESS 	1
+#define FAIL   		-1
+#define NO_PACKET       -2
+#define SERIAL_PORT_ERR -3
+
+/* Added for debug utility support */
+#define ERR		stderr
+#define OUTPUT		stdout
+#define DEBUG_ERR	0x0001
+#define DEBUG_INFO	0x0002
+#define DEBUG_DBG	0x0004
+
+#define DPRINT_ERR	if (defined_debug & DEBUG_ERR) \
+			    fprintf
+#define DPRINT_INFO	if (defined_debug & DEBUG_INFO) \
+			    fprintf
+#define DPRINT_DBG	if (defined_debug & DEBUG_DBG) \
+			    fprintf
+
+extern int wl_get(void *wl, int cmd, void *buf, int len);
+extern int wl_set(void *wl, int cmd, void *buf, int len);
+#endif 
+
 /* DHD utility function declarations */
 extern int dhd_check(void *dhd);
 extern int dhd_atoip(const char *a, struct ipv4_addr *n);
 extern int dhd_option(char ***pargv, char **pifname, int *phelp);
 void dhd_usage(cmd_t *port_cmds);
 
-static int process_args(struct ifreq* ifr, char **argv);
+/* Remote DHD declarations */
+int remote_type = NO_REMOTE;
+extern char *g_rwl_buf_mac;
+extern char* g_rwl_device_name_serial;
+unsigned short g_rwl_servport;
+char *g_rwl_servIP = NULL;
+unsigned short defined_debug = DEBUG_ERR | DEBUG_INFO;
 
 
+static int process_args(struct ifreq* ifr, char **argv);
+
 #define dtoh32(i) i
 #define dtoh16(i) i
 
diff --git a/bcmdhd/dhdutil/dhdu_linux.c b/bcmdhd/dhdutil/dhdu_linux.c
index 4e58020..146240f 100644
--- a/bcmdhd/dhdutil/dhdu_linux.c
+++ b/bcmdhd/dhdutil/dhdu_linux.c
@@ -1,8 +1,8 @@
 /*
- * Linux port of dhd command line utility.
- *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Linux port of dhd command line utility, hacked from wl utility.
  *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdu_linux.c,v 1.16.2.2 2010-12-16 08:12:11 Exp $
+ * $Id: dhdu_linux.c 308298 2012-01-14 01:35:34Z $
  */
 
 #include <stdio.h>
@@ -53,15 +53,24 @@ typedef u_int8_t u8;
 #include <wlioctl.h>
 #include <bcmcdc.h>
 #include <bcmutils.h>
+
+#if defined(RWL_WIFI) || defined(RWL_SOCKET) ||defined(RWL_SERIAL)
+#define RWL_ENABLE
+#endif 
+
 #include "dhdu.h"
+#ifdef RWL_ENABLE
+#include "wlu_remote.h"
+#include "wlu_client_shared.h"
+#include "wlu_pipe.h"
+#endif /* RWL_ENABLE */
 #include <netdb.h>
+#include <netinet/in.h>
 #include <dhdioctl.h>
 #include "dhdu_common.h"
 
-extern int wl_get(void *wl, int cmd, void *buf, int len);
-extern int wl_set(void *wl, int cmd, void *buf, int len);
-
 char *av0;
+static int rwl_os_type = LINUX_OS;
 /* Search the dhd_cmds table for a matching command name.
  * Return the matching command or NULL if no match found.
  */
@@ -84,7 +93,7 @@ syserr(char *s)
 	exit(errno);
 }
 
-/* This function is called by ioctl_setinformation_fe or ioctl_queryinformation_fe 
+/* This function is called by ioctl_setinformation_fe or ioctl_queryinformation_fe
  * for executing  remote commands or local commands
  */
 static int
@@ -95,8 +104,18 @@ dhd_ioctl(void *dhd, int cmd, void *buf, int len, bool set)
 	int ret = 0;
 	int s;
 	/* By default try to execute wl commands */
-	int driver_magic = DHD_IOCTL_MAGIC;
-	int get_magic = DHD_GET_MAGIC;
+	int driver_magic = WLC_IOCTL_MAGIC;
+	int get_magic = WLC_GET_MAGIC;
+
+	/* For local dhd commands execute dhd. For wifi transport we still
+	 * execute wl commands.
+	 */
+	if (remote_type == NO_REMOTE && strncmp (buf, RWL_WIFI_ACTION_CMD,
+		strlen(RWL_WIFI_ACTION_CMD)) && strncmp(buf, RWL_WIFI_GET_ACTION_CMD,
+		strlen(RWL_WIFI_GET_ACTION_CMD))) {
+		driver_magic = DHD_IOCTL_MAGIC;
+		get_magic = DHD_GET_MAGIC;
+	}
 
 	/* open socket to kernel */
 	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
@@ -291,7 +310,17 @@ dhd_find(struct ifreq *ifr, char *type)
 static int
 ioctl_queryinformation_fe(void *wl, int cmd, void* input_buf, int *input_len)
 {
-	return dhd_ioctl(wl, cmd, input_buf, *input_len, FALSE);
+	if (remote_type == NO_REMOTE) {
+		return dhd_ioctl(wl, cmd, input_buf, *input_len, FALSE);
+	}
+#ifdef RWL_ENABLE
+	else {
+		return rwl_queryinformation_fe(wl, cmd, input_buf,
+			(unsigned long*)input_len, 0, RDHD_GET_IOCTL);
+	}
+#else /* RWL_ENABLE */
+	return IOCTL_ERROR;
+#endif /* RWL_ENABLE */
 }
 
 /* This function is called by wl_set to execute either local dhd command
@@ -300,17 +329,34 @@ ioctl_queryinformation_fe(void *wl, int cmd, void* input_buf, int *input_len)
 static int
 ioctl_setinformation_fe(void *wl, int cmd, void* buf, int *len)
 {
-	return dhd_ioctl(wl,  cmd, buf, *len, TRUE);
+	if (remote_type == NO_REMOTE) {
+		return dhd_ioctl(wl,  cmd, buf, *len, TRUE);
+	}
+#ifdef RWL_ENABLE
+	else {
+		return rwl_setinformation_fe(wl, cmd, buf, (unsigned long*)len, 0, RDHD_SET_IOCTL);
+
+	}
+#else /* RWL_ENABLE */
+	return IOCTL_ERROR;
+#endif /* RWL_ENABLE */
 }
 
-/* The function is replica of wl_get in wlu_linux.c. Optimize when we have some 
+/* The function is replica of wl_get in wlu_linux.c. Optimize when we have some
  * common code between wlu_linux.c and dhdu_linux.c
  */
 int
 wl_get(void *wl, int cmd, void *buf, int len)
 {
 	int error = BCME_OK;
-	error = (int)ioctl_queryinformation_fe(wl, cmd, buf, &len);
+	/* For RWL: When interfacing to a Windows client, need t add in OID_BASE */
+	if ((rwl_os_type == WIN32_OS) && (remote_type != NO_REMOTE)) {
+		error = (int)ioctl_queryinformation_fe(wl, WL_OID_BASE + cmd, buf, &len);
+	} else {
+		error = (int)ioctl_queryinformation_fe(wl, cmd, buf, &len);
+	}
+	if (error == SERIAL_PORT_ERR)
+		return SERIAL_PORT_ERR;
 
 	if (error != 0)
 		return IOCTL_ERROR;
@@ -318,7 +364,7 @@ wl_get(void *wl, int cmd, void *buf, int len)
 	return error;
 }
 
-/* The function is replica of wl_set in wlu_linux.c. Optimize when we have some 
+/* The function is replica of wl_set in wlu_linux.c. Optimize when we have some
  * common code between wlu_linux.c and dhdu_linux.c
  */
 int
@@ -326,13 +372,34 @@ wl_set(void *wl, int cmd, void *buf, int len)
 {
 	int error = BCME_OK;
 
-	error = (int)ioctl_setinformation_fe(wl, cmd, buf, &len);
+	/* For RWL: When interfacing to a Windows client, need t add in OID_BASE */
+	if ((rwl_os_type == WIN32_OS) && (remote_type != NO_REMOTE)) {
+		error = (int)ioctl_setinformation_fe(wl, WL_OID_BASE + cmd, buf, &len);
+	} else {
+		error = (int)ioctl_setinformation_fe(wl, cmd, buf, &len);
+	}
+
+	if (error == SERIAL_PORT_ERR)
+		return SERIAL_PORT_ERR;
 
 	if (error != 0) {
 		return IOCTL_ERROR;
 	}
 	return error;
 }
+
+int
+wl_validatedev(void *dev_handle)
+{
+	int retval = 1;
+	struct ifreq *ifr = (struct ifreq *)dev_handle;
+	/* validate the interface */
+	if (!ifr->ifr_name || wl_check((void *)ifr)) {
+		retval = 0;
+	}
+	return retval;
+}
+
 /* Main client function
  * The code is mostly from wlu_linux.c. This function takes care of executing remote dhd commands
  * along with the local dhd commands now.
@@ -345,9 +412,13 @@ main(int argc, char **argv)
 	int err = 0;
 	int help = 0;
 	int status = CMD_DHD;
+#ifdef RWL_SOCKET
+	struct ipv4_addr temp;
+#endif /* RWL_SOCKET */
+
 	UNUSED_PARAMETER(argc);
 
-	av0 = dhdu_av0 = argv[0];
+	av0 = argv[0];
 	memset(&ifr, 0, sizeof(ifr));
 	argv++;
 
@@ -355,8 +426,94 @@ main(int argc, char **argv)
 		if (ifname)
 			strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
 	}
+	/* Linux client looking for a Win32 server */
+	if (*argv && strncmp (*argv, "--wince", strlen(*argv)) == 0) {
+		rwl_os_type = WIN32_OS;
+		argv++;
+	}
+
+	/* RWL socket transport Usage: --socket ipaddr [port num] */
+	if (*argv && strncmp (*argv, "--socket", strlen(*argv)) == 0) {
+		argv++;
+
+		remote_type = REMOTE_SOCKET;
+#ifdef RWL_SOCKET
+		if (!(*argv)) {
+			rwl_usage(remote_type);
+			return err;
+		}
+
+		if (!dhd_atoip(*argv, &temp)) {
+			rwl_usage(remote_type);
+			return err;
+		}
+		g_rwl_servIP = *argv;
+		argv++;
+
+		g_rwl_servport = DEFAULT_SERVER_PORT;
+		if ((*argv) && isdigit(**argv)) {
+			g_rwl_servport = atoi(*argv);
+			argv++;
+		}
+#endif /* RWL_SOCKET */
+	}
+
+	/* RWL from system serial port on client to uart dongle port on server */
+	/* Usage: --dongle /dev/ttyS0 */
+	if (*argv && strncmp (*argv, "--dongle", strlen(*argv)) == 0) {
+		argv++;
+		remote_type = REMOTE_DONGLE;
+	}
 
-	err = process_args(&ifr, argv);
+	/* RWL over wifi.  Usage: --wifi mac_address */
+	if (*argv && strncmp (*argv, "--wifi", strlen(*argv)) == 0) {
+		argv++;
+#ifdef RWL_WIFI
+		remote_type = NO_REMOTE;
+		if (!ifr.ifr_name[0])
+		{
+			dhd_find(&ifr, "wl");
+		}
+		/* validate the interface */
+		if (!ifr.ifr_name[0] || wl_check((void*)&ifr)) {
+			fprintf(stderr, "%s: wl driver adapter not found\n", av0);
+			exit(1);
+		}
+		remote_type = REMOTE_WIFI;
+
+		if (argc < 4) {
+			rwl_usage(remote_type);
+			return err;
+		}
+		/* copy server mac address to local buffer for later use by findserver cmd */
+		if (!dhd_ether_atoe(*argv, (struct ether_addr *)g_rwl_buf_mac)) {
+			fprintf(stderr,
+			        "could not parse as an ethernet MAC address\n");
+			return FAIL;
+		}
+		argv++;
+#else /* RWL_WIFI */
+		remote_type = REMOTE_WIFI;
+#endif /* RWL_WIFI */
+	}
+
+	/* Process for local dhd */
+	if (remote_type == NO_REMOTE) {
+		err = process_args(&ifr, argv);
+		return err;
+	}
+
+#ifdef RWL_ENABLE
+	if (*argv) {
+		err = process_args(&ifr, argv);
+		if ((err == SERIAL_PORT_ERR) && (remote_type == REMOTE_DONGLE)) {
+			DPRINT_ERR(ERR, "\n Retry again\n");
+			err = process_args((struct ifreq*)&ifr, argv);
+		}
+		return err;
+	}
+	rwl_usage(remote_type);
+#endif /* RWL_ENABLE */
 
 	return err;
 }
@@ -374,6 +531,21 @@ process_args(struct ifreq* ifr, char **argv)
 	int err = BCME_OK;
 	cmd_t *cmd = NULL;
 	while (*argv) {
+#ifdef RWL_ENABLE
+		if ((strcmp (*argv, "sh") == 0) && (remote_type != NO_REMOTE)) {
+			argv++; /* Get the shell command */
+			if (*argv) {
+				/* Register handler in case of shell command only */
+				signal(SIGINT, ctrlc_handler);
+				err = rwl_shell_cmd_proc((void*)ifr, argv, SHELL_CMD);
+			} else {
+				DPRINT_ERR(ERR,
+				"Enter the shell command (e.g ls(Linux) or dir(Win CE) \n");
+				err = BCME_ERROR;
+			}
+			return err;
+		}
+#endif /* RWL_ENABLE */
 		if ((status = dhd_option(&argv, &ifname, &help)) == CMD_OPT) {
 			if (help)
 				break;
@@ -385,17 +557,19 @@ process_args(struct ifreq* ifr, char **argv)
 		else if (status == CMD_ERR)
 		    break;
 
+		if (remote_type == NO_REMOTE) {
 		/* use default interface */
-		if (!ifr->ifr_name[0])
-			dhd_find(ifr, "dhd");
-		/* validate the interface */
-		if (!ifr->ifr_name[0] || dhd_check((void *)ifr)) {
-		if (strcmp("dldn", *argv) != 0) {
-			fprintf(stderr, "%s: dhd driver adapter not found\n", av0);
-			exit(BCME_ERROR);
+			if (!ifr->ifr_name[0])
+				dhd_find(ifr, "dhd");
+			/* validate the interface */
+			if (!ifr->ifr_name[0] || dhd_check((void *)ifr)) {
+			if (strcmp("dldn", *argv) != 0) {
+				fprintf(stderr, "%s: dhd driver adapter not found\n", av0);
+				exit(BCME_ERROR);
+				}
 			}
-		}
 
+		}
 		/* search for command */
 		cmd = dhd_find_cmd(*argv);
 		/* if not found, use default set_var and get_var commands */
@@ -414,7 +588,7 @@ process_args(struct ifreq* ifr, char **argv)
 		if (cmd) {
 			dhd_cmd_usage(cmd);
 		} else {
-			printf("%s: Unrecognized command \"%s\", type -h for help\n",
+			DPRINT_ERR(ERR, "%s: Unrecognized command \"%s\", type -h for help\n",
 			           av0, *argv);
 		}
 	} else if (!cmd)
@@ -440,3 +614,32 @@ rwl_shell_killproc(int pid)
 	kill(pid, SIGKILL);
 }
 
+#ifdef RWL_SOCKET
+/* validate hostname/ip given by the client */
+int
+validate_server_address()
+{
+	struct hostent *he;
+	struct ipv4_addr temp;
+
+	if (!dhd_atoip(g_rwl_servIP, &temp)) {
+	/* Wrong IP address format check for hostname */
+		if ((he = gethostbyname(g_rwl_servIP)) != NULL) {
+			if (!dhd_atoip(*he->h_addr_list, &temp)) {
+				g_rwl_servIP = inet_ntoa(*(struct in_addr *)*he->h_addr_list);
+				if (g_rwl_servIP == NULL) {
+					DPRINT_ERR(ERR, "Error at inet_ntoa \n");
+					return FAIL;
+				}
+			} else {
+				DPRINT_ERR(ERR, "Error in IP address \n");
+				return FAIL;
+			}
+		} else {
+			DPRINT_ERR(ERR, "Enter correct IP address/hostname format\n");
+			return FAIL;
+		}
+	}
+	return SUCCESS;
+}
+#endif /* RWL_SOCKET */
diff --git a/bcmdhd/dhdutil/include/bcm_cfg.h b/bcmdhd/dhdutil/include/bcm_cfg.h
new file mode 100644
index 0000000..88d41d6
--- /dev/null
+++ b/bcmdhd/dhdutil/include/bcm_cfg.h
@@ -0,0 +1,23 @@
+/*
+ * BCM common config options
+ *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: bcm_cfg.h 294399 2011-11-07 03:31:22Z $
+ */
+
+#ifndef _bcm_cfg_h_
+#define _bcm_cfg_h_
+#endif 
diff --git a/bcmdhd/dhdutil/include/bcm_mpool_pub.h b/bcmdhd/dhdutil/include/bcm_mpool_pub.h
new file mode 100644
index 0000000..9f4a332
--- /dev/null
+++ b/bcmdhd/dhdutil/include/bcm_mpool_pub.h
@@ -0,0 +1,355 @@
+/*
+ * Memory pools library, Public interface
+ *
+ * API Overview
+ *
+ * This package provides a memory allocation subsystem based on pools of
+ * homogenous objects.
+ *
+ * Instrumentation is available for reporting memory utilization both
+ * on a per-data-structure basis and system wide.
+ *
+ * There are two main types defined in this API.
+ *
+ *    pool manager: A singleton object that acts as a factory for
+ *                  pool allocators. It also is used for global
+ *                  instrumentation, such as reporting all blocks
+ *                  in use across all data structures. The pool manager
+ *                  creates and provides individual memory pools
+ *                  upon request to application code.
+ *
+ *    memory pool:  An object for allocating homogenous memory blocks.
+ *
+ * Global identifiers in this module use the following prefixes:
+ *    bcm_mpm_*     Memory pool manager
+ *    bcm_mp_*      Memory pool
+ *
+ * There are two main types of memory pools:
+ *
+ *    prealloc: The contiguous memory block of objects can either be supplied
+ *              by the client or malloc'ed by the memory manager. The objects are
+ *              allocated out of a block of memory and freed back to the block.
+ *
+ *    heap:     The memory pool allocator uses the heap (malloc/free) for memory.
+ *              In this case, the pool allocator is just providing statistics
+ *              and instrumentation on top of the heap, without modifying the heap
+ *              allocation implementation.
+ *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id$
+ */
+
+#ifndef _BCM_MPOOL_PUB_H
+#define _BCM_MPOOL_PUB_H 1
+
+#include <typedefs.h> /* needed for uint16 */
+
+
+/*
+**************************************************************************
+*
+* Type definitions, handles
+*
+**************************************************************************
+*/
+
+/* Forward declaration of OSL handle. */
+struct osl_info;
+
+/* Forward declaration of string buffer. */
+struct bcmstrbuf;
+
+/*
+ * Opaque type definition for the pool manager handle. This object is used for global
+ * memory pool operations such as obtaining a new pool, deleting a pool, iterating and
+ * instrumentation/debugging.
+ */
+struct bcm_mpm_mgr;
+typedef struct bcm_mpm_mgr *bcm_mpm_mgr_h;
+
+/*
+ * Opaque type definition for an instance of a pool. This handle is used for allocating
+ * and freeing memory through the pool, as well as management/instrumentation on this
+ * specific pool.
+ */
+struct bcm_mp_pool;
+typedef struct bcm_mp_pool *bcm_mp_pool_h;
+
+
+/*
+ * To make instrumentation more readable, every memory
+ * pool must have a readable name. Pool names are up to
+ * 8 bytes including '\0' termination. (7 printable characters.)
+ */
+#define BCM_MP_NAMELEN 8
+
+
+/*
+ * Type definition for pool statistics.
+ */
+typedef struct bcm_mp_stats {
+	char name[BCM_MP_NAMELEN];  /* Name of this pool. */
+	unsigned int objsz;         /* Object size allocated in this pool */
+	uint16 nobj;                /* Total number of objects in this pool */
+	uint16 num_alloc;           /* Number of objects currently allocated */
+	uint16 high_water;          /* Max number of allocated objects. */
+	uint16 failed_alloc;        /* Failed allocations. */
+} bcm_mp_stats_t;
+
+
+/*
+**************************************************************************
+*
+* API Routines on the pool manager.
+*
+**************************************************************************
+*/
+
+/*
+ * bcm_mpm_init() - initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    osh:       INPUT  Operating system handle. Needed for heap memory allocation.
+ *    max_pools: INPUT Maximum number of mempools supported.
+ *    mgr:       OUTPUT The handle is written with the new pools manager object/handle.
+ *
+ * Returns:
+ *    BCME_OK     Object initialized successfully. May be used.
+ *    BCME_NOMEM  Initialization failed due to no memory. Object must not be used.
+ */
+int bcm_mpm_init(struct osl_info *osh, int max_pools, bcm_mpm_mgr_h *mgrp);
+
+
+/*
+ * bcm_mpm_deinit() - de-initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    mgr:     INPUT  Pointer to pool manager handle.
+ *
+ * Returns:
+ *    BCME_OK  Memory pool manager successfully de-initialized.
+ *    other    Indicated error occured during de-initialization.
+ */
+int bcm_mpm_deinit(bcm_mpm_mgr_h *mgrp);
+
+/*
+ * bcm_mpm_create_prealloc_pool() - Create a new pool for fixed size objects. The
+ *                                  pool uses a contiguous block of pre-alloced
+ *                                  memory. The memory block may either be provided
+ *                                  by the client or dynamically allocated by the
+ *                                  pool manager.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *                     Must be >= sizeof(void *).
+ *    nobj:     INPUT  Maximum number of concurrently existing objects to support
+ *    memstart  INPUT  Pointer to the memory to use, or NULL to malloc()
+ *    memsize   INPUT  Number of bytes referenced from memstart (for error checking).
+ *                     Must be 0 if 'memstart' is NULL.
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_prealloc_pool(bcm_mpm_mgr_h mgr,
+                                 unsigned int obj_sz,
+                                 int nobj,
+                                 void *memstart,
+                                 unsigned int memsize,
+                                 char poolname[BCM_MP_NAMELEN],
+                                 bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_prealloc_pool() - Delete a memory pool. This should only be called after
+ *                                  all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_prealloc_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+/*
+ * bcm_mpm_create_heap_pool() - Create a new pool for fixed size objects. The memory
+ *                              pool allocator uses the heap (malloc/free) for memory.
+ *                              In this case, the pool allocator is just providing
+ *                              statistics and instrumentation on top of the heap,
+ *                              without modifying the heap allocation implementation.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_heap_pool(bcm_mpm_mgr_h mgr, unsigned int obj_sz,
+                             char poolname[BCM_MP_NAMELEN],
+                             bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_heap_pool() - Delete a memory pool. This should only be called after
+ *                              all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_heap_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+
+/*
+ * bcm_mpm_stats() - Return stats for all pools
+ *
+ * Parameters:
+ *    mgr:         INPUT   The handle to the pools manager
+ *    stats:       OUTPUT  Array of pool statistics.
+ *    nentries:    MOD     Max elements in 'stats' array on INPUT. Actual number
+ *                         of array elements copied to 'stats' on OUTPUT.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting stats.
+ *
+ */
+int bcm_mpm_stats(bcm_mpm_mgr_h mgr, bcm_mp_stats_t *stats, int *nentries);
+
+
+/*
+ * bcm_mpm_dump() - Display statistics on all pools
+ *
+ * Parameters:
+ *    mgr:     INPUT  The handle to the pools manager
+ *    b:       OUTPUT Output buffer.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mpm_dump(bcm_mpm_mgr_h mgr, struct bcmstrbuf *b);
+
+
+/*
+ * bcm_mpm_get_obj_size() - The size of memory objects may need to be padded to
+ *                          compensate for alignment requirements of the objects.
+ *                          This function provides the padded object size. If clients
+ *                          pre-allocate a memory slab for a memory pool, the
+ *                          padded object size should be used by the client to allocate
+ *                          the memory slab (in order to provide sufficent space for
+ *                          the maximum number of objects).
+ *
+ * Parameters:
+ *    mgr:            INPUT   The handle to the pools manager.
+ *    obj_sz:         INPUT   Input object size.
+ *    padded_obj_sz:  OUTPUT  Padded object size.
+ *
+ * Returns:
+ *    BCME_OK      Ok
+ *    BCME_BADARG  Bad arguments.
+ *
+ */
+int bcm_mpm_get_obj_size(bcm_mpm_mgr_h mgr, unsigned int obj_sz, unsigned int *padded_obj_sz);
+
+
+/*
+***************************************************************************
+*
+* API Routines on a specific pool.
+*
+***************************************************************************
+*/
+
+
+/*
+ * bcm_mp_alloc() - Allocate a memory pool object.
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool.
+ *
+ * Returns:
+ *    A pointer to the new object. NULL on error.
+ *
+ */
+void* bcm_mp_alloc(bcm_mp_pool_h pool);
+
+/*
+ * bcm_mp_free() - Free a memory pool object.
+ *
+ * Parameters:
+ *    pool:  INPUT   The handle to the pool.
+ *    objp:  INPUT   A pointer to the object to free.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during free.
+ *
+ */
+int bcm_mp_free(bcm_mp_pool_h pool, void *objp);
+
+/*
+ * bcm_mp_stats() - Return stats for this pool
+ *
+ * Parameters:
+ *    pool:     INPUT    The handle to the pool
+ *    stats:    OUTPUT   Pool statistics
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting statistics.
+ *
+ */
+int bcm_mp_stats(bcm_mp_pool_h pool, bcm_mp_stats_t *stats);
+
+
+/*
+ * bcm_mp_dump() - Dump a pool
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool
+ *    b        OUTPUT   Output buffer
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mp_dump(bcm_mp_pool_h pool, struct bcmstrbuf *b);
+
+
+#endif /* _BCM_MPOOL_PUB_H */
diff --git a/bcmdhd/dhdutil/include/bcmcdc.h b/bcmdhd/dhdutil/include/bcmcdc.h
index f5fc452..5d19dab 100644
--- a/bcmdhd/dhdutil/include/bcmcdc.h
+++ b/bcmdhd/dhdutil/include/bcmcdc.h
@@ -4,7 +4,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -18,7 +18,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmcdc.h,v 13.25.10.3 2010-12-22 23:47:26 Exp $
+ * $Id: bcmcdc.h 318308 2012-03-02 02:23:42Z $
  */
 
 #ifndef _bcmcdc_h_
@@ -64,26 +64,44 @@ typedef struct cdc_ioctl {
 
 
 
-#define	BDC_HEADER_LEN		4
+struct bdc_header {
+	uint8	flags;			
+	uint8	priority;		
+	uint8	flags2;
+	uint8	dataOffset;		
+};
 
-#define BDC_PROTO_VER_1		1
-#define BDC_PROTO_VER		2
+#define	BDC_HEADER_LEN		4
 
-#define BDC_FLAG_VER_MASK	0xf0
-#define BDC_FLAG_VER_SHIFT	4
 
-#define BDC_FLAG__UNUSED	0x03
-#define BDC_FLAG_SUM_GOOD	0x04
-#define BDC_FLAG_SUM_NEEDED	0x08
+#define BDC_FLAG_80211_PKT	0x01	
+#define BDC_FLAG_SUM_GOOD	0x04	
+#define BDC_FLAG_SUM_NEEDED	0x08	
+#define BDC_FLAG_EVENT_MSG	0x08	
+#define BDC_FLAG_VER_MASK	0xf0	
+#define BDC_FLAG_VER_SHIFT	4	
 
-#define BDC_PRIORITY_MASK	0x7
 
-#define BDC_FLAG2_FC_FLAG	0x10
+#define BDC_PRIORITY_MASK	0x07
+#define BDC_PRIORITY_FC_MASK	0xf0	
+#define BDC_PRIORITY_FC_SHIFT	4	
 
-#define BDC_PRIORITY_FC_SHIFT	4
 
-#define BDC_FLAG2_IF_MASK	0x0f
+#define BDC_FLAG2_IF_MASK	0x0f	
 #define BDC_FLAG2_IF_SHIFT	0
+#define BDC_FLAG2_FC_FLAG	0x10	
+					
+
+
+#define BDC_PROTO_VER_1		1	
+#define BDC_PROTO_VER		2	
+
+
+#define BDC_GET_IF_IDX(hdr) \
+	((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+	((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
+
 #define BDC_FLAG2_PAD_MASK		0xf0
 #define BDC_FLAG_PAD_MASK		0x03
 #define BDC_FLAG2_PAD_SHIFT		2
@@ -99,16 +117,4 @@ typedef struct cdc_ioctl {
 	((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \
 	(((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT)))
 
-#define BDC_GET_IF_IDX(hdr) \
-	((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
-#define BDC_SET_IF_IDX(hdr, idx) \
-	((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
-
-struct bdc_header {
-	uint8	flags;
-	uint8	priority;
-	uint8	flags2;
-	uint8	dataOffset;
-};
-
 #endif
diff --git a/bcmdhd/dhdutil/include/bcmdefs.h b/bcmdhd/dhdutil/include/bcmdefs.h
index c8c68b4..44634a1 100644
--- a/bcmdhd/dhdutil/include/bcmdefs.h
+++ b/bcmdhd/dhdutil/include/bcmdefs.h
@@ -1,7 +1,7 @@
 /*
  * Misc system wide definitions
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmdefs.h,v 13.68.2.8 2011-01-08 04:04:19 Exp $
+ * $Id: bcmdefs.h 316830 2012-02-23 20:29:22Z $
  */
 
 #ifndef	_bcmdefs_h_
@@ -23,22 +23,45 @@
 
 
 
+
+#define BCM_REFERENCE(data)	((void)(data))
+
+
+#define STATIC_ASSERT(expr) { \
+	 \
+	typedef enum { _STATIC_ASSERT_NOT_CONSTANT = (expr) } _static_assert_e; \
+	 \
+	typedef char STATIC_ASSERT_FAIL[(expr) ? 1 : -1]; \
+}
+
+
 #define bcmreclaimed 		0
 #define _data	_data
 #define _fn	_fn
+#define BCMPREATTACHDATA(_data)	_data
+#define BCMPREATTACHFN(_fn)	_fn
 #define _data	_data
 #define _fn		_fn
 #define _fn	_fn
+#define	BCMNMIATTACHFN(_fn)	_fn
+#define	BCMNMIATTACHDATA(_data)	_data
 #define CONST	const
+#ifndef BCMFASTPATH
 #define BCMFASTPATH
-
+#define BCMFASTPATH_HOST
+#endif 
 
 
 
 #define _data	_data
+#define BCMROMDAT_NAME(_data)	_data
 #define _fn		_fn
 #define _fn	_fn
 #define STATIC	static
+#define BCMROMDAT_ARYSIZ(data)	ARRAYSIZE(data)
+#define BCMROMDAT_SIZEOF(data)	sizeof(data)
+#define BCMROMDAT_APATCH(data)
+#define BCMROMDAT_SPATCH(data)
 
 
 #define	SI_BUS			0
@@ -153,12 +176,22 @@ typedef struct {
 #endif
 
 
+#ifndef SDALIGN
+#define SDALIGN	32
+#endif
+
+
 #define BCMDONGLEHDRSZ 12
 #define BCMDONGLEPADSZ 16
 
 #define BCMDONGLEOVERHEAD	(BCMDONGLEHDRSZ + BCMDONGLEPADSZ)
 
 
+#if defined(NO_BCMDBG_ASSERT)
+# undef BCMDBG_ASSERT
+# undef BCMASSERT_LOG
+#endif
+
 #if defined(BCMASSERT_LOG)
 #define BCMASSERT_SUPPORT
 #endif
@@ -184,6 +217,15 @@ typedef struct {
 
 #define	MAXSZ_NVRAM_VARS	4096
 
-#define LOCATOR_EXTERN static
 
+#ifdef DL_NVRAM
+#define NVRAM_ARRAY_MAXSIZE	DL_NVRAM
+#else
+#define NVRAM_ARRAY_MAXSIZE	MAXSZ_NVRAM_VARS
+#endif 
+
+#ifdef BCMUSBDEV_ENABLED
+extern uint32 gFWID;
 #endif
+
+#endif 
diff --git a/bcmdhd/dhdutil/include/bcmdevs.h b/bcmdhd/dhdutil/include/bcmdevs.h
index 85a4559..27b25a4 100644
--- a/bcmdhd/dhdutil/include/bcmdevs.h
+++ b/bcmdhd/dhdutil/include/bcmdevs.h
@@ -1,7 +1,7 @@
 /*
  * Broadcom device-specific manifest constants.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmdevs.h,v 13.285.2.39 2011-02-04 05:03:16 Exp $
+ * $Id: bcmdevs.h 329854 2012-04-27 01:42:28Z $
  */
 
 
@@ -25,9 +25,18 @@
 
 #define	VENDOR_EPIGRAM		0xfeda
 #define	VENDOR_BROADCOM		0x14e4
-#define VENDOR_SI_IMAGE		0x1095
-#define VENDOR_TI		0x104c
-#define VENDOR_RICOH		0x1180
+#define	VENDOR_3COM		0x10b7
+#define	VENDOR_NETGEAR		0x1385
+#define	VENDOR_DIAMOND		0x1092
+#define	VENDOR_INTEL		0x8086
+#define	VENDOR_DELL		0x1028
+#define	VENDOR_HP		0x103c
+#define	VENDOR_HP_COMPAQ	0x0e11
+#define	VENDOR_APPLE		0x106b
+#define VENDOR_SI_IMAGE		0x1095		
+#define VENDOR_BUFFALO		0x1154		
+#define VENDOR_TI		0x104c		
+#define VENDOR_RICOH		0x1180		
 #define VENDOR_JMICRON		0x197b
 
 
@@ -45,12 +54,43 @@
 #define BCM_DNGL_BL_PID_43236   0xbd17
 #define BCM_DNGL_BL_PID_4332	0xbd18
 #define BCM_DNGL_BL_PID_4330	0xbd19
+#define BCM_DNGL_BL_PID_4334	0xbd1a
 #define BCM_DNGL_BL_PID_43239   0xbd1b
+#define BCM_DNGL_BL_PID_4324	0xbd1c
+#define BCM_DNGL_BL_PID_4360	0xbd1d
+
 #define BCM_DNGL_BDC_PID	0x0bdc
 #define BCM_DNGL_JTAG_PID	0x4a44
-#define	BCM4325_D11DUAL_ID	0x431b
-#define	BCM4325_D11G_ID		0x431c
-#define	BCM4325_D11A_ID		0x431d
+
+#define BCM_HWUSB_PID_43239     43239
+
+
+#define	BCM4210_DEVICE_ID	0x1072		
+#define	BCM4230_DEVICE_ID	0x1086		
+#define	BCM4401_ENET_ID		0x170c		
+#define	BCM3352_DEVICE_ID	0x3352		
+#define	BCM3360_DEVICE_ID	0x3360		
+#define	BCM4211_DEVICE_ID	0x4211
+#define	BCM4231_DEVICE_ID	0x4231
+#define	BCM4303_D11B_ID		0x4303		
+#define	BCM4311_D11G_ID		0x4311		
+#define	BCM4311_D11DUAL_ID	0x4312		
+#define	BCM4311_D11A_ID		0x4313		
+#define	BCM4328_D11DUAL_ID	0x4314		
+#define	BCM4328_D11G_ID		0x4315		
+#define	BCM4328_D11A_ID		0x4316		
+#define	BCM4318_D11G_ID		0x4318		
+#define	BCM4318_D11DUAL_ID	0x4319		
+#define	BCM4318_D11A_ID		0x431a		
+#define	BCM4325_D11DUAL_ID	0x431b		
+#define	BCM4325_D11G_ID		0x431c		
+#define	BCM4325_D11A_ID		0x431d		
+#define	BCM4306_D11G_ID		0x4320		
+#define	BCM4306_D11A_ID		0x4321		
+#define	BCM4306_UART_ID		0x4322		
+#define	BCM4306_V90_ID		0x4323		
+#define	BCM4306_D11DUAL_ID	0x4324		
+#define	BCM4306_D11G_ID2	0x4325		
 #define	BCM4321_D11N_ID		0x4328
 #define	BCM4321_D11N2G_ID	0x4329
 #define	BCM4321_D11N5G_ID	0x432a
@@ -95,82 +135,355 @@
 #define BCM43228_D11N5G_ID	0x435a
 #define BCM43362_D11N_ID	0x4363
 #define BCM43239_D11N_ID	0x4370
+#define BCM4324_D11N_ID		0x4374		
+#define BCM43217_D11N2G_ID	0x43a9		
+#define BCM43131_D11N2G_ID	0x43aa		
+#define BCM4314_D11N2G_ID	0x4364		
+#define BCM43142_D11N2G_ID	0x4365		
+#define BCM4334_D11N_ID		0x4380		
+#define BCM4334_D11N2G_ID	0x4381		
+#define BCM4334_D11N5G_ID	0x4382		
+#define BCM43341_D11N_ID	0x4386		
+#define BCM43341_D11N2G_ID	0x4387		
+#define BCM43341_D11N5G_ID	0x4388		
+#define BCM4360_D11AC_ID	0x43a0
+#define BCM4360_D11AC2G_ID	0x43a1
+#define BCM4360_D11AC5G_ID	0x43a2
+
+
+#define BCM943228HMB_SSID_VEN1	0x0607
+#define BCM94313HMGBL_SSID_VEN1	0x0608
+#define BCM94313HMG_SSID_VEN1	0x0609
+
+
+#define BCM4335_D11AC_ID	0x43ae
+#define BCM4335_D11AC2G_ID	0x43af
+#define BCM4335_D11AC5G_ID	0x43b0
+#define BCM4352_D11AC_ID	0x43b1		
+#define BCM4352_D11AC2G_ID	0x43b2		
+#define BCM4352_D11AC5G_ID	0x43b3		
+
+#define	BCMGPRS_UART_ID		0x4333		
+#define	BCMGPRS2_UART_ID	0x4344		
+#define FPGA_JTAGM_ID		0x43f0		
+#define BCM_JTAGM_ID		0x43f1		
+#define SDIOH_FPGA_ID		0x43f2		
+#define BCM_SDIOH_ID		0x43f3		
+#define SDIOD_FPGA_ID		0x43f4		
+#define SPIH_FPGA_ID		0x43f5		
+#define BCM_SPIH_ID		0x43f6		
+#define MIMO_FPGA_ID		0x43f8		
+#define BCM_JTAGM2_ID		0x43f9		
+#define SDHCI_FPGA_ID		0x43fa		
+#define	BCM4402_ENET_ID		0x4402		
+#define	BCM4402_V90_ID		0x4403		
+#define	BCM4410_DEVICE_ID	0x4410		
+#define	BCM4412_DEVICE_ID	0x4412		
+#define	BCM4430_DEVICE_ID	0x4430		
+#define	BCM4432_DEVICE_ID	0x4432		
+#define	BCM4704_ENET_ID		0x4706		
+#define	BCM4710_DEVICE_ID	0x4710		
+#define	BCM47XX_AUDIO_ID	0x4711		
+#define	BCM47XX_V90_ID		0x4712		
+#define	BCM47XX_ENET_ID		0x4713		
+#define	BCM47XX_EXT_ID		0x4714		
+#define	BCM47XX_GMAC_ID		0x4715		
+#define	BCM47XX_USBH_ID		0x4716		
+#define	BCM47XX_USBD_ID		0x4717		
+#define	BCM47XX_IPSEC_ID	0x4718		
+#define	BCM47XX_ROBO_ID		0x4719		
+#define	BCM47XX_USB20H_ID	0x471a		
+#define	BCM47XX_USB20D_ID	0x471b		
+#define	BCM47XX_ATA100_ID	0x471d		
+#define	BCM47XX_SATAXOR_ID	0x471e		
+#define	BCM47XX_GIGETH_ID	0x471f		
+#define	BCM4712_MIPS_ID		0x4720		
+#define	BCM4716_DEVICE_ID	0x4722		
+#define BCM47XX_SMBUS_EMU_ID	0x47fe		
+#define	BCM47XX_XOR_EMU_ID	0x47ff		
+#define	EPI41210_DEVICE_ID	0xa0fa		
+#define	EPI41230_DEVICE_ID	0xa10e		
+#define JINVANI_SDIOH_ID	0x4743		
+#define BCM27XX_SDIOH_ID	0x2702		
+#define PCIXX21_FLASHMEDIA_ID	0x803b		
+#define PCIXX21_SDIOH_ID	0x803c		
+#define R5C822_SDIOH_ID		0x0822		
+#define JMICRON_SDIOH_ID	0x2381		
+
+
+#define	BCM4306_CHIP_ID		0x4306		
+#define	BCM4311_CHIP_ID		0x4311		
+#define	BCM43111_CHIP_ID	43111		
+#define	BCM43112_CHIP_ID	43112		
+#define	BCM4312_CHIP_ID		0x4312		
+#define BCM4313_CHIP_ID		0x4313		
+#define	BCM43131_CHIP_ID	43131		
+#define	BCM4315_CHIP_ID		0x4315		
+#define	BCM4318_CHIP_ID		0x4318		
+#define	BCM4319_CHIP_ID		0x4319		
+#define	BCM4320_CHIP_ID		0x4320		
+#define	BCM4321_CHIP_ID		0x4321		
+#define	BCM43217_CHIP_ID	43217		
+#define	BCM4322_CHIP_ID		0x4322		
+#define	BCM43221_CHIP_ID	43221		
+#define	BCM43222_CHIP_ID	43222		
+#define	BCM43224_CHIP_ID	43224		
+#define	BCM43225_CHIP_ID	43225		
+#define	BCM43227_CHIP_ID	43227		
+#define	BCM43228_CHIP_ID	43228		
+#define	BCM43226_CHIP_ID	43226		
+#define	BCM43231_CHIP_ID	43231		
+#define	BCM43234_CHIP_ID	43234		
+#define	BCM43235_CHIP_ID	43235		
+#define	BCM43236_CHIP_ID	43236		
+#define	BCM43237_CHIP_ID	43237		
+#define	BCM43238_CHIP_ID	43238		
+#define	BCM43239_CHIP_ID	43239		
+#define	BCM43420_CHIP_ID	43420		
+#define	BCM43421_CHIP_ID	43421		
+#define	BCM43428_CHIP_ID	43428		
+#define	BCM43431_CHIP_ID	43431		
+#define	BCM43460_CHIP_ID	43460		
+#define	BCM4325_CHIP_ID		0x4325		
+#define	BCM4328_CHIP_ID		0x4328		
+#define	BCM4329_CHIP_ID		0x4329		
+#define	BCM4331_CHIP_ID		0x4331		
+#define BCM4336_CHIP_ID		0x4336		
+#define BCM43362_CHIP_ID	43362		
+#define BCM4330_CHIP_ID		0x4330		
+#define BCM6362_CHIP_ID		0x6362		
+#define BCM4314_CHIP_ID		0x4314		
+#define BCM43142_CHIP_ID	43142		
+#define	BCM4324_CHIP_ID		0x4324		
+#define	BCM43242_CHIP_ID	43242		
+#define BCM4334_CHIP_ID		0x4334		
+#define BCM4360_CHIP_ID		0x4360          
+#define BCM4352_CHIP_ID		0x4352          
+#define BCM43526_CHIP_ID	0xAA06
+#define BCM43341_CHIP_ID	43341		
+#define BCM43342_CHIP_ID	43342		
+
+#define BCM4335_CHIP_ID         0x4335
+
+#define	BCM4342_CHIP_ID		4342		
+#define	BCM4402_CHIP_ID		0x4402		
+#define	BCM4704_CHIP_ID		0x4704		
+#define	BCM4706_CHIP_ID		0x5300		
+#define	BCM4710_CHIP_ID		0x4710		
+#define	BCM4712_CHIP_ID		0x4712		
+#define	BCM4716_CHIP_ID		0x4716		
+#define	BCM47162_CHIP_ID	47162		
+#define	BCM4748_CHIP_ID		0x4748		
+#define	BCM4749_CHIP_ID		0x4749		
+#define BCM4785_CHIP_ID		0x4785		
+#define	BCM5350_CHIP_ID		0x5350		
+#define	BCM5352_CHIP_ID		0x5352		
+#define	BCM5354_CHIP_ID		0x5354		
+#define BCM5365_CHIP_ID		0x5365		
+#define	BCM5356_CHIP_ID		0x5356		
+#define	BCM5357_CHIP_ID		0x5357		
+#define	BCM53572_CHIP_ID	53572		
+
+
+#define	BCM4303_PKG_ID		2		
+#define	BCM4309_PKG_ID		1		
+#define	BCM4712LARGE_PKG_ID	0		
+#define	BCM4712SMALL_PKG_ID	1		
+#define	BCM4712MID_PKG_ID	2		
+#define BCM4328USBD11G_PKG_ID	2		
+#define BCM4328USBDUAL_PKG_ID	3		
+#define BCM4328SDIOD11G_PKG_ID	4		
+#define BCM4328SDIODUAL_PKG_ID	5		
+#define BCM4329_289PIN_PKG_ID	0		
+#define BCM4329_182PIN_PKG_ID	1		
+#define BCM5354E_PKG_ID		1		
+#define	BCM4716_PKG_ID		8		
+#define	BCM4717_PKG_ID		9		
+#define	BCM4718_PKG_ID		10		
+#define BCM5356_PKG_NONMODE	1		
+#define BCM5358U_PKG_ID		8		
+#define BCM5358_PKG_ID		9		
+#define BCM47186_PKG_ID		10		
+#define BCM5357_PKG_ID		11		
+#define BCM5356U_PKG_ID		12		
+#define BCM53572_PKG_ID		8		
+#define BCM5357C0_PKG_ID	8		
+#define BCM47188_PKG_ID		9		
+#define BCM5358C0_PKG_ID	0xa		
+#define BCM5356C0_PKG_ID	0xb		
+#define BCM4331TT_PKG_ID        8		
+#define BCM4331TN_PKG_ID        9		
+#define BCM4331TNA0_PKG_ID     0xb		
+#define	BCM4706L_PKG_ID		1		
+
+#define HDLSIM5350_PKG_ID	1		
+#define HDLSIM_PKG_ID		14		
+#define HWSIM_PKG_ID		15		
+#define BCM43224_FAB_CSM	0x8		
+#define BCM43224_FAB_SMIC	0xa		
+#define BCM4336_WLBGA_PKG_ID	0x8
+#define BCM4330_WLBGA_PKG_ID	0x0
+#define BCM4314PCIE_ARM_PKG_ID		(8 | 0)	
+#define BCM4314SDIO_PKG_ID		(8 | 1)	
+#define BCM4314PCIE_PKG_ID		(8 | 2)	
+#define BCM4314SDIO_ARM_PKG_ID		(8 | 3)	
+#define BCM4314SDIO_FPBGA_PKG_ID	(8 | 4)	
+#define BCM4314DEV_PKG_ID		(8 | 6)	
+
+#define PCIXX21_FLASHMEDIA0_ID	0x8033		
+#define PCIXX21_SDIOH0_ID	0x8034		
+
+
+#define	BFL_BTC2WIRE		0x00000001  
+#define BFL_BTCOEX      0x00000001      
+#define	BFL_PACTRL		0x00000002  
+#define BFL_AIRLINEMODE	0x00000004  
+#define	BFL_ADCDIV		0x00000008  
+#define	BFL_RFPLL	        0x00000008  
+#define	BFL_ENETROBO		0x00000010  
+#define	BFL_NOPLLDOWN		0x00000020  
+#define	BFL_CCKHIPWR		0x00000040  
+#define	BFL_ENETADM		0x00000080  
+#define	BFL_ENETVLAN		0x00000100  
+#define	BFL_UNUSED		0x00000200
+#define BFL_NOPCI		0x00000400  
+#define BFL_FEM			0x00000800  
+#define BFL_EXTLNA		0x00001000  
+#define BFL_HGPA		0x00002000  
+#define	BFL_BTC2WIRE_ALTGPIO	0x00004000  
+#define	BFL_ALTIQ		0x00008000  
+#define BFL_NOPA		0x00010000  
+#define BFL_RSSIINV		0x00020000  
+#define BFL_PAREF		0x00040000  
+#define BFL_3TSWITCH		0x00080000  
+#define BFL_PHASESHIFT		0x00100000  
+#define BFL_BUCKBOOST		0x00200000  
+#define BFL_FEM_BT		0x00400000  
+#define BFL_NOCBUCK		0x00800000  
+#define BFL_CCKFAVOREVM		0x01000000  
+#define BFL_PALDO		0x02000000  
+#define BFL_LNLDO2_2P5		0x04000000  
+#define BFL_FASTPWR		0x08000000
+#define BFL_UCPWRCTL_MININDX	0x08000000  
+#define BFL_EXTLNA_5GHz		0x10000000  
+#define BFL_TRSW_1by2		0x20000000  
+#define BFL_LO_TRSW_R_5GHz	0x40000000  
+#define BFL_ELNA_GAINDEF	0x80000000  
+#define BFL_EXTLNA_TX	0x20000000	
+
+
+#define BFL2_RXBB_INT_REG_DIS	0x00000001  
+#define BFL2_APLL_WAR		0x00000002  
+#define BFL2_TXPWRCTRL_EN	0x00000004  
+#define BFL2_2X4_DIV		0x00000008  
+#define BFL2_5G_PWRGAIN		0x00000010  
+#define BFL2_PCIEWAR_OVR	0x00000020  
+#define BFL2_CAESERS_BRD	0x00000040  
+#define BFL2_BTC3WIRE		0x00000080  
+#define BFL2_BTCLEGACY          0x00000080  
+#define BFL2_SKWRKFEM_BRD	0x00000100  
+#define BFL2_SPUR_WAR		0x00000200  
+#define BFL2_GPLL_WAR		0x00000400  
+#define BFL2_TRISTATE_LED	0x00000800  
+#define BFL2_SINGLEANT_CCK	0x00001000  
+#define BFL2_2G_SPUR_WAR	0x00002000  
+#define BFL2_BPHY_ALL_TXCORES	0x00004000  
+#define BFL2_FCC_BANDEDGE_WAR	0x00008000  
+#define BFL2_GPLL_WAR2	        0x00010000  
+#define BFL2_IPALVLSHIFT_3P3    0x00020000
+#define BFL2_INTERNDET_TXIQCAL  0x00040000  
+#define BFL2_XTALBUFOUTEN       0x00080000  
+				
+				
+
+#define BFL2_ANAPACTRL_2G	0x00100000  
+#define BFL2_ANAPACTRL_5G	0x00200000  
+#define BFL2_ELNACTRL_TRSW_2G	0x00400000  
+#define BFL2_BT_SHARE_ANT0	0x00800000  
+#define BFL2_TEMPSENSE_HIGHER	0x01000000  
+#define BFL2_BTC3WIREONLY       0x02000000  
+#define BFL2_PWR_NOMINAL	0x04000000  
+#define BFL2_EXTLNA_PWRSAVE	0x08000000  
+						
+#define BFL2_4313_RADIOREG	0x10000000
+									   
+#define BFL2_SDR_EN		0x20000000	
+
+
+#define	BOARD_GPIO_BTC3W_IN	0x850	
+#define	BOARD_GPIO_BTC3W_OUT	0x020	
+#define	BOARD_GPIO_BTCMOD_IN	0x010	
+#define	BOARD_GPIO_BTCMOD_OUT	0x020	
+#define	BOARD_GPIO_BTC_IN	0x080	
+#define	BOARD_GPIO_BTC_OUT	0x100	
+#define	BOARD_GPIO_PACTRL	0x200	
+#define BOARD_GPIO_12		0x1000	
+#define BOARD_GPIO_13		0x2000	
+#define BOARD_GPIO_BTC4_IN	0x0800	
+#define BOARD_GPIO_BTC4_BT	0x2000	
+#define BOARD_GPIO_BTC4_STAT	0x4000	
+#define BOARD_GPIO_BTC4_WLAN	0x8000	
+#define	BOARD_GPIO_1_WLAN_PWR	0x02	
+#define	BOARD_GPIO_3_WLAN_PWR	0x08	
+#define	BOARD_GPIO_4_WLAN_PWR	0x10	
+
+#define GPIO_BTC4W_OUT_4312  0x010  
+#define GPIO_BTC4W_OUT_43224  0x020  
+#define GPIO_BTC4W_OUT_43224_SHARED  0x0e0  
+#define GPIO_BTC4W_OUT_43225  0x0e0  
+#define GPIO_BTC4W_OUT_43421  0x020  
+#define GPIO_BTC4W_OUT_4313  0x060  
+#define GPIO_BTC4W_OUT_4331_SHARED  0x010  
+
+#define	PCI_CFG_GPIO_SCS	0x10	
+#define PCI_CFG_GPIO_HWRAD	0x20	
+#define PCI_CFG_GPIO_XTAL	0x40	
+#define PCI_CFG_GPIO_PLL	0x80	
+
+
+#define PLL_DELAY		150		
+#define FREF_DELAY		200		
+#define MIN_SLOW_CLK		32		
+#define	XTAL_ON_DELAY		1000		
+
+
+
+#define BCM943341WLABGS_SSID	0x062d
+
+
+#define GPIO_NUMPINS		32
+
+
+#define RDL_RAM_BASE_4319 0x60000000
+#define RDL_RAM_BASE_4329 0x60000000
+#define RDL_RAM_SIZE_4319 0x48000
+#define RDL_RAM_SIZE_4329  0x48000
+#define RDL_RAM_SIZE_43236 0x70000
+#define RDL_RAM_BASE_43236 0x60000000
+#define RDL_RAM_SIZE_4328 0x60000
+#define RDL_RAM_BASE_4328 0x80000000
+#define RDL_RAM_SIZE_4322 0x60000
+#define RDL_RAM_BASE_4322 0x60000000
+
+
+#define MUXENAB_UART		0x00000001
+#define MUXENAB_GPIO		0x00000002
+#define MUXENAB_ERCX		0x00000004	
+#define MUXENAB_JTAG		0x00000008
+#define MUXENAB_HOST_WAKE	0x00000010	
+#define MUXENAB_I2S_EN		0x00000020
+#define MUXENAB_I2S_MASTER	0x00000040
+#define MUXENAB_I2S_FULL	0x00000080
+#define MUXENAB_SFLASH		0x00000100
+#define MUXENAB_RFSWCTRL0	0x00000200
+#define MUXENAB_RFSWCTRL1	0x00000400
+#define MUXENAB_RFSWCTRL2	0x00000800
+#define MUXENAB_SECI		0x00001000
+#define MUXENAB_BT_LEGACY	0x00002000
+#define MUXENAB_HOST_WAKE1	0x00004000	
 
 
-#define SDIOH_FPGA_ID		0x43f2
-#define SPIH_FPGA_ID		0x43f5
-#define	BCM4710_DEVICE_ID	0x4710
-#define BCM27XX_SDIOH_ID	0x2702
-#define PCIXX21_FLASHMEDIA0_ID	0x8033
-#define PCIXX21_SDIOH0_ID	0x8034
-#define PCIXX21_FLASHMEDIA_ID	0x803b
-#define PCIXX21_SDIOH_ID	0x803c
-#define R5C822_SDIOH_ID		0x0822
-#define JMICRON_SDIOH_ID	0x2381
-
-
-#define	BCM4306_CHIP_ID		0x4306
-#define	BCM4311_CHIP_ID		0x4311
-#define	BCM43111_CHIP_ID	43111
-#define	BCM43112_CHIP_ID	43112
-#define	BCM4312_CHIP_ID		0x4312
-#define BCM4313_CHIP_ID		0x4313
-#define	BCM4315_CHIP_ID		0x4315
-#define	BCM4318_CHIP_ID		0x4318
-#define	BCM4319_CHIP_ID		0x4319
-#define	BCM4320_CHIP_ID		0x4320
-#define	BCM4321_CHIP_ID		0x4321
-#define	BCM4322_CHIP_ID		0x4322
-#define	BCM43221_CHIP_ID	43221
-#define	BCM43222_CHIP_ID	43222
-#define	BCM43224_CHIP_ID	43224
-#define	BCM43225_CHIP_ID	43225
-#define	BCM43227_CHIP_ID	43227
-#define	BCM43228_CHIP_ID	43228
-#define	BCM43226_CHIP_ID	43226
-#define	BCM43231_CHIP_ID	43231
-#define	BCM43234_CHIP_ID	43234
-#define	BCM43235_CHIP_ID	43235
-#define	BCM43236_CHIP_ID	43236
-#define	BCM43237_CHIP_ID	43237
-#define	BCM43238_CHIP_ID	43238
-#define	BCM43239_CHIP_ID	43239
-#define	BCM43420_CHIP_ID	43420
-#define	BCM43421_CHIP_ID	43421
-#define	BCM43428_CHIP_ID	43428
-#define	BCM43431_CHIP_ID	43431
-#define	BCM4325_CHIP_ID		0x4325
-#define	BCM4328_CHIP_ID		0x4328
-#define	BCM4329_CHIP_ID		0x4329
-#define	BCM4331_CHIP_ID		0x4331
-#define BCM4336_CHIP_ID		0x4336
-#define BCM43362_CHIP_ID	43362
-#define BCM4330_CHIP_ID		0x4330
-#define	BCM4402_CHIP_ID		0x4402
-#define	BCM4704_CHIP_ID		0x4704
-#define	BCM4710_CHIP_ID		0x4710
-#define	BCM4712_CHIP_ID		0x4712
-#define BCM4785_CHIP_ID		0x4785
-#define	BCM5350_CHIP_ID		0x5350
-#define	BCM5352_CHIP_ID		0x5352
-#define	BCM5354_CHIP_ID		0x5354
-#define BCM5365_CHIP_ID		0x5365
-
-
-#define	BCM4303_PKG_ID		2
-#define	BCM4309_PKG_ID		1
-#define	BCM4712LARGE_PKG_ID	0
-#define	BCM4712SMALL_PKG_ID	1
-#define	BCM4712MID_PKG_ID	2
-#define BCM4328USBD11G_PKG_ID	2
-#define BCM4328USBDUAL_PKG_ID	3
-#define BCM4328SDIOD11G_PKG_ID	4
-#define BCM4328SDIODUAL_PKG_ID	5
-#define BCM4329_289PIN_PKG_ID	0
-#define BCM4329_182PIN_PKG_ID	1
-#define BCM5354E_PKG_ID		1
-#define HDLSIM5350_PKG_ID	1
-#define HDLSIM_PKG_ID		14
-#define HWSIM_PKG_ID		15
+#define FLASH_KERNEL_NFLASH	0x00000001
+#define FLASH_BOOT_NFLASH	0x00000002
 
 #endif
diff --git a/bcmdhd/dhdutil/include/bcmutils.h b/bcmdhd/dhdutil/include/bcmutils.h
index 3b823a1..a493c53 100644
--- a/bcmdhd/dhdutil/include/bcmutils.h
+++ b/bcmdhd/dhdutil/include/bcmutils.h
@@ -1,7 +1,7 @@
 /*
  * Misc useful os-independent macros and functions.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,15 +15,12 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: bcmutils.h,v 13.236.2.16 2011-01-26 00:45:06 Exp $
+ * $Id: bcmutils.h 347624 2012-07-27 10:49:56Z $
  */
 
-
 #ifndef	_bcmutils_h_
 #define	_bcmutils_h_
 
-#include <stddef.h>
-
 #define bcm_strcpy_s(dst, noOfElements, src)            strcpy((dst), (src))
 #define bcm_strncpy_s(dst, noOfElements, src, count)    strncpy((dst), (src), (count))
 #define bcm_strcat_s(dst, noOfElements, src)            strcat((dst), (src))
@@ -32,6 +29,10 @@
 extern "C" {
 #endif
 
+#ifdef PKTQ_LOG
+#include <wlioctl.h>
+#endif
+
 
 #define _BCM_U	0x01
 #define _BCM_L	0x02
@@ -98,24 +99,46 @@ typedef struct pktq_prec {
 	uint16 max;
 } pktq_prec_t;
 
+#ifdef PKTQ_LOG
+typedef struct {
+	uint32 requested;    
+	uint32 stored;	     
+	uint32 saved;	     
+	uint32 selfsaved;    
+	uint32 full_dropped; 
+	uint32 dropped;      
+	uint32 sacrificed;   
+	uint32 busy;         
+	uint32 retry;        
+	uint32 ps_retry;     
+	uint32 retry_drop;   
+	uint32 max_avail;    
+	uint32 max_used;     
+	uint32 queue_capacity; 
+} pktq_counters_t;
+#endif 
+
+
+#define PKTQ_COMMON	\
+	uint16 num_prec;        			\
+	uint16 hi_prec;         	\
+	uint16 max;             					\
+	uint16 len;             
 
 
 struct pktq {
-	uint16 num_prec;
-	uint16 hi_prec;
-	uint16 max;
-	uint16 len;
-
+	PKTQ_COMMON
+	
 	struct pktq_prec q[PKTQ_MAX_PREC];
+#ifdef PKTQ_LOG
+	pktq_counters_t	_prec_cnt[PKTQ_MAX_PREC];		
+#endif
 };
 
 
 struct spktq {
-	uint16 num_prec;
-	uint16 hi_prec;
-	uint16 max;
-	uint16 len;
-
+	PKTQ_COMMON
+	
 	struct pktq_prec q[1];
 };
 
@@ -136,7 +159,9 @@ typedef bool (*ifpkt_cb_t)(void*, int);
 #define SHARED_POOL		((struct pktpool *)NULL)
 #endif
 
+#ifndef PKTPOOL_LEN_MAX
 #define PKTPOOL_LEN_MAX		40
+#endif 
 #define PKTPOOL_CB_MAX		3
 
 struct pktpool;
@@ -187,6 +212,7 @@ typedef struct pktpool {
 	uint8 cbcnt;
 	uint8 ecbcnt;
 	bool emptycb_disable;
+	pktpool_cbinfo_t *availcb_excl;
 	pktpool_cbinfo_t cbs[PKTPOOL_CB_MAX];
 	pktpool_cbinfo_t ecbs[PKTPOOL_CB_MAX];
 	void *q[PKTPOOL_LEN_MAX + 1];
@@ -212,10 +238,14 @@ extern void* pktpool_get(pktpool_t *pktp);
 extern void pktpool_free(pktpool_t *pktp, void *p);
 extern int pktpool_add(pktpool_t *pktp, void *p);
 extern uint16 pktpool_avail(pktpool_t *pktp);
+extern int pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb);
 extern int pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
 extern int pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
 extern int pktpool_setmaxlen(pktpool_t *pktp, uint16 maxlen);
+extern int pktpool_setmaxlen_strict(osl_t *osh, pktpool_t *pktp, uint16 maxlen);
 extern void pktpool_emptycb_disable(pktpool_t *pktp, bool disable);
+extern bool pktpool_emptycb_disabled(pktpool_t *pktp);
 
 #define POOLPTR(pp)			((pktpool_t *)(pp))
 #define pktpool_len(pp)			(POOLPTR(pp)->len - 1)
@@ -239,18 +269,20 @@ extern int ether_isnulladdr(const void *ea);
 
 
 
-#define pktq_psetmax(pq, prec, _max)    ((pq)->q[prec].max = (_max))
-#define pktq_plen(pq, prec)             ((pq)->q[prec].len)
-#define pktq_pavail(pq, prec)           ((pq)->q[prec].max - (pq)->q[prec].len)
-#define pktq_pfull(pq, prec)            ((pq)->q[prec].len >= (pq)->q[prec].max)
-#define pktq_pempty(pq, prec)           ((pq)->q[prec].len == 0)
+#define pktq_psetmax(pq, prec, _max)	((pq)->q[prec].max = (_max))
+#define pktq_pmax(pq, prec)		((pq)->q[prec].max)
+#define pktq_plen(pq, prec)		((pq)->q[prec].len)
+#define pktq_pavail(pq, prec)		((pq)->q[prec].max - (pq)->q[prec].len)
+#define pktq_pfull(pq, prec)		((pq)->q[prec].len >= (pq)->q[prec].max)
+#define pktq_pempty(pq, prec)		((pq)->q[prec].len == 0)
 
-#define pktq_ppeek(pq, prec)            ((pq)->q[prec].head)
-#define pktq_ppeek_tail(pq, prec)       ((pq)->q[prec].tail)
+#define pktq_ppeek(pq, prec)		((pq)->q[prec].head)
+#define pktq_ppeek_tail(pq, prec)	((pq)->q[prec].tail)
 
 extern void *pktq_penq(struct pktq *pq, int prec, void *p);
 extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
 extern void *pktq_pdeq(struct pktq *pq, int prec);
+extern void *pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p);
 extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
 
 extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir,
@@ -262,23 +294,26 @@ extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
 
 extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
 extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
+extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
 
 
 
-#define pktq_len(pq)                    ((int)(pq)->len)
-#define pktq_max(pq)                    ((int)(pq)->max)
-#define pktq_avail(pq)                  ((int)((pq)->max - (pq)->len))
-#define pktq_full(pq)                   ((pq)->len >= (pq)->max)
-#define pktq_empty(pq)                  ((pq)->len == 0)
+#define pktq_len(pq)		((int)(pq)->len)
+#define pktq_max(pq)		((int)(pq)->max)
+#define pktq_avail(pq)		((int)((pq)->max - (pq)->len))
+#define pktq_full(pq)		((pq)->len >= (pq)->max)
+#define pktq_empty(pq)		((pq)->len == 0)
 
 
-#define pktenq(pq, p)		pktq_penq(((struct pktq *)pq), 0, (p))
-#define pktenq_head(pq, p)	pktq_penq_head(((struct pktq *)pq), 0, (p))
-#define pktdeq(pq)		pktq_pdeq(((struct pktq *)pq), 0)
-#define pktdeq_tail(pq)		pktq_pdeq_tail(((struct pktq *)pq), 0)
-#define pktqinit(pq, len) pktq_init(((struct pktq *)pq), 1, len)
+#define pktenq(pq, p)		pktq_penq(((struct pktq *)(void *)pq), 0, (p))
+#define pktenq_head(pq, p)	pktq_penq_head(((struct pktq *)(void *)pq), 0, (p))
+#define pktdeq(pq)		pktq_pdeq(((struct pktq *)(void *)pq), 0)
+#define pktdeq_tail(pq)		pktq_pdeq_tail(((struct pktq *)(void *)pq), 0)
+#define pktqinit(pq, len)	pktq_init(((struct pktq *)(void *)pq), 1, len)
 
 extern void pktq_init(struct pktq *pq, int num_prec, int max_len);
+extern void pktq_set_max_plen(struct pktq *pq, int prec, int max_len);
+
 
 extern void *pktq_deq(struct pktq *pq, int *prec_out);
 extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
@@ -293,18 +328,21 @@ extern uint pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf);
 extern uint pkttotlen(osl_t *osh, void *p);
 extern void *pktlast(osl_t *osh, void *p);
 extern uint pktsegcnt(osl_t *osh, void *p);
+extern uint pktsegcnt_war(osl_t *osh, void *p);
+extern uint8 *pktoffset(osl_t *osh, void *p,  uint offset);
+
 
+#define	PKTPRIO_VDSCP	0x100		
+#define	PKTPRIO_VLAN	0x200		
+#define	PKTPRIO_UPD	0x400		
+#define	PKTPRIO_DSCP	0x800		
 
 extern uint pktsetprio(void *pkt, bool update_vtag);
-#define	PKTPRIO_VDSCP	0x100
-#define	PKTPRIO_VLAN	0x200
-#define	PKTPRIO_UPD	0x400
-#define	PKTPRIO_DSCP	0x800
 
 
-extern int bcm_atoi(char *s);
-extern ulong bcm_strtoul(char *cp, char **endp, uint base);
-extern char *bcmstrstr(char *haystack, char *needle);
+extern int bcm_atoi(const char *s);
+extern ulong bcm_strtoul(const char *cp, char **endp, uint base);
+extern char *bcmstrstr(const char *haystack, const char *needle);
 extern char *bcmstrcat(char *dest, const char *src);
 extern char *bcmstrncat(char *dest, const char *src, uint size);
 extern ulong wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen);
@@ -315,7 +353,7 @@ int bcmstrnicmp(const char* s1, const char* s2, int cnt);
 
 
 extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
-extern int bcm_ether_atoe(char *p, struct ether_addr *ea);
+extern int bcm_ether_atoe(const char *p, struct ether_addr *ea);
 
 
 struct ipv4_addr;
@@ -324,6 +362,8 @@ extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
 
 extern void bcm_mdelay(uint ms);
 
+#define NVRAM_RECLAIM_CHECK(name)
+
 extern char *getvar(char *vars, const char *name);
 extern int getintvar(char *vars, const char *name);
 extern int getintvararray(char *vars, const char *name, int index);
@@ -338,6 +378,7 @@ extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
 #define bcmtslog(tstamp, fmt, a1, a2)
 #define bcmprinttslogs()
 #define bcmprinttstamp(us)
+#define bcmdumptslog(buf, size)
 
 extern char *bcm_nvram_vars(uint *length);
 extern int bcm_nvram_cache(void *sih);
@@ -361,7 +402,7 @@ typedef struct bcm_iovar {
 
 
 #define IOV_GVAL(id)		((id)*2)
-#define IOV_SVAL(id)		(((id)*2)+IOV_SET)
+#define IOV_SVAL(id)		((id) * 2 + IOV_SET)
 #define IOV_ISSET(actionid)	((actionid & IOV_SET) == IOV_SET)
 #define IOV_ID(actionid)	(actionid >> 1)
 
@@ -526,11 +567,21 @@ extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
 #define	ISALIGNED(a, x)		(((uintptr)(a) & ((x)-1)) == 0)
 #define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
 	                                         & ~((boundary) - 1))
-#define	ISPOWEROF2(x)		((((x)-1)&(x)) == 0)
+#define ALIGN_SIZE(size, boundary) (((size) + (boundary) - 1) \
+	                                         & ~((boundary) - 1))
+#define	ISPOWEROF2(x)		((((x) - 1) & (x)) == 0)
 #define VALID_MASK(mask)	!((mask) & ((mask) + 1))
+
 #ifndef OFFSETOF
-#define	OFFSETOF(type, member)	((uint)offsetof(type, member))
-#endif
+#ifdef __ARMCC_VERSION
+
+#include <stddef.h>
+#define	OFFSETOF(type, member)	offsetof(type, member)
+#else
+#define	OFFSETOF(type, member)	((uint)(uintptr)&((type *)0)->member)
+#endif 
+#endif 
+
 #ifndef ARRAYSIZE
 #define ARRAYSIZE(a)		(sizeof(a)/sizeof(a[0]))
 #endif
@@ -586,6 +637,21 @@ extern void *_bcmutils_dummy_fn;
 #define CRC32_GOOD_VALUE 0xdebb20e3
 
 
+#define MACF				"%02x:%02x:%02x:%02x:%02x:%02x"
+#define ETHERP_TO_MACF(ea)	((struct ether_addr *) (ea))->octet[0], \
+							((struct ether_addr *) (ea))->octet[1], \
+							((struct ether_addr *) (ea))->octet[2], \
+							((struct ether_addr *) (ea))->octet[3], \
+							((struct ether_addr *) (ea))->octet[4], \
+							((struct ether_addr *) (ea))->octet[5]
+
+#define ETHER_TO_MACF(ea) 	(ea).octet[0], \
+							(ea).octet[1], \
+							(ea).octet[2], \
+							(ea).octet[3], \
+							(ea).octet[4], \
+							(ea).octet[5]
+
 typedef struct bcm_bit_desc {
 	uint32	bit;
 	const char* name;
@@ -657,19 +723,16 @@ extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
 
 
 extern const char *bcmerrorstr(int bcmerror);
+extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
 
 
 typedef uint32 mbool;
-#define mboolset(mb, bit)		((mb) |= (bit))
-#define mboolclr(mb, bit)		((mb) &= ~(bit))
-#define mboolisset(mb, bit)		(((mb) & (bit)) != 0)
+#define mboolset(mb, bit)		((mb) |= (bit))		
+#define mboolclr(mb, bit)		((mb) &= ~(bit))	
+#define mboolisset(mb, bit)		(((mb) & (bit)) != 0)	
 #define	mboolmaskset(mb, mask, val)	((mb) = (((mb) & ~(mask)) | (val)))
 
 
-extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
-extern uint8 bcm_mw_to_qdbm(uint16 mw);
-
-
 struct fielddesc {
 	const char *nameandfmt;
 	uint32 	offset;
@@ -677,21 +740,23 @@ struct fielddesc {
 };
 
 extern void bcm_binit(struct bcmstrbuf *b, char *buf, uint size);
-extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
+extern void bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, uint8 *buf, int len);
+
 extern void bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount);
-extern int bcm_cmp_bytes(uchar *arg1, uchar *arg2, uint8 nbytes);
-extern void bcm_print_bytes(char *name, const uchar *cdata, int len);
+extern int bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes);
+extern void bcm_print_bytes(const char *name, const uchar *cdata, int len);
 
 typedef  uint32 (*bcmutl_rdreg_rtn)(void *arg0, uint arg1, uint32 offset);
 extern uint bcmdumpfields(bcmutl_rdreg_rtn func_ptr, void *arg0, uint arg1, struct fielddesc *str,
                           char *buf, uint32 bufsize);
-
-extern uint bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint len);
 extern uint bcm_bitcount(uint8 *bitmap, uint bytelength);
 
+extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
 
 
-#define SSID_FMT_BUF_LEN	((4 * DOT11_MAX_SSID_LEN) + 1)
+extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
+extern uint8 bcm_mw_to_qdbm(uint16 mw);
+extern uint bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint len);
 
 unsigned int process_nvram_vars(char *varbuf, unsigned int len);
 
diff --git a/bcmdhd/dhdutil/include/bcmwifi.h b/bcmdhd/dhdutil/include/bcmwifi.h
index 4b0a237..47c67a5 100644
--- a/bcmdhd/dhdutil/include/bcmwifi.h
+++ b/bcmdhd/dhdutil/include/bcmwifi.h
@@ -14,8 +14,6 @@
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- * software in any way with any other Broadcom software provided under a license
- * other than the GPL, without Broadcom's express prior written consent.
  *
  * $Id: bcmwifi.h,v 1.29.6.3 2010-08-03 17:47:04 Exp $
  */
diff --git a/bcmdhd/dhdutil/include/bcmwifi_channels.h b/bcmdhd/dhdutil/include/bcmwifi_channels.h
new file mode 100644
index 0000000..3e46584
--- /dev/null
+++ b/bcmdhd/dhdutil/include/bcmwifi_channels.h
@@ -0,0 +1,339 @@
+/*
+ * Misc utility routines for WL and Apps
+ * This header file housing the define and function prototype use by
+ * both the wl driver, tools & Apps.
+ *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: bcmwifi_channels.h 309193 2012-01-19 00:03:57Z $
+ */
+
+#ifndef	_bcmwifi_channels_h_
+#define	_bcmwifi_channels_h_
+
+
+
+typedef uint16 chanspec_t;
+
+
+#define CH_UPPER_SB			0x01
+#define CH_LOWER_SB			0x02
+#define CH_EWA_VALID			0x04
+#define CH_80MHZ_APART			16
+#define CH_40MHZ_APART			8
+#define CH_20MHZ_APART			4
+#define CH_10MHZ_APART			2
+#define CH_5MHZ_APART			1	
+#define CH_MAX_2G_CHANNEL		14	
+#define	MAXCHANNEL		224	
+#define CHSPEC_CTLOVLP(sp1, sp2, sep)	ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < (sep)
+
+
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+#ifndef D11AC_IOTYPES
+
+#define WL_CHANSPEC_CHAN_MASK		0x00ff
+#define WL_CHANSPEC_CHAN_SHIFT		0
+
+#define WL_CHANSPEC_CTL_SB_MASK		0x0300
+#define WL_CHANSPEC_CTL_SB_SHIFT	     8
+#define WL_CHANSPEC_CTL_SB_LOWER	0x0100
+#define WL_CHANSPEC_CTL_SB_UPPER	0x0200
+#define WL_CHANSPEC_CTL_SB_NONE		0x0300
+
+#define WL_CHANSPEC_BW_MASK		0x0C00
+#define WL_CHANSPEC_BW_SHIFT		    10
+#define WL_CHANSPEC_BW_10		0x0400
+#define WL_CHANSPEC_BW_20		0x0800
+#define WL_CHANSPEC_BW_40		0x0C00
+
+#define WL_CHANSPEC_BAND_MASK		0xf000
+#define WL_CHANSPEC_BAND_SHIFT		12
+#define WL_CHANSPEC_BAND_5G		0x1000
+#define WL_CHANSPEC_BAND_2G		0x2000
+#define INVCHANSPEC			255
+
+
+#define LOWER_20_SB(channel)	(((channel) > CH_10MHZ_APART) ? ((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)	(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+				((channel) + CH_10MHZ_APART) : 0)
+#define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#define CH20MHZ_CHSPEC(channel)	(chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+				WL_CHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
+				WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define NEXT_20MHZ_CHAN(channel)	(((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+					((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+					((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
+					WL_CHANSPEC_BAND_5G))
+#define CHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#define CHSPEC_BAND(chspec)	((chspec) & WL_CHANSPEC_BAND_MASK)
+
+
+#define CHSPEC_CTL_SB(chspec)	((chspec) & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)	((chspec) & WL_CHANSPEC_BW_MASK)
+
+#ifdef WL11N_20MHZONLY
+
+#define CHSPEC_IS10(chspec)	0
+#define CHSPEC_IS20(chspec)	1
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	0
+#endif
+
+#else 
+
+#define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
+#define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+
+#endif 
+
+#define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_NONE(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_NONE)
+#define CHSPEC_SB_UPPER(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER)
+#define CHSPEC_SB_LOWER(chspec)	(((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER)
+#define CHSPEC_CTL_CHAN(chspec)  ((CHSPEC_SB_LOWER(chspec)) ? \
+				  (LOWER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))) : \
+				  (UPPER_20_SB(((chspec) & WL_CHANSPEC_CHAN_MASK))))
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
+
+#define CHANSPEC_STR_LEN    8
+
+#else 
+
+#define WL_CHANSPEC_CHAN_MASK		0x00ff
+#define WL_CHANSPEC_CHAN_SHIFT		0
+#define WL_CHANSPEC_CHAN1_MASK		0x000f
+#define WL_CHANSPEC_CHAN1_SHIFT		0
+#define WL_CHANSPEC_CHAN2_MASK		0x00f0
+#define WL_CHANSPEC_CHAN2_SHIFT		4
+
+#define WL_CHANSPEC_CTL_SB_MASK		0x0700
+#define WL_CHANSPEC_CTL_SB_SHIFT	8
+#define WL_CHANSPEC_CTL_SB_LLL		0x0000
+#define WL_CHANSPEC_CTL_SB_LLU		0x0100
+#define WL_CHANSPEC_CTL_SB_LUL		0x0200
+#define WL_CHANSPEC_CTL_SB_LUU		0x0300
+#define WL_CHANSPEC_CTL_SB_ULL		0x0400
+#define WL_CHANSPEC_CTL_SB_ULU		0x0500
+#define WL_CHANSPEC_CTL_SB_UUL		0x0600
+#define WL_CHANSPEC_CTL_SB_UUU		0x0700
+#define WL_CHANSPEC_CTL_SB_LL		WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_LU		WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_UL		WL_CHANSPEC_CTL_SB_LUL
+#define WL_CHANSPEC_CTL_SB_UU		WL_CHANSPEC_CTL_SB_LUU
+#define WL_CHANSPEC_CTL_SB_L		WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_U		WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_LOWER 	WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_UPPER	WL_CHANSPEC_CTL_SB_LLU
+
+#define WL_CHANSPEC_BW_MASK		0x3800
+#define WL_CHANSPEC_BW_SHIFT		11
+#define WL_CHANSPEC_BW_5		0x0000
+#define WL_CHANSPEC_BW_10		0x0800
+#define WL_CHANSPEC_BW_20		0x1000
+#define WL_CHANSPEC_BW_40		0x1800
+#define WL_CHANSPEC_BW_80		0x2000
+#define WL_CHANSPEC_BW_160		0x2800
+#define WL_CHANSPEC_BW_8080		0x3000
+
+#define WL_CHANSPEC_BAND_MASK		0xc000
+#define WL_CHANSPEC_BAND_SHIFT		14
+#define WL_CHANSPEC_BAND_2G		0x0000
+#define WL_CHANSPEC_BAND_3G		0x4000
+#define WL_CHANSPEC_BAND_4G		0x8000
+#define WL_CHANSPEC_BAND_5G		0xc000
+#define INVCHANSPEC			255
+
+
+#define LOWER_20_SB(channel)		(((channel) > CH_10MHZ_APART) ? \
+					((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)		(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+					((channel) + CH_10MHZ_APART) : 0)
+#define LOWER_40_SB(channel)		((channel) - CH_20MHZ_APART)
+#define UPPER_40_SB(channel)		((channel) + CH_20MHZ_APART)
+#define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#define CH20MHZ_CHSPEC(channel)		(chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+					(((channel) <= CH_MAX_2G_CHANNEL) ? \
+					WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define NEXT_20MHZ_CHAN(channel)	(((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+					((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+					((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
+					WL_CHANSPEC_BAND_5G))
+#define CH80MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | \
+					 WL_CHANSPEC_BW_80 | WL_CHANSPEC_BAND_5G)
+#define CH160MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | \
+					 WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G)
+
+
+#define CHSPEC_CHANNEL(chspec)		((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#define CHSPEC_CHAN1(chspec)		((chspec) & WL_CHANSPEC_CHAN1_MASK)
+#define CHSPEC_CHAN2(chspec)		((chspec) & WL_CHANSPEC_CHAN2_MASK)
+#define CHSPEC_BAND(chspec)		((chspec) & WL_CHANSPEC_BAND_MASK)
+#define CHSPEC_CTL_SB(chspec)		((chspec) & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)		((chspec) & WL_CHANSPEC_BW_MASK)
+
+#ifdef WL11N_20MHZONLY
+
+#define CHSPEC_IS10(chspec)	0
+#define CHSPEC_IS20(chspec)	1
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	0
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)	0
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)	0
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)	0
+#endif
+
+#else 
+
+#define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
+#define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80)
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160)
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080)
+#endif
+
+#endif 
+
+#define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_UPPER(chspec)	\
+	((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) && \
+	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC_SB_LOWER(chspec)	\
+	((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) && \
+	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
+
+
+#define CHANSPEC_STR_LEN    20
+
+
+
+#define WL_LCHANSPEC_CHAN_MASK		0x00ff
+#define WL_LCHANSPEC_CHAN_SHIFT		     0
+
+#define WL_LCHANSPEC_CTL_SB_MASK	0x0300
+#define WL_LCHANSPEC_CTL_SB_SHIFT	     8
+#define WL_LCHANSPEC_CTL_SB_LOWER	0x0100
+#define WL_LCHANSPEC_CTL_SB_UPPER	0x0200
+#define WL_LCHANSPEC_CTL_SB_NONE	0x0300
+
+#define WL_LCHANSPEC_BW_MASK		0x0C00
+#define WL_LCHANSPEC_BW_SHIFT		    10
+#define WL_LCHANSPEC_BW_10		0x0400
+#define WL_LCHANSPEC_BW_20		0x0800
+#define WL_LCHANSPEC_BW_40		0x0C00
+
+#define WL_LCHANSPEC_BAND_MASK		0xf000
+#define WL_LCHANSPEC_BAND_SHIFT		    12
+#define WL_LCHANSPEC_BAND_5G		0x1000
+#define WL_LCHANSPEC_BAND_2G		0x2000
+
+#define LCHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_LCHANSPEC_CHAN_MASK))
+#define LCHSPEC_BAND(chspec)	((chspec) & WL_LCHANSPEC_BAND_MASK)
+#define LCHSPEC_CTL_SB(chspec)	((chspec) & WL_LCHANSPEC_CTL_SB_MASK)
+#define LCHSPEC_BW(chspec)	((chspec) & WL_LCHANSPEC_BW_MASK)
+#define LCHSPEC_IS10(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_10)
+#define LCHSPEC_IS20(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_20)
+#define LCHSPEC_IS40(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40)
+#define LCHSPEC_IS5G(chspec)	(((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_5G)
+#define LCHSPEC_IS2G(chspec)	(((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_2G)
+
+#define LCHSPEC_CREATE(chan, band, bw, sb)  ((uint16)((chan) | (sb) | (bw) | (band)))
+
+#endif 
+
+
+
+
+#define WF_CHAN_FACTOR_2_4_G		4814	
+
+
+#define WF_CHAN_FACTOR_5_G		10000	
+
+
+#define WF_CHAN_FACTOR_4_G		8000	
+
+
+#define WLC_MAXRATE	108	
+#define WLC_RATE_1M	2	
+#define WLC_RATE_2M	4	
+#define WLC_RATE_5M5	11	
+#define WLC_RATE_11M	22	
+#define WLC_RATE_6M	12	
+#define WLC_RATE_9M	18	
+#define WLC_RATE_12M	24	
+#define WLC_RATE_18M	36	
+#define WLC_RATE_24M	48	
+#define WLC_RATE_36M	72	
+#define WLC_RATE_48M	96	
+#define WLC_RATE_54M	108	
+
+#define WLC_2G_25MHZ_OFFSET		5	
+
+
+extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
+
+
+extern chanspec_t wf_chspec_aton(const char *a);
+
+
+extern bool wf_chspec_malformed(chanspec_t chanspec);
+
+
+extern bool wf_chspec_valid(chanspec_t chanspec);
+
+
+extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
+
+
+extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
+
+
+extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec);
+
+
+extern int wf_mhz2channel(uint freq, uint start_factor);
+
+
+extern int wf_channel2mhz(uint channel, uint start_factor);
+
+#endif	
diff --git a/bcmdhd/dhdutil/include/bcmwifi_rates.h b/bcmdhd/dhdutil/include/bcmwifi_rates.h
new file mode 100644
index 0000000..68acfca
--- /dev/null
+++ b/bcmdhd/dhdutil/include/bcmwifi_rates.h
@@ -0,0 +1,300 @@
+/*
+ * Indices for 802.11 a/b/g/n/ac 1-3 chain symmetric transmit rates
+ *
+ * Copyright (C) 1999-2012, Broadcom Corporation
+ * 
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * $Id: bcmwifi_rates.h 252708 2011-04-12 06:45:56Z $
+ */
+
+#ifndef _bcmwifi_rates_h_
+#define _bcmwifi_rates_h_
+
+#ifdef __cplusplus
+extern "C" {
+#endif 
+
+
+#define WL_RATESET_SZ_DSSS		4
+#define WL_RATESET_SZ_OFDM		8
+#define WL_RATESET_SZ_HT_MCS	8
+#define WL_RATESET_SZ_VHT_MCS	10
+
+#define WL_TX_CHAINS_MAX	3
+
+#define WL_RATE_DISABLED		(-128) 
+
+
+typedef enum wl_tx_bw {
+	WL_TX_BW_20,
+	WL_TX_BW_40,
+	WL_TX_BW_80,
+	WL_TX_BW_20IN40,
+	WL_TX_BW_20IN80,
+	WL_TX_BW_40IN80,
+	WL_TX_BW_ALL
+} wl_tx_bw_t;
+
+
+
+typedef enum wl_tx_mode {
+	WL_TX_MODE_NONE,
+	WL_TX_MODE_STBC,
+	WL_TX_MODE_CDD,
+	WL_TX_MODE_SDM
+} wl_tx_mode_t;
+
+
+
+typedef enum wl_tx_chains {
+	WL_TX_CHAINS_1 = 1,
+	WL_TX_CHAINS_2,
+	WL_TX_CHAINS_3
+} wl_tx_chains_t;
+
+
+
+typedef enum wl_tx_nss {
+	WL_TX_NSS_1 = 1,
+	WL_TX_NSS_2,
+	WL_TX_NSS_3
+} wl_tx_nss_t;
+
+
+typedef enum clm_rates {
+	
+
+	
+	WL_RATE_1X1_DSSS_1         = 0,
+	WL_RATE_1X1_DSSS_2         = 1,
+	WL_RATE_1X1_DSSS_5_5       = 2,
+	WL_RATE_1X1_DSSS_11        = 3,
+
+	WL_RATE_1X1_OFDM_6         = 4,
+	WL_RATE_1X1_OFDM_9         = 5,
+	WL_RATE_1X1_OFDM_12        = 6,
+	WL_RATE_1X1_OFDM_18        = 7,
+	WL_RATE_1X1_OFDM_24        = 8,
+	WL_RATE_1X1_OFDM_36        = 9,
+	WL_RATE_1X1_OFDM_48        = 10,
+	WL_RATE_1X1_OFDM_54        = 11,
+
+	WL_RATE_1X1_MCS0           = 12,
+	WL_RATE_1X1_MCS1           = 13,
+	WL_RATE_1X1_MCS2           = 14,
+	WL_RATE_1X1_MCS3           = 15,
+	WL_RATE_1X1_MCS4           = 16,
+	WL_RATE_1X1_MCS5           = 17,
+	WL_RATE_1X1_MCS6           = 18,
+	WL_RATE_1X1_MCS7           = 19,
+
+	WL_RATE_1X1_VHT0SS1        = 12,
+	WL_RATE_1X1_VHT1SS1        = 13,
+	WL_RATE_1X1_VHT2SS1        = 14,
+	WL_RATE_1X1_VHT3SS1        = 15,
+	WL_RATE_1X1_VHT4SS1        = 16,
+	WL_RATE_1X1_VHT5SS1        = 17,
+	WL_RATE_1X1_VHT6SS1        = 18,
+	WL_RATE_1X1_VHT7SS1        = 19,
+	WL_RATE_1X1_VHT8SS1        = 20,
+	WL_RATE_1X1_VHT9SS1        = 21,
+
+
+	
+
+	
+	WL_RATE_1X2_DSSS_1         = 22,
+	WL_RATE_1X2_DSSS_2         = 23,
+	WL_RATE_1X2_DSSS_5_5       = 24,
+	WL_RATE_1X2_DSSS_11        = 25,
+
+	WL_RATE_1X2_CDD_OFDM_6     = 26,
+	WL_RATE_1X2_CDD_OFDM_9     = 27,
+	WL_RATE_1X2_CDD_OFDM_12    = 28,
+	WL_RATE_1X2_CDD_OFDM_18    = 29,
+	WL_RATE_1X2_CDD_OFDM_24    = 30,
+	WL_RATE_1X2_CDD_OFDM_36    = 31,
+	WL_RATE_1X2_CDD_OFDM_48    = 32,
+	WL_RATE_1X2_CDD_OFDM_54    = 33,
+
+	WL_RATE_1X2_CDD_MCS0       = 34,
+	WL_RATE_1X2_CDD_MCS1       = 35,
+	WL_RATE_1X2_CDD_MCS2       = 36,
+	WL_RATE_1X2_CDD_MCS3       = 37,
+	WL_RATE_1X2_CDD_MCS4       = 38,
+	WL_RATE_1X2_CDD_MCS5       = 39,
+	WL_RATE_1X2_CDD_MCS6       = 40,
+	WL_RATE_1X2_CDD_MCS7       = 41,
+
+	WL_RATE_1X2_VHT0SS1        = 34,
+	WL_RATE_1X2_VHT1SS1        = 35,
+	WL_RATE_1X2_VHT2SS1        = 36,
+	WL_RATE_1X2_VHT3SS1        = 37,
+	WL_RATE_1X2_VHT4SS1        = 38,
+	WL_RATE_1X2_VHT5SS1        = 39,
+	WL_RATE_1X2_VHT6SS1        = 40,
+	WL_RATE_1X2_VHT7SS1        = 41,
+	WL_RATE_1X2_VHT8SS1        = 42,
+	WL_RATE_1X2_VHT9SS1        = 43,
+
+	
+	WL_RATE_2X2_STBC_MCS0      = 44,
+	WL_RATE_2X2_STBC_MCS1      = 45,
+	WL_RATE_2X2_STBC_MCS2      = 46,
+	WL_RATE_2X2_STBC_MCS3      = 47,
+	WL_RATE_2X2_STBC_MCS4      = 48,
+	WL_RATE_2X2_STBC_MCS5      = 49,
+	WL_RATE_2X2_STBC_MCS6      = 50,
+	WL_RATE_2X2_STBC_MCS7      = 51,
+
+	WL_RATE_2X2_STBC_VHT0SS1   = 44,
+	WL_RATE_2X2_STBC_VHT1SS1   = 45,
+	WL_RATE_2X2_STBC_VHT2SS1   = 46,
+	WL_RATE_2X2_STBC_VHT3SS1   = 47,
+	WL_RATE_2X2_STBC_VHT4SS1   = 48,
+	WL_RATE_2X2_STBC_VHT5SS1   = 49,
+	WL_RATE_2X2_STBC_VHT6SS1   = 50,
+	WL_RATE_2X2_STBC_VHT7SS1   = 51,
+	WL_RATE_2X2_STBC_VHT8SS1   = 52,
+	WL_RATE_2X2_STBC_VHT9SS1   = 53,
+
+	WL_RATE_2X2_SDM_MCS8       = 54,
+	WL_RATE_2X2_SDM_MCS9       = 55,
+	WL_RATE_2X2_SDM_MCS10      = 56,
+	WL_RATE_2X2_SDM_MCS11      = 57,
+	WL_RATE_2X2_SDM_MCS12      = 58,
+	WL_RATE_2X2_SDM_MCS13      = 59,
+	WL_RATE_2X2_SDM_MCS14      = 60,
+	WL_RATE_2X2_SDM_MCS15      = 61,
+
+	WL_RATE_2X2_VHT0SS2        = 54,
+	WL_RATE_2X2_VHT1SS2        = 55,
+	WL_RATE_2X2_VHT2SS2        = 56,
+	WL_RATE_2X2_VHT3SS2        = 57,
+	WL_RATE_2X2_VHT4SS2        = 58,
+	WL_RATE_2X2_VHT5SS2        = 59,
+	WL_RATE_2X2_VHT6SS2        = 60,
+	WL_RATE_2X2_VHT7SS2        = 61,
+	WL_RATE_2X2_VHT8SS2        = 62,
+	WL_RATE_2X2_VHT9SS2        = 63,
+
+
+	
+
+	
+	WL_RATE_1X3_DSSS_1         = 64,
+	WL_RATE_1X3_DSSS_2         = 65,
+	WL_RATE_1X3_DSSS_5_5       = 66,
+	WL_RATE_1X3_DSSS_11        = 67,
+
+	WL_RATE_1X3_CDD_OFDM_6     = 68,
+	WL_RATE_1X3_CDD_OFDM_9     = 69,
+	WL_RATE_1X3_CDD_OFDM_12    = 70,
+	WL_RATE_1X3_CDD_OFDM_18    = 71,
+	WL_RATE_1X3_CDD_OFDM_24    = 72,
+	WL_RATE_1X3_CDD_OFDM_36    = 73,
+	WL_RATE_1X3_CDD_OFDM_48    = 74,
+	WL_RATE_1X3_CDD_OFDM_54    = 75,
+
+	WL_RATE_1X3_CDD_MCS0       = 76,
+	WL_RATE_1X3_CDD_MCS1       = 77,
+	WL_RATE_1X3_CDD_MCS2       = 78,
+	WL_RATE_1X3_CDD_MCS3       = 79,
+	WL_RATE_1X3_CDD_MCS4       = 80,
+	WL_RATE_1X3_CDD_MCS5       = 81,
+	WL_RATE_1X3_CDD_MCS6       = 82,
+	WL_RATE_1X3_CDD_MCS7       = 83,
+
+	WL_RATE_1X3_VHT0SS1        = 76,
+	WL_RATE_1X3_VHT1SS1        = 77,
+	WL_RATE_1X3_VHT2SS1        = 78,
+	WL_RATE_1X3_VHT3SS1        = 79,
+	WL_RATE_1X3_VHT4SS1        = 80,
+	WL_RATE_1X3_VHT5SS1        = 81,
+	WL_RATE_1X3_VHT6SS1        = 82,
+	WL_RATE_1X3_VHT7SS1        = 83,
+	WL_RATE_1X3_VHT8SS1        = 84,
+	WL_RATE_1X3_VHT9SS1        = 85,
+
+	
+	WL_RATE_2X3_STBC_MCS0      = 86,
+	WL_RATE_2X3_STBC_MCS1      = 87,
+	WL_RATE_2X3_STBC_MCS2      = 88,
+	WL_RATE_2X3_STBC_MCS3      = 89,
+	WL_RATE_2X3_STBC_MCS4      = 90,
+	WL_RATE_2X3_STBC_MCS5      = 91,
+	WL_RATE_2X3_STBC_MCS6      = 92,
+	WL_RATE_2X3_STBC_MCS7      = 93,
+
+	WL_RATE_2X3_STBC_VHT0SS1   = 86,
+	WL_RATE_2X3_STBC_VHT1SS1   = 87,
+	WL_RATE_2X3_STBC_VHT2SS1   = 88,
+	WL_RATE_2X3_STBC_VHT3SS1   = 89,
+	WL_RATE_2X3_STBC_VHT4SS1   = 90,
+	WL_RATE_2X3_STBC_VHT5SS1   = 91,
+	WL_RATE_2X3_STBC_VHT6SS1   = 92,
+	WL_RATE_2X3_STBC_VHT7SS1   = 93,
+	WL_RATE_2X3_STBC_VHT8SS1   = 94,
+	WL_RATE_2X3_STBC_VHT9SS1   = 95,
+
+	WL_RATE_2X3_SDM_MCS8       = 96,
+	WL_RATE_2X3_SDM_MCS9       = 97,
+	WL_RATE_2X3_SDM_MCS10      = 98,
+	WL_RATE_2X3_SDM_MCS11      = 99,
+	WL_RATE_2X3_SDM_MCS12      = 100,
+	WL_RATE_2X3_SDM_MCS13      = 101,
+	WL_RATE_2X3_SDM_MCS14      = 102,
+	WL_RATE_2X3_SDM_MCS15      = 103,
+
+	WL_RATE_2X3_VHT0SS2        = 96,
+	WL_RATE_2X3_VHT1SS2        = 97,
+	WL_RATE_2X3_VHT2SS2        = 98,
+	WL_RATE_2X3_VHT3SS2        = 99,
+	WL_RATE_2X3_VHT4SS2        = 100,
+	WL_RATE_2X3_VHT5SS2        = 101,
+	WL_RATE_2X3_VHT6SS2        = 102,
+	WL_RATE_2X3_VHT7SS2        = 103,
+	WL_RATE_2X3_VHT8SS2        = 104,
+	WL_RATE_2X3_VHT9SS2        = 105,
+
+	
+	WL_RATE_3X3_SDM_MCS16      = 106,
+	WL_RATE_3X3_SDM_MCS17      = 107,
+	WL_RATE_3X3_SDM_MCS18      = 108,
+	WL_RATE_3X3_SDM_MCS19      = 109,
+	WL_RATE_3X3_SDM_MCS20      = 110,
+	WL_RATE_3X3_SDM_MCS21      = 111,
+	WL_RATE_3X3_SDM_MCS22      = 112,
+	WL_RATE_3X3_SDM_MCS23      = 113,
+
+	WL_RATE_3X3_VHT0SS3        = 106,
+	WL_RATE_3X3_VHT1SS3        = 107,
+	WL_RATE_3X3_VHT2SS3        = 108,
+	WL_RATE_3X3_VHT3SS3        = 109,
+	WL_RATE_3X3_VHT4SS3        = 110,
+	WL_RATE_3X3_VHT5SS3        = 111,
+	WL_RATE_3X3_VHT6SS3        = 112,
+	WL_RATE_3X3_VHT7SS3        = 113,
+	WL_RATE_3X3_VHT8SS3        = 114,
+	WL_RATE_3X3_VHT9SS3        = 115,
+
+	
+	WL_NUMRATES                = 116
+} clm_rates_t;
+
+#ifdef __cplusplus
+}
+#endif 
+
+#endif 
diff --git a/bcmdhd/dhdutil/include/dhdioctl.h b/bcmdhd/dhdutil/include/dhdioctl.h
index 54a7f5c..25e0028 100644
--- a/bcmdhd/dhdutil/include/dhdioctl.h
+++ b/bcmdhd/dhdutil/include/dhdioctl.h
@@ -5,7 +5,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -19,7 +19,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: dhdioctl.h,v 13.11.10.1 2010-12-22 23:47:26 Exp $
+ * $Id: dhdioctl.h 350488 2012-08-14 04:36:26Z $
  */
 
 #ifndef _dhdioctl_h_
@@ -80,6 +80,10 @@ enum {
 #define DHD_EVENT_VAL	0x0800
 #define DHD_BTA_VAL	0x1000
 #define DHD_ISCAN_VAL	0x2000
+#define DHD_ARPOE_VAL	0x4000
+#define DHD_REORDER_VAL	0x8000
+#define DHD_WL_VAL		0x10000
+#define DHD_TRACE2_VAL	0x20000
 
 #ifdef SDTEST
 /* For pktgen iovar */
diff --git a/bcmdhd/dhdutil/include/epivers.h b/bcmdhd/dhdutil/include/epivers.h
index 72b2470..cec06b4 100644
--- a/bcmdhd/dhdutil/include/epivers.h
+++ b/bcmdhd/dhdutil/include/epivers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -13,31 +13,30 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: epivers.h.in,v 13.32.4.1 2010-09-17 00:39:18 Exp $
+ * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 $
  *
 */
 
-
 #ifndef _epivers_h_
 #define _epivers_h_
 
-#define	EPI_MAJOR_VERSION	5
+#define	EPI_MAJOR_VERSION	1
 
-#define	EPI_MINOR_VERSION	90
+#define	EPI_MINOR_VERSION	28
 
-#define	EPI_RC_NUMBER		125
+#define	EPI_RC_NUMBER		9
 
-#define	EPI_INCREMENTAL_NUMBER	14
+#define	EPI_INCREMENTAL_NUMBER	2
 
 #define	EPI_BUILD_NUMBER	0
 
-#define	EPI_VERSION		5, 90, 125, 14
+#define	EPI_VERSION		1, 28, 9, 2
 
-#define	EPI_VERSION_NUM		0x055a7d0e
+#define	EPI_VERSION_NUM		0x011c0902
 
-#define EPI_VERSION_DEV		5.90.125
+#define EPI_VERSION_DEV		1.28.9
 
 
-#define	EPI_VERSION_STR		"5.90.125.14"
+#define	EPI_VERSION_STR		"1.28.9.2 (r351283)"
 
 #endif
diff --git a/bcmdhd/dhdutil/include/packed_section_start.h b/bcmdhd/dhdutil/include/packed_section_start.h
index 6196aae..c6a7053 100644
--- a/bcmdhd/dhdutil/include/packed_section_start.h
+++ b/bcmdhd/dhdutil/include/packed_section_start.h
@@ -15,7 +15,7 @@
  * #include <packed_section_end.h>
  *
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -29,12 +29,11 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: packed_section_start.h,v 1.4.124.1 2010-09-17 00:47:03 Exp $
+ * $Id: packed_section_start.h 286783 2011-09-29 06:18:57Z $
  */
 
 
 
-
 #ifdef BWL_PACKED_SECTION
 	#error "BWL_PACKED_SECTION is already defined!"
 #else
@@ -45,7 +44,7 @@
 
 
 
-#if defined(__GNUC__)
+#if defined(__GNUC__) || defined(__lint)
 	#define	BWL_PRE_PACKED_STRUCT
 	#define	BWL_POST_PACKED_STRUCT	__attribute__ ((packed))
 #elif defined(__CC_ARM)
diff --git a/bcmdhd/dhdutil/include/proto/802.11.h b/bcmdhd/dhdutil/include/proto/802.11.h
index c74fe5f..e55d1e1 100644
--- a/bcmdhd/dhdutil/include/proto/802.11.h
+++ b/bcmdhd/dhdutil/include/proto/802.11.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  *
  * Fundamental types and constants relating to 802.11
  *
- * $Id: 802.11.h,v 9.260.2.6 2010-12-15 21:41:14 Exp $
+ * $Id: 802.11.h 346820 2012-07-24 13:53:12Z $
  */
 
 
@@ -283,6 +283,12 @@ BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
 	uint8   control;
 } BWL_POST_PACKED_STRUCT;
 
+BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
+	uint8	category;
+	uint8	action;
+	uint16	id;
+} BWL_POST_PACKED_STRUCT;
+
 #define SM_PWRSAVE_ENABLE   1
 #define SM_PWRSAVE_MODE     2
 
@@ -423,10 +429,31 @@ typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
 BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
 	uint8 id;
 	uint8 len;
-	uint8 cap;
+	uint8 cap[1];
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_extcap_ie dot11_extcap_ie_t;
-#define DOT11_EXTCAP_LEN    1
+
+#define DOT11_EXTCAP_LEN_MAX	7
+#define DOT11_EXTCAP_LEN_COEX	1
+#define DOT11_EXTCAP_LEN_BT	3
+#define DOT11_EXTCAP_LEN_IW	4
+#define DOT11_EXTCAP_LEN_SI	6
+
+#define DOT11_EXTCAP_LEN_TDLS	5
+BWL_PRE_PACKED_STRUCT struct dot11_extcap {
+	uint8 extcap[DOT11_EXTCAP_LEN_TDLS];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap dot11_extcap_t;
+
+
+#define TDLS_CAP_TDLS			37		
+#define TDLS_CAP_PU_BUFFER_STA	28		
+#define TDLS_CAP_PEER_PSM		20		
+#define TDLS_CAP_CH_SW			30		
+#define TDLS_CAP_PROH			38		
+#define TDLS_CAP_CH_SW_PROH		39		
+
+#define TDLS_CAP_MAX_BIT		39		
 
 
 
@@ -534,11 +561,11 @@ typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
 #define WME_OUI         "\x00\x50\xf2"
 #define WME_OUI_LEN     3
 #define WME_OUI_TYPE        2
-#define WME_VER         1
 #define WME_TYPE        2
 #define WME_SUBTYPE_IE      0
 #define WME_SUBTYPE_PARAM_IE    1
 #define WME_SUBTYPE_TSPEC   2
+#define WME_VER			1	
 
 
 #define AC_BE           0
@@ -682,6 +709,7 @@ BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
 	uint16 aac;
 } BWL_POST_PACKED_STRUCT;
 typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
+#define BSS_LOAD_IE_SIZE 	7	
 
 
 #define FIXED_MSDU_SIZE 0x8000
@@ -703,6 +731,14 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 #define DOT11_MGMT_NOTIFICATION_LEN 4
 
 
+BWL_PRE_PACKED_STRUCT struct ti_ie {
+	uint8 ti_type;
+	uint32 ti_val;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ti_ie ti_ie_t;
+#define TI_TYPE_REASSOC_DEADLINE	1
+#define TI_TYPE_KEY_LIFETIME		2
+
 #define WME_ADDTS_REQUEST   0
 #define WME_ADDTS_RESPONSE  1
 #define WME_DELTS_REQUEST   2
@@ -718,9 +754,8 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 
 #define DOT11_OPEN_SYSTEM   0
 #define DOT11_SHARED_KEY    1
-#define DOT11_OPEN_SHARED   2
-#define DOT11_FAST_BSS      3
-#define DOT11_CHALLENGE_LEN 128
+#define DOT11_FAST_BSS		2	
+#define DOT11_CHALLENGE_LEN	128	
 
 
 #define FC_PVER_MASK        0x3
@@ -920,9 +955,18 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 
 #define DOT11_RC_MAX            23
 
+#define DOT11_RC_TDLS_PEER_UNREACH	25
+#define DOT11_RC_TDLS_DOWN_UNSPECIFIED	26
+
 
-#define DOT11_SC_SUCCESS        0
-#define DOT11_SC_FAILURE        1
+#define DOT11_SC_SUCCESS		0	
+#define DOT11_SC_FAILURE		1	
+#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2	
+					
+#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3	
+#define DOT11_SC_TDLS_SEC_DISABLED	5	
+#define DOT11_SC_LIFETIME_REJ		6	
+#define DOT11_SC_NOT_SAME_BSS		7	
 #define DOT11_SC_CAP_MISMATCH       10
 #define DOT11_SC_REASSOC_FAIL       11
 #define DOT11_SC_ASSOC_FAIL     12
@@ -941,12 +985,23 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 #define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED   25
 #define DOT11_SC_ASSOC_ERPBCC_REQUIRED  26
 #define DOT11_SC_ASSOC_DSSOFDM_REQUIRED 27
+#define DOT11_SC_ASSOC_R0KH_UNREACHABLE	28	
+#define DOT11_SC_ASSOC_TRY_LATER	30	
+#define DOT11_SC_ASSOC_MFP_VIOLATION	31	
+
+#define	DOT11_SC_DECLINED		37	
+#define	DOT11_SC_INVALID_PARAMS		38	
+#define DOT11_SC_INVALID_PAIRWISE_CIPHER	42 
+#define	DOT11_SC_INVALID_AKMP		43	
+#define DOT11_SC_INVALID_RSNIE_CAP	45	
+#define DOT11_SC_DLS_NOT_ALLOWED	48	
+#define	DOT11_SC_INVALID_PMKID		53	
+#define	DOT11_SC_INVALID_MDID		54	
+#define	DOT11_SC_INVALID_FTIE		55	
 
-#define DOT11_SC_DECLINED       37
-#define DOT11_SC_INVALID_PARAMS     38
-#define DOT11_SC_INVALID_AKMP       43
-#define DOT11_SC_INVALID_MDID       54
-#define DOT11_SC_INVALID_FTIE       55
+#define DOT11_SC_UNEXP_MSG			70	
+#define DOT11_SC_INVALID_SNONCE		71	
+#define DOT11_SC_INVALID_RSNIE		72	
 
 
 #define DOT11_MNG_DS_PARAM_LEN          1
@@ -1006,13 +1061,28 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 #define DOT11_MNG_EXT_CSA_ID            60
 #define DOT11_MNG_HT_ADD            61
 #define DOT11_MNG_EXT_CHANNEL_OFFSET        62
-
-
-#define DOT11_MNG_RRM_CAP_ID        70
-#define DOT11_MNG_HT_BSS_COEXINFO_ID        72
-#define DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID  73
-#define DOT11_MNG_HT_OBSS_ID            74
-#define DOT11_MNG_EXT_CAP           127
+#define DOT11_MNG_WAPI_ID			68	
+#define DOT11_MNG_TIME_ADVERTISE_ID	69	
+#define DOT11_MNG_RRM_CAP_ID		70	
+#define	DOT11_MNG_HT_BSS_COEXINFO_ID		72	
+#define	DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID	73	
+#define	DOT11_MNG_HT_OBSS_ID			74	
+#define DOT11_MNG_CHANNEL_USAGE			97 
+#define DOT11_MNG_TIME_ZONE_ID			98	
+#define DOT11_MNG_LINK_IDENTIFIER_ID	101	
+#define DOT11_MNG_WAKEUP_SCHEDULE_ID	102 
+#define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID	104 
+#define DOT11_MNG_PTI_CONTROL_ID		105	
+#define DOT11_MNG_PU_BUFFER_STATUS_ID	106	
+#define DOT11_MNG_INTERWORKING_ID		107	
+#define DOT11_MNG_ADVERTISEMENT_ID		108	
+#define DOT11_MNG_EXP_BW_REQ_ID			109	
+#define DOT11_MNG_QOS_MAP_ID			110	
+#define DOT11_MNG_ROAM_CONSORT_ID		111	
+#define DOT11_MNG_EMERGCY_ALERT_ID		112	
+#define	DOT11_MNG_EXT_CAP_ID		127	
+#define	DOT11_MNG_VHT_CAP_ID		191	
+#define	DOT11_MNG_VHT_OPERATION_ID	192	
 #define DOT11_MNG_WPA_ID            221
 #define DOT11_MNG_PROPR_ID          221
 
@@ -1046,7 +1116,16 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 #define DOT11_CAP_CCK_OFDM          0x2000
 
 
-#define DOT11_OBSS_COEX_MNG_SUPPORT 0x01
+#define DOT11_EXT_CAP_OBSS_COEX_MGMT		0
+
+#define DOT11_EXT_CAP_SPSMP					6
+
+#define DOT11_EXT_CAP_BSS_TRANSITION_MGMT	19
+
+#define DOT11_EXT_CAP_IW						31
+
+#define DOT11_EXT_CAP_SI						41
+#define DOT11_EXT_CAP_SI_MASK					0x0E
 
 
 #define DOT11_ACTION_HDR_LEN        2
@@ -1064,8 +1143,11 @@ BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
 #define DOT11_ACTION_CAT_RRM        5
 #define DOT11_ACTION_CAT_FBT    6
 #define DOT11_ACTION_CAT_HT     7
-#define DOT11_ACTION_CAT_BSSMGMT    10
-#define DOT11_ACTION_NOTIFICATION   17
+#define	DOT11_ACTION_CAT_SA_QUERY	8	
+#define	DOT11_ACTION_CAT_PDPA		9	
+#define DOT11_ACTION_CAT_BSSMGMT	10	
+#define DOT11_ACTION_NOTIFICATION	17
+#define DOT11_ACTION_CAT_VSP		126	
 #define DOT11_ACTION_CAT_VS     127
 
 
diff --git a/bcmdhd/dhdutil/include/proto/bcmevent.h b/bcmdhd/dhdutil/include/proto/bcmevent.h
index 966daa0..6fecc0f 100644
--- a/bcmdhd/dhdutil/include/proto/bcmevent.h
+++ b/bcmdhd/dhdutil/include/proto/bcmevent.h
@@ -1,7 +1,7 @@
 /*
  * Broadcom Event  protocol definitions
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
  *
  * Dependencies: proto/bcmeth.h
  *
- * $Id: bcmevent.h,v 9.64.2.9 2011-02-01 06:24:21 Exp $
+ * $Id: bcmevent.h 326276 2012-04-06 23:16:42Z $
  *
  */
 
@@ -138,11 +138,11 @@ typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
 #define WLC_E_UNICAST_DECODE_ERROR 50
 #define WLC_E_MULTICAST_DECODE_ERROR 51
 #define WLC_E_TRACE		52
-#define WLC_E_BTA_HCI_EVENT	53
-#define WLC_E_IF		54
-#ifdef WLP2P
-#define WLC_E_P2P_DISC_LISTEN_COMPLETE 	55
+#ifdef WLBTAMP
+#define WLC_E_BTA_HCI_EVENT	53	
 #endif
+#define WLC_E_IF		54	
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE	55	
 #define WLC_E_RSSI		56
 #define WLC_E_PFN_SCAN_COMPLETE	57
 #define WLC_E_EXTLOG_MSG	58
@@ -158,10 +158,8 @@ typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
 #define WLC_E_WAI_MSG 		68
 #define WLC_E_ESCAN_RESULT 	69
 #define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE 	70
-#if defined(WLP2P)
 #define WLC_E_PROBRESP_MSG	71
 #define WLC_E_P2P_PROBREQ_MSG	72
-#endif
 #define WLC_E_DCS_REQUEST 73
 
 #define WLC_E_FIFO_CREDIT_MAP	74
@@ -175,7 +173,18 @@ typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
 #define WLC_E_EXCESS_PM_WAKE_EVENT	81
 #define WLC_E_PFN_SCAN_NONE		82
 #define WLC_E_PFN_SCAN_ALLGONE	83
-#define WLC_E_LAST		84
+#define WLC_E_GTK_PLUMBED 		84
+#define WLC_E_ASSOC_IND_NDIS		85	
+#define WLC_E_REASSOC_IND_NDIS		86	
+#define WLC_E_ASSOC_REQ_IE 		87
+#define WLC_E_ASSOC_RESP_IE 		88
+#define WLC_E_ASSOC_RECREATED	89	
+#define WLC_E_ACTION_FRAME_RX_NDIS	90	
+#define WLC_E_AUTH_REQ		91	
+#define WLC_E_TDLS_PEER_EVENT 	92	
+#define WLC_E_SPEEDY_RECREATE_FAIL	93	
+#define WLC_E_LAST			94	
+
 
 
 typedef struct {
@@ -220,6 +229,8 @@ extern const int		bcmevent_names_size;
 #define WLC_E_REASON_BETTER_AP		8
 
 
+#define WLC_E_REASON_REQUESTED_ROAM 11	
+
 #define WLC_E_PRUNE_ENCR_MISMATCH	1
 #define WLC_E_PRUNE_BCAST_BSSID		2
 #define WLC_E_PRUNE_MAC_DENY		3
@@ -286,19 +297,25 @@ typedef struct wl_event_data_if {
 #define WLC_E_IF_ROLE_WDS		2
 #define WLC_E_IF_ROLE_P2P_GO		3
 #define WLC_E_IF_ROLE_P2P_CLIENT	4
-#define WLC_E_IF_ROLE_BTA_CREATOR	5
-#define WLC_E_IF_ROLE_BTA_ACCEPTOR	6
+#ifdef WLBTAMP
+#define WLC_E_IF_ROLE_BTA_CREATOR	5	
+#define WLC_E_IF_ROLE_BTA_ACCEPTOR	6	
+#endif
+
 
+#define WLC_E_LINK_BCN_LOSS	1	
+#define WLC_E_LINK_DISASSOC	2	
+#define WLC_E_LINK_ASSOC_REC	3	
+#define WLC_E_LINK_BSSCFG_DIS	4	
 
-#define WLC_E_LINK_BCN_LOSS	1
-#define WLC_E_LINK_DISASSOC	2
-#define WLC_E_LINK_ASSOC_REC	3
-#define WLC_E_LINK_BSSCFG_DIS	4
 
+#define WLC_E_OVL_DOWNLOAD		0	
+#define WLC_E_OVL_UPDATE_IND	1	
 
-#define WLC_E_OVL_DOWNLOAD	0
-#define WLC_E_OVL_UPDATE_IND	1
 
+#define WLC_E_TDLS_PEER_DISCOVERED		0	
+#define WLC_E_TDLS_PEER_CONNECTED		1
+#define WLC_E_TDLS_PEER_DISCONNECTED	2
 
 #include <packed_section_end.h>
 
diff --git a/bcmdhd/dhdutil/include/proto/bcmip.h b/bcmdhd/dhdutil/include/proto/bcmip.h
index af4e8cb..8b58da1 100644
--- a/bcmdhd/dhdutil/include/proto/bcmip.h
+++ b/bcmdhd/dhdutil/include/proto/bcmip.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  *
  * Fundamental constants relating to IP Protocol
  *
- * $Id: bcmip.h,v 9.19 2009-11-10 20:08:33 Exp $
+ * $Id: bcmip.h 290206 2011-10-17 19:13:51Z $
  */
 
 
@@ -41,8 +41,10 @@
 	((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
 
 #define IP_PROT_ICMP		0x1
-#define IP_PROT_TCP		0x6
-#define IP_PROT_UDP		0x11
+#define IP_PROT_IGMP		0x2	
+#define IP_PROT_TCP		0x6	
+#define IP_PROT_UDP		0x11	
+#define IP_PROT_ICMP6		0x3a	
 
 
 #define IPV4_VER_HL_OFFSET	0
diff --git a/bcmdhd/dhdutil/include/proto/ethernet.h b/bcmdhd/dhdutil/include/proto/ethernet.h
index d18231f..8480bca 100644
--- a/bcmdhd/dhdutil/include/proto/ethernet.h
+++ b/bcmdhd/dhdutil/include/proto/ethernet.h
@@ -1,7 +1,7 @@
 /*
  * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: ethernet.h,v 9.56 2009-10-15 22:54:58 Exp $
+ * $Id: ethernet.h 309193 2012-01-19 00:03:57Z $
  */
 
 
@@ -59,15 +59,17 @@
 #define	ETHER_TYPE_IP		0x0800
 #define ETHER_TYPE_ARP		0x0806
 #define ETHER_TYPE_8021Q	0x8100
-#define	ETHER_TYPE_BRCM		0x886c
-#define	ETHER_TYPE_802_1X	0x888e
-#define	ETHER_TYPE_802_1X_PREAUTH 0x88c7
-#define ETHER_TYPE_WAI		0x88b4
+#define	ETHER_TYPE_IPV6		0x86dd		
+#define	ETHER_TYPE_BRCM		0x886c		
+#define	ETHER_TYPE_802_1X	0x888e		
+#define	ETHER_TYPE_802_1X_PREAUTH 0x88c7	
+#define ETHER_TYPE_WAI		0x88b4		
+#define ETHER_TYPE_89_0D	0x890d		
 
+#define ETHER_TYPE_IPV6		0x86dd		
 
 
-#define	ETHER_BRCM_SUBTYPE_LEN	4
-#define	ETHER_BRCM_CRAM		1
+#define	ETHER_BRCM_SUBTYPE_LEN	4	
 
 
 #define ETHER_DEST_OFFSET	(0 * ETHER_ADDR_LEN)
@@ -104,7 +106,7 @@ BWL_PRE_PACKED_STRUCT struct	ether_addr {
 
 #define ETHER_SET_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
 #define ETHER_IS_LOCALADDR(ea) 	(((uint8 *)(ea))[0] & 2)
-#define ETHER_CLR_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xd))
+#define ETHER_CLR_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xfd))
 #define ETHER_TOGGLE_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
 
 
@@ -115,15 +117,15 @@ BWL_PRE_PACKED_STRUCT struct	ether_addr {
 
 
 
-#define	ether_cmp(a, b)	(!(((short*)a)[0] == ((short*)b)[0]) | \
-			 !(((short*)a)[1] == ((short*)b)[1]) | \
-			 !(((short*)a)[2] == ((short*)b)[2]))
+#define	ether_cmp(a, b)	(!(((short*)(a))[0] == ((short*)(b))[0]) | \
+			 !(((short*)(a))[1] == ((short*)(b))[1]) | \
+			 !(((short*)(a))[2] == ((short*)(b))[2]))
 
 
 #define	ether_copy(s, d) { \
-		((short*)d)[0] = ((short*)s)[0]; \
-		((short*)d)[1] = ((short*)s)[1]; \
-		((short*)d)[2] = ((short*)s)[2]; }
+		((short*)(d))[0] = ((const short*)(s))[0]; \
+		((short*)(d))[1] = ((const short*)(s))[1]; \
+		((short*)(d))[2] = ((const short*)(s))[2]; }
 
 
 static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
diff --git a/bcmdhd/dhdutil/include/proto/wpa.h b/bcmdhd/dhdutil/include/proto/wpa.h
index 99a246f..32dff96 100644
--- a/bcmdhd/dhdutil/include/proto/wpa.h
+++ b/bcmdhd/dhdutil/include/proto/wpa.h
@@ -1,7 +1,7 @@
 /*
  * Fundamental types and constants relating to WPA
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: wpa.h,v 1.19 2009-07-13 08:29:58 Exp $
+ * $Id: wpa.h 261155 2011-05-23 23:51:32Z $
  */
 
 
@@ -108,14 +108,23 @@ typedef BWL_PRE_PACKED_STRUCT struct
 #define WPA_CIPHER_AES_OCB	3
 #define WPA_CIPHER_AES_CCM	4
 #define WPA_CIPHER_WEP_104	5
+#define WPA_CIPHER_BIP		6	
+#define WPA_CIPHER_TPK		7	
 
+#ifdef BCMWAPI_WAI
+#define WAPI_CIPHER_NONE	WPA_CIPHER_NONE
+#define WAPI_CIPHER_SMS4	11
+
+#define WAPI_CSE_WPI_SMS4	1
+#endif 
 
 #define IS_WPA_CIPHER(cipher)	((cipher) == WPA_CIPHER_NONE || \
 				 (cipher) == WPA_CIPHER_WEP_40 || \
 				 (cipher) == WPA_CIPHER_WEP_104 || \
 				 (cipher) == WPA_CIPHER_TKIP || \
 				 (cipher) == WPA_CIPHER_AES_OCB || \
-				 (cipher) == WPA_CIPHER_AES_CCM)
+				 (cipher) == WPA_CIPHER_AES_CCM || \
+				 (cipher) == WPA_CIPHER_TPK)
 
 
 #define WPA_TKIP_CM_DETECT	60
diff --git a/bcmdhd/dhdutil/include/trxhdr.h b/bcmdhd/dhdutil/include/trxhdr.h
index bad2e71..a1e29fb 100644
--- a/bcmdhd/dhdutil/include/trxhdr.h
+++ b/bcmdhd/dhdutil/include/trxhdr.h
@@ -1,7 +1,7 @@
 /*
  * TRX image file header format.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,11 +15,11 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: trxhdr.h,v 13.15.108.2 2010-11-15 17:57:30 Exp $
+ * $Id: trxhdr.h 260898 2011-05-20 23:11:12Z $
  */
 
-#ifndef	_TRX_HDR_H_
-#define	_TRX_HDR_H_
+#ifndef _TRX_HDR_H
+#define _TRX_HDR_H
 
 #include <typedefs.h>
 
@@ -28,9 +28,10 @@
 #define TRX_MAX_LEN	0x3B0000	/* Max length */
 #define TRX_NO_HEADER	1		/* Do not write TRX header */
 #define TRX_GZ_FILES	0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
-#define TRX_OVERLAYS	0x4     /* Contains an overlay header after the trx header */
-#define TRX_MAX_OFFSET	3		/* Max number of individual files */
+#define TRX_EMBED_UCODE	0x8	/* Trx contains embedded ucode image */
+#define TRX_ROMSIM_IMAGE	0x10	/* Trx contains ROM simulation image */
 #define TRX_UNCOMP_IMAGE	0x20	/* Trx contains uncompressed rtecdc.bin image */
+#define TRX_MAX_OFFSET	3		/* Max number of individual files */
 
 struct trx_header {
 	uint32 magic;		/* "HDR0" */
@@ -43,4 +44,4 @@ struct trx_header {
 /* Compatibility */
 typedef struct trx_header TRXHDR, *PTRXHDR;
 
-#endif /* _TRX_HDR_H_ */
+#endif /* _TRX_HDR_H */
diff --git a/bcmdhd/dhdutil/include/typedefs.h b/bcmdhd/dhdutil/include/typedefs.h
index 027f982..e63133f 100644
--- a/bcmdhd/dhdutil/include/typedefs.h
+++ b/bcmdhd/dhdutil/include/typedefs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: typedefs.h,v 1.103.2.1 2010-05-11 18:19:28 Exp $
+ * $Id: typedefs.h 286783 2011-09-29 06:18:57Z $
  */
 
 
@@ -255,7 +255,7 @@ typedef float64 float_t;
 
 
 
-#if defined(__GNUC__)
+#if defined(__GNUC__) || defined(__lint)
 	#define BWL_COMPILER_GNU
 #elif defined(__CC_ARM) && __CC_ARM
 	#define BWL_COMPILER_ARMCC
@@ -300,5 +300,7 @@ typedef float64 float_t;
 #define UNUSED_PARAMETER(x) (void)(x)
 
 
+#define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
+
 #include <bcmdefs.h>
 #endif
diff --git a/bcmdhd/dhdutil/include/wlioctl.h b/bcmdhd/dhdutil/include/wlioctl.h
index 2e2d4d8..d9ebc5e 100644
--- a/bcmdhd/dhdutil/include/wlioctl.h
+++ b/bcmdhd/dhdutil/include/wlioctl.h
@@ -4,7 +4,7 @@
  *
  * Definitions subject to change without notice.
  *
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -18,7 +18,7 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: wlioctl.h,v 1.767.2.38 2011-02-01 23:04:28 Exp $
+ * $Id: wlioctl.h 334796 2012-05-23 22:59:44Z $
  */
 
 
@@ -30,7 +30,8 @@
 #include <proto/bcmeth.h>
 #include <proto/bcmevent.h>
 #include <proto/802.11.h>
-#include <bcmwifi.h>
+#include <bcmwifi_channels.h>
+#include <bcmwifi_rates.h>
 
 #include <bcmcdc.h>
 
@@ -57,6 +58,12 @@ typedef struct wl_action_frame {
 
 #define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
 
+typedef struct ssid_info
+{
+	uint8		ssid_len;	/* the length of SSID */
+	uint8		ssid[32];	/* SSID string */
+} ssid_info_t;
+
 typedef struct wl_af_params {
 	uint32          channel;
 	int32           dwell_time;
@@ -66,13 +73,49 @@ typedef struct wl_af_params {
 
 #define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
 
+#define MFP_TEST_FLAG_NORMAL	0
+#define MFP_TEST_FLAG_ANY_KEY	1
+typedef struct wl_sa_query {
+	uint32			flag;
+	uint8 			action;
+	uint16 			id;
+	struct ether_addr 	da;
+} wl_sa_query_t;
 
 #define BWL_DEFAULT_PACKING
 #include <packed_section_start.h>
 
 
+/* Legacy structure to help keep backward compatible wl tool and tray app */
+
+#define	LEGACY_WL_BSS_INFO_VERSION	107	/* older version of wl_bss_info struct */
 
+typedef struct wl_bss_info_107 {
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
+	struct ether_addr BSSID;
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	uint8		channel;		/* Channel no. */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
+	uint32		ie_length;		/* byte length of Information Elements */
+	/* variable length Information Elements */
+} wl_bss_info_107_t;
 
+/*
+ * Per-BSS information structure.
+ */
 
 #define LEGACY2_WL_BSS_INFO_VERSION 108
 
@@ -133,18 +176,28 @@ typedef struct wl_bss_info {
 	uint8       n_cap;
 	uint32      nbss_cap;
 	uint8       ctl_ch;
-	uint32      reserved32[1];
-	uint8       flags;
-	uint8       reserved[3];
-	uint8       basic_mcs[MCSSET_LEN];
-
-	uint16      ie_offset;
-	uint32      ie_length;
-	int16       SNR;
-
-
+	uint8		padding1[3];		/* explicit struct alignment padding */
+	uint16		vht_rxmcsmap;		/* VHT rx mcs map */
+	uint16		vht_txmcsmap;		/* VHT tx mcs map */
+	uint8		flags;			/* flags */
+	uint8		vht_cap;		/* BSS is vht capable */
+	uint8		reserved[2];		/* Reserved for expansion of BSS properties */
+	uint8		basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
+
+	uint16		ie_offset;		/* offset at which IEs start, from beginning */
+	uint32		ie_length;		/* byte length of Information Elements */
+	int16		SNR;			/* average SNR of during frame reception */
+	/* Add new fields here */
+	/* variable length Information Elements */
 } wl_bss_info_t;
 
+/* bss_info_cap_t flags */
+#define WL_BSS_FLAGS_FROM_BEACON	0x01	/* bss_info derived from beacon */
+#define WL_BSS_FLAGS_FROM_CACHE		0x02	/* bss_info collected from cache */
+#define WL_BSS_FLAGS_RSSI_ONCHANNEL 0x04 /* rssi info was received on channel (vs offchannel) */
+
+/* bssinfo flag for nbss_cap */
+#define VHT_BI_SGI_80MHZ			0x00000100
 typedef struct wl_bsscfg {
 	uint32  wsec;
 	uint32  WPA_auth;
@@ -154,6 +207,9 @@ typedef struct wl_bsscfg {
 	uint32  phytest_on;
 	struct ether_addr   prev_BSSID;
 	struct ether_addr   BSSID;
+	uint32  targetbss_wpa2_flags;
+	uint32 assoc_type;
+	uint32 assoc_state;
 } wl_bsscfg_t;
 
 typedef struct wl_bss_config {
@@ -162,6 +218,52 @@ typedef struct wl_bss_config {
 	uint32  chanspec;
 } wl_bss_config_t;
 
+#define DLOAD_HANDLER_VER			1	/* Downloader version */
+#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
+#define DLOAD_FLAG_VER_SHIFT	12	/* Downloader version shift */
+
+#define DL_CRC_NOT_INUSE 			0x0001
+
+/* generic download types & flags */
+enum {
+	DL_TYPE_UCODE = 1,
+	DL_TYPE_CLM = 2
+};
+
+/* ucode type values */
+enum {
+	UCODE_FW,
+	INIT_VALS,
+	BS_INIT_VALS
+};
+
+struct wl_dload_data {
+	uint16 flag;
+	uint16 dload_type;
+	uint32 len;
+	uint32 crc;
+	uint8  data[1];
+};
+typedef struct wl_dload_data wl_dload_data_t;
+
+struct wl_ucode_info {
+	uint32 ucode_type;
+	uint32 num_chunks;
+	uint32 chunk_len;
+	uint32 chunk_num;
+	uint8  data_chunk[1];
+};
+typedef struct wl_ucode_info wl_ucode_info_t;
+
+struct wl_clm_dload_info {
+	uint32 ds_id;
+	uint32 clm_total_len;
+	uint32 num_chunks;
+	uint32 chunk_len;
+	uint32 chunk_offset;
+	uint8  data_chunk[1];
+};
+typedef struct wl_clm_dload_info wl_clm_dload_info_t;
 
 typedef struct wlc_ssid {
 	uint32      SSID_len;
@@ -169,14 +271,57 @@ typedef struct wlc_ssid {
 } wlc_ssid_t;
 
 
+#define MAX_PREFERRED_AP_NUM     5
+typedef struct wlc_fastssidinfo {
+	uint32				SSID_channel[MAX_PREFERRED_AP_NUM];
+	wlc_ssid_t		SSID_info[MAX_PREFERRED_AP_NUM];
+} wlc_fastssidinfo_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wnm_url {
+	uint8   len;
+	uint8   data[1];
+} BWL_POST_PACKED_STRUCT wnm_url_t;
+
+typedef struct chan_scandata {
+	uint8		txpower;
+	uint8		pad;
+	chanspec_t	channel;	/* Channel num, bw, ctrl_sb and band */
+	uint32		channel_mintime;
+	uint32		channel_maxtime;
+} chan_scandata_t;
+
+typedef enum wl_scan_type {
+	EXTDSCAN_FOREGROUND_SCAN,
+	EXTDSCAN_BACKGROUND_SCAN,
+	EXTDSCAN_FORCEDBACKGROUND_SCAN
+} wl_scan_type_t;
+
+#define WLC_EXTDSCAN_MAX_SSID		5
+
+typedef struct wl_extdscan_params {
+	int8 		nprobes;		/* 0, passive, otherwise active */
+	int8    	split_scan;		/* split scan */
+	int8		band;			/* band */
+	int8		pad;
+	wlc_ssid_t 	ssid[WLC_EXTDSCAN_MAX_SSID]; /* ssid list */
+	uint32		tx_rate;		/* in 500ksec units */
+	wl_scan_type_t	scan_type;		/* enum */
+	int32 		channel_num;
+	chan_scandata_t channel_list[1];	/* list of chandata structs */
+} wl_extdscan_params_t;
+
+#define WL_EXTDSCAN_PARAMS_FIXED_SIZE 	(sizeof(wl_extdscan_params_t) - sizeof(chan_scandata_t))
+
 #define WL_BSSTYPE_INFRA 1
 #define WL_BSSTYPE_INDEP 0
 #define WL_BSSTYPE_ANY   2
 
+/* Bitmask for scan_type */
+#define WL_SCANFLAGS_PASSIVE	0x01	/* force passive scan */
+#define WL_SCANFLAGS_RESERVED	0x02	/* Reserved */
+#define WL_SCANFLAGS_PROHIBITED	0x04	/* allow scanning prohibited channels */
 
-#define WL_SCANFLAGS_PASSIVE 0x01
-#define WL_SCANFLAGS_RESERVED 0x02
-#define WL_SCANFLAGS_PROHIBITED 0x04
+#define WL_SCAN_PARAMS_SSID_MAX 	10
 
 typedef struct wl_scan_params {
 	wlc_ssid_t ssid;
@@ -286,16 +431,16 @@ typedef struct wl_probe_params {
 	struct ether_addr mac;
 } wl_probe_params_t;
 
-#define WL_NUMRATES     16
+#define WL_MAXRATES_IN_SET		16	/* max # of rates in a rateset */
 typedef struct wl_rateset {
-	uint32  count;
-	uint8   rates[WL_NUMRATES];
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_MAXRATES_IN_SET];	/* rates in 500kbps units w/hi bit set if basic */
 } wl_rateset_t;
 
 typedef struct wl_rateset_args {
-	uint32  count;
-	uint8   rates[WL_NUMRATES];
-	uint8   mcs[MCSSET_LEN];
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_MAXRATES_IN_SET];	/* rates in 500kbps units w/hi bit set if basic */
+	uint8   mcs[MCSSET_LEN];        /* supported mcs index bit map */
 } wl_rateset_args_t;
 
 
@@ -308,12 +453,13 @@ typedef struct wl_uint32_list {
 
 
 typedef struct wl_assoc_params {
-	struct ether_addr bssid;
-	uint16 bssid_cnt;
-	int32 chanspec_num;
-	chanspec_t chanspec_list[1];
+	struct ether_addr bssid;	/* 00:00:00:00:00:00: broadcast scan */
+	int32 chanspec_num;		/* 0: all available channels,
+					 * otherwise count of chanspecs in chanspec_list
+					 */
+	chanspec_t chanspec_list[1];	/* list of chanspecs */
 } wl_assoc_params_t;
-#define WL_ASSOC_PARAMS_FIXED_SIZE  (sizeof(wl_assoc_params_t) - sizeof(chanspec_t))
+#define WL_ASSOC_PARAMS_FIXED_SIZE 	OFFSETOF(wl_assoc_params_t, chanspec_list)
 
 
 typedef wl_assoc_params_t wl_reassoc_params_t;
@@ -328,9 +474,9 @@ typedef struct wl_join_params {
 	wlc_ssid_t ssid;
 	wl_assoc_params_t params;
 } wl_join_params_t;
-#define WL_JOIN_PARAMS_FIXED_SIZE   (sizeof(wl_join_params_t) - sizeof(chanspec_t))
-
 
+#define WL_JOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_join_params_t, params) + \
+					 WL_ASSOC_PARAMS_FIXED_SIZE)
 typedef struct wl_join_scan_params {
 	uint8 scan_type;
 	int32 nprobes;
@@ -345,12 +491,9 @@ typedef struct wl_extjoin_params {
 	wl_join_scan_params_t scan;
 	wl_join_assoc_params_t assoc;
 } wl_extjoin_params_t;
-#define WL_EXTJOIN_PARAMS_FIXED_SIZE    (sizeof(wl_extjoin_params_t) - sizeof(chanspec_t))
+#define WL_EXTJOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_extjoin_params_t, assoc) + \
+					 WL_JOIN_ASSOC_PARAMS_FIXED_SIZE)
 
-typedef struct {
-	uint32 num;
-	chanspec_t list[1];
-} chanspec_list_t;
 
 
 #define NRATE_MCS_INUSE 0x00000080
@@ -428,6 +571,35 @@ typedef struct {
 	cca_congest_t  secs[1];
 } cca_congest_channel_req_t;
 
+#define ITFR_MODE_DISABLE	0	/* disable feature */
+#define ITFR_MODE_MANUAL_ENABLE	1	/* enable manual detection */
+#define ITFR_MODE_AUTO_ENABLE	2	/* enable auto detection */
+
+/* interference sources */
+enum interference_source {
+	ITFR_NONE = 0,		/* interference */
+	ITFR_PHONE,		/* wireless phone */
+	ITFR_VIDEO_CAMERA,	/* wireless video camera */
+	ITFR_MICROWAVE_OVEN,	/* microwave oven */
+	ITFR_BABY_MONITOR,	/* wireless baby monitor */
+	ITFR_BLUETOOTH,		/* bluetooth */
+	ITFR_VIDEO_CAMERA_OR_BABY_MONITOR,	/* wireless camera or baby monitor */
+	ITFR_BLUETOOTH_OR_BABY_MONITOR,	/* bluetooth or baby monitor */
+	ITFR_VIDEO_CAMERA_OR_PHONE,	/* video camera or phone */
+	ITFR_UNIDENTIFIED	/* interference from unidentified source */
+};
+
+/* structure for interference source report */
+typedef struct {
+	uint32 flags;	/* flags.  bit definitions below */
+	uint32 source;	/* last detected interference source */
+	uint32 timestamp;	/* second timestamp on interferenced flag change */
+} interference_source_rep_t;
+
+/* bit definitions for flags in interference source report */
+#define ITFR_INTERFERENCED	1	/* interference detected */
+#define ITFR_HOME_CHANNEL	2	/* home channel has interference */
+#define ITFR_NOISY_ENVIRONMENT	4	/* noisy environemnt so feature stopped */
 #define WLC_CNTRY_BUF_SZ    4
 
 typedef struct wl_country {
@@ -542,10 +714,14 @@ typedef enum sup_auth_status {
 #define CRYPTO_ALGO_AES_OCB_MSDU    5
 #define CRYPTO_ALGO_AES_OCB_MPDU    6
 #define CRYPTO_ALGO_NALG        7
+#define CRYPTO_ALGO_PMK			12	/* for 802.1x supp to set PMK before 4-way */
 
 #define WSEC_GEN_MIC_ERROR  0x0001
 #define WSEC_GEN_REPLAY     0x0002
 #define WSEC_GEN_ICV_ERROR  0x0004
+#define WSEC_GEN_MFP_ACT_ERROR	0x0008
+#define WSEC_GEN_MFP_DISASSOC_ERROR	0x0010
+#define WSEC_GEN_MFP_DEAUTH_ERROR	0x0020
 
 #define WL_SOFT_KEY (1 << 0)
 #define WL_PRIMARY_KEY  (1 << 1)
@@ -593,6 +769,9 @@ typedef struct {
 #define WSEC_SWFLAG     0x0008
 #define SES_OW_ENABLED      0x0040
 
+#define WSEC_WEP_ENABLED(wsec)	((wsec) & WEP_ENABLED)
+#define WSEC_TKIP_ENABLED(wsec)	((wsec) & TKIP_ENABLED)
+#define WSEC_AES_ENABLED(wsec)	((wsec) & AES_ENABLED)
 
 #define WPA_AUTH_DISABLED   0x0000
 #define WPA_AUTH_NONE       0x0001
@@ -627,9 +806,144 @@ typedef struct _pmkid_cand_list {
 	pmkid_cand_t    pmkid_cand[1];
 } pmkid_cand_list_t;
 
+typedef struct wl_assoc_info {
+	uint32		req_len;
+	uint32		resp_len;
+	uint32		flags;
+	struct dot11_assoc_req req;
+	struct ether_addr reassoc_bssid; /* used in reassoc's */
+	struct dot11_assoc_resp resp;
+} wl_assoc_info_t;
 
+/* flags */
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01 /* assoc req was actually a reassoc */
 
+typedef struct wl_led_info {
+	uint32      index;      /* led index */
+	uint32      behavior;
+	uint8       activehi;
+} wl_led_info_t;
+
+
+/* srom read/write struct passed through ioctl */
+typedef struct {
+	uint	byteoff;	/* byte offset */
+	uint	nbytes;		/* number of bytes */
+	uint16	buf[1];
+} srom_rw_t;
+
+/* similar cis (srom or otp) struct [iovar: may not be aligned] */
+typedef struct {
+	uint32	source;		/* cis source */
+	uint32	byteoff;	/* byte offset */
+	uint32	nbytes;		/* number of bytes */
+	/* data follows here */
+} cis_rw_t;
+
+#define WLC_CIS_DEFAULT	0	/* built-in default */
+#define WLC_CIS_SROM	1	/* source is sprom */
+#define WLC_CIS_OTP	2	/* source is otp */
+
+/* R_REG and W_REG struct passed through ioctl */
+typedef struct {
+	uint32	byteoff;	/* byte offset of the field in d11regs_t */
+	uint32	val;		/* read/write value of the field */
+	uint32	size;		/* sizeof the field */
+	uint	band;		/* band (optional) */
+} rw_reg_t;
+
+/* Structure used by GET/SET_ATTEN ioctls - it controls power in b/g-band */
+/* PCL - Power Control Loop */
+/* current gain setting is replaced by user input */
+#define WL_ATTEN_APP_INPUT_PCL_OFF	0	/* turn off PCL, apply supplied input */
+#define WL_ATTEN_PCL_ON			1	/* turn on PCL */
+/* current gain setting is maintained */
+#define WL_ATTEN_PCL_OFF		2	/* turn off PCL. */
 
+typedef struct {
+	uint16	auto_ctrl;	/* WL_ATTEN_XX */
+	uint16	bb;		/* Baseband attenuation */
+	uint16	radio;		/* Radio attenuation */
+	uint16	txctl1;		/* Radio TX_CTL1 value */
+} atten_t;
+
+/* Per-AC retry parameters */
+struct wme_tx_params_s {
+	uint8  short_retry;
+	uint8  short_fallback;
+	uint8  long_retry;
+	uint8  long_fallback;
+	uint16 max_rate;  /* In units of 512 Kbps */
+};
+
+typedef struct wme_tx_params_s wme_tx_params_t;
+
+#define WL_WME_TX_PARAMS_IO_BYTES (sizeof(wme_tx_params_t) * AC_COUNT)
+
+/* defines used by poweridx iovar - it controls power in a-band */
+/* current gain setting is maintained */
+#define WL_PWRIDX_PCL_OFF	-2	/* turn off PCL.  */
+#define WL_PWRIDX_PCL_ON	-1	/* turn on PCL */
+#define WL_PWRIDX_LOWER_LIMIT	-2	/* lower limit */
+#define WL_PWRIDX_UPPER_LIMIT	63	/* upper limit */
+/* value >= 0 causes
+ *	- input to be set to that value
+ *	- PCL to be off
+ */
+
+/* Used to get specific link/ac parameters */
+typedef struct {
+	int ac;
+	uint8 val;
+	struct ether_addr ea;
+} link_val_t;
+
+#define BCM_MAC_STATUS_INDICATION	(0x40010200L)
+
+typedef struct {
+	uint16			ver;		/* version of this struct */
+	uint16			len;		/* length in bytes of this structure */
+	uint16			cap;		/* sta's advertised capabilities */
+	uint32			flags;		/* flags defined below */
+	uint32			idle;		/* time since data pkt rx'd from sta */
+	struct ether_addr	ea;		/* Station address */
+	wl_rateset_t		rateset;	/* rateset in use */
+	uint32			in;		/* seconds elapsed since associated */
+	uint32			listen_interval_inms; /* Min Listen interval in ms for this STA */
+	uint32			tx_pkts;	/* # of packets transmitted */
+	uint32			tx_failures;	/* # of packets failed */
+	uint32			rx_ucast_pkts;	/* # of unicast packets received */
+	uint32			rx_mcast_pkts;	/* # of multicast packets received */
+	uint32			tx_rate;	/* Rate of last successful tx frame */
+	uint32			rx_rate;	/* Rate of last successful rx frame */
+	uint32			rx_decrypt_succeeds;	/* # of packet decrypted successfully */
+	uint32			rx_decrypt_failures;	/* # of packet decrypted unsuccessfully */
+} sta_info_t;
+
+#define WL_OLD_STAINFO_SIZE	OFFSETOF(sta_info_t, tx_pkts)
+
+#define WL_STA_VER		3
+
+/* Flags for sta_info_t indicating properties of STA */
+#define WL_STA_BRCM		0x1		/* Running a Broadcom driver */
+#define WL_STA_WME		0x2		/* WMM association */
+#define WL_STA_UNUSED		0x4
+#define WL_STA_AUTHE		0x8		/* Authenticated */
+#define WL_STA_ASSOC		0x10		/* Associated */
+#define WL_STA_AUTHO		0x20		/* Authorized */
+#define WL_STA_WDS		0x40		/* Wireless Distribution System */
+#define WL_STA_WDS_LINKUP	0x80		/* WDS traffic/probes flowing properly */
+#define WL_STA_PS		0x100		/* STA is in power save mode from AP's viewpoint */
+#define WL_STA_APSD_BE		0x200		/* APSD delv/trigger for AC_BE is default enabled */
+#define WL_STA_APSD_BK		0x400		/* APSD delv/trigger for AC_BK is default enabled */
+#define WL_STA_APSD_VI		0x800		/* APSD delv/trigger for AC_VI is default enabled */
+#define WL_STA_APSD_VO		0x1000		/* APSD delv/trigger for AC_VO is default enabled */
+#define WL_STA_N_CAP		0x2000		/* STA 802.11n capable */
+#define WL_STA_SCBSTATS		0x4000		/* Per STA debug stats */
+
+#define WL_WDS_LINKUP		WL_STA_WDS_LINKUP	/* deprecated */
+
+/* Values for TX Filter override mode */
 #define WLC_TXFILTER_OVERRIDE_DISABLED  0
 #define WLC_TXFILTER_OVERRIDE_ENABLED   1
 
@@ -763,9 +1077,9 @@ typedef struct wlc_iov_trx_s {
 #define WLC_SET_MSGLEVEL            8
 #define WLC_GET_PROMISC             9
 #define WLC_SET_PROMISC             10
-#define WLC_OVERLAY_IOCTL           11
+/* #define WLC_OVERLAY_IOCTL			11 */ /* not supported */
 #define WLC_GET_RATE                12
-
+#define WLC_GET_MAX_RATE			13
 #define WLC_GET_INSTANCE            14
 
 
@@ -780,7 +1094,7 @@ typedef struct wlc_iov_trx_s {
 #define WLC_GET_SSID                25
 #define WLC_SET_SSID                26
 #define WLC_RESTART             27
-
+#define WLC_TERMINATED             		28
 #define WLC_GET_CHANNEL             29
 #define WLC_SET_CHANNEL             30
 #define WLC_GET_SRL             31
@@ -1112,6 +1426,9 @@ typedef struct wlc_iov_trx_s {
 #define OID_STA_SET_NUM_PEERS   (WL_OID_BASE + WLC_SET_NUM_PEERS)
 #define OID_STA_GET_NUM_BSS (WL_OID_BASE + WLC_GET_NUM_BSS)
 
+#define OID_NAT_SET_CONFIG	(WL_OID_BASE + WLC_SET_NAT_CONFIG)
+#define OID_NAT_GET_STATE	(WL_OID_BASE + WLC_GET_NAT_STATE)
+
 #define WL_DECRYPT_STATUS_SUCCESS   1
 #define WL_DECRYPT_STATUS_FAILURE   2
 #define WL_DECRYPT_STATUS_UNKNOWN   3
diff --git a/bcmdhd/dhdutil/miniopt.c b/bcmdhd/dhdutil/miniopt.c
index fadb8aa..ec720e0 100644
--- a/bcmdhd/dhdutil/miniopt.c
+++ b/bcmdhd/dhdutil/miniopt.c
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 1999-2011, Broadcom Corporation
+ * Description.
+ *
+ * Copyright (C) 1999-2012, Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -12,8 +14,8 @@
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * $Id: miniopt.c,v 1.8 2009-09-21 16:10:13 Exp $
+ * 
+ * $Id: miniopt.c 310902 2012-01-26 19:45:33Z $
  */
 
 /* ---- Include Files ---------------------------------------------------- */
diff --git a/bcmdhd/firmware/bcm4324/fw_bcm4324.bin b/bcmdhd/firmware/bcm4324/fw_bcm4324.bin
index 12c523d..8f25587 100644
--- a/bcmdhd/firmware/bcm4324/fw_bcm4324.bin
+++ b/bcmdhd/firmware/bcm4324/fw_bcm4324.bin
diff --git a/bcmdhd/firmware/bcm4329/fw_bcm4329.bin b/bcmdhd/firmware/bcm4329/fw_bcm4329.bin
index ba9d41f..167a1c4 100644
--- a/bcmdhd/firmware/bcm4329/fw_bcm4329.bin
+++ b/bcmdhd/firmware/bcm4329/fw_bcm4329.bin
diff --git a/bcmdhd/firmware/bcm4329/fw_bcm4329_abg.bin b/bcmdhd/firmware/bcm4329/fw_bcm4329_abg.bin
index be20bdb..f1cb13a 100644
--- a/bcmdhd/firmware/bcm4329/fw_bcm4329_abg.bin
+++ b/bcmdhd/firmware/bcm4329/fw_bcm4329_abg.bin
diff --git a/bcmdhd/firmware/bcm4329/fw_bcm4329_apsta.bin b/bcmdhd/firmware/bcm4329/fw_bcm4329_apsta.bin
index b04e4e0..d58f474 100644
--- a/bcmdhd/firmware/bcm4329/fw_bcm4329_apsta.bin
+++ b/bcmdhd/firmware/bcm4329/fw_bcm4329_apsta.bin
diff --git a/bcmdhd/firmware/bcm4330/device-bcm.mk b/bcmdhd/firmware/bcm4330/device-bcm.mk
index f036d18..cd34600 100644
--- a/bcmdhd/firmware/bcm4330/device-bcm.mk
+++ b/bcmdhd/firmware/bcm4330/device-bcm.mk
@@ -19,11 +19,11 @@
 ifeq ($(strip $(WIFI_BAND)),802_11_BG)
 BCM_FW_SRC_FILE_STA := fw_bcm4330_bg.bin
 BCM_FW_SRC_FILE_AP  := fw_bcm4330_apsta_bg.bin
-BCM_FW_SRC_FILE_P2P := fw_bcm4330_p2p_bg.bin
+BCM_FW_SRC_FILE_P2P := fw_bcm4330_bg.bin
 else
 BCM_FW_SRC_FILE_STA := fw_bcm4330_abg.bin
-BCM_FW_SRC_FILE_AP  := fw_bcm4330_apsta_abg.bin
-BCM_FW_SRC_FILE_P2P := fw_bcm4330_p2p_abg.bin
+BCM_FW_SRC_FILE_AP  := fw_bcm4330_apsta_bg.bin
+BCM_FW_SRC_FILE_P2P := fw_bcm4330_abg.bin
 endif
 
 PRODUCT_COPY_FILES += \
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_abg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_abg.bin
index df129fd..b5213f1 100644
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_abg.bin
+++ b/bcmdhd/firmware/bcm4330/fw_bcm4330_abg.bin
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_abg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_abg.bin
deleted file mode 100644
index df129fd..0000000
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_abg.bin
+++ /dev/null
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_bg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_bg.bin
index 149ca02..ca6000b 100644
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_bg.bin
+++ b/bcmdhd/firmware/bcm4330/fw_bcm4330_apsta_bg.bin
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_bg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_bg.bin
index 149ca02..d9e2f88 100644
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_bg.bin
+++ b/bcmdhd/firmware/bcm4330/fw_bcm4330_bg.bin
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_abg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_abg.bin
deleted file mode 100644
index df129fd..0000000
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_abg.bin
+++ /dev/null
diff --git a/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_bg.bin b/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_bg.bin
deleted file mode 100644
index 149ca02..0000000
--- a/bcmdhd/firmware/bcm4330/fw_bcm4330_p2p_bg.bin
+++ /dev/null
diff --git a/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c b/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c
index eafb118..f7af801 100644
--- a/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c
+++ b/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c
@@ -277,7 +277,9 @@ int wpa_driver_nl80211_driver_cmd(void *priv, char *cmd, char *buf,
 			    (os_strcasecmp(cmd, "RSSI") == 0) ||
 			    (os_strcasecmp(cmd, "GETBAND") == 0) )
 				ret = strlen(buf);
-
+			else if (os_strcasecmp(cmd, "COUNTRY") == 0)
+				wpa_supplicant_event(drv->ctx,
+					EVENT_CHANNEL_LIST_CHANGED, NULL);
 			wpa_printf(MSG_DEBUG, "%s %s len = %d, %d", __func__, buf, ret, strlen(buf));
 		}
 	}